Requests for comment/Global IPBE guidelines

The following request for comments is closed. The request was closed as being unsuccessful.

Preamble

The global IP block exemption (global IPBE, or GIPBE) is a global permission that can be assigned to a user by stewards. The only guidance this permission is procedural in nature: Global IP block exemptions specifies that this permission should be requested on Steward requests/Global permissions or by emailing the stewards' listserv. It does not provide any guidance as to how stewards should decide whether or not to give this permission to a user, nor does it specify whether and how the permission may be revoked.

In this request for comments, a guideline is proposed for the assignment and revocation of the global IPBE permission.

Background

IP Block Exempt (IPBE) permission allows a logged-in user to bypass IP blocks that are also applicable to registered users. Global IPBE permission allows a logged-in user to bypass a global (but not a local) IP block of this kind.

Global IP blocks that extend to registered users are typically only issued for one reason: to prevent abuse of proxies. Stewards globally block IP addresses that are associated with open proxies, VPN providers, hosting providers (including cloud providers such as Amazon Web Services, etc.) and so on. By issuing a global block, they make sure that on every WMF project, including those without a CU or a large administrator group, abuse of proxies is minimized.

Because of the above, local WMF wikis tend not to replicate those blocks locally. When a steward blocks the /16 range associated with, say, Amazon Web Services, there is little incentive for local admins of every single project to also replicate that block locally. After all, they assume the global block will extend to their wiki too (which is exactly the purpose for the global block feature to exist).

If a user on abcwiki (e.g. enwiki or dewiki) has a legitimate reason to bypass the IPBE, they can request it locally on their home wiki. However, if they are active on many wikis, it may be challenging to request IPBE on several local wikis. This is where the global IPBE right can come handy.

However, if a user on abcwiki knows that their local wiki will not grant them local IPBE permission (because their reason is not legitimiate), they can currently come to Meta and request global IPBE permission. While this will not have the identical effect to local IPBE permission in that any IP that is locally blocked would still require local IPBE permission for the user to be able to edit from it, given the point above (i.e. lack of replication of global blocks at the local level), the user will mostly be able to use proxy/VPN/the like on that local wiki. If a user in bad faith, this would allow them to evade local checkusers (CU) by hiding their real IP.

It is unrealistic to expect stewards to be able to accurately vet every user who request global IPBE permission without some guidelines. It is also unrealistic (and quite wasteful) to expect local wikis to replicate all global IP blocks. Therefore, a set of guidelines should be used to help stewards in deciding when to grant global IPBE permission requests and when to grant requests for removal of global IPBE permission from a user.

Of note, at the time of this writing some 1470 users have the global IPBE permission. At least some of these users are only active on a handful of projects.

The proposed guideline, once approved, will be added to Global IP block exemptions in a section with header "Guidelines".

Proposal

Global IPBE permission is meant to be given only to users in good standing who are active across many wikis. A user requesting global IPBE permission should provide evidence that their editing ability across many wikis is affected by a global IP block.

Similar to the local IPBE permission, evidence of abuse of multiple accounts (also known as sock puppets) could be sufficient grounds to lose global IPBE permission.

Stewards will use their discretion in granting global IPBE permission to users. They will use the following guidelines as part of their decision making:

If a user is almost exclusively active on only one or a few projects, and all of those projects have an active local administrator group, the user maybe asked to first obtain local IPBE permission on those wikis.
- If a user is primarily active on one or a few projects and is requesting GIPBE to occasionally contribute to shared wikis i.e. Wikidata or Commons, stewards should consider the tradeoff between GIPBE versus project-specific IPBE on Wikidata and Commons.
If a user has been previously blocked on local wikis, especially for suspicion or confirmed abuse of sock puppet accounts, global IPBE may not be granted, or may be granted only after consulting the administrators and/or checkusers of the local wikis on which they had been blocked.
If a user with global IPBE is suspected to have abused this permission to purposefully hide their IP address for some or all of their edits on wikis with active checkusers, stewards may revoke the user's global IPBE permission. Local administrators or checkusers can also request the revocation of a user's global IPBE permission in such circumstances.
If a user wishes to hide their IP on a wiki with active checkusers and also has a legitimate use of the global IPBE permission, they should seek both local and global IPBE permissions. Evidence that a user has requested global IPBE permission to evade the local IPBE permission process can be grounds for revocation the global IPBE permission.
If a user's global IPBE permission is revoked by request of a local community, the stewards may require approval by that local community's administrators or checkusers before granting another global IPBE permission request by that same user.

Stewards should treat global IPBE as a temporary permission. Until temporary assignment of this permission is supported as a feature of the software, they may need to manually revoke the permission from the user at the designated deadline. A reasonable deadline may be the expiry date of the global IP block that impacts the requesting user.

