Why has my upvoted answer about xz been silently deleted?

Question

On 24/03/30, a question was posted, whether the backdoor in xz is affecting Ubuntu:

• Is Ubuntu affected by the xz backdoor compromise?

I answered few hours later and received 5 upvotes.

My answer was deleted by the moderator Thomas Ward without telling his concerns. He used just the template with a link to a generic information which lists possible reasons like spam, commentary, another question and so on, nothing applies to my answer.

Since he didn't make a comment, what in particular his concern is, I didn't receive any notice from the system, that there is something wrong with my answer and that I should improve it, despite not telling, what needs to be improved.

I revisited the page today and was astonished, that this happened to my post. I consider this to be a very poor form of moderation, deleting competing answers without noting the author. He didn't even downvote my post, maybe to make me not aware of his intervention.

I thought it was considered best practice, to suggest improvements on posts, which you vote to close, if they aren't obviously sent with bad intend, like spam.

Update: Now, that my answer was undeleted, I'm more relaxed to the question. For the general handling of closing a question, I still believe, that answers, given in good faith with reasonable effort - I'm not talking about rude or offensive ones, spam or answers which aren't answers at all - should be closed, preferably with a reason why, so that the author can improve his post and maybe defend his position in comments. More so, a closed question or answer should trigger a notification.

If a moderator can't justify his reason to close, he shouldn't close it.

Answer 1

I strongly disagree both with the mod's decision to delete the post and with the way the post was handled.

In my opinion your suggestion of running the xz --version command is not problematic, since the OP is primarily concerned if an LTS is affected, which isn't. Running the command in an LTS is perfectly safe and reassuring for the OP to see that their version of xz is not the dangerous one.

The OP is also concerned if some other version is affected and, as you said, only 24.04 could be affected. Running the command in that version could pose a risk, however, 24.04 is still a development release, so if someone was running this release could already be at risk. Furthermore, if the OP was concerned specifically about 24.04, then their question would be off-topic and would get closed.

So for both the LTS and non-development releases, your answer is fine. It could be improved, however, by providing a way to check the installed version of xz without having to run it, so that the version checking would be safe for all releases. A safe version-checking command could be, for example:

apt-cache policy xz-utils

So this would be a nice improvement to your post. So the user that flagged your post could have also commented below your answer and expressed their concerns instead of just flagging it, and that would have most likely led you to find another way of checking the package's version.

However, the flagger's action is not my main concern here. It's the mod's action that matters more. The mod could have also expressed their concerns and comment below your post to let you know what the issue is with your post and then proceed to deletion, which wasn't really required in my opinion, but would be acceptable. Instead, the mod chose to delete the post without any justification of his action. While deleting a post with an explanation for the reason deletion is not obligatory, it is a good practice that can also lead to post improvement and subsequent undeletion. Our goal after all in this site is to have as many good questions and answers as possible.

Just deleting the post without any explanation about the reason of deletion feels as an extreme authoritative action in this case. And mods shouldn't perform such actions lightly. Okay, I don't expect an explanation for the deletion of every flagged post that was handled by a mod, but in this case the post wasn't clearly bad (I still don't think it is and that it should be undeleted) and at least an explanation for the deletion reason should have been provided.

Additonally, there is another answer to the same question that suggests to run the same command. Is this answer less dangerous?

Finally, I would like to remind that mods are also users, just with more tools and bigger responsibilities than non-mods, that are supposed to set the example for the community. As the rest of the users, they should justify their actions and not abuse their authority.

Answer 2

It is true that mods are not required to leave comments explaining deletions. It is still a good idea to do so though, to avoid precisely the confusion you describe in your question. So as a general rule, mods do try to leave comments.

However, sometimes they forget or don't have time to. Mods are human too, and if you need to go through a few dozen flags, as is often the case on Ask Ubuntu (or at least was, when I was a mod here), it isn't always possible to leave a comment on every one. It is just too time consuming. So, sometimes, mods will forget or choose not to leave a comment.

I completely understand how unpleasant this can be, but do bear in mind that mods are volunteers and they perform their moderation duties on their own time. There will be occasions where although leaving a comment would have been better, a frazzled mod who is currently doing 5 things in parallel just won't leave a comment. It happens. And it isn't against any rule.

Now, it is good practice never to act on a flag when you might be perceived as having a conflict of interest. I know Thomas and I don't for a second believe he deleted that post for anything other than the reasons explained in his answer. However, it's true that since he had an answer himself, it would have been better to leave the flag to another mod to handle to avoid even the possibility of anyone misinterpreting the action. But, again, mods are human. And Thomas's field is security, which means he—quite correctly—tends to feel he is knowledgeable enough to make calls on security related issues. And, well, he is, so he should, and he does.

All this to say that while Thomas could indeed have handled this better, first by not acting on a flag where he may be perceived as having a conflict of interest and second by taking the time to leave a comment explaining, both for you and for anyone else who isn't a mod but can see deleted posts, I do think it's clear he acted with good intentions and didn't do anything really wrong.

Answer 3

While certainly Thomas lacked leaving a (due in my opinion) comment, I second deleting the answer in the state it was when it was deleted (and in which apparently still is, which is: lacking a GIANT warning).

First off suggesting that the command is safe to run on supported Ubuntu releases makes suggesting to run it inherently useless advice. If it's safe to run on supported Ubuntu releases because those releases only provide safe versions of the command, then what is it that we're checking exactly? What are we doing here? And OTOH, why are we suggesting running potentially unsafe commands in unknown environments without warning about the potential consequences?

Overall I find anything beyond the initial "No" in the answer completely useless (it doesn't help users in learning something they're not aware of already after having read "No") and only potentially dangerous.

Addressing the users who're not running a supported release / a Ubuntu release at all and that may be tempted to run the command: while it's "technically correct" that one should do its homework and interpreting the answer as "This has been answered on Ask Ubuntu, answers there only apply to Ubuntu releases that were supported at the time the answers were posted + I shouldn't be blindly running commands found on the internet", do you think the average / potentially clueless user running 24.04 / MyOwnLinuxDistro would 100% debate the safety of that command?

It doesn't matter if they're running an unsupported relase / another distribution altoghether, there are obvious security implications to running that command which go beyond being on-topic / off-topic or correctly guessing what OP is using and deeming it safe for OP to run (the latter, as also suggested above, due to this site being primarely aimed to help everyone stumbling upon the post, not just OP).

At the very least there should be a GIANT warning.

So, being overall not useful (at the time it was posted there was at least Rinzwind's answer clearly stating that LTS versions are not affected already) + potentially dangerous in its current state = I'd rather not have it on the site.

While I'm all about free information, and while I agree this could've been handled better (I'm not judging Thomas at all, everyone makes mistakes, myself being the prime example; I'm just stating that objectively a comment was due there), I second censoring something that's not useful for those in a safe spot and that's only potentially dangerous to those who aren't. I'd rather have the user figure out another (safer) way to check if they're affected.

Answer 4

The post in question received a flag for moderator attention, alluding to the insecure approach you wrote of "executing potential malware" on the system in question as your 'solution' to determine if someone is vulnerable or not, which is substantially dangerous from a Security perspective.

This is the flag history on the post (with specific information redacted):

As your answer was written, it encourages user to execute the potentially-compromised executable files to gather information about the potentially-compromised executable. Doing so outside of a secure sandbox is dangerous, and as such I agreed with the custom mod flag. I've underlined in the deleted post here where you tell someone to execute the binary that could be compromised.

To that end, due to the danger of executing potentially compromised binary files and malware I deleted the answer as "Overwhelmingly unsafe to be posted". When a moderator deletes a flagged post, the moderator is not obligated to state why the answer was deleted, as moderation history etc. is available to moderators including post flag history, which I've attached here.