Page MenuHomePhabricator

Create VRT user rights group for nl-wp
Closed, ResolvedPublic

Description

Per community consultation, please create a new user rights group for VRT on Dutch (nl) Wikipedia.

Per the proposal on the talk page linked above, please assign the following rights to the users in this group:

  • ipblock-exempt
  • centralauth-createlocal
  • noratelimit
  • checkuser-temporary-account
  • checkuser-temporary-account-auto-reveal
  • oathauth-enable

And:

  • The right to add other users to the ip-block-exempt group

Details

Event Timeline

JJMC89 subscribed.
  • checkuser-temporary-account
  • checkuser-temporary-account-auto-reveal

This is prohibited. See m:Limits to configuration changes

Per limits mentioned above:

WMF Legal has barred non-admins not passing an RFA-comparable process from viewing deleted content; see Wikipedia:Viewing deleted content.
Creation of such a user group usually requires WMF Legal review. Small wikis will not likely be allowed to have such user groups.

Thanks for the link JJMC, and the quote Nemoralis.
Interesting, since VRT agents have to disclose their personal information to the WMF and sign an NDA, and admins don't.

For now, I will implement the group changes without the checkuser-temporary-accounts-part. Most of the VRTS agents of the Dutch Wikipedia are also local sysops already anyway (except for one or two). If we would receive permission to implement this anyway in a later stage, we can still add it later as well.

Thanks Daniuu!

I see the case of VRT is explitly adressed in the link to the en-wp page:
"With this proposal, WMF is concerned about possible increased liability for the Foundation and OTRS agents. Sensitive legal matters may be deleted, and, for that reason, increasing the size of the group who can view such deleted material could arguably increase WMF's liability. In addition, OTRS agents could risk personal liability by undeleting content that had been originally deleted for legal reasons (either by the community or WMF). We appreciate the opportunity to be consulted, and we are sorry we cannot support this. "

Understandable that "deletedhistory" cannot be assigned here.

Change #1165056 had a related patch set uploaded (by Daniuu; author: Daniuu):

[operations/mediawiki-config@master] nlwiki: add VRT agent user group

https://gerrit.wikimedia.org/r/1165056

I removed deletedhistory from the list in my request.
The ones you mention though, @JJMC89, are needed to view the information behind the new temporary accounts, and are considered a low risk right. VRT agents without additional rights (not sysop) need them to properly answer the emails VRT (OTRS) receives. I can't imagine the quote you shared applies here, but I am happy to consult with WMF legal if you'd really want me to?

  • checkuser-temporary-account
  • checkuser-temporary-account-auto-reveal

This is prohibited. See m:Limits to configuration changes

are considered a low risk right

I don't think the Foundation agrees with that assessment.

IP address of temporary accounts is personally identifiable information. Access to it carries risk [....]


I can't imagine the quote you shared applies here

It definitely applies. Trust and Safety Product Team added the prohibition to the list, and the policy is decided by WMF-Legal.

Group assignment of this right is governed by the access policy. Changing it requires a change in the policy and may require technical changes.

I have for now removed the contested revisions from the proposed change.

Change #1165056 merged by jenkins-bot:

[operations/mediawiki-config@master] nlwiki: add VRT agent user group

https://gerrit.wikimedia.org/r/1165056

Mentioned in SAL (#wikimedia-operations) [2025-07-01T07:31:29Z] <urbanecm@deploy1003> Started scap sync-world: Backport for [[gerrit:1165056|nlwiki: add VRT agent user group (T398216)]]

Mentioned in SAL (#wikimedia-operations) [2025-07-01T07:33:33Z] <urbanecm@deploy1003> urbanecm, daniuu: Backport for [[gerrit:1165056|nlwiki: add VRT agent user group (T398216)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2025-07-01T07:43:34Z] <urbanecm@deploy1003> Finished scap sync-world: Backport for [[gerrit:1165056|nlwiki: add VRT agent user group (T398216)]] (duration: 12m 04s)

Patch has been merged. This task can be closed.