I set an outcome to the proposal. I should be able to work on the implementation within a week.
Thanks, Florian. If I understand your outcome correctly, it will allow people to mention someone even when that person cannot see the post. This to me is problematic, and deserves further discussion - and the motion was only swung by one vote, so not a convincing majority.
I wouldn’t be happy for someone to be able to mention me if I were unable myself to view that mention - whether it’s a ‘regular link’ or a ‘mention link’. (I’m not sure what the difference is, apart from the notification.) Indeed, I’d rather be notified so I could at least then ask the person to remove the link if I wanted, rather than have no idea there was this link to my profile.
I think the better thing would be either:
- allow the mention (and notification) so at least the person mentioned knows that they have been mentioned,
or - stripping out the hyperlink completely.
I think that transforming it to a ‘regular link’ is the worst outcome, because that way there would still be a link to my profile, which I wouldn’t be able to see and wouldn’t even know if its existence. And I don’t feel this was the outcome of the vote, either.
I may well have misunderstood you. But if I have understood correctly, I think it needs further discussion about the issues (which are quite important, I think) before taking such action.
Best wishes.
Goob
We have a real issue here that needs to be fixed asap. The most simple solution with the least implications is to strip it. That doesn’t mean it has to be the answer for ever. But it’s the answer for the moment.
So I’m tempted to reopen the proposal and ask to vote for an intermediate solution. And after that we can discuss what the ideal behavior should be.
That’s a good idea, Jonne, and I support it.
Florian said I’ll work on the definitive solution in a week. We’ll not release a hotfix before that, so what’s the benefit of an intermediate solution?
I think that transforming it to a ‘regular link’ is the worst outcome, because that way there would still be a link to my profile, which I wouldn’t be able to see and wouldn’t even know if its existence. And I don’t feel this was the outcome of the vote, either.
@goob do you think so? If someone asks a question in a limited aspect, I’d love to answer “you should ask @someone”. The person will not see the conversation neither a notification, but the asker will be able to find him easily, independently of his pod. For the moment, I have to put the handle of the person because if I make a link (like diasp.org/u/someone) the user will not understand why I can’t add it from the profile (He is probably not on diasp.org).
For my, strip the notification and not allow the mentioned person to see the post but adding a link to his profile is the best solution. Your friend which is able to mention you is able to link to your profile anyway, stripping completely the mention does not solve the issue of “link to my profile”, it just complicates it as it is not “cross-pod”.
Fla, yes I do think so. I dislike it in exactly the same way as I dislike it when someone whom I have entrusted with my personal contact details gives my email address, phone number or house address to someone I don’t know without asking me first. It’s an invasion of my privacy, my choice to whom I give my contact details.
We can’t stop someone providing a link using Markdown to my profile in a post I am not allowed to read, but let’s not actually facilitate this behaviour (i.e. make it easy for them) by allowing them to do a mention, which then gets changed into a normal link.
Don’t forget that the mention being changed into a normal link is without the knowledge of the person doing the mention as well, unless they have read this discussion, for example. They would assume that I would receive a notification, as they had @-mentioned me, but this wouldn’t happen. Thus it’s not working for them and it’s not working for me. It’s just a privacy leak.
If you really want to mention me in a limited post in the way you suggest (‘you should ask @someone’), add me to the relevant aspect before posting.
If you don’t feel I should be reading the content you post to that aspect, you also shouldn’t be mentioning me in posts in that aspect. It’s as simple as that (I think).
@florianstaudacher - please don’t change the code to turn a mention into a standard link without further discussion, because that outcome was not even one of the two options that was being voted on, but something completely different.
alright … you have to understand, a quickfix for the privacy issue would probably take me half an hour, tops.
The description states my two easy-to-apply solutions, and I wasn’t sure which one would make more sense so I started this discussion. Then I put the first one up to a vote and waited 7 days for the result, which went 5:6 for not just removing the mention markup.
The only other quickfix option, while keeping the current aspect model and fixing the privacy leak, is to convert the mention into a link.
That can be done today, while we can start discussing a better solution to the whole Aspect/Mention situation altogether.
Thanks for your reply, Florian. I think I understand:
At the moment we have a ‘broken’ functionality - mentions to people not in an aspect send them notifications which they can’t see. This causes problems technically, and so needs to be ‘fixed’ immediately.
I would say the best stop-gap solution to a feature which is not working and is causing problems, if no better solution has yet been found, must be to remove that feature until a proper solution can be found which works properly and causes no problems.
In this case, that would mean stripping out mentions completely when a person mentioned is not in the relevant aspect.
I suspect when you set the vote, people who voted against it did so because they didn’t like the idea of mentions being completely stopped in such cases, not (necessarily) because they thought it is a good idea to replace mentions with an ordinary hyper-link as a stop-gap solution until a better solution has been found.
I think there are serious privacy issues here – we’d be facilitating a behaviour which shouldn’t be happening – and if your proposal had been worded in a way which allowed me to ‘block’ the suggestion of replacing mentions with an ordinary hyperlink, I would have done so, because I believe it is far worse than allowing people to use ‘real’ @-mentions (with notifications) in posts which the person mentioned can’t see. Using a standard hyperlink may be neater from a technical point of view, but I seriously think it is much worse from a privacy/user experience point of view.
So if you really need to ‘fix’ this mention behaviour today, I believe the only possible step is to remove the feature completely for the time being (by stripping out mentions and replacing with plain text), until a better long-term solution can be found and has been agreed on.
This may stop some people from doing something they want to – that is, to @-mention their contacts in posts which those contacts can’t read – but it’s debatable whether they should be doing that in any case. And we have to consider not just whether people want to do something, but also the consequences of enabling them to do it.
And we can then try to come to a decision on a long-term solution as quickly as possible so that this facility is not unavailable any longer than it needs to be – if, indeed, it is a good idea to have it at all.
Sorry this is so long, but I do think there are important considerations here.
btw it is also possible to mention a user who is not one of your contacts with @{name ; user@pod.tld}. I just tested that on my dev-pod. The post shows up in the stream of the mentioned user but he/she doesn’t get a notification.
Goob, I still don’t get your argument that a link to a user-page is vulnerating privacy. Could you explain a little more, since it seems to be quite important to you.
Doing some housekeeping on old Github issues, I found a discussion on this issue, which mirrors this one: https://github.com/diaspora/diaspora/issues/2516
Rasmus, I think I’ve explained it as well as I can. Apologies if it’s not clear to you.