Tavern on the Meta

Glen Campbell - Galveston

1:58 AM

A vague reference to:

►

?

3:33 AM

@VoteDukakis lol wow

So there's an extant privesc bug in SE huh?

(Couldn't they just have added the ♦ unicode to their name?)

@forest no, it's blocked

ah

Then either they genuinely got mod privs, or they found a way around the visible diamond block (which is probably not too hard with homoglyphs).

If more people start exploiting this, don't blame me. I told a few people on IRC for the lulz :^) Also I blame SE for being closed source.

3:49 AM

It's 🔷 which means Moderator, black diamond is for CM. This tweet was ominous. Yeah, don't use public WiFi; person whom was online several hours ago.

heh

Well that's not a big issue for SE since it uses HTTPS. Anyone smart enough to tweet about the risks of public Wi-Fi is unlikely to be fooled by sslstrip.

At most a legit "Moderator" is a mod of less than half a dozen sites. CM is Mod everywhere and Dev may or may not look like a Mod; some have less than a few posts and a few hundred rep.

So the bug is a privesc to CM?

That person appeared to be Moderator on 175 sites, and was doing reviews; which CMs/Devs shouldn't be doing.

hm

4:00 AM

So, not so much an "escalation". More like using an account to create as high a privilege as possible. I suspect Moderator accounts can't create Moderators and CM accounts can't create employees. Maybe a CM created a user and chose 'moderator on all sites' (which is a hint that something isn't correct).

Unless they started as a CM, it's still privesc.

@Rob well, it's not really "CMs/Devs shouldn't be doing reviews". It's just it's not on their job description, so they aren't obligated to do, but they are free to do it if interested (like JNat does ocassionally on Anime.SE)

LOL someone told me they might know what bug was exploited :D

Unless they're just screwing with me lel

(they probably are ;-;)

@NoDistractionWizard Shog wrote somewhere that they didn't want Devs and other employees using their privileges because it hammers things, treating it like they are a mod; of course if there's an image posted or language that's offensive it needs to go.

4:15 AM

So like, if a score for a question flickers rapidly between 0 and 1, is someone upvoting and removing their upvote rapidly, or is this just a bug?

upvoting & undoing rapidly, also the vote will get locked quick

Locked?

Doesn't that take 5 minutes?

> Note that after voting and undoing your vote 30 times, it will also be locked in. -- What are the limits on how I can cast, change, and retract votes?

heh

That's an odd limit. For comments, it's just one. :P

Because someone has done it to annoy others.

4:21 AM

How could it cause annoyance? I thought it takes some time for the rep change to be made visible, so it's not like it'd spam an inbox.

I believe JNat participates on Anime as a regular user, as best one can whilst carrying a hammer.

SE mods are thankfully a lot more chill than mods on other sites.

So it's not like there's a significant bias against them when they participate.

There's quite a few sites where the Mod participates, editing, commenting, asking and answering. Often they have been to school and are experts in the field.

On Sec.SE and Crypto.SE, the mods are generally respected.

Only site I saw serious mod drama was EE.

4:51 AM

If an RA flag is marked helpful, does that mean a penalty is applied?

Or can an RA flag be marked helpful without anything but deletion performed?

@Rob there's no difference between a cm/employee diamond and a mod one

5:10 AM

@JourneymanGeek Why are some colored black and the other blue?

Shog9

@forest they can be marked helpful without anything being performed. Not much point to it, but is possible.

if deleted by community at the same time as flag is helpful, flag-deleted (== penalty)
if deleted by someone else at the same time as flag is helpful, normal-deleted (no penalty)

@JourneymanGeek Also the person we are discussing had 1 rep and diamond on 175 sites, and 1 Bronze Badge - rather odd for a CM or Mod.

@Rob what? where? which one is black and which one is blue?

Scroll, back. I was just leaving.

5:25 AM

because I can't never in my life distinguish between mods, CM, and SE devs' diamond (except on per-site Users' mod list)

Especially CM and SE devs, which made me always refer CM as SE employees for convenience and safety

6:24 AM

@Shog9 Ah. In this case I flagged a comment calling someone a scumbag and it got deleted and the flag marked helpful. No idea if a penalty was applied.

I'd guess not.

Shog9

there's no penalty for comment flags anyway

oh huh

Shog9

well, no automatic penalty

Yeah I imagine particularly egregious offenses would warrant moderator action.

6:55 AM

7:08 AM

That's a pretty photograph.

:)

7:44 AM

@forest Don't spoil him

8:02 AM

@Margarine I haven't even watched Infinity War yet.

Still busy cleaning the bookshelves I presume

We'll see later this week...

Have to get around to binging the MCU at some point.

Hmm, MCU Movie Marathon might be a good idea to try...

10:05 AM

@Mithrandir what Avengers movies did you watch?

@Mithrandir nice! Kinneret?

10:20 AM

@Rob They are not. They're red on mobile and blue on desktop

@ShadowWizard No, Mediterranean

@ShadowWizard Phase One

11:07 AM

@NoDistractionWizard there's only about.... 8?

Though I lost track of who's the cogro/support CMs

Q: Why is the mod diamond (♦) red in Android?

12:46 PM

@Rob not really odd, you mean Cesar? He had active account only on a rather minor site (Card Games), and no rep expect association bonus on other sites when he got hired as a CM.

Anyway, no such thing "blue diamond", that's result of a different OS, e.g. on android the diamond is red.

16

Related: Why is the mod diamond red for question titles in the iOS app? ♦ I noticed that the mod diamond shows up red. I'm pretty sure it wasn't red not long ago. Has anything changed recently? I'm on: Android 6, Nexus 5 Stack Exchange v. 1.0.73 This is also true for the mobile view in ...

1:00 PM

@ShadowWizard eh, on Android, it's dependent on the OEM

And periodically the browser. FF overrides some emojis IIRC

more or less though, from a user standpoint

there's literally no difference between how a mod and CM is displayed

Which is particularly annoying when you're a MSE mod who is trying very hard not be seen as canonical ;p

1:17 PM

Sure. There's long been discussion about finding a way to indicate staff either on the account or the post.

The diamond is increasingly not the right solution for various reasons.

@Catija tbh y'all could just revive the old chaos trident

(There used to be a team of semi-cm/community growth folks who had a different symbol). They got mostly rolled into the regular CM team eventually)

or the hexagon used in teams?

The hexagon is dumb. Just... saying.

John Dvorak

I'd suggest a heart

@Catija and I don't think anyone but the old timers remember the phi

1:33 PM

I don't, for certain.

@Catija it wasn't a thing for very long.

and that project is something I view with rose tinted glasses and pushed for reviving for a bit. ;p

If we're marking posts , it could just say "Staff".

@Catija could work.

Question would be, would it be a "hat"

(I often talk of the "mod hat" and the "regular user hat" in meta posts ;p)

It does need to persist after someone leaves, though. That's why I wasn't thinking attaching it to the usercard.

@Olivia still, my point is it's not on SE side.

They use unicode character, how to display it is up to the device/OS/whatever being used by the user. :)

1:48 PM

true

@Catija in which case it would need to be attached to the post, not the user...

like the proposed extensions to use MSE for proper error tracking and blogging....;p

@Aibobot yep.

@Catija you mean the status tag edits? But one of the key features we now have is the ability to see who made it, and being able to ping them.

status tags could work there...

@ShadowWizard I guess the thing is say, if Jeff wrote something, it was official then and say not now

but but but that's for questions

the problem is for answers there's no clear way to say "this is the official SE view of things"

As a start, we can distinguish staff and mods by using a different tooltip and title in profile page, e.g. they'll show as "staff" instead of "moderator" for, well, SE staff.

1:57 PM

@Catija and there's "This is my personal viewpoint and does not reflect the opinion of my employer" posts

So still same diamond, but those who take better look, will see the difference.

I can think of one specific situation where people were teed off by a dev ;p

plz-delete coefficient meta.stackexchange.com/questions/328086/… @rene @TravisJ (@Bart and @Glor are not pingable....)

erf

Yesterday's rep on my main account...

199

2:13 PM

:O

user302202

Re-reading yesterday's script-generated email about Roy Montague, I noticed he was reported as an employee on several sites: TeX, Electrical Engineering, Board Games, Information Security (lol), PPCG, Fitness, Japanese, Martial Arts, Anime, Magento, CS50 (ugh), Joomla, Buddhism, Vi, Woodworking, Hardware Recs, CS Educators, and IPS. Hm.

user302202

The script calls /moderators API method on each site, and then checks is_employee for those returned. It got "employee" for the aforementioned sites, and simply "moderator" on the rest of the network.

user302202

So this looks less like a Shog's sockpuppet unleashed on a production server, and more like someone with an employee access doing something weird.

@VoteDukakis what email? What did I miss? :(

user302202

It's one of my Google Sheets contraptions that sends me an email when something funny happens on the network.

2:18 PM

Roy Montague

1

You mean that one was marked as employee???

user302202

Had a diamond network-wide. And used it. Reference: chat.meta.stackexchange.com/transcript/message/7710001#7710001 and what follows.

user302202

If the access was unauthorized (which is suggested by the network suspension), there was potential PII leak. Expect a legal threat from Sonic in 1...2...3...

Oof

@VoteDukakis ugh... major hack?

Guess we'll get some update in 6-8 months.

user302202

In happier news, Operations Research reached 100% commitment. Finally, there might be some place for not super-abstract math that is not deluged by homework.

user271002

2:24 PM

@VoteDukakis 1...2...3...?

@MilkyWay90 it's just dry facts: requests posted on Twitter by high profile people get a faster response from SE team, while getting zero attention on MSE.

@Loong 5... 6... 7...

user302202

5...6...8...b...j...b...

cat!!!

chat --meta-se | grep \\d | lolcat

I have 1L milk at home, with 200-800 ML daily consumption. So there's small risk tomorrow kids will be without milk. I don't really need anything else so don't want to go for shopping just for that. What should I do? Halp!

:D

!!/milk

SmokeDetector

2:28 PM

@ShadowWizard No such command 'milk'.

:(

user302202

@ShadowWizard Google "Uber but for milk"

You buy coffee, and use a milk extractor to separate the milk from the coffee. Problem solved ;p

Expected bot response:

in Shadow's Den, Oct 15 '15 at 21:23, by Moosebot

user302202

What happened to your friendly neighborhood milkman?

user302202

2:31 PM

Guy on TV show saying that Peru is like “50 years behind” the US because they still do things like deliver milk and bread, and yet there’s probably a startup with $50 million of funding in SV to do just that

Tweeted by oysta on May 27, 2018 at 2:34 AM

@VoteDukakis SFW? At office

(only one "t", but still...)

user302202

Unfortunately. Nothing interesting came up there.

oh wait. lol

No Uber here so forgot what it is. LOL

user302202

"Like Uber but in Israel and for milk", then.

We do have delivery service via taxi app though.

gett.com/il/delivery

I once used it to send my wife keys back to her after she forgot them in my bag.

(Which might explain some unexplained downvotes I got, now that I think of it. ;))

@VoteDukakis hehe, found a better job :D

user302202

2:37 PM

How could AU election page get broken during a weekend?

user302202

Is back up now.

@VoteDukakis maybe related to that suspended user? (e.g. he messed up with something before being kicked out of the system.)

user302202

BTW it seems a waste to run an election on this large site for just 1 mod. A lot of mental energy goes into it, a number of very strong candidates present themselves, and for little.

user302202

Choosing just 1 of Byte Commander, Zanna, and Videonauth.

@ShadowWizard Things seem to be different where you are:

MilkyWay90

2:45 PM

@VoteDukakis "Guy on TV Show"

It's blue because it's a link.

user302202

Diamonds may render in different color in different places. They are still identical for CMs and mods.

user302202

I.e., this is incorrect.

Thanks

user302202

I just had an idea. If the university wants more of its faculty to attend commencement/convocation and wear a stupid gown in the process, they can offer the choice: attend or donate $$ to endowment (e.g., a fund for student aid). I'd be very happy to take the second option, but a larger number of people may choose the first.

user302202

2:50 PM

(The reason I'm online now is that I'm hiding in a coffee shop while the aforementioned ridiculous thing is happening.)

@Rob didn't get the red part, but blue is for links... it's just a character so it get the color of the text which is expected.

Make it a toga party, toga optional.

user302202

> The manly toga itself could signify corruption, if worn too loosely, or worn over a long-sleeved, "effeminate" tunic, or woven too fine and thin, near transparent.

user302202

Gah people over-interpret everything all the time.

user302202

That said, I wouldn't pick the near-transparent kind, and you probably wouldn't want to see most of the faculty wearing that.

Q: Achievements can be used against us by trolls

2:54 PM

@forest maybe just trolling, same as....

47

First, please take a look in this video: http://www.youtube.com/watch?v=JVTsQZeVCSM The baby is having fun, but imagine someone would cause the lights in your own room to turn on and off over and over and over again? Irritating, isn't it? Now see this: It's real. (Thanks Manishearth for...

discussion top-bar trolling achievements-dialog

I used to work for the people who sold graduation regalia to the university students and staff at UT. We'd order the university-specific doctoral robes for any university... they're expensive and hot (velvet). But beautiful. It was neat to see the difference between the various university designs.

@Rob wrong wiki link. Correct one: en.wikipedia.org/wiki/Toga_party ;)

user302202

I bought the first thing that came up on Amazon search for "doctoral graduation gown".

@Rob still no slight idea what you mean by that, but guess it's not really important. lol

user302202

Apparently it didn't have a hood (whatever that is), but I didn't care.

2:58 PM

The design for UT was pretty cool, I thought. commencement.utexas.edu/graduates/regalia/doctoral-regalia

@VoteDukakis this one then?

Wait, IS IT YOU?! ;)

@VoteDukakis The university will have a specific hood, usually. And the colors match the department you're degreed in.

user302202

@ShadowWizard Yes, a white dude - since we're all essentially the same

These are pretty standardized unless the school is special somehow. washington.edu/graduation/graduation-colors

@VoteDukakis of course, we all have flesh and blood too. And DNA.

I'm going to click an icon with small yellow rectangle. So if I'm not coming back.... farewell and thanks for all the fish, everyone! :D

Buh looks like Microsoft clickbait to lure me into creating and signing in to Windows account. No, I won't fall for that.

I'm sure they send everything to their servers anyway, but still, giving them permission for that feels wrong. lol

3:09 PM

@ShadowWizard I offered the link for the 'faculty version', not the student grad version.

Still no idea what's that for and how it's related to diamond color, and with that, I'm off... cya! :D

user302202

You have to wear diamonds of the correct color with your graduation toga.

2

user302202

The color must match the university and the department.

3:31 PM

I think UCB has a decent gown and hood:

MEE the sneaky user

Hi everyone. Anything new about the "privilege escalation" thing?

So, I wouldn't complain about moderator status, but...

@MEEthesneakyuser entirely unofficially... But as someone who studied this sort of thing?

Waiting makes sense. Even if the hole is plugged it may not be in SE's or even our best interest for this to come out

Also while Adam replied... SE has a security team now and they probably will be the ones investigating

user271002

3:46 PM

@JourneymanGeek They have redshirts now?

Yup!

I should set Monday as Meta-Free Day...

I heard good things about the person in charge too

@NoDistractionWizard you can logout but never really leave

(and just for the record I heard about that on off site, not mod grapevine ;p)

MEE the sneaky user

By the way, why is a user's avatar shown in chat, if they are suspended on the main site. The suspension should set their rep to 1 and users with < 20 rep will not have their avatar shown.

rene

@ShadowWizard already taken care of. it is mothersday so I was away.

3:57 PM

Privilege escalation?

blablabla someone who is not nicael blablabla

user302202

@MEEthesneakyuser Maybe Meta chat doesn't follow that rule? Given the existence of 1-rep employees who use this chat.

user302202

Or, everything is broken and Jeremy can delete anyone's profile by typing a few lines in the browser console.

@VoteDukakis I suspect the employee and mod flags kinda give you full access

rene

4:28 PM

Oh irony ...

user302202

4:46 PM

SEDE Sunday: Users with the most answers in 2019. Gordon Linoff has 4201, over twice the count of the runner-up (jezrael with 1999).

Tinkeringbell

@VoteDukakis That's.... a lot of answers to write in less than 5 months o.0

user302202

After checking a few active sites, the third place network-wide should go to Kavi Rama Murthy on Math with 1605.

user302202

And DonAntonio has over 100, despite

user302202

> I can't agree anymore with the site's outlines of working and neither with the site's administration "making of justice" and direct insinuations of misuse, without possibility of defending oneself and without being able to retort absurd accusations and other nonsenses.
> I hereby shall stop my participation in this site at once.

user302202

Easier said than done.

Tinkeringbell

4:57 PM

@VoteDukakis People almost never make mods that happy ;)

Alex

5:09 PM

@VoteDukakis That's a lot of answers.

I'm two shy of 1,000 in the year and a half I've been participating.

How About a Nice Big Cup of

I'm only at 3k answers on SU in close to a decade

user302202

5:26 PM

I'm at... (looks for the spreadsheet with the list of old accounts)... 6392 on Math all-time. Too many.

user302202

Should have stopped sooner.

user302202

Heh, my old Meta account kept its name (unlike on Math, where it "triggered" someone)

user302202

1k 9 19

feature-request status-completed support bug android-app flags status-declined

user302202

The good old pre-welcoming days.

5:45 PM

@VoteDukakis I think I interacted with that account under my old account?

6:10 PM

@VoteDukakis Coffee? Water?! WHAT LIQUID?! screams

Hi there. I reported a bug a couple weeks ago which is now status-completed. I could post an answer along the lines of "gone now, see screenshot, kthanxbye", but that wouldn't feel very useful - is it improper if I just ping a mod here to slap the SC tag on it?

That's the question: meta.stackexchange.com/q/324962/398063

an answer documenting if it's already fixed is at least useful enough, like "as of rev xx.yy, the <issue> has been fixed. see screenshot"

or well, slapping the question with the tag might work (please consider the question's feeling...)

@Jenayah honestly the answer makes it more likely it gets retagged

Basically we essentially don't have any information you don't

So unless it's super obvious a bug is squashed we leave the tags to the CMs or devs to handle

Well... It was a missing capital that got back into being a capital, so that's not a very big deal :-)

In any case, I blame TypeScript migration >_>

6:20 PM

That's definitely the sorta thing where the answer with screenshots will help

Q: Inconsistency with case in tabs

oh nevermind, upion searching a bit more, it's... a dupe.

15

On the most pages text in tabs is capitalized: Home Questions Tags Tagged questions when Custom Lists is disabled: Unanswered But don't for users page: Is it intentional, or just oversight after fixing the related bug?

bug status-completed design tabs

@Jenayah I generally answer with "blah blah blah, [screenshot], thus this is now status-completed", it gets upvoted; then I flag it and it's usually helpful.

Should I answer and VTC then? Or only VTC?

@Jenayah Since it's a dupe go ahead and VTC

@SonictheInclusiveHedgehog Done and checked "solved my problem"

though going back to the SC tag, as the dupe is SC, should mine be as well?

(and sorry for the dupe, then :/ )

user302202

6:24 PM

If a bug is reported a bunch of time, and reports are dupe-closed, I don't expect mods to retag all of them.

If it's a different manifestation of the same bug, it might be both marked and closed as dupe

@Jenayah yes

@JourneymanGeek yes to which one? :-)

6:47 PM

I'd go for the answer, referencing the other post and the dupe closure

So if someone finds it it's still immediately useful

Let's circular dupe

hmmmm... I may have already closed it? :/

Does anyone have a site name suggestion for one of our newest sites: Operations Research - The current generic name seems like it's about researching operations (in the OR) or military planning.

Isn't it moot when Robert has decided to use OR?

> Yes, this site is slated to launch as "Operations Research". It was the community's top choice and we concur. This article summarizes some of the issues of naming sites. Wikipedia [Operations Research] is also sometimes a good source to provide a higher-level mainstream view of a how subject is commonly referenced. -- Our site name changed. Is it final?

They are accepting clearly better suggestions.

John Dvorak

6:56 PM

What is the site about?

Not HAM, nor ham

@Jenayah that's ok too