Hi list,
I wanted to get some feedback about https://phabricator.wikimedia.org/T74222. In the last security release, I changed the return of the api to remove the "action" for log entries that had been revdeleted with "Hide action and target". However, ever since 2009 / r46917, we've assumed that "Hide action and target" didn't mean the actual action field in the db, but rather the target and the text of the message about the action, which might include other parameters. So the message about what's being hidden and the intended protection of that option could have slightly different interpretations.
I'd like to hear if anyone has intended for the actual log action to be deleted / suppressed. If not, I'm happy to revert the recent patch, and we'll just update the wording in the deletion UI to be more clear about what is being removed.
Seeing no reply here, I've now submitted https://gerrit.wikimedia.org/r/178527 to revert the API change and to update the UI message.
On Mon, Dec 1, 2014 at 8:30 PM, Chris Steipp csteipp@wikimedia.org wrote:
Hi list,
I wanted to get some feedback about https://phabricator.wikimedia.org/T74222. In the last security release, I changed the return of the api to remove the "action" for log entries that had been revdeleted with "Hide action and target". However, ever since 2009 / r46917, we've assumed that "Hide action and target" didn't mean the actual action field in the db, but rather the target and the text of the message about the action, which might include other parameters. So the message about what's being hidden and the intended protection of that option could have slightly different interpretations.
I'd like to hear if anyone has intended for the actual log action to be deleted / suppressed. If not, I'm happy to revert the recent patch, and we'll just update the wording in the deletion UI to be more clear about what is being removed. _______________________________________________ Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Speaking from my experience as an oversighter, I find it a bit strange that when you oversight something, information that is hidden in the UI is not hidden in the API. That notwithstanding, there is nothing particularly private about the information that is shown in the API only (i.e. the type of the action), but I found it strange.
I also find it strange that the fact that this information is still available via the API is not mentioned in the interface. I've been an oversighter for many, many years, and I never knew that this information could be retrieved via the API.
Personally, I prefer the way things are after Chris's change. It makes the UI and API more consistent with each other.
That said, given that there is no particularly private information given out in the API response, I don't think it's worth complaining about Brad's patch. It's not the way I'd prefer it to be, but it doesn't personally strike me as overtly incorrect or as causing any real problems.
Dan
On 1 December 2014 at 17:30, Chris Steipp csteipp@wikimedia.org wrote:
Hi list,
I wanted to get some feedback about https://phabricator.wikimedia.org/T74222. In the last security release, I changed the return of the api to remove the "action" for log entries that had been revdeleted with "Hide action and target". However, ever since 2009 / r46917, we've assumed that "Hide action and target" didn't mean the actual action field in the db, but rather the target and the text of the message about the action, which might include other parameters. So the message about what's being hidden and the intended protection of that option could have slightly different interpretations.
I'd like to hear if anyone has intended for the actual log action to be deleted / suppressed. If not, I'm happy to revert the recent patch, and we'll just update the wording in the deletion UI to be more clear about what is being removed. _______________________________________________ Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Thanks, Dan... I was going to ask about that, too. I don't understand well enough what is and isn't visible in the API, but I will say that if the API is linking an action (i.e., suppression) to a user (i.e. the specific oversighter) I *do* have a problem with it; we've had experience in the past with people actively harassing oversighters because of legitimate suppressions they've carried out, and perhaps this is exactly how they've found out it was Oversighter A who did that particular suppression.
Risker/Anne
On 9 December 2014 at 14:01, Dan Garry dgarry@wikimedia.org wrote:
Speaking from my experience as an oversighter, I find it a bit strange that when you oversight something, information that is hidden in the UI is not hidden in the API. That notwithstanding, there is nothing particularly private about the information that is shown in the API only (i.e. the type of the action), but I found it strange.
I also find it strange that the fact that this information is still available via the API is not mentioned in the interface. I've been an oversighter for many, many years, and I never knew that this information could be retrieved via the API.
Personally, I prefer the way things are after Chris's change. It makes the UI and API more consistent with each other.
That said, given that there is no particularly private information given out in the API response, I don't think it's worth complaining about Brad's patch. It's not the way I'd prefer it to be, but it doesn't personally strike me as overtly incorrect or as causing any real problems.
Dan
On 1 December 2014 at 17:30, Chris Steipp csteipp@wikimedia.org wrote:
Hi list,
I wanted to get some feedback about https://phabricator.wikimedia.org/T74222. In the last security release, I changed the return of the api to remove
the
"action" for log entries that had been revdeleted with "Hide action and target". However, ever since 2009 / r46917, we've assumed that "Hide
action
and target" didn't mean the actual action field in the db, but rather the target and the text of the message about the action, which might include other parameters. So the message about what's being hidden and the
intended
protection of that option could have slightly different interpretations.
I'd like to hear if anyone has intended for the actual log action to be deleted / suppressed. If not, I'm happy to revert the recent patch, and we'll just update the wording in the deletion UI to be more clear about what is being removed. _______________________________________________ Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
-- Dan Garry Associate Product Manager, Mobile Apps Wikimedia Foundation _______________________________________________ Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
On Tue, Dec 9, 2014 at 2:33 PM, Risker risker.wp@gmail.com wrote:
Thanks, Dan... I was going to ask about that, too. I don't understand well enough what is and isn't visible in the API, but I will say that if the API is linking an action (i.e., suppression) to a user (i.e. the specific oversighter) I *do* have a problem with it; we've had experience in the past with people actively harassing oversighters because of legitimate suppressions they've carried out, and perhaps this is exactly how they've found out it was Oversighter A who did that particular suppression.
No, that's not what this is about.
Consider a log entry such as (taken from my local test wiki):
13:33, 5 December 2014 Anomie (talk | contribs) deleted page MediaWiki:Revdelete-hide-name (Use default message)
In the API, that information is represented like this:
{ "logid": 2412, "action": "delete", "ns": 8, "title": "MediaWiki:Revdelete-hide-name", "pageid": 0, "logpage": 1016, "type": "delete", "user": "Anomie", "timestamp": "2014-12-05T18:33:23Z", "comment": "Use default message" },
If someone does a RevDel on that log entry and chooses the poorly-described "Hide action and target" checkbox, the log entry is now displayed like this:
13:33, 5 December 2014 Anomie (talk | contribs) (log details removed) (Use default message)
And in the API (before T74222 and after the proposed revert), we get the following information:
{ "logid": 2412, "actionhidden": "", "type": "delete", "action": "delete", "user": "Anomie", "timestamp": "2014-12-05T18:33:23Z", "comment": "Use default message" },
All this mess is because someone noticed that the poorly-described checkbox says "Hide action" but the API was still reporting that the subtype (here named 'action') is "delete" (versus "restore", "revision", etc).
On Tue, Dec 9, 2014 at 11:46 AM, Brad Jorsch (Anomie) <bjorsch@wikimedia.org
wrote:
All this mess is because someone noticed that the poorly-described checkbox says "Hide action" but the API was still reporting that the subtype (here named 'action') is "delete" (versus "restore", "revision", etc).
I don't think action was ever truly hidden in the UI; obscured at best. The <li> elements for the log items still get an mw-logline-<action> class even if the action is suppressed.
On Tue, Dec 9, 2014 at 2:01 PM, Dan Garry dgarry@wikimedia.org wrote:
Speaking from my experience as an oversighter, I find it a bit strange that when you oversight something, information that is hidden in the UI is not hidden in the API.
There's little reason we couldn't surface this information in the web UI, and in fact I almost did when working on this change. But I ran into trouble figuring out what exactly the "enhanced" watchlist was doing with the grouping and decided it wasn't worth the trouble to figure it out.
There's actually a good bit of information that is available from the API that isn't in the web UI (or isn't very visible there). For example, history pages only display timestamps to the minute while the API gives resolution to the second. The timestamp when a page was added to a category isn't exposed in the web UI either, as far as I know, nor are sha1 hashes of revisions, files, and so on.
Or are you referring to how the RevDel checkboxes were labeled "Hide action and target"? That's being fixed.
There's actually a good bit of information that is available from the API
that isn't in the web UI (or isn't very visible there). For example, history pages only display timestamps to the minute while the API gives resolution to the second.
You can actually get up to the second resolution if you change your prefs.
--bawolff
wikitech-l@lists.wikimedia.org