How I Learned to Stop Worrying and Love the Edit Rate Limit

Question

Due to a recent change in how grace period edits work, users without the "remove new user restrictions" privilege can no longer take advantage of the grace period — all their edits now create revisions for each edit. This brought up a discussion on whether this new restriction can be abused as there is no rate limit on making edits to one's single post. There are concerns that malicious users can make use of that.

The above lead to a proposal this post is introducing: rate-limit the number of sequential edits to own posts either by users without the "remove new user restrictions" privilege or for all users. Note that the scope of the proposal is limited to own post edits and will not impede prominent editors from doing their job.

The following SEDE query confirms that even on the heaviest traffic site, Stack Overflow, the maximum number of edits made by the author of the post in the first hour of its existence caps at 15 edits (including grace period edits). It is therefore proposed to introduce the limit to a number equal or close to that number (preferably a little smaller) to ensure good-faith users are not affected.

The proposal could also indirectly benefit limiting the impact of rollback wars when authors keep stubbornly reverting edits by other users (as such rollbacks can sometimes account for dozens or even hundreds of revisions) if those were to be included in the rate-limit alongside normal edits.

Answer 1

Your data is skewed due to the recent change to the grace period: out of the top 100 posts shown, three of them were created yesterday.

Without the grace period, it is very likely that we'll see an explosion of these posts with many initial revisions, not due to malice but purely because it is a normal pattern and was previously being masked by the grace period (which is the purpose of the grace period).

IOW: we have no idea what a normal range looks like for initial edits, and won't know for a good bit.

The suggested feature is still reasonable, but the suggested threshold isn't, at least not yet. An employee could query access logs and determine the actual distribution of edits, but failing that I recommend implementing the restriction with an initial threshold set to some unrealistically high value (60-100 per hour) and then lowering it only when faced with either clear evidence of abuse or sufficient data to make a good estimate as to what will allow normal editing behavior without restriction.