Page MenuHomePhabricator

Sorting by hit counts may partly reveal the numbers
Open, Needs TriagePublic


Similar to T120562: on Meta-Wiki anonymous users can see hit counts of those filters that are public. Hidden ones always have a blank field there. Sorting the table by hit count however reveals between what numbers it could be.

Event Timeline

matej_suchanek raised the priority of this task from to Needs Triage.
matej_suchanek updated the task description. (Show Details)
matej_suchanek added a project: AbuseFilter.
matej_suchanek subscribed.

What's the benefit of hiding the hit numbers?

Daimona subscribed.

The hit count is available with a way weaker right (abusefilter-log-detail) for public filters. Hiding the hit count for private filters may actually be useful. Anyway, since we need to stick to TablePager's methods, it should be enough to require abusefilter-log-detail AND abusefilter-view-private to sort the table by hit count. Hopefully in the future we may be able to provide a more selective sorting (for instance leaving private ones at the end), also capable of things like T52839 and sorting non-DB data like (when they will be added there) average execution time and conditions. However, either we abandon tablepager, strongly overwrite its methods or make the change directly in TablePager.

Change 431093 had a related patch set uploaded (by Daimona Eaytoy; owner: Daimona Eaytoy):
[mediawiki/extensions/AbuseFilter@master] Add a requirement for view-private to allow sorting hit counts

I don't think this is a good idea; those who cannot see private filters should still be able to sort the table by hit count.

Can you please explain why hiding the hit count for private filters may be useful?

We can't provide such selective sorting without a major change as explained above. I didn't have a specific situation where it'd be useful, I only thought we may give vandals (especially LTA) some info on how much a private filter is being triggered, although at the moment I can't think of a specific way to use this data. In any case, the right place to decide whether we want to make the hit count public is T21005.

If we don't have a reason to think the current state is actually harmful, why are we trying to change it? I'd rather wait for T21005 to be decided on.

Change 431093 abandoned by Daimona Eaytoy:
Add a requirement for view-private to allow sorting hit counts

Needs a better strategy

Daimona removed a project: Patch-For-Review.