3

One of the 10k privileges is the ability to see reviews by other users in the review history pages, e.g. https://meta.stackexchange.com/review/close/history. (With less reputation, you only see your own reviews – a low-rep user can't make much use of the page unless they previously had enough reputation to review.)

However, reviews are accessible, even to logged-out users, if they know the URL of the review. Review URLs follow a fairly predictable pattern, with reviews being given consecutive numbers, so if you want to find out what reviews have been happening recently, you can do so simply via URL enumeration: you can try a review number in every review queue until you find the appropriate URL, and work out what the "current" review number is via bisection. This is an approach which I've used when I'm curious about what the current state of reviewing is on exchanges where I don't have much reputation.

This seems like a problem, though, regardless of whether or not the information is meant to be publicly available:

  • If the information is not meant to be publicly available, then the ability for logged-out users to access it means anyway that something has gone wrong with the security behind the site.
  • If the information is meant to be publicly available (and I can't think of a reason to hide it – being able to see what reviewers are up to may well be a good way of learning how to use the review queues correctly), the current method of accessing it creates a lot of extra server load for both the viewer, and for Stack Exchange (because there are multiple review queues, and lots of network round-trips are wasted by incorrectly guessing which queue a review will belong to, and many more trying to figure out what the most recent review number is).

Probably, most low-reputation users aren't trying to read the review history anyway, but the current situation is unsatisfactory when they do (and there are plenty of people who have high reputation on some Stack Exchange sites and low reputation on others, so there will be plenty of low-rep users who know that the review history page exists).

It's unclear what the best way to fix the inconsistency is – making the review history page work via direct URL entry (without linking it anywhere) would almost be the simplest fix, but the same URL is used for the "view your reviews" page as for the "view everyone's reviews" page, which complicates things a lot because users can access the page itself before they hit 10k reputation but are only "supposed" to be able to access half its content. Perhaps this shouldn't be a 10k privilege – it's unclear why 10k users would find the information more useful than lower-reputation users (as there isn't really much they can do about it).

2
  • 4
    This isn't really any different from the vote counta being visible to everyone, just not conveniently available by clicking on the score until a reputation threshold. Review information is also available via Data Explorer so you don't even need to enumerate. You can just go download it all into a CSV if you really want it.
    – animuson StaffMod
    Jun 18 at 21:46
  • Another note is that all reviews of a user are publicly available to users with and without 10K tools should they go to said user's profile page and open the "all actions" tab. For this to work, the unlinked review pages must be accessible, so it all works as intended. That said, there is some merit in giving access to the history of others to users with at least a corresponding review privilege (2K -> suggested edits, 3K -> CV/RV, 5K -> tag wikis/excerpts), however, the benefits would be marginal (i.e. devs of moderation bots without 10K). Jun 19 at 18:58

1 Answer 1

4

I think the review queues are appropriately locked down as they are.

Reviews are not always so useful for low rep users to have access to, since they can't see deleted posts (except under specific conditions, including having reviewed it themselves).

See this deleted question review. A low rep user gets more information from that page than they would otherwise, but not the body of the post, which is the most important part. And this, I believe, is why the list of reviews unlocks with the same privilege as seeing deleted posts.

On a healthy site, many of the outcomes of reviews are obvious without needing to see the queues. Off topic questions get closed. Bad questions get downvotes. Good questions rise to the top.


Somewhat related: public spam edits have some value to spammers, so they're not public. See an example spam edit. I believe that being logged in allows you to see it, however.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .