Commons:Administrators/Requests/タチコマ robot

 Bureaucrat note: Nomination was withdrawn, closing as unsuccessful. odder (talk) 10:51, 26 November 2016 (UTC)

タチコマ robot

Vote

タチコマ robot (talk · contributions (views) · deleted user contributions · recent activity (talk · project · deletion requests) · logs · block log · global contribs · CentralAuth)

Scheduled to end: 19:52, 24 November 2016 (UTC)

Hello, I am seeking an admin flag for my bot "タチコマ robot". I am an admin myself. The bot used to have an admin flag but it was removed when I resigned non-controversially myself. It would not make sense to let the bot keep the sysop flag when the operator resigned.

The intended function of the bot's admin flag would be to mainly edit protected pages but also to deal with bulk admin actions (such as mass deletions and undeletions based on consensus). The main intention of separating bulk/scripted admin actions like this is to allow mitigation of any issues that can emerge (as unlikely as it is) should there be an issue.

-- とある白い猫 ^ちぃ？ 19:52, 17 November 2016 (UTC)

I am pretty much withdrawing my request. I will run the bot as is where it will process thousands of pages. If it hits protected pages it will simply ignore them. The community can figure out a way to deal with these leftover pages. I will NOT make any attempt in notifying the community or editing these pages myself. I am not bitter or angry, I simply do not want to spend a significant amount of time for something the bot would have dealt with within seconds. -- とある白い猫 ^ちぃ？ 12:13, 24 November 2016 (UTC)

Votes

•  Support --Thibaut120094 (talk) 19:56, 17 November 2016 (UTC)
•  Support ok but in my opinion a simple request to the crats should be sufficiant for something as trival as this. Natuur12 (talk) 20:09, 17 November 2016 (UTC)
  •  Oppose Sorry but Krd does have a point and we had a user in the past who used a bot to delete bulk stuff which let to great trouble. Natuur12 (talk) 12:47, 18 November 2016 (UTC)
•  Support --Yann (talk) 20:27, 17 November 2016 (UTC)
•  Support lNeverCry 20:29, 17 November 2016 (UTC)
•  Support, uncontroversial, no RFA needed, in my opinion --Sebari – aka Srittau (talk) 20:31, 17 November 2016 (UTC)
•  Support if neeeded. Nick (talk) 21:16, 17 November 2016 (UTC)
•  Support - not sure whether this RFA is really needed, but maybe it's the safest way to prevent problems later - Jcb (talk) 23:17, 17 November 2016 (UTC)
•  Support no problem --Hedwig in Washington ^(mail?) 02:36, 18 November 2016 (UTC)
•  Oppose for the moment, see below. Not shown that the bot needs sysop rights for its regular tasks at reasonable amount, and not shown why manual bulk tasks cannot be done with the main account. --Krd 12:03, 18 November 2016 (UTC)

  @Krd: We do have several fairly large COM:DEL cases from time to time that require bulk deletion or undeletion. I can certainly run pywikibot scripts under my main account, but in doing so makes mitigating the issue harder if something goes wrong as unlikely as that is. I believe we should discourage such unauthorized use of automation under human accounts where it would be noisy as well. Also this way automated actions are clearly marked. It is not like I will run such tasks all the time. If a bot makes an error, I still need to resolve the issue. That is the bear minimum responsibility we expect from bot operators. -- とある白い猫 ^ちぃ？ 15:26, 18 November 2016 (UTC)

  Please elaborate why doing so makes it harder mitigating mistakes, or why automated actions are marked more clearly. I don't see that. --Krd 16:00, 18 November 2016 (UTC)

  If an automated edit is committed by a bot account, by very nature it will be marked as such. If a mistake happens, you only need to look at deletions by the bot which will exclusively be the bulk actions. Probably the only ones that day, week or month which you can identify with a simple quarry query without relying on edit summary or other hack. Say you are mass deleting/undeleting 100 files, you may commit other deletions in that time frame while reviewing other COM:DEL cases which can easily be a mess. If bot needs to process hundreds of thousands of pages, due to a non-controversial categorization, that one in 60 ratio would be a lot of trouble. It does not happen always but when it does, this way it is dealt with trivially. -- とある白い猫 ^ちぃ？ 16:27, 18 November 2016 (UTC)

