User talk:Vodomar

Welcome to Meta!

Hello Vodomar, and welcome to the Wikimedia Meta-Wiki! This website is for coordinating and discussing all Wikimedia projects. You may find it useful to read our policy page. If you are interested in doing translations, visit Meta:Babylon. You can also leave a note on Meta:Babel or Wikimedia Forum (please read the instructions at the top of the page before posting there). If you would like, feel free to ask me questions on my talk page. Happy editing! --Mikhailov Kusserow (talk) 05:41, 9 February 2009 (UTC)

Removal of rights

I've removed all your userrights. Sorry to see you go. Have a good luck in your future endeavors! --FiliP ██ 09:04, 28 February 2010 (UTC)

Hmm, I'm not sure whether we should give you your rights back or ask you to go through some more voting processes on hrwiki. So, you should perhaps post a request on Steward requests/Permissions and see if there is a more decisive steward that can just give you the rights back. BTW, I'm glad it's not anything serious. :) --FiliP ██ 08:45, 15 March 2010 (UTC)

Filip, thank you for you message. I have asked the stewards the question what is required. Yes lucky it was not anything serious, the way it was going I was having a rough ride. I would not wish this to anyone. Vodomar 22:19, 15 March 2010 (UTC)

Statement

Hi, maybe you forgot to fill the "languages" field in your steward election statement. Ciao, M/ (talk) 11:20, 21 January 2015 (UTC)

I will fill this in today. Thank you very much. Vodomar (talk) 21:13, 22 January 2015 (UTC)

37.144.145.16

Will you look, please, at https://commons.wikimedia.org/wiki/Special:Contributions/37.144.145.16 That seems to be a destructive bot. What do you think about it? How to deal with it? Domitori (talk) 04:22, 17 February 2015 (UTC)

Integrity of data is quite important. Destructive bots should be stopped. looking at the talk pages, the bot has gone through a large number of pictures and placed tags based. There should probably be a better test method and approval process for bots that will affect large number of files or pages. So what would be best is to have a proper change process and approval process for bots that will cause impact to the existing database. Probably proof of the output, dummy run and then ability to perform this in a staged approach. Vodomar (talk) 05:33, 17 February 2015 (UTC)

Kubura

Sta je s tim covekom, zbog cega to radi na hr.wiki? --VS6507 (talk) 16:12, 19 November 2015 (UTC)

Civility

You are an admin and former functionary on hrwiki; given that, you have no excuse for not understanding the existence and application of civility policies. If you continue to engage in personal attacks, you will be blocked. On another note, checkusers cannot release data or make public connections of IPs to accounts. As I understand it, you have a decent amount of experience with this and is definitely something you should already know. We will not release data, and we will not tolerate incivility. Regards, Vermont (talk) 03:32, 18 November 2020 (UTC)

If you want to talk about civility then you should apply it across the board in an equitable manner then you should caution many others and not just single me out. I was not asking for checkuser data to be released just transcode this say IP-1, IP-2, IP-3 and so on, the same for user agents UA-1, etc, and assign it to users. Vodomar (talk) 03:45, 18 November 2020 (UTC)

If there are other examples of incivility remotely approaching what you added to the RfC, please note it for me and I will deal with it. However, the notion that people you disagree with doing something makes it right for you to do the same is patently incorrect. Regarding the table you want, no we can’t do that, please read the relevant policy. Vermont (talk) 03:54, 18 November 2020 (UTC)

Thank you Vodomar (talk) 21:41, 18 November 2020 (UTC)

Side-by-side comparison

Hi Vodomar. I see that you are willing to help stewards with the investigation. Can you send an email to stewardswikimediaorg to provide us with the accurate CU data you used to make that table? Thank you--Sakretsu (炸裂) 11:18, 18 November 2020 (UTC)

炸裂 after I have been de-sysoped without any warning, I have deleted all the files as now that I am not an admin I have no right to hold any data. Vodomar (talk) 05:20, 19 November 2020 (UTC)

My policy with CU investigations was always after the report is concluded was to do a safe delete of all files after two months of investigation. Once I have lost the CU privilege, according to data retention principles the data that I had were above my privileges and hence there was no direction on what to do with this data - the choice is to do safe destruction of data as I don't have these privileges anymore and hence having this data is a compromise. Vodomar (talk) 05:29, 19 November 2020 (UTC)

Sorry, did I get this right? After being desysoped tonight for wheel warring, you finally decided to delete all the data? Actually, a user loses the right to keep CU data when they cease to be a checkuser. Your access was removed on October 10, but you still posted that table on October 21, and ten days later you even published CU results of checks you made 4 months before. That timing doesn't fit your story very well.
Anyway, back to the data I asked you. Your answer still leaves me with a question. By now you should know that checkuser queries are always logged, without exception.
So how did you claim that Kubura and the rest of the affected users all had separate UAs although all you did was get IP addresses only?--Sakretsu (炸裂) 12:35, 19 November 2020 (UTC)

Yes I posted it coz it was the last bit I had to finish as part of my report. And after publishing the data. I deleted the information because I had no right to it. Thank you. Vodomar (talk) 13:42, 19 November 2020 (UTC)

Please, don't avoid answering my question. Where did you get the UAs from?--Sakretsu (炸裂) 13:52, 19 November 2020 (UTC)

