This is an archive of past discussions. Do not edit the contents of this page. If you wish to start a new discussion or revive an old one, please do so on the
current talk page.
The SPI status colors have indeed changed. Asartea made
an edit request to change {{SPI case status}} to use consistently WCAG AA Normal or better color contrast (
MOS:COLOR). Firefly found a way to keep moreinfo eye-catching while keeping it in the same color range as before, but there wasn't really any way to do that for administrator, so that's been changed from a noncompliant bright orange to a compliant bright green (rather than a compliant dull orange). For consistency's sake, I made a matching change to {{SPIstatusentry/color}}, the template that is called on the SPI list. I welcome any feedback. --
Tamzincetacean needed (she/they)05:07, 21 January 2022 (UTC)
Small request that we change the bright green to something else since the CU checked is also green (though dull), and they might get lumped together. Also, generic comment that the accessibility guideline really shouldn't be in MOS space since everything other than accessibility is only applicable in mainspace... though nothing we can do about that here :-)
TonyBallioni (
talk)
05:58, 21 January 2022 (UTC)
Green background we went with instead: Black text. Blue link.
Visited blue link.
I wanted to retain the general logic that CUrequest, moreinfo, admin, and clerk are the four most eye-catching categories, and it doesn't look like there's a way to do that with orange in an a11y-compliant fashion. Thing is, all the main parts of the color wheel are already taken for something: yellow for CU, blue(ish) for endorse, red/pink for open and declined, dull green for checked, purple/magenta for hold and more info, reddish for clerk. So the way I see it:
We could use Asartea's original proposal.
We could use a shade of red distinct from that of awaiting clerk. They're conceptually similar so it wouldn't be that different from having both moreinfo and hold being in the same neighborhood.
We could switch the dull green of checked to a dull orange. Which might actually be a good idea, in terms of the psychology of color: I feel like sometimes the checked queue gets negelected despite often containing fairly time-sensitive cases.
I agree with Tony, and personally I would actually prefer Asartea's original duller orange proposal rather than the current green, since the CU completed status is also green (and, more selfishly, I've been conditioned over the years to look for orange). I think orange as a color is inherently eye-catching in the context of the contrasting colors of yellow and green.
Mz7 (
talk)
08:04, 21 January 2022 (UTC)
I think orange works better. I think "awaiting admin" should be important and eye-catching, given that it usually means socks need to be blocked. Orange is quite eye-catching, and is what most people are used to. Though, if we want to change the color, red would also be good, though maybe a bit too urgent. InvalidOStalk13:16, 21 January 2022 (UTC)
@
TonyBallioni,
Mz7,
Blablubbs, and
InvalidOS: Okay, I've switched to Asartea's original proposal, but seeing it alongisde the other colors on the table, I think it looks a bit too much like the open and declined colors, especially if my screen's on night mode. Thoughts? --
Tamzincetacean needed (she/they)13:51, 21 January 2022 (UTC)
OK, I do see the issues on night mode, it's definitely harder to tell the difference. Maybe we could try white text on darker colors for the "awaiting x" statuses? It's still more eye-catching and urgent, but also remains accessible. InvalidOStalk16:18, 21 January 2022 (UTC)
@
InvalidOS: I actually considered that, but the issue is the link coloring. Could highlight the links white within the orange background, but I think that would look very jarring, as you can see here. --
Tamzincetacean needed (she/they)16:25, 21 January 2022 (UTC)
Yeah, I don't think this will look good. Also I have bad news: originally I ignored {{SPI case status|clerk}} because its accessible against black, but I just realised when it gets used in the table it is of course used against links. --
AsarteaTalk|Contribs16:34, 21 January 2022 (UTC)
(
edit conflict) Oh, that is really bad. Maybe the "Open" case color could be changed, but that might as well be less of a good idea. I'm just really not a big fan of that green though. InvalidOStalk16:36, 21 January 2022 (UTC)
I'm happy as long as it meets AA; I don't actually do any SPI work, so I'll leave the determination of which colors work to people who actually have to look at them on a regular basis. --
AsarteaTalk|Contribs17:35, 21 January 2022 (UTC)
Okay, switched to that pair of colors now. About as close to the originals as possible while staying within AA Normal, so hopefully this works for people. (Currently there's nothing in the table with these statuses, but you can do what I did and mess around with inspect element. Hexes are #F9AC71 for ADMIN and #FF8E7A for CLERK.) --
Tamzincetacean needed (she/they)06:37, 22 January 2022 (UTC)
First may I offer congratulations to all of you who have worked so hard to reduce the backlog.
I have an observation which may not be borne out by real life. When CU is requested a new investigation is almost always handled comparative quickly. When not requested it can feel to someone not intimately involved with the SPI process that it is treated as less urgent.
This may be because there are more non CU requests than there are CU requests, and I accept this may be a result of the human frailty of seeing patterns where none exist. The purpose of this post is to alert you very busy SPI folks of my perception.
I think this may be partially due to CUs focusing on cases with CU requests. I certainly generally focus on cases marked as needing CU and then to the open cases. This may also be due to the CU cases being slightly further up the list (so are seen first).On the other hand, at the moment only two CU complete cases are newer than the oldest non-cu case. Furthermore, I would say that a combination of non-cu requests also including IP-only SPI cases and when filing cases CU being marked as "only check this if you need it" when using the preload form probably means that there are generally more non-cu cases than cu cases.
Dreamy Jazztalk to me | my contributions23:20, 26 January 2022 (UTC)
I can quite understand your thought process here. I think very hard before requesting CU and try to err on the side of not doing so. I do take your point about non CU cases being physically lower on the list, as well as being likely to be greater in number than CU cases because of the wise preload discouragement of flagging for CU.
FiddleTimtrentFaddleTalk to me23:29, 26 January 2022 (UTC)
Another thing to consider is that non-CU cases typically fall into three categories: 1) IP/account or all-IP cases, 2) cases coming out of a long dormancy, and 3) cases filed by people inexperienced with SPI who don't know to request CU. (Yes, there's a smattering of "Too obvious to bother with a CU request" cases thrown in, but those are often picked off as they come in.) All three of those categories are relatively effort-intensive to clerk. If I clerk a CU request, all I need to do is see that a threshold of
reasonable suspicion has been met and that a check would be policy-compliant, and then I can hand it off to a CU for technical analysis. Your post here inspired me to take a look at
the oldest pending "open" case, which fell into Category 1. It was a well-made filing, and about as short as it could be expected to be, but still pretty long. It required a weighing of big-picture behavioral analysis, tells, past procedural history, and the nuances of the sockpuppetry policy, and I had to be extra-sure of my conclusion because there won't be a CU safety net to tell me I got the wrong guy. Clerking that took me quite a bit longer than it takes to say "Yep, both of these accounts created the same draft with similar edit summaries. {{endorse}}." So a lot of the discrepancy between CU and non-CU cases is just inherent in what they demand of the clerk team, I think. --
Tamzincetacean needed (she/they)00:40, 27 January 2022 (UTC)
I knew a great deal of work happened behind the scenes. I was not aware of quite how much. I've often been tempted to put myself forward for work in this area, but I think AFC is enough for me right now. At least I get a regular chance from AFC to set 'em up for SPI specialists to knock down. Not that I always get it right!
While I was at
WP:PERM, something clicked me. That if someone changes their username after a SPI case had been filed against them, the SPI link at {{rfplinks}} would *probably* show up as a red-link, making this Template useless. Can someone more knowledgeable confirm this? And if this is true, we should fix it so that a username change automatically creates a redirect from the new username SPI page to the old one where a case was actually filed. ---CX Zoom(he/him)(let's talk|contribs)06:44, 13 February 2022 (UTC)
If my observations are untrue, that username change does create appropriate redirect, someone should note them at the documentation for SPI processes. Thank you. ---CX Zoom(he/him)(let's talk|contribs)07:04, 13 February 2022 (UTC)
User pages are usually redirected to the new name as part of the rename process, although a renamer can choose whether to suppress the redirects creation. I think they mostly allow it in normal circumstances. Additionally someone can manually remove the redirect afterwards, however, but that'd create edit history which can be inspected to determine where the user-page used to redirect. –
Ammarpad (
talk)
13:28, 13 February 2022 (UTC)
I think the question here is about the SPI page in particular. I am not aware of any automated process that moves SPI pages when users are renamed. This means that at the moment that SPI cases can in theory be left at the old username, and potentially forgotten about if the link was not included in any block log. I think I've found a way to determine if a user exists, and as I cannot find a pre-existing module to do this I will be creating one.
Dreamy Jazztalk to me | my contributions13:43, 13 February 2022 (UTC)
Not just the SPI page, but also the RFAR page to be specific. Also, I'm unaware if there are any other kind of pages to which links should ideally be preserved. ---CX Zoom(he/him)(let's talk|contribs)14:17, 13 February 2022 (UTC)
I've created two categories that are automatically filled with SPI cases when either:
The userpage and user talkm page both do not exist (unless it's an IP address)
The user talk page is a redirect to somewhere outside the user's userspace
Unfortunately it was not possible to detect if the user does or does not exist without access to the API, which is not possible using Lua or parser functions. As such, for the time being that gives a list of SPI cases that could be worth checking. I'll likely move this over to a bot, as from looking at this method it includes a fair number of false positives.
Dreamy Jazztalk to me | my contributions10:21, 15 February 2022 (UTC)
In practice, I don't think this is a big deal. If there were actually issues with sockpuppetry, then typically the user would have been blocked, or perhaps at minimum a message would have been left on their user talk page, so even if the reviewing administrator misses the SPI link, they would probably still discover the past conduct issues when they check the block log and the user's talk page.
Mz7 (
talk)
08:29, 15 February 2022 (UTC)
Apologies
but I seem to have ballsed up this
shiney new report somehow, and can't work out the code to fix it. The loading form froze at one point, so it was probably something to do with that; unfortunately, I didn't notice. D'oh!
SN5412920:57, 20 February 2022 (UTC)
With regards to how you merge/combine cases, this is nearly always performed by a clerk or a CU who is comfortable merging cases.
WP:SPIHELPER is used by those who merge cases. Raising it here if you are in neither group is the best option, as spihelper.js doesn't allow you to merge if you are neither a clerk or checkuser.
@
Dreamy Jazz: Category:Wikipedia sockpuppets of Guardian of the Rings and Category:Suspected Wikipedia sockpuppets of Lieutenant of Melkor both exist. I should have been more specific about what exactly was to be combined, that being said I can't find the sockpuppet investigation for the sockpuppets of Guardian of the Rings, they aren't in the
Wikipedia:Sockpuppet_investigations/Lieutenant_of_Melkor archive.
Horse Eye's Back (
talk)
23:47, 23 February 2022 (UTC)
With regards to not finding a sockpuppet investigation, all but one of those accounts were self-admitted socks based on the diff presented on their userpages. The other account as confirmed by a CU. This means that both may not have been reported in the usual sense, as with all but one there was no need to investigate it as the connection was self-disclosed and with the last a checkuser may have just ran a check and then blocked without an investigation. Happy editing,
Dreamy Jazztalk to me | my contributions23:59, 23 February 2022 (UTC)
This is all interesting, I've been clerking since 2015 and have done plenty of merges, but have never once used spihelper to do it. I didn't even know it could.
Ivanvector (Talk/Edits)
00:23, 24 February 2022 (UTC)
@
Ivanvector: That's because in
User:Ivanvector/vector.js, you're using importScript('User:Timotheus Canens/spihelper.js');—which is totally fine and functional, if this is the version you prefer. However, GeneralNotability has been maintaining
an updated version of the script that has a bunch of new features, including automated merging. It can be installed by replacing importScript('User:Timotheus Canens/spihelper.js'); with importScript( 'User:GeneralNotability/spihelper.js' );.
Mz7 (
talk)
01:58, 24 February 2022 (UTC)
Changes, such as the introduction of the {{socklist}} template, is likely to break the older version of spihelper. This could be updated so that the older version still works, but perhaps it might be better to redirect the older script to GN's version which is being kept up to date. I wouldn't want to do this without the support of
Timotheus Canens, but this might be something to consider so that just because you have a different version installed you don't get new features etc.
Dreamy Jazztalk to me | my contributions02:12, 24 February 2022 (UTC)
I've reported a good number of socks over the years. I'm an admin but don't work in this area. I've identified an IP user as a sock without any doubt (edit same articles; restored 32k of text removed in 2019 as a result of a sockpuppet investigation). What do I have to do? Do I need to open an investigation or can I just go ahead, block the IP, and add the IP address to the list of previously identified socks? A sock would usually be blocked indefinitely, but I believe that's no longer possible for IP addresses. So do I go for the maximum length of time or are there options to permanently block an IP? Schwede6608:41, 24 February 2022 (UTC)
Hi everyone, I recently created a template that can be used to mark votes/comments cast by sockpuppets. The template is {{Sock vote}}. I didn't spent a lot of time to create this and it may require some modification. Please feel free to review and modify the template as appropriate and then use it! Thanks! ---CX Zoom(he/him)(let's talk|contribs)16:59, 28 February 2022 (UTC)
So, I got a hunch that a number of accounts (Saurabh darade 1998, Shivadikarshreyash73, RudrakshaVaity, Navneet77, Kalpana234, Mdshayansiddiqui3, Aru Jaiswar, Mitul46, Ajayso.wp) are sockpuppets of
User:Deep. 123456 based on their userpages/sandboxes but they are all inactive for several years. Is it still worth reporting them? Asking because several userpages were just tagged as U5 speedy deletion and thus showed up on the speedy deletion queue, and when checking I noticed a pattern.
Jo-Jo Eumerus (
talk)
10:09, 4 March 2022 (UTC)
@
Jo-Jo Eumerus If you think there's value to getting them into the record, my suggestion would be to file an SPI, note that it's just for historical purposes, and then close the case yourself. That'll get it into the archives for future reference. But it's very unlikely anybody would spend any time investigating accounts which have been inactive for several years. --
RoySmith(talk)15:39, 4 March 2022 (UTC)
I wouldn't, in this particular case. I remember the FOSS newbie vandalism thing from around that time, as I recall it turned out to be a misguided school project. Adding more accounts to the case (again, in this specific instance) won't do anything to help prevent abuse, and might document connections that don't actually exist if any of these users decide to take up Wikipedia in the future.
Ivanvector (Talk/Edits)
17:25, 4 March 2022 (UTC)
I've been repeatedly frustrated by this, even when I note that its for historical purposes the admin acts like its a waste of their time. From my perspective there is *always* value in identifying sleeper or abandoned sock accounts.
Horse Eye's Back (
talk)
16:28, 4 March 2022 (UTC)
The deletion (not archiving) of SPI reports is not something that has made sense to me, so it would be helpful to know what the wider expectations are.
CMD (
talk)
07:27, 5 March 2022 (UTC)
Renaming a case page for earlier username
From what I've seen in edit histories, the case page
Wikipedia:Sockpuppet investigations/Dealer07 has an earlier username involved, and should be moved to
Wikipedia:Sockpuppet investigations/Eurofan2000. Both Eurofan2000 and Dealer07 behaved the same as Greek IPs pursuing edit-warring behavior, and both were intensely interested in Greek/Albanian/Macedonian nationalities, with the intent to diminish non-Greek connections. They were also trying to weaken the UK by dividing "British" descriptions into English, Scottish, etc. Below I've listed the named accounts that I have seen. A massive number of Greek IPs is also part of this case.
Binksternet (
talk)
01:12, 13 March 2022 (UTC)
Apr–Jul 2021 –
Eurofan2000. At the Eleni Foureira bio, this account added something about Foureira being inspired by Bebe Rexha,
[1] the same as a later sock.
[2] This username reduced the Albanian nationality of a singer.
[3] The username was blocked by GiantSnowman because of multiple accounts, edit-warring first with a Greek IP, then with Eurofan2000, then with
John07234.
[4][5][6]
Jun–Jul 2021 –
John07234 was created to continue the edit-warring of Greek IPs and Eurofan2000. Two edits removed "Albanian" nationality from the Foureira bio.
[7][8]John07234 signed his username to a talk page edit made by Greek IP.
Per
[10] it looks like you managed to fix the issue. I'll reiterate what I said in that thread: I deeply apologize for the lack of foresight here. In the future, I will definitely give a heads up here before I make any major changes to the bot's behavior.
Mz7 (
talk)
02:39, 29 March 2022 (UTC)
New user tagging socks
A relatively new user who is not an admin or clerk has
tagged the user and user talk pages of socks. Not sure if this is allowed (or what to do if not) so I figured I'd bring it to your attention here.
Nardog (
talk)
03:58, 11 May 2022 (UTC)
Recently I found a phrase "Infinite torque at zero rpm" on an article. Such thing does not really exist, except in Wikipedia. I did further investigation, and here is what I found:
@
Nikolas Ojala's suspicious mind would have been better deployed by looking at the diffs before posting here.
Each of those edits was made using
WP:REFLINKS, one of those secondary tasks is (annoyingly) to use redirects in place of section links. In these cases, Reflinks replaced
Torque#Machine torque with the redirect
Infinite torque at zero rpm.
In my case, I pay no attention to those part of Reflink's changes, and was unaware that they had been made. I have no view on whether they are appropriate.
BrownHairedGirl(talk) • (
contribs)
10:07, 17 May 2022 (UTC)
Now that you are aware of this discussion, I want to ask: In four articles you replaced a link like this
torque by a link like this
torque. Why did you do that four times? Is that phrase "Infinite torque at zero rpm" somehow important to you? ⸻
Nikolas Ojala (
talk)
10:32, 17 May 2022 (UTC)
@
Nikolas Ojala: the civil and collaborative response at his stage would have been for you to apologise for wasting the time of other editors my making an allegation of sockpuppetry without first doing some simple basic checks such as reading the edit summaries to see that these edits all use
WP:REFLINKS.
Instead, you responded by apparently not even reading the reply which I promptly posted, and asking a question which I had just answered.
@
Nikolas Ojala: Please apologize. Both for the initial reckless sockpuppetry allegation and for the completely uncalled-for snark when BHG rightly took polite exception to it. --
Tamzincetacean needed (she/they)22:07, 17 May 2022 (UTC)
I have almost no experience with SPI, so please bear with me if this is a dumb question. I've recently reported a new suspected sock into an old existing case - will it autopopulate into the big table on the main SPI page, or since it's an old SPI will I need to make some sort of additional action to bring attention to it?
Hog FarmTalk01:32, 22 May 2022 (UTC)
Thanks! They're being a bit of a pain in the butt so I wanted to make sure it didn't languish in malformed land.
Hog FarmTalk01:45, 22 May 2022 (UTC)
Just as an explanatory sidenote: The case list is not populated by Twinkle or the filers themselves, but by a bot over at
Wikipedia:Sockpuppet investigations/SPI/Cases and then transcluded over, so it can take a while until new cases and status changes show up in the table. If a case hasn't shown up after 40 minutes or so, something is probably borked – it happens on occasion, usually because the bot is down, or because people ignore the instructions we have and don't follow the case format; the bot and other tools really don't like it when {{
SPI case status}} or other important elements are missing. If a case hasn't shown up for a while, please post here so we can either fix the filing or annoy the
bot operator with a million pings. --
Blablubbs (
talk)
08:38, 22 May 2022 (UTC)
@
Fade258: Your ping failed (you have to add the ping template in the same edit as you add your signature), but I saw this anyway. I'm not sure why you are seemingly trying to expedite the processing of a case you filed 20 minutes ago. If you want to speed things up, there are some tips for writing good filings
here (
this and
this seem particularly relevant). --
Blablubbs (
talk)
10:04, 27 May 2022 (UTC)
They all fall onto the shoulders of a very select few, and I'm not at all sure how you manage without burnout. One thing I notice often is that the non CU request queue seems to get less of your attention, perhaps because it's lower down the list. Or is my perception incorrect? Oughtn't Duck cases to be somehow simpler, fewer folk involved?
I'm not "pushing" for anything except equality. There's no deadline for anything because those with the rights can correct many issues at a few keystrokes. I'm honestly not complaining. I think there need to be more of you guys. But that's true of all specialist areas of WP. So what is the real answer? 🇺🇦
FiddleTimtrentFaddleTalk to me 🇺🇦
19:09, 31 May 2022 (UTC)
@
RoySmith I think I deserved that hint! I have thought of it a number of times, and set the thought aside because I think my skills lie more in AFC. I suspect clerking requires a very tightly focussed attention to detail. I also might find folk were encouraging me towards adminship, something I have never aspired to, indeed I aspire to remain a run of the mill editor. 🇺🇦
FiddleTimtrentFaddleTalk to me 🇺🇦
19:19, 31 May 2022 (UTC)
I'm going to try monitoring this list more closely. I have CU tools so should be able to help out with any report that has CU requested. Frankly, though, most of the work falls on the clerks. Current clerks and future clerks, thanks for all the thankless work you do! --
Yamla (
talk)
19:31, 31 May 2022 (UTC)
Yeah, typically the backlog is at its highest in the Northern hemisphere summer months (late May-early September) then disappears around October after all the new CUs are appointed. Stays pretty low October through April, then gets high again in May.SPI has traditionally been driven by CU activity (clerks do have an important role, but CUs go through the cases without CU requests as well and check as needed, and this often clears those.) If you think about the demographic that get appointed CU, this kinda makes sense. It tends to be people who have been administrators at least a year, if not longer, and who are still active in the day-to-day activity of the project to the level that they're known and respected by the active editing community.That degree of activity typically doesn't last for more than a couple of years based on interests changing and real life happening. The Northern summer is usually a time of transitions in life, work, school, etc. Add in vacations, trips after 2 years of pandemic etc. it makes sense that "longer term" users like CUs would probably be less active now, and its my theory for why we see the pattern every year... also why I make a similar post to this every year.
TonyBallioni (
talk)
19:38, 31 May 2022 (UTC)
The button to open a report is broken for IP users
Hello,
I've just noticed that the button for submitting a report seems to have broken for IP editors. The button should only direct you to the talk page if you are opening a brand new investigation and need to create a new page, if you are adding a new section to an existing report then you can edit the page directly. I seem to remember that there used to be two boxes you could use which covered both possibilities?
192.76.8.78 (
talk)
13:27, 7 June 2022 (UTC)
Hmm,
[11] shows 33 cases with leading spaces. I see at least one,
Wikipedia:Sockpuppet investigations/ Kautilya3, that should be merged with the correct case (both were declined as baseless, but someone having been twice wrongly accused is a good thing to know), and I'm guessing that's not the only one. For resulting soft redirects, or ones created as a result of past moves/merges (which is most of the 33), my inclination is to delete any without backlinks. Does anyone else have thoughts on the matter? --
Tamzincetacean needed (she/they)20:21, 17 June 2022 (UTC)
Not a clerk, but FWIW that seems eminently reasonable. I might also suggest titleblacklisting leading-space SPI pages, or might that have unintended consequences?
firefly (
t ·
c )
10:39, 18 June 2022 (UTC)
Not sure what to do with this. A new article
Tylerbrizyy (musician) has been created, and it looks like a recreation of something deleted earlier after this AfD:
Wikipedia:Articles for deletion/Tylerbrizyy (hence I've requested speedy on it). At the AfD it was mentioned that its creator Tylerbrizyy was blocked as a puppeteer, and David DXL was also mentioned. This new article has been created by the latter, now twice. I haven't filed a formal case as I don't know if this is enough of a reason to, but I reckon something's ducky here. --
DoubleGrazing (
talk)
13:23, 1 July 2022 (UTC)
A single-minded interest in creating a spammy article previously created/defended by a bunch of socks? Sounds like the quack heard around the world - either sockpuppetry or meatpuppetry (e.g. paying someone else to create the article) which can be treated in identical fashion. Blocked without tags, closing. :)firefly (
t ·
c )
13:32, 1 July 2022 (UTC)
I've probably created a dozen SPI reports since I started editing here regularly and today when I did this, the "submit" won't go through. It kept bringing me back to an editing screen with no explanation of what the problem could be. I've gone through this now three times in case I was inputting the information incorrectly but I get the same response each time. Any advice? LizRead!Talk!02:48, 23 June 2022 (UTC)
It turns out that there was some interferences with "Bawl", an editing tool I installed some time ago. It kept insisting that I add a subject line and I didn't notice this was preventing the report from being submitted. So, I added a subject line that I just had to remove later. Just thought I'd keep this message here in case another editor runs into this problem with Bawl. LizRead!Talk!04:29, 23 June 2022 (UTC)
@
Doug Weller Thanks! (That's arb-, not SPI-clerk but I do a passing impression of an SPI clerk now and then too as a patrolling admin :P)
firefly (
t ·
c )
09:27, 7 July 2022 (UTC)
Oops, my bad. Good luck, before I was an Arb I was recruited as a clerk. The request to become one was quite a surprise! But that was long ago now. :)
Doug Wellertalk09:39, 7 July 2022 (UTC)
Bot to change mobile diff links to desktop diffs
I've seen a few SPI fillings that link to mobile diffs, and would a bot task to change to desktop diffs be useful? 0x
Deadbeef05:34, 10 July 2022 (UTC)
I've recently started becoming slightly active here at SPI, and noticed some peculiarities regarding how the backlog works here. Firstly, the list of unarchived closed cases seems to be well over 100 cases long, and includes cases that haven't been modified in nearly a month. I assume that every once in a while, a clerk begrudgingly does the tedious work of archiving these cases and clears out the list periodically. Is archiving closed cases a sufficiently straightforward and clear-cut task that we might recruit the help of a
bot to do it? Or is it something that requires subjective evaluation by a human or complex decision-making?
Secondly, I've noticed that the list of "open" cases contains a relatively large number of stale cases that have never had any edits made to them since they were originally created, with the list similarly stretching nearly a month back. Maybe they're just uninteresting cases. Maybe the requester gave very little info and therefore a lot of digging would be required by anyone that tries to handle the case. Or perhaps there just aren't enough people working at SPI to handle all the incoming cases. Anyway, I'm wondering what eventually happens to these stale cases? Is there a time limit after which they're just closed without comment? Or do all cases eventually get some kind of response from a clerk/admin/CU?
—ScottyWong— 15:04, 20 July 2022 (UTC)
Basically, "too many cases, not enough people working them".
Archiving requires human eyes. It's quality control where somebody looks over the case to make sure there's no loose ends. As a simple example, somebody might have said they were going to tag socks, but didn't. Once in a while when I was doing a lot of archiving, I would see something that just didn't seem right and ping the person who worked the case for clarification. Bogus cases get deleted under
WP:G6 instead of archiving.
The bottom line is we need more people working SPI. There's a list of people (some of whom are exceptionally qualified) who have applied to get clerk training at
WT:SPI/C. You could add yourself. And, looking at my fellow CUs, we really do need a better process for triaging applicants and getting the good ones trained up. In addition to the clerks, any admin is welcome to help out. See
WP:SPI/C#Admin_patrollers for details, although I'll admit that the instructions aren't wonderful. I got my start that way.
I have recently been having an exchange with
Somebody040404 in relation to a minor content dispute at
Languages of the Democratic Republic of the Congo. A new user called
JustSomeone08 had now made exactly the same disputed edit with an edit summary which is
almost verbatim what the other user added a few days earlier entirely separately
on my talk page. There is also an obvious similarity of usernames. I see that the two users also edit the same other articles (
12) on Congolese languages, often on the same days, sometimes only hours apart.
Although it is perhaps also unfair to raise this allegation, I also wonder whether the single-use account
TSHepo050302 is another sock of the same user given the similar edit history and naming format but I apologise sincerely if this is not the case.
In my view the filing should just be deleted. It's pointless as everyone involved has already been blocked/locked.
Spicy (
talk)
10:44, 25 August 2022 (UTC)
Advice needed: way too early for SPI, but they sure ring a bell
From those of you with more experience at this, what do you do if you think you've spotted someone you recognize, but it's *way* too early to have substantive evidence yet. For example, this editor only registered hours ago and they have
eight total edits, but they immediately reminded me of
Hopelesswiki. Now what?
Mathglot (
talk)
03:37, 30 August 2022 (UTC)
I assume you have at least some evidence because if there's no evidence at all, then it probably isn't right to be suspicious. In that case, you should file a SPI and request checkuser to investigate. Even if you don't feel there is enough evidence to warrant a check, you should file a case anyways in my opinion, leave it open, and monitor for future edits. 0x
Deadbeef10:01, 30 August 2022 (UTC)
To answer Deadbeef's question, yes, I do, but it's too thin to be sure or even have a well-founded suspicion yet. To Banner's point: the
pattern is completely stylistic and independent of specific pages or topics. I'll continue to monitor their contributions for the time being and see what develops, and if the pattern continues, I'll file. Thanks, all; this was helpful.
Mathglot (
talk)
17:47, 30 August 2022 (UTC)
I have a question. A throw-away account was created to commit one act of vandalism, which it did, and has been blocked. Is there a way to request that CheckUser determine who the sockmaster is? It was clearly a throw-away account created by a person who used it for a bad joke. If I had reason other than idle suspicion to guess who else had used that IP address during that time window, I could submit an SPI request, but I only know of one address, so I can't specify who else to check.
Robert McClenon (
talk)
01:51, 3 September 2022 (UTC)
Throw-away socks are a dime a dozen. If they're already blocked, it's not worth investing much effort to figure out who they're a sock of. --
RoySmith(talk)02:14, 3 September 2022 (UTC)
I think I've found another potential sock of
Jurrasic kid (
User:2019Rocks), but I can't find any previous cases involving them (Jurrasic kid) in the archives and I don't want to file it under the wrong name. Would it even be worth it to start an investigation, since 2019Rocks already blocked?
Asking for some guidance on somewhat speculative reporting. I've just come across two drafts at AfC,
Draft:Nuvoco Vistas and
Draft:Akhil Talreja, which were created by new users. Both articles (by which I mean, articles on these topics, not necessarily identical in content) have previously been created by socks. If I can't find any other connection to the earlier socks (ie. no similarity in eg. usernames), is the mere recreation of an article previously associated with socking enough of a reason to report to SPI? In other words, is it better to report 'just in case', or not to bother you guys without more evidence? Cheers, --
DoubleGrazing (
talk)
06:55, 17 September 2022 (UTC)
IP socking
I know that you don't usually connect IPs to accounts, but what are we supposed to do when we have good reasons to believe that someone is IP socking? Thanks.
M.Bitton (
talk)
23:00, 23 September 2022 (UTC)
I would like to know whether it is technically possible to perform an investigation between two users editing from two different countries. The reason why I ask this is because an admin of the Italian Wikipedia called
Ignis claims that user
Jacquesparker0 may have engaged in "POV pushing" on their project using my IP address just because we edited the same article about Margaret Singer. They seem to think that I'm a
sockpuppet or
meatpuppet of him. Of course I am not as I edit from Italy, which you can easily verify, but Ignis is absolutely convinced I am.
Here you can find the discussion. I'd be happy if you could clarify the point. Thanks.
151.31.243.65 (
talk)
15:38, 17 October 2022 (UTC)
OK, got it. But what can I do to prove that I'm not his sockpuppet as I've been accused of it, despite being Italian and despite this user don't even speak Italian?
151.31.243.65 (
talk)
08:36, 20 October 2022 (UTC)
MER-C: Based on behavior, article overlap, and the fact that someone else already made the decision of merging the cases before, these should all be dual-tagged with the same alternative master. I'm not looking forward to re-tag 171 accounts within 4 different confirmed groups, but I think you should consider all of them as part of the same group.
MarioGom (
talk)
21:19, 27 November 2022 (UTC)
Thanks. The merger is not critical, I've run the four categories separately. It's a lot of potential copyvio to go through but
WP:PDEL+G5 make a powerful combination.
MER-C19:15, 28 November 2022 (UTC)
Thailandhindi, as I asked in the SPI you filed: why? What has Sk5055 done that merits the use of the checkuser tool? And while we're at it, how did you, a brand-new user, file a sockpuppet investigation as your first edit?
GeneralNotability (
talk)
02:24, 3 December 2022 (UTC)
This user nominated an article from a popular profile, calling it clear propaganda. This leads to suspicion that this is a mother's account with a complete lack of information. Either the blind is shooting arrows in the dark.
Thailandhindi (
talk)
02:27, 3 December 2022 (UTC)
I see no such activity on the English Wikipedia, which suggests that this is a dispute from a different language Wikipedia. We are not going to take action here based on a dispute elsewhere. Raise your concerns wherever these issues are happening, not here.
GeneralNotability (
talk)
02:29, 3 December 2022 (UTC)
I maintain that MfD is an incompetent forum for authorising the deletion of LTA and SPI subpages without the involvement of an SPI clerk or checkuser.
I don’t think it is wise to allow random editors to blank LTA subpages. Precedent may be set by experienced users and admins that opens the door to others doing selective blanking for nefarious reasons. There should be some rule, and I suggest the rule that clerking of LTA be limited to SPI clerks. Alongside, I suggest serious consideration of the blanking of all LTA subpages, due to it containing more problems than useful resources, and it being abandoned by regular management.
SmokeyJoe (
talk)
02:13, 4 December 2022 (UTC)
For beavering away in a thankless area, creating order out of chaos, this award is for all who undertake the detailed task of nuking sockpuppetry, and most particularly for the current low level of backlog of SPI reports 🇺🇦
FiddleTimtrentFaddleTalk to me 🇺🇦
17:33, 13 December 2022 (UTC)
Would it be useful to look for patterns which might indicate potential socks, such as rapidly making exactly ten edits then becoming dormant, or would that constitute unwarranted fishing? I understand that any such trawl would include false positives from good-faith editors and require corroboration from other activities before meriting any sort of investigation.
Certes (
talk)
15:11, 15 January 2023 (UTC)
@
Certes: When I was very active in NPP, I came across a lot of users like that. In my guess, 85% of such users are returning editors, 2% new ones read about it on wikipedia itself and then go dormant till becoming auto confirmed, 8% seem to read about it somewhere else with searches like "how to publish article on wikipedia", and get a normal idea. Around 5% are genuine/goodfaith editors who simply cant/dont edit after one or two days for whatever reasons. Even though the 85% are returning ones, it is extraordinarily difficult to guess who the master is. —usernamekiran
(talk)15:48, 15 January 2023 (UTC)
Thanks. Of course, the 85% have various motives, and it's hard to tell good from bad sleepers who, by definition, haven't provided evidence either way. If it's in hand, well done; I'll leave you to it and not ask for
further details.
Certes (
talk)
20:21, 15 January 2023 (UTC)
Help
Hello. I do not know how to handle all this sockpuppetry investigation stuff. However, I strongly suspect
Mysteronfax and
Historian442 of being sockpuppets of each other. They only edit one article,
Jerome Sinclair. They have both been editing only since January 8, 2023 at the EXACT same time. They mirror and back up each other in debates, such as
the ones on this talk page. On that page, they responded to the previous commenter within minutes apart, on two (four) occasions! It's clear as day they're sockpuppets, I just don't know how to get them banned.
Paul Vaurie (
talk)
09:07, 18 January 2023 (UTC)
Paul Vaurie Note that there is a difference between a
ban and
a block. I think you are referring to a block. If you are having difficulty making an SPI report, it may be easier for you to do if you enable Twinkle in your account Preferences; Twinkle is a gadget that makes most reporting tasks easier to carry out.
331dot (
talk)
09:28, 18 January 2023 (UTC)
Mz7 (bot) will no longer add pages in the User or Template namespaces to the SPI case table even if the template {{Checkuser needed}} is placed on them. There is currently an issue where adding the CU needed template to a page will cause the bot to add all pages that transclude that page to the SPI table as well. Since
more than a hundred pages transclude
WP:AIV, for example, this resulted in an overwhelming amount of duplicate entries in the table when it was used there—see
[12] for an illustration of this issue. Off the top of my head, I could not think of an easy solution to skip these sorts of "nested" transclusions directly, so I decided to implement this solution instead. Almost all pages that transclude pages like
WP:AIV are in the User and Template namespaces, and it seems unlikely that a legitimate use of the {{Checkuser needed}} template will occur in those namespaces. Please let me know if you notice any other issues with the bot. Thanks,
Mz7 (
talk)
22:52, 31 January 2023 (UTC)
Are Izaaqnewton and Mark Mulwanyi linked or one and the same master?
At some level, no, it doesn't really matter. But having the histories combined can provide a better baseline for future comparisons. Is there something specific in the archives that you noticed which makes you think they're the same? You're not the first person to suggest they might be connected; I can't disclose the details, but the possibility is discussed in the cuwiki notes. --
RoySmith(talk)14:43, 7 February 2023 (UTC)
RoySmith The problem is that I just have a feeling about it. Each sock farm is likely UPE specialising in Hamis Kiggundu. Kiggundu is a wealthy Ugandan, and unlikely to need a sock farm nor UPE to qualify for an article here, but every edit by this growing (pair of?) sock farm(s) is promotional. They even created an article about HK on Wikiquote!
I suppose it comes down to my not liking to be fooled, in the same way that SPI folk dislike attempts to fool them, coupled with a desire for loose ends to be tidied away.
All this is way above anything I have a right or a need to see. I suppose I am also wondering what level of a "more than suspicion" is required to trigger someone being authorised to get the drains up and have a good dig about. I think my mind has more than "It's a fishing expedition" in it, but concrete things without admin goggles are hard to assemble into a case 🇺🇦
FiddleTimtrentFaddleTalk to me 🇺🇦
16:18, 7 February 2023 (UTC)
Being suitably coy is never a bad thing in this delicate arena. I'm glad there are rules which bind us against going fishing, though sometimes frustrated by that concept in equal measure. 🇺🇦
FiddleTimtrentFaddleTalk to me 🇺🇦
16:45, 7 February 2023 (UTC)
Just a note that the CheckUser queue on
the Account Creation Interface is backlogged: currently at 36 requests and four weeks. If any CUs have some spare time, processing some of these would be much appreciated. (Noting this here because I figure a bunch of CUs have this watchlisted and I can't think of anywhere better. :) ) —
Mdaniels5757 (
talk •
contribs)
17:19, 8 February 2023 (UTC)
The first investigation is by me in which I wrote "All first four accounts are created in interval of 2-3 hours at the same day and I think that they all are about same user because they all regularly create unsourced and one sentence articles about towns and villages in
Uzbekistan.", second is by
@User:Bbb23 in which he wrote "Generally, this involves the creation of drafts/articles on Uzbekistani topics, mostly places and mosques. There are a slew of users who create the drafts, and then usually the master or Dilshod's project move the drafts to article space. The master and Dilshod's project also create pages on their own, and sometimes the other users also create pages directly into article space on their own. Occasionally, the master and Dilshod's project edit the same pages. With the exception of the master, all of the accounts were created at roughly the same time. I'm requesting a check to confirm and also to look for other accounts. I found most of the suspected socks from following the history of the pages in the masters and Dilshod's project's history, but I don't think I found all of them." and third is by
@User:Onel5969 in which he wrote "Okay, not sure exactly what this is, but these 6 editors, 4 of them created in the last day or two, went on a stub-spree today. Each of them created about 20+ articles on Uzbekistan subjects, using the exact same sourcing and framework. Not sure if its the same editor or not, but I thought perhaps it might be worth taking a look at. I'll provide a link to one article from each of them, but as I said, if you look at their contributions, each did quite a few. Here are the articles:
To'xtaboyvachcha Mosque,
Tillasheykh mosque, [Qambarboyvachcha uy Mosque]],
Chor Xaros Mosque (although that one's a little bit different, but same subject matter from a recently created account, but it's their only creation today),
Uzun Hovuz Mosque, and
Tinchob Mosque." and the similarity of these all three investigation is that the suspected users of this investigation creates articles related to Uzbekistan which means that this all investigations is about one subject and should be merged.
Thanks for the ping, but I don't think I can help with this. I'm not entirely sure, but this seems like it would require a histsplit to unwind the histories of the two cases.
Spicy (
talk)
16:12, 30 March 2023 (UTC)
Yeah, I was thinking that it might take some special tools, which I probably have, but don't know how to use properly. Hopefully one of the adminclerks above can help. I've gotta be more careful...
GirthSummit (blether)16:25, 30 March 2023 (UTC)
In short,
this edit was a goof, and needs moving back over to where it came from. I could have a stab at it, but don't want to make matters worse by cluttering the histories if I mess it up.
GirthSummit (blether)17:44, 30 March 2023 (UTC)
Done, although please note that we have a perennially lengthy backlog at
Wikipedia:Sockpuppet investigations. I would not encourage editors to request attention at specific cases on this talk page unless there is something truly urgent, lest this talk page overflows with such requests. Thanks,
Mz7 (
talk)
23:17, 13 April 2023 (UTC)
Now already dealt with. Thanks for bringing this to our attention; in the future, please use
WP:AIV to request attention against obvious vandalism such as this. More administrators watch that page, and this page is more for discussing the sockpuppet investigations process itself rather than for reporting sockpuppetry. Thanks,
Mz7 (
talk)
01:21, 9 May 2023 (UTC)
It's showing up for me. You might need to purge the page or find the underlying template and purge it directly, or just try a hard refresh.
Ivanvector (Talk/Edits)
17:15, 16 May 2023 (UTC)
Hi, the user I think is sockpuppeting hasn't bothered to make an account this time and seems to be just using a IP address. How do I go about reporting it in this case? I believe it to be
Brogo13 – Mesidast (
talk)
19:03, 17 May 2023 (UTC)
I was just browsing the list on the main SPI page and was wondering why there are some SPI investigations listed that were last actioned in February, March and April. I know that your schedules are full of SPI cases to investigate so it seems like these older ones should have aged off the list at this point to make room for new cases. I can't imagine there are still cases that have been left open for 2 or 3 months so I guess I'm just wondering what bot moves cases along (and off) the list on this page. Thanks. LizRead!Talk!21:52, 25 May 2023 (UTC)
The only thing a bot does is build the big table broken down by case status. Cases don't actually change status until a human makes the change. And once a case is closed, it doesn't get archived until a clerk or CU gives it a final look over to catch any problems. You're right that things are backed up. They often are at SPI. We'd be happy to have more admins helping out with the caseload (hint, hint). --
RoySmith(talk)22:53, 25 May 2023 (UTC)
Backlog update?
Hi all, I know there's a backlog and admins must be flooded with things to do, but is there a chance that some of the oldest open SPI cases will be evaluated in the near future? I'm asking because one of the suspected sockpuppets I reported back in May (
here) hasn't been looked at yet but is still very much active and continues to disrupt multiple articles, so I'm considering bringing a report to
WP:ANI, but I really think it would be better dealt with here first (it seems to me a fairly blatant case of
WP:BLOCKEVADE). Thanks for any advice and/or update on where things stand.
R Prazeres (
talk)
17:53, 22 June 2023 (UTC)
@
R Prazeres if it is urgent to be dealt with I would suggest taking this to
WP:ANI or
WP:AIV.
WP:SOCK can handle complicated cases, but in the cases of clear disruption using other processes is likely to be a lot quicker. Determining if they are a sock can be done after the block for the disruption.
Dreamy Jazztalk to me | my contributions20:30, 22 June 2023 (UTC)
Thanks for the feedback. That's what I was starting to think, so I'll keep this in mind now for next time. And thanks for going ahead and performing the CheckUser operation in the meantime. Cheers,
R Prazeres (
talk)
21:51, 22 June 2023 (UTC)
A user has made a few weird removals of data about himself, mostly from talk page archives, claiming that he is "archiving" something. The data is mostly SPI-related stuff about the person "archiving" the data. Do we just revert?
No, I'm sorry. I believed this is a G3 or G5 case, but I'm not sure. So I turned to MfD. I didn't have enough experience about that.
-Lemonaka11:51, 24 July 2023 (UTC)
I'm not sure why you think that. Onlinenow was created in 2005, and Billy Hathorn shows as created in 2013, but that's actually not true and no doubt has to do with account unification; in any event, their first edits were in 2006.--
Bbb23 (
talk)
19:44, 13 August 2023 (UTC)
You'd have to ask the various admins and CUs involved in the case back in 2021. It's pretty messy to look at. All I know is there's no case for Billy anymore but instead for Onlinenow, and no one seemed to care much about the tagging issue.--
Bbb23 (
talk)
17:40, 14 August 2023 (UTC)
I'd say there's a strong correlation between "it's a year and a half old" and "nobody seems to care much about the tagging" :-)
RoySmith(talk)17:48, 14 August 2023 (UTC)
Backlog notice
A while ago
RoySmith made a request at
WP:AN for more administrators to patrol SPI to help out with what he described as a seasonal backlog. One administrator - forget who - thought it would be a good idea to put up a backlog notice on the SPI page like the ones you see at AIV and RFPP. I think it should be removed. First, those notices at other boards are handled by bots so they are added and removed when some algorithm decides they should be, whereas the notice at SPI will only be removed if someone decides it should be removed, and there don't appear to be any agreed-upon criteria for when it should be placed or when it should be removed. Second, based on past experience there will almost always be a backlog at SPI in one category or another, so what's the point? I doubt it will attract any admins who don't already patrol SPI anyway. Is it supposed to "shame" CUs or clerks to be more active? We don't usually do that - and with good reason. Anyway, I think it should be removed as valueless.--
Bbb23 (
talk)
11:34, 8 August 2023 (UTC)
It will hide automatically after
Category:Open SPI cases drops below 100 pages (as of the time I'm writing this, it's at 124). I'm personally not bothered by the template, and I understand its intent as trying to recruit more administrators rather than guilting CUs/clerks into working harder, but at the same time, I am somewhat skeptical of its effectiveness (how many of us actually look at
Category:Administrative backlog?).
Mz7 (
talk)
21:40, 8 August 2023 (UTC)
I briefly looked into how we can get rid of or change the misleading language in the template that says "change this to {{no admin backlog}}", but it seems
the template is pretty inflexible there at the moment.
Mz7 (
talk)
21:45, 8 August 2023 (UTC)
I think I was the one that added it. My goal was to get this page into
Category:Administrative backlog, which myself and some other admins patrol when looking for things to do. If the visible template is the problem, a solution might be adding a parameter to the template to turn off its visibility while still placing the category, or just replacing the template with the category. Also, it's not meant to be a badge of shame or anything like that. It's used all over Wikipedia, and in a lot of places whether it is shown or not is automated by feeding it a count of how many of X are open (using a template/module usually) over Y threshold. Hope this helps. –
Novem Linguae (
talk)
22:58, 8 August 2023 (UTC)
FWIW I look regularly at CAT:AB, and I'm quite sure I'm not the only one. But also, once you've been around the various admin noticeboards a bit, you'll realize that SPI and CCI are essentially permanently backlogged; not through any fault of the editors who work those venues, but because of the persistent and prolific nature of copyright problems and sockpuppetry. As such it's not a bad idea for SPI to be appearing in the backlog, but also any regulars who check on where admins are needed already know that SPI always needs admins. Vanamonde (
Talk)00:09, 10 August 2023 (UTC)
It's gone now. As a clerk, I am fine with the notice. If I get a bit nitpicky, I would say cases awaiting archive should not count towards the notice threshold though. It's a harmless category, and non-clerks should not come in to archive cases anyway.
MarioGom (
talk)
06:24, 21 August 2023 (UTC)
AFAICT, closed cases (I assume that's what you mean by "awaiting archive") do not count. I believe it's the only category that doesn't count.--
Bbb23 (
talk)
12:03, 21 August 2023 (UTC)
Personally, I think 100 was a good threshold. I feel like SPI is above 50 cases for the wide majority of the year, but all I have is anecdotes. One of these days I've been meaning to write something that can parse the history of
Wikipedia:Sockpuppet investigations/SPI/Cases and get historical data on backlog size, and this could be a good excuse to work on that.
Mz7 (
talk)
06:13, 24 August 2023 (UTC)
Could someone (anyone but I'll ping two) tell me (1) what cases are now counted toward the backlog (use the terminology in the SPI table, please) and (2) what the threshold number is? @
Bradv and
Dreamy Jazz:--
Bbb23 (
talk)
13:12, 22 August 2023 (UTC)
It's currently all pages in
Category:Open SPI cases, which is to say all of the cases in all categories currently listed in the table on the page (including closed cases). The threshold is 100, but that number includes 18 subcategories, so really the threshold is 82. I propose to change this to exclude closed cases, as those are the responsibility of SPI clerks and do not constitute an administrator backlog, and to reduce the threshold accordingly. –
bradv14:02, 22 August 2023 (UTC)
According to the existing formula the current count is 113, including 18 subcategories. If we remove closed cases from that count the current number is 62 (again including 18 subcategories). If we agree that the board is currently just on the verge of being backlogged, we can set the threshold at 50 + 18 subcategories = 68. Does that make sense, or should it be lower/higher? –
bradv14:50, 22 August 2023 (UTC)
I'm woefully ignorant of the mechanics of all this. What do you mean by "subcategories"? As a general principle, though, I'm in favor of a higher threshold.--
Bbb23 (
talk)
14:57, 22 August 2023 (UTC)
Okay I'll just make the change and we can discuss here going forward if the backlog notice is showing up at the appropriate times. –
bradv16:21, 22 August 2023 (UTC)
Absolutely. We might even be able to make the backlog notice ping you when it pops up so you don't miss the next discussion. –
bradv18:10, 22 August 2023 (UTC)
Unity360 and Plant360
Hi. I suspect that these two accounts were operated by same person because of editing pattern. I didn't filling a SPI for these users yet because I didnt notice any disruptive edits by these editors. So, I bring this up here for better suggestions. Thank you !
Fade258 (
talk)
07:03, 24 August 2023 (UTC)
The edits themselves don't need to be disruptive as socking itself is defacto disruption. Regardless, I've already blocked and tagged the accounts. They have large dynamic ranges available to them so they'll be back.--
Ponyobons mots16:28, 24 August 2023 (UTC)
I've been debating whether to TfD this talk page notice and thought some feedback from SPI regulars would be useful. This template essentially duplicates the functionality of {{Socksuspectnotice}} (the old yellow box talk notice), which was removed from twinkle and deleted last year following a request
[17].
I think most SPI regulars would agree that notifying people that you've spotted they're a sock is at best unproductive and at worst results in a significant amount of disruption. Having the suspected sock show up to engage in 200k of "You're a sockpuppet" "no I'm not" arguments is a waste of time for everyone involved. In my experience most of the people who use these notices are newcomers who don't realise how unproductive the notices are.
Does anyone have any thoughts on whether this template is actually worth keeping? I think it would probably be better for clerks/checkusers to invite people to an investigation when they are needed, rather than doing it relativley indiscriminately with twinkle/redwarn.
192.76.8.91 (
talk)
14:26, 10 September 2023 (UTC)
Hello fellow CUs and SPI folk! I'm unravelling
Wikipedia:Sockpuppet investigations/Amansharma111 and will definitely need more hands on deck. This is a massive UPE sockfarm that is using proxies extensively to create multiple accounts and articles daily. Cross checks are going to be needed as every check I make, more socks fall out. I've been heavy handed with the G11 and G5 deletions and have now started protecting some targets in article space as they typically create a draft then move it themselves to article space. It may be a good idea to loop in
WP:NPP and
WP:AFC to catch them early (
Wikishovel seems to have picked up on their pattern, which is helpful). Also, we'll need to shore up the proxy/P2P blocks. All of my checks will likely need to be rerun as I was unaware of the scope of the socking yesterday when I first starting checking the accounts. --
Ponyobons mots17:02, 22 September 2023 (UTC)
@
Uhai: I'm deleting what you wrote so as to avoid giving our socks information about what we know so they can improve their game and help avoid detection. I'm going to revdel that in a moment. I know that's really pushing the limits of what revdel is for, but I plead
WP:IAR and authorize any admin to revert my revdel if they feel I've overstepped my authority.
RoySmith(talk)23:24, 22 September 2023 (UTC)
The individual(s) involved in this sockfarm do not seem to be particularly intelligent, so I wouldn't be too worried. If this was a more devious sockfarm or LTA, I wouldn't have said anything.
Uhai (
talk)
09:06, 23 September 2023 (UTC)
I just
filed a SPI prior to seeing this. I realize I have no tools to search like you do so just laying this out there. The SPI I filed involves a user with similar styled username. Not sure if this would part of the same group or not. --
CNMall41 (
talk)
22:34, 22 September 2023 (UTC)
Since it is a globally locked user, and there are cross-wiki creations (on simple wiki), global locks should be requested. I have no time to do that now though.
MarioGom (
talk)
08:36, 24 September 2023 (UTC)
Indef block of IP?
@
Tamzin regarding your quick request on 60.242.166.182, I'm curious how many indefs you've found on IPs. I would think (hope, anyway) those would be exceptionally rare.
RoySmith(talk)17:29, 28 September 2023 (UTC)
Interesting. I see a few marked
per request of <school>. I'm surprised we would be placing blocks at the request of outside entities. If a school wants to forbid their students from editing, they can implement it in their firewall. No reason we need to be complicit in that.
RoySmith(talk)18:11, 28 September 2023 (UTC)
Don't have it readily available, but I know at some point there was a consensus against such blocks. I think it can be reasonable to take network sysadmin request into account when it's already within admin discretion to block (e.g. a moderate level of vandalism), but it shouldn't be the only reason, and in any case shouldn't be indef.As to my own look through the category, you can see a few IP indefs I reversed at
Special:Log/block/Tamzin (sorry, imprecise link; on mobile and in a rush). Two or three others were reversed by the blocking admin at my prompting. --
Tamzin[
cetacean needed (she|they|xe)
18:38, 28 September 2023 (UTC)
You can also get a half-decent up-to-date listing via
Special:BlockList, including partial blocks which have probably been forgotten about. There was an amnesty for indef-IPs a few years ago at VPR (
archive link), which used an upper length of approximately 10 years. I haven't seen it cause any subsequent problems. --
zzuuzz(talk)21:20, 28 September 2023 (UTC)
A lot of the proxy blocks from 2006 are still valid, which can be easily noticed because of the AS (e.g. SoftLayer). We should probably reblock these as long-term {{webhostblock}} though.
MarioGom (
talk)
07:24, 1 October 2023 (UTC)
I've changed
Wikipedia:Sockpuppet investigations/JoinFluffy250 to Clerk status but thought it prudent to drop a note here as well. I've blocked several socks, some of which were being used over a long period to vote in and, in some cases sway the outcome of AfDs. Extra eyes would be appreciated to untangle the deceptive edits.--
Ponyobons mots18:15, 6 October 2023 (UTC)
Phallic edits
Rehashing this from the Incidents Noticeboard:
I have noticed that numerous IP addresses and accounts that have been posting pornographic imagery mostly involving phalluses for the past few months appear to have characteristics that suggest that they are based in Sweden and are the same person (same nature of images and threats of police action to impose their edits). Is there a possible way to pinpoint the exact location and to determine how extensive is this possible sockpuppet network?
Borgenland (
talk)
16:01, 6 October 2023 (UTC)
This probably doesn't help much but this is almost daily vandalism, if not several new users/ip's a day. Just found one,
Ghjkghjkasdf (
talk·contribs) and that's at least the second today. I'm on Wikipedia every day (lots of free time) so I see a lot of them but there are more that I don't see.
Knitsey (
talk)
16:06, 6 October 2023 (UTC)
Haven't encountered that vandal yet. There was one time that certain users used Swedish words and made similar threats to call cops (that was the exact term they used) and the tended to post a picture of a Swedish-labeled can in place of a phallus.
Borgenland (
talk)
16:20, 6 October 2023 (UTC)
@
Borgenland: I know the one you're talking about. They post a series of pornagraphic photos?
I think there are maybe 3 lots of 'porn' vandals.
Cheeizy (who posts a long series of photos, Fuerdai who usually includes something about testicle going up and down along with a single photo and the ones who sometimes post on Swedish(and sometimes German) articles with a single photo and summary about call the cops.
Knitsey (
talk)
16:33, 6 October 2023 (UTC)
Now I'm thinking of the one who always posts interiors of metro stations, usually escalators. I've gone down the rabbit hole now.
Knitsey (
talk)
17:50, 6 October 2023 (UTC)
Knitsey, for what it's worth, the person who posts a long series of photos, and the one who posts in Swedish with the same photo and calling the cops, is the same person, Cheeizy. --
Ferien (
talk)
06:18, 9 October 2023 (UTC)
Are editors supposed to be forewarned or informed of SPIs against them?
I have stumbled into a link to an SPI against me completely at random while reading a section in Arbitration/Requests/Enforcement. Shouldn't I have been pinged or informed on my talk page or something?
JM2023 (
talk)
02:41, 15 October 2023 (UTC)
Notifying "by default" is something we've generally discouraged.
This thread concerning removal of the autonotification option from Twinkle's SPI module, which happened two years ago at the request of SPI regulars, explains some reasons for that. I also touch on it in an essay
here. This may seem odd given that many of our conduct noticeboards do have notification requirements, but SPI is a bit of a different animal because it essentially serves as a highly structured fact-finding mission as opposed to a community discussion venue. --
Blablubbs (
talk)
10:35, 15 October 2023 (UTC)
I'll also note that the standard SPI templates such as {{checkuser}} deliberately display usernames in a way that suppresses pings. Users get explicitly pinged when whoever is working the case needs some specific input. BTW, just to save people some time, we're talking about
WP:Sockpuppet investigations/JM2023RoySmith(talk)16:13, 15 October 2023 (UTC)
UPE studio spam ring - FYI
If any CU is up to it, I've come across a large (has there ever been any other size?) UPE studio spam ring. Start with a check on FilmyTV, then run a "get edits" on the IPs showing multiple users. I'm heading out in a moment or I would continue pulling the threads and watching the socks unravel.--
Ponyobons mots18:43, 24 October 2023 (UTC)
Investigations of accounts with no known master
Sometimes accounts are suspicious solely because they are doing something only experienced editors would do on their first edits, or their usernames suggest LTA, but no master is known. The existing format of SPI is not conducive to requesting investigations of these accounts as the format presumes there's a suspected sockmaster. I think we should have a different process for investigating these sorts of cases.
Jasper Deng(talk)00:05, 29 October 2023 (UTC)
I don't think there should be a formalized procedure. In other words, it should not be done at SPI. In practice, most editors contact a CU, either on their Talk page or privately, depending on the kinds of suspicions one has. I've also seen editors use {{
Checkuser needed}}.--
Bbb23 (
talk)
00:53, 29 October 2023 (UTC)
I'll offer a different opinion. I'd rather see an SPI opened, where it will be looked at by the next available sockwalla. It's not a big deal if you file it under the new account name and it ends up being merged once the correct sockmaster is identified. When somebody asks me on my talk page to investigate a sock, I'll almost always request that they file an SPI unless it's from somebody I know well and whose opinion I respect. But that's just me; I know other CUs welcome direct requests.
RoySmith(talk)01:07, 29 October 2023 (UTC)
I agree with Bbb23. I don't think it's a good idea to make requests for discretionary checks at SPI because not all CUs are open to running these sorts of checks and if the check doesn't turn anything up, the SPI page is useless. Also, some people have good instincts for spotting socks, but a lot of people don't, and I think having a formal process for this would lead to a lot of baseless requests.
Spicy (
talk)
13:46, 29 October 2023 (UTC)
"doing something only experienced editors would do"... it's possible to gain plenty of experience as an IP and then create an account. Unless there's more to the suspicion, i.e. a sockmaster, there's nothing to act on.
Cabayi (
talk)
14:11, 29 October 2023 (UTC)
And there are plenty of reasons to create a new Wikipedia account that are well within policy. "Acting like an experienced editor" is simply not grounds for opening an SPI case. I think cases without master might occasionally be valid, but I think we should strongly discourage them unless we want even more people to resort to SPI for things they should use AIV, ANI or other venues.
MarioGom (
talk)
17:18, 29 October 2023 (UTC)
Let's put it in another way: if I see two accounts in a case, I can usually make a good call about whether there's
WP:ILLEGIT use or not. If there is a single account, it is one of the following: a) disruption is enough to issue a block without any sockpuppetry investigation or b) it might be possible but very hard to make a call on whether there's
WP:ILLEGIT use or not.
MarioGom (
talk)
17:22, 29 October 2023 (UTC)
I agree that SPI isn't well suited for these sorts of CheckUser requests. My recommendation has been and is to contact a checkuser privately if you suspect that an account is a sockpuppet but are not sure who the sockmaster is. You can simply email a checkuser via
Special:EmailUser for this, or alternatively use the VRT queue at checkuser-en-wpwikipedia.org, with the understanding that not many checkusers actively look at that queue. User talk pages are also okay if all of the evidence is on-wiki.
Mz7 (
talk)
04:39, 30 October 2023 (UTC)
I've been wondering about this myself since sometimes it can be hard to pin down who the sockmaster is. A few LTAs show some behavioral overlap, but also know how to change IPs.
TornadoLGS (
talk)
18:16, 1 November 2023 (UTC)
It's also worth mentioning that if an account is being abusive, that's enough to block them on. Figuring out who they're a sock of (or if they are a sock at all) is secondary.
RoySmith(talk)20:35, 1 November 2023 (UTC)
Fair point. I guess just recognizing it as LTA/socking just gives it a higher priority. Though I know one LTA, known for playing the AGF card, once managed to trick an admin into unblocking them. But I figure that's a rare occurrence.
TornadoLGS (
talk)
02:12, 2 November 2023 (UTC)
Would this situation be an appropriate time to file a SPI?
I'm almost certain that I've found a connection between two accounts, and it was being used as a
WP:STRAWSOCK. The problem is, the sockpuppet was used for only two edits, and that was a few months ago. They were being used abusively (unless, of course, it turns out that they aren't related) but I don't know if too much time has passed since the violations. Any advice? Cheers~
Relativity
02:04, 3 November 2023 (UTC)
If more than a few months have passed since the account's last edit, it's unlikely that any CU information would be available, so it would be difficult to come to a conclusion. Probably not worth it for two edits months ago.
Spicy (
talk)
09:07, 3 November 2023 (UTC)
Just to expand on what Spicy said, even if we could prove they were the same,
WP:BLOCKP says "Blocks should be used to ... prevent imminent or continuing damage and disruption". If nothing's happened for several months, it's hard to argue that blocking them would meet that requirement.
RoySmith(talk)03:02, 5 November 2023 (UTC)
Repeal/replace the ban on admin SPIs?
In the past 2 months, we have had 3 administrators desysopped under circumstances relating to sockpuppetry: CorbieVreccan and Mark Ironie in August (resigned facing ArbCom inquiry about meatpuppetry) and Lourdes this month (resigned facing ADMINCOND inquiry, then self-outed as a sock of Wifione).
Pound for pound, maybe, but the past few months show that sockpuppetry is a significant concern among admins. There was also Eostrix two years ago, who came within inches of getting adminship as a sock of a globally banned user.
Admins are more likely to draw spurious reports
This is true of all users involved in anti-abuse efforts; we do just fine handling spurious reports against others through
G6 speedy deletions and warnings or blocks of reporting users. Plus this only moves the spurious reports to other venues such as
AN/I.
This is not a serious concern in many cases (particularly meatpuppetry), and even when it is, that's not a line of reasoning we use anywhere else. Even when an admin has made a massively bad block—prima facie evidence that they are at high risk of further abuse of the tools—we don't insist that the matter be discussed in private. Rather, public AN or ArbCom filings are the norm in such cases. Rouge-ness is also much less of a concern these days, as most admin abuse can be prevented by block.
ArbCom handles these cases just fine
Empirically, in the Mark/Corbie case, they did not,
as acknowledged by multiple arbs after the community bounced the case back to them following their initial decision not to impose sanctions. This isn't a criticism of the people who volunteer a lot of time and emotional energy for the thankless job of arbitrator, just an acknowledgment of dynamics: Arbitrators are not generally experts in investigating sockpuppetry, and the fewer eyes there are on an investigation, the more things are likely to slip through the cracks.
Furthermore, the focus on administrators is strange and gives an impression of us being above the law. It doesn't even make sense in terms of avoiding abuse: Many of the worst things an admin can do, a bot operator or template editor can do as well.
In light of all this, I would propose either removing the line outright or making the following change:
This draws more eyes to the case, both ensuring that spurious reports will be handled promptly (since all arbs have clerk powers as CUs) and that ArbCom will be aware of any risk of rouge-ness. Personally I have a slight preference for removal, though. Enough arbs watch SPI pages, and enough admins/clerks know how to get in touch with an arb on short notice. --
Tamzin[
cetacean needed (they|xe|she)
15:55, 6 November 2023 (UTC)
In my view, the rule shouldn't apply to reports filed, or endorsed (not in the CU sense, but in an "I think this is legit" sense), by a CheckUser. With that change, it seems to serve a useful purpose. I defer, though, to my functionary colleagues, some of whom I know have been discussing this. Best, KevinL (aka
L235·t·c)
00:07, 7 November 2023 (UTC)
(
edit conflict) I actually brought this wording up on the functionaries mailing list a few months ago following
this edit request to the header. One interesting bit of history I learned was that part of the original reason for this idea to report admin socking discreetly was the fact that it used to be impossible to truly block a rogue administrator without desysopping them, which could take a while (a bureaucrat or steward needs to be awake). Historically, administrators used to have the ability to unblock themselves in all cases; nowadays, this is no longer the case: blocked administrators can no longer unblock themselves unless they were the ones to place the block (as a safety precaution against compromised accounts, blocked administrators can still block the administrator that blocked them). Basically, we wanted to keep suspicions of admin-socking discreet to make sure that a rogue administrator, upon learning someone is onto them, doesn't cause a severe amount of damage to the encyclopedia. As times have changed, I find that I don't really have a solid counterargument here against transparency. If this provision asking editors not to publicly report admin socking is a relic from the past when we didn’t have as safeguards like not being able to unblock oneself, then I am on board with simply removing the line and allowing administrators to be reported on-wiki at SPI like anyone else.
Mz7 (
talk)
00:10, 7 November 2023 (UTC)
While I am not sure how I feel about the proposal overall, I'm not finding the cited examples particualrly compelling.
Nobody that I am aware of expressed a suspiscion that Lourdes was Wifione, and from what I understand, CU would not have caught the connection either. (As an aside, I've always found it a bit odd that admins get
WP:IPBE automatically whether they need it or not. Obviously I have not myself ever run a check on the Lourdes account, but from what I do know they may have benefited from this, using proxies to appear to be somewhere Wifione, from what we do know of them, wouldn't have been.)
Corbie and Mark were not hiding what they were doing, at all, in the errant belief that the committee had previously agreed to look the other way in perpetuity. That being the case, it probably would have had to go to the committee anyway so that aspect could be investigated. That case to me fell into the rtealm of "admins who were elected back in the early days and just have wrong or outdated ideas about how things work in the modern environment." This is a regular feature in admin conduct cases, whether they involve sock/meat issues or not.
Eostrix was caught by the committee, before they could become an admin. In that case, again, I think the committee was in fact the best place for that specific investigation. Obviously I can't go into details (I don't think I could remember them all at this point anyway) but the person behind that account is one of the worst long-term-abusers around, and those details I spoke of are not public knowledge, and also not known to the abuser, exactly because the committee handled it.
I'm really not trying to dog your proposal, I certainly do agree with the idea that admins are not supposed to be above the law, in particualr with regard to bedrock policies like socking, I'm just not sure this change would have prevented any of the speific cases you cited.
Beeblebrox (
talk)
00:53, 7 November 2023 (UTC)
I'm not meaning to say that any of these cases would have gone differently if this procedural rule didn't exist. Now, I can tell you that in pursuing the Mark/Corbie case the rule gave me significant pause, and again did lead some commenters to suggest the case had been thrown out. (I didn't realize then, and I suspect they didn't either, that the rule doesn't actually apply outside of SPI. But how it's perceived is what matters.) There was also of course the SPI previously filed against Mark and Corbie. Its deletion was partly due to oversightable information, but the no-admin-SPI rule foreclosed the possibility of redacting it and continuing on-wiki. After an unresolved behind-closed-doors review by the functionaries which apparently gave Mark and Corbie the impression that they had done nothing wrong, several years of meatpuppetry followed. As to other cases, I have no idea. Maybe Eostrix would have been caught faster, or maybe Lourdes would have been caught by someone other than herself, if there were less of a taboo against reporting admins for sockpuppetry. Or maybe not. My point is to show that these things do happen, fairly regularly, and that the current system has been slow at catching it. --
Tamzin[
cetacean needed (they|xe|she)
02:23, 7 November 2023 (UTC)
Coming back from the void on this as I've dealt with admin socking before, and I think the current system works well. I'd oppose this proposal on two grounds:
1) the law of least dramah. Admin socking cases create a ton of drama and if a case was filed SPI would not really have the capacity to handle it based on the design of the page (anyone who has seen an SPI with a ton of back and forth will know they linger forever because they're skipped.)
2) ArbCom is all CUs but most of them don't use it and you're more likely to have a thorough investigation done by a non-arb CU who will then ask for a concurring opinion from a second non-arb CU, who will then pass it to ArbCom where the arb CUs will look at it and report their thoughts to the committee. You could email the committee first, but it would likely eventually get passed to the ground level at some point, and it would take more time to reach a result. If the goal is to get a socking admin out, the best way really is to email a CU whom you trust who is active in sock investigations.
I agree with Beeblebrox. Further, there is a power dynamic aspect. Admins are hesitant to block other admins. Plus, what if you get it wrong? Part of the reason the Committee has taken on admin sock blocks is to ensure maximum review. The other part is to take the blame if it goes wrong. Better for ArbCom to make a mistake than an admin. If you're a regular admin and you wrongly block a fellow admin, the psychological and social ramifications of that would be intense. ArbCom exists in part to bear that burden. As much as Wikipedia is mostly non-hierarchical, this is one place where the hierarchy is intentional. The admin buck stops with ArbCom for a reason.
CaptainEekEdits Ho Cap'n!⚓01:29, 7 November 2023 (UTC)
I think what you're saying is a good argument for keeping ArbCom in the loop on any investigation of an admin, in line with the "replace" option of my proposal. But I don't see how it justifies keeping investigations purely in the jurisdiction of ArbCom, an entity that is not selected for expertise in sock-hunting and that we have seen this year has significant institutional issues when it comes to doing so. Which I genuinely say with the utmost respect, Eek. There isn't a person on the Committee who I don't respect as both a person and a colleague. But I had multiple arbitrators say to me, directly, that the Committee's private procedures were ill-suited to handle a case like Mark and Corbie, and that doesn't surprise me, because 10–15 people voting in private, many without experience in anti-sock work, is not a great way to investigate sockpuppetry. Sometimes it might be the only way possible for privacy reasons, but it should never be the first choice. (And for what it's worth, I have zero problem blocking an admin who socks, and I can't imagine I'm the only SPI admin who feels that way. SPI admins are generally expected to be able to make difficult blocks, sometimes of users with more social capital than the average admin.) --
Tamzin[
cetacean needed (they|xe|she)
02:35, 7 November 2023 (UTC)
To a great extent, this is all moot. Our policies restrict actions people can take, they don't restrict what conversations they can have. And fundamentally, an SPI is just a conversation. If I want to accuse Tamzin of being a CaptainEek sock, there's nothing to prevent me from posting to WP:AN, "Hey folks, I think Tamzin is CaptainEek, and here's why I think that..." And if I can do that, then I can certainly wrap it up in some fancy templates and call it an SPI. I still can't post private evidence. I still can't desysop them. I (as a CU) still can't run a check on them unless I meet the requirements of
WP:CHECK, but that's equally true whether the conversation is going on at
WP:SPI or at
WP:ARC. I could block them both, but I could do that even without the SPI, subject only to the requirement that I justify my action if challenged.
As for the header language banning an admin SPI, I don't think it does. It says If you suspect sockpuppetry by an
administrator, you should
email the Arbitration Committee ... If you need to ... you must
contact the checkuser team privately to open an investigation. Private information, emails, logs, and other sensitive evidence must not be posted on Wikipedia. The first one is a should which is generally taken to be advisory. The next two are musts, which are obligatory. I assume whoever wrote that language used those specific words exactly because they mean different things. So as far as I can tell, if you file an SPI against an admin, as long as you don't violate any of the musts, you're fine. It won't be very useful because SPI can't desysop, and the changes Tamzin proposes won't change that, nor allow the posting of private or off-wiki evidence. So there's not really any point in filing an SPI against an admin, but I don't see that doing so is actually forbidden. And, seriously, if you're going to have people accusing admins of socking, wouldn't you rather it happen on SPI instead of WPO or Discord?
As a practical point, one disadvantage to filing an admin SPI is that it's virtually guaranteed to degenerate into a total shit-show. Historically, SPI clerks have been less willing and/or less able to control drama than arb clerks are, partly because the arb clerks are working with a more rigid case structure and word count limits.
RoySmith(talk)03:58, 7 November 2023 (UTC)
I should clarify that the "should" language is something I inserted
WP:BOLDly in September
[18] in response to
this discussion. The more longstanding text that existed prior to that was: If you suspect sockpuppetry by an
administrator, or if you need to submit off-wiki evidence for some other reason, you must
email the checkuser team to open an investigation.Mz7 (
talk)
12:11, 7 November 2023 (UTC)
Only ArbCom has the power to desysop for cause on English Wikipedia (with the sole exception of CBANs). An admin socking case is highly likely to result in desysopping (without necessarily an indefinite ban), so I don't see the point of an SPI when the involvement of ArbCom is required anyways. --
King of ♥ ♦ ♣ ♠04:15, 7 November 2023 (UTC)