diff --git a/research-group-presi/images/active-hidden-filters-actions.png b/research-group-presi/images/active-hidden-filters-actions.png
new file mode 100644
index 0000000000000000000000000000000000000000..d17bb6efa7389d25f4fd0ca1df015444de2ed474
Binary files /dev/null and b/research-group-presi/images/active-hidden-filters-actions.png differ
diff --git a/research-group-presi/images/active-public-filters-actions.png b/research-group-presi/images/active-public-filters-actions.png
new file mode 100644
index 0000000000000000000000000000000000000000..5d453a051d4bbeaaba02b3f534c19a7bca9a0c17
Binary files /dev/null and b/research-group-presi/images/active-public-filters-actions.png differ
diff --git a/research-group-presi/images/all-filters-actions.png b/research-group-presi/images/all-filters-actions.png
new file mode 100644
index 0000000000000000000000000000000000000000..f4eae8c9b34d5d34b2d6a922721bc340bab0748f
Binary files /dev/null and b/research-group-presi/images/all-filters-actions.png differ
diff --git a/research-group-presi/images/funnel-diagramm-no-filters.JPG b/research-group-presi/images/funnel-diagramm-no-filters.JPG
new file mode 100644
index 0000000000000000000000000000000000000000..a9d2df55864e118caf95fd5eb9ccb1c80d6cd48b
Binary files /dev/null and b/research-group-presi/images/funnel-diagramm-no-filters.JPG differ
diff --git a/research-group-presi/images/funnel-diagramm-with-filters.JPG b/research-group-presi/images/funnel-diagramm-with-filters.JPG
new file mode 100644
index 0000000000000000000000000000000000000000..7225b843d69b737df15f4e3945c6d4ca81f58837
Binary files /dev/null and b/research-group-presi/images/funnel-diagramm-with-filters.JPG differ
diff --git a/research-group-presi/images/general_stats.png b/research-group-presi/images/general_stats.png
new file mode 100644
index 0000000000000000000000000000000000000000..ba7778824386443c3842a8f2c8ecf6d17b57f0a9
Binary files /dev/null and b/research-group-presi/images/general_stats.png differ
diff --git a/research-group-presi/images/number-filter-hits.png b/research-group-presi/images/number-filter-hits.png
new file mode 100644
index 0000000000000000000000000000000000000000..d96ec1701ad58d48a6aebbdc1ae8e0e378e50d5e
Binary files /dev/null and b/research-group-presi/images/number-filter-hits.png differ
diff --git a/research-group-presi/slides.html b/research-group-presi/slides.html
index b06ad3e9225b210b239965a1372efc2d5c70fcb7..7131d27ec507f120641d520ef5eadbd09d8dcfe4 100644
--- a/research-group-presi/slides.html
+++ b/research-group-presi/slides.html
@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="generator" content="pandoc">
   <meta name="author" content="HCC Research Group Meeting May 2019">
-  <title>You shall not publish this: Edit filters on EN Wikipedia</title>
+  <title>You shall not publish: Edit filters on EN Wikipedia</title>
   <meta name="apple-mobile-web-app-capable" content="yes">
   <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
   <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, minimal-ui">
@@ -28,7 +28,7 @@
     <div class="slides">
 
 <section>
-  <h1 class="title">You shall not publish this: Edit filters on EN Wikipedia</h1>
+  <h1 class="title">You shall not publish: Edit filters on EN Wikipedia</h1>
   <p class="author">HCC Research Group Meeting May 2019</p>
   <p class="date">Lusy</p>
 </section>
@@ -36,11 +36,11 @@
 <section class="slide level1">
 
 <h2 id="edit-filter-an-example">Edit filter, an example</h2>
-<p><img src="images/Screenshot-trigger-disallow.png" height="500" alt="screenshot-filter-disallow-message"></p>
+<p><img src="images/Screenshot-trigger-disallow.png" class="stretch" height="500" alt="screenshot-filter-disallow-message"></p>
 </section>
 <section id="motivation" class="slide level1">
 <h1>Motivation</h1>
-<p>What are edit filters? Why are there edit filters? What task(s) do they take care of? How are they different from other existing mechanisms?</p>
+<p>What are edit filters? Why are there edit filters? What task(s) do they take care of? How are they different from other existing mechanisms? What is their role in Wikipedia's complex socio-technical system?</p>
 </section>
 <section class="slide level1">
 
@@ -49,10 +49,6 @@
 </blockquote>
 <p><small><a href="https://en.wikipedia.org/wiki/Wikipedia:Edit_filter" class="uri">https://en.wikipedia.org/wiki/Wikipedia:Edit_filter</a></small></p>
 </section>
-<section id="structure" class="slide level1">
-<h1>Structure</h1>
-<p>(of the presi? or of the thesis?)</p>
-</section>
 <section id="vandalism-on-wikipedia" class="slide level1">
 <h1>Vandalism on Wikipedia</h1>
 </section>
@@ -66,15 +62,15 @@
 </section>
 <section class="slide level1">
 
-<h2 id="examples">Examples</h2>
-<p><img src="images/example-vandalism-veganism-1.png" height="300" width="400" alt="example-vandalism-veganism-1"> <img src="images/example-vandalism-veganism-2.png" height="300" width="400" alt="example-vandalims-veganism-2"></p>
+<h2 id="example">Example</h2>
+<p><img src="images/example-vandalism-veganism-1.png" class="stretch" height="500" alt="example-vandalism-veganism-1"></p>
 </section>
 <section id="fighting-vandalism-on-wikipedia" class="slide level1">
 <h1>Fighting vandalism on Wikipedia</h1>
 </section>
 <section class="slide level1">
 
-<p>Literature review:</p>
+<h2 id="literature-review">Literature review</h2>
 <p>bots, semi-automated tools, ores, humans</p>
 </section>
 <section class="slide level1">
@@ -90,16 +86,21 @@
 
 <h2 id="bots">Bots</h2>
 <ul>
+<li class="fragment">ClueBot NG, XLinkBot, HBC AIV Helperbots, MartinBot, AntiVandalBot, AWB, DumbBOT, EmausBot</li>
+<li class="fragment">revert edits detected as vandalism</li>
 <li class="fragment">1st line of defence</li>
-<li class="fragment">fastest revert time</li>
-<li class="fragment">ClueBot NG, ...</li>
+<li class="fragment">on average: fastest revert time</li>
+<li class="fragment">batch scripts</li>
+<li class="fragment">critical infrastructure run by volunteer bot developers: when the levee breaks</li>
 </ul>
 </section>
 <section class="slide level1">
 
 <h2 id="semi-automated-tools">Semi-automated tools</h2>
 <ul>
-<li class="fragment">Huggle, Twinkle, STiki, ..</li>
+<li class="fragment">Huggle, Twinkle, STiki, VandalProof, ARV, AIV, Lupin's Anti-vandal tool</li>
+<li class="fragment">users need <em>rollback</em> permission</li>
+<li class="fragment">gamification concerns</li>
 </ul>
 </section>
 <section class="slide level1">
@@ -119,16 +120,13 @@
 </section>
 <section class="slide level1">
 
-<p>Summary: funnel diagram (without filters) One thing is ostentatiously missing: edit filters</p>
-</section>
-<section class="slide level1">
-
-<p>(# Methods)</p>
+<p><img src="images/funnel-diagramm-no-filters.JPG" alt="Funnel diagramm of all vandal fighting mechanisms (no filters)"></p>
+<p>One thing is ostentatiously missing: edit filters</p>
 </section>
 <section id="data" class="slide level1">
 <h1>Data</h1>
 <ul>
-<li class="fragment">wikipedia's pages (policies, guidelines, etc.), most prominently: ...</li>
+<li class="fragment">wikipedia's pages (policies, guidelines, etc.)</li>
 <li class="fragment">abuse filter extention tables</li>
 </ul>
 </section>
@@ -143,21 +141,35 @@
 
 <h2 id="mediawiki-extension">MediaWiki Extension</h2>
 <ul>
-<li class="fragment">permissions</li>
+<li class="fragment">permissions: <em>abusefilter-modify</em>, <em>abusefilter-view</em>, etc.</li>
 <li class="fragment">tables: <em>abuse_filter</em>, <em>abuse_filter_log</em>, <em>abuse_filter_action</em> and <em>abuse_filter_history</em></li>
 <li class="fragment">actions filters trigger: logging, warning, throttling, disallowing, revoking auto-promoted groups, blocking, removing from privileged groups, range-blocking, tagging</li>
-<li class="fragment">smth else?</li>
 </ul>
 </section>
 <section class="slide level1">
 
 <h2 id="introducing-a-new-filter">Introducing a new filter</h2>
+</section>
+<section class="slide level1">
+
 <p>For everybody:</p>
 <ul>
-<li class="fragment">checklist: is an edit filter the suitable solution
-</li>
+<li class="fragment">filters, after adding up, make editing slower</li>
 <li class="fragment">request at: <a href="https://en.wikipedia.org/wiki/Wikipedia:Edit_filter/Requested" class="uri">https://en.wikipedia.org/wiki/Wikipedia:Edit_filter/Requested</a></li>
 </ul>
+</section>
+<section class="slide level1">
+
+<p>checklist: is an edit filter the suitable solution</p>
+<ul>
+<li class="fragment">problematic changes of a single page</li>
+<li class="fragment">in depth checks should be done by a separate software that users run on their own machines (!!!)</li>
+<li class="fragment">no trivial errors</li>
+<li class="fragment">Titles Blacklist and Link/Spam Blacklist</li>
+</ul>
+</section>
+<section class="slide level1">
+
 <p>For edit filter managers:</p>
 <ul>
 <li class="fragment">read the docs</li>
@@ -179,11 +191,22 @@
 <section class="slide level1">
 
 <h2 id="how-are-problems-handled">How are problems handled</h2>
+<ul>
+<li class="fragment">Edit Filter Noticeboard</li>
+<li class="fragment"><a href="https://en.wikipedia.org/wiki/Wikipedia:Edit_filter/False_positives" class="uri">https://en.wikipedia.org/wiki/Wikipedia:Edit_filter/False_positives</a></li>
+<li class="fragment">Personal security best practices for edit filter managers</li>
+</ul>
+</section>
+<section class="slide level1">
+
 <p>Edit Filter Noticeboard:</p>
 <ul>
 <li class="fragment">current filters behaviour: e.g. changing filter action or updating pattern</li>
 <li class="fragment">users rights discussions</li>
 </ul>
+</section>
+<section class="slide level1">
+
 <p><a href="https://en.wikipedia.org/wiki/Wikipedia:Edit_filter/False_positives" class="uri">https://en.wikipedia.org/wiki/Wikipedia:Edit_filter/False_positives</a>:</p>
 <ul>
 <li class="fragment">monitored by edit filter managers</li>
@@ -191,7 +214,6 @@
 <li class="fragment">help good faith users</li>
 <li class="fragment">discourage malicious edits</li>
 </ul>
-<p>Personal security best practices for edit filter managers</p>
 </section>
 <section class="slide level1">
 
@@ -205,7 +227,12 @@
 <section class="slide level1">
 
 <h2 id="motivations-for-introducing-the-abuse-filter-extention">Motivations for introducing the abuse filter extention</h2>
-<p>Quote from EditFilter discussion archive</p>
+<p>From <a href="https://en.wikipedia.org/wiki/Wikipedia_talk:Edit_filter/Archive_1" class="uri">https://en.wikipedia.org/wiki/Wikipedia_talk:Edit_filter/Archive_1</a>:</p>
+<ul>
+<li class="fragment">disallow certain types of obvious pervasive (perhaps automated) vandalism directly</li>
+<li class="fragment">takes more than a single click to revert</li>
+<li class="fragment">human editors can use their time more productively elsewhere</li>
+</ul>
 </section>
 <section class="slide level1">
 
@@ -213,12 +240,23 @@
 </section>
 <section class="slide level1">
 
+<blockquote>
+<p>&quot;Could the name of this log be changed, please? I just noticed the other day that I have entries in an &quot;abuse&quot; log for linking to YouTube and for creating articles about Michael Jackson, which triggered a suspicion of vandalism. A few other people are voicing the same concern at AN/I, and someone suggested posting the request here. SlimVirgin talk|contribs 18:11, 2 July 2009 (UTC) &quot;</p>
+</blockquote>
+</section>
+<section class="slide level1">
+
+<blockquote>
+<p>&quot; I would support a name change on all public-facing parts of this extension to &quot;Edit filter&quot;. Even after we tell people that &quot;Entries in this list do not necessarily mean the edits were abusive.&quot;, they still worry about poisoning of their well. –xenotalk 18:14, 2 July 2009 (UTC)&quot;</p>
+</blockquote>
+</section>
+<section class="slide level1">
+
 <h2 id="collaboration-bots-filters">Collaboration bots-filters</h2>
-<p>&quot;There is a bot reporting users tripping certain filters at WP:AIV and WP:UAA; you can specify the filters here.&quot; </p>
 <ul>
-<li class="fragment">consider collaborations filters/bots (e.g. MrZ Bot which puts editors found on the abuse log often on the AIV noticeboard.) are there further exampled for this kind of collaborations?</li>
+<li class="fragment">MrZ Bot puts editors found on the abuse log often on the AIV noticeboard</li>
+<li class="fragment">&quot;There is a bot reporting users tripping certain filters at WP:AIV and WP:UAA; you can specify the filters here:&quot; <a href="https://en.wikipedia.org/wiki/User:DatBot/filters" class="uri">https://en.wikipedia.org/wiki/User:DatBot/filters</a></li>
 </ul>
-<p> </p>
 </section>
 <section class="slide level1">
 
@@ -242,7 +280,7 @@ Jun 2010 : STiki initial release
 </section>
 <section class="slide level1">
 
-<p>funnel diagram with filters</p>
+<p><img src="images/funnel-diagramm-with-filters.JPG" alt="Funnel diagramm of all vandal fighting mechanisms (with filters)"></p>
 </section>
 <section class="slide level1">
 
@@ -251,39 +289,130 @@ Jun 2010 : STiki initial release
 </section>
 <section class="slide level1">
 
-<p>+--------------------+---------------------+------+-----+---------+----------------+ | Field | Type | Null | Key | Default | Extra | +--------------------+---------------------+------+-----+---------+----------------+ | af_id | bigint(20) unsigned | NO | PRI | NULL | auto_increment | | af_pattern | blob | NO | | NULL | | | af_user | bigint(20) unsigned | NO | MUL | NULL | | | af_user_text | varbinary(255) | NO | | NULL | | | af_timestamp | binary(14) | NO | | NULL | | | af_enabled | tinyint(1) | NO | | 1 | | | af_comments | blob | YES | | NULL | | | af_public_comments | tinyblob | YES | | NULL | | | af_hidden | tinyint(1) | NO | | 0 | | | af_hit_count | bigint(20) | NO | | 0 | | | af_throttled | tinyint(1) | NO | | 0 | | | af_deleted | tinyint(1) | NO | | 0 | | | af_actions | varbinary(255) | NO | | | | | af_global | tinyint(1) | NO | | 0 | | | af_group | varbinary(64) | NO | MUL | default | | +--------------------+---------------------+------+-----+---------+----------------+ \end{verbatim} ~ \end{figure*}</p>
+<p>abuse_filter</p>
+<pre><code>+--------------------+---------------------+------+-----+---------+----------------+
+| Field              | Type                | Null | Key | Default | Extra          |
++--------------------+---------------------+------+-----+---------+----------------+
+| af_id              | bigint(20) unsigned | NO   | PRI | NULL    | auto_increment |
+| af_pattern         | blob                | NO   |     | NULL    |                |
+| af_user            | bigint(20) unsigned | NO   | MUL | NULL    |                |
+| af_user_text       | varbinary(255)      | NO   |     | NULL    |                |
+| af_timestamp       | binary(14)          | NO   |     | NULL    |                |
+| af_enabled         | tinyint(1)          | NO   |     | 1       |                |
+| af_comments        | blob                | YES  |     | NULL    |                |
+| af_public_comments | tinyblob            | YES  |     | NULL    |                |
+| af_hidden          | tinyint(1)          | NO   |     | 0       |                |
+| af_hit_count       | bigint(20)          | NO   |     | 0       |                |
+| af_throttled       | tinyint(1)          | NO   |     | 0       |                |
+| af_deleted         | tinyint(1)          | NO   |     | 0       |                |
+| af_actions         | varbinary(255)      | NO   |     |         |                |
+| af_global          | tinyint(1)          | NO   |     | 0       |                |
+| af_group           | varbinary(64)       | NO   | MUL | default |                |
++--------------------+---------------------+------+-----+---------+----------------+</code></pre>
+</section>
+<section class="slide level1">
+
+<p>abuse_filter_log</p>
+<pre><code>+------------------+---------------------+------+-----+---------+----------------+
+| Field            | Type                | Null | Key | Default | Extra          |
++------------------+---------------------+------+-----+---------+----------------+
+| afl_id           | bigint(20) unsigned | NO   | PRI | NULL    | auto_increment |
+| afl_filter       | varbinary(64)       | NO   | MUL | NULL    |                |
+| afl_user         | bigint(20) unsigned | NO   | MUL | NULL    |                |
+| afl_user_text    | varbinary(255)      | NO   |     | NULL    |                |
+| afl_ip           | varbinary(255)      | NO   | MUL | NULL    |                |
+| afl_action       | varbinary(255)      | NO   |     | NULL    |                |
+| afl_actions      | varbinary(255)      | NO   |     | NULL    |                |
+| afl_var_dump     | blob                | NO   |     | NULL    |                |
+| afl_timestamp    | binary(14)          | NO   | MUL | NULL    |                |
+| afl_namespace    | tinyint(4)          | NO   | MUL | NULL    |                |
+| afl_title        | varbinary(255)      | NO   |     | NULL    |                |
+| afl_wiki         | varbinary(64)       | YES  | MUL | NULL    |                |
+| afl_deleted      | tinyint(1)          | NO   |     | 0       |                |
+| afl_patrolled_by | int(10) unsigned    | YES  |     | NULL    |                |
+| afl_rev_id       | int(10) unsigned    | YES  | MUL | NULL    |                |
+| afl_log_id       | int(10) unsigned    | YES  | MUL | NULL    |                |
++------------------+---------------------+------+-----+---------+----------------+</code></pre>
+</section>
+<section class="slide level1">
+
+<p>abuse_filter_history</p>
+<pre><code>+---------------------+---------------------+------+-----+---------+----------------+
+| Field               | Type                | Null | Key | Default | Extra          |
++---------------------+---------------------+------+-----+---------+----------------+
+| afh_id              | bigint(20) unsigned | NO   | PRI | NULL    | auto_increment |
+| afh_filter          | bigint(20) unsigned | NO   | MUL | NULL    |                |
+| afh_user            | bigint(20) unsigned | NO   | MUL | NULL    |                |
+| afh_user_text       | varbinary(255)      | NO   | MUL | NULL    |                |
+| afh_timestamp       | binary(14)          | NO   | MUL | NULL    |                |
+| afh_pattern         | blob                | NO   |     | NULL    |                |
+| afh_comments        | blob                | NO   |     | NULL    |                |
+| afh_flags           | tinyblob            | NO   |     | NULL    |                |
+| afh_public_comments | tinyblob            | YES  |     | NULL    |                |
+| afh_actions         | blob                | YES  |     | NULL    |                |
+| afh_deleted         | tinyint(1)          | NO   |     | 0       |                |
+| afh_changed_fields  | varbinary(255)      | NO   |     |         |                |
+| afh_group           | varbinary(64)       | YES  |     | NULL    |                |
++---------------------+---------------------+------+-----+---------+----------------+</code></pre>
+</section>
+<section class="slide level1">
+
+<p>abuse_filter_action</p>
+<pre><code>+-----------------+---------------------+------+-----+---------+-------+
+| Field           | Type                | Null | Key | Default | Extra |
++-----------------+---------------------+------+-----+---------+-------+
+| afa_filter      | bigint(20) unsigned | NO   | PRI | NULL    |       |
+| afa_consequence | varbinary(255)      | NO   | PRI | NULL    |       |
+| afa_parameters  | tinyblob            | NO   |     | NULL    |       |
++-----------------+---------------------+------+-----+---------+-------+</code></pre>
 </section>
 <section class="slide level1">
 
-
+<h2 id="what-do-most-active-filters-do">What do most active filters do?</h2>
+<pre><code>135  repeating characters &amp; tag, warn
+30   &quot;large deletion from article by new editors&quot; &amp; tag, warn
+61   &quot;new user removing references&quot; (&quot;new user&quot; is handled by &quot;!(&quot;confirmed&quot; in user\_groups)&quot;) &amp; tag
+18   &quot;test type edits from clicking on edit bar&quot; (people don&#39;t replace Example texts when click-editing) &amp; deleted in Feb 2012
+3    &quot;new user blanking articles&quot; &amp; tag, warn
+172  &quot;section blanking&quot; &amp; tag
+50   &quot;shouting&quot; (contribution consists of all caps, numbers and punctuation) &amp; tag, warn
+98   &quot;creating very short new article&quot; &amp; tag
+65   &quot;excessive whitespace&quot; (note: &quot;associated with ascii art and some types of vandalism&quot;) &amp; deleted in Jan 2010
+132  &quot;removal of all categories&quot; &amp; tag, warn</code></pre>
 </section>
 <section class="slide level1">
 
-
+<h2 id="descriptive-statistics">Descriptive statistics</h2>
+<p><img src="images/general_stats.png" class="left" alt="General filter statistics"></p>
+<pre><code>all filters: 954
+public filters: 361
+Active public filters: 110
+disabled (but not deleted) public filters: 35
+deleted public filters: 216
+hidden filters: 593
+active hidden filters: 91
+disabled (but not deleted) hidden filters: 118
+deleted hidden filters: 384</code></pre>
 </section>
 <section class="slide level1">
 
-\begin{figure*}
-
+<p>Number of filter hits per month March 2009-March 2019</p>
+<p><img src="images/general_stats.png" alt="Number of filter hits per month"></p>
 </section>
 <section class="slide level1">
 
-<h2 id="what-do-most-active-filters-do">What do most active filters do?</h2>
-
+<p>Filters Actions</p>
+<p><img src="images/all-filters-actions.png" alt="Filters Actions of all Filters"></p>
 </section>
 <section class="slide level1">
 
-<h2 id="descriptive-statistics">Descriptive statistics</h2>
-<p>see jupyter notebook for diagrams</p>
+<p>Active Public Filters Actions</p>
+<p><img src="images/active-public-filters-actions.png" alt="Filters actions of active public filters"></p>
 </section>
 <section class="slide level1">
 
-<h2 id="public-and-hidden-filters">Public and hidden filters</h2>
-<ul>
-<li class="fragment">2/3 of filters are hidden</li>
-<li class="fragment">all admins can view hidden filters</li>
-<li class="fragment">mailinglist for discussing private filters</li>
-</ul>
+<p>Active Hidden Filters Actions</p>
+<p><img src="images/active-hidden-filters-actions.png" alt="Filters actions of active hidden filters"></p>
 </section>
 <section class="slide level1">
 
@@ -293,6 +422,22 @@ Jun 2010 : STiki initial release
 <section class="slide level1">
 
 <p>diagram with sublables</p>
+<p>('vandalism', 263), ('vandalism?', 162), ('spam?', 41), ('spam', 17), ('vandalbot', 5), ('vandalbot?', 2), ('page_move_vandalism', 5), ('page_move_vandalism?', 3), ('silly_vandalism', 5), ('silly_vandalism?', 2), ('trolling?', 7), ('hoaxing?', 4), ('hoaxing', 2), ('copyright', 3), ('copyright?', 2), ('image_vandalism', 3), ('talk_page_vandalism', 3), ('template_vandalism?', 1), ('template_vandalism', 1), ('template_spam', 2), ('link_vandalism?', 1), ('abuse_of_tags_vandalism?', 1), ('avoidant_vandalism', 1), ('avoidant_vandalism?', 1), ('username_vandalism?', 1),</p>
+<p>('prank', 1)</p>
+<p>('phishing?', 1), ('malware?', 1), ('malware', 1),</p>
+<p>('guideline_vio?', 1),</p>
+<p>('religious_vandalism?', 3), ('politically_motivated?', 8), ('politically_motivated', 2),</p>
+<p>('sockpuppetry', 59), ('sockpuppetry?', 35), ('long_term_abuse', 35), ('long_term_abuse?', 9), ('abuse', 1), ('abuse?', 21), ('harassment?', 31), ('harassment', 24), ('doxxing?', 2), ('personal_attacks', 6), ('personal_attacks?', 4), ('impersonation', 1), ('not_polite', 1),</p>
+<p>('biased_pov', 17), ('biased_pov?', 15),</p>
+<p>('conflict_of_interest', 3), ('stockbrocker_vandalism', 3), ('self_promotion?', 2), ('conflict_of_interest?', 1), ('self_promotion', 1),</p>
+<p>('seo', 8), ('seo?', 4),</p>
+<p>('bad_style', 13), ('bad_style?', 12), ('edit_warring?', 3),</p>
+<p>('good_faith?', 63), ('good_faith', 48),</p>
+<p>('lazyness', 4),</p>
+<p>('maintenance', 7), ('maintenance?', 5), ('maintenance? ', 1),</p>
+<p>('bug', 5), ('bug?', 10), ('wiki_policy?', 9),</p>
+<p>('test', 43), ('test?', 4),</p>
+<p>('unknown', 71), ('misc', 59), ('misc?', 8), ('unclear', 14),</p>
 </section>
 <section class="slide level1">
 
@@ -301,7 +446,7 @@ Jun 2010 : STiki initial release
 <section id="next-steps-for-finishing-the-thesis" class="slide level1">
 <h1>Next steps for finishing the thesis</h1>
 <ul>
-<li class="fragment">abuse_filter_history table (ping Aaron)</li>
+<li class="fragment">abuse_filter_history table (open MR, ping Aaron)</li>
 </ul>
 </section>
 <section id="beyond-the-thesis" class="slide level1">
@@ -311,6 +456,11 @@ Jun 2010 : STiki initial release
 <li class="fragment">Are there filters targetting harassment?</li>
 <li class="fragment">Ethnographic analysis (e.g. IVs with edit filter managers/admins/users whose edits have been disallowed would be really interesting)</li>
 <li class="fragment">(how) has the notion of &quot;vandalism&quot; on Wikipedia evolved over time (when looking at the regex patterns)</li>
+</ul>
+</section>
+<section class="slide level1">
+
+<ul>
 <li class="fragment">Precision/Recall: False Positives? were filters shut down, bc they matched more False positives than they had real value?</li>
 <li class="fragment">Do filters work the desired way/help for a smoother Wikipedia service or is it a lot of work to maintain them and the usefulness is questionable?</li>
 <li class="fragment">What can we filter with a REGEX? And what not? Are regexes the suitable technology for the means the community is trying to achieve?</li>
@@ -323,8 +473,9 @@ Jun 2010 : STiki initial release
 <li class="fragment">manual filter classification only conducted by me</li>
 </ul>
 </section>
-<section id="bigger-picture-upload-filters" class="slide level1">
-<h1>Bigger picture: Upload filters</h1>
+<section class="slide level1">
+
+<h2 id="bigger-picture-upload-filters">Bigger picture: Upload filters</h2>
 <p><img src="images/Blackout_of_wikipediade_by_Wikimedia_Deutschland_-_March_2019.png" height="500" alt="blackout German Wikipedia March 2019"> <small><a href="https://upload.wikimedia.org/wikipedia/commons/c/c5/Blackout_of_wikipedia.de_by_Wikimedia_Deutschland_-_March_2019.png" class="uri">https://upload.wikimedia.org/wikipedia/commons/c/c5/Blackout_of_wikipedia.de_by_Wikimedia_Deutschland_-_March_2019.png</a></small></p>
 </section>
 <section id="thank-you" class="slide level1">
diff --git a/research-group-presi/slides.md b/research-group-presi/slides.md
index 3652116a2811933d5e896dda454a9805c80408c9..5cfc364fbb42832384ec302f74fb09541fe950bd 100644
--- a/research-group-presi/slides.md
+++ b/research-group-presi/slides.md
@@ -1,4 +1,4 @@
-% You shall not publish this: Edit filters on EN Wikipedia
+% You shall not publish: Edit filters on EN Wikipedia
 % HCC Research Group Meeting May 2019
 % Lusy
 
@@ -6,7 +6,7 @@
 
 ## Edit filter, an example
 
-<img src="images/Screenshot-trigger-disallow.png" height="500" alt="screenshot-filter-disallow-message">
+<img src="images/Screenshot-trigger-disallow.png" class="stretch" height="500" alt="screenshot-filter-disallow-message">
 
 ---
 
@@ -16,6 +16,7 @@ What are edit filters?
 Why are there edit filters?
 What task(s) do they take care of?
 How are they different from other existing mechanisms?
+What is their role in Wikipedia's complex socio-technical system?
 
 ---
 
@@ -25,12 +26,6 @@ How are they different from other existing mechanisms?
 
 ---
 
-# Structure
-
-(of the presi? or of the thesis?)
-
----
-
 # Vandalism on Wikipedia
 
 ---
@@ -43,10 +38,9 @@ Def:
 
 ---
 
-## Examples
+## Example
 
-<img src="images/example-vandalism-veganism-1.png" height="300" width="400" alt="example-vandalism-veganism-1">
-<img src="images/example-vandalism-veganism-2.png" height="300" width="400" alt="example-vandalims-veganism-2">
+<img src="images/example-vandalism-veganism-1.png" class="stretch" height="500" alt="example-vandalism-veganism-1">
 
 ---
 
@@ -54,7 +48,7 @@ Def:
 
 ---
 
-Literature review:
+## Literature review
 
 bots, semi-automated tools, ores, humans
 
@@ -70,15 +64,20 @@ bots, semi-automated tools, ores, humans
 
 ## Bots
 
+* ClueBot NG, XLinkBot, HBC AIV Helperbots, MartinBot, AntiVandalBot, AWB, DumbBOT, EmausBot
+* revert edits detected as vandalism
 * 1st line of defence
-* fastest revert time
-* ClueBot NG, ...
+* on average: fastest revert time
+* batch scripts
+* critical infrastructure run by volunteer bot developers: when the levee breaks
 
 ---
 
 ## Semi-automated tools
 
-* Huggle, Twinkle, STiki, ..
+* Huggle, Twinkle, STiki, VandalProof, ARV, AIV, Lupin's Anti-vandal tool
+* users need *rollback* permission
+* gamification concerns
 
 ---
 
@@ -95,19 +94,15 @@ bots, semi-automated tools, ores, humans
 
 ---
 
-Summary:
-funnel diagram (without filters)
-One thing is ostentatiously missing: edit filters
-
----
+<img src="images/funnel-diagramm-no-filters.JPG" alt="Funnel diagramm of all vandal fighting mechanisms (no filters)">
 
-(# Methods)
+One thing is ostentatiously missing: edit filters
 
 ---
 
 # Data
 
-* wikipedia's pages (policies, guidelines, etc.), most prominently: ...
+* wikipedia's pages (policies, guidelines, etc.)
 * abuse filter extention tables
 
 ---
@@ -122,27 +117,32 @@ One thing is ostentatiously missing: edit filters
 
 ## MediaWiki Extension
 
-* permissions
+* permissions: *abusefilter-modify*, *abusefilter-view*, etc.
 * tables: *abuse_filter*, *abuse_filter_log*, *abuse_filter_action* and *abuse_filter_history*
 * actions filters trigger: logging, warning, throttling, disallowing, revoking auto-promoted groups, blocking, removing from privileged groups, range-blocking, tagging
-* smth else?
 
 ---
 
 ## Introducing a new filter
 
+---
+
 For everybody:
 
-* checklist: is an edit filter the suitable solution
-\begin{itemize}
-    \item "Filters are applied to all edits. Therefore, problematic changes that apply to a single page are likely not suitable for an edit filter."
-    \item filters, after adding up, make editing slower
-    \item in depth checks should be done by a separate software that users run on their own machines
-    \item no trivial errors should be catched by filters (ala style guidelines)
-    \item there are Titles Blacklist and Link/Spam Blacklist which should be used if the issue at hand has to do with a problematic title or link.
-\end{itemize}
+* filters, after adding up, make editing slower
 * request at: [https://en.wikipedia.org/wiki/Wikipedia:Edit_filter/Requested](https://en.wikipedia.org/wiki/Wikipedia:Edit_filter/Requested)
 
+---
+
+checklist: is an edit filter the suitable solution
+
+* problematic changes of a single page
+* in depth checks should be done by a separate software that users run on their own machines (!!!)
+* no trivial errors
+* Titles Blacklist and Link/Spam Blacklist
+
+---
+
 For edit filter managers:
 
 * read the docs
@@ -163,11 +163,19 @@ For edit filter managers:
 
 ## How are problems handled
 
+* Edit Filter Noticeboard
+* [https://en.wikipedia.org/wiki/Wikipedia:Edit_filter/False_positives](https://en.wikipedia.org/wiki/Wikipedia:Edit_filter/False_positives)
+* Personal security best practices for edit filter managers
+
+---
+
 Edit Filter Noticeboard:
 
 * current filters behaviour: e.g. changing filter action or updating pattern
 * users rights discussions
 
+---
+
 [https://en.wikipedia.org/wiki/Wikipedia:Edit_filter/False_positives](https://en.wikipedia.org/wiki/Wikipedia:Edit_filter/False_positives):
 
 * monitored by edit filter managers
@@ -175,8 +183,6 @@ Edit Filter Noticeboard:
 * help good faith users
 * discourage malicious edits
 
-Personal security best practices for edit filter managers
-
 ---
 
 ## Tripping a filter: Traces
@@ -191,7 +197,11 @@ Personal security best practices for edit filter managers
 
 ## Motivations for introducing the abuse filter extention
 
-Quote from EditFilter discussion archive
+From [https://en.wikipedia.org/wiki/Wikipedia_talk:Edit_filter/Archive_1](https://en.wikipedia.org/wiki/Wikipedia_talk:Edit_filter/Archive_1):
+
+* disallow certain types of obvious pervasive (perhaps automated) vandalism directly
+* takes more than a single click to revert
+* human editors can use their time more productively elsewhere
 
 ---
 
@@ -200,15 +210,18 @@ abuse filter -> edit filter
 
 ---
 
-## Collaboration bots-filters
+> "Could the name of this log be changed, please? I just noticed the other day that I have entries in an "abuse" log for linking to YouTube and for creating articles about Michael Jackson, which triggered a suspicion of vandalism. A few other people are voicing the same concern at AN/I, and someone suggested posting the request here. SlimVirgin talk|contribs 18:11, 2 July 2009 (UTC) "
 
-"There is a bot reporting users tripping certain filters at WP:AIV and WP:UAA; you can specify the filters here."
-\url{https://en.wikipedia.org/wiki/User:DatBot/filters}
+---
 
-* consider collaborations filters/bots (e.g. MrZ Bot which puts editors found on the abuse log often on the AIV noticeboard.) are there further exampled for this kind of collaborations?
+> "    I would support a name change on all public-facing parts of this extension to "Edit filter". Even after we tell people that "Entries in this list do not necessarily mean the edits were abusive.", they still worry about poisoning of their well. –xenotalk 18:14, 2 July 2009 (UTC)"
 
-\url{https://en.wikipedia.org/wiki/Wikipedia:Administrator_intervention_against_vandalism}
-\url{https://en.wikipedia.org/wiki/Wikipedia:Bots/Requests_for_approval/Mr.Z-bot_7}
+---
+
+## Collaboration bots-filters
+
+* MrZ Bot puts editors found on the abuse log often on the AIV noticeboard
+* "There is a bot reporting users tripping certain filters at WP:AIV and WP:UAA; you can specify the filters here:" [https://en.wikipedia.org/wiki/User:DatBot/filters](https://en.wikipedia.org/wiki/User:DatBot/filters)
 
 ---
 
@@ -233,7 +246,7 @@ abuse filter -> edit filter
 
 ---
 
-funnel diagram with filters
+<img src="images/funnel-diagramm-with-filters.JPG" alt="Funnel diagramm of all vandal fighting mechanisms (with filters)">
 
 ---
 
@@ -243,151 +256,141 @@ Data analysis of the abuse filter extension tables
 
 ---
 
-+--------------------+---------------------+------+-----+---------+----------------+
-| Field              | Type                | Null | Key | Default | Extra          |
-+--------------------+---------------------+------+-----+---------+----------------+
-| af_id              | bigint(20) unsigned | NO   | PRI | NULL    | auto_increment |
-| af_pattern         | blob                | NO   |     | NULL    |                |
-| af_user            | bigint(20) unsigned | NO   | MUL | NULL    |                |
-| af_user_text       | varbinary(255)      | NO   |     | NULL    |                |
-| af_timestamp       | binary(14)          | NO   |     | NULL    |                |
-| af_enabled         | tinyint(1)          | NO   |     | 1       |                |
-| af_comments        | blob                | YES  |     | NULL    |                |
-| af_public_comments | tinyblob            | YES  |     | NULL    |                |
-| af_hidden          | tinyint(1)          | NO   |     | 0       |                |
-| af_hit_count       | bigint(20)          | NO   |     | 0       |                |
-| af_throttled       | tinyint(1)          | NO   |     | 0       |                |
-| af_deleted         | tinyint(1)          | NO   |     | 0       |                |
-| af_actions         | varbinary(255)      | NO   |     |         |                |
-| af_global          | tinyint(1)          | NO   |     | 0       |                |
-| af_group           | varbinary(64)       | NO   | MUL | default |                |
-+--------------------+---------------------+------+-----+---------+----------------+
-\end{verbatim}
-  \caption{abuse\_filter schema}~\label{fig:db-schemas-af}
-\end{figure*}
-
----
-
-\begin{figure*}
-\begin{verbatim}
+abuse_filter
+
+    +--------------------+---------------------+------+-----+---------+----------------+
+    | Field              | Type                | Null | Key | Default | Extra          |
+    +--------------------+---------------------+------+-----+---------+----------------+
+    | af_id              | bigint(20) unsigned | NO   | PRI | NULL    | auto_increment |
+    | af_pattern         | blob                | NO   |     | NULL    |                |
+    | af_user            | bigint(20) unsigned | NO   | MUL | NULL    |                |
+    | af_user_text       | varbinary(255)      | NO   |     | NULL    |                |
+    | af_timestamp       | binary(14)          | NO   |     | NULL    |                |
+    | af_enabled         | tinyint(1)          | NO   |     | 1       |                |
+    | af_comments        | blob                | YES  |     | NULL    |                |
+    | af_public_comments | tinyblob            | YES  |     | NULL    |                |
+    | af_hidden          | tinyint(1)          | NO   |     | 0       |                |
+    | af_hit_count       | bigint(20)          | NO   |     | 0       |                |
+    | af_throttled       | tinyint(1)          | NO   |     | 0       |                |
+    | af_deleted         | tinyint(1)          | NO   |     | 0       |                |
+    | af_actions         | varbinary(255)      | NO   |     |         |                |
+    | af_global          | tinyint(1)          | NO   |     | 0       |                |
+    | af_group           | varbinary(64)       | NO   | MUL | default |                |
+    +--------------------+---------------------+------+-----+---------+----------------+
+
+---
+
 abuse_filter_log
-+------------------+---------------------+------+-----+---------+----------------+
-| Field            | Type                | Null | Key | Default | Extra          |
-+------------------+---------------------+------+-----+---------+----------------+
-| afl_id           | bigint(20) unsigned | NO   | PRI | NULL    | auto_increment |
-| afl_filter       | varbinary(64)       | NO   | MUL | NULL    |                |
-| afl_user         | bigint(20) unsigned | NO   | MUL | NULL    |                |
-| afl_user_text    | varbinary(255)      | NO   |     | NULL    |                |
-| afl_ip           | varbinary(255)      | NO   | MUL | NULL    |                |
-| afl_action       | varbinary(255)      | NO   |     | NULL    |                |
-| afl_actions      | varbinary(255)      | NO   |     | NULL    |                |
-| afl_var_dump     | blob                | NO   |     | NULL    |                |
-| afl_timestamp    | binary(14)          | NO   | MUL | NULL    |                |
-| afl_namespace    | tinyint(4)          | NO   | MUL | NULL    |                |
-| afl_title        | varbinary(255)      | NO   |     | NULL    |                |
-| afl_wiki         | varbinary(64)       | YES  | MUL | NULL    |                |
-| afl_deleted      | tinyint(1)          | NO   |     | 0       |                |
-| afl_patrolled_by | int(10) unsigned    | YES  |     | NULL    |                |
-| afl_rev_id       | int(10) unsigned    | YES  | MUL | NULL    |                |
-| afl_log_id       | int(10) unsigned    | YES  | MUL | NULL    |                |
-+------------------+---------------------+------+-----+---------+----------------+
-\end{verbatim}
-  \caption{abuse\_filter\_log schema}~\label{fig:db-schemas-afl}
-\end{figure*}
-
----
-
-\begin{figure*}
-\begin{verbatim}
+
+    +------------------+---------------------+------+-----+---------+----------------+
+    | Field            | Type                | Null | Key | Default | Extra          |
+    +------------------+---------------------+------+-----+---------+----------------+
+    | afl_id           | bigint(20) unsigned | NO   | PRI | NULL    | auto_increment |
+    | afl_filter       | varbinary(64)       | NO   | MUL | NULL    |                |
+    | afl_user         | bigint(20) unsigned | NO   | MUL | NULL    |                |
+    | afl_user_text    | varbinary(255)      | NO   |     | NULL    |                |
+    | afl_ip           | varbinary(255)      | NO   | MUL | NULL    |                |
+    | afl_action       | varbinary(255)      | NO   |     | NULL    |                |
+    | afl_actions      | varbinary(255)      | NO   |     | NULL    |                |
+    | afl_var_dump     | blob                | NO   |     | NULL    |                |
+    | afl_timestamp    | binary(14)          | NO   | MUL | NULL    |                |
+    | afl_namespace    | tinyint(4)          | NO   | MUL | NULL    |                |
+    | afl_title        | varbinary(255)      | NO   |     | NULL    |                |
+    | afl_wiki         | varbinary(64)       | YES  | MUL | NULL    |                |
+    | afl_deleted      | tinyint(1)          | NO   |     | 0       |                |
+    | afl_patrolled_by | int(10) unsigned    | YES  |     | NULL    |                |
+    | afl_rev_id       | int(10) unsigned    | YES  | MUL | NULL    |                |
+    | afl_log_id       | int(10) unsigned    | YES  | MUL | NULL    |                |
+    +------------------+---------------------+------+-----+---------+----------------+
+
+---
+
 abuse_filter_history
-+---------------------+---------------------+------+-----+---------+----------------+
-| Field               | Type                | Null | Key | Default | Extra          |
-+---------------------+---------------------+------+-----+---------+----------------+
-| afh_id              | bigint(20) unsigned | NO   | PRI | NULL    | auto_increment |
-| afh_filter          | bigint(20) unsigned | NO   | MUL | NULL    |                |
-| afh_user            | bigint(20) unsigned | NO   | MUL | NULL    |                |
-| afh_user_text       | varbinary(255)      | NO   | MUL | NULL    |                |
-| afh_timestamp       | binary(14)          | NO   | MUL | NULL    |                |
-| afh_pattern         | blob                | NO   |     | NULL    |                |
-| afh_comments        | blob                | NO   |     | NULL    |                |
-| afh_flags           | tinyblob            | NO   |     | NULL    |                |
-| afh_public_comments | tinyblob            | YES  |     | NULL    |                |
-| afh_actions         | blob                | YES  |     | NULL    |                |
-| afh_deleted         | tinyint(1)          | NO   |     | 0       |                |
-| afh_changed_fields  | varbinary(255)      | NO   |     |         |                |
-| afh_group           | varbinary(64)       | YES  |     | NULL    |                |
-+---------------------+---------------------+------+-----+---------+----------------+
-\end{verbatim}
-  \caption{abuse\_filter\_history schema}~\label{fig:db-schemas-afh}
-\end{figure*}
-
----
-
-\begin{figure*}
-\begin{verbatim}
+
+    +---------------------+---------------------+------+-----+---------+----------------+
+    | Field               | Type                | Null | Key | Default | Extra          |
+    +---------------------+---------------------+------+-----+---------+----------------+
+    | afh_id              | bigint(20) unsigned | NO   | PRI | NULL    | auto_increment |
+    | afh_filter          | bigint(20) unsigned | NO   | MUL | NULL    |                |
+    | afh_user            | bigint(20) unsigned | NO   | MUL | NULL    |                |
+    | afh_user_text       | varbinary(255)      | NO   | MUL | NULL    |                |
+    | afh_timestamp       | binary(14)          | NO   | MUL | NULL    |                |
+    | afh_pattern         | blob                | NO   |     | NULL    |                |
+    | afh_comments        | blob                | NO   |     | NULL    |                |
+    | afh_flags           | tinyblob            | NO   |     | NULL    |                |
+    | afh_public_comments | tinyblob            | YES  |     | NULL    |                |
+    | afh_actions         | blob                | YES  |     | NULL    |                |
+    | afh_deleted         | tinyint(1)          | NO   |     | 0       |                |
+    | afh_changed_fields  | varbinary(255)      | NO   |     |         |                |
+    | afh_group           | varbinary(64)       | YES  |     | NULL    |                |
+    +---------------------+---------------------+------+-----+---------+----------------+
+
+---
+
 abuse_filter_action
-+-----------------+---------------------+------+-----+---------+-------+
-| Field           | Type                | Null | Key | Default | Extra |
-+-----------------+---------------------+------+-----+---------+-------+
-| afa_filter      | bigint(20) unsigned | NO   | PRI | NULL    |       |
-| afa_consequence | varbinary(255)      | NO   | PRI | NULL    |       |
-| afa_parameters  | tinyblob            | NO   |     | NULL    |       |
-+-----------------+---------------------+------+-----+---------+-------+
-\end{verbatim}
+
+    +-----------------+---------------------+------+-----+---------+-------+
+    | Field           | Type                | Null | Key | Default | Extra |
+    +-----------------+---------------------+------+-----+---------+-------+
+    | afa_filter      | bigint(20) unsigned | NO   | PRI | NULL    |       |
+    | afa_consequence | varbinary(255)      | NO   | PRI | NULL    |       |
+    | afa_parameters  | tinyblob            | NO   |     | NULL    |       |
+    +-----------------+---------------------+------+-----+---------+-------+
 
 ---
 
 ## What do most active filters do?
 
-\begin{table*}
-  \centering
-    \begin{tabular}{r p{10cm} p{5cm} }
-    % \toprule
-    Filter ID & Publicly available description & Actions \\
-    \hline
-      135 & repeating characters & tag, warn \\
-      30 & "large deletion from article by new editors" & tag, warn \\
-      61 & "new user removing references" ("new user" is handled by "!("confirmed" in user\_groups)") & tag \\
-      18 & "test type edits from clicking on edit bar" (people don't replace Example texts when click-editing) & deleted in Feb 2012 \\
-      3 & "new user blanking articles" & tag, warn \\
-      172 & "section blanking" & tag \\
-      50 & "shouting" (contribution consists of all caps, numbers and punctuation) & tag, warn \\
-      98 & "creating very short new article" & tag \\
-      65 & "excessive whitespace" (note: "associated with ascii art and some types of vandalism") & deleted in Jan 2010 \\
-      132 & "removal of all categories" & tag, warn \\
-      225 & "vandalism in all caps" (difference to 50? seems to be swear words, but shouldn't they be catched by 50 anyway?) & disallow \\
-      189 & "BLP vandalism or libel" & tag \\
-      402 & "new article without references" & deleted in Apr 2013, before that disabled with comment "disabling, no real use" \\
-      384 & "addition of bad words or other vandalism" (seems to be a blacklist) & disallow \\
-      432 & "starting new line with lower case letters" & tag, warn //I recall there was a rule of thumb recommending not to user filters for style things? although that's not really style, but rather wrong grammar.. \\
-      380 & hidden; public comment "multiple obscenities" & disallow \\
-      351 & "text added after categories and interwiki" & tag, warn \\
-      279 & "repeated attempts to vandalise" & tag, throttle (triggered when someone hits "edit" repeatedly in a short ammount of time) \\
-      491 & "edits ending with emoticons or !" & tag, warn \\
-      636 & "unexplained removal of sourced content" & warn (that, together with 634 and 635 refutes my theory that warn always goes together with tag) \\
-      231 & "long string of characters containing no spaces" (that's surely english though^^) & tag, warn \\
-      650 & "creation of a new article without any categories" & (log only) \\
-      527 & hidden; public comments "T34234: log/throttle possible sleeper account creations" & throttle \\
-      633 & "possible canned edit summary" (apparently pre-filled on mobile though) & tag \\
-      686 & "IP adding possible unreferenced material to BLP" (BLP= biography of living people? I thought, it was forbidden to edit them without a registered account) & (log only) \\
-      712 & "possibly changing date of birth in infobox" ("possibly"? and I thought infoboxes were pre-generated from wikidata?) & (log only) \\
-      833 & "newer user possibly adding a unreferenced or improperly referenced material" & (log only) \\
-  \end{tabular}
-\end{table*}
+    135  repeating characters & tag, warn
+    30   "large deletion from article by new editors" & tag, warn
+    61   "new user removing references" ("new user" is handled by "!("confirmed" in user\_groups)") & tag
+    18   "test type edits from clicking on edit bar" (people don't replace Example texts when click-editing) & deleted in Feb 2012
+    3    "new user blanking articles" & tag, warn
+    172  "section blanking" & tag
+    50   "shouting" (contribution consists of all caps, numbers and punctuation) & tag, warn
+    98   "creating very short new article" & tag
+    65   "excessive whitespace" (note: "associated with ascii art and some types of vandalism") & deleted in Jan 2010
+    132  "removal of all categories" & tag, warn
 
 ---
 
 ## Descriptive statistics
 
-see jupyter notebook for diagrams
+<img src="images/general_stats.png" class="left" alt="General filter statistics">
+
+    all filters: 954
+    public filters: 361
+    Active public filters: 110
+    disabled (but not deleted) public filters: 35
+    deleted public filters: 216
+    hidden filters: 593
+    active hidden filters: 91
+    disabled (but not deleted) hidden filters: 118
+    deleted hidden filters: 384
+
+---
+
+Number of filter hits per month March 2009-March 2019
+
+<img src="images/general_stats.png" alt="Number of filter hits per month">
+
+---
+
+Filters Actions
+
+<img src="images/all-filters-actions.png" alt="Filters Actions of all Filters">
 
 ---
 
-## Public and hidden filters
+Active Public Filters Actions
 
-* 2/3 of filters are hidden
-* all admins can view hidden filters
-* mailinglist for discussing private filters
+<img src="images/active-public-filters-actions.png" alt="Filters actions of active public filters">
+
+---
+
+Active Hidden Filters Actions
+
+<img src="images/active-hidden-filters-actions.png" alt="Filters actions of active hidden filters">
 
 ---
 
@@ -399,6 +402,95 @@ see jupyter notebook for diagrams
 
 diagram with sublables
 
+('vandalism', 263),
+('vandalism?', 162),
+  ('spam?', 41),
+  ('spam', 17),
+  ('vandalbot', 5),
+  ('vandalbot?', 2),
+  ('page_move_vandalism', 5),
+  ('page_move_vandalism?', 3),
+  ('silly_vandalism', 5),
+  ('silly_vandalism?', 2),
+  ('trolling?', 7),
+  ('hoaxing?', 4),
+  ('hoaxing', 2),
+  ('copyright', 3),
+  ('copyright?', 2),
+  ('image_vandalism', 3),
+  ('talk_page_vandalism', 3),
+  ('template_vandalism?', 1),
+  ('template_vandalism', 1),
+  ('template_spam', 2),
+  ('link_vandalism?', 1),
+  ('abuse_of_tags_vandalism?', 1),
+  ('avoidant_vandalism', 1),
+  ('avoidant_vandalism?', 1),
+  ('username_vandalism?', 1),
+
+('prank', 1)
+
+('phishing?', 1),
+('malware?', 1),
+('malware', 1),
+
+('guideline_vio?', 1),
+
+('religious_vandalism?', 3),
+('politically_motivated?', 8),
+('politically_motivated', 2),
+
+('sockpuppetry', 59),
+('sockpuppetry?', 35),
+('long_term_abuse', 35),
+('long_term_abuse?', 9),
+('abuse', 1),
+('abuse?', 21),
+('harassment?', 31),
+('harassment', 24),
+('doxxing?', 2),
+('personal_attacks', 6),
+('personal_attacks?', 4),
+('impersonation', 1),
+('not_polite', 1),
+
+('biased_pov', 17),
+('biased_pov?', 15),
+
+('conflict_of_interest', 3),
+('stockbrocker_vandalism', 3),
+('self_promotion?', 2),
+('conflict_of_interest?', 1),
+('self_promotion', 1),
+
+('seo', 8),
+('seo?', 4),
+
+('bad_style', 13),
+('bad_style?', 12),
+('edit_warring?', 3),
+
+('good_faith?', 63),
+('good_faith', 48),
+
+('lazyness', 4),
+
+('maintenance', 7),
+('maintenance?', 5),
+('maintenance? ', 1),
+
+('bug', 5),
+('bug?', 10),
+('wiki_policy?', 9),
+
+('test', 43),
+('test?', 4),
+
+('unknown', 71),
+('misc', 59),
+('misc?', 8),
+('unclear', 14),
+
 ---
 
 check memos
@@ -407,8 +499,7 @@ check memos
 
 # Next steps for finishing the thesis
 
-* abuse_filter_history table (ping Aaron)
-
+* abuse_filter_history table (open MR, ping Aaron)
 
 ---
 
@@ -418,6 +509,9 @@ check memos
 * Are there filters targetting harassment?
 * Ethnographic analysis (e.g. IVs with edit filter managers/admins/users whose edits have been disallowed would be really interesting)
 * (how) has the notion of "vandalism" on Wikipedia evolved over time (when looking at the regex patterns)
+
+---
+
 * Precision/Recall: False Positives? were filters shut down, bc they matched more False positives than they had real value?
 * Do filters work the desired way/help for a smoother Wikipedia service or is it a lot of work to maintain them and the usefulness is questionable?
 * What can we filter with a REGEX? And what not? Are regexes the suitable technology for the means the community is trying to achieve?
diff --git a/thesis/4-Edit-Filters.tex b/thesis/4-Edit-Filters.tex
index 32caa03d350a22317985d51e4b57295002ed82ac..0613eec01979570931e764e72ee01f83d14a20e7 100644
--- a/thesis/4-Edit-Filters.tex
+++ b/thesis/4-Edit-Filters.tex
@@ -250,6 +250,19 @@ The rules format can be viewed under \url{https://www.mediawiki.org/wiki/Extensi
 Data generated by the extension in stored in following database tables: \emph{abuse\_filter}, \emph{abuse\_filter\_log}, \emph{abuse\_filter\_action} and \emph{abuse\_filter\_history}~\cite{gerrit-abusefilter}.
 
 %TODO which new user permissions and which filter actions does the extension introduce?
+abusefilter-modify 	Modify abuse filters
+abusefilter-view 	View abuse filters
+abusefilter-log 	View the abuse log
+abusefilter-log-detail 	View detailed abuse log entries
+abusefilter-private 	View private data in the abuse log
+abusefilter-modify-restricted 	Modify abuse filters with restricted actions
+abusefilter-modify-global 	Create or modify global abuse filters
+abusefilter-revert 	Revert all changes by a given abuse filter
+abusefilter-view-private 	View abuse filters marked as private
+abusefilter-log-private 	View log entries of abuse filters marked as private
+abusefilter-hide-log 	Hide entries in the abuse log
+abusefilter-hidden-log 	View hidden abuse log entries
+abusefilter-private-log 	View the AbuseFilter private details access log
 
 \subsection{How is a new filter introduced?}
 //maybe move to governance?