39

Moderators can see individual votes from all users on their site right now, i.e. what you see here for your own account.

While this does make it easier for use to find voting rings that managed to stay under the radar, this power is normally reserved for staff members and should remain that way; IIRC accessing that URL for other users used to give a 404 - Not Found for me (which it still does when not logged in, or on sites where I'm not a moderator).

Improve this question
9
  • 6
    If they just removed the All, Upvotes, and Downvotes tabs, it would be good: Allow moderators to view close and delete vote history
    – Laurel
    Commented Aug 11, 2022 at 10:29
  • 8
    The bug was introduced while addressing that other post, yeah, @Laurel ;)
    – JNat StaffMod
    Commented Aug 11, 2022 at 10:40
  • @Randal'Thor that was a significant (but good) edit, but now I'm wondering what the threshold here is - I didn't get a notification ...
    – Glorfindel Mod
    Commented Aug 11, 2022 at 18:46
  • 5
    Here's hoping the title doesn't get changed back later by some well-intentioned person trying to follow rules like "no tags in titles" without thinking of the repercussions in this particular case :-)
    – Rand al'Thor
    Commented Aug 11, 2022 at 18:48
  • 1
    @Randal'Thor And...that's what happened here half an hour ago...
    – Sonic the Anonymous Hedgehog
    Commented Aug 14, 2022 at 8:21
  • 2
    @ShadowTheKidWizard The title edit was correct here. See the edit summary for the edit, and the above comments.
    – Sonic the Anonymous Hedgehog
    Commented Aug 14, 2022 at 8:23
  • @Sonic I disagree with this, following this logic all bugs that have been fixed should have their title edited to say "temporary". And that's a bad idea. It's trivial that a bug that was fixed was temporary. Anyway, I'm not going to edit war over this.
    – Shadow Wizard
    Commented Aug 14, 2022 at 12:40
  • @Randal'Thor it got nothing about tags in title. "temporary bug" is just noise, because it's beyond obvious the bug was temporary if it's fixed. You can also add [FIXED] and [SOLVED!!!1!], exact same level of noise.
    – Shadow Wizard
    Commented Aug 14, 2022 at 12:42
  • 3
    @ShadowTheKidWizard - No, not every bug needs such a marker in the title. When leaving it out could mislead people into thinking that moderators can always see vote data, it's not unreasonable to take steps to prevent that misunderstanding.
    – Mithical
    Commented Aug 14, 2022 at 15:29

1 Answer 1

Reset to default
26

This bug was indeed introduced while working on allowing to view close and delete vote history. We're rolling back that change, afterwards it should be fixed. Apologies for the inconvenience!

Update: We've audited traffic logs and have no evidence to suggest that user vote pages were abused while this bug was in production.

Improve this answer
2
  • 54
    Thanks for addressing this! However, it is slightly concering that this slipped past testing. Revealing vote data is a non-insignificant breach of privacy, given that we've always emphasized that votes are private. While accidentally granting this access to moderators is better than leaking it to the general userbase, I wonder what went wrong in the testing process that this went live in this state. I'd hoped that any changes touching access to private data (even aside from PII) would be thoroughly tested before releasing to production.
    – Mithical
    Commented Aug 11, 2022 at 13:17
  • @Mithical SE got hundreds of testers for the mod tools. ;)
    – Shadow Wizard
    Commented Aug 14, 2022 at 8:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .