51 ms·

Reddit's website uses DRM for fingerprinting

1099 points by smitop 6y ago

kyleee 6y ago
honestly disgusting behaviour IMO, everyone should use noscript or ublock origin to turn off all js by default. Even though it's a hassle it gets easier once you've established your allow/deny list for frequent sites over time. First time visits remain a bear though since sometimes you have to do a bunch of guesswork to determine which js bits are required for a given site to work
- userbinator 6y ago
  sometimes you have to do a bunch of guesswork to determine which js bits are required for a given site to work I've been browsing with off-by-default JS basically since JS was invented, and my list of trusted sites has remained very small (around a dozen) --- the majority of sites I come across on searches that ask me to enable it will simply cause me to go somewhere else. The rare occasion that I can't find the information elsewhere, I will view source and sometimes it's sitting there, or even RE the API, but actually getting me to enable JS is close to a "never", as it's reserved for the very few sites I have far more trust in, e.g. my bank. Once --- and only once --- I was enticed by a site that doesn't need it to "enable JS for a better experience", and immediately disabled it again when I was bombarded with ads and other distracting, irritating shit (selecting text causes a popup, elements animating around while I'm trying to focus, etc.)
mschuster91 6y ago
GDPR says hello. Even something as easy as Google's recaptcha is impossible to implement GDPR-compliant according to many German authorities, so I highly doubt that this kind of invasive tracking is in any way legal. Why can't they just use something like a proof-of-work mechanism to combat spam?
- eindiran 6y ago
  How would the PoW mechanism work?
  - superkuh 6y ago
    You can see anonymous proof of work voting in action over at notabug.io.
    - hombre_fatal 6y ago
      I was able to upvote something 30 times, myself. Like, the first point of an anti-spam system on a forum is so that you can't just upvote your own crap to the front page. Wonder why this never caught on. /s
      - deleted 6y ago
        [deleted]
      - superkuh 6y ago
        It's the least worst system that allows for anonymous people to participate (no accounts required). Rather than stopping people the idea is to add just a little friction.
        hombre_fatal 6y ago
        To say that, you're kinda assuming the objective though and then suggesting that it's a worthwhile one. Like, this poor solution is probably the best thing on some dimension, I would just wonder if it's a dimension worth caring about. The objective seems to be eliminating the requirement of registration at all. Why? Why would I care to enable people to upvote/downvote content that don't care to spend 1 second registering? I also don't think you can make a convincing case that the friction of registration makes or breaks any websites when almost all of the most popular websites require registration. Seems to be me users are willing to jump the hurdle by the millions if they care to engage. It can't be a matter of privacy because the site could be logging your IP address in both cases. It can't really be friction because you could make the most frictionless process possible. Maybe clicking upvote summons a tiny tooltip where you enter a username and password. EZBoard forums back in the day had that -- You would write your whole post and the submit button would assign you a random username that you could then customize. I just see a forum that made the questionable decision to let you infinitely manipulate rankings without even trying to stop you, the actual impl of that (no registration, PoW puzzle, etc.) rather irrelevant.
- deleted 6y ago
  [deleted]
- zemnmez 6y ago
  do you have a source on this? I've only seen assertions that recaptcha is against GDPR from US sources
  - mschuster91 6y ago
    Only in German: https://www.lda.bayern.de/de/faq.html https://www.lda.bayern.de/de/faq.html
    - MauranKilom 6y ago
      Translating the captcha-related items: > It it allowed to embed captchas that prevent bots? > Yes. The website operator has not only a vested interest in using captchas but is even obligated to do so as they have to guarantee website availability. (I don't understand what this obligation is about - surely it's my own choice whether my website is up or down?) > Is it allowed to embed Google captchas on the website? > Website operators should strongly consider alternatives. If Google reCAPTCHA is used regardless, the responsible should be aware that they must be able to prove that this use is lawful according to [data privacy law]. When unable to explain how Google uses user data, the user cannot be informed transparently and the lawful use cannot be established.
      - kube-system 6y ago
        > (I don't understand what this obligation is about - surely it's my own choice whether my website is up or down?) They are likely either saying that the uptime of the service relies on the use of captchas (i.e. it's a technical obligation), or it is implying that the majority of sites are commercially operated, wherein the operator has a financial/legal/contractual obligation that they deliver a working product.
- callalex 6y ago
  I agree that this is gross, but I do want to add some subtlety to the discussion. Reddit is trying to combat a different kind of activity than traditional spray-n-pray “buy our pills” spam. It is a large and influential enough forum that corporate and nation-state actors try to manipulate the tone and content of conversation with both words and votes. None of that is necessarily a volume-based issue, which is what proof-of-work is effective against.
  - toomuchtodo 6y ago
    Reddit could require users associate a mobile number with their account and use an SMS to validate. Zelle (the payment network) performs fraud validation using your mobile number as a signal, for example (using a Google Voice, Twilio, or similar virtual number will cause onboarding to fail).
    - lmz 6y ago
      As if people won't complain about that, especially if they want a throwaway identity.
      - deleted 6y ago
        [deleted]
    - AnthonyMouse 6y ago
      A prepaid SIM card is $5. There are also now services that do this for you so you don't even have to buy the SIM card yourself. They add some new phone numbers every day and publish the numbers along with every SMS they receive on a public site with ads on it. The "higher end" ones give you your own personal throwaway phone number but then you have to pay the $5. This means sites should immediately stop using this verification method because it obviously isn't going to stop adversaries with even trivial resources, and the security implications of encouraging vulnerable populations to use random sites like that is hugely bad. SMS verification is also ridiculous to begin with because phone numbers get recycled quickly and users should neither lose their account just because their phone number changed nor have some stranger enabled to steal it.
- eli 6y ago
  Spammers don’t mind doing work
  - hombre_fatal 6y ago
    Especially when it's not their machine.
- nemothekid 6y ago
  >Why can't they just use something like a proof-of-work mechanism to combat spam? I don't believe there is a level of work that one could do that would both be too expensive for scammers and not grind your battery to a halt.
  - superkuh 6y ago
    This actually played out on the reddit-alike notabug.io (federated all js thing with proof of work anonymous voting). What happened was a couple users had the programming skill to write better than JS could ever be voting bots and then they controlled the "front page" and only looking at all posts by 'new' worked. This of course meant the anti-spam proof of work voting was not working and so useless.
- neilv 6y ago
  Separate from GDPR, I'm wondering whether using security exploits (such as ones the article listed) will be considered violation of US law pertaining to unauthorized access of a computer system.
tptacek 6y ago
Lots of sites use "DRM" (content protection, obfuscation) techniques to fingerprint for anti-abuse. Somewhere, there's a truly excellent writeup from (I think?) Mike Hearn about the work they had to do to build anti-abuse for Youtube; it involved nested VMs implemented in Javascript.
- TedDoesntTalk 6y ago
  I’ve never heard obfuscation referred to as DRM. The author is referring to the DRM browser checks. > Specfically, it looks for Widevine, PlayReady, Clearkey, and Adobe Primetime
