Wikipedia:Edit filter noticeboard

Welcome to the edit filter noticeboard
Filter 1235 (new) — Actions: none; Flags: enabled,public; Pattern modified
Last changed at 13:49, 7 December 2022 (UTC)

Filter 1234 (new) — Actions: none; Flags: enabled,private; Pattern modified

Last changed at 13:20, 6 December 2022 (UTC)

Filter 384 — Pattern modified

Last changed at 20:22, 5 December 2022 (UTC)

Filter 1013 — Flags: enabled

Last changed at 21:49, 4 December 2022 (UTC)

Filter 54 — Pattern modified

Last changed at 00:23, 4 December 2022 (UTC)

Filter 887 — Pattern modified

Last changed at 00:09, 4 December 2022 (UTC)

Filter 890 — Pattern modified

Last changed at 00:08, 4 December 2022 (UTC)

Filter 1168 — Pattern modified

Last changed at 00:01, 4 December 2022 (UTC)

Filter 1220 (deleted) — Flags: disabled

Last changed at 23:47, 3 December 2022 (UTC)

Filter 1233 (new) — Actions: disallow; Flags: enabled,public; Pattern modified

Last changed at 23:42, 3 December 2022 (UTC)

This is the edit filter noticeboard, for coordination and discussion of edit filter use and management.

If you wish to request an edit filter, please post at Wikipedia:Edit filter/Requested. If you would like to report a false positive, please post at Wikipedia:Edit filter/False positives.

Private filters should not be discussed in detail here; please email an edit filter manager if you have specific concerns or questions about the content of hidden filters.

Click here to start a new discussion thread

Condition limitEdit

I'm not liking the look of this graph (live view). If that line touches 1000, then some of time, some filters (probably the highest-numbered ones) won't be active on every edit. I've already pruned out a few of "my" filters and will look for more. But now would be a good time to check "your" filters. Suffusion of Yellow (talk) 21:26, 18 October 2022 (UTC)

Thanks for the heads up. I do think we should be culling more of the filters. Excluding anything edited in the last couple of months, I see there are active 'test' filters 'owned' by ProcrastinatingReader (2), King of Hearts (201), TheresNoTime (1 & 773), Crow (861), Cyp (898), Cyberpower678 (915), ST47 (1019), QEDK (1027), Blablubbs (1166). Unless they step forward to claim them, I'll disable them. -- zzuuzz (talk) 22:11, 18 October 2022 (UTC)
Disabled 1 (as the last person to touch the main public test filter) and 773 — TheresNoTime (talk • they/them) 22:14, 18 October 2022 (UTC)
@TheresNoTime: Mind moving it to another filter as it's relatively useful in catching erroneous pages or those that are in the wrong ns. --Minorax«¦talk¦» 08:11, 23 October 2022 (UTC)
@TheresNoTime: <bump> --Minorax«¦talk¦» 04:50, 1 November 2022 (UTC)
Thanks for the ping. I've disabled mine. --Blablubbs (talk) 22:17, 18 October 2022 (UTC)
It looks like Crow is inactive. 861 disabled. -- zzuuzz (talk) 22:28, 18 October 2022 (UTC)
@Tamzin, 'TeZt' filter 1206. -- zzuuzz (talk) 22:40, 18 October 2022 (UTC)
Disabled mine (and marked disabled filters above). Κσυπ Cyp   07:43, 19 October 2022 (UTC)
Disabled mine as well (thanks for the ping). --qedk (t c) 10:58, 19 October 2022 (UTC)
Thanks, I've disabled the remainding test filters. We should still review any others. -- zzuuzz (talk) 18:57, 20 October 2022 (UTC)
Eyeballing the graph linked above (or just counting the |s by hand), it looks like 1094 (hist · log) (@Ohnoitsjamie:) is using about 60-90 conditions in the worst case. Most of that is from checks targeted at a few pages each. I've usually declined requests for single-page filters, because, well, if we have too many of them, we'll run out of conditions. Now you could reduce condition usage on most pages with a redundant check at the start:
equals_to_any(page_id, 1, 2, 3, 4, ...) & (
      (equals_to_any(page_id, 1) & added_lines irlike ...)
    | (equals_to_any(page_id, 2, 3) & added_lines irlike ...)
    | (equals_to_any(page_id, 4) & added_lines irlike ...)
But that still could trip the condition limit on any the targeted pages. I have to wonder if protection (at some level) is a better choice for most of these pages. It's been my view that single-page filters should be used only if there's really a good reason to keep a page unprotected. Suffusion of Yellow (talk) 23:01, 18 October 2022 (UTC)
I pruned a bunch of LTA conditions that seem to be dormant; also disabled another entire filter, which will hopefully help. OhNoitsJamie Talk 23:14, 18 October 2022 (UTC)
@Suffusion of Yellow and Zzuuzz: Unsure if it'll be helpful, but I've got a bot job which could keep User:TNTBot/abusefilter-conditions up to date with the most recent condition usage (currently paused) — perhaps a template could be shown here/on Special:AbuseFilter if it approaches 1000 again? — TheresNoTime (talk • they/them) 12:46, 19 October 2022 (UTC)
@TheresNoTime: Nice! If it's not too much trouble for you to maintain, might as well transclude it all the time. Suffusion of Yellow (talk) 20:54, 19 October 2022 (UTC)
@TheresNoTime: can we not just implement that in AbuseFilter itself? Legoktm (talk) 21:57, 19 October 2022 (UTC)
I was thinking it'd make a somewhat useful magic word... I've stopped the bot and I'll take a look at that tomorrow  TheresNoTime (talk • they/them) 22:03, 19 October 2022 (UTC)
The condition count is very dynamic and IMO a poor fit for a magic word that ends up getting parser cached, etc. I just meant having Special:AbuseFilter show a warning if you're close to the condition limit (like 80% or 90%). Legoktm (talk) 22:05, 19 October 2022 (UTC)
Ah, makes sense, yes — TheresNoTime (talk • they/them) 22:09, 19 October 2022 (UTC)
Would it be worth checking through the currently enabled filters, sorted by lowest hit count, to find any that are consuming conditions but not actually getting any hits? Though I can't see the private filters, there seems like there might be some low hanging fruit there in the public filters. For example, #1213 has never had a hit as far as I can tell but according to its statistics entry it consumes 2.2 conditions on average despite this.
The other suggestion I'd have would be to look for duplicate filters. For example from the titles, it looks like filters #1159 and #1217 are tracking the same disruption. I can't confirm if this is the case beyond the titles however as 1217 is a private filter. Sideswipe9th (talk) 21:15, 19 October 2022 (UTC)
See User:MusikBot/StaleFilters/Report. Unfortunately some filters get just enough hits (often entirely or mostly FPs) to avoid being listed there. E.g. 860 (hist · log), which I've just disabled.
Not sure what's going with 1213; either that was never really an issue, or there's a typo in filter somewhere. If no one can spot anything wrong with it, I'll disable. 1159 and 1217 have different actions enabled, and are dealing with some active ongoing harassment, so I'll leave those for now. Suffusion of Yellow (talk) 03:03, 22 October 2022 (UTC)
For 1213 the regex looks fine, it validates OK, and there's no spelling mistakes in the listed categories I can easily see. We could test the filter on testwiki if you want, and manually add those categories to a sample page to see if it gets a hit. But otherwise aside from the report that lead to its creation, it doesn't seem to have happened since. Sideswipe9th (talk) 22:52, 22 October 2022 (UTC)
The stale filters report has one interesting entry that I can't see. Filter #729 hasn't had a hit in just under 7 years. Unfortunately it's a private one so I dunno how many conditions its consuming. Description says it's tracking a specific set of vandalism, so either that vandal has stopped or they've changed editing patterns? Sideswipe9th (talk) 23:00, 22 October 2022 (UTC)

You know what? This haphazard approach is duplicating effort. Let's review them all! Leave your findings below: Suffusion of Yellow (talk) 02:19, 23 October 2022‎ (UTC)

For some of the log-only ones (which we doubt anyone is monitoring), I'm inclined to disable and see if anyone complains? I know some people watch filters using MusikBot on IRC, but otherwise, the tooling to monitor edits that hit a log-only filter is shabby, and I get the feeling that only so many editors use it, such that many of these are entirely unmonitored (except perhaps if they're tagged and people are monitoring tags, or DatBot is reporting to AIV). ProcrastinatingReader (talk) 12:01, 23 October 2022 (UTC)


  • 3 (hist · log) ("New user blanking articles", public)

Obviously useful, no obvious optimizations. Leave it alone. Suffusion of Yellow (talk) 02:32, 23 October 2022 (UTC)

Agreed. I can't see any way to optimise it. Sideswipe9th (talk) 18:08, 23 October 2022 (UTC)


  • 5 (hist · log) ("User self-renaming or moving user talk pages into article talk space", public)

Short-circuits at first line unless action=="move". Appears to still be a fairly common newbie mistake. Leave it alone. Suffusion of Yellow (talk) 02:32, 23 October 2022 (UTC)


  • 11 (hist · log) ("Warn and tag vandalism", public)

48 of the last 50 edits that saved were reverted. Should this be merged into a disallowing filter, e.g. 260 (hist · log)? Something to consider. Suffusion of Yellow (talk) 02:32, 23 October 2022 (UTC)


  • 12 (hist · log) ("Replacing a page with obscenities", public)

Reordered the conditions a bit. Overlaps with other "bad words" and blanking filters, but considering how common both swearing and blanking are, probably justified. Suffusion of Yellow (talk) 02:57, 23 October 2022 (UTC)

@Suffusion of Yellow: Is this supposed to be log-only? Last I checked I thought this was a disallowing filter (and IMO it should be). Taking Out The Trash (talk) 03:09, 26 October 2022 (UTC)
@Taking Out The Trash: Yes, I sometimes switch filters to log-only when I've edited them and want to do something other than monitor the log for FPs, and I forgot to switch it back. That said zero hits have save successfully so far; everything has been stopped by another filter. So maybe it's not needed after all. I'll leave it log-only for now. Suffusion of Yellow (talk) 04:30, 26 October 2022 (UTC)


  • 29 (hist · log) ("New user removing speedy deletion templates", public)

Overlaps a bit with 1060 (hist · log) ("Disallow CSD tag removal by page creator"), but it's helpful to have a tagging filter as a fallback in case of socks, etc. No obvious optimizations. Suffusion of Yellow (talk) 03:02, 23 October 2022 (UTC)


  • 30 (hist · log) ("Large deletion from article by new editors", public)

Not really sure what the best condition order is there, but should SC on most edits at the first line. Probably useful as a warn+tag fallback for less clear-cut cases than 12 (hist · log). Suffusion of Yellow (talk) 03:09, 23 October 2022 (UTC)


Pruned out a whole lot, which doesn't save conditions but at least improves readability and maintainability. Might regexify the rest. Were it not for the {{routemap}} exception this could be merged somewhere. Suffusion of Yellow (talk) 03:39, 23 October 2022 (UTC)

My only concern about regexing the remaining lines would be that lines 10, 11, and 12 would require a lot of escape characters, which would I think impact on maintainability? Sideswipe9th (talk) 17:30, 23 October 2022 (UTC)
With regex, it could be merged into 614 (hist · log). I'd probably remove lines 10-12 in that case; they only account for a handful of hits. I suspect ASCII art is less common these days; the people who remember Usenet are the parents of today's vandals. Suffusion of Yellow (talk) 22:40, 23 October 2022 (UTC)


  • 33 (hist · log) ("Talk page blanking by unregistered/new user", public)

This one possibly overlaps with #34, but that one is private so I cannot confirm. #33 tracks blanking in any talk page by a new or unregistered user. Unless there's something specific in #34, could these be merged? Sideswipe9th (talk) 17:45, 23 October 2022 (UTC)

Aside from this, I'd maybe swap lines 2 and 3 so that we detect the page namespace immediately after we determine if it's a low edit count user. And then do the same composite condition as in filter #3 to detect blanking, just so that we have a consistent definition of what blanking is across filters. You could also maybe swap the total edit count check on line 1 with a user_groups check, though that could also widen the filter's initial check because of how autoconfirmed is granted. Sideswipe9th (talk) 17:51, 23 October 2022 (UTC)
@Sideswipe9th: I put the namespace check first. In general any filter that only targets non-mainspace edits should do this; it will never use more than one condition on a mainspace edit (where most filters are using up conditions). After that, there isn't much point in micro-optimizing a non-mainspace filter. There's no overlap with 34 since 33 is specifically excluding user talk pages. Merging might be a bit tricky since the checks in 34 are very different, but it's something to consider. Let's first decide if we want to make 34 public (see next section). Suffusion of Yellow (talk) 22:53, 23 October 2022 (UTC)
Interesting! I would have thought that the low user_editcount check would have had a lower hit rate than the page_namespace check.
On the merge, if you check the notes the original intent of this filter was Filter to prevent blanking of talk pages by non-registered users, except to their own user talk page. That would account for line 5 which gets a hit if the name of the user making the edit is in the page title. However the notes also say Tweaking, user talk covered by filter 34. This accounts for line 6, which explicitly excludes the User Talk namespace. So at one point, filters 33 and 34 duplicated each other and the duplication was removed by the filter creator. This raises two interesting points. One is to do with the merge as that could be a reason to support or oppose merging them, and the other is two possible optimisations we could make.
If the intent of this filter is to check against all talk page edits, except those in the user talk namespace, then should the second check not be to exclude user talk (namespace 3)? Or in other words, should line 6 not be moved to line 2? That way your first two conditions are "is talk namespace and is not user talk namespace". Alternatively if moving line 6 to line 2 would result in more hits, then it seems as though line 5 may be extraneous to the check, as it looks like the intent of that check is to ensure that a new/unregistered user blanking their own talk page is not caught by this filter. In theory, a user name should not appear outside of namespace 2 or 3 (user and user talk) right? Or do we have vandals/LTAs who create usernames that match article titles? Sideswipe9th (talk) 23:58, 23 October 2022 (UTC)
re I would have thought that the low user_editcount check would have had a lower hit rate than the page_namespace check. To be clear, I'm talking about total worst-case usage, not the usage of any specific filter. If filter A is page_namespace == 0 & ( /* N conditions */ ) and filter B is page_namespace != 0 & ( /* M conditions */) then the worst combined usage is 1 + max(N, M). Suffusion of Yellow (talk) 02:20, 24 October 2022 (UTC)
Aaaah! Got that now! Sideswipe9th (talk) 02:22, 24 October 2022 (UTC)


  • 34 (hist · log) ("New or unregistered user blanking someone else's user or user talk page", private)
  Comment: Why is this filter private but 33 is public? That makes no sense... they're targeting the same type of behavior (just 33 is looking at main space and 34 is looking at userspace). Unless there's some sort of anti-harassment issue that necessitates the userspace filter being private, I would think that it should be made public or merged with 33. Taking Out The Trash (talk) 19:09, 23 October 2022 (UTC)
I recall asking the same thing myself once, but now I can't remember the answer. This was created way before my time and none of the major maintainers have edited in months. There are a few exceptions that a LTA might exploit, but the same could be said about almost any public filter. I'll ping NawlinWiki (who marked it private) in case they're still lurking. Also pinging zzuuzz and MusikAnimal who might have some memory of why this is private. Suffusion of Yellow (talk) 22:58, 23 October 2022 (UTC)
This dates back to the LTAs of Hamish Ross and Grawp (etc), with all their death threats and stuff, and the fact that they gamed the filters. That's its primary purpose: threats and gaming. Hamish still surfaces occasionally, and Grawp is busy with other things, but these LTAs are relatively inactive in this department at this time. Is it stopping other problems? I don't rightly know. Could it be public or merged? probably. I think it is usually a bad idea to make the history and logs of a filter which has been private, public. -- zzuuzz (talk) 23:18, 23 October 2022 (UTC)
Also note that 294, 478 and 739 are somewhat related. -- zzuuzz (talk) 23:51, 23 October 2022 (UTC)
If the concern is making the history of a private filter public, would merging the still relevant parts of the private filter that are not otherwise sensitive into a related public filter that does not have the same history, and then disabling the private filter not be a suitable alternative? That way the history that needs to be private remains so, and the active parts of the filter are merged elsewhere hopefully reducing the number of conditions used. Sideswipe9th (talk) 00:42, 24 October 2022 (UTC)
Yes, that's what I meant. If it's decided to go public, it could even be posted here. -- zzuuzz (talk) 07:04, 24 October 2022 (UTC)


  • 39 (hist · log) ("School libel and vandalism", public)
Logic wise this one looks OK to me. Not seeing any obvious optimisations that could be made. Were it not for the need to specifically track a subset of page titles, and that there are some non offensive but still contextually libellous words in the pattern, I'd suggest looking at merging it with a similar obscenity filter like #380. You could potentially merge with 189 though, as it also tracks libel, but for a different subset of pages? Sideswipe9th (talk) 18:33, 24 October 2022 (UTC)


  • 46 (hist · log) (""Poop" vandalism", public)
Can't see any obvious optimisations to the logic, unless line 3 is extraneous? This only tracks a single type of vandalism however, would it be worth merging the pattern into another filter like 614? Or is there a reason to track this separately from other common vandal terms? Sideswipe9th (talk) 19:07, 24 October 2022 (UTC)


It's not clear why the length(rmwhitespace(added_lines)) > 12 is there. Testing (at 1014 (hist · log)) if it can be removed safely. Suffusion of Yellow (talk) 22:42, 28 October 2022 (UTC)


  • 51 (hist · log) ("LTA username pattern hit (Oshwah)", private)


  • 52 (hist · log) ("Edit summary vandalism II", private)

I recently did a bit of a cleanup here. I'm looking to merge the remainder elsewhere (or find where it's already merged). This is a useful filter to have around for occasional problems, but I'd like to see it disabled at this time. -- zzuuzz (talk) 18:57, 25 October 2022 (UTC)

Actually, I might just re-task it to the current issue. Anyway, consider this one under active review. -- zzuuzz (talk) 19:17, 25 October 2022 (UTC)
  • This one should be public as a general vandalism filter. Or, if it's not a general vandalism filter looking at edit summaries for vandalism across the board, it should be renamed. Taking Out The Trash (talk) 03:10, 26 October 2022 (UTC)
  • From its origin to this day, this filter has been tracking/blocking a small number of filter-aware LTAs, beginning with Grawp. In its current form it's highly specialised, not general. Renaming it to 'LTA edit summary vandalism' would probably be more accurate (but really?). It's not a good candidate for being public (though like I say I'd like to see some of it merged). -- zzuuzz (talk) 03:22, 26 October 2022 (UTC)
  • I'm a huge stickler for having filter names being as accurate as possible without revealing private information, especially for hidden filters, as it makes patrolling for non-EFHs ten times easier if the filter titles are accurate. If a filter is targeting specific LTA behavior, the title should have "LTA" in it (though not just a random four digit number afterwards - actually a basic description of the behavior being targeted). So in this case, "LTA edit summary vandalism" would be a perfect name for the filter. Unless a given filter is targeting specific and active LTA behavior, it should be made public (or at least disabled/deleted). Since EFH permissions aren't being given out as freely as I think was envisioned based on the history of WP:EFH, the least we can do is to limit the number of private filters and only hide them when absolutely necessary. Taking Out The Trash (talk) 23:02, 27 October 2022 (UTC)


  • 53 (hist · log) ("LTA edit summary or editing pattern hit (Oshwah)", private)


  • 54 (hist · log) ("Promotional, group, organization, or company username (Oshwah)", public)
I think this one is largely OK. It'd be worth checking though if this one duplicates anything in filter 499, which I can't check. There's a coding style niggle I have, where if I were to write this one I'd put line 3 into a set of parentheses with line 9, so that the variable is only declared when the first and second conditions get a hit. It's not a condition limit problem, but instead I'm fairly certain this will be creating unnecessary garbage for the garbage collector when condition 1 is true and condition 2 is false, as that variable will need to be disposed of even in circumstances where it's not evaluated. Sideswipe9th (talk) 19:35, 24 October 2022 (UTC)


  • 58 (hist · log) ("Long-term pattern abuse", private)

Took out some voodoo that was claiming to prevent "Wikipedia" from "hanging" on large edits. Suffusion of Yellow (talk) 03:06, 24 October 2022 (UTC)


  • 59 (hist · log) ("New user removing templates on image description", public)


  • 61 (hist · log) ("New user removing references", public)


  • 68 (hist · log) ("Pagemove throttle for new users", private)

Is this one really even necessary anymore? I'd guess that this dates back to the days when autoconfirmed wasn't required to move pages, and also when page-move vandalbots were a thing (I think the ability for the filter to revoke autoconfirmed status dates back to around the same time). But seeing that new users haven't been able to move pages at all for many years now, and page move vandalbots aren't really a thing anymore, I'd wonder if this is still required (can't make any firm conclusions since the filter is private). Taking Out The Trash (talk) 03:13, 26 October 2022 (UTC)

I'll just say it goes beyond autoconfirmed. Page move vandals are unfortunately still a thing. Take Special:Contributions/Grasshopper49058 for example. -- zzuuzz (talk) 03:27, 26 October 2022 (UTC)
That's not a "page move vandal" though - that's a compromised account that just happened to engage in page move vandalism. What I'm talking about are the (semi-)automated page move vandalbots that would disruptively move dozens if not hundreds of pages within a short time frame, back when autoconfirmed wasn't required to move pages. I think that's when the ability for the filter to revoke autoconfirmed status had its heyday, but I was under the impression that this type of automated attack wasn't really a thing anymore since there is now a software restriction on moving pages. Taking Out The Trash (talk) 23:06, 27 October 2022 (UTC)


  • 79 (hist · log) ("New user removing reference grouping tags", public)



  • 98 (hist · log) ("Creating very short new article", public)

Does this serve a purpose anymore? WP:ACPERM has cut down on the mainspace crud. Special:NewPagesFeed and Special:NewPages both list the article size. Special:NewPages even has a max size option. Suffusion of Yellow (talk) 03:26, 24 October 2022 (UTC)

I still find it useful to help identify potential WP:A1 situations, and it also will often catch things like malformed redirects. Whenever I see hits for this filter, I put the page on my watchlist to see if it is expanded, and, if not, will tag it for deletion. It seems to be 50-50 as to whether it actually gets deleted or gets moved to draftspace and the redirect deleted, but regardless it gets the incomplete stub out of the main space. Taking Out The Trash (talk) 03:16, 26 October 2022 (UTC)


  • 102 (hist · log) ("Abusive account names", private)

Why is this private? Seems like another general vandalism filter, though in this case looking for vandalism in usernames rather than edits. Having the general username filters (as opposed to specific filters targeting the individual username patterns of LTAs) hidden makes it difficult for any non-admins who work UAA and/or patrol the logs for inappropriate usernames. IIRC the instructions at the bottom of the UAA header even told patrollers to monitor the logs of this filter and several other private username filters for many years, until this was finally fixed fairly recently. Taking Out The Trash (talk) 03:22, 26 October 2022 (UTC)

Renamed to "LTA account names". There are a few probably) non-LTA terms in there, but it seems to be mostly LTA-related. Suffusion of Yellow (talk) 23:01, 28 October 2022 (UTC)


  • 113 (hist · log) ("Misplaced #redirect in articles", public)


  • 117 (hist · log) ("removal of Category:Living people", public)


  • 132 (hist · log) ("Removal of all categories", public)


  • 135 (hist · log) ("Repeating characters", public)


