From KnightLago at gmail.com Tue Nov 30 00:03:38 2010
From: KnightLago at gmail.com (KnightLago)
Date: Mon, 29 Nov 2010 19:03:38 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
Message-ID: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>

Giano,

I am writing on behalf of the Arbitration Committee regarding the recent
unauthorized access to the private Arbitration Committee wiki. Those
Arbitrators running for election are not privy to this email or the
discussion concerning this matter as it is being discussed on our "B"
mailing list. Please either respond to the "B" mailing list CC'd on this
email or to me directly.

We were hoping you could address some of our concerns and shed some light on
what exactly occurred involving the Arbitration wiki by answering the
following questions:

1) How did you learn about the security hole?
2) Did you work with anyone in accessing the wiki?
2) Whose account did you use to access the wiki?
3) How did you obtain the account to access the wiki?
4) To your knowledge, who else was accessing the wiki before Risker was
notified?
5) Did you attempt to access any other accounts, and if so, were you able
to?
6) Did you copy, disclose, or distribute any information you viewed on the
wiki to anyone?
7) Did you tell anyone else how to access the wiki before notifying Risker?
8) If so, who; and to your knowledge did they access the wiki?
9) If anyone else was able to access the wiki, to your knowledge did they
copy, disclose, or distribute any information they viewed?
10) Is there any other information you could provide that would help us
better understand what occurred here?

Thanks for working with us, and taking the time to answer our questions.

--KnightLago



From KnightLago at gmail.com Tue Nov 30 00:09:30 2010
From: KnightLago at gmail.com (KnightLago)
Date: Mon, 29 Nov 2010 19:09:30 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
Message-ID: <AANLkTinwQkavmPR2jPjX7wO+-Ks7k_7E0GAsQ7Aaa8U_@mail.gmail.com>

<list only>

I figured I would take it easy to start and see how willing he is to work
with us. We already know the answer to some of these questions, so we will
also be able to determine if he is lying about his actions. We can then get
into specific questions about Usher, etc.

KL


*****


From kirill.lokshin at gmail.com Tue Nov 30 01:48:01 2010
From: kirill.lokshin at gmail.com (Kirill Lokshin)
Date: Mon, 29 Nov 2010 20:48:01 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTinwQkavmPR2jPjX7wO+-Ks7k_7E0GAsQ7Aaa8U_@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTinwQkavmPR2jPjX7wO+-Ks7k_7E0GAsQ7Aaa8U_@mail.gmail.com>
Message-ID: <AANLkTinZXBvbcceaKS7qjtTvP_XHL-VJKCQS-=TED2NX@mail.gmail.com>

That seems reasonable. I expect he's going to come back with "you'll never
make me talk!" or something along those lines, but I suppose I could be
pleasantly surprised.

Kirill


*****

From risker.wp at gmail.com Tue Nov 30 15:57:57 2010
From: risker.wp at gmail.com (Risker)
Date: Tue, 30 Nov 2010 10:57:57 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTinZXBvbcceaKS7qjtTvP_XHL-VJKCQS-=TED2NX@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTinwQkavmPR2jPjX7wO+-Ks7k_7E0GAsQ7Aaa8U_@mail.gmail.com>
<AANLkTinZXBvbcceaKS7qjtTvP_XHL-VJKCQS-=TED2NX@mail.gmail.com>
Message-ID: <AANLkTimuF43vr5pvdg57VOx=1Bw_YJUMYnFUiLqSo9+P@mail.gmail.com>

<list only>
Well, seems he was ready to spar a bit but likely cooperate until he read
Jimmy's talk page today. Now he is completely focused on the issue of
whether or not Jimbo could really refuse to seat a candidate who meets all
criteria except for the identification....

I do understand those who criticize the relative pointlessness of the
current identification process, and Jimmy is way off base in thinking that
identifying according to WMF processes would have in any way changed the
outcome of the Sam Blacketer situation. On the other hand, I'll admit that I
might well not have identified under a different process as the level of
professionalism and the respect for personal information and security
of electronic data was, shall we say, not particularly a strong point of the
WMF even two years ago. They're getting there, but there are still some
realistic concerns.

Risker/Anne

*******

From User.CoolHandLuke at gmail.com Tue Nov 30 23:38:41 2010
From: User.CoolHandLuke at gmail.com (Cool Hand Luke)
Date: Tue, 30 Nov 2010 18:38:41 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTimuF43vr5pvdg57VOx=1Bw_YJUMYnFUiLqSo9+P@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTinwQkavmPR2jPjX7wO+-Ks7k_7E0GAsQ7Aaa8U_@mail.gmail.com>
<AANLkTinZXBvbcceaKS7qjtTvP_XHL-VJKCQS-=TED2NX@mail.gmail.com>
<AANLkTimuF43vr5pvdg57VOx=1Bw_YJUMYnFUiLqSo9+P@mail.gmail.com>
Message-ID: <AANLkTik4cBE=16C0tdZvotOAeN-3faOpoxmfxSdAVtZe@mail.gmail.com>

Yeah: going through the FT2 material, I was amused to see that Poetlister
was identified. The tone and timing are unfortunate. FWIW, I wish he said
that it was ArbCom's policy. He seems to forget this each year, but both of
the last two incoming classes were asked about whether identification should
be required (as was announced by FT2 prior to ACE2008), and both classes
responded in the affirmative--without dissent, I believe. By making it *his
* policy, Jimbo makes it seem more personal--especially when he directly
addresses one candidate.

Anyhow, what do we do if Giano doesn't respond at all?

Frank

*****

From risker.wp at gmail.com Tue Nov 30 23:44:21 2010
From: risker.wp at gmail.com (Risker)
Date: Tue, 30 Nov 2010 18:44:21 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTik4cBE=16C0tdZvotOAeN-3faOpoxmfxSdAVtZe@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTinwQkavmPR2jPjX7wO+-Ks7k_7E0GAsQ7Aaa8U_@mail.gmail.com>
<AANLkTinZXBvbcceaKS7qjtTvP_XHL-VJKCQS-=TED2NX@mail.gmail.com>
<AANLkTimuF43vr5pvdg57VOx=1Bw_YJUMYnFUiLqSo9+P@mail.gmail.com>
<AANLkTik4cBE=16C0tdZvotOAeN-3faOpoxmfxSdAVtZe@mail.gmail.com>
Message-ID: <AANLkTinxTDnWott0s6+t8CQLe9SpmfpPLyPRd_Z5oceE@mail.gmail.com>

Good question, and I have poked him privately again to express my opinion
that this issue is really, really important. Whether he responds or is still
too angry about the Jimmy issue is a coin toss.

Risker/Anne

On 30 November 2010 18:38, Cool Hand Luke <User.CoolHandLuke at gmail.com>wrote:

> Yeah: going through the FT2 material, I was amused to see that Poetlister
> was identified. The tone and timing are unfortunate. FWIW, I wish he said
> that it was ArbCom's policy. He seems to forget this each year, but both of
> the last two incoming classes were asked about whether identification should
> be required (as was announced by FT2 prior to ACE2008), and both classes
> responded in the affirmative--without dissent, I believe. By making it *
> his* policy, Jimbo makes it seem more personal--especially when he
> directly addresses one candidate.
>
> Anyhow, what do we do if Giano doesn't respond at all?
>
> Frank

*****

From risker.wp at gmail.com Wed Dec 1 00:01:27 2010
From: risker.wp at gmail.com (Risker)
Date: Tue, 30 Nov 2010 19:01:27 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTinxTDnWott0s6+t8CQLe9SpmfpPLyPRd_Z5oceE@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTinwQkavmPR2jPjX7wO+-Ks7k_7E0GAsQ7Aaa8U_@mail.gmail.com>
<AANLkTinZXBvbcceaKS7qjtTvP_XHL-VJKCQS-=TED2NX@mail.gmail.com>
<AANLkTimuF43vr5pvdg57VOx=1Bw_YJUMYnFUiLqSo9+P@mail.gmail.com>
<AANLkTik4cBE=16C0tdZvotOAeN-3faOpoxmfxSdAVtZe@mail.gmail.com>
<AANLkTinxTDnWott0s6+t8CQLe9SpmfpPLyPRd_Z5oceE@mail.gmail.com>
Message-ID: <AANLkTiknHxtoXM8LMOHhgXbmgXQk_e8TB1og3w9y1=cM@mail.gmail.com>

Just to keep folks up to date, I've been in contact with Philippe who in
turn passed me to Christine (the temporary Philippe for non-fundraiser
things) to give a brief overview and to ask that the WMF "facilitate" Andrew
being able to prioritize analysis and resolution of the security issue on
the arbwiki. If for some reason it is outside of Andrew's scope, or there's
another person with better availability or more indepth knowledge of how to
resolve this, I've told Christine we could work with that person too.

I've also given her some background on Usher. Although she was somewhat
concerned that this information could hit the "non-wikipedia-favourable"
sites fairly soon, my suspicion is that if Usher has gathered much
information from the arbwiki, he'll horde it, use it for further digging,
and either try to use it against people or release it at a time when he
feels it will cause most drama, which is probably not right now.

Risker/Anne

*****

From KnightLago at gmail.com Wed Dec 1 00:43:19 2010
From: KnightLago at gmail.com (KnightLago)
Date: Tue, 30 Nov 2010 19:43:19 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
Message-ID: <AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>

Giano,

Thank you for the courtesy. I still think we need to clarify a few points. I
have replied immediately below your replies. As for why we are using this
list, we want to avoid any possible conflict of interest by those running in
the current election.

You sent me an email earlier regarding Jimbo. Honestly, I have no
relationship with Jimbo. I was elected, not appointed. I have never
interacted with him in any meaningful way regarding anything. So let's
please focus on the issues at hand.

On Tue, Nov 30, 2010 at 7:38 AM, Giacomo M-Z <solebaciato at googlemail.com>wrote:

>
>
> On Tue, Nov 30, 2010 at 12:03 AM, KnightLago <KnightLago at gmail.com> wrote:
>
>> Giano,
>>
>> I am replying out of courtesy and for the sake of others' privacy.
>> Following the ongoing efforts to have attacking and insulting comments about
>> me made by Shell kinney and Coren deleted and supressed, I do not feel I
>> owe the arbcom anything.
>
>
>
>> However, if you are concerned that I shall be posting or pasing on private
>> files, that the arbcom were too careless to keep secure, then you can relax.
>> I shall not. The moment I realised the that Fred Bauder, James Forrester and
>> others were able to access the Arb's wiki (contrary to what the Wikipedia
>> community was led to beleive) I notified an Arb. To my knowledge the only
>> people, other than Arbs, who gained access were those whose access had not
>> been denied. To be frank, I still find that it was certain particular arbs
>> who were permitted to retain access, very suspicious; perhaps you would do
>> well to look for your culprits elewhere.
>>
>> 1) How did you learn about the security hole? - Per chance
>>
>
This is really not an answer. Per chance how?


> 2) Did you work with anyone in accessing the wiki? - No
>>
>
With the assistance of a developer we were able to determine that you
attempted to access the wiki in extremely close proximity to banned user
Timothy Usher. The timing is so close that the chances of it being a
coincidence are extremely remote. Did you contact him after learning that
there was a security vulnerability or vice versa? Was he able to access the
wiki? Were you working in concert with Timothy Usher to gain access to the
wiki?


> 2) Whose account did you use to access the wiki? - Did I access an
>> account? Have I said that anywhere?
>>
>
Our understanding is that the only way to access the wiki is with an
account. Are you now saying this is not the case? If so, how did you learn
of the security hole and access the wiki?


> 3) How did you obtain the account to access the wiki? As above
>
> 4) To your knowledge, who else was accessing the wiki before Risker was
>> notified? - No one
>>
>
Again, then how did you learn of the security hole? A former Arbitrator
either provided you an account, or you guessed the password of a former
Arbitrator. Please explain.


> 5) Did you attempt to access any other accounts, and if so, were you able
>> to? - N/A
>>
>
CheckUser has confirmed that you attempted to access Risker's account 4
times, then Neyorkbrad's account, and finally Carcharoth's account and were
unsuccessful. Do you deny this?


> 6) Did you copy, disclose, or distribute any information you viewed on the
>> wiki to anyone? - No
>> 7) Did you tell anyone else how to access the wiki before notifying
>> Risker? - No
>>
>
Again, we are very concerned with the privacy implications here. Was
information from the wiki provided to anyone else, or was anyone else
(Timothy Usher) able to access the wiki?


> 8) If so, who; and to your knowledge did they access the wiki? - N/A
>> 10) Is there any other information you could provide that would help us
>> better understand what occurred here? - No
>>
>
>
>> Fortunatly, because of my discovery, there has *not* been a security leak
>> - the Arbcom can count itself lucky that it was me and not certain others.
>>
>
> Yours sincerely
>
> Giacomo
>
>>
>>
Attempting to access other users' accounts is taken very seriously by the
Wikipedia Community and the Arbitration Committee. We are very concerned
about whether private information was taken from the wiki by Timothy Usher
or anyone else. Your answers to our questions so far have not addressed our
concerns. At this point, with the facts we have, honesty would go a long
way.


>
>>
>>
>>
>
--KnightLago

*****

From risker.wp at gmail.com Wed Dec 1 00:50:22 2010
From: risker.wp at gmail.com (Risker)
Date: Tue, 30 Nov 2010 19:50:22 -0500
Subject: [arbcom-en-b] Fwd: Chat with Giacomo M-Z
In-Reply-To: <AANLkTi=AaXYwR=Oajj06Lx9_sqBct72iCguw6v7UraMT@mail.gmail.com>
References: <9919013.109757.1291163933932.chat@gmail.com>
<AANLkTi=AaXYwR=Oajj06Lx9_sqBct72iCguw6v7UraMT@mail.gmail.com>
Message-ID: <AANLkTimMZKfC5SO9C=4JMphQROmXDP5pwAXFr=PDGpeQ@mail.gmail.com>

Forwarded with permission, and with typos corrected per Giano's request.

---------- Forwarded message ----------
From: Risker <risker.wp at gmail.com>
Date: 30 November 2010 19:45
Subject: Re: Chat with Giacomo M-Z
To: Giacomo M-Z <solebaciato at googlemail.com>


G, can I send a copy of this specific message below to Arbcom?

On 30 November 2010 19:38, Giacomo M-Z <solebaciato at googlemail.com> wrote:

>
> These messages were sent while you were offline.
>
> 19:38 Giacomo: I was drawing attention to the possibility that someone
> would
> sooner or later
> 19:39 because months and months and months ago
> proabouviac sent a link to the portal of the page you have on him
> 19:40 one cannot get in
> but any fool can type in another name
> and see if the tab is black or red
> 19:41 the same with the door to the wiki
> one either has a "wrong password" or "no account"
> it was too simple for words and all on wiki
> I placed it there a week ago
> 19:42 the only people going illicitly in and out have been former arbs
>

*****

From KnightLago at gmail.com Wed Dec 1 00:52:35 2010
From: KnightLago at gmail.com (KnightLago)
Date: Tue, 30 Nov 2010 19:52:35 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
Message-ID: <AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>

<list only>

He appears to be lying about a number of points, or being deliberately
obtuse. Attempting to access another person's account on wiki is taken very
seriously by the community. In my experience it almost always leads to a
block or ban of a long duration. In this case, CU confirms he attempted to
access a number of Arbitrator accounts on the private wiki. I think the
community would take the attempted unauthorized access in this case even
more seriously because of what he was trying to gain access to. His lying,
or deliberate obstruction on the issue rules out the idea that he was just
attempting to find the extent to the security hole. I am also concerned with
his denial of involvement of Timothy Usher. I am hoping that he replies and
his helpful and apologetic. I am not optimistic. The question is where we go
from here. The community at least deserves to know about this, and a more
severe sanction is likely called for.

Thoughts?

KL



On Tue, Nov 30, 2010 at 7:43 PM, KnightLago <KnightLago at gmail.com> wrote:

> Giano,
>
> Thank you for the courtesy. I still think we need to clarify a few points.
> I have replied immediately below your replies. As for why we are using this
> list, we want to avoid any possible conflict of interest by those running in
> the current election.
>
> You sent me an email earlier regarding Jimbo. Honestly, I have no
> relationship with Jimbo. I was elected, not appointed. I have never
> interacted with him in any meaningful way regarding anything. So let's
> please focus on the issues at hand.
>
> On Tue, Nov 30, 2010 at 7:38 AM, Giacomo M-Z <solebaciato at googlemail.com>wrote:
>
>>
>>
>> On Tue, Nov 30, 2010 at 12:03 AM, KnightLago <KnightLago at gmail.com>wrote:
>>
>>> Giano,
>>>
>>> I am replying out of courtesy and for the sake of others' privacy.
>>> Following the ongoing efforts to have attacking and insulting comments about
>>> me made by Shell kinney and Coren deleted and supressed, I do not feel I
>>> owe the arbcom anything.
>>
>>
>>
>>> However, if you are concerned that I shall be posting or pasing
>>> on private files, that the arbcom were too careless to keep secure,
>>> then you can relax. I shall not. The moment I realised the that Fred Bauder,
>>> James Forrester and others were able to access the Arb's wiki (contrary to
>>> what the Wikipedia community was led to beleive) I notified an Arb. To my
>>> knowledge the only people, other than Arbs, who gained access were those
>>> whose access had not been denied. To be frank, I still find that it was
>>> certain particular arbs who were permitted to retain access, very
>>> suspicious; perhaps you would do well to look for your culprits elewhere.
>>>
>>> 1) How did you learn about the security hole? - Per chance
>>>
>>
> This is really not an answer. Per chance how?
>
>
>> 2) Did you work with anyone in accessing the wiki? - No
>>>
>>
> With the assistance of a developer we were able to determine that you
> attempted to access the wiki in extremely close proximity to banned user
> Timothy Usher. The timing is so close that the chances of it being a
> coincidence are extremely remote. Did you contact him after learning that
> there was a security vulnerability or vice versa? Was he able to access the
> wiki? Were you working in concert with Timothy Usher to gain access to the
> wiki?
>
>
>> 2) Whose account did you use to access the wiki? - Did I access an
>>> account? Have I said that anywhere?
>>>
>>
> Our understanding is that the only way to access the wiki is with an
> account. Are you now saying this is not the case? If so, how did you learn
> of the security hole and access the wiki?
>
>
>> 3) How did you obtain the account to access the wiki? As above
>>
>> 4) To your knowledge, who else was accessing the wiki before Risker was
>>> notified? - No one
>>>
>>
> Again, then how did you learn of the security hole? A former Arbitrator
> either provided you an account, or you guessed the password of a former
> Arbitrator. Please explain.
>
>
>> 5) Did you attempt to access any other accounts, and if so, were you able
>>> to? - N/A
>>>
>>
> CheckUser has confirmed that you attempted to access Risker's account 4
> times, then Neyorkbrad's account, and finally Carcharoth's account and were
> unsuccessful. Do you deny this?
>
>
>> 6) Did you copy, disclose, or distribute any information you viewed on the
>>> wiki to anyone? - No
>>> 7) Did you tell anyone else how to access the wiki before notifying
>>> Risker? - No
>>>
>>
> Again, we are very concerned with the privacy implications here. Was
> information from the wiki provided to anyone else, or was anyone else
> (Timothy Usher) able to access the wiki?
>
>
>> 8) If so, who; and to your knowledge did they access the wiki? - N/A
>>> 10) Is there any other information you could provide that would help us
>>> better understand what occurred here? - No
>>>
>>
>>
>>> Fortunatly, because of my discovery, there has *not* been a security
>>> leak - the Arbcom can count itself lucky that it was me and not certain
>>> others.
>>>
>>
>> Yours sincerely
>>
>> Giacomo
>>
>>>
>>>
> Attempting to access other users' accounts is taken very seriously by the
> Wikipedia Community and the Arbitration Committee. We are very concerned
> about whether private information was taken from the wiki by Timothy Usher
> or anyone else. Your answers to our questions so far have not addressed our
> concerns. At this point, with the facts we have, honesty would go a long
> way.
>
>
>>
>>>
>>>
>>>
>>
> --KnightLago
>

*****

From risker.wp at gmail.com Wed Dec 1 00:59:28 2010
From: risker.wp at gmail.com (Risker)
Date: Tue, 30 Nov 2010 19:59:28 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
Message-ID: <AANLkTikoyuhqbvnv-TB9UD0UEgJ8Fn0yMAp3poR_Ytaq@mail.gmail.com>

Ummm....we have absolutely no knowledge of whether or not people try to
access other people's accounts, because that data isn't tracked or
reported. It's only logged at all for admin accounts, and even when logged,
it's only accessible to developers (the rest of us don't see it). We have
no idea how often it happens, which accounts it happens to, whether or not
the individuals are blocked or are considered editors in good standing.

And, um...he essentially admitted trying to access the accounts onwiki on
WT:AC, and three separate arbitrators thanked him for sharing this
information.

