Talk:AbuseFilter

Yo Folks,

great job at fighting the zombie hordes everyone. But it is getting a bit tiresome.

So I went (again) and browsed ShoutWiki to see what we can technically do against it. There is still the option to disallow account creation for non-users, but that is something we have to ask the staff to do manually, and I still don't like the idea.

I also found a forum thread with a solution to the old problem that a valid link is on the spam blacklist: There's a whitelist we can edit. But I forgot any examples so that will have to wait for another day.

The new thing is: The extension "AbuseFilter" has been activated for all wikis since I last looked, and that is some powerful (and rather complex) stuff. Our page for that is here, the Mediawiki explanation page over there.

The question is: what should it do exactly? After browsing a bit in the Wikipedia filters I thought we could do something like disallowing users younger than say a day to create pages, but that would run counter to our rule that they should say hello on their user page to prove that they are human. Or we could disallow certain username patterns, say those who contain numbers over 666 or so. ;o)

Ideas? Please speak in RegEx, haha. I'll look deeper into it soon.

I hope you're all well and not too much in trouble because of the meatspace zombie apocalypse.

--CE (talk) 22:07, 21 March 2020 (UTC)


 * On Wikipedia new users are not allowed to create pages. But this does not prevent them from editing or creating their own user or talk pages.


 * Actually we could even disable creating their own pages. We could have a "Welcome new users" page that they should sign.


 * P.S. - Prepare for World War Z -- Petri Krohn (talk) 01:26, 22 March 2020 (UTC)


 * They seem to be learning zombies. So maybe we shall eliminate those whose numbers are less then 666 too. --Resup (talk) 10:04, 22 March 2020 (UTC)


 * You're right, only one of the just kicked seven would have fit that pattern. Coincidence?
 * Petri, the idea with a special page to sign is good, but we must have a way to change their permissions after they did it. So we would have to add them to a new user group with different rights. Which is nothing we can do here on ShoutWiki as far as I can see. This is stuff only they can do for us, so we would have to think it through before we ask them to remove some rights from the normal user group and create a new group that adds those rights. Looking at the (lack of) activity on the main site and forums, I guess those changes could take some time to be done by someone. Disallowing creating accounts would be done the same way but much simpler: remove the right "createaccount" from the "all" group.
 * Anyway, I think I'll find the time today to get my head around the AbuseFilter stuff and see what comes up as possibilities there. --CE (talk) 10:24, 22 March 2020 (UTC)


 * Maybe the simplest way for the moment is to prevent them from posting links for a certain amount of time after signing up, because it's very rare that they edit their created pages (and surprising that it happens at all) - usually the process of creating a page and posting a link is a single one. That should be possible with AbuseFilter. --CE (talk) 10:32, 22 March 2020 (UTC)

That looks good already. See the adventures of my evil twin! :oD - --CE (talk) 14:33, 22 March 2020 (UTC)

I simplified filter 1: We don't want to prevent real users from starting with their edits immediately after they sign-up, so now it just checks "edits with links by users younger than a day". Seems to work fine, only that it still doesn't do the autoblock (which it did in the beginning). But I think I found the problem: It gets marked a potentially harmful because it hit a too high percentage of recent edits. So my prediction is that it will eventually do it again after we made more edits. Let's wait and see.

Then I made a second filter to catch Zombies: "edits with links by users older than a day with an edit count of zero".

Those two should catch anything but new accounts that do nothing (and those that do an edit without links on the first day and after that day spam links, which I don't think is very likely for a bot). We could delete them manually or let them stay in their graves.

Is that logic sound? --CE (talk) 16:21, 22 March 2020 (UTC)

'''Ha! We have the first fish in our net.''' Dear Sonya66H35560060 tried to annoy us with her own link-spammy user page and with cricket spam as you can see in the abuse log. "She" tried both actions only once, and the filter is still "throttled", so there was no auto-block. I think I remove the warning so the block takes place at first try when the filter will be fully activated. Done. --CE (talk) 14:33, 23 March 2020 (UTC)

† RIP AudryMesser45, the first zombie killed by filter 1!!! --CE (talk) 20:57, 23 March 2020 (UTC)


 * Great work! What a pain in the ass it had to be. But now I'm seeing Abuse Filter doing some of the blocking. What a valuable team member! --Caustic Logic (talk) 09:42, 24 March 2020 (UTC)


 * No, it was actually easier than I thought and pretty interesting to explore that powerful tool. I'm thinking about how to fine-tune the filters now before I update the after-signup message and the description on the "how to contribute" page.
 * We don't want real members to wait 24 hours before they can post links, because in general we want stuff they add to be sourced. So a way could be to add the condition to filter 1 that they are only forbidden to post links when they haven't made at least one post without links before. And to remove the condition that the post contains links from filter 2. So that would make the new rule something like this:
 * SPAM PROTECTION: During the next 24 hours, you have to make one edit that contains no added link. You can do that on your user page (say "hi"), in the sandbox or anywhere else (f.e. correct a typo you spotted). After that edit, your account has complete user rights. Failing to make that edit during the next 24 hours will flag your account as bot and block it when it tries to make any edit.
 * That will eliminate all reasons for us to manually block bots, other than for cosmetic purposes. Opinions? --CE (talk) 16:36, 24 March 2020 (UTC)
 * OK, I've combined the two into one that should do what I just described:
 * ''action == "edit"
 * ''& user_editcount == 0
 * ''& ((added_links & user_age <= 86400) | user_age > 86400)
 * --CE (talk) 17:05, 24 March 2020 (UTC)

I've updated the message new accounts get after registration and asked to pay attention to it at the end of our "mission statement". I consider this problem to be solved. :o) --CE (talk) 01:25, 26 March 2020 (UTC)