Wikimedians of Mainland China/Draft proposal on establishing an official mirror site of Wikimedia projects for mainland Chinese users

This page is still finalizing, as it was transferred from a discussion board and new inputs from the community may be added. Other images, links, and tables will be added to it shortly. ETA 16:00 UTC, December 1st (0:00 UTC+8, December 2nd 2020).

Please leave any discussion on the Community Wishlist Survey page, and we will address them.

Details

This proposal is about setting up mirror sites for all Wikimedia projects, which will be operated by the WMF officially. Such mirror sites will help editors access Wikimedia projects from China, where Wikipedia was blocked, and solve problems that emerged from the massive usage of proxies on Chinese Wikimedia projects.

This proposal has already been discussed thoroughly with some community members to examine its feasibility. It is not difficult to set up said mirror site from a technical perspective, but the main goal of this proposal is to demonstrate the demand for such a site and why this is a sensible idea.

China's internet censorship mechanism is named "the Great Firewall," or "GFW" for short. GFW currently blocks all websites on the domain name "wikipedia.org," as well as the main IP address that the WMF assigns for visitors from mainland China. A mirror site will bypass such a detecting mechanism by avoiding using "wikipedia.org" as part of its link and change its IP address every time the GFW issues a block.

Current state of accessibility

To begin with, accessibility of Wikimedia projects in mainland China varies by the exact data center the visitor is accessing and whether the connection is through IPv4 or IPv6.

The WMF currently runs five data centers and will route visitors based on their location to the closest one. For example, visitors from Europe and Africa will be assigned the Amsterdam data center's IP address, visitors from the US east coast and South America will be assigned the Virginia one. Although China is geographically closer to the Singapore data center, it will be given San Francisco's IP address by default.

The chart below shows the IP addresses of each WMF's data center, in both IPv4 and IPv6, and whether serving text contents (text-lb) or image and other media contents (upload-lb). Addresses such as fr.wikipedia.org, en.wiktionary.org, meta.wikimedia.org will use the "text-lb" IP, while upload.wikimedia.org will use the "upload-lb" IP.

As we can see, the IPv4 address of the San Francisco data center, which is default to the US west coast and mainland Chinese visitors, was blocked by GFW, but other IPv4s and all IPv6s are fine.

As of November 2020,

• All languages of Wikipedia were blocked.
  • This was accomplished by detecting SNI headers and DNS poisoning. Both methods will look for "wikipedia.org" as the keyword.
  • GFW will shut down (reset) connections when detecting someone is attempting to establish an HTTPS connection to Wikimedia's server.
  • By poisoning DNS, GFW will give the visitor a wrong IP address that does not lead to the actual Wikimedia servers.
  • The blocked San Francisco IP address is not the main cause of the block on Wikipedias.
• If the user is accessing from IPv4, then all other Wikimedia projects were blocked, regardless of language.
  • This includes everything we put on the San Francisco text-lb IP address, i.e., Wikipedia, Wikisource, Wikiquote, Wiktionary, Wikiversity, Meta-Wiki, Wikimedia Commons, MediaWiki.org, and "w.wiki" link shortener.
  • One can get around this block by modifying the hosts file on their device with another IP address from a different data center. A hosts file can force the operating system to go for the IP address that is hardcoded in it, overwriting the default San Francisco IP address assigned by the WMF's server, which GFW blocked.
• If the user has IPv6 accessibility, then most Wikimedia projects other than Wikipedia will be accessible, with a few exceptions.
  • All three major Chinese internet service providers have been rapidly deploying IPv6 to their users since the Chinese Communist Party's top governing bodies demanded so in 2017. (surprise, right?) Almost all 4G LTE users had IPv6 addresses allocation, and most home internet had IPv6 if the modem and ONTs are compatible. Official data says 10% of the traffic on LTE backbone is IPv6.
  • However, IPv6 is not something to rely on since its availability varies vastly depends on the device, router, and network configuration, and its speed to Wikimedia's servers is far from ideal.
  • IPv6 doesn't help with DNS poisoning or SNI detection. Some Wikimedia wikis, most notably Chinese Wikiquote, is a non-Wikipedia wiki that also suffers from these blocking measures.
• Some legacy methods used by GFW are still effective. These are no longer useful, but they still work and will create obstacles over connectivity.
  • For example, when connecting Wikipedia through HTTP, the connection will be terminated as the full, unencrypted URL is visible to GFW. This method does not involve SNI detecting and it used to be useful before WMF started forcing HTTPS and implemented HSTS back in 2014.

To sum up: All languages of Wikipedia are not accessible in China. Most other Wikimedia projects are accessible if the visitor has IPv6 capability, which is not uncommon; otherwise, all Wikimedia projects are inaccessible.

GFW's blockades on Wikimedia projects had been constantly changing, and many of GFW's moves don't seem to make much sense. They are some that make sense, though, such as in May 2015, GFW started poisoning DNS translation on "zh.wikipedia.org" exclusively, and it was widely speculated that GFW wanted to block Chinese Wikipedia, but not other languages of Wikipedia - because being bilingual was a higher bar to understand its content, and also English Wikipedia may be more useful for academic research. This continued to May 2019, when GFW extended its block to all languages of Wikipedia.

But GFW also made some less drastic moves that didn't attract as much attention like both incidents in 2015 and 2019, such as in August 2018, GFW started to implement SNI detection on "zh.wikipedia.org." Before this move, one could regain access to Wikipedia simply by modifying the hosts file as described above to combat DNS poisoning. However, they had to use proxies to edit Wikipedia after the move, intensifying the problems of over-issuing IP Block Exemptions and Checkuser, which we are going to discuss later.

Other non-drastic moves include blocking Wikipedia (zh.wikipedia.org) but leaving mobile versions accessible (zh.m.wikipedia.org); before all Wikipedias were blocked in 2019, GFW specifically blocked the Japanese desktop version of Wikipedia for some reason; sister projects including Chinese Wikinews, Wikisource, and Wikiquote had been blocked and unblocked multiple times throughout the years. Not until recently, the San Francisco text-lb IPv6 address that we just discussed was somehow blocked on CERNET, the internet backbone network used by Chinese universities and research institutions, but remained unblocked on other Chinese civilian carriers - CERNET lifted this block not long ago.

Most of such non-drastic moves were not documented well and lost in history. Chinese Wikipedia and her sister projects had long been in a struggle with GFW dated back to 2004, and its ways of being censored and other's ways to counter it was far more complicated than what's mentioned above.

Existing mirror sites

There are dozens of Wikipedia mirrors intended to serve mainland Chinese visitors. Many of them are read-only, censoring content on topics such as Tiananmen Square and Tibet. These mirrors are circulating on Chinese forums and instant messaging platforms, and they did expand the audience of Wikimedia projects to the general public. They are so accessible that one can find them by simply searching "Wikipedia" on Baidu. However, it is not clear how many people actually use them.

On Chinese e-commerce website Taobao and a Craigslist-like website Xianyu, which their parent company Alibaba also runs AliExpress, many are selling Kiwix, the offline Wikipedia database, for a price. They usually cost around 20 Chinese Yuan (~USD 3), and once purchased, the merchant will send a share link of Baidu Netdisk, a Dropbox-like service common for sharing pirated content in China for buyers to download, despite the fact that Kiwix's website isn't blocked and BitTorrent did work just as fine in China.

It is worth noting that those looking for Wikipedia mirrors on Baidu or buy Kiwix database are mostly knowingly looking for Wikipedia. They know they are reading Wikipedia, and are consciously choosing Wikipedia over its Chinese counterparts such as Baidu Baike. Wikipedia has a generally good reputation among the Chinese public for being more reliable, trustworthy, and academically-oriented.

The is another Wikimedia mirror that is widely used among Wikimedians in China, and it inspired this proposal. This mirror, which I can't disclose its URL, has some special designs to make it work more like a proxy instead of a mirror. It will take cookies and allow Wikimedians to log in to their accounts to make edits, while its server has optimized link to Chinese internet carriers, which makes it faster to browse in China.

The mirror operator told me that his mirror has roughly 50,000 visitors and 500,000 page views per month (it honors Do Not Track requests). It costs him about 600 Chinese Yuan (~USD 90) per month to pay for the server. He accepts donations from others who are using his mirror to run, and luckily, the donations managed to keep up.

Over-issuing IP Block Exemptions, Checkuser, and abuses

Wikimedia projects traditionally didn't welcome edits from proxies since abusers can easily bypass IP-based MediaWiki blocks by using proxies to change their IP addresses. Administrators on Chinese Wikipedia used to block ranges of IP addresses that may be used by internet data centers and potential open proxies, but they can no longer do that under the current situation - everyone from mainland China, which takes up one-third of all active contributors on Chinese Wikipedia, has to use a proxy to edit, and those who live in Hong Kong and Taiwan may need to go to mainland China from time to time.

On Chinese Wikipedia, administrators are dealing with the situation by trying to block as few proxy IPs as possible and granting a special flag called "IP Block Exemption" to virtually everyone. "IP Block Exemption" is a flag that can be applied to one's Wikimedia account like Patrol and Rollback. When someone is editing on an IP address that is "hard blocked," they will be blocked from doing so even if they have logged in to their Wikimedia account and the account itself wasn't blocked. An "IPBE" flag will solve this.

This flag is supposed to be granted only in extreme cases to those who, say, just so happened to share the same IP range with a Long Time Abuser (LTA). When a CheckUser discovered that, they might apply a "hard IP range block" to the IPs and grant IPBE flags to those who will be interfered by the block. However, owing to the current situation, IPBE flags were granted to anyone who asked for it.

The IPBE flag, on itself, posts these problems: IPBE flags need to be granted by admins. This creates extra, unnecessary work for them. Even though 99% of IPBE applications are approved, but the nature of this task means that every application needs to be manually reviewed and cannot be replaced by a bot. On Chinese Wikipedia, one's IPBE flag will be removed once they haven't made any edit in half a year, and this half-a-year requirement on activeness is only tighter on other Wikimedia wikis. On some wikis, admins and CheckUsers will only grant IPBE flags that expire in half a year. Users have to re-apply for the IPBE flag once theirs has expired or been removed due to inactivity. Users may need more than one IPBE flag, and they have to be applied separately. This discourages cross-wiki contribution. A typical Wikipedia contributor from China usually has two IPBE flags: a local flag works on Chinese Wikipedia, and a global one issued by Stewards from the Meta-Wiki level, which works on global blocks. I will discuss the complexity and the bureaucracy behind it later. A third or fourth IPBE flag may also be needed for one to edit English Wikipedia, Wikimedia Commons, Wikidata, or other projects. As a consequence, it's not uncommon for Chinese editors seeking help to add interlanguage links to their newly created articles because their IP was blocked on Wikidata; or ask someone else to upload images to Wikimedia Commons. IPBE flags are harder to obtain on some wikis due to local guidelines.

More problems emerged as admins on Chinese Wikipedia have to issue IPBE flags to virtually all editors.

CheckUser became more challenging to conduct on Chinese Wikipedia. Previously, admins and CheckUsers can massively block IP addresses in suspicion of being used for open proxies, making Long Time Abusers (LTAs) more difficult to find usable proxies. However, under the current situation, everyone can be using proxies from everywhere. This makes conducting CheckUser requests on sockpuppeteers as well as experienced users who may be abusing sockpuppets more difficult. This is worsened by the fact that there are no CheckUsers on Chinese Wikipedia. The WMF removed CheckUser privilege from zhwiki in 2016, citing security concerns, and all CheckUser requests from zhwiki had to be conducted by Stewards ever since.

LTAs had also learned how to exploit the system. There are reported incidents in which an LTA pretended to be a newbie and successfully scammed the admin to register an account and grant an IPBE flag for them.

How newbies are suffering

Let's imagine Zhang San, who comes from China and wants to get his hands on Wikipedia editing.

Zhang edits Wikipedia with four proxies and will switch between them based on their speed, latency, and stableness. Their IP addresses are 1.1.1.1, 2.2.2.2, 3.3.3.3, 4.4.4.4.

1.1.1.1 was blocked on Chinese Wikipedia (zhwiki), 2.2.2.2 was blocked globally on Meta-Wiki, 3.3.3.3 was blocked on both zhwiki and global (yes, an IP and account can be blocked twice), and 4.4.4.4 was blocked on English Wikipedia (enwiki) and global. In this setup, Zhang San must need three separate IPBE flags, granted by zhwiki, Meta-Wiki, and enwiki separately, if he wants to edit zhwiki, uploads images to Wikimedia Commons, updates language links on Wikidata, and edits enwiki occasionaly.

Zhang San finds a typo on a Wikipedia entry and wants to correct it. But the first thing he sees after clicking the "edit" button is a block notice: his proxy was blocked. He learned from the block notice that he needs to write to Wikipedia administrators and have the admins create an account for him.

Zhang got lucky this time because he used a PC. On mobile views and apps, the crucial block notice that gives him instructions on how to contact the admins cannot be properly displayed - it's just a bunch of unstyled HTML garbage. I have seen countless confused newbies with a screenshot of Wikipedia's mobile webpage or app asking why they can't edit. Moreover, if Zhang encountered an IP range that was blocked globally, but there's no local block in place, then Zhang will see a confusing message left by Stewards who imposed the block. The message asks Zhang to contact them if he is affected, but that means Zhang will have to write an email in English, which he may struggle to describe his situation clearly, and may suffer longer wait time than zhwiki's mailing list.

Admins get back to Zhang in three days - not the longest wait time - and he still remembers which entry he wanted to edit. The newly created account will come with an IPBE flag, but the IPBE flag is only good for Chinese Wikipedia. With a zhwiki local IPBE, he is able to use all four of his IPs on zhwiki now - a local IPBE can overrule a global IP block.

Now Zhang wants to create his first article, and he needs to upload an image to Wikimedia Commons. With the proxy service he had, he is unable to upload to Commons if he is using any IP besides 1.1.1.1. It's normal for a proxy service provider targeting Chinese users to have dozens of servers and IPs to choose from. He may find out that 1.1.1.1 will work for him on Commons, but very likely, he can't. Zhang asks for help, and someone tells him that he needs a "Global IPBE," which he has to apply from Meta-Wiki.

Global IP locks imposed by Stewards are effective in all Wikimedia wikis except Meta-Wiki itself, so Zhang is able to edit the Meta-Wiki page for applying Global IPBE (GIPBE). In one day, Zhang gets his GIPBE flag and is able to upload images to Wikimedia Commons. A GIPBE flag can overrule global IP blocks, only if there is no double-block locally on the specific wiki Zhang's trying to edit.

Zhang can also choose to apply for a local IPBE flag on Commons. However, admins and CheckUsers on many wikis don't quite know how to deal with such requests, but Stewards do. Also, a GIPBE flag overruling global blocks means Zhang can also edit on other wikis, such as Chinese Wikiquotes.

After a few dozens of edits on Chinese Wikipedia and several images on Commons, Zhang now wants to edit English Wikipedia. Enwiki has a higher bar on granting IPBE flags, and usually, a CheckUser will be performed to make sure Zhang is actually suffering from an IP block. If Zhang is using the IP 4.4.4.4, then even if he already had a local IPBE flag for zhwiki and a global one, he is still unable to edit enwiki. He decided to apply one on enwiki.

Zhang can apply by leaving an unblock request on his User talk page, or through English Wikipedia's unblock ticketing system, known as "Unblock Ticket Request System" or UTRS for short. Others told Zhang to go for the unblock request, and Zhang did. The former version of UTRS has an extremely confusing interface for IPBE applicants, and very few people managed to walk through the system. A new beta version of UTRS does address the issue.

A CheckUser on enwiki denied Zhang's request, citing Zhang's editing history on other wikis cannot demonstrate that we won't conduct vandalism on enwiki or clear the doubts that he is not a sockpuppet controlled by anyone. But then, Zhang is able to find out that some of his proxy IPs are good for editing enwiki and go on using those.

There are many Zhang San's who managed to navigate themselves through the system, with or without help from other editors, but many who don't. Zhang San's story above is what a "typical" newbie may run into, but there are more variables and possibilities to daunt him. Wikipedia has a pretty steep learning curve for newcomers, and adding extra burdens to steepen it is not something we should do. Considering that internet censorship worldwide is only getting more common, we need to do our best to make Wikipedia editing more accessible, available and make the system easier to understand and navigate.

Benifits

Those who benefit the most from this mirror will be Wikimedians who are not very familiar with modern technology and find it difficult to set up proxies on their own devices or don't want to go through that hassle.

Many Wikimedians are also heavy users of other websites blocked by GFW, such as Google and YouTube, so they usually have proxies running at all times. However, for many who don't rely heavily on those blocked websites, and read Wikipedia through non-editable mirrors or Kiwix, they will have to fire up their proxies before being able to edit or even browse (the online version of) Wikipedia. As a previous survey on the mainland Chinese community shows, these editors do make up a sizable portion of the population.

Intermediate editors who may only have a few dozens edits per year can also benefit from the mirror. A mirror eliminates the hassle for re-applying and renewing IPBE flags, as well as the half-a-year limitation, for occasional editors who only make edits a few times a year and often find their IPBE flags removed. Making editing more accessible to them will inevitably increase participation, and it will be more likely for them to transform into frequent editors.

Newbies will find registering accounts much easier, as they can do it themselves instead of writing an email and waiting potentially weeks to apply. Administrators will spend less time registering accounts for newbies and putting their efforts into other tasks.

Admins can also block IP ranges in suspicion of open proxies like before, without worrying that this may interfere with legitimate editors. LTAs will find it more challenging to get IPBE flags, and more of their sockpuppet accounts will get stopped by "hard blocked" IP ranges.

Counter-vandalism and sockpuppet investigation will be easier. Stewards and CheckUsers will have real IPs to work with, and dozens-of-legit-users-sharing-the-same-IP scenario will rarely happen. This will make LTAs easier to hunt and make it harder for experienced users to abuse sockpuppets.

Lastly, although I hate to say it, I should point out that this mirror could be a futureproof solution. Turkey just lifted its block on Wikipedia, while Iran temporarily blocked it for one day this year. Multiple "internet blackouts" incidents occurred in India, Ethiopia, and many others. No one knows which country and which Wikipedia will be the next. I noticed that after Turkey lifted its block, Stewards on Meta-Wiki started to remove Global IPBE flag from Turkish users massively, indicating that the Turkish Wikipedia community might use the same way to fight with their blockade as us. This tells us that we need a backup solution to brace for the next possible blockade.

Plans and steps

We had some internal discussions to make this plan more doable. There are three ideal choices for servers of the mirror site, and to generally improve accessibility from China:

• Third-party cloud services with optimized links to China, such as Alibaba Cloud.
• Regular third-party cloud services, such as AWS.
• Change routings for WMF's IPs.

Internet content providers have routinely used third-party cloud services to bypass censorship, for they provide a pool of IP addresses when some get blocked. According to statistics pulled from the existing mirror, we expect no more than 10 TB of monthly data usage, and that's an amount a single AWS Lightsail instance will handle.

Some providers, such as Alibaba, offer optimized links to China by directly peering with Chinese ISPs. This will improve user experience dramatically. However, this will increase cost, and some may have privacy concerns over connecting to a Chinese cloud service provider like Alibaba.

Certain Asian datacenter locations of AWS, Google Cloud, and Azure also offer decent connectivity to China. These could be a compromise of good connectivity and price.

Since WMF has already been using Cloudflare's Magic Transit service to help migrate DDoS attacks, it is also possible to neglect all third-party public clouds and go for Cloudflare. Cloudflare has direct peering with 2 out of 3 major Chinese ISPs, and the speed is more than acceptable. Putting all Chinese traffic to Cloudflare is definitely an improvement.

Precautions need to be taken to make sure the mirror lasts longer. This includes:

• Limiting access to it only to those who already have a Wikimedia account. The website will only present Special:Log in, and only users with an existing Wikimedia account can access Wikimedia contents after logging in. Access to pages other than Special:Log in should be 403 denied or redirected to Special:Log in.
• Only allowing users with no HTTP referrer header or a referrer header of Wikimedia sites to access. This helps limit the spread of the mirror site's link, so GFW censors are less likely to discover it. Moreover, additional banners need to be placed on the mirror once users logged in, warn them not to publicly post the link on a forum, but private share through an IM should be allowed.
  • HTTP referrer is a piece of information presented to the web server when the user's browser requests web pages. For example, when I google "wikipedia" and click on the link in Google search result, the HTTP referrer will be the Google search result's link. When someone found the mirror's link on a forum, the HTTP referrer will be the forum post's link. Thus, by limiting the HTTP referrer, we can tell if the mirror's link has been posted publicly and deny all visitors with incorrect HTTP referrer.
• The only pages that can be accessed directly besides Special:Log in should be Special:Create account and Special:Reset password. This helps ease the work for administrators who have to deal with account creation requests manually.

These precautions and limitations on access are essential to the survival of the mirror. Otherwise, we will find ourselves in a cat-and-mouse situation with the GFW censors, which a mirror may be set up and last a few days before GFW blocks it. Further discussion of these precautions is below in the "Q&A" session.

Most of the aforementioned precautions can be accomplished by modifying configurations of Nginx or Apache, but IP-logging for checkuser and for MediaWiki's IP block mechanism can be a bit difficult and needs extra work. The latter may be possible by configuring servers to accept X-Forwarded-For headers from mirrors as legitimate IP addresses.

At the very first stages of implementation, whether to use the official mirror should be voluntary. Local administrators and stewards should grant IPBE flags as usual, but applicants may face more doubts; IPBE flags already issued should keep as is. We should treat the official mirror as a replacement for the unofficial ones, as in we should make an official mirror available and encourage those who are using the unofficial ones to switch over, but not forcing the others using regular proxies to switch. Whether or not those who are using regular proxies need to switch should be decided by local communities. What we need to do first is to make the mirror available.

Q&A

We have this idea of building a mirror site for a while now, and we have received some questions and concerns. Here are some of them below:

Q1

Will this further anger China or against Chinese laws?

No. Setting up mirror sites is a common tactic to get around GFW's censorship. Some Chinese universities have their own mirror sites to help students accessing Google and other websites blocked by the GFW. Subsidiaries of Microsoft and Google in China are known to have dedicated circuits to their overseas headquarters while providing their employees in China to have uncensored internet access. In a tally previously conducted on the mainland Chinese Wikimedia community, around 4% of respondents said the company offers uncensored internet or provide their own VPNs for employees to use, and they are taking advantage of this to edit Wikipedia. In general, it is acceptable to provide unfiltered internet, as long as the access to it is limited.

Speaking of "angering China," the WMF has already issued several statements several statements that may actually "anger China," so I'd say a mirror site is fine.

Q2

What's the possibility of GFW censors discovered this site? And what if it's blocked again?

GFW censors won't usually look deep into a website's content, so showing nothing but a login prompt is good enough to turn them away. Also, as we have previously discussed, they tend to block random websites and IPs. Such blocking-for-no-obvious-reason still happens today, and there's nothing to worry about.

The unofficial mirror doesn't even require login first to access uncensored Wikipedia contents, and it has been operating for more than one year with no problems following all the precautions discussed above.

However, what we need to avoid is a cat-and-mouse scenario.

Q3

What about those who just want to browse, but not to edit Wikipedia?/Why not make the mirror fully public?

If we make the mirror fully public, it may get blocked in a matter of weeks or days. There is no perfect solution to this matter, and we have to compromise. The "existing mirror" was set up over a year ago and still remains accessible as of this writing, with fewer precautions in place.

If, unfortunately, we do run into the cat-and-mouse scenario, we should only discuss further action after that since this is still unlikely considering we have the "existing mirror" as a sample.

Q4

Can I check out that "existing mirror" that was used widely among Chinese Wikimedians?

Yes, but for the same reason in the "Plans and steps" section, it is not appropriate for me to post its link directly here. Plus, in addition to the precautions listed above, this mirror is denying access to all non-Chinese IP addresses to help defend against botnet attacks. If you really want to see what the mirror looks like, please send me an email, and I will give you a VPN that will connect you to China, and you may take a look at the mirror with the VPN on.

Q5

How people get access to Wikipedia and other blocked websites such as Google, Facebook, and Twitter?

GFW can detect traditional VPN protocols such as PPTP, L2TP, and OpenVPN, and the connections are far from stable. So traditional VPNs (including those which are advertising heavily on YouTube) were mostly abolished. Most people use proxy protocols that are designated to bypass GFW detection, such as Shadowsocks, V2ray, and Trojan.

A healthy black market of such proxies emerged to provide services bypassing GFW, and it's not difficult to get your hands on one at all. Intense competition in the market brought their average monthly price to about 10 to 20 Chinese Yuan (~USD 1.5 to 3). These proxies can usually guarantee streaming 1080p to even 8K YouTube videos with no problem.

This makes it sounds like accessing Wikipedia shouldn't be a problem, but due to barriers that *we* set up, newbies will have to apply an account by sending an email and apply for multiple IPBE flags, while experienced editors who may not be interested in Google and Facebook will have to put themselves through the inconvenience of setting up proxies - and that's part of the reason why unofficial mirrors gained so much in popularity.

Moreover, people tend to have problems with configuring proxies. Proxies are available on all platforms, from Windows to iOS, but a not-insignificant percentage of users still find them challenging to use and unstable from time to time. At the same time, many complain that they only have proper proxies set up on either mobile or desktop devices and had to use either mobile or desktop to access Wikipedia, which discourages participation and engagement to Wikimedia projects.

Q6

China blocked Wikipedia since 2015. Why bring up this topic now, but not, say, five years earlier?

As we have discussed earlier on GFW's history of blocking Wikipedia, its process is more like the boiling-a-frog-slowly-so-it-won't-jump story in the past five years. After its initial block in May 2015, most Wikimedians can just get by with modified hosts files on their devices; when the block upgraded in August 2018 and hosts file modification no longer worked, mass-blocking of proxy IP ranges wasn't common; as more IP ranges were gradually blocked from both Chinese Wikipedia locally and by Stewards globally, it avoided a sudden surge of IPBE flag application; and finally, we ended up in the ludicrous situation: virtually everyone has an IPBE flag, dozens of users sharing the same IP address, CheckUser became practically useless on experienced editors who may be abusing sockpuppets, backlogs of account creation requests became commonplace, newcomers facing countless middle-fingers just to get their hands onto Wikipedia editing, while LTAs noticed the loophole of the system and started to take advantage of it.

We have to address this issue sometime, and it's better to be now.

Q7

What about privacy?

Providing a new, officially-run mirror and encouraging its usage is an improvement to privacy, not a regress.

Speaking from a personal perspective, I used to firmly oppose the idea of a mirror site. A mirror could be disastrous for privacy and account safety - anyone who logs in their Wikimedia account to make edits will have to give away their password to the mirror, for it to be handed over to the actual WMF servers. If any unofficial mirror deliberately records all the usernames and passwords, especially those with higher privileges such as rollback and sysop, the consequences of leakage or cyberattack could be unimaginable - and we have yet to talk about the fact that unofficial mirrors will also obtain the users' IP addresses, which has safety problems on its own.

My opinion did change after seeing wide adoption and increased editing participation after the "existing mirror" became popular among Wikimedians. But so far, we will have to regard the legitimacy of mirrors based on an honor system, to hope the mirror operators will respect privacy and won't store any personal information. I used to try my best to persuade fellow Wikimedians not to log in to their accounts on any mirrors, but I not only failed, but the mirrors also gained popularity thanks to their convenience instead. There are many people - more than what you may think - that cares less about safety and security and just want an easy and convenient way to edit Wikipedia, while those third-party mirrors fit their need. An official mirror will, at the very least, eliminate the problem of third-party mirrors obtaining Wikimedia accounts passwords and IP addresses.

Another likely concern over privacy after the potential widespread use of official mirrors is whether or not IPBE flags will still be granted to users who may feel more comfortable editing with a proxy or Tor. As suggested above, at the first stages of the official mirror's initial roll out, switch to it will be voluntary, and whether or not the official mirror will be part of policies and guidelines should be left decided by local communities, while users who already had IPBE flags will be left as is. The current situation is: administrators had been granting IPBE flags to anyone who asked for it, and "I'm from mainland China" or "I need to use proxies" are excuses sufficient enough to get one. IPBE applicants may have to present a better story to demonstrate their need for an IPBE flag - which was what it used to be like before China blocked Wikipedia and everyone started to use a proxy, but anyone who wants to use Tor for reasons such as fear of government suppression should be able to get one.

Q8

How many people will benefit from this?

About 500,000 page views were made per month for the "existing mirror," but not all of them have registered a Wikimedia account. (Editing directly from the mirror without logging in is banned since admins locked the mirror's IP addresses. Also, one cannot register new accounts through the mirror.) It is estimated that there are roughly 30 active mirror users, with more occasional editors made edits through the mirror periodically.

However, the official mirror, which by design neglects the need for multiple IPBE flags for newcomers, will encourage cross-wiki editing and editing from occasional users. We will also see account registration surge after the link to the mirror is presented to those who are blocked from registering for their proxies. After I massively unblocked proxy IP ranges a few years back, I saw the number for account creation increased by threefold on Chinese Wikipedia. I expect more than 100 active users of the mirror and thousands to benefit from easier account registration processes.