Wikipedia talk:Requests for adminship/ProtectionBot

message: Why can't the source code be revealed? AWB would require much less modification to be an effective vandalbot, and its source is freely available to anyone who cares. -Amarkov blahedits 18:18, 7 January 2007 (UTC)
replies: text: Not sure, I have read it and it seems to be safe releasing the source. HighInBC (Need help? Ask me) 18:26, 7 January 2007 (UTC)

text: There is no WP:BEANS here.  This is nothing that couldn't be done with the freely and openly available pywikipedia framework.  Cheers, ✎ Peter M Dodge ( Talk to Me • Neutrality Project ) 19:21, 7 January 2007 (UTC)
replies: text: I agree, pywikipedia framwork, the perl wikimedia module, or just plain html scripting can get the same results. The functions this bot performs are not difficult to reproduce. What's more, the code would not be able to perform admin functions on a non-admin account anyways, so it is really just the recursive unprotected template/image finder. If the bot is functioning, then this list of unprotected pages will not be a threat. I read the source, I see no reason to keep it a secret, but I respect the authors right to do so. HighInBC (Need help? Ask me) 19:28, 7 January 2007 (UTC)
replies: text: Earlier today, I was thinking the same thing as you, HighinBC, but I've realised the potential issue with releasing the code.  I'm going to break WP:BEANS here (on the understanding that the code won't be released), in order to enlighten everyone.  The simple matter is that the bot code could be changed to automatically vandalise every unprotected page, perhaps before the bot would be able to protect, and cause the vandalised page to be protected.  This is a very serious possibility, allowing vandals to easily impose mass vandalism (esp image vandalism).  I anyone thinks that this comment is severely WP:BEANS, blank it. Martinp23 20:03, 7 January 2007 (UTC)

text: So far as I can tell, the code of User:AntiVandalBot isn't public (at least I couldn't find it)... why is no one freaking out about that? It's a much more complicated bot that can make edits to every page on Wikipedia. It makes more edits in a day than the protection bot will in an entire year. If it 'went berserk' it could require vastly more work to clean up than the proposed protection bot ever would. In short, all the concerns expressed about 'protection bot' are vastly more applicable to 'antivandal bot'... yet the code is not public and no one seems to mind. Why do you suppose that is? Why do you suppose that 'auto wiki browser' isn't just given out to anyone who wants it? My own theory is that most people realize that 'making smarter vandals' is a bad idea. Yes, a vandal could build their own version of 'anti vandal bot' that instead creates vandalism... some have. But most of them aren't 'dedicated' enough to figure out the hows of it and eventually go away. Does it really make sense to HAND those people a ready made vandalism tool that just requires a few tweaks to create a massive mess? That's what making 'protection bot' or 'anti vandal bot' code publically available would do... give general vandals the ability to do alot more damage. We can handle the few vandals who are capable of building their own bots.  Let's not give every vandal the ability to make bot attacks. --CBD 23:01, 7 January 2007 (UTC)
replies: text: AntiVandalBot obviously does have a vandalism problem. It can edit anything already, it can do it fast, and it requires no human intervention. This bot can only edit images and templates, and even then only to add or remove three specific things, so it would take loads more work to convert it into a useful vandalbot. And as I've reiterated a lot already, we already have the full source of AWB, which would be much easier to convert to a vandalbot. (It wouldn't even be conversion, really). -Amarkov blahedits 23:07, 7 January 2007 (UTC)
replies: text: Alternatively, you can use my perlwikipedia framework to write a vandalbot. I just wrote a dirt simple, proof-of-concept one with the framework, 24 lines of code, that uses threading and multiple usernames. Elapsed time: 4 minutes. Just because the bot is open-source doesn't make it an automatic target for vandals trying to create vandalbots. It would probably be harder to convert ProtectionBot into a vandalbot than it would be to write one from scratch using pywikipedia. Shadow1 (talk) 23:31, 7 January 2007 (UTC)

text: I agree, bot making is not some secret, anyone can learn it and use existing frameworks. HighInBC (Need help? Ask me) 23:32, 7 January 2007 (UTC)
replies: text: Absolutely agree. Not that I don't trust HighInBC, but I believe strongly in trust-but-verify. I already know pretty well how Antivandalbot works just by having seen what types of things it's done, and it would not hard to write vandalbots from what's already out there. Our anti-vandalism techniques need to be just as open, so that when the vandalbot runners find a way around them (and you believe me, they will), we can respond quickly and improve our own techniques (and perhaps find weaknesses before they're exploited). Security through obscurity isn't-and if this bot's code is too insecure to post, it's too insecure period, let alone to trust with an admin flag. Seraphimblade 00:04, 8 January 2007 (UTC)
replies: text: This is one of the best comments I've seen for the release of the source code. Just posting this to highlight it... Mathmo Talk 16:08, 9 January 2007 (UTC)

text: To echo some comments from other editors that I think are most worthy of consideration: nothing this bot could do is difficult or uniquely complex, there's no good reason not to publish, publication would facilitate bug discovery and resolution.  The bot could be blocked if it ever caused problems.  It should also be possible to distribute a version this bot set to run in semi-automatic attended mode, which would enable the word to be done efficiently without the risk that comes with a fully automatic bot, of being fooled by cleverly written malware or mischievous humans. --Tony Sidaway 07:12, 8 January 2007 (UTC)

text: I said this in my oppose !vote-if this bot code, through error or malice, is that dangerous (and if danger exists, either error or malice can lead into it), and would be that dangerous if a non-admin had possession of it, it is more, not less, critical that the code be open to continuous review-not just now but during its operation. It's not like we've never seen a vandalbot, but if this code is suddenly released we'll have a flood of them. (Please note-you certainly have the right to keep your code secret, but even if most seem alright with that, I think it's a bad idea and will in the end decrease the effectiveness of the response against vandalism. And for myself, I can't support it without seeing it.) Seraphimblade 07:50, 8 January 2007 (UTC)

text: Um... with AWB, just removing checkpage functionality, which should be much easier, leaves you with a pretty effective vandalbot. You won't be guaranteed to hit the unprotected things transcluded on main page articles, no, but you could just vandalise the pages themselves, and I do not see how that's worse. -Amarkov blahedits 15:50, 8 January 2007 (UTC)

text: You're missing my point. There already is one, and it's patently obvious that removing the checkpage would leave you with a vandalbot. Thus, it is obviously not all that much of a problem. -Amarkov blahedits 05:11, 9 January 2007 (UTC)
replies: text: Is there really anything in the code that cannot be gotten from User:Shadowbot2/Source? HighInBC (Need help? Ask me) 14:44, 9 January 2007 (UTC)
thread_title:  Someone please explain to me... 

message: (cross-posted to bot approval page) With the RfA now pending, is ProtectionBot currently operating during the RfA period? I hope that it is, at least on an ongoing trial basis. Newyorkbrad 20:21, 7 January 2007 (UTC)
replies: text: A member of the BAG ended the trial after one day and instructed DF to shut down the bot here, and DF did as he requested, so no, it's not running.  —bbatsell ¿? 20:30, 7 January 2007 (UTC)

text: I think BAG shut it down, In the meantime we have User:Shadowbot2. Which as stated on the RFA page, is fixed and will preform correctly. Cheers! —— Eagle 101 (Need help?) 23:16, 7 January 2007 (UTC)
replies: text: Probably best to just wait, I know I am checking shadowbot2's mailings. HighInBC (Need help? Ask me) 23:18, 7 January 2007 (UTC)
replies: text: Suggestion: Might it be possible to authorise the continued running of ProtectionBot for as long as this RfA maintains a suitable level of consensus for the Bot? e.g. 80 or 85%? That would combine practicality with respect for the views of the community... WJBscribe (WJB talk) 23:39, 7 January 2007 (UTC)

text: *That's a very nice idea, and I'd commend you for lateral thinking, but I don't think it's feasible.  Cheers, ✎ Peter M Dodge ( Talk to Me • Neutrality Project ) 23:41, 7 January 2007 (UTC)

text: *My point is it's not running right now. Newyorkbrad 23:05, 8 January 2007 (UTC)
thread_title:  Current status question 

message: If Dragons flight is willing I would like to see this bot continue operating on a trial basis during the RfA period, both so we have the benefit of its services during the next week and so that in the unlikely event of an issue arising the RfA !voters could consider it. Comments? Newyorkbrad 20:32, 7 January 2007 (UTC)
replies: text: I think BAG shut it down, In the meantime we have User:Shadowbot2. Which as stated on the RFA page, is fixed and will preform correctly. Cheers! —— Eagle 101 (Need help?) 23:16, 7 January 2007 (UTC)
replies: text: Probably best to just wait, I know I am checking shadowbot2's mailings. HighInBC (Need help? Ask me) 23:18, 7 January 2007 (UTC)
replies: text: Suggestion: Might it be possible to authorise the continued running of ProtectionBot for as long as this RfA maintains a suitable level of consensus for the Bot? e.g. 80 or 85%? That would combine practicality with respect for the views of the community... WJBscribe (WJB talk) 23:39, 7 January 2007 (UTC)

text: *That's a very nice idea, and I'd commend you for lateral thinking, but I don't think it's feasible.  Cheers, ✎ Peter M Dodge ( Talk to Me • Neutrality Project ) 23:41, 7 January 2007 (UTC)

text: *My point is it's not running right now. Newyorkbrad 23:05, 8 January 2007 (UTC)
thread_title: Suggest continued trial operation during RfA period

message: I see a few people concerned about buffer overflow exploits, my understanding is that this type of vulnerability can only be used on a bot that can be given binary input. Since this script gets all of it's input from mediawiki which stores it's data in text form, I see no way to insert such an attack. Python does not allow for run-time compiling. You cannot fool such a bot into running arbitrary code given such input restrictions, as the precompiled code needed for such an attack cannot be stored as text.
I may be wrong, so correct me if I am, but it seems a buffer overflow vulnerability is not an issue for technical reasons. HighInBC (Need help? Ask me) 23:50, 7 January 2007 (UTC)
replies: text: Malfunction on malformed input is far from executing arbitrary code, and would lead to a parsing failure. And changing input formats would exceed the approval it is seeking. HighInBC (Need help? Ask me) 23:53, 7 January 2007 (UTC)

text: *I know - hence "mostly correct" :)  I just felt it necessary to point out that there still ways in which this kind of thing may happen, if without the severe consequences.  Cheers, ✎ Peter M Dodge ( Talk to Me • Neutrality Project ) 00:00, 8 January 2007 (UTC)

text: I see, I agree that we cannot discount the possibility of the bot being intentionally screwed with, but I think the threat of arbitrary code execution is not an issue. HighInBC (Need help? Ask me) 00:04, 8 January 2007 (UTC)
replies: text:  Arbitrary code exception on the bot's machine? No. Arbitrary command execution on wikipedia? Depends on how the bot sends information back to the servers. I have not reviewed the code, nor has, to my knowledge, any python security expert, nor can I rely on distributed error checking to review the code, and as such, you just don't know what happens if a page to be protected has the following on it -> . Does it load and recurisvely protect everyting on malicioustemplate%2%6%9deleteallcontributions? Does it attempt to load and recursively protect the page deleteallcontributions, which has now resulted in the protection of the entire encyclopedia (oops!) Does it load http://en.wikipedia.com/w/deleteallcontributions and fail? I don't know! I can think of more way to beat the bot, but I'm just shooting in the dark. Real security audits involve reviewing the code. Hipocrite - «Talk» 20:15, 8 January 2007 (UTC)
replies: text: Interesting point - do you know any available python security experts who might be willing?  Guettarda 21:35, 8 January 2007 (UTC)
replies: text:  Open_source_versus_closed_source#Security, to be a bit snarky but not too much. Hipocrite - «Talk» 21:54, 8 January 2007 (UTC)

text: Yep, I'm aware of that, and I read a good chunk of the RFA - I see your point and I see Robert's.  He isn't likely to change his position, and the bot fills a real need.  I respect both his position and yours.  I trust both his judgement and yours.  I only see one of two outcomes - either the RFA fails (with the result that the main page remains vulnerable), or the bot is approved with the code secret (or semi-secret).  So rather than arguing about what should be, I am wondering how create the best outcome.  Guettarda 22:03, 8 January 2007 (UTC)
thread_title:  Buffer overflow 

message: Just to avoid complacency, and to remind those saying that this bot will "deal with the problems of Main Page vandalism", a reminder that the bot will deal with some methods of vandalism, but human administrators still need to be alert to the following, which, however unlikely, will probably happen at some point in the future. I've given examples below. Carcharoth 12:43, 8 January 2007 (UTC)
thread_title:  Please don't forget that human oversight is still needed 

message: *Administrators unprotecting stuff and forgetting to re-protect (ProtectionBot will not override another administrator). The fix is to reprotect and politely ask the administrator not to make this mistake in the future. Carcharoth 12:43, 8 January 2007 (UTC)
thread_title: Human error

message: *Protecting a vandalised transclusion added to the featured article. The bot cannot check whether an image or template is in a vandalised state before it protects it. If a vandal strikes lucky and vandalises a template just before it gets protected (unlikely but possible), then an admin is required to unprotect and undo the vandalism. If no-one is watching closely, then a vandal could do this on the featured article and then remove the newly protected vandalised template or image and add it to lots of pages. The template/image in question will be unprotected by ProtectionBot after two passes, but a lot of damage could be done in this time interval. Carcharoth 12:43, 8 January 2007 (UTC)
thread_title: Bot error

message: Okay, if I have misunderstood, please educate me: aren't there templates and images on the italian main page (and, of course, on the featured articles) which are editable on purpose? What would ProtectionBot do on the italian WP? And what would access to ProtectionBot's code do for an italian WP vandal that he could not already do with the "edit" links right under his nose on the main page? I'm pretty sure this goes for most, if not all, of the others -- with the notable exception of english WP. These concerns are misplaced. In any case, isn't Shadowbot2's code already written to do just what John fears: report vulnerable vandalism targets? You'd only need to change who it notifies. Abu-Fool Danyal ibn Amir al-Makhiri 14:38, 10 January 2007 (UTC)
replies: text: I have no idea (and no familiarity with it.wiki), but the point you raise that it doesn't seem protected is valid.  The request was raised by User:Dario vet, so perhaps you should go ask him.  Dragons flight 15:55, 10 January 2007 (UTC)
thread_title:  Italian Wikipedia 

message: I see considerable worries about the code of the bot not being open source and if we fail to address these the whole thing will not fly.
As being one of the supporters of giving the bot admin rights and letting the bot do what it was intended for, I would like to try to work towards consensus and see if we can move a little bit on all sides.
Would it be acceptable, that Dragons flight gets a startup time where he can establish the bot and tweak it and iron out all early bugs without publishing the code and publish the code later, when the bot is running and already doing its job?
Part of this my proposal here is that those who give their RfA support as soon as the code is published would move a bit and give their approval for the RfA based on the mere promise of Dragons flight to publish the code in - let's say - a month?
Of course my proposal only works if Dragons flight would agree to publish the code in a month. Deal or no deal? 
If this is not acceptable, what can be tweaked to make it acceptable?
Could we keep parts of the code unpublished? For example the code part(s) that determine the exact time when the bot will protect a specific page. Maybe this could be refactored out into a call of a random function so that the complete code could be published without giving the knowledge exactly when it is going to protect a page. 
Please help work towards consensus, everybody! --Ligulem 10:40, 10 January 2007 (UTC)
replies: text: Personally, I would like to see at least an outline of the algorithm used, in order to be able to identify potential exploits and have them addressed ahead of time. Perhaps this is already written somewhere, but between this RfA and BRfA I can't find it. For instance, how is the template recursion handled? If template A transcludes B which transcludes A, does the recursion stop? How does it treat noincude and includeonly parts of templates? Gimmetrow 13:53, 10 January 2007 (UTC)

text: A month? Well... let's face it -- contrary to what you say, the whole thing is going to fly without addressing our concerns. So if that was the offer I'd take it. Abu-Fool Danyal ibn Amir al-Makhiri 14:54, 10 January 2007 (UTC)
thread_title:  Idea for a compromise about the source code 

message: Erm... please don't shoot me down, cos I'm not a techie and I'm also not overly familiar with process here (yet) and I'm feeling my way with this message:
Is this correct, that the Bot needs admin powers only to be able to automatically protect and unprotect images? Am I also right that the real urgency is only the need to protect images, not the unprotecting again?
Surely a simple workaround would be to give all logged-in non admins the power to protect images (something an admin can easily over-ride if abused, and something not particularly attractive as a method of vandalism). The bot can then do the urgent protection and (also on an automation) send an unprotect message to an admin backlog page, like when us non admins flag something for speedy deletion (because obviously vandals should not have the chance to unprotect).
I presume that making the protection function available to non admins would be controversial (I'm not that wet behind the ears!) but if we pretend for a minute that that could go through "on the nod", have I made any mistakes in my understanding of what the Bot needs to do, that means my suggestion wouldn't work? --Dweller 17:02, 10 January 2007 (UTC)
replies: text: It would be used in content disputes, that is why a level of trust must be established before such powerful tools are given out. This will not fly I am afraid. Maybe in the future when the world is perfect, I can see it now.... HighInBC (Need help? Ask me) 17:07, 10 January 2007 (UTC)
replies: text: Hmmm... you mean where two editors edit war about the inclusion of an image, one might protect it? I get your point. --Dweller 17:27, 10 January 2007 (UTC)

