Admin tools development

Rationale
There are a number of powerful anti-disruption and protective tools that are provided for our communities on the Wikimedia clusters. These include local tools for each project's sysops or other higher-graded users, and cross-wiki tools co-ordinated on metawiki that are either for all metawiki sysops, or for stewards.

These tools are crucial for the community to fight against spam, disruptive behaviour and large-scale vandalism, and dealing with private information or other, less-common situations. It is important that the Wikimedia Foundation works on these tools so that the communites we support are not overloaded with work and that they can maintain the quality of the projects.

Sadly, the resources of the Wikimedia Foundation are limited, and we do not wish for this to interfere with our timely delivery of appropriate tools. Thus, we hope that a member of the community to work as the volunteer Product Manager for these admin tools, liaising between the different users of these tools and the developers, shaping what the products should look like and prioritising areas of particular concern.

Roadmap
Still a little hazy. Our top priorities for now (in descending order) are:


 * 1) Global AbuseFilter rules
 * 2) Global AbuseFilter variables/throttling
 * 3) CentralAuth mass account blocking

See below for more details on what these items mean.

List of in-scope extensions and corefeatures

 * Local project-specific tools
 * AbuseFilter
 * Revision supression and Oversight
 * ConfirmEdit
 * CheckUser
 * BadImageList
 * MassDelete
 * File upload cleanness checking (mostly relevant to Commons).


 * Note: local blocking tools are, at least for now, out of scope.


 * Metawiki-based tools
 * GlobalAbuseFilter (not currently extant - see below)
 * GlobalBlocking
 * CentralAuth account locking, renaming, merging
 * TorBlock (currently broken?)
 * AntiBot (currently broken?)
 * SpamBlacklist
 * TitleBlacklist

Existing major problems, and possible solutions

 * The number one cross-wiki issue is dealing with spammers and other bot-driven disruptive editing. This is especially a problem on our smaller wikis where the spam can easily swamp the local community. Beyond the original problem, noticing the problem once it's occurred can take some time during which our readers are poorly served, and cleaning up the spam can be arduous.
 * To try to prevent the spam from occurring, we are looking to provide a version of the AbuseFilter extension, based on metawiki, that would apply its event rules to act globally on all Wikimedia wikis at once, as directed by Stewards. This functionality is currently implemented as an experiment in the existing codebase, but it has never been used, is untested, and likely to be rusty).
 * To deal with multiple accounts being created - or multiple edits being made - very rapidly across a number of wikis, we would like to extend AbuseFilter to allow per-IP throttles on events ('only 5 edits a minute' and similar) to apply across all of our wikis globally, rather than be implemented on a per-wiki basis.
 * One recurring Wikimedia Foundation issue is the performance of the systems that we provide, and in particular the scalability of existing systems to work as the load grows.
 * In general, the Foundation would like to re-engineer the ad hoc collection of tools into a smaller number of more powerful tools (ideally one), based on the existing AbuseFilter extension. This would take some time and is not the top priority, but is our overall intended direction.
 * A particular piece of work in simplifying and speeding up our systems would be to move some of the lists of banned article titles, account names, used images and external links from blocks of wikitext that need to be interpretted by their own extensions into the database.

Other problems or possible pieces of work

 * There is an opportunity (via AbuseFilter) to use detection of particular UserAgent strings used by spammers to prevent more effectively.


 * Allow supression using the RevisionDeletion tool of multiple revisions of deleted page (existing functionality in action=history which is needed in Special:Undelete).


 * The current CAPTCHA system is awkward for a number of users (there are internationalisation concerns - see 5309), and isn't very effective in fighting against spammers given the state of the art in image character recognition and the wide number of mechnical turk-like systems. We should analyse our logs and consider either somehow replacing it with something that would work, or just disabling it entirely and relying on our other tools that actually work.


 * Allow local sysops to temporary variation of the IP throttles for particular IPs and IP ranges (e.g. so that an event with a lot of expected newbies would not hit the "too many account creations from your IP" issue), which currently can only be solved by a user with shell access, or individually-creating accounts by local sysops. The code hooks for this functionality already exist, but no extension has yet been written.


 * The e-mail black list (which prevents account registration or sending e-mail using matching addresses) is currently split into a file that only shells can access, or an entirely-public list on metawiki. A middle-ground tool which could only be accessed by a small number of users would be a significant improvement for privacy purposes.


 * Better filtering on potential exploits in file uploads


 * Selective blocking so a user cannot edit particular pages under a LocalBlock, pages in a Category (feels like local poltical decision - not for this?)


 * Auto-warn user that they've reverted 3 times


 * Global AbuseFilter separated resources


 * CentralAuth mass account blocking - "search with check boxes" (from Special:Log/newaccounts or whatever?). Global view into account creation(?)

Documents

 * User requirements:
 * Specifications:
 * Software design document:
 * Test plan:
 * Documentation plan:
 * User interface design docs:
 * Schedule:
 * Task management:
 * Release management plan:
 * Communications plan: