Talk:Anti-Harassment Tools/CheckUser Improvements
Previous discussions about feature design | ||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
What do you think of the preliminary check idea?edit
How else could the CheckUser information be presented?edit
What do you think of the information being displayed in the actual CheckUser step?edit
How can we improve the CheckUser logs to be more helpful with the above proposed improvements?edit
What are we missing?editNote: We are not adding any new information to the tool, as a first step. We are looking to improve access to the information already being presented in the tool. We want to be able to deliver value quickly and iterate based on the feedback we receive.
Pagination for busy range resultseditWith the current checkuser tool, if a check is tried on a busy range it may exceed a maximum number for results and then only gives a list of IP addresses with the number of edits per address which is not very usable (failed check). It does not give proper results. A desired feature would be to paginate the results (Page 1, Page 2, etc. as necessary) for busy ranges. One current way around the max number exceeded is to select a lower time frame from a pull down box but this shortens the 90 day period to either one month, two weeks or one week. That loss of data is sometimes undesirable depending on the case that you are working on. That is already built in as a feature of the current tool. Another workaround to retain the full 90 day information involves splitting the network and running separate checks. For example (using Class B reserved range), if a /16 range (172.16.0.0/16) fails because it is too busy then you might could split the network in half and run a check on 172.16.0.0/17 and then run a check on 172.16.128.0/17. If those fail then you can run four separate checks on 172.16.0.0/18, 172.16.64.0/18, 172.16.128.0/18 and 172.16.192.0/18. If that fails then you can run eight separate checks and so on. Some checkusers acquired their cu bit by being elected to Arbcom and may not have a strong networking background so they aren't likely to try this second workaround. It would make it easier for all checkusers to have pagination on busy range results which would forego the need for workarounds. SockFilter?editWould it be possible to put alerts on certain IP-ranges / UA data so certain editors get flagged? (I know, likely these are flags that only checkusers will see, maybe only to admins?) The current situation on-wiki is now that we see an editor with a pattern (possibly through AbuseFilter) that is recognised and that editor gets reported to CheckUsers to see the data behind the editor. That is often a Always-Too-Late action, prolific sockers are already on another account, and you keep hunting. It must be possible to flag certain combinations so that if a sock performs an action on wiki they get matched against the pattern. Setting the filter should be at CheckUser discretion and only used on serial-violators (and not to pre-emptively 'catch' editors). --Dirk Beetstra T C (en: U, T) 13:11, 9 October 2019 (UTC) Get IP addresses vs Get Users vs Get Editsedit@MusikAnimal, Zzuuzz, and NinjaRobotPirate: and others - I tried to enlist the various features and use cases for the three Get options in CheckUser. Does the below seem accurate? What other use cases do you have for these views? I'd appreciate your help in teasing those out. Thank you. -- NKohli (WMF) (talk) 05:56, 12 October 2019 (UTC)
Get IP addressesedit
Get Usersedit
Get Editsedit
Wikimedia specific tool links messageseditMediaWiki:Checkuser-toollinks and MediaWiki:Checkuser-userlinks-ip often have to be customised locally due to either the default links provided not working or not being enough. Having Wikimedia overrides for those via the WikimediaMessages extension would help. I don't think we want to push, e.g. wmflabs tools on the CheckUser extension itself for all MediaWiki installs outside Wikimedia to use. Further local customisation will still be allowed of course, but at least those who have to do crosswiki checks such as stewards will actually have some tools that work. Thank you. —MarcoAurelio (talk) 09:32, 22 October 2019 (UTC)
Blocking from CheckUseredit@MusikAnimal, Zzuuzz, Ajraddatz, NinjaRobotPirate, MarcoAurelio, Huji, Akoopal, and Rschen7754: We have been working on preparing a set of mocks for a redesigned CheckUser experience that we will be sharing with this group soon. Meanwhile, we have a question about the blocking feature built into the Get users view.
1) How often do you use the blocking feature in CheckUser?
Update and mockupsedit@MusikAnimal, Zzuuzz, Ajraddatz, NinjaRobotPirate, MarcoAurelio, Huji, Akoopal, and Rschen7754: Hi all! I shared an update on the project page. It outlines some of the things we have learnt from this page so far that we have designed some mockups around. These are early-stage mockups and there are a lot of details to work out. My biggest question from you all is whether these make sense at a high-level and provide the information you seek from the tool. Looking forward to your feedback.
Thanks. -- NKohli (WMF) (talk) 02:21, 7 November 2019 (UTC)
In many cases, one of the first steps of running CU is to determine if the accounts are editing on similar days or not. As I pointed out, the Punch Card feature of DEWKIN can also be helpful (e.g. to see if the users edit during similar times of the day). Huji (talk) 20:18, 7 November 2019 (UTC) Looking for your feedback on interactive mockupedit@MusikAnimal, Zzuuzz, Ajraddatz, Rschen7754, MER-C, Akoopal, Huji, MarcoAurelio, NinjaRobotPirate, Bbb23, Berean Hunter, and Beetstra: Pinging everyone who's chimed in on this page in the past. Hi all, I want to share some interactive mockups that our team has been using to do our series of user tests up until now. I want to share these with you to give you a sense of the direction we are going in for the new tool and get your feedback. You can find the mocks on this link. The mocks are along the tool outline we initially set out with. Please keep in mind that because they are just mockups, not everything will work and you will probably find some bugs. Also, some things have changed since the last time this mockup was updated. This mostly involves design changes. There are also some features in the works that are not present in the mocks here. For example, we are working on incorporating MusikAnimal's feedback to allow looking up a range in the Checkuser interface (mock here). With that said, I would like your feedback in the following categories. Thanks so much for your time. -- NKohli (WMF) (talk) 01:49, 8 May 2020 (UTC) What do you like?edit
What concerns you?edit
What else would you like to see?edit
|
This section is to collect feedback on the new special page. We're looking to hear what you like, what you don't like and what else you'd like to see. The new Checkuser tool is accessible at Special:Investigate. The documentation for it can be found at Special Investigate.
