Timeline for Is someone botting API key removal suggested edits?
Current License: CC BY-SA 4.0
12 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Oct 15, 2022 at 2:55 | comment | added | Yrll | @Bobson, yeah I was thinking that redacting old posts with their API keys could not help because some might have copied and pasted it somewhere already. So maybe I was thinking of just monitoring new ones and editing them out before they get compromised. | |
Oct 14, 2022 at 15:15 | comment | added | Bobson | @Yrll - Just to expand on a different part of what Makyen said, there's a number of sites out there which basically just scrape and re-show content from SO. If any of them grabbed the key while it was visible, even redacting it here doesn't help. Maybe have a [feature-request] to detect an API key in a post before the user makes it in the first place and warn them? There's an old one asking to block it that was denied, but I think the "new question quality" checks are newer than that, so a warning might be doable. | |
Oct 14, 2022 at 10:30 | comment | added | Lundin | In addition to what @Makyen just said, the edit history of a post is also still fully available, so anyone can easily go and have a peek at the original version of the post. | |
Oct 14, 2022 at 4:52 | comment | added | Makyen Mod | @david-fong We're OK with the redaction flags, because redaction does help in many cases. Being OK with such flags doesn't mean it's the best solution. Once some private information, such as an API key, is posted, it's out in the world and there isn't any way to get it back to being fully private. The right solution for things that can be changed, such as API keys, is for the user to invalidate the key and use a new API key, which they, hopefully, have learned not to post indiscriminately. If the information can't be changed, then redaction is the best we can do. | |
Oct 14, 2022 at 4:16 | comment | added | starball | @Makyen and Machavity, (it was me helping with the flags) It's interesting that you both seem ok with the redaction request flags. Ryan M told me that it's not really the correct solution and that the correct solution is to tell the poster to cycle their API key (link). I agree. I think now that we know the purpose is to prevent accidental billing mishaps instead of for security and privacy, it's not useful to redact the edit history. That's my current thought anyway. Maybe I'll see/learn something new that changes my mind. | |
Oct 14, 2022 at 1:32 | vote | accept | Michael M. | ||
Oct 13, 2022 at 23:30 | comment | added | Jonathan Leffler | One day, when you get enough reputation, your edits won't need to be reviewed. You'll still need to be careful, and you should follow the feedback. Manual edits should fix other problems in the Q&A. Maybe you should answer some questions or perhaps ask some. | |
Oct 13, 2022 at 23:25 | comment | added | Yrll | Really appreciate all these feedback! Regarding the flagging for redaction, We were doing it before but we got banned from flagging after our flags got rejected multiple times with a message linking us to here: security.stackexchange.com/a/82977/283712. I believe the other users who helped in flagging got banned from flagging too. | |
Oct 13, 2022 at 15:59 | comment | added | Makyen Mod | If you are intending to flag for redaction, then it's better to have an edit revision which makes only the redaction changes and not fix everything. Changing only what needs redaction makes it much easier for moderators to know exactly what needs redaction. If we have to dig it out of a bunch of other changes at the same time, it can sometimes be unclear exactly what needs to be redacted. Under almost all circumstances, edits, particularly suggested edits, should fix everything, but when intending to ask for redaction, it's better to focus just on those changes. | |
Oct 13, 2022 at 15:05 | comment | added | Machavity Mod | I should note that other users have been noticing your edits and flagging them for redaction. Edits remove them from the visible post, but they can still be viewed in the revision history. For instance this edit you made has been redacted out of the original post. Your edit was useful to point out what needed removal, and now the key cannot be seen anymore (hence why your edit appears empty). Edit and flag, and we can take it from there. | |
Oct 13, 2022 at 9:13 | comment | added | Sabito | I have gone through some of your edits and I noticed that you just removed the API key without fixing other issues in the post... please try to fix all issues in the post before submitting the edit for review... for example here, you didn't fix the unnecessary capitalization in the post... and here you didn't remove the "I appreciate all the support, greetings." part and so on... Please go through How do I make a good edit? once... thanks | |
Oct 13, 2022 at 6:44 | history | answered | Yrll | CC BY-SA 4.0 |