User talk:Entropy/blacklist

You should put an "Anyone may edit" tag on this. 03:16, 25 September 2008 (UTC)

an interpretation of QDV
I think that documenting a consistent pattern of vandalism is helpful in catching future ones. However, any additional speculation as to identity/relationship of the perpetrator(s) do not actively help, and in some cases can be counter productive, and thus I would like to discourage it. I'm going to be bold and remove what I think are unnecessary in helping users identify future attacks. Feel free to disagree on the particulars and discuss them. -User:PanSola (talk to the ) 04:38, 26 September 2008 (UTC)
 * You EC'd me in the middle of some changes which I was already going to correct some of that, hold on a sec. I do disagree about not listing the uesrs and IPs though, if only so there is a paper trail. [[Image:Entropy Sig.jpg]] (T/C) 04:48, 26 September 2008 (UTC)
 * Since Pan deleted the userpages of the users in question, they no longer serve the purpose of an example that sysops uncertain what to look for can use, so there's no reason to list them now beyond having a list. [[Image:Felix_Omni_Signature.png]] 04:50, 26 September 2008 (UTC)
 * I await on the explanation of how the paper trail would be useful q-: -User:PanSola (talk to the [[Image:follower of Lyssa.png]]) 04:53, 26 September 2008 (UTC)
 * To show the username characteristics; to link to a concrete example (you can view deleted edits); to keep a historical tab; to provide information which may spark further correlations. [[Image:Entropy Sig.jpg]] (T/C) 05:00, 26 September 2008 (UTC)
 * Oh yes, I suppose confused sysops could view them. Right you are. [[Image:Felix_Omni_Signature.png]] 05:02, 26 September 2008 (UTC)
 * Shut up. I'm keeping them for my own personal use in any case. [[Image:Entropy Sig.jpg]] (T/C) 05:05, 26 September 2008 (UTC)
 * Wat, I was supporting you. Poo head. [[Image:Felix_Omni_Signature.png]] 05:06, 26 September 2008 (UTC)

Listing the accounts/anons doesn't bring any worthwhile information to the article. If anything, it more makes it a badge of honor to any vandals who want to leave an impression. If it's anonymous you are only adding a stigma to a string that shifts identities. The section is pointless and counter-productive and should be removed, imo. 67.159.45.52 06:03, 28 September 2008 (UTC)
 * Fine. Whatever. I should have kept this for my own personal use. [[Image:Entropy Sig.jpg]] (T/C) 06:21, 28 September 2008 (UTC)
 * I think it is a good idea to share this with the community because the occurrences go beyond isolated cases. As a "badge of honor", this page is far too much off the beaten track; Special:IpBlockList is much more visible and just as hard (or easy) to get onto (and can't get blanked). --◄mendel► 13:30, 28 September 2008 (UTC)
 * PanSola and the anon don't like it, Felix and Mendel do. I've already moved it back and forth like three times. Also Mendel, this is linked on the admin noticeboard, though I dunno how visible that is. [[Image:Entropy Sig.jpg]] (T/C) 18:16, 28 September 2008 (UTC)
 * Just do what YOU like, then? --◄mendel► 22:58, 28 September 2008 (UTC)

infinite bans
The current text of the article suggests that if an IP is caught doing such activity, the IP should be infinitely banned. I'd like to bring up that only named accounts should be infinitely banned, as IPs might change hands. The current attack pattern seem to always come from registered accounts though, so this technical point is probably moot, but still just want to bring it up to be safe. -User:PanSola (talk to the ) 04:45, 26 September 2008 (UTC)
 * Agreed on this point- the IPs are probably proxies anyway. [[Image:Felix_Omni_Signature.png]] 04:46, 26 September 2008 (UTC)
 * See above [[Image:Entropy Sig.jpg]] (T/C) 04:48, 26 September 2008 (UTC)

Images used
They seem to mainly be images uploaded a long time ago (2006-07) and mainly by users who have left (no edits since 2006-07), anyone think it's significant? --Gimmethegepgun 05:21, 28 September 2008 (UTC)
 * If you use the "random image" function (exists somewhere, or at least I know the mediawiki supports it) you could get anything, so statistically I don't think it's significant. [[Image:Entropy Sig.jpg]] (T/C) 05:51, 28 September 2008 (UTC)

Protected from creation pages
You have a link to edit that list of pages, but normal users can't edit it since it's protected. Should you have a "to be protected" list instead and then a sysop moves it to "protected" when it's put on the list? --JonTheMon 16:05, 30 October 2008 (UTC)


 * That's a good point...I want to protect those pages with sysop-lock, but the list shouldn't be protected. >.> Hmm. [[Image:Entropy Sig.jpg]] (T/C) 16:13, 30 October 2008 (UTC)


 * How is that? It will eat up more of RC but I don't want to make a redundant list. [[Image:Entropy Sig.jpg]] (T/C) 16:16, 30 October 2008 (UTC)
 * That should work. Maybe a minor heading/small text between the protected and to be protected list. --JonTheMon 16:25, 30 October 2008 (UTC)

botnet phoning home?
This bot could be a botnet's way of "phoning home", i.e. you get some exploit going that spreads, and each time it infects a new PC it does one of these edits here, so the person who controls it knows the IP address of the next machine ready to do his bidding. Since there is no direct connection to the author coded into the bot, tracing it requires access to the infected macines, not just to the infection vector.

If that is true, the thing to do is to eradicate any mention of the new IP adresses from the wiki (the old ones should be kept as they're probably already known); and if the person controlling the bots gets RC via RSS feed or some other "live" source, this is of course going to be completely pointless. The only way to stop this then would be to block the bots from posting at all. The only idea I have for achieving this is to block the /16 addresses these posts are mainly coming from. --◄mendel► 11:04, 21 November 2008 (UTC)
 * Range blocks are dangerous and we really try to avoid them, but yeah this is minorly ridiculous. [[Image:Entropy Sig.jpg]] (T/C) 11:10, 21 November 2008 (UTC)