Risker/Anne

*****

From carcharothwp at googlemail.com Wed Dec 1 01:07:00 2010
From: carcharothwp at googlemail.com (Carcharoth)
Date: Wed, 1 Dec 2010 01:07:00 +0000
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
Message-ID: <AANLkTikG4NykSevNg0W_MUHUCsNh_AfUkkyt0J_Nz1aA@mail.gmail.com>

My thoughts are that the front page of the arbwiki being public is an
open temptation for people to do this sort of thing. I'm sure people
other than Giano have tried this sort of thing. What I'm still not
clear about is what exactly he "saw" and how much access he had. It
doesn't help that he is obsessing about the former arbs and will
(likely) refuse to accept any explanation provided. Can someone drum
it into him that the ones marked disabled *were* disabled and could
not be accessed, unless that would distract too much from the answers
we are trying to get.

KnightLago, you say below that he is denying the involvement of Usher.
I think you only mentioned Usher in this e-mail and he hasn't yet
replied to your mention of Usher, is that right? If so, I want to wait
and see what he says in reply to your e-mail to him, which I thought
was good and focused on what we need to know.

Carcharoth

*****

From KnightLago at gmail.com Wed Dec 1 01:11:03 2010
From: KnightLago at gmail.com (KnightLago)
Date: Tue, 30 Nov 2010 20:11:03 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTikoyuhqbvnv-TB9UD0UEgJ8Fn0yMAp3poR_Ytaq@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
<AANLkTikoyuhqbvnv-TB9UD0UEgJ8Fn0yMAp3poR_Ytaq@mail.gmail.com>
Message-ID: <AANLkTinTvh1qXXWV1HpH3ZLEaTOSz0zh155g3xnYwKLx@mail.gmail.com>

Risker,

But we do know when people's passwords are guessed because they get an email
that someone is trying to access their account. In this case, we have a
developer giving us the failed logins that resolve to Giano and Timothy
Usher's IPs. That in and of itself speaks volumes.

He admits it, but denies it. He did not admit to attempting to crack the
passwords of Arbitrator accounts. How he gained access has been left murky.
Just that he found a security flaw, and was thanked for pointing it out. It
is quite a different thing for him to have been trying to guess the
passwords in order to gain access. I want to see his reply to my email, but
as I said, I am not optimistic.

KL


*****

From KnightLago at gmail.com Wed Dec 1 01:11:36 2010
From: KnightLago at gmail.com (KnightLago)
Date: Tue, 30 Nov 2010 20:11:36 -0500
Subject: [arbcom-en-b] Fwd: Arbitration Committee Wiki
In-Reply-To: <AANLkTi=agRa6qWBiaYCB28pN5OeRQF7EhuK6M3cTW-v1@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=agRa6qWBiaYCB28pN5OeRQF7EhuK6M3cTW-v1@mail.gmail.com>
Message-ID: <AANLkTimVUV+R7zSJiKp+j1XEaRLGN+FuO7DeTNOa+Ri1@mail.gmail.com>

<list only>

He just sent me this. Nothing else....

KL

---------- Forwarded message ----------
From: Giacomo M-Z <solebaciato at googlemail.com>
Date: Tue, Nov 30, 2010 at 8:00 PM
Subject: Re: Arbitration Committee Wiki
To: KnightLago <KnightLago at gmail.com>


http://en.wikipedia.org/w/index.php?title=...oldid=399034755

*****

From KnightLago at gmail.com Wed Dec 1 01:17:52 2010
From: KnightLago at gmail.com (KnightLago)
Date: Tue, 30 Nov 2010 20:17:52 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTikG4NykSevNg0W_MUHUCsNh_AfUkkyt0J_Nz1aA@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
<AANLkTikG4NykSevNg0W_MUHUCsNh_AfUkkyt0J_Nz1aA@mail.gmail.com>
Message-ID: <AANLkTimhimkgPgXtP911BoQ5Md9YLWp5e0CuO0wYfXrk@mail.gmail.com>

Carcharoth,

I didn't specifically mention Usher, but asked a number of questions that
would lead him to telling us if someone else had access that wasn't supposed
to. He denied everything.

KL

*****

From KnightLago at gmail.com Wed Dec 1 01:21:21 2010
From: KnightLago at gmail.com (KnightLago)
Date: Tue, 30 Nov 2010 20:21:21 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTi=agRa6qWBiaYCB28pN5OeRQF7EhuK6M3cTW-v1@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=agRa6qWBiaYCB28pN5OeRQF7EhuK6M3cTW-v1@mail.gmail.com>
Message-ID: <AANLkTimF3MXtQ=9w+KaR_hKDzXdzhjvO-z6eKzxwnQ5t@mail.gmail.com>

Giano,

I am trying to read between the lines here. Are you saying you guessed a
former Arbitrator's password? Can you please answer my other questions,
especially those dealing with Timothy Usher?

Thanks,

--KnightLago

*****

From risker.wp at gmail.com Wed Dec 1 01:22:37 2010
From: risker.wp at gmail.com (Risker)
Date: Tue, 30 Nov 2010 20:22:37 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTinTvh1qXXWV1HpH3ZLEaTOSz0zh155g3xnYwKLx@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
<AANLkTikoyuhqbvnv-TB9UD0UEgJ8Fn0yMAp3poR_Ytaq@mail.gmail.com>
<AANLkTinTvh1qXXWV1HpH3ZLEaTOSz0zh155g3xnYwKLx@mail.gmail.com>
Message-ID: <AANLkTimJx-MRR4jo-YaKSBiwCW98m80vYEFYJRLxL2d5@mail.gmail.com>

Did you folks not get the forwarded chat log that I sent half an hour ago?
Usher sent Giano the URL of the arbwiki months ago, specifically to his own
page there. We knew almost two years ago that its location was known;
heaven only knows how many attempts have been made to crack into it.

Giano, unfortunately, is just barely computer literate enough to make a
dog's breakfast of things. Even without logging in, it turns out, the search
function works enough to tell whether or not a page is a black link or a red
link - something I just discovered myself. And yes, the "disabled" accounts
still look to an ordinary person as being available if one puts in the exact
username, just as our own "live" accounts do. (We'll have to rename all the
current arb accounts...probably by tacking an additional tidbit on the
usernames.)

The irony is that Giano thinks the ex-arb accounts were the security leak.
In fact, they were secure, and it is actually the "inactive" accounts that
are the security risk.

Risker/Anne

*****

From: Giacomo M-Z <solebaciato at googlemail.com>
Date: Tue, Nov 30, 2010 at 7:38 AM
Subject: Re: Arbitration Committee Wiki
To: KnightLago <KnightLago at gmail.com>




On Tue, Nov 30, 2010 at 12:03 AM, KnightLago <KnightLago at gmail.com> wrote:

> Giano,
>
> I am replying out of courtesy and for the sake of others' privacy.
> Following the ongoing efforts to have attacking and insulting comments about
> me made by Shell kinney and Coren deleted and supressed, I do not feel I
> owe the arbcom anything.



> However, if you are concerned that I shall be posting or pasing on private
> files, that the arbcom were too careless to keep secure, then you can relax.
> I shall not. The moment I realised the that Fred Bauder, James Forrester and
> others were able to access the Arb's wiki (contrary to what the Wikipedia
> community was led to beleive) I notified an Arb. To my knowledge the only
> people, other than Arbs, who gained access were those whose access had not
> been denied. To be frank, I still find that it was certain particular arbs
> who were permitted to retain access, very suspicious; perhaps you would do
> well to look for your culprits elewhere.
>
> 1) How did you learn about the security hole? - Per chance
> 2) Did you work with anyone in accessing the wiki? - No
> 2) Whose account did you use to access the wiki? - Did I access an
> account? Have I said that anywhere?
> 3) How did you obtain the account to access the wiki? As above
> 4) To your knowledge, who else was accessing the wiki before Risker was
> notified? - No one
> 5) Did you attempt to access any other accounts, and if so, were you able
> to? - N/A
> 6) Did you copy, disclose, or distribute any information you viewed on the
> wiki to anyone? - No
> 7) Did you tell anyone else how to access the wiki before notifying Risker?
> - No
> 8) If so, who; and to your knowledge did they access the wiki? - N/A
> 10) Is there any other information you could provide that would help us
> better understand what occurred here? - No
>


> Fortunatly, because of my discovery, there has *not* been a security leak
> - the Arbcom can count itself lucky that it was me and not certain others.
>

Yours sincerely

Giacomo

*****

From carcharothwp at googlemail.com Wed Dec 1 01:23:58 2010
From: carcharothwp at googlemail.com (Carcharoth)
Date: Wed, 1 Dec 2010 01:23:58 +0000
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTimhimkgPgXtP911BoQ5Md9YLWp5e0CuO0wYfXrk@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
<AANLkTikG4NykSevNg0W_MUHUCsNh_AfUkkyt0J_Nz1aA@mail.gmail.com>
<AANLkTimhimkgPgXtP911BoQ5Md9YLWp5e0CuO0wYfXrk@mail.gmail.com>
Message-ID: <AANLkTi=Yueb=SjsfKd1W8n15oLLtv7iBvpub1mf7uEKm@mail.gmail.com>

Well, he would say that if there's another explanation. You've
(rightly) brought Usher into this and asked him to explain it. I'm
waiting for his response before making any judgment. He might (just)
be able to explain why Usher would attempt to login half-an-hour after
he attempted to do so, though I haven't been able to think of anything
plausible so far (other than the fact that Usher might do such
attempts regularly, but Werdna sent us the data for all of November,
IIRC).

Carcharoth

*****

From KnightLago at gmail.com Wed Dec 1 01:26:14 2010
From: KnightLago at gmail.com (KnightLago)
Date: Tue, 30 Nov 2010 20:26:14 -0500
Subject: [arbcom-en-b] Fwd: Arbitration Committee Wiki
In-Reply-To: <AANLkTimA=ajbpEVaBhWDn9j2-GwR7E0ve9wQokLw2yqx@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=agRa6qWBiaYCB28pN5OeRQF7EhuK6M3cTW-v1@mail.gmail.com>
<AANLkTimF3MXtQ=9w+KaR_hKDzXdzhjvO-z6eKzxwnQ5t@mail.gmail.com>
<AANLkTimA=ajbpEVaBhWDn9j2-GwR7E0ve9wQokLw2yqx@mail.gmail.com>
Message-ID: <AANLkTi=ZJFQML82FG96F8g5DNPHaJQkRZkAK=dNOyE3E@mail.gmail.com>

<list only>

That seems to be the end of his cooperation.

KL

---------- Forwarded message ----------
From: Giacomo M-Z <solebaciato at googlemail.com>
Date: Tue, Nov 30, 2010 at 8:22 PM
Subject: Re: Arbitration Committee Wiki
To: KnightLago <KnightLago at gmail.com>


Oh talk to Risker, I am completely disgusted by all this and want nothing
more to do with you. The answer has been publicly on wikipedia for over a
week. go read it.

G

*****

From KnightLago at gmail.com Wed Dec 1 01:30:58 2010
From: KnightLago at gmail.com (KnightLago)
Date: Tue, 30 Nov 2010 20:30:58 -0500
Subject: [arbcom-en-b] Fwd: Arbitration Committee Wiki
In-Reply-To: <AANLkTinOWmpsGShNrcANHEiBwzUMkTq1hqfH8egp-55t@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=agRa6qWBiaYCB28pN5OeRQF7EhuK6M3cTW-v1@mail.gmail.com>
<AANLkTimF3MXtQ=9w+KaR_hKDzXdzhjvO-z6eKzxwnQ5t@mail.gmail.com>
<AANLkTimA=ajbpEVaBhWDn9j2-GwR7E0ve9wQokLw2yqx@mail.gmail.com>
<AANLkTi=ZJFQML82FG96F8g5DNPHaJQkRZkAK=dNOyE3E@mail.gmail.com>
<AANLkTinOWmpsGShNrcANHEiBwzUMkTq1hqfH8egp-55t@mail.gmail.com>
Message-ID: <AANLkTi=xLhtwL5Udzd0pX5ic8qPgFuV_hETVKkK8xo5i@mail.gmail.com>

Risker, did he not describe content, the actual information on the pages to
you? The only way to do that would be with an account, correct? And he has
now essentially refused to answer any questions about his association with
Usher, or why he attempted to log into Arbitrator accounts. The later we
know he did. The former, very likely as the timing is just too coincidental.

KL

******

From carcharothwp at googlemail.com Wed Dec 1 01:36:09 2010
From: carcharothwp at googlemail.com (Carcharoth)
Date: Wed, 1 Dec 2010 01:36:09 +0000
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTimJx-MRR4jo-YaKSBiwCW98m80vYEFYJRLxL2d5@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
<AANLkTikoyuhqbvnv-TB9UD0UEgJ8Fn0yMAp3poR_Ytaq@mail.gmail.com>
<AANLkTinTvh1qXXWV1HpH3ZLEaTOSz0zh155g3xnYwKLx@mail.gmail.com>
<AANLkTimJx-MRR4jo-YaKSBiwCW98m80vYEFYJRLxL2d5@mail.gmail.com>
Message-ID: <AANLkTim3eVyzdRDg-ZSg9aCcrrTmeZkQ6soVz=nxroHp@mail.gmail.com>

On Wed, Dec 1, 2010 at 1:22 AM, Risker <risker.wp at gmail.com> wrote:

> Giano, unfortunately, is just barely computer literate enough to make a
> dog's breakfast of things. Even without logging in, it turns out, the search
> function works enough to tell whether or not a page is a black link or a red
> link - something I just discovered myself.

Well, I can't reproduce this. How do you do this?

> And yes, the "disabled" accounts
> still look to an ordinary person as being available if one puts in the exact
> username, just as our own "live" accounts do.? (We'll have to rename all the
> current arb accounts...probably by tacking an additional tidbit on the
> usernames.)

I'm glad my suggestion to do this wasn't completely forgotten. :-)

If the search function can't be publicly disabled, it might be an idea
to put numbers after all page names that people might try and guess.
I'm going to reply to Happy-melon in the other e-mail and ask him for
advice on how to disable most of the public-facing functions of such a
wiki.

Carcharoth

*****

From risker.wp at gmail.com Wed Dec 1 01:42:15 2010
From: risker.wp at gmail.com (Risker)
Date: Tue, 30 Nov 2010 20:42:15 -0500
Subject: [arbcom-en-b] Fwd: Arbitration Committee Wiki
In-Reply-To: <AANLkTi=xLhtwL5Udzd0pX5ic8qPgFuV_hETVKkK8xo5i@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=agRa6qWBiaYCB28pN5OeRQF7EhuK6M3cTW-v1@mail.gmail.com>
<AANLkTimF3MXtQ=9w+KaR_hKDzXdzhjvO-z6eKzxwnQ5t@mail.gmail.com>
<AANLkTimA=ajbpEVaBhWDn9j2-GwR7E0ve9wQokLw2yqx@mail.gmail.com>
<AANLkTi=ZJFQML82FG96F8g5DNPHaJQkRZkAK=dNOyE3E@mail.gmail.com>
<AANLkTinOWmpsGShNrcANHEiBwzUMkTq1hqfH8egp-55t@mail.gmail.com>
<AANLkTi=xLhtwL5Udzd0pX5ic8qPgFuV_hETVKkK8xo5i@mail.gmail.com>
Message-ID: <AANLkTi=qzMLK0OiRtiyQGsLiAd1hDHaK1m0hUq4XqZf+@mail.gmail.com>

Well, his description of the Geogre page was along the lines of "those
horrible things you said about a brilliant user, accusing him of socking and
lying" and a few other nasty things about the evil arbcom and those who
dragged the case around.(Disclosure, I was also a target for that case; in
fact, it's been suggested to me by several people that getting me de-arbed
was the primary objective there.) The discussion board he described as the
place where we made silly little motions and decisions and talked about
people behind closed doors. To me, having read those pages, they're cynical
but pretty accurate descriptions. But I will grant that the purpose of
those pages would not have been all that hard to guess.

Risker/Anne

**********

From marc at uberbox.org Wed Dec 1 01:50:34 2010
From: marc at uberbox.org (Marc A. Pelletier)
Date: Tue, 30 Nov 2010 20:50:34 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com> <AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com> <AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
Message-ID: <4CF5A9EA.8030900@uberbox.org>

On 30/11/2010 7:52 PM, KnightLago wrote:
> <list only>
>
> He appears to be lying about a number of points, or being deliberately
> obtuse. Attempting to access another person's account on wiki is taken
> very seriously by the community. In my experience it almost always
> leads to a block or ban of a long duration. In this case, CU confirms
> he attempted to access a number of Arbitrator accounts on the private
> wiki. I think the community would take the attempted unauthorized
> access in this case even more seriously because of what he was trying
> to gain access to. His lying, or deliberate obstruction on the issue
> rules out the idea that he was just attempting to find the extent to
> the security hole. I am also concerned with his denial of involvement
> of Timothy Usher. I am hoping that he replies and his helpful and
> apologetic. I am not optimistic. The question is where we go from
> here. The community at least deserves to know about this, and a more
> severe sanction is likely called for.

IMO, the lies seal his doom. He discarded any possibility of claiming
to be a white had the second he did not completely disclose to us.

-- Coren / Marc

*******

From carcharothwp at googlemail.com Wed Dec 1 01:57:12 2010
From: carcharothwp at googlemail.com (Carcharoth)
Date: Wed, 1 Dec 2010 01:57:12 +0000
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <4CF5A9EA.8030900@uberbox.org>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
<4CF5A9EA.8030900@uberbox.org>
Message-ID: <AANLkTi=r+++y0Gg9szS3r5pH9A7Ar2WDL17bhYPcsSJy@mail.gmail.com>

On Wed, Dec 1, 2010 at 1:50 AM, Marc A. Pelletier <marc at uberbox.org> wrote:

> IMO, the lies seal his doom.? He discarded any possibility of claiming to be
> a white had the second he did not completely disclose to us.

Could you (and KL) point out where you feel he is lying in his e-mail.
I've copied it below, so you can annotate it (I've renumbered the 1-10
listing as some of the numbers were wrong):

<START QUOTE>

"However, if you are concerned that I shall be posting or pasing on
private files, that the arbcom were too careless to keep secure, then
you can relax. I shall not. The moment I realised the that Fred
Bauder, James Forrester and others were able to access the Arb's wiki
(contrary to what the Wikipedia community was led to beleive) I
notified an Arb. To my knowledge the only people, other than Arbs, who
gained access were those whose access had not been denied. To be
frank, I still find that it was certain particular arbs who were
permitted to retain access, very suspicious; perhaps you would do well
to look for your culprits elewhere."

1) How did you learn about the security hole? - Per chance
2) Did you work with anyone in accessing the wiki? - No
3) Whose account did you use to access the wiki? - Did I access an
account? Have I said that anywhere?
4) How did you obtain the account to access the wiki? As above
5) To your knowledge, who else was accessing the wiki before Risker
was notified? - No one
6) Did you attempt to access any other accounts, and if so, were you
able to? - N/A
7) Did you copy, disclose, or distribute any information you viewed on
the wiki to anyone? - No
8) Did you tell anyone else how to access the wiki before notifying
Risker? - No
9) If so, who; and to your knowledge did they access the wiki? - N/A
10) Is there any other information you could provide that would help
us better understand what occurred here? - No

"Fortunatly, because of my discovery, there has not been a security
leak - the Arbcom can count itself lucky that it was me and not
certain others."

I see him avoiding straight answers, but where is he directly lying
based on what we know to be true (not what we suspect to be true)?

Carcharoth

*******

From marc at uberbox.org Wed Dec 1 02:06:45 2010
From: marc at uberbox.org (Marc A. Pelletier)
Date: Tue, 30 Nov 2010 21:06:45 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTi=r+++y0Gg9szS3r5pH9A7Ar2WDL17bhYPcsSJy@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com> <AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com> <AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com> <AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com> <4CF5A9EA.8030900@uberbox.org>
<AANLkTi=r+++y0Gg9szS3r5pH9A7Ar2WDL17bhYPcsSJy@mail.gmail.com>
Message-ID: <4CF5ADB5.8090602@uberbox.org>

On 30/11/2010 8:57 PM, Carcharoth wrote:
>
> Could you (and KL) point out where you feel he is lying in his e-mail.
> I've copied it below, so you can annotate it (I've renumbered the 1-10
> listing as some of the numbers were wrong):
>
> <START QUOTE>
>
> "[...] I still find that it was certain particular arbs who were
> permitted to retain access, very suspicious; perhaps you would do well
> to look for your culprits elewhere."

That's just his paranoia speaking; he probably believes that.

> 1) How did you learn about the security hole? - Per chance

That's a transparent lie, though that's a tough one to call him on. He
obviously either was told, or was poking around on his own. There is no
such thing random knowledge.

> 2) Did you work with anyone in accessing the wiki? - No
> 3) Whose account did you use to access the wiki? - Did I access an
> account? Have I said that anywhere?
> 4) How did you obtain the account to access the wiki? As above

He described the contents of two pages on-wiki. Either he lies about
that, or he lies about having accessed an account. Also note how he
doesn't actually *answer* the question either way!

> 5) To your knowledge, who else was accessing the wiki before Risker
> was notified? - No one

Related to 8 and 9

> 6) Did you attempt to access any other accounts, and if so, were you
> able to? - N/A

Checkuser demonstrates he attempted to login on, what, four accounts?

> 7) Did you copy, disclose, or distribute any information you viewed on
> the wiki to anyone? - No

Plausible, can't say either way.

> 8) Did you tell anyone else how to access the wiki before notifying
> Risker? - No
> 9) If so, who; and to your knowledge did they access the wiki? - N/A

This is related to the link with Usher. I still am unable to believe
that the timing is a coincidence; he either learned about the possible
hole around the same time (and from the same source) Usher did (making
(1) a lie) or was in communication with him.

> 10) Is there any other information you could provide that would help
> us better understand what occurred here? - No

That's simple obstructionism. Par for the course.

-- Coren / Marc

******

Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTi=r+++y0Gg9szS3r5pH9A7Ar2WDL17bhYPcsSJy@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
<4CF5A9EA.8030900@uberbox.org>
<AANLkTi=r+++y0Gg9szS3r5pH9A7Ar2WDL17bhYPcsSJy@mail.gmail.com>
Message-ID: <AANLkTi=8vmH+BVqMqBEppkDmhxjgW6fG71WRcofmMhq4@mail.gmail.com>

On Tue, Nov 30, 2010 at 8:57 PM, Carcharoth <carcharothwp at googlemail.com>wrote:

> On Wed, Dec 1, 2010 at 1:50 AM, Marc A. Pelletier <marc at uberbox.org>
> wrote:
>
> > IMO, the lies seal his doom. He discarded any possibility of claiming to
> be
> > a white had the second he did not completely disclose to us.
>
> Could you (and KL) point out where you feel he is lying in his e-mail.
> I've copied it below, so you can annotate it (I've renumbered the 1-10
> listing as some of the numbers were wrong):
>
> <START QUOTE>
>
> "However, if you are concerned that I shall be posting or pasing on
> private files, that the arbcom were too careless to keep secure, then
> you can relax. I shall not. The moment I realised the that Fred
> Bauder, James Forrester and others were able to access the Arb's wiki
> (contrary to what the Wikipedia community was led to beleive) I
> notified an Arb. To my knowledge the only people, other than Arbs, who
> gained access were those whose access had not been denied. To be
> frank, I still find that it was certain particular arbs who were
> permitted to retain access, very suspicious; perhaps you would do well
> to look for your culprits elewhere."
>
> 1) How did you learn about the security hole? - Per chance
>

Deliberate obfuscation or lie. He didn't magically land on the arb wiki page
one day and find himself with access.


> 2) Did you work with anyone in accessing the wiki? - No
>

The Usher angle is too much of a coincidence to be pure chance. Usher either
told him, or he told Usher. And they both attempted to gain access. His
refusal to answer any questions about this doesn't help.


> 3) Whose account did you use to access the wiki? - Did I access an
> account? Have I said that anywhere?
>

The only way I know of to view any content is with an account. My reading of
Giano's comments and Risker's conversation with him was that he viewed
content.


> 4) How did you obtain the account to access the wiki? As above
>

Obfuscation.


> 5) To your knowledge, who else was accessing the wiki before Risker
> was notified? - No one
>

Usher, perhaps? He has said that former Arbitrators were, but I am not so
sure now.


> 6) Did you attempt to access any other accounts, and if so, were you
> able to? - N/A
>

Outright lie, or deliberate obfuscation. CU confirms he attempted to access
Risker's account 4 times, and a couple other accounts. This is the strongest
point because we have the CU data showing he did.


> 7) Did you copy, disclose, or distribute any information you viewed on
> the wiki to anyone? - No
> 8) Did you tell anyone else how to access the wiki before notifying
> Risker? - No
>

As soon as Usher was mentioned he stopped talking.


> 9) If so, who; and to your knowledge did they access the wiki? - N/A
> 10) Is there any other information you could provide that would help
> us better understand what occurred here? - No
>
> "Fortunatly, because of my discovery, there has not been a security
> leak - the Arbcom can count itself lucky that it was me and not
> certain others."
>
> I see him avoiding straight answers, but where is he directly lying
> based on what we know to be true (not what we suspect to be true)?
>
> Carcharoth

*****

From carcharothwp at googlemail.com Wed Dec 1 02:29:29 2010
From: carcharothwp at googlemail.com (Carcharoth)
Date: Wed, 1 Dec 2010 02:29:29 +0000
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTi=8vmH+BVqMqBEppkDmhxjgW6fG71WRcofmMhq4@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
<4CF5A9EA.8030900@uberbox.org>
<AANLkTi=r+++y0Gg9szS3r5pH9A7Ar2WDL17bhYPcsSJy@mail.gmail.com>
<AANLkTi=8vmH+BVqMqBEppkDmhxjgW6fG71WRcofmMhq4@mail.gmail.com>
Message-ID: <AANLkTinAhMErdFeQ+-7s939Q0DRbYPhX9gCM1Ua7QTUp@mail.gmail.com>

On Wed, Dec 1, 2010 at 2:07 AM, KnightLago <KnightLago at gmail.com> wrote:

>> 6) Did you attempt to access any other accounts, and if so, were you
>> able to? - ?N/A
>
> Outright lie, or deliberate obfuscation. CU confirms he attempted to access
> Risker's account 4 times, and a couple other accounts. This is the strongest
> point because we have the CU data showing he did.

He has said on-wiki that he was typing in names (this is the diff he sent you):

http://en.wikipedia.org/w/index.php?title=...oldid=399034755

He says he typed in Kirill's name, but may have been referring to
something earlier.

He may genuinely believe that typing in random names and possible user
names and random passwords is just playing around. Given that he would
be unlikely to guess someone's password, I don't think he was
genuinely trying to get in. But then I find it mystifying. Do people
really type in "password" in the hope that they will get in?

Carcharoth

*****

From KnightLago at gmail.com Wed Dec 1 02:55:50 2010
From: KnightLago at gmail.com (KnightLago)
Date: Tue, 30 Nov 2010 21:55:50 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTinAhMErdFeQ+-7s939Q0DRbYPhX9gCM1Ua7QTUp@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
<4CF5A9EA.8030900@uberbox.org>
<AANLkTi=r+++y0Gg9szS3r5pH9A7Ar2WDL17bhYPcsSJy@mail.gmail.com>
<AANLkTi=8vmH+BVqMqBEppkDmhxjgW6fG71WRcofmMhq4@mail.gmail.com>
<AANLkTinAhMErdFeQ+-7s939Q0DRbYPhX9gCM1Ua7QTUp@mail.gmail.com>
Message-ID: <AANLkTim2EkkhSaSsJhgChwaUrxnku4-_CE2yPp+cecoj@mail.gmail.com>

So where are we at with this? I think at the very least we should make the
community aware of Giano's actions as we decided to do with FT2.

I also think a further sanction is called for. Giano attempted to crack 3
accounts that we know of (likely more) in order to access the arb-wiki. This
is a fact, confirmed by CU. I strongly suspect he was working in concert
with Usher in doing so. The log entries make the chance of a coincidence too
remote to doubt.

Thoughts?

KL

*******

From risker.wp at gmail.com Wed Dec 1 03:16:42 2010
From: risker.wp at gmail.com (Risker)
Date: Tue, 30 Nov 2010 22:16:42 -0500
Subject: [arbcom-en-b] Arbitration Committee Wiki
In-Reply-To: <AANLkTim2EkkhSaSsJhgChwaUrxnku4-_CE2yPp+cecoj@mail.gmail.com>
References: <AANLkTikGCf7Ap=w=HdVN14-46Y13VMV77SC4cuZm4--k@mail.gmail.com>
<AANLkTik-Gh9v7YQCeXtaNn+LLmWUNCSmce8fL-Er-JpL@mail.gmail.com>
<AANLkTimUng1HbDnpT76LW3hVGCFhVRYAR4BrU3=XePE5@mail.gmail.com>
<AANLkTi=M8_TxSy_HWfqdU-Q78J1_cTyxSEBm8mX3SHdK@mail.gmail.com>
<4CF5A9EA.8030900@uberbox.org>
<AANLkTi=r+++y0Gg9szS3r5pH9A7Ar2WDL17bhYPcsSJy@mail.gmail.com>
<AANLkTi=8vmH+BVqMqBEppkDmhxjgW6fG71WRcofmMhq4@mail.gmail.com>
<AANLkTinAhMErdFeQ+-7s939Q0DRbYPhX9gCM1Ua7QTUp@mail.gmail.com>
<AANLkTim2EkkhSaSsJhgChwaUrxnku4-_CE2yPp+cecoj@mail.gmail.com>
Message-ID: <AANLkTinCm72hBBacBY2obf7LR2LzFS-j8qtwrjS3J5MM@mail.gmail.com>

I actually doubt very very much that he was working with Usher, and that we
do have a rather spectacular coincidence of the two of them showing up
within a brief period. That's based on the fact that he has actively warned
people about Usher, that he's defused situations where Usher was planning to
cause serious real life psychological harm to users, a

This helps to explain why they don't like Giano anymore......
he certainly made fools of them.

And in other news: as expected (and against policy? not sure), non-Arbcom friends of
Jimbo have free access to the Arbcom wiki. You and I, on the other hand, are not
permitted to see it.

As I recall, the "tl;dr" version of this is "no." This was discussed on-wiki. Giano never had access to the wiki, he exploited a security loophole that allowed him to see that certain users still had accounts. The Arbitration Committee was under the impression that these accounts had been disabled, but it turned out that they were wrong. Or something along those lines.

Is this intentionally truncated?

If the Arbcom wiki has identifying information about the targeted users then it could violate WMF policy although the range of people allowed to see sensitive information is so ludicrously broad that it's a long shot.

Oh, for fuck's sake, aren't they a bunch of the most stupid and short sighted idiots that ever congealed...?

The answer that can fairly be easily read is that he was provided with the address of the private wiki (likely Proab, but not important) and went and typed in account names of current and ex-arbs in the space provided (oh, and whose brainwave is it that the publicly viewable username and the one for the private wiki should be the same?) and then tried a password and noted that some ex-arbs returned a "wrong password" message; which made it appear as if they still had access. Nothing more (although Giano got upset at the conclusion he arrived at).

To make things reflect even more poorly upon themselves, they decide that should Giano's responses not be in the manner of their preference - unequivocal and comprehensive - that they are going to act as if he managed to gain access, and never mind the fact that ArbCom and Giano are the founder and only members of a Mutual Nonadmiration Society of almost mythical proportion. Dumb fucks.

The most amazing thing about all of this is that when I have had individual interactions with arbs they mostly have appeared to be smart and caring individuals - but as a group... I used the phrase "congeal" to describe the committee, but I think I got it wrong; it should be "convoy" - who famously proceed at the speed of the slowest, most decrepit, and least able member of the group.

I wonder who that is?

Set up a poll on the subject, and who ever comes top will no doubt be a worthy winner.

Sorry to be the killjoy on this sensational leak, but I think you will find the whole story was posted almost verbatim (as above) on Wikipedia itself ages ago, most of it by me. I have to say the Arb's' secret comments on me were interesting, but hardly shocking. So Kirill and Coren don't like me - well that's a real revelation - I am deeply hurt as I respect them so much. As stories go, this one is rather yesterday's news.

Seriously though, I am sure (not that have seen ithem) the arbcom files do contain information on some vulnerable people which is best not published here. Most of us are big enough, ugly enough and fighters enough to take care of ourselves, but there are a few who are not. I hope Malice Aforethought is aware of that and will draw a line on what information is disclosed. Embarassing pompous people is one thing, doing the vulnerable real harm is quite another.


Giacomo

He appears to have a soul, don't worry.

Oh please, quote the version with my corrected spelling. I don't want people thnking I am illiterate.

Giacomo

Well, Giano seems like the only person on arbcom who is not a complete fool!

Oh! He's not on arbcom? That's what's wrong with the whole darn thing. Giano absolutely completely needs to be an arb to straighten the place out!

Is Risker really as dumb as she sounds?

Ask Horse that question.

Put it this way...I e-mailed Risker's photo to Ripley's Believe It or Not. And Ripley e-mailed me back: "I don't believe it!"

I'm afraid so. Risker has consistently struck me as the arb most resembling a box of hammers. Although I must admit that Rlevse is also in the running for that award.

You will not be at all surprised to know that I have some knowledge in respect of this particular incident - but the issue I am commenting on is that the ArbCom were given reasonably clear responses which, along with their technical paper trail, should have quite clearly indicated that there was no breech; but since their confirmation bias is so infused with the notion that "GianoReturned" and predecessor accounts are the enemy of Wikipedia authority that they could not see the obvious when it was provided to them. That is what exasperates me, especially as individually they seem quite reasonable people. ArbCom seems to instill an "us and them" mentality, certainly in regard to a few individuals.

So-- not the sharpest tools in the shed. Each of them is one instrument shy of ...um... a full box of blunt instruments?

I was amused to see the Rlevse's real name is not R. Levse. But Hivemind had him correctly. http://www.wikipedia-watch.org/hivemind.html#344

Coren, Kyrill and their sidekick Knight Lago saw only what they wanted to see and it certainly was not the truth. That they are now proven to be such people is no surprise to me. The whole time they were salivating over the chance to get me "his lies have doomed him" or whatever pompous crap it was that Coren came out with the answers were already posted on Wikipedia, I do wonder though how many less fortunate people have been sent packing on their misguided say so. Whatever, it's not impressive. The biggest hoot is Coren still trying to maintain I am paranoid, it's a wonder I am not suicidal.

Giacomo