What's good?
edit- Wikitext output looks great. SQLQuery me! 19:49, 8 October 2020 (UTC)
- Can the links in the wikitext output be formatted with the name of the wiki as a preface? Example:
[[w:en:User:SQL]]
. – bradv🍁 19:58, 8 October 2020 (UTC)- @Bradv: That's a good idea. I created a task for it here: task T265433. -- NKohli (WMF) (talk) 23:58, 13 October 2020 (UTC)
- @Bradv: This has now been fixed and deployed! Thanks for your input. Let me know if it does not work as expected. -- NKohli (WMF) (talk) 23:42, 17 November 2020 (UTC)
- Can the links in the wikitext output be formatted with the name of the wiki as a preface? Example:
- The biggest game-changer for me is the highlighting of similar cells, and the pinning feature. This saves me an enormous amount of time! I also like the "Account information" tab. I think I might have said that isn't very useful when this project first started, but as a steward now I have a new level of appreciation for it. — MusikAnimal talk 01:22, 16 October 2020 (UTC)
What's not good?
edit- Separate log from Special:CheckuserLog. Makes it difficult to use the 'checks' function if both tools are in use, or for historical, legacy log data. SQLQuery me! 19:43, 8 October 2020 (UTC)
- Just coming here to second that that's not ideal at all. Is there any reason they have to be logged separately? GorillaWarfare (talk) 19:47, 8 October 2020 (UTC)
- Third. We rely heavily on the logs, even going back years in the case of some of our most notorious serial abusers, so previous checks really should be shown in one place. – bradv🍁 19:51, 8 October 2020 (UTC)
- I think it'd make sense to unify both logs under a single page too. Thanks. —MarcoAurelio (talk) 22:16, 8 October 2020 (UTC)
- @SQL, GorillaWarfare, Bradv, and MarcoAurelio: Thanks for the feedback! We have a task to do this. They're stored in the same table so it should be easy to merge the two. For our purposes, we wanted to be able to see which logs were coming from the new tool to make sure there is no problem with the new tool generating logs. We can achieve this by adding an indicator of sorts to the logs to make sure we (and you all) can identify which tool was used for the lookup. Does that work? -- NKohli (WMF) (talk) 23:34, 8 October 2020 (UTC)
- @SQL, GorillaWarfare, Bradv, and MarcoAurelio: Sorry for the late response here. This request has been fulfilled and all checkuser-ing logs are now available at Special:CheckUserLog. Thank you. -- NKohli (WMF) (talk) 23:46, 17 November 2020 (UTC)
- I think it'd make sense to unify both logs under a single page too. Thanks. —MarcoAurelio (talk) 22:16, 8 October 2020 (UTC)
- Third. We rely heavily on the logs, even going back years in the case of some of our most notorious serial abusers, so previous checks really should be shown in one place. – bradv🍁 19:51, 8 October 2020 (UTC)
- Just coming here to second that that's not ideal at all. Is there any reason they have to be logged separately? GorillaWarfare (talk) 19:47, 8 October 2020 (UTC)
- I found my own IP address linked and littered throughout the results of the timeline of a range check, alongside the unlinked IP addresses of interest. That's quite disturbing actually. I've placed a sample on cuwiki. -- zzuuzz (talk) 23:30, 8 October 2020 (UTC)
- @Zzuuzz: That is certainly not expected. It should be showing you the IP address that you looked up. Can you tag me where you posted the sample? I can take a look. Thanks. -- NKohli (WMF) (talk) 23:37, 8 October 2020 (UTC)
- @NKohli (WMF): It's my only edit today in my sandbox. And the check is noted at the top - it's the last one I did (timeline tab). -- zzuuzz (talk) 23:41, 8 October 2020 (UTC)
- @Zzuuzz: Thank you! I left a clarifying question on the talk page. -- NKohli (WMF) (talk) 23:51, 8 October 2020 (UTC)
- @Zzuuzz: This bug was fixed as part of task T265082 that Martin Urbanec and Bsadowski1 discovered and fixed. Unfortunately it will not be out in production until next week due to deployment issues holding up the train. We are monitoring the situation and will have the fix out as soon as we can. Thanks. -- NKohli (WMF) (talk) 00:02, 14 October 2020 (UTC)
- @NKohli (WMF): It's my only edit today in my sandbox. And the check is noted at the top - it's the last one I did (timeline tab). -- zzuuzz (talk) 23:41, 8 October 2020 (UTC)
- @Zzuuzz: That is certainly not expected. It should be showing you the IP address that you looked up. Can you tag me where you posted the sample? I can take a look. Thanks. -- NKohli (WMF) (talk) 23:37, 8 October 2020 (UTC)
What is missing?
edit- Search on Special:InvestigateLog (or just merge the two logs as noted above so we only need to check in one place) stwalkerster (talk) 20:29, 8 October 2020 (UTC)
- @Stwalkerster: Both logs have now been merged into Special:CheckUserLog. Thanks. -- NKohli (WMF) (talk) 23:47, 17 November 2020 (UTC)
- Aside from the separate log issue, unless I'm missing it, there appears to be no equivalent message to MediaWiki:Checkuser-investigate-log-subtitle linking to the logs from the form. -- zzuuzz (talk) 20:39, 8 October 2020 (UTC)
- @Zzuuzz: I see a "Logs" button in the top right hand corner of the page which goes to the logs. It's slightly annoying that it's not with all the other links, but it does seem to be there. stwalkerster (talk) 20:41, 8 October 2020 (UTC)
- Oh yes thanks. On reflection, I guess it didn't (and still doesn't) look like a link. -- zzuuzz (talk) 20:45, 8 October 2020 (UTC)
- Ah, yes. It might be worth looking into how we can make it look more like the previous link. :) -- NKohli (WMF) (talk) 23:44, 8 October 2020 (UTC)
- Oh yes thanks. On reflection, I guess it didn't (and still doesn't) look like a link. -- zzuuzz (talk) 20:45, 8 October 2020 (UTC)
- @Zzuuzz: I see a "Logs" button in the top right hand corner of the page which goes to the logs. It's slightly annoying that it's not with all the other links, but it does seem to be there. stwalkerster (talk) 20:41, 8 October 2020 (UTC)
- How can I expand the range for one of the IP results? It's very common to increase an IPv6 result to a /64, for example, and I don't see an obvious way to do that without starting a new session. – bradv🍁 20:39, 8 October 2020 (UTC)
- Also, just to add a range to an IP address preloaded into the form via the
&targets=
URL parameter, without editing the URL or removing and re-adding the IP address stwalkerster (talk) 20:45, 8 October 2020 (UTC)- @Bradv: That is one of the things we are yet to add. We were not sure about how important that feature might be for users so we prioritized a little lower in our task list. It is good to know that it will be helpful! I'll make a task for it.
- @Stwalkerster: Yes, I will make sure we get it in for our next round of features. Thank you for the feedback! -- NKohli (WMF) (talk) 23:44, 8 October 2020 (UTC)
- @NKohli (WMF): I came to ask the same question. :) Callanecc (talk) 11:33, 9 October 2020 (UTC)
- Also, just to add a range to an IP address preloaded into the form via the
- Local and Global account status next to user name in Investigate tabs (e.g. Blocked, Previously blocked, Blocked indefinitely or Locked). I don't see it either in the IP & User agents tab, nor in the Timeline tab. Thanks. —MarcoAurelio (talk) 22:15, 8 October 2020 (UTC)
- @MarcoAurelio: You should see it in the Account Information tab. Would you rather see it in the IPs & User agents and/or the Timeline tab? -- NKohli (WMF) (talk) 23:44, 8 October 2020 (UTC)
- It would be great if I could add a new IP to the list in an easier way. Mostly because I want to add not the IP but it's CIDR range (obtained from ipinfo.com or something) but I couldn't find an easy way to add it to my current investigation and had to use the old way. Amir (talk) 15:32, 19 October 2020 (UTC)
- What seems missing is information about IP's an UA's of a user who is only logging in on a certain moment (or many moments), possibly to make new accounts but does not edit at all. This info is available when checking in the old way. Thanks, Ellywa (talk) 21:07, 7 March 2021 (UTC)
Any other feedback
edit- Can the links in the dropdown be customized like they can in the current CheckUser tool? For example, if the WHOIS site goes down, can we switch to another, or add an alternate? – bradv🍁 20:06, 8 October 2020 (UTC)
- @Bradv: We tried to pick a couple of websites that were reliable but you can modify the list with this message. Let me know if there's any problem with it. On a side note, in the near future, we are hoping to build a feature to show location and organization information within the page! -- NKohli (WMF) (talk) 00:01, 9 October 2020 (UTC)
- @NKohli (WMF): Does importing that into enwiki not allow us to override it? I tried creating w:en:MediaWiki:Checkuser-investigate-compare-toollinks but it doesn't appear to work. Unless I've formatted it incorrectly – there's an extra bracket in the one on meta that I assumed is a typo. – bradv🍁 02:32, 9 October 2020 (UTC)
- Oh nevermind, the links require two square brackets at the start and one at the end in order for it to work. That's quite strange. – bradv🍁 02:36, 9 October 2020 (UTC)
- @NKohli (WMF): Does importing that into enwiki not allow us to override it? I tried creating w:en:MediaWiki:Checkuser-investigate-compare-toollinks but it doesn't appear to work. Unless I've formatted it incorrectly – there's an extra bracket in the one on meta that I assumed is a typo. – bradv🍁 02:32, 9 October 2020 (UTC)
- @Bradv: We tried to pick a couple of websites that were reliable but you can modify the list with this message. Let me know if there's any problem with it. On a side note, in the near future, we are hoping to build a feature to show location and organization information within the page! -- NKohli (WMF) (talk) 00:01, 9 October 2020 (UTC)
- Can you add phab:T204347 (The duration) to the log? --Alaa :)..! 21:01, 8 October 2020 (UTC)
- @Alaa: I will add that task to the priority list. Thank you. -- NKohli (WMF) (talk) 00:01, 9 October 2020 (UTC)
- Can you make the "IP" and "User Agents" columns be left to right aligned and "username" and "date" columns right to left aligned, on RtL wikis (like arwiki)? --Alaa :)..! 21:06, 8 October 2020 (UTC)
