6

It's come up quite a few times since Hidden Communities were implemented - users expect privacy and unexpectedly end up losing it all when conversation gets migrated to the chat system. Suddenly their name and network profile are exposed on a message which was once linked to a profile not visibly linked to the rest of the network.

Fixing this in the chat system is unlikely to happen, just because of the way chat exists. You have a single profile which operates for all the sites on our network, minus two. So if you're holding out on being able to participate in a site-specific chat room without linking to the rest of your network activity, don't get your hopes up too high.

However, we can prevent the surprise of suddenly losing anonymity due to no fault of the owner by doing some more pre-processing on the site before the migration of comments to chat actually occurs. A couple of solutions:


Don't migrate messages from users who have the site hidden

Essentially, for each comment under the post look up the owner. If the owner has this site set as hidden, then just delete the comment and don't include it in the list of comments to be migrated into the chat room.

This is the less-than-ideal option because it can effectively destroy a conversation, making the migration to chat somewhat useless. If the entire conversation is between two users and you delete all the messages from one user, then all you're migrating is a one-sided conversation with no context.

Anonymize all messages from users who have the site hidden

Similar to the previous option, we'll need to look at the user. This time if they have the site set as hidden, we simply won't migrate their user data with the comment when it makes it to the new chat room (will show their plain-text display name with no link to their profile).

Assuming there are no major pitfalls with this solution, it'd be ideal because it preserves all messages and has less chance of breaking a conversation while still preventing the user's identity being revealed in chat. But there may be something I'm not thinking of here.


So what am I missing? Anything? Which option would be better for users who utilize the hidden communities feature and why? Or are there other solutions that might work better for this case?

No, we're not adding a site preference so users can choose what happens to their comments in these situations.

  • anonymizing looks better to me but what happens when "anonymized" user gets into chat room (and possibly is surprised to find their messages anonymized - because they will hardly know this obscure technical reason you just explained). What if they would want to join that chat to continue conversation - possibly not knowing that this will expose their hidden communities – gnat Jul 12 '17 at 19:35
  • That's also a tough thing to handle and I don't have a solution for it. But in the meantime, we can still take steps in the right direction. – animuson Jul 12 '17 at 19:38
7

Gotta be honest... I don't like either of these options. They break the expected functionality of the tool, which already has a tendency to break too easily. Even the second option implies that - once migrated - it's no longer possible to determine who posted a given message; it wouldn't be linked to their network account, but also wouldn't be linked to their profile on the site from which it originated. That feels... wrong. Both for the author (who is no longer really attributed) and for the other people in the conversation.

Worth noting here that "hidden communities" are not a bullet-proof privacy option - it's fairly trivial to find the account ID for a given user, and from there the rest of their accounts; at best, the tool exists to discourage casual snooping.

With that in mind, the only way to fix this in ways that doesn't break things is to alter how chat works in some way. Seems to me that the simplest solution is to just re-parent their chat profile when a conversation is moved, associating it with the originating site. Now readers aren't immediately clued in to the fact that they have other sites, which is in keeping with the "weak privacy" philosophy of hidden communities.

| improve this answer | |
  • 1
    Re-parenting would be a viable solution for users who aren't active in chat, but would be irritating for users who do actively participate in chat and one of their conversations somewhere else gets migrated to chat - all of a sudden their parent profile has changed and they're contributing under a different name in their favorite room. I don't think we want users to have to pay attention to whether they're using the correct profile every time they start up a chat room. I'm not opposed to just saying "this doesn't work with hidden communities" but figured it was worth looking at solutions. – animuson Jul 13 '17 at 2:32
  • I don't think there's a solution here that wouldn't be irritating for the user, short of redesigning chat. Something else occurred to me while researching this: the vast majority of these migrations happen because a user clicks that "continue in chat" link in a comment thread - chances are, at least some of them are clicked by the user with the hidden communities. So not only would this end up being weird, it'd end up being weird for the very person who we're trying to spare (incidentally, folks with hidden sites amount to roughly 4% of all accounts "moved" to chat, ever - most long deleted) – Shog9 Jul 13 '17 at 3:15
  • 1
    Quite honestly, I think "hidden communities" is a dead-end - it's a nice feature for profile customization, but we're never going to be able to turn it into a true privacy measure without breaking a lot of stuff that's nice to not have broken, and even if we did it won't do the one thing folks really want: let them get rid of that one embarrassing question. We need a self-serve disassociate function, something that's also a cripplingly difficult thing to do but would at least fill a common need rather than constructing an ever more elaborate ruse. – Shog9 Jul 13 '17 at 3:18
  • I like this solution... I also think that if someone is seriously concerned with both their work-related and non-work content being merged, it would be better for them to have two accounts. – Catija Jul 13 '17 at 3:39
2

The re-parenting mentioned by Shog9 in his answer seems like a good solution to the problem.

I'd like to see all chat profiles re-parented if the chat user has an account on the site linked to the chat room. Many times I've been in the chat room for a site and wanted to look up a user's account for that site. I end up going to their parent account and then having to back track through the network profile. When it's a newer, beta, site, their rep in the current site can be much lower than others, and going through the list of accounts can take a while.

If the re-parenting is only done for messages moved into chat from comments, then their should also be the ability to choose to re-parent the chat user profile on a per-room basis. I can't go into chat in one of my hidden communities that has a unique user name and have that name show in chat. Instead it shows my un-hidden user name. Those in the chat room think I'm not on their site, since the user names don't match. The "privacy" is sort of maintained, since going to the profile for the parent account will not show the hidden community in my network profile, but I'm also, relative to the site, an interloper. OTOH, if I make that site the parent while I'm in that room, then I have to leave, and not even monitor, the other rooms that I keep a presence in, including Charcoal HQ. Otherwise, in all the other rooms, I'm now listed as the user name from the hidden community, and the chat profile will lead directly to that hidden profile. The end result is that I don't use the chat for the hidden community. Being a Beta site, it really needs active members, and while my SE experience is still relatively new, I could be helpful in discussions on that site as we (or they) begin to iron out what the site will be.

| improve this answer | |
  • Re-parenting on a per-room basis is exactly the kind of thing that we'll probably never do. That complicates the system way too much because you're essentially maintaining a separate profile for every room where the user participates. – animuson Jul 13 '17 at 2:28
  • @animuson I can see, and appreciate, the complexity such a change would make in the system, and in the development of the code. It would be nice to have some method of isolating the hidden community chat user from the rest of the SE chats. I've enjoyed the community building in Computer Science Educators and would love to help that other one as well. The complexity of switching chat parent, and dropping out of the other rooms, is just too much from the user's end for me to do it. Would making it an option on a per-site basis at least for hidden communities be out of bounds? – user351780 Jul 13 '17 at 2:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .