2

As it looks like, post revisions are public.

Sometimes, a new user (or somebody who did not think long enough) posts code samples that contain real-world data that should probably not have been there in the first place. Like in this question: Double byte Unicode shown as 2 characters by classic ASP.

Now when the person corrects the mistake and uses harmless data instead, search engines will still happily index the old revision, so somebody might find data through a regular search that was never really intended to be public.

Adding "nofollow" to the links that point to revision pages would prevent that kind of disclosure. So:

  1. Did I get the facts right (about search engines seeing revisions)?
  2. Would it make sense to prevent this for protection of the lightheaded (and the third-parties that do not even know that their data has been disclosed)?
  3. Would it break useful functionality?
Improve this question
2

2 Answers 2

Reset to default
4

This is already handled through robots.txt so revisions are not indexed.

Typical revision url:
https://stackoverflow.com/posts/nnnnnnn/revisions

robots.txt:

User-Agent: *
Disallow: /posts
Disallow: /posts/
Improve this answer
1
  • That'll teach me to go off of what I know is correct from memory rather than checking. (Actually, it probably won't.) This is a little disappointing though, for my use case of searching for an old post. Am I the only person who associates SO posts -- among other things -- with random words/phrases that were on the page?
    – Pops
    Commented Jul 15, 2010 at 17:46
1

nofollow could help in the situation you describe, but that's security through obscurity, and contains some holes. Humans can still — intentionally or otherwise — view the history and see the sensitive stuff. Malicious or stupid web crawlers could still do so as well.

Furthermore, it might be nice for search engines to see history of pages that don't contain sensitive info. Sometimes I come across a problem and immediately think "I saw something about that on SO eight months ago!" If the post has been edited since then, I still want to be able to find it.

Seems to me the solution is having the team do a hard sanitize.

Improve this answer
1
  • While non-conforming crawlers would ignore robots.txt, it is unlikely that they are the base of any widely-used search engine. I was thinking about the "somebody enters a person's name into Google"-case, where results with personal data could show up. A user that knows where to look can of course still find it, but this case is wildly improbable in comparison. Sure it is "security through obscurity", strictly speaking. But anything about robots.txt or rel="nofollow" is, really. Nevertheless, it's a convention that works. What you can't find through Google does not exist.
    – Tomalak
    Commented Jul 15, 2010 at 17:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .