Citadel of Zot

Fri, 25 Jan 2019 13:21:45 +0100

Hello !Hubzilla Support Forum

I just noticed that my posts where i mention my forum with double-! are still public, e.g. here:

Thomas Runge schrieb den folgenden Beitrag Wed, 23 Jan 2019 14:02:41 +0100

Fernseh-Tipp
Es gibt eine spannende Doku über Facebook in der Mediathek:

Facebook außer Kontrolle?

Rund 2,2 Milliarden Nutzer loggen sich mindestens einmal pro Monat bei Facebook ein. Das Netzwerk erreicht seine Nutzer ganz gezielt: mit Werbung, aber auch mit Meinungen.

!!MINT-Stammtisch Nürnberg/Erlangen

https://mint-n-er.de/channel/thomas/?f=&mid=e066448ac224646d70fc4422c0bf8207989fd7141ce282e420fa68aac32c368a@mint-n-er.de

There are several more examples in the stream of the forum.

This is a bug, isn't it?

show all 33 comments

Tanja

Fri, 25 Jan 2019 13:33:21 +0100

I think the !! just means the posts don't show up in you other connection's stream, unless they are also connected to the forum. For the posts to be private, I guess the forum would have to be private, but if the forum is public, everything shared to the forum would be public, too.

Thomas Runge

Fri, 25 Jan 2019 13:37:17 +0100

I think the !! just means the posts don't show up in you other connection's stream

The double-bash means that the post should be visible for all connections of the forum and only for those users. At least that used to be the meaning :)

There is no other way to send a private post to the members of the forum (unless you post directly as the forum).

Thomas Runge

Fri, 25 Jan 2019 13:47:58 +0100

I wanted to check how far back this issue reaches, but it seems that all my !!-messages ever are now public! That was definitely not the case until lately...

if the forum is public, everything shared to the forum would be public, too.

You can check that !!-posts are meant to be private by mentioning a forum with two ! and clicking the review-button. The review has the lock symbol for a private post, but the sent post will be public.

Tanja

Fri, 25 Jan 2019 13:51:39 +0100

The documentation is not very clear on this. The way I read it originally was the way I posted in my first comment, but looking at it again now, it's a little unclear and could easily be interpreted your way. When I click on your name from my channel, so that I'm logged in with remote auth, I can't see the post about the documentary from two days ago. I see this post, and the next one is 6 days old. I can, however, see it when I look at the forum channel.

Can somebody who knows better than me clear this up?

Mario Vavti

Fri, 25 Jan 2019 14:15:53 +0100

With !! you post to the forums wall.

If the forum default permission is public, the post will be public. It will not be public at your wall though since you shared the post with the forum only.

Thomas Runge

Fri, 25 Jan 2019 14:37:10 +0100

If the forum default permission is public, the post will be public. It will not be public at your wall though since you shared the post with the forum only.

Hmkay... so there is no way for me as a user to post something privately to the forum connections unless the forum itself is a private forum?

Shame...

Then I have been misunderstanding Mikes explanation for more than 8 months... now I know a bit more :)

Thanks!

Mario Vavti

Fri, 25 Jan 2019 14:48:08 +0100

Yes, @!mention is a shortcut to share a post only with the mentioned channel. !!forum-mention is a shortcut to share a post only with the mentioned forum-channel.

A forum always creates a "copy" oft the post with its own permissions - no matter what permissions you set...

Fraengii

Mon, 28 Jan 2019 17:01:41 +0100 last edited: Mon, 28 Jan 2019 17:03:18 +0100

Sorry, @Mario Vavti, I didn't really get what you wrote: With the @!-mention my post can only be seen on the forum wall and with the !!-mention it is send to al subscribers (contacts)? This way?

Mario Vavti

Mon, 28 Jan 2019 21:54:50 +0100

@Fraengii @! can not be used for forums. This is for "normal" channels only...

Thomas Runge

Wed, 30 Jan 2019 10:34:13 +0100

I'm sorry, but I have to add another thing to this issue: when I go to one of those posts via my stream I see lock symbols for private posts on both the post itself and on its comments. This is confusing, since it is actually a public post -- I guess this behaviour was what lead me to the assumption that I could send a private post to a forum.

Is there any possibility for me as a user to decide if I am about to comment on a public or private post? The lock symbol is obviously not helpful.

If the symbol is supposed to be only on private posts (as I thought it was) I would consider this a heavy privacy bug... if it is not supposed to be only on private posts I would consider this a usability bug, because the usual interpretation of a lock symbol would be "the information you see here is not public".

Mario Vavti

Wed, 30 Jan 2019 10:57:18 +0100

As mentioned above. The item is private at your channel - hence the lock. If you decide to post to a public forum, that is your own active decision. The item on the public forum channel will be public and will have no lock there.

Thomas Runge

Wed, 30 Jan 2019 11:14:46 +0100

The item is private at your channel - hence the lock. If you decide to post to a public forum, that is your own active decision.

May be... but the problem remains: "Is there any possibility for me as a user to decide if I am about to comment on a public or private post? The lock symbol is obviously not helpful."

Even if I want to post publicly to a forum today: weeks or months later there may be a comment on the initial post that I find having a lock symbol. I answer to this comment, seeing a lock symbol in my preview. I send and see the full post having lock symbols all over the place... then I log out and find the post to be public, all lock symbols gone.

This is very confusing!

What is the logic behind "the post is private for you, but public for anyone else"? Is the post in the forum and the one in my stream actually two different items even if comments will be added to both items? If not I see no use to the lock symbol, but if they are I see no use in comments being shared.

Mario Vavti

Wed, 30 Jan 2019 12:20:23 +0100

Sigh... I see what you mean but i don't know how to explain it better...

If you post to a public forum the forum creates a public "copy" of your post no matter what permissions you set. Your "copy" will keep the permissions you have set.

"Is there any possibility for me as a user to decide if I am about to comment on a public or private post? The lock symbol is obviously not helpful."

If there is a lock, the thread is private. If a public forum is mentioned in the toplevel post via ! or !!, the comment will be still private in this thread but public in the public forum.

Usecase: i want to post something to a public forum to be discussed there but i don't want the post to be visible on my channels public timeline for everybody (i am doing that a lot).

Conclusion: if you want your post to be private do not post it to a public forum (allthough you can).

If you are asking to remove the ability to !!-mention or !-mention a forum in a private post, this will have to be discussed in the community...

Thomas Runge

Wed, 30 Jan 2019 12:38:34 +0100 last edited: Wed, 30 Jan 2019 12:41:31 +0100

If you post to a public forum the forum creates a public "copy" of your post (...) If there is a lock, the thread is private.

That's what I mean: it is not a public copy of my private post, it is my private post, but appearing public to other users.

E.g. the post I mentioned in my first post here ("Fernseh-Tipp ..."): if I go to the post via my stream I see lock symbols in the initial post an in all comments. When I log out I see the same post with the same comments but without lock symbols -- hence you cannot trust the lock symbols to indicate a private post!

If you are asking to remove the ability to !!-mention or !-mention a forum (..)

No, I am suggesting to remove the (wrong and hence confusing) lock symbols on public posts... :)

Additionally: when I click on the link to the post from this forum I even have a permission denied message on my own post. When I then log out with the empty page (because of the "permission denied") still open I see the post including all comments.

Thomas Runge

Wed, 30 Jan 2019 12:58:17 +0100

By the way:

Your "copy" will keep the permissions you have set.

My "!!"-posts are usually not restricted (because I thought that the "!!" would set the permissions). So, just to be clear about my use case, this is exactly what I do and get:

1) write a post with "!!" to a forum channel, no changes in permissions (i.e. visibility "public")
2) click "Preview": the post appears with a lock symbol (!)
3) click "Send" -> the sent post also has a lock symbol (!)
5) comment on your post -> your new comment also have a lock symbol (!)
6) log out -> you see the same post with your comment, but now without lock symbols (!!!)

And the second use case:
a) "embed" your post from before in a new post
b) click on the link "...wrote the following post" -> the result is an empty page with hint "permission denied" (at least in my case with the link in this thread)
c) log out -> the post loads and is now visible to you

M. Dent

Wed, 30 Jan 2019 14:32:13 +0100 last edited: Wed, 30 Jan 2019 14:33:25 +0100

It's taken me a few days of looking at this thread to come to the point of agreeing this is at least not clear from a user standpoint. I think it seems from the fact that the lock represents only a partial reality. Unfortunately, because of the distributed nature of things, I'm not sure there is a way to give a user the "whole picture".

It may help to map out all the different circumstances that can arise then describe the message flow and the info available at each node. Maybe a clearer way to express reality on the UI can emerge from an accurate understanding of what's going on "inside the black box"

I don't have the opportunity to do this analysis myself right now, but maybe there is already a description somewhere that someone knows about. We need to make sure to validate it BEFORE we start talking about it. Otherwise the conversation will get nowhere and lead to confusion and frustration.

M. Dent

Wed, 30 Jan 2019 14:41:05 +0100

Maybe the answer is adding a second icon next to the lock if the message is a "forum" post. The lock represents the fact that YOUR HUB only allows those who have the proper permission to view the message/thread. A little group of people icon indicates that the message is distributed via a forum (and you have no control over who the forum sends the message to or whether it is ultimately public or private)

I'm just not sure that there is enough info available to the recipient hub to definitively communicate that info.

Thomas Runge

Wed, 30 Jan 2019 15:07:56 +0100

The lock represents the fact that YOUR HUB only allows those who have the proper permission to view the message/thread.

But this is not the case: both my personal channel (thomas@mint-n-er.de) and my forum channel (stammtisch@mint-n-er.de) are on the same hub. So the hub could know about the privacy state of the final post. But when logged in as thomas the post seems to be private, but when not logged in it suddenly is public...

Now I do get that the forum post is public and I do get that the "!!" sends the post to the forum without showing it in my own channel, but what I don't get is why there is the lock symbol. If you are willing to introduce a new icon then there should be a forum icon (as you suggest), but the lock should indicate the real privacy state of the post, i.e. if the post goes to a public forum it should appear "public" to me, if the forum is private it should have the lock.

If you can't use a new icon or do not have the information needed, then at least please remove the lock symbol that only appears because of the "!!".

Mike Macgirvin

Wed, 30 Jan 2019 20:40:41 +0100

Some miscellaneous comments:

If one uses privacy tags to tag a forum, they will be the only person who sees a lock. The other forum members will not.

The only advantage of posting to a public forum privately is that your normal "followers" won't see the forum post in your stream. This may be important for channels which do topical posts or photo blogs so that their channel stream appears to stay on topic.

The advantage of using privacy tags over ACLs (they both do the same thing), is that privacy tags can be seen by all the commenters so they know exactly who can see the conversation. With ACLs, only the post creator has knowledge of who can see the post.

Whenever you add a forum to a conversation with a forum tag, you also add all its members to the conversation; and this is true whether the post is public or private. In both cases you are handing over control of privacy to a third party. The forum has their own privacy settings which apply to all posts sent to the forum. So if you don't want a post to be visible to Google, you might not want to post it to a public forum.

Commenters don't get to decide anything about the privacy of their comments. The privacy is decided completely by the conversation creator. I've been looking at mechanisms to change this, but the privacy implications get "complicated" and apparently one is not allowed to create software which requires an IQ above 3 to operate; so I've left that alone.

Private forums are a different concept completely. You cannot post to a private forum using tags because this would allow somebody to share the private forum post with other people who were not in the forum. You can only post to these forums using the "wall-to-wall" mechanism. This concept is so hard to grasp that to date a couple of people have only used these things experimentally, although millions of people do it every day on Facebook. So apparently it is only open source software which is forced to be accessible to people with an IQ of 3, and commercial software is exempted from this rule.

Herbert Thielen

Thu, 31 Jan 2019 00:33:15 +0100

Well, Facebook users just don't care about privacy, I believe. That isn't related to any IQ requirement. The IQ required to use open source software is often necessary to read the sources, as the documentation is sometimes not up to date or complicated, and privacy stuff is seldomly self explaining, so don't be to harsh with your judgement. Open source resp. Free software needs much patience as everything of high value 😃

❦ CRIME LICH ❦

Thu, 31 Jan 2019 00:44:00 +0100

i have a forum that only allows wall to wall posts; it is not experimental.

M. Dent

Thu, 31 Jan 2019 03:40:55 +0100 last edited: Thu, 31 Jan 2019 04:56:47 +0100

PROPOSAL: @Mario Vavti @Max Kostikov @Mike Macgirvin

Change the $lock setting in include/conversation.php:L699 to be:


$lock = (($item['item_private'] || strlen($item['allow_cid']) || strlen($item['allow_gid']) || 
 strlen($item['deny_cid']) || strlen($item['deny_gid']))
 ? t('Private Message')
false
);

if ($lock) {
 if (count(get_terms_oftype($item['term'],TERM_FORUM))) {
 $lock=false;
 }
}

Likewise - the same change in Zotlabs/Lib/ThreadItem.php ~Line 102 or so.

These changes should remove the "lock" if there is a forum tagged in the item and alleviate the situation for most instances.

MR: https://framagit.org/hubzilla/core/merge_requests/1499

Mario Vavti

Thu, 31 Jan 2019 07:37:56 +0100

@M. Dent that would pretend that the post has no ACL allthough it has one.

Thomas Runge

Thu, 31 Jan 2019 07:56:35 +0100

that would pretend that the post has no ACL allthough it has one

From the users point of view it should not have any access limitation since (as I learned from Mike a few posts earlier) you usually only can use "!!" to post to public forums.

So, if the ACL only contains a (public) forum and it contains it only because of the "!!" (not because the user changed the privacy settings) it is from a user's viewpoint a public post, isn't it? At least that is what I would expect, i.e. it should be from my point of view ;)

I see the argument that you may want to have some indicator that the post is treated in a special way, but in my opinion the lock symbol is not the best choice, because it implies something different.

Mario Vavti

Thu, 31 Jan 2019 11:03:36 +0100

@Thomas Runge you can post to a public forum via !mention or !!mention.

The !mention will add the forum to the ACL. The !!mention will override the ACL and only post to the mentioned forum (similar to the @!mention for normal channels).

Olaf Wendt (Hz)

Thu, 31 Jan 2019 16:06:48 +0100

Excuse my dense question, but I lost you on "ACL" - for the second-language speakers, what does this acronym stand for (I could neither find that in /help nor in the glossary)? TYIA

❦ CRIME LICH ❦

Thu, 31 Jan 2019 16:43:31 +0100

@Olaf Wendt (Hz) access control list

Olaf Wendt (Hz)

Thu, 31 Jan 2019 16:45:45 +0100

Ah, I see, thank you! (And it's "you've lost me", not the other way round... I keep improving

)

❦ CRIME LICH ❦

Thu, 31 Jan 2019 16:59:51 +0100

anytime!

Mario Vavti

Thu, 31 Jan 2019 19:40:01 +0100

@Thomas Runge have you by chance sourced (channel sources app) the @MINT-Stammtisch Nürnberg/Erlangen channel?

Thomas Runge

Thu, 31 Jan 2019 23:03:56 +0100

have you by chance sourced (channel sources app) the @MINT-Stammtisch Nürnberg/Erlangen channel?

No.

Mario Vavti

Fri, 01 Feb 2019 19:05:06 +0100

Ok, trying to figure out why you see the public forum post on your channel timeline. This is unusual...

Mario Vavti

Fri, 01 Feb 2019 19:18:31 +0100

Also why you can not see the post via /channel/channelname?mid=item_mid

If you could provide me the db entries for the mid in question we might be able tofigure out what is going on.