  - catalogia 6y ago
    DRM and obfuscation are traditionally related because unobfuscated DRM wouldn't be effective for long. Hardware assisted DRM is newer and a bit different.
    - TedDoesntTalk 6y ago
      Perhaps you mean encryption, not obfuscation.
      - tptacek 6y ago
        For content-controlled code, meaningful encryption tend to imply obfuscation.
- paulryanrogers 6y ago
  Was that nesting server side?
  - tptacek 6y ago
    No, it was all content Javascript.
- belltaco 6y ago
userbinator 6y ago
i.e. the main redesign domain, not old.reddit.com If the old one didn't do this, there's yet another reason to use it... I still believe that part of the reason a lot of sites are moving to JS-only SPAs and the like is that it becomes much harder to block things like this. Regardless of sandboxing, the idea of letting a site execute Turing-complete computations on its visitor's computers, just to display what could be done without, is quite repulsive.
- ryanlol 6y ago
  >the idea of letting a site execute Turing-complete computations on its visitor's computers Why is Turing-completeness the issue here?
  - jdm2212 6y ago
    I think that's being used to mean "it's impossible to predict/reason about/constrain what the computation might do". Turing completeness => it can do anything, you can't predict anything
    - ryanlol 6y ago
      This only makes sense as far as resource usage goes, Turing completeness has nothing to do with access to APIs which you really need to do anything interesting. Brainfuck is turing complete but can’t call any APIs, you can very much predict that a Brainfuck program won’t be doing anything very exciting.
    - Gene_Parmesan 6y ago
      Maybe, but I think it's an overblown term in these sort of questions. Being Turing-complete doesn't mean that it can do anything. It means that it is isomorphic to a Turing machine; in other words, it can emulate a Turing machine, which means it can compute anything a Turing machine can compute. That's definitely not the same as "do anything." For instance, it doesn't mean it's suddenly granted access to APIs to communicate with the system/break out of a sandbox. I mean, I guess it's theoretically possible for it to create an entire simulated CPU (is it though? not sure...), but not in practice. The more concerning thing is how strong your sandbox is.
deleted 6y ago
[deleted]
TheAdamAndChe 6y ago
How has Reddit not had its Digg 2.0 moment yet? They are blatantly user-hostile in so many ways nowadays. For those who don't know, a UI change at Digg triggered a mass exodus to reddit years ago.
- brutal_chaos_ 6y ago
  Because they keep the old UI around still, at: https://old.Reddit.com https://old.Reddit.com But I agree with the user hostile notion. They are terrible nowadays
- Swenrekcah 6y ago
  Because they are smart and provide old.reddit.com for those of us that would otherwise have left. But it's a pretty shit site now anyway compared to how it used to be. It's the law of forums it seems to be.
- scrooched_moose 6y ago
  It seems like they learned a lot of lessons from the Digg redesign and are being a lot smarter (or insidious...) about the transition. Digg rolled out massive changes overnight which caused a sharp, immediate rebuke. Reddit has been slowly rolling out changes for a couple years, and at least so far are leaving the old interface available at old.reddit.com. The redesign is as bad or worse in every way; but it's so slow there hasn't been the organized revolt. Reddit also has the advantage of doing it during a major UI shift - it's easy to justify design changes when everyone is heading for mobile browsers anyway. Digg didn't have that excuse. It's funny though, I actually really like the new Digg. It's nothing like what it used to be, but it's a nice curated list of interesting articles, major headlines, and tech news.
  - DaiPlusPlus 6y ago
    > Reddit also has the advantage of doing it during a major UI shift - it's easy to justify design changes when everyone is heading for mobile browsers anyway. Digg didn't have that excuse. On the contrary, Digg’s UI changes were happening when “Web 2.0”-hype was peaking, including bold new web-design trends - many sites were actively redesigning themselves with a brighter theme and better visual-effects: this was around 2007-2010 when IE6-support was starting to be discounted by tech-oriented websites so they could start using new CSS features and alpha-channel PNG images that IE7, Firefox, and Opera supported. I argue that the changes to their recommendation algorithm - and the introduction - and eventual promotion - of mainstream news (especially sports news) meant that their early users: technology news readers, lost interest in the site. The redesign of the site was a contributing factor, but a bad redesign is nowhere near as damaging to a site’s popularity than it losing relevance to its core user base.
echelon 6y ago
While many Redditors are changing their "avatar" to dancing rainbow cockroaches, I had the idea to set mine to the Digg logo as an act of protest. I'm hoping it catches on. I suppose Reddit's new userbase may not even know what that means. Why the hell do we need avatars on Reddit anyway? Most of them are animated, strobing distractions. Reddit has jumped the shark. If there weren't significant opportunity cost, I'd happily work on a replacement. It's become a low-signal, high-noise ad-laden dumpster fire. Advertising is eating the Internet alive. I fucking hate it.
- Jestar342 6y ago
  old.reddit.com is still there and removes a lot of the dross. There's also extensions to ensure you always get redirected to it from any reddit link you follow. But it's still a dumpster fire of hate, bots and/or paid-for responses, for any sub that reaches critical mass.
  - paranoidrobot 6y ago
    You don't actually need old.reddit.com, as I commented above, you can change your account preferences to turn the redesign off. e: I just realised, you may need old.reddit.com if you don't sign in.
    - fossuser 6y ago
      On mobile it reverts you every few days whether you want it to or not and you have to set it again. There are a few extensions around for each browser that fix this, but every time it happens it makes me angry at whatever person thought this was a good idea. If they rely on metrics for old vs. new this 'feature' obviously distorts the reality.
      - paranoidrobot 6y ago
        Strange, mine doesn't revert that frequently. I think over a month since the last time.
encom 6y ago
As if another reason was needed to leave that cesspool behind.
mensetmanusman 6y ago
vprza.com strikes again
- km3r 6y ago
  what is that domain? cant seem to find any useful info about it.
dilandau 6y ago
Stallman was right. Holy shit.
cwhiz 6y ago
Reddit is absolutely one of the worst things to ever happen to humanity. Reddit invented modern bubble building. It is impossible to understate how much better off this world would be without Reddit.
- Rebles 6y ago
  You meant 4chan, right? w.r.t. bubbling, how is Reddit as a platform different than a forum?
  - type0 6y ago
    > how is Reddit as a platform different than a forum? you can have meaningful on topic discussions on a forum spanning across months and even years, reddit has the priority and visibility on new threads same as HN. The style of writing seems to be different but that of course depends on the forum or subreddit (I have yet to find the good ones if there are any)
  - simias 6y ago
    4chan is pretty niche these days, and for good reasons. It was never mainstream but it definitely lost a lot of its prestige and relevance. But at least 4chan was always upfront about its policies: you could always basically post anything as long as it didn't put the site's existence in jeopardy, so effectively as long as the lawyers/cops/fbi didn't come knocking it was free for all. Reddit is roughly the same thing except they hypocritically attempt to maintain a façade of being "the good guys". I remember in particular how, after having hosted "jail bait" and other very questionable content for years they finally decided to no longer allow it they felt the need to publish a heartfelt message about how "we thought about our daughters" and all that crap instead of saying the truth, which is that it just generated too much bad publicity and made the advertisers go away. Reddit is 4chan pretending to be Facebook.
- KingMachiavelli 6y ago
  As much as it's a meme, something like reddit should exist. A lot of communities are too small to have a dedicated forum and often dedicated forums are even worse from a design perspective. Old reddit had easy to use features like a built in wiki system that let a lot of communities form with minimal friction. I'm not sure what a better alternative would be that is also as easy to use.
vehemenz 6y ago
This isn't newsworthy. There are hundreds of ways to use the browser's built-in API for fingerprinting purposes. It's actually overkill because you only need a handful and a decent statistical model derived from device testing. Any big company with ad revenue has their own research and proprietary methods to catch fraudulent ads and TOS violators. It's been happening for years, and as long as browsers "improve", it will continue.
indolering 6y ago
The title is misleading because they are not using DRM to generate a unique identifier like, for example, Netflix would use. Instead, it is using the type of DRM implementation for fingerprinting/bot detection. It's just a few more bits of unique entropy, along the lines of your screen size and user agent. This might seem like a small difference, but reason activists hate DRM is that it enables service providers to go a step beyond traditional fingerprinting and gain a truly unique identifier.
- type0 6y ago
  It's not misleading, they check for DRM presence and that's bad enough. > but reason activists hate DRM is that it enables service providers to go a step beyond traditional fingerprinting and gain a truly unique identifier. The reason is that in some places on Earth you can be sentenced for violation of special computer laws prohibiting you to even look at such code and disclose what it does, you just run it and see what happens
  - milkytron 6y ago
    maybe this a silly question, but isn't that like most closed source code?
    - Polylactic_acid 6y ago
      No. You can basically always decompile proprietary software and work out how it works. And even publish most of your findings. In some places like the US, if that code is DRM its now illegal to study (Under the DMCA specifically I think).
      - brokenmachine 6y ago
        Is there a specific definition that makes something DRM? Sounds like all software companies should add some trivial DRM only for the specific purpose of exposing people to legal risk if they attempt to reverse engineer their code.
    - 6y ago
kahlonel 6y ago
Just another reason why I am never going to touch the new reddit with a 10-foot pole. If they phase out the “old” design, I’m done with it.
jeppesen-io 6y ago
Not to sound like an idiot - but aside from CPU usage, what's the downside to this exactly?
- filleduchaos 6y ago
  Honestly speaking a lot of the list pointed out in the article is weird that way. For example, "Checks if function bodies that are implemented in the browser contain [native code] when stringified" - that's a very straightforward way to check if a particular feature is browser-supported or was polyfilled.
kbenson 6y ago
Is Reddit not doing enough to identify and remove bot accounts and bad actors, or are they doing too much fingerprinting? The former is definitely a problem, and I imagine most users care about it to some degree. If you as a user care about both, perhaps a nuanced opinion is warranted.
stonogo 6y ago
I find the current title ("Reddit's website uses DRM for fingerprinting") to be fascinating. Is there more to Reddit than a website? The headline just sounds like "wrestler's body grapples and pins opponent" to me.
- Mindwipe 6y ago
  They have native first party applications for iOS and Android now.
baybal2 6y ago
Not a new phenomenon. Google's anti-bot team in St. Petersburg had a lot of positions for such "talent" good at using borderline exploit techniques to detect bots as far back as 2012-2013 https://news.ycombinator.com/item?id=17649371 https://news.ycombinator.com/item?id=17649371 > You know, mobile ads companies resort to borderline exploits to fight botting, but even they loose out. > Lockdown is a useless measure, from my experience. Both IOS and Android ad nets croak under 60-70% bot traffic.
sitkack 6y ago
This is basically supercookie from Samy.
llacb47 6y ago
@OP and others, here's how to enable this flag temporarily. In the pretty printed version of https://www.redditstatic.com/desktop2x/Reddit.de2e3f279d82eef14ab2.js https://www.redditstatic.com/desktop2x/Reddit.de2e3f279d82ee... add a breakpoint to the first line of this part of the code. if (!as(e)) return; const t = e.user.account ? Jt()(e.user.account.id).toString() : void 0 , s = document.createElement("script"); s.src = Object(es.a)("https://s.udkcrj.com/ag/386183/clear.js", { dt: "3861831591810830724000", pd: "acc", mo: 0, et: 0, ti: $t()(), ui: t, si: "d2x" }), Then when you are paused on the breakpoint evaluate this in the console: e.runTimeEnvVars.staging=true
Mindwipe 6y ago
DRM is a bit clickbaity here. The site does a lot of fingerprinting, and the EME module is one of the least useful bits and doesn't really reveal anything the browser user agent string doesn't already.
mark_l_watson 6y ago
I just followed the privacy URI FOR iOS Reddit on Apple App Store, the link is no longer valid. I am searching and reviewing their privacy statements. EDIT: their blanket policy I found on the web was what I expected. I donate money to Reddit and I wish that as a perk I had more privacy “We may share information between and among Reddit, and any of our parents, affiliates, subsidiaries, and other companies under common control and ownership.”
p2t2p 6y ago
Ah, that’s why Firefox was notifying me that Reddit wants me to enable DRM recently. We new it was only matter of time, since they got this crap into the standard. Pity mofos.
AlexCoventry 6y ago
Does anyone know of a nice open-source desktop client for reddit which runs on Linux?
- dredmorbius 6y ago
  For CLI values of desktop, there's the (no longer maintained) rtv (https://github.com/michael-lazar/rtv https://github.com/michael-lazar/rtv), though last I checked it works well, and three others: https://gist.github.com/michael-lazar/8c31b9f637c3b9d7fbdcbb0eebcf2b0a https://gist.github.com/michael-lazar/8c31b9f637c3b9d7fbdcbb...
tlear 6y ago
Reddit as of late has crossed my enough is enough line, used extension to wipe out 8+years of posts and deleted my account. Alternative will happen, there is a pile already being promoted we will see who wins.
- flanbiscuit 6y ago
  what extension did you use? Was it this one? https://chrome.google.com/webstore/detail/nuke-reddit-history/aclagjkmidmkcdhkhlicmgkgmpgccaod?utm_source=chrome-ntp-icon https://chrome.google.com/webstore/detail/nuke-reddit-histor...
  - tlear 6y ago
    I will check, it was a bookmarklet actually, not extension my bad.
  - tlear 6y ago
    Here it is https://github.com/j0be/PowerDeleteSuite https://github.com/j0be/PowerDeleteSuite
- thearchitect1 6y ago
  Why did you wipe out all of your posts and comments though? That just makes it harder for people trying to see insightful comments from years ago.
  - Fuzzwah 6y ago
    If all the insightful comments are gone, there's more chance people looking for insightful content will leave too.
  - tlear 6y ago
    I do not want Reddit to earn a single cent from anything I ever posted.
codezero 6y ago
A lot of these bugs are used to test for fake user agents. Even sophisticated bots may not know that their fake user agent’s V8 version had a jit or rounding bug. If you watch change logs you can spot this stuff. Most of these are obvious and sophisticated fraudsters are well beyond that. I could say it’s defensible but a big reason bots are a problem is the way the entire online ad system is still the Wild West. There is no regulation so I wouldn’t be surprised if a majority of the bots were just competitors. It has to be tempting to use that black hat fraud defense knowledge against your competitors, especially if there is so little regulation or transparency.
yalogin 6y ago
It real stupidity to push for that 2.0 UI. I don’t know why reddit insisted on that. It’s honestly really bad, pages feel real heavy and wastes a lot of screen real estate. The only reason people haven’t migrated away is because there isn’t an alternative.
- Panini_Jones 6y ago
  > I don’t know why reddit insisted on that. It's likely that they discovered through A/B testing that they could improve their metrics and monetization strategy this way better than the original UI. Reddit doesn't exist to satisfy us, it exists to make money.
- MaxBarraclough 6y ago
