User:OrenBochman/Counter Vandalism

This is an assignment for Simone's adoption program. You are welcome to edit this page if you notice any errors or have any additional information to add, but as a courtesy, please notify OrenBochman if you make any major changes to avoid any possible confusion between him and his adoptee(s). Thanks!

This is a tutorial on counter vandalism. It is based The Rambling Man, on vandalism

Rambling Man, I noticed you put in over 4,000 edits in the last 2 weeks. Please describe the procedures you use for fighting vandalism?

I also have some questions for you:

1. #How do you switch between VandalProof and AWB so fast?
2. #Is VandalProof easier to use than Popups for reverting vandalism?
3. #Do you feel the warnings posted to users' talk pages about their vandalism help?
4. #Do you make use of the Defcon system?
5. #Where did you learn how to fight vandalism (what instruction pages did you read, who taught you, etc.)?
6. #Do you actually read each edit before you revert, or guess based on certain factors?
7. #Sometimes vandalism hunters revert valid edits; how does this happen, and how can it be avoided?

I tend to kick AWB off with some rudimentary task such as spell checking on a large category e.g. :Category:1980 births, set it to skip pages to which it makes no changes and let it run, perhaps even minimising it. Then I get on with VP and focus my attentions on anonymous IP vandalism. Whenever AWB finds a page which it thinks needs changing, the taskbar (I'm running XP) will flash so that I can quickly restore AWB, check that the mods AWB is suggesting are sensible, save or ignore as appropriate, and minimse to get back to VP again. One thing (I'll talk more about shortly) that I would suggest is refreshing VP when coming back to it after a period of time (even a relatively short one) to avoid mistakes...!

Yes, oh yes, and thrice yes. VP allows multiple edits to be reverted in one click and adds a suitable warning to the vandal's talk page. VP also allows you to keep track of vandals you yourself have already blacklisted and checks user pages for warnings already posted.

Although mistakes can be made with VP, I believe that even more are possible with Popups.

Yes, I think that a large proportion of anonymous IP vandals really are testing out Wikipedia and as such the test templates are ideal. In most cases I normally only have to issue a test1 or test1a (for when they blank sections of the page) to first-time vandals and they back down.

Clearly there are serial vandals out there for whom the warnings are useless, but it's right and proper to follow the procedures of at least giving a third and fourth level warning before opting for WP:AIV.

Kind of. I will tend to stay on longer if Defcon is 3 or worse, but on the whole I tend to keep my eyes peeled when the kids in the USA get to school which starts early afternoon for me. In my experience there's usually a huge surge of "blah is a poop head" around that time.

Learning was (and still is) by just applying the policies as best I can with the tools. I'd recommend WP:VAND, of course, which places considerable emphasis on assuming good faith in all edits before declaring them as vandalism. I do base the level of warning on the type of vandalism - it's a case of trying to judge whether the edit you're about to revert really was a test or if the editor knew exactly what he was doing.

I didn't receive any tuition from anyone really. I spent some time looking at why pages had "rvv" in their edit summary, and spent some time trying to understand WP:EL so that I could keep an eye on spam links being added. I've certainly upset a number of anon IPs who think I'm victimising them, which of course I'm not, I'm just removing their vandalism.

Finally, most of my learning comes from the mistakes I make! Remaining polite, calm and circumspect is very useful when under assault from (righly) disgruntled editors!

Both, but it does depend on how VP reports each edit. VP will highlight pages with large changes in the number of characters, so blanked pages or sections of pages stand out like a sore thumb. Generally I'll revert those on sight, but that has lead to one or two mistakes (more below). Large additions from anon IPs also tend to be "blahisgay" copied and pasted a thousand times. This is clearly identifiable from the diff and I'll revert them instantly. Most editors who contribute significantly and intelligently will tend to be logged in. I do spend 99% of my time hunting the anon IPs.

I also tend to seek out changes without edit summaries, although most of anon IP edits are made without them so it can be a false indicator.

Yes, and in the last 4000 edits I have to admit to a few mistakes. The warning VP places on user talk pages encourages discussion if it is believed that the reversion was made in error. I positively encourage this too. In most cases the reason my reversions have been mistakes are that I'm trying to do too much at once. As I said earlier about using AWB in parallel, if I leave VP just before I press the rollback button (in other words, rollback is still available before I go to AWB) and then come back and rollback, there's a good chance that I'll rollback a reversion that VP hasn't seen which took place while I was using AWB. The only foolproof way of avoiding this is to refresh the list of recent changes or click another edit within VP and click back to the one in question. This way VP reloads the edit history and mistakes can be avoided!

Template:Wdefcon Yes, it helps a lot. Thanks. And yes, your answers have brought some more questions to mind:

8. #Do you use different browsers at the same time?

9. #Do you operate both AWB and Vandalproof in Internet Explorer windows?

10. #I just reread the description of your external interface - has that changed at all?

11. #What is the difference between vandal hunting and Recent changes patrol?

12. #What was the most confusing thing you had to overcome when you started learning how to deal with vandalism?

13. #What is your main method of finding vandalized pages?

14. #What other methods of finding vandalized pages do you use?

15. #Do vandalism hunters work together, or do you all pretty much work on your own? How do vandalism hunters coordinate their efforts?

16. #What other kinds of edits do you come across when dealing with vandalism, and how do you deal with those? For example, do you spot them in VandalProof, and then work on them in another window? Or is VandalProof multi-purpose in this regard?

17. #Do you use AWB for fighting vandalism, and if so, how?

18. #Is VandalProof useful for anything else besides finding and reverting vandalism?

19. #You mentioned in a previous discussion that VandalProof is a bit buggy. Are you still having problems with that? Have the bugs been fixed, or have you found some workarounds?

20. #What other procedures do you use to fight vandalism?

21. #What is the most important thing to keep in mind when fighting vandalism?

22. #Do you have any other tips for would be vandalism hunters?

23. #I'd like to invite some more vandalism hunters to participate in this discussion. What are the easiest ways to find them?

With IE7, we've finally caught up with Safari and Firefox with half-decent tabbed browsing. Unfortunately most developers are still stuck in the land of Windows so I have to revert to my trusty Dell where I can just IE7 on its own. On my iBook I do use both Safari and Firefox together, but unfortunately it precludes the use of both AWB and VP (for the time being...) so I'm stuck with Popups which does tend to blitz Safari. I do confess to being on Mac OS X 10.3 though, perhaps with Tiger or Leopard these problems will go away.

No, they both operate in their own environments, independent of IE. This is a good thing because it means that when IE crashes (does that ever happen?!) then my life isn't overwhemingly disrupted. VP has its fair share of bugs, and it does crash out often. If, like me, you enjoy long sessions (e.g. over a couple of hours), VP becomes very sensitive and falls over a lot. It's been reported to the author and a number of users are hoping for resolution soon. Having said that, the power of the tool by far compensates for the shortcomings.

No, other than I'm now using IE7 on my Windows platform(s) instead of IE6. The tabbed browsing is good, but still lacking in user friendliness with respect to Safari.

I do a bit of RC patrol, it tends to concentrate on people using it for attack pages or nonsense pages. These are the pages that I spend most of my time on (without tools) and simply using the {{db...}} templates. Vandal hunting ranges from noticing sections or pages being blanked to individual statistics and references being subtly modified. Vandal hunting and RC patrol are different disciplines, but they most certainly have common elements.

That's an interesting question. I think the most challenging thing was remembering to be bold, in other words, I had to trust my instinct. If someone anonymously changed a number in an article without good reason (i.e. an edit summary) it felt strange to use the tools to suggest that they shouldn't have done it.

With WP:VPRF it's looking at the pages with most added or most taken away. Beyond that I'd suggest heading for anon IP changes without summaries and then after that it's just luck!

I look at pages which are frequently vandalised and add them to my watchlist. For example, it was recently brought to my attention that Coventry City F.C. was a frequent victim of anon vandalism. I was asked to repair a partially reverted page and afterwards I chose to watch the page as it was clear that the vandal in question wasn't going to quit. I've also spent some time working (subtly!) within Wikipedia:WikiProject Football and they have a selection of pages to watch which are commonly vandalised.

Talking to other editors is a good way of working out what will be subject to vandalism.

As above I use hints from the odd Wiki-project, but generally I'm a independent vandal warrior.

I'd just like to point out that many vandalism hunters use the #vandalism-en-wp channel on the Freenode IRC network to coordinate reversion efforts.--digital_me 05:10, 14 December 2006 (UTC)

Yes. A lot of them do. When I used it I found it to be a great tool to use in fighting vandalism. If you are looking to fight vandalism and are interested in a tool check this out. Peace :) --James, La gloria è a dio 22:21, 11 March 2007 (UTC)

That's definitely a great help, anytime I'm on IRC, I've got #bootcamp and a few of the vandalism channels on. Vandal hunters are independent, I'm not sure how we could work together. [Mαc Δαvιs] (How's my driving?) ❖ 17:46, 1 April 2007 (UTC)

I do find that several edits are well-meaning but badly formed, in other words they're not exactly vandalism but they don't quite meet WP:MOS, say. In these cases I tend to head for the editor's talk page and chat about it, or in extreme circumstances I'll roll back their edits with VP (which allows you to do this without warnings being placed on talk pages) and carry on going for the extremists...

At the moment, no. I feel that I allow AWB to use my resources to make Wikipedia more accurate and more consistent. It's more of a background tool for me at the moment.

Well, it's certainly useful to see how the guts of Wikipedia works. It takes its feed from the IRC which means that it's quick and efficient. Observing how quickly bots and other VP users revert vandalism is an education, some of these guys work at light speed...!

It's still buggy. But the VP community are honest and upfront and we add our comments here. The benefits of the tool by far outweigh its shortcomings. I'd like to see a Mac OS X version, but then I'm a bit of a snob like that!

I frequently check my watchlist, althought that got up to over 8,000 articles recently so I've cut that down a bit. I'm keen to listen to other users and add frequently vandalised pages to my watchlist.

1. Be prepared to get it wrong. I've made several mistakes with the Popups and VP tools. Just be prepared to discuss it, be humble, apologise and get on with life!
2. Be prepared to let it go. So you see an anon edit without summary that changes that population of town X from 10,000 to 15,000. You need to think twice about reverting it, but the key thing about VP is that it encourages editors to discuss their edits. However, we shouldn't bite the newbies and as such you need to be prepared to let some edits go. Either do the research or move on.

Tips... be prepared to make mistakes, use VP judiciously and be aware that it will lead you astray unless the info is 100% tip-top up to date. I'm predominantly concerned with anon IP vandalism which can be demoralising because the last thing that Wikipedia wants to do is ban schools, colleges etc and that's where most of your daily work comes from. Be patient and cool, enjoy the chase and keep one thing in mind - everything you do should make Wikipedia better.

• It's like being in the A Team! "If you know where to find them..."' and all that.
• I bump into vandal hunters all the time, especially using VP. You tend to see who's reverted multiple acts of vandalism before you.
• You could add WP:AIV to your watchlist to see who's adding culprits (us vandal hunters) and who's deciding on whether or not they should be blocked (the admins). This page is frequently backlogged which is a source of frustration to us non-admin vandal hunters. Some vandals can run amock for over an hour after being reported.

Hi, I feel that I have sufficient experience in vandal fighting to answer these questions... I tend to use Lupin's tools... for more info, see here and, extremely helpful, here. These tools are easy to use and quite quick, but save you from downloading any tools. Recent changes is also a good, but somewhat slower way of reverting vandalism, because there are a number of valid edits in there (which is GOOD, but harder to find vandalism in) however, you can see from the edit summaries where some vandalism is. CattleGirl ^{talk | e@} 01:50, 12 December 2006 (UTC)

I like to use VandalSniper both because I like it and because it's my tool. (So I'm a bit biased there.) It's very good at pointing out obvious vandalism by giving a count of lines removed, added, and changed, and it counts the number of words that could be considered vandal slang and/or blatant profanity. It also notifies me -- in real-time -- of changes made to my watchlisted pages and changes made by users that I've added to my VS blacklist. This makes RC patrol much quicker; I can patrol the recent changes, while knowing that my tool is watching users I've flagged as potential problems. I don't need to reload their contributions every 30 seconds to see if they've made any further edits, and any RC patroller knows that this becomes impossible once you've run into just five or so people. --Chris (talk) 19:08, 12 December 2006 (UTC)

Just browsing you tend to find some vandalised pages, but checking out the new pages is always a good way to check for pages that should be speedily deleted. However, I, as I said before, use Lupin's tools, which bring me to a page found in my toolbar. This page filters the recent changes and picks out edits containing words that have been 'tagged', at User:Lupin/badwords. On this page is a "show details" button, which shows a diff of the edit, a rollback (revert) button, which reverts all edits on that page the user has made, a warn button, as well as a link to contributions and the talk page of that user. A really effective tool for reverting vandalism

CattleGirl, you mentioned "I use Lupin's tools, which bring me to a page found in my toolbar." What page? What toolbar? How did you set that up?

If you have a look on the left hand side of the screen, you will see a Toolbox, with a few links in it, for instance "What links here" and "Upload File", but with Lupin's tools, you have a number of extra links, my favourite being "Filter recent changes"- an effective vandal-fighter. The Transhumanist has posted some more links below

To summarize CattleGirl , and with some additional links, here's a list of pages which can assist you in finding new pages that you can check for vandalism:

• User:Lupin/Anti-vandal tool - after you have installed the tool in your monobook.js page, you can use it to patrol the following pages:
  • [W:[User:Lupin/Filter recent changes|[User:Lupin/Filter recent changes]]
  • User:Lupin/All recent changes
  • User:Lupin/Recent IP edits
  • User:Lupin/Monitor my watchlist

• Some other pages to check (using VandalProof, etc.:
  • Special page:Newpages
  • Wikipedia:New user log
  • Wikipedia:RC patrol
  • Wikipedia:New articles by topic
  • Wikipedia:Request articles
  • Category:Wikipedia new articles

If you have IRC (I use Chatzilla) you can look at a bot-feed of anything added to Wikipedia with 'http://' in it - great for removing linkspam (which is a growing problem). The bot itself is named Linkwatcher, and you can see this feed at #wikipedia-spam, or ask about it on its talk channel at #wikipedia-spam-t. It really is brilliant to see; you can just do a couple of middle-clicks from the channel and get the page dif and view the potential spam link, making it simply a matter of to revert changes or not. Those guys love new volunteers too, so hop on over. JoeSmack ^Talk 16:47, 13 December 2006 (UTC)

I'd like to see a more effective way of stopping vandals. Just recently I came across an editor who had only made a few edits, including major vandalism and creating attack pages, and these edits were sufficient enough to get him blocked- however administrator's aren't superhuman, and can't get to every blatant vandal all the time. I suppose it's like what The Transhumanist said before- the encyclopedia is growing larger, and we don't have enough admins for it. There are a lot of users out there who would make fine admins, and would like to be an admin, however they have not applied for adminship- it's a matter of encouragement and confidence. CattleGirl ^{talk | e@} 02:01, 12 December 2006 (UTC)

I'm not sure about the percentage, however it has over a hundred thousand edits and probably clocks up a few thousand edits per day. Here's its contribs- [1], as you can see, there were too many edits to count! I do sometimes clash with AVB when I revert, in an edit conflict, or sometimes I can't revert at all because it's beaten me to it, but it's a great tool. As the encyclopedia is growing and more users are editing, so are more vandals, and we need as many anti-vandal fighters as we can, both human and bot. CattleGirl ^{talk | e@} 02:14, 12 December 2006 (UTC)

If I can add to this (:)), I occasionally run User:MartinBot, which is an AVB clone, when the main bot is down. As it's on the toolserver, AVB has a far superior edit rate to any of the clones, and does a huge amount of vandalism, but only the blatant stuff (page blanking, addition of some "badwords") and often, bad edits will come in while the bot is reverting others, which subsequently get missed (the bot has to conform to an edit throttle per WP:B), so there will always be (huge amounts of) work for human vandal fighters, whether on RC patrol, or using any of the many tools available. To answer a part of the question I only just saw, the edit rate of AVB has probably reached its peak (ie, it did when it went on the toolserver!). Of course, there are fluctuations depending on the time of day, but I doubt that AVB can get much quicker, as there's only so many edits it can make per minute. Martinp23 19:10, 12 December 2006 (UTC)

What would define a Defcon 1? Has it ever happened before? In this event, is there a system to simultaneously summon a large amount of editors to help? A call to arms for admins?

The Wikidefcon levels are described at Template:Wdefcon/descriptions. I don't know whether defcon 1 has happened before (I assume it has). The Wikidefcon box that appears above on the right-hand side of the screen is the vandalism alert system! That box is the template called Template:Wdefcon and it is transcluded to this page. Whenever a template page is updated, the update appears wherever that page is transcluded. Hundreds of vandal fighters have the Wdefcon template transcluded to their user pages. To transclude that template to your user page, place {{Wdefcon}} wherever you want the alert box to appear on the page (preferably near the top so it's one of the first things you see when you access your page). If there's anything you need clarified further, please feel free to ask.

Defcon1 here apparently by Doc Glasgow/Wdefconbot. And at least one other occasion by a vandal....

What are the recommendations, if a user operates on a Dial-up connection (45.1 kbps) which limits his time and inhibits effective vandal fighting and makes using programs like AWB and Vandal Proof difficult. ?

If all I had was dial-up, I would optimize performance by minimizing bandwidth requirements, and would therefore focus only on editing by cuttin and pasting a page to an editor (like Wordpad), editing it, and then cutting and pasting it back in to the article when I'm done editing it. Or write new articles from scratch on my computer and upload them when I'm done. Interactive editing using the Wikipedia interface would be too cumbersome because the wait times between actions would waste too much time. Therefore, off-line work is the key to optimizing performance. A slow connection pretty much rules out vandalism patrolling. Though you should still revert any cases of vandalism that you run across. I hope this advice helps.

I hope this is not too late to ask a question that has been bugging me. It seems to me from reading the above that most vandalism is done from anon IPs. In my experience, the path to blocking an anon IP, especially if it is a proxy, is too long. I often go to anon IP talk pages to leave a warning message, only to see that they already have 10 or 20 such messages and still have never been blocked.

I guess my question is basically this: first, is it technically possible to block access from anon IPs but still allow registered users from that IP to access? If so, don't you think it is legitimate to be "trigger happy" in blocking anon IPs, even for long periods of time? This could go with a friendly template stating that legit editors from that IP should sympathize with our difficulty and create users in order to be able to continue editing. Am I the only one who thinks this? --Zvika 07:43, 5 January 2007 (UTC)

Sorry for the late reply, but I've been busy in both the real world and in my RFA. I believe that blocking IP addresses will prevenet a registered user from editing from that IP address. In the words of WP:BLOCK,

When a blocked user attempts to edit, their IP is "autoblocked", so that the user may not make the same edit anonymously or under a different username. Autoblocks expire after 24 hours — when a username is blocked indefinitely, their IP will be automatically unblocked 24 hours after he or she last attempted to edit a page.

As for friendly templates, they actually already exist, the{{sharedwelcome}}, {{test3ip}} and {{Anon vandal}} templates all contain a caveat for good-faith editors working from IP addresses which may have received warnings in the past. They also ask anon editors to consider creating an account. Hope that helps. The Rambling Man 09:07, 10 January 2007 (UTC)

Hi BK, and thanks for your response. Am I correct in understanding that if User A vandalizes a page and is blocked, and User B shares the same proxy server, then User B will also be blocked -- even when logged in as User B? Doesn't this seem like a bug that ought to be fixed? Who would be responsible for fixing something like this? I think this could really help reduce the amount of vandalism on WP, by giving admins more freedom to block consistently troubling IPs (e.g. proxies) for long periods of time. --Zvika 16:08, 10 January 2007 (UTC)

Not necessarily - an administrator could block the user A, but disable autoblock to allow User B to continue editing, as well as any subsequent accounts registered from that IP (which creates the possibility of sockpuppetry). You might want to review WP:BLOCK#How to block for the complete documentation. anthonycfc ^[talk] 19:58, 11 March 2007 (UTC)

Here are some practice AIV. You must tell me if a block is appropriate and what duration the block should last for. Good luck!

Example 1 Template:IPvandal vandalized pages at 19:51, 19:55, 19:57 and 19:59. The user was then reported to AIV.

Last three warnings:

• 20:00 UTC 12 March (uw-4)
• 19:58 UTC 12 March (uw-3)
• 19:56 UTC 12 March (uw-1)

Example 2 Template:IPvandal vandalized pages at 19:51, 19:55, 19:57 and 19:59. The user was then reported to AIV.

Last three warnings:

• 20:00 UTC 12 March (uw-4)
• 19:58 UTC 12 March (uw-2)
• 19:56 UTC 12 March (uw-1)

Example 3 Template:IPvandal IP vandalized pages at 23:11 on 12 March. The user was then reported to AIV.

Last three warnings:

• 20:00 UTC 11 March (uw-4im)
• 19:58 UTC 8 March (uw-3)
• 19:56 UTC 7 March (uw-1)

Example 4 Template:IPvandal School IP vandalized at least 10 times on March 12, directly after a 3-month block. The last vandalism edit occurred after a final warning. The user was then reported to AIV.

Last three warnings: 20:00 UTC 12 March (uw-4) 19:58 UTC 12 March (uw-3) 19:56 UTC 12 March (uw-1)

Example 5 XX (talk · contribs) Registered user vandal created an account and has made 6 vandalism edits, 1 of which came after a final warning. The user was then reported to AIV.

Example 6 Template:IPvandal Shared IP last received a vandalism warning (uw-4) at 19:00 UTC on March 11. Someone from the IP has made 4 vandalism edits at around 12:00 UTC on March 12, but has not received no final warnings (uw-2 was the highest). The user was then reported to AIV.

Any questions or would you like to take the test?