23

TL;DR:

  • Links in off-topic close reasons are not HTTPS.
  • Links to other sites in migration close reasons are not HTTPS.

NB: This question is tagged "custom close reasons". Those include both the free-form close reasons users can provide, and the per site templated close reasons. I don't know if free-form close reasons also have this problem; I haven't tested it yet, and am reluctant to.

I did a spot-check of a few sites, and this is true for every site I checked.


I'm occasionally active on CodeReview.SE. That means closing questions every now and then (there really aren't that many off-topic ones, thankfully). While I was casting my close-vote, I wrote a comment to let the person know what they'd done wrong, so that they could try to fix it. To help, I copied a link from the off-topic close-vote reason, pasted it, and noticed that it started with http://. Given Stack Exchange's recent migration to SSL, this surprised me, especially considering this bit:

Cleanup all existing user content that was http:// (https:// where possible, and converted to links if we can't embed it securely).

and it being marked with done. While I understand that close reasons are an... esoteric bit of user content, they are still user content, and should probably be retroactively modified. At the very worst, a mass-email to the mods of every site would probably get it changed within a day; there are (if I'm remembering correctly) at most 5 site-specific close reasons. Apparently, that won't work. We need a dev to go in and change them directly.

The generic ones that all sites have are correctly migrated to HTTPS. However, none of the 3 close reasons on CR uses HTTPS links, and the Off-Topic > Migration options don't seem to, either.

I did a spot-check of a few other sites, and this is true for every site I checked.

9
  • No repro in this question's flag dialog or close dialog. Repro in the off-topic close dialog. Apr 22, 2017 at 15:31
  • 12
    Ugh, yeah. Pretty much all the custom off-topic reasons are going to be HTTP links because they were likely written that way when they were created on-site (those aren't generated by the system but are just saved Markdown). They'll all have to be edited by devs (not recreated by moderators, so that the changes will retroactively apply to older posts previously closed with those reasons).
    – animuson StaffMod
    Apr 22, 2017 at 16:20
  • 2
    Can confirm on Stack Overflow, Super User, Software Engineering, Arqade and meta sites for each of them. There are also several links to stackexchange.com/sites on the "should be closed" descriptions on meta sites.
    – Filnor
    Oct 4, 2017 at 10:36
  • 1
    @animuson We appear to have a case of this http-vs-https confusion mentioned on ELU’s meta. Is bugging a dev to edit the old one to make it appear to have been https all along worth the trouble?
    – tchrist
    Jan 14, 2018 at 21:28
  • @animuson Doing another brief spot-check on SO and CR, this seems fixed. If that's the case, could you write up an 'official' answer? Or at least status-completed the question.
    – user248725
    Sep 3, 2018 at 21:15
  • 2
    Not yet fixed on Science Fiction & Fantasy. Some links use https, some links use http, some links are protocol-relative.
    – SQB
    Sep 5, 2018 at 15:15
  • @animuson Would you be willing clarify your comment a bit (or even expand it to an answer)? AFAICT the mods cannot edit custom close reason. But creating a new one with https instead of http would at least improve that situation that the http link would not appear in the posts which are closed from now on. (I understand that fixing the http link which have already been closed can only be done by the developers.)
    – Martin
    May 7, 2022 at 5:06
  • @Martin That's why developers had to update them, yes. If the mods had deleted and recreated it'd leave the http links in all the old posts. But the devs can go in and change the stored markdown, so that posts are retroactively edited.
    – user248725
    Jun 14, 2022 at 0:35

1 Answer 1

9
+50

With the help of the Stack Exchange Data Explorer, it is possible to keep track of all instances of HTTP links in close reasons network-wide. This query lists them all:

enter image description here

The system stores three types of 'guidance', which is the texts we're talking about here. 'Input' is shown while flagging/voting, the other two ('PostOwner', 'PrivilegedUser') are shown to post owners resp. privileged users when the question is actually closed. The query indicates which of those have HTTP links.

The usual caveat applies: SEDE is refreshed only once a week, on Sunday morning. So the results might be a bit stale.

I have no idea whether Stack Exchange deems 92 instances of this worth fixing with a script or not, like what has been done for HTTP links in regular posts. But at least they know the size of the problem now :)

2
  • 2
    Well, 92 seems like a relatively small number. At the same time, whenever such close reason is used, the http link appears in the close notice. (It is visible only to some users - but still, I'd guess it means hundreds or maybe even thousands of posts.)
    – Martin
    May 7, 2022 at 3:56
  • With 92 I'd advise pinging those site's moderators and requesting a manual reopen&reclose.
    – bad_coder
    May 8, 2022 at 3:53

You must log in to answer this question.