  > The only reason people haven’t migrated away is because there isn’t an alternative. I agree the new design is just awful, but you can switch to the old design in the settings menus (equivalent to browsing https://old.reddit.com https://old.reddit.com ).
  - yalogin 6y ago
    This is what I do but recently they changed it so the mobile browser doesn’t honor your settings. So I have to type the old.reddit url every time. I do that and don’t give in to them
historyremade 6y ago
Oh come on HN. These are old ancient stuff spans back to 2010. Real stuff happens in server side. Those are just poly fill to fool ya cunts
ComodoHacker 6y ago
So fraud detection becomes a new excuse for tracking, when ads targeting doesn't sound solid enough.
idkcd 6y ago
Reddit died with Aaron Swartz. Check out r/watchredditdie and r/declineintocensorship to see blatant examples of how Reddit censors right wing opinion. I left Reddit when they recently banned 2000 subs to curb "racist" speech while racist subreddits against whites are okay because they are the majority (America is the only country that exists). Reddit has become such an echo chamber it's worse than Facebook now.
stevekemp 6y ago
I have recurring thoughts of implementing something like reddit, by writing a server which would present a list of groups/posts actually stored on an NNTP server. This would allow sharing posts, and decentralized hosting, because all the real content would be stored on the NNTP host. (A simpler approach would be to use an IMAP server - a different mailbox for each group, and threads naturally being stored as .. threaded emails.) Perhaps I should have a stab at actually implementing it!
- jbb67 6y ago
  this is his the d programming language forums work
- Karrot_Kream 6y ago
  I've been thinking about this for quite a while and finally worked out a way to do this in my head the other day and I plan on writing it down to code soon-ish. I'm glad to see others interested in this, and would love to collaborate if you're interested!
Accacin 6y ago
I wasn’t on Reddit often at the very beginning, I only really started to use it when I found out about rage comics and would log on every morning before university to check the new ones out. That must have also been around the time the same guy who introduced me to Reddit also asked me to check out a cool game he was playing called Minecraft!
avainlakech 6y ago
I sat this every time I see a post about Reddit - selete your accounts. I did this about two years ago and as a result I was multiples happier and more productive.
Quequau 6y ago
I've been a Reddit user since about the time that the Digg Patriots poisoned the well over at Digg... At least that's what prompted me to make an account. Reading through the comments here is a bit weird for me because it seems like I have a much different experience that most folks here. I suspect this is because a) I use the RES browser extension to filter out a great many useless or unpleasant subreddits and b) most of my time on Reddit is spent moderating. The redesign however, is a bit of disaster. Even though I don't care for the look I would have used it but when they rolled it out and made it the default experience it lacked the basic functionality for moderators which is where I spend the majority of my time on Reddit. For two years every time the admins released some improvement to it, I would go back and try to use it and couldn't... so I gave up and branded it "worse.Reddit" Anyway, I suppose it's about time to find an alternative to Reddit but I've yet to find a site where I can create and curate niche communities, like I do on Reddit or where I could somehow transfer the collected data and experience of the larger subreddits I moderate to some other site (which isn't already home to unpleasant extremists who left Reddit). So far I know about: https://tildes.net/ https://tildes.net/ and https://dev.lemmy.ml/ https://dev.lemmy.ml/. I sorta lean towards lemmy but I don't have a solid reason for that. Lastly fingerprinting on Reddit seems like a very useful and very needed solution to problems that have little to do with targetted advertising or selling private user data.
- TheSpiceIsLife 6y ago
  > Lastly fingerprinting on Reddit seems like a very useful and very needed solution to problems that have little to do with targetted advertising or selling private user data. Ohhhh cliffhanger! Tell us more? I suspect you're referring to abuse???
arnaudsm 6y ago
That's why I'm so happy that HN stayed roughly the same : fastest UI in the west, respectable community, and non-profit. Just like Wikipedia and Craigslist. I wish we had an equivalent for every big website.
- yangminded 6y ago
  Totally agree. This is also why I keep donating to Wikipedia.
- Cthulhu_ 6y ago
  Still wouldn't mind some basic formatting options in comments like bullet lists and code though. The equivalent for websites is probably reader mode supported in various browsers or addons, but that too is probably limited. Pretty sure it doesn't work for Reddit, but for Reddit there may be browser addons that clean up the interface by a lot.
  - Wingman4l7 6y ago
    There is a pretty popular one for Reddit, yes -- it's called Reddit Enhancement Suite, adds a ton of features.
simonsaidit 6y ago
I joined reddit more than 14 years ago, before subreddits, when it was written in lisp and top posts were Paul graham essays and Joel on software. Today HN is the place for this kind of content. When digg died there was a fear what their user base would turn the site into. I have no issues with the design but probably because I’m mainly on my mobile. What did change for me though was the amount of toxic people in almost every subreddit I frequent.
- sillysaurusx 6y ago
  http://www.paulgraham.com/re.html http://www.paulgraham.com/re.html suggests the world may be getting “more toxic” (fragmented + interconnected), rather than some underlying force (“It’s because Digg’s user base invaded”).
  - simonsaidit 6y ago
    Thank you!
est 6y ago
Is it possible to use DRM to display a captcha? I tried to lookup Chrome's DRM doc but it was removed and can be only accessed by DRM members.
jakub_g 6y ago
You know how this works those days on a big corp level: the CEO buys a "solution" from 3rd-party "vendor". The solution does things but no one cares what exactly and how. A few insider developers get upset when they run a debugger and notice weird stuff going on, but they don't have any power over it. Anyway rolling this kind of things on your own in a non-creepy way is not viable unless you're Google scale, so you pay the 3rd party like WhiteOps or Distil or Cloudflare or use Google captcha.
jaybeeayyy 6y ago
>"haha jit go brrrr"
Andrex 6y ago
> Contains what appears to be a Javascript engine JIT exploit/bug, "haha jit go brrrrr" appears in a part of the code that appears to be doing something weird with math operations. Ignoring everything else, this made me chuckle quite a bit. I can only imagine how much funnier it'd be if I actually saw that line while picking apart minified code.
peter_d_sherman 6y ago
There's an interesting philosophical question raised here, which looks like this: User Privacy Vs. Troll/Bot Protection If you want stronger privacy (weaker browser fingerprinting), then you must equal-and-oppositely accept that that allows Trolls and Bots to flourish on the network... On the other hand, you can have less Trolls and Bots on the network -- but this means that you must give up some of your privacy via stronger browser fingerprinting... So, the next logical question is, is there a way to have the best of both worlds, that is, more privacy (less browser fingerprinting), and less Trolls and Bots simultaneously? The answer I come up with at this time is: "No -- UNLESS Reddit were to call up every single user that registers, and voice verify them and/or make sure they have a credit card or other valid ID on file... and then they'd have to take extra steps to validate those..." So yes, it could be done... but then Reddit might lose its automated registration process -- and possibly casual users, who didn't want to provide all of that information as well... It's interesting, because all online user commmunities represent various types of compromises between the different factors I've outlined above (there are more factors, of course)... in the future, I should create a matrix of all of them, and see where other various famous online communities exist as points on it... I think such an exercise would be enlightening in some way or other...

1099 points by smitop 6y ago

honestly disgusting behaviour IMO, everyone should use noscript or ublock origin to turn off all js by default. Even though it's a hassle it gets easier once you've established your allow/deny list for frequent sites over time. First time visits remain a bear though since sometimes you have to do a bunch of guesswork to determine which js bits are required for a given site to work

userbinator 6y ago
sometimes you have to do a bunch of guesswork to determine which js bits are required for a given site to work I've been browsing with off-by-default JS basically since JS was invented, and my list of trusted sites has remained very small (around a dozen) --- the majority of sites I come across on searches that ask me to enable it will simply cause me to go somewhere else. The rare occasion that I can't find the information elsewhere, I will view source and sometimes it's sitting there, or even RE the API, but actually getting me to enable JS is close to a "never", as it's reserved for the very few sites I have far more trust in, e.g. my bank. Once --- and only once --- I was enticed by a site that doesn't need it to "enable JS for a better experience", and immediately disabled it again when I was bombarded with ads and other distracting, irritating shit (selecting text causes a popup, elements animating around while I'm trying to focus, etc.)

mschuster91 6y ago

GDPR says hello. Even something as easy as Google's recaptcha is impossible to implement GDPR-compliant according to many German authorities, so I highly doubt that this kind of invasive tracking is in any way legal. Why can't they just use something like a proof-of-work mechanism to combat spam?

