{"action":"created","issue":{"url":"https://api.github.com/repos/hackmdio/hackmd/issues/766","repository_url":"https://api.github.com/repos/hackmdio/hackmd","labels_url":"https://api.github.com/repos/hackmdio/hackmd/issues/766/labels{/name}","comments_url":"https://api.github.com/repos/hackmdio/hackmd/issues/766/comments","events_url":"https://api.github.com/repos/hackmdio/hackmd/issues/766/events","html_url":"https://github.com/hackmdio/hackmd/issues/766","id":305573380,"number":766,"title":"Deleting a note should really delete the note in database","user":{"login":"dekonnection","id":8539442,"avatar_url":"https://avatars1.githubusercontent.com/u/8539442?v=4","gravatar_id":"","url":"https://api.github.com/users/dekonnection","html_url":"https://github.com/dekonnection","followers_url":"https://api.github.com/users/dekonnection/followers","following_url":"https://api.github.com/users/dekonnection/following{/other_user}","gists_url":"https://api.github.com/users/dekonnection/gists{/gist_id}","starred_url":"https://api.github.com/users/dekonnection/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dekonnection/subscriptions","organizations_url":"https://api.github.com/users/dekonnection/orgs","repos_url":"https://api.github.com/users/dekonnection/repos","events_url":"https://api.github.com/users/dekonnection/events{/privacy}","received_events_url":"https://api.github.com/users/dekonnection/received_events","type":"User","site_admin":false},"labels":[{"id":714542488,"url":"https://api.github.com/repos/hackmdio/hackmd/labels/database/sequelize","name":"database/sequelize","color":"fef2c0","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-03-15T14:23:37Z","updated_at":"2018-03-15T15:13:56Z","closed_at":null,"author_association":"NONE","body":"Hi,\r\n\r\nCurrently, it seems like deleting a note just marks the note as deleted (by adding the deletion date in the deletedAt field), but keep the note in the database.\r\n\r\nSince all notes are stored in plaintext, I know that the database administrator is able to see all the active notes, so user privacy is limited, but I think that a deleted note shouldn't be available, like, ever.\r\n\r\nDemonstration : \r\n\r\n```\r\nmysql> select * from Notes where content like '%mysecretnote%';\r\n+--------------------------------------+-----------+-------+------------+-----------+----------+----------------------------------------+-----------------------------------------------------------------------------+---------------------+---------------------+---------------------+---------------------+-----------+--------------------------------------+--------------------------------------+\r\n| id                                   | shortid   | alias | permission | viewcount | title    | content                                | authorship                                                                  | lastchangeAt        | savedAt             | createdAt           | updatedAt           | deletedAt | ownerId                              | lastchangeuserId                     |\r\n+--------------------------------------+-----------+-------+------------+-----------+----------+----------------------------------------+-----------------------------------------------------------------------------+---------------------+---------------------+---------------------+---------------------+-----------+--------------------------------------+--------------------------------------+\r\n| 8b530b18-0796-4833-a213-81189cadef20 | SJR4bZuKz | NULL  | private    |         0 | Untitled | mysecretnote that I don't want anymore | [[\"8c158b3e-ce0b-4550-8347-4f533f50aaba\",0,38,1521123644145,1521123662902]] | 2018-03-15 14:21:03 | 2018-03-15 14:20:38 | 2018-03-15 14:20:38 | 2018-03-15 14:21:03 | NULL      | 8c158b3e-ce0b-4550-8347-4f533f50aaba | 8c158b3e-ce0b-4550-8347-4f533f50aaba |\r\n+--------------------------------------+-----------+-------+------------+-----------+----------+----------------------------------------+-----------------------------------------------------------------------------+---------------------+---------------------+---------------------+---------------------+-----------+--------------------------------------+--------------------------------------+\r\n1 row in set (0.00 sec)\r\n```\r\n\r\nAfter deletion : \r\n```\r\nmysql> select * from Notes where content like '%mysecretnote%';\r\n+--------------------------------------+-----------+-------+------------+-----------+----------+----------------------------------------+-----------------------------------------------------------------------------+---------------------+---------------------+---------------------+---------------------+---------------------+--------------------------------------+--------------------------------------+\r\n| id                                   | shortid   | alias | permission | viewcount | title    | content                                | authorship                                                                  | lastchangeAt        | savedAt             | createdAt           | updatedAt           | deletedAt           | ownerId                              | lastchangeuserId                     |\r\n+--------------------------------------+-----------+-------+------------+-----------+----------+----------------------------------------+-----------------------------------------------------------------------------+---------------------+---------------------+---------------------+---------------------+---------------------+--------------------------------------+--------------------------------------+\r\n| 8b530b18-0796-4833-a213-81189cadef20 | SJR4bZuKz | NULL  | private    |         0 | Untitled | mysecretnote that I don't want anymore | [[\"8c158b3e-ce0b-4550-8347-4f533f50aaba\",0,38,1521123644145,1521123662902]] | 2018-03-15 14:21:03 | 2018-03-15 14:20:38 | 2018-03-15 14:20:38 | 2018-03-15 14:21:03 | 2018-03-15 14:21:18 | 8c158b3e-ce0b-4550-8347-4f533f50aaba | 8c158b3e-ce0b-4550-8347-4f533f50aaba |\r\n+--------------------------------------+-----------+-------+------------+-----------+----------+----------------------------------------+-----------------------------------------------------------------------------+---------------------+---------------------+---------------------+---------------------+---------------------+--------------------------------------+--------------------------------------+\r\n1 row in set (0.01 sec)\r\n```\r\n\r\nThanks for your work :)"},"comment":{"url":"https://api.github.com/repos/hackmdio/hackmd/issues/comments/373411301","html_url":"https://github.com/hackmdio/hackmd/issues/766#issuecomment-373411301","issue_url":"https://api.github.com/repos/hackmdio/hackmd/issues/766","id":373411301,"user":{"login":"ccoenen","id":124909,"avatar_url":"https://avatars3.githubusercontent.com/u/124909?v=4","gravatar_id":"","url":"https://api.github.com/users/ccoenen","html_url":"https://github.com/ccoenen","followers_url":"https://api.github.com/users/ccoenen/followers","following_url":"https://api.github.com/users/ccoenen/following{/other_user}","gists_url":"https://api.github.com/users/ccoenen/gists{/gist_id}","starred_url":"https://api.github.com/users/ccoenen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ccoenen/subscriptions","organizations_url":"https://api.github.com/users/ccoenen/orgs","repos_url":"https://api.github.com/users/ccoenen/repos","events_url":"https://api.github.com/users/ccoenen/events{/privacy}","received_events_url":"https://api.github.com/users/ccoenen/received_events","type":"User","site_admin":false},"created_at":"2018-03-15T15:13:56Z","updated_at":"2018-03-15T15:13:56Z","author_association":"CONTRIBUTOR","body":"That said: if you're not trusting the server administrator, you should keep in mind: they could have backups (or other ways of reconstructing the note) even if it was deleted.\r\n\r\nFrom a user's perspective i would not distinguish between different types of deletions, this will just confuse people. I would keep soft-delete as default and offer some means of \"undo\" for some period of time. Right now i'm thinking 1 hour, but this might not be a perfect fit for everyone, either."}}
{"actor":{"display_login":"ccoenen"}}