# Is it a security violation to show a directory of users?
**URL:** https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557
**Category:** Feature
**Created:** [March 20, 2015, 12:34am UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557 "2015-03-20T00:34:36Z")
**Posts on this page:** 20
**Page:** 3
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 24, 2015, 4:57am UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/41 "2015-03-24T04:57:29Z")
Well, that’s boring – I don’t care if you are a member if you never posted. What’s the point? Like a high school yearbook that shows pictures of people who never attended a day of class?
---
### Author:  [@downey](https://meta.discourse.org/u/downey)
#### Post date: [March 24, 2015, 5:05am UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/42 "2015-03-24T05:05:12Z")
> [@codinghorror](#):
>
> I don’t care if you are a member if you never posted. What’s the point?
Not all communities exist **only** within Discourse. And some communities are **new** users of Discourse with a large **existing** user base.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 24, 2015, 5:06am UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/43 "2015-03-24T05:06:19Z")
Fine, but that is not the design function of this page.
---
### Author:  [@Sander78](https://meta.discourse.org/u/Sander78)
#### Post date: [March 24, 2015, 7:08am UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/44 "2015-03-24T07:08:56Z")
The reason is indeed this:
> [@downey](#):
>
> Not if your clients post in a client-only private category.
---
### Author:  [@downey](https://meta.discourse.org/u/downey)
#### Post date: [March 24, 2015, 11:38am UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/45 "2015-03-24T11:38:46Z")
> [@watchmanmonitor](#):
>
> Oy - now the Users page is actually just an Active Users page? I would hope it’s title matches…
and
> [@codinghorror](#):
>
> that is not the design function of this page.
Hmm. So, what actually **is** the design function of the “user directory” then, if not to be a directory of users of the site?
---
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [March 24, 2015, 12:30pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/46 "2015-03-24T12:30:58Z")
> [@downey](#):
>
> > [@codinghorror](#):
> >
> > If someone posts, they are a customer, and you can see them posting.
>
> Not if your clients post in a client-only private category.
I have the alternative use case:
- Some public categories:
- for users to introduce themselves to the community (“Newbies” category")
- public “Events” categories.
- Some users get to by-pass posting in the “Newbies” category if introduced by a member of the community.
- Large number of non-public categories which contain the majority of content.
- Would still like the “Users Directory” to display non-public activity as this community is “effectively public”, just with a optional staging area for users as a gateway to the private categories.
- The larger community / activity exists in “private categories” - but the community very much sees this as public.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [March 24, 2015, 6:36pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/47 "2015-03-24T18:36:23Z")
> [@codinghorror](#):
>
> Yeah but someone who posts only in a private category would not show up in these stats, would they @eviltrout? I would say you need at least one post in a public category to be included in the users list.
Yes, it does not count activity from restricted categories.
---
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [March 25, 2015, 1:27am UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/48 "2015-03-25T01:27:47Z")
For me excluding restricted category content does not provide an accurate user directory view.
In same as removing the restricted category counts from the totals on the about page would.
Would posts from “Lounge” not be counted?
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [March 25, 2015, 2:56pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/49 "2015-03-25T14:56:03Z")
> [@DeanMarkTaylor](#):
>
> Would posts from “Lounge” not be counted?
Yes it’s a restricted category. I understand the argument, but it would be very inefficient to query a version of the user directory based on who is looking at it.
---
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [March 25, 2015, 3:38pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/50 "2015-03-25T15:38:40Z")
> [@eviltrout](#):
>
> I understand the argument, but it would be very inefficient to query a version of the user directory based on who is looking at it.
That wasn’t what I was thinking.
Perhaps the notion of a “public” or “private” forum / discourse instance…
For me the existence of a users activity on a public forum instance should display publicly - there is no issue in displaying a count of posts a user has made in the “Lounge”. If these counts do not include content from “restricted categories” my users will see the user directory as very broken.
For @Sander78 however displaying / including counts from “restricted categories” rises a privacy issue and I would consider his forum instance as “private”. Actually for him I would see the [trust](https://meta.discourse.org/groups/trust_level_0/members)(1) [level](https://meta.discourse.org/groups/trust_level_1/members)(2) [pages](https://meta.discourse.org/groups/trust_level_3/members)(3) as a further issue in terms of revealing who is using his forum privately.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [March 25, 2015, 3:47pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/51 "2015-03-25T15:47:12Z")
> [@DeanMarkTaylor](#):
>
> If these counts do not include content from “restricted categories” my users will see the user directory as very broken.
I disagree. I feel that most users would see counts of their private activity (ie restricted categories) to be a privacy issue. You can imagine someone watching their directory and saying “oh wow you can see them posting a lot of restricted stuff!”
It seems much safer just to exclude it.
---
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [March 25, 2015, 4:07pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/52 "2015-03-25T16:07:45Z")
> [@eviltrout](#):
>
> I feel that most users would see counts of their private activity (ie restricted categories) to be a privacy issue. You can imagine someone watching their directory and saying “oh wow you can see them posting a lot of restricted stuff!”
The issue I have is that ~90% of user activity occurs in “restricted categories” and I would like that to be seen in the Users Directory.
In my case users would say “where are my posts - I’ve posted - but my posts included in the count”.
---
### Author:  [@Sander78](https://meta.discourse.org/u/Sander78)
#### Post date: [March 25, 2015, 4:16pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/53 "2015-03-25T16:16:42Z")
> [@eviltrout](#):
>
> Yes, it does not count activity from restricted categories.
Well, then I’m totally happy with the user page as it is now. Because it serves my client’s needs of privacy at the same time (as long as they don’t post in a public category, but that’s ok).
---
### Author:  [@elberet](https://meta.discourse.org/u/elberet)
#### Post date: [March 25, 2015, 4:27pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/54 "2015-03-25T16:27:43Z")
Not necessarily. Yes, you have to cache more, but you could cache views / likes / whatever per category, filter by current user’s access list and sum the values in Ruby code. Since a list of accessible category IDs is available in the user model anyways, that should be O(n) on number of categories, no?
> [@eviltrout](#):
>
> I feel that most users would see counts of their private activity (ie restricted categories) to be a privacy issue.
This is only true due to Discourse’s binary interpretation of “public”. Any Discourse instance which’s users are predominantly members of an organization that the forum is intended to support will either appear uninviting to guests (when `login required` is set, there can be no truly public content _at all_) or will have to have a lot of “restricted” categories which are public in practice (i.e. require TL0 to access). 😕
---
### Author:  [@purldator](https://meta.discourse.org/u/purldator)
#### Post date: [March 25, 2015, 7:10pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/55 "2015-03-25T19:10:00Z")
> [@elberet](#):
>
> This is only true due to Discourse’s binary interpretation of “public”.
_That_ is what I have been meaning to speak about in regards to [private profiles](https://meta.discourse.org/t/is-there-any-possibility-that-only-members-can-view-the-personal-profiles/23948).
Either I have to completely shut off my community (private) or have restricted categories, _BUT_ ergo, Discourse considers the latter set up ‘public’ and thus other items (such as profiles, user activity listed elsewhere or not confusing things) are still technically ‘public’ and now open for every visitor or random passerby to gawk at.
At least with SMF I could fine-tune those things so I could have some in-between state. I could have public topics/categories to whet visitor’s appetites while keeping the rest of the forum (and profiles, et al) secure.
This in-between state could also allow me to have a public category for a top-level domain blog and allow visitors to interact with blog comments via Discourse. Can’t have that with Discourse if it means giving up privacy for my userbase with their profiles and other activity, or hints of it.
EDIT: To round this to the current topic, I will say that having privacy built into the new user directory would be moot for my ‘usual/old’ set up described above. In fact, I would highly welcome all the activity front and center for public view, especially if someone registers an account to use the front-end blog and eventually apply for the actual community (which is private). That way they can see who is active, and who they can possibly PM to ask questions. With the profile privacy feature idea, clicking to a profile yields a login wall for a guest. That is fine. When they actually sign up is when they would see profiles and then they can slowly go through the motions of applying to become a member of the private community.
But closing off the entire thing like some ivory tower wouldn’t allow me to use Discourse in conjunction with a public blog. Nor would I be able to show bits and pieces of the private community with topics and member profiles once they take the plunge and log in to explore more. If it isn’t for them, they simply don’t post and delete their account or just never log in.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 25, 2015, 9:50pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/56 "2015-03-25T21:50:48Z")
OK! we made some decisions on this
1. The user directory will now show _all_ stats for _all_ users no matter what category their posts are in. This is much simpler.
2. You can switch off user directory via a site setting if you have the sort of site where users seeing the mere presence of other users (even if they can’t see any of their posts) may cause issues. This is also simple.
I do think the underlying issues are irreconcilable, so this gives us a nice (and simple for the first version of this feature) way to allow both camps to have reasonable choices.
@eviltrout will make it so tomorrow.
(there is a more complex version of this where stats can be selected per-category but we don’t have time for that in v1.3)
---
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [March 26, 2015, 3:35am UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/58 "2015-03-26T03:35:25Z")
> [@watchmanmonitor](#):
>
> I just updated now, and can’t readily find the site setting to control /users
@watchmanmonitor It’s not implemented yet - wait ~24 hours as indicated by @codinghorror comment:
> [@codinghorror](#):
>
> @eviltrout will make it so tomorrow.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [March 26, 2015, 3:27pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/60 "2015-03-26T15:27:11Z")
Here is the functionality that @codinghorror mentioned:
[https://github.com/discourse/discourse/commit/2cc585816369afd2f1b0266615d78282a0a99ad8](https://github.com/discourse/discourse/commit/2cc585816369afd2f1b0266615d78282a0a99ad8)
The new site setting is called `enable_user_directory`
---
### Author:  [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [March 26, 2015, 8:51pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/61 "2015-03-26T20:51:24Z")
> [@eviltrout](#):
>
> The new site setting is called enable\_user\_directory
I was a bit surprised to see it under
Admin → Settings → Users
but I guess it makes as much sense there as anywhere else.
And some of the Admin pages are getting so long adding any more “trees” to them will get them lost in the “forest”
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 28, 2015, 8:51pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/62 "2015-03-28T20:51:38Z")
This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.
[Previous page](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557.md?page=2)