User talk:AmandaNP/Archives/2013/May

This is an archive of past discussions with User:AmandaNP. Do not edit the contents of this page. If you wish to start a new discussion or revive an old one, please do so on the current talk page.

Hello everyone, recently on ANI, I and two other checkusers notified the community about Riley and Gwickwire sharing an account password. Several members of the community have expressed concern about how I obtained this information, and some have accused me of fishing. I just want to respond public ally on the matter since the first chance I got was after the ANI thread was closed. This all started with processing a request at ACC. There was an active and recent block on the request, so I ran the IP through CU to get the users. One of the two users mentioned showed up. Due to the nature of the IP and the information given to me by said user, I checked the user. The user also requested information from inside CU. In the check, the case came up that Riley had given access to his account to Gwickwire at somepoint.

Some of you wonder why we took this to ANI, it's because Riley had access to sensitive data, and did not follow community norms for account sharing. There was no way to verify that the password had been changed. Also, there was a disconnect in the story. Riley claimed not to have access to his account, yet he was able to give Gwickwire a temporary password...I don't understand how that's possible, and it has yet to have been explained to me.

I encourage any of you that still have concerns about my use of the tool to contact the Audit Subcommittee for them to do a full investigation.

I am really sad to see that these members of the community have left, and I wish them the best on their real life journey. -- DQ (ʞlɐʇ) 00:05, 1 May 2013 (UTC)

wikt:temporary Riley gives Gwickwire the password at the time and then changes it when they get back online. NE Ent 01:51, 1 May 2013 (UTC)

I don't understand your point. Ryan Vesey 02:03, 1 May 2013 (UTC)

NE Ent, I know what the word temporary means. And that would be his old password, not his new temporary one, which also may be (I don't know) his ACC password with sensitive data. -- DQ (ʞlɐʇ) 19:53, 1 May 2013 (UTC)

Did they say "new temporary" or just "temporary"? NE Ent 02:28, 2 May 2013 (UTC)

"my temp. password" to directly quote. But if were pulling teeth over this small detail, it really should have been explained better when I asked, as the context is quite vague. -- DQ (ʞlɐʇ) 04:16, 2 May 2013 (UTC)

Some things are inherently "temporary," such as igloos, henna tattoos, and sandcastles on the beach. Other things are temporary or not based on extrinsic factors, like an assigned parking spot at a workplace. There's nothing about the parking spot that makes it temporary or permanent, it's how its used. Passwords are like that ... there's nothing about a particular password that makes it temporary, it's how it's used. As far as pulling teeth over small detail -- this has got to be the WP:Lamest security breaches ever -- I mean, proxy editing to remove a bot notification off a talk page?? Why would Riley care in the first place? NE Ent 10:04, 2 May 2013 (UTC)

I saw it suggested somewhere that they asked for the edits to be removed because it was creating some issues for them, although I don't really get what or why. About the temporary thing, since the reason the sharing happened is because they were traveling it is plausible that they already created a temporary password out of security fears.. Nil Einne (talk) 17:58, 2 May 2013 (UTC)

• Thanks for your explanation. I was one of the people at WP:ANI who directly requested further explanation of how you came to uncover this problem, as it wasn't clear how it could be randomly tripped on under the normal course of checkuser duties. Since you have explained just that, I am now more than satisfied that my questions on this matter have been answered, and I see nothing worth pursuing any further on this. Thanks again for being forthcoming and dealing with such questions in a responsive manner. --Jayron32 06:01, 1 May 2013 (UTC)
• The explanation makes perfect sense, but you should never have had a million people jumping down your neck and violating WP:AGF every 30 seconds, that was disgraceful behaviour. Any experienced Wikipedian should know that most of what CUs do is private (and how they do it), and it should stay that way. Lukeno94 (tell Luke off here) 07:15, 2 May 2013 (UTC)

Your CU was apparently done sometime before 21:43 1 May. This account was created the following day after I blocked Damonthesis. I'm fairly certain it's either a sock or a meat puppet. Should I reopen the SPI, or can something be done without going to that trouble? I could also block based on duck. Thanks.--Bbb23 (talk) 01:04, 3 May 2013 (UTC)

He's technical  Unrelated, but obviously not new. I would support a block as a sock of someone. -- DQ (ʞlɐʇ) 13:10, 3 May 2013 (UTC)

Thanks for checking, DQ, and for your thoughts. For the moment, I'll just continue to monitor the situation. Regards.--Bbb23 (talk) 00:09, 4 May 2013 (UTC)

Any relation to anyone from Targeted Individual? — PinkAmpers&^{(Je vous invite à me parler)} 01:37, 4 May 2013 (UTC)

PinkAmpersand, I don't know what your asking. All the editors in that deleted article are established users except for one IP address, which I can't comment on. -- DQ (ʞlɐʇ) 12:53, 4 May 2013 (UTC)

Well psychotronic/electronic weapons were mentioned in its AFD, with at least one user arguing that they were a scientifically proveable phenomenon. Not to cast aspersions on anyone in particular, of course. (Of course, I can't see the deleted history, so I have no way of knowing if any users with possibly-overlapping behavioral patterns might have edited it.) — PinkAmpers&^{(Je vous invite à me parler)} 15:28, 4 May 2013 (UTC)

here i request you to check the relations between an not new and child star grown up.please it is important.

istion the ip of child star is 182.188.190.59 taken from its investigation page and my ip is 119.154.4.48.there is absolute no relation between range.the only relation which is visible is relation between location internet service provider and location.and it is because there is only one ISP in Pakistan that is PTCL.i request another clerks to please check my relation again.

i dont know him so please.

please i request you to see .Dil e Muslim talk 08:58, 3 May 2013 (UTC)

I have provided my opinion on the SPI. -- DQ (ʞlɐʇ) 16:12, 3 May 2013 (UTC)

some questions. is it behavioural evidence or technical.can i know where it is likely and what is meaning of if not very likely.Dil e Muslim talk 17:03, 3 May 2013 (UTC)

You should have known better than to block a famous President. You're gonna get it. Sorry, but that edit summary was so funny, I just had to share it with someone. AutomaticStrikeout (T • C • Sign AAPT) 02:23, 5 May 2013 (UTC)

Hey DeltaQuad; Kaldari has finished scripting a set of potential replacements available to test and give feedback on. Please go to this thread for more detail on how to enable them. Okeyes (WMF) (talk) 14:54, 7 May 2013 (UTC)

You recently blocked User:Emile Largo as a sockpuppet of blocked/banned editor. He or she appears to have used another account to continue editing. Can you please block this other account, too? Thanks! ElKevbo (talk) 23:15, 7 May 2013 (UTC)

This is actually Mangoeater, not Paul Bedson, but blocked. -- DQ (ʞlɐʇ) 01:19, 8 May 2013 (UTC)

One of the stale users is no longer stale KonstantineUO (talk · contribs), and an editor is asking if you can look again. I've still only done the users that moved to the new case and haven't reviewed everything there. Dennis Brown - 2¢ © Join WER 01:48, 10 May 2013 (UTC)

 Done. -- DQ (ʞlɐʇ) 02:05, 10 May 2013 (UTC)

Didn't see you on IRC so sent a mail. Thanks! Legoktm (talk) 05:51, 12 May 2013 (UTC)

Should be fine. -- DQ (ʞlɐʇ) 21:59, 13 May 2013 (UTC)

There are growing concerns that Amiram Goldblum is himself editing the article about him. He has two accounts: User:Rastiniak and User:רסטיניאק. Take a look at the this sockpuppet investigation. Also, read the following discussion. רסטיניאק has removed the POV tag from the article twice so far: 1 and 2. While I don't find this subject particularly interesting, I'm alarmed by the fact that Goldblum is fighting tooth and nail to get users who question the neutrality of his article to get blocked. I request you to help us determine whether the two accounts indeed belong to Goldblum. Nataev (talk) 11:27, 13 May 2013 (UTC)

Please note that Nataev (talk · contribs) is posting this item on the talk pages of > a dozen admins. It might be instructive to investigate more deeply via his contribs as to why he is doing this -- I suggest that it has to do with his right-wing (Israeli) sympathies and his desire to smear Goldblum for being a leftist (on which [1]). Nomoskedasticity (talk) 11:37, 13 May 2013 (UTC)

Here we go again. This is the first time I have asked for help from a user who has access to CheckUser. Now Nomoskedasticity himself is calling me names. I don't know much about left-right politics. I have no interest about subjects related to Israel either. My sole problem is that Amiram Goldblum has written the entire article about himself. If doing so is acceptable on Wikipedia, then I have no problems with it. Nataev (talk) 11:45, 13 May 2013 (UTC)

Looks to have been solved elsewhere. -- DQ (ʞlɐʇ) 21:59, 13 May 2013 (UTC)

Please, help me, User:Safetidhehyria reappeared as alternative account of User:Sulmues (again), but both that and User:Sulmuesi were abandoned in order to hide traces and fresh start. For more see this SPI. User is master sockpuppeteer, and it is indef blocked on User:Futbollisti. Please, block this problematic DE user, and please, mark or block those two old account, as user will try again to slip away with it. I dont know to open a SPI at old archived SPI... :( --WhiteWriter^speaks 20:35, 14 May 2013 (UTC)

•  Confirmed

• Safetidhehyria (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• MexicanGrillOps (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• ZacTaylor (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)

•  Likely to each other and above:

• Guzhinjeri (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tetovo boy (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki)

All including the previous accounts are blocked. -- DQ (ʞlɐʇ) 21:58, 14 May 2013 (UTC)

Hello, AmandaNP. You have new messages at WilliamH's talk page.
Message added 09:34, 15 May 2013 (UTC). You can remove this notice at any time by removing the {{Talkback}} or {{Tb}} template.

WilliamH (talk) 09:34, 15 May 2013 (UTC)

Thehelpfulone has activated it. Callanecc (talk • contribs • logs) 11:27, 15 May 2013 (UTC)

I am blocked by you, until December 9, 2015, because "the IP range [I] am editing from is a web host provider." I would like it if you could please unblock me, as it means I can't use Google Chrome to edit Wikipedia anymore. — Preceding unsigned comment added by Jinkinson (talk • contribs) 00:09, 16 May 2013 (UTC)

(talk page stalker) You'll have to provide the ip blocked address range either publicly or by email to DQ, myself, or at WP:OP for us to investigate. However, that said, I don't think google chrome is the source of your problems. Sailsbystars (talk) 00:16, 16 May 2013 (UTC)

Ya I'm not sure what range your on, but whatever range it is, it certainly is not your normal one, which you can edit from perfectly. -- DQ (ʞlɐʇ) 12:32, 16 May 2013 (UTC)

There's a few queued unblocks waiting for an open proxy investigation on UTRS.—Kww(talk) 00:34, 16 May 2013 (UTC)

Since i've moved again, it appears my ISP is blocking portscans, therefore I do not have the proper ability to review these. I might see if I can get Reaper Eternal to help me out with it though. -- DQ (ʞlɐʇ) 12:24, 16 May 2013 (UTC)

I feel summoned.... Reaper Eternal (talk) 13:22, 16 May 2013 (UTC)

Could you block "\Chelsie44"? I inadvertently created it.—cyberpower ^Chat_Online 12:18, 16 May 2013 (UTC)

 Done -- DQ (ʞlɐʇ) 12:27, 16 May 2013 (UTC)

Ping me if you find anything interesting there. Dennis Brown - 2¢ - © - @ - Join WER 20:57, 17 May 2013 (UTC)

The context is killing me trying to figure it out... -- DQ (ʞlɐʇ) 00:26, 18 May 2013 (UTC)

The RentAGoat move you just made, which I worked a related SPI case for, sorry. How many goats are in your life that you didn't get that? lol. Dennis Brown - 2¢ - © - @ - Join WER 01:23, 18 May 2013 (UTC)

just, try many many hours ago :P I just forgot about it. :P I'm discussing stuff with another CU on it, and i'll let you know our two cents at the end, though I haven't read up on the SPI to be honest. -- DQ (ʞlɐʇ) 02:48, 18 May 2013 (UTC)

The other CU added a comment to that case's archive, btw. ​—DoRD (talk)​ 03:07, 18 May 2013 (UTC)

Can some CheckUser or someone work on the SPI for Beefyted69? He probably has sleepers out there that he's using to get around autoconfirm and the few he's already probably used need to be checked too. It's been several days, which is enough time for any new sleeper accounts to get around the autoconfirmed, so someone should get on that soon. Smartyllama (talk) 17:46, 19 May 2013 (UTC)

Ran the CU for this and left the results there. -- DQ (ʞlɐʇ) 13:32, 22 May 2013 (UTC)

I don't know how far back the CU records go, and this one hasn't edited since 10 Dec 2012, but could you check Yessington (talk · contribs) against Harro774 (talk · contribs)? JohnCD (talk) 10:04, 21 May 2013 (UTC)

CU  Stale, sorry. I can check Harro774 if there is indication that there could be sleepers around. -- DQ (ʞlɐʇ) 15:59, 21 May 2013 (UTC)

Yes, please. He says on my talk page that he's giving up, so it would be useful to tidy up any loose ends. Actually I see signs, including this message, that he's growing up, and am wording a reply suggesting he takes a standard-offer six months off and then applies for unblock if he would like to become a constructive contributor. JohnCD (talk) 17:25, 21 May 2013 (UTC)

Only him and his alt account showed up when I checked this. -- DQ (ʞlɐʇ) 18:51, 23 May 2013 (UTC)

You've got mail.—Kww(talk) 15:30, 21 May 2013 (UTC)

Replied, i'll try and reply to your second soon enough, but i'm on travel days now. -- DQ (ʞlɐʇ) 13:31, 22 May 2013 (UTC)

Hello everyone, I am out of office till the 28th for the Wikimedia Hackathon, which includes my travel days. I'll try and respond here and to emails, but I can't make any promises. My usual talkpage stalkers, if you could please check things here a little more often while I'm gone and reply as possible, that would be great. -- DQ (ʞlɐʇ) 13:38, 22 May 2013 (UTC)

https://bugzilla.wikimedia.org/show_bug.cgi?id=48791 —Kww(talk) 17:20, 24 May 2013 (UTC)

What prompted your SPI? Am I doing something wrong? --Biker Biker (talk) 06:49, 26 May 2013 (UTC)

The SPI was prompted after I found your two accounts while running a check on a vandal. Yes, there are issues with you using multiple accounts like you are. Listed below are all inappropriate uses of multiple accounts, from the sock policy:

• Editing project space: Undisclosed alternative accounts should not edit policies, guidelines, or their talk pages; comment in Arbitration proceedings; or vote in requests for adminship, deletion debates, or elections.
• Contributing to the same page or discussion with multiple accounts: Editors may not use more than one account to contribute to the same page or discussion in a way to suggest that they are multiple people. Contributions to the same page with clearly linked legitimate alternative accounts is not forbidden (e.g. editing the same page with your main and public computer account or editing a page using your main account that your bot account edited).

• North Park Secondary School - 2 minutes in between edits
• Beer in the Czech Republic - 3 days in between edits

• Avoiding scrutiny: Using alternative accounts that are not fully and openly disclosed to split your editing history means that other editors may not be able to detect patterns in your contributions. While this is permitted in certain circumstances (see legitimate uses), it is a violation of this policy to create alternative accounts to confuse or deceive editors who may have a legitimate interest in reviewing your contributions.

Since there is no declaration on your userpage that these are alternative accounts, I had to file an SPI. -- DQ (ʞlɐʇ) 08:38, 26 May 2013 (UTC)

Was this discussed with the editor before the SPI? Peter James (talk) 16:48, 26 May 2013 (UTC)

No, there isn't a requirement to do so either. -- DQ (ʞlɐʇ) 17:00, 26 May 2013 (UTC)

I can understand that there isn't a requirement in all cases, but it's just something I thought would have been done routinely where an account is not obviously used (or intended) disruptively. There can be cases where two editors in a household are identified as sockpuppets, or an alternative account is used for privacy, and one editor's identity is already known (not necessarily on Wikipedia), resulting in outing. Peter James (talk) 17:49, 26 May 2013 (UTC)

I do occasionally ask the user before I post, it just depends on the circumstances. In this case 6k edits under the screen of "for privacy reasons" is a little excessive. You would use the account as it's needed, not for normal vandalism work or nominating items for deletion left and right. The people in the same house theory was shot down by the CU results, which I'm not going divulge here for my own sake. Also, if he didn't want a privacy issue, there is the clean start option. Another option would to have been to tell a trusted admin, functionary, or arbcom member enough details not to reveal his privacy but for his need to use such accounts. So with the amount of red flags raised here, I didn't ask questions first. -- DQ (ʞlɐʇ) 21:15, 26 May 2013 (UTC)

Not everyone thinks it's necessary, or trusts people enough - information has leaked from Arbcom before. And if the information was provided, wouldn't it be necessary to ask the editor which trusted admin, functionary, or arbcom member to contact to verify that the accounts have been disclosed? Peter James (talk) 22:01, 26 May 2013 (UTC)

Yes, information has been leaked before. That's why I mentioned the other available options (such as clean start), it's not like he is restricted to one method, it's the fact that he did not use any of them. If he did decide to disclose the second account to someone else, then yes that person would have to verify in public or in private that they were disclosed. -- DQ (ʞlɐʇ) 07:58, 27 May 2013 (UTC)

Hello, AmandaNP. Please check your email; you've got mail!
It may take a few minutes from the time the email is sent for it to show up in your inbox. You can remove this notice at any time by removing the {{You've got mail}} or {{ygm}} template.

MSJapan (talk) 21:31, 28 May 2013 (UTC)

Replied, I'll try and pickup on your reply as fast as possible. -- DQ (ʞlɐʇ) 12:49, 29 May 2013 (UTC)

Reywas92 (talk · contribs) is caught in your block of 137.132.250.13 as an open proxy. Editor since 2006, clean block log - OK to give him IPBE? JohnCD (talk) 09:39, 29 May 2013 (UTC)

nslookup for unblockme.dyndns.org shows that the IP for that URL is no longer 137.132.250.13. ​—DoRD (talk)​ 12:10, 29 May 2013 (UTC)

(edit conflict)(talk page stalker) Actually, the IP doesn't look like it's functioning as an open proxy any more. It looks like a web caching forward proxy for the National University of Singapore now. Furthermore, 137.132.82.94, the IP now pointed to by unblockme.dyndns.org, does not respond to attempted connections. Reaper Eternal (talk) 12:16, 29 May 2013 (UTC)

Are you sure about that? I'm not. Data I have here indicates 137.132.250.13 is an HTTP proxy on 8080. I can't seem to connect to it though. --(ʞɿɐʇ) ɐuɐʞsǝp 12:17, 29 May 2013 (UTC)

I can't even get an ACK from port 8080. Reaper Eternal (talk) 12:45, 29 May 2013 (UTC)

The port is filtered so that's not surprising. However, since I never managed to connect to it, I think it's pretty questionable whether or not it's functioning as an open proxy. --(ʞɿɐʇ) ɐuɐʞsǝp 13:44, 29 May 2013 (UTC)

As far as I'm concerned, the proxy I originally found is not around anymore, so since I can't do proxy checks (stupid ISP :/) I'll leave it up to you guys to figure it out, but I haven't been able to get anything off that IP. But feel free to modify the block or even unblock it if it seems appropriate. -- DQ (ʞlɐʇ) 12:48, 29 May 2013 (UTC)

I have given the user IPBE, as he found this morning that he was blocked again. JohnCD (talk) 09:34, 1 June 2013 (UTC)

Sorry to be counter productive, but I unblocked the IP and revoked the IPBE as he doesn't need it anymore. -- DQ (ʞlɐʇ) 13:31, 1 June 2013 (UTC)

Thanks! Reywas92^Talk 15:35, 1 June 2013 (UTC)