Wikipedia talk:Sockpuppet investigations/Archive 22

This page is an archive of past discussions. Do not edit the contents of this page. If you wish to start a new discussion or revive an old one, please do so on the current talk page.

The last time Amalthea (bot) updated the SPI table was yesterday at 05:51 UTC. I left a message on Amalthea's Talk page yesterday, but there's no telling when he'll respond. I can't remember the last time we substituted DeltaQuad's updating mechanism (I don't even know what to call it). I also don't remember how to do it, although I think I did it once a long time ago. Does it still work? If so, could someone temporarily substitute it so the table updates? I'd ask Amanda directly, but she's around so seldom, I decided asking here and pinging her at the same time would be most efficient. Thanks.--Bbb23 (talk) 15:05, 10 July 2019 (UTC)

@Bbb23: I switched it --DannyS712 (talk) 15:07, 10 July 2019 (UTC)

You're supposed to tell me how you did it so I can forget again. Never mind, I looked at your edit. It never occurred to me to check internal comments. Thanks!--Bbb23 (talk) 15:15, 10 July 2019 (UTC)

@Bbb23: Yeah. Just revert my edit once the normal overview table is updated, and then the comments will be there for next time too! Glad I could be of service --DannyS712 (talk) 15:16, 10 July 2019 (UTC)

• Can this DeltaQuad's list be altered? It shows some cases as "open" and "closed" at the same time. Yes, those cases have some closed reports and some open reports, but they should be classified as "open" as long as there is at least one open report. Vanjagenije (talk) 21:47, 10 July 2019 (UTC)
• Bot up again, sorry everyone. Amalthea 07:49, 11 July 2019 (UTC)

...and has been for at least several hours. As an example, I get "500 - Internal Server Error".
 — Berean Hunter (talk) 15:59, 10 July 2019 (UTC)

Yeah, it's annoying. You could try using Robtex as an alternative. NinjaRobotPirate (talk) 18:20, 10 July 2019 (UTC)

Looks like it's working again.--Bbb23 (talk) 23:22, 12 July 2019 (UTC)

What does UA stand for?Is their a list of abbreviations?  Dlohcierekim (talk) 16:27, 11 July 2019 (UTC)

It's user agent. I'm not aware of a page with a list of acronyms.-- Jezebel's Ponyo^{bons mots} 16:32, 11 July 2019 (UTC)

United Airlines, United Artists, Unified Arabesque, Unmitigated Asshole ... --Bbb23 (talk) 16:36, 11 July 2019 (UTC)

...Unnamed Antagonist. Unnatural Aroma. Universal Anarchy.-- Jezebel's Ponyo^{bons mots} 16:51, 11 July 2019 (UTC)

Although I am using the markblocked script by User:Burninthruthesky, I've noticed today that in the SPI case pages, usernames of blocked users are not stroke through any more (at least not for me). The "talk" and "contributions" links are stroke through, but the username itself is not. It was all OK last time I was clerking, but today there's the described issue. Can someone help? Vanjagenije (talk) 13:19, 2 August 2019 (UTC)

Yes, this is a problem for me too. Doesn’t appear to be any recent change in Template:Checkuser that I can see, which was my first guess. TonyBallioni (talk) 14:14, 2 August 2019 (UTC)

It's very annoying. I reported this to Writ Keeper a few days ago, not because it's his responsibility, but simply because he's good at scripts. Unfortunately, we've not gotten any further than clarifying what I meant. WK is around only sporadically and hasn't edited since my last comment. Who else can look into this?--Bbb23 (talk) 14:18, 2 August 2019 (UTC)

I guess it has again something to do with this: Help_talk:Notifications/Archive_7#Checkuser_and_admin_questions. I'm pinging @Jc86035 and JJMC89:. Vanjagenije (talk) 15:24, 2 August 2019 (UTC)

But that was from 2017. What's changed recently? Anyway, might as well ping Burninthruthesky. I didn't even know they were still around.--Bbb23 (talk) 15:32, 2 August 2019 (UTC)

Well, I have the gadget enabled and not the script, so I'm not sure who is maintaining that. All this technical stuff is beyond me. See, Bbb, something I don't know. TonyBallioni (talk) 15:36, 2 August 2019 (UTC)

It's probably either a change to the external link HTML or a change to how some MediaWiki page variables are defined. The links to user pages are formatted external links instead of normal wikilinks, because if they were then it wouldn't be possible to use {{Vandal}} without notifying the linked user account. Jc86035 (talk) 15:53, 2 August 2019 (UTC)

I don't understand a word you said. I didn't even know there was a gadget (which one?). But back to the script. It's important to note that the strikethrough issue is occurring only at SPI. Strikethroughs for blocked accounts and redlinked userpages are correctly dislayed elsewhere.--Bbb23 (talk) 16:25, 2 August 2019 (UTC)

If you go to the gadgets tab of Special:Preferences and click "strike out usernames that are blocked" or something like that, it will do the same thing as the script without you having a script in your .js page. I use that instead of the script, and it is broken at SPI for me too. Since both are working I assume it means that for some reason it isn't working with external links to user pages, because {{checkuser}} uses external links to prevent pings from happening. {{noping}} also seems to cause this problem (ex: Hidden Tempo ) and it also uses external links. I'm not sure who the correct person to pester over this is. TonyBallioni (talk) 19:32, 2 August 2019 (UTC)

I hate the way the Gadgets tab renders: you have to scroll all the way down because it only displays things as you scroll. Then, of course, you have to scroll up to look for whatever is you're trying to find. I did find the entry, though, thanks. So, if the gadget and the script were working, would you get double strikethroughs if you had both? :-) I think we should pester editors at random. More seriously, should we ask at the Pump? Or maybe we should let it percolate here a bit longer.--Bbb23 (talk) 20:02, 2 August 2019 (UTC)

As much as I get nostalgic for percolators, I've asked at VPT. TonyBallioni (talk) 20:05, 2 August 2019 (UTC)

• Hey, y'all. Sorry for being on sporadically, as Bbb says: not to get too personal, but there was a death in my immediate family a month or so ago and I'm still grappling with it. Anyway, something must have changed on Wikipedia's end to have caused this script to fail, since obviously nothing has changed script- or wikicontent-wise over the last few days. Probably something to do with the way external links are rendered in the page source by Mediawiki. I've created a fork of the script that should work now: try replacing the Burninthruthesky script with User:Writ_Keeper/Scripts/markBlocked.js. I've quickly tested it and it seems to be working now. Thanks, y'all. Writ Keeper ⚇♔ 05:08, 3 August 2019 (UTC)

  pings for TonyBallioniVanjagenijeBbb23 Writ Keeper ⚇♔ 05:09, 3 August 2019 (UTC)

  It seams to be OK now. Vanjagenije (talk) 09:32, 3 August 2019 (UTC)

1999Newbie is an obvious sock of Blake20 as you can tell by the fact that they've both left trollish messages on my talk page that are of absolutely no interest to me. And on top of that, they both have the same editing patterns, and the fact that they've both mentioned The Sims Wiki which is a Fandom wiki that I administrate. And that they've both brought up the subject of ILoveSims5 who was a former sockpuppeteer on that wiki back in 2014-2015. ― C.Syde (talk | contribs) 12:51, 22 August 2019 (UTC)

@C.Syde65: This talk page isn't used to report sockpuppets. The easiest way to report socks is to install Twinkle and use the "ARV" feature to report them to SPI. —k6ka 🍁 (Talk · Contributions) 12:16, 25 August 2019 (UTC)

Oh right, okay. I'll need to remember that - which I'm sure I will. ― C.Syde (talk | contribs) 12:41, 25 August 2019 (UTC)

So, I have an exhaustive list of accounts created since April/May which all behave the same way and I believe that they are all created by one or two editors whose main accounts have been blocked indefinitely for sock puppetry. However, I don't believe it's possible to arrange/separate these accounts, I'm not sure how I should open an investigation. Should I simply open one and make my sense as I add the exhaustive list? --Ahmedo Semsurî (talk) 09:07, 2 September 2019 (UTC)

This is the previous investigation I believe my investigation is a continuation of[1] which already has an exhaustive list of sock puppets. --Ahmedo Semsurî (talk) 09:12, 2 September 2019 (UTC)

I've opened an investigation, so let's see how it turns out. [2] --Ahmedo Semsurî (talk) 11:03, 2 September 2019 (UTC)

Please review Wikipedia:Miscellany for deletion/Wikipedia:Long-term abuse/50.232.233.114.

Please comment on whether it is appropriate for random editors to nominate LTA subpages for deletion. It is my opinion that only qualified clerks should be doing this. --SmokeyJoe (talk) 08:01, 20 August 2019 (UTC)

This particular page is so empty and out of scope I might not object if Willy on Wheels himself nominated it for deletion (joke). On the general point, I don't see any harm in any subpage being nominated as long as a) the nominator is not a sock b) the SPI team (or admins, or involved editors, or a wide enough pool of people outside of MfD) are made aware of the nomination, and c) relevant people have commented before any deletion. @LaundryPizza03: FYI if you're going to be doing any more, a convention has developed that LTA subpages get mentioned here before/during nomination. -- zzuuzz ^(talk) 11:57, 20 August 2019 (UTC)

For what it’s worth, I’d support deleting all LTA subpages. I’ve never found them useful and I pretty much ignore them when someone points to one or pretend they don’t exist otherwise. TonyBallioni (talk) 16:31, 20 August 2019 (UTC)

I've advocated this many times before but I'm with Tony on this one. LTA pages are almost never helpful anymore and all they do is feed into their egos. Praxidicae (talk) 16:36, 20 August 2019 (UTC)

What a waste of everyone's time. I deleted the LTA page. If I'd known about it, I would have deleted it by myself. An MfD wasn't needed. I'd appreciate it if someone would take care of closing the MfD (not my forte). I don't care what you call the reason for the deletion: snow delete, whatever. As for Tony's and Praxidicae's comments about there's no such thing as a helpful LTA, I disagree. Many are not helpful, but in cases with which I'm unfamiliar and the presentation of evidence is piss-poor (unfortunately often), the LTA may help me understand the behavioral patterns. What I think is if an LTA is created, we should be notified here so we can see from the get-go whether it's helpful. Otherwise, it takes on a life of its own. I don't like the fact that anyone can create an LTA.--Bbb23 (talk) 16:54, 20 August 2019 (UTC)

• Perhaps cascade-protect the LTA main page and its subordinates? FWIW, I voted keep on the last MFD for the LTA pages in general, but many of them should be individually culled as yes they are trophy cases for some of the trolls, especially the ones that are obvious and need no documentation. Crow^Caw 17:02, 21 August 2019 (UTC)

I would also oppose (again) mass-deletion of the LTA pages. Sure, some are pointless (i.e. do we really need one for VxFC or BKF? everyone knows their schtick and the wall of dynamic IP addresses is grossly unhelpful) but others are very useful and document changing patterns over time, for example. Ivanvector (^Talk/_Edits) 18:58, 21 August 2019 (UTC)

Agree with Bbb23 and Ivan...and commenting that yes, the page for BKFIP is helpful because I just found another account because of it.
 — Berean Hunter (talk) 14:35, 4 September 2019 (UTC)

@Bbb23: We're causing Misnested tag with different rendering in HTML5 and HTML4 high-priority lint errors in every Wikipedia:Sockpuppet investigations/... article. At the end of every

*'''Tools''': <span class="plainlinks">[https://tools.wmflabs.org/sigma/editorinteract.py?users={{urlencode:{{SUBPAGENAME}}}} Editor interaction utility] • <span class="plainlinks">[https://tools.wmflabs.org/interaction-timeline?wiki=enwiki&user={{urlencode:{{SUBPAGENAME}}}} Interaction Timeline] • [https://tools.wmflabs.org/betacommand-dev/UserCompare/{{urlencode:{{SUBPAGENAME}}}}.html User compare report]</span> <small>''Auto-generated every hour.''</small>

we need to append </span>. Can we please make this fix going forward. —Anomalocaris (talk) 18:57, 2 September 2019 (UTC)

Just to be clear, Anomalocaris was making this change at individual SPIs, and I asked him to post the "problem" here. This is beyond my pay grade. As far as I'm concerned a lint error, can be fixed easily by using a lint brush to remove the lint from my very best tuxedo. I find it interesting, though, that this "error" hasn't caused any problems being, uh, misnested that I've noticed. I'll leave this for those among us who are technical, alhough also preferably a member of the SPI team.--Bbb23 (talk) 19:38, 2 September 2019 (UTC)

Sorry, I just noticed this thread. Fixed in {{SPI report}} here. However, since the template is always substed, and the error was introduced in May, it has affected 1.6K+ pages. Certainly not something that "can be fixed easily" without running a bot or script. (So Bbb23's reverts seem to have been ill-motivated, but Anomalocaris's attempt at a fix was also imperfect: the right way is to remove the extra <span>, not to add the missing </span>.) Nardog (talk) 21:20, 2 September 2019 (UTC)

I can AWB this later, or we can request a bot to do it. 1600 pages is a lot to do with AWB but I'd be honestly surprised if there were new reports in 1600 different cases in four months. There might be several on an archive page but that's still one edit to AWB. Just to be clear: the fix is to remove the second <span class="plainlinks"> and leave the first, correct? Ivanvector (^Talk/_Edits) 14:49, 4 September 2019 (UTC)

Correct. Nardog (talk) 18:17, 4 September 2019 (UTC)

Your impression was right, my regex query seems to have been incomplete and the actual number of affected pages is probably ~900. Nardog (talk) 18:20, 4 September 2019 (UTC)

• Wikipedia:Miscellany for deletion/Wikipedia:Long-term abuse/The abominable Wiki troll

Discussion has already been open long enough to have been relisted once, but this page should have been notified. Ivanvector (^Talk/_Edits) 18:14, 4 September 2019 (UTC)

• Wikipedia:Miscellany for deletion/Wikipedia:Long-term abuse/Incorrigible Troll

...and this one has been listed as well.
 — Berean Hunter (talk) 02:19, 5 September 2019 (UTC)

The Arbitration Committee is accepting applications for appointments as CheckUser and Oversight team members. GorillaWarfare and KrakatoaKatie are the arbitrators overseeing this process. The names of all applicants will be shared with the Functionaries team, who will be asked for assistance with vetting candidates.

• Applications: 23 September to 29 September
• Review period: 30 September to 2 October – the committee will review applications and ask the functionary team for their feedback
• Notification of candidates: 2 October to 3 October – notification of candidates
• Community consultation: 4 October to 23:59 UTC, 10 October – candidates' statements published, community is invited to comment
• Appointments: by 14 October

For the Arbitration Committee,

Katie^talk 17:14, 23 September 2019 (UTC)

After conferring with JJMC89 and the functionaries, we are pleased to announce that he is now a SPI Clerk trainee and I will begin training him soon. Please welcome him and if I'm not around and he needs something, please help him out. Thank you,
 — Berean Hunter (talk) 23:48, 8 October 2019 (UTC)

What can I do if I suspect a user heavily involved in a canvassed AfD, with no other edits, of being a sock, but I have no evidence of their possible other account? I see someone has already opened a request for them and it was deleted as a G8 (no single-user requests). Vashti (talk) 22:53, 8 October 2019 (UTC)

@Vashti: In this case, I recommend contacting a checkuser privately with your concerns, e.g. via Special:EmailUser or by contacting OTRS queue checkuser-en-wpwikipedia.org. SPIs can't really be opened without two accounts, but a checkuser will sometimes look into accounts that exhibit suspicious behavior indicative of sock puppetry in order to identify a master in a case where the master is unknown. Mz7 (talk) 00:26, 20 October 2019 (UTC)

Thank you! Vashti (talk) 06:19, 20 October 2019 (UTC)

At Wikipedia:Miscellany for deletion/Wikipedia:Sockpuppet investigations/Navawnatherat was another SPI subpage event brought to MfD. Wikipedia:Sockpuppet investigations/Navawnatherat. See also Wikipedia talk:Criteria for speedy deletion#G7 for SPI pages?.

I continue to believe that these things should NOT be welcome at MfD, but should be for SPI clerks and checkusers to deal with as they see fit.

Accordinging, I believe that User:ST47 was qualified to delete the page even outside the documented CSD criteria. --SmokeyJoe (talk) 02:51, 23 October 2019 (UTC)

Hello, I'm Minhngoc25a, an active user from the Vietnamese Wikipedia. Recently, the check users from our wiki found a wave of sockpuppets. Those accounts affected heavily the result of page deletion and high-class user group election votings in our community.

So, I'd like to ask, how are sockpuppets in your wiki handled? Could you please list the function of your bots used against these accounts?

Minhngoc25a (talk) 15:15, 26 October 2019 (UTC).

@Minhngoc25a: Hi. You will get a general idea at WT:SPI, by observing some cases. Please feel free to post your following questions here. —usernamekiran(talk) 21:03, 26 October 2019 (UTC)

Minhngoc25a, we usually block sockpuppets and masters indefinitely. You can read our policy at WP:SOCK. Vietnamese Wikipedia CheckUsers are also able to request any second opinion if they should want one on the checkuser mailing list. Other than that, we tend not to comment on the affairs of other projects as each wiki is independent in setting it's policies and guidelines. TonyBallioni (talk) 03:02, 27 October 2019 (UTC)

I'm looking at Wikipedia:Sockpuppet investigations/BrookeCook, which has a list of many suspected socks. Is there some standard convention to mark a given suspect as, "Investigation completed on this one", so other investigators can quickly tell which ones still need work? -- RoySmith (talk) 14:04, 28 October 2019 (UTC)

On the whole case or on an individual account? For the former, simply note in the clerk's section that you've found / not found sockpuppetry evidence and any administrator action(s) you have taken. If you wish, you can use the {{admin-note}} template (looks like  Administrator note blah blah blah) to denote that you are a reviewing administrator and have given your decision. Then change the status of the case page to "close". For the latter, you can just leave a note that you looked at one account and found that it was / wasn't related to the master. Again, you can use {{admin-note}} if you wish. If you have any other questions, you can ask here, or, preferably, at the SPI clerks' noticeboard, which more people watch and nobody uses for some reason. Cheers! Reaper Eternal (talk) 15:05, 28 October 2019 (UTC)

On the whole case, the "in progress" does that, for individual accounts, just as RE said above (in my opinion). --qedk (t 桜 c) 17:11, 28 October 2019 (UTC)

Don't use the "in progress" status, that's for checkusers. You can change the status to "hold" (onhold also works, and there's {{on hold}} which looks like  On hold) if you want to mark a case as on hold, although the docs also say that status is for clerk holds, but I don't think anyone's going to complain. Ivanvector (^Talk/_Edits) 17:23, 28 October 2019 (UTC)

I might. I think RE's advice is fine.--Bbb23 (talk) 17:55, 28 October 2019 (UTC)

See Wikipedia:Miscellany for deletion/Wikipedia:Sockpuppet investigations/Hijiri88. —SmokeyJoe (talk) 21:01, 28 October 2019 (UTC)

The community should not decide whether an SPI page should be deleted.--Bbb23 (talk) 15:10, 30 October 2019 (UTC)

Is there ever justification for blocking a new account that is almost certainly intended as a sockpuppet? I realize the answer is either "never" or "only in exceptional circumstances; AGF assumes the user intends to mend their ways". But my reason: some articles, particularly Martin Short have been repeatedly hit by accounts with a particular name pattern, and two more accounts with the same pattern were created a few hours ago, within minutes of each other (so it's hard to AGF). There's a third created a few days ago. They haven't made edits yet. David Brooks (talk) 15:05, 30 October 2019 (UTC)

Just out of curiosity, how did you locate these accounts? -- RoySmith (talk) 15:17, 30 October 2019 (UTC)

If you know what you're looking for (or a pattern) you can search the user creation log, or there are some edit filters that log certain username patterns. From the history of the article it does look like the pattern is pretty obvious. As a general rule we don't block accounts unless they've edited, because coincidences are pretty common when all you're going by is a username, but when you have, say, a blocked User:Hninwi002 and within a few hours after they're blocked you see in the logs that users Hninwi003, Hninwi004, Hninwi007 have all been created but haven't edited, I'd be inclined to block those. Checkuser logs also record account creations so we can check if the technical details of the accounts match, and block that way. On that note, I've just blocked a whole bunch of matching accounts that were very clearly using the same computer and being used only for vandalism, many of which also matched that username pattern. Ivanvector (^Talk/_Edits) 16:12, 30 October 2019 (UTC)

I found the accounts in the generic list of users, because the first few characters are pretty distinctive, and I looked for creations this month. Ivanvector suggests these are candidates for pre-emptive block. FTR, the names start with "mogg". Second, if the vandal is determined enough, and switches the name pattern, do we have enough to block the IP? David Brooks (talk) 16:34, 30 October 2019 (UTC)

Yep, absolutely. I didn't in this case because it looks like a public IP with a lot of constructive edits, and IMO it's not worth blocking those editors to stop this degree of petty schoolyard vandalism. Just WP:RBI. Ivanvector (^Talk/_Edits) 16:42, 30 October 2019 (UTC)

@Ivanvector: Thanks for the quick research and action. David Brooks (talk) 00:04, 31 October 2019 (UTC)

• Yes, if they're a sock of a confirmed sock. Not if they're not though, otherwise they could be a legit "alternate account". But it's the identity behind them which carries the blame, so that would be shared. Andy Dingley (talk) 00:24, 31 October 2019 (UTC)

Hello a previous discussion here that I was involved in subsequently resulted in one of the editors I was in dispute with being blocked indefinitely. However a recent reply to Talk:List of Royal Navy admirals (1707–current) final section which I have noticed today leads me to suspect that Special:Contributions/12.144.5.2 could be the previous user that was blocked. Their comments are not neutral or impartial and specifically name myself and my involvement in this matter e.g. 'assiduous work that was abandoned when Navops47 showed up and demanded that the evolution of understanding of what the rank of admiral means be disregarded' any advice would be appreciated.--Navops47 (talk) 07:32, 1 November 2019 (UTC)

If you believe the IP is the blocked user, you should file a report at WP:SPI with evidence. Your expectations in filing such a report should be low because IP reports are often not reviewed quickly, and if the IP has stopped editing at the point of review, the report will be closed with no action. However, even if that happens, there is some advantage to making a record for the future.--Bbb23 (talk) 13:17, 1 November 2019 (UTC)

An IP editor used one just the other day. Looking at the talk page archives, I see this occassionally happens. The intro page states "If you are an anonymous (IP address) editor, and the case page is protected or does not exist, please click "show" to the right and use the box below". I can't say for sure what happens when that pathway is taken — so I just wanted to confirm that using that box does not, in some way unknown to me, turn-on {{semi-protected edit request}} in a manner such that any advice to IP editors not to use it would be wrong.^[a] A portion of the guidance I give to others is empirical (as is here) and if that template is being used in an official way that I don't know about, I'd go around thinking it's not supposed to be used when it is. Wanted to avoid that, so thanks in advance for any guidance! Warm regards,  Spintendo  06:05, 11 November 2019 (UTC)

Spintendo, the IP raised a legitimate SPI report at Wikipedia talk:Sockpuppet investigations/Paavada which they wanted moved to Wikipedia:Sockpuppet investigations/Paavada. The creation of new SPI pages is permanently semi-protected so, in the "show" instructions, an IP is presented with a button to submit an edit request. The SPI in question got moved and processed. Cabayi (talk) 07:55, 11 November 2019 (UTC)

I thought that might be the case, thank you for clarifying that — I appreciate it!  Spintendo  15:40, 11 November 2019 (UTC)

Template:Checkuserbacklog has been nominated for deletion. You are invited to comment on the discussion at the template's entry on the Templates for discussion page. Here's another deletion discussion for an SPI-related page where the nominator (courtesy ping Trialpears) did not notify the project. Ivanvector (^Talk/_Edits) 23:25, 11 November 2019 (UTC)

Template:Ssp has been nominated for deletion. You are invited to comment on the discussion at the template's entry on the Templates for discussion page. ‑‑Trialpears (talk) 16:25, 14 November 2019 (UTC)

What tools/procedures do we have to prevent using SPI to conduct a Denial Of Service attack? Suppose there was some legitimate user that I wanted to attack. It would be easy for me to create an account and pretend to be their sock. If they had an edit reverted, I would restore it. I could follow them around to AfDs and support their positions. If I was smart, I would run them through any of a number of IP-hiding tools. Well, you get the idea. Eventually, somebody would notice, open an SPI, and both my throw-away sock and my intended target would get blocked. I can't be the first person to have thought of this. Have there been instances of this? Do we have any effective way to discover and counter this sort of attack? -- RoySmith (talk) 02:49, 18 November 2019 (UTC)

It does happen sometimes, but a CheckUser can usually tell when it's a joe job. NinjaRobotPirate (talk) 10:20, 18 November 2019 (UTC)

Excuse me while I go stuff beans up my nose...my guess is that although what you're suggesting is possible, an attacker would need pretty specific knowledge to pull the attack off - they'd need to know possible user agents and either the user's area/IP range or that they were going through a proxy, otherwise a checkuser should be able to notice something like "they were always editing from Firefox before, now they're using Safari" or "all of their edits geo'd to the UK but now they're editing through Tor." ^creffpublic _{a creffett franchise} (talk to the boss) 13:44, 18 November 2019 (UTC)

Joe jobs do happen as NRP said, and there's a few LTAs running around trying to play this game (e.g. Wikipedia:Long-term abuse/Nsmutte) but they're pretty easy to spot even without checkuser. When we do run CU on them it's incredibly obvious. Even if an attacker did have very specific info on their target and had a way to spoof their technical info to make a really sophisticated impersonation attack, we can usually tell when data is being spoofed (Tor exit nodes are blocked on sight by policy, for example) and so even if they were successful in fooling an administrator into blocking their target, the best they could reasonably manage would be to slightly inconvenience them, and then we'd have detailed technical info on the attacker. It would really not be worth the effort. Ivanvector (^Talk/_Edits) 14:55, 18 November 2019 (UTC)

The chaotic evil part of my brain keeps thinking of more clever ways to implement this which would be harder to detect, but, yeah, I'll put the beans away now. -- RoySmith (talk) 15:17, 18 November 2019 (UTC)

I've semi-proposed this idea before but I'm finding that we're getting a mix of well-meaning and sock creations of LTA pages which serve as nothing more than a trophy for trolls. Rarely are these pages useful anymore and often they are for garden variety vandal-socks as opposed to actual long term abuse (how we define it is irrelevant at this point, though.) I think Wikipedia is mostly past the point of these pages being necessary but since I doubt we'll be making WP:LTA historic any time soon, I think it would be better if CUs and clerks were given the sole discretion of creation of new LTA pages (and possibly editing past but that's probably a different battle.) Praxidicae (talk) 19:58, 21 November 2019 (UTC)

I have created a handful of good LTA pages and I'm not a CU or clerk, so naturally I would be against your proposal. I find that LTA pages serve to maintain institutional memory, and they are immediately useful as a way of tagging problematic new edits. Binksternet (talk) 22:09, 21 November 2019 (UTC)

I agree that LTA pages should be created sparingly and I would be happy with a restriction such as CUs/clerks. There could be a low-profile page where established editors could ask for a creation but it would have to be based on a demonstrated benefit basis. WP:DENY is the only tool that works and the loving maintainance of LTA pages is the best way to ensure they never break the habit. Johnuniq (talk) 22:34, 21 November 2019 (UTC)

There's probably been some OK LTA pages created by some OK users who are not CU/clerks. LTA does have a system known as Category:Wikipedia long-term abuse – Pending approval, which I'm not sure was properly set up in the first place, but certainly has always needed some attention (as has the whole project). This is probably the system you are looking for. -- zzuuzz ^(talk) 22:37, 21 November 2019 (UTC)

What do people think of this edit two hours ago at an LTA page? I reverted a similar post on the LTA talk two days ago: diff. My conclusion is that firm clerking is necessary. Johnuniq (talk) 02:34, 22 November 2019 (UTC)

Wow, it's in an article. Johnuniq (talk) 02:38, 22 November 2019 (UTC)

If there's any interest, I posted a proposal to improve the screen space usage of the case table at Wikipedia talk:Sockpuppet investigations/Cases/Overview#Suggested format change. —[AlanM1(talk)]— 02:19, 25 November 2019 (UTC)

Despite being fairly used to opening SPI cases by now, I have accidentally started an SPI at Wikipedia:Sockpuppet investigations/AuthorWiki9, where I meant to open in at Wikipedia:Sockpuppet investigations/AuthorWiki99. Can someone fix this? SamHolt6 (talk) 04:53, 27 November 2019 (UTC)

 Done — JJMC89 (T·C) 06:00, 27 November 2019 (UTC)

I recently tried to report ContentEditman for SPI but the report was then edited with all text removed and replaced with the word "blank." Why is this, can someone advice if the report was done properly? — Preceding unsigned comment added by 68.229.71.252 (talk) 15:29, 30 November 2019 (UTC)

The reason this was blanked is likely because you presented no evidence to support an allegation of sockupppetry. This is required. Please refile the report with an explanation why you think the IP in questions is ContentEditman, and links to the relevant edits. Also because the case page already exists, you don't need to use the talk page. Sir Sputnik (talk) 15:41, 30 November 2019 (UTC)

Thanks. — Preceding unsigned comment added by 2600:8805:DC00:14D0:19B1:D5BB:25A4:6AA3 (talk) 15:53, 30 November 2019 (UTC)

I'm not sure if something changed recently that is causing this error, but we seem to have some archive pages with many calls to {{checkuser}} suddenly not rendering properly. LakesideMiners observed the issue on Wikipedia:Sockpuppet investigations/Krajoyn/Archive/1 (scroll to about 22 March 2018 - after a point around there the page stops transcluding templates). It's only happening in archives (pages with more calls to {{checkuser}}) so it's probably not something we need to be terribly concerned about, but do we need to do something to the template to stop this happening? Ivanvector (^Talk/_Edits) 16:32, 22 November 2019 (UTC)

Ivanvector, I don't think it is isolated to just that template, I think it might have something to do with the MediaWiki software itself, as it seems to be happening to ALL templates. I might try experimenting with this in my user space with a template I store in my own userspace, if that is something okay to do. (but don't quote me on this) It appers that archive was split because of this as shown on the first entry on Wikipedia:Sockpuppet_investigations/Krajoyn/Archive LakesideMiners^{Come Talk To Me!} 16:54, 22 November 2019 (UTC)

Oh, yes, that's what I meant, once the transclusion limit is reached on a page then no more templates are transcluded on that page. It's not template-specific. It's just that the checkuser template is the most likely culprit to be causing the limit to be reached on SPI archive pages. Ivanvector (^Talk/_Edits) 17:20, 22 November 2019 (UTC)

And technically, if you're going to copy the archive to a user page to experiment with it, you should follow WP:CWW and attribute where you copied from, and you should request deletion (WP:G7) when you're done. But I don't think anyone's going to be terribly concerned about it. Ivanvector (^Talk/_Edits) 17:21, 22 November 2019 (UTC)

Ivanvector, I decied to not copy the page, as it would ping way to many people. anyways, I hope this can get resolved. LakesideMiners^{Come Talk To Me!} 15:02, 23 November 2019 (UTC)

@LakesideMiners: Don't quote me on this, but I'm pretty sure if you copy the page but don't sign your edit, no pings will be generated. Also, you'd mostly only be pinging sockpuppets. Ivanvector (^Talk/_Edits) 15:08, 23 November 2019 (UTC)

I've actually encountered this problem once before. There's an upper limit as to how much transcluded content there can be in a single page before it breaks. There isn't really anything we can do to fix this. The solution the last time I encountered this issue was to simply remove about a third of the page's content which was of dubious quality to begin with. Obviously that's not workable here. All we can really do is make sure that the SPI clerks are aware this can be an issue for long-term cases, and break up archives into multiple pages when it does occur. Sir Sputnik (talk) 15:42, 23 November 2019 (UTC)

The Morning277 (Wiki-PR) SPI had to be broken into a couple SPI archives because it broke the servers. Reaper Eternal (talk) 16:50, 23 November 2019 (UTC)

• Looks like the same thing is happening with Wikipedia:Sockpuppet investigations/MariaJaydHicky/Archive. I'm thinking the archive needs to be archived as well. Mz7 (talk) 22:11, 24 November 2019 (UTC)

The Sockpuppet pages in Category:Pages where template include size is exceeded are:

• Wikipedia:Sockpuppet investigations/AndresHerutJaim/Archive
• Wikipedia:Sockpuppet investigations/Eeeeeewtw/Archive
• Wikipedia:Sockpuppet investigations/Jaredgk2008/Archive/1
• Wikipedia:Sockpuppet investigations/Krajoyn/Archive/1
• Wikipedia:Sockpuppet investigations/Morning277/Archive
• Wikipedia:Sockpuppet investigations/OfficialPankajPatidar/Archive
• Wikipedia:Sockpuppet investigations/Orangemoody/Archive
• Wikipedia:Sockpuppet investigations/Prabhak582/Archive
• Wikipedia:Sockpuppet investigations/Ugur none/Archive

I extracted the above from this XML list showing pages in the Wikipedia namespace that are in the category. Johnuniq (talk) 22:33, 24 November 2019 (UTC)

I've split all of the archives mentioned in this thread. — JJMC89 (T·C) 23:22, 24 November 2019 (UTC)

This is kind of interesting to me, in a weird way. I've been playing around with some code to analyze SPI cases. The process starts by doing a prefix search on "Wikipedia:Sockpuppet investigations" via the API. Adapting to this change should be straight-forward. The standard assumption in the big-data world is that any dataset you're using is going to be messy, incomplete, internally inconsistent, and in violation of it's own documentation. The bigger the data set, the more valuable it is, but the more certain it is to meet all those criteria. Wikipedia never fails to deliver on both those scores :-) -- RoySmith (talk) 03:03, 25 November 2019 (UTC)

Just to close this discussion off, I've written some changes to the SPI helper script that will preempt this problem going forward. If an archive action would cause the archive page to exceed the post-expand size limit, the script will now move the existing archive to a new title before archiving the closed case. Sir Sputnik (talk) 16:51, 1 December 2019 (UTC)

A sidenote, the same problem also affects the larger archives of m:srg such as m:Steward requests/Global/2019-10. Pinging JarBot. Cabayi (talk) 21:35, 1 December 2019 (UTC)

I created this SPI with a new puppeteer, but looking into article histories some more, I think they all belong to this one. Should I leave it as is (I've left a note in the SPI I created) or add them to the older SPI? Thanks, and sorry for the confusion. Spike 'em (talk) 11:57, 9 December 2019 (UTC)

I don't think there's anything else you need to do. A member of the SPI team will deal with it.--Bbb23 (talk) 12:28, 9 December 2019 (UTC)

Bravo to the clerks for getting the ever-present backlog of cases under control, but I've noticed that cases with the "checked" status (case checked but further review required, green in the table) are still languishing, with the oldest now nearly two months old since filing (one month since results on that case). Do we need to clarify the intent of this status? Personally I use it for cases where I have reported results but suggested behavioural analysis or otherwise requested further input. How are the other checkusers using it, and how are the clerks seeing it? Ivanvector (^Talk/_Edits) 13:20, 3 December 2019 (UTC)

The oldest one, Bodiadub, needs some Russian input to progress the request for a global ban. Any Russian speakers here? Cabayi (talk) 19:06, 3 December 2019 (UTC)

Part of the issue with checked cases languishing for such a long time is we are waiting for global locks to be put in place. For example, with Wikipedia:Sockpuppet investigations/Vrahomarinaner, I don't want to mess with it because a global checkuser was supposed to look at the case but it's been more than a month alreay. To be completely honest, I really dislike having to ask for global locks, I much prefer to stick to matters at my home wiki and let the other wikis sort things out on their own. And with more complicated cases like Wikipedia:Sockpuppet investigations/Bodiadub, when I see so many accounts, some of which are blocked, some of which are long stale, some of which need to be evaluated behaviorally, my motivation to take on a case like that vanishes. Surely I'm not alone in this feeling. Sro23 (talk) 04:57, 4 December 2019 (UTC)

So, there’s no such thing as global Checkuser (and I strongly oppose it even though stewards have been begging for it for years...) The data stewards have without asking us to give it to them is extremely limited and is only good for 90 days after account creation, because loginwiki tracks account creation, not logins. Waiting on a steward should not prevent a local block, and I block accounts that have been globally locked already all the time if they come up in results because it’s just easier. In fact blocking locally will often speed up a global lock because some stewards refuse to lock unless one or multiple local blocks are in place.

Bodiadub is a unique case because it’s really two best friends running a UPE ring together and previously there was xwiki politics involved. I’d leave it for uk.wiki CUs to request anything global, but block as you see fit locally. TonyBallioni (talk) 05:48, 4 December 2019 (UTC)

For simple cases I try to do all of the tagging and closing myself to save the clerks the effort. If the check is not a slam dunk and additional assessment of the behavioural evidence is needed in light of my findings, I'll stick it in the "checked" queue. Which is a long way of stating that I use the queue as you do, Ivanvector.-- Jezebel's Ponyo^{bons mots} 21:24, 3 December 2019 (UTC)

• Basically the same as above. On occasion I’ll mark it as checked if the accounts are  Confirmed but I’d prefer a clerk or admin determine if to block/how long. DeltaQuad and I think DoRD used to do this as well, but I’m not sure if anyone else does this currently. TonyBallioni (talk) 21:37, 3 December 2019 (UTC)
• What TonyBallioni said. Only rarely do I do the blocking; that's the role of clerks and reviewing admins in most cases, and it also puts me in a better position to block IPs without drawing connections to the accounts. I don't really place a huge value on tagging of accounts, but I get that some people do, so I leave it to others. Risker (talk) 00:30, 4 December 2019 (UTC)

When is a checkuser block not a checkuser block?

TonyBallioni, Risker, in a discussion we've been having, Dreamy Jazz points out that Wikipedia:CheckUser#CheckUser blocks provides a level of irreversibility to CU blocks that isn't there for blocks placed by admins based on CU results. Shurely shome mishtake ?? Cabayi (talk) 21:02, 9 December 2019 (UTC)

Erm, no. That's intentional. Checkuser blocks are placed by checkusers and are most commonly used for blocks where there would be no reasonable possibility that a non-CU would have sufficient access to information to make an informed decision with respect to unblock. Most checkuser checks do not result in CU blocks. In fact, most SPIs do not result in CU blocks. And most blocks that checkusers make are not CU blocks. Risker (talk) 22:46, 9 December 2019 (UTC)

I’m a bit more liberal with the template than Risker is, but the point of it is to prevent admin/community review of actions without the consent of a CU. If a CU doesn’t use the template, it’s intentional. TonyBallioni (talk) 23:16, 9 December 2019 (UTC)

With respect to the user of the template, I don't think Risker is typical, at least not in the last years - I can't speak for what CUs did before I became one. I almost always do my own blocks and tagging as well. As for the "point" of the template, the consequence of using the template is it prevents non-CUs from unblocking on their own. However, the template is also a clear indicator that the block of the account was based on CU evidence. That may be clear at the SPI, but it isn't always clear if one looks only at the block log. The template becomes even more important when accounts are blocked outside of SPI.--Bbb23 (talk) 01:17, 10 December 2019 (UTC)

Agreed re: outside SPI. I think "newer" CUs (last 5 years or so) tend to use it more than the "older" ones. The only times I don't use it are when I'm not entirely sure if a use of multiple accounts are a violation of the policy, or if I would rather let someone else decide how to block: typically first time one account socking stuff. If there are many accounts or it is someone who has done it a few times, a CU block is my norm. TonyBallioni (talk) 03:21, 10 December 2019 (UTC)

Would a clerk please move Wikipedia:Sockpuppet investigations/Renamed user 49274c4c204245204241434b and the respective archive to Wikipedia:Sockpuppet investigations/CommotioCerebri and WP:Sockpuppet investigations/CommotioCerebri/Archive? The courtesy vanishing has been reversed by the stewards. Thank you very much.
 — Berean Hunter (talk) 15:53, 16 December 2019 (UTC)

 Done — JJMC89 (T·C) 23:03, 21 December 2019 (UTC)

(Should we not/ Why don't we/ Have there been previous discussions on whether it would be helpful to) have a brief summary about the case on each casepage? It's usually blank most of the time anyway. I'm thinking something similar to the info pages about LTAs that it seems we do have but much briefer, perhaps, — a list of socks (or links to confirmed and suspected socks category pages), a list of affected articles, traits/area of focus (global or specific country, wikiprojects, AUTO or PAID, CIR, block evasion, etc.). I did search the archives with a few keywords I could think of but didn't find anything. Why I'm asking here. Thank you for reading! Usedtobecool ^TALK ✨ 17:50, 22 December 2019 (UTC)

Usedtobecool, SPI has a number of bots and tools which rely on the format of the SPI case pages. I guess the answer would come down to balancing the usefulness of such an addition against the additional risk of malformed case pages.

I've kept my own sock drawer to note the traits, prefixes & search strings which I've noticed in cases I've filed. Luckily the cases listed there have nearly all given up and gone away. If you want to take a copy of any of the code, feel free. Cabayi (talk) 19:19, 22 December 2019 (UTC)

The most obvious reason it's not is because all investigation pages are public. Changing your pattern after your pattern is conclusively known is simple. --qedk (t 桜 c) 09:03, 24 December 2019 (UTC)

What is the policy on non-admin SPI clerks making block requests? For example, this request by Cabayi. As far as I can tell from WP:SPI/C#Role and responsibilities of SPI Clerks, deciding cases is outside the remit of a clerk, so I'm unsure how I'm supposed to treat this request. Since the block would be logged in my name, I feel the obligation to investigate it to the same extent I would perform any other investigation. -- RoySmith (talk) 14:12, 27 December 2019 (UTC)

RoySmith, that's part of the role. If I were an admin clerk I'd have done the block. As for checking it out, I'd expect no less, we're all responsible for our own actions & nobody else's. Also note the further discussion I've had there with Praxidicae noting that the 3 day request was solely for the sockpuppetry (within my remit as an SPI clerk), not for the egregious SPA promotional activity (beyond my role, but probably deserving an indef).

Maybe the description needs expanding, but this is well within what the clerks are trained to do, see User:Cabayi/Clerking from March 11 onward. Cabayi (talk) 14:32, 27 December 2019 (UTC)

Cabayi is correct. AFAIK, clerks have always decided cases. In my view, that's their principal role. Non-admin clerks are no different from admin clerks except they must request a block as Cabayi did, which has been imposed by an admin clerk. I guess the description should be expanded. I confess I'd never read it until now.--Bbb23 (talk) 14:39, 27 December 2019 (UTC)

I've expanded the description. I'm not altogether happy with the formatting of the section, and my language might need tweaking. I'll leave that to others who are familiar with what clerks do. I was trying to be minimalist.--Bbb23 (talk) 14:48, 27 December 2019 (UTC)

OK, thanks, that clears up the confusion. It's always good when the documentation matches the real world. BTW, I had just finished my due diligence and was about to block them both myself, but Sir Sputnik beat me to it. -- RoySmith (talk) 15:10, 27 December 2019 (UTC)

It can be very frustrating in SPI cases where a large amount of accounts are listed to have misidentified the oldest account in the bunch (sockmaster). No matter how careful you are, everyone's bound to have made this mistake at least once (especially in cases where 50+ users are involved), and it's a real pain to have to go back and retag all those socks and move the SPI. I was wondering if someonoe more technically inclined than me could create or modify an existing user script that clearly tells you which sock in the group is the oldest account and therefore true sockmaster? Sro23 (talk) 08:11, 6 January 2020 (UTC)

Anyone? Sro23 (talk) 00:57, 10 January 2020 (UTC)

I suggest putting a clear request at WP:VPT with an example: link to page that script would have to read, link to example of incorrect tagging due to misidentification, and a statement of what the script should produce to avoid the problem. Johnuniq (talk) 02:24, 10 January 2020 (UTC)

Actually, I think I've got most of this already. I've got some code that parses SPI archives. Having it check registration dates on accounts shouldn't be a big deal. I'll see if I can get that banged out quickly. -- RoySmith (talk) 03:47, 10 January 2020 (UTC)

• Related discussion, re the oldest block, Wikipedia talk:Sockpuppet investigations/SPI/Clerks#Tool suggestion. Cabayi (talk) 08:22, 10 January 2020 (UTC)

• @Sro23: OK, I've got this basically working. See screenshot for analysis of Darryl.jensen. In this particular case, User:Abd has an earlier registration date than the master, so possibly this is listed under the wrong case name? The next step is for me to productionize it. Right now, it's running in a way that isn't accessible publicly. If this is what you need, I can start working on that. -- RoySmith (talk) 15:50, 10 January 2020 (UTC)

  RoySmith, will be very useful for larger cases and I will definitely use it if it is hosted publicly. Dreamy Jazz 🎷 ^{talk to me | my contributions} 16:13, 10 January 2020 (UTC)

OK, I'll start working on that. I need to get up to speed on Kubernetes, and possibly navigate some administrative approvals (WP:BAG, etc). I'm guessing a few days. -- RoySmith (talk) 19:26, 10 January 2020 (UTC)

RoySmith The reason Abd shows up is someone incorrectly listed that user as a sock once in the SPI archive. I'm looking for a script that will locate the oldest account in the current open SPI case, not the archive. Sro23 (talk) 04:33, 12 January 2020 (UTC)

@Sro23: I've got a semi-stable version up and running on https://tools.wmflabs.org/spi-tools/ Give it a try. The U/I is pretty basic. Enter a case name, check or uncheck the box to include the archives or not, and hit the "Sock Info" button. The "IP Info" button is left over from an earlier project that morphed into this; I'm not sure it does anything useful at this point. Let me know what works, what doesn't work, what else it could do that would be useful. -- RoySmith (talk) 03:31, 13 January 2020 (UTC)

• Guys, we have one. It’s one of the CU staleness scripts. It says the registration date. You can check my common.js and copy any of the staleness ones because they’re useful. TonyBallioni (talk) 05:25, 12 January 2020 (UTC)

"It says the registration date." - Great, but unless the oldest account is highlighted a different color or whatever, I still have to manually search for the oldest account. Sro23 (talk) 05:52, 12 January 2020 (UTC)

• As Tony mentioned above, everyone interested in working at SPI should install the CU staleness script by adding the following lines to their Special:MyPage/common.js:

mw.loader.load("/w/index.php?title=User:Writ Keeper/Scripts/cuStaleness.js&action=raw&ctype=text/javascript");
mw.loader.load("/w/index.php?title=User:Writ Keeper/Scripts/sockStaleness.js&action=raw&ctype=text/javascript");

The first one (cuStaleness) will allow you to easily identify whether accounts listed with the {{checkuser}} template have data within the CheckUser window; furthermore, it provides the registration dates next to accounts, which you can easily scan to determine which one's the oldest. The second one (sockStaleness) provides the same information but on sockpuppet category pages, e.g. Category:Wikipedia sockpuppets of Srinesh.saravanan. This will change your life. Mz7 (talk) 09:07, 12 January 2020 (UTC)

I recommend that if you add the cuStaleness script, that you also enter the line,

maxUsersCUStaleness = 300;

Without it, you will have to click on the red links repeatedly in very large archives to make the script finish. It is defaulted to 100. That doesn't help with Sro23's question though. Writ Keeper may be able to assist here.
 — Berean Hunter (talk) 14:02, 12 January 2020 (UTC)

It makes much more sense for Writ Keeper to update the existing script rather than create a brand new one. Assuming the script, when identifying the earliest created account, distinguishes between accounts created on the same day (currently the script tells you only the day of creation, not the time, unless there's a parm I'm unaware of), that would be a small side benefit.--Bbb23 (talk) 14:53, 12 January 2020 (UTC)

Sro23JohnuniqRoySmithCabayiTonyBallioniMz7Berean HunterBbb23: Well that was harder than I thought it'd be, but I've updated the cuStaleness script to bold the oldest date and italicize the newest date for account creation and contribs separately. Still kind of testing it, but let me know how it works, and if y'all have any suggestions. Thanks, Writ Keeper ⚇♔ 15:35, 13 January 2020 (UTC)

(also, to answer your implied question, Bbb23, the script has precision out to seconds, it just doesn't show that to teh end user for brevity's sake. Writ Keeper ⚇♔ 15:41, 13 January 2020 (UTC))

@Writ Keeper: Thanks for your work.--Bbb23 (talk) 15:50, 13 January 2020 (UTC)

Ah! That's why it was just doing one at a time this morning. Thanks Writ Keeper for the tweaks. Cabayi (talk) 17:34, 13 January 2020 (UTC)

Yeah, sorry about that. I really should fork the script while developing and testing it. Writ Keeper ⚇♔ 18:14, 13 January 2020 (UTC)

Thank you Writ Keeper, the script is immensely helpful with clerking duties. Sro23 (talk) 22:28, 13 January 2020 (UTC)

An accusation was made by User:Esuka at an unrelated edit-warring complaint (1) accusing me of being an anonymous IP editor - 46.226.190.219 - in an article. When I asked them to apologize for the accusation, they essentially said there was "good reason" to believe I was guilty of such. Such accusations taint a user's edits forever unless discredited right away. Please do a comparison. I am not this other user, or any other IP user either. - Jack Sebastian (talk) 04:58, 13 January 2020 (UTC)

A quick Google check geolocates the user to a specific name (who I'll not name out of outing concerns) on Dalton Street in Dalton, Isle of Man. I can verify that I am not there, have not ever been there, and really am not interested in roadtripping to there in the near future. - Jack Sebastian (talk) 05:07, 13 January 2020 (UTC)

@Jack Sebastian: Checking is done per CheckUser policy, which means checkusers do not have the mandate to check editors' private information without specific use-cases, even if you submit to a check voluntarily. That also means that your request to clear your name will be summarily rejected by all CUs, I see the editor making the accusation is temporarily blocked, so that should put the aspersions off for a while. --qedk (t 桜 c) 13:55, 13 January 2020 (UTC)

I'd strongly discourage using search results to try to identify anyone, because IP addresses can change, and they can also be shared or accessible by multiple people. The reality is that no one can prove that any one person did not use this IP address. You cannot be cleared by technical means, just as I can't. It's up to any accuser to make a good case, otherwise it should be ignored. -- zzuuzz ^(talk) 14:37, 13 January 2020 (UTC)

I would like to thank the both of you, QEDK and zzuuzz for taking the time to respond. I was really pissed at the accusation precisely because it would be an utter pain in the ass to clear my name of such an accusation. I wish the penalties for unsupported accusations like that were far more severe than they are. As the user said, they consider their short block to be just a "slap on the wrist"; they aren't going to see it as a preventative in the future. They are likely laughing about the ineffectiveness of the block.

Zzuuzz, while I do understand that a person's IP is pretty dynamic, but aren't they pretty much within a narrow range as provided by the ISP? I know that I edit Wiki from home, which should limit the range of IPs being used by me. Maybe I'm wrong. -- Jack Sebastian (talk) 16:57, 13 January 2020 (UTC)

You'll find that persistent spurious sockpuppetry allegations can be subject to penalties, which can be flexible. I've lost track of all places it might be mentioned, but WP:PA is one such place. On your other point, I was dealing with a user (definitely one user) the other day who within five minutes would edit from El Salvador, Ukraine, and Côte d'Ivoire. Can I prove it wasn't me, you, or Jimbo? Absolutely not. This Isle of Man IP range falls into a similar category as far as I'm concerned. -- zzuuzz ^(talk) 18:26, 13 January 2020 (UTC)

Regarding IPs, the basic problem is that you can't prove that a specific account didn't use a given IP - there are plenty of ways of obfuscating your IP. Regardless, there's nothing to worry about here - as QEDK and zzuuzz both mentioned, allegations of sockpuppetry without evidence are considered personal attacks (so if that editor continues after the block expires they're liable to be blocked), and most experienced editors know better than to listen to that kind of allegation, so I don't think you can expect to suffer any sort of "tainting" of your edits. ^creffpublic _{a creffett franchise} (talk to the boss) 18:31, 13 January 2020 (UTC)

Not sure if this is the place to ask but this users behavior has been problematic crosswiki wrt mass tagging socks and I was shocked to see so many tagged here by them that haven't even edited nor were they evaluated at SPI. For the record, I have no doubt about the accounts being socks but I fail to see how bringing attention to trolls is beneficial and I find mass tagging by non-clerks/cus to be a bit problematic so I was wondering if it would be appropriate to request deletion of said tags. Praxidicae (talk) 20:15, 14 January 2020 (UTC)

Yes.--Bbb23 (talk) 21:22, 14 January 2020 (UTC)

Can this be considered a request? Or do you want me to go through and tag the ones that are inappropriate (really, probably all of them ¯\_(ツ)_/¯) Praxidicae (talk) 21:25, 14 January 2020 (UTC)

