Page MenuHomePhabricator

Installing the UserPageEditProtection extension on jawiki
Open, Stalled, Needs TriagePublicRequest

Description

The Japanese Wikipedia has an abuse filter that prohibits IPs and new users who have not yet reached a certain number of edits or days since joining from editing other users' user pages with some exceptions. However, since around June 2023, vandals have been abusing this filter mechanism by repeatedly attempting to edit pages in the User: (利用者:) namespace in a short time, filling the filter log with records of their actions and disrupting monitoring (e.g. 1, 2). Semi-protection has been implemented for pages targeted by vandals, but they keep changing their targets, resulting in a cat-and-mouse game. Therefore, in order to prevent vandals from accessing the editing screen of any page in the User namespace (except for their own user pages) in the first place, I would like to request the following changes to the wiki settings:

  • Install the extension UserPageEditProtection.
  • Grant the editalluserpages permission (provided by the extension) to autoconfirmed and confirmed user group.
  • Transfer the authority to grant and remove the confirmed user group from bureaucrat to accountcreator and sysop.

Restricting access to the edit screen of other users' user pages is intended to be limited to IPs and users who have not been autoconfirmed. The last change is intended as a relief measure for bona fide users who may be restricted by the introduction of the extension.

After sufficient announcement and nearly two months of discussion on the page linked below, the community has reached a consensus. For further details, please see the discussion at the village pump:

Event Timeline

Nemoralis subscribed.

This extension has not been deployed to any Wikimedia wiki, so it has not been tested for security or performance. Therefore, even if the request is accepted, it will take a long time.

Due to the fact that this extension has not gone through security and performance testing, we will not consider stewarding this extension until further notice.

Is there anything else we, as the jawiki community, need to do in the future to make this request a reality?

Due to the fact that this extension has not gone through security and performance testing, we will not consider stewarding this extension until further notice.

You're creating a chicken or the egg problem here. There's no incentive for anyone to take the extension through the required security and performance reviews unless some WMF team agrees to steward it. For example see how T355161 has stalled.

(To be clear, my motivation is not to blame anyone here, nor to make anyone feel obligated to do anything, but instead to highlight the fact that the processes here are broken for reasons that aren't anyone here's fault. See more ranting about this at T355150#10001057 and T379526)

Given that the code inside this extension can legitimately fit into a Phabricator comment, and to my understanding does not impact any major performance-sensitive components, I don't see why this couldn't/shouldn't be upstreamed into MediaWiki. For what it's worth, I think meta (and a few other projects) already monkey-patch this in using AbuseFilters.

@Yushu-kasai I assume jawiki is still interested in this being implemented?

Thank you, @Soda. I personally still believe that a change in the system, including introducing this extension, may be necessary to solve the jawiki problem. However, I am not entirely sure whether other users’ opinions have changed or whether new issues have emerged over time. If possible, could you give me a week or two so that I can re-examine whether this change is truly needed, just to be sure?

I have properly re-announced the topic to the jawiki community to the jawp community for two weeks, and no objections have been raised (please see the village pump subpage). Therefore, I believe we can move forward with this system change.