Sockmaster with 40 puppets could have been elected in Arbcom Options

[mbz1]

Ban discussion: Loosmark and sockpuppeting

[Theanima]

Ban discussion: Loosmark and sockpuppeting

He didn't have a chance of passing, but it's not like he'd have been the first sockpuppeteering arbitrator.

[CharlotteWebb]

Ban discussion: Loosmark and sockpuppeting

Yes but now Ceiling Cat has 72 brand new socks waiting for him in the Top Drawer.

You know, because nothing beats that brand new socks feeling.

[Tarc]

Ban discussion: Loosmark and sockpuppeting

Why do you choose your first post on WR to get all butthurt over some sock-master, did he cross you at some point? Another anti-Israeli editor to mark off your list?

[Abd]

This is one very weird situation. Those were recent socks. The user is not unsophisticated. So what was he doing? Who needs 46 socks? Running for ArbComm with a massive number of socks mostly being used for a couple of edits?

I conclude trolling. Loosemark emailed me earlier today.....

But this all reveals something about checkuser. For example, last edit for U547821 (T-C-L-K-R-D) was 30 August. So how was this sock discovered by a checkuser run 28 November?

Is checkuser data being kept for longer than the previous thirty days? Are checkusers maintaining private archives?

The information on checkusers claims that the log of actions used by checkuser is only kept for a "short time." A bit over two months? Anyone know what's going on?

[Abd]

Ban discussion: Loosmark and sockpuppeting

Why do you choose your first post on WR to get all butthurt over some sock-master, did he cross you at some point? Another anti-Israeli editor to mark off your list?

Wow, when was Tarc elected to the Welcoming Committee? That's quite a leap, from pointing to a rather interesting piece of wikidrama, to getting all "butthurt."

There is more to this than meets the eye. What more, I don't know, but just a casual glance at contributions for socks, and this looks very strange indeed, I've not seen anything like it.

[radek]

This is one very weird situation. Those were recent socks. The user is not unsophisticated. So what was he doing? Who needs 46 socks? Running for ArbComm with a massive number of socks mostly being used for a couple of edits?

I conclude trolling. Loosemark emailed me earlier today.....

But this all reveals something about checkuser. For example, last edit for U547821 (T-C-L-K-R-D) was 30 August. So how was this sock discovered by a checkuser run 28 November?

Is checkuser data being kept for longer than the previous thirty days? Are checkusers maintaining private archives?

The information on checkusers claims that the log of actions used by checkuser is only kept for a "short time." A bit over two months? Anyone know what's going on?

Some of those socks, as far as I can tell, have 0 edits. That is the accounts were created but never used. So I guess that answers the question about whether CU can check the registration IP of accounts.

[EricBarbour]

Ban discussion: Loosmark and sockpuppeting

Yes but now Ceiling Cat has 72 brand new socks waiting for him in the Top Drawer.
You know, because nothing beats that brand new socks feeling.

Heh heh heh.

[carbuncle]

But this all reveals something about checkuser. For example, last edit for U547821 (T-C-L-K-R-D) was 30 August. So how was this sock discovered by a checkuser run 28 November?

Is checkuser data being kept for longer than the previous thirty days? Are checkusers maintaining private archives?

The information on checkusers claims that the log of actions used by checkuser is only kept for a "short time." A bit over two months? Anyone know what's going on?

Some of those socks, as far as I can tell, have 0 edits. That is the accounts were created but never used. So I guess that answers the question about whether CU can check the registration IP of accounts.

Here is a public statement from one of the Arbs, who would certainly know if that is the case:

You appear to be saying that the privacy policy, such as it is, has been written to thwart third-parties in any attempts to subpoena data from the WMF, rather than to actually protect the privacy of Wikipedia users. This explains why the policy lacks such obvious information as which data is collected and how often it is deleted (although it helpfully says "the server confidentially stores related IP information for a limited period of time" and that the data "is automatically deleted after a set period"). This "policy" is simply useless bafflegab (and apparently so by design). I have heard that IP data collected when accounts are created is kept indefinitely. Do you know if this is the case? If you don't know, can you make inquiries on my behalf? Thanks. Delicious carbuncle (talk) 23:43, 15 September 2010 (UTC)

I don't think it is. As far as I know, loggable actions (edits, admin actions, account creations) are currently kept some 90 days, though that is not set in stone (it's a balancing act between keeping checkuser useful and privacy). Access logs (reads) are not kept more than a few hours; they are processed for the stats (without keeping the actual identifying stuff — i.e. it sums reads, counts unique visitors, etc) then deleted.
But you're missing the point — preventing the data from being subpoenaed is for the protection of users' privacy: there is no cost or harm to the foundation if someone gets logs (beyond the annoyance of complying), but the point is to keep that data out of vexatious litigants' hands. And trust me, this isn't an hypothetical: ask Mike how many times each year he gets to say "Sorry, that data is not kept as a matter of routine procedure" to entities who want to SLAPP editors silly. — Coren (talk) 01:57, 16 September 2010 (UTC)

Ok, I see your point. Delicious carbuncle (talk) 02:46, 16 September 2010 (UTC)

Are you saying that perhap Coren was not being truthful in his response above?

[radek]

But this all reveals something about checkuser. For example, last edit for U547821 (T-C-L-K-R-D) was 30 August. So how was this sock discovered by a checkuser run 28 November?

Is checkuser data being kept for longer than the previous thirty days? Are checkusers maintaining private archives?

The information on checkusers claims that the log of actions used by checkuser is only kept for a "short time." A bit over two months? Anyone know what's going on?

Some of those socks, as far as I can tell, have 0 edits. That is the accounts were created but never used. So I guess that answers the question about whether CU can check the registration IP of accounts.

Here is a public statement from one of the Arbs, who would certainly know if that is the case:

You appear to be saying that the privacy policy, such as it is, has been written to thwart third-parties in any attempts to subpoena data from the WMF, rather than to actually protect the privacy of Wikipedia users. This explains why the policy lacks such obvious information as which data is collected and how often it is deleted (although it helpfully says "the server confidentially stores related IP information for a limited period of time" and that the data "is automatically deleted after a set period"). This "policy" is simply useless bafflegab (and apparently so by design). I have heard that IP data collected when accounts are created is kept indefinitely. Do you know if this is the case? If you don't know, can you make inquiries on my behalf? Thanks. Delicious carbuncle (talk) 23:43, 15 September 2010 (UTC)

I don't think it is. As far as I know, loggable actions (edits, admin actions, account creations) are currently kept some 90 days, though that is not set in stone (it's a balancing act between keeping checkuser useful and privacy). Access logs (reads) are not kept more than a few hours; they are processed for the stats (without keeping the actual identifying stuff — i.e. it sums reads, counts unique visitors, etc) then deleted.
But you're missing the point — preventing the data from being subpoenaed is for the protection of users' privacy: there is no cost or harm to the foundation if someone gets logs (beyond the annoyance of complying), but the point is to keep that data out of vexatious litigants' hands. And trust me, this isn't an hypothetical: ask Mike how many times each year he gets to say "Sorry, that data is not kept as a matter of routine procedure" to entities who want to SLAPP editors silly. — Coren (talk) 01:57, 16 September 2010 (UTC)

Ok, I see your point. Delicious carbuncle (talk) 02:46, 16 September 2010 (UTC)

Are you saying that perhap Coren was not being truthful in his response above?

I'm not saying anything as I simply have no idea about any of the technical issues involved and I hence I have no way of assessing Coren's truthfulness. But I do wonder how a sock can be identified when it never made a single edit. Like this one (can't tell when this account was created - specifically whether or not it was created a "few hours" before getting blocked). Or this one.

Or I'm missing something completely - like maybe those accounts actually made edits but these edits where then disappeared. But then, why?

Though Coren seems to be saying that account creation data is kept for 90 days, not indefinitely.

