WTF Login issue?

April 23, 2012 11:15 AM

I am somehow suddenly logged into Metafilter as someone else (that I don't know) - without changing cookies or logging out.

I can see their most recent post under "Recent Activity", and my username at the top of the page is "namewithoutwords", instead of "IAmBroom".

Matthowie, please contact me.

iambroom @ gmail.com, but Memail should go there.

Update: After reloading twice, I finally got back to being me. Still, pretty weird. Prob something Mathowie should investigate.

posted by IAmBroom to Bugs at 11:15 AM (64 comments total)

This is a known issue that has to do with a weird caching side effect that some ISPs, workplaces and schools have. Basically they'll show you a version of the page they have cached that is not *your* version. You would not have been able to post as that person or send MeMail as them, but I know it's weird to see happening. We mention it in the faq here.
posted by jessamyn (staff) at 11:20 AM on April 23, 2012

does that mean that namewithoutwords and IAmBroom work in the same place? Totes awkward yo.
posted by Think_Long at 11:23 AM on April 23, 2012 [2 favorites]

You could read their memails, though, if they had cached them by viewing them before you tried to.

Might be a good idea to make memails https?
posted by empath at 11:25 AM on April 23, 2012

oh iSp. nevermind.
posted by Think_Long at 11:25 AM on April 23, 2012

You could read their memails, though, if they had cached them by viewing them before you tried to.

No, you couldn't. Before you can read MeFi Mail, your cookies are verified against the database. So the caching problem wouldn't apply there.
posted by pb (staff) at 11:30 AM on April 23, 2012

I think the server was just being cheeky. It thought you were being unnecessarily explicit in pointing out that you are in fact Broom, so it figured giving you a namewithoutwords would be a good way to take you down a notch.
posted by koeselitz at 11:31 AM on April 23, 2012 [3 favorites]

No, you couldn't. Before you can read MeFi Mail, your cookies are verified against the database. So the caching problem wouldn't apply there.

Can you elaborate? If it's a server side check and the page is cached, how would that happen?
posted by empath at 11:33 AM on April 23, 2012

oh that's true. If you're seeing a locally cached version of the page it might not go through the more rigorous check. You definitely can't change data on the server without authenticating, but you're right, that requires a trip to the server.
posted by pb (staff) at 11:39 AM on April 23, 2012

I think you can set a no-cache attribute in the header, though, can't you? If the firewall is well-behaved it shouldn't cache it.
posted by empath at 11:45 AM on April 23, 2012 [1 favorite]

Yes, we can. We should do that for every page in the /contribute directory.
posted by pb (staff) at 11:46 AM on April 23, 2012 [1 favorite]

Desjardins' and Bunny Ultramod's idea for a Spock and Kirk love story are pretty good, ya'll should definitely work up a treatment. Leave out the scene in the engine room though, that's a damn weird use of dilithium crystals.
posted by Brandon Blatcher at 11:59 AM on April 23, 2012

I added cache-control and pragma headers to everything in the /contribute directory. That includes MeFi Mail and Recent Activity.
posted by pb (staff) at 11:59 AM on April 23, 2012 [2 favorites]

Well, this is awkward.
posted by namewithoutwords at 12:10 PM on April 23, 2012 [81 favorites]

Iamwithoutwords or namewithoutbroom?
posted by JohnnyGunn at 12:28 PM on April 23, 2012

jessamyn : This is a known issue that has to do with a weird caching side effect that some ISPs, workplaces and schools have.

Weirdly, namewithoutwords works (geographically) where I used to work, pre2006. Not sure yet if we were at the same company... but it's possible my new company and his use the same ISP, I guess.
posted by IAmBroom at 12:37 PM on April 23, 2012

And, the cache-vs-database seems to be correct. From "his" pages, I can't Memail others as him, nor read his Memail. But I can access his recent activity... which is a really sucky superpower.
posted by IAmBroom at 12:38 PM on April 23, 2012 [1 favorite]

But I can access his recent activity

The changes I just made should stop that from happening in the future.
posted by pb (staff) at 12:50 PM on April 23, 2012 [1 favorite]

pb needs laser beam sound effects or something.
posted by carsonb at 12:54 PM on April 23, 2012 [4 favorites]

Welcome to the cabal, IAmBroom.

There is no cabal.
posted by The 10th Regiment of Foot at 1:05 PM on April 23, 2012 [1 favorite]

There was a glitch in the Matrix, people. Everything's fine now.
posted by vidur at 1:12 PM on April 23, 2012

*rubs hand together* the device is working ...good good
posted by The Whelk at 1:16 PM on April 23, 2012

Wait, so - the username at the top of the page was his, but you were able to post this under your own username? That's bizarre.
posted by LobsterMitten at 1:22 PM on April 23, 2012

Wait, so - the username at the top of the page was his, but you were able to post this under your own username? That's bizarre.

Cosmetically bizarre, but a way, way better outcome than being able to post this under the other guy's username.
posted by cortex (staff) at 1:24 PM on April 23, 2012 [2 favorites]

You would not have been able to post as that person or send MeMail as them

Says you. I've been posting as Horace Rumpole for months now and he still hasn't caught on.

Protip: All the funny jokes are mine.
posted by Horace Rumpole at 1:28 PM on April 23, 2012 [2 favorites]

All those comments I got timed-out for?

Totally someone else!
posted by Trurl at 1:28 PM on April 23, 2012 [3 favorites]

a way, way better outcome than being able to post this under the other guy's username

Well, yes. I was more commenting on the surprisingness of these two things (displayed name vs posting name) being held in different "places" in the browser or whatever. I have even read that entry in the FAQ before and not really understood what it meant.
posted by LobsterMitten at 1:34 PM on April 23, 2012

Or, shorter:
This thing you are talking about, it is a thing? Wow.
posted by LobsterMitten at 1:35 PM on April 23, 2012

If this happens to anybody with my username and you are able to post, please post something really awesome that garners many favorites. Thanx.
posted by etc. at 1:38 PM on April 23, 2012 [2 favorites]

All those comments I got timed-out for?
Totally someone else!
posted by Trurl at 4:28 PM on April 23 [+] [!]

I heard it was some dude named Joe.
posted by aught at 1:47 PM on April 23, 2012 [2 favorites]

"You would not have been able to post as that person or send MeMail as them"

Aww, man, I was gonna blame my crummy FPPs on that.
posted by klangklangston at 1:54 PM on April 23, 2012

This thing you are talking about, it is a thing? Wow.

Yeah it's sort of counterintuitive that you can see a cached version of a page that might not be your cached version but some upstream server's cached version. We've got checks in place that mean that when you're posting/commenting and reading/writing MeMail you can only do that AS YOU but there are some weirdnesses about the occasional faulty display thing. We're as curious about it other folks since it only comes up really rarely but when it does, it's really mind-bending. The tweak pb made today should make it even less of a "wtf" occurrence hopefully.
posted by jessamyn (staff) at 2:10 PM on April 23, 2012

Update: I'm still posting as Horace Rumpole. What a loser!
posted by shakespeherian at 2:20 PM on April 23, 2012 [3 favorites]

oh goddammit
posted by shakespeherian at 2:20 PM on April 23, 2012 [2 favorites]

I'd say the whelk should have better things to do but he really doesn't.
posted by The Whelk at 2:22 PM on April 23, 2012

metafilter.com and metatalk seem to be sending cache-control: private consistently, but the other sub-sites aren't. Without explicit cache-control or expires headers, caches are left to their own devices when determining whether content should be cached and for how long it should be served. This is happening when set-cookie is present, which means a cache is free to re-send that set-cookie to subsequent visitors passing through it. Adding cache-control: private to all logged-in responses will fix it for well-behaving caches.

http://redbot.org is extremely useful for testing such things.
posted by gregjones at 2:23 PM on April 23, 2012 [1 favorite]

I'm Spartacus.
posted by Sidhedevil at 2:27 PM on April 23, 2012 [1 favorite]

Burhanistan: "Everyone shares in Pittsburgh."

It's true, it's pretty much just a big hippy commune here.
posted by octothorpe at 2:36 PM on April 23, 2012

More importantly, you might want to look into how namewithoutwords got into your house and whether that is or is not the screenname of the Tall Man.
posted by Potomac Avenue at 2:51 PM on April 23, 2012

Sidhedevil: "I'm Spartacus."