I prefer the tagging. Perhaps someone else will be willing to do so without. There really should also be a warning to MCC214. In my view, they should not be tagging any users, although that stupid "expressed a concern" is supposedly kosher.--Bbb23 (talk) 21:33, 14 January 2020 (UTC)

bbb23 I did drop them a warning but I don't have any hope that it will sink in considering they've been blocked on meta and ZH wiki as well as had autopatrolled yanked (today!) on meta for this exact problem. Also considering that only 22 of their 800+ edits are to mainspace, not really sure they care. I'll go through and tag them. On a side note, I think the suspected notice on talk pages should be deleted as they only seem to attract incompetent vandal fighters who make messes. and I also don't generally see the point of notifying socks that you think they're a sock

I also think it's become the accepted norm now that only clerks, CUs and admins should be tagging anyway, so perhaps we can create a filter to disallow non-A/C/CU sock tags. Praxidicae (talk) 21:59, 14 January 2020 (UTC)

I'm not really in agreement with that. Regular users can often be a great help to CUs (and presumably others) in identifying sockers. Not always the case of course, but disallowing it would be a step too far, imo. -- zzuuzz ^(talk) 22:27, 14 January 2020 (UTC)

not really sure I follow. Wouldn’t they just bring it to SPI? It’s not like they’re not being identified. I just rarely find non-spi folks tagging socks to be helpful. Praxidicae (talk) 22:45, 14 January 2020 (UTC)

If they know who the sockmaster is, and the sock has been blocked for some other reason, people will often be not persuaded to add a SPI report. They just add a tag? Plus it saves all the SPI backlog and admin/CU/cleark work type stuff. -- zzuuzz ^(talk) 23:02, 14 January 2020 (UTC)

Looks like you have run into this little fella before.Praxidicae (talk) 22:03, 14 January 2020 (UTC)

I have noticed that many sockmasters who have had been confirmed to be socking by checkusers twice after the initial indefinite block are not marked as banned on their userpage. WP:THREESTRIKES is the policy on this and it has been around since the March 2018 RfC. How would this apply retrospectively to cases with less than two CU confirmed cases of socking after March 2018, but with more than two CU confirmed cases of socking if you also include before March 2018? Also should all sockmasters who meet WP:THREESTRIKES have their {{sockpuppeteer}} template changed from blocked to banned (with checked=yes if it is not already there)? Is some kind of semi-automated tool / bot task to search / list eligible sockmasters to be banned per WP:THREESTRIKES wanted (a full bot seems too risky, so manually checking the sockmaster's case page seems best)? Dreamy Jazz 🎷 ^{talk to me | my contributions} 16:30, 10 February 2020 (UTC)

There is not much of a need, so to say? If any of these editors return, they will probably be found to be meeting 3X and then treated accordingly. A retroactive tagging might help, but depends on the fact if anyone would want to take on such an endavour. Doubt there's a tool for this, though. --qedk (t 桜 c) 16:42, 10 February 2020 (UTC)

Only the master's tag would be updated, there is no equivalent switch in {{sockpuppet}}. I recall we had a discussion and determined that old sockmasters who would be deemed 3X banned now would not be updated retroactively, because there wouldn't be much point, but personally I do update them if we find them socking again after the 2018 RFC. Ivanvector (^Talk/_Edits) 17:31, 10 February 2020 (UTC)

I don't bother because they're literally never going to get unblocked anyway. (I personally find the "three strikes" policy to be unnecessary bureaucracy.) Reaper Eternal (talk) 18:25, 10 February 2020 (UTC)

I agree.--Bbb23 (talk) 18:40, 10 February 2020 (UTC)

• I wrote 3X. I think it's useful policy requirement for documenting that any unblock should be sent to AN for review, but yeah, if it's a bunch of vandal accounts/an LTA it doesn't matter. Though, it did have the advantage of getting rid of the previous unnecessary bureaucracy that was common at the time of people regularly requesting a CBAN for their pet LTA at AN. The goal wasn't to tag for sport. The goal was to stop the AN threads and to clarify for admins who work CAT:RFU when taking something to AN was required. TonyBallioni (talk) 00:04, 11 February 2020 (UTC)

  It is quite useful, having closed quite a few of these threads at AN as "Per 3X, already banned", it has saved a lot of community time and headache. --qedk (t 桜 c) 08:02, 11 February 2020 (UTC)

Just wanted to post a wee reminder to CUs that there is a checkuser queue at WP:UTRS that needs monitoring. Often it's requests for IPBE that just need a quick check. Thank you to 5 albert square for all of the work she performs in reviewing requests, but she can't do it all on her own! -- Jezebel's Ponyo^{bons mots} 22:15, 13 February 2020 (UTC)

Thank you! Yup there's a big of a backlog at UTRS for CU cases. As I'm not CU I can't deal with them. I think it's about 6 or 7 cases outstanding at the moment. Ponyo I do try to do it all by myself -- 5 albert square (talk) 22:25, 13 February 2020 (UTC)

Sorry 5 albert square, looks like there were no takers. I'll try to handle the the worst of the backlog. For those CUs who are not familiar with reviewing UTRS appeals, you can see the list of open appeals and their status here. The appeal numbers are clickable and will take you to the specific appeal to review. No log in needed! -- Jezebel's Ponyo^{bons mots} 17:14, 14 February 2020 (UTC)

Update - knocked it down to one outstanding (at least for the moment!). I commented on the one remaining (UTRS appeal #28756) some time ago; it still needs more eyes.-- Jezebel's Ponyo^{bons mots} 18:08, 14 February 2020 (UTC)

Not since yesterday at 12:50. I contacted Amalthea yesterday. I tried to replace the usual table with DeltaQuad's table, but either I did it wrong or DQ's table is not working. Can anything be done?--Bbb23 (talk) 16:42, 2 February 2020 (UTC)

Bbb23, I saw this and was considering creating my own list. It will take a few days for me to develop it and I could place the list in the userspace of my bot to bypass needing a BRFA for the time being, but it might be worth having a third backup, which I could use if I wanted to. Dreamy Jazz 🎷 ^{talk to me | my contributions} 16:46, 2 February 2020 (UTC)

I could also try to work on the other tasks, but I would focus on the list first. Dreamy Jazz 🎷 ^{talk to me | my contributions} 16:47, 2 February 2020 (UTC)

@Bbb23: DQ's one looks good to me. It was broken because the placeholder template you copied had a stray |} at the end. Fixed that and the transclusion. --qedk (t 桜 c) 16:56, 2 February 2020 (UTC)

I undid your change. That table is completely out of date, worse than the other.--Bbb23 (talk) 16:59, 2 February 2020 (UTC)

Yes, that table has not updated since the 20th of January. See Special:History/User:DeltaQuad/SPI case list. Dreamy Jazz 🎷 ^{talk to me | my contributions} 17:01, 2 February 2020 (UTC)

Must be the sock table coronavirus.--Bbb23 (talk) 17:05, 2 February 2020 (UTC)

Oops..., missed that. --qedk (t 桜 c) 18:43, 2 February 2020 (UTC)

I have just reactivated mine for the time being. I turned it off because I was no longer using it, and the updates seemed useless. That said, I'd be happy to put this and the rest of my bot's basic tasks into a project on labs (for when i'm not around) so that multiple people can start it up and fix issues if needed. Is that something people are interested in? -- Amanda (aka DQ) 18:55, 2 February 2020 (UTC)

That's a good idea, if there's a resource constraint you could make a webservice to just have one of us start it when the other one stops working. --qedk (t 桜 c) 19:14, 2 February 2020 (UTC)

I definitely don't have the time of day to turn it into a webservice. It's a simple handful of python files that is run every 10 minutes for the SPI one. I'll start looking into it, but anyone with enough Linux background and toollabs experience I'd be willing to consider. -- Amanda (aka DQ) 19:30, 2 February 2020 (UTC)

Just noticed a problem with DeltaQuad's table. Wikipedia:Sockpuppet investigations/Padavalamkuttanpilla has the closed case listed with the wrong date on the table.

The filing time for the closed case listed on the table is the same as the one which is still open. The case with status of clerk request was opened on the 7th of Jan and the ones closed were opened on 14th and 24th of Jan. The closed row for this case on the table should show the 14th of Jan instead of the 7th of Jan. Not a big issue, but it might want to be fixed. Dreamy Jazz 🎷 ^{talk to me | my contributions} 19:33, 2 February 2020 (UTC)

I am no longer working on the bots unless there are critical errors (as I am trying to keep my leave of absence in tact). I am aware and have been for a long time, it would require a lot of coding changes to adapt for this issue. If you are willing to take a crack at the code, feel free to suggest a fix on Github. -- Amanda (aka DQ) 19:42, 2 February 2020 (UTC)

@Dreamy Jazz: Just to further note, Amalthea's won't even double list, it will only use one of the statuses relevant. It becomes very difficult to determine it also if the case has 2 closed cases (then which case timestamp do I use?). I'm not going to add redundant lines, so I think this is down to  Won't fix. -- Amanda (aka DQ) 10:27, 18 February 2020 (UTC)

I don't have enough toollabs experience, but if you did host it on toollabs and give me maintainer access, I could fire it up and restart it when required. --qedk (t 桜 c) 19:56, 2 February 2020 (UTC)

I am working on my own table at User:Dreamy Jazz Bot/spitable, however, there is now a working table so I won't keep it updated for now. Dreamy Jazz 🎷 ^{talk to me | my contributions} 19:23, 2 February 2020 (UTC)

• Thank you, Amanda.--Bbb23 (talk) 20:05, 2 February 2020 (UTC)

I wrote a script to match the format of Amalthea's bot's output. Once the normal bot is turned back on, mine will automatically stop editing the case list. ST47 (talk) 00:38, 3 February 2020 (UTC)

If you think an IP is ban-evading, is this the place to report? It's been so long since I filed a check-user request, I can't remember. Thanks! —Мандичка^YO 😜 04:36, 20 February 2020 (UTC)

Hi, for some reason I opened up this SPI and it never showed up on the main page. Any ideas? --Mr. Vernon (talk) 01:43, 22 February 2020 (UTC)

@Mr. Vernon: If you remove the case status,[3] the case loses all its status. Try putting it back, with a parameter of 'open' -- zzuuzz ^(talk) 01:59, 22 February 2020 (UTC)

@Zzuuzz: Ugh, thank you. --Mr. Vernon (talk) 02:14, 22 February 2020 (UTC)

Please see Wikipedia:Deletion review#Wikipedia:Long-term abuse/WhenDatHotlineBling. --SmokeyJoe (talk) 05:15, 28 February 2020 (UTC)

Could a template similar to the "A long-term abuse case exists at..." be created for users who have persistently violated copyright? It would ideally say something along the lines of "The subject of this SPI has previously had issues with copyright (Link to CCI). Liberal reversion of their sock's edits is encouraged." It would be useful with dealing with users like Zawl, Superbrickbro, Billy Hathorn, Dante8, Chewygum, ARA SANTA FE, and Sayerslle, for a few examples, and would help prevent the backlog from getting any bigger at CCI. Money emoji💵^{Talk💸Help out at CCI!} 12:45, 2 March 2020 (UTC)

Money emoji, sure, I can crank something like that out today. ^creffpublic _{a creffett franchise} (talk to the boss) 13:35, 2 March 2020 (UTC)

Money emoji, got a prototype at Template:SPI_archive_notice/sandbox. Wording right now is: A contributor copyright investigation exists at Wikipedia:Contributor_copyright_investigations/(username). Edits by sockpuppets should should be reviewed for potential copyright violations. It depends on a CCI with the same username existing, but I imagine that if needed one could create a redirect. This would be added to the existing SPI archive notice, which already automagically links to the LTA page and would now automagically link to the CCI page as well. creffett (talk) 00:50, 3 March 2020 (UTC)

Creffett, Yeah... a redirect should work in cases where the cci is named after the date it was opened on to hide the users identity (Billy Hathorn, for example) or if the editor themselves were a sock (like DendroNaja). Thanks a lot for making it, it should make some of the more problematic nuisances easier to cleanup. Money emoji💵^{Talk💸Help out at CCI!} 01:56, 3 March 2020 (UTC)

Money emoji, Creffett, I've added a testcase to Template:SPI archive notice/testcases and I think some tweaks are needed:

1. The ordering. In terms of how an SPI case needs to be handled (and that's what the template is for) the original case name and cross-wiki activity are more pressing than the sock cleanup at CCI. The new text should be added at the bottom, not the top.
2. "Edits by sockpuppets should should be reviewed for potential copyright violations."... good luck at trying to get SPI clerks to act as copyright handlers. The text would be better if it said what you want the SPI clerk to do - and checking for copyvio isn't likely to be on the menu.
3. Whitespace. The new text is introducing unnecessary blank lines.

Just my 1st thoughts & 2¢. Cabayi (talk) 08:53, 5 March 2020 (UTC)

Trying to think through what the objective is, whose eyeballs we want to attract, and at what stage of the process... How about altering Timotheus Canens's spihelper.js so that when it archives a report (or reports) it also adds a report to CCI, even if it's just "New sockpuppets for this account have been reported at XXXX/Archive"? Cabayi (talk) 09:27, 5 March 2020 (UTC)

Cabayi, The intention was for people to revert the sock's edits more aggressively. I got the idea after two instances where I finished/almost finished a CCI (Wikipedia:Contributor copyright investigations/20191012 and Wikipedia:Contributor copyright investigations/Haikavin1990), only for a bunch of socks to be found and their edits dumped on my plate. To prevent that from happening, a note about the CCI encouraging reverting the socks edits would be very useful. Money emoji💵^{Talk💸Help out at CCI!} 20:07, 5 March 2020 (UTC)

I added a bit about presumptive removal - mass reverting is the best option for dealing with copyvio socks. It should also be taken as encouragement to liberally apply G5. MER-C 08:16, 6 March 2020 (UTC)

I used the HTML comment trick to get rid of the extra whitespace. ^creffpublic _{a creffett franchise} (talk to the boss) 20:19, 6 March 2020 (UTC)

Will leave it for the two(?) editors at RM on Talk:Animation in South Korea to explain for now. But FYI In ictu oculi (talk) 10:06, 7 March 2020 (UTC)

I can't tell why Wikipedia:Sockpuppet investigations/Akash199mishra is not showing a link to the case's archive. Anyone else seeing the same thing? Ivanvector (^Talk/_Edits) 13:48, 12 March 2020 (UTC)

This often happens until you WP:PURGE. I've done this. -- zzuuzz ^(talk) 13:59, 12 March 2020 (UTC)

Last night and this morning I went through a bunch of open and checked cases looking for ones that easily could be closed with no action or blocks so as to make the list less overwhelming for clerks and patrolling admins. I mentioned this to DeltaQuad off-wiki, but my one piece of feedback would be that I think clerks/patrolling admins should be a bit more comfortable closing cases with no action if a policy violation isn’t alleged or if the alleged abuse is too minor and stale to warrant action. These make up a significant portion of cases filed, and just letting them sit there for months makes them list more overwhelming to look at so people are less likely to investigate the cases that should be investigated.

That, and if you don’t explain to people the type of abuse or evidence we expect at SPI, they’re just going to keep reporting. There are also significant number of admins who don’t know they can block on their own if the evidence is strong enough, or who don’t think to block for regular ongoing disruption because they’re awaiting clerks or CUs at SPI. That’s no ones fault, but if we nudge them and let them know that SPI isn’t the only venue for dealing with repeat disruption, Wikipedia would likely be better :) TonyBallioni (talk) 15:46, 21 March 2020 (UTC)

I have just open an investigation that has been placed by Twinkle into Wikipedia:Sockpuppet investigations/XInolanIX#30 March 2020. This is a mistake as XInolanIX is not suspect to be a sockpuppet, and his only relation with the sock puppets it that one of the socks opened a fake investigation against him (and me).

The investigation should be named Wikipedia:Sockpuppet investigations/Elahadji, or, if the thread must be named after the oldest involved account, Wikipedia:Sockpuppet investigations/Brancojuan.

Could someone with more knowledge or more rights fix the mistake. D.Lazard (talk) 11:07, 30 March 2020 (UTC)

I've requested a clerk to use your report to create a new case.--Bbb23 (talk) 13:12, 30 March 2020 (UTC)

FYI, I've requested a tweak to Twinkle's handling of SPI reports at Wikipedia talk:Twinkle#SPI reports to check the master in the pagename matches the master in the {{SPI archive notice}}. Cabayi (talk) 12:09, 11 April 2020 (UTC)

Doctor Andrew Baldwin MD (talk · contribs · deleted contribs · logs · filter log · block user · block log) and his socks are none other than Nsmutte (talk · contribs · deleted contribs · logs · filter log · block user · block log) – the proof is here, where one of the socks brought up "Dr Sreehari Y". Nsmutte's serial socking started with Wikipedia:Articles_for_deletion/Y._Srihari. There are other hallmarks as well but I don't want to waste more of my life writing about this person – since the users are all blocked, the only thing that needs doing is to merge Wikipedia:Sockpuppet investigations/Doctor Andrew Baldwin MD into Wikipedia:Sockpuppet investigations/Nsmutte. --bonadea contributions talk 17:54, 13 May 2020 (UTC)

Hi there! Just wondering, but if these two users are the same person, should Wikipedia:Sockpuppet investigations/Atomic Meltdown/Archive be merged into the other one? BOZ (talk) 18:30, 17 May 2020 (UTC)

They're different people. They both edit comic book-related articles, however Atomic Meltdown has this fixation with late night talk show hosts Rymax23 lacks. It's fairly common more than one sockfarm will intersect on certain pages, and sometimes one sockmaster will purposefully imitate the behavior of another. Sro23 (talk) 19:46, 17 May 2020 (UTC)

Ah, interesting. User:Banana Mutant was connected to Atomic Meltdown after all then - I guess the new sock was telling the truth about one thing at least. ;) BOZ (talk) 20:22, 17 May 2020 (UTC)

If sock puppeteers edit long enough, they can get into grudges with other sock puppeteers. On reality TV shows, one reliable way to recognize Starbucks6789 and Leviathan648 is by their edit wars. One likes the table a certain way, and the other really hates it that way. So the table see-saws between them until I block both accounts and semi-protect the article. There are a couple other pairs like that, too. Sometimes they report each others' accounts at SPI. NinjaRobotPirate (talk) 04:22, 18 May 2020 (UTC)

Spirit Place is a new name name for Southwest Place and Linde Place which are already blocked. Spirit Place is making the same kind of strange "contributions" to articles about the Stockholm Metro, changing its name to the home made "Stockholm Tunnel Rail". That is a nonsense name, never used by anybody. It is just a litteral translation of "Stockholms tunnelbana". He must be stopped, because it is a lot of work to revert all this. --Andhanq (talk) 22:56, 3 June 2020 (UTC)

Reported by Dicklyon & handled at Wikipedia:Sockpuppet investigations/Linde Place. Cabayi (talk) 18:41, 4 June 2020 (UTC)

Would a clerk kindly rename Wikipedia:Sockpuppet investigations/CGSFH to Wikipedia:Sockpuppet investigations/Blue Barette Bam, along with any associated paperwork. User:Blue Barette Bam is in fact the oldest account. I'm aware this might look a bit like make-work, but trust me I am not big on bureaucracy. Given the disruption ongoing to this day, I think this might actually be useful. Thanks. -- zzuuzz ^(talk) 17:02, 5 June 2020 (UTC)

Done. Sro23 (talk) 17:12, 5 June 2020 (UTC)

Thanks. Thanks also for helping deal with this muppet. -- zzuuzz ^(talk) 17:36, 5 June 2020 (UTC)

Also Zzuuzz, I don't know how comfortable you are with modifying edit filters (I know I'm not at this point in time), but those seem to be a viable alternative to protecting every page this vandal targets. Sro23 (talk) 17:52, 5 June 2020 (UTC)

@Zzuuzz: Personally, I feel like this is a time to IAR because the vandal is much better known as CGSFH. But it doesn't matter too much in the end. -- King of ♥ ♦ ♣ ♠ 17:54, 5 June 2020 (UTC)

Most relevant things will redirect, and you're welcome to call them anything you like, so I don't think anything is lost from us. I find vandals can sometimes become too attached to their meme, and might sometimes benefit from being reminded of their early edits. -- zzuuzz ^(talk) 18:01, 5 June 2020 (UTC)

Hello, all,

This week I've come across two curious courtesy vanishing renames, both for editors who have been blocked for years. This made them stand out because all of the previous courtesy vanishing incidents I've come across were for editors in good standing who wanted to quit editing Wikipedia. I can't recall the name of the first editor but when I looked into the second editor who received a rename, it turns out that they were a long time sockpuppeteer. I've asked the renamer for an explanation but I would think that it would cause problems to basically erase all previous user pages for a sockpuppeteer. In fact, now, any new editor could assume the old names of this previously blocked editor.

So, I wanted to know whether this was a real problem for checkusers when you are keeping track of sockpuppeteers or is this not really a big issue at all. I hadn't expected to find such a mess with the second editor but the more that I looked, the more tangled past I found. Thanks. Liz ^{Read! Talk!} 05:08, 6 June 2020 (UTC)

I’m a renamer as well. Typically those aren’t granted and it was probably an oversight because the rename backlog now is pretty long. I personally find them difficult when dealing with sock cases because it’s easier for me to remember “real” names and piece things together that way. Not everyone feels that way. I also don’t get why it matters unless it’s a real name account, which is why I’m less sympathetic unless there are privacy reasons. TonyBallioni (talk) 05:44, 6 June 2020 (UTC)

It's rare, but sometimes a vandal or sock puppeteer wants to move on. Very rare. NinjaRobotPirate (talk) 06:40, 6 June 2020 (UTC)

Okay. I appreciate the response. Thanks! Liz ^{Read! Talk!} 15:25, 6 June 2020 (UTC)

On a related note, I've seen a distinct uptick in these types of requests over the last couple of days. There's currently a request in the OS OTRS queue for courtesy vanishing and I just explained to this account that was blocked 6 years ago that deleting accounts is not possible. I'm starting to think there's an off-wiki discussion "out there" suggesting old blocked accounts request deletion/vanishing.-- Jezebel's Ponyo^{bons mots} 17:54, 6 June 2020 (UTC)

A random newish user seeks deletion of a sockpuppet userpage. See Wikipedia:Miscellany for deletion/User:Prinsipe Ybarro. —SmokeyJoe (talk) 04:01, 13 June 2020 (UTC)

Hi, as you can see on the COI Noticeboard here, I discovered a very extensive, undisclosed WP:PAID editing campaign by a company. An administrator notified me the next steps would be to have the dozen or so named accounts involved banned (and potentially the IPs as well, not sure). Is this where I would initiate that request/investigation? The admin, DDG, characterized them as meatpuppets--they are not the same person, but almost certainly directed by the same company, so I'm not sure CheckUser would be particularly revealing. A link to my comprehensive investigation is also available on the COI noticeboard link above, and I sent additional "open source" evidence tying the accounts to specific employees at EG to paid-en-wp [at] wikipedia.org yesterday as well. WhinyTheYounger (talk) 16:58, 15 June 2020 (UTC)

Hi WhinyTheYounger, thanks for bringing this up. Yep, this is the right place to file; it can be complicated the first time you do it so if you run into issues let me know. For the reference of others the ticket here is ticket:2020061410006955 (CU OTRS only). Best, Kevin (aka L235 · t · c) 03:21, 16 June 2020 (UTC)

• Murjrathnam Nebal (talk · contribs · deleted contribs · logs · filter log · block user · block log)
• Wikipedia:Sockpuppet investigations/Habashiyuma
• Wikipedia:Sockpuppet investigations/editingdanielbalaji
• Wikipedia:Sockpuppet investigations/Robertfranci
• Wikipedia:Sockpuppet investigations/Ibrahim Rowther

A new user filed 4 SPI reports against (mostly) blocked and stale users, offering no evidence, and requesting IP checks. I've blocked him for disruptive editing. Anybody have any complaints against deleting all 4? Cabayi (talk) 11:00, 22 June 2020 (UTC)

Looks like the filer might be another sock of Abcdef7890/Skdklddhudke, per the first report in Wikipedia:Sockpuppet investigations/Abcdef7890/Archive. Unless I'm mistaken about that, it would be reasonable to delete the SPIs as created by a blocked editor. --bonadea contributions talk 11:24, 22 June 2020 (UTC)

I support deleting (definitely at least Ibrahim Rowther as I checked that one and found no evidence). Dreamy Jazz ^{talk to me | my contributions} 20:36, 22 June 2020 (UTC)

I just archived Wikipedia:Sockpuppet investigations/Joveal George Joshua, but failed to notice that there were two cases on the page and one of them was still open. What's the best way to fix that? Should I just revert the edits to the active and archive pages? -- RoySmith (talk) 00:07, 2 July 2020 (UTC)

Correct. You can just revert your edit on the main SPI page and blank the second case on the archive. Or if you want, just delete the archive. It might be easier that way but it's up to you. Sro23 (talk) 00:25, 2 July 2020 (UTC)

Sro23, Thanks. Done. I wish all my screw-ups were that easy to fix :-) -- RoySmith (talk) 00:32, 2 July 2020 (UTC)

Please join the discussion at Wikipedia talk:Sockpuppet investigations/SPI/header#Template-protected edit request on 28 March 2020. —⁠andrybak (talk) 16:11, 2 July 2020 (UTC)

{{SPIpriorcases}} seems to be inhibiting the display of headers at Wikipedia:Sockpuppet investigations/Bambifan101, so I commented it out. NinjaRobotPirate (talk) 10:56, 8 July 2020 (UTC)

Jonesey95 made some changes to that template on 4 July supposedly to address the issue of headers not rendering on a different case. Maybe they can comment here? Evidently more work is needed. Ivanvector (^Talk/_Edits) 14:58, 8 July 2020 (UTC)

Man, that is strange! The date header was being rendered, but it was invisible. If you copied and pasted the text on the page into a text editor, the date showed up fine. Anyway, I added a {{clear}} template to {{SPIpriorcases}}, and that seems to have fixed this particular problem. The template still needs a bit of work, and it is challenging to create test cases for it, because it is context-sensitive based on the case history for a particular editor. – Jonesey95 (talk) 16:37, 8 July 2020 (UTC)

Would some CU please grant IP block exempt to my alt Usernamekiran (AWB) per CU Ticket#2020070810007624? Courtesy ping to Risker —usernamekiran (talk) 15:16, 13 July 2020 (UTC)

 Done for the same duration as your main account. Mz7 (talk) 22:03, 18 July 2020 (UTC)

Seems like Wikipedia:Sockpuppet investigations/Cases/Overview has not updated since 08:10 today. There have been new CU requests and they haven't been listed. I've switched to the backup for now to keep things going. @Amalthea: any idea of a cause and when the bot will restart updating the list? Dreamy Jazz ^{talk to me | my contributions} 11:11, 17 July 2020 (UTC)

Amalthea has not been active since May 2020 when they made two edits. They have made less 200 edits since 2017. I have made a bot request at Wikipedia:Bot_requests#Amalthea_(bot). --- C&C (Coffeeandcrumbs) 04:40, 23 July 2020 (UTC)

Could someone with the power to edit Wikipedia:Requests for checkuser tweak the category? Category:Wikipedia sock puppetry has moved to Category:Wikipedia sockpuppetry but the bot that moved the category couldn't change that page. Le Deluge (talk) 11:06, 23 July 2020 (UTC)

Le Deluge: I found the sub-page where this category needed to be edited. Thanks. – Fayenatic London 18:23, 23 July 2020 (UTC)

was recently blocked as a sock of Skoojal, and filed under that account. But there's also a page at Wikipedia:Sockpuppet investigations/FreeKnowledgeCreator. Should they be merged? ——Serial 06:43, 28 July 2020 (UTC)

Looks like Skoojal was the earlier account. I agree that the two cases should be merged. Binksternet (talk) 07:33, 28 July 2020 (UTC)

In theory, they should be merged (and Freeknowledgecreator should be renamed since the master account got renamed), but neither case has any activity in five or more years. NinjaRobotPirate, you did the block - any thoughts? GeneralNotability (talk) 13:09, 28 July 2020 (UTC)

I usually leave that decision up to the clerks. My own view is that we should more often consider leaving well enough alone. In this case, both of the sock farms have a significant history and overlapping edits, which can used to identify new socks. That strikes me as a decent reason to combine the cases. However, I find it a bit silly when people repeatedly move a case to be under the name of a newly discovered "burner account" that made one or two edits before being abandoned. NinjaRobotPirate (talk) 20:17, 28 July 2020 (UTC)

That's a good point. Perhaps "well enough" would simply be adding links to each other in both pages. Binksternet (talk) 04:40, 29 July 2020 (UTC)

I don't see FKC listed among the Skoojal SPIs (which stop in 2013) and there isn't an entry for May 2020 in their own SPI archive, were they never actually investigated/checkusered due to being blocked for other reasons? JoelleJay (talk) 01:26, 29 July 2020 (UTC)

• (Courtesy ping to NinjaRobotPirate, whose block it was—apologies for the delay! ——Serial 09:15, 29 July 2020 (UTC))

Hello everyone! I am compiling a list at User:Usedtobecool/Tea intended to be used by regular hosts at the Teahouse for questions that are about to get archived unanswered (happens rarely but often enough). From memory, I reckon, once or twice a year, Teahouse gets an SPI-related question that is answered "I think... but I am not very experienced with SPIs". For those occasions only, I am seeking willing volunteers to be listed in the aforementioned list under "SPI procedures". Off the top of my head, I am thinking of asking @Mz7, Ivanvector, and Vanjagenije: based on the frequency with which I encounter them handling cases, but I have also seen @Drmies, TonyBallioni, MER-C, El C, Dreamy Jazz, and AmandaNP: investigating cases on occasion, and more recently, increasingly, @RoySmith and GeneralNotability:. Any volunteers? I need at least a couple CUs. If I can't find a few volunteers from among the pinged or those who come across this post, I will need to reach out to more editors, so any suggestions? Also, other obvious choices that I've missed owing to my very limited watching of and working in SPI. Thank you in advance, and best regards! Usedtobecool ☎️ 12:59, 20 August 2020 (UTC)

@Usedtobecool: Feel free to add me, but I am not a CU. Vanjagenije (talk) 13:03, 20 August 2020 (UTC)

Usedtobecool, although I am still a trainee SPI clerk, I am happy to be added to the list if no one else steps forward. Dreamy Jazz ^{talk to me | my contributions} 13:05, 20 August 2020 (UTC)

Usedtobecool, Like Dreamy, I'm a clerk-in-training-wheels, but I'm certainly happy to field questions if pinged. -- RoySmith (talk) 13:24, 20 August 2020 (UTC)

Usedtobecool, it might be worthwhile to have a link to Wikipedia:Sockpuppet_investigations/SPI/Clerks#List_of_clerks and basically say "if you know anyone on the active clerks list, try pinging them." (Also, I'm happy to be listed, but as with Dreamy Jazz and RoySmith I'm still in trainee diapers) GeneralNotability (talk) 13:31, 20 August 2020 (UTC)

Missing Cabayi was a definite brain fade from me; I've seen them around more than anyone else. GN, The idea is to be able to ping editors who have explicitly indicated a willingness to be; I have observed unsolicited pings give rise to acrimony depending on other variables in the communication. I have done pings from the Teahouse before but always felt a bit uncomfortable, and I haven't seen anyone else doing it. One given to being on the list is that editors may be pinged in groups and all editors who follow the ping after the first one might find the question already taken care of. So, it would also have to be a willingness to follow unproductive pings a few times a year. Best, Usedtobecool ☎️ 13:46, 20 August 2020 (UTC)

Feel free to add me as well. The list at WP:SPI/C doesn't include checkusers, just so you know. Checkusers are listed here, but many of the users listed there have checkuser access by virtue of holding other community positions and aren't actually active in sockpuppet investigations. It should be fine to refer users with questions to the clerks list, but probably not the checkuser list. Ivanvector (^Talk/_Edits) 14:20, 20 August 2020 (UTC)

Sure. Drmies (talk) 16:25, 20 August 2020 (UTC)

Happy to help if I can. Cabayi (talk) 17:32, 20 August 2020 (UTC)

User:Kidhackr (edit | talk | history | links | watch | logs) seems to prefer socks whose names have "Kidhackr" or "Jaiden" in them (see SPI for the latest incarnation, Jaidenmala/contribs). Is it practical to get a daily or several-times-a-day report of edits or account-creations made by new-ish - say, not yet autoconfirmed or not yet extended-autoconfirmed - whose names match known-favorite-name patters, such as Jaiden*? Whether it's feasible or not, would it be as helpful as it seems at first glance? davidwr/(talk)/(contribs) 19:13, 5 September 2020 (UTC)

Davidwr, if a sockmaster is known to use a particular string in their username and that string is fairly distinctive, we can add a check to DeltaQuadBot's UAA blacklist. The problem, of course, is that more sophisticated sockmasters will notice this and change their patterns. GeneralNotability (talk) 00:41, 6 September 2020 (UTC)

I'm not sure we want an actual blacklist, more of an "Alarm list" as others may want to use that string legitimately. Basically, if a new account is created by, say, Jaidenmalalala, I'll want to see that and watchlist his user page. Once a person or bot writes to his talk page - probably to give him a welcome or warning, or once he creates his user page, I'll check his contribution history. Ideally, I'd be able to "watchlist" his contribution history but I don't think Wikipedia software can do that. If I'm wrong, please show me how. davidwr/(talk)/(contribs) 00:53, 6 September 2020 (UTC)

Davidwr, that is an alert list, "blacklist" is a bit of a misnomer - anything that matches one of the rules will get added to Wikipedia:Usernames_for_administrator_attention/Bot where a passing admin will review it, and the bot can be told to add specific comments (in fact, I think there is functionality specifically designed for "users with this username should be compared against sockmaster X"). And no, there isn't any functionality to watchlist a specific user's contribs; it would be incredibly useful, but it also could be misused pretty easily. GeneralNotability (talk) 01:05, 6 September 2020 (UTC)

@GeneralNotability: Sounds like we already have a good solution then. davidwr/(talk)/(contribs) 01:08, 6 September 2020 (UTC)

@GeneralNotability: I spoke too soon, that list is for "block on sight" names. We need something a little softer, one that doesn't necessarily need administrative attention immediately, just the attention of people willing to watch the person and if necessary start an SPI or otherwise get the attention of an administrator. davidwr/(talk)/(contribs) 01:33, 6 September 2020 (UTC) Update Maybe the combination of LOW_CONFIDENCE and SOCK_PUPPET could be useful. The number of false positives may make it less than useful though. At least it's a starting point - I could run my own version of the bot to generate an off-wiki report. davidwr/(talk)/(contribs) 01:43, 6 September 2020 (UTC)

I think adding the prefix Jaiden* to 579 could make sense and it already exists for essentially a similar purpose. Thoughts? N.J.A. | talk 11:22, 6 September 2020 (UTC)

I'll have to take your word for it, that filter is wisely hidden from public view. davidwr/(talk)/(contribs) 14:50, 6 September 2020 (UTC)

It depends on what kind of response you want. My bot post to UAA about it until it has edited. Filter will log automatically, but the filter also won't pop out and say "hey this was done" you have to go check it, where as my bot flags it. Basically it comes down to how much you want to be annoyed about it. -- Amanda (aka DQ) 05:15, 7 September 2020 (UTC)

The Arbitration Committee is seeking to appoint additional editors to the Checkuser and Oversight teams. The arbitrators overseeing this will be Bradv, KrakatoaKatie, and Xeno.

The usernames of all applicants will be shared with the Functionaries team, and they will assist in the vetting process.

This year's timeline is as follows:

• 7 September to 19 September: Candidates may self-nominate by contacting the Arbitration Committee at arbcom-en-cwikimedia.org.
• 20 September to 23 September: The Arbitration Committee and Functionaries will vet the candidates.
• 24 September to 26 September: The committee will notify candidates going forward for community consultation and create the candidate subpages containing the submitted nomination statements.
• 27 September to 7 October: Nomination statements will be published and the candidates are invited to answer questions publicly. The community is invited and encouraged to participate.
• By 14 October: Appointments will be announced.

For the Arbitration Committee, Katie^talk 23:03, 6 September 2020 (UTC)

The Arbitration Committee is seeking to appoint additional editors to the Checkuser and Oversight teams. The arbitrators overseeing this will be Bradv, KrakatoaKatie, and Xeno.

The usernames of all applicants will be shared with the Functionaries team, and they will assist in the vetting process.

This year's timeline is as follows:

• 7 September to 19 September: Candidates may self-nominate by contacting the Arbitration Committee at arbcom-en-cwikimedia.org.
• 20 September to 23 September: The Arbitration Committee and Functionaries will vet the candidates.
• 24 September to 26 September: The committee will notify candidates going forward for community consultation and create the candidate subpages containing the submitted nomination statements.
• 27 September to 7 October: Nomination statements will be published and the candidates are invited to answer questions publicly. The community is invited and encouraged to participate.
• By 14 October: Appointments will be announced.

For the Arbitration Committee, Katie^talk 23:03, 6 September 2020 (UTC)

I found a proposal offering paid Wikipedia editing on Freelancer, and the proposal gave three examples of articles representing the editor's work: List of hot dog restaurants, hot dog stand, and Mall of Memphis. None of these have a creator in common.

Is there a tool that lets me feed in a list of articles and it outputs a list of editors who have edited all articles? ~Anachronist (talk) 18:06, 30 August 2020 (UTC)

Anachronist, I don't know of one, the closest I know of is a tool to get a list of distinct editors among a given list of articles (not perfect, but you can start at the top and work your way down until you reach people with fewer than 3 edits). Here's the query that answers your request: [4]. I don't see anything jumping out at me from that list. Remember, of course, that paid editors a) often lie about the articles they've worked on, and b) might be using socks if they did actually work on those articles. GeneralNotability (talk) 18:56, 30 August 2020 (UTC)

See the article/editor intersection tool. NinjaRobotPirate (talk) 06:26, 31 August 2020 (UTC)

Thanks! Based on that, the freelance editor is likely using sockpuppets. I don't see an editor common to all three articles I mentioned. ~Anachronist (talk) 14:47, 31 August 2020 (UTC)

NinjaRobotPirate, ooh, neat, I hadn't seen that one before. Added to my SPI bookmarks. GeneralNotability (talk) 15:06, 31 August 2020 (UTC)

Mall of Memphis is a strange one to claim; the mall was demolished in 2004. I wonder if the advert had a typo? ☆ Bri (talk) 21:42, 15 September 2020 (UTC)

I've been feeling troubled by the interaction between WP:DENY & SPI. While the intention to deny recognition to vandals is sensible, doing that by failing to tag socks impedes most editors in their vigilance against further socking. I'd suggest that, if we make the tag less of a trophy - no image, no box, no bold text - we can return to tagging all culprits without feeding their vanity.

I've drafted a version in {{Sockpuppeteer/sandbox}}, Special:Permalink/978871298 by stripping all embellishment from the current live version. Testcases at {{Sockpuppeteer/testcases}}. Cabayi (talk) 12:34, 17 September 2020 (UTC)

Cabayi, Makes sense to me. -- RoySmith (talk) 12:59, 17 September 2020 (UTC)

I don't think it's that big of a deal, honestly. Tagging or not tagging Orchomen socks isn't really going to change anything. Orchomen isn't going to suddenly stop engaging in sock puppetry because you didn't tag his latest sock, and I doubt anyone will find his sock puppets any quicker or easier if you do tag them. However, an immature vandal like My Royal Young might compete to become English Wikipedia's #1 most active sock puppeteer if you give him a high score to beat. NinjaRobotPirate (talk) 05:28, 18 September 2020 (UTC)

• I think SPI does a fabulous job, procedurally, professionally, and keeping the mess contained. I don't think it flatters any fool for long to collect archived SPI subpage trophies, and the lack of ongoing processes on their userspace gives the message: "dealt with, no one cares". This relates to my skepticism of the wisdom of random people (not SPI affiliated people) bringing pages to MfD on the basis that they were created by a now SPI-blocked account. --SmokeyJoe (talk) 07:58, 18 September 2020 (UTC)

Hey, just giving you guys a head's up. In a prior comment on their talk page FocoCasti threatened to create sockpuppets and generally evade a block if they were ever blocked. I ended up blocking them for hostile posts on REFUND combined with their general edit/action history, but I kind of expect them to try to evade a block. TBH, for some reason I kind of get the feeling that this account is probably not their first and that it's a sock of another, earlier account. ReaderofthePack(formerly Tokyogirl79) (｡◕‿◕｡) 04:45, 22 September 2020 (UTC)

I did look into this, and no action is needed at this time, nor can I determine a proper master with any certainty. -- Amanda (aka DQ) 04:41, 3 October 2020 (UTC)

Wikipedia:Sockpuppet investigations/Praytvresmi had ducks quacking so loudly that I only put the diffs in because they were "required." All accounts - now blocked by the way - either had a history of bad behavior or they were new and had few if any bad edits outside their own user-space.

My question is, the next time I see something where it's sufficient to say "see contribution and log history for each" because those histories are 90%+ evidence of sock- or meat-puppetry, so you, the checkusers and SPI clerks, still need specific diffs as examples? davidwr/(talk)/(contribs) 00:51, 3 October 2020 (UTC)

Davidwr, "Need" is a slippery concept. The easier you make it on the person working the case, the more likely it is that it'll get addressed quickly. I'm not going to refuse to look at a case because it doesn't have diffs, but I'm also more likely to spend a short amount of time on it, not make any progress, and then just move on to the next case. If you've been following a sock for a long time, you may be more familiar with the case history than the person working it. So why not share your knowledge and make it easier on everybody? -- RoySmith (talk) 02:30, 3 October 2020 (UTC)

I'm going to take slightly more hardline position on this than Roy. You may not need diffs, specifically, but you do need specific examples. From the introductory paragraph at WP:SPI: You need to actually show why your suspicion that the accounts are connected is reasonable. If all you say is "see contribution and log history for each", I don't know why you suspect sockpuppetry, much less whether or not that suspicion is reasonable. For me anyway, the minimum requirements for an SPI filing are a description of the repeated behaviour that makes you suspect sockpuppetry, and clear examples of that behaviour for each of the suspected socks, as well for the master account or previous socks. Diffs are usually most effective way of presenting these examples. Sir Sputnik (talk) 03:16, 3 October 2020 (UTC)

Thanks RoySmith, Sir Sputnik, that is helpful. More specifically, was the final sentence "Specific diffs because the instructions say so:...projects" in the Praytvresmi SPI necessary, given everything before it? davidwr/(talk)/(contribs) 03:45, 3 October 2020 (UTC)

I'm not sure what your specific latest question is, but I'll say this...when I'm looking at an SPI from a CU standpoint, I will first look for diffs, if I don't see that, I'll cursory glance the contribs page. If I can't figure out what it is that justifies my check in those two steps, it's going to wait 3 or 4 days before I have the full time to sit down and look to see if I can connect the dots. When I look at that page, I saw the three Praytv named accounts, and that was my justification right there, ran the check, and got lucky to find the rest so I didn't have to look beyond that. Basically, all we need is a reason. 1 set of diffs, a quick explanation that shows us why this couldn't be anyone else. We CUs don't want to read your 5 paragraphs as much as you don't want to write it. Short and sweet is absolutely fine, as long as you are to the point about why, that's all we need. And since that is the very low bar, I will take TFDs stance below and say if it's not there, it's gonna sit and sit and sit. Hope this helps, -- Amanda (aka DQ) 04:30, 3 October 2020 (UTC)

If you don't have the time to explain why you think an account is a sock, don't expect the clerks to take the time to investigate. TFD (talk) 03:43, 3 October 2020 (UTC)

• To be honest, most people are really bad at filing SPIs and I do my own behavioural investigation before reading the SPI that’s been filed a lot of the time. It’s usually quicker that way. What is helpful is billet points and side-by-side diffs with a brief non-conspiracy theory explanation as to why it’s one person not two. Paragraphs that at aren’t easily parsed make up the SPI backlog. TonyBallioni (talk) 06:01, 3 October 2020 (UTC)
• There's nothing more exasperating than "I've got proof! Guess what it is." Who's got 358 years to spare? Cabayi (talk) 08:40, 3 October 2020 (UTC)
• For a great example of how failing to provide diffs makes an SPI case harder to work, see Wikipedia:Sockpuppet investigations/Dcelano#30 September 2020 -- RoySmith (talk) 12:35, 3 October 2020 (UTC)

  RoySmith, my rule of thumb is I don't usually include diffs if what I'm describing would be obvious to anyone after going through the casepage archive, and then the actual evidence would be available on the first pages of the article's history and the user's contributions (the user has <10-15 contributions total), rationalisation being that most SPIs are more about patterns than comparing a pair of diffs or two. And I don't usually include logs either. I currently have two pending requests, Ssapkota23 and Petter noca. Would you care to take a look and tell me if the details I gave are too scant, or too much of the irrelevant? Reading Tony mention "conspiracy theory explanation" above, I feel I might have done just that with Ssapkota filing :D I can see that they have been viewed a few times but there is no action, so at least some people must have seen and skipped them?

  My first report was very detailed and I think nobody read it in full, and that's guided my reporting ever since. But I haven't received any specific advice about how to do better. So, perhaps, clerks should consider telling users (those who aren't newbs) what's wrong with their report and how they could improve? That would certainly be more useful, IMO, than most talk page warnings we, the regular Wikipedians, give each other over nothingburgers. Regards! Usedtobecool ☎️ 13:19, 3 October 2020 (UTC)

  Usedtobecool, I took a look at Wikipedia:Sockpuppet investigations/Ssapkota23. Here's a few comments on how you might improve the case presentation.

  • As a minor detail, where you say, They asked me to review Shirish Devkota which I declined, a link to the diff showing them asking you would save a clerk some time looking that up.
  • The most important thing I see here is that Anupamsuwar recreated the article which was originally created by Ssapkota23, so that's what you want to put up front. For sure, the fact that you're not an admin, so can't see the deleted history, is a roadblock for you to do a pre-investigation, but maybe you could ping an admin (maybe WP:REFUND?) and ask them to do a history restore. If you explained that you wanted to compare the original and recreated versions for evidence of sockpuppetry, I think most admins would be happy to do that for you. There's really no downside to the history restore unless there's copyvio or WP:BLP issues. I've gone ahead and done that for you. I'll leave the actual comparison of the text, and updating the SPI with your conclusions as an exercise for the reader :-)
  • I might point out that handing out barnstars left and right is not typical new user behavior (with links to each diff).
  • More generally, be fanatical about cutting out words that aren't needed. "Ssapkota came here to create" -> "Ssapkota created". "a clearly non-notable individual" doesn't add anything SPI-wise. "They then created articles on notable folk singer" -> "created". "which made me suspicious that their series of articles on Nepalese folk singers could be an UPE batch job" could be dropped entirely. Likewise, the stuff about exhausing community patience. As Joe Friday said, "Just the facts, ma'am". -- RoySmith (talk) 13:54, 3 October 2020 (UTC)

    RoySmith, I think I was trying to create a story. The problem, as it appears to me, is SPI is actually like other adminny admin intervention boards while I don't have as much confidence in COIN. Both COIN and ANI require reported users to be notified and is open to the peanut gallery. So, I might have been tempted to dump all my problems to SPI. I will take care to carefully consider what's relevant for the SPI, in the future.

    I didn't even know that histmerges like that were allowed. Apparently, it just sorts all available entries by date, so it took me a while to figure out but I think I got it. I probably should have asked for the articles on Mark X Lowney and Tushar Ganeriwal too because I don't exactly remember how they looked. But, anyway, better? Usedtobecool ☎️ 03:26, 4 October 2020 (UTC)

Hello, I want to start a sockpuppet investigation but I'd like to know if there are tools I can use for comparing contributions of past sockpuppet accounts and a current sockpuppet account of which I am suspicious. In particular, I'd like to know if there are tools for searching contributions based on keywords instead of just a list of common Wikipedia articles, and see if there are similarities between the specific edits/contributions of the suspected account and those of the past confirmed sockpuppets. Thank you. Stricnina (talk) 11:28, 27 September 2020 (UTC)

Hi Stricnina, somewhat similar would be this tool, which automatically appears on SPI reports as the Interaction Timeline, and this tool, which appears in each page history as the "alternate" of "Find addition/removal (alternate)". The first one I mentioned gives a "chronological history for two users on pages where they have both made edits", listing the article, section, and edit summary, and letting you view the edit itself easily; the second allows you to input text, and it will find any past edits that added it (helpful for finding diffs if a possible sock is adding text that you suspect was added by another sock in the past). The non-alternate version of the tool works in non-article space and finds removals too, but it's more confusing to use. Crossroads ^-talk- 03:02, 7 October 2020 (UTC)

Given the availability of Special:Investigate, I think it would be helpful to have a userscript which links to Special:Investigate with multiple accounts and IPs pre-selected. (Currently the {{checkuser}} template only prefills one username, and that's the best the template can do.) Is it possible to have a script check all of the users listed in {{checkuser}} templates in the current page and in the archive, provide the checkuser with a list of non-stale accounts (perhaps listing some basic info such as registration date, last edit, is it currently blocked, is it currently glocked), and allow the CU to use checkboxes to select which accounts to check? And then link to Special:Investigate with those accounts selected? ST47 (talk) 23:47, 8 October 2020 (UTC)

ST47, Some of the functionality you describe is already available in my Spi Tools. https://spi-tools.toolforge.org/spi/. It would be straight-forward to add the ability to build a Special:Investigate link. -- RoySmith (talk) 01:38, 9 October 2020 (UTC)

I'm concerned about how much information should be publicly provided in sockpuppet investigations, as I don't want to inform the puppeteer of how they can evade detection in the future, given they appear highly motivated. Is this a reasonable concern? I'm willing to make it easier for investigators and I'm sure this is something that has been discussed before. Should I wait until someone says I haven't provided enough? I'm referring to Wikipedia:Sockpuppet_investigations/The_Little_Platoon. Thanks. Onetwothreeip (talk) 21:12, 9 October 2020 (UTC)

I think the meta-level answer to your question is above and the specific-case answer I've left for you on the SPI. -- Amanda (aka DQ) 04:16, 10 October 2020 (UTC)

It's been 24 hours and we still require some clarification on the information needed for this investigation. Thanks. Onetwothreeip (talk) 04:05, 11 October 2020 (UTC)

Onetwothreeip, 24 hours isn't very long in SPI land. You have added comments in CU/clerk section in your SPI; please move your comments to the filer section. Regards! Usedtobecool ☎️ 04:13, 11 October 2020 (UTC)

Could somebody more experienced than me take a look at Wikipedia:Sockpuppet investigations/Wikinger. Due to some confusion about what was requested, I moved the entire case instead of just one section. I don't know the best way to unwind the problem. -- RoySmith (talk) 17:25, 11 October 2020 (UTC)

@Newslinger: This should be a fairly straightforward hist-split. Everything this year is not Wikinger. If it's not done in about an hour, which I'm sure it will be, I'll be happy to sort it out. -- zzuuzz ^(talk) 17:33, 11 October 2020 (UTC)

zzuuzz, are you okay with me doing this, or would you prefer to have an SPI clerk handle it? — Newslinger talk 17:35, 11 October 2020 (UTC)

Personally, I'm indifferent about who does it, and if you'd like to then be my guest. The first step is restore the previous status quo, which surely anyone can do. But I'm going to be in the kitchen for the next hour. -- zzuuzz ^(talk) 17:40, 11 October 2020 (UTC)

Okay, I'll start the history splitting now. — Newslinger talk 17:42, 11 October 2020 (UTC)

Newslinger, Much appreciated. -- RoySmith (talk) 17:57, 11 October 2020 (UTC)

Newslinger, If you ping me when you've got everything back to where it was before I smashed things to bits, ping me and I'll take another shot at doing the case move the correct way. -- RoySmith (talk) 17:58, 11 October 2020 (UTC)

​No problem, and the history splitting is all done! Thanks for handling the case move. — Newslinger talk 17:59, 11 October 2020 (UTC)

Newslinger, OK, I think I finally got this right. My many years of sysadmin have taught me that once you've dug yourself into a hole, the best thing is to stop, take a deep breath, read the instructions, and find somebody with more experience to transfer blame to help you out. -- RoySmith (talk) 18:11, 11 October 2020 (UTC)

​Thanks for completing the case move. I wouldn't consider myself more experienced, but Wikipedia:Requests for history merge makes for good practice with history merging/splitting if you're inclined. I've only done one manual history merge before, but I think it's one of those things that become intuitive after doing it the hard way once. — Newslinger talk 18:16, 11 October 2020 (UTC)

Nice work everyone, thanks. -- zzuuzz ^(talk) 19:42, 11 October 2020 (UTC)