eindiran 6y ago
How would the PoW mechanism work?
- superkuh 6y ago
  You can see anonymous proof of work voting in action over at notabug.io.
  - hombre_fatal 6y ago
    I was able to upvote something 30 times, myself. Like, the first point of an anti-spam system on a forum is so that you can't just upvote your own crap to the front page. Wonder why this never caught on. /s
    - deleted 6y ago
      [deleted]
    - superkuh 6y ago
      It's the least worst system that allows for anonymous people to participate (no accounts required). Rather than stopping people the idea is to add just a little friction.
      - hombre_fatal 6y ago
        To say that, you're kinda assuming the objective though and then suggesting that it's a worthwhile one. Like, this poor solution is probably the best thing on some dimension, I would just wonder if it's a dimension worth caring about. The objective seems to be eliminating the requirement of registration at all. Why? Why would I care to enable people to upvote/downvote content that don't care to spend 1 second registering? I also don't think you can make a convincing case that the friction of registration makes or breaks any websites when almost all of the most popular websites require registration. Seems to be me users are willing to jump the hurdle by the millions if they care to engage. It can't be a matter of privacy because the site could be logging your IP address in both cases. It can't really be friction because you could make the most frictionless process possible. Maybe clicking upvote summons a tiny tooltip where you enter a username and password. EZBoard forums back in the day had that -- You would write your whole post and the submit button would assign you a random username that you could then customize. I just see a forum that made the questionable decision to let you infinitely manipulate rankings without even trying to stop you, the actual impl of that (no registration, PoW puzzle, etc.) rather irrelevant.
deleted 6y ago
[deleted]
zemnmez 6y ago
do you have a source on this? I've only seen assertions that recaptcha is against GDPR from US sources
- mschuster91 6y ago
  Only in German: https://www.lda.bayern.de/de/faq.html https://www.lda.bayern.de/de/faq.html
  - MauranKilom 6y ago
    Translating the captcha-related items: > It it allowed to embed captchas that prevent bots? > Yes. The website operator has not only a vested interest in using captchas but is even obligated to do so as they have to guarantee website availability. (I don't understand what this obligation is about - surely it's my own choice whether my website is up or down?) > Is it allowed to embed Google captchas on the website? > Website operators should strongly consider alternatives. If Google reCAPTCHA is used regardless, the responsible should be aware that they must be able to prove that this use is lawful according to [data privacy law]. When unable to explain how Google uses user data, the user cannot be informed transparently and the lawful use cannot be established.
    - kube-system 6y ago
      > (I don't understand what this obligation is about - surely it's my own choice whether my website is up or down?) They are likely either saying that the uptime of the service relies on the use of captchas (i.e. it's a technical obligation), or it is implying that the majority of sites are commercially operated, wherein the operator has a financial/legal/contractual obligation that they deliver a working product.
callalex 6y ago
I agree that this is gross, but I do want to add some subtlety to the discussion. Reddit is trying to combat a different kind of activity than traditional spray-n-pray “buy our pills” spam. It is a large and influential enough forum that corporate and nation-state actors try to manipulate the tone and content of conversation with both words and votes. None of that is necessarily a volume-based issue, which is what proof-of-work is effective against.
- toomuchtodo 6y ago
  Reddit could require users associate a mobile number with their account and use an SMS to validate. Zelle (the payment network) performs fraud validation using your mobile number as a signal, for example (using a Google Voice, Twilio, or similar virtual number will cause onboarding to fail).
  - lmz 6y ago
    As if people won't complain about that, especially if they want a throwaway identity.
    - deleted 6y ago
      [deleted]
  - AnthonyMouse 6y ago
    A prepaid SIM card is $5. There are also now services that do this for you so you don't even have to buy the SIM card yourself. They add some new phone numbers every day and publish the numbers along with every SMS they receive on a public site with ads on it. The "higher end" ones give you your own personal throwaway phone number but then you have to pay the $5. This means sites should immediately stop using this verification method because it obviously isn't going to stop adversaries with even trivial resources, and the security implications of encouraging vulnerable populations to use random sites like that is hugely bad. SMS verification is also ridiculous to begin with because phone numbers get recycled quickly and users should neither lose their account just because their phone number changed nor have some stranger enabled to steal it.
eli 6y ago
Spammers don’t mind doing work
- hombre_fatal 6y ago
  Especially when it's not their machine.
nemothekid 6y ago
>Why can't they just use something like a proof-of-work mechanism to combat spam? I don't believe there is a level of work that one could do that would both be too expensive for scammers and not grind your battery to a halt.
- superkuh 6y ago
  This actually played out on the reddit-alike notabug.io (federated all js thing with proof of work anonymous voting). What happened was a couple users had the programming skill to write better than JS could ever be voting bots and then they controlled the "front page" and only looking at all posts by 'new' worked. This of course meant the anti-spam proof of work voting was not working and so useless.
neilv 6y ago
Separate from GDPR, I'm wondering whether using security exploits (such as ones the article listed) will be considered violation of US law pertaining to unauthorized access of a computer system.

tptacek 6y ago

Lots of sites use "DRM" (content protection, obfuscation) techniques to fingerprint for anti-abuse. Somewhere, there's a truly excellent writeup from (I think?) Mike Hearn about the work they had to do to build anti-abuse for Youtube; it involved nested VMs implemented in Javascript.

TedDoesntTalk 6y ago
I’ve never heard obfuscation referred to as DRM. The author is referring to the DRM browser checks. > Specfically, it looks for Widevine, PlayReady, Clearkey, and Adobe Primetime
- catalogia 6y ago
  DRM and obfuscation are traditionally related because unobfuscated DRM wouldn't be effective for long. Hardware assisted DRM is newer and a bit different.
  - TedDoesntTalk 6y ago
    Perhaps you mean encryption, not obfuscation.
    - tptacek 6y ago
      For content-controlled code, meaningful encryption tend to imply obfuscation.
paulryanrogers 6y ago
Was that nesting server side?
- tptacek 6y ago
  No, it was all content Javascript.
belltaco 6y ago

userbinator 6y ago

i.e. the main redesign domain, not old.reddit.com If the old one didn't do this, there's yet another reason to use it... I still believe that part of the reason a lot of sites are moving to JS-only SPAs and the like is that it becomes much harder to block things like this. Regardless of sandboxing, the idea of letting a site execute Turing-complete computations on its visitor's computers, just to display what could be done without, is quite repulsive.

ryanlol 6y ago
>the idea of letting a site execute Turing-complete computations on its visitor's computers Why is Turing-completeness the issue here?
- jdm2212 6y ago
  I think that's being used to mean "it's impossible to predict/reason about/constrain what the computation might do". Turing completeness => it can do anything, you can't predict anything
  - ryanlol 6y ago
    This only makes sense as far as resource usage goes, Turing completeness has nothing to do with access to APIs which you really need to do anything interesting. Brainfuck is turing complete but can’t call any APIs, you can very much predict that a Brainfuck program won’t be doing anything very exciting.
  - Gene_Parmesan 6y ago
    Maybe, but I think it's an overblown term in these sort of questions. Being Turing-complete doesn't mean that it can do anything. It means that it is isomorphic to a Turing machine; in other words, it can emulate a Turing machine, which means it can compute anything a Turing machine can compute. That's definitely not the same as "do anything." For instance, it doesn't mean it's suddenly granted access to APIs to communicate with the system/break out of a sandbox. I mean, I guess it's theoretically possible for it to create an entire simulated CPU (is it though? not sure...), but not in practice. The more concerning thing is how strong your sandbox is.

deleted 6y ago

[deleted]

TheAdamAndChe 6y ago

How has Reddit not had its Digg 2.0 moment yet? They are blatantly user-hostile in so many ways nowadays. For those who don't know, a UI change at Digg triggered a mass exodus to reddit years ago.

brutal_chaos_ 6y ago
Because they keep the old UI around still, at: https://old.Reddit.com https://old.Reddit.com But I agree with the user hostile notion. They are terrible nowadays
Swenrekcah 6y ago
Because they are smart and provide old.reddit.com for those of us that would otherwise have left. But it's a pretty shit site now anyway compared to how it used to be. It's the law of forums it seems to be.
scrooched_moose 6y ago
It seems like they learned a lot of lessons from the Digg redesign and are being a lot smarter (or insidious...) about the transition. Digg rolled out massive changes overnight which caused a sharp, immediate rebuke. Reddit has been slowly rolling out changes for a couple years, and at least so far are leaving the old interface available at old.reddit.com. The redesign is as bad or worse in every way; but it's so slow there hasn't been the organized revolt. Reddit also has the advantage of doing it during a major UI shift - it's easy to justify design changes when everyone is heading for mobile browsers anyway. Digg didn't have that excuse. It's funny though, I actually really like the new Digg. It's nothing like what it used to be, but it's a nice curated list of interesting articles, major headlines, and tech news.
- DaiPlusPlus 6y ago
  > Reddit also has the advantage of doing it during a major UI shift - it's easy to justify design changes when everyone is heading for mobile browsers anyway. Digg didn't have that excuse. On the contrary, Digg’s UI changes were happening when “Web 2.0”-hype was peaking, including bold new web-design trends - many sites were actively redesigning themselves with a brighter theme and better visual-effects: this was around 2007-2010 when IE6-support was starting to be discounted by tech-oriented websites so they could start using new CSS features and alpha-channel PNG images that IE7, Firefox, and Opera supported. I argue that the changes to their recommendation algorithm - and the introduction - and eventual promotion - of mainstream news (especially sports news) meant that their early users: technology news readers, lost interest in the site. The redesign of the site was a contributing factor, but a bad redesign is nowhere near as damaging to a site’s popularity than it losing relevance to its core user base.

echelon 6y ago

While many Redditors are changing their "avatar" to dancing rainbow cockroaches, I had the idea to set mine to the Digg logo as an act of protest. I'm hoping it catches on. I suppose Reddit's new userbase may not even know what that means. Why the hell do we need avatars on Reddit anyway? Most of them are animated, strobing distractions. Reddit has jumped the shark. If there weren't significant opportunity cost, I'd happily work on a replacement. It's become a low-signal, high-noise ad-laden dumpster fire. Advertising is eating the Internet alive. I fucking hate it.

Jestar342 6y ago
old.reddit.com is still there and removes a lot of the dross. There's also extensions to ensure you always get redirected to it from any reddit link you follow. But it's still a dumpster fire of hate, bots and/or paid-for responses, for any sub that reaches critical mass.
- paranoidrobot 6y ago
  You don't actually need old.reddit.com, as I commented above, you can change your account preferences to turn the redesign off. e: I just realised, you may need old.reddit.com if you don't sign in.
  - fossuser 6y ago
    On mobile it reverts you every few days whether you want it to or not and you have to set it again. There are a few extensions around for each browser that fix this, but every time it happens it makes me angry at whatever person thought this was a good idea. If they rely on metrics for old vs. new this 'feature' obviously distorts the reality.
    - paranoidrobot 6y ago
      Strange, mine doesn't revert that frequently. I think over a month since the last time.

encom 6y ago

As if another reason was needed to leave that cesspool behind.

mensetmanusman 6y ago

vprza.com strikes again

km3r 6y ago
what is that domain? cant seem to find any useful info about it.

dilandau 6y ago

Stallman was right. Holy shit.

cwhiz 6y ago

Reddit is absolutely one of the worst things to ever happen to humanity. Reddit invented modern bubble building. It is impossible to understate how much better off this world would be without Reddit.

Rebles 6y ago
You meant 4chan, right? w.r.t. bubbling, how is Reddit as a platform different than a forum?
- type0 6y ago
  > how is Reddit as a platform different than a forum? you can have meaningful on topic discussions on a forum spanning across months and even years, reddit has the priority and visibility on new threads same as HN. The style of writing seems to be different but that of course depends on the forum or subreddit (I have yet to find the good ones if there are any)
- simias 6y ago
  4chan is pretty niche these days, and for good reasons. It was never mainstream but it definitely lost a lot of its prestige and relevance. But at least 4chan was always upfront about its policies: you could always basically post anything as long as it didn't put the site's existence in jeopardy, so effectively as long as the lawyers/cops/fbi didn't come knocking it was free for all. Reddit is roughly the same thing except they hypocritically attempt to maintain a façade of being "the good guys". I remember in particular how, after having hosted "jail bait" and other very questionable content for years they finally decided to no longer allow it they felt the need to publish a heartfelt message about how "we thought about our daughters" and all that crap instead of saying the truth, which is that it just generated too much bad publicity and made the advertisers go away. Reddit is 4chan pretending to be Facebook.
KingMachiavelli 6y ago
As much as it's a meme, something like reddit should exist. A lot of communities are too small to have a dedicated forum and often dedicated forums are even worse from a design perspective. Old reddit had easy to use features like a built in wiki system that let a lot of communities form with minimal friction. I'm not sure what a better alternative would be that is also as easy to use.

vehemenz 6y ago

This isn't newsworthy. There are hundreds of ways to use the browser's built-in API for fingerprinting purposes. It's actually overkill because you only need a handful and a decent statistical model derived from device testing. Any big company with ad revenue has their own research and proprietary methods to catch fraudulent ads and TOS violators. It's been happening for years, and as long as browsers "improve", it will continue.

indolering 6y ago

The title is misleading because they are not using DRM to generate a unique identifier like, for example, Netflix would use. Instead, it is using the type of DRM implementation for fingerprinting/bot detection. It's just a few more bits of unique entropy, along the lines of your screen size and user agent. This might seem like a small difference, but reason activists hate DRM is that it enables service providers to go a step beyond traditional fingerprinting and gain a truly unique identifier.

type0 6y ago
It's not misleading, they check for DRM presence and that's bad enough. > but reason activists hate DRM is that it enables service providers to go a step beyond traditional fingerprinting and gain a truly unique identifier. The reason is that in some places on Earth you can be sentenced for violation of special computer laws prohibiting you to even look at such code and disclose what it does, you just run it and see what happens
- milkytron 6y ago
  maybe this a silly question, but isn't that like most closed source code?
  - Polylactic_acid 6y ago
    No. You can basically always decompile proprietary software and work out how it works. And even publish most of your findings. In some places like the US, if that code is DRM its now illegal to study (Under the DMCA specifically I think).
    - brokenmachine 6y ago
      Is there a specific definition that makes something DRM? Sounds like all software companies should add some trivial DRM only for the specific purpose of exposing people to legal risk if they attempt to reverse engineer their code.
  - 6y ago

kahlonel 6y ago

Just another reason why I am never going to touch the new reddit with a 10-foot pole. If they phase out the “old” design, I’m done with it.

jeppesen-io 6y ago

Not to sound like an idiot - but aside from CPU usage, what's the downside to this exactly?

filleduchaos 6y ago
Honestly speaking a lot of the list pointed out in the article is weird that way. For example, "Checks if function bodies that are implemented in the browser contain [native code] when stringified" - that's a very straightforward way to check if a particular feature is browser-supported or was polyfilled.

kbenson 6y ago

Is Reddit not doing enough to identify and remove bot accounts and bad actors, or are they doing too much fingerprinting? The former is definitely a problem, and I imagine most users care about it to some degree. If you as a user care about both, perhaps a nuanced opinion is warranted.

stonogo 6y ago

I find the current title ("Reddit's website uses DRM for fingerprinting") to be fascinating. Is there more to Reddit than a website? The headline just sounds like "wrestler's body grapples and pins opponent" to me.

