{"action":"created","issue":{"url":"https://api.github.com/repos/gitterHQ/gitter/issues/332","labels_url":"https://api.github.com/repos/gitterHQ/gitter/issues/332/labels{/name}","comments_url":"https://api.github.com/repos/gitterHQ/gitter/issues/332/comments","events_url":"https://api.github.com/repos/gitterHQ/gitter/issues/332/events","html_url":"https://github.com/gitterHQ/gitter/issues/332","id":39354275,"number":332,"title":"Security Issue: Sensitive Uploads not deletable","user":{"login":"SecUpwN","id":6000299,"avatar_url":"https://avatars.githubusercontent.com/u/6000299?v=3","gravatar_id":"","url":"https://api.github.com/users/SecUpwN","html_url":"https://github.com/SecUpwN","followers_url":"https://api.github.com/users/SecUpwN/followers","following_url":"https://api.github.com/users/SecUpwN/following{/other_user}","gists_url":"https://api.github.com/users/SecUpwN/gists{/gist_id}","starred_url":"https://api.github.com/users/SecUpwN/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SecUpwN/subscriptions","organizations_url":"https://api.github.com/users/SecUpwN/orgs","repos_url":"https://api.github.com/users/SecUpwN/repos","events_url":"https://api.github.com/users/SecUpwN/events{/privacy}","received_events_url":"https://api.github.com/users/SecUpwN/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2014-08-02T18:20:52Z","updated_at":"2015-12-02T11:56:23Z","closed_at":"2014-08-04T15:28:35Z","body":"Good evening, Ladies and Gentlemen!\r\n\r\nWhile I very much enjoy Gitter since 3 days now, I have to open this Issue because it appeared that a user uploaded sensitive data to the public chat of our security-project, the [Android IMSI-Catcher Detector](http://secupwn.github.io/Android-IMSI-Catcher-Detector). Talking to the developers of Gitter in their own chat, I was presented with not being able to delete anything that is being published there. It will be visible for everyone (even unregistered users) and forever. Great!\r\n\r\nBeing the owner of the main repository and creator of the corresponding chat room, I consider this to be a **huge security Issue**. Of course, I can edit my own posts until 4 minutes have passed - but what about **sensitive** content other people post, even if not intended? Don't I have the right to delete as an admin?\r\n\r\nIf this is not going to be resolved as desired, I'm afraid I'll have to fully delete our Gitter account (which I really don't want to do since Gitter is awesome). Especially security-related projects such as ours rely on the possibility of defending the anonymity of contributors and, at the very least, delete sensitive content."},"comment":{"url":"https://api.github.com/repos/gitterHQ/gitter/issues/comments/161271117","html_url":"https://github.com/gitterHQ/gitter/issues/332#issuecomment-161271117","issue_url":"https://api.github.com/repos/gitterHQ/gitter/issues/332","id":161271117,"user":{"login":"mydigitalself","id":1491887,"avatar_url":"https://avatars.githubusercontent.com/u/1491887?v=3","gravatar_id":"","url":"https://api.github.com/users/mydigitalself","html_url":"https://github.com/mydigitalself","followers_url":"https://api.github.com/users/mydigitalself/followers","following_url":"https://api.github.com/users/mydigitalself/following{/other_user}","gists_url":"https://api.github.com/users/mydigitalself/gists{/gist_id}","starred_url":"https://api.github.com/users/mydigitalself/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mydigitalself/subscriptions","organizations_url":"https://api.github.com/users/mydigitalself/orgs","repos_url":"https://api.github.com/users/mydigitalself/repos","events_url":"https://api.github.com/users/mydigitalself/events{/privacy}","received_events_url":"https://api.github.com/users/mydigitalself/received_events","type":"User","site_admin":false},"created_at":"2015-12-02T11:56:22Z","updated_at":"2015-12-02T11:56:22Z","body":"@Kryptos-FR Let's be perfectly clear on one thing here, the issue has absolutely nothing to do with laziness and any insinuation otherwise is pretty disrespectful to a small team who work exceptionally long hours trying to build a great service.\r\n\r\nSecondly, we're constantly listening to our users and have and will continue to act on individual requests for the deletion of content. We have helped people to remove spam and abuse as well as sensitive information erroneously posted.\r\n\r\nThere's a very fine balance here to be struck that has multiple competing pressures and I'll be the first to admit that we haven't always got it right, but rest assured we're always listening. By way of example, I've seen communities where owners have requested the deletion of messages that, quite literally, just strongly disagree with a position or an action and are in no ways abusive or infringing on copyright and such. This is an environment that we've strongly been opposed to creating and have perhaps taken decisions that sway towards this position at the cost of other scenarios. We've also wanted to create an environment where people can't just be abusive, knowing that they can inflict emotional damage at a point in time and then delete it thereafter as if it never happened. \r\n\r\nFinally, we are right now in the process of defining improved moderation capability and will be revisiting some of our previous decision making around the matter. This includes not only the amount of time given to edit or remove a message as well as giving administrators the ability to delete messages and for the community to flag messages.."}}