(In reply to comment #39)
> This was considered and it's probably easy enough to implement these
> restrictions, but as I said above, I'm not sure they're necessary. My view
> was
> to take a "wait and see" approach. If local administrators begin to abuse or
> misuse the tool, we can always add in restrictions later.

I would actually look at it differently. Right now, as I understand it, cross-wiki message delivery is only configured to be run from Meta, where it's easy to see who's configuring what "spams" and for what audiences. It's easy for folks to have a shared conversation about what's appropriate and what isn't, and even for people to revert additions that they see as unreasonable.

So you've actually created a very clever tool that plays well into the norms of the wiki community, and uses an existing shared space (Meta) in the intended manner.

In contrast, enabling admins everywhere to _easily_ post bulk messages across wikis from anywhere, with the audit trail being HTML comments in the messages that are left, is IMO quite likely to play against the norms of the wiki, because messages _will_ be sent in a manner that's inconsistent with the norms of a given target wiki, and it'll be harder for the community to have a shared conversation about it or even to easily see what's happening (because there is no central message log at that point).

Because actions such as compiling target lists are dispersed, the normal processes of community peer review won't kick in as effectively to moderate and monitor behavior.

Yes, anyone can of course post anywhere today, but not everyone has access to a shared bot account that they can use on any wiki to do so, nor do they have an automated delivery tool. ReviewerBot would suddenly take bot actions on wikis and users would be tasked with figuring out what's going on. That's manageable if the only possible source is Meta, but more problematic if the source is any of our wikis.

Cross-wiki bulk messages to anywhere from anywhere are a significant change from the status quo that requires more consideration. And on that point, WMF will certainly get the blame if the tool is misused.

So I'm not comfortable with a deploy that amounts to giving admins in every wiki 'massmessage' permission to every other wiki. I'd be fine with 1) limiting the availability of the massmessage permission to Meta, or 2) adding back the global/local message delivery distinction and enabling local delivery on all wikis, and global delivery on Meta.

Better broadcasting tools should still continually be developed, and the imperfections of this approach will hopefully feed into whatever comes next, whether it's an iteration on MassMessage or an entirely new approach.