Wikipedia talk:Event coordinator/Archive 1

Archive 1

Revokes

I copied in some very high level criteria for revocation. Don't want to get too beansy about unrealted use, the "general misconduct" clause should be enough, and unless it is blatant a warning may be all that is needed. — xaosflux ^Talk 03:51, 12 May 2018 (UTC)

I'm fine with that, especially as only established editors will be getting this permanently. The revocation criteria is less of an issue, but I do think having it is good and thank you for adding it. (unsigned) TonyBallioni (talk) 14:11, 12 May 2018 (UTC)

FYI on future bundled permission request

Tracked in Phabricator
Task T76053

Should phab:T76053 ever get done, it should replace the (noratelimit) option on this group. — xaosflux ^Talk 14:39, 12 May 2018 (UTC)

Directions

This page could probably use some directions on the process of using Special:CreateAccount and Special:UserRights. Might it be useful for the account creators to drop welcome messages for their new users as well? — xaosflux ^Talk 03:49, 12 May 2018 (UTC)

Is there an account creator guide for this sort of thing? I could write something up on user rights briefly. TonyBallioni (talk) 03:57, 12 May 2018 (UTC)

@TonyBallioni: there is a section on editing rights in Wikipedia:Administrators' guide/Granting and revoking user rights that could be mostly reused. — xaosflux ^Talk 12:40, 12 May 2018 (UTC)

@Xaosflux: I've tweaked the text from there and added it to this page. Feel free to make any changes. TonyBallioni (talk) 14:11, 12 May 2018 (UTC)

@TonyBallioni: I added a bunch more, take a look. — xaosflux ^Talk 15:10, 12 May 2018 (UTC)

Looks good to me. TonyBallioni (talk) 15:22, 12 May 2018 (UTC)

Pre-populated times

I added "10 days" to the drop down list to make this easier to pick "the max" for this group. — xaosflux ^Talk 15:39, 12 May 2018 (UTC)

Great, thanks. TonyBallioni (talk) 15:42, 12 May 2018 (UTC)

History of this userright and thanks

The creation of this userright followed the April 2018 Wikipedia:Requests for comment/Event coordinator proposal. TonyBallioni presented that RfC and has been guiding discussion toward the establishment of the userright.

The userright follows many discussions about the security risk of granting the Wikipedia:Account creator userright to people who are doing Wikimedia programs and events. Although the "account creator" rights include some of what an event coordinator would need, they do not address every need, and the account creator rights also includes some functions beyond the needs of people doing programs and events. It took time to recognize that account creator rights would not work for programs and events, and the years of failed attempts to make that userright work for this purpose were a necessary precedent for convincing people to support the establishment of a new userright. Another driving force behind making this userright now is the increase in programs and events over the past few years. With more people doing more Wikimedia programs, more outreach coordinators are using tools like the Wiki Education Foundation's meta:Programs and Events Dashboard to track event attendees, edits, and audience views and to give credit to organizers, supporting organizations, and the participants. The Wikimedia Foundation Community Tech team is currently developing the meta:Community Tech/Tools for program and event organizers in response to the demand which the 2017 Community Wishlist recorded.

If anyone wants to read about the circumstances after which the Wikimedia community came to support the establishment of this userright then I recommend checking out problem logs associated with events. The typical scenario would be that some event coordinator would gather lots of new editors together who all wanted to do Wikimedia editing together in a community center. Common cases were students in classes, people in libraries to commemorate special events or holidays, experts such as university staff or researchers or staff at STEM or GLAM organizations doing their own community outreach, academic conferences hosting Wikimedia workshops, or any other kind of social event with Wikimedia editing. In all of these cases there would be mass confusion with Wikimedia administrators treating the event as a security breach, blocking IP addresses, blocking users, posting messages accusing everyone of vandalism, and going into a panic over the sudden rush of editing by a related group of people. I know that this has happened at Wiki NYC and Wikimedia UK events, and other groups like Art + Feminism, AfroCROWD, Wiki Medicine, Wiki LGBT+ have experienced this as well. The conflicts were predictably recurring and the Wikimedia community had to do something. Blue Rasberry (talk) 14:47, 14 May 2018 (UTC)

Thanks

Please anyone who knows anything about the establishment of this userright please thank everyone who contributed to the establishment of the userright, including anyone who knows someone who did program and event outreach and encountered difficulty in the past because this userright did not yet exist.

Everyone who commented in any of these discussions deserves thanks for the creation of this userright:

"How we organized a 1500 person meetup (and you could too)", Art+Feminism @ WikiConference North America 2015

• meta:Learning patterns/Six-account limit, October 2013
• Large group of users requesting accountcreator permissions, February 2016
• Wikipedia:Requests for permissions/Account creator (event coordinator denied userright), August 2016
  • Extended discussion from PERM, August 2016
• Propose changes to process for granting userright, August 2016
• Temporary access, August 2016
• Multi-site events, August 2016
• Request userright on behalf of another person, August 2016
• "Event management" bot or tool for new account registration, August 2016
• Can bluerasberry be an account creator?, August 2016
• Userright for event management, September 2016
• Using off-wiki tools to register new Wikimedia accounts, October 2016
• My wish - the example case, January 2017
• Allow users in the Account Creator user group to add users to the Confirmed user group, August 2017
• Blocked editing at high profile event, March 2018
• Propose change to give access to anyone doing outreach, March 2018
• NOTICE: EducationProgram extension is being deprecated, March 2018
• Please allow my students to register their accounts, April 2018
• Wikipedia:Requests_for_comment/Event_coordinator_proposal, April - May 2018
  • Wikipedia_talk:Requests_for_comment/Event_coordinator_proposal, March - May 2018

Blue Rasberry (talk) 14:47, 14 May 2018 (UTC)

Written rules should match the software interface's design

This interface prompts new users to register accounts with their desired username and the password they choose.

The interface when the email option is checked.

The current text here says, "When creating accounts, event coordinators should always check the box marked use a temporary random password and send it to the specified email address, and should never allow event participants access to the coordinator's account." There is other text which elaborates on this idea.

The design of the software interface imagines that the person with account creator or event coordinator userrights will pass access of their computer and logged-in Wikimedia account to the new user to register an account. This is evident because the interface asks the new user to set a password. After registering the account, a process which should take 2 minutes, the new user passes control of the computer back to the account owner.

I recognize that this is a theoretical security risk but at the same time this is the software's design and its intuitive use. It is not reasonable to expect the end user, especially one who has no Wikimedia experience whatsoever and a 0 edit count, to reject the design of the software and understand a rule which is contrary to the prompts in front of them. It does not increase security to develop a fiction that end users will use an interface in a way contrary to design. Let's match the rules to the software interface. Execute an interface change if there is consensus.

This is an old problem which existed with WP:Account creator. There was never any consensus on the text being used here. I propose giving instructions which match the prompts. Does anyone have other thoughts? Blue Rasberry (talk) 23:25, 14 May 2018 (UTC)

• Pinging Stwalkerster on this, as I typically defer to him regarding account creation stuff. TonyBallioni (talk) 23:31, 14 May 2018 (UTC)
• The real "solution" to this seems to be to move to the program and events dashboard, which could run on a shared device like a kiosk or tablet, or peoples own devices. Making it "easy to use" for event coordinators is key here. — xaosflux ^Talk 23:48, 14 May 2018 (UTC)

Xaosflux Yes, I agree. That would solve this problem and several others. I see benefits to that idea and no drawbacks. Blue Rasberry (talk) 10:53, 15 May 2018 (UTC)

I would argue that the UI is trying to serve two roles: allowing users to create alternative/doppelgänger/bot/testing accounts for themselves, and creating accounts for other people. The first use case is why it prompts for a password, the second is why it has the option to email a randomly generated password. I see nothing on the page that says "pass access of your computer and logged-in Wikimedia account to the new user". --Ahecht (TALK
PAGE) 14:45, 15 May 2018 (UTC)

I meant to come and comment here since Tony pinged me - but Ahecht has said pretty much what I was going to say - it's a dual-use form. We shouldn't be adapting our policies to meet the system, rather use the system per our policies. [stwalkerster|talk] 18:02, 16 May 2018 (UTC)

@Ahecht and Stwalkerster: Event coordinators will pass control of their logged into computers to new users so that they can register the accounts. The interface design prompts this. If there is an event coordinator at a Wikimedia outreach event who needs to assist new users in creating accounts, they will pass control of their device to the new users so that those people can make accounts. The idea that someone could see a prompt saying "create account, username, password" and not believe that these are instructions for a new user to enter a desired username and password seems inexplicable to me. The use case that we have to imagine for this userright is that many event coordinators will have 0 edits and no Wikimedia editing experience. There is almost no use training planned. Users will know and understand what they read in front of them and there is no plan to invest in infrastructure to train anyone to disregard instructions that we put in front of them.

I assert that my interpretation this situation is reasonable, normal and expected. Neither now nor at any time in the past has there ever been event coordinators who had input into this interface and agreed to the odd assertion that users should or will disregard the interface in front of them.

The current documentation on this page is a legal fiction with no basis in reality or the precedent. To expect otherwise is to treat this documentation as a bogus EULA where there is neither expectation that anyone will read it nor that any typical user will modify their behavior as a consequence of their agreement to it. The documentation here has origins in practices unrelated to coordinating events and the intended use case for this documentation is something other than programs and events.

Ahecht, Stwalkerster, please: is it really the case that I have not communicated clearly enough for you to understand what I am saying? If you understand but are not convinced, can you suggest what I could to to persuade you? Is it truly your belief that users can and will follow the instructions on this page? Blue Rasberry (talk) 21:27, 16 May 2018 (UTC)

What I don't understand is how someone with no experience could consider themselves knowledgeable enough to guide newer users in a meaningful manner? It seems inexplicable to me that this situation even occurs.

I do understand that event coordinators are intentionally compromising their accounts who either don't understand or simply haven't familiarised themselves with policy - that's what these pages are here for. It's not bogus, and I don't even think it's particularly hidden - it's linked to from the permissions request page! I'm open to changing the interface, but the simple matter is - if an event coordinator hands over control of their account, that account must be blocked. If the event coordinator has knowledge of the newcomer's password, the newcomer's account must be blocked. The only acceptable option here is for the event coordinator to create the account with the password sent by email. Whether this is via the Special:CreateAccount form or through another tool, I don't particularly care.

I don't expect the new users at events to be aware of our policies (that's one of the things the coordinator should be there for), but I do expect those requesting advanced rights (ie. the coordinators) to understand how to correctly use them according to policy, otherwise they should not be eligible to hold those rights.

I'm genuinely stunned at the complete disregard for policies that you claim happens at these events - I sincerely hope you are exaggerating. Outreach events should be guiding newcomers into productive editors on their own, not giving them a blanket "oh, you don't have to follow the rules because this is an outreach event" exception which will be completely useless to them outside of that outreach event. [stwalkerster|talk] 22:37, 16 May 2018 (UTC)

@Bluerasberry: It doesn't say "create account, username, password", it says "Create account, username, use a temporary random password and send it to the specified email address", and as soon as you check that box, the "password" field disappears. --Ahecht (TALK
PAGE) 23:53, 16 May 2018 (UTC)

@Stwalkerster and Ahecht: I am not sure what more it would be useful for me to say. Thanks for hearing me out and sharing your positions. If you think of other things to discuss or do then ping me. I am available by voice or video chat. Blue Rasberry (talk) 02:23, 17 May 2018 (UTC)