  • 139 (hist · log) ("Fixed position vandalism", private)

What exactly is "fixed position" vandalism? Is this a type of LTA behavior? Or is it a type of vandalism in general? If the latter, the filter should be made public. If the former, it could probably be left as is - I think the title is descriptive/accurate enough. Taking Out The Trash (talk) 23:08, 27 October 2022 (UTC)

You could class this as LTA behaviour. -- zzuuzz (talk) 05:21, 28 October 2022 (UTC)


  • 148 (hist · log) ("Users creating autobiographies", public)


  • 149 (hist · log) ("User adds link containing username", public)


  • 164 (hist · log) ("Possible cut and paste moves", public)



  • 174 (hist · log) ("New user removing XfD template", public)


  • 180 (hist · log) ("Large unwikified new article", public)


  • 189 (hist · log) ("BLP vandalism or libel", public)


  • 220 (hist · log) ("Adding external images/links", public)


  • 225 (hist · log) ("Vandalism in all caps", public)
Seems like this would be best merged to 384. Unless there is some specific reason not to? Logs of users who have tripped the filter recently:[1][2][3][4][5][6][7][8][9][10][11] Mako001 (C)  (T)  🇺🇦 06:23, 26 November 2022 (UTC)


  • 231 (hist · log) ("Long string of characters containing no spaces", public)

Why is there a question mark at the end of stringy := "[\p{L}\p{N}]{50,}?"; and shouldn't finding the first 50 be enough, i.e. {50} (if it makes any difference performancewise)? Ponor (talk) 07:14, 31 October 2022 (UTC)

@Ponor: I doubt it makes a difference in performance. But {50} is more readable, so I've made that change. Suffusion of Yellow (talk) 23:19, 25 November 2022 (UTC)


  • 242 (hist · log) ("Redirecting a substantial existing page - new user throttle", private)

How common is this type of disruption/vandalism? Is this something that routine drive-by vandals will engage in? Or is this a specific LTA filter? If the latter, the title needs pruning/adjusting, because right now it reads like a general filter targeting a specific type of vandalism that any random drive-by troll could engage in. If the former, this should be made public as a general vandalism filter that's not targeting any specific LTA case(s). Taking Out The Trash (talk) 23:12, 27 October 2022 (UTC)

At least a couple LTAs I'm familiar with still do this sort of nonsense, including to impersonate sysops and other established users. JavaHurricane 06:39, 3 November 2022 (UTC)


  • 247 (hist · log) ("Adding emails in articles", public)

Why should there be both a "warn" and "disallow" function? AKK700 03:01, 31 October 2022 (UTC)

Good catch, see edit request at MediaWiki talk:Abusefilter-disallow-email. (Ping Primefac.) Suffusion of Yellow (talk) 04:07, 31 October 2022 (UTC)


  • 249 (hist · log) ("New user conducting large scale reverts", public)


  • 260 (hist · log) ("Common vandal phrases", public)


  • 264 (hist · log) ("Specific-page vandalism", private)

Do we really need an edit filter to track vandalism to specific pages? Isn't that what page protection is for? Taking Out The Trash (talk) 02:30, 28 October 2022 (UTC)


  • 279 (hist · log) ("Repeated attempts to save edit", private)

And here we have yet another general vandalism filter that's private which shouldn't be. This one is tracking a very common sign of vandalism, namely the action of repeatedly attempting to save a page despite an edit filter warning or disallowment. I've actually seen this quite a bit - deliberately triggering the edit filter over and over again with the goal of flooding the log seems to be one common type of vandalism across the board. Hits from this filter raise a red flag over users who may be engaging in this type of disruption. There is zero reason why this kind of filter needs to be private - anything LTA-specific currently in this filter should be migrated into whichever private filter is relevant to the LTA in question anyway. Taking Out The Trash (talk) 02:33, 28 October 2022 (UTC)

There is about a 50% chance that the edit is being prevented by a private filter. Hence private information would become public if this filter was public. See archive. Publicly visible logs are still available for these edits. -- zzuuzz (talk) 05:15, 28 October 2022 (UTC)


Could probably be merged into one of the other filters that already targets inappropriate language/bad words across multiple namespaces. Taking Out The Trash (talk) 17:40, 30 October 2022 (UTC)

May be an LTA filter. If so, can this be reanmed to something more appropriate? Mako001 (C)  (T)  🇺🇦 06:50, 26 November 2022 (UTC)


  • 316 (hist · log) ("Subtle changes to articles", private)

There are numerous good reasons why a subtle change to an article would be necessary. Of course, this is also a common method of sneaky vandalism. Nonetheless, it seems to be a common enough vandalism pattern that I don't think it's specifically LTA related. A wide variety of drive-by vandals will try to fly under the radar by being sneaky about what they are vandalizing instead of making it painfully obvious. Taking Out The Trash (talk) 17:39, 30 October 2022 (UTC)

That appears to be a narrowly targeted LTA filter, actually. But the SPI page of the user mentioned at the beginning of the notes hasn't had a sock reported since 2010. Disabled. Suffusion of Yellow (talk) 03:10, 31 October 2022 (UTC)


  • 320 (hist · log) (""Your mom" Vandalism", public)

This one should be expanded to include usernames... there have been several cases of inappropriate account creations containing "Your Mom" vandalism that I thought the filter would've stopped but didn't. Taking Out The Trash (talk) 17:37, 30 October 2022 (UTC)

Example from tonight, usernames like Special:Contributions/Urmumisgay20001 should be blocked by this filter. Taking Out The Trash (talk) 23:06, 14 November 2022 (UTC)
I think that it is generally best to avoid having filters on usernames unless absolutely necessary. It makes it easier for admins to decide to block a vandal if the username is enough to block on sight. If they try to create "Urmomisadouche69" get told that it isn't acceptable, so create "Newuser582", that makes everyones life harder, not easier. If the username is just a nondescript generic username, AGF and not BITE-ing them means that they tend to waste more patroller and admin time than if they were using names like "Amongus69420urmom", where the username makes their intent clear. By using such obvious usernames, they do everyone a favour. Mako001 (C)  (T)  🇺🇦 06:48, 26 November 2022 (UTC)


  • 323 (hist · log) ("Undoing anti-vandalism bot", public)

This one is obvious. I don't see anything to do here. -- zzuuzz (talk) 05:48, 26 October 2022 (UTC)


  • 339 (hist · log) ("Claims of homosexuality, bisexuality, or transexuality in a BLP", public)
    • This edit filter should probably be renamed to Claims of sexual orientation or gender in a BLP and probably broadened (include more identities) or tightened (remove terms like bisexuality that probably aren't common among vandals) as needed. –MJLTalk 04:36, 28 October 2022 (UTC)
      Agree, at the very least because I've never heard of "transexuality" (did the EFM who create it mean transgender?) casualdejekyll 00:58, 6 December 2022 (UTC)


  • 345 (hist · log) ("Extraneous formatting from browser extension", public)


  • 346 (hist · log) ("Large non-English contributions", public)


  • 351 (hist · log) ("Text added after categories and interwiki", public)


  • 354 (hist · log) ("Promotional text added by user to own user(-talk) page", private)


  • 364 (hist · log) ("Changing the name in a BLP infobox", public)


  • 365 (hist · log) ("Unusual changes to featured or good content", public)
I think this one fits an important niche between other filters, even if most of what it picks up is straightforward blanking. It's well optimised. -- zzuuzz (talk) 19:29, 25 October 2022 (UTC)


  • 380 (hist · log) ("Multiple obscenities", public)
Noting this before I've done a check on the logic. I've got a suggestion for improving the regex on this filter. On line 3 swap \bPEDO(?:PH|F)ILE for \bPA?EDO((?:PH|F)ILE)?. This will allow the filter to detect both the British variant of paedophile, and also the commonly used contraction of the word. Spotted this when looking at 39 which matches on both spelling variants. There may be other string matches that could be improved in the regex as well, I've not done an exhaustive look. Sideswipe9th (talk) 18:47, 24 October 2022 (UTC)
Thanks, I've made that change. No comment on the rest of it. -- zzuuzz (talk) 05:09, 26 October 2022 (UTC)


  • 384 (hist · log) ("Addition of bad words or other vandalism", public)


  • 391 (hist · log) ("Changing height/weight in an infobox", public)


  • 397 (hist · log) ("Userpage vandalism", private)


  • 420 (hist · log) ("Large removal of talk page content by IP", public)

About 3/4 of hits also trip 33 (hist · log); only "independently" stopped 15 hits edits this month. This can't be merged with 33 because of the throttle. Set to log-only to see if the throttle was really needed after all. Suffusion of Yellow (talk) 04:54, 26 October 2022 (UTC)

Oh, forgot that 33 is warn-only and this is disallow. Still, worth seeing if the throttle is needed. Suffusion of Yellow (talk) 04:55, 26 October 2022 (UTC)


  • 425 (hist · log) ("Magic/astrology spambots", private)


  • 432 (hist · log) ("Starting new line with lowercase letters", public)


  • 464 (hist · log) ("Possible open proxy", private)


  • 466 (hist · log) ("Userspace & talk page spamming", private)

Can probably merge and optimise this, 794 (hist · log) and 974 (hist · log) ProcrastinatingReader (talk) 03:42, 30 October 2022 (UTC)



  • 491 (hist · log) ("Edits ending with emoticons or !", public)


  • 499 (hist · log) ("Possible spambot or promotional username", private)



  • 550 (hist · log) ("nowiki tags inserted into an article", public)


This shouldn't exist. AFAIK the community only allows blocking sources per the Wikipedia:Spam blacklist process. Filters are used for warning on their use after the deprecation process or if they're self-published. I previously made a request to get it added to the spam blacklist but that never happened. Going to disable this filter and re-make the request to add to spam blacklist. ProcrastinatingReader (talk) 11:38, 23 October 2022 (UTC)

Yeah that's a good call I think. Could you take a look at 559 and 1141? They're both private filters, so I can't see em, but 559 is titled " additions", and 1141 is "OpenSea spam links". I suspect 559 is tracking specific set URLs that the blocklist can't handle, however for 1141 I believe OpenSea is already on the spam blocklist. Unless that's tracking a specific subset of OpenSea URLs, it might be redundant?
I also took a glance at the public filters 54, 1030, 1043, 1045, and 1132 as those have similar titles to 554's actions. Those all appear to be OK, as they're just tracking, warning, and/or tagging edits. I suspect 1016 is also probably fine, even if it's a blocking filter (it's private so I can't confirm), because my understanding is that the spam blocklist only blocks http/s URIs and not others like file. Sideswipe9th (talk) 01:22, 24 October 2022 (UTC)


  • 559 (hist · log) (" additions", private)

Disabled - don't see this having any purpose now. c.f. the filter notes, also per notes it seems any useful purpose has been taken over by the spam blacklist. I also think this could be made public but haven't done that. ProcrastinatingReader (talk) 21:37, 26 October 2022 (UTC)


  • 579 (hist · log) ("Possible sockpuppet account creations", private)



  • 600 (hist · log) ("Possible template vandalism", private)


  • 602 (hist · log) ("Arbitration discretionary sanctions alerts", public)

Required for various ArbCom/DS purposes, particularly tracking whether a user has been given a DS alert. ProcrastinatingReader (talk) 21:43, 26 October 2022 (UTC)

Would be nice if we could set this one not to warn. I don't find the warning helpful. Just adds extra clicks, and messes up user scripts. On the off chance that someone does warn someone twice in a year instead of once, doesn't seem like a huge deal. –Novem Linguae (talk) 06:58, 28 October 2022 (UTC)
That would probably need to be discussed over at ArbCom, though I agree that it can be a pain. Mako001 (C)  (T)  🇺🇦 06:37, 26 November 2022 (UTC)


  • 614 (hist · log) ("Memes and vandalism trends", public)


  • 627 (hist · log) ("Promotional text added by user to draft in own user(-talk) page or in draft namespace", public)


  • 630 (hist · log) ("New users de-userfying pages", private)

No obvious optimizations. No opinion on how useful this is, but does it really need to be private? I can't imagine anyone gaming the check on line 2 just to avoid a tag. Suffusion of Yellow (talk) 23:12, 29 October 2022 (UTC)

For what my $0.02 is worth, if all the filter is doing is tagging new users moving user pages to mainspace, the "gaming" potential is clearly and obviously low casualdejekyll 01:49, 6 December 2022 (UTC)


  • 631 (hist · log) ("Extraneous toolbar markup", public)


  • 633 (hist · log) ("Possible canned edit summary", public)


  • 636 (hist · log) ("Unexplained removal of sourced content", public)


  • 639 (hist · log) ("persistent block evasion", private)


  • 642 (hist · log) ("VRT template added by non-VRT member (global)", public)


  • 643 (hist · log) ("Persistent sockpuppetry", private)


  • 655 (hist · log) ("Large plot section addition", public)


  • 657 (hist · log) ("Adding an external link to a disambiguation page", public)



  • 667 (hist · log) ("Wikipedia:Long-term abuse/Best known for IP", private)

Renamed to "WP:LTA/BKFIP". Otherwise, no changes. I check this one regularly; while most edits are FPs, the ones that aren't often lead to a new sock busily stirring up drama at ANI. Suffusion of Yellow (talk) 21:46, 7 November 2022 (UTC)


  • 680 (hist · log) ("Adding emoji unicode characters", public)


  • 686 (hist · log) ("New user adding possibly unreferenced material to BLP", public)


  • 694 (hist · log) ("Moves to or from the Module namespace", public)


  • 702 (hist · log) ("Warning against clipboard hijacking", public)


  • 711 (hist · log) ("Dead link replacement", public)


  • 712 (hist · log) ("Possibly changing date of birth or death", public)


  • 716 (hist · log) ("New user tagging or de-tagging article as FA/GA", public)
Is there any reason why this isn't at least set to like, tag or something? I can't see any valid reason for an unconfirmed account to perform such an action. casualdejekyll 01:59, 6 December 2022 (UTC)


  • 718 (hist · log) ("Prolific socker III", private)


  • 733 (hist · log) ("New user creating a page in someone else's userspace", public)


  • 735 (hist · log) ("Vandalising sport infobox", public)


  • 738 (hist · log) ("Frequently blocked user", private)


This could probably be part-merged (somewhere?) and disabled. -- zzuuzz (talk) 05:57, 28 October 2022 (UTC)


  • 752 (hist · log) ("Possible spamming of references", private)


  • 753 (hist · log) ("wikilinks removed by a new user or IP", public)

The math here is off by a factor of 2:

edit_delta == -( rcount("\[\[", removed_lines) + rcount("\]\]", removed_lines) ) & 
rcount("\[\[", removed_lines) > rcount("\[\[", added_lines)

We're tagging edits which remove exactly half of the wikilinks on the touched lines. That can't possibly have been the intention.

This could be fixed with:

edit_delta < 0 &
edit_delta == 2 * (rcount("\[\[|\]\]", added_lines) - rcount("\[\[|\]\]", removed_lines))

If this was a recent error, I'd just fix it. But no one, including me, noticed this in six and half years! So I don't think anyone cares much about tracking this kind of edit. And I suspect the "fix" will create lots of AbuseLog spam. Disabled, until someone objects. (Courtesy ping MusikAnimal) Suffusion of Yellow (talk) 04:48, 26 October 2022 (UTC)

I think my involvement with this filter was solely to make optimizations. No objection to disabling, and thanks for starting this cleanup effort! Note also (in case you/others didn't know) the stale filters report. MusikAnimal talk 10:08, 26 October 2022 (UTC)





I think this filter is used to prevent unregistered users from removing reports from AIV, in the same way that filter 788 filters out IPs removing reports from WP:RFPP/I to avert page protections and prevention of vandalism. This filter is private and the RFPP filter is not. Is this filter or 984 targeted at LTAs or sock puppets of blocked or banned users? AKK700 18:46, 31 October 2022 (UTC)

Yes, there's some LTA stuff going on there, and there are many vandals who would like to vandalise AIV, including anyone who finds themselves on it. It's a bit more complicated than the RFPP filter. AIV also requires a high degree of resilience, in a different league to even RFPP. One LTA in particular - one of the filter's primary subjects - has been seen recently. But having said that, it probably needs to be looked at a bit closer. Now you mention it, it's possible there could be a merge with 984, but then that may be overly complicated. 984 covers some other pages, and although there are some things in common, it would probably still need rules per page - which gets messy in a hurry. -- zzuuzz (talk) 22:37, 2 November 2022 (UTC)


  • 777 (hist · log) ("End date present vandal", public)


  • 782 (hist · log) ("Content Translation Edits", public)


  • 783 (hist · log) ("Adding Template:Persondata", public)
    • Is this still worth tracking? I know it still gets hits, but it uses 3.9 conditions right now. –MJLTalk 04:56, 28 October 2022 (UTC)
      Disabled. According to the notes, this is to prevent old school users from readding {{persondata}}. What it's actually tripping on is people reverting biography pages to ancient revisions (for many reasons, but often to remove copyvios or accumulated spam). That's probably going to reintroduce all sorts of deprecated crud, so I don't see the need to single out this one template. I suppose we could create a new filter warning about redlinked templates in general, but that might be expensive, as it would need to check new_html on every edit, or at least every edit that adds a template. Suffusion of Yellow (talk) 22:32, 28 October 2022 (UTC)


  • 788 (hist · log) ("IP removing report from RFPP", public)


  • 793 (hist · log) ("Common spam/scam phone numbers", private)




  • 798 (hist · log) ("Possible copyvio for image upload", public)


  • 803 (hist · log) ("Prevent new users from editing other's user pages", public)

Created after this RFC. No obvious optimizations. Suffusion of Yellow (talk) 22:32, 29 October 2022 (UTC)


  • 806 (hist · log) ("New account suspicious activity", private)

Renamed "New account unusual activity" because good-faith editors aren't going to like being called "suspicious". Tidied a bit. Otherwise not seeing much to do. Definitely LTA-related so should stay private. Suffusion of Yellow (talk) 22:28, 29 October 2022 (UTC)

I've ever only seen this filter trip under two circumstances: when a user is trying to game autoconfirmed or extended confirmed by making rapid-fire pointless edits in their userspace, and when a brand-new user creates personal JavaScript/CSS pages before being autoconfirmed. Other than those two circumstances - the first of which is worthy of monitoring, the second of which is more often than not a false positive, I don't think I've ever seen any hits from this filter. Taking Out The Trash (talk) 16:33, 4 November 2022 (UTC)


  • 809 (hist · log) ("Possible SPI disruption", private)


  • 812 (hist · log) ("Unreasonably large addition of content", public)




  • 828 (hist · log) ("Redirecting talk page", public)


  • 833 (hist · log) ("Newer user possibly adding unreferenced or improperly referenced material", public)


  • 835 (hist · log) ("Temporary vandalism II", private)


  • 837 (hist · log) ("Removal of disambiguation templates by new users", public)



  • 847 (hist · log) ("The Sandbox Troll (WP:LTA/SBT)", private)

This LTA is still active and the filter useful. I think it's optimised OK, but you're welcome to review that. -- zzuuzz (talk) 21:53, 23 October 2022 (UTC)


  • 850 (hist · log) ("New user moving page to project space", public)


  • 856 (hist · log) ("Non-admin or patroller removing copyvio templates", public)




  • 867 (hist · log) ("Large creations by inexperienced user", public)


  • 868 (hist · log) ("Template vandalism", private)


  • 869 (hist · log) ("Adding deprecated source to articles", public)



  • 874 (hist · log) ("LTA username creations", private)


  • 878 (hist · log) ("New user removing COI template", public)




  • 887 (hist · log) ("Excessive repetition in usernames", public)



  • 890 (hist · log) ("Random typing in username", public)

This is one of many filters where we're saying

    user_rights ? /* T230256 workaround */
        !('override-antispoof' in user_rights) :

instead of just

!('override-antispoof' in user_rights)

This doesn't use any extra conditions, but it's an ugly hack. If I'm reading phab:T230256 correctly, the workaround is no longer needed; the change that caused this problem was reverted and user_rights will just be null for logged-out account creations. I plan on removing this workaround code from all the filters, but double-checking first with @Daimona Eaytoy: if that's a good idea. Suffusion of Yellow (talk) 23:57, 29 October 2022 (UTC)

@Suffusion of Yellow: Yes, it should be possible to remove it. --Daimona Eaytoy (Talk) 13:11, 1 November 2022 (UTC)


  • 891 (hist · log) ("Predatory open access journals", public)


  • 892 (hist · log) ("RS linked through proxy", public)


  • 894 (hist · log) ("Self-Published Sources", public)


  • 901 (hist · log) ("Possible Drumpf plugin", public)

Disabled. "Drumpf" is stopped by 614 (hist · log); this was just to give a friendlier message to those who installed the "Drumpfinator" browser extension. But most recent attempts look deliberate to me. I can't even find the original extension in the Chrome Store, though a few knockoffs exist. Suffusion of Yellow (talk) 02:33, 24 October 2022 (UTC)


  • 906 (hist · log) ("All namespace abuse", private)




  • 917 (hist · log) ("Prevent the addition of Daniel C. Boyer", private)

@Cyberpower678: You previously objected when I merged this into a log-only filter. Any objection if I merge it into a disallowing filter instead? He might notice that we've disabled this filter, but he'll still get the same old message if he tries to add his name. Suffusion of Yellow (talk) 21:39, 9 November 2022 (UTC)

Given the fairly low hit rate, I think this can actually made log-only. —CYBERPOWER (Chat) 21:44, 9 November 2022 (UTC)
Are we sure the low hit rate isn't just because he knows there's a filter? Suffusion of Yellow (talk) 21:56, 9 November 2022 (UTC)
Actually, you know what, the false positive rate is really low, so let's just keep it to disallow and merge it.—CYBERPOWER (Around) 16:18, 10 November 2022 (UTC)


  • 921 (hist · log) ("Suspicious claims of nazism", public)


  • 923 (hist · log) ("Possible Nigerian phone scams", private)
Might be able to be merged with 793? Mako001 (C)  (T)  🇺🇦 07:13, 26 November 2022 (UTC)


  • 926 (hist · log) ("Image vandalism II", private)


LTA still (barely) active, though it's clear no one is monitoring the log as none of the users are blocked. (Or are those FPs...?) @Kuru: Any objection if I merge this into 579 (hist · log). Or if those really are FPs, just disable it? Suffusion of Yellow (talk) 00:13, 30 October 2022 (UTC)

@Suffusion of Yellow: Some of those appear to be positive positives, but they don't appear to be particularly active. I can't even remember the long lost grudge here, so this is an opportunity to disable and cover with a thin layer of soil. Sam Kuru (talk) 22:51, 2 November 2022 (UTC)
@Kuru: Thanks, disabled. Didn't merge, but you do can that if you want. Suffusion of Yellow (talk) 21:49, 7 November 2022 (UTC)


  • 928 (hist · log) ("Transclusion of userpages", public)


  • 930 (hist · log) ("Prevent indexing userspaces by newer users", public)


  • 935 (hist · log) (""ntsamr"-pattern spambot filter", private)



  • 937 (hist · log) ("Qwertywander long-term abuse", private)


  • 942 (hist · log) ("Log edits to protected pages", public)

What's the reason for this? Is this still being monitored? DatGuyTalkContribs 20:28, 13 November 2022 (UTC)

Its main purpose is related to checking individual admin activity, in relation to inactivity de-sysops. @Xaosflux: to opine about its usefulness. -- zzuuzz (talk) 20:34, 13 November 2022 (UTC)
I still use it as well, also allows easy transparency for anyone to ensure that admins are following the protection policy and only editing through protection when appropriate. — xaosflux Talk 20:48, 13 November 2022 (UTC)


Disabled, LTA seems to have been inactive for the last two years or so. Courtesy ping JJMC89 and Galobtter. (zzuuzz I think you're already watching...) Suffusion of Yellow (talk) 00:27, 30 October 2022 (UTC)


  • 957 (hist · log) ("Removal of article lead", public)



  • 960 (hist · log) ("Log edits to other user's scripts", public)


  • 961 (hist · log) ("Disruptive Category Removal", private)

Disabled. Looking at only the edits with saved changes, there's a clear spree from the LTA in October 2019 but after that nearly everything has been disallowed by other filters. Courtesy ping @Crow and Beyond My Ken:. Suffusion of Yellow (talk) 21:36, 7 November 2022 (UTC)


  • 963 (hist · log) ("LTA 963", private)
    • I check this one regularly and find it useful. Spicy (talk) 12:41, 23 October 2022 (UTC)


  • 964 (hist · log) ("AfC unsourced submissions", public)


  • 965 (hist · log) ("Indo-Aryan expletives", private)

Although not strictly an LTA filter, it does prevent some LTAs, so should remain private. ProcrastinatingReader (talk) 15:04, 7 November 2022 (UTC)


  • 970 (hist · log) ("Possibly inaccurate edit summary", public)


  • 971 (hist · log) ("Additions of missing files", public)


  • 973 (hist · log) ("New or unregistered user modifying talk page archives", public)



  • 979 (hist · log) ("Accidental insertion of biomedical references", public)



  • 981 (hist · log) ("Common vandal summaries", public)


  • 982 (hist · log) ("Labelling of nationality as Jewish", public)


Effective, optimised, relevant, and worthwhile. No FPs worth bothering about. (though it's slightly misnamed). -- zzuuzz (talk) 05:58, 23 October 2022 (UTC)


  • 986 (hist · log) ("Private filter 986", private)

I claim this filter and check it regularly. It's still generating relevant hits over a relevant time period. I can't think how it can really be optimised. But you're welcome to review it anyway. -- zzuuzz (talk) 04:54, 23 October 2022 (UTC)



  • 989 (hist · log) ("Edits to other user's edit and email notices", public)


  • 994 (hist · log) ("Article created as template", public)


LTA is bordering on inactive at this time, though they're called 'long' for good reason. MO check is pretty much optimised with no FPs. Possible candidate for disabling. -- zzuuzz (talk) 05:10, 23 October 2022 (UTC)


  • 1000 (hist · log) ("Sydney days-of-the-year vandal", private)

@Someguy1221: Is this still needed? It's not clear which LTA this is tracking. A very quick spot check suggests the usual mix of good-faith and bad-faith edits typical of IPs and new users. In any case, no hits in about a year, though I'm not sure if that's because of any active blocks. Suffusion of Yellow (talk) 21:35, 9 November 2022 (UTC)


  • 1001 (hist · log) ("Image changes by new users", private)

This is part of MusikAnimal's bot, so should be left enabled even if no one is checking the log. Suffusion of Yellow (talk) 21:28, 9 November 2022 (UTC)

That bot died a while back and I haven't gotten around to fixing it. I think it's only me that's using it anyway, so I've disbaled the filter for now. However I do intend to fix the bot, as well as make it usable by others (similar to User:MusikBot/AbuseFilterIRC), so I do intend to re-enable this eventually. MusikAnimal talk 22:03, 9 November 2022 (UTC)


Noting that ST47 has disabled this. Suffusion of Yellow (talk) 21:26, 9 November 2022 (UTC)



I look at this periodically. * Pppery * it has begun... 01:44, 24 October 2022 (UTC)


  • 1014 (hist · log) ("Suffusion of Yellow public test filter", public)


  • 1015 (hist · log) ("long-term IP-hopping vandal detection", private)


@Sideswipe9th: This one is only private to keep the log private; it sometimes contains links like file://c:/users/my_real_name/foo.html. The filter is:

equals_to_any(page_namespace, 0, 2, 118) &
    link := "file://";
    added_lines irlike link &
    !(removed_lines irlike link)
) &
!("bot" in user_groups) &
!(summary irlike "^(?:revert|restore|rv|undid)") &
!("URI scheme" in new_wikitext)

Don't see any obvious improvements, and with over 3000 hits, it's serving a purpose. The spam blacklist can't be used here; MediaWiki doesn't even recognize these as links, and its log is semi-public. Suffusion of Yellow (talk) 03:43, 24 October 2022 (UTC)

Yeah that makes sense. I figured the spam blocklist couldn't handle file URIs after checking its documentation, and I'd forgotten that a lot of those sorts of links would contain a computer username that may or may not also be someone's real name. I'm also not seeing any obvious changes that we could make. Sideswipe9th (talk) 03:50, 24 October 2022 (UTC)



  • 1020 (hist · log) ("LTA Europeanhaematology", public)




  • 1030 (hist · log) ("Adding URLs with tracking parameters", public)

Optimized to not generate added_links every time someone edits a line containing a link. @ST47: Would it be a good idea to do something with this besides log? I haven't checked for FPs but I suppose we could add a warning, though that might deter people from adding references at all. Or, maybe just fix these links with a bot? In that case, would the bot even need the filter to find the links to fix? Suffusion of Yellow (talk) 01:14, 29 October 2022 (UTC)

@Suffusion of Yellow: There used to be a bot. one is inactive and the other is an AWB task, meaning that it is run intermittently and only if primefac remembers. I don't know if warning is the right thing to do here - the idea was to see if there are any spammers who are using these kinds of URLs often, not to simply get rid of these (mostly-meaningless) parameters. However, there's too much noise to really do anything with the results of this filter. It should probably be disabled. ST47 (talk) 02:48, 10 November 2022 (UTC)


  • 1031 (hist · log) ("New user editing mass message list", public)


  • 1032 (hist · log) ("Adding URLs with characters that decompose or case-fold to ASCII characters", private)

Was checking added_links on every single edit! Was a bit non-intuitive to fix that. Might tidy the regex further. (Ping ST47) Suffusion of Yellow (talk) 04:18, 1 November 2022 (UTC)




  • 1035 (hist · log) ("Possible dead link replacement", public)



There are, um, privacy concerns, with discussing this one here. I've a made a change and emailed someone. Others are invited to review. Suffusion of Yellow (talk) 04:44, 1 November 2022 (UTC)



  • 1045 (hist · log) ("Self-published (blog / web host)", public)



  • 1051 (hist · log) ("India IP topic rangeblock", private)


  • 1052 (hist · log) ("Template substitution vandalism", private)


  • 1053 (hist · log) ("Personal attack on user or user talk page", private)


  • 1055 (hist · log) ("Unusual user talk page activity", private)




@ToBeFree: Is this still serving a purpose? Only 50 hits in over two years, and the recent few I checked look like weird cut-and-paste fails and not from any one LTA. Suffusion of Yellow (talk) 22:45, 9 November 2022 (UTC)

Hi Suffusion of Yellow, thanks for asking – I think this can be removed and/or made public. Or, if the 50 hits are precisely capturing bad edits well enough, perhaps merged into an existing and public filter. ~ ToBeFree (talk) 23:27, 9 November 2022 (UTC)
Filter disabled ~ ToBeFree (talk) 23:30, 9 November 2022 (UTC)


  • 1060 (hist · log) ("Disallow CSD tag removal by page creator", public)

The MediaWiki:Abusefilter-disallowed-remove-csd message used by the filter should contain an indication that the edit was prevented, like most of the other messages used by filters that disallow problematic edits. AKK700 03:06, 31 October 2022 (UTC)


  • 1062 (hist · log) ("Rickroll vandalism prevention", private)

Why does this filter exist when there's edit filter 614 that automatically prevents rickroll vandalism? AKK700 03:10, 31 October 2022 (UTC)

Perhaps this contains more links and prevents more cases. 0xDeadbeef→∞ (talk to me) 00:19, 10 November 2022 (UTC)


This LTA is active and the filter is effective with no FPs. No obvious optimisations. -- zzuuzz (talk) 17:15, 26 October 2022 (UTC)


Simplified the logic a bit. @Wugapodes: Is this still a problem? I'm not familiar with this LTA. Suffusion of Yellow (talk) 20:27, 29 October 2022 (UTC)


  • 1073 (hist · log) ("Contest and editathon tracking", public)


  • 1074 (hist · log) ("Vandalism to Number Pages", public)


Large crossover with filter 1135. -- zzuuzz (talk) 20:36, 13 November 2022 (UTC)


  • 1076 (hist · log) ("Draftified article more than 180 days old", public)


  • 1081 (hist · log) ("Unreliable source added by revert, script or bot", public)


  • 1082 (hist · log) ("New user creating a user talk page redirect", private)

This filter is the same as filter 828, except this one is private. Is there a need for creating a private copy of an already existing filter? AKK700 05:27, 1 November 2022 (UTC)

@AKK-700 and ST47: Well they're not exactly the same. But they're similar enough, so I've merged this into 828 (hist · log). I'm not marking this one public because there are some BEANsy suggestions in the notes. Suffusion of Yellow (talk) 22:15, 25 November 2022 (UTC)


  • 1084 (hist · log) ("Large non-free image uploads", public)


  • 1086 (hist · log) ("Disruptive edit summaries", public)



@GeneralNotability: Merged with 1037 (hist · log). No hits since April 2021. But see the Commons account I linked in the notes. Not totally sure they've given up. Suffusion of Yellow (talk) 22:32, 25 November 2022 (UTC)


  • 1090 (hist · log) ("Linking to draftspace or userspace from mainspace", public)

Made a few tweaks to reduce FPs. This should set to at least warn+tag. Suffusion of Yellow (talk) 23:13, 10 November 2022 (UTC)


  • 1093 (hist · log) ("New user modifying javascript in userspace", public)


  • 1094 (hist · log) ("miscellaneous LTAs", private)
    • Actively in use for LTAs; should remain private. OhNoitsJamie Talk 14:25, 23 October 2022 (UTC)





  • 1109 (hist · log) ("Possible promotional edit", private)

Fairly valuable for catching a certain type of account. If possible, I'd like to keep this one around. --Blablubbs (talk) 09:46, 23 October 2022 (UTC)

@Blablubbs: One line sticks out as obviously outdated. -- zzuuzz (talk) 10:55, 23 October 2022 (UTC)
@Zzuuzz: Line #3? --Blablubbs (talk) 11:00, 23 October 2022 (UTC)
6 :) -- zzuuzz (talk) 11:01, 23 October 2022 (UTC)
Ooh, good call – removed, thanks. :) --Blablubbs (talk) 11:04, 23 October 2022 (UTC)


  • 1112 (hist · log) (""Notable people" disruption", public)
    • Useful for catching graffiti/vanity efforts. OhNoitsJamie Talk 14:29, 23 October 2022 (UTC)


  • 1119 (hist · log) ("Excerpt or labeled section transclusion removal", public)





This is another filter that only tracks a single type of meme, whereas edit filter 614 is a filter dedicated to catching many popular memes. Why should we have one filter for a singular meme and another for all other memes when we probably should merge this filter into 614 for a filter that catches all meme vandalism? AKK700 02:58, 31 October 2022 (UTC)

@AKK-700: Some of what's in 614 was probably in another filter at some time. Memes, as Richard Dawkins taught us, evolve, and it's helpful to keep the log for an "active" meme separate because making changes to a "combined" filter is dangerous; no one is going to sift through the log checking for FPs. Eventually, this can be merged somewhere. But right now the edit_delta logic makes that difficult. As this loses popularity, we can probably stop filtering on plain "among us" (which is a fairly common term) and stick with the always bad faith stuff like "impostor is sus", etc. Suffusion of Yellow (talk) 04:27, 31 October 2022 (UTC)