This post has been edited by radek: Mon 29th November 2010, 5:26am

[Alison]

I'm not saying anything as I simply have no idea about any of the technical issues involved and I hence I have no way of assessing Coren's truthfulness. But I do wonder how a sock can be identified when it never made a single edit. Like this one (can't tell when this account was created - specifically whether or not it was created a "few hours" before getting blocked). Or this one.

Here's the source, clearly commented;

http://svn.wikimedia.org/viewvc/mediawiki/...097&view=markup

CODE

905                                    # Check how many accounts the user made recently?
906                                    if ( $ip ) {
907                                            $key = wfMemcKey( 'acctcreate', 'ip', $ip );
908                                            $count = intval( $wgMemc->get( $key ) );
909                                            if ( $count ) {
910                                                    $flags[] = '<strong>[' . wfMsgExt( 'checkuser-accounts', 'parsemag', $wgLang->formatNum( $count ) ) . ']</strong>';
911                                            }

It's common knowledge & it's evident from other wiki implementations, that account creations are logged per IP address checked. There's no mystery there at all & is how 'six-packs' of sock accounts are usually identified

But this all reveals something about checkuser. For example, last edit for U547821 (T-C-L-K-R-D) was 30 August. So how was this sock discovered by a checkuser run 28 November?

FWIW, the check was run this morning. That's within the 90-day window (assuming it exists )

[mbz1]

Ban discussion: Loosmark and sockpuppeting

Why do you choose your first post on WR to get all butthurt over some sock-master, did he cross you at some point? Another anti-Israeli editor to mark off your list?

The editor has nothing to do with Israel, but in case you have difficulties in reading and understanding English, he is not just "some sock-master". He could have been elected to arbcom, if his puppets were not discovered. I assure you, if one day your puppets would be discovered, I would not bother to post it here.

This post has been edited by mbz1: Mon 29th November 2010, 3:48pm

[SarekOfVulcan]

He could have been elected to arbcom, if his puppets were not discovered.

No, actually, he couldn't have. No way was he going to get to any sort of community-acceptable total...

[carbuncle]

But this all reveals something about checkuser. For example, last edit for U547821 (T-C-L-K-R-D) was 30 August. So how was this sock discovered by a checkuser run 28 November?

FWIW, the check was run this morning. That's within the 90-day window (assuming it exists )

I think it's safe to assume in this case that there are many more socks that were created before the fabled 90 day data cutoff.

[Alison]

FWIW, the check was run this morning. That's within the 90-day window (assuming it exists )

I think it's safe to assume in this case that there are many more socks that were created before the fabled 90 day data cutoff.

I'd say that's highly likely, yes and given that a number of these ones were unused, it's also likely that they're being stockpiled for a later socking campaign.

[powercorrupts]

I'd love to see who voted for whom. Personally I'm thinking that the editors who are running (Off2riorob and Loosmark) will have been getting - for various different reasons - quite a lot of votes.

This post has been edited by powercorrupts: Mon 29th November 2010, 7:55pm

[Abd]

FWIW, the check was run this morning. That's within the 90-day window (assuming it exists )

I think it's safe to assume in this case that there are many more socks that were created before the fabled 90 day data cutoff.

I'd say that's highly likely, yes and given that a number of these ones were unused, it's also likely that they're being stockpiled for a later socking campaign.

It's not at all clear that Loosmark was doing this long-term. What's weird is that he was doing this before running for ArbComm.

To my knowledge, the length of time the log is kept is a MediaWiki variable. It is not AFAIK, configurable by the individual checkusers or other admins. Would it take a developer to change it?

In any case, sure, 90 days, sure, that explains it. But I had always heard, long-term, that the logs were only kept for 30 days. Perhaps the 90 days was a cat kept in the bag to lure sockmasters into a false sense of security? Or what?

There is, by the way, as to what some of us were looking at, the possibility of deleted edits. But I doubt that there were many. Indeed, these socks seem to have been interested in legitimate edits, and I did not see evidence that they were being used for prohibited sock activity. However, Loosmark, AFAIK, did deny having these accounts. If he wanted to keep them concealed, he sure blew it by running for ArbComm!

But he may have accomplished exactly what he wanted, being able to call admins dickheads without getting immediately blocked.

If I were going to set up a lot of socks, I sure would not do it this way. There would, in fact, be no way to trace them to me, not even behavioral evidence. It's not rocket science. But I haven't done it. Socking is evidence of obsession with Wikipedia.... on the other hand, revolutionaries to tend to get a bit obsessed.....

[Abd]

FWIW, the check was run this morning. That's within the 90-day window (assuming it exists )

I think it's safe to assume in this case that there are many more socks that were created before the fabled 90 day data cutoff.

I'd say that's highly likely, yes and given that a number of these ones were unused, it's also likely that they're being stockpiled for a later socking campaign.

It's not at all clear that Loosmark was doing this long-term. What's weird is that he was doing this before running for ArbComm.

To my knowledge, the length of time the log is kept is a MediaWiki variable. It is not AFAIK, configurable by the individual checkusers or other admins. Would it take a developer to change it?

In any case, sure, 90 days, sure, that explains it. But I had always heard, long-term, that the logs were only kept for 30 days. Perhaps the 90 days was a cat kept in the bag to lure sockmasters into a false sense of security? Or what?

There is, by the way, as to what some of us were looking at, the possibility of deleted edits. But I doubt that there were many. Indeed, these socks seem to have been interested in legitimate edits, and I did not see evidence that they were being used for prohibited sock activity. However, Loosmark, AFAIK, did deny having these accounts. If he wanted to keep them concealed, he sure blew it by running for ArbComm!

But he may have accomplished exactly what he wanted, being able to call admins dickheads without getting immediately blocked.

If I were going to set up a lot of socks, I sure would not do it this way. There would, in fact, be no way to trace them to me, not even behavioral evidence. It's not rocket science. But I haven't done it. Socking is evidence of obsession with Wikipedia.... on the other hand, revolutionaries to tend to get a bit obsessed.....

I mentioned that I haven't done socking. I won't sock, I expect, unless I'm banned. Then I'd get to play, from time to time, the game of whack-a-mole, from the side that is far more fun, once one realizes that the hammer is imaginary, and that editing the project isn't the goal of that game, nor is whacking the moles editing the project either. There may be a need for this game, but it is not with editors who have improving pages as their goal, who should be handled differently, if firmly, if there is a problem, than with bans. One of my favorite ideas is bot reversion, which leaves the edit in history, restorable by anyone, and which is easily trackable. With a block, the edit isn't seen, the name or IP address constantly changes, and so supporting such an editor becomes tedious. More than transiently, account bans would be for accounts with no redeeming value at all, or those who prove incapable of any level of cooperation at all, which is pretty extreme.

[CharlotteWebb]

In any case, sure, 90 days, sure, that explains it. But I had always heard, long-term, that the logs were only kept for 30 days. Perhaps the 90 days was a cat kept in the bag to lure sockmasters into a false sense of security? Or what?

The previous limit of 30 days was a side-effect of storing checkuser data in the recentchanges table, but it is now stored in a separate table and is separately configurable.

CODE

30     # How long to keep CU data?
31     $wgCUDMaxAge = 3 * 30 * 24 * 3600; // 3 months

linky.

[Alison]

In any case, sure, 90 days, sure, that explains it. But I had always heard, long-term, that the logs were only kept for 30 days. Perhaps the 90 days was a cat kept in the bag to lure sockmasters into a false sense of security? Or what?

The previous limit of 30 days was a side-effect of storing checkuser data in the recentchanges table, but it is now stored in a separate table and is separately configurable.

CODE

30     # How long to keep CU data?
31     $wgCUDMaxAge = 3 * 30 * 24 * 3600; // 3 months

linky.

This diff is kinda interesting ....