Wikipedia:Bots/Requests for approval/Protection Helper Bot

The following discussion is an archived debate. Please do not modify it. To request review of this BRFA, please start a new section at Wikipedia:Bots/Noticeboard. The result of the discussion was

Approved.

Protection Helper Bot

Operator: Daniel Quinlan (talk · contribs · SUL · edit count · logs · page moves · block log · rights log · ANI search)

Time filed: 22:10, Tuesday, July 30, 2024 (UTC)

Automatic, Supervised, or Manual: automatic

Programming language(s): Python

Source code available: ~~The source code will be made open source on GitHub if the bot is approved and once it is operational.~~ On GitHub

Function overview: The bot will automatically restore long-term page protection levels after shorter-term higher protection levels expire to reduce administrator workload and to avoid unintentionally leaving at-risk pages unprotected.

Links to relevant discussions (where appropriate): Special:Permalink/1237644057#Bot_to_restore_long-term_protections_after_shorter-term_higher_protections_expire

Edit period(s): Continuous

Estimated number of pages affected: roughly 50 to 200 pages per year

Exclusion compliant (Yes/No): Yes

Already has a bot flag (Yes/No): No

Function details: The Protection Helper Bot will automatically restore the original long-term page protection level after a temporary higher-level protection expires. This bot will:

Monitor the protection log to track when temporary higher protection levels are scheduled to expire.
After scheduled expirations, check the page protection status and restore the previous long-term protection if needed.
Ensure that protection changes are logged with the appropriate reason and attribution to the original protecting administrator.
Notify the most recent protecting administrator about the restoration action to allow for any necessary adjustments.
Skip pages with the {{bots}} template indicating exclusion from bot actions.
Stop all actions if an emergency shutoff method is activated.
No action will be taken if the duration of the higher protection level extends beyond the prior protection's expiration date, or if the protection level is the same or lower.
The bot will initially rely on existing bots to update protection templates as needed, but that functionality may be added in the future.

Minor adjustments to the bot's operation may be made based on feedback.

Discussion

Approved for trial (25 edits or 30 days, whichever happens first). Please provide a link to the relevant contributions and/or diffs when the trial is complete. I am counting these 25 edits as page protections (since page protections show as "an edit" in the page history) but please make sure the edit log posted at the end of this trial also contains any user talk notifications as described above (in other words, if I'm reading the functionality correctly, there will be up to a total of 50 edits made). Primefac (talk) 23:44, 4 August 2024 (UTC)[reply]

I had a few comments but I've accidentally lost them. Roughly speaking:

I don't think it makes sense to exclude pages with {{bots}} - that would allow non-admins to control protection status of pages. Further, often the template is added to deal with minor content adjustment bots or buggy bots affecting singular pages, and not this particular bot.
It may be good for there to be a mechanism for an admin to prevent reprotection of a page by the bot. As it stands, my understanding is that the admin will only be notified after the reprotection is reinstated. If the temporary protection is that of ECP for 6 months, for example, the original admin may not even be active when the original protection is reinstated, which hurts effective review. One mechanism might be an ignore comment in the protection log prevents the bot from acting, and the bot informing the admin it will do a reprotection as soon as they change the protection level, rather than when the bot is due to change it back. There might be other ways too.
I would ask the source code be released as a condition of approval, prior to approval, especially as this is an adminbot and behaviour in edge cases is relevant. That would also allow for better scrutiny of the bot prior to approval.

ProcrastinatingReader (talk) 02:32, 15 August 2024 (UTC)[reply]

I have some thoughts on each of those points:

I agree that giving all editors the ability to override a protection reinstatement simply by slapping a {{bots}} tag into an article is a bad idea.
This bot doesn't need to have any additional mechanism to prevent reinstatement of protection (which I see as unlikely to be needed). The mechanism is already there. An administrator who wants to prevent reinstatement would merely perform two actions: first re-protect for a short duration (or just unprotect), and then apply the second temporary protection for a longer duration. When the temporary protection expires, the original protection would also be expired, and the bot does nothing.
A source code review would be good. I thought that was standard procedure, especially for admin bots, but I am unfamiliar with how bots get approved.

~Anachronist (talk) 17:48, 31 August 2024 (UTC)[reply]

I will also chime in and request that the source code be made available before approval. EggRoll97 ^(talk) 19:01, 1 September 2024 (UTC)[reply]

I also feel it is important that the source be released and a reasonable amount of time be allowed for review before approval for production use. RoySmith (talk) 19:06, 1 September 2024 (UTC)[reply]

@Daniel Quinlan: This bot was approved temporarily and the approval period is almost done. I have seen no activity from this bot. Were you planning to start it up?

Also, your source code availability conditions are backward. For something like this, it should be available for examination before approval, not after. ~Anachronist (talk) 19:12, 1 September 2024 (UTC)[reply]

I don't think releasing source code is a normal BRFA requirement. I think BRFA is normally based around consensus for the task plus performance in trials. –Novem Linguae (talk) 19:55, 1 September 2024 (UTC)[reply]

I'm pretty much a BRFA newbie, but I've been editing wikipedia for almost 20 years, been working on open source coding projects longer than that, and writing software in general a lot longer than that. I'm just not seeing any reason to make releasing the code conditional on approval to run it. RoySmith (talk) 20:08, 1 September 2024 (UTC)[reply]

Assuming good faith, Daniel probably meant something like "let me get the bot working, then after that I'll take the extra time and effort to spin up git and a GitHub repo". –Novem Linguae (talk) 20:52, 1 September 2024 (UTC)[reply]

I'm always happy to AGF. I guess I was mostly responding to the statement that BRFA doesn't normally require releasing the source code. If that's true, I think it's an unfortunate state of affairs. I was also thinking of a conversation I recently had in another setting regarding the fragility of the whole ecosystem of scripts, bots, and other bits of software on which the smooth running of enwiki depends, and how often some important tool gets abandoned with no practical way for another developer to take it over. But, I really shouldn't be trying to make this particular request a soapbox for all that. RoySmith (talk) 21:27, 1 September 2024 (UTC)[reply]

Thanks for sharing your views. I might be open to supporting a rule that complex bots need to have their source code in the BRFA, if proposed on the right talk page. I agree that it helps immensely with keeping old bots running once their owners go inactive. –Novem Linguae (talk) 21:54, 1 September 2024 (UTC)[reply]

For an admin bot like this, the bot policy recommends (but doesn't require) a source code review. The review doesn't have to be community-wide. ~Anachronist (talk) 22:48, 1 September 2024 (UTC)[reply]

@Novem Linguae: Per the bot policy, It is recommended that the source code for adminbots be open, but should the operator elect to keep all or part of the code not publicly visible, they must present such code for review upon request from any BAG member or administrator. I am not either (though I would fancy myself technically competent enough to have a look through it), but at least two administrators and a BAG member have now requested that the source code be made available. While providing the code privately to those individuals would technically satisfy the conditions of WP:ADMINBOT, I don't see any reason why the source code would need to be private. EggRoll97 ^(talk) 22:35, 1 September 2024 (UTC)[reply]

@Anachronist: I've been pulled away from working on this the last few weeks, but the bot is nearly ready for activation.

As mentioned in the BRFA, the source code will be released. In addition, Novem Linguae has kindly agreed to review the code prior to activation (and if Novem Linguae ends up being too busy, I'll ask someone else to review). While I understand the need for contingency plans on some critical bots, I'm concerned that requiring completed source code prior to approving projects would be a strong disincentive for future development.

Based on the above discussion and reviewing logs, exclusion using the {{bots}} template doesn't seem to be necessary or helpful, so that functionality has been left out. Also, if an administrator wishes to prevent restoration of a long-term protection, unprotecting the page before applying the new protection will be sufficient and is less hacky than some other approaches that I considered. Based on my experience handling requests on WP:RFPP, I expect that to be rare, though.

Finally, the bot is designed to handle both temporary and indefinite protections. Daniel Quinlan (talk) 09:08, 2 September 2024 (UTC)[reply]

Thank you. I look forward to seeing it in action. ~Anachronist (talk) 17:13, 2 September 2024 (UTC)[reply]

The source is located at protection-helper-bot . I'm still cleaning up the code, revising some of the method names, etc. so if anyone has feedback, I'd appreciate an email rather than pull requests or GitHub issues at this point. Thanks. Daniel Quinlan (talk) 21:40, 3 September 2024 (UTC)[reply]

I'm also on Discord if anyone has any questions that you would like to ask interactively. Daniel Quinlan (talk) 22:06, 3 September 2024 (UTC)[reply]

requiring completed source code prior to approving projects would be a strong disincentive for future development. The "completed" source code isn't being requested. You're free to change the source code any time, including after the approval – only major changes in functionality require a new supplementary BRFA. – SD0001 (talk) 17:25, 3 September 2024 (UTC)[reply]

I guess what's really bugging me about this is trying to understand why anybody would not want to release the code early. @Novem Linguae said a couple of days ago, let me get the bot working, then after that I'll take the extra time and effort to spin up git and a GitHub repo. To me, it's hard to imagine "git init" not being pretty close to the first thing I type when starting any new project. It's just good software engineering hygiene. And pushing it out to some storage that's more robust than my laptop's hard drive isn't far behind. RoySmith (talk) 18:26, 3 September 2024 (UTC)[reply]

The significant part is let me get the bot working, not setting up source control. It took me five minutes to create the repository and package the script. Requiring someone to invest a significant amount of time developing code prior to approving a project is the issue. This wasn't a ten line user script, it was a significant investment of my free time in the month since project was approved. Daniel Quinlan (talk) 21:19, 3 September 2024 (UTC)[reply]

@Daniel Quinlan Thank you. My apologies for the gruff tone I inadvertently adopted. This is just something that pushes my buttons and I should not have taken it out on you. RoySmith (talk) 23:02, 3 September 2024 (UTC)[reply]

I've kicked off a discussion at Wikipedia_talk:Bot_policy#Open_source_bots; let's continue there if people have feelings about this. Legoktm (talk) 03:55, 5 September 2024 (UTC)[reply]

The bot is running now. The code review by Novem Linguae highlighted a few areas for improvement, especially improving some method names for clarity, which I'm addressing. There are also several cases where the bot won’t reprotect an article but where a notification might be helpful. To address this, I plan to add a user talk page notification to the administrator who performed the expired protection, but only for those cases.

The vast majority of articles that would have been reprotected have already been handled (either due to disruption resuming or administrators monitoring expirations), but even with that constraint, the bot has already restored long-term protection on several pages protected under general sanctions, two under WP:CT/A-I and one under WP:GS/RUSUKR.

Link to relevant contributions as per the terms of the trial: Special:Log/protect/Protection Helper Bot. Daniel Quinlan (talk) 01:35, 4 September 2024 (UTC)[reply]

As the trial period is ending, I've turned off the bot for the time being. Daniel Quinlan (talk) 23:40, 4 September 2024 (UTC)[reply]

Trial complete. –Novem Linguae (talk) 00:18, 5 September 2024 (UTC)[reply]

Okay... so what happens now? Assuming that the trial didn't turn up any issues, what must happen to activate the bot for real? ~Anachronist (talk) 01:27, 5 September 2024 (UTC)[reply]

A WP:BAG member will swing by and make a decision, which is typically full approval or another trial, unless there's something special about adminbots that I'm not aware of or I'm missing something. –Novem Linguae (talk) 02:20, 5 September 2024 (UTC)[reply]

The bot only appears to have run for 10 protections and 1 day, not 30 days. The trial period only starts when you start the bot. – SD0001 (talk) 17:52, 5 September 2024 (UTC)[reply]

The bot and admin flags for that bot have expired, so it would have to be re-flagged to continue the trial, I think. –Novem Linguae (talk) 18:17, 5 September 2024 (UTC)[reply]

The bot completed the actions it was able to during the trial. It processed about 13,000 protection logs, identifying 741 relevant expirations, and out of those only 10 pages had protections that needed to be restored, which the bot handled successfully.

Going forward, whether in an extended trial or after approval, the pace of protections will generally be very slow now that the backlog has been handled. A quick review doesn't show anything that will be reprotected in the next week, but that could change. Daniel Quinlan (talk) 19:48, 5 September 2024 (UTC)[reply]

Thanks for taking this task on Daniel. Where is the bot going to be running from? Does the account have 2FA set on it and are you using OAuth or BotPasswords to log in? Legoktm (talk) 03:18, 5 September 2024 (UTC)[reply]

@Legoktm: I have a secure Linux server, only accessible by me, where I will be running it. The server is regularly updated with the latest security patches, and I follow best practices for securing remote access. I submitted a request to enable 2FA for Protection Helper Bot on meta. The reprotection script is using a BotPassword with the minimum set of required permissions enabled. Daniel Quinlan (talk) 05:43, 5 September 2024 (UTC)[reply]

2FA is now enabled for Protection Helper Bot. Daniel Quinlan (talk) 06:36, 5 September 2024 (UTC)[reply]

Approved for extended trial. Please provide a link to the relevant contributions and/or diffs when the trial is complete. Same terms as previous, but since as mentioned the bot didn't actually start editing until the end of the temporary permission grant, we might as well go again. Please count the previous edits as part of the 25 edits stipulated in the first trial. Primefac (talk) 13:00, 7 September 2024 (UTC)[reply]

@Primefac: Thanks. Note that if the bot had been active all month, it would have made only one additional protection (for Mahatma Gandhi which was reprotected manually). The bot is running again, but no restorations are currently scheduled to happen until 22 September. A simulation shows only 58 protections would have been restored in the past year and there are idle periods like the current one. If this bot is approved, I expect the rate to increase somewhat over time because there will be less downside to making short-term higher-level protections. Daniel Quinlan (talk) 02:47, 8 September 2024 (UTC)[reply]

Ah, fair enough, it seems I misread the earlier statement regarding the bot running. I don't see any major issues, complaints, or concerns that haven't been dealt with, so I'll go ahead and make it official:

Approved. If there are any significant changes or updates required (other than the usual minor maintenance/debugging sorts of things) please ping {{@BAG}} on the talk page or at WP:BOTN for review/approval. Primefac (talk) 13:56, 8 September 2024 (UTC)[reply]

The above discussion is preserved as an archive of the debate. Please do not modify it. To request review of this BRFA, please start a new section at Wikipedia:Bots/Noticeboard.