Misplaced Pages

This is an old revision of this page, as edited by Carcharoth (talk | contribs) at 14:35, 10 January 2007 (→Access rights for protection bot: reply indirectly to Gmaxwell's wikitech-l posting). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Someone please explain to me...

Why can't the source code be revealed? AWB would require much less modification to be an effective vandalbot, and its source is freely available to anyone who cares. -Amarkov _edits 18:18, 7 January 2007 (UTC)

Not sure, I have read it and it seems to be safe releasing the source. HighInBC 18:26, 7 January 2007 (UTC)

If Dragons flight released the source, I would withdraw my opposition. My only significant beef is the needless secrecy. Cheers, ✎ Peter M Dodge ( Talk to Me • Neutrality Project ) 19:05, 7 January 2007 (UTC)

Dragons flight has stated (see comment under Oppose #1), "The code has been released to trusted members of the community for review, but it will not be made public. I feel the risk of people adapting certain functions to create powerful vandalbots is too great." Perhaps other users who have seen and reviewed the code can comment on this issue. This seems a plausible concern to me but an even bigger concern to me is that releasing the code would allow the vandals to try to reverse-engineer ways around it (compare WP:BEANS). Newyorkbrad 19:10, 7 January 2007 (UTC)

There is no WP:BEANS here. This is nothing that couldn't be done with the freely and openly available pywikipedia framework. Cheers, ✎ Peter M Dodge ( Talk to Me • Neutrality Project ) 19:21, 7 January 2007 (UTC)

I agree, pywikipedia framwork, the perl wikimedia module, or just plain html scripting can get the same results. The functions this bot performs are not difficult to reproduce. What's more, the code would not be able to perform admin functions on a non-admin account anyways, so it is really just the recursive unprotected template/image finder. If the bot is functioning, then this list of unprotected pages will not be a threat. I read the source, I see no reason to keep it a secret, but I respect the authors right to do so. HighInBC 19:28, 7 January 2007 (UTC)

Earlier today, I was thinking the same thing as you, HighinBC, but I've realised the potential issue with releasing the code. I'm going to break WP:BEANS here (on the understanding that the code won't be released), in order to enlighten everyone. The simple matter is that the bot code could be changed to automatically vandalise every unprotected page, perhaps before the bot would be able to protect, and cause the vandalised page to be protected. This is a very serious possibility, allowing vandals to easily impose mass vandalism (esp image vandalism). I anyone thinks that this comment is severely WP:BEANS, blank it. Martinp23 20:03, 7 January 2007 (UTC)

• This could be easily done with ANY bot framework - including my own or perlwikipedia - so where's the specific risk? Please clarify. Cheers, ✎ Peter M Dodge ( Talk to Me • Neutrality Project ) 20:21, 7 January 2007 (UTC)
  • We get it. The point is that we want to make it as hard as possible for people to do that. Would you like Tawker to release the source for AVB too? That would be incredibly stupid too. -Royalguard11(Talk·Desk·Review Me!) 20:36, 7 January 2007 (UTC)
    • Peter, I'm sure that perlwikipedia doesn't allow you to find all unprotected pages/files linked from one, does it? Martinp23 20:41, 7 January 2007 (UTC)
      • Actually, yeah, it does, thanks to the lovely patch the devs made to the transclusion list code. Shadow1 (talk) 22:11, 7 January 2007 (UTC)
      • I can get every contribution an editor's made, every edit to an article by x users - getting all transclusions is trivial, since it's just a api.php hack. I appreciate the security concerns, but I feel they are unwarranted. Cheers, ✎ Peter M Dodge ( Talk to Me • Neutrality Project ) 20:53, 7 January 2007 (UTC)
        • You can get the list of pages trancluded on one page using api.php?! Wow - I didn't know that (though I do use api.php a lot for my bots, I tend to stick to the same queries). Can you give me a link to show this (just out of interest)? Martinp23 21:30, 7 January 2007 (UTC)
  • That is a really simple sub-routine to make for anyone capable of editing existing code. HighInBC 20:42, 7 January 2007 (UTC)
    • I'm fairly certain that I could write a decent vandalbot in under 5 minutes with perlwikipedia, it's not like this sort of thing requires a rocket scientist </cliche>. Any fifth grader with a decent knowledge of Perl and a copy of the WWW::Mechanize module can write one. Shadow1 (talk) 22:11, 7 January 2007 (UTC)

On thing that just came to my mind - Dragons flight noted on the BRFA that the bot would run on random times etc. to prevent the vandals from predicting its execution and racing to vandalism. I haven't seen the code yet, but this feature (or something similar) may well be the reason that the release of the source code would violate WP:BEANS. Миша13 22:01, 7 January 2007 (UTC)

• It isn't all that hard to design a RNG algorithm such that determining the times from it without having direct access is too hard to be plausible. Video games have managed that for a while, I think that a bot can. -Amarkov _edits 22:06, 7 January 2007 (UTC)
  • I agree with Amarkov here ... any even somewhat decent implementation of a RNG would not allow anyone to predict its random numbers, even with access to the source. Besides, even if it was a simple timestamp RNG, on-wiki actions are only reported to the nearest second, whereas the script would be using a more fine-grained time seed than that. So there really would be no way to try to predict when it would run again. --Cyde Weys 22:19, 7 January 2007 (UTC)

