Page MenuHomePhabricator

Consider using the /64 range for IPv6 autoblocks
Open, Needs TriagePublicFeature

Description

Feature summary: Admins usually block /64-ranges instead of single IPv6 because with IPv6 changing much more frequently than IPv4, blocking just a single IPv6 often doesn't stop disruptions -> https://en.wikipedia.org/wiki/WP:64

Autoblocks should do the same (unless it's a high-traffic range?) in order to be more effective.

Use cases / benefits: With temporary accounts rolled out admins and patrollers are less likely to detect if there's vandalism coming from a specific range unless they reveal the IP of temporary accounts all the time. And usually admins will just block the temporary account instead of loading Special:Block a second time to additionally block the /64-range for anons. Autoblocks on /64-ranges support fighting vandalism more effectively.

Event Timeline

Some (large) networks notably allocate addressing for multiple users on a single /64. This would have a negative impact on those users.

The advent of temporary accounts has brought this from being a nice quality-of-life improvement to, IMO, a necessity if the TA system is going to continue. @kostajh I hope you don't mind if I ping you per your comment at en:WP:VPT pointing to this ticket. With /64 autoblocking, I think many of the concerns being expressed in that thread would go away quietly. There would be lower donwside to situations where admins neglect to look into an underlying IP/range when blocking a TA (@ScottishFinnishRadish' concern) and, at risk of stating the obvious, fewer TAs able to evade blocks without even trying (if they're doing one of any number of technical things that have the side-effect of bypassing a cookie-block). As a long-term goal, it might be nice to exempt ISPs known to split /64s, but in the short term I think the mild increase in collateral damage is worth it, and is comparable to what we already see with blocking schools, libraries, large mobile networks, etc. Alternatively, a middle-ground solution might be having TA autoblocks specifically affect the /64, although one would want to clearly document this divergent behavior.

kostajh added a subscriber: Madalina.

I would be open to trying this. I'm not sure how we'd be able to effectively monitor for collateral damage, though.

As a long-term goal, it might be nice to exempt ISPs known to split /64s

We could potentially do this via a hardcoded list of known IPs, or by using IPoid's data.

I'm not sure how we'd be able to effectively monitor for collateral damage, though.

We could include some tracking logic in the unblock process. Like, instead of serving MediaWiki:Autoblockedtext, we could create MediaWiki:Autoblockedtext-64, and ask at least the biggest Wikipedias to recommend a separate unblock template in that message, like {{unblock-auto-64}}. The way TAs are implemented already means that someone can't appeal a block through normal channels if they haven't already created a TA on that client pre-block, which artificially decreases the base rate of appeals, but I can't think of any reason that that rate would differ for /64 autoblocks versus other blocks, so we could then still do meaningful data analysis based on the rate of {{unblock-auto}} vs. {{unblock-auto-64}}.

Edited per correction below.

The way TAs are implemented already means that someone can't appeal a block through normal channels if they haven't already created a TA on that client pre-block, which artificially decreases the base rate of appeals

Logged out users should be able to use the default unblock process via user talk page even without already having a TA: T398673: Unregistered editors on blocked ranges need a way to interact on-wiki to appeal a block allows creating a TA for user talk page appeals even on blocked IPs / IP ranges (unless „prevent this user from editing their own talk page“ is enabled).