PSA: When linking to an Area 51 proposal, don't link directly to "follow"!

Question

I recently realized¹ that some users, when linking to an Area 51 proposal in their profiles, link directly to the "follow" link. This means that simply clicking on the profile link will automatically make you follow the proposal!

So, for example, a user would have something like this in their profile:

Check out my cool proposal!

Where the link, instead of just linking to https://area51.stackexchange.com/proposals/123/foo, would link to https://area51.stackexchange.com/proposals/123/foo?follow=1.

That seems to me like a very sneaky, underhanded way to artificially inflate interest in your proposal. Don't do that! Proposals should survive, or not, on their own merit and not by using this sort of dirty trick to force people to follow.

Yes, you can indeed click on "unfollow" and remove yourself but:

1. It is easy to miss that you followed in the first place since you didn't actually click on any "follow" link.
2. Refreshing the page will immediately make you follow again since the URL is pointing to the follow=1.
3. It's cheating, dammit!

So, when advertising proposals you are interested in, don't cheat. Link to the proposal page and don't try to trick others into following it. Let them make their own choice.

---

¹ _{"Recently realized" as in I found a link to a proposal on a user's profile, couldn't believe anyone had actually seriously made a proposal about that, clicked on it and was suddenly following something I have no wish to be associated with in any way. The user who had done this (with whom I have no issue since they were quite willing to fix the link when I asked them to) told me that "many people do this". Hence this post.}

Answer 1

This has been fixed. Any URL to a proposal with follow=1 will no longer automatically cause the visitor to follow. This should also prevent any existing links from causing an auto-follow as well.

Answer 2

Actually I consider this as a security breach, aka CSRF attack:

Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing

Worth to mention that CSRF breach I found in the past was fixed quickly by the team. (Less than hour after reporting.)

SE team should fix this breach ASAP.

Answer 3

I strongly agree. I have been tricked into the same thing, and even double tricked when I refreshed the page and it re-followed me.

To me, this is gaming the system in an unhealthy way. As you said, it makes proposals look like they have more support than they actually do, but furthermore, it could become a nuisance to users when they are alerted that a proposal they followed is entering the Commitment phase, and they realise that they actually assisted a proposal for which they have no interest whatsoever in moving to the next phase.

To me, it's about equivalent to linking in your profile to follow your Facebook or Twitter account, +1 a Google+ post, or upvote an answer on Stack Overflow. It's sneaky, unhealthy, and basically cheating users by gaining an unfair advantage for your proposal off their backs.

If you see it, by all means flag for moderator attention.