bsitu wrote:

https://gerrit.wikimedia.org/r/#/c/25200/

swalling wrote:

Wow, that was quick. Thanks Benny! :)

Will close when the change is +1/2-ed and merged. I assume it will ride the train into production next week.

Merged. Expected to appear in 1.20wmf13.

I'm reopening this for now because I'm a bit concerned both about the change and the implementation.

Sadly I think this is pretty high risk right now. We don't currently have any other way to delete moodbar comments, the hide function is the ONLY way, after that the next escalation is to manually edit the database. This leads us to some major issues and the hidden feedback includes things that would normall be oversighted such as libel or personal information. This is problematic for even sysops to have access to but, I believe, has been a compromise until a full OS option is available. In my opinion it seems absolutely unacceptable to have autoconfirmed users able to view and undelete at the very least without legal approval and a much comprehensive community consensus (with them having a full understanding of what they are giving away).

I'm also hesitant about the implementation. This shouldn't be in moodbar.php, it's a local change that even if implemented should be in commonsettings, not in the defaults.

Copying in Philippe because I know he's worked with the moodbar team before on some of the privacy and OS issues and will have a better understanding of legals needs.

swalling wrote:

(In reply to comment #4)

Sadly I think this is pretty high risk right now. We don't currently have any
other way to delete moodbar comments, the hide function is the ONLY way, after
that the next escalation is to manually edit the database.

James,

I'm sorry but you're completely wrong here.

There has _never_ been deletion of any kind (page deletion, revdeletion, or oversight) in FeedbackDashboard. Hiding is not a substitute for deletion, and should not be treated as such. Unhiding feedback is an option at any time when something is hidden, and there is no log of what has been hidden. There is no policy which outlines that hiding is equivalent to deletion, and if you look at the original bugs I linked to, opening hiding to autoconfirmed editors has long been considered for this very reason.

Copying in Philippe because I know he's worked with the moodbar team before on
some of the privacy and OS issues and will have a better understanding of
legals needs.

Remember that feedback, unlike wiki pages, does not appear in the wiki anywhere other than the Special page, and is not a part of XML dumps or accessible via the API.

This is why there was no deletion or oversight built into the tool to begin with. If legal would like to request to features engineering that we need these features in order to stay protected, they should do that. But it is not up to legal or you James to make decisions on features or associated permissions.

Actually, legal has been deeply involved in oversight and content removal here. :)

I've asked Howie to take a look.

Also, I was under the impression that any community member could weigh in on these bugs, Steven. I see this as James weighing in on a bug. I'm a little confused as to why you're discouraging that, but maybe we'll discuss that offline. :-)

Everyone, let's have the proverbial tea, shall we?

swalling wrote:

(In reply to comment #3)

Merged. Expected to appear in 1.20wmf13.

In case he's not reading, I'll ask Siebrand to unmerge for now.

swalling wrote:

https://gerrit.wikimedia.org/r/#/c/25586/

Courtesy Patrick.

swalling wrote:

(In reply to comment #4)

Sadly I think this is pretty high risk right now. We don't currently have any
other way to delete moodbar comments, the hide function is the ONLY way, after
that the next escalation is to manually edit the database. This leads us to
some major issues and the hidden feedback includes things that would normall be
oversighted such as libel or personal information. This is problematic for even
sysops to have access to but, I believe, has been a compromise until a full OS
option is available. In my opinion it seems absolutely unacceptable to have
autoconfirmed users able to view and undelete at the very least without legal
approval and a much comprehensive community consensus (with them having a full
understanding of what they are giving away).

The hide/unhide feature was not built with the oversight use case in mind, clearly. It wasn't even built for deletion. I don't like starting from the assumption that we should use it as such, because it means that it gives us an excuse to lag on building in oversight, and in the meantime cripple the community's ability to deal with the other kinds of feedback that really need to be removed.

The number of cases where this scenario would happen are much much smaller than the amount of really poor feedback or regular vandalism which need to be removed from the queue. Rather than playing to the edge case here for the tiny minority of content that merits oversight, I would like us to build in what's necessary to have a real oversight tool, not misuse something that should be more widely available and for a different purpose.

swalling wrote:

Request for real deletion added in #40729 per discussion with Philippe, Howie, et al.

swalling wrote:

(In reply to comment #10)

Request for real deletion added in #40729 per discussion with Philippe, Howie,
et al.

Okay, since delete has been added PB has given his thumbs up to re-add this user right change.

bsitu wrote:

https://gerrit.wikimedia.org/r/#/c/27486/

swalling wrote:

Deployed.