42

I flagged a comment to one of my answers and then deleted the answer. Then I went to my flagging summary and was surprised to see that my flag has been marked as helpful. Went back to the post and saw that the comment was still here.

Ok. To check my assumptions, I've flagged the comment again, and then undeleted-deleted the answer. The flag has been marked as helpful again.

the flag history, as described above

Is it intentional though? I did flag the comment because it contained sensitive information, and I did want it to be removed, regardless of whether my answer is deleted or not.

Improve this question
11
  • Haven't voted yet. I think deleting a post did mark flags as helpful, and that was expected. Imagine some new user on SO being angry at your profile pic so when you commented under their NAA they started to insult you. Then when the answer gets deleted, your comment flags shouldn't remain on the air, should they?
    – M.A.R.
    Commented Jun 19, 2016 at 9:32
  • 3
    @TIPS That's a good example, but probably it shouldn't be the case with the custom flags (flagged with "custom")?
    – nicael
    Commented Jun 19, 2016 at 9:36
  • Mhm maybe. If I understand correctly, custom flags on removed posts remain intact.
    – M.A.R.
    Commented Jun 19, 2016 at 9:38
  • @TIPS But I've flagged with "custom" in the both cases.
    – nicael
    Commented Jun 19, 2016 at 9:38
  • You mean a custom-flag on the post also was marked as helpful?
    – M.A.R.
    Commented Jun 19, 2016 at 9:40
  • @TIPS On the comment, not the post.
    – nicael
    Commented Jun 19, 2016 at 9:41
  • 10
    I see the potential for an easy Marshal badge ...
    – zondo
    Commented Jul 8, 2016 at 2:32
  • 1
    I'm fairly certain this is status-bydesign.
    – ale
    Commented Jul 8, 2016 at 13:13
  • 1
    A related fact I learned the other day: comments on deleted posts can still be flagged (which surprised me).
    – Rand al'Thor
    Commented Jul 8, 2016 at 13:19
  • Has someone observed a duplicate flag as helpful if the post is deleted?
    – anki
    Commented Sep 25, 2019 at 2:55
  • @nicael if only this had any effect on SE staff... but it doesn't.
    – Shadow Wizard
    Commented Sep 25, 2019 at 8:38

4 Answers 4

Reset to default
19
+100

This is a way someone could use to easily game the system. Someone could do that over and over and unrightfully earn a million helpful flags (And unrightfully have 100 flags per day and flagging-badges.) In my opinion, the flag should not be automatically marked as anything (neither helpful nor declined.) This should definitely be fixed as soon as possible.

Improve this answer
4
  • 3
    Self-deletes are quite rigidly rate-limited and observed.
    – quid
    Commented Jul 9, 2016 at 13:56
  • 6
    @quid Self-deletes are rate-limited when it comes to actually deleting the post (and not undeleting later that day). Deleting&undeleting the post is not rate-limited.
    – nicael
    Commented Jul 9, 2016 at 16:04
  • 2
    @nicael I was not aware of this. I take back my remark.
    – quid
    Commented Jul 9, 2016 at 16:09
  • 3
    "should not be automatically marked as anything": have it marked as "moot".
    – Raedwald
    Commented Sep 23, 2019 at 10:39
19
+50

This is a privilege escalation attack, plain and simple. Using this, a non-moderator user can instruct the Community ♦ user to take disciplinary action against other users. In fact, they can answer ban other users under the right conditions – I've confirmed this (details not disclosed for obvious reasons). It's also difficult for moderators to detect when this is going on unless they're specifically looking for it – most moderators are aware of the issue, but this is still another thing for them to look out for.

Once this is fixed, we'd need a script to detect when people have been banned via this method, so moderators can review each case and correct them if necessary.

Updates:

  • A viable, sophisticated proof of concept attack has been developed (moderator-only), involving this and some other (more deliberate) site features, to efficiently ban medium-sized groups of helpful, high-contributing users from day-old accounts. This is serious.
Improve this answer
7
  • 7
    There’s no such thing as a comment ban. Post flags are not cleared (if I remember correctly).
    – Catija Staff
    Commented Sep 21, 2019 at 14:34
  • 1
    "they can probably answer ban other users under the right conditions." What conditions are those? Answer bans work through an automated system whose exact working is unknown. So unless one of the powers that be said that answers on deleted questions count against you, it's not clear that they do. Also, it would be really difficult to specifically target someone, as they would have to answer multiple questions from the same user, while not answering questions from other users.
    – Nicol Bolas
    Commented Sep 21, 2019 at 15:15
  • 8
    While there are no automatic comment bans, there are automatic moderator flags raised against users for having too many comment deleted as abusive, and this may lead to a human moderator incorrectly suspending the user.
    – Sonic the Anonymous Hedgehog
    Commented Sep 21, 2019 at 15:36
  • The link you posted is 404; are you sure you copied it correctly?
    – Sonic the Anonymous Hedgehog
    Commented Sep 24, 2019 at 22:02
  • 2
    @SonictheAnonymousHedgehog The link goes to a chat transcript for a moderator only chat room. We're also discussing this on the moderator team site, so it's probably an accident.
    – ColleenV
    Commented Sep 25, 2019 at 1:34
  • 2
    Perhaps this update would have better been shared with the dev team directly, rather than providing clues to those that are ill-intended.
    – Luuklag
    Commented Sep 25, 2019 at 8:43
  • 1
    @Luuklag It's unlikely that they'll be able to figure out this proof of concept, since it requires intimate knowledge of the site's behaviour in order to successfully deploy. For instance, very few people will know how to trigger automatic user merges with the new system. But it's the principle of the thing – this attack is possible.
    – wizzwizz4
    Commented Sep 25, 2019 at 16:59
8

When I was a moderator on ELL, I cast a binding close vote on a question with the comment that it was being closed because it wasn't about English. The author had already flagged a similar comment by a user as unfriendly, and I declined that flag. (It was actually the flag on the comment that brought the question to my attention as something that was off-topic.) The author of the question flagged the user's comment a second time, but as "abusive" instead of "unfriendly".

Then the author flagged my "Other" closure comment as abusive and deleted their post, which marked their flags against my comment and the other user’s comment as "Helpful".

Is authors being able to resolve flags on comments on their posts intended behavior? If I hadn't been involved as a moderator, it would have never come to my notice that the author had been able to resolve their own comment flags as "helpful".

After bringing this up on the moderators' SE team site, wizzwizz4 was able to determine that flags on answers could be similarly resolved by self-deleting content, which is a bit more concerning because there are actual penalties associated with rude/abusive flags on answers; "helpful" comment flags just cause moderators to be notified when there are too many raised against a particular user's content.

I'm a bit worried that users will be able to target other users by flagging content, resolving those flags by deleting their post, undeleting their post and flagging the content again repeatedly, although I suspect there may be safeguards in place against that already and someone would need to do some sophisticated sock puppetry to get around them.

I don't think comment flags getting resolved is very serious or that it merits going back and correcting previously resolved flags (at least on ELL, which probably has very few instances of this happening because we've never received a single notification of someone getting too many unfriendly flags). I would like to be reassured that while this can happen in ones and twos, a malicious user isn't able to exploit this mechanic in a way that's difficult for moderators to catch before it's already done damage.

Improve this answer
3
  • 1
    "I would like some reassurances that while this can happen in ones and twos, a malicious user isn't able to exploit this mechanic in a way that's difficult for moderators to catch before it's already done damage." I can assure you that a malicious entity is able to perform such an exploit – and I'm still coming up with ways to make it harder to detect (stuff like exploiting intricacies of user merges ­– though I don't expect the average attacker to have the knowledge to synthesise such things). This answer is just on the border of revealing non-public info, though, so be careful editing!
    – wizzwizz4
    Commented Sep 26, 2019 at 15:54
  • 1
    @wizzwizz4 Yes, I tried to be careful. I was really addressing it to whoever might be trying to think of a solution to implement since this has moved to review status.
    – ColleenV
    Commented Sep 26, 2019 at 16:20
  • 2
    Oh, by the way: anybody thinking to try the method described in this answer should know that I tried it, and it doesn't work. If you figure one out that you think does work, please contact Stack Overflow employees in private to let them know.
    – wizzwizz4
    Commented Sep 26, 2019 at 16:22
6

If someone is the post owner, any flags they leave are intentionally marked as helpful, unless they fall into the category type of IsPostOffensiveSpam.

Improve this answer
1
  • 4
    Do you have a comment on the possible abuse this opens up, noted by other answers?
    – bobble
    Commented Nov 2, 2021 at 18:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .