→ 10 messages moved to Chimney

@Spevacus Hi, I don't think its necessary to delete the 2 vulnerability meta posts I posted.

@Spevacus I don't want to go into detail here, but at this point I'd imagine this will be handled quite quickly, and any user seeking to exploit this will have this reverted quickly (likely with a suspension)

@Starship My thought process is just... Well, you included the reproduction steps, and when it concerns potential security vulnerabilities like this, you're really supposed to report them using the contact us form (ref: meta.stackexchange.com/help/security-reports ). This one's less of a security vulnerability and more of a system vulnerability, but I think the spirit of that's still there.

I pinged staff and let 'em know what the deal is. I personally would be happy to undelete them after I get something back about them.

@Spevacus Okay

We had another vulnerability that was deleted by staff somewhat recently. I believe it had to do with moderator help center articles being exposed to users via some oddball endpoint.

@Spevacus I personally think its not that "big" of deal becuase I'd imagine its totally reversible (and anyone abusing this will get themselves suspended when staff check this out).

Yeah I also think it'll be easy for a dev to make some unholy query and find all instances of this. Now... Reversing those instances might be tricky, but I'm not a dev so I'm really only guessing

In that case I think keeping visibility limited here might be a good idea

You'd be surprised how much work stuff like that takes to fix - + its a weekend

@Spevacus The difference with that is that fixing the bug doesn't make users unsee something. I definetly wouldn't meta if I found out how to hack myself into users PII or something

@JourneymanGeek Without publicly posting the hack on this chat and defeating the point of @Spevacus deleting it, I'd imagine its not that hard to fix (and I'd imagine it would get top-priority or something close to it)

@Spevacus The company already has a system for reversal of voter fraud, I'd imagine they can reverse all votes whenever they want to

Also, @JourneymanGeek even if its not done this weekend, it will be done eventually, and reasonably soon. Whether something stays for 3 hours vs. 3 days isn't a huge difference.

@Starship I'd think a proper, quiet escalation (there's a way to report security issues) or a mod-emergency escalation is more likely to get a quick response. And I got 10k here, I can see deleted posts

Oh, people can get up to so much in 3 days

it makes a difference

@JourneymanGeek If you look at the post you'll see what I'm talking about, but the point was not to disclose to everyone else reading this chat

I trust you not to go on a hack rampage

I did. I'm also a former moderator - so I know the process the current team would likely follow

What is modemergency escalation

@JourneymanGeek You're also a current mod...did you forget?

Mods have a Contact Us option that's titled "Community Emergency" that's used for... Well, emergencies. Such as spam waves, abuse rampages, etc

moderators can, in a situation where there's something that can do harm to a person, community or network, kind of do a special 'contact us' message to get whomever's on duty to handle things faster

@Starship with respect to meta :D

In this case I dunno if it crosses that emergency threshold, so I just tossed it at some staff.

@Spevacus Oh yes I remember that now...a mod referenced it during the academia spam wave

@Spevacus I doubt its an emergency, in that whether its fixed today, tommorrow, or in a week isn't a big deal

@JourneymanGeek @Spevacus I submitted a Contact Us report and got "Please be aware that the support team does not monitor support tickets during the weekend or holidays." Does this mean that they won't see it even after the weekend is over?

Naw, it'll go to a ticketing system

don't expect anyone to read it today

Nah they still get them, they just don't monitor them during the weekend/holidays. When they're back from the weekend they'll see it. It's just informing you that nobody's working at this moment.

→ 4 messages moved to Chimney

→ 13 messages moved to Chimney

Oh, right

@Spevacus whoa does it include blaring sirens and what-not

@Spevacus Did you get a response from your escalation? Because my incorrect rep has been removed (but not Organic Marble's)

@Starship Not yet. It's possible your rep was adjusted due to an automated rep recalc

It seems that I have 24 close votes left today. But where is this number taken from? It doesn't seem to be what SE would usually use.

@Spevacus yeah there is "failsafe" recalculate running every 24 hours or so. Added by balpha at some point.

(the pop-up is from my own question)

@ShadowWizard great minds post alike!

@PetəíŕdtheWizard base number (20?) plus rep-based number, e.g. 1 for each 500 rep.

@ShadowWizard ah, thanks

But by your formula I should have only 22 flaags.

(I don't even have 1.5k yet)

(let alone 2.5k)

@PetəíŕdtheWizard you get more flags for sucessful flags I thiiiinnnlkkkk

@JourneymanGeek CVs :)

On my own question, I mean.

And I have at least 28 flags per day.

You get 10 flags pre day. For every 10 successful flags you get 1 more flag per day. Maximum flags per day is 100.

@PetəíŕdtheWizard just example, too lazy to check actual formula. ;)

lol

@ShadowWizard Have you closed any questions today?

@JourneymanGeek ah, not rep?? whoops.

minus something for unsuccessful flags

@PetəíŕdtheWizard nope. feels hungry

@ShadowWizard hmm I remember something like U2FsdGVkX19cLjya5AsqE+CFmetW6y7rMCA0ce+dsRAte7LyuqYqAqAojSM7tTme20gApz4KdqMuQlGJcfTSYYj03+YYsdNqOZx1TfJCorw= somewhere.

ah we were both correct!

@ShadowWizard throth?..

lol

@ShadowWizard I don't see anything about CVs there

@PetəíŕdtheWizard Oh, you are talking about close votes, not flags.

Well, duh.

ah never mind then :D

I've never run out of closevotes

Good! :D

@JourneymanGeek show off!

taking out my $100000 wand

Oh mean, I hardly closevote :D

recites some old spells

!!

??

Kenny ain't here.

@ShadowWizard duplicate :(

:D

</jk>

yeah, new troll was born.

→ 28 messages moved to Chimney