Wikipedia:Edit filter/Requested/Archive 14

Misleading "added content"

The summary "added content" or similar, combined with the net removal of content, can be indicative of vandalism or other problematic edits. Inspired by [1].

Suggested code: !("confirmed" in user_groups) & page_namespace = 0 & summary irlike "add(ed)? content" & edit_delta < 0

thanks, --DannyS712 (talk) 06:05, 19 August 2019 (UTC)

Does 970 do what you're looking for? ^creffpublic _{a creffett franchise} (talk to the boss) 15:36, 19 August 2019 (UTC)

@Creffett: not really - while it correctly matched the edit (Special:AbuseLog/24626326) its based primarily on the edit summary and doesn't capture the the fact that saying content was added when it was actually removed is more than just an indication of a stock edit summary, but rather an indication of a misleading stock edit summary DannyS712 (talk) 21:35, 19 August 2019 (UTC)

• Not sure I see the utility of this and 970 in general. "Added content" is one of the example edit summaries presented to mobile users, etc, so it's likely that some newbies think the summary has to be one of those. Not to mention that 970 has over 21k hits in 6 months... is anyone going through all of those to see what's being added to confirm the summary is accurate (which in itself sounds a bit thought-policey)? Or is it more likely that run of the mill vandalism, under whatever summary, is being caught by the vandal hunters, and we're wasting 1.4 conditions? Crow^Caw 18:22, 20 August 2019 (UTC)

  @DannyS712: 970 does check if edit_delta < 0 for "added content" and -10 < edit_delta < 10 for "fixed typo". The title of the filter could be "misleading edit summary" but I didn't want to shame users, who, as Crow said, just think that those are the only allowable summaries.

  @Crow: I don't know about the value of the filter. It's certainly a bit spammy, if no one's checking. It mostly supposed to be of benefit to those who patrol for vandalism from the full Special:AbuseLog. I didn't do a rigorous analysis or anything, but it seemed to me at the time I last editing the filter that a large fraction of the edits were of very low quality, even compared to IP edits in general. Suffusion of Yellow (talk) 21:54, 31 August 2019 (UTC)

Long term abuser/banned user attempted edit

• Task: block any edit in all-caps on user and user talk pages
• Reason: LTAs and (WMF) banned users sometimes regularly attack users on userpages, and edits in all-caps are usually done in bad faith. Nigos (t@lk • Contribs) 09:18, 24 August 2019 (UTC)

• I disagree that all-caps is always bad faith. Often it is the sign that a discussion is getting heated, as all-caps equates to shouting, but still be in good faith. That discussion may degrade into a potential civility issue, but the filter with its lack of context or history of the discussion should not be cast into the role of civility policing. My 2p anyway, others are free to comment of course. Crow^Caw 19:36, 31 August 2019 (UTC)

proposed filter:infobox person on user page

Task: Tag suspicious infoboxes in userspace.

Reason: I see {{Infobox person}} (and similar infoboxen) on userpages every so often, and it's generally a good indicator that the user is here either to promote themselves or isn't aware of the WP:NOTSOCIALMEDIA rules. Could we add a filter to flag that? I'm thinking something like this (though I'm not sure how to restrict it to just User:(username) and ignore sandboxes, maybe something like "user_name = page_title"?):

user_editcount < 50 & page_namespace == 2 & added_lines irlike "{{[Ii]nfobox person}}" & !(removed_lines irlike "{{[Ii]nfobox person}}")

Could also expand to match the sub-templates of infobox person if this proves successful. creffett (talk) 21:26, 28 August 2019 (UTC)

Actually, while I'm thinking about it, {{Infobox company}} would be good to check for too. creffett (talk) 22:43, 28 August 2019 (UTC)

• I added Infobox-company as that's normally a sign. Infobox-person or the like (or a fake infobox-looking section) are not always indicative of a problem, I've found. Crow^Caw 19:32, 31 August 2019 (UTC)

• I'll defer to your judgment on that. Thank you! creffett (talk) 00:49, 1 September 2019 (UTC)

Edit filter to address Visual Editor bug (or common user error)

When a user drafts content with references in a sandbox, if using the Visual Editor it is necessary to enter edit mode before copying in order to retain the references. If the user doesn't copy from edit mode, the superscript links will be retained, but they will be links back to the original page (where the footnote anchor would be) without the reference itself. You can see an example of this in my sandbox:

This sandbox shows the first paragraph from the body of Wikipedia copied from edit mode.

This sandbox shows the same paragraph copied without entering edit mode.

It would be useful to have an edit filter or some other way to indicate when this happens. This is something I always tell new users, but which people very regularly forget about, just to introduce improperly formatted content into an article when trying to copy out of a sandbox. It seems like this could be easily detected by looking for superscript tags around a link to a different page. (Another common sign this happened is that "[edit]" appears inside a heading). Ideally, this would notify the user when they try to save, but an edit filter could be useful, too.

(Originally posted to VPT. Xaosflux suggested posting here instead.) — Rhododendrites ^talk \\ 02:59, 6 August 2019 (UTC)

Also came here to suggest this, am seeing edits like these regularly. Warning on additions containing both <sup>[[ and #cite%20note would be helpful. – Thjarkur (talk) 21:01, 13 August 2019 (UTC)

• Watching/logging on 861. Crow^Caw 19:59, 20 August 2019 (UTC)

• @Rhododendrites and Þjarkur: It's been running for a few days and there's a lot of hits for this. Some are corrected when the editor notices the problem, others are not. So the question is, what now to do about these? Right now the filter takes no action. See 861 (hist · log) for the examples. Crow^Caw 19:27, 24 August 2019 (UTC)

• Warn at least. Would need to check that the deleted lines don't contain this string so we don't stop this type of edit. Seems to already be a problem in multiple articles with both new and experienced editors making this error. – Thjarkur (talk) 20:02, 24 August 2019 (UTC)
• User:Crow and Thjarkur, I strongly suggest blocking these edits on grounds the "citations" are invalid, they are not reliable. I am the author of the bot trying to repair them (User:GreenC bot/Job 18) and it's very time consuming and sometimes involves manual work. Even if the bot can repair it, it's still not a sure thing because the bot has technical limits, so it has to leave inline notes for users to manually verify the cite, which creates more uncertainty about reliability. The benefit of allowing these edits through is outweighed by the unreliability of the sources. BTW the filter should be checking for #cite%20note only, because they often show up without a <sup>[[ or with <span>[[ or with <nowiki>[ and other variations. VE is generating a mess of strings. The only string that is consistent among them is #cite%20note. -- GreenC 15:21, 3 September 2019 (UTC)

• @GreenC and Þjarkur: If we're going to outright block these, I'd need A:consensus that this is a deny-able event, and B:someone with mediawiki sorcery (admin?) to create a warning message to present to the attempting editor, as the default one ("your edit has been deemed unconstructive") would usually not apply to these good-faith edits. Also, not all of the detected hits have been unreliable sources. Often they are copy/pasted from another article and not the article's wikitext, thus causing this issue. Crow^Caw 22:42, 3 September 2019 (UTC)

• User:Crow: Opened an RfC at Wikipedia:Village_pump_(proposals)#RFC:_Block_edits_that_contain_a_VisualEditor_bug. While we wait, could you modify the log Filter so it only checks for #cite%20note- (note dash on the end) .. this will catch more cases because the current filter is only getting a sub-set by requiring <sup> . It will also reveal if there are any false-positives, which will be needed in determining the final block filter. -- GreenC 00:15, 4 September 2019 (UTC)

• Filter tweaked. Crow^Caw 14:16, 4 September 2019 (UTC)

• Thank you, User:Crow. In this diff of All_Grown_Up! the filter was triggered because the article previously contained the target string. The following revert didn't trigger the filter. Is that normal/expected? -- GreenC 15:35, 4 September 2019 (UTC)

• Strange, it didn't log the hit, but the test interface shows it as a hit. Crow^Caw 15:47, 4 September 2019 (UTC)

Prevent or control the mention of "Alfonso Castañeda" in mainspace

• Task: As what the title says.
• Reason: Per WP:LTA/MRY, as the LTA in question is using that name whenever he trolls those whom he crosses paths with. Blake Gripling (talk) 07:16, 8 September 2019 (UTC)

Filter 1003

• Task: Warn on edits linking ResearchGate
• Reason: ResearchGate is an open platform. It contains a mix of unpublished sources, pre-prints and user-uploaded copies of published research. This can result in copyright violations, mistaken reliance on self-published sources, and in some case pre--prints that have potentially been corrected or updated in peer-review. Defined as a parameter to allow addition of DOI and aliases. Set to Warn and create a warning.

1003

equals_to_any(page_namespace, 0, 118) &
(
    researchgate := "researchgate\.net";
    added_lines irlike researchgate &
    !(removed_lines irlike researchgate)&
    !("bot" in user_groups) &
    !("AFCH" in summary)
)

I have set this up and not enabled pending review. — Preceding unsigned comment added by JzG (talk • contribs) 16:04, 2 September 2019 (UTC)

Why do you check it using regex when you could use less resource intensive contains? I think, based on my non-exsistent experience, that this would be a more efficient while doing the same thing:

equals_to_any(page_namespace, 0, 118) &
(
    researchgate := "researchgate.net";
    added_lines contains researchgate &
    !(removed_lines contains researchgate)&
    !("bot" in user_groups) &
    !("AFCH" in summary)
)

--Trialpears (talk) 07:09, 3 September 2019 (UTC)

See the current version, it also includes the DOI. Guy (Help!) 07:26, 3 September 2019 (UTC)

Someone added this to 891 (see noticeboard). This should be its own filter, RG is not prima facie predatory. It can have predatory papers, it can have unreviewed papers, but most are legitimate peer-reviewed papers. Headbomb {t · c · p · b} 04:59, 9 September 2019 (UTC)

"I made it better"

• Task: Tag, warn, or (if proven useful) prevent non-autoconfirmed edits made with a summary of "i made it better".
• Reason: I have no idea how to verify this, but I guess it would apply to hundreds of bad edits each day, with a false positive rate below 1%. ~ ToBeFree (talk) 20:49, 9 September 2019 (UTC)

  Candidate for Special:AbuseFilter/970, I'm thinking. ^creffpublic _{a creffett franchise} (talk to the boss) 20:54, 9 September 2019 (UTC)

  Seems thematically fitting indeed, thanks! I guess the bad faith probability of "i made it better" may be noticeably higher than for "fixed" or "added content", for example. It may be reasonable to maintain two such filters, only one of which actually prevents edits. ~ ToBeFree (talk) 20:57, 9 September 2019 (UTC)

  Sounds reasonable to me, no objections to adding a filter for more likely bad-faith edit summaries. creffett (talk) 00:11, 10 September 2019 (UTC)

Block joinncc.online

• Task: Prevent the addition of joinncc.online to articles.
• Reason: IP editor added links to this 2-page website to a number of articles yesterday. The site appears to be mocked up to masquerade as an official site, and should never be cited in any article. I cleared them all out, and have been watching (search results) to make sure it didn't get added again when it occurred to me that an edit filter would be more efficient than just me keeping an eye out for it. Schazjmd (talk) 19:46, 10 September 2019 (UTC)

​ Defer to Local blacklist If the site is being spammed then the blacklist is appropriate. — JJMC89 (T·C) 02:10, 11 September 2019 (UTC)

New users adding CSS in {{DISPLAYTITLE}} switches

• Task: Tag and/or prevent edits by non-confirmed users that contain CSS inside of {{DISPLAYTITLE}} switches.
• Reason: See this archived discussion. Users can remove characters from article titles with CSS such as "font-size:0" or "color:white", which can be used to make article titles display as expletives. Invalid^OS (talk) 15:36, 18 September 2019 (UTC)

Alfonso Cabarlazon

• Task: Prevent or flag any mention of said phrase or regex variants thereof.
• Reason: Apparently someone with a weird obsession for that place is using it for trolling or harassing admins and other users. Blake Gripling (talk) 08:01, 21 September 2019 (UTC)

Set filter 135 (Repeating characters) to disallow?

I think filter 135 should be set to disallow after reviewing 200 recent edits tagged by the filter. Of these one was a false positive from a user replacing a numbered list using hard codedvalues with # symbols. This false positive could be fixed by allowing repeated # symbols (done by replacing "([^_:.*'|=}{-]{1,9})\1{6}" with "([^_:.*'|=#}{-]{1,9})\1{6}" at line 10). The change was tested using https://regex101.com/ and worked as expected. I don't know what false positive rate is generally desired before disallowing but I feel like this should be sufficient after my proposed change. --Trialpears (talk) 11:11, 14 September 2019 (UTC)

Any thoughts? --Trialpears (talk) 07:07, 27 September 2019 (UTC)

Jo-Jo Eumerus wanna respond to this request as well? If you don't want me to ask you in the future tell me. --Trialpears (talk) 18:55, 1 October 2019 (UTC)

Sorry, but my familiarity with edit filter syntax is very limited. Changing a message is something I can do, the actual syntax not. Jo-Jo Eumerus (talk, contributions) 20:00, 1 October 2019 (UTC)

Indians stinky

• Task: Stinky vandal writes, (hate to write this but it is needed here for clarity): "Indians are stinky".
• Reason: We have a persistent vandal (for quite some time), the stinky vandal, who continually attacks India-related articles (e.g. South India), and Indian cooking pages, and also pages like Stink and Stinky to make derogatory comments about people from the Indian Subcontinent -- Alexf^(talk) 11:10, 14 October 2019 (UTC)

This is User:Arjayay/Anti-Indian Racist and 954 (hist · log)​ is the existing filter trying to combat them. — JJMC89 (T·C) 03:14, 15 October 2019 (UTC)

S122595264

• Task: filter out the string S122595264
• Reason: Scammers yet again, apparently. Not 100% sure if this is another fake tech support number or something else. The string actually has it's own facebook page for some reason. [2] but it doesn't make anything any clearer. Beeblebrox (talk) 21:59, 15 October 2019 (UTC)

Filtering for date "May 15 2001", etc.

• Task: Filtering out edits like these. There are many of them, all by socks of PhoenixS15.
• Reason: This is reported to the emergency channels repeatedly but the threats are known to be non-credible. Ideally we could avoid using staff time on these. Joe Sutherland (WMF) (talk) 05:13, 13 October 2019 (UTC)

Added here. -- zzuuzz ^(talk) 05:34, 19 October 2019 (UTC)

Refspammer

• Task: Prevent additions of text referencing Maximiliano Korstanje, (including, e.g., Korstanje, M. E.), or thana\s?(tourism|capitalism) (case insensitive, obv).
• Reason: Years of self-promotion and refspamming by the subject (who also created an article on himself, now deleted and salted). Recent example: [3]. I'm pretty sure this would fit into some existing filter, but my RegEx-fu is not strong enough. Guy (Help!) 22:58, 25 February 2019 (UTC)

@JzG: I {{subst:DNAU}}'d this thread, then forgot about it. Is this still going on? Suffusion of Yellow (talk) 19:59, 21 November 2019 (UTC)

• Now? Not according to a search I just did. I think the last time I had to remove any was a couple of months ago - I think he may finally have got the hint. You can close this, thanks. Guy (help!) 20:22, 21 November 2019 (UTC)

Change to the repeated characters filter

I think the repeated characters filter should be able to match the following: "([^0^_:.*'}[^0^_:.*'}){3,})|([^0^_:.*'}[^0^_:.*'}[^0^_:.*'}){3,})"
This is supposed to match repeated 2 or 3 character-long strings. The minimum of 3 repetitions is so that strings such as "tutu" are not matched by the filter. Invalid^OS (talk) 17:21, 24 October 2019 (UTC)

Likely unnecessary, as the filter already seems to do this. I think I likely misread the regex. Invalid^OS (talk) 16:10, 19 November 2019 (UTC)

@InvalidOS: Currently, the filter requires 8 repetitions of a 1-9 character string. I think that cutting that down to only 3 repetitions would be awfully aggressive. The filter's doing quite well right now. What is your regex trying to do? It's not valid PCRE. Suffusion of Yellow (talk) 19:55, 21 November 2019 (UTC)

I realized that the filter was fine as-is. Probably should’ve withdrawn. Invalid^OS (talk) 00:11, 22 November 2019 (UTC)

Wikipedia:Long-term abuse/Angela Criss

That DEVO asshole is back. Maybe someone can tweak the filters? See the edits by User:Mlpwtfisthat Backup 8.0. Thanks! Drmies (talk) 23:00, 28 October 2019 (UTC)

Just noting that every edit was revdelled, so an admin will need to get to this one. Suffusion of Yellow (talk) 20:00, 21 November 2019 (UTC)