• I don't really think my point got across. If you wanted to build a vandalbot, you could do it from this, grabbing the unprotected pages... or you could just remove the checkpage requirement from AWB, set it on auto mode, and vandalize away. Much easier than introducing editing functionality to a bot that doesn't have it, and plus, as long as you have a user and user talk page, and are careful not to remove or add too much stuff, it won't look any more suspicious than any other AWB fix. While removing the checkpage requirement isn't a trivial matter, anyone who could turn this bot into a vandalbot could manage it. -Amarkov _edits 22:32, 7 January 2007 (UTC)

So far as I can tell, the code of User:AntiVandalBot isn't public (at least I couldn't find it)... why is no one freaking out about that? It's a much more complicated bot that can make edits to every page on Misplaced Pages. It makes more edits in a day than the protection bot will in an entire year. If it 'went berserk' it could require vastly more work to clean up than the proposed protection bot ever would. In short, all the concerns expressed about 'protection bot' are vastly more applicable to 'antivandal bot'... yet the code is not public and no one seems to mind. Why do you suppose that is? Why do you suppose that 'auto wiki browser' isn't just given out to anyone who wants it? My own theory is that most people realize that 'making smarter vandals' is a bad idea. Yes, a vandal could build their own version of 'anti vandal bot' that instead creates vandalism... some have. But most of them aren't 'dedicated' enough to figure out the hows of it and eventually go away. Does it really make sense to HAND those people a ready made vandalism tool that just requires a few tweaks to create a massive mess? That's what making 'protection bot' or 'anti vandal bot' code publically available would do... give general vandals the ability to do alot more damage. We can handle the few vandals who are capable of building their own bots. Let's not give every vandal the ability to make bot attacks. --CBD 23:01, 7 January 2007 (UTC)

AntiVandalBot obviously does have a vandalism problem. It can edit anything already, it can do it fast, and it requires no human intervention. This bot can only edit images and templates, and even then only to add or remove three specific things, so it would take loads more work to convert it into a useful vandalbot. And as I've reiterated a lot already, we already have the full source of AWB, which would be much easier to convert to a vandalbot. (It wouldn't even be conversion, really). -Amarkov _edits 23:07, 7 January 2007 (UTC)

Alternatively, you can use my perlwikipedia framework to write a vandalbot. I just wrote a dirt simple, proof-of-concept one with the framework, 24 lines of code, that uses threading and multiple usernames. Elapsed time: 4 minutes. Just because the bot is open-source doesn't make it an automatic target for vandals trying to create vandalbots. It would probably be harder to convert ProtectionBot into a vandalbot than it would be to write one from scratch using pywikipedia. Shadow1 (talk) 23:31, 7 January 2007 (UTC)

I agree, bot making is not some secret, anyone can learn it and use existing frameworks. HighInBC 23:32, 7 January 2007 (UTC)

Absolutely agree. Not that I don't trust HighInBC, but I believe strongly in trust-but-verify. I already know pretty well how Antivandalbot works just by having seen what types of things it's done, and it would not hard to write vandalbots from what's already out there. Our anti-vandalism techniques need to be just as open, so that when the vandalbot runners find a way around them (and you believe me, they will), we can respond quickly and improve our own techniques (and perhaps find weaknesses before they're exploited). Security through obscurity isn't-and if this bot's code is too insecure to post, it's too insecure period, let alone to trust with an admin flag. Seraphimblade 00:04, 8 January 2007 (UTC)

This is one of the best comments I've seen for the release of the source code. Just posting this to highlight it... Mathmo 16:08, 9 January 2007 (UTC)

To echo some comments from other editors that I think are most worthy of consideration: nothing this bot could do is difficult or uniquely complex, there's no good reason not to publish, publication would facilitate bug discovery and resolution. The bot could be blocked if it ever caused problems. It should also be possible to distribute a version this bot set to run in semi-automatic attended mode, which would enable the word to be done efficiently without the risk that comes with a fully automatic bot, of being fooled by cleverly written malware or mischievous humans. --Tony Sidaway 07:12, 8 January 2007 (UTC)

I believe many people here are grossly underestimating how little modification to the source it would take to turn a bot that looks for vulnerabilities in order to protect them, into a bot that looks for vulnerabilities in order to vandalize them. Changing fewer than 5 lines would turn this into effective malware. Changing a few more than that would be enough to let it rampage all over the place. If you are unwilling to accept this as private source, then by all means kill it, but I have no intention of making the source public. Dragons flight 07:34, 8 January 2007 (UTC)

I said this in my oppose !vote-if this bot code, through error or malice, is that dangerous (and if danger exists, either error or malice can lead into it), and would be that dangerous if a non-admin had possession of it, it is more, not less, critical that the code be open to continuous review-not just now but during its operation. It's not like we've never seen a vandalbot, but if this code is suddenly released we'll have a flood of them. (Please note-you certainly have the right to keep your code secret, but even if most seem alright with that, I think it's a bad idea and will in the end decrease the effectiveness of the response against vandalism. And for myself, I can't support it without seeing it.) Seraphimblade 07:50, 8 January 2007 (UTC)

Um... with AWB, just removing checkpage functionality, which should be much easier, leaves you with a pretty effective vandalbot. You won't be guaranteed to hit the unprotected things transcluded on main page articles, no, but you could just vandalise the pages themselves, and I do not see how that's worse. -Amarkov _edits 15:50, 8 January 2007 (UTC)

Everyone does know that WP:BEANS was written for a reason, right? FOLLOW IT! It is absolute nonsense to argue over who can write a vandal-bot faster. You've got a responce above how fast someone could turn this into a vandal-bot. There's no point in making it easier for someone to do it. Yes, people can make vandal-bots, but lets make them write them entirely themselves. Let's not hand then one that's already mostly pre-written! -Royalguard11(Talk·Desk·Review Me!) 04:23, 9 January 2007 (UTC)

You're missing my point. There already is one, and it's patently obvious that removing the checkpage would leave you with a vandalbot. Thus, it is obviously not all that much of a problem. -Amarkov _edits 05:11, 9 January 2007 (UTC)

Is there really anything in the code that cannot be gotten from User:Shadowbot2/Source? HighInBC 14:44, 9 January 2007 (UTC)

Current status question

(cross-posted to bot approval page) With the RfA now pending, is ProtectionBot currently operating during the RfA period? I hope that it is, at least on an ongoing trial basis. Newyorkbrad 20:21, 7 January 2007 (UTC)

A member of the BAG ended the trial after one day and instructed DF to shut down the bot here, and DF did as he requested, so no, it's not running. —bbatsell ¿? 20:30, 7 January 2007 (UTC)

Suggest continued trial operation during RfA period

If Dragons flight is willing I would like to see this bot continue operating on a trial basis during the RfA period, both so we have the benefit of its services during the next week and so that in the unlikely event of an issue arising the RfA !voters could consider it. Comments? Newyorkbrad 20:32, 7 January 2007 (UTC)

I think BAG shut it down, In the meantime we have User:Shadowbot2. Which as stated on the RFA page, is fixed and will preform correctly. Cheers! —— Eagle 101 23:16, 7 January 2007 (UTC)

Probably best to just wait, I know I am checking shadowbot2's mailings. HighInBC 23:18, 7 January 2007 (UTC)

Suggestion: Might it be possible to authorise the continued running of ProtectionBot for as long as this RfA maintains a suitable level of consensus for the Bot? e.g. 80 or 85%? That would combine practicality with respect for the views of the community... WJBscribe  23:39, 7 January 2007 (UTC)

• That's a very nice idea, and I'd commend you for lateral thinking, but I don't think it's feasible. Cheers, ✎ Peter M Dodge ( Talk to Me • Neutrality Project ) 23:41, 7 January 2007 (UTC)

• No need to be bureaucractic about it, this bot is useful (and the RFA has overwhelming support so far) so there's no reason why it shouldn't keep running for a few more days. >Radiant< 12:28, 8 January 2007 (UTC)

• My point is it's not running right now. Newyorkbrad 23:05, 8 January 2007 (UTC)

Buffer overflow

I see a few people concerned about buffer overflow exploits, my understanding is that this type of vulnerability can only be used on a bot that can be given binary input. Since this script gets all of it's input from mediawiki which stores it's data in text form, I see no way to insert such an attack. Python does not allow for run-time compiling. You cannot fool such a bot into running arbitrary code given such input restrictions, as the precompiled code needed for such an attack cannot be stored as text.

I may be wrong, so correct me if I am, but it seems a buffer overflow vulnerability is not an issue for technical reasons. HighInBC 23:50, 7 January 2007 (UTC)

• Mostly correct. It could still malfunction on malformed input, or if the input format changes. Cheers, ✎ Peter M Dodge ( Talk to Me • Neutrality Project ) 23:52, 7 January 2007 (UTC)

Malfunction on malformed input is far from executing arbitrary code, and would lead to a parsing failure. And changing input formats would exceed the approval it is seeking. HighInBC 23:53, 7 January 2007 (UTC)

• I know - hence "mostly correct" :) I just felt it necessary to point out that there still ways in which this kind of thing may happen, if without the severe consequences. Cheers, ✎ Peter M Dodge ( Talk to Me • Neutrality Project ) 00:00, 8 January 2007 (UTC)

I see, I agree that we cannot discount the possibility of the bot being intentionally screwed with, but I think the threat of arbitrary code execution is not an issue. HighInBC 00:04, 8 January 2007 (UTC)

Arbitrary code exception on the bot's machine? No. Arbitrary command execution on wikipedia? Depends on how the bot sends information back to the servers. I have not reviewed the code, nor has, to my knowledge, any python security expert, nor can I rely on distributed error checking to review the code, and as such, you just don't know what happens if a page to be protected has the following on it -> . Does it load and recurisvely protect everyting on malicioustemplate%2%6%9deleteallcontributions? Does it attempt to load and recursively protect the page deleteallcontributions, which has now resulted in the protection of the entire encyclopedia (oops!) Does it load http://en.wikipedia.com/w/deleteallcontributions and fail? I don't know! I can think of more way to beat the bot, but I'm just shooting in the dark. Real security audits involve reviewing the code. Hipocrite - «Talk» 20:15, 8 January 2007 (UTC)

Interesting point - do you know any available python security experts who might be willing? Guettarda 21:35, 8 January 2007 (UTC)

Open_source_versus_closed_source#Security, to be a bit snarky but not too much. Hipocrite - «Talk» 21:54, 8 January 2007 (UTC)

Yep, I'm aware of that, and I read a good chunk of the RFA - I see your point and I see Robert's. He isn't likely to change his position, and the bot fills a real need. I respect both his position and yours. I trust both his judgement and yours. I only see one of two outcomes - either the RFA fails (with the result that the main page remains vulnerable), or the bot is approved with the code secret (or semi-secret). So rather than arguing about what should be, I am wondering how create the best outcome. Guettarda 22:03, 8 January 2007 (UTC)

Some concerns

While correcting a misunderstanding I wrote the following to express some of my concerns (despite supporting the RfA). Comments welcomed.

I was reading the ProtectionBot discussion, and I noticed in one of the oppose votes discussions someone said "remember this bot only protects images and templates on the Main Page". This is incorrect. The bot is also intended to protect templates being used on the featured article, the actual featured article page, not the introduction to it that appears on the Main Page. Thus anyone can add a template to the featured article, vandalise the template, and sit back and watch as ProtectionBot protects the vandalised template. The good thing though, is that the featured article is (normally) freely editable, and so anyone can remove the protected vandalised template. This situation is a bit more problematic when the featured article is in a state of protection or semi-protection due to high levels of vandalism (someone always seems to protect the featured article at some point in any given day), and if the protected vandalised template is in widespread use in other articles. However, the discussions at Misplaced Pages:Main Page featured article protection may change all this. Thus the interaction of all these proposals needs to be carefully considered. Not too much change too fast. Also, no-one seems to have picked up yet on the comment I made here. That can be summed up by: Main_Page/Tomorrow needs to be actively watched every day and a button clicked to show that someone has checked it, otherwise, as I said in that comment I linked to: "...the vandalism (possibly not very visible) remains undetected for a whole day, and then silently switches over on the main page, at which point all hell will break loose." Carcharoth 10:55, 8 January 2007 (UTC)

Incidentially, Main_Page/Tomorrow is unprotected, for some reason. This should probably change. Carcharoth 11:02, 8 January 2007 (UTC)

Actually it was semi-protected. Now it's fully protected. Though since nothing that's directly on that page is ever included in the Main Page, I'm not entirely sure what the problem was – Gurch 12:33, 8 January 2007 (UTC)

The problem was that templates on that page are being protected by ProtectionBot, so this is a way for someone to get something protected by ProtectionBot. That something might be something that we wouldn't want to be protected and then freely added to other pages. Hence all pages scanned by ProtectionBot should be protected. Today's featured article page is a notable exception to this, and one that will need to be watched very closely. Carcharoth 12:46, 8 January 2007 (UTC)

Is the bot really checking Main Page/Tomorrow itself rather than the relevant component templates? If so, I'm not sure that makes sense. The 'tomorrow' template isn't actually 'copied over' to the Main Page each day. When I first mocked up a 'tomorrow' version of the Main Page I used the then current formats of the Main Page and just added in the {{day+1}} template where appropriate... and someone then took that to create the 'tomorrow' page. However, since then there have been numerous small changes to the Main Page which have not necessarily been kept up on the 'tomorrow' version. That process will continue over time and eventually there may be templates and/or images on the 'tomorrow' version which are no longer used on the actual Main Page and which thus would not need to be protected. We could always 'recopy' the current Main Page formats from time to time (and would anyway), but the bot could be a bit smarter by checking the specific sub-templates which vary on the Main Page a day in advance. --CBD 13:19, 8 January 2007 (UTC)

Good points. The bot description say: "In addition, it will protect the predictable elements (such as the next Picture of the Day) a day before they appear on the main page." - so I think you are right. What we need is for that description to be expanded so it says exactly what pages it protects in advance (probably just the TFA, SA and PoTD transcluded pages). On the other hand, the Main Page/Tomorrow must show what will actually appear (and so needs to remain protected as I suggested), otherwise people watching that page might miss 'sleeper' vandalism.

On another point, can we clarify terminology here. Does it make sense to distinguish between images, transclusion of pages from template namespace, and transclusion of pages from other namesspaces? When people refer to templates, they can mean either pages in template namespace, or (more widely) anything that appears in the {{ and }} curly brackets. Carcharoth 13:38, 8 January 2007 (UTC)

I did find this edit by the bot programmer, who said (on 30 December): "As described it would be looking at Main Page/Tomorrow and Tomorrow's Featured Article as well as the current ones, so predictable elements will be protected before they actually reach high profile status." - though possibly things have changed since then. I've asked Dragons flight to comment here. Carcharoth 13:49, 8 January 2007 (UTC)

Another point. If the bot tries to predict what the 'next day' templates are, there needs to be a note that changing that system (eg. changing the format of the dates, or using different templates - as recently happened with PoTD) would confuse and probably break that part of the bot's function. But then that would break Main Page/Tomorrow as well! So another note for the human oversight section below. Carcharoth 13:58, 8 January 2007 (UTC)

The answer is that yes, the current implementation relies on Main Page/Tomorrow to predict the upcoming content, and I apologize if that was unclear. So yes, at the present time that would need to be kept updated and potentially full-protected if it becomes a problem. One could imagine an implementation that uses Main Page alone to predict future content, but that also would have problems. At present, the rotating elements rely on three different nomenclatures "{current month name} {current day}", "{current month name} {current day}, {current year}", "{current year}-{current month number}-{current day 2 digit number}" and only 2 of the 3 is on the Main Page itself, one of the rotating elements is in a subtemplate. Trying to write something that would be robust against the variations in placement and nomenclature that people might devise in the future would represent a hard problem (and I would note that POTD has already changed twice in the last week). My present "solution" is to encourage any modifications to the main page to also maintain the day+1 state of Tomorrow. I realize this isn't really a solution, but it is something that people can do that will work predictably, as opposed to my trying to guess at potential future main page changes, which seems likely to fail. Dragons flight 14:42, 8 January 2007 (UTC)

An example is this edit where the editor who redesigned the PotD template system updated the Main Page/Tomorrow page. If this step had been forgotten, the system might have broken down. Carcharoth 14:00, 8 January 2007 (UTC)

Please don't forget that human oversight is still needed

Just to avoid complacency, and to remind those saying that this bot will "deal with the problems of Main Page vandalism", a reminder that the bot will deal with some methods of vandalism, but human administrators still need to be alert to the following, which, however unlikely, will probably happen at some point in the future. I've given examples below. Carcharoth 12:43, 8 January 2007 (UTC)

Human error

• Administrators unprotecting stuff and forgetting to re-protect (ProtectionBot will not override another administrator). The fix is to reprotect and politely ask the administrator not to make this mistake in the future. Carcharoth 12:43, 8 January 2007 (UTC)
  • Query - if something is protected by an administrator, will ProtectionBot still unprotect the page in question once it leaves the sensitive areas? This is not good for high-risk templates that should remain protected even when off the main page. Carcharoth 12:43, 8 January 2007 (UTC)
    • No. It remembers what it's protected and only unprotects things it protected itself. This may result in things being protected for longer than they should be, but that's infinitely preferable to things being unprotected when they shouldn't be – Gurch 12:45, 8 January 2007 (UTC)
      • I agree that having some things protected for longer than they should be is better than the alternative, but one of the advantages of having ProtectionBot unprotect things, was that admins would no longer have to do this chore. Admins will need to learn that if they protect something, they can't rely on ProtectionBot to unprotect it. Probably a separate bot is needed to unprotect any selected anniversary pages that remain protected after leaving the main page. The Picture of the Day and Today's Featured Article daily templates remain protected, I believe, as a record of what that bit of that day's main page looked like. The random stuff going on and off the featured article page and the DYK and ITN templates are the admins responsibility to protect and unprotect as needed, so I am happy that the query is not a problem, and have struck it out. The human error bit remains, of course, and not a lot we can do about that. Carcharoth 12:55, 8 January 2007 (UTC)
• Administrators forgetting to protect something in the first place before adding to the main page or to that day's featured article. ProtectionBot will protect a short while later, but a small window of opportunity remains for vandalism. Administrators should not be complacent and should still remember to protect and unprotect DYK and ITN templates/images (ITN is the most common update area, other areas less so as DYK should be done through the DYK update area, though the image on the Featured article blurb sometimes gets wrangled over) and featured article templates/images that they add to the featured article or main page on the day (if added a day beforehand, or to the DYK update area, ProtectionBot will protect for you the day before, via Main Page/Tomorrow). Carcharoth 13:02, 8 January 2007 (UTC)
  • Possible solution - if the ITN editors feel they might still forget to protect images, then they could move to an update area like DYK and lag a day behind the news. Just for the image, maybe, and have the other ITN lines updated throughout the day. Carcharoth 13:06, 8 January 2007 (UTC)
• Major redesigns of the main page or its templates. Any major (or even minor) redesign of the main page and its various template systems may impact the operation of the bot. Tread carefully before carrying out redesigns, and drop a note off at User talk:Dragons flight. This is an argument for having the actual step-by-step processes (if not the actual code) described as fully as possible. ie. a log of what it does, like an annotated version of its protection/edit contributions list. Carcharoth 14:06, 8 January 2007 (UTC)
  • It should actually be quite robust against anything that you could do (though I should never doubt the potential for people to surprise me). More troubling I think is the potential for changes to Mediawiki to break it. Relevant changes would probably be quite infrequent but are at least possible. Dragons flight 14:19, 8 January 2007 (UTC)
• Changes in Mediawiki could affect the way the bot operates. The bot programmer has said (see above): "More troubling I think is the potential for changes to Mediawiki to break it. Relevant changes would probably be quite infrequent but are at least possible." (User:Dragons flight, 08/01/2007). Carcharoth 14:58, 8 January 2007 (UTC)
  • This problem actually hit Shadowbot2 recently (see User talk:Shadowbot2). --ais523 10:15, 10 January 2007 (UTC)
• No-one watching Main Page/Tomorrow for vandalism that then gets frozen in place by ProtectionBot. What is needed here is a way for any admin to 'sign off' on the Tomorrow page and confirm it is not in a vandalised state, and for ProtectionBot (prefereably, or possibly another bot) to squeal if such a check hasn't been performed. This could be similar to the breakdown alert system currently in place for ProtectionBot. Carcharoth 15:25, 8 January 2007 (UTC)
  • It doesn't take an admin to look at and call attention to problems with that page, anyone could do it. Dragons flight 15:41, 8 January 2007 (UTC)
    • The thing I had in mind was not so much calling attention to the problem, as having a box ticked to confirm that someone had checked the page. If this is not done, you can end up with everyone or no-one checking the page. By sod's law, and as people get bored doing this check, the one time no-one checks will be when the page (through one of its templates) is in a vandalised state. Everyone is away at various times, so you can't rely on a single person to carry out this single check. The reason an admin is needed to check the box (or turn a big red light green), is that if anyone can 'tick the box', then a vandal will do it. I suggest the sequence should go: (1) ProtectionBot protects all templates etc. on 'Tomorrow' at the beginning of a day. (2) An admin makes a change to a protected page (call it the checkpage) that indicates that the 'Tomorrow' page has been checked by a human, and indicates to others that this change has been done. (3) ProtectionBot checks the checkpage and if the change hasn't been made that indicates a human has checked the page, e-mails the admins on its list. (4) At the end of the day, ProtectionBot changes the checkpage back to its "unchecked" status. Put this checkpage on a ProtectionBot subpage if need be, and then transclude as a little red/green light at the top right of Main Page/Tomorrow. Does this sound workable or too complicated? Carcharoth 16:38, 8 January 2007 (UTC)

Bot error

• Protecting a vandalised transclusion added to the featured article. The bot cannot check whether an image or template is in a vandalised state before it protects it. If a vandal strikes lucky and vandalises a template just before it gets protected (unlikely but possible), then an admin is required to unprotect and undo the vandalism. If no-one is watching closely, then a vandal could do this on the featured article and then remove the newly protected vandalised template or image and add it to lots of pages. The template/image in question will be unprotected by ProtectionBot after two passes, but a lot of damage could be done in this time interval. Carcharoth 12:43, 8 January 2007 (UTC)
  • Such a race condition is possible (beans anyone?). I don't see anyway around it. However, since the vandal has to guess at when the bot will run, I'd guess that on average he would be blocked even before he succeeded at getting the timing right to protect something. Any other suggestions? Dragons flight 14:12, 8 January 2007 (UTC)
    • If this one is too bean-y, please remove it. But this has been discussed elsewhere as well. I think the problem (of a malicious user indirectly using ProtectionBot to get something protected) may be resolved if the featured article and main page functions of ProtectionBot are separated. Then it becomes a question of whether Misplaced Pages:Main Page featured article protection ever gets resolved. Carcharoth 14:58, 8 January 2007 (UTC)
      • Could the bot at least post a message somewhere, after the protection, if the page had a recent edit (i.e. more recent then the last time it scanned)? The bot wouldn't be able to tell if the page had been vandalised, but it would be able to call in a human who could tell. --ais523 17:19, 8 January 2007 (UTC)
• Protecting a vandalised state of a rotating main page transcluded page. A similar example to the above is when ProtectionBot protects the rotating transcluded pages that use date parsing to queue the main page templates for the featured article and the picture of the day and selected anniversaries. This is done in advance by using Main Page/Tomorrow, but unless humans watch this page, vandalism may pass un-noticed here for a day until it flips over onto the Main Page. Carcharoth 12:43, 8 January 2007 (UTC)
  • Yes, humans will still have to pay some attention. But looking at a single page to see if it looks right ought to be a much easier task that checking the protection state of everything. Dragons flight 14:12, 8 January 2007 (UTC)
  • Conclusion - cannot be detected by ProtectionBot. Requires human oversight. Reliable human checking system needs to be implemented, allowing humans to tell ProtectionBot that the page has been checked. Carcharoth 17:09, 8 January 2007 (UTC)
• The bot may unprotect a page that should remain protected. The bot is unable to make the necessary judgement, though it could be programmed to look at whether the page is already in a high-risk category. Merely having it return the page to the state it was in before arriving on the main page or featured article is not enough, as some pages are protected by admins beforehand, but should be unprotected once they leave the sensitive area. Carcharoth 12:43, 8 January 2007 (UTC)
  • It will only unprotect pages that it has protected. If a high-risk template is added to the Main Page it will already be protected, so the bot won't do anything when it is removed. If an administrator protects a template/image themselves, and they add to the Main Page, the bot won't touch it at all, no matter what – Gurch 12:47, 8 January 2007 (UTC)
    • OK, thanks. I've struck that one out. Carcharoth 12:57, 8 January 2007 (UTC)
• Transcluding featured article onto itself. Does the bot protect all templates transcluded on the daily FA, or all pages? If a vandal transcludes the featured article into itself, would the bot end up protecting the featured article and any vandalized content? Gimmetrow 13:05, 8 January 2007 (UTC)
  • Apparently (after trying it out on one of my user subpages) this is indeed possible. Strange, and well-spotted. And yes, I believe it does protect any transcluded pages. The rotating date pages for the main page featured article, picture of the day and selected anniversaries are actually page transclusions, not transclusions from template namespace. Carcharoth 13:13, 8 January 2007 (UTC)
  • I've added a line to prevent this eventuality. Dragons flight 14:12, 8 January 2007 (UTC)

Please add any more examples you can think of needing human oversight. Carcharoth 12:43, 8 January 2007 (UTC)

Shrubberies

We are the Knights who say Ni!

1. The bot must not be sysopped until we can see that the bot does only that which is stated

2. The bot may not be run under Dragons Flight's own account because that violates bot rules

3. The bot must therefore only be run under its own assigned account

4. The bot's assigned purpose requires sysop privileges

5. Goto 1

And there you have it. Guy (Help!) 16:38, 8 January 2007 (UTC)

Indeed. Lots of FUD being thrown about all over the place as well. Sad. —bbatsell ¿? 16:44, 8 January 2007 (UTC)

What about the discussion above, which is actively trying to lay out possible problems and solutions. Contributing or linking to that could help. Carcharoth 16:55, 8 January 2007 (UTC)

I was talking more about the votes that have no explanation, or that are POINT violations (my favorite so far is the one opposing because the bot did not sign accepting the nomination, then proceeding to chastise everyone else involved for not knowing the rules), or that list issues that are either not factual or have already been addressed; as is my mantra, discussion is never a bad thing. Administrative oversight will always still be required, and laying out exactly what will be required above is wonderful. —bbatsell ¿? 17:05, 8 January 2007 (UTC)

Adding it to Category:Administrators open to recall is my favourite. :-) Carcharoth 17:33, 8 January 2007 (UTC)

I'm all for adding the bot to that category, just as soon as it expresses its willingness to be added. ;) SuperMachine 17:35, 8 January 2007 (UTC)

The bot will agree to stand for reconfirmation upon the request of any six other bots. :) Newyorkbrad 17:41, 8 January 2007 (UTC)

I'll make sure no other bot will clerk for it (I was born in Detroit, we have ways to influence bots...) and thus the recall will fail procedurally. ++Lar: t/c 23:06, 8 January 2007 (UTC)

• Would it be POINTy to post this under my bot's username I wonder? :) Nice to see some good humour in here after some of the clashes on both sides, though. :) ✎ Peter M Dodge ( Talk to Me • Neutrality Project ) 17:44, 8 January 2007 (UTC)

"The Knights have a weakness in that a number of words, when spoken to them, cause them pain and agony." (from the article Knights who say Ni). Thanks for that nice pointer, Guy. :-) --Ligulem 22:55, 8 January 2007 (UTC)

Alas! there is away out! Go look thee, to the wonderful land of the test wiki. Just follow that yellow brick to find all sorts of wonderful things! </Wizard of oz>Anyway, this bot can easily test on the testwiki, and a sysop bit should be easy to come by over there. The wikimedia framework is very similar, so what works there should work here as well. Cheers! —— Eagle 101 23:12, 8 January 2007 (UTC)

I know a way out of that shrubbery, it removes number 1! Release the ****ing source code. Sorry for the starred language, but I'm really, really, annoyed that such a simple solution seems to be randomly overlooked.

And for humor, I think we need to stick this thing on ArbCom, it'll go well with AntiVandalBot. I wonder when it'll be programmed well enough to arbitrate? -Amarkov _edits 06:07, 9 January 2007 (UTC)

You mean best publish the source code before starting the RfA then? To give the vandals some advantage in case the RfA should succeed - <chuckle>. Looks like we should modify Guy's "Knights who say Ni" program loop then :-). Nice RfA though. --Ligulem 10:25, 9 January 2007 (UTC)

Yeah, security through obscurity... No, really, such a simple way out. If anything the request for shrubbery is in obtaining access to the source code. "Drop me a note, I'll decide if you're trusted, and get back to you." Abu-Fool Danyal ibn Amir al-Makhiri 15:17, 9 January 2007 (UTC)

(in reply to Ligulem) Decent source, is secure, no matter who reads it. Anyone can go read the Mediawiki code that feels like it-go on, you can right now! What you'll note, however, is that this ability really doesn't make things any easier for the vandals, because the code is good. One hopes that this bot has certain features built in (for example, altering the exact times at which it performs its checks by random intervals)-these types of safeguards would not be compromised or harmed by anyone reading the code, and the bot could be compromised through simple observation if they're not. That being said, it seems like this bot's coder is pretty competent. Here's my problem. An adminbot must be exceptionally good. If the source code cannot be released without danger that this bot will be compromised, it's not properly coded. If Dragons Flight believes that it'll make anything easier for blackhats than having the code for AWB out there, this thing is either exceptionally dangerous or he's unaware of the real situation. Any of those scenarios make me nervous enough to oppose this. It's really too bad-I saw one of those nasty incidents, I think this is a good way to solve it, and I'd like to be able to support it. But basically, what's being asked here is for the community to support a person for admin because someone trustworthy nominated them. We don't do that. We go look through that person's history. For the same reason, I can't support here because I trust the coder-I'd have to see the code, and know that everyone can do so. Seraphimblade 15:29, 9 January 2007 (UTC)

One must also remember that there are a LOT more wikis than just en, but this bot will only protect on en. So, if DF openly releases the source code, vandals now have a bot handed to them where they can have it search out every single un-protected template and image on every Misplaced Pages in every language, change 10 lines and have it vandalize those pages instead. Could vandals program a bot to do this anyway? Sure... but let's not make it any easier for them and just hand them the absolute perfect vandal tool. As it stands now, the code has already been reviewed by numerous qualified programmers, and is available to anyone in good standing (including those on other language wikipedias who want to implement it on theirs). I'll be honest, I'd prefer if it were open-source. I love open-source and will always prefer it to closed-source. But opposing simply because it is not open-source is acting ideologically rather than practically. The "security through obscurity" charge doesn't work, because it's been reviewed by numerous people, and can continue to be reviewed by anyone who wants to. It's not closed-source because there's a possibility of it being compromised, but because there's a possibility of the code being abused. My $0.02. —bbatsell ¿? 16:12, 9 January 2007 (UTC)

The others I'm aware of do not have fully protected main pages anyway. I do believe the question is moot for all wikis except this one. I am also amused to find myself accused of being an open-source ideologue. Abu-Fool Danyal ibn Amir al-Makhiri 19:32, 9 January 2007 (UTC)

I've already recieved a request for ProtectionBot to be used on the Italian wiki, for which I am happy to provide the code provided that I can find a English speaking Italian bot operator who is willing to take responsibility for it. Dragons flight 19:59, 9 January 2007 (UTC)

Huh? I can edit some of the main page templates on Italian wikipedia. Like this one. It's not even semi-protected, and it doesn't look like it's supposed to be. Abu-Fool Danyal ibn Amir al-Makhiri 20:24, 9 January 2007 (UTC)

Is there really anything in the code that cannot be gotten from User:Shadowbot2/Source? HighInBC 16:34, 9 January 2007 (UTC)

Great, so you'll share with more "trusted users" in an entirely different wiki, but still can't be bothered to release the code so any wiki can use it, or so that we can review it. WTF, man? --badlydrawnjeff talk 00:43, 10 January 2007 (UTC)

(undent) The others I'm aware of do not have fully protected main pages anyway. I do believe the question is moot for all wikis except this one. You appear to totally misunderstand the situation. This is not about vulnerabilities in the Main Page, it is about vulnerabilities in the Main Page Article, the most widely viewed page on all of en.wikipedia.org. And that article is never fully protected.

The bot is designed to find weaknesses (unprotected templates and images) and fix them. It is trivial for anyone familiar with that type of code to modify the program so that it finds weakness and lists them. And that list is a list of targets for vandalism.

Do you really believe that other wikis don't use templates and images, or that (the only way to avoid this problem) those other wikis fully protect templates and images so that only admins can modify them? Because those are the only two ways that this issue is "moot" for other wikis. John Broughton | Talk 01:34, 10 January 2007 (UTC)

Actually, just as a quick note, it does both. It does what you describe, but it also searches for and protects vulnerable templates and images on the Main Page, which is what has been a bigger problem as of late. —bbatsell ¿? 02:10, 10 January 2007 (UTC)

Idea for a compromise about the source code

I see considerable worries about the code of the bot not being open source and if we fail to address these the whole thing will not fly.

As being one of the supporters of giving the bot admin rights and letting the bot do what it was intended for, I would like to try to work towards consensus and see if we can move a little bit on all sides.

Would it be acceptable, that Dragons flight gets a startup time where he can establish the bot and tweak it and iron out all early bugs without publishing the code and publish the code later, when the bot is running and already doing its job?

Part of this my proposal here is that those who give their RfA support as soon as the code is published would move a bit and give their approval for the RfA based on the mere promise of Dragons flight to publish the code in - let's say - a month?

Of course my proposal only works if Dragons flight would agree to publish the code in a month. Deal or no deal?

If this is not acceptable, what can be tweaked to make it acceptable?

Could we keep parts of the code unpublished? For example the code part(s) that determine the exact time when the bot will protect a specific page. Maybe this could be refactored out into a call of a random function so that the complete code could be published without giving the knowledge exactly when it is going to protect a page.

Please help work towards consensus, everybody! --Ligulem 10:40, 10 January 2007 (UTC)

Bots
Sysops
Bureaucrats
checkuser
Stewards
boardvote
import
developer
oversight