End date: 04:21, 10 August 2009 (UTC)
Because of my "usual" working hours I am often active on the project when other checkusers are not online. I have, previously, spent 17 years as an IT engineer working with major banks and Fortune 500 companies in 7 countries. I am an expert in understanding networks and IP addresses and was formerly a CCNP (still current), and MCSE (not current) and also a Sun Certified Systems Engineer (current). I believe I have proven that I fight against vandals and users who run sock-puppet accounts. I have submitted multiple reports to WP:RFCU and have been able to justify each one. I am a trusted user on simpleWP and am both a sysop and a bureaucrat here. I am 41 years of age and don't take decisions in a rash manner. I am a medical doctor and am used to dealing with confidential and private information in a mature and sensitive manner. As such, I would like to ask the community to consider me for checkuser. (I am willing and able to identify myself to the WMF)
Candidate's acceptance: Self-nomination fr33kman talk 04:21, 2 August 2009 (UTC)
From NonvocalScream (talk)
Q: Many editors may edit from an IP. What technical data provided from the checkuser interface may assist a checkuser in separating the users?
A: There are three parts to the checkuser interface; 1) Get IPs (obtains the IP addresses that a named user has used), 2) Get edits from IPs (obtains the edits that a particular IP address has performed), and 3) Get users (provides user names that have edited from a specific IP address). Using a combination of these three tools provides a checkuser with the ability to sort out who is abusing the wiki and who is not. Since many abusive editors have patterns to their editing, it should be possible to only target the right person. If in doubt, it'd be best to check with someone else who is a checkuser or perhaps even a steward. Since browser information is also available, it can be used to aid in separating users as most users probably only use a single OS and browser. This is not definitive however as some users do have multiple machines or use more than one browser.
Q:In what two circumstances are you permitted to release an IP (or group of IPs) to an administrator?
A:When the user has performed a lot of vandalism or very disruptive editing it is allowed to release the information to a third-party. This would include admins. Additionally in cases of investigation of abuse and it is also acceptable to release personally identifiable information when the safety of the WMF, its users or the public is at risk. Furthermore it can be released with the permission of the user in question and also when ordered to by a court order or a subpoena. However, it would not normally be needed to actually release the private information of a user. Most often it would be only required to say that the checkuser has been confirmed as the same person, or that the user is from the location they say they are from.
Q:Are you permitted to tell a user that you have checked them?
A:The privacy policy states that when presented with a subpoena to release information to law enforcement or government agencies, that the user whom it is regarding will be contacted in order to inform them information has been requested. This also implies that users can be told they have been checked. Since checkuser requests are normally made on a publicly accessible page on wiki, and since the result (not the actual private info) of a request is then posted to that page, it seems obvious that users will be aware that they have been checked.
Q:How many machines will a CIDR /16 block?
A:CIDR (Classless Inter-Domain Routing) is the "solution" that was started to prevent the running out of IP addresses under IPV4 before IPV6 was implmented. It has (in some ways) trumped IPV6 (which very few people actually use). The /16 range block will block 65536 individual IP addresses. It may, however, block many more than that due to use of NAT *network address translation". But it's the most accurate answer I can give in general terms.
Q:Will technical data always prove if an editor is sockpuppeting?
A:No! There is no such thing as "always". When ever anyone in life tells you that something will always happen, you can rest assured they it won't. The data will give you a good idea; often a very good idea. But you can rarely be totally sure. Sometimes it will be a judgment call. Sometimes a hard one, occasionally a wrong one (hopfully only rarely). This is why it is important to leave a blocked user able to edit their talk page, or able to email a sysop just in case a mistake was made.
Q: How would you detect if an IP is an open proxy?
A:I've not had much personal experience in dealing with open proxies, but I understand the basics. It is not always going to be possible to 100% determine if it is an open proxy, but one can often get a very good indication that it is by the following. Firstly, one should have a good reason to suspect that an open proxy exists. Such grounds for suspicion can include; that an IP is in fact running a web proxy, and that one of the following additional conditions are met; 1) the proxy permits access to anyone, 2) that it doesn't let anyone access it but that the level of authentication is very weak and easily bypassed, 3) that the details for accessing the proxy are to be found publicly on the Internet, 4) the host has been hijacked so as to allow one or more persons unauthorized access to it. Probable cause for thinking that an open proxy exists are; many edits from a single IP address, especially if they occur around the clock; inconsistent traffic coming from a single IP address or traffic of such a nature as to cause one to think that it is being used by multiple people; similar traffic originating from multiple IP address (esp if from all over the world) that lead one to believe that a single person is using multiple IP addresses can lead one to believe that some of them may be open proxies; listing on sites that contain lists of openproxies or in completewhois reports. There are also multiple checker scripts and tools that can aid one in making the decision. Checking also to see if an IP has been blocked elsewhere on WMF (meta, enWP) as an open proxy can help too. My standard rule would still apply; if in doubt, check with someone who knows more than you, and if need by, err on the side of caution with a short block and then a longer block if it turns out to be an open proxy.
Q: What method do you use to calculate a range block?
A:Generally I'd use a table of CIDR ranges as it is a very quick method and is less prone to error, but I do also have the knowledge to do the binary math if need be. I believe in as small a range block as is needed. I'd also check with the list of sensitive IP addresses and check what collateral blocks of named users I'd be affecting. If there is going to be collateral blocks, I'd consider using an anonymous only block or else giving the named users (if trusted) the flag "IP block exempt". Again, check with someone else if unsure.
About your bio, you say that you are 41, but you also say that you have 17 years of IT experience and that you are a doctor. Since medical school usually takes 8 years, 8+17=25. 41-25=16. So you were 16 when you started working in IT? Not impossible, but odd. Griffinofwales (talk) 03:10, 3 August 2009 (UTC)
Probably not allowed to vote yet, but thanks for welcoming me on IRC Fr33kman, and I hope you pass the audition :) — Preceding unsigned comment added by TomasWiki (talk • contribs)