Privacy of Wikimedia Space

Is there a goal to make Wikimedia Space more privacy-minded than what Discourse provides by default? I think non-logged in users on Wikimedia Space honestly have it better as it stands, since it’s not being displayed how many visits they make and their link clicks are not not being tracked.

As glad I would be to get away from archaic mailing list setup Wikimedia communities use to track goings-on, this is a pretty big deal breaker for me and, I would guess, others (if they will become aware of this).

5 Likes

Hi @stjn, welcome.

In order to understand better your concern, can you specify which information you would prefer to keep private? I mean, only visits in that page or is there more?

Out of questionable things I noticed it’s this (showing visits of every single person on a public page) and link tracking (numbers shown next to external links). There might be more things like this, but I am not really well-versed in this discussion engine to make a judgment.

I would generally say whatever can not be tracked probably should stay non-public. In the users table, thios is View, Read, and Visits.

2 Likes

Just for context, Discourse displays View, Read and Visits because this data is used to compute user trust levels, which are public too. For instance, @Ymblanter recently became a member, thanks to his view, read and visits metrics among other factors. :tada:

I believe showing this data to other members is part of the design of Discourse, whose motto is civilized discussions. This software contains many features that contribute to keep discussions civil, and sharing who is who in a community through their involvement metrics is part of that.

So far this hasn’t been a goal per se, although we are very open to make the changes needed to make everyone feel safe and welcomed.

Discourse offers many user data points and also many configuration options. It also has a framework for fine grained access permissions. In addition to this, Discourse has a plugin system and is open source, meaning that technically almost everything can be fine tuned. With this I mean that the combinations are aplenty. With some patience, I am confident that we can find a reasonable level of privacy for our needs as a community.

Some things are simple, because they are already contemplated in the configuration options. For example, Maybe make Gravatar opt-in?

In the case of the information displayed in the user lists (and user cards, and user profiles), the only configuration available by default is

hide user profiles from public - Disable user cards, user profiles and user directory for anonymous users.

Therefore, the first question would be whether “non-public” means anonymous users, or also all registered users.

As far as I am aware, there is no plugin available to fine tune the visibility of these values in more detail. If we want to do this, we would need to commission the development of a plugin (can be done if this is considered a priority), and if we want to develop a plugin we will need to agreed on more refined requirements, like e.g. whether users of a certain trust level and/or moderators/admins could still see this information.

Even though it kind of feels like spilling the BEANS right now, adding to things that I think are harmful from the privacy standpoint: if you go to my profile page, there’s the same information about my topic-viewing and post-reading habits along with the number of days I have visited this website while logged in and even the time I have spent reading the posts.

I guess the authors of the forum felt it was appropriate for them to gather and share this kind of information, but I don’t think it’s appropriate for any kind of Wikimedia venue to do this. I’d say any Wikimedians will be better logged off on this website until those metrics will get turned off by default.

1 Like

Yes, I mentioned this in my comment above, explaining why the Discourse developers have designed it this way.

I also said that we are open to limit the information shared. We “just” need to get into the specific details in order to develop the desired functionality accordingly.

I realized that, so far in this discussion, the reasons for not showing this information are assumed. Let me ask: in your opinion, why showing views, read and visits of users is bad?

The potential benefits are to get an idea of someone’s involvement. What are the problems and why do they counterweight the benefits?

Honest questions!

Well, it is just a little bit like in real life. I sometimes publish articles in (mainly scientific) journals, and I am naturally fine with compiling the statistics what I publuished, when, and where. However, I am definitely not fine with someone collecting statistics on what I read, and I am absolutely not fine with anybody publishing these statistics. Here, the statistics of visits is probably not harmful (definitely less harmful than open statistics on what I read online), but still.

4 Likes

I’m not overly concerned about the visits statistic on the userpage, but I wouldn’t want any more information than that given out (and apologies if it isn’t – this is still a new platform for me). And maybe an option for users to hide that on their userpages would be nice, if it is a concern for some.

In Wikimedia projects, statistics are anonymised: you can see how much the community interacts with specific pages or the project in general, but you can’t tell whether @qgil-WMF visited the project (and how much did he visit) today or not. I think this should be a default in any Wikimedia venue, and there doesn’t need to be an explanation for doing the stuff that way.

But putting it more frankly, the wide availability of all these stats about involvement of each and every single person does not feel welcoming in any way. It is off-putting, it is something that people will inevitably account for when visiting, and it is, as I said, opposite to what we in Wikimedia movement do.

Based on the (very interesting!) discussion so far, we have decided to enable the setting mentioned above:

About the conversation itself:

Yes, but let’s look at more situations in real life. Imagine a weekly community meeting attended by many people, some of them every week, some of them sporadically, and only a few are regular speakers. One day a person raises their hand to speak. It is the first time that they will speak at the group, but the regulars have seen that person attending every meeting since the beginning, paying attention and listening. When that person starts to speak, it has way more recognition and trust by the group that someone who would just walk in for the first time.

And here, someone posting for the first time with high number of View, Read, and Visits would also get more recognition by default than a completely new user.

In Wikimedia projects, discussion channels are far from perfect. They seem to work well for certain types of people and certain types of discussion, but clearly not for all people and all types of conversation. At Space we have a chance to try to aim higher.

Again, if we’re going to make changes here we need to come up with concrete specs. We have started a conversation to get a list going.

I agree with you that Wikimedia discussion channels are awful in their general usability and some social aspects. What I do not agree with is the notion that privacy is something that is wrong about our discussion channels. That could not be further from the truth: the fact that no one tracks when and how much anyone reads any discussion venues is liberating, and it is not something that we should get rid of before really serious and numerous arguments in favour of doing so.

Just to clarify: the point of this topic was that all of these statistics (that expose an unreasonable amount of information about visitors) should be either disabled in their entirety or be opt-in. I don’t think that an opt-out provides a good solution for my concern, since it is more reasonable to have the same privacy expectations here as in other Wikimedia venues, and an opt-out that most people will not learn about does not provide the community with that.

I have been wondering how mailing list mirroring will work. Since Wikimedia emails are private, Discourse should not be allowed to recognize users by email address unless they do some kind of opt-in. I don’t think that’s the case currently.

Well, I do not know. So far, with one or two exceptions, I could somehow recognize all people whose posts I have seen - I know them either from the projects, or from Wikimedia-l, or from some collaborative projects on meta. And I am not a functionary, never been one, and I am not formally a member of any committee .Probably just everybody who knows abot this place and posts here is in a similar situation and can recognize pretty much everybody. I guess we do not get people appearing out of nowhere, and if we start getting them in some numbers I would call this very suspicious. I understand that in principle everybody is welcome here, but getting for example globally banned people here will hardly have a benefit to the place, even if they have previously watched a lot of topics.

Btw I guess just to register I need to identify myself with the phabricator account, which is associated with my global account.

I think the e-mail address from Phabricator is picked up, which might or might not be the same as the e-mail associated with the global account (actually, in my case they are different).

You can see how it works at https://discourse-mediawiki.wmflabs.org/c/mailing-list-mirrors/mediawiki-l

Discourse creates staged users for users whose email address used in the mailing list don’t belong to any existing Discourse user.

Since Wikimedia emails are private, Discourse should not be allowed to recognize users by email address unless they do some kind of opt-in.

I think it is fair to assume that most users active in mailing lists with the same email addresses used in their Wikimedia accounts are going to be pleased by the automatic integration of their accounts here. Mailman exposes email addresses to everyone (something that MediaWiki and Discourse avoid). Mailman users sensitive to privacy should use dedicated email addresses for mailing lists (and many I know do).

I’d rather invest our time and energy in making Discourse fit for Mailman users, and leave Mailman behind – see Integrating mailing lists to Wikimedia Space.

Wikimedia login for Space is in the works. Once we get rid of the interim Phabricator login, the email used in Wikimedia SUL accounts will be the same used here.

1 Like

I don’t think this is true already today, and if we succeed in our efforts this should be not true for a big majority of Space users in the future. The main motivation of Wikimedia Space is to support the clear drive for growth brought by the Wikimedia Strategy and the Wikimedia Foundation medium-term plan.

Less than a quarter after its release as a prototype, Wikimedia Space has today more than 300 registered users, and counting. Our ambition is to bring not only the usual suspects to one place, but also newcomers as in new individuals and new communities joining Wikimedia. We are focusing on movement organizers first, because they are the first ones to validate the Wikimedia Space and help build it, but as soon as we have the main building blocks in place and a critical mass we will start targeting newcomers too, for instance the ones these movement organizers are bringing in and want to support well. You can see a hint of this in our initial focus on events through the events map and calendar.

All this to say that yes, we expect the user activity data to be useful for new and old Wikimedians to get to know other Space fellows beyond our usual circles and other known contacts.