29

As indicated in this answer, it's possible for a user to approve an edit by electing to first improve it, then submitting no additional changes. This validates the suggested edit, but because no additional changes are made by the "improver", the secondary revision is not saved as per normal rules.

This can be used on sites that require multiple approvers to circumvent the number of required approvers. And, worse and more severe, regardless of the approver requirements the approval is attributed to the Community user only. I don't know if the devs can actually see the failed revision submission or if they otherwise track the "improver", but it's otherwise a very big hole: the person approving the edit is effectively anonymous - a malicious editor could potentially propose an edit without logging in, and then log in to improve/approve it, resulting in a completely anonymous edit being made.

Improve this question
9
  • Now that is scary.
    – BoltClock's a Unicorn
    Commented Apr 8, 2011 at 14:05
  • And: it already has happened a lot on Stack Overflow!
    – Arjan
    Commented Apr 8, 2011 at 14:09
  • 3
    @Arjan Keep in mind, Community also approves legitimate improve actions. This is only when the "improve" is just an "approve".
    – Grace Note StaffMod
    Commented Apr 8, 2011 at 14:11
  • @Arjan: those aren't all instances of this problem. If you take a look, most do have subsequent revisions submitted by the improving approver. You can tell because the revision timestamps match.
    – Shog9 Mod
    Commented Apr 8, 2011 at 14:13
  • @Arjan A legitimate approve will typically be followed by the "improver" submitting an additional revision. The reason this works is because the "improver" is submitting as normal, but because there's no changes, it isn't documented.
    – Grace Note StaffMod
    Commented Apr 8, 2011 at 14:14
  • I just did exactly what Shog9 and Grace Note are referring to. My revision came 1 second after the suggested edit, which I clicked Improve on.
    – BoltClock's a Unicorn
    Commented Apr 8, 2011 at 14:15
  • Ah, right @Shog & Grace. I now understand it just doesn't show on the suggested edits, which is perfectly okay of course.
    – Arjan
    Commented Apr 8, 2011 at 14:16
  • what will this do to the user originally suggesting the edit? will it no longer count as an approved edit as well?
    – Tobias Kienzler
    Commented Apr 8, 2011 at 14:21
  • 2
    @Tobias It is treated the exact same as any other form of improvement - you get the +2 rep if applicable and it counts as an edit. The only real effect is the cancelling of the following matching revision, which has no impact on the original edit suggestor. In essence, this is just a fatefully bad collision of two otherwise normal and sensible mechanics of the system.
    – Grace Note StaffMod
    Commented Apr 8, 2011 at 14:22

2 Answers 2

Reset to default
6

Edit: This is fixed! Now you cannot Improve it, without doing any changes.

I used to say that is abusable, but nobody with 2000+ will abuse since their reps are more important.

So it is not really as dangerous as people think. But probably a fix will do.

And I sometimes do that on small edits, code formatting stuffs, that I know my vote alone is enough.

Edit: Regarding Anonymity, I also don't think It is correct. It should show my name, instead of Community User on Approve.

Improve this answer
2
  • 1
    There is no reputation penalty to the 2000+ user for doing this. In fact, because they can't be attributed to the act (and thus cannot be subject to revenge downvoting for that act), it's actually safer for them if they're concerned for their reputation. The anonymity is the much larger issue, we have a system to track who is approving these so that we can detect when users are approving things and who might be making good/bad approvals. This really mars that.
    – Grace Note StaffMod
    Commented Apr 8, 2011 at 14:10
  • Hmmm, thinking about it, that must have been quite a difficult change! I guess a suggested edit now is not removed from the list, just in case you don't change anything after clicking "Improve". Then, while you're improving, someone may actually accept or reject the suggested edit? Nice!
    – Arjan
    Commented Apr 27, 2011 at 10:09
12

This can be used on sites that require multiple approvers to circumvent the number of required approvers.

That's fine. That's... kinda the point. The approving/improving user has edit rights, so he could do all sorts of stupid stuff - we trust them not to.

And, worse and more severe, regardless of the approver requirements this is anonymous as to who did it

This could be a problem. Either the approving user's name should be shown next to Community in the approval record, or the system should reject improvement-approvals when no changes (== no revision entry) would be recorded.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .