Change Details

In the context of #ip_info, "access" covers: #### Rights #ip_info has two separate sets of MediaWiki rights: 1. The right that allows the user to enable the tool, `ipinfo` 2. The rights that control the user's access to the information provided by the tool – {T292626} and the right to use the tool, which is gated by #1 above and the user having enabled the tool and agreed to its terms of use – {T291582} and {T264150} Access will work as follows for the MVP version: * "Full" access: Limited to sysop, bureaucrat, checkuser, oversight and steward user groups. * "Basic" access: All other registered users {F34679604, width=600} #### Logging and reporting @STran and @Niharika met with members of the Legal and Trust & Safety teams today to iron out the logging requirements. Here are the discussed upon requirements: 1. The logs should capture: ** Who performed the IP information check ** Access of the performer (limited or full) ** Against which IP address ** Whether it was the popup or the accordion ** Timestamp of the check 2. To avoid the problem of log spam, only one log entry will be captured if multiple checks are made by the same user against the same IP over a period of 24 hours (rolling or one UTC day). Note that we will have a separate log entry for popup check versus accordion check but each of them will be captured only once every 24 hours. ** This time period needs to be configurable to allow flexibility in the future. 3. Retention: Logs will be retained forever. 4. Trust & Safety, Stewards, Ombuds and Checkusers will potentially have access to the logs. This will need to be configurable to allow flexibility in the future. 5. The users will be informed that their checks will be logged when they accept the terms of access. (Ticket TBD) #### Revocation From {T264150} only: > T&S/Legal reserve the right to revoke a user’s access permissions in case of abuse > If a user’s permission is revoked by us, they should not be able to activate it again > There is a possibility that users might need to regain access periodically **(TBD)**

In the context of #ip_info, "access" covers: #### Rights #ip_info has two separate sets of MediaWiki rights: 1. The right that allows the user to enable the tool, `ipinfo` 2. The rights that control the user's access to the information provided by the tool – {T292626} and the right to use the tool, which is gated by #1 above and the user having enabled the tool and agreed to its terms of use – {T291582} and {T264150} Access will work as follows for the MVP version: * "Full" access: Limited to sysop, bureaucrat, checkuser, oversight and steward user groups. * "Basic" access: All other registered users {F34679604, width=600} #### Logging and reporting @STran and @Niharika met with members of the Legal and Trust & Safety teams today to iron out the logging requirements. Here are the discussed upon requirements: 1. The logs should capture: ** Who performed the IP information check ** Access of the performer (limited or full) ** Against which IP address ** Whether it was the popup or the accordion ** Timestamp of the check 2. To avoid the problem of log spam, only one log entry will be captured if multiple checks are made by the same user against the same IP over a period of 24 hours (rolling or one UTC day). Note that we will have a separate log entry for popup check versus accordion check but each of them will be captured only once every 24 hours. ** This time period needs to be configurable to allow flexibility in the future. 3. Retention: Logs will be retained forever. 4. Trust & Safety, Stewards, Ombuds and Checkusers will potentially have access to the logs. This will need to be configurable to allow flexibility in the future. 5. The users will be informed that their checks will be logged when they accept the terms of access. (Ticket TBD) #### Revocation From {T264150} only: > T&S/Legal reserve the right to revoke a user’s access permissions in case of abuse > If a user’s permission is revoked by us, they should not be able to activate it again > There is a possibility that users might need to regain access periodically **(TBD)** While estimating {T291854}, we also discussed: * The user's access should be revoked across all wikis

In the context of #ip_info, "access" covers: #### Rights #ip_info has two separate sets of MediaWiki rights: 1. The right that allows the user to enable the tool, `ipinfo` 2. The rights that control the user's access to the information provided by the tool – {T292626} and the right to use the tool, which is gated by #1 above and the user having enabled the tool and agreed to its terms of use – {T291582} and {T264150} Access will work as follows for the MVP version: * "Full" access: Limited to sysop, bureaucrat, checkuser, oversight and steward user groups. * "Basic" access: All other registered users {F34679604, width=600} #### Logging and reporting @STran and @Niharika met with members of the Legal and Trust & Safety teams today to iron out the logging requirements. Here are the discussed upon requirements: 1. The logs should capture: ** Who performed the IP information check ** Access of the performer (limited or full) ** Against which IP address ** Whether it was the popup or the accordion ** Timestamp of the check 2. To avoid the problem of log spam, only one log entry will be captured if multiple checks are made by the same user against the same IP over a period of 24 hours (rolling or one UTC day). Note that we will have a separate log entry for popup check versus accordion check but each of them will be captured only once every 24 hours. ** This time period needs to be configurable to allow flexibility in the future. 3. Retention: Logs will be retained forever. 4. Trust & Safety, Stewards, Ombuds and Checkusers will potentially have access to the logs. This will need to be configurable to allow flexibility in the future. 5. The users will be informed that their checks will be logged when they accept the terms of access. (Ticket TBD) #### Revocation From {T264150} only: > T&S/Legal reserve the right to revoke a user’s access permissions in case of abuse > If a user’s permission is revoked by us, they should not be able to activate it again > There is a possibility that users might need to regain access periodically **(TBD)** While estimating {T291854}, we also discussed: * The user's access should be revoked across all wikis