Voting

Support I also propose to add another guideline asking stewards to grant IPBE always temporarily and at most for one year or two. The user right can be extended if necessary. I take the opportunity to inform the stewards that Internet in Iran is not as bad as in China, so please be stricter with users based in Iran. Thanks 4nn1l2 (talk) 09:06, 29 March 2021 (UTC)[reply]
Oppose as rule creep. Also dislike the idea that IPBE should be more strictly vetted (it should be given out more loosely, as many possibly good editors are subject to IP blocks), that it should always be temporary (hosting range IPs are likely indefinitely blocked), that editors should seek multiple local IPBEs, etc. If a user, for some reason by circumstance especially outside of their control, cannot edit freely, they should be granted IPBE with as minimal hassle as possible and never have to think about the issue again. ProcrastinatingReader (talk) 14:45, 3 April 2021 (UTC)[reply]
@ProcrastinatingReader: then how do you suggest we handle the situation in which sleeper socks completely ignore the local IPBE, come here and get GIPBE, then go back to their local wiki and edit via proxies only, thereby rendering local CUs unable to link them to their original account? The key issue with IPBE is it allows evading CU, so it should not be given out to sock masters. The key issue with GIPBE is it is being given out by users (stewards) who have little insight into sock behavior across hundreds of wikis, so cannot tell who is a sock and who is not. Our current setup allows for sock masters to evade local CU, and this almost happened on Persian Wikipedia recently. Huji (talk) 02:08, 6 April 2021 (UTC)[reply]
Evading CU is not difficult. Even ignoring the VPN rangeblocks + asking stewards method you seem to describe, there are plenty of ways to evade CU to the point where it surprises me that anyone actually gets caught by it.

If a particular local wiki has issues with the way stewards are handling IPBE, they could always do their own local blocks like en:User:ST47ProxyBot (or there could be an opt-out of GIPBE feature implemented into the software, if it's not already possible by overriding local permissions?). I just don't believe in making granting IPBE harder. IMO you'd be catching plenty of legitimate editors in the same net - perhaps even more legitimate editors than socks - who can't prove that they're not socks because they couldn't edit in the first place to become 'established editors in good standing' because their IP is blocked. ProcrastinatingReader (talk) 02:14, 6 April 2021 (UTC)[reply]
If this proposal fails, I will work on and opt-out for fawiki. Huji (talk) 00:49, 9 April 2021 (UTC)[reply]
Oppose: First of all, it is quite normal to upload an image to the Commons while editing. If a normal user who is globally banned does not have GIPBE, it is quite troublesome for him to apply for IPBE in every Wikimedia project he is working on. --Yining Chen (Talk) 15:00, 9 April 2021 (UTC)[reply]
Oppose Ehhhhhhh I don't think we need more rules for this. It works quite well at present. Vermont (talk) 01:15, 27 April 2021 (UTC)[reply]
Oppose huhh, rule creep, ribet, some doesn't even make sense. This is a solution looking for a problem. If someone is abusing proxies on a local wiki then those proxies should be locally blocked, don't need to create all this complicated process. Enjoyer of World (talk) 02:54, 30 April 2021 (UTC)[reply]
Oppose IP block exemption shouldn't be such a big deal; it's not like it's adminship.Jackattack1597 (talk) 17:40, 22 May 2021 (UTC)[reply]
Oppose Rule creep.--Vulp here 12:25, 25 May 2021 (UTC)[reply]
Strong oppose. IPBE really does little harm to others. SHB2000 (talk | contibs | en.wikivoyage | en.wikipedia) 23:58, 29 July 2021 (UTC)[reply]
Oppose as unclear and procedurally bureaucratic. Good-faith proposal, but from what I've observed, Stewards will already routinely request a user obtain a local IPBE first before requesting a GIPBE. It depends on the circumstances, of course. Anyway, the more interesting part of the rationale was that the proponent said local wikis do not routinely replicate global web host/open proxy blocks locally. As such, by this logic, it's being said that global administration of such IP blocks is preferred to local IP blocks, but this is counter to the whole Wikimedia philosophy/ethos of local control. In other words, nothing is stopping from local wikis from replicating global blocks locally. I'm sure they could probably host a local discussion on each wiki that calls for global IP blocks to be replicated locally on a regular cronjob or something. Dmehus (talk) 02:38, 4 January 2022 (UTC)[reply]

Discussion

The proposal was originally prepared by me, User:Huji. If you want to address a response to me, please ping me using {{Reply to}} -- Huji (talk) 01:42, 29 March 2021 (UTC)[reply]

Thanks for the ping, Huji:
I think it'd be good for the guideline to mention that GIPBE should preferably be assigned on a temporary basis (e.g. for one year with renewals as required, like it happens with global interface editors), and set some sort of inactivity criteria too for those cases where GIPBE was granted indefinitelly (e.g. any user with GIPBE who's absent/totally inactive for a full calendar year will get his GIPBE permissions removed). This is one of the main reasons for T153815 when it becomes a reality (/me suspires).
I also miss from the guideline a reference to an actual need for a GIPBE. My opinion is that if you ain't affected by a global IP block, you don't need GIPBE, no matter how trusted you are. While not in the letter of the policy/guideline, it's in the spirit of the IPBE permission that it exists only to fulfill a need.
Agreed with asking the users to seek preferably local IPBEs instead of global ones. Best regards, —MarcoAurelio (talk) 11:02, 29 March 2021 (UTC)[reply]

Thanks for the quick response, MarcoAurelio. I added a statement in the proposal to make it explicit that the requesting user should provide evidence that a global IP block is impacting their ability to edit several wikis. I also clarified that GIPBE should be treated as temporary; even though we don't have the convenicen of phab:T153815, we should still treat it as such. I know at least in the past, stewards would issue other temporary permissions and revoke them manually at the deadline. Huji (talk) 00:59, 30 March 2021 (UTC)[reply]
I personally do not think that there is a big need to create such guideline, although if there would be one adopted I would strive to follow it. I agree that there are clear cases such as when people requesting are living in a dictatorship, and not so clear cases when it is a trusted user who prefers to use VPN/Tor for some reasons either privacy or convenience (I've requested the rights for the latter reason myself in the past for example, as I do need to use VPN to access my personal Ukraine blocked Yandex mail, but I do not need VPN to access Wikipedia — I often forgot to disable VPN and faced IP blocks); also, even in the clear cases sometimes people do only edit a single wiki so there is sometimes a small discussion on whether local or global permissions fit better. But that being said, in my experience it always was regulated by common sense well, and I am afraid that formal guidelines might leave some legitimate cases off board while not really providing any great improvement. What is a bigger problem IMHO is the very fact that GIPBE is useless regarding local blocks, which is a real problem for contributors from dictatorships that want to edit many wikis. I have a draft RfC on this, Requests for comment/Global IPBE to cover local blocks too, but I haven't had enough time and energy to finish its preparation, perhaps someone is willing to jump in to help, I would only welcome that. --Base (talk) 11:47, 29 March 2021 (UTC)[reply]
@Base: thank you for the quick response. The need is not grave, but the guideline can still be helpful. The impetus for me was that a fawiki user bypassed local IPBE and requested (and was given) GIPBE without due process. See also Amanda's comment here where she, also, agrees that due process was not taken in giving out this GIPBE.

Regarding your comment that GIPBE is useless for local blocks, I would like to remind you that if we allow GIPBE to bypass local IP blocks, we would essentially attract more users to try to evade local IP blocks and local IPBE process altogether, by trying to convince a steward to give them GIPBE. I for one would be against making GIPBE bypass local blocks; if the idea ever gets widespread support, I would propose allowing certain projects to opt out of it and would assume the projects with active CUs and large administrator groups (including fawiki, and obviously enwiki) would want to be excluded from GIPBE. Huji (talk) 00:59, 30 March 2021 (UTC)[reply]
Would somebody simply tell me if these guidelines would make users from Mainland China harder to be granted Global IPBE flag? I had to TL;DR. IMHO Mainland users suffer from a dead loop of "can't edit multilingual wikis" -> "apply for GIPBE" -> "stewards decline because of low activity" -> "can't edit multilingual wikis". Maybe it's just too easy to grab that flag at zhwiki, but I'm afraid when a user is in need, no more barriers should be added to a process which is tedious enough, given the fact that most of us don't speak English. @Huji: --Super Wang hates PC _{You hate, too?} 08:14, 5 April 2021 (UTC)[reply]
@Super Wang: here is the TL;DR-ish explanation:
- If you are a user in good standing, are affected by IP blocks, and only intend to edit one wiki, then you should seek IPBE on that wiki.
  - If that wiki's local community is refusing to give IPBE and you think it is unfair practice, that is a separate issue and should be solved, not worked around using GIPBE.
- If you are a user in good standing, are affected by IP blocks, and intend to edit multiple wikis, you can ask for GIPBE instead of getting IPBE on individual wikis.
  - Multiple wikis does not mean "multilingual" wikis; if a user wants to edit Chinese Wikipedia and Chinese Wikisource and Chinese Wikibooks regularly, that is still a good justification for GIPBE versus three separate IPBEs.
- Under no circumstance, GIPBE should be given to a user who appears to be circumventing the local IPBE process. That is, if you have block histories on the local wiki, or admins or CUs of the local wiki report to Meta that you really are not using GIPBE to edit on multiple wikis, or that your original claim of being stuck behind an IP block is false and you have been editing freely from your actual IP address.
So in short, if you are a user in Mainland China, are interested in editing in a few WMF wikis, but cannot do so because of the effective IP block enforced by the Chinese government, and you are a user in good standing, you can apply for GIPBE and will most likely get it.

I guess your point is: what if this is a user who "wants" to edit in multiple wikis but still cannot because of the blocks; ie, the "chicken and egg" problem (you cannot request GIPBE without crosswiki edit history, and cannot easily have crosswiki edit history without GIPBE). That is why the guidelines emphasize that stewards will use their own discretion; these are guidelines, and stewards can disregard them using common sense. These are not hard and fast policies. Huji (talk) 12:35, 5 April 2021 (UTC)[reply]
If you're a user in mainland China, you can't edit in the first place, so how do you become a user in good standing who has a history to support their GIPBE app? ProcrastinatingReader (talk) 23:09, 5 April 2021 (UTC)[reply]
Maybe we can maintain a list of countries where Wikimedia projects are blocked, (I don't know if it's just Mainland China or not) provide a link to it, and add a provision to the proposed guidelines that states stewards may generally grant GIPBE to users contributing from those countries. There is also an alternative, that is, asking them to request locally, but I'm more supportive of the first approach since entangling newbies in the bureaucratic process of explaining the situation to different checkusers and administrators can be discouraging, and because they might have difficulty finding checkusers or admins on different projects in the first place. Ahmad^talk 02:47, 7 April 2021 (UTC)[reply]

Hi @Huji: I'm afraid you didn't get me; when I refer to "multilingual" wikis, I mean sites such as Wikidata, Commons and Wikispecies. From what you answered, I concluded that GIPBE could be granted at stewards' discretion; GIPBE is the very flag for us to edit those sites. Trouble is when an user who seldoms edits outside zhwiki wants to add a wikidata link and applys for Gipbe, they could be declined by stewards for "not having a good record on other projects". Also, I have the same question as ProcrastinatingReader. Maybe no better solution? --Super Wang hates PC _{You hate, too?} 01:52, 6 April 2021 (UTC)[reply]

Hi @Super Wang: you are correct; I did not get you the first time but now I do. I think if a user needs GIPBE for the reason you specified, they should first get IPBE in their home wiki and then ask for expanding it to GIPBE so that they can easily work in Commons/Wikidata. If they don't have IPBE at their home wiki, how are they editing there? Huji (talk) 02:04, 6 April 2021 (UTC)[reply]

Hi User:Huji, I think it's a great idea. But some user's home wiki isn't the one he/she usually work on. For example, I created my account on en.wikipedia, back when the ban on Wikimedia projects by (PR)China only effected some Sino-language wikis, but I usually work on zh.wikipedia, on which I have IPBE. I still haven't get the IPBE on enwiki yet, but I'm requesting it. Back to the point, my advice is, If a user needs GIPBE for the reason [...], they should first get IPBE on a Wikimedia wiki and have a number of edits on it (for instance, 200) and then ask for expanding it to GIPBE. -- regards, 羊羊32521 (talk) 12:36, 11 April 2021 (UTC)[reply]

@羊羊32521: great suggestion. I will update the proposal accordingly. Huji (talk) 12:47, 11 April 2021 (UTC)[reply]

First of all, I'm sorry I use machine translation, because my English is perhaps even worse than the machine, I am against the restriction of GIPBE, in the Chinese Wikipedia, many mainland editors use GIPBE to translate the content on other wikis and upload images to Commonwiki, if one by one, the time and effort needed to apply for gipbe is huge, for example, I, at present, only have zhipbe, I need friends to help me upload, which is very troublesome, so at present I am against the restriction of gipbe distribution. --Catowen (talk) 13:53, 9 April 2021 (UTC)[reply]

@Catowen: the machine translation was very easy to understand. I should clarify that this proposal does not intent to restrict GIPBE. It intends to help steward know what they should consider as they make their decisions. As far as Wikipedia editors from countries in which WMF projects are blocked, such as Mainland China, this proposal should not make any difference to the way stewards handle those requests. Huji (talk) 12:47, 11 April 2021 (UTC)[reply]

@Huji:(Per request for replying and translation by Catowen on w:QQ) The current policies followed by the stewards are acknowledged by all users and do not need to change unless necessary. Higher demand for the application of GIPBE is unnecessary and will add a burden to the new users. (Catowen didn't have IPBE on Meta, so he can not reply directly. He apologizes for it.)羊羊32521 (talk) 13:27, 11 April 2021 (UTC)[reply]

Thanks for translating, 羊羊32521.

The current policies may be just fine for users from China. However, they can cause issues when requesters are from other countries and this has happened at least once. The proposal above is *not* a policy; it is a guideline so that similar issues can be avoided or mitigated better. Huji (talk) 17:09, 11 April 2021 (UTC)[reply]