At the initial step there is a presumption that each user is separate entity and each is given a UA code by a program. The checking that was done is broken into 3 steps, first a rough scan is, then a semi-fine and after a detailed interrogation is done. In the first scan information a few samples are pulled from the system, then combined and first the IP addresses are then interrogated using several WHOIS tools to determine the internet provider and geographic location if that is possible. If there is a pattern that emerges between any of the users, then the second step is done. In the second step the information about the user IP is then pulled into a single file, parsed and placed into a database. Once the information about IP addresses, types of IP addresses, IP service provider are added into the system dates. Edits for each user are added are also added into the database. A program is then run to find patters in this, and if there are patterns then the third step is then executed where each of the IP addresses and users UA is pulled from the system. This is then added to the database and then the final UAs are adjusted. That is the process that have used. The whole point of this gated process was to reduce the level of effort that is spent on this task Vodomar (talk) 19:39, 19 November 2020 (UTC)

Once the system is in place if there are red flags then they are attended to. I had to do some adjustments to the model after a request to check the user Lasta and 2 others. The model showed an overlap between the users in terms of IP address and UA agents, upon a query with the users about the device they were using Suradnik A10 said that the device they used is a cheap and available device that is used by many people. After making these adjustments, and using the contribution logs from the hr.wikipedia and the data collected from CU there was no collusion found with Lasta and the other users, and hence using the same model that was used for Lasta and the two users then the results for Kubura and the other users didn't warrant doing the third step of checking the system UA as the probability in the first place was very low based on the data that was collected and processed. Vodomar (talk) 21:53, 19 November 2020 (UTC)

And since you never used the CU tool to get the UAs that the users actually had, what did this program of yours do? Assign each of the users a "UA code" based on nothing so that you could tell everybody you didn't find a single UA match? Does this look like an accurate, detailed, or even valid investigation to you? CheckUser doesn't work like that, at all. Now it shouldn't come as a surprise that CU results on meta differ so much. Thanks for the explanation--Sakretsu (炸裂) 22:16, 19 November 2020 (UTC)

Yes it is accurate as it derives a correlation between edits on the hr.wiki and user activity. As a CU in the hr.wiki space I am only privileged to see the activity on the hr.wiki, where as you on Meta probably have access to more data than myself. My model is 95% accurate, and I have been using it for some time for this CU work and other work that I do in my private life. In terms of percentage the significance was quite low and therefore did not warrant going a level deeper. The CU tools that are available on the hr.wiki are quite basic and there is a lot of manual work required to extract the data and then parse it. There are really no analysis tools, and I had to develop my and my own methodology. Like I said before Last and a few others users came from the same IP and had the same UA on different dates and their explanation was it is the same cheap device that is not upgraded. This was from conversations from the users, after that I updated my model to take care for this factor. The UA agents are not unique as they are repeated across the userbase then how can one say that a user is the same as another. This is why it would be necessary to create unique user hashes where there would be a lesser chance of drowning investigations and there would be on terms of balance of probability to match a user you need a very high significance level to say that something is certain. In such cases a 50% is not significant, you need at least 85% - 90% to say that there is collusion. Also when the edits don't overlap or behaviour does not overlap, then there is a need to go into the lexical analysis of user's contributions and a significant. As I said I used data only from hr.wiki as I was a CU only there. So when the examination of IP overlap for the 38 users was very low, the user contributions differed by a lot, session times, length, size of articles, types of articles, types of activity, and so on were low there was no real need to go deeper. Also considering that for each operating system and browser there are security updates etc there is a tendency for drift in the UA over time as the pair of OS hash + Browser Hash, and considering that on probability many users use and own many devices and hook up to many networks and routers the probability model after taking all what was previously said did not require. If you check the CU page on hr.wiki you will see that my CU replies are the most comprehensive and they cover a lot of detail. Over time as I said I was able to fine tune my model and my methodology which takes time to perform, and if there is no warrant to go past a particular gate, just like I did with my investigation of Lasta and 2 users and like I did with Kubura. Lasta can attest that the investigation I did on him took time and that I was impartial. Vodomar (talk) 23:25, 19 November 2020 (UTC)

Vodomar, this has nothing to do with your “steps”, your “model”, or anything else of that sort. I truly can’t believe you wrote these messages, knowing they would be read by stewards and other checkusers, thinking they would believe a word of it. Your messages here demonstrate either a remarkably nonexistent understanding of the checkuser tool and checkuser policy, or a poor attempt at misdirection. Answer this question, and please do so concisely: how did you get the useragent strings? Vermont (talk) 01:27, 20 November 2020 (UTC)

There is no training or support for CU admins and they need to figure everything on their own. I have answered my question with what I have written above. You can figure it out Vodomar (talk) 01:35, 20 November 2020 (UTC)

You have done basically everything conceivable except answer the question. How did you get the UAs? Did you fabricate them? Did you run some magic program? Or did you check for them? It’s simple. Vermont (talk) 01:38, 20 November 2020 (UTC)

And regarding your training or support, it doesn’t matter whether you had any training or not, that’s simply not how the checkuser tool works. Your comments explaining the process you supposedly went through are completely devoid of anything remotely resembling reality. It reads like the written equivalent of a hacking scene in a poorly researched television show. The original question remains wholly unanswered. Vermont (talk) 01:46, 20 November 2020 (UTC)

Contact request

Hello,

I'm contacting you on behalf of the Ombuds Commission. I need to contact you by e-mail for matters regarding some of your actions.

You can contact me here or email directly the OC. Please contact me/us within the next two weeks so we can continue with our investigation.

Regards,

--Superpes15 (talk) 14:56, 1 February 2021 (UTC)

Revocation of your access to nonpublic personal data

On the recommendation of the Ombuds Commission, the Trust & Safety Team of the Wikimedia Foundation, on direction of the General Counsel, has revoked your access to non-public information or tools that may be used to access non-public information, previously granted under the NDA. This revocation is permanent. Please refer to the email you will shortly receive from Trust & Safety for further information. WMFOffice (talk) 15:40, 5 April 2021 (UTC)