text: Exactly. Of course, bots don't have a pride to lead them to edit war. HighInBC (Need help? Ask me) 17:43, 10 January 2007 (UTC)

text: Also, it needs to protect templates, not just images. Carcharoth 18:01, 10 January 2007 (UTC)
thread_title:  Newbie kind of idea 

message: (header added by Carcharoth 22:53, 10 January 2007 (UTC)
replies: text: Ah. This possibility was pointed out with ProtectionBot as well. The risk is less here because ProtectionBot protection is a random action, not an immediate effect. With the Mediawiki coding, surely if a vandal transcludes a page to the Featured Article, thus getting that page protected, won't just removing the page reverse the protection? What about having the cascading full protection feature available for article s-protection as well as full protection? No, that won't work either, as vandals can easily use sleeper accounts. Hmm. Looks like discussion will have to go to Wikipedia:Main Page featured article protection. Carcharoth 22:43, 10 January 2007 (UTC)

text: This has been raised in my discussions as well.  A suggested (but not yet implemented) response was to require an item to appear as needing protection during multiple passes of the featured article seperated by some interval (e.g. 15 minutes) so that a single act of vandalism was less likely to result in protection and to have a hard limit on the total number of items the bot would protect at any one time.  This ameliorates (but not entirely prevents) the situation you suggest.  This approach is of course not practical for Mediawiki.  Since the vandalism required to promote this sort of spurious protection should be easily revertable, I'm not sure how seriously I would rate it even in the Mediawiki case (though self-inclusion could have strange consequences if not explicitly exempted).  Dragons flight 22:45, 10 January 2007 (UTC)
thread_title: Problem?

message: Why not publish pseudocode? ---J.S  (T/C/WRE) 18:47, 10 January 2007 (UTC)
replies: text: I am willing to publish psuedocode as a compromise, provided a couple bits can have a high level of abstraction.  It would probably take me at least a couple days before I can find time to write it out though.  Also, I'm not sure how many of the people objecting on the basis of open source concerns would actually accept psuedocode.  Dragons flight 19:04, 10 January 2007 (UTC)
replies: text: Well, it might be an acceptable compromise for some people on the fence.  Just tossing out ideas:) ---J.S  (T/C/WRE) 19:05, 10 January 2007 (UTC)

text: *The accuracy could be verified by any of the other nearly dozen people who have seen the code.  Dragons flight 21:06, 10 January 2007 (UTC)
replies: text: *I would be willing to review and vouch for the accuracy of pseudo code. I have received the code to the bot, which was sent promptly and politely. ++Lar: t/c 22:46, 10 January 2007 (UTC)

text: *Peter, have you requsted the code from Dragons flight? If so, did he send you the code? SuperMachine 21:22, 10 January 2007 (UTC)
replies: text: *I can't speak for Peter, but for me, I won't waste Dragons Flight's time - picking and choosing who the code is sent to is not transparency, whether or not that list happens to include me, and even if he sent me the code right away it wouldn't change my mind. Someone else might spot a bug the handpicked list would miss-that's why code should be open to all eyes. Nothing less would sway me. I already trust Dragons' Flight that, to the best of his ability, the code works and does what he says it does. But there's always bugs and vulnerabilities in any non-trivial code, and the more people can look at it, the more get found. Our alternative is to wait until a vandal figures out a weakness by observation or "plinking", and the handpicked group scrambles to figure out how it happened. Secrecy is not a good way to write code, not a good way to audit code, and realistically, against the spirit of how we do things around here. Seraphimblade 22:55, 10 January 2007 (UTC)
replies: text: *Well said.  I am in full agreement.  Cheers, ✎ Peter M Dodge ( Talk to Me • Neutrality Project ) 00:28, 11 January 2007 (UTC)
thread_title:  PseudoCode? 

message: See  (just for the record). --Ligulem 10:39, 14 January 2007 (UTC)
thread_title:  New MediaWiki feature "Cascading protection" now enabled