diff --git a/thesis/3-Methods.tex b/thesis/3-Methods.tex
index a6366f2c1fd26e29934c2d0aee3d90aed766e97f..a84738646fcdd3433e8da7a130e09b88748e9714 100644
--- a/thesis/3-Methods.tex
+++ b/thesis/3-Methods.tex
@@ -1,6 +1,36 @@
\chapter{Methods}
\label{chap:methods}
+\begin{comment}
+vgl \cite{GeiHal2017}
+iterative mixed method
+combination of:
+* quantitative methods: mining big data sets/computational social science
+"begin with one or
+more large (but often thin) datasets generated by a software platform, which has recorded digital
+traces that users leave in interacting on that platform. Such researchers then seek to mine as much
+signal and significance from these found datasets as they can at scale in order to answer a research
+question"
+* more traditional social science/qualitative methods, e.g. interviews, observations, experiments
+
+\cite{Geiger2014}
+"the idea that Wikipedia only takes place on wiki-
+pedia.org – or even entirely on the Internet – is a huge misunderstanding (Konieczny, 2009;
+Reagle, 2010). Wikipedia is not a virtual world, especially one located entirely on the wiki."
+e.g. in order to get hold of abuse_filter_history I had to engage with
+- wikipedia.org
+- mediawiki.org
+- irc channels
+- phabricator
+- gerrit
+- toolserver/cloudservices
+----
+other spaces Wikipedia takes place
+- mailinglists
+- WomenEdit/offenes Editieren @Wikimedia
+- Wikimania
+- Wikimedia's office and daily work
+\end{comment}
\section{Grounded Theory}
\section{Trace Ethnography}
diff --git a/thesis/5-Overview-EN-Wiki.tex b/thesis/5-Overview-EN-Wiki.tex
index abd10843478e3b827004a7bb6b7bba9f4ceb9f39..bca85a502a6931551af1e511db3894c7a0882085 100644
--- a/thesis/5-Overview-EN-Wiki.tex
+++ b/thesis/5-Overview-EN-Wiki.tex
@@ -1,48 +1,27 @@
\chapter{Descriptive overview of Edit Filters on the English Wikipedia}
\label{chap:overview-en-wiki}
-\section{Data}
+The purpose of this chapter (syn?) is to explore the edit filters on the Englisch Wikipedia.
+We want to gather a understanding of what types of tasks these filters take over,
+and, as far as feasible, trace how these tasks have evolved over time.
-\begin{comment}
-vgl \cite{GeiHal2017}
-iterative mixed method
-combination of:
-* quantitative methods: mining big data sets/computational social science
-"begin with one or
-more large (but often thin) datasets generated by a software platform, which has recorded digital
-traces that users leave in interacting on that platform. Such researchers then seek to mine as much
-signal and significance from these found datasets as they can at scale in order to answer a research
-question"
-* more traditional social science/qualitative methods, e.g. interviews, observations, experiments
-
-\cite{Geiger2014}
-"the idea that Wikipedia only takes place on wiki-
-pedia.org – or even entirely on the Internet – is a huge misunderstanding (Konieczny, 2009;
-Reagle, 2010). Wikipedia is not a virtual world, especially one located entirely on the wiki."
-e.g. in order to get hold of abuse_filter_history I had to engage with
-- wikipedia.org
-- mediawiki.org
-- irc channels
-- phabricator
-- gerrit
-- toolserver/cloudservices
-----
-other spaces Wikipedia takes place
-- mailinglists
-- WomenEdit/offenes Editieren @Wikimedia
-- Wikimania
-- Wikimedia's office and daily work
-\end{comment}
+The data upon which the analysis is based is described in section~\ref{sec:overview-data}
+and the methods we use–in chapter 3.
-The \emph{abuse\_filter} and \emph{abuse\_filter\_action} tables from \emph{enwiki\_p} were downloaded on 6.01.2019 via quarry~\footnote{\url{https://quarry.wmflabs.org/}}.
+\section{Data}
+\label{sec:overview-data}
+
+The main part of the present analysis rests upon/is based upon/is grounded in/foundations lie the \emph{abuse\_filter} table from \emph{enwiki\_p}(the database which stores data for the EN Wikipedia), or more specifically a snapshot thereof which was downloaded on January 6th, 2019 via quarry, a web-based service offered by Wikimedia for running SQL queries against their public databases~\footnote{\url{https://quarry.wmflabs.org/}}.
The complete dataset can be found in the repository for the present paper~\cite{github}. % TODO add a more specific link
-These tables, along with \emph{abuse\_filter\_log} and \emph{abuse\_filter\_history}, are created and used by the AbuseFilter MediaWiki extension~\cite{gerrit-abusefilter-tables}.
-Selected queries have been run against the \emph{abuse\_filter\_log} table as well.
-Unfortunately, currently the \emph{abuse\_filter\_history} table is not exposed to the public due to security/privacy concerns~\cite{phabricator}.
-We hope to be shortly able to access a view of this table in order to conduct historic inquirements.
+This table, along with \emph{abuse\_filter\_actions}, \emph{abuse\_filter\_log}, and \emph{abuse\_filter\_history}, are created and used by the AbuseFilter MediaWiki extension~\cite{gerrit-abusefilter-tables}.
+Selected queries have been run via quarry against the \emph{abuse\_filter\_log} table as well.
+Unfortunately, the \emph{abuse\_filter\_history} table which will be necessary for a complete historical analysis of the edit filters is currently not exposed to the public due to security/privacy concerns~\cite{phabricator}.
+Therefore, the present work only touches upon historical trends. %TODO how are these determined: API to abuse_filter_history; general stats from abuse_filter
+or qualitatively shows patterns.
+A comprehensive historical analysis is therefore (syn!) one of the possibilities/directions for future studies (syn).
-The schemas of these tables can be viewed in Figures~\ref{fig:db-schemas-af},~\ref{fig:db-schemas-afl},~\ref{fig:db-schemas-afh} and~\ref{fig:db-schemas-afa}.
+The schemas of all four tables can be viewed in figures~\ref{fig:db-schemas-af},~\ref{fig:db-schemas-afl},~\ref{fig:db-schemas-afh} and~\ref{fig:db-schemas-afa}.
\begin{figure*}
\begin{verbatim}
@@ -97,6 +76,7 @@ abuse_filter_log
\caption{abuse\_filter\_log schema}~\label{fig:db-schemas-afl}
\end{figure*}
+%TODO do something with the schemas, they are too wide and get cut off on the right side
\begin{figure*}
\begin{verbatim}
abuse_filter_history
@@ -496,85 +476,6 @@ Multiple filters have the comment "let's see whether this hits something", which
%We can sort filters into categories along various criteria.
%For now we don't have a different criteria...
-\section{Patterns in filters creation and usage}
-* What are typical filter usage patterns?
- ** switched on for a while, then deactivated and never activated again?: 81 (bad charts), 167 (two brief disables underway), 302 (switched off on the grounds of insufficient activity); 904 (to track smth);
- ** switched on for a short while and then powered down: mostly stuff merged to other filters; or for which the community decides filter is not an appropriate solution (308), 199 ('Unflagged Bots'); or decides to not implement the thing (that way); 290 (disabled, since relevant pages were protected); 207 ("Copy of another one we disabled. Unneeded, a bot already sees this. -Prodego")
- ** or switched off after a short while because there were no hits: 304, 67, 122, 401 ("Red hair" vandalism)
- ** or switched off after a longer while, because it was not tripped frequently, in order to save conditions from the condition limit: 211 ("Disable, appears to be inactive (log only filter). If you are using this filter, please let me know, and I'll reenable it -Prodego"); 20 ("A waste of processor time, deleted -Prodego")
- ** switched off bc merged to another filter 440 was merged in 345
- ** on for a short while and off again bc?? (false positives is a plausible option here): 394
- ** switched on and still on: 11 (verify), 79 (with brief periods of being disabled for couple of minutes/hours, probably in order to update the pattern), 164, 642 (if we ignore the 2min period it was disabled on 13.4.2018), 733 (2.11.2015-present), 29 (18.3.2009-present), 30 (18.3.2009-present), 33 (18.3.2009-present), 39 (18.3.2009-present), 50 (18.3.2009-present), 59 (19.3.2009-present), 80 (22.3.2009-present)
- ** switched on for a while, deactivated for a while, activated again?: 61, 98 (was deactivated briefly since an editor found the "warn" action unfounded; re-enabled to tag), 148 ("20160213 - disabled - possible technical issue - see edit filter noticeboard - xaosflux")
- ** switched on and stayed on, with the exception of brief periods of time when the filter was deactivated (and the activated again), probably in order to update the conditions: 79, 135 (there were couple of others in Shirik's list, go back and look);
- ** irregular?
- ** switched off, bc filter was deemed inappropriate to deal with the issue at hand: 484 "Shutdown of ClueBot by non-admin user" (From the comments: " Just sysop-protect the page if you don't want non-admins messing with it. --Reaper 2012-09-06")
-
-* What do filters target: general behaviour vs edits by single users
- ** there are quite some filters targeting particular users: 290 (targets an IP range), 177 ('User:Television Radio'), 663 ('Techno genre warrior
-', targets specific IP ranges)
- ** there are also some targetting particular pages (verify!), although this clashed with the guidelines: 264 "Specific-page vandalism" (it's hidden though, so we don't know what exactly it's doing); 401 ("Red hair" vandalism); there's smth with the main page; 715 "IP notification on RFP/C"
- ** and there are some filtering in general
- ** there are also filters such as 199 (Unflagged bots) which were implemented in order to track something which was not quite malicious or abusive and were thus deemed inappropriate use of filters by the community and consequently (quite swiftly) deleted
- ** some target insults in general and some contain regexes containing very specifically insults directed towards edit filter managers (see filter 12)
-
-* How do filters emerge?
- ** an older filter is split? 79 was split out of 61, apparently; 285 is split between "380, 384, 614 and others"; 174 is split from 29
- ** several older filters are merged?
- ** or functionality of an older filter is took and extended in a newer one (479->631); (82->278); (358->633);
- ** new condition(s) are tested and then merged into existing filter : stuff from 292 was merged to 135 (https://en.wikipedia.org/wiki/Special:AbuseFilter/history/135/diff/prev/4408 , also from 366; following the comments from https://en.wikipedia.org/wiki/Special:AbuseFilter/292 it was not conceived as a test filter though, but it was rather merged in 135 post-factum to save conditions); 440 was merged into 345; apparently 912 was merged into 11 (but 11 still looks like checking for "they suck" only^^); in 460: "Merging from 461, 472, 473, 474, and 475. --Reaper 2012-08-17"
- ** an incident caught repeatedly by a filter motivates the creation of a dedicated filter (994)
- ** filter is shut down, because editors notice there are 2 (or more filters) that do nearly identical checks: 344 shut down because of 3
-
- ** "in addition to filter 148, let's see what we get - Cen" (https://en.wikipedia.org/wiki/Special:AbuseFilter/188) // this illustrates the point that edit filter managers do introduce stuff they feel like introducing just to see if it catches something
-
-\begin{comment}
- From filter-lists/edit-filter-managers-bot-operators
- %TODO Check there for further patterns
-* 893, Predatory open access journals - introduced by Beetstra on 6.12.2017 and deleted again the same day https://en.wikipedia.org/wiki/Special:AbuseFilter/history?user=&filter=893 (probably doubling since filter 891 is already named "Predatory open access journals" and was introduced on 3.12.2017 https://en.wikipedia.org/wiki/Special:AbuseFilter/history?user=&filter=891 ; Beetstra added some additional domains to check to this filter on 11.12.2017 https://en.wikipedia.org/wiki/Special:AbuseFilter/history/891/diff/prev/18262); since both filters were introduced so close in time to one another I can imagine that there was an incident/discussion/request for such a filter and two different people went on and implemented it without coordinating with eachother.
-\end{comment}
-
-* How stable is the filter maker community?
- ** how many new users have become part of it over time?
- ** Has it been the same people from the very beginning?
- ** are there a couple of very active edit filter managers, that are also (informal) leaders?
- ** Do edit filter managers specialize on particular types of filters (e.g. vandalism vs good faith?)
-
-\begin{comment}
-%TODO This is a duplicate of a paragraph in 4.5.1. Does it fit better here?
-% this actually fits also in the patterns of new filters in chap.5; these are the filters introduced for couple of days/hours, then switched off to never be enabled again
-Edit filter managers often introduce filters based on some phenomena they have observed caught by other filters, other algorithmic quality control mechanisms or general experience.
-As all newly implemented filters, these are initially enabled in logging only mode until enough log entries are generated to evaluate whether the incident is severe and frequent enough to need a filter.
-
-
-Quite some of the 154 edit filter managers have a kind of "not active at the moment" banner on their user page.
-How many new editors have gotten the permission in recent time?
-Otherwise the group is apparently aging..
-
-
-CAT: https://ca.wikipedia.org/wiki/Especial:Usuaris/abusefilter (currently: 4 users)
-
--- auf Spanisch/Deutsch/Russisch existiert die Rolle nicht; interessant zu wissen, ob sie iwo subsumiert wurde
--- auf Bulgarisch übrigens auch nicht, aber da existiert auch die gesamte EditFilter seite nicht
-Probably it's simply admins who can modify the filters there.
-
-\subsection{Modifying a filter}
-% TODO Moved from chap.4, building a filter
-It is not uncommon, that the action(s) a particular filter triggers change over time.
-As of the guidelines for implementing new filters, every filter should be enabled in ``log only'' mode at its introduction.
-After it has been deemed that the filter actually acts as desired, usually additional actions are switched on~\cite{Wikipedia:EditFilterInstructions}.
-Sometimes, when a wave of particularly persistent vandalism arises, a filter is temporarily set to ``warn'' or ``disallow'' and the actions are removed again as soon as the filter is not tripped very frequently anymore. %TODO src? other than data?
-
-\end{comment}
-
-* How are filter actions set
- ** there's this pattern that all actions but logging (which cannot be switched off) are took out, when edit filter managers are updating the regex of the filter
- ** there's a tendency of editors to hide filters just for the heck of it (at least there are never clear reasons given), which is then reverted by other editors with the comment that it is not needed: 148, 225 (consesus that general vandalism filters should be public \url{[Special:Permalink/784131724#Privacy of general vandalism filters]}), 260 (similar to 225), 285 (same), 12 (same), 39 (unhidden with the comment "made filter public again - these edits are generally made by really unsophisticated editors who barely know how to edit a page. --zzuuzz")
- ** oftentimes, when a hidden filter is marked as "deleted" it is made public
-
-
-%TODO What were the first filters to be implemented immediately after the launch of the extension?
-
\section{Public and Hidden Filters}
The first noticeable typology is along the line public/private filters.
@@ -863,6 +764,85 @@ There are some 10 or so filters I manually labeled as targeting "bugs".
Most of them do log only.
\end{comment}
+\section{Patterns in filters creation and usage}
+* What are typical filter usage patterns?
+ ** switched on for a while, then deactivated and never activated again?: 81 (bad charts), 167 (two brief disables underway), 302 (switched off on the grounds of insufficient activity); 904 (to track smth);
+ ** switched on for a short while and then powered down: mostly stuff merged to other filters; or for which the community decides filter is not an appropriate solution (308), 199 ('Unflagged Bots'); or decides to not implement the thing (that way); 290 (disabled, since relevant pages were protected); 207 ("Copy of another one we disabled. Unneeded, a bot already sees this. -Prodego")
+ ** or switched off after a short while because there were no hits: 304, 67, 122, 401 ("Red hair" vandalism)
+ ** or switched off after a longer while, because it was not tripped frequently, in order to save conditions from the condition limit: 211 ("Disable, appears to be inactive (log only filter). If you are using this filter, please let me know, and I'll reenable it -Prodego"); 20 ("A waste of processor time, deleted -Prodego")
+ ** switched off bc merged to another filter 440 was merged in 345
+ ** on for a short while and off again bc?? (false positives is a plausible option here): 394
+ ** switched on and still on: 11 (verify), 79 (with brief periods of being disabled for couple of minutes/hours, probably in order to update the pattern), 164, 642 (if we ignore the 2min period it was disabled on 13.4.2018), 733 (2.11.2015-present), 29 (18.3.2009-present), 30 (18.3.2009-present), 33 (18.3.2009-present), 39 (18.3.2009-present), 50 (18.3.2009-present), 59 (19.3.2009-present), 80 (22.3.2009-present)
+ ** switched on for a while, deactivated for a while, activated again?: 61, 98 (was deactivated briefly since an editor found the "warn" action unfounded; re-enabled to tag), 148 ("20160213 - disabled - possible technical issue - see edit filter noticeboard - xaosflux")
+ ** switched on and stayed on, with the exception of brief periods of time when the filter was deactivated (and the activated again), probably in order to update the conditions: 79, 135 (there were couple of others in Shirik's list, go back and look);
+ ** irregular?
+ ** switched off, bc filter was deemed inappropriate to deal with the issue at hand: 484 "Shutdown of ClueBot by non-admin user" (From the comments: " Just sysop-protect the page if you don't want non-admins messing with it. --Reaper 2012-09-06")
+
+* What do filters target: general behaviour vs edits by single users
+ ** there are quite some filters targeting particular users: 290 (targets an IP range), 177 ('User:Television Radio'), 663 ('Techno genre warrior
+', targets specific IP ranges)
+ ** there are also some targetting particular pages (verify!), although this clashed with the guidelines: 264 "Specific-page vandalism" (it's hidden though, so we don't know what exactly it's doing); 401 ("Red hair" vandalism); there's smth with the main page; 715 "IP notification on RFP/C"
+ ** and there are some filtering in general
+ ** there are also filters such as 199 (Unflagged bots) which were implemented in order to track something which was not quite malicious or abusive and were thus deemed inappropriate use of filters by the community and consequently (quite swiftly) deleted
+ ** some target insults in general and some contain regexes containing very specifically insults directed towards edit filter managers (see filter 12)
+
+* How do filters emerge?
+ ** an older filter is split? 79 was split out of 61, apparently; 285 is split between "380, 384, 614 and others"; 174 is split from 29
+ ** several older filters are merged?
+ ** or functionality of an older filter is took and extended in a newer one (479->631); (82->278); (358->633);
+ ** new condition(s) are tested and then merged into existing filter : stuff from 292 was merged to 135 (https://en.wikipedia.org/wiki/Special:AbuseFilter/history/135/diff/prev/4408 , also from 366; following the comments from https://en.wikipedia.org/wiki/Special:AbuseFilter/292 it was not conceived as a test filter though, but it was rather merged in 135 post-factum to save conditions); 440 was merged into 345; apparently 912 was merged into 11 (but 11 still looks like checking for "they suck" only^^); in 460: "Merging from 461, 472, 473, 474, and 475. --Reaper 2012-08-17"
+ ** an incident caught repeatedly by a filter motivates the creation of a dedicated filter (994)
+ ** filter is shut down, because editors notice there are 2 (or more filters) that do nearly identical checks: 344 shut down because of 3
+
+ ** "in addition to filter 148, let's see what we get - Cen" (https://en.wikipedia.org/wiki/Special:AbuseFilter/188) // this illustrates the point that edit filter managers do introduce stuff they feel like introducing just to see if it catches something
+
+\begin{comment}
+ From filter-lists/edit-filter-managers-bot-operators
+ %TODO Check there for further patterns
+* 893, Predatory open access journals - introduced by Beetstra on 6.12.2017 and deleted again the same day https://en.wikipedia.org/wiki/Special:AbuseFilter/history?user=&filter=893 (probably doubling since filter 891 is already named "Predatory open access journals" and was introduced on 3.12.2017 https://en.wikipedia.org/wiki/Special:AbuseFilter/history?user=&filter=891 ; Beetstra added some additional domains to check to this filter on 11.12.2017 https://en.wikipedia.org/wiki/Special:AbuseFilter/history/891/diff/prev/18262); since both filters were introduced so close in time to one another I can imagine that there was an incident/discussion/request for such a filter and two different people went on and implemented it without coordinating with eachother.
+\end{comment}
+
+* How stable is the filter maker community?
+ ** how many new users have become part of it over time?
+ ** Has it been the same people from the very beginning?
+ ** are there a couple of very active edit filter managers, that are also (informal) leaders?
+ ** Do edit filter managers specialize on particular types of filters (e.g. vandalism vs good faith?)
+
+\begin{comment}
+%TODO This is a duplicate of a paragraph in 4.5.1. Does it fit better here?
+% this actually fits also in the patterns of new filters in chap.5; these are the filters introduced for couple of days/hours, then switched off to never be enabled again
+Edit filter managers often introduce filters based on some phenomena they have observed caught by other filters, other algorithmic quality control mechanisms or general experience.
+As all newly implemented filters, these are initially enabled in logging only mode until enough log entries are generated to evaluate whether the incident is severe and frequent enough to need a filter.
+
+
+Quite some of the 154 edit filter managers have a kind of "not active at the moment" banner on their user page.
+How many new editors have gotten the permission in recent time?
+Otherwise the group is apparently aging..
+
+
+CAT: https://ca.wikipedia.org/wiki/Especial:Usuaris/abusefilter (currently: 4 users)
+
+-- auf Spanisch/Deutsch/Russisch existiert die Rolle nicht; interessant zu wissen, ob sie iwo subsumiert wurde
+-- auf Bulgarisch übrigens auch nicht, aber da existiert auch die gesamte EditFilter seite nicht
+Probably it's simply admins who can modify the filters there.
+
+\subsection{Modifying a filter}
+% TODO Moved from chap.4, building a filter
+It is not uncommon, that the action(s) a particular filter triggers change over time.
+As of the guidelines for implementing new filters, every filter should be enabled in ``log only'' mode at its introduction.
+After it has been deemed that the filter actually acts as desired, usually additional actions are switched on~\cite{Wikipedia:EditFilterInstructions}.
+Sometimes, when a wave of particularly persistent vandalism arises, a filter is temporarily set to ``warn'' or ``disallow'' and the actions are removed again as soon as the filter is not tripped very frequently anymore. %TODO src? other than data?
+
+\end{comment}
+
+* How are filter actions set
+ ** there's this pattern that all actions but logging (which cannot be switched off) are took out, when edit filter managers are updating the regex of the filter
+ ** there's a tendency of editors to hide filters just for the heck of it (at least there are never clear reasons given), which is then reverted by other editors with the comment that it is not needed: 148, 225 (consesus that general vandalism filters should be public \url{[Special:Permalink/784131724#Privacy of general vandalism filters]}), 260 (similar to 225), 285 (same), 12 (same), 39 (unhidden with the comment "made filter public again - these edits are generally made by really unsophisticated editors who barely know how to edit a page. --zzuuzz")
+ ** oftentimes, when a hidden filter is marked as "deleted" it is made public
+
+
+%TODO What were the first filters to be implemented immediately after the launch of the extension?
+
\section{Fazit}
\begin{comment}
diff --git a/thesis/conclusion.tex b/thesis/conclusion.tex
index 06245e1f9c454cfc6e441d8b8fe468ffaacd9929..8c6e088c873aa8d958392b26fc22ad2bfdef2dd9 100644
--- a/thesis/conclusion.tex
+++ b/thesis/conclusion.tex
@@ -113,6 +113,12 @@ Here, the filter editor responsible should monitor the filter and the logs in or
I think these cases should be scrutinised extra carefully since ``urgent situations'' have historically always been an excuse for cuts in civil liberties.
\end{comment}
+\begin{comment}
+also
+* complete abuse\_filter\_history and real historical analysis
+* access to the whole database and analysis of private filters
+\end{comment}
+
%********************
% Filters vs bots
% Investigation of edit filter managers who are also bot operators: what do they implement when?
diff --git a/thesis/introduction.tex b/thesis/introduction.tex
index 2490cb4084052420df19603d031db9b2e1d4d521..be74578ad25d2c2455fd10d46c6c11cb27b71108 100644
--- a/thesis/introduction.tex
+++ b/thesis/introduction.tex
@@ -148,6 +148,8 @@ Note:
* documentation (Wikipedia, MediaWiki pages): what have we learnt here
* data (filters stats, REGEX patterns): what do the filters actually do?
+Open science? + ref to github
+
\section{Structure}
The remaining part of this thesis is organised in the following manner: