This is an archive of past discussions with User:Ryan Norton. Do not edit the contents of this page. If you wish to start a new discussion or revive an old one, please do so on the current talk page.
Following discussions at the Bureaucrats' noticeboard and Wikipedia talk:Administrators, an earlier change to the restoration of adminship policy was reverted. If requested, bureaucrats will not restore administrator permissions removed due to inactivity if there have been five years without a logged administrator action; this "five year rule" does not apply to permissions removed voluntarily.
Technical news
A new tool is available to help determine if a given IP is an open proxy/VPN/webhost/compromised host.
Arbitration
The Arbitration Committee announced two new OTRS queues. Both are meant solely for cases involving private information; other cases will continue to be handled at the appropriate venues (e.g., WP:COIN or WP:SPI).
paid-en-wpwikipedia.org has been set up to receive private evidence related to abusive paid editing.
checkuser-en-wpwikipedia.org has been set up to receive private requests for CheckUser. For instance, requests for IP block exemption for anonymous proxy editing should now be sent to this address instead of the functionaries-en list.
You've been identified either as a previous member of the project, an active editor on Apple related pages, a bearer of Apple related userboxes, or just a hoopy frood.
WikiProject Apple Inc. has unexpectedly quit, because an error type "unknown" occured. Editors must restart it! If you are interested, read the project page and sign up as a member. There's something for everyone to do, such as welcoming, sourcing, writing, copy editing, gnoming, proofreading, or feedback — but no pressure. Do what you do, but let's coordinate and stay in touch.
See the full welcome message on the talk page, or join the new IRC channel on irc.freenode.net named #wikipedia-en-appleincconnect. Please join, speak, and idle, and someone will read and reply.
The Wikimedia Foundation's Community health initiative plans to design and build a new user reporting system to make it easier for people experiencing harassment and other forms of abuse to provide accurate information to the appropriate channel for action to be taken. Please see meta:Community health initiative/User reporting system consultation 2019 to provide your input on this idea.
Two more administrator accounts were compromised. Evidence has shown that these attacks, like previous incidents, were due to reusing a password that was used on another website that suffered a data breach. If you have ever used your current password on any other website, you should change it immediately. All admins are strongly encouraged to enable two-factor authentication, please consider doing so. Please always practice appropriate account security by ensuring your password is secure and unique to Wikimedia.
As a reminder, according to WP:NOQUORUM, administrators looking to close or relist an AfD should evaluate a nomination that has received few or no comments as if it were a proposed deletion (PROD) prior to determining whether it should be relisted.
Recently, several Wikipedia admin accounts were compromised. The admin accounts were desysopped on an emergency basis. In the past, the Committee often resysopped admin accounts as a matter of course once the admin was back in control of their account. The committee has updated its guidelines. Admins may now be required to undergo a fresh Request for Adminship (RfA) after losing control of their account.
What do I need to do?
Only to follow the instructions in this message.
Check that your password is unique (not reused across sites).
Check that your password is strong (not simple or guessable).
Enable Two-factor authentication (2FA), if you can, to create a second hurdle for attackers.
How can I find out more about two-factor authentication (2FA)?
Administrator account security (Correction to Arbcom 2019 special circular)
ArbCom would like to apologise and correct our previous mass message in light of the response from the community.
Since November 2018, six administrator accounts have been compromised and temporarily desysopped. In an effort to help improve account security, our intention was to remind administrators of existing policies on account security — that they are required to "have strong passwords and follow appropriate personal security practices." We have updated our procedures to ensure that we enforce these policies more strictly in the future. The policies themselves have not changed. In particular, two-factor authentication remains an optional means of adding extra security to your account. The choice not to enable 2FA will not be considered when deciding to restore sysop privileges to administrator accounts that were compromised.
We are sorry for the wording of our previous message, which did not accurately convey this, and deeply regret the tone in which it was delivered.
XTools Admin Stats, a tool to list admins by administrative actions, has been revamped to support more types of log entries such as AbuseFilter changes. Two additional tools have been integrated into it as well: Steward Stats and Patroller Stats.
Arbitration
In response to the continuing compromise of administrator accounts, the Arbitration Committee passed a motion amending the procedures for return of permissions (diff). In such cases, the committee will review all available information to determine whether the administrator followed "appropriate personal security practices" before restoring permissions; administrators found failing to have adequately done so will not be resysopped automatically. All current administrators have been notified of this change.
Following a formal ratification process, the arbitration policy has been amended (diff). Specifically, the two-thirds majority required to remove or suspend an arbitrator now excludes (1) the arbitrator facing suspension or removal, and (2) any inactive arbitrator who does not respond within 30 days to attempts to solicit their feedback on the resolution through all known methods of communication.
The CSD feature of Twinkle now allows admins to notify page creators of deletion if the page had not been tagged. The default behavior matches that of tagging notifications, and replaces the ability to open the user talk page upon deletion. You can customize which criteria receive notifications in your Twinkle preferences: look for Notify page creator when deleting under these criteria.
Twinkle's d-batch (batch delete) feature now supports deleting subpages (and related redirects and talk pages) of each page. The pages will be listed first but use with caution! The und-batch (batch undelete) option can now also restore talk pages.
Miscellaneous
The previously discussed unblocking of IP addresses indefinitely-blocked before 2009 was approved and has taken place.
