Requests for comment/Make Commons filemovers skipcaptcha globally
The following request for comments is closed. There is consensus to grant skipcaptcha to Commons filemovers globally to support their work across wikis (or otherwise prevent them from seeing Captchas). While some comments have been made about the level of community trust associated with Commons filemover rights, as another user noted they are at least not bots and resultingly should not be served captchas. An opposer and some supporters noted feasibility concerns in granting the right to all users holding the local Commons filemover group; this RfC closure confirms simply that consensus exists, and does not necessarily confirm the existence of resourcing to enact the consensus. Vermont (🐿️—🏳️🌈) 02:50, 20 May 2026 (UTC)
WMF note
[edit]I lead WMF's Product Safety and Integrity team, which is responsible for captcha-related work. We see the consensus, and it makes sense to remove friction for accounts who are routinely doing cross-wiki work like this.
Something that's changed since this RFC was opened is that we've changed our approach to CAPTCHAs altogether, and are in the process (now) of a staged roll-out to all wikis of a service called hCaptcha. We posted about this on the Commons Village Pump recently.
The about-to-be-old model always presented a challenge to all humans, in the hopes of stopping bots. The new model will rarely ever challenge humans (we estimate it happens ~2% of the time) - instead, it tries to only challenge obvious bots. This has been running on 8 wikis for ~8 months, including large ones like English, French, and Japanese Wikipedias, and it seems to have overall done its job while making things easier for people.
Given this change, from an always-challenge model to one that's usually invisible, we're planning to see if this model ends up resolving the concerns underlying this discussion, as a practical matter. This should be in place for edits (for users without the skipcaptcha right) across all wikis by the end of June.
EMill-WMF (talk) 13:45, 21 May 2026 (UTC)
I'm from Chinese Wikipedia and today we have a Commons filemover complaining about having to fulfill captchas to complete the file moving precedure and we have to give her comfirmed right. Is it possible we somehow give Commons filemovers a global skipcaptcha right to make things easier for everyone? --魔琴 (talk) 19:17, 12 January 2025 (UTC)
- (See w:zh:Wikipedia talk:Guestbook for non-Chinese speakers#Filemover on Wikimedia Commons.) --魔琴 (talk) 19:18, 12 January 2025 (UTC)
Oppose This would amount to adding all file movers to the CAPTCHA exemptions global group. The amount of work for the stewards that this would create greatly exceeds the value. * Pppery * it has begun 04:05, 14 January 2025 (UTC)
- Surely there's a way to automate the task, no? JayCubby (talk) 00:38, 6 February 2025 (UTC)
- @JayCubby Maybe dangerous due to NDA data safety concerns, see below. Liuxinyu970226 (talk) 04:52, 2 March 2025 (UTC)
- Surely there's a way to automate the task, no? JayCubby (talk) 00:38, 6 February 2025 (UTC)
- Oppose For security concerns, especially as nowadays wikitech:'s account login system is merged with SUL, by global automatically granting skipcaptcha permissions, file movers may also simply skip OATHauth (aka 2FA, the system to advance protect your account, that require you to either enter token codes, or scan QR codes by mobile phones, when enabled), which may potentially also result NDA-related sensitive datas been moved. Certain wikis may request to grant such permissions around their own wiki domains, though. --Liuxinyu970226 (talk) 03:32, 12 February 2025 (UTC)
- I'm sorry, but what has Wikitech being merged with SUL have anything to do with this request. Really reads non-sequitur. //shb (t • c) 22:37, 12 February 2025 (UTC)
- @SHB2000 Because, as said, this is a really sensitive right, and granting it to any non-sysop users should really be ultra-careful like the IPBE, as sockpuppets may also try washing their own socks as "non-sock" by this right. Probably wikitech administrators should also participate on this matter. Liuxinyu970226 (talk) 10:33, 16 February 2025 (UTC)
- ...what? Sorry, but this is just flat-out nonsense. //shb (t • c) 10:41, 16 February 2025 (UTC)
- @Liuxinyu970226: I hope you are aware that all autoconfirmed users have this right. JJPMaster (she/they) 15:14, 19 February 2025 (UTC)
- @JJPMaster Ah okay, but eventually, granting such permissions for new registered users would still be a dangerous thing, any wrongs here? And otherwise why still no users support this RFC? Liuxinyu970226 (talk) 15:23, 6 March 2025 (UTC)
- @Liuxinyu970226 Commons file movers are not "new registered users". It’s a high-trust role. JJPMaster (she/they) 15:24, 6 March 2025 (UTC)
- @JJPMaster It's even possible that children may also gain filemovers permission (unless, in the very unlikely case, you're planning to file another RFC to restrict appliers of filemovers to those who signed ANPDP so this permission became CheckUser-like, Oversighter-like...), so how do we think those children filemovers are also high-trust? Liuxinyu970226 (talk) 16:31, 10 November 2025 (UTC)
- @Liuxinyu970226: Being young does not entail that one is stupid. JJPMaster (she/they) 17:32, 10 November 2025 (UTC)
- @JJPMaster It's even possible that children may also gain filemovers permission (unless, in the very unlikely case, you're planning to file another RFC to restrict appliers of filemovers to those who signed ANPDP so this permission became CheckUser-like, Oversighter-like...), so how do we think those children filemovers are also high-trust? Liuxinyu970226 (talk) 16:31, 10 November 2025 (UTC)
- @Liuxinyu970226 Commons file movers are not "new registered users". It’s a high-trust role. JJPMaster (she/they) 15:24, 6 March 2025 (UTC)
- @JJPMaster Ah okay, but eventually, granting such permissions for new registered users would still be a dangerous thing, any wrongs here? And otherwise why still no users support this RFC? Liuxinyu970226 (talk) 15:23, 6 March 2025 (UTC)
- @SHB2000 Because, as said, this is a really sensitive right, and granting it to any non-sysop users should really be ultra-careful like the IPBE, as sockpuppets may also try washing their own socks as "non-sock" by this right. Probably wikitech administrators should also participate on this matter. Liuxinyu970226 (talk) 10:33, 16 February 2025 (UTC)
- file movers may also simply skip OATHauth: Could you explain how to skip OATHauth with skipcaptcha right? If this really happens, please consider reporting security bugs. Steven Sun (talk) 02:22, 2 June 2025 (UTC)
- I'm sorry, but what has Wikitech being merged with SUL have anything to do with this request. Really reads non-sequitur. //shb (t • c) 22:37, 12 February 2025 (UTC)
- Oppose per above Phương Linh (thảo luận) 13:49, 14 February 2025 (UTC)
not sure abt this. Phương Linh (thảo luận) 07:17, 1 March 2025 (UTC)- Restoring my o. – Phương Linh (T · C · CA · L · B) 13:09, 12 May 2025 (UTC)
- Great suggestion that will helps filemover(s) a lot, glad to
Support. Since they are trusted when they has been grant their rights, so I believe there would be no issues on it. I'm not convinced by the oppose reasons above when their concerns are not valid. aqurs ❄️ 15:35, 6 March 2025 (UTC) - Support Please see the skipcaptcha requests on meta in 2025-01. I think it is useful. However Filemover is not a global right now. So maybe we should find a way to solve this. Hehua (talk) 11:21, 9 March 2025 (UTC)
- Support, unlike other projects besides Wikidata, changes that occur in the Wikimedia Commons file space are likely to be global in natureand it is important for file renaming work that file names are changed globally in a timely manner after rename completed in the Commons. Also, we have several filemovers have experienced captcha-related problems, which I think is valid support for the proposal. A global user group obviously doesn't occur much of a security problem, and for issues that would add workload to stewards, I think we can use an automated process to solve the problem. I don't see the need for a separate global user group, "skip captcha" will suffice. It could be required that when filemover requests it, stewards can immediately grant this permission to the requester without any discussion, unless they have other confusions. Thank you. Yours sincerely, Iming 彼女の愛は、甘くて痛い。 11:50, 9 March 2025 (UTC)
- Support - the reasoning is sensible and I don't see a problem with this being done either via a VRT-style case (access granted on request with no further questions, which can come from the user or maybe a Commons admin), or a script to automatically grant all such users global CAPTCHA right. It's otherwise harmless. Leaderboard (talk) 18:24, 23 March 2025 (UTC)
- I checked the list of users with filemover rights on commons and two of the top 10 are blocked on other projects. I didn't go further down but there is likely to be more. I don't think it's a high trust role. I think this task is more suitable for a global bot if someone comes up with one.--BRP ever 02:07, 10 April 2025 (UTC)
Weak support: filemovers being blocked on some other wikis is a bit concerning as BRP pointed out, but I checked some more from the list and out of first 100, only 3 (not including 1 self-requested block and 1 block because the user passed away) are actually blocked on one other project so hopefully the ratio isn't as bad as it seems from the first 10. Further, CAPTCHAs can't stop strategized human spammers anyway - so I don't see the harm in this if dealings with this right on Common will include in their assessment the factor of filemover right entailing global CAPTCHA exemption. – Svārtava (tɕ) 07:01, 11 April 2025 (UTC)- Support Seems OK. --نوفاك اتشمان (talk) 11:03, 25 June 2025 (UTC)
- Support This is a reasonable request. Rentangan (talk) 18:13, 27 June 2025 (UTC)
- Support per Iming. --dringsim 16:28, 15 August 2025 (UTC)
- Support makes sense —Matrix (user page (@ commons) - talk?) 13:45, 31 October 2025 (UTC)
- Support per above Plutus 💬 🎃 — Fortune favours the curious 04:04, 7 November 2025 (UTC)
- Support if there is a decent way to implement this (without bad hacks and without unjustifiable extra complexity). Taylor 49 (talk) 22:15, 28 November 2025 (UTC)
- Support per above. 浅村しき (talk) 10:01, 13 March 2026 (UTC)