What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 130 Stack Exchange communities.

Sometimes users accidentally post credentials or sensitive information in their posts. Although it's easy to edit those post then, the revision list will still show that information.

Deleting the post would be an option, but I assume it will also be somewhat annoying to users, even if it's for their own security. Plus, 10k+ users would still be able to see the post anyway. Our current approach is to ping a community manager who will then destroy the revision. Until that happens, the user's credentials are vulnerable to theft. Thus, to be able to better protect our users and react more quickly, moderators should be able to hide revisions. That would be like providing first aid until the doctor comes.

Possible implementations could be to have a link at each revision to hide the revision (maybe with possible undo). Or a link to flag them to Community managers, which would then hide the revisions until handled and also takes care of the pinging.

To go along with that, we could also introduce a separate flag reason for users that says "Contains credentials, private information or malware". These flags could then show up in the mod flag queue. Since we could filter for those then, we could give them priority handling instead of stumbling over them in "Other".

Note: there is a similar feature request in Edit revisions - possibility to hide a revision for users with the Edit priviledge (2000+ rep) already, but it asks for a user privilege, not a mod-tool. The Accepted Answer suggests to flag such posts. But like explained above, that doesn't help when moderators have to escalate this to a community manager as well.

Note: There is also Ability for mods to hard-delete a question or revisions. It addresses the same problem, but suggests a different implementation. Personally, I'd like hiding better than hard deletion by consensus. We cannot really hard delete anything so hiding would be in accordance with our other options. Also, when the aim is to protect a user quickly, we should be able to take action without having to wait for a consensus.

share|improve this question
16  
I love the idea of 'hiding' them. –  Andrew Barber Jul 30 '13 at 23:15
    
Perhaps two buttons are needed: "hide" to simply hide a revision, and "rollback and hide" to rollback to the last revision (only) and hide the proceeding revision. –  Emrakul Jul 30 '13 at 23:23
    
I thought it is already implemented. Now I am too curious how animuson could hide it. See the revision. –  hims056 Jul 31 '13 at 6:36
2  
@hims056 The way this works is a user or moderator makes an edit that removes the undesired content. Then they get the community team or a developer to hard-delete the original revision. So in that case, animuson made an edit, then a community team member hard-deleted the OP's original revision. –  Cody Gray Jul 31 '13 at 6:43
    
This is a good idea; but it's open to abuse (I know none of you are going to abuse it but still...). It also doesn't destroy the revision. Would it make sense to have all of these actions reviewed by a member of the community team, who can then destroy the revision so the user's personal information is still protected and the moderators actions are double-checked? It removes the potential for abuse but still allows you to act more quickly than you can currently. –  ben is uǝq backwards Jul 31 '13 at 6:44
    
@CodyGray - Okay that means a Community team member was active at that time. –  hims056 Jul 31 '13 at 6:45
    
@benisuǝqbackwards A "link to flag the revisions to Community managers, which would then hide the revisions until handled and also takes care of the pinging" as suggested in my question pretty much achieves that. –  Gordon Jul 31 '13 at 6:55
    
Can someone provide an estimate for how often this happens (eg. once a week in the Trilogy, twice a day across SE, every hour on SO)? –  Double AA Jul 31 '13 at 8:46
2  
@DoubleAA a rough estimate based on the pings I found in the chat suggests three requests per month. That might not be much in quantity, but given the quality of the problem, I don't think we should base the necessity to handle them quickly on these numbers alone. If you'd accidentally put your credentials in a post, you'd want us to protect you, wouldn't you? –  Gordon Jul 31 '13 at 8:55

2 Answers 2

up vote 28 down vote accepted
+50

I like this idea because moderators are almost always the ones that spot this and bring it to our attention.

In order for this to be implemented, we need to be able to soft delete (or hide) revisions. Currently, destroying a revision of a post means just that - hard deleting it. While I'd like to keep that functionality around for the next time someone asks a boat programming question a rainy day (or if we ever really need to hard delete a revision), I'd much prefer just setting a flag on that revision indicating that it's diamond only.

When we get that accomplished, there's positively no reason to keep the feature from moderators. Not going to toss a status on this yet, but I do intend to pick this up after we finish this round of tool improvements.

Update

This isn't nearly as easy as we thought it would be, just due to the way history on posts is recorded and the amount of code that needs to read specific things from that history. However, we've got an idea in the works that would allow moderators to make 'surgical' changes to certain revisions, which we think might actually work.

Not yet sure on time to deployment, but it's something we'd really like to get out soon. I'll continue to update this post as we make progress.

share|improve this answer
    
Note, I have this in our queue of features to discuss for possible implementation, but it might take a week or two before we get a chance to really look at it. –  Tim Post Oct 24 '13 at 13:12
    
That's an excellent option. –  Andrew Barber Nov 20 '13 at 15:23
    
I didn't know you guys could delete revisions. That's why I've never flagged anything like that. –  ɥʇǝS Jan 30 at 4:28

In the case of questions where the OP has added personal details you can as a moderator

  1. Post a new question quoting the old question (or ask the OP to repost a very similar question)
  2. Close the old question
  3. Merge the old question into the new question
  4. Delete the old question

The new question wont have the revision history of the old question, but all answers from the old question will be preserved.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .