The Cunctator wrote: Yeah, that's definitely going to happen before this is implemented. Any suggestions for expiration time? This is not an arms race of hacker against hacker, it's an arms race of hacker against troll. Michael is using nothing more advanced than a web browser. You shouldn't think of this as some kind of technological cure-all, it is just a tool in sysops' arsenals, like the rollback button. Sure a vandal can log out, change their IP address and log back in again, but the moment they make a change to a page, a sysop can ban them again. This greatly increases the cost to vandals, and reduces the cost to us. That said, the worst-case scenario of a vandalbot is always in the back of my mind. This feature cuts off the simplest kinds of vandalbots, and slows down the more advanced ones, meaning that they cause less damage in the time it takes for a developer to respond. Anthere asked: That's a very good question. Currently the feature can't be turned on and off easily, but if you want I can easily fix it up so that it can be. -- Tim Starling <tstarlingphysicsunimelbeduau>

Jimmy Wales wrote: Yes, but then the terrorists would have won. -- Toby

"Dante Alighieri" &lt;dalighieri(a)digitalgrapefruit.com&gt; wrote in message news:5.2.0.9.2.20030903133745.02d3b748@digitalgrapefruit.com... Thing. we A sophisticated vandalbot would not be at all deterred by this protection. A well-written vandalbot would create a new, random username before every edit. It would never use the same name twice. If the attacker was at all aware of how our software works, it would probably concentrate on deleting images by uploading a dummy and then deleting the old revision. It would open multiple connections to the server, for greater speed. If this ever actually happens, then I would be in favour of implementing anti-bot protection when new users log in. In the meantime, I think we should have better protection for our images. At the moment they're deleted permanently and instantly. They should be moved to an archive instead. More regular backups would also be useful -- some method of backing up only those old and cur entries which have changed would be useful for this. I don't think we should be spending too much time on filters and other annoying security when we don't even have a decent backup system in place. I think if we can get it to the stage where the most a bot can do is lose us a few hours worth of edits plus say half an hour downtime, it won't be worth spending any more time on the problem unless it actually happens. -- Tim Starling <tstarlingphysicsunimelbeduau>