Spam is when outside groups try to use Wikibooks as a vehicle for advertising. Spammers, often automated spam programs, insert links to external commercial websites on various pages.
Vandals are not financially motivated. They disrupt the project by adding inappropriate pages and content.
There are several common types of disruption that have occurred at Wikibooks in the past. Some of these types have been mitigated through technical measures. Some have simply become less popular for vandals over time. Others are still in occasional use. In general, Wikibooks has very low levels of spam and vandalism, especially compared to what it once had. However, it's a problem that never goes away completely and that our administrators and vandal fighters should be prepared for.
There are dozens of other types of vandalism, and many repeat vandals have particular signatures that can be used to identify their handiwork. However, these are some of the main types to be aware of.
Some Wikibookians watch theRecent Changes list to try and monitor for vandalism. Other users monitor the vandalism alerts on IRC. Sometimes users will find vandalism and report them at theAdministrative Assistance reading room. A good admin should keep these pages on their watchlist, or find another way to stay alerted about vandalism.
Many types of vandalism will become obvious on the recent changes list, such as page-move vandalism, edit summary vandalism, or page blanking.
When fighting vandalism, the first task is to block the offending user. The length of the block depends on various factors. Once the user is blocked, you can start reverting the vandal edits.
However, if there are multiple vandals, checkuser help is going to be needed to determine where the vandals are coming from. A checkuser can determine if multiple vandal accounts are coming from the same computer and if so, block all of them at once. Another benefit to checkusers is that when a source for vandalism has been blocked, no new vandal accounts can be created from that computer. Here is a general checklist or playbook to follow when dealing with a vandal:
If the vandal creates inappropriate pages or uploads inappropriate images as part of the vandalism, they cannot be reverted and need to be deleted. Admins can delete the page, while other users can mark it with{{delete}}.
A side note to the discussion about vandalism is the discussion about open proxies. An open proxy is an internet IP address which is available for other people to use. The result is that a person can appear to be editing from the open proxy, while concealing their real IP address. WMF policy is that open proxies should be banned for a year. While this isn't always ideal (there are many people who rely on open proxies for regular internet access) it does cut down on vandalism dramatically.
Some admins choose to mass-block open proxies, some admins choose not to bother with it. Technically, an open proxy can be blocked indefinitely, but we don't make people do it if they don't want to.
Some vandals are highly determined, and may use multiple user accounts and multiple IP addresses (typically open proxies) to attack. Sometimes, these attacks can feel overwhelming. Here are some tips for getting through a difficult vandalism attack:
Blocking users is a necessary weapon in the fight against vandalism. However blocking non-vandals is something that should almost never be done, except in the most extreme circumstances. User blocks can be very disruptive and demoralizing. For that reason, except in cases of obvious vandalism or serial spam should a user be blocked. However, a block is not a one-size-fits-all solution, there are many options that can be set by the blocking admin to affect the way a block is performed.
The duration of a block is the most obvious option that an admin can modify. A user can be blocked for as little as a few minutes, and as long as indefinitely. When deciding a block duration, the admin should check how long similar blocks have been for in the past, and how serious was the offense.
Users who are being disruptive but are acting like a new user (adding "friends of gays" vandalism, or making test edits) should be talked to first. If they don't respond to messages, they can be blocked for a short period.If you block a user temporarily, leave a message on their talk page explaining how long the block was, why they were blocked, and what the expectations are for them to return to regular editing. Some users will just disappear after that, others will learn their lesson and become normal editors here.
Some users are not so harmless and actually make a concerted effort to disrupt the project. These types of users are "vandals", and can be dealt with more suddenly and harshly. These users, who are only interested in disruption and are not experimenting, are not ever going to become normal editors and do not need to be warned or treated kindly. Accounts which have been created for the sole purpose of vandalism can be blocked indefinitely on sight without warning.
There is a drop-down list of the most common blocking reasons. If possible, a reason should be selected from the list when a user is blocked for a common offense. Sometimes, the reason why a user is blocked is not well-suited to the pre-existing explanations, and a custom explanation is in order. When explaining a user block, be as descriptive as you can to show why the user has been blocked. These reasons will appear in the logs so that they can be considered by future admins who might be considering an unblock request.
There are three options when blocking users which may have a profound effect on the user. Some of these options are cryptic:
Historically, one had to unblock and re-block a user to change the settings of the block. Recently, this was changed so administrators can change the settings without unblocking. Use the "change block settings" link, or simply useSpecial:Block/User.
Historically, the only way to block a user was to prevent them from editing the entire site. With the introduction of partial blocks, it is now possible to block users to, for instance, a particular textbook. This is very useful if the contributor is problematic only in that section of the project (for instance, edit warring) and is otherwise a productive editor. It is also possible to allow full editing but block email access only.
A user can request unblock on their user talk page. Administrators should consult the admin who placed the block, except in obvious, uncontroversial cases. An admin may, at their discretion, unblock the user or engage in a discussion with that user about the terms for being unblocked. Caution and discretion are advised, however, because many vandals use bogus unblock requests as an additional form of harassment and vandalism. Users abusing the ability to edit their talk page should have that ability revoked. Previously, this was done by full-protecting the page, but administrators can now adjust the block settings to disallow the blocked user from editing the user talk page. If abuse continues from IPs or new accounts, then protection should be placed in addition to blocking other users/IPs.
CheckUsers are privy to private system logs which are not accessible by the public or administrators. Blocks marked as{{checkuserblock}} or "per CU" etc are not to be lifted without consultation with project CheckUsers.
Possibly the worst-case scenario is a rogue admin or bureaucrat account. It has never happened on Wikibooks, but it has happened on other wikis, notably the English Wikipedia and English Wiktionary, before. Typically, this happens when an administrator's password is discovered by a vandal. It is not unheard of on Wikipedia for a regular admin to become disgruntled with the project and act out negatively as well. The vandal using the administrator's account, or the disgruntled admin, can then go on a rampage blocking ordinary users, deleting pages and unblocking other vandals to destroy the project.
A quick solution would be to block the rogue admin, who can do nothing but block you (admins can no longer unblock themselves). Bureaucrats are not able to demote an administrator, so the only help after that will come from thestewards atMeta. In the event of a rogue admin, the first and most important task is for people to request help from the stewards and/or block the rogue admin if possible. Once the admin has been demoted and blocked, the cleanup effort can begin.
This scenario is a major reason why all Wikibookians, especially those with additional tools, should choose astrong password and (for admins) consider applying two-factor authentication. If a vandal is able to get access to your account, they can cause long term damage not only to the project but to your reputation as well.
← Deleting, Undeleting, and Importing ·Using Wikibooks ·Advanced Administration →