  I cannot follow. When you close a DR all the affected files are listed at the DR page, so no need to look anywhere else, even in case you have to restore all of them. Categorization is a totally different thing than deletion, and I don't see any 1:60 ratio proven to justify sysop rights here. Sorry, I have the impression the same weak arguments reappear here now that have been found wrong or irrelevant in the previous discussion. --Krd 17:30, 18 November 2016 (UTC)

  That is if they are listed. "Delete everything in category foo" or "delete everything tagged with license template bar" or "Delete all uploads by grill" type nominations do exist where individual files are not listed. Once deleted, going back and trying to find the list is non-trivial. You can parse the deletion log summary but that isn't ideal IMHO.

  You will not get a strong argument from me, that is NOT the point of this nomination. This isn't something critical or vital. Commmons won't break regardless the outcome. It is more of a matter of convenience and efficiency.

  What you are suggesting is:

  • You want to require humans to deal with a task that can be automated without issues (in the case of protected pages). Mind you these are tasks bots normally deal with if pages aren't protected. There is nothing to supervise here.
  • You want to flood the RC feed when a bulk action is taken by the human account which would be hidden otherwise.
  • You want people to run automated scripts under their human account instead of a bot account. I recognize some people already do this. I feel that should be discouraged as this is the very point we have bot accounts. Why even bother with bot accounts and flags otherwise?

  -- とある白い猫 ^ちぃ？ 18:03, 18 November 2016 (UTC)

  You still mix up editing with deleting, which are totally different things. Editing should be done by bots to hide it from RC and watchlists, and editing of protected pages should be done with maximum care and should be done manually if reasonably possible. Deleting will not be hidden from RC and watchlists in any case, so the bot flag is irrelevant here, and there is not any need to do this with a bot account and mix it up with other automated bot tasks. You are of course free to disagree. --Krd 06:22, 19 November 2016 (UTC)

  Protected pages are nothing special. I really do not follow your logic. What about bot edits give less than maximum care? Unlike a human bot will perform the task exactly as it is programmed. Humans on the other hand are more prone to making errors. When dealing with non-controversial tasks I do NOT want to deal with the same task a second time just because the page is protected. -- とある白い猫 ^ちぃ？ 16:20, 19 November 2016 (UTC)

  Which does apply to all bots. Do you suggest all bot should get sysop flag just in case they have to edit a protected page? --Krd 07:17, 20 November 2016 (UTC)

  As always it is a case by case basis, this RfA does not set a precedent, this isn't a court. For instance you need to take the bot edit count into account. If a bot edit few pages every so often, this may not be needed. If the bot makes hundreds of thousands of edits (like this one), those few pages adds up to quite a lot. We should prefer bots editing protected pages over people when relevant. -- とある白い猫 ^ちぃ？ 21:01, 20 November 2016 (UTC)

  I'm slightly confused, is Krd suggesting running a deletion bot on とある白い猫's main account, and only bothering to have a bot account when editing tasks would flood watchlists and RC feeds ? Why bother having bots and a bot policy at all in that case ? Nick (talk) 16:41, 19 November 2016 (UTC)

•  Oppose Sorry, but i agree with Krd. --Steinsplitter (talk) 18:06, 18 November 2016 (UTC)
•  Oppose I was about to support this request because the operator is an admin and this bot was granted admin rights before, which would make me trust giving this bot admin rights again, but Krd makes a good point above. Sorry. --★ Poké⁹⁵ 03:18, 19 November 2016 (UTC)

  @Pokéfan95: Which point is this? -- とある白い猫 ^ちぃ？ 16:20, 19 November 2016 (UTC)

•  Support - Easy support of 2016 so far!, If the bot operator is an admin then it makes sense to upgrade their bot to admin status too, I see no valid reason to oppose. –Davey2010^Talk 14:56, 20 November 2016 (UTC)
•  Support per Nick --Zhuyifei1999 (talk) 18:08, 20 November 2016 (UTC)
•  Support Taivo (talk) 09:53, 23 November 2016 (UTC)
•  Somewhat mild oppose per Krd. The only substantial benefit I can see would be the automation of restoring files in deleted categories... I don't think that's such a frequently tedious task that granting the bot a sysop bit is needed. Storkk (talk) 11:00, 23 November 2016 (UTC)
•  Oppose per Krd --Didym (talk) 16:32, 23 November 2016 (UTC)
•  Oppose for now per Krd. Trijnstel_talk 22:44, 23 November 2016 (UTC)
•  Oppose as less as possible bots should have Admin rights. If they have, the cause should be clear and good. Marcus Cyron (talk) 04:25, 24 November 2016 (UTC)

Comments

 Question I am unsure of the procedure here, why is an RFA needed for an administrator to grant the sysop rights to a legitimate sock account? If bot approval is needed to confirm that its scope and rights needed are suitable, there is a bot approval process for doing that. Please do not set a precedent by using an unnecessarily bureaucratic procedure. --Fæ (talk) 20:37, 17 November 2016 (UTC)

Only crats can actually 'grant' sysop rights... admins cannot. Revent^talk 02:18, 18 November 2016 (UTC)

I'm also not sure whether an RfA is the best procedure here, possibly a bot request could be more appropriate. I'd not say the flag should be handed out without any procedure, as e.g. I can imagine some questions, see below. --Krd 06:28, 18 November 2016 (UTC)

I am open to all options if we can agree on a process. -- とある白い猫 ^ちぃ？ 09:12, 18 November 2016 (UTC)

 Question Which tasks are intended to be done with sysop rights, and why are they not being done from the main account? Can you give one or two examples? --Krd 06:28, 18 November 2016 (UTC)

• Any mass deletion or undeletion, I have dealt with a few bulk nominations myself and it is rather time consuming. I would close such nominations with the bot
• There also are cases where bot needs to deal with protected pages such as during re-categorization or while processing double redirects.

-- とある白い猫 ^ちぃ？ 09:12, 18 November 2016 (UTC)

Referring to your request for Global Editinterface, see: [1] (archivelink to closed discussion), how often does it happen to deal with protected pages for the mentioned tasks? --Krd 09:36, 18 November 2016 (UTC)

It is common enough, on commons wiki, protected double redirect pages accumulated over time. There were two or three dozen of them for example. I dealt with them in the past. On en.wikipedia, I recently ran my bot to fix the CIA Worldfactbook links which was a trivial find and replace task. There were around 60ish article namespace pages and total about 1,100 entries on rest of the site. Of those pages, the bot worked on there were IIRC 3 that needed to be handled by an admin. So 3 out of 60 in that specific case. While it isn't very common, it is common enough that I'd rather let the bot deal with it. We frequently protect files if they are going to appear on main pages for example. These file descriptions may need to be updated in bulk (along with other files).

As for the editinterface permission, there is a case of truthiness (perception of truth not based by facts) that double redirects are not a problem. I do not want to discuss this at this point since that entire discussion is baffling.

-- とある白い猫 ^ちぃ？ 15:16, 18 November 2016 (UTC)

Just to give a specific example, I recently re-licensed all media from change.gov with a new template which included the file File:Official portrait of Barack Obama.jpg which is indefinitely protected (since 18 August 2014) at the moment. I ran the bot on all other pages from change.gov. Such trivial find & replace tasks are better run by bots than humans as humans are more error prone. -- とある白い猫 ^ちぃ？ 15:47, 18 November 2016 (UTC)

I don't see why this requires an admin bot. As you have to start the job manually anyway and check some samples anyway, it doesn't matter to edit one or two protected pages by hand. Maybe you want to edit them by hand in any case, to check the reason for the protection and see if the edit is appropriate regarding the context of the protection. --Krd 15:55, 18 November 2016 (UTC)

It isn't required. I do not see why you want me to spend human time for something that a bot is better suited for. I am more likely to leave them broken if I am distracted for whatever the reason. I would not normally review such protected pages since the task is a simple find and replace (categorization, urls etc) which can be run unsupervised. We tend to protect file pages more for abuse or potential abuse or heavy use. In all those cases actions of the bot would not disrupt anything since the actual file itself isn't modified. -- とある白い猫 ^ちぃ？ 16:27, 18 November 2016 (UTC)

 Question At which system will the bot be run, what about password security? --Krd 06:28, 18 November 2016 (UTC)

• I primarily rely on python based pywikibot but also AWB (typically with custom find and replace tasks)
• I already use a fairly complex password for the bot, with 2FA this would improve as well, although I am uncertain if either platform has adopted it just yet.

-- とある白い猫 ^ちぃ？ 09:12, 18 November 2016 (UTC)

So the bot is running at your own machine at home or something similar, not e.g. at WMF Labs or another public place? --Krd 09:36, 18 November 2016 (UTC)

Chipping in as I've just been looking at the 2FA issues with respect to bots. This is a complex area, where best practice is yet to be recommended, and more the sort of discussion that fits with bot approvals but not RFA.

OAuth works with Pywikibot, but not AWB, and incongruously BotPasswords work with AWB and not Pywikibot (at least not without a local hack to the modules). The "advantage" of BotPasswords is that limited rights can be granted to the bot account, so if hacked it's not a disaster. Unfortunately if you are granting sysop rights to the bot, then that's worrying as it bypasses the current recommendation of the WMF of using 2FA for all sysop accounts, and so the bot account may become a target for hackers precisely for this reason. I would recommend sticking to Pywikibot if a bot account is to control deletions, the OAuth setup simply means registering for credentials and adding these to the local user-config, and the account should be at least as secure as the 2FA system; though the WMF has yet to comment directly on this. Refer to mw:Manual:Pywikibot/OAuth and m:Special:OAuthConsumerRegistration.

With regard to running on WMF labs, it is acceptable use OAuth on a labs account, but the file holding the credentials must be set as user only read access. Similarly if a local machine is running the script, it is sensible to presume it is not secure, especially if using cloud backup; so again secure read access settings should be applied and other copies of the credentials kept secure (i.e. not as plain text files in a Google drive or Dropbox account). --Fæ (talk) 10:04, 18 November 2016 (UTC)

I run the bot locally, not on a shared system. Bot has a password that is over 30 characters of random letters, symbols numbers etc. -- とある白い猫 ^ちぃ？ 15:16, 18 November 2016 (UTC)

That's good, however as sysop accounts have been actively targeted and accounts with complex passwords have been hacked (there's yet to be an official confirmation of how), we have to presume that 2FA with the use of OAuth should be the new best practice for sysop accounts, including bot accounts with sysop rights. I'll think about raising this elsewhere, as we could do with an appropriate wider community discussion. --Fæ (talk) 10:27, 19 November 2016 (UTC)

It makes no difference if it is a bot account or human account. -- とある白い猫 ^ちぃ？ 12:22, 24 November 2016 (UTC)

I agree. I have nudged the general request for better information from the WMF and specifically added mention of BotPasswords. See Phab:T150605. --Fæ (talk) 12:24, 24 November 2016 (UTC)

 Question I'm leaning towards being persuaded by Krd... could you please offer some more examples of edits that the bot would perform that would be difficult to acheive with VFC using your main account? Storkk (talk) 14:26, 22 November 2016 (UTC)

• It would be just additional (and pointless) work for me. I am NOT inclined to run secondary scripts such as VFC (I am not familiar with it) in dealing with bot edits. Human accounts are not meant to be used for bot edits. I am more inclined to run the bot processing pages in bulk and ignoring protected pages. Humans can figure out where those pages are and what edits needed to be done on their own. It would be like dealing with the needle and haystack on a situation the bot could have dealt within seconds had it had the ability to edit protected pages.
• An example I would suggest is the official portrait of Obama: File:Official portrait of Barack Obama.jpg. This is one of the heavier used file with higher visibility on many wikis and beyond. It ran into a problem when its source change.gov was taken down. I scrambled recently to re-license all media from transition sites where I replaced the standard CC-by template with the one that has a notification pointing to change.gov's archived copyright notice. Without this the copyright notice on the page establishing license was gone. The bot wasn't able to edit this file because it was protected. So I would have had to review hundreds of pages to figure out which file the bot skipped and also spend the time to manually edit the page. Some of the work the bot did, involved modifying tens of thousands of file description pages.
• I am pretty much done looking at this discussion. Feel free to notify me on my talk page if you have questions. I do not mind answering them, I just do not see much of a point in participating here since people seem to base their opinion above on truthiness (perception of truth not based by facts). It does suit this year to be honest.

-- とある白い猫 ^ちぃ？ 12:10, 24 November 2016 (UTC)