Does it seem like a security risk to have mods be able to edit other people's posts?

Submitted by flabberghaster at December 8, 2020, 11:53 PM in meta

I don't think anyone on this site would abuse it but I could imagine it being abused easily.

Comments

You must log in or register to comment.

emma wrote at December 9, 2020, 12:12 AM

no longer allowed in later postmill versions, btw. imagine the advancements of society if this website ran a postmill version that wasn't from 2018

flabberghaster wrote at December 9, 2020, 12:26 AM

We value our traditions, don't erase our culture.

hollyhoppet wrote at December 9, 2020, 2:13 AM

it was hard to upgrade last time i tried due to some edits i had to make to make things work on heroku

BUT... i have between christmas and new years off and was planning on giving it a go again then

emma wrote at December 9, 2020, 9:21 AM

in a just world, one would be paid a living wage for sitting in an office and hitting the "update postmill" button all day

hollyhoppet wrote at December 9, 2020, 8:21 PM

yeah, for real

hollyhoppet admin wrote at December 9, 2020, 2:18 AM

i wouldn't say it's a security risk as it isn't really a vector for acquiring another user's personally identifiable information, but it isn't really the best thing. if we were a larger site i'd be more concerned about it but it's something i keep an eye out for.

that said even if mods were prevented from editing others' posts i can still edit the database so there still needs to be some trust when using a site like this. not that i'd ever want to do that unless something was broken from a technical standpoint ew. i'm not interested in being a bad person. it is important to think about when you use sites run by someone who isn't you though (read: corporations).

flabberghaster wrote at December 9, 2020, 3:52 AM

I'm gonna cryptographically sign all my posts.

emma wrote at December 9, 2020, 9:21 AM

please add your -----BEGIN PGP SIGNED MESSAGE----- block so i can just assume your messages belong to you without actually verifying this

hollyhoppet wrote at December 9, 2020, 8:20 PM

twovests wrote at December 9, 2020, 12:30 AM

So, we have moderation logs, but AFAIK they don't mark edits. This is good for, say, scouring the site of spam links or porn posts or whatnot.

For the health of a larger site run by postmill, I'd say it's definitely bad. Forum mods should not be able to edit someones post. Admins would have the power but probably shouldn't.

Not to be a "muh freeze peach" chud, but I think it's plainly icky for mods and admins to edit posts, even in jest. The only exceptions I could see are syntactically-clear mod edits, a-la "USER WAS BANNED FOR THIS POST".

flabberghaster wrote at December 9, 2020, 12:47 AM

There should be a way to mark a post as being the cause of a ban without editing it.

I was thinking the use case would be like, if someone doxxed someone it could be scrubbed for example. But if it did get edited by a mod it should be marked as such. Iunno.

cute_spider_ni_srsly wrote at December 9, 2020, 9:17 PM

dear admins,

please write this post for me

just replace all this with something you'd think I'd say

thanks

srsly