Steward requests/Global permissions

From Meta, a Wikimedia project coordination wiki
Jump to navigation Jump to search
Requests and proposals Steward requests (Global permissions) latest archive
This page hosts requests for global permissions. To make a request, read the relevant policy (global rollback, global sysop, global rename, …) and make a request below. Explain why membership is needed for that group, and detail prior experience or qualifications.

This is not a vote and any active Wikimedia editor may participate in the discussion.

Successful global rollback requests require no fewer than 5 days of discussion, while successful global renamer and global sysop discussions require no fewer than 2 weeks. For requests that are unlikely to pass under any circumstances, they may be closed by a steward without further discussion (after a reasonable amount of input).

Quick navigation: Global Rollback | Global Sysop | Global IP Block Exemption | Global Rename | Other global rights | Removal of access | Local permissions | Unexpired temporary access

Cross-wiki requests
Meta-Wiki requests


Requests for global rollback permissions[edit]

Symbol comment vote.svg Please be sure to follow the instructions below:
Your request might be rejected if you don't follow the instructions, and not doing so would reflect poorly on your suitability.
Please also review the Global rollback policy.
Instructions for making a request

Before requesting, make sure that:

  1. You have sufficient activity to meet the requirements to be allocated the global rollback flag
  2. You have a global account;
  3. You are logged in on this wiki, and the account is part of your global account;
To make a request
Copy the template below to the bottom of this section and explain of why you need the access and why you're suitable.
=== Global rollback for [[User:Foo|Foo]] ===
{{sr-request
 |status    = <!-- don't change this line -->
 |domain    = global <!-- don't change this line -->
 |user name = Username
}}
::''Not ending before {{subst:#time:j F Y H:i|+5 days}} UTC''

The request will be approved if consensus to do so exists after a period of consideration of no less than 5 days (other than requests that are unlikely to pass under any circumstances, no other exceptions are allowed, no matter how obvious the result may seem). This is not a vote, and all input is welcome. Stewards will determine whether consensus exists; when doing so it is likely that the weight given to the input of those involved in cross-wiki work will be most influential.

Requests for global sysop permissions[edit]

Symbol comment vote.svg Please be sure to follow the instructions below:
Your request might be rejected if you don't follow the instructions, and not doing so would reflect poorly on your suitability.
Please also review the Global sysops policy.
Stewards
When you give someone global sysop rights, please list them on Users with global sysop access and ask them to subscribe to the global sysops mailing list.
Instructions for making a request

Before requesting, make sure that:

  1. You have a global account;
  2. You are logged in on this wiki, and the account is part of your global account;
To make a request
Copy the template below to the bottom of this section and explain of why you need the access and why you're suitable. If you previously requested that right, please add a link to the previous discussion(s).
=== Global sysop for [[User:Foo|Foo]] ===
{{sr-request
 |status    = <!-- don't change this line -->
 |domain    = global <!-- don't change this line -->
 |user name = Username
}}
:''Not ending before {{subst:#time:j F Y H:i|+2 week}} UTC''

The request will be approved if consensus to do so exists after a period of consideration of no less than two weeks (no exceptions are allowed no matter how obvious the result may seem). This is not a vote, and all input is welcome. Stewards will determine whether consensus exists; when doing so it is likely that the weight given to the input of those involved in cross-wiki work will be most influential. Please note: Since 2019 all global sysops are required to have two-factor authentication (2FA) enabled.


Requests for global rename permissions[edit]

Symbol comment vote.svg Please be sure to follow the instructions below:
Your request might be rejected if you don't follow the instructions, and not doing so would reflect poorly on your suitability.
Please also review the global rename policy and the global renamers policy page.
Stewards
When you give someone global rename rights, please add them to the list of global renamers and ask them to subscribe to the global renamers' mailing list.
Instructions for making a request

Before requesting, make sure that:

