13

In Chat, if you delete a message, and then paste a permalink to that message, the onebox will show the full content of the "deleted" message. This works for non-moderators (verified on chat.SO).

revealed deleted chat message

It's possible to get the message ID of a deleted message by using the web inspector to check its element ID, so you can therefore construct the permalink for any deleted message and view its contents by this message.

As moderators we often remove content when it has personally identifiable information or otherwise must be removed; this circumvents the ability to remove posts. To fully remove a chat post, you would have to edit its content to be empty, then purge its history, then delete it. Once it's been deleted you can't edit it, so any deleted message that wasn't edit-purge-deleted is permanently accessible.

Improve this question
11
  • To that end I still don't get why the purge history leaves the latest revision visible without any option to have it do otherwise.
    – Tim Stone
    Jun 3, 2015 at 5:52
  • Trivia: you can edit deleted messages. Ask me why I had to know this...
    – Shog9
    Jun 3, 2015 at 5:54
  • @TimStone Pardon my lack of understanding how chat works on a regular basis, but... what do you mean by "purge history"?
    – Adam Lear StaffMod
    Jun 3, 2015 at 5:54
  • @AnnaLear That button under "Message History". Pressing it clears the bits at the bottom but the rendered message at the top remains afterward. So you have to edit the message to say something else then purge the history, in cases where the latest revision was what needed to be purged. (post-purge example)
    – Tim Stone
    Jun 3, 2015 at 5:58
  • @Shog9 Huh, indeed. I thought I had tried that before and it didn't work. Or maybe it did work and I'm just now doubting myself. Seems likely.
    – Tim Stone
    Jun 3, 2015 at 6:01
  • @TimStone Huh, interesting. In principle, I'd argue that "purge history" does literally what it says on the tin - it doesn't say "purge message" and it ain't history until you got back at least one message... But this is a weird argument to make. A lot of our chat moderation tools need work.
    – Adam Lear StaffMod
    Jun 3, 2015 at 6:03
  • @AnnaLear Yeah, I've always taken it as balpha "Technically…"-trolling us, but despite that it's probably not the most useful behaviour. There's unfortunately a number of things in chat that I'd be super stoked to see fixed since they're low-hanging fruit, but also hard to justify priority-wise :(
    – Tim Stone
    Jun 3, 2015 at 6:06
  • 1
    @TimStone I bet a number of them are low-hanging because nobody knows they exist and therefore wouldn't miss whatever the current behaviour is... ;)
    – Adam Lear StaffMod
    Jun 3, 2015 at 6:12
  • @Shog9 OK I'll ask... why did you have to know this? And uh... how?
    – nhinkle
    Jun 3, 2015 at 7:58
  • @AnnaLear You mean we're not complaining loud enough about chat? I think we can change that ;-)
    – Mad Scientist
    Jun 3, 2015 at 13:49
  • Because Josh Gitlin, @nhinkle.
    – Shog9
    Jun 3, 2015 at 20:05

2 Answers 2

Reset to default
7

In general, the oneboxing will work in every case where the person posting the message permalink has access to the message's content. So, say, if you, in a public room, post a permalink to a message in a non-public room that you have access to, it will onebox (the reasoning being that you might as well copy & paste the content). This even works across chat sites (e.g. a message in a moderator room on chat.SE, posted into the Tavern on chat.MSE). So this isn't really a security or privacy issue.

However you're absolutely correct that it makes no sense in this case. A deleted message has no "content" anymore that could be oneboxed. Yes, it still has a history and you may have access to it, but there is no message history oneboxing, only message content oneboxing.

From the next build on, deleted messages won't be oneboxed anymore, in any case.

Improve this answer
0
7

This is possible, but you should not worry that people can view your deleted messages: it only works when you can actually see the content (here you can see the testing I did). As the message poster, you can see the history, so you can onebox the message. I, as a room owner of the Sandbox, can also see the history of a deleted message, so I can onebox it. But when my chatbot account tries to onebox it, it fails, because it cannot see the original message content.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .