Page MenuHomePhabricator

Include proxy information from IP Information tool as conditions in Abuse Filter extension
Closed, DuplicatePublicFeature

Description

Feature summary (what you would like to be able to do and where):
Allow Edit Filter Managers and Helpers to use proxy information from IP Information tool to be used a conditions, e.g.:

if (ip_behavior == FILE_SHARING) 
  disallow editing

If possible, can one include the details in Behaviors, RIsks, Connection types, Tunnel operator, Proxies from the info tool?

image.png (439×952 px, 56 KB)

Use case(s) (list the steps that you performed to discover that problem, and describe the actual underlying problem which you want to solve. Do not describe only a solution):

  • check if ip address exhibits proxy like behaviours. if yes, disallow ip address from editing on administrative pages.

Benefits (why should this be implemented?):
No open proxies is a global policy, but the enforcement of it is poor due to how dynamic the industry is right now. There are services offering millions of residential IP addresses as proxied IP now, unlike in the past when services largely operates servers running on known/easily discoverable IP addresses.

On enwiki, this was implemented using bots (recently, ST47ProxyBot). However the bot has stopped working due to a disinclination by the operator to continue to run as it is since there are data feeds that we rely on now, as evidently seen on the IP information tool. The bot would also generate millions of the entries in the block log. Currently there have been 13,885,193 blocks from the bot.

Using the edit filter extension to disallow edits from such IP addresses would be an more efficient use of everyone's time. It can also prevent disruptive edits from some users (which enwiki is currently facing on the administrative pages).

Event Timeline

Reminds me of T354599: Make IP reputation available as a variable in AbuseFilter and some of the work that went into SFS scores in AbuseFilter (there was also work to include Spur data in SFS but :shrug: )

matej_suchanek renamed this task from Include proxy information from IP Information tool as conditions in Edit Filter extension to Include proxy information from IP Information tool as conditions in Abuse Filter extension.Aug 10 2024, 2:31 PM

Thanks for filing this, @Robertsky. As I understand it, this task is a duplicate of the one that @TheresNoTime linked to (T354599: Make IP reputation available as a variable in AbuseFilter). That one is marked as stalled pending a request to research some likely patterns we'd want to use for mitigations, but it doesn't necessarily need to be. We do, however, probably need to consult with Legal, Safety & Security Center before we could enable this functionality.

@kostajh, I will close this as duplicate then. :) thanks for the update.