Drpremrajpushpakaran

• Task: Stop a long term abuse case involving repeated recreation of user sandbox pages.
• Reason: Prolific sockpuppeteer Drpremrajpushpakaran has been trying to create an autobiography for himself on Wikipedia for years (at least since 2012). See Wikipedia:Sockpuppet investigations/Drpremrajpushpakaran. Only a small subset of the blocked accounts are listed at Category:Suspected Wikipedia sockpuppets of Drpremrajpushpakaran. Lately, he has been creating user sandbox pages about himself every few days. Recent examples include User:Paulpontus/sandbox, User:Pavelpauling/sandbox, and User:Pedersenpurcell/sandbox. The text is usually consistent, so an edit filter should be able to catch and stop it. I can email the deleted text if anyone needs it. -- Ed (Edgar181) 16:26, 5 November 2019 (UTC)

  @Edgar181: Are most pages similar to Special:AbuseLog/23462768? I can work off of that. Suffusion of Yellow (talk) 21:52, 21 November 2019 (UTC)

Yes, exactly like that. Thank you. -- Ed (Edgar181) 21:57, 21 November 2019 (UTC)

@Edgar181: Logging at 1013 (hist · log). Let me know if anything isn't flagged there. Suffusion of Yellow (talk) 22:39, 21 November 2019 (UTC)

Bhaumik Gondaliya

• Task: The filter should prevent the addition of the expressions "Bhaumik Gondaliya" "Gondaliya Film ___" "Gondaliya Films ___" "Gondaliya Productions" to articles.
• Reason: Today, an editor brought to my attention that an IP-hopper from Gujarati, India kept adding the name "Bhaumik Gondaliya" to Indian Hindi-language film articles, typically in the |Producer= and |Actor= parameters. This has largely been going on since early October 2019 to present, but I did find an instance from 2016 here, where it sat for years until today. Performing due-diligence to see if I could find his name on any of the film posters, I could not, so my conclusion is that this name is always a pernicious vanity edit. While cleaning out scores of these additions today, I also found some instances of "Gondaliya Films", sometimes with other words like here where Venus World Entertainment became Gondaliya Films Entertainment. So any filter that would swallow that sort of thing up, would be helpful. I didn't see any "Gondaliya Productions", but I thought I'd suggest it since it's the intuitive next choice. Thanks for your help and please ping me if there are any questions. Cyphoidbomb (talk) 16:22, 6 November 2019 (UTC)

For what it's worth, since I added this request, there have been at least six more additions of Bhaumik Gondaliya to articles. And here are all of the fixes I've processed manually in the last few days. Cyphoidbomb (talk) 20:46, November 10, 2019‎

@Cyphoidbomb: Logging at 1013 (hist · log). Really broad right now, but can be narrowed down before disallowing. Suffusion of Yellow (talk) 20:57, 21 November 2019 (UTC)

Canada vandal

There's a recurring IP editor who vandalizes Canada-related pages with a long-winded statement involving the phrase "bibi is of romanian origin," that seems rare enough to be worth a temporary filter. See Special:Diff/925477668 for an example. creffett (talk) 18:24, 10 November 2019 (UTC)

@Creffett: I think NawlinWiki did something about this. Suffusion of Yellow (talk) 20:59, 21 November 2019 (UTC)

ok boomer

• Task: block additions of "ok boomer"
• Reason: Uptick in this particular vandalism. –MJL ‐Talk‐^☖ 15:52, 21 November 2019 (UTC)

Specifically, adjust Filter 614 or create a new filter along the lines of:

(O|o)(K|k)(ay)?,? boomer

¯\_(ツ)_/¯ –MJL ‐Talk‐^☖ 16:02, 21 November 2019 (UTC)

 Done Special:AbuseFilter/history/614/diff/prev/22712, thanks. Galobtter (pingó mió) 21:06, 21 November 2019 (UTC)

869

• Task: The filter is supposed to warn users about using deprecated sources. The filter should be used for an Wiki article about Simone Battle.
• Reason: The filter is needed because they are using dailymail, and dailymail is a deprecated source? JaneciaTaylor (talk) 20:00, 21 November 2019 (UTC)

@JaneciaTaylor: The dailymail reference was added back in 2014, which is before the filter was even created. Fairly sure it would have warned the user, had the edit been made today. If you see any recent examples that the filter skipped, let us know. Suffusion of Yellow (talk) 21:24, 21 November 2019 (UTC)

Also, just because the filter warns doesn't mean people will necessarily follow what it says. ^creffpublic _{a creffett franchise} (talk to the boss) 21:56, 21 November 2019 (UTC)

Eolgi Interstate Highway vandal

• Task: We need a filter to disallow all edits to the article space containing the nonsense string eolgi, and to notify AIV to block the vandal that uses it.
• Reason: For at least 5 years, on a semi-regular basis, there's a vandal who leaves the word "eolgi" on a wide variety of articles, though usually historically this has been limited to articles on the Interstate Highway System, recently they have been branching out to other articles, see for example here. We may also need to add the string "dover impulse", as he's started recently using that. for example. This guy has been going for years, uses hundreds of IP addresses, and refuses to go away. Jayron32 14:25, 31 October 2019 (UTC)

Here's some code I've made that could work:

!("confirmed" in user_groups) &
(ccnorm_contains_any(added_lines, "EOLGI", "DOVER IMPULSE") |
ccnorm_contains_any(summary, "EOLGI", "DOVER IMPULSE"))

Hope it helps. Invalid^OS (talk) 15:40, 15 November 2019 (UTC)

@Jayron32: Looks like MusikAnimal did something at 676 (hist · log) (disallowing). I added something broader, related to InvalidOS suggestion, to 1013 (hist · log) (log-only). Suffusion of Yellow (talk) 20:54, 21 November 2019 (UTC)

Thanks to the both of you! Hopefully this stems the issue. --Jayron32 13:01, 22 November 2019 (UTC)

Special:AbuseFilter/891 (add iMedPub LTD, Ashdin Publishing and others)

Here are two divisions/affiliates of of the OMICS Publishing Group.

• iMedPub, with DOI prefix 10.21767
• Ashdin Publishing, with DOI prefix 10.4303

Headbomb {t · c · p · b} 04:56, 9 September 2019 (UTC)

Also

• Science Publishing Corporation, with DOI prefix 10.14419
• MECS Press, with DOI prefix 10.5815

Headbomb {t · c · p · b} 22:45, 9 September 2019 (UTC)

De-archived Headbomb {t · c · p · b} 11:12, 14 October 2019 (UTC)

Re-de-archived. Headbomb {t · c · p · b} 20:10, 31 October 2019 (UTC)

Headbomb, DOIs added. If you can confirm the domains I'll add those too. Guy (help!) 20:15, 31 October 2019 (UTC)

@JzG: Like URL domains? No idea what those might be. I could look I suppose. See also this request, which should remove Frontiers from this filter. It is way too borderline. Headbomb {t · c · p · b} 20:19, 31 October 2019 (UTC)

• http://www.imedpub.com/
• https://www.ashdin.com/
• https://www.sciencepubco.com/
• http://www.mecs-press.org/

Headbomb {t · c · p · b} 20:22, 31 October 2019 (UTC)

@Headbomb: This is complete now, sorry for the delay, I started going down the rabbit hole of finding and removing them and lost track of time. Guy (help!) 18:22, 24 November 2019 (UTC)

@JzG: I've been purging a bunch of crap journals myself using your User:JzG/Predatory. It's quite handy. I tweaked it to more easily catch DOIs and ISSN hits btw. Headbomb {t · c · p · b} 18:43, 24 November 2019 (UTC)

Headbomb, I noticed - thanks! Much appreciated. Guy (help!) 19:01, 24 November 2019 (UTC)

Thicc

• Task: block additions of "Thicc"
• Reason: for vandalism? ~~ CAPTAIN MEDUSA^talk 13:21, 24 November 2019 (UTC)

At Filter 260; add line of Thicc. This is one of common vandal phrases. ~~ CAPTAIN MEDUSA^talk 13:21, 24 November 2019 (UTC)

Thicc is a slang for "voluptuous, hourglass-like curvature of a woman's hips". [4] It has quickly become a meme; which can be used by a lot of editors to vandalise articles especially women's. Google Trend is showing it is still rising. [5] ~~ CAPTAIN MEDUSA^talk 19:19, 25 November 2019 (UTC)

Special:AbuseFilter/614 blocks additions of "thicc". Galobtter (pingó mió) 06:06, 26 November 2019 (UTC)

Change to Filter 260

Add "WHO'?S? JOE\??|JOE M[AO]M{1,2}A?" as one of the possible matches for the filter. I've found instances such as this, and I would expect this phrase to be common. Invalid^OS (talk) 17:31, 15 November 2019 (UTC)

@InvalidOS: Logging at 1013 (hist · log) (sorry, private because of some other stuff mixed in there). Went with norm(added_lines) rlike "WHOI?SJOE|JOEM[AO]M" because everything else is being norm()ed there and it makes it simpler. Might be a better fit for 614 (hist · log) in the end, unless this is common outside of mainspace. Suffusion of Yellow (talk) 22:14, 21 November 2019 (UTC)

LOL, that was quick. Suffusion of Yellow (talk) 22:17, 21 November 2019 (UTC)

One minute. Must be a new record. Invalid^OS (talk) 00:25, 22 November 2019 (UTC)

@InvalidOS:. "joe mama" is looking really promising. Not sure about "who's joe". I'm going to be away for a few days, and messing with a disallowing filter and walking away is bad, mmmkay? But I'll do something with 614 (hist · log) when I get back, if no one else has. Suffusion of Yellow (talk) 22:38, 22 November 2019 (UTC)

@Suffusion of Yellow: Fine by me. Glad to help. Invalid^OS (talk) 16:53, 23 November 2019 (UTC)

 Done. @InvalidOS: Added to 614. "Who's Joe" didn't match a whole lot on its own, and already had one FP, so I left it out. Suffusion of Yellow (talk) 17:52, 26 November 2019 (UTC)

Suffusion of Yellow, can this block the addition of " joe mama" edit summary. Like this [6]. ~~ CAPTAIN MEDUSA^talk 18:35, 26 November 2019 (UTC)

@CAPTAIN MEDUSA: 614 does not check summaries. 1013 had been checking, and I only saw two examples in five days where "joe mama" was in the summary but not also in the added_lines. I don't think it's all that common. Suffusion of Yellow (talk) 18:43, 26 November 2019 (UTC)

Digit string

I don't know if this being checked, but an IP6 was recently blocked for vandalizing a number of articles with a particular 10-digit string, usually both in the text and in the summary. It seems rare that it be appropriate for such a string to be added to articles, except as part of a URL or an unformatted index number such as an ISBN. I haven't looked much at edit filters after I lost my bit, so I was just wondering whether something like this would be appropriate. — Arthur Rubin (talk) 18:42, 1 November 2019 (UTC)

@Arthur Rubin: I doubt this will be useful, but logging at 1014 (hist · log) anyway to find out what the valid uses are, at least. Suffusion of Yellow (talk) 20:14, 27 November 2019 (UTC)

On second thought, no. Lots of filenames on commons have 10-digit strings, and excluding filenames is more complicated than it sounds. If someone else wants to take this on, go ahead, but there are probably more possibilities beyond isbns, urls, and filenames that we aren't thinking of. Of course if an LTA is fond of a particular 10-digit string, that would be easy to add to one of the LTA filters, but filtering on all 10-digit strings without FPs is probably more trouble than it's worth. Suffusion of Yellow (talk) 23:24, 27 November 2019 (UTC)

I've had particular 10-digit strings, probably phone numbers, added to the list of naughty words in a swear filter after they appeared in place of the eponymous number in multiple articles about integers. Certes (talk) 23:32, 27 November 2019 (UTC)

Change to Filter 46 ("Poop" vandalism)

Moved from WP:EFN

I propose changing Filter 46 to the following:
!("confirmed" in user_groups) &
page_namespace == 0 &
edit_delta < 300 &
ccnorm(added_lines) rlike "\b([\.\,\/\?\>\<\!\@\#\$\%\^\&\*\(\)\_\+\-\=\{\}\|\[\]\\\:\;\']?)(P+\1?([O0]*P*|[E3]*)*\1?)*(E*\1?S+\1?|E+\1?R+\1S*\1?|E*\1?D+\1?|I\1?N+\1?G+\1?)?\b" &
!(old_wikitext irlike "\b(P+([O0]*P*)|[E3]*P*)*(E+R+S*|E*D+|E*S+|I+N+G+)?\b")

This change is intended to allow the filter to match strings like "pee", "poopoo", "peepeepoopoo", and other strings of that nature. Invalid^OS (talk) 15:51, 14 November 2019 (UTC)

Small error: this matches the string "p", which it shouldn't. Only fix I can think of is the following:

!("confirmed" in user_groups) &
page_namespace == 0 &
edit_delta < 300 &
ccnorm(added_lines) rlike "\b([\.\,\/\?\>\<\!\@\#\$\%\^\&\*\(\)\_\+\-\=\{\}\|\[\]\\\:\;\']?)(P+\1?([O0]*P*|[E3]*)*\1?)*(E*\1?S+\1?|E+\1?R+\1S*\1?|E*\1?D+\1?|I\1?N+\1?G+\1?)?\b" &
!(old_wikitext irlike "\b(P+([O0]*P*)|[E3]*P*)*(E+R+S*|E*D+|E*S+|I+N+G+)?\b")
& !(ccnorm(added_lines) === "P")

This solution obviously isn't ideal, but it's the only thing I can think of. Invalid^OS (talk) 13:45, 18 November 2019 (UTC)

@InvalidOS: That last line doesn't really help. It will still match "po", "foo p bar", etc. Suffusion of Yellow (talk) 21:30, 27 November 2019 (UTC)

Yeah, this has a lot of problems. Invalid^OS (talk) 20:53, 29 November 2019 (UTC)

Epstein meme

• Task: Prevent editors from adding the Epstein didn't kill himself meme to mainspace.
• Reason: It's been happening about five times a day, to seemingly random articles.

  Surprised no one requested this. I've already been logging this at 1013 (hist · log) for a week. Just putting this here so anyone can object; then I'll add it to 614 (hist · log). Suffusion of Yellow (talk) 23:05, 27 November 2019 (UTC)

   Done Added to 614. Suffusion of Yellow (talk) 20:54, 30 November 2019 (UTC)

Special:AbuseFilter/891: More predatory publishers (2)

Which is basically everything in User:JzG/Predatory with a DOI associated to it, except

• Frontiers in Bioscience (search/all) bioscience.org   {{DOI|10.2741}}
• Frontiers Media (search/all) frontiersin.org   {{DOI|10.3389}}

because those are too borderline. There will be some duplication with what's already in the filter. And again, the filter on frontiersin\.org should be removed, since Frontiers Media is too borderline to be including in this filter. Headbomb {t · c · p · b} 14:06, 30 November 2019 (UTC)

@JzG: on this. Headbomb {t · c · p · b} 14:12, 30 November 2019 (UTC)

Made some useful sandbox things at User:Headbomb/sandbox4. Both for the warning and for the regex. Headbomb {t · c · p · b} 11:06, 1 December 2019 (UTC)

Excessive and irrelevant linking, even down to syllables of words

I opened a discussion at Wikipedia:Administrators' noticeboard/Incidents#Excessive and irrelevant linking, even down to syllables of words, and another editor suggested that I post a notification here. Narky Blert (talk) 12:46, 21 October 2019 (UTC)

Just checking for back-to-back links would probably be a useful filter, something like \]\]\[\[ might even be enough. ^creffpublic _{a creffett franchise} (talk to the boss) 13:51, 21 October 2019 (UTC)

@Creffett: That's been suggested in the ANI thread as well, and it looks as if it could work. Narky Blert (talk) 15:27, 21 October 2019 (UTC)

Almost all instances of this are images being placed in the same line as the text: [[File:Image.jpg]][[Birds]] are... I think this is usually caused by moving images around with VisualEditor. – Thjarkur (talk) 21:04, 23 October 2019 (UTC)

Something like \[\[[^\]:]+\]\]\[\[ (regex101) would work. --Majavah ^(t/c) 14:20, 24 October 2019 (UTC)

That could work, here's the search. I don't actually see that many cases of excessive linking, the majority appear to be: chemical formulas (CH₃), accidentally missed spaces (a Marvel Studiossuperhero film), a few helpful uses (decadegrees, Czechoslovaks), and a few VisualEditor hiccups (Underworld). – Thjarkur (talk) 15:02, 24 October 2019 (UTC)

• @Narky Blert: Logging at filter 1010 (hist · log). I noticed when testing than many of the targeted pages already had the same issue. Don't know what's up with that. Anyway, 1010 will probably have lots of false positives, but we can try to refine it later. Suffusion of Yellow (talk) 19:16, 12 November 2019 (UTC)

Reopened discussion now at Wikipedia:Administrators' noticeboard/Incidents#Excessive and irrelevant linking, even down to syllables of words (revisited).

@Suffusion of Yellow: It should be possible to kill honest false positives by inserting either a space or something like <!--This comment is needed for technical reasons, do not delete it-->, or as a last resort by a specific exemption. The problem is things like this; note that the IP editor has not only added new garbage but also edited its own old garbage. Narky Blert (talk) 20:38, 12 November 2019 (UTC)

Here is a search which excludes chemicals by requiring the second segment of the word to be lower case. In theory we should run it without "Japanese"; in practice that would load the servers and probably not terminate. It found a few non-Japanese uses such as this Easter egg but they are probably unrelated. It should be easy to unlink these cases semi-automatically with AWB/JWB if we agree that this is desirable. (Edited to exclude an editor's signature from the search results.) Certes (talk) 12:48, 13 November 2019 (UTC)

I am (or, more accurately, used to be) a chemist: pass any chemicals to me for attention. I haven't seen examples, but something like [[Sodium|Na]][[Hydroxide|OH]] would be too horrible for words, and definitely need sorting out. If might need copyediting as well as use of the {{chem}} template. Narky Blert (talk) 20:17, 13 November 2019 (UTC)

We should be able to find the chemical formulae with searches for oxygen, oxide, etc. If you can fix a few examples manually and link the diffs, we should be able to train AWB/JWB to repeat those patterns. Certes (talk) 23:32, 13 November 2019 (UTC)

• @Certes and Narky Blert: The filter now has >120 hits. It seems, unfortunately, that >90% are just simple typos, e.g. a worn-out spacebar. When I narrow down the log to cases where the old wikitext contained "Japan", it's still mostly FPs, but there are few enough that it might be useful a log-only (or perhaps tagging) filter. I don't see ever disallowing this, unless the disruption only comes from certain IP ranges. Suffusion of Yellow (talk) 19:40, 21 November 2019 (UTC)

@Suffusion of Yellow and Certes: >120 hits isn't exactly burdensome. I've seen DABfixing problems with several thousand bad links.

Unfortunately, there's no tight IP range. I've seen both 148.etc and 2400.etc.

However, I have today noticed a pattern I'd missed before. A lot of the silliness takes place in sections headed 'Tokusatsu'. It might be worth filtering on that. Narky Blert (talk) 20:00, 21 November 2019 (UTC)

Example diffs 1 and 2. Narky Blert (talk) 20:20, 21 November 2019 (UTC)

How would the filter fare with something like links := "\|[A-Za-z][a-z]?[a-z]?\]\]\[\[[^]|]+\|[a-z][a-z]?[a-z]?\]\]\[\["; and perhaps checking for Tokusatsu rather than Japan? (That's a PCRE version of the search regex above.) Caveat: if the filter were extended to Template: namespace, it would catch the valid signature of an active DYK editor: example. Certes (talk) 20:28, 21 November 2019 (UTC)

Sjones23 seems to know about Tokusatsu. Please can you confirm that these wikilinks serve no useful purpose? Example: "Ayakashi" in Jūrōta Kosugi#Tokusatsu. Thanks, Certes (talk) 16:59, 22 November 2019 (UTC)

[[Rhinoceros|A]][[Tiger|y]][[Cattle|a]][[Elephant|k]][[Nightmare|ashi]] [[Baku (mythology)|Yumebakura]] in Jūrōta Kosugi#Tokusatsu is typical of the sort of stuff I've encountered. It strikes me as spectacularly WP:DISRUPTIVE. Narky Blert (talk) 22:58, 23 November 2019 (UTC)

Further evidence of the 'Tokusatsu' fixation - the edit which introduced those links was made by 2400:2652:481:CB00:807A:38E7:568E:BC5A; check that IP's edit history (all on 30 May 2019). Narky Blert (talk) 23:04, 23 November 2019 (UTC)

I've unlinked all the cases I can find. Please report any others, even if you fix them: they may suggest further patterns to look for. Certes (talk) 02:29, 26 November 2019 (UTC)

Will do. Narky Blert (talk) 07:00, 1 December 2019 (UTC)

@Certes: Here's one, in Mitsuru Ogata. The culprit, Special:Contributions/27.81.2.164, is currently blocked. There's other evidence in its posting history. Narky Blert (talk) 13:07, 1 December 2019 (UTC)

Some of those, such as [[Ladybug|Gubydal]], are hard to detect automatically and even to assess manually. It may be a potentially useful Easter egg indicating that the name is derived from a word spelled backwards, or may be OR which has Llareggub to do with the topic. I'll take a closer look. Certes (talk) 13:15, 1 December 2019 (UTC)

@Narky Blert: Good catch. I've fixed another 82 cases, mainly voice actor bios. Certes (talk) 21:59, 1 December 2019 (UTC)

Julius Zhang

Pages affected:

• Baguio Cathedral
• Baclaran Church
• Fire Emblem Warriors
• Heroes' Cemetery
• Taguig Church
• Baguio

IP hopping vandal making edits. Example diffs: [7], [8], [9].

Behaviors:

• He edits on the same pages.
• All pages are related to the Philippines.
• The edits are sporadic, but they happen within a few hours of each other.
• All six pages are vandalized at the same time.
• This started happening in the last days of November.
• The edit summary is Julius Zhang is dead....
• He adds Julius Zhang ay patay na... to the bottom of the page. According to Google Translate, it's Filipino for "Julius Zhang is dead."
• Some IPs have been rangeblocked by EvergreenFir before, but he has found more IPs to vandalize on.

– UnnamedUser ^{(open talk page)} 02:29, 1 December 2019 (UTC)

@UnnamedUser: Logging at 1013 (hist · log) (private). zzuuzz, this relates to 936 (hist · log), yes? Suffusion of Yellow (talk) 03:07, 1 December 2019 (UTC)

@ Yes, undoubtedly. -- zzuuzz ^(talk) 09:53, 1 December 2019 (UTC)

@ToBeFree: You sent UnnamedUser here from WP:RFPP. Unfortunately, filters aren't terribly very effective against this LTA (whose purpose in life seems to be to get us to mention their name, but see the pattern at 936 (hist · log)). They just change their MO as soon as they get blocked by the filter. Protection may be a better option, after all, unless zzuuzz has any better ideas. Suffusion of Yellow (talk) 23:31, 2 December 2019 (UTC)

I personally don't want to protect every page one single IP-hppping vandal happens to cross with their widely spread vandalism. If this is not a task for an edit filter, I'm out of ideas. ~ ToBeFree (talk) 23:35, 2 December 2019 (UTC)

Well there's always WP:RBI of course... 23:36, 2 December 2019 (UTC)

BLP vandalism or libel

• Task: block additions of "Nonce"
• Reason: block BLP vandalism. I suggest adding this at Special:AbuseFilter/189. I went through vandalism filters I coudn't find this. ~~ CAPTAIN MEDUSA^talk 13:10, 27 November 2019 (UTC)

@CAPTAIN MEDUSA: Is this really all that common? I had to look the word up, only knowing the crypto-related usage. Logging at 1014 (hist · log) for now. Suffusion of Yellow (talk) 20:19, 27 November 2019 (UTC)

Suffusion of Yellow, Nonce is a commonly used British slang. The word stands for a paedophile. ~~ CAPTAIN MEDUSA^talk 20:39, 27 November 2019 (UTC)

I do see it occasionally. I can't think of any occasion this should appear in a biography, unless it's in a direct quote of something (again hard to think of). I don't think we have any filters for biographies which prevent edits, a dedicated filter for this word would be excessive, so I think it does belong in 189 (and probably also 39). This won't block any additions, but they will be tagged (in 39 they will be warned and tagged). -- zzuuzz ^(talk) 21:02, 27 November 2019 (UTC)

Mostly the case for the quotes as can be seen from this search, it does seem to be a movie called "The Nonce" and something in French. This is definitely good enough for a warn only filter. Adding it to 39 also looks sensible based on this search. ‑‑Trialpears (talk) 21:19, 27 November 2019 (UTC)

@CAPTAIN MEDUSA: Added to 189 (hist · log). I'll let 1014 (hist · log) run a bit longer before adding to 39 (hist · log). Suffusion of Yellow (talk) 21:10, 30 November 2019 (UTC)

Suffusion of Yellow/CAPTAIN MEDUSA: Found one false positive (well, okay, it was a bad edit for other reasons, but false positive in this context) while reviewing 1014 for other reasons - Special:Diff/928802207 (use of the word "nonce" in a URL). People shouldn't be using URLs with cryptographic nonces in articles in the first place, but it's another potential source of false positives. Probably not worth adding an exception yet, though. creffett (talk) 02:40, 3 December 2019 (UTC)

Two other FPs - Special:AbuseFilter/examine/log/25481486 ("Pagnoncelli") and Special:AbuseFilter/examine/log/25480018 ("Annonce"). Maybe change to \bnonce? Probably best to not do \bnonce\b unless you want to come up with every suffix these people have tacked on, but I don't think I've seen any prefixes on the genuine vandalism. Also, I've seen the word nonce enough times in the past ten minutes that I'm at semantic satiation. creffett (talk) 02:49, 3 December 2019 (UTC)

@Creffett: I used \bnonce in 189 already and will do the same in 39. 39 already checks for added references, which should (I hope) prevent most FPs on URLs. Aside, did you notice the spectacular cut-and-paste fail in Special:Diff/928802207? I wish all spammers would be so generous... Suffusion of Yellow (talk) 18:33, 3 December 2019 (UTC)

Wow, I did miss that excellent addition. Very nice. creffett (talk) 22:34, 3 December 2019 (UTC)

•  Done Added to 39. But, beginning to wonder if some words (including this one) should be split out of 189 into a warn-and-tag filter. Suffusion of Yellow (talk) 19:23, 4 December 2019 (UTC)

  Suffusion of Yellow, hmmm... [10] [11] ~~ CAPTAIN MEDUSA^talk 13:41, 6 December 2019 (UTC)

  @CAPTAIN MEDUSA: That's not a BLP or a school. "Nonce" would a tricky word to filter on all pages, see Cryptographic nonce and Nonce word. Suffusion of Yellow (talk) 17:46, 6 December 2019 (UTC)

Word flooding

• Task: Disallow editors from adding the same word in the same sentence a bunch of times.
• Reason: Stuff like this. Sincerely, Deauthorized. (talk) 22:18, 5 December 2019 (UTC)

Something like

!("confirmed" in user_groups) &
page_namespace == 0 &
ccnorm(added_lines) rlike "(\S{3,})\s\1\s\1\s\1\s\1"

would have matched that, finding the same word (3 or more characters) appearing 5 times in a row. Could someone try it on filter 1? Thanks, --DannyS712 (talk) 02:04, 6 December 2019 (UTC)

@DannyS712: The test in filter 135 (hist · log), rmwhitespace(added_lines) rlike "([^_:.*'|=}{0 -]{1,9})\1{7}", already matched that edit, but the filter didn't trip because of one the exceptions on line 12. Most of the other ones in Special:Diff/929501258 did match 135, but the few that didn't also failed because of one the exceptions. Do you still want me to run the test? Suffusion of Yellow (talk) 07:03, 6 December 2019 (UTC)

@Suffusion of Yellow: well, given the exception made for urls in 135, it might be useful to have this separate DannyS712 (talk) 07:04, 6 December 2019 (UTC)

@DannyS712: OK if I leave out the ccnorm(), so I can merge it with the regex in 1014 (hist · log)? I've never seen vandalism like "Foo föö FOO f00". Or is it there for some other purpose? Suffusion of Yellow (talk) 07:31, 6 December 2019 (UTC)

@Suffusion of Yellow: not really, I just thought it was good practice to use ccnorm DannyS712 (talk) 07:32, 6 December 2019 (UTC)

@DannyS712: Added to 1014. Mixed in with some other stuff, but of course you know how to prune that out now. :-) Suffusion of Yellow (talk) 07:42, 6 December 2019 (UTC)

I've no evidence of this actually happening but is it worth including multi-word phrases such as "Joe Vandal Joe Vandal Joe Van..."? Certes (talk) 10:58, 6 December 2019 (UTC)

I'm considering adding Suffusion of Yellow's recent filter (1014 (hist · log)) to DatBot's filters page. Is this a good idea? If so, what list should I put it under? Sincerely, Deauthorized. (talk) 22:27, 6 December 2019 (UTC)

@Deauthorized: No! That's "my" testing filter; I might put anything in there, at any time. Suffusion of Yellow (talk) 22:36, 6 December 2019 (UTC)

*id.com Linkspam

• Task: Disallow links to certain often-spammed pages.
• Reason: I am seeing a lot of link spam for the following domains:
• boatid.com
• camperid.com
• carid.com
• motorcycleid.com
• powersportsid.com
• recreationid.com
• toolsid.com
• truckid.com

The linkspam comes from different IPs each time, making a block impractical. Would this be a good application for an edit filter? --Guy Macon (talk) 16:38, 13 December 2019 (UTC)

@Guy Macon: Usually the WP:SBL is a better choice for links, unless there are some legitimate uses. In this case, I suppose a log-only filter could be used to find other "*id.com" links that you don't know about yet. Presumably, there are some good sites also matching that pattern. Suffusion of Yellow (talk) 17:48, 13 December 2019 (UTC)

LTA needs an edit filter to stop.

There's an LTA currently spamming random talk pages using a variety of IP addresses and throw-away accounts. They're using a rather simple-to-match boilerplate text to do so, see here and here. Can we get an edit filter to slow this down a bit? --Jayron32 18:09, 19 December 2019 (UTC)

Oh, hey, it's our good friend Nsmutte. I'm honestly starting to wonder whether just filtering any mention of bonadea by new users might be a net positive... ^creffpublic _{a creffett franchise} (talk to the boss) 18:37, 19 December 2019 (UTC)

(Non-administrator comment) (& non-EFH/EFM, too) I suspect so. Additionally, a filter on new accounts whose very first edit is pinging-or-linking-to half a dozen or so admins probably would do more good than harm, too... (Let's just say that the number of fresh accounts knowing how to trigger notifications and familiar enough with our admin corps to know several of them and with a non-abusive reason to summon several of them on first edit is, ahem, vanishingly small. On the other hand, the number of LTAers that do this is by no means limited to Nsmutte.) AddWittyNameHere 18:50, 19 December 2019 (UTC)

@Creffett and AddWittyNameHere: Can't hurt to check. Logging both at 884 (hist · log) (private, unfortunately). Suffusion of Yellow (talk) 19:31, 19 December 2019 (UTC)

@Suffusion of Yellow: Thanks for taking the time and effort to check it! :) Unfortunate but eminently sensible--anti-LTA filters don't work too well if the LTAers can see exactly how to circumvent them, after all. AddWittyNameHere 19:34, 19 December 2019 (UTC)

Suffusion of Yellow, in case you don't have it already set up like this, I'd recommend something like [Bb]\s*[Oo]\s*[Nn]]... (I've seen several examples of intentionally weirdly spaced letters). ^creffpublic _{a creffett franchise} (talk to the boss) 19:57, 19 December 2019 (UTC)

@Creffpublic: Emailed a copy of the filter, to your main account. Suffusion of Yellow (talk) 20:05, 19 December 2019 (UTC)

@Suffusion of Yellow: as I can't see the filter, did it log this one? If not, might want to further tweak the filter. AddWittyNameHere 16:22, 21 December 2019 (UTC)

@AddWittyNameHere: Some of the recent activity would indicate that they might be reading this discussion, so I'd like to say as little as possible. Suffusion of Yellow (talk) 19:28, 21 December 2019 (UTC)

@Suffusion of Yellow: Makes sense. AddWittyNameHere 19:34, 21 December 2019 (UTC)

@Jayron32: Added something to filter 885 (hist · log). Probably could use some more refinement. Bonadea, any interest in requesting WP:EFH rights? You'll be able to see what we're already checking and suggest changes. Would also be useful at WP:SPI in general. Suffusion of Yellow (talk) 18:55, 19 December 2019 (UTC)

--Jayron32 18:57, 19 December 2019 (UTC)

@Suffusion of Yellow: yes, that sounds like something I might be interested in requesting, actually. I will look into what would be required of me to request it – thanks for the suggestion, and the ping! --bonadea contributions talk 19:21, 19 December 2019 (UTC)

• May need additional tweaks to filter. Here is the latest appearance. --Jayron32 14:24, 20 December 2019 (UTC)

Thanks, added something else to 885. Suffusion of Yellow (talk) 18:56, 20 December 2019 (UTC)

Jimbo's talk page

[12][13][14]

These keep popping up, and nobody seems to know how to stop them. The image the LTA keeps using is blocked, but that just means the edit goes through with a non-working image.

Is there some reason why we can't simply disallow any post that contains "image = Jimmy Wales by Pricasso.jpg"? --Guy Macon (talk) 22:08, 20 December 2019 (UTC)

@Guy Macon: Did something about this. I'll keep the page watched for a while. Suffusion of Yellow (talk) 19:26, 21 December 2019 (UTC)

"youngest entrepreneur"

Moved from WP:EFN

 – creffett (talk) 21:05, 21 December 2019 (UTC)

• Task: Filter for the phrase "youngest entrepreneur" (maybe add to 627 (hist · log))
• Reason: Phrase pops up a lot in self-promotional/autobiographical drafts and sandboxes (amazing how many youngest entrepreneurs there are out there). Tag-only seems appropriate, since I'm sure there are indeed youngest entrepreneurs out there. creffett (talk) 21:05, 21 December 2019 (UTC)

Change: add tag/warn to filter 686?

Regarding filter 686: "IP adding possibly unreferenced material to BLP": is there any support for adding Tag and/or Warn actions to this filter? This could help to prevent some BLP violations that otherwise may fly under the radar. Thanks! –Erakura^(talk) 20:56, 22 December 2019 (UTC)

Thanks for pointing out, expanded to include all non-confirmed users and started tagging. Filter looks like its doing a fairly good job of catching unreferenced additions though it may need some tweaking, which I'll see about. Galobtter (pingó mió) 00:10, 23 December 2019 (UTC)

Local links

• Task: The filter should prevent the addition of "file:///path" links.
• Reason: How often such links appear I don’t know yet, but if they are added, then they are not detected for a long time: <ref>file:///C: (example 1), <ref>file:///home (example 2). The initial discussion is here. Fractaler 08:54, 20 November 2019 (UTC)

  Side note - I've found that these things sometimes suggest paid editing, especially in new articles (I've seen filesystem links in articles whose paths strongly suggested that they were written by a marketing team and handed to someone else for publishing). ^creffpublic _{a creffett franchise} (talk to the boss) 13:39, 20 November 2019 (UTC)

@Creffett: Logging at 1014 (hist · log). Suffusion of Yellow (talk) 20:15, 27 November 2019 (UTC)

Suffusion of Yellow, I've skimmed 1014, and haven't seen any false positives yet from the past few days of logging - all of the flagged edits were incorrectly adding external links (and like I hinted at above, a couple of them sure look like paid article-writing). creffett (talk) 02:45, 3 December 2019 (UTC)

@Creffett: Created 1016 (hist · log). I think warn-only will be the right setting. Want to have a go at the message? Something like MediaWiki:Abusefilter-warning-external-images is what I have in mind. Suffusion of Yellow (talk) 19:32, 7 December 2019 (UTC)

Suffusion of Yellow, warn-only sounds good. How about taking 220 and replacing the main body with something like:

An automated filter has identified a possible formatting error in your edit.

Please read the section below that applies to you. Are you attempting to:

• link to a file on your computer in a reference? If the file is available on the internet, you can usually add a link to it in your citation, though you should not link to a website which doesn't have legal permission to distribute the file. If it isn't available on the Internet, please provide a citation so that other editors can find the source.
• upload a file from your computer? If you want to upload a file that you created, you may upload it to Wikipedia and link to the image as follows: [[File:Example.jpg]]. Please see our file help page for preferred formats. Note: In certain instances, such as in a gallery or infobox, the square brackets ([[ ]]) may not be necessary. Replace File:Example.jpg with the name of the file. For more detailed information, please see Wikipedia:Extended image syntax. If you did not create the file, then in most cases, you will not be able to add it to Wikipedia, which requires that content be free (that is, may be reused, copied, and modified freely by others) unless allowed under the provision of fair use. See our copyright policy for more details.
• copy text from a word processor? There may be internal links in the text you copied, please review your submission for those.

I'm open to wordsmithing, of course, but I think that captures the major cases I've seen. Will need an interface admin to actually make the change. creffett (talk) 21:33, 7 December 2019 (UTC)

@Creffett: Thanks. Copied that to MediaWiki talk:Abusefilter-warning-local-link/sandbox and made one change. I'm not sure that many of these people even know what "file://" even means, so I added a line explaining it. Suffusion of Yellow (talk) 22:23, 7 December 2019 (UTC)

@Creffett: Couldn't think of any more improvements, so I submitted an edit request. Any admin can create the page; only JS and CSS pages are restricted to intadmins. Suffusion of Yellow (talk) 00:06, 8 December 2019 (UTC)

My only question is why Wikipedia:Requests for adminship/Suffusion of Yellow is still red :) Galobtter (pingó mió) 01:35, 8 December 2019 (UTC)

Suffusion of Yellow, thanks for the page creation and the information on who can create in the MW space. creffett (talk) 03:01, 8 December 2019 (UTC)

I assume we have a filter for <ref>C:\ already? I only found (and fixed) one offence. If not then it might go in with file:. Certes (talk) 12:45, 25 December 2019 (UTC)

Not in a place to check, but if we don't have that in an existing filter then +1 for adding it here. Also curious whether any other drive letters show up (you never know, maybe I really wanted to upload from a 5.25" floppy disk...) creffett (talk) 01:38, 26 December 2019 (UTC)

Good question. I fixed one T:\ here. Nothing found for other letters or /home; I can't search properly for other Unix-like prefixes such as ~/ or ./. Certes (talk) 09:14, 26 December 2019 (UTC)

Lyrics website spam

• Task: Watch for links added containing "lyric(s)" by users that are not autoconfirmed. Right now it should not do anything except log.
• Reason: I've noticed a ton of spamming links to lyrics sites (which probably violate copyright as well) on Lyrics, and as soon as that was semi'd the spam just moved to other pages. I'd like to see how much and on what other pages this might be happening. – Frood (talk) 19:39, 28 December 2019 (UTC)

Burger emoji spam by LTA

• Task: Flag edits using the "🍔" emoji
• Reason: Frequent and recurring abuse by a certain LTA whose name I won't mention. Blake Gripling (talk) 01:29, 30 December 2019 (UTC)

New user modifying short descriptions

• Task: prevent vandalism by monitoring short description changes made by new users.
• Reason: new vandal user tends to edit short description first because it describes the page in few words. Some example include [15] [16] [17]

~~ CAPTAIN MEDUSA^talk 13:08, 4 January 2020 (UTC)

I believe something simple like

shortdesc := "{{SHORT DESCRIPTION\|";
!("autoconfirmed" in user_groups)
& (ccnorm(added_lines) rlike shortdesc | ccnorm(removed_lines) rlike shortdesc)

would work. Majavah ^(t/c) 15:11, 4 January 2020 (UTC)

"Goals" Subheading

A tag/warn(?) filter to catch non-autoconfirmed people using "Goals" as a subheading would be quite helpful, since I find that this is quite common with CoIs trying to advertise themselves/copy-paste parts from their websites. ^{[Username Needed]} 10:52, 9 January 2020 (UTC)

Shrek script filter?

per this edit. maybe disallow. https://en.wikipedia.org/w/index.php?title=Alva_Academy&oldid=935310922 maedacho - talk 22:53, 11 January 2020 (UTC)

Add "truth" to filter 633 (Possible canned edit summary)

• Task: Add "truth" to 633 (hist · log) (Possible canned edit summary)
• Reason: This one isn't common, but I've seen it a couple of times (example). --Majavah ^(t/c) 17:36, 4 January 2020 (UTC)

  I recommend adding "lies" as well. ~~ CAPTAIN MEDUSA^talk 08:59, 6 January 2020 (UTC)

  • I think you're looking for 981 (hist · log). That's the one for "common problem summaries"^{[Username Needed]} 18:16, 6 January 2020 (UTC)

    I've been meaning to cleanup/split 981 (as explained in the notes) for a long long time now, but have putting it off, as it requires evaluating maybe 50-100 hits from each word. I'm going to be away for a bit, but will make a point to do that when I get back, then add "truth", "made it better", etc. to 981. Suffusion of Yellow (talk) 21:48, 17 January 2020 (UTC)

Add typo to epstein meme (in 614)

• Task: Add misspelling "epstien" to filter 614
• Reason: Seen the misspelling pop up a few times, might as well add it. I figure changing "epstein\W" to "epst(:?ie|ei)n\W" should do the trick. creffett (talk) 00:14, 15 January 2020 (UTC)

  @Creffett:  Done. Suffusion of Yellow (talk) 21:42, 17 January 2020 (UTC)

Expletives in Hindi in edit summaries & page content

• Task: I was wondering if the (redacted) edits linked from Wikipedia:Administrators' noticeboard#Nasty expletives need redaction could potentially be caught with a filter, as they are being posted by a block-evading IP. Jo-Jo Eumerus (talk) 13:16, 17 January 2020 (UTC)

  Jo-Jo Eumerus, maybe to Special:AbuseFilter/981 or to a new private filter. ~~ CAPTAIN MEDUSA^talk 13:20, 17 January 2020 (UTC)

  Suffusion of Yellow your thoughts on this? ~~ CAPTAIN MEDUSA^talk 13:22, 17 January 2020 (UTC)

  Half of them are oversighted, which doesn't help. Special:AbuseFilter/965 might be an option, assuming the summaries duplicate the content, and 52 might be a stopgap. Unfortunately Hindi is not one of my strengths. Ping User:Galobtter. -- zzuuzz ^(talk) 13:51, 17 January 2020 (UTC)

  965 is for Hindi expletives transliterated to English, that plus it being a public filter doesn't make it a good option I'd say. Assuming all the IPs are posting the same/similar text I think it would be best to treat this as any other LTA and try to block that text using one of the LTA filters/a dedicated filter rather than trying to block Hindi expletives in general. Galobtter (pingó mió) 17:32, 17 January 2020 (UTC)

  I'm not sure it's an LTA as such, but I'm sure we can squeeze it in somewhere at this time. However I think we're going to need someone to help with the Hindi, because I could end up blocking 'Namaste' for all I know about Hindi script: @DBigXray:. On the other hand, we could probably just approach the English parts of it. -- zzuuzz ^(talk) 19:07, 17 January 2020 (UTC)

  Zzuuzz, I am a native speaker of Hindi and I will be glad to help here with my skills. I had read the message before it was redacted. In his messages, he is claiming to be a victim of cheating of ₹20,000 (US$250) and is posting vulgar lines targeting the alleged cheat. To summarize what the LTA block evading IP was saying, " Mother F*k*r Cu*t etc etc (Some Guys Name) swindled ₹20,000 (US$250). His lady partner is (some feminine name) (some expletive). At the end there is someone's full address in English at the end."

  I think we should most certainly filter the hindi expletives. in the filter as they will serve a general purpose and take care of other vandals as well. If Jo-Jo Eumerus or User:Oshwah can email me the message then I can point out the Hindi keywords. ( I could only recall MotherF#$#r and the hindi transliteration for it is मादरचोद (also माधरचोद ) --DBigXrayᗙ 19:25, 17 January 2020 (UTC)

  I admit I am not so certain about passing over now oversighted content. Jo-Jo Eumerus (talk) 19:31, 17 January 2020 (UTC)

  There have to be some oversighter that is comfortable with edit filters that can handle this properly. Xaosflux perhaps? ‑‑Trialpears (talk) 19:43, 17 January 2020 (UTC)

  Jo-Jo Eumerus The user seems to be copy pasting the exact same line, everytime in edit window as well as edit summary box. I was the one who reported all three recent instances of this Vandal. I did not felt the need of saving that drivel, that is why I suggested to email. IMHO sharing it back with me should not be a concern. as it only has abuses in Hindi. You may redact the last part of the message which is Address in English.

  Zzuuzz for now, I suggest that you add these 2 words (for MF) in abuse filter. If the vandal returns, I will try to save a copy of the message in my PC. DBigXrayᗙ 19:45, 17 January 2020 (UTC)

  Yep, I can't safely parse the bits I can read. We need an Oversighter who speaks fluent Hindi and edits filters! While we're waiting, let's negotiate something. So DBigXray, if we block all occurrences of the following string of characters माधरचोद will this cause any issues? -- zzuuzz ^(talk) 19:48, 17 January 2020 (UTC)

  I was thinking that a non-Hindi speaker could block the adress, which feels like the least likely part to change since it's presumably not chosen at random. ‑‑Trialpears (talk) 19:54, 17 January 2020 (UTC)

  I am surprised it was not already blocked. But then there is always a first time for everything. Yes मादरचोद is the commonly used hindi word for Mother Fkr so I can't think of any serious damage it will cause. The only collateral damage can be a quote from a politician or a novel. but even in Hindi literature, this word is extremely rarely used. So chances of blocking a literary quote is very very rare. If someone wants to really use it, He should probably make a request at WP:INDIA first. This word however will not stop our Vandal here, since he is using a less common variation of the same. Including the second word माधरचोद should take care of this phrase that this IP is using. (P.S. On a side note may be I should run for RfA and RfOS soon, I could be a big asset :D )--DBigXrayᗙ 19:57, 17 January 2020 (UTC)

  For this instance it should be easy enough to add phrase including "T......... .-..." to a private filter. — xaosflux ^Talk 20:01, 17 January 2020 (UTC)

  OK, we should probably add मादरचोद and माधरचोद to an existing warn (at least) filter. I'll set about a private filter where we can block and keep track of the other stuff peculiar to this vandal. I suspect this will not be very long term, but we'll see. Consider the latter done. -- zzuuzz ^(talk) 20:26, 17 January 2020 (UTC)

  DBigXray, there are other various other words as well. This includes behenchod and kaminey. ~~ CAPTAIN MEDUSA^talk 00:47, 19 January 2020 (UTC)

  I'll see if I can get some oversighters to comment on this. Jo-Jo Eumerus (talk) 10:26, 19 January 2020 (UTC)

I think we have enough to go on without oversighters, unless they can also speak Hindi and regex or have some other useful thing to add. The private filter is coming along well. There are two other aspects to this issue: a filter which prevents general profanity in Hindi script, and this vandal. I suspect they are a returning vandal; you can see similar (but different) contributions in the following ranges 49.15.159.175/16 (block range · block log (global) · WHOIS (partial)), 112.110.15.197/17 (block range · block log (global) · WHOIS (partial)), 106.67.106.160/17 (block range · block log (global) · WHOIS (partial)) going back into last year. If some Hindi speakers want to help develop a filter for Hindi script, I'm happy to entertain the idea. -- zzuuzz ^(talk) 11:11, 19 January 2020 (UTC)

• zzuuzz Thanks for sharing the range. Indeed this is a returning vandal. May be an LTA page is needed. I will explain what is going on.
• Starting September 2019, Vandal is targeting a few politician Bios, Police related pages and some journalists/news channels. He is attacking certain specific Hindu communities. The edit summaries are completely unacceptable and highly disruptive. IMHO once we are done with creation of the filters all these will need to be redacted. I will make a list. I suggest adding all these Hindi texts and the Transliteration into edit filters for swear word vandalism.

Hindi text	transliteration	English counterpart	Example diffs	Notes
बेटीचोद	betichod	daughter fu#K@r	[18], [19]	on Anjana Om Kashyap (a journo)
चूत	chut	cu&t	see above
गाण्ड	gaand	a*se	see above
रण्डी	randi	wh@re	see above
माधरचोद	madharchod	Mother fu#K@r	[20],	Madarchod is the more common transliteration.
बहनचोद	behenchod	sister fu#K@r	[21]	bahanchod is the less common transliteration.

List of diffs to revdel once the discussion is complete.

• [22], [23], [24], [25], [26], [27], [28], [29], [30], [31], [32], [33], [34], [35], [36], [37], [38], [39], [40], [41], [42], [43], [44], [45], [46], [47], [48], [49], [50], [51], [52], [53], [54]
• Special:Contributions/112.110.15.197/17 [55], [56], [57], [58], [59], [60], [61], [62], [63], [64], [65], [66], [67], [68], [69], [70], [71], [72],
• Special:Contributions/49.15.159.175/16 [73], [74], [75], [76], [77], [78], [79], [80], [81],--DBigXrayᗙ 14:47, 19 January 2020 (UTC)

• Special:Contributions/106.67.112.155 new ip now only using English text for Hindi expletives. So looks like zzuuzz's filters are working for the hindi texts. We should probably include the first 2 columns of the table above to deter this IP and other vandals. --DBigXrayᗙ 10:52, 20 January 2020 (UTC)