4 ms·
I have to wonder why this dropped off the front page. I feel like stories like this get "crossed out" of HN. Anyone from HN wanna chime in?
by Kinnard 11y ago
I have to wonder why this dropped off the front page. I feel like stories like this get "crossed out" of HN. Anyone from HN wanna chime in?
- Kinnard 11y agoThere's a post with 10 votes that's 53 minutes old at #11. This one is at 32 votes 35 minutes old.
- Kinnard 11y agoOk, it's back on the front page now. Could HN have less opaque flagging?
- Kinnard 11y agoAnd now it's gone.
- dang 11y agoHN doesn't compute story rank from points and timestamp alone.
- Kinnard 11y agoIs the algorithm public?
- dang 11y agoNo. A version of HN's source code is included with the public release of Arc, but HN's algorithm has many extensions that aren't public. It has to be that way, because it would be too easy to game the system otherwise.
- Kinnard 11y agodang, that violate's Kerckhoffs's principle: "A system should be secure even if everything about the system is public knowledge." Security through obscurity. https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
- dang 11y agoYes, but we don't know how to secure an internet forum in that sense. You mentioned that you're working on an HN clone. Perhaps you'll figure this out.
- tptacek 11y agoKerckhoff's Principle holds only if the adversary's cost are unbounded. In reality, there's almost always a cost ceiling tied in some way to the value of the target. In other words: you are welcome to spend unlimited hours and dollars finding and exploiting the flaws in HN's ranking model simply to prove a point, but hopefully, you have better things to do. Similarly, the HN team has better things to do than investing resources to defeat the (unlikely) adversaries who harness both skill and irrationality. (This wrinkle of Kerckhoff's Principle comes up a lot in systems security work, which is why I was moved to comment about it.)
- Tomte 11y agoKerckhoff is only directly relevant to cryptosystems, but the related notion of "security by obscurity" comes up again and again. And it's usually a sign that the one trying to shut down a discussion with this argument is wrong. :-) Usual forum scenario: changing your SSH port to a non-standard port is security by obscurity and doesn't do anything. Usual reply: it doesn't cost me anything (except a few minutes of my time), but may keep a non-sophisticated attacker out – think some automated script kiddie software.
- scott_s 11y agoIt's possible users could have flagged it.
- Kinnard 11y agoI posted an Ask HN[1] but it has been mysteriously edited. Now I'd really like someone from HN to chime in. [1] https://news.ycombinator.com/item?id=11176843 https://news.ycombinator.com/item?id=11176843