A site user recently unprotected virtually all of our protected questions. Is that okay?

Question

[First off, there's no need to name the user, and I'm kinda-glad in this case that I think it'd be relatively hard for anyone but a mod to go back and figure out who. This isn't about the user. I assume they're trying to make the site better like the rest of us, that they never thought to come check ahead of time on meta, and that they will continue being a productive member. Hell: I happen to agree that most questions should be unprotected. This post is about the manner of its doing, and wanting to set a signpost for future stackizens.]

A user last week unprotected 700 questions, leaving 4 protected.

That's about 99.4% of our protected questions, unprotected on one person's judgment.

...

Almost everything about routine Stack-usage is transparent and builds in some redundancy/error-checking. Edit histories, bumping questions, queues. This is status-by-design. And this is important: communicating with each other in real-time is how a lot of Stack-education gets done. I remember during my first Hatmas deciding to go for an editing badge and being gently introduced to the term "flooding the frontpage." Lesson learned! (Hi, SSD!)

This, though, is a corner-case where the users' actions were unreviewable and basically invisible. Unprotections appear in a question's timeline, but you'd need to know what question to look at first. And I'm not aware that there is a way to search for questions that were protected. Unprotections don't go into a queue or bump a question.

So a user stumbled into a thing they had the privileges to do, thought they should do to improve the site, and went ahead and made a project of it.

Should they have?

What the heck? That's hugely disruptive, and I am very not okay that this has happened. Several hundred of those were protected specifically because they're repeat spammer targets—our standard spam sources always repeat on the same question over time if it's left unprotected. That was a defense we had. Nothing like this should have happened without first checking with the community. Is there any way to get staff to roll that back? — doppelgreener, Commented Jul 7, 2020 at 17:49
@doppelgreener related meta on reprotecting the recent batch of unprotections. — nitsua60, Commented Jul 7, 2020 at 18:04
Is there any way a mod can rollback the changes made? First off, I am amazed that someone manually unprotected 700 questions, but protecting them again manually seems like a lot of energy and effort from the community. There should be a way that mods can "revert everything a user has done in the past X hours" - in case a user gets hacked, does something without too much thinking or stuff like this. — HellSaint, Commented Jul 7, 2020 at 18:12
@HellSaint Most things are rate-limited so a user literally could not do anything that warrants such an ability. This seems to be a glaring hole in the process — Exempt-Medic, Commented Jul 7, 2020 at 18:13
Might this need to be a bug report? Feature request? Or is this step one in that many step process? — KorvinStarmast, Commented Jul 7, 2020 at 18:13
@HellSaint: We are already in communication with site staff to understand what options we have here. But diamond moderators definitely do not have any power to revert the change manually or otherwise since these changes are essentially untraceable. — Rubiksmoose, Commented Jul 7, 2020 at 18:15
@KorvinStarmast A feature request could certainly be written about concerning this, and I'm planning to do so, but I'm inclined to wait a bit and see how the solution pans out to give us a better idea of what that long-term improvement/fix should look like before proposing something. And that would be better placed on MSE whenever that happens. — Rubiksmoose, Commented Jul 7, 2020 at 18:26
@KorvinStarmast right now, I think showing unprotecting as an action in a user's profile would be a good start as well as having automation check when the actions are being taken en masse (as we have on other things). — Rubiksmoose, Commented Jul 7, 2020 at 18:27
@HellSaint that's the conversation I was hoping to kickstart over on the other meta =) — nitsua60, Commented Jul 7, 2020 at 19:31
@Rubik for what it's worth, having unprotecting appear on the user profile was a feature request that has been deferred for a few years — Exempt-Medic, Commented Jul 7, 2020 at 20:12
@Rubiksmoose unprotecting as an action on a profile only helps if you go digging into users' profiles... I'm not convinced that's the best way to handle it. Still thinking, though, about what's the right way to make sure that some eyes see an unprotection. — nitsua60, Commented Jul 7, 2020 at 20:24
@nitsua60: Like I said, only a first pass at the idea. At the very least it would help with investigating the issue once one was made aware of one. But yeah, haven't thought of a true solution to it, if there even is one... — Rubiksmoose, Commented Jul 7, 2020 at 20:28
Just out of technical curiosity: If it is so hard to find, how did you find it? — Anagkai, Commented Jul 8, 2020 at 6:50

nitsua60 · Accepted Answer · 2020-07-07 17:28:25Z

25

One shouldn't undertake a large maintenance project alone, invisibly.

[Reiterating: the user had the privileges to do so, and I assume no malice.]

TL;DR: default to humility in judgment, and look for opportunities to better the site and the community.

To my mind there are two things at play here: a responsibility and an opportunity.

We all have a responsibility to use our privileges for the betterment of the site. And most of the time it's easy to do so. OP leaves a link in a comment, you edit it into the question seamlessly, and nobody suggests you should have opened a meta to discuss that. New user posts a question-as-answer, you flag and leave a nice comment, the site's better off. You notice a tag being used in a way that strikes you oddly and open a meta to discuss. (Notice, because you may have forgotten: each of the actions there are privilege-actions!)

But sometimes there are judgment calls: OP mentioned some things in comments that prompt you to edit their post pretty substantially. It seems like people are using tags in $system_you_know incorrectly and you go on a re-tagging spree. Your gold badge earns you a dupe-hammer, and it's not always super-clear whether to use it.

In many of these cases people are proactive about seeking second opinions. A comment to OP saying "I've made a pretty substantial edit, please check that I've encapsulated your meaning" not only pings OP, it implicitly invites every follow-on reader to push back on the editor if it looks amiss to them. Meta discussions tagged tags are common enough that tags is our second most-used tag. And most weeks people come into chat to ask about whether or not a close-as-duplicate vote is appropriate for their case.

Even if none of those proactive steps is taken, each of the examples would bump the post, inviting inspection and review. The system is ensuring that actions we take are publicly-reviewable. (And in nearly every case I can remember, that review--if there's an objection--is handled graciously.)

A large program of "invisible" unprotection bypasses those quality controls. It takes the judgment of one user and enacts it over the judgments of the dozens-if-not-hundreds of users who protected those questions and (any) who later saw the protected question and thought "yeah, that's right."^*

We also have an opportunity when using our privileges to better the site and ourselves. Leaving a comment about a large edit both forces you into introspection and it teaches newer users (by example) how to treat others' work. Opening a meta on a re-tagging project pulls in a variety of expertise, might engage otherwise-inactive users, and often spawns spin-off discussions. Asking someone in chat to sanity-check you both nets you the sanity check and reinforces the site-wide message that "we're all here working together."

^{* - story time: I once, in the mod-room, mentioned that I unprotect the majority of protected posts I come across. I was met with "why would you do that!?" I only mention it to say that I know there exist users who would respond to "I unprotected lots" with "why would you do that!?"}

answered Jul 7, 2020 at 17:28

nitsua60

102k59 silver badges146 bronze badges

4

\$\begingroup\$ I would like to add another important fact that may have been missed by the person doing the changes mentioned in this meta. When I use my 5e golden badge to dupe a question (and I kinda do liberally), I know that if I messed up some other person with the golden badge or 5 other people can go on and reopen the question. If I edit a question substantially and change the actual meaning of the question, the original asker - or other community members - can simply rollback that. If I go on a retagging spree, the worst that happens is flooding the first page. \$\endgroup\$
– HellSaint
Commented Jul 7, 2020 at 18:26
5

\$\begingroup\$ Now, what has been done here is, to the best of our knowledge, irreversible. Such an action should be done with hundred times more thought and carefully. In fact, it may be the only thing a user can do that is pretty much irreversible by other community members with the same privileges as the user who has done it - and even the mods are, unfortunately, having a hard time and trying to find a solution with the higher-higher ground staffs. Please, take this into account: the harder it is to reverse the effect of what you did, the harder you should think about it before doing. \$\endgroup\$
– HellSaint
Commented Jul 7, 2020 at 18:29
1

\$\begingroup\$ @HellSaint Please know that staff has been contacted. Also it is possible to get a list of these posts that were unprotected but as of right now we should not do anything with such a list. Best to wait and see what the staff decide or if they have some much more efficient method than individually re-protecting 700+ posts. It's also not particularly clear (or really clear at all) that unprotecting a question is not easy to trace or undo \$\endgroup\$
– Exempt-Medic
Commented Jul 7, 2020 at 18:40
3

\$\begingroup\$ @Medix2 If it requires contacting the staff/CM, it is already clear to me that it is not easy at all. Any other action in the site can be undone by community members with simple clicks. Some of them require one person with no rep at all, some of them require 5 people with considerably high rep (e.g. deleting a post), and this one requires, probably, a staff from SE or at least a diamond mod. My point is simply that: the harder it is to revert your action, the more thoughtful it should be doing the action. \$\endgroup\$
– HellSaint
Commented Jul 7, 2020 at 22:06
3

\$\begingroup\$ @HellSaint: Well, the biggest reason why this is harder is that the changes are largely not visible. But now that we have the list of posts, we can reverse each one taking the same amount of clicks and effort as it took to unprotect them (at least in most cases). So in that sense it is reversible, but obviously the situation is not ideal. \$\endgroup\$
– Rubiksmoose Mod
Commented Jul 7, 2020 at 22:08
1

\$\begingroup\$ @gszavae There are no reports or interfaces to see a list of questions that have had protection/unprotection status. You'd need to run a SEDE query or a direct DB query as an employee to find such a list. Once found, there's no mechanism for moderators or even staff to just click a button and undo them en masse. It has to be undone by a db rollback (never going to happen), re-done by a db script (unlikely to happen), or re-done manually. Unless someone has a user script to help with some automation. At high numbers, you have to be careful to avoid getting rate limited by the site. \$\endgroup\$
– TylerH
Commented Jul 29, 2020 at 15:01
1

\$\begingroup\$ @TylerH I know, but I mean, is there any text somewhere saying "this is an invisible and irreversible tool - beware!" or something to that effect? Or is it one of those "you just have to know" kind of things? \$\endgroup\$
– user-781943
Commented Jul 30, 2020 at 0:08
3

\$\begingroup\$ This is one of those "the system gates certain actions behind rep-limits, and expects that most users getting to those numbers have well-acquainted themselves to the relevant mechanic, or will at least have learned to ask questions about new things as they try them out." They don't make anyone pass a test or sign a form for each privilege, just expect people to educate themselves, use their privileges thoughtfully, accept correction graciously, and engage in good faith on meta when they think something needs to change. \$\endgroup\$
– nitsua60
Commented Jul 30, 2020 at 0:46
1

\$\begingroup\$ @gszavae Not really; there is the privilege page for protecting questions which explains how protecting/unprotecting works, but it doesn't have any caveat emptor on mass usage. There's also the tools page 1 and tools page 2 that show protected question details/stats, but don't show recently unprotected questions. \$\endgroup\$
– TylerH
Commented Jul 30, 2020 at 14:35
2

\$\begingroup\$ Custom flag to ask a moderator for some guidance. Ask experienced users in chat. Raise a meta before taking hundreds of rapid actions. There aren't "no resources," and this isn't an unreasonable expectation, as evidenced by the fact that literally no other user ever has gone off and done something like this. \$\endgroup\$
– nitsua60
Commented Jul 31, 2020 at 1:05
1

\$\begingroup\$ @gszavae I'm not sure "so many users" qualifies here. This is not something that happens often; it was one user who used a tool an extremely high number of times in an extremely short period. There's no way that user didn't know they were using the tool more frequently than most. Whoever it is, I think they simply had a different view on the Protected feature and decided to apply their view as broadly as possible as soon as they were able, without consulting anyone, because they likely knew anyone they consulted would caution against such an action. \$\endgroup\$
– TylerH
Commented Jul 31, 2020 at 13:51
1

\$\begingroup\$ @TylerH I was the one who unprotected the questions (I'm assuming you weren't aware). I did not have malicious intentions, I just didn't know it was an invisible tool, and no one I have talked to so far knew it was an invisible tool either. I asked several questions and spent many hours reviewing, but it never occurred to me to ask "is this an invisible tool" because I never even knew invisible tools existed. \$\endgroup\$
– user-781943
Commented Aug 1, 2020 at 0:22
1

\$\begingroup\$ @gszavae I did not know it was you, and to be clear I don't/didn't think the intent was malicious. I think the use was just one of those where one user (you in this case) thought "I have the power now to change something I think ought to be different". For what it's worth, on Stack Overflow we tend to have processed that have been discussed/vetted by the Meta community for such massive things; protections are usually the purview of SMEs, tag burnination/cleanup requires consensus/score thresholds, etc. That may be a good thing to start implementing here. \$\endgroup\$
– TylerH
Commented Aug 1, 2020 at 19:01
1

\$\begingroup\$ And question protection/unprotection is not an "invisible" tool. It's just something that doesn't have a dashboard/alert system built in when it gets used at large scales. \$\endgroup\$
– TylerH
Commented Aug 1, 2020 at 19:02
3

\$\begingroup\$ @gszavae it's not assuming malicious intent, just assuming intent that goes against what the community would most likely recommend. Malicious intent would be if you unprotected them for the sake of allowing bad answers/spam in or something. \$\endgroup\$
– TylerH
Commented Aug 2, 2020 at 1:40

| Show 4 more comments

Dale M · Accepted Answer · 2020-08-06 05:32:18Z

Tangentially - you can check for this type of edit (or any others)

This is the 10 most recent Unprotect edits using:

SELECT TOP 10 *
FROM PostHistory
WHERE PostHistoryTypeId = 15
ORDER BY CreationDate DESC

The PostHistoryTypes are:

$$\begin{array}{c|c} \text{Id}&\text{Name}\\\hline 1&\text{Initial Title}\\\hline 2&\text{Initial Body}\\\hline 3&\text{Initial Tags}\\\hline 4&\text{Edit Title}\\\hline 5&\text{Edit Body}\\\hline 6&\text{Edit Tags}\\\hline 7&\text{Rollback Title}\\\hline 8&\text{Rollback Body}\\\hline 9&\text{Rollback Tags}\\\hline 10&\text{Post Closed}\\\hline 11&\text{Post Reopened}\\\hline 12&\text{Post Deleted}\\\hline 13&\text{Post Undeleted}\\\hline 14&\text{Post Locked}\\\hline 15&\text{Post Unlocked}\\\hline 16&\text{Community Owned}\\\hline 17&\text{Post Migrated}\\\hline 18&\text{Question Merged}\\\hline 19&\text{Question Protected}\\\hline 20&\text{Question Unprotected}\\\hline 22&\text{Question Unmerged}\\\hline 24&\text{Suggested Edit Applied}\\\hline 25&\text{Post Tweeted}\\\hline 31&\text{Discussion moved to chat}\\\hline 33&\text{Post Notice Added}\\\hline 34&\text{Post Notice Removed}\\\hline 35&\text{Post Migrated Away}\\\hline 36&\text{Post Migrated Here}\\\hline 37&\text{Post Merge Source}\\\hline 38&\text{Post Merge Destination}\\\hline 50&\text{CommunityBump}\\\hline 52&\text{SelectedHotNetworkQuestion}\\\hline 53&\text{RemovedHotNetworkQuestion}\\\hline \end{array}$$

I think you messed up the first link; both links have the same query ID, causing them both to take the user to the Post History Types query on SEDE. — V2Blast, Commented Aug 6, 2020 at 6:50

Stack Exchange Network

A site user recently unprotected virtually all of our protected questions. Is that okay?

2 Answers 2

One shouldn't undertake a large maintenance project alone, invisibly.

Tangentially - you can check for this type of edit (or any others)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
discussion
.

Linked

Hot Network Questions

A site user recently unprotected virtually all of our protected questions. Is that okay?

2 Answers 2

One shouldn't undertake a large maintenance project alone, invisibly.

Tangentially - you can check for this type of edit (or any others)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged discussion.

Linked

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
discussion
.