38

I flagged a comment to one of my answers and then deleted the answer. Then I went to my flagging summary and was surprised to see that my flag has been marked as helpful. Went back to the post and saw that the comment was still here.

Ok. To check my assumptions, I've flagged the comment again, and then undeleted-deleted the answer. The flag has been marked as helpful again.

the flag history, as described above

Is it intentional though? I did flag the comment because it contained sensitive information, and I did want it to be removed, regardless of whether my answer is deleted or not.

  • 3
    And the downvote is here because?.. Do you find this behavior expected? – nicael Jun 19 '16 at 9:29
  • Haven't voted yet. I think deleting a post did mark flags as helpful, and that was expected. Imagine some new user on SO being angry at your profile pic so when you commented under their NAA they started to insult you. Then when the answer gets deleted, your comment flags shouldn't remain on the air, should they? – M.A.R. Jun 19 '16 at 9:32
  • 2
    @TIPS That's a good example, but probably it shouldn't be the case with the custom flags (flagged with "custom")? – nicael Jun 19 '16 at 9:36
  • Mhm maybe. If I understand correctly, custom flags on removed posts remain intact. – M.A.R. Jun 19 '16 at 9:38
  • @TIPS But I've flagged with "custom" in the both cases. – nicael Jun 19 '16 at 9:38
  • You mean a custom-flag on the post also was marked as helpful? – M.A.R. Jun 19 '16 at 9:40
  • @TIPS On the comment, not the post. – nicael Jun 19 '16 at 9:41
  • 1
    @Pandya Thanks, couldn't pick a better title :) – nicael Jun 19 '16 at 10:05
  • 8
    I see the potential for an easy Marshal badge ... – zondo Jul 8 '16 at 2:32
  • 1
    I'm fairly certain this is status-bydesign. – ale Jul 8 '16 at 13:13
  • A related fact I learned the other day: comments on deleted posts can still be flagged (which surprised me). – Rand al'Thor Jul 8 '16 at 13:19
  • 2
    This is a security breach! Someone could do that over and over and unrightfully earn a million helpful flags (And unrightfully have 100 flags per day.) In my opinion, the flag should not be automatically marked as anything (neither helpful nor declined.) This should definitely be fixed as soon as possible. – John Militer Jul 8 '16 at 22:59
  • 1
    @John Nice point, and also it wouldn't be bad to have it as an answer. – nicael Jul 9 '16 at 11:04
  • Has someone observed a duplicate flag as helpful if the post is deleted? – ankii Sep 25 at 2:55
  • @nicael if only this had any effect on SE staff... but it doesn't. – Shadow The Princess Wizard Sep 25 at 8:38
15
+100

This is a way someone could use to easily game the system. Someone could do that over and over and unrightfully earn a million helpful flags (And unrightfully have 100 flags per day and flagging-badges.) In my opinion, the flag should not be automatically marked as anything (neither helpful nor declined.) This should definitely be fixed as soon as possible.

  • 2
    Self-deletes are quite rigidly rate-limited and observed. – quid Jul 9 '16 at 13:56
  • 5
    @quid Self-deletes are rate-limited when it comes to actually deleting the post (and not undeleting later that day). Deleting&undeleting the post is not rate-limited. – nicael Jul 9 '16 at 16:04
  • 2
    @nicael I was not aware of this. I take back my remark. – quid Jul 9 '16 at 16:09
  • 3
    "should not be automatically marked as anything": have it marked as "moot". – Raedwald Sep 23 at 10:39
14
+50

This is a privilege escalation attack, plain and simple. Using this, a non-moderator user can instruct the Community ♦ user to take disciplinary action against other users. In fact, they can answer ban other users under the right conditions – I've confirmed this (details not disclosed for obvious reasons). It's also difficult for moderators to detect when this is going on unless they're specifically looking for it – most moderators are aware of the issue, but this is still another thing for them to look out for.

Once this is fixed, we'd need a script to detect when people have been banned via this method, so moderators can review each case and correct them if necessary.


Updates:

  • A viable, sophisticated proof of concept attack has been developed (moderator-only), involving this and some other (more deliberate) site features, to efficiently ban medium-sized groups of helpful, high-contributing users from day-old accounts. This is serious.
  • 7
    There’s no such thing as a comment ban. Post flags are not cleared (if I remember correctly). – Catija Sep 21 at 14:34
  • 1
    "they can probably answer ban other users under the right conditions." What conditions are those? Answer bans work through an automated system whose exact working is unknown. So unless one of the powers that be said that answers on deleted questions count against you, it's not clear that they do. Also, it would be really difficult to specifically target someone, as they would have to answer multiple questions from the same user, while not answering questions from other users. – Nicol Bolas Sep 21 at 15:15
  • 8
    While there are no automatic comment bans, there are automatic moderator flags raised against users for having too many comment deleted as abusive, and this may lead to a human moderator incorrectly suspending the user. – Sonic the Reinstate Monica-hog Sep 21 at 15:36
  • The link you posted is 404; are you sure you copied it correctly? – Sonic the Reinstate Monica-hog Sep 24 at 22:02
  • 2
    @SonictheAnonymousHedgehog The link goes to a chat transcript for a moderator only chat room. We're also discussing this on the moderator team site, so it's probably an accident. – ColleenV parted ways Sep 25 at 1:34
  • 2
    Perhaps this update would have better been shared with the dev team directly, rather than providing clues to those that are ill-intended. – Luuklag Sep 25 at 8:43
  • 1
    @Luuklag It's unlikely that they'll be able to figure out this proof of concept, since it requires intimate knowledge of the site's behaviour in order to successfully deploy. For instance, very few people will know how to trigger automatic user merges with the new system. But it's the principle of the thing – this attack is possible. – wizzwizz4 Sep 25 at 16:59
3

As a moderator on ELL, I cast a binding close vote on a question with the comment that it was being closed because it wasn't about English. The author had already flagged a similar comment by a user as unfriendly, and I declined that flag. (It was actually the flag on the comment that brought the question to my attention as something that was off-topic.) The author of the question flagged the user's comment a second time, but as abusive instead of unfriendly.

Then the author flagged my "Other" closure comment as abusive and deleted their post, which marked their flags against my comment and the other user’s comment as "Helpful".

Is authors being able to resolve flags on comments on their posts intended behavior? If I hadn't been involved as a moderator, it would have never come to my notice that the author had been able to resolve these comment flags.

After bringing this up on the moderators' SE team site, wizzwizz4 was able to determine that flags on answers could be similarly resolved by self-deleting content, which is a bit more concerning because there are actual penalties associated with rude/abusive flags on answers; comment flags just cause moderators to be notified when there are too many.

I'm also a bit worried that users will be able to target other users by flagging content, resolving those flags by deleting their post, undeleting their post and flagging the content again repeatedly, although I suspect there may be safeguards in place against that already and someone would need to do some sophisticated sock puppetry to get around them.

I don't think comment flags getting resolved is very serious or that it merits going back and correcting previously resolved flags (at least on ELL, which probably has very few instances of this happening because we've never received a single notification of someone getting too many unfriendly flags). I would like to be reassured that while this can happen in ones and twos, a malicious user isn't able to exploit this mechanic in a way that's difficult for moderators to catch before it's already done damage.

  • 1
    "I would like some reassurances that while this can happen in ones and twos, a malicious user isn't able to exploit this mechanic in a way that's difficult for moderators to catch before it's already done damage." I can assure you that a malicious entity is able to perform such an exploit – and I'm still coming up with ways to make it harder to detect (stuff like exploiting intricacies of user merges ­– though I don't expect the average attacker to have the knowledge to synthesise such things). This answer is just on the border of revealing non-public info, though, so be careful editing! – wizzwizz4 Sep 26 at 15:54
  • 1
    @wizzwizz4 Yes, I tried to be careful. I was really addressing it to whoever might be trying to think of a solution to implement since this has moved to review status. – ColleenV parted ways Sep 26 at 16:20
  • 2
    Oh, by the way: anybody thinking to try the method described in this answer should know that I tried it, and it doesn't work. If you figure one out that you think does work, please contact Stack Overflow employees in private to let them know. – wizzwizz4 Sep 26 at 16:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .