Wikipedia talk:Unblock Ticket Request System

Recusals

FWIW, I recuse from UTRS appeal #77629 and UTRS appeal #77620 -- Deepfriedokra (talk) 17:39, 25 August 2023 (UTC)

Peer to peer proxy blocks

I routinely try to stay out of the affairs of the unblock admins as I feel I have too much a vested interest being the developer of the tool. That being said, I'm concerned with the P2P proxy block template. It both refuses to assist a user affected by said block, and throws a slightly modified version of the regular proxy block template at the users. Beyond that it points the user to the meta page, which points to the stewards as a point to complain to. English Wikipedia hands out it's own peer to peer proxy blocks frequently, which the stewards have no ability to override unless they contact one of their English Wikipedia admin colleagues. So the buck is being passed here.

The other problem with this, is peer-to-peer proxy blocks are very similar to range blocks. There are legitimate editors behind it, who have done nothing wrong and no power to do anything to not be editing from P2P proxies. P2P proxies by nature are at their basics a shared IP where one user on that IP employs a proxy, but none of the other users have access to it (nor have a need for it).

I think we need to improve our response to these types of blocks. -- Amanda (she/her) 20:33, 7 September 2023 (UTC)

Agree. Lack tech knowledge to write it meaningfully and not write stupid. -- Deepfriedokra (talk) 20:37, 7 September 2023 (UTC)

We need to offer them a solution or work around. -- Deepfriedokra (talk) 20:38, 7 September 2023 (UTC)

@AmandaNP: How should we proceed? What changes can we make? How can we help blocked users? -- Deepfriedokra (talk) 21:49, 10 September 2023 (UTC)

Any idea how this is going?

We recently had a suggestion to add a parallel system on Commons. I was wondering: how often does this process on en-wiki result in someone being reinstated? I'm guessing that the number is quite low, but if I'm wrong then it makes more sense for Commons to consider it.

Please ping me if responding, I don't currently maintain a watchlist on en-wiki. - Jmabel | Talk 18:32, 14 September 2023 (UTC)

Replied on Commons -- Deepfriedokra (talk) 18:51, 14 September 2023 (UTC)

Possible privacy issue

I’m posting here as I’d like to get community input on this. (I’ve already emailed Oversight, but they confirmed that there was nothing that required suppression under the Oversight policy, so I’m assuming it’s ok to talk about on-wiki.)

Let’s say that Logged-in User X has a (non-anon-only) block that’s been placed on an IP address they use. They don’t want to reveal their IP address on-wiki, so they follow the instructions in the block notice and submit a request through UTRS, for the IP block underneath their account to be lifted.

After investigating, let’s say the responding administrator determines that the IP block was misplaced. They unblock it, and include the UTRS # in the unblock reason field so that it’s clear to other editors/admins why the block was removed.

This on its own isn’t a privacy issue, I don’t think. However, the problem is that there is an automatically-updated page on-wiki that contains a list of all UTRS appeals: User:AmandaNP/UTRS Appeals. When User X submitted their appeal, it will have been added to the table, along with the UTRS # and their username.

Therefore, because of the existence of this table, the unblocked IP address can be connected to User X completely on-wiki — by using the appeals table to determine a username from the UTRS #. This is despite the fact that User X appealed through UTRS (rather than on their talk page) specifically because they didn’t want this to happen.

This isn’t just a hypothetical situation. There are several situations I’ve found where an editor’s IP address seems to have been inadvertently revealed on-wiki in this manner (hence my contact with Oversight prior to posting this publicly).

I don’t know what the solution is here. I’m posting it on-wiki because I’m hoping that members of the community might have an idea of what might be best.

Notes

All the best, ^user:A smart kitten_meow 08:29, 29 September 2023 (UTC)

As only admins have access to UTRS and as sensitive information is/can be oversighted, there is no privacy issue. Users with names do not reveal their IP's. IP's are visible to CU's only. Indiscretions in UTRS tickets are oversighted. Admins need to know the status of UTRS tickets when evaluating requests for unblocking. @AmandaNP: covered these considerations years ago. -- Deepfriedokra (talk) 21:12, 29 September 2023 (UTC)

@Deepfriedokra: Forgive me if I’m getting confused, but (e.g.) if an IP address is unblocked with the logged reason unblocking per UTRS #63829, and the UTRS table contains a row that connects #63829 to User:Example2, then isn’t that effectively revealing an IP address of user Example2? I don’t mean to imply that things haven’t been properly considered, just wanted to share a concern that came to my mind. Sorry if how I wrote it lead it to come across as the former. Best, ^user:A smart kitten_meow 18:32, 30 September 2023 (UTC)

If it's an IP an not a registered user, it is not a privacy violation. -- Deepfriedokra (talk) 19:05, 30 September 2023 (UTC)

The ticket you refer to was sent to the checkusers as a checkuser block. Don't see where that user was unblocked per that ticket. I see no connection yet to a registered user. -- Deepfriedokra (talk) 19:07, 30 September 2023 (UTC)

As far as I can tell, there was no connection drawn between the IP, the ticket, or a registered user. -- Deepfriedokra (talk) 19:10, 30 September 2023 (UTC)

And I cannot see unblocking a registered user and referring to a UTRS ticket for an IP. I would have no way of knowing of that connection. -- Deepfriedokra (talk) 19:12, 30 September 2023 (UTC)

And I think I only post UTRS statuses for uncomplicated tickets w/o privacy concerns because of obvious reasons. -- Deepfriedokra (talk) 19:16, 30 September 2023 (UTC)

And, for instance, I did not post to that talk page (for UTRS appeal #63829) when I closed the ticket. -- Deepfriedokra (talk) 19:18, 30 September 2023 (UTC)

@Deepfriedokra So sorry, that was a random number I plucked out of my mind to use as an example. I can get an actual example if you want but that was just a random string of numbers for a hypothetical example. ^user:A smart kitten_meow 19:22, 30 September 2023 (UTC)

You have a registered user that was unblocked with reference to a UTRS ticket for an IP? -- Deepfriedokra (talk) 19:23, 30 September 2023 (UTC)

Yeah, the reason for posting (after emailing oversight) is because I’d found IPs that had been unblocked with references to UTRS numbers, where the UTRS table connected those numbers to registered users.

Is it okay if I email you the examples? I was deliberately vague in my original post here because, even though oversight’s been declined, I’d still feel uncomfortable referring directly to an IP-user combination onwiki.

Best, ^user:A smart kitten_meow 19:26, 30 September 2023 (UTC)

That would be great. Ann the UTRS ticket numbers. -- Deepfriedokra (talk) 19:48, 30 September 2023 (UTC)

So the next question is, shouldn't we oversight any ticket that connects a name with a number? -- Deepfriedokra (talk) 20:08, 30 September 2023 (UTC)

I'm afraid that was all very confusing for me. A link to the IP and the UTRS number would be all I need. -- Deepfriedokra (talk) 20:18, 30 September 2023 (UTC)

Two I saw, and could probably revdel. One, the link did not work -- Deepfriedokra (talk) 20:23, 30 September 2023 (UTC)

Three revdel'd. The 72.78 does not work for me. Moving forward, this probably something we should not be doing. -- Deepfriedokra (talk) 20:31, 30 September 2023 (UTC)

Please don't I'm dyslexic, and, no. -- Deepfriedokra (talk) 20:32, 30 September 2023 (UTC)

Having said all that, at UTRS, we walk a fine line between transparency and not violating privacy. -- Deepfriedokra (talk) 20:35, 30 September 2023 (UTC)

• This is an interesting problem. There is a need for transparency of admin processes and a need for protecting privacy. I really don't know the solution here except to get rid of @AmandaNP:'s table. Which reduces some transparency but I'd rather do that then not provide a UTRS ticket # when unblocking accounts or IPs.--v/r - TP 04:32, 2 October 2023 (UTC)

  Sorry this is the first chance I've had any sort of energy all this weekend, and I've been trying to get some dev work done before the week starts.

  This really is one hell of use case. Essentially, someone would have to find a UTRS ticket for a user - which could be a needle in a haystack, then search through the unblocks for the UTRS number, where an admin unblocked an IP (which is a rarity with some new statistics I'm tracking), and make the correlation there - if it's not already a proxy and obfuscated. That's a lot of leg work, but it's still enough for an essential privacy breach.

  I don't want to review (nor want to have the argument in my head) what UTRS should/shouldn't be through this, so I don't really have an option but to at least remove the appeal numbers. I could I guess put hashes so that it doesn't link back to a ticket number...but that would require even more dev work for little gain. That would leave the appeal user, the type of appeal, the status and the verification - and verification being anything but verified will be a thing of the past shortly. I don't think any of that reveals private data nor would require me to stop producing the table and nuke it. I do see a point in deleting what has been there though, so I'll go through and do that now. If there are other concerns we'll have to talk them through. -- Amanda (she/her) 05:21, 2 October 2023 (UTC)

  For clarity, that is now  Done. -- Amanda (she/her) 05:34, 2 October 2023 (UTC)

  They used Quarry searches. -- Deepfriedokra (talk) 08:06, 2 October 2023 (UTC)

  @AmandaNP: Looks good. Thanks. -- Deepfriedokra (talk) 08:09, 2 October 2023 (UTC)

  FWIW, I don't use the table to navigate UTRS. I get all I need once I'm there. Thanks again. 😀 -- Deepfriedokra (talk) 08:11, 2 October 2023 (UTC)

Something not quite right

I clicked on a link (here) to utrs-beta.wmflabs.org/appeal/80761, whereupon I was told

403 Forbidden: Viewing enwiki appeals is restricted to users in the following groups: admin, staff, steward

I'm an admin here in en:WP. (Actually I was always under the impression that this did not let me see OTRS/VRT/UTRS stuff.) But:

Your user roles have not been loaded yet.

I tried again after a few minutes. But:

If your role [sic] have not loaded after a couple of minutes, please contact us.

It haven't, even though I waited more than a couple of minutes. (Not that I much mind; I'm just dutifully complying with the request to contact you, as a working system might help another user who, unlike me, needs to be able to read what's written.) -- Hoary (talk) 02:48, 6 November 2023 (UTC)

I logged in through OAuth yesterday and I got the same message which hasn't changed when I checked again just now. 0xDeadbeef→∞ (talk to me) 01:14, 17 November 2023 (UTC)

There's a way to manually recheck one's permissions. Try logging in, then clicking on your user name (top right), then ticking "Reload permissions from attached wikis", then click save. See if that fixes it.

This process really should be automatic or at least less hidden, so may be worth a bug report at https://github.com/utrs2/utrs/issues. –Novem Linguae (talk) 01:31, 17 November 2023 (UTC)

I did try that yesterday, and I did it again after your comment. Still no permission. 0xDeadbeef→∞ (talk to me) 02:26, 17 November 2023 (UTC)

Does it send you to meta.mediawiki.org to authenticate? Is your account there and here both linked to the same global account?--v/r - TP 04:59, 17 November 2023 (UTC)