  1. You have a global account;
  2. You are logged in on this wiki, and the account is part of your global account;
  3. You have considered the addition of a user language box to your user page
To make a request
Copy the template below to the bottom of this section and explain of why you need the access and why you're suitable. If you previously requested that right, please add a link to the previous discussion(s).
=== Global rename for [[User:Foo|Foo]] ===
{{sr-request
 |status    = <!-- don't change this line -->
 |domain    = meta.wikimedia <!-- don't change this line -->
 |user name = Username
}}
:''Not ending before {{subst:#time:j F Y H:i|+2 week}} UTC''

The request will be approved if consensus to do so exists after a period of consideration of no less than two weeks (no exceptions are allowed no matter how obvious the result may seem). This is not a vote, and all input is welcome. Stewards will determine whether consensus exists; when doing so it is likely that the input of those involved in cross-wiki work will be most influential.

Requests for global IP block exemption[edit]

Symbol comment vote.svg Please be sure to follow the instructions below:
Your request might be rejected if you don't follow the instructions. Please review Global IP block exemption.
Please note: Global IP block exemption does NOT make one immune to locally-created blocks of any sort, only global blocks.
Instructions for making a request

Before requesting global IP block exemption, make sure that:

  1. You have a global account;
  2. You are logged in on this wiki, and the account is part of your global account;
To request global IP block exemption
Copy the template below to the bottom of this section and explain why you need the access and why you're suitable. If needed, link to relevant discussions.
=== Global IP block exempt for [[User:Foo|Foo]] ===
{{sr-request
 |status    = <!--don't change this line-->
 |domain    = global<!--don't change this line-->
 |user name =  Username
 |discussion=
}}
<Add an explanation here>, thanks, --~~~~

The request will be approved if there is demonstrated need for the permission, such as bypassing a global block from someone who is not the intended target.

Global IP block exempt for IP Range of WikiLoop Battlefield[edit]

Statement[edit]

I am a developer, and we are building a counter-vandalism tool called WikiLoop Battlefield, and here is its source code. We recently start to roll out Oauth login and in-place revert feature. When we move our test from localhost to our dev and canary(staging) environment, we noticed that we received the following error.

{ "error": { "code": "globalblocking-ipblocked-range", "info": "'''Your IP address is in a range which has been blocked on all wikis.''' The block was made by [//meta.wikimedia.org/wiki/User:Jon_Kolbert Jon Kolbert] (meta.wikimedia.org). The reason given is ''[[NOP|Open Proxy]]: Webhost: Contact [[m:Special:Contact/stewards|stewards]] if you are affected ''. * Start of block: 2019-07-23T12:01:56 * Expiration of block: 2021-01-23T11:01:56 You can contact [//meta.wikimedia.org/wiki/User:Jon_Kolbert Jon Kolbert] to discuss the block. You cannot use the \"Email this user\" feature unless a valid email address is specified in your [[Special:Preferences|account preferences]] and you have not been blocked from using it. Your current IP address is 3.86.232.24, and the blocked range is 3.86.0.0/16. Please include all above details in any queries you make.", "*": "See https://en.wikipedia.org/w/api.php for API usage. Subscribe to the mediawiki-api-announce mailing list at <https://lists.wikimedia.org/mailman/listinfo/mediawiki-api-announce> for notice of API deprecations and breaking changes." }, "servedby": "mw1346" }

We host our server on Heroku, does it mean that the IP address of heroku is being blocked globally for MediaWiki API? Can we apply to be whitelisted for our legit use-case?

Thank you!

Xinbenlv (talk)

Responses[edit]

@Xinbenlv: Heroku is a shared host, and Wikimedia discourages hosting service in third-party shared hosts (it may host VPN or reverse proxy, which can hide users' IP address). You should either:
  • Move the project to Toolforge (recommended) or Cloud VPS
  • Create a edit service in Toolforge similar to toollabs:widar, and invoke the service (you must use GET or JSONP, Cloud does not support POST from third-party service) in the project (not recommended, this may have security issues)

--GZWDer (talk) 18:41, 17 October 2019 (UTC)

@GZWDer: thank you.
First sorry I just noticed I didn't use the template (which doesn't apply to IP range extemption for al IPs), I updated it.
Second, here we are building an app that requires a user to login with Oauth. We only conduct edit on-behalf of loged-in users and their username will show up.
3rdly, with respect to your suggestion, We've considered porting the project to Toolforge but we are waiting for the Toolforge to support modern Kubernates https://phabricator.wikimedia.org/T214513.
It is not particularly feasible for all users to rely on IP addresses because as many of people who submit for permissions here, IP addresses are only largely available in USA and a few developed countries who took part in early Internet infrastructure development discussions. Many other countries they have to rely on NAT that shares limited IP addresses. Our app hope to expand to all language locales to help users with counter-vandalism efforts. If we block IP addresses, it will reduce the access of these users from Non-USA/developed countries who would like to help.
In summary, can we apply for unblocking any IP addresses if we have allowed users to identify themselves with login? Thank you!

Xinbenlv (talk) 21:21, 17 October 2019 (UTC)

all, I don't know who to send this argument to... Xinbenlv (talk) 10:36, 25 October 2019 (UTC)
I start a discussion en:User:Xinbenlv/Propose:Allow_Login_Users_By_Default_When_IP_Range_Blocked
There is a block configurations to let logged in users edit while on blocked IP: However we usually do not allow it on NOP blocks. We cannot let anyone using your tool be exempt from the block, this is a software restrictions. There's just no way to do that. And since we are not going to unblock AWS — thus Heroku — I think your only bet is to follow GZWDer's advice. — regards, Revi 07:54, 4 November 2019 (UTC)
@-revi:, @GZWDer: thanks for answering. How about the following solutions sound to admins?
  1. if we use certain way to crypt-sign a request from our app's server, can you grant app-specific exception for this use-case? (rather than unblocking all IP-addresses but unblockgin all users who have signed in and use our app)?
  2. if we managed to find a fixed IP address, can you unblock individual IP address of the one that we use for our webapp?
Xinbenlv (talk) 22:37, 4 November 2019 (UTC)
#1: There's no such feature(tm) to do so. #2: I think I can do that, with two conditions: You notify us when you stop your project (thus releasing the IP to the shared pool) and you absolutely always require authentication. — regards, Revi 04:40, 5 November 2019 (UTC)
@-revi: thank you! Yes. We are likely to use at most 3 IP addresses at this moment:
  • 35.222.141.110 for dev
  • 34.67.56.51 for canary (staging)
  • 34.69.252.115 for prod
and I agree to both terms: we will absolutely require authentication(in fact you can just allow only login users to edit from these IP addresses) and we will notify you when we stop project and release the IP to the shared pool. (once the Toolforge support mount on Root or custom domain, or we are approved for WMF Cloud VPS)
Xinbenlv (talk) 06:13, 5 November 2019 (UTC)
Note individual IPs can not be globally whitelisted (phab:T42439). They can only be whitelisted locally.--GZWDer (talk) 19:58, 5 November 2019 (UTC)
@GZWDer:, thank you!
Do I understand it correctly that both the global and local needs to unblock the IP for any IP address to be used? While I will work on applying for individual local wiki's IP whitelist approve, can I ask why individual IPs can not be globally whitelisted? In particular, is it a policy or a technical reason?
  1. If it's a policy, I'd argument by fixing the static IP, it's no longer an Open Proxy since being reserved and occupied by an application, a random internet user cannot use it. Given that we promise that we only authenticate users, it's a fixed set of users (only registered Wikipedian users) rather than open to public.
  2. If it's a technical issue, I'd argument previously we are blocking IP range IP1 to IP3, now if we have a static IP2 to unblock, you can block [IP1, IP2), (IP2, IP3]
Dear global admins, what do you think? Thank you!
Xinbenlv (talk) 21:35, 5 November 2019 (UTC)
Please let me know if there are other information you would love me to provide accompanying this application Xinbenlv (talk) 22:49, 7 November 2019 (UTC)
It's a technical reason. We simply cannot globally whitelist individual IP addresses, even if we wanted to. Trijnsteltalk 23:06, 9 November 2019 (UTC)
@Trijnstel: thank you for your answer. Can you help me understand how that is not technically possible? I suggested that you can unblock [IP1, IP2), (IP2, IP3] instead of the range [IP1,IP3]? Or what are alternatives if you could kindly suggest? Xinbenlv (talk) 02:54, 10 November 2019 (UTC)
@RonaldB: What can you tell me about the IP address 3.86.232.24? Currently the whole /16 IP range has been blocked and I don't think it's possible/desired to unblock a part of it, but perhaps you can advice? Trijnsteltalk 18:47, 10 November 2019 (UTC)
@RonaldB:, @Trijnstel:, @GZWDer:, @-revi:, thank you, do I understand it correctly that you are helping us to find the technical solutions because there is no other concerns in the policy aspects right? If there are policy concern, could we discuss policy concern in the meanwhile? Xinbenlv (talk) 00:41, 15 November 2019 (UTC)

Global IP block exempt for Nurseways[edit]

Hi, I only connect to the internet through a VPN due to freedom of speech limitations in my country. For instance, see this recent news article from MSN Brazil (content from Deutsch Welle Brazil) about the current far-right government trying to censor a Wikipedia article and seeking legal prosecution of an editor:

https://www.msn.com/pt-br/noticias/politica/minist%C3%A9rio-da-educa%C3%A7%C3%A3o-tentou-censurar-a-wikip%C3%A9dia/ar-AAGU1Ee

I can supply other examples if needed. The IP I am editing from is my personal VPN, not an open proxy - I am the sole person with access to this IP. I received an error message regarding an IP block when I tried to create an account at the Brazilian Wikipedia directing me to contact user Jon Kolbert who directed me to make a request for an IP Block exemption here. May I use Wikipedia with this VPN? I do not need an exemption for any other IP, thanks --Nurseways (talk) 12:15, 3 November 2019 (UTC)

You said that "you are editing" but the only your edit is to this page. Please, clarify. Ruslik (talk) 17:10, 12 November 2019 (UTC)
@Nurseways:? Ruslik (talk) 20:11, 16 November 2019 (UTC)

Global IP block exempt for Uzielbot[edit]

I am using this bot account to upload data to Wikidata using script. I am having issues running the script on my own machine due to connectivity issues etc. and tried to get this to work on Digital Ocean droplet, just to find out their IP range is blocked. Will be glad to remove the global block for my bot account, in order to use Digital Ocean servers for bot activity, thanks, --Uziel302 (talk) 13:17, 10 November 2019 (UTC)

Why not use Toolforge instead? Masum Reza 06:24, 11 November 2019 (UTC)
User_talk:Masumrezarock100, I thought it is more for public tools or long term bots, my bot is one-off, I only need to upload the 500k forms I extracted from other resource. I don't care using both, I will try to apply to Toolforge, but would like to be exempted anyway. Uziel302 (talk) 17:51, 11 November 2019 (UTC)
Why does the exempt need to be global? --Krd 18:13, 11 November 2019 (UTC)
I thought the block is global and I needed exempt from it, I can have it specific to my above needs. Uziel302 (talk) 21:39, 11 November 2019 (UTC)
Local IPBE can override global blocks, but global IPBE can not override local blocks.--GZWDer (talk) 17:23, 12 November 2019 (UTC)
GZWDer, so I need local IPBE. How do I get it? Uziel302 (talk) 05:54, 16 November 2019 (UTC)
See links on d:Q4048709, or directly contact an administrator if the wiki is not listed.--GZWDer (talk) 09:36, 16 November 2019 (UTC)

Global IP block exempt for 荣智浩[edit]

<我是中国大陆用户,需要解锁全域IP>,谢谢, --荣智浩 (talk) 12:11, 14 November 2019 (UTC)

  • @荣智浩::请使用英文!并说明你需要使用Global IP Block Exemption的必要性。(Please use English! And explain the need for you to use Global IP Block Exemption.)--舞月書生(JoyeZhang)👉☎️👈 ♪My Heart Will Go On 16:17, 14 November 2019 (UTC)

你确认你遇到的是全域封禁吗?你在commoms上也遇到过这种现象吗?如果没有的话,我建议你在中文维基本地申请IP封禁豁免。另外你需要用英语解释你遇到的情况。—TechyanTalk) 06:01, 15 November 2019 (UTC)

  • @荣智浩:Are you sure your IP address have been global block? Maybe provide your IP address to confirm will be better. --Streetdeck Talk) 09:38, 18 November 2019 (UTC)

Global IP block exempt for Rowe Wilson Frederisk Holme[edit]

Hey, Due to work and some reasons in life, I now have to live in mainland China for a long time. But because of the China's Censorship and Great Firewall, I had to edit it via Proxy. But my activity IP has recently been blocked by metawiki. I am in a lot of (Chinese) wiki projects, so asking for IPBE permissions on a local basis is complicated and cumbersome. So I want to be able to get global IPBE permissions to solve these problems. Thanks. --Rowe Wilson Frederisk Holme (talk) 12:03, 17 November 2019 (UTC)

Global IP block exempt for 500000000006城[edit]

Hello,I am 500000000006城.I live in China.I must use a VPN to view and edit wikipedia.I have IP block exemption in zhwikipedia,but when I am in other wikis,I can't edit the pages.So I need global IP block exemption to edit the pages.

Global IP block exempt for Czestja[edit]

Hello, The user @Czestja: is using Avast VPN and asks for an exception to global IP blocking, thanks-MrJaroslavik (talk) 05:54, 20 November 2019 (UTC)

Requests for 2 Factor Auth tester permissions[edit]

Symbol comment vote.svg Please be sure to follow the instructions below:
Your request might be rejected if you don't follow the instructions.
Instructions for making a request

Before requesting 2FA tester global permissions, make sure that:

  1. You are logged in on this wiki;
  2. You have read Help page about the two factor authentication;
To request additional global permissions
Copy the template below to the bottom of this section and INDICATE you have read the Help page.
=== 2FA Tester for [[User:Foo|Foo]] ===
{{sr-request
 |status    = <!--don't change this line-->
 |domain    = global<!--don't change this line-->
 |user name = Username
 |discussion=
}}
<Add an explanation here>, thanks, --~~~~

The request will be approved if there is no reason not to grant one. A steward will review the request.

2FA Tester for Z Everson[edit]

Please enable 2FA access to this account. Thanks. --Z Everson (talk) 14:54, 16 November 2019 (UTC)

@Z Everson: Have you read the documentation? Ruslik (talk) 20:07, 16 November 2019 (UTC)

2FA Tester for SRuizR[edit]

I'd like to secure my account better because I'm a little paranoid. I've read the help page carefully, thanks, --SRuizR ¡Pure life! 17:51, 18 November 2019 (UTC)

Yes check.svg Done --Alaa :)..! 11:46, 19 November 2019 (UTC)

Requests for other global permissions[edit]

Symbol comment vote.svg Please be sure to follow the instructions below:
Your request might be rejected if you don't follow the instructions.
Instructions for making a request

Before requesting additional global permissions, make sure that:

  1. You are logged in on this wiki;
  2. No specific section on this page exists for the permission you want to request;
To request additional global permissions
Copy the template below to the bottom of this section and explain what kind of access you need and why. If needed, link to relevant discussions. If you hold, or have previously held, the right and are asking for either a renewal or revival of that right, please add a link to the previous discussion.
=== <Add requested permission here> for [[User:Foo|Foo]] ===
{{sr-request
 |status    = <!--don't change this line-->
 |domain    = global<!--don't change this line-->
 |user name = Username
 |discussion=
}}
<Add an explanation here>, thanks, --~~~~

The request will be approved if consensus to do so exists after a short period of consideration. A steward will review the request.

add global OTRS member for Bijay chaurasia[edit]

Thanks, --Krd 17:15, 20 November 2019 (UTC)

Done. —MarcoAurelio (talk) 17:22, 20 November 2019 (UTC)

See also[edit]