How do you do? I'm The Doctor.
posted by zarq at 2:51 PM on April 23, 2012

I'm Bond.
posted by The Whelk at 2:56 PM on April 23, 2012

I'm Doctor Bondacus.
posted by Salvor Hardin at 2:59 PM on April 23, 2012

Julian Bond? Nice to meet you.
posted by zarq at 2:59 PM on April 23, 2012

Adding cache-control: private to all logged-in responses will fix it for well-behaving caches.

That's true, we should add that to all logged-in requests. Even though this bug is extremely rare it'd be good to get rid of it.
posted by pb (staff) at 3:04 PM on April 23, 2012

Are there load balancers in the metafilter environment at all? I have seen load balancing methods set to match large enough prefix lengths such that mega-proxies were calculated to be a single connection when in reality there were multiple users behind that subnet range.
posted by roboton666 at 3:12 PM on April 23, 2012

No, no load balancers.
posted by pb (staff) at 3:20 PM on April 23, 2012

I'm Doctor Bondacus.

And so's my wife!
posted by Holy Zarquon's Singing Fish at 3:29 PM on April 23, 2012

Huhn, turns out there actually is a Julian Bond, I thought that was a typo. I wonder if they accidentally get each other's mail sometimes.

If so, you have my sympathy, Mr. Bond.
posted by Alvy Ampersand at 3:48 PM on April 23, 2012

Metafilter Lady Gaga: Cosmetically bizarre
posted by HuronBob at 5:12 PM on April 23, 2012

Still me. [sighs]
posted by arcticseal at 5:35 PM on April 23, 2012 [1 favorite]

I am somehow suddenly logged into Metafilter as someone else (that I don't know)

Whom.

yw
posted by George_Spiggott at 7:23 PM on April 23, 2012

I am Spartacus.
posted by swift at 7:46 PM on April 23, 2012

With the wisdom of my advancing years, I decline to give into the temptation offered by cookie jobs, clean sweeps and yunz.
posted by infini at 2:17 AM on April 24, 2012

What is a cookie job? Who was typing here just now?
posted by infini at 2:18 AM on April 24, 2012

> I am somehow suddenly logged into Metafilter as someone else (that I don't know)

Whom.

yw

Not sure what "yw" means here, but in case you're serious: there is nothing wrong with "that" in this construction. The demand for "who(m)" in all cases when human beings are referred to is one of those recent bits of peevery with no foundation in actual English usage.
posted by languagehat at 9:21 AM on April 24, 2012 [2 favorites]

I am somehow suddenly logged into Metafilter as someone else (that I don't know)

Whom.

yw

Incorrect, George_Spiggott. I have since met the other Mefite, and uncovered that "he" is in fact a webspider, based largely on code developed in Uzbekistan.

Nice enough fellow, if you don't mind *nix-based programs.
posted by IAmBroom at 10:04 AM on April 24, 2012

If that whom is whom that 'that whom' is referring to, then who is that?
posted by blue_beetle at 10:07 AM on April 24, 2012

the
posted by SpiffyRob at 10:25 AM on April 24, 2012

Whom that who say whom that?
posted by Sidhedevil at 10:44 AM on April 24, 2012

by whom was babby formed
posted by cortex (staff) at 11:02 AM on April 24, 2012 [2 favorites]

I resent the implication that I am a web spider.

my robots.txt file disallows all.
posted by namewithoutwords at 11:19 AM on April 24, 2012

We need to rethink spelling on whom, it is often spoken as though having some sort of uh, or e, sound.

Whom looks like an om nom nom opoeia for the sound which large tarpaulins make when whipping in the wind winding up to a storm.
posted by infinite intimation at 11:30 AM on April 24, 2012

Desmond?
posted by maryr at 11:50 AM on April 24, 2012

Spare Oom?
posted by subbes at 4:13 PM on April 24, 2012

To HooM it may concern;

He(dry-cat-hiss-sound)UME, that sounds off.

(To say it old school "prop-ly", I think you have to pronounce (as in pro-NOWnce, [or is that "PRO-NUNce"]) it this way: To "Hugh-m" it may concern [mu-huhmu-uh-mu-ha, British Moustache-filled-mumble-chuff]).

It gets hard to say after saying it a few times. The end obviously sounds like Fume almost any way I say it, but the start is feeling strange, and it seems to be a different word when trying to think of it as British English speaking, instead of American English speaking (I was thinking the uh, or deadened e was at the end).
-WHOMP, in the many ways of WORDS!
posted by infinite intimation at 7:51 PM on April 24, 2012