35

I recently realized1 that some users, when linking to an Area 51 proposal in their profiles, link directly to the "follow" link. This means that simply clicking on the profile link will automatically make you follow the proposal!

So, for example, a user would have something like this in their profile:

Check out my cool proposal!

Where the link, instead of just linking to https://area51.stackexchange.com/proposals/123/foo, would link to https://area51.stackexchange.com/proposals/123/foo?follow=1.

That seems to me like a very sneaky, underhanded way to artificially inflate interest in your proposal. Don't do that! Proposals should survive, or not, on their own merit and not by using this sort of dirty trick to force people to follow.

Yes, you can indeed click on "unfollow" and remove yourself but:

  1. It is easy to miss that you followed in the first place since you didn't actually click on any "follow" link.
  2. Refreshing the page will immediately make you follow again since the URL is pointing to the follow=1.
  3. It's cheating, dammit!

So, when advertising proposals you are interested in, don't cheat. Link to the proposal page and don't try to trick others into following it. Let them make their own choice.


1 "Recently realized" as in I found a link to a proposal on a user's profile, couldn't believe anyone had actually seriously made a proposal about that, clicked on it and was suddenly following something I have no wish to be associated with in any way. The user who had done this (with whom I have no issue since they were quite willing to fix the link when I asked them to) told me that "many people do this". Hence this post.

  • Well, now you've just gone and told everyone how they can cheat to get more followers to their proposals. – Rand al'Thor Jun 7 '17 at 13:29
  • @randal'thor ...and warned them of what will happen if they do. :) – anonymous2 Jun 7 '17 at 13:32
  • @randal'thor I was asked if this was against the rules. Some people need an external rule book, so I wanted something to point them to. – terdon - stop harming Monica Jun 7 '17 at 13:41
  • Could this be easily prevented by adding a confirmation? I don't Web stuff, so I don't know the implications or diffulty of making folks confirm 'following' in a way that can't be embedded in a url. – ColleenV Jun 7 '17 at 13:44
  • 7
    Noted. This is on top of my priority list. – Jon Chan Jun 7 '17 at 14:34
  • @Randal'Thor WP:BEANS – OldBunny2800 Jun 12 '17 at 21:17
24

This has been fixed. Any URL to a proposal with follow=1 will no longer automatically cause the visitor to follow. This should also prevent any existing links from causing an auto-follow as well.

  • 2
    Nice! Although I am now tempted to complain that you have yet again redefined the meaning of 6-8 weeks ;P Joking apart, thank you I appreciate the quick fix. – terdon - stop harming Monica Jun 7 '17 at 15:57
  • @terdon urgent bugs or security breaches were always fixed very fast, literally ASAP. 6-8 weeks meme applies to the non critical bugs. – Shadow The Princess Wizard Jun 9 '17 at 19:06
21

Actually I consider this as a security breach, aka CSRF attack:

Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing

Worth to mention that CSRF breach I found in the past was fixed quickly by the team. (Less than hour after reporting.)

SE team should fix this breach ASAP.

  • 1
    Personally I'm wondering why following a proposal is done by an http GET. Surely it should be a POST? – AakashM Jun 7 '17 at 14:42
  • 1
    @Aakash Area 51 is very old, the code for it was written about 7-8 years ago when everything was different, don't think the term CSRF existed back then. It was like a generation ago. Doing it via GET is easier to code, don't think the developers back then put any thought into it. – Shadow The Princess Wizard Jun 7 '17 at 14:47
10

I strongly agree. I have been tricked into the same thing, and even double tricked when I refreshed the page and it re-followed me.

To me, this is gaming the system in an unhealthy way. As you said, it makes proposals look like they have more support than they actually do, but furthermore, it could become a nuisance to users when they are alerted that a proposal they followed is entering the Commitment phase, and they realise that they actually assisted a proposal for which they have no interest whatsoever in moving to the next phase.

To me, it's about equivalent to linking in your profile to follow your Facebook or Twitter account, +1 a Google+ post, or upvote an answer on Stack Overflow. It's sneaky, unhealthy, and basically cheating users by gaining an unfair advantage for your proposal off their backs.

If you see it, by all means flag for moderator attention.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .