Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Wikipedia: Wikitech

Range Contribs tool; anti-vandal software; anon IPs' User-Agents; the netblocks that vandalize the most; etc.

 

 

Wikipedia wikitech RSS feed   Index | Next | Previous | View Threaded


unforgettableid at gmail

Jan 26, 2010, 8:55 PM

Post #1 of 5 (692 views)
Permalink
Range Contribs tool; anti-vandal software; anon IPs' User-Agents; the netblocks that vandalize the most; etc.

Hi all,

I was curious about a vandalistic edit[1]: the logged-out vandal, who uses a
US-based home broadband ISP[2][3], has made only one edit: the vandalistic edit
I mentioned. The edit was made two days ago. I reverted it, then tried using
Soxred93's useful Range Contributions tool[4] to see if any of the 255 IP
addresses closest to the vandal's IP had ever made any other edits. Nope.[5]
In fact, not even any of the closest 131072 have done so.[6] But when I
expanded my search to the closest 262144, I found lots of edits over the past
few weeks, made by a variety of IPs. I looked at the first seven. One was
vandalism: an edit[7] to [[Patrick Stump]]. Someone else has since reverted
it. It was made by another user from the same ISP.[8] I am just curious:

A) Did I go too far when I did all the research I described above? Do you
yourself often use the Range Contributions tool[4] for looking at vandals' ISPs'
contributions?

B) What do you think are the chances that the same person made both the
first[1] and the second[7] vandalistic edits? The IP addresses' binary
representations are quite different.

C) Why did no anti-vandalism software automatically revert either edit?

D) When I look at the history[9] of [[Patrick Stump]], I see that there were
fourteen edits between 06:51 and 07:03, most vandalism. Yet the vandalistic
edits come from a variety of IP addresses and usernames. The IP addresses
differ widely from each other. Why is this?

E) When comparing two vandals' edits in other situations, is there any quick
way for editors to find out both IPs' hostnames, User-Agents, Accept-Charset
strings, Accept-Language strings, screen resolutions, and/or IP geolocation
results? I do very little vandalism removal, so I myself am not sure.

F) Which netblocks do the most vandalism and the least useful editing? Which
cities? Which entire countries? Should those netblocks, cities, and countries
be forced to log in before editing?

G) Wouldn't it be cool if some web browsers or ISPs would tell Wikipedia what a
contributor's PPPoE username was whenever the contributor made an edit?

If you reply to only one of A), B), C), D), E), F), or G) then please use a
different subject line than I used. And add a "(was: ...)" tag at the end of
the subject line. That way, it'll be easier for others to follow just the parts
of the discussion that they want to follow.

Kind regards,
--[[User:Unforgettableid]]

^ [1].
http://en.wikipedia.org/w/index.php?title=Fetus_in_fetu&diff=prev&oldid=339770615
^ [2]. http://toolserver.org/~chm/whois.php?ip=174.105.248.31
^ [3]. http://en.wikipedia.org/wiki/Road_Runner_High_Speed_Online
^ [4]. http://toolserver.org/~soxred93/rangecontribs/
^ [5].
http://toolserver.org/~soxred93/rangecontribs/index.php?type=range&ips=174.105.248.31/8&limit=100
^ [6].
http://toolserver.org/~soxred93/rangecontribs/index.php?type=range&ips=174.105.248.31/15&limit=100
^ [7].
http://en.wikipedia.org/w/index.php?title=Patrick_Stump&diff=prev&oldid=339703861
^ [8]. http://toolserver.org/~chm/whois.php?ip=174.106.99.246
^ [9]. http://en.wikipedia.org/w/index.php?title=Patrick_Stump&action=history


_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


innocentkiller at gmail

Jan 26, 2010, 9:38 PM

Post #2 of 5 (661 views)
Permalink
Re: Range Contribs tool; anti-vandal software; anon IPs' User-Agents; the netblocks that vandalize the most; etc. [In reply to]

On Tue, Jan 26, 2010 at 11:55 PM, Unforgettableid
<unforgettableid [at] gmail> wrote:
> Hi all,
>
> I was curious about a vandalistic edit[1]:  the logged-out vandal, who uses a
> US-based home broadband ISP[2][3], has made only one edit:  the vandalistic edit
> I mentioned.  The edit was made two days ago.  I reverted it, then tried using
> Soxred93's useful Range Contributions tool[4] to see if any of the 255 IP
> addresses closest to the vandal's IP had ever made any other edits.  Nope.[5]
> In fact, not even any of the closest 131072 have done so.[6]  But when I
> expanded my search to the closest 262144, I found lots of edits over the past
> few weeks, made by a variety of IPs.  I looked at the first seven.  One was
> vandalism:  an edit[7] to [[Patrick Stump]].  Someone else has since reverted
> it.  It was made by another user from the same ISP.[8]  I am just curious:
>
> A)  Did I go too far when I did all the research I described above?  Do you
> yourself often use the Range Contributions tool[4] for looking at vandals' ISPs'
> contributions?
>
> B)  What do you think are the chances that the same person made both the
> first[1] and the second[7] vandalistic edits?  The IP addresses' binary
> representations are quite different.
>
> C)  Why did no anti-vandalism software automatically revert either edit?
>
> D)  When I look at the history[9] of [[Patrick Stump]], I see that there were
> fourteen edits between 06:51 and 07:03, most vandalism.  Yet the vandalistic
> edits come from a variety of IP addresses and usernames.  The IP addresses
> differ widely from each other.  Why is this?
>
> E)  When comparing two vandals' edits in other situations, is there any quick
> way for editors to find out both IPs' hostnames, User-Agents, Accept-Charset
> strings, Accept-Language strings, screen resolutions, and/or IP geolocation
> results?  I do very little vandalism removal, so I myself am not sure.
>
> F)  Which netblocks do the most vandalism and the least useful editing?  Which
> cities?  Which entire countries?  Should those netblocks, cities, and countries
> be forced to log in before editing?
>
> G)  Wouldn't it be cool if some web browsers or ISPs would tell Wikipedia what a
> contributor's PPPoE username was whenever the contributor made an edit?
>
> If you reply to only one of A), B), C), D), E), F), or G) then please use a
> different subject line than I used.  And add a "(was: ...)" tag at the end of
> the subject line.  That way, it'll be easier for others to follow just the parts
> of the discussion that they want to follow.
>
> Kind regards,
> --[[User:Unforgettableid]]
>
> ^  [1].
> http://en.wikipedia.org/w/index.php?title=Fetus_in_fetu&diff=prev&oldid=339770615
> ^  [2].  http://toolserver.org/~chm/whois.php?ip=174.105.248.31
> ^  [3].  http://en.wikipedia.org/wiki/Road_Runner_High_Speed_Online
> ^  [4].  http://toolserver.org/~soxred93/rangecontribs/
> ^  [5].
> http://toolserver.org/~soxred93/rangecontribs/index.php?type=range&ips=174.105.248.31/8&limit=100
> ^  [6].
> http://toolserver.org/~soxred93/rangecontribs/index.php?type=range&ips=174.105.248.31/15&limit=100
> ^  [7].
> http://en.wikipedia.org/w/index.php?title=Patrick_Stump&diff=prev&oldid=339703861
> ^  [8].  http://toolserver.org/~chm/whois.php?ip=174.106.99.246
> ^  [9].  http://en.wikipedia.org/w/index.php?title=Patrick_Stump&action=history
>
>
> _______________________________________________
> Wikitech-l mailing list
> Wikitech-l [at] lists
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
>

This should be on wikien-l, not here.

-Chad

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


Simetrical+wikilist at gmail

Jan 27, 2010, 6:23 AM

Post #3 of 5 (661 views)
Permalink
Re: Range Contribs tool; anti-vandal software; anon IPs' User-Agents; the netblocks that vandalize the most; etc. [In reply to]

On Tue, Jan 26, 2010 at 11:55 PM, Unforgettableid
<unforgettableid [at] gmail> wrote:
> A)  Did I go too far when I did all the research I described above?  Do you
> yourself often use the Range Contributions tool[4] for looking at vandals' ISPs'
> contributions?

Most of the people here aren't enwiki vandal hunters. Why don't you
ask wikien-l instead?

> B)  What do you think are the chances that the same person made both the
> first[1] and the second[7] vandalistic edits?  The IP addresses' binary
> representations are quite different.

Possible but unlikely. If you look at the reverse DNS, one is
cpe-174-105-248-31.insight.res.rr.com and one is
cpe-174-106-099-246.nc.res.rr.com. The latter looks like it's
probably from RoadRunner in North Carolina, while the former has
"insight" instead of "nc" -- not sure what that is, but they're
probably geographically different groups of customers.

> C)  Why did no anti-vandalism software automatically revert either edit?

This list is for MediaWiki development and Wikimedia systems
adminstration. The various auto-reverting bots are maintained by
entirely different people, and you should ask them.

> D)  When I look at the history[9] of [[Patrick Stump]], I see that there were
> fourteen edits between 06:51 and 07:03, most vandalism.  Yet the vandalistic
> edits come from a variety of IP addresses and usernames.  The IP addresses
> differ widely from each other.  Why is this?

Maybe because they're totally different people?

> E)  When comparing two vandals' edits in other situations, is there any quick
> way for editors to find out both IPs' hostnames, User-Agents, Accept-Charset
> strings, Accept-Language strings, screen resolutions, and/or IP geolocation
> results?  I do very little vandalism removal, so I myself am not sure.

You can find out their reverse DNS and whois information through
standard tools, such as the command-line utilities "dig" and "whois"
or various websites that will run them for you. Geolocation services
are provided by a variety of websites using different databases of
varying quality. The rest is not available to unprivileged users,
although some is available to checkusers (at least for logged-in
users, dunno about anonymous).

> F)  Which netblocks do the most vandalism and the least useful editing?  Which
> cities?  Which entire countries?  Should those netblocks, cities, and countries
> be forced to log in before editing?

That's a policy decision that would be made either by Wikimedia or
individual wikis, not by devs/sysadmins, so this isn't the right list.

> G)  Wouldn't it be cool if some web browsers or ISPs would tell Wikipedia what a
> contributor's PPPoE username was whenever the contributor made an edit?

That's not very useful for people who don't use PPPoE, which is
probably a large majority. We do have arrangements with some ISPs,
like AOL, to send X-Forwarded-For headers so we can display users'
real IP addresses rather than those of proxies. It's very unlikely
that ISPs would be willing to give us their customers' names -- their
customers pay them, we don't.

> If you reply to only one of A), B), C), D), E), F), or G) then please use a
> different subject line than I used.  And add a "(was: ...)" tag at the end of
> the subject line.  That way, it'll be easier for others to follow just the parts
> of the discussion that they want to follow.

I don't think this discussion will go on for much longer anyway, and
people would not appreciate it if I posted seven times as many
responses to a thread that's largely off-topic to begin with.

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


Platonides at gmail

Jan 27, 2010, 3:39 PM

Post #4 of 5 (657 views)
Permalink
Re: Range Contribs tool; anti-vandal software; anon IPs' User-Agents; the netblocks that vandalize the most; etc. [In reply to]

Unforgettableid wrote:
> A) Did I go too far when I did all the research I described above? Do you
> yourself often use the Range Contributions tool[4] for looking at vandals' ISPs'
> contributions?
>
> B) What do you think are the chances that the same person made both the
> first[1] and the second[7] vandalistic edits? The IP addresses' binary
> representations are quite different.

Not likely. Both are childish vandalism, but I don't see a connection
between them.


> C) Why did no anti-vandalism software automatically revert either edit?

Probably those edits didn't match any pattern.


> D) When I look at the history[9] of [[Patrick Stump]], I see that there were
> fourteen edits between 06:51 and 07:03, most vandalism. Yet the vandalistic
> edits come from a variety of IP addresses and usernames. The IP addresses
> differ widely from each other. Why is this?

I see more vandalism based on "He died because he divided by zero".
Perhaps there was something like that said on the radio and all those
people went to the article at once.


> E) When comparing two vandals' edits in other situations, is there any quick
> way for editors to find out both IPs' hostnames, User-Agents, Accept-Charset
> strings, Accept-Language strings, screen resolutions, and/or IP geolocation
> results? I do very little vandalism removal, so I myself am not sure.

IP hostname/geolocation can be done by anyone. If it's a registered
user, only checkusers can. They also have access to the User-Agent.



> G) Wouldn't it be cool if some web browsers or ISPs would tell Wikipedia what a
> contributor's PPPoE username was whenever the contributor made an edit?

That's probably a breach of their contract. And many ISPs don't use
PPPoE usernames, using instead the phone#


_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


admin at some-day

Jan 27, 2010, 3:49 PM

Post #5 of 5 (658 views)
Permalink
Re: Range Contribs tool; anti-vandal software; anon IPs' User-Agents; the netblocks that vandalize the most; etc. [In reply to]

Use russian huy for this purposes.

2010/1/28 Platonides <Platonides [at] gmail>:
> Unforgettableid wrote:
>> A)  Did I go too far when I did all the research I described above?  Do you
>> yourself often use the Range Contributions tool[4] for looking at vandals' ISPs'
>> contributions?
>>
>> B)  What do you think are the chances that the same person made both the
>> first[1] and the second[7] vandalistic edits?  The IP addresses' binary
>> representations are quite different.
>
> Not likely. Both are childish vandalism, but I don't see a connection
> between them.
>
>
>> C)  Why did no anti-vandalism software automatically revert either edit?
>
> Probably those edits didn't match any pattern.
>
>
>> D)  When I look at the history[9] of [[Patrick Stump]], I see that there were
>> fourteen edits between 06:51 and 07:03, most vandalism.  Yet the vandalistic
>> edits come from a variety of IP addresses and usernames.  The IP addresses
>> differ widely from each other.  Why is this?
>
> I see more vandalism based on "He died because he divided by zero".
> Perhaps there was something like that said on the radio and all those
> people went to the article at once.
>
>
>> E)  When comparing two vandals' edits in other situations, is there any quick
>> way for editors to find out both IPs' hostnames, User-Agents, Accept-Charset
>> strings, Accept-Language strings, screen resolutions, and/or IP geolocation
>> results?  I do very little vandalism removal, so I myself am not sure.
>
> IP hostname/geolocation can be done by anyone. If it's a registered
> user, only checkusers can. They also have access to the User-Agent.
>
>
>
>> G)  Wouldn't it be cool if some web browsers or ISPs would tell Wikipedia what a
>> contributor's PPPoE username was whenever the contributor made an edit?
>
> That's probably a breach of their contract. And many ISPs don't use
> PPPoE usernames, using instead the phone#
>
>
> _______________________________________________
> Wikitech-l mailing list
> Wikitech-l [at] lists
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
>

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l

Wikipedia wikitech RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.