0E800 I believe it should not give out information related to:
Toby is the admin.
Toby joined 2014
Toby was last seen 2017
If Toby was also in any other groups.
Wasn't it the explicit wish of @Ralkage to let guests view the user list? If he wouldn't want that, he could simply revoke that permission.
On the other hand, I would like to somewhat restrict the amount of information given to non-members. Like Franz Franz, we shouldn't allow anyone (not even registered users) to systematically iterate the whole userbase. I would like to show e.g. only users online to non-members and only users with at least one post to members. And I would probably like to share less of the user information with guest than with members.
To do that, we would need more fine-grained permission settings for different user groups (including recentness of activity) and the items revealed within the user profile (eg. join date, last seen, bio and contact information). This looks like a decent extension proposal to me.
Ralkage Didn't esoTalk go by user ID followed by the username? I like that approach.
A more robust way to target this problem is to assign a unique random identifier to each user account that would never change, even if the username might be changed one day or deleted. That way existing @-mentions would become future proof.
