codidact / qpixel

Q&A-based community knowledge-sharing software
https://codidact.com
GNU Affero General Public License v3.0
375 stars 70 forks source link

show profile creation date/time to owner and mods #1340

Closed cellio closed 1 month ago

cellio commented 1 month ago

Based on a question in chat, this PR adds the date and time a profile was created, only for the owner and moderators. (Owner because it's yours and why not; mods because it might help with investigating certain kinds of abuse.)

Some sites show account age to everyone. If we decide to do this, I would suggest showing the full info to the owner and mods but showing at most only the date to everyone else. I don't know if there's a privacy reason to fuzz this more, so for now I'm not showing it publicly at all.

I considered adding this to the table of stats (top-level posts, answers, edits, etc), but all of those values are short while timestamps are long, so it flowed weirdly. I saw no clean way to fit it in there, so I made a separate new mini-section.

ws909 commented 1 month ago

I think it would be reasonable to hide the exact account creation date for everybody else, and instead show:

This provides a little bit of privacy such that users cannot get the exact date after the user has been a member for a while (unless their profile page was archived within 60 days), and it still shows others approximately for how long somebody has been a member (which can be useful in various situations).

Well, I guess people can also monitor user accounts for when the month number changes, but, I’d say that’s not too bad.

trichoplax commented 1 month ago

Well, I guess people can also monitor user accounts for when the month number changes, but, I’d say that’s not too bad.

Because of this possibility, the vague version of creation date does not add real privacy, and worse, it gives the false impression of privacy. I would prefer that the privacy level be clear and explicit - either showing the full date to everyone or showing nothing to anyone other than the user and moderators.

We could add randomness to try to prevent getting a specific date out of the vague version, but that seems to invite the possibility of privacy bugs, so I'd prefer to avoid that and stick to something simple.

I like the approach implemented here (only the user and moderators see the creation date). It might be nice to have a checkbox that allows people to make their account creation date public if they wish, but that can be a future feature if someone chooses to raise it. I see no reason to implement it in this pull request.