  • 1132 (hist · log) ("Adding deprecated source to article talk pages", public)





Disabled and made public per note in filter. ProcrastinatingReader (talk) 21:46, 26 October 2022 (UTC)


  • 1145 (hist · log) ("Removal of Turkish lang templates", public)




  • 1153 (hist · log) ("Arbitration Case Requests filed by new users", public)

@Clerks: Is this still required? As there's a large editnotice on that page already, and per filter logs it seems the users file their request anyway, so not sure the warning is having its intended purpose. ProcrastinatingReader (talk) 21:43, 26 October 2022 (UTC)

I don't see a real reason to keep it, but I will defer to DJ -- Guerillero Parlez Moi 21:45, 26 October 2022 (UTC)
This was in response to a number of new editors filing arbitration requests that were declined as premature. At the time I thought a warning which makes them stop and read the message may be useful. However, looking at what has happened there has been no occasion where an editor has seen the warning and the not continued to file the request. As such, I've disabled it as likely not being useful enough. Dreamy Jazz talk to me | my contributions 22:45, 26 October 2022 (UTC)



Some of this (whichever parts don't have many FPs) can probably be merged into 965 (hist · log) and the filter disabled overall. ProcrastinatingReader (talk) 15:04, 7 November 2022 (UTC)



  • 1157 (hist · log) ("Non-clerk/admin/CU tagging sock", private)

Useful for a multitude of reasons – not sure if we have to keep it private, though. --Blablubbs (talk) 11:09, 23 October 2022 (UTC)

I think this can be made public. I've optimised it a bit, and fixed the last line. -- zzuuzz (talk) 11:43, 23 October 2022 (UTC)


Active problem, but probably only one of this or 1217 (hist · log) needs to stay. ProcrastinatingReader (talk) 11:38, 23 October 2022 (UTC)

If possible I'd prefer the public one to remain. I monitor it every so often, particularly when we see a spate of activity on this pattern. But I do understand if the private one needs to be the active one. Sideswipe9th (talk) 19:40, 24 October 2022 (UTC)


Active LTA ProcrastinatingReader (talk) 11:38, 23 October 2022 (UTC)


  • 1161 (hist · log) ("LTA: editor shopping by globally banned user", private)


  • 1162 (hist · log) ("Non-admin placing block templates", public)



  • 1168 (hist · log) ("Misuse of Unicode mathematical or letterlike symbols in usernames", public)



  • 1170 (hist · log) ("Non-clerk/CU/bot editing SPI archives", public)


No hits since September, but I doubt they've gone away. Merged with 906. Suffusion of Yellow (talk) 21:18, 10 November 2022 (UTC)




  • 1176 (hist · log) ("WP:NOTWALLOFSHAME reminder", public)



  • 1178 (hist · log) ("Harassment pattern (TNT)", private)




  • 1183 (hist · log) ("Log uses of INDEX and NOINDEX", public)





  • 1195 (hist · log) ("Template image vandalism", private)



  • 1197 (hist · log) ("Excessive exclamation marks", public)


  • 1199 (hist · log) ("Unusual rate of edits from new user or IP", public)


  • 1200 (hist · log) ("Potential pronoun disruption", public)


  • 1201 (hist · log) ("Random sample of non-autoconfirmed edits", public)

This is my workaround for phab:T102944. By capturing every variable at the time of the edit, we can test against a "real" log hit, instead of the "simulated" hit generated by Special:AbuseFilter/test. If you have User:Suffusion of Yellow/batchtest-plus installed, note the new "FP check" button in filter interface, next to "Save filter".

I expect this might be a bit slow (@MusikAnimal:: How slow?) for the unlucky 1 in 1000 non-autoconfirmed users, but it doesn't use many conditions. Suffusion of Yellow (talk) 21:52, 23 November 2022 (UTC)


  • 1202 (hist · log) ("misc article/draft/talk LTAs", private)
    • This is currently use to track several persistent LTAs across several pagespaces; should remain private. OhNoitsJamie Talk 14:25, 23 October 2022 (UTC)


This should have some sort of warning, once I get the FPs low enough. It's remarkable how many people seem to think there's nothing wrong with calling a living person the "perpetrator" of a crime, when they have not in fact been convicted of that crime. Suffusion of Yellow (talk) 20:53, 20 November 2022 (UTC)





Disabled, merged into 58 (hist · log). Also partially covered by several other filters. Suffusion of Yellow (talk) 02:09, 1 November 2022 (UTC)


  • 1210 (hist · log) ("Redirecting base user or talk page to other namespace", public)

@Locke Cole, PhantomTech, Mako001, and Xaosflux:. Disabled and part-merged into disallowing filter 828 (hist · log). I did not merge the check for user pages (only user talk pages). A redirect from the user page seems silly, but not really all that disruptive. Suffusion of Yellow (talk) 22:12, 25 November 2022 (UTC)

Ultimately the biggest concern with 1210 was disallowing redirects to Main Page because that specific page suppresses the "Redirected from ..." text, which makes it difficult to get to a vandals user page on most devices. If you want to make it more specific I'd not object as the other redirects aren't nearly as big an issue. I would enable it for user pages though as this was the biggest issue (clicking on a user name in an edit history took you straight to Main Page with no indication of what was going on). —Locke Coletc 23:28, 25 November 2022 (UTC)
In the past four months, there has been only been one user who has attempted to redirect any user page to the MP. I'm not sure that's a common enough problem to have a filter for. Suffusion of Yellow (talk) 23:59, 25 November 2022 (UTC)
It's not so much that it's common, it's that it's a vector for abuse. I initially sought to get a bot to look for user/user talk page redirects to Main Page but was advised an edit filter would be better and could stop them from being created altogether. —Locke Coletc 00:35, 26 November 2022 (UTC)
Given that the only other user who has recently (like, over 12 months ago) redirected their user talk to mainspace was me, and since this this filter hasn't had any hits for that problem, it might even be best to remove it per BEANS. Mako001 (C)  (T)  🇺🇦 07:07, 26 November 2022 (UTC)
Given that the only other user who has recently (like, over 12 months ago) redirected their user talk to mainspace was me No, as Suffusion of Yellow indicated just before my reply, there was an editor who did it (see Special:Contributions/The Number Line), promptly did something bad and was ultimately blocked. I'm not going to fight to maintain this. I've done as much as I can do, if other editors disagree and want to leave us open to this kind of abuse, so be it. —Locke Coletc 05:37, 30 November 2022 (UTC)


@ToBeFree: Any objection if I disable this? The last true positive was on 23 August. The meme seems to have died a natural death. Suffusion of Yellow (talk) 23:37, 20 November 2022 (UTC)

Thanks Suffusion of Yellow, no objections and   Done. There would be no objections to making it public from my side either. ~ ToBeFree (talk) 23:46, 20 November 2022 (UTC)


  • 1212 (hist · log) ("Possibly claiming death of article subject", public)


  • 1213 (hist · log) ("Manual addition of automatic mediawiki categories", public)
Already discussed above. @Ahecht and EpicPupper: No hits at all. This doesn't appear to be a common enough problem for a filter. Disabled. Suffusion of Yellow (talk) 04:20, 31 October 2022 (UTC)


  • 1214 (hist · log) ("DatGuy's private test filter", private)



No true positive since late September, disabling for now. DatGuyTalkContribs 15:20, 10 November 2022 (UTC)



Disabled. Uses close to zero conditions, but pointless unless a warning is added, and not worth the trouble of maintaining. As mentioned before, jpgordon if you find a large number of requests that this filter is missing, let me know. Suffusion of Yellow (talk) 20:46, 29 October 2022 (UTC)



Mostly catching drive-by vandalism and should be a public filter, but I'm not sure if there's anything in the log that should stay private. Disabled this one, and created public filter 1233 (hist · log) with nearly the same conditions. Suffusion of Yellow (talk) 23:51, 3 December 2022 (UTC)





@Suffusion of Yellow: seems like this could be renamed and made public. DatGuyTalkContribs 15:10, 8 November 2022 (UTC)

@DatGuy: There might be some stuff in the log that shouldn't be public. If this is to be a public filter, it's probably best to move it to new filter ID. I'm not sure if it's valuable enough to keep around, though. Suffusion of Yellow (talk) 21:19, 9 November 2022 (UTC)


Disabled for now. Might disable some other related filters soon. Suffusion of Yellow (talk) 23:31, 28 October 2022 (UTC)


Disabled; too much clutter in the log to be worth checking. Suffusion of Yellow (talk) 23:08, 20 November 2022 (UTC)



The LTA seems to have gone away. I would like to give it another week before we disable it in case they come back --Guerillero Parlez Moi 21:47, 26 October 2022 (UTC)

EFH Permission request (Taking Out The Trash)Edit

The following discussion is closed. Please do not modify it. Subsequent comments should be made in a new section. A summary of the conclusions reached follows.
  Request withdrawn. No matter how you connect the dots, even if a rough consensus were to emerge, this would be an incredibly controversial appointment and would probably generate some amount of unease, which is something that I don't feel I should be putting the community through if it can be avoided. I firmly stand behind what I have said previously regarding the alleged logged out editing, which is that I have never done so except for the one accidental edit that I have already taken responsibility for. I am someone who always advocates for the truth and the facts above anything else, and I can assure you (collective) that this is the absolute truth of the matter. I still do not see nor understand the correlation between the allegations of logged out editing and the evaluation of whether I am suited and have the competence needed to appropriately handle the private edit filters, and that's something that I acknowledge I may never recognize. Spicy's comments at the bottom of this discussion gave me great pause; I've always thought that the filters are made private simply to prevent LTAs and sockmasters from evading them, and that the conditions are otherwise general vandalism stuff. I never considered the possibility that there would be oversightable material in the filter logs, which brings me back to a point that I made in the discussion about whether or not EFH is being granted in the appropriate manner. If this permission would, even theoretically, grant access to information that would be deleted or oversighted if made public, I'd seriously wonder if it should be an NDA permission granted only by ArbCom (in a similar manner to CU and OS), or perhaps even abolished outright and the ability to view filters restricted to admins who are already trusted to view deleted material. At this time I plan to step back from the filter areas, at least for the time being, and reevaluate my "backstage" participation, hopefully finding a new niche area that I can dedicate my time and effort to without the need for sensitive permissions. I'll be taking a short wikibreak in order to accommodate this, but my talk page and email are still open if anyone has any further questions or comments. I thank everyone who participated here for their comments - I greatly appreciate them - and I look forward to seeing folks around other areas of the project in the near future. Respectfully submitted. Taking Out The Trash (talk) 03:40, 18 November 2022 (UTC)

Taking Out The Trash (t · c · del · cross-wiki · SUL · edit counter · pages created (xtools • sigma· non-automated edits · BLP edits · undos · rollbacks · logs (blocks • rights • moves) · rfar · spi) (assign permissions)(acc · ap · fm · mms · npr · pm · pcr · rb · te)

I was hoping that the above discussions and reviews of the existing filters would result in some of the filters that I feel are unnecessarily private being made public, but it doesn't seem like that's going to happen. As such, I would like to request edit filter helper permissions. The ability to view the private filters (well, at least their logs) would greatly assist me as one of the people who regularly patrols WP:EFFPR and will allow me to handle reports based on private filters without having to constantly ping @Suffusion of Yellow: to go troubleshoot. Additionally, I am a prolific counter vandalism patroller who primarily focuses on the edit filter log. When I see mass flooding of the log that is exclusively from private filters, I have no idea if it is a false positive, or attempted vandalism. Finally, having to guess what exactly the filters are looking for just based on the title is far from ideal, and for many filters that are just "LTA" followed by an anonymizing four-digit number, that tells me nothing. I can't troubleshoot false positives, or determine which hits in the log require immediate attention and which ones don't, when I haven't a clue what exactly the filter is looking for. For full disclosure, I have requested this once before, and was rejected more or less on the grounds that my account was too new at the time. I don't believe that should be an issue anymore. I can confirm that I meet all of the criteria at WP:EFH. I'll answer any questions/address any concerns to the best of my ability. Thank you for your consideration. Taking Out The Trash (talk) 21:54, 11 November 2022 (UTC)

Previous discussion at Wikipedia:Edit filter noticeboard/Archive 9#Edit Filter Helper for Taking Out The Trash. GeneralNotability (talk) 22:06, 11 November 2022 (UTC)
Based on this (and further discussion here, I'm strongly opposed. EFH requires a lot of trust. loutsocking is a major abuse of trust. GeneralNotability (talk) 22:16, 11 November 2022 (UTC)
Sigh... when will this nonsense end? This is all a giant red herring. I do not edit with any other account or IP address and have never intentionally done so. Anyone who says otherwise is either wrong, and/or doesn't know what a shared computer is. The edits in question were not made by me. I don't know how to make that any more clear. I also find it mildly concerning that an admin would link to a blatant personal attack made against me, especially one that was made almost a year ago. Taking Out The Trash (talk) 22:51, 11 November 2022 (UTC)
Where's the personal attack? DatGuyTalkContribs 00:23, 12 November 2022 (UTC)
In the first diff. Implicitly calling me a liar. That's a personal attack. Taking Out The Trash (talk) 01:04, 12 November 2022 (UTC)
I'm assuming you're referring to TNT's saying [I find] your statements to Blablubbs nothing short of a barefaced lie in the fact of overwhelming evidence. It could be casting aspersions. That is, if it were done repeatedly and without proof. However, considering the second half of that sentence it appears not to be the case. Regarding the implicitness part, that sounds more like Joe Pesci in Goodfellas - all based on interpretation. On the other hand, I see rather combative behaviour by you in your reply, as well as flagrant wikilawyering in the sections linked above. I won't hold the latter part against you though since it took place nearly a year ago. DatGuyTalkContribs 01:31, 12 November 2022 (UTC)
I apologize if my comments appeared to be combative - that was certainly not my intent. I am however frustrated and tired of having to refute this false allegation repeatedly. Heck, this is what led to my retirement from WP for several months. I just don't understand how and why other users, let alone admins, are being permitted to make false statements about me that have the potential to damage my reputation, refuse to provide public evidence to justify these serious allegations, call me a liar for refuting the false allegations, and then continue to hammer this over my head even almost a year later! Allowing privileged users to damage the reputation of less privileged users, seemingly without consequence or even a soft rebuke, is toxic behavior. This cannot be allowed to continue. <end rant>. Taking Out The Trash (talk) 02:21, 12 November 2022 (UTC)
I guess the apparent logging out editing at hand is here and here? Regardless of whether it is or isn't TOTT I don't think there's anything awfully problematic there. As for temperament: the relevant part is whether TOTT is collaborative, and IME (in the space of edit filters) he's been fine. I'm not worried about temperament otherwise as this isn't an RfA; it's a request to be able to see the patterns and logs of private filters, and EFH cannot make any onwiki actions. I'm not awfully convinced there's anything TOTT has done to show he's unsuited for this particular technical permission, and see a few ways in which it might lead to improvements on Wikipedia, so overall I remain not concerned about this passing. (as an aside: while there are definitely private filters that shouldn't be, I guarantee your perspective on whether certain filters need to be private will change if this passes, as did mine.) ProcrastinatingReader (talk) 15:54, 12 November 2022 (UTC)
In all seriousness, I'd value comments from you folks. As this has now been open 3 days, I'd like to avoid a "no consensus" result if at all possible - would like a definitive "yes" or "no". Thanks. Taking Out The Trash (talk) 23:02, 14 November 2022 (UTC)
Take heed, if you ask me for my opinion, you'll usually get one. I'm in the undecided camp, but I do lean towards potential support. Anyone who knows me may know it usually takes a high level of confidence to get my personal endorsement for anything, so not being opposed should be considered the good thing here. If GN stands where they stand, then you might just get that 'no consensus'. I'm undecided about the apparent logged out editing. I am a checkuser, but I can state that I didn't look closely at any of that at the time, so I have no idea whether you or anyone else is or was using that IP. The evidence is not unconvincing; yet your account was not blocked. I note that it was early in your editing history, but I also note that you've stated that your editing history extends beyond this account. Your previous account is a mystery meat as far as I'm concerned. I'm open minded, note your denials, and don't actually hold any of that against you.

Anything more recent? not that I know of. So, on the one hand, you seem to working with the filters and would have a use for EFH. On the other hand we need to look at the risks. My concerns about risk were well stated by Tamzin in your previous application. Where my concern would lie is whether you are naturally capable of maintaining the privacy of the filters, given your stated preference for transparency as well as some previous statements. When I say previous statements, I can point to your statement about filter 279 on the current version of this page, which says: "There is zero reason why this kind of filter needs to be private". I then provided a reason. This was followed by silence. That type of overconfidence is fairly common on Wikipedia, and I always find it concerning. However, I think with a strong enough commitment to the importance maintaining privacy, we could probably get over it. -- zzuuzz (talk) 05:11, 15 November 2022 (UTC)

For me, it really does come down to the loutsocking accusations. No, the edits weren't all that bad. But if those edits really were TOTT, lying about it (to Blablubbs), never apologizing for lying, and then calling the claim a "personal attack" would be a deal-breaker. What else is a lie? OTOH if TOTT is innocent, their supposed temperament issues aren't a problem. I'd be getting a bit testy, too, if I were wrongly accused of socking. Let's at least get on the same page:
@Taking Out The Trash:, are you specifically denying that you, as Special:Contributions/, made any edits to Wikipedia talk:Arbitration Committee/Noticeboard and Wikipedia:Arbitration Committee/CheckUser and Oversight/2021 CUOS appointments/CU?
@GeneralNotability:, is your oppose based on your own examination of the evidence? Or are you merely repeating the claims of others?
@Blablubbs:, you wrote about conclusive evidence which I'm not allowed to disclose on-wiki per the outing policy that you used that exact IP address within the last few hours. I am happy to share it with any interested functionary if that is desired. This is mysterious. You weren't a CheckUser when you wrote that. Did TOTT email you from an external client, and leak their IP that way? If you're still as confident as you were then, can you share this evidence with zzuuzz?
I'll have more to say when these questions are answered. But please don't close this request yet; that would be unfair to TOTT. Suffusion of Yellow (talk) 23:09, 15 November 2022 (UTC)
@Suffusion of Yellow: Yes, I am specifically and unequivocally denying that I made any edits while logged out, under that IP address or any other, at any time, with the exception of this one, which was a complete accident and I didn't even notice I was logged out. Any other edits from that IP address or any other were 100% not made by me. Taking Out The Trash (talk) 23:49, 15 November 2022 (UTC)
Suffusion of Yellow, I have not seen the technical evidence (and given that we're now talking about specific IP addresses, I doubt anyone who has seen the technical evidence would be willing to comment), but I have nothing but confidence in TheresNoTime's abilities with the CU tool. And I can't speak for Blablubbs, but I'm guessing the evidence in question is something to the effect of "here's a behavioral tell that conclusively connects the IP to TOTT", and before his recent appointment as a CU, Blablubbs was an SPI clerk with solid experience at identifying behavioral connections. It wouldn't be exaggerating much to say that the two of them are some of the people I trust most on Wikipedia, and if both of them say that someone is editing logged-out, I am definitely inclined to believe them.
Now TOTT has acknowledged above that they made a logged-out edit from Special:Contribs/, so I'll comment on that directly. That IP is an institutional IP belonging to the University of Indianapolis, so it's not implausible that there's more than one person behind it (can't say I'm familiar with their IP addressing scheme). However, around the time of the apparent loutsocking at CUOS2021 (+/- a month), there was definitely someone editing from that IP with a lot of behind-the-scenes knowledge (arbcom, CUOS appointments, edit filters)...and that knowledge and their interests sure sound like TOTT to me. The entire range (Special:Contribs/ doesn't have a ton of other activity around that time, I only count two other IPs active, and both of them seemed to have fairly consistent interests (32.8 in particular seems consistently interested in reality TV over the course of a month). To me, that suggests a few things: IPs tend to be fairly static, there's not a lot of people editing logged-out, and the consistency elsewhere makes me think that IPs aren't shared that much. I freely admit that there's a lot of speculation and inferring here, I could be wrong, all of this could be coincidence. But to me, the sum of evidence sure looks like projsocking. GeneralNotability (talk) 01:26, 16 November 2022 (UTC)
To be completely honest, now that I've looked, I don't see any edit filter stuff in the linked range. The only "project" stuff that I see are ArbCom-related things (ACN and CUOS appointments, both of which I don't really have any interest in being part of) and one edit it looks like to Articles for Creation (pretty routine of any IP or new account). I also certainly don't have any keen interest in reality TV, either. Taking Out The Trash (talk) 02:20, 16 November 2022 (UTC)
Off topic but semi relevant TLDR
I should point out however, that geolocation and WHOIS data for Indy IP ranges is next to useless. 95% of the time the results that these tools will return will be at least partially incorrect. To use the range in question for example, yes it is "registered" to the University of Indianapolis, but its usage is not explicitly restricted to the university's internet connections. In fact, given the most recent edits it almost looks to me that it may currently being used by someone at or affiliated with Butler University, arguably one of UIndy's chief rivals. It seems rather unlikely that someone at UIndy would be editing articles related to one of their top opponents, when, with the exception of social interactions between the two mascots (both dogs), connections between the two schools are generally restricted to official and large-scale events (I am indeed a UIndy alum).
Finally, if you're wondering how I know all this, my previous job when I was still living in Indy was in a computer-based field and as such I learned quite a bit about the inner workings of the Indianapolis Internet Grid. I can say that unless things have dramatically changed in the ~11 months since I left the area, there were only about a dozen different IP ranges that encompassed all of Indy's public internet hotspots, from parks to cafes to guest networks at schools, you name it: everything was assigned within a limited number of ranges. This is ultimately was causes geolocation etc to be inaccurate, and also results in a ton of shared networks that might not otherwise be shared.
@Taking Out The Trash: The "edit filter stuff" is in Special:Diff/1041977607. Suffusion of Yellow (talk) 21:59, 16 November 2022 (UTC)
Ah. Though honestly that just looks like someone well versed in MediaWiki, not necessarily in the backstage areas of enwiki specifically. Taking Out The Trash (talk) 23:22, 16 November 2022 (UTC)
@Suffusion of Yellow: I've sent an e-mail to GN and zzuuzz. The information in question is not NDA'd, and indeed readily accessible by a large number of admins, but posting it publicly would still constitute OUTING. Also noting that I've removed some indentation in the collapsed section above because my reply refused to show up with otherwise. --Blablubbs (talk) 11:38, 16 November 2022 (UTC)
I've been pinged multiple times to chime in on this discussion. I've seen TOTT's work at WP:EF/FP and in my experience it seems great and shows a genuine need for EFH. On the surface I have no reason to oppose, but the concerns with possible loutsocking also concern me. Thus, I wouldn't mind seeing the info you have as well, @Blablubbs, if you don't mind sharing. I will try to investigate and draw my own conclusions. I myself was once wrongfully accused of socking, so I sympathize with the frustration TOTT might be experiencing in that regard. MusikAnimal talk 23:45, 16 November 2022 (UTC)
If the information is not NDA'd, I'd ask that you please send it to me as well, with any private information that doesn't directly relate to me redacted as necessary. If I can review at least the gist of the evidence, I might grant permission for it to be posted publicly (thereby waiving any protections under OUTING), as I'm no longer living or working in the same place that I was when these events unfolded. Taking Out The Trash (talk) 15:06, 16 November 2022 (UTC)
  • So, SPI clerk hat on, the level of behavioral similarity with that IP is such that I would have made a tempblock if it had been reported to SPI in a timely fashion. I note that you later had IPBE revoked for cause, although the burden of proof for IPBE revocation is lower than for blocking. Now, hat off, as someone who's been not just falsely accused of socking but wrongly blocked for socking, and who's made hundreds of sockblocks, I constantly worry about "What if this user is the 0.1%? What if it's just the perfect storm of coincidences for them?" And I do worry that, in being relatively forgiving of people who own up to socking and relatively unforgiving of people who maintain their innocence, we create a perverse incentive for false confessions for those rare cases of people caught up in a series of improbably coincidences. Furthermore, while (pace two arbs' comments of late), editors are absolutely allowed to ask someone whether they edit from a given IP in the course of looking into abusive editing, admins cannot punish people for not answering (or at least that's how I interpret editors who have edited while logged out are never required to connect their usernames to their IP addresses on-wiki). Now, that doesn't directly apply here, but I do think it's, again, a bit of a perverse incentive to punish someone for being honest about their IP, when we wouldn't be allowed to punish them for not answering. (More broadly, if you ask me, we should repeal that clause of WP:SOCK, since editors always retain the RightToLeave and thus nothing an admin imposes really requires anyone to do anything, but as long as that's on the books, we should avoid situations that punish transparency.)
    The upshot of that is... I'm willing to look past the still-IMO-probable loutsocking, given that there's been no recurrence, if you would otherwise meet the criteria for granting. But that's a big "if". The concern about your unstated previous account is independent from the loutsocking concern, and personally I couldn't see supporting without that in some way addressed. I recall that when Floquenbeam RfA'd, having abandoned a previous account for privacy reasons, he shared his old username with a functionary and had her give a broad summary of his previous editing patterns. Would you be open to doing that? -- Tamzin[cetacean needed] (she|they|xe) 23:42, 16 November 2022 (UTC)
    It might have been better to link directly to my RFA instead of ping me, because I have absolutely no understanding of what anyone is talking about here. ("LOUTSOCK" has always registered in my head as socking while acting like a lout, but apparently not) I dropped an old account with privacy issues, and created a new, normal, mortal account without telling anyone, as was my right. When I decided I wanted to run for admin, I felt - since it was probably obvious to everyone I had edited before, as the new account was kind of precocious - compelled to tell someone, so I first told a Checkuser (and later one Arb, and later one Crat, to appease people at the RFA), and proved it by emailing them from my old account too. Not so they could vouch for how wonderful I was when editing under the old account, but so they could vouch for there not being any skeletons in my closet. It was ultimately successful, but I was a little disappointed that all those people vouching for the old account was still not enough for a lot of people, and how much everyone seemed to think that the old account name was their business. I would imagine an Arb of your choosing might be willing to do the same. Personally, I wouldn't tell the whole committee if it's important to you: I'm not sure I'd consider the ArbCom mailing list 100% secure. If this trip down memory lane is useful info to anyone in this thread, I'll be pleasantly surprised. If more specific info is desired, let me know. Floquenbeam (talk) 00:07, 17 November 2022 (UTC)
  • So having now heard from everyone whom I wanted to hear from, plus one extra (thanks Floq), I'm getting a feeling that it might just be better to withdraw. Clearly I'm a controversial candidate, though I don't quite understand why. All this false sockpuppetry stuff is from over a year ago, and I don't see how any of it directly relates to my suitability and competence to work with the edit filters. That being said, I still would like to see for myself what "information" @Blablubbs: might have "against me" (since he has stated that it's not covered by the NDA) and, assuming there's nothing seriously compromising that could endanger my current job or link me to a real name or physical address or anything like that, I'd probably waive my protections under OUTING and allow it to be posted publicly so that everyone can see for themselves. But I'd have to see the information in question first, obviously with anything private that doesn't concern me redacted as appropriate. Additionally, in response to @Tamzin:, I don't see anything at WP:EFH that says identifying abandoned accounts/previous accounts before a WP:CLEANSTART is required for the granting of this permission (as opposed to, say, RFA or ACE where such a requirement is explicitly listed). If this is a requirement somewhere, I haven't seen it, and would have to ponder/consider the ramifications of doing such further before I could make a decision on that front. But I don't think it should be necessary. Taking Out The Trash (talk) 18:48, 17 November 2022 (UTC)
    I found the conversation draining when we had it a year ago, and I don't want to have it again (nor do I wish to share my e-mail address); hence my staying out of this discussion. I've shared the information with interested functionaries; if one of them wants to pass it on, they should feel free to do so, but I'm out. --Blablubbs (talk) 18:57, 17 November 2022 (UTC)
    I've seen the stuff, and I don't feel I'm in a position to disclose it further. But I can report on it. It all appears very intriguing, but it's not. In reality it merely supports what TOTT has told us, which is that certain IP address(es) were used by them at some point. We are back at square one, which is not exactly knowing whether more than one edit was made by TOTT using That's about it, and that about all I foresee myself saying about it. I've said what I've said above. One last thing though: if TOTT decides they want to disclose their previous account(s) to me, in order for me to give a "broad summary", they can do that with absolute guarantees of confidentiality. Just email me to discuss the parameters. -- zzuuzz (talk) 19:52, 17 November 2022 (UTC)

It seems relevant to note that User:Taking Out The Trash has also been editing as Special:Contributions/ This IP started editing prolifically a couple of months after User:Taking Out The Trash had supposedly stopped editing last year. In late August this year, the IP was criticised for incorrectly tagging things for speedy deletion, and stopped editing on 9 September. On 10 September, User:Taking Out The Trash returned with a particular interest in tagging things for speedy deletion. IP geolocates to Indianapolis, where the account is also known to have edited from. (talk) 18:52, 17 November 2022 (UTC)

  • I don't see the necessary trust here. Private filters do a fair bit more than preventing people from replacing articles with swear words or putting pages "on wheels". There are a number of filters whose logs contain content that would be revdeled or oversighted if posted on-wiki (e.g. PII and libellous material). Because access to filter logs is not monitored, it's difficult to determine when or how the EFH right is abused. I am not saying that I believe this candidate, specifically, intends to use this right improperly, but I am saying that this concern necessitates a level of trust that is much greater than something like rollback or PCR, and as such a few months of responding {{Not done}} to vandals at EFFP isn't enough to overcome the doubts raised by others. The repeated agitation for making private filters public (mentioned by Zzuuzz above) adds to this concern IMO.
    I don't know what "private evidence" is being referred to, and I don't have any interest in seeing it, but based on what I can see publicly (TOTT has acknowledged editing from before; the IP has edited railfan topics that TOTT mentions on his userpage; the IP has displayed knowledge of projectspace that is unusual for an IP editor - and even most registered editors - but is consistent with TOTT's knowledge and interests) the denial of logged-out editing is frankly unconvincing. I also note that a checkuser revoked the editor's IPBE right based on technical evidence of IP socking [12].
    As is mentioned above, TOTT admits to having a previous account that he doesn't want to disclose. That's fine and is permitted by WP:CLEANSTART. But considering TOTT's dedication to maintaining the privacy of his previous account, I would hope he could understand why people might be hesitant about granting a right that would - for example - allow someone to see every time an editor accidentally tried to link to C:\Users\Editor'sIRLName\Files\Example.JPG when they have reason to believe that the candidate is not being entirely transparent about their history (whether or not that is true). Spicy (talk) 20:10, 17 November 2022 (UTC)
    • BTW, I started writing this before I saw the IP's comment above. None of my comments are in reference to the 47. IP. I've seen that IP around before and it seemed to have a distinctly different "vibe" from TOTT, although I haven't really looked into it and don't intend to do so. Spicy (talk) 20:13, 17 November 2022 (UTC)
  • I'll just say that the IPs comment is nothing but complete BS (no personal attack intended). There is absolutely no truth to that claim, and matter of fact, I had already left the Indianapolis area when I returned to editing in September. I continue to maintain that I have never edited logged out under any circumstance except for the one accidental edit that I've already claimed responsibility for, and will continue to maintain this position for the entire duration of my wiki career. Now, reading Spicy's comments almost makes me wonder if EFH should be an NDA permission, perhaps to be granted by ArbCom in the same way that CU and OS are. It just doesn't seem proper that a permission where numerous people are expressing concerns about access to private data can be assigned without technical limitation by administrators, who may or may not have signed the relevant agreements(s) since they're not required for RFA. Finally, I still don't see the correlation between "may have possibly edited while logged out a year ago" and "can be trusted not to leak the contents of private filters". Taking Out The Trash (talk) 21:21, 17 November 2022 (UTC)
The discussion above is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

Idea at WP:VPI: Enable the AbuseFilter blocking actionEdit

This is a continuation of the topic I brought up here a while back — your comments and suggestions are welcomed at this thread on WP:VPI. Many thanks — TheresNoTime (talk • they/them) 11:51, 29 November 2022 (UTC)

Add "ezproxy2" to proxy link filterEdit

Found at Music of South Asia ("") * Pppery * it has begun... 23:27, 29 November 2022 (UTC)

Set filter 979 to warn?Edit

  • 979 (hist · log) ("Accidental insertion of biomedical references", public)

See Wikipedia:Village pump (miscellaneous)#Paywalled 1970s biochemical articles used widely as references. I'm not sure what the warning should say, because I'm not totally certain why people are doing this in the first place. It's probably not intentional, because they never seem to cite PMID 69 or 420... But this covers the two most likely possibilities: (feel free edit)

I also suspect that this is going to be one of those filter where people say "Oh that warning isn't for me. It must be for that guy behind me." and click "publish" anyway. So maybe we should also consider the possibility of disallowing if this fails. Suffusion of Yellow (talk) 23:47, 29 November 2022 (UTC)

This looks good to me. Perhaps a link to the help desk or teahouse or something would be in order, but other then that it looks like it would help a lot - and having the filter set to log only means nothing if nobody's actually actioning on the log, does it? casualdejekyll 23:23, 5 December 2022 (UTC)

Lack of autocreateaccount on username filtersEdit

Is there any particular reason the log-only filters here only use createaccount instead of both createaccount and autocreateaccount? DatGuyTalkContribs 20:05, 3 December 2022 (UTC)

Some of those say action contains "createaccount", which covers both possibilities of course. As to the others, I can't see any harm in logging autocreations. Suffusion of Yellow (talk) 20:11, 3 December 2022 (UTC)
I see, makes sense. I've updated the two remaining filters to 'contains' as well. DatGuyTalkContribs 20:12, 3 December 2022 (UTC)
As an aside, I'm unsure about the effectiveness of Special:AbuseFilter/1196. It does indeed catch its target, but considering the type of target, wouldn't they just keep working until they find a username that isn't disallowed? DatGuyTalkContribs 20:17, 3 December 2022 (UTC)
1196 was split out from 874 (hist · log) after this discussion. Personally I wish we had gone with my suggestion to throw some WP:TNT in the whole thing and start over. There might be an odd LTA whose only interest is impersonating other users. But usually impersonation is just one game they play, and they'll just continue disrupting, only under a less obvious username. Unless checkusers are actively monitoring the log, that is. @Zzuuzz: Do you (or any other CU) ever check the IPs of users tripping 1196 and related filters, to find out which username (if any) ended up getting through? Suffusion of Yellow (talk) 20:39, 3 December 2022 (UTC)
It's very uncommon, though it does happen. We usually pick up on their created accounts. Indeed they create other accounts and do disruption, but I don't think this negates preventing their preferred one. The further away their username is from the real one the better, IMO. -- zzuuzz (talk) 22:28, 3 December 2022 (UTC)