- @Alaa: Thanks for catching this. PSaxena (WMF) tagging you for this. -- NKohli (WMF) (talk) 00:01, 9 October 2020 (UTC)
- It would be helpful to have abuse filter log counts. For example when you look at Special:CentralAuth/JuanForro2910, and that is basically what you will also see in Account information tab at Investigate, it appears that they have zero contributions, but in fact it is important to know that they have triggered abuse filter on plwikisource 4 times. --Base (talk) 20:07, 10 October 2020 (UTC)
- And as a side note, the tool failed to detect other users under user's IP and then under the /24 range too, which I then found with the old CU (see login wiki for the logs). --Base (talk) 20:16, 10 October 2020 (UTC)
- @Base: Can you elaborate on the second issue? What were the exact steps you did and what was the mismatch between what you expected to see and what it showed to you? This will be immensely helpful in tracking down the problem. Thank you. -- NKohli (WMF) (talk) 00:14, 14 October 2020 (UTC)
- And as a side note, the tool failed to detect other users under user's IP and then under the /24 range too, which I then found with the old CU (see login wiki for the logs). --Base (talk) 20:16, 10 October 2020 (UTC)
Adding and removing users from an investigation
editI have started an investigation on three users. It is not conclusive, so I did some more digging (behavioral, outside of Special:Investigate) and want to add a fourth user to the comparison. There does not appear to be any way to do this. It should be possible to edit/add to the list of users/IPs. ST47 (talk) 22:54, 8 October 2020 (UTC)
- @ST47: That's been added to the list of feature we want to deliver on. We will come up with mocks and share them with the community soon. Thanks. -- NKohli (WMF) (talk) 00:16, 14 October 2020 (UTC)
- @NKohli (WMF) and ST47: This indeed would be an awesome addition. Being able to keep adding users and IPs to an investigation would be of great help. Thanks. —MarcoAurelio (talk) 15:50, 18 November 2020 (UTC)
Missing IP addresses
editI performed a check on the same user using both Special:Investigate and Special:CheckUser. Special:Investigate failed to detect one of the user's two IP addresses. It appears that Special:Investigate does not check all of the same types of entries as Special:CheckUser. Users with the appropriate access can find a testcase here. ST47 (talk) 23:00, 8 October 2020 (UTC)
- It also fails to detect abuse filter logs, for example, it is claiming that en:Special:Contributions/Meckma is stale. ST47 (talk) 01:23, 9 October 2020 (UTC)
- It sounds like a major flaw if it doesn't show up all the IPs that the older checkuser does. Since we cannot ourselves test on enwiki to look at the output difference, do you mind pasting the outputs on checkuserwiki that I can then look at which will help us determine the issue? I appreciate all the help.
- The issue with abuse filter logs not showing up has been mentioned above. I'll make a note of it and we'll get to it as soon as we can. Thanks. -- NKohli (WMF) (talk) 00:32, 14 October 2020 (UTC)
- @NKohli (WMF): I expect that it's that all of the logs aren't being displayed in the table. User creation, abuse filter, password reset, login, email... ST47 (talk) 21:36, 16 October 2020 (UTC)
- I performed a check on an IP. Summary does not display one of the accounts (creation is the only log action) but chronology does — NickK (talk) 18:59, 14 October 2020 (UTC)
I don't know if it's the same problem, but in my case I checked a single new account that has no edits, and the "IPs & User agents" tab says "there are no results". However I do see the IP and UA for the account creation on the Timeline tab. I would expect that information to be listed on the "IPs & User agents" tab too. To clarify my use case, as a steward I usually run checks on loginwiki where users cannot make edits. — MusikAnimal talk 00:22, 16 October 2020 (UTC)
I think the problems is that "account created" and "login" (and maybe "mail", too) entries are missing. Run queries using both tools and got different number of IPs (on user A):
tool | query | user A | user B |
---|---|---|---|
classic | Get IP addresses | 3 rows | 11 rows |
investigate | 2 rows | 11 rows |
Unfortunately, the row which was missing from Special:Investigate output but was present in the classic tool, indicated a perfect match between the users that would otherwise be missed. This could be a major flaw. Missed IP did not have any edits, only user automated creation and login. « Saper // talk » 20:44, 24 March 2021 (UTC)
Unclear cues for when additional data is available for an IP address
editI performed a check, and got back several IP addresses. One IP was used by two users, and with different UAs, so it appears three times in the table. It is annotated with "[1 edit](~5 from all users)". This gives the impression that additional information is available for that IP address. However, adding that IP to the investigation returns no new data. There should be a clear and easily visible cue to indicate that a given IP address has additional edits associated with it, but which are not part of the current investigation. (Similarly, if I check an IP, there should be a cue for usernames which have additional edits which are not yet part of the current investigation.) ST47 (talk) 23:59, 8 October 2020 (UTC)
Not possible to add an IP range to an investigation
editI performed a check on two users, and got a list of three IP addresses in what I recognize as a /23 range. I want to run a check on that range. It does not appear to be possible to do this without starting a brand new investigation. ST47 (talk) 23:59, 8 October 2020 (UTC)
- +1. Very strongly needed to add the entire range to the investigation — NickK (talk) 19:00, 14 October 2020 (UTC)
- +1. Because of that I'm having to use the new and old tool simultaneously. Rafael (stanglavine) msg 21:25, 16 October 2020 (UTC)
- +1 —MarcoAurelio (talk) 15:50, 18 November 2020 (UTC)
Not possible to highlight (for copy/paste) information from table
editI performed a check, and I want to copy the IP address from the table in order to run a separate check (or to block them, or whatever). However, you appear to be blocking copy/paste from the table. Attempting to highlight text by clicking and dragging has no effect. This affects the username, IP, and user agent columns. ST47 (talk) 23:59, 8 October 2020 (UTC)
- I'll have more to add tomorrow, but this was an extreme pain in the ass to get proper results over to the SPI and to other tools to check. The sooner this can be fixed, the better. -- Amanda (aka DQ) 02:31, 9 October 2020 (UTC)
- @ST47 and DeltaQuad: It's not intentional but a bug. It's tracked in task T261646. We'll get to it as soon as possible. My apologies. -- NKohli (WMF) (talk) 04:54, 9 October 2020 (UTC)
- Seconding that this is important, but because some LTAs use dedicated phone models that show up in UA and I want to copy the model to search in results Amir (talk) 05:09, 13 October 2020 (UTC)
- @ST47, DeltaQuad, and Ladsgroup: This has now been fixed! You should be able to select text from the table as expected. Sorry for my late response here. I got tied up in a few different things. Let me know if you find any further issues. Thanks. -- NKohli (WMF) (talk) 05:40, 18 November 2020 (UTC)
- Seconding that this is important, but because some LTAs use dedicated phone models that show up in UA and I want to copy the model to search in results Amir (talk) 05:09, 13 October 2020 (UTC)
- @ST47 and DeltaQuad: It's not intentional but a bug. It's tracked in task T261646. We'll get to it as soon as possible. My apologies. -- NKohli (WMF) (talk) 04:54, 9 October 2020 (UTC)
Middle click to open in new tab doesn't work on tool links
editI was trying to open the contributions for an IP by middle clicking in the dropdown menu. However, this has no effect. I see that you are forcing those links to open in a new tab by default. This is a questionable practice at best - it should be the user's choice, not the designer's, how to organize their browser. However, there is no reason to block middle-click from working. ST47 (talk) 00:09, 9 October 2020 (UTC)
- Thanks for the feedback, ST47. Filed this as task T265439. -- NKohli (WMF) (talk) 00:46, 14 October 2020 (UTC)
Not possible to set the number of items in IP&UA tab
editOn IP&UA tab, if there are too many IPs/accounts in some range, only 50 items will appear, and I must click Next Page to view the next part. If this happens, the inconvenience of individually checking each page will arise. It's a good idea to be able to choose the number or set them all to appear. --Sotiale (talk) 00:52, 9 October 2020 (UTC)
- Yes, this definitely should not be paginated. We routinely need to look at more than 50 IP/user/UA combinations at the same time. ST47 (talk) 01:18, 9 October 2020 (UTC)
- You may increase the number of items to show per page by going to the "Recent changes" tab in Special:Preferences, and changing the option "Number of edits to show in recent changes, page histories, and in logs, by default:" (these are the English translations, obviously). DWalden (WMF) (talk) 12:13, 14 October 2020 (UTC)
- Sorry, I don't want to do that. I frequently browse RC on mobile, and increasing it to (say) 500 to force a "un-paginated view" is not realistic because my phone will just stop thinking for a while whenever I see RCs, page histories, and other logs. Please find some other ways. — regards, Revi 12:40, 14 October 2020 (UTC)
- @DWalden (WMF), ^ — regards, Revi 20:18, 15 October 2020 (UTC)
- Another temporary workaround is to add to the URL
&limit=n
, wheren
is any number up to 1000. E.g.Special:Investigate/IPs_%26_User_agents&limit=500&token=...
. Note this will not be preserved across different tabs (e.g. going to Timeline). DWalden (WMF) (talk) 09:01, 19 October 2020 (UTC)
- Another temporary workaround is to add to the URL
- @DWalden (WMF), ^ — regards, Revi 20:18, 15 October 2020 (UTC)
- Sorry, I don't want to do that. I frequently browse RC on mobile, and increasing it to (say) 500 to force a "un-paginated view" is not realistic because my phone will just stop thinking for a while whenever I see RCs, page histories, and other logs. Please find some other ways. — regards, Revi 12:40, 14 October 2020 (UTC)
- Yeah, that unrelated setting certainly isn't an adequate fix. Just show the entire table on a single page, so that we can Ctrl-F and copy-paste and sort. There is no reason to paginate it, we can scroll down the page. ST47 (talk) 21:38, 16 October 2020 (UTC)
Only one pin can be set
editThe function to highlight UA or IP with pin is useful, but it halves the usefulness of only one UA or IP being fixed. Is it possible to set multiple pins? --Sotiale (talk) 00:57, 9 October 2020 (UTC)
- +1, it is useful as it is, but it would be even more so if you could "categorise" different data into different pins/colours. --Base (talk) 07:55, 9 October 2020 (UTC)
- @Base and Sotiale: Thanks for the feedback. It gives us a lot of joy to hear that you found the highlighting feature helpful. We will do some thinking around how we can make multiple pins happen and get back to you as soon as we can. Thanks. -- NKohli (WMF) (talk) 00:17, 14 October 2020 (UTC)
What is the default sort of the IPs and user agents table?
editI assumed it was by date descending, but that does not appear to be the case. File:Investigate_sort.png. The new sockpuppet would be the first row if I ran Special:CheckUser, but it's buried in the middle of the table for Special:Investigate. ST47 (talk) 01:33, 9 October 2020 (UTC)
- Also, if the table exceeds one page (50 rows), it is impossible to sort. Unfortunately this is unusable. ST47 (talk) 01:42, 9 October 2020 (UTC)
- I see the problem you are talking about. We do have a task to allow sorting to work across tabs but it proved to be a harder technical challenge than we had imagined. The underlying infrastructure are in such a way that if we choose to allow sorting across tabs, it will take way longer for results to load and quite likely timeout often. One intermediary solution is to set the limit on number of rows in the result to be higher. This is the preference under your Special:Preferences > Recent changes tab. It's called Number of edits to show in recent changes, page histories, and in logs, by default. You can see up to 1000 rows on the same page and as long as the results are restricted to one page, you will be able to sort. I'm sorry to not have a better response for you. -- NKohli (WMF) (talk) 00:55, 14 October 2020 (UTC)
Timeout function?
editI noticed that when a certain amount of time has passed, clicking [Next page] automatically sends me to the first interface. At first I thought it was my mistake, but when I tried again, it was. Perhaps it is set to automatically timeout after a certain period of time. Does this feature have an automatic timeout feature? --Sotiale (talk) 02:29, 9 October 2020 (UTC)
- @Sotiale: It does not timeout unless there is no activity for 24 hours. What likely happened is that you got logged out as part of the mass-logout that was done by the security team to log all users out last week. You should not encounter this problem again. Please let us know if you do. Thanks. -- NKohli (WMF) (talk) 00:50, 14 October 2020 (UTC)
URL parameters
editIf you are using GET parameters to fill tool's fields (for example linking from the contribution page), parameters "user" and "period" don't work.
For example https://meta.wikipedia.org/w/index.php?title=Special:CheckUser&user=DR&reason=SomeReason&period=14 fills both "User" and "Reason" fields, but https://meta.wikipedia.org/w/index.php?title=Special:Investigate&user=DR&reason=SomeReason&period=14 fills only "reason". --DR (talk) 14:22, 9 October 2020 (UTC)
- @DR:
&targets=
seems to work for me. stwalkerster (talk) 14:48, 9 October 2020 (UTC)- `targets=` doesn't appear in the URL after the check has started. So this may work for creating a new "Investigation", but doesn't solve the inability to add users or IP ranges to an investigation that is already started. ST47 (talk) 21:40, 16 October 2020 (UTC)
More precise timestamps
editCould the tool list the time as well as the dates? Currently it only lists the date range but wouldn't it be more useful if it listed something like "9 October 2020, 12:20 (UTC) - 9 October 2020, 14:40 (UTC)"? Regards SoWhy 16:14, 9 October 2020 (UTC)
- @SoWhy: That sounds like a good idea. I'll document it in a task and we'll get around to it. Thanks. -- NKohli (WMF) (talk) 01:20, 14 October 2020 (UTC)
Link to edits / Show edits directly in table
editThe table currently display "~X edits" but there seems to be no way to show just those edits. When you click on "Contributions" in the drop down, it shows only contributions for this IP address. Shouldn't it rather display the user's contributions filtered by start and end timestamp? Better yet, can't they be displayed in the table with a expand toggle? Regards SoWhy 16:14, 9 October 2020 (UTC)
- @SoWhy: This was one of the challenging things for us to figure out. The table lists the username, IP address, user-agent and the activity time. So when we show contributions there are multiple ways one could imagine them to show up:
- for that user account
- for that IP address
- for that user account when editing from that IP address
- for that user account with that user-agent
- for that IP address with that user-agent
- for that user account + IP address + user agent combination
- Linking to IP contribs was easy because it could be placed in a way that was intuitive. I'd love to hear more about what you think is most valuable for your workflow and how we can display it in a good way. By the way I love your username. :) -- NKohli (WMF) (talk) 01:03, 14 October 2020 (UTC)
- This old thing? Thanks! :-D
- This is the current output when checking my own IP:
Username IP User agent Date range SoWhy [IP removed] [1 edit](~2 from all users)Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0 14 October 2020 - 14 October 2020 Yhwos [IP removed] [1 edit](~2 from all users)Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 14 October 2020 - 14 October 2020
- It displays my main account and my alt account separately. Since it already does that, shouldn't the "Contributions" drop-down link next to the IP offer the possibility to show all contributions for the username listed in the first cell? At least, it might be useful if the drop down offered links both to the IP contributions and the user contributions, no? Regards SoWhy 08:14, 14 October 2020 (UTC)
Several requests
editI didn't want to create like 6-7 separate sections, so i'm listing all requests in one.
- IP Ranges (up to /16 for IPv4 and up to /32 for IPv6) should be grouped together for the same user like this:
- 192.168.1.0/16
- 192.168.1.5
- 192.168.1.82
- 192.168.1.133
- 192.168.1.0/16
- UAs on the same IP need to be grouped. It's pointless to a CU, especially if it's only version changes to have these separated out by each IP
- IPs from the same user should also be grouped together. Maybe with a thicker border than just the separation by IPs This may need discussion, but when I have like 6-7 ranges that a user is on, it gets very crowded and unorganized very very fast and hard to not be distracted or confused.
- Firstly, thanks for all the feedback, Amanda. I love the idea of grouping records. The only downside will be that sorting might not work as expected or remove grouping settings if selected by the user. We'll brainstorm this some more in the team and get back to you. -- NKohli (WMF) (talk) 01:29, 14 October 2020 (UTC)
- User links are not set for IPs, making user scripts like markblocked, popups and other things useless.
- This makes sense. We should fix this. -- NKohli (WMF) (talk) 01:29, 14 October 2020 (UTC)
- Timeline formatting should match the formatting of get edits in Special:CheckUser. The way it is now is distracting and hard to read.
- We purposely chose to format the timeline just like RecentChanges in order to maintain familiarity for new checkusers who found the older 'get edits' interface hard to parse. Do you think the new interface is missing any information that the older one provided? Or any other visual cues that you liked? -- NKohli (WMF) (talk) 01:29, 14 October 2020 (UTC)
- @NKohli (WMF): Specifically, I was hoping just for the IP/UA to maintain a different line from the actual log, with a different font so it's definitely distinguishable. I'd be happy to explain more by email about why and how because there are specifics that involve me that I don't wish to put out here. -- Amanda (aka DQ) 13:21, 16 October 2020 (UTC)
- We purposely chose to format the timeline just like RecentChanges in order to maintain familiarity for new checkusers who found the older 'get edits' interface hard to parse. Do you think the new interface is missing any information that the older one provided? Or any other visual cues that you liked? -- NKohli (WMF) (talk) 01:29, 14 October 2020 (UTC)
- User links are also missing from timeline.
- Again, makes sense to fix. I'll create a task for it. -- NKohli (WMF) (talk) 01:29, 14 October 2020 (UTC)
I am happy to create a table and screenshot it to show what I mean with the grouping or even the links if that helps at all. Feel free to comment inline inside my comment too. -- Amanda (aka DQ) 01:03, 10 October 2020 (UTC)
- @NKohli (WMF): If you could just link any tasks you create for these, I'd be interested in following them directly. :) -- Amanda (aka DQ) 13:21, 16 October 2020 (UTC)
Table export
editIf I want to export a table, I can do it only once. If I change sorting, there is no way to export with the new sorting. This is quite annoying: by mistake I clicked on wikitable export without sorting, I sorted in the correct order but I had to reload page for export — NickK (talk) 19:56, 14 October 2020 (UTC)
Indicate number of users behind the IP
editThis is a request for something that doesn't exist in Special:CheckUser either. On the "IPs & User agents" tab, it would be neat if it indicated the number of users behind the IP. So instead of saying "~10 from all users", it could say "~10 from 5 users". This is helpful because for instance if it's just one user (the user I looked up), I know I don't need to investigate further because the Timeline will show all activity for that user. — MusikAnimal talk 00:55, 16 October 2020 (UTC)
"~N from all users" appears to be wrong
editI've been testing on my own account. Under the "IPs & User agents" tab, it says "[8 edits] (~296 from all users)". First, I think it should indicate the number of all logged actions, not just edits. For instance if they've made 0 edits, I am misled into thinking activity occurs only for other users on that IP, when in fact the "~296 from all users" is just the single user I looked up.
Now, for the actual bug: the 296 in my example seems to be wildly incorrect. No one has edited/logged in using my IP except me and my bot, and I have only made ~11 actions in the last week. The number should match the number of items on the Timeline tab if I were to investigate the IP, I think. — MusikAnimal talk 01:13, 16 October 2020 (UTC)
- The count appears to be correct for me - it's counting the edits made by myself and by my bot, and while I agree that it should be counting log entries (it completely misses m:Special:CentralAuth/ST47ProxyBot) the "[X edits]" counts for each row do add up to the total "(~2723 from all users)" exactly. Are you counting your bot? ST47 (talk) 21:54, 16 October 2020 (UTC)
- In fact, they should be exact - this isn't an "EXPLAIN SELECT" like Special:CheckUser, they're actually running a SELECT COUNT(*) for each IP (thank christ they're caching it, but still, imagine a user on T-Mobile who has used 100+ IPs over the last 90 days, that's a lot of queries). ST47 (talk) 21:58, 16 October 2020 (UTC)
- There is a single edit made using my bot under my IP in this time range, but that is all. The results I'm seeing suggest 297 actions happened on that IP, and if I run a check on that IP, neither the old "Get edits" or the "Timeline" in Special:Investigate show anywhere near this number. In the old CU, the number I see matches the number of results under "Get edits" exactly, which is what I would expect. — MusikAnimal talk 23:49, 16 October 2020 (UTC)
- Bear in mind that the "(~n from all users)" is not limited by the Duration parameter. It will get actions going back 90 days. "[n edits]" is limited by the Duration parameter. DWalden (WMF) (talk) 09:15, 19 October 2020 (UTC)
- There is a single edit made using my bot under my IP in this time range, but that is all. The results I'm seeing suggest 297 actions happened on that IP, and if I run a check on that IP, neither the old "Get edits" or the "Timeline" in Special:Investigate show anywhere near this number. In the old CU, the number I see matches the number of results under "Get edits" exactly, which is what I would expect. — MusikAnimal talk 23:49, 16 October 2020 (UTC)
I want to add that I get lots of "[8 edits] (~8 from all users)" (the two numbers being the same) in my CU while in the old code, when the two are the same, it doesn't show them which makes it much easier to spot IPs that are being used by more than one user. Can this follow the old code and omit showing "(~N from all users)" when the number is the same? Amir (talk) 15:27, 19 October 2020 (UTC)
WMFTimeoutException
editWith the advent of being able to enter multiple IPs/users, I suppose this is always a possibility. In my first test, I checked myself, my staff account and my bot on enwiki, and only for the last week. Even with my bot included, that amounts to only a few hundred actions, so I'm a little surprised it timed out. Next I checked only my bot account, and it still timed out :( My bot is hosted on Toolforge where the IP changes a lot, so I suspect Special:Investigate is running a bunch of queries on each of those IPs, and that's what's slowing it down. But in this case there were only 35 different IPs in the last week. I imagine this scenario could easily happen when checking wide IP ranges, too. I would suggest maybe doing something like Special:CheckUser does where it first runs an EXPLAIN to estimate how expensive it's going to be, and if it's too much it shows limited info. I certainly should be able to at least get the list of IPs/UAs, and if I have to start a new investigation for each IP one by one (like Special:CheckUser), that's OK.
Also, the issue I pointed out above might be related; where Special:Investigate is reporting a much higher number of actions for an IP then there actually are. Perhaps Special:Investigate is doing more scanning than it needs to.
If it helps your team with testing, I consent to you running checks on MusikBot. They're all Toolforge IPs anyway, which are publicly known. (actually a single action from my IP is in there too, but I don't mind you seeing it :) — MusikAnimal talk 01:42, 16 October 2020 (UTC)
- @MusikAnimal: Thanks for this report! We aren't quite sure why it's timing out. It certainly isn't supposed to. We will look into this and get back to you soon. Sadly, we are not allowed to run tests on enwiki itself. Does MusikBot run on testwiki too? -- NKohli (WMF) (talk) 22:14, 29 October 2020 (UTC)
- It has in the past, but there's no recent data. I suspect you'll run into this issue with any Toolforge bot that edits regularly. You could try setting up a test bot that edits in the bot's userspace, or something. I just ran another test (on enwiki) and noted the exception ID is 3066779a-7880-4ec4-977c-392be0e1d2d5. From Logstash it looks like the timeout happened in MediaWiki\CheckUser\CompareService->getTotalEditsFromIp(). — MusikAnimal talk 17:13, 30 October 2020 (UTC)
More aggregation
editCurrently, it aggregates pretty loosely causing lots and lots of rows that I'm not much interested to, specially or the time I want to have a summary report for checkuser wiki. It would be great to have an option to give a much more summarized version of the table. Thank you! Amir (talk) 20:23, 21 October 2020 (UTC)
Accounts without edits or actions are not displayed on "IPs & User agents"
editI don't know if this has been reported before, but accounts that don't have any edit or any filter log (have only account creation log) do not appear on "IPs & User agents" tab, they only appear on the "Timeline". I think they should appear in both. Rafael (stanglavine) msg 17:31, 27 October 2020 (UTC)
- I mentioned this above but it deserves its own section. This is important for stewards who use loginwiki to run checks, since no one has any edits there. — MusikAnimal talk 02:42, 28 October 2020 (UTC)
Tour message too WMF specific
editHello. Unless these are going to be phased out in the near future, I suggest that we modify MediaWiki:Checkuser-investigate-tour-copywikitext-desc and related messages in order to remove jargon specific to WMF such as CUWiki which surely does not exist for all other MediaWiki installs elsewhere. If needed, we can have a custom message and override using the WikimediaMessages extension. Thanks. —MarcoAurelio (talk) 15:48, 18 November 2020 (UTC)
Some i18n issues
edittask T268379, task T268380 —MarcoAurelio (talk) 12:16, 21 November 2020 (UTC)
- The first task is a dupe of task T41013 created by me in 2012. It looks like the schema change patches are there already for review. Given that they're pre-Investigate, I assume we need to make sure they'd work with the new system. The last task is now resolved thanks to Ammarpad. —MarcoAurelio (talk) 10:49, 23 November 2020 (UTC)
Wording tweak
editWhen the tour says "don't worry, we'll create a separate checkuser log for each user" or something like that, I imagine the author meant to say "we'll create a separate checkuser log entry". But I like the interface otherwise, very professional. Enterprisey (talk) 12:11, 21 December 2021 (UTC)