4 ms·

The constraint that no one in tech wants to consider is on full-text search. If you want to regain the pseudo-privacy of physical spaces online, put your commu

The constraint that no one in tech wants to consider is on full-text search. If you want to regain the pseudo-privacy of physical spaces online, put your community’s conversations behind an authentication barrier and disable full text search of conversations. Search engine indexing is what turns a pseudo-private space into a humiliating-public one. It’s okay to let search engines index your forum’s existence, the sub forums it contains, and their descriptions. But do not let them index participants or conversations - either by subject, by participants, or by content. And do not offer full text search of post content to authenticated members. It’s okay to index keyword tags, but that’s it. If you do this, you will regain the semi-anonymity that made the early Internet possible to enjoy. If you don’t, you will continue to suffer the trolls and abuse that full-text search enabled in the mid-90s (see also DejaNews, X-No-Archive: Yes, and Google’s purchase of DejaNews). EDIT: If you truly feel that full-text search is so valuable that it must not be withheld, you have to do a lot of things to defend against abuse attackers - for example: charge money for search credits, deduct credits when they choose to reveal the text of results, warn users that their searches will be monitored for abuse, require users to be in good standing with paid membership and posting activity for at least 90 days, etc. Otherwise trolls will just use stolen cards to perform full content searches to identify users to harass and then report their findings back to a central forum. They may still do that after all the above criteria, but they’ll have to work excruciatingly hard at it. Yeah, they could manually scrape the site, but you can defend against that too (“you’ve participated on 12 days, so you’re allowed to view 12 days of old content” is a good simple test).

namanyayg 7y ago
How about not showing any usernames or profile info for any search results? That way you get SEO benefits as well.
- floatingatoll 7y ago
  Do you want to improve SEO or do you want a safe semi-private public space? If you permit full text search of content, you permit abusers to discover and harass your members, because they can just sign up to find out who posted something once full text search discovers it.
  - satanspastaroll 7y ago
    >Do you want to improve SEO or do you want a safe semi-private public space? You're implying they're somehow inversely related. A site can be well represented even when it's users contents are not on display
Yen 7y ago
I broadly agree that infinite perfect archival, and searchability of that archive, make an online discussion effectively public forever, subject to broadcast forever. But, even if you disable search, disable history, there's the fundamental fact that _anyone_ can record everything they see, easily and silently. You can't just have a private authenticated space, you need to be able to personally trust every single person you let in that space. At that point, the features around archiving or search are a bit moot.
- floatingatoll 7y ago
  "It's impossible to stop a truly determined attacker, so we'd better not take any steps to fend off the less-determined attackers" is a terrible approach to building safe spaces. Some applications of that logic: - We shouldn't bother checking for characteristics of credit card fraud at transaction time, because a determined attacker might get a fraudulent card through. - We shouldn't bother checking IDs at bars, because a determined attacker might get a fake ID through. - We shouldn't bother trying to prevent email spam, because a determined attacker might get a spam message through. - We shouldn't bother making laws against recording people without their consent, because a determined attacker might do so anyways. Please construct a more plausible argument than "it's ultimately hopeless". I'm willing to consider alternatives, but I'm not willing to consider fatalism.
  - marcinzm 7y ago
    Three of the four items you list work because the government will use force against those who break the rule which prevents rampant abuse. If you want a government run and legally protected safe space then sure. I suspect most people talking about them don't actually want that.
    - floatingatoll 7y ago
      As noted above, fatalism is an uninspiring argument here. "This won't work because you can't use force against those who break the rules" is framing-by-assumption that success is either all or nothing. Success is not all-or-nothing when it comes to creating safe spaces. If you take steps and someone works very hard to break through your steps, they will probably succeed. That does not implicitly guarantee failure, especially if success is defined as "safety improved" rather than "safety guaranteed".
aidenn0 7y ago
In some jurisdictions it's illegal to record a verbal conversation without all parties's consent. It's interesting that you don't often see anyone suggesting extending that right to online conversations.
- floatingatoll 7y ago
  I personally believe that stems from the popular social platforms forcing you to give up your controlling interest in copyright, preventing you from suing a troll forum for republication of your protected works without your consent, since you openly divested yourself of that right when you tweeted. Under US law anyways, it is absolutely not okay to republish a written conversation without permission under copyright law to do so, unless you fall under the "fair use" exemptions. It is safe to say that most forms of attack would not pass a "fair use" test in the courts. So if more people were to sue over copyright violations and demand the unmasking of who posted and/or those who operate, that would certainly go a long ways towards resolving that imbalance. Sadly, it's a very expensive process, and it's very cheap to violate copyright.
Wowfunhappy 7y ago
I find this argument really compelling. But, I also find it interesting to contrast this with HN's reactions to a court declaring web scraping legal a couple of weeks ago: https://news.ycombinator.com/item?id=22180559 https://news.ycombinator.com/item?id=22180559
- bnjms 7y ago
  It is interesting but the proposal is entirely in line with that case as I recall. This issue was LinkedIn was complaining about scrapping of publicly reachable sites. And this new proposal is to keep the contents of discussions unarchived behind a login.

namanyayg 7y ago

How about not showing any usernames or profile info for any search results? That way you get SEO benefits as well.

floatingatoll 7y ago
Do you want to improve SEO or do you want a safe semi-private public space? If you permit full text search of content, you permit abusers to discover and harass your members, because they can just sign up to find out who posted something once full text search discovers it.
- satanspastaroll 7y ago
  >Do you want to improve SEO or do you want a safe semi-private public space? You're implying they're somehow inversely related. A site can be well represented even when it's users contents are not on display

Yen 7y ago

I broadly agree that infinite perfect archival, and searchability of that archive, make an online discussion effectively public forever, subject to broadcast forever. But, even if you disable search, disable history, there's the fundamental fact that _anyone_ can record everything they see, easily and silently. You can't just have a private authenticated space, you need to be able to personally trust every single person you let in that space. At that point, the features around archiving or search are a bit moot.

floatingatoll 7y ago
"It's impossible to stop a truly determined attacker, so we'd better not take any steps to fend off the less-determined attackers" is a terrible approach to building safe spaces. Some applications of that logic: - We shouldn't bother checking for characteristics of credit card fraud at transaction time, because a determined attacker might get a fraudulent card through. - We shouldn't bother checking IDs at bars, because a determined attacker might get a fake ID through. - We shouldn't bother trying to prevent email spam, because a determined attacker might get a spam message through. - We shouldn't bother making laws against recording people without their consent, because a determined attacker might do so anyways. Please construct a more plausible argument than "it's ultimately hopeless". I'm willing to consider alternatives, but I'm not willing to consider fatalism.
- marcinzm 7y ago
  Three of the four items you list work because the government will use force against those who break the rule which prevents rampant abuse. If you want a government run and legally protected safe space then sure. I suspect most people talking about them don't actually want that.
  - floatingatoll 7y ago
    As noted above, fatalism is an uninspiring argument here. "This won't work because you can't use force against those who break the rules" is framing-by-assumption that success is either all or nothing. Success is not all-or-nothing when it comes to creating safe spaces. If you take steps and someone works very hard to break through your steps, they will probably succeed. That does not implicitly guarantee failure, especially if success is defined as "safety improved" rather than "safety guaranteed".

aidenn0 7y ago

In some jurisdictions it's illegal to record a verbal conversation without all parties's consent. It's interesting that you don't often see anyone suggesting extending that right to online conversations.

floatingatoll 7y ago
I personally believe that stems from the popular social platforms forcing you to give up your controlling interest in copyright, preventing you from suing a troll forum for republication of your protected works without your consent, since you openly divested yourself of that right when you tweeted. Under US law anyways, it is absolutely not okay to republish a written conversation without permission under copyright law to do so, unless you fall under the "fair use" exemptions. It is safe to say that most forms of attack would not pass a "fair use" test in the courts. So if more people were to sue over copyright violations and demand the unmasking of who posted and/or those who operate, that would certainly go a long ways towards resolving that imbalance. Sadly, it's a very expensive process, and it's very cheap to violate copyright.

Wowfunhappy 7y ago

I find this argument really compelling. But, I also find it interesting to contrast this with HN's reactions to a court declaring web scraping legal a couple of weeks ago: https://news.ycombinator.com/item?id=22180559 https://news.ycombinator.com/item?id=22180559

bnjms 7y ago
It is interesting but the proposal is entirely in line with that case as I recall. This issue was LinkedIn was complaining about scrapping of publicly reachable sites. And this new proposal is to keep the contents of discussions unarchived behind a login.