Yeah, the problem extends beyond the TFA due to the widespread use of these vandalised templates... On 19/12/06, James Hare <messedrocker(a)gmail.com> wrote:

The highly used meta templates should just be moved to {{hprotected}}, [[Category:Wikipedia protected edit requests]] never seems to have that much of a backlog if legit updates are needed. (e.g. I just added {{for}} to hprot). X ----- Original Message ----- From: "James Hare" <messedrocker(a)gmail.com> To: "English Wikipedia" <wikien-l(a)wikipedia.org> Sent: Monday, December 18, 2006 8:59 PM Subject: Re: [WikiEN-l] Main Page Featured Article

On 12/18/06, Tariq Ab- Jo- Tu- <tariqabjotu(a)gmail.com> wrote: Along those lines, we need to remember checkuser -- they can't review and block the source, if we don't let them know which usernames to check. The usual "block and move on" mentality won't quite cut it, in this case; there's an ongoing section at RFCU about all of this, and unfortunately the checkusers can't see everything. Rangeblocks have been slowing it down, but have not yet stopped it. We need to explore new options, including protection options for templates. As far as templates on TFA, is there consensus as to whether they should be semi or fully protected? We're obviously dealing with somebody smart enough to start using sleeper accounts, is what I figure, but I'm not sure how much they've done so, yet. Eh. This one is incredibly frustrating, to me. -Luna

On 12/19/06, Luna <lunasantin(a)gmail.com> wrote: Full protection, obviously. The incident last week where such vandalism was on the main page for fifteen minutes until it was found was by an established account, semi-protection wouldn't have stopped it; indeed the template that was affected *was* semi-protected at the time the vandalism occurred. -- Stephen Bain stephen.bain(a)gmail.com

On 12/19/06, Tariq Ab- Jo- Tu- <tariqabjotu(a)gmail.com> wrote: Of course, what I was intending to convey is that the type of vandalism we're seeing lately (using more complicated tricks of wikisyntax), of which that main page template vandalism was the clearest example, isn't something that can be defeated by semi-protection. -- Stephen Bain stephen.bain(a)gmail.com

On 12/19/06, Sam Korn <smoddy(a)gmail.com> wrote: The pages transcluded are already shown at the bottom of the edit page. I think we should have an additional feature (let's call it [[Special:Recentchangestranscluded]]) that shows all changes to templates used on an article (all levels of transclusion). Then we could easily spot the offending change and revert, block and ignore the vandal as quickly as we do for regular FA vandalism. The problem is not that penis vandalism happens on a page linked to from the Main Page (we are used to that, and do not protect the FA of the day), it is that finding out what exactly has happened and reverting it takes too long. We just have to make it easy to figure out how to revert the vandalism. Kusma

On 19/12/06, Ilmari Karonen <nospam(a)vyznev.net> wrote: It's a hassle, but I've done it. And last time, I picked up two bits of vandalism - clever css include things, too - which hadn't been reverted or protected against. We should have absolutely no qualms about full-protecting templates used in high-profile pages or across a large number of pages. I would say that at least a third of the vandalism complaints we get can be traced to these. -- - Andrew Gray andrew.gray(a)dunelm.org.uk

Steve Bennett wrote: You're wrong. Subtle vandalism isn't prevented by a time delay. -- Alphax - http://en.wikipedia.org/wiki/User:Alphax Contributor to Wikipedia, the Free Encyclopedia "We make the internet not suck" - Jimbo Wales Public key: http://en.wikipedia.org/wiki/User:Alphax/OpenPGP

Steve Bennett wrote: <snip> [[MediaWiki:Bad image list]] does this, but in this case they were uploading the images they were using. -- Alphax - http://en.wikipedia.org/wiki/User:Alphax Contributor to Wikipedia, the Free Encyclopedia "We make the internet not suck" - Jimbo Wales Public key: http://en.wikipedia.org/wiki/User:Alphax/OpenPGP

On 12/19/06, George Herbert &lt;george.herbert(a)gmail.com&gt; wrote: Naively substituting all templates used on a given page isn't viable imho - some templates would subst into a huge, ugly mess of code. What I was attempting to suggest before was taking something like this: {{infobox foo| aoeuoae| oaueoau| ... }} and substituting it into a temporary template, then replacing that in the page code: {{_tfa_infobox foo| aoeuoae| oaueoau| ... }} It's a bit of work to organise (every template used on the page has to go through this protection mechanism), but has the advantage that the effect on the code in the page itself is minimal: every instance of {{ is replaced by {{_tfa_, and then vice-versa after the page is no longer TFA. Steve

On 12/18/06, Luna &lt;lunasantin(a)gmail.com&gt; wrote: Responding to you and Steve here... I would assume that this would be a temporary subst; that we'd essentially freeze the page prior to TFA move, make a completely subst'ed version, protect that, have it up for the day, and then do a revert to the immediately prior version as soon as it's done being TFA. It doesn't really matter if it's terribly ugly for a while; the freeze is intended to keep it from being malignly modified. This does make TFA temporarily not-editable, which people have objected to, but I don't know that doing so is necessarily a bad thing given the ongoing highly visible vandalism problem. How many tens of thousands or hundreds of thousands of visitors have gotten penis pictures so far? 8-( -- -george william herbert george.herbert(a)gmail.com

On 12/18/06, David Gerard &lt;dgerard(a)gmail.com&gt; wrote: I don't like my answer, either. It's certainly not great. Fundamentally, the problem is that we're having some growth pains resulting in problems which tend to put goals such as "Be a great encyclopedia" in conflict with goals such as "Which everyone can always edit". I am tending towards the opinion that, as unfortunate as it is, the Featured Article has become an Attractive Nuisance. Legally, in the US, it's normal to assume that the owner of an attractive nuisance bears responsibility to put a fence around it and keep it from hurting people. I don't like that conclusion, but that's where I'm leaning. I think that it's going to come down to a balance of lesser evils. I am interested in seeing what everyone else thinks about it. Something that occurred to me a bit ago... We could both freeze and not-freeze the featured article, with a bit of effort. We could create a new name heirarchy (wiki/Featured Article/article-name) and drop a subst'ed version of the page, protected, down into that subpage, with a link to the "live" wiki article there if people want to see how it may have improved over the course of the day. If there's bandwidth available, someone could repeat the process (create an updated frozen subst version from the live wiki page) every hour or two during the TFA run, so it doesn't even have to be fixed as of the beginning of the day. This doesn't take any new technology, just a few subpages and a bit of procedure... -- -george william herbert george.herbert(a)gmail.com

On 12/19/06, George Herbert &lt;george.herbert(a)gmail.com&gt; wrote: I'm fairly sure that you've just described exactly what is to be implemented when Stable Versions go online, which we have been told since Wikimania is Real Soon Now.

Rich Holton wrote: Not without some fairly significant controversy. -Jeff

Rich Holton wrote: Both, really. We still can't get a protection on the main page without people throwing a fit about it, and a couple attempts at stable trial runs didn't exactly go well (although the person who decided to try it probably wasn't the best choice). I think we're merely going to have to look into the protection of problem templates used on the main page. That's where we're having the problem, and protecting them doesn't remove the ability to edit what's seen in front of people. -Jeff -- If you can read this, I'm not at home.

On 12/19/06, Luna &lt;lunasantin(a)gmail.com&gt; wrote: If you just want to recursively transclude all templates, there is a page for that, [[Special:Expand templates]]. This will transform all template code into static wikicode (including dynamic stuff like {{#if}}s and dates and whatnot). It tends to produce a heck of a lot of wikicode though.

On Tue, 19 Dec 2006 06:49:11 +0100, "MacGyverMagic/Mgm" &lt;macgyvermagic(a)gmail.com&gt; wrote: The obvious is never a problem, as my dad always says. Guy (JzG) -- http://www.chapmancentral.co.uk http://en.wikipedia.org/wiki/User:JzG

There have also been suggestions of communicating with the vandal's ISP. Should that just take place, instead of us trying to figure out how to preempt the vandal?

George Herbert wrote: Given that that particular vandal was originating from a totalitarian police state[1], I'd say that reporting them to their ISP would be a Really Good Disincentive against future vandalism. [1] I don't plan on going there any time soon. -- Alphax - http://en.wikipedia.org/wiki/User:Alphax Contributor to Wikipedia, the Free Encyclopedia "We make the internet not suck" - Jimbo Wales Public key: http://en.wikipedia.org/wiki/User:Alphax/OpenPGP

The main page vandalism problem is becoming a reason why I'm becoming reluctant to submit articles to WP:FAC or strive for that as my goal. And, I'm aware of other featured articles where the author(s) have understandably expressed wishes that the article not be showcased on the main page. {{subst}}ing the templates is worth doing, though perhaps not enough to address concerns. I'm not sure what the best, technically feasible option is...

Steve Block wrote: Or resurrect the middle option, like the idea of giving trusted users the rollback function. Even trusted users wouldn't get the admin bit if it were loosened, but would be perfectly trusted to have access to something like that. -Jeff -- If you can read this, I'm not at home.

Thomas Dalton wrote: Yeah, but if it was on a voluntary basis, it wouldn't be that much work after the initial rush. Not every trusted user would want/need access to templates, for instance. -Jeff -- If you can read this, I'm not at home.

On Wed, 20 Dec 2006 17:53:32 +0000, "Thomas Dalton" &lt;thomas.dalton(a)gmail.com&gt; wrote: The real problem here is that trusted users should be given the sysop bit and are not. No big deal? Not these days. Guy (JzG) -- http://www.chapmancentral.co.uk http://en.wikipedia.org/wiki/User:JzG

On 12/21/06, Guy Chapman aka JzG &lt;guy.chapman(a)spamcop.net&gt; wrote: Yes. Put differently, we lack a middle ground. Admin is too powerful to give to everyone. But there's nothing to give to our trusted users. Steve

On 12/21/06, Chris Picone &lt;ccool2ax(a)gmail.com&gt; wrote: Adminship lets you do lots of very different things, including protecting/unprotecting, accessing deleted revisions of pages, deleting pages, blocking users, rollback, modifying protected articles, templates, and stylesheets and more. This range of powers is so diverse that it's hard to even imagine one person actually needing them all. And that can be a problem: we have users who would make great vandal fighters, but would you really want them with write-access to the front page, or read-access to sensitive deleted revisions? Steve

On 12/21/06, geni &lt;geniice(a)gmail.com&gt; wrote: Yep. Know anyone who has used all of them? Steve

On 12/23/06, Steve Bennett &lt;stevagewp(a)gmail.com&gt; wrote: I haven't edited [[MediaWiki:Monobook.css]] or [[MediaWiki:Common.css]], etc, although I have edited other MediaWiki pages in addition to doing everything else in that list. I've also undeleted pages, unblocked users, and used [[Special:Unwatchedpages]]. I can't remember if I've ever moved a move-protected page, although I'm fairly certain I haven't hidden the contributions of any vandals from [[Special:Recentchanges]]. Over the course of time a reasonable active admin will use all of the buttons at some point or another. How big a deal each of them are varies. The original admin work, the janitorial stuff, really is no big deal and never has been. However as WP has scaled, a greater amount (though not, IMHO, a greater proportion) of work can be a big deal. Certain types of deleted content, blocks in certain circumstances and so forth. -- Stephen Bain stephen.bain(a)gmail.com

Steve Bennett wrote: Admins can: * Delete, restore, view deleted revisions * Protect and unprotect on various levels, edit protected * Edit global interface (MediaWiki: namespace) and user interface (User: space .js and .css files other than their own) * Block, unblock users, IPs, IP ranges * Rollback, rollback with bot parameter to remove from RC This is from a technical point of view; the combination of these things just makes it look like they can do a whole lot more. -- Alphax - http://en.wikipedia.org/wiki/User:Alphax Contributor to Wikipedia, the Free Encyclopedia "We make the internet not suck" - Jimbo Wales Public key: http://en.wikipedia.org/wiki/User:Alphax/OpenPGP

On 12/21/06, geni &lt;geniice(a)gmail.com&gt; wrote: Remember that the issue at hand is main page/featured article template vandalism, and there are ways to deal with that that don't require this can of worms to be opened, let alone answered, first. -- Stephen Bain stephen.bain(a)gmail.com

On 12/21/06, George Herbert &lt;george.herbert(a)gmail.com&gt; wrote: The potential for it to be a very big deal indeed on the occasion is enough to make it a big deal. -- geni

On 12/21/06, Steve Block &lt;steve.block(a)myrealbox.com&gt; wrote: Hell no. There are too many templates which need too much maintenance. There's no reason for navigation boxes to be protected like that, and they do get updated fairly often. Restrictions on what can go into an unprotected template might be worth pursuing though. Steve