11

Due to a recent change in how grace period edits work, users without the "remove new user restrictions" privilege can no longer take advantage of the grace period — all their edits now create revisions for each edit. This brought up a discussion on whether this new restriction can be abused as there is no rate limit on making edits to one's single post. There are concerns that malicious users can make use of that.

The above lead to a proposal this post is introducing: rate-limit the number of sequential edits to own posts either by users without the "remove new user restrictions" privilege or for all users. Note that the scope of the proposal is limited to own post edits and will not impede prominent editors from doing their job.

The following SEDE query confirms that even on the heaviest traffic site, Stack Overflow, the maximum number of edits made by the author of the post in the first hour of its existence caps at 15 edits (including grace period edits). It is therefore proposed to introduce the limit to a number equal or close to that number (preferably a little smaller) to ensure good-faith users are not affected.

The proposal could also indirectly benefit limiting the impact of rollback wars when authors keep stubbornly reverting edits by other users (as such rollbacks can sometimes account for dozens or even hundreds of revisions) if those were to be included in the rate-limit alongside normal edits.

2

1 Answer 1

10

Your data is skewed due to the recent change to the grace period: out of the top 100 posts shown, three of them were created yesterday.

Without the grace period, it is very likely that we'll see an explosion of these posts with many initial revisions, not due to malice but purely because it is a normal pattern and was previously being masked by the grace period (which is the purpose of the grace period).

IOW: we have no idea what a normal range looks like for initial edits, and won't know for a good bit.

The suggested feature is still reasonable, but the suggested threshold isn't, at least not yet. An employee could query access logs and determine the actual distribution of edits, but failing that I recommend implementing the restriction with an initial threshold set to some unrealistically high value (60-100 per hour) and then lowering it only when faced with either clear evidence of abuse or sufficient data to make a good estimate as to what will allow normal editing behavior without restriction.

3
  • 3
    That means something else, Oleg - effectively a grace period rollback. So what I'm suggesting is... We have no way of knowing if 10/hr is way too high or way too low or just right. Given the data for just the initial grace period (and there could potentially be hundreds, and easily be dozens of grace periods in the first hour), my money is on "way too low".
    – Shog9
    May 15, 2022 at 16:36
  • Oh, I forgot those are grace period rollbacks, thanks, @Shog9, my brain short-circuited. At least now I gett what you referred to. Mine is still on it's high enough to discourage dozens of revisions fixing a typo at a time, but at least I get what you mean now! May 15, 2022 at 16:44
  • 4
    Gut feelings are kinda useless for SO's scale - even 1% is still a good number of posts per day, and a lot of potential disruption - so even if 99% of posts get < 15 edits per hour, you could still end up messing with folks (and in this case, folks with the least amount of experience on how to avoid problems). This data should start to get interesting come Monday...
    – Shog9
    May 15, 2022 at 16:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .