L33t Hacking of SE through 404 information leakage

Question

Alternative and much more boring title: Should a 404 result reveal the post title?

I ran across some odd behaviour today. When manually entering a Stack Exchange URL into the address bar¹, if you pick a post number that has been deleted then you still see the old post title along with the 404.

For example, I entered:

• http://webapps.stackexchange.com/questions/34 and the resolved address came back as http://webapps.stackexchange.com/questions/34/what-is-the-best-empire-avenue-stock-to-buy

• And http://stackoverflow.com/questions/3 came back as http://stackoverflow.com/questions/1/where-oh-where-did-the-joel-data-go/3#3²

Note, I'm obviously not a 10k+ user on either of those sites, which is why they 404'd

It's not that big of a deal, but it seems like this leaks information about the site(s) that we may not want exposed.

And since a picture is worth N words:

_{Stuff I probably shouldn't be able to see is highlighted.}

¹_{And why was I manually entering posts like that? Because I was trying to find a benign 404 example from Web Applications that I could share with others because I think their 404 image is hilarious.}
²_{And where did this fabled Joel data go? Inquiring minds want to know!}

Answer 1

We send a HTTP 404 with those pages, what is shown (title, or the whole thing if you have the rep) is just a convenience for the owner of the post or users that have the privilege to see it.

Crawlers see 404 and .. stop caring, and that's really the only case we need to worry about when we consider the ramifications of 'leaking' deleted spammy titles. That hasn't been an issue so far, on any site.

I suppose we could put more moving parts in how we redirect all the things to avoid that, but since it's not at all actively harmful, I don't think it really justifies (what could turn out to be) a somewhat lengthy and frustrating effort.