Page MenuHomePhabricator

Blocked Wikidata user sockpuppets are doing automated misconduct with QuickStatements
Open, MediumPublicBUG REPORT

Description

Some blocked Wikidata users may be doing misconduct in the form of doing maximal automated edits in QuickStatements. This does not seem to be a crisis as the editing is blocked. I do not see a negative editing outcome for this activity, but I think the intent is to consume computing resources. It seems to be doing something with large automated batches of edit requests that do not result in Wikidata edits. This is a case of active misconduct and may be some kind of security issue.

Steps to replicate the issue (include links if applicable):

  • Sorry, I am just reporting based on what I read in a Wikidata thread. I do not have technical understanding of what might be happening.

What happens?:

A Wikidata blocked user is able to use a Wikidata automated tool, QuickStatements. I think what is happening is that QuickStatements first allows anyone to make automated edit requests, then after they make many requests, it finally checks at the end whether the user is blocked. Consequently, it processes many thousands of requests, then cancels them after they are set up.

What should have happened instead?:

QuickStatements should first check whether a user is blocked, and if they are, prohibit use of tools.

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):

Other information (browser name/version, screenshots, etc.):

Event Timeline

Bluerasberry updated the task description. (Show Details)
Bluerasberry updated Other Assignee, added: Magnus.
Bluerasberry updated Other Assignee, removed: Magnus.
Bluerasberry added a subscriber: Magnus.
Daniel_Mietchen renamed this task from blocked Wikidata user doing automated misconduct with QuickStatements to Blocked Wikidata user sockpuppets are doing automated misconduct with QuickStatements.Feb 21 2025, 6:15 PM
Daniel_Mietchen updated the task description. (Show Details)

By the way, restoring the right for Wikidata administrators to block batches in QuickStatements would mitigate the issue; this function ceased to work many years ago.

As admins on WD, we still can't stop the batches.

Following up from my comments from the private duplicate: if the only impact from those users is that they're DoSing the tool itself then we have nothing that we could easily do from either the Toolforge infrastructure or the MediaWiki side. So that needs to be fixed by the maintainers of that tool. If the tool is down and maintainers are active, then https://wikitech.wikimedia.org/wiki/Help:Toolforge/Abandoned_tool_policy could be used to adopt the tool.

By the way, restoring the right for Wikidata administrators to block batches in QuickStatements would mitigate the issue; this function ceased to work many years ago.

https://github.com/magnusmanske/quickstatements/pull/62

By the way, restoring the right for Wikidata administrators to block batches in QuickStatements would mitigate the issue; this function ceased to work many years ago.

As admins on WD, we still can't stop the batches.

At least now we can. I could stop all the batches by VerifyToday.

FWIW I added a check on every ~20s batch edit (to not overload the Wikidata API) if the user is blocked, which should then block all batches by this user. Please let me know if this is effective, or if it has unintended side effects.

@Magnus: Could you please provide a link to that changeset/patch? Thanks.

Only checking whether the user is blocked only when an edit fails would be better.