Mindwipe 6y ago
They have native first party applications for iOS and Android now.

baybal2 6y ago

Not a new phenomenon. Google's anti-bot team in St. Petersburg had a lot of positions for such "talent" good at using borderline exploit techniques to detect bots as far back as 2012-2013 https://news.ycombinator.com/item?id=17649371 https://news.ycombinator.com/item?id=17649371 > You know, mobile ads companies resort to borderline exploits to fight botting, but even they loose out. > Lockdown is a useless measure, from my experience. Both IOS and Android ad nets croak under 60-70% bot traffic.

sitkack 6y ago

This is basically supercookie from Samy.

llacb47 6y ago

@OP and others, here's how to enable this flag temporarily. In the pretty printed version of https://www.redditstatic.com/desktop2x/Reddit.de2e3f279d82eef14ab2.js https://www.redditstatic.com/desktop2x/Reddit.de2e3f279d82ee... add a breakpoint to the first line of this part of the code. if (!as(e)) return; const t = e.user.account ? Jt()(e.user.account.id).toString() : void 0 , s = document.createElement("script"); s.src = Object(es.a)("https://s.udkcrj.com/ag/386183/clear.js", { dt: "3861831591810830724000", pd: "acc", mo: 0, et: 0, ti: $t()(), ui: t, si: "d2x" }), Then when you are paused on the breakpoint evaluate this in the console: e.runTimeEnvVars.staging=true

Mindwipe 6y ago

DRM is a bit clickbaity here. The site does a lot of fingerprinting, and the EME module is one of the least useful bits and doesn't really reveal anything the browser user agent string doesn't already.

mark_l_watson 6y ago

I just followed the privacy URI FOR iOS Reddit on Apple App Store, the link is no longer valid. I am searching and reviewing their privacy statements. EDIT: their blanket policy I found on the web was what I expected. I donate money to Reddit and I wish that as a perk I had more privacy “We may share information between and among Reddit, and any of our parents, affiliates, subsidiaries, and other companies under common control and ownership.”

p2t2p 6y ago

Ah, that’s why Firefox was notifying me that Reddit wants me to enable DRM recently. We new it was only matter of time, since they got this crap into the standard. Pity mofos.

AlexCoventry 6y ago

Does anyone know of a nice open-source desktop client for reddit which runs on Linux?

dredmorbius 6y ago
For CLI values of desktop, there's the (no longer maintained) rtv (https://github.com/michael-lazar/rtv https://github.com/michael-lazar/rtv), though last I checked it works well, and three others: https://gist.github.com/michael-lazar/8c31b9f637c3b9d7fbdcbb0eebcf2b0a https://gist.github.com/michael-lazar/8c31b9f637c3b9d7fbdcbb...

tlear 6y ago

Reddit as of late has crossed my enough is enough line, used extension to wipe out 8+years of posts and deleted my account. Alternative will happen, there is a pile already being promoted we will see who wins.

flanbiscuit 6y ago
what extension did you use? Was it this one? https://chrome.google.com/webstore/detail/nuke-reddit-history/aclagjkmidmkcdhkhlicmgkgmpgccaod?utm_source=chrome-ntp-icon https://chrome.google.com/webstore/detail/nuke-reddit-histor...
- tlear 6y ago
  I will check, it was a bookmarklet actually, not extension my bad.
- tlear 6y ago
  Here it is https://github.com/j0be/PowerDeleteSuite https://github.com/j0be/PowerDeleteSuite
thearchitect1 6y ago
Why did you wipe out all of your posts and comments though? That just makes it harder for people trying to see insightful comments from years ago.
- Fuzzwah 6y ago
  If all the insightful comments are gone, there's more chance people looking for insightful content will leave too.
- tlear 6y ago
  I do not want Reddit to earn a single cent from anything I ever posted.

codezero 6y ago

A lot of these bugs are used to test for fake user agents. Even sophisticated bots may not know that their fake user agent’s V8 version had a jit or rounding bug. If you watch change logs you can spot this stuff. Most of these are obvious and sophisticated fraudsters are well beyond that. I could say it’s defensible but a big reason bots are a problem is the way the entire online ad system is still the Wild West. There is no regulation so I wouldn’t be surprised if a majority of the bots were just competitors. It has to be tempting to use that black hat fraud defense knowledge against your competitors, especially if there is so little regulation or transparency.

yalogin 6y ago

It real stupidity to push for that 2.0 UI. I don’t know why reddit insisted on that. It’s honestly really bad, pages feel real heavy and wastes a lot of screen real estate. The only reason people haven’t migrated away is because there isn’t an alternative.

Panini_Jones 6y ago
> I don’t know why reddit insisted on that. It's likely that they discovered through A/B testing that they could improve their metrics and monetization strategy this way better than the original UI. Reddit doesn't exist to satisfy us, it exists to make money.
MaxBarraclough 6y ago
> The only reason people haven’t migrated away is because there isn’t an alternative. I agree the new design is just awful, but you can switch to the old design in the settings menus (equivalent to browsing https://old.reddit.com https://old.reddit.com ).
- yalogin 6y ago
  This is what I do but recently they changed it so the mobile browser doesn’t honor your settings. So I have to type the old.reddit url every time. I do that and don’t give in to them

historyremade 6y ago

Oh come on HN. These are old ancient stuff spans back to 2010. Real stuff happens in server side. Those are just poly fill to fool ya cunts

ComodoHacker 6y ago

So fraud detection becomes a new excuse for tracking, when ads targeting doesn't sound solid enough.

idkcd 6y ago

Reddit died with Aaron Swartz. Check out r/watchredditdie and r/declineintocensorship to see blatant examples of how Reddit censors right wing opinion. I left Reddit when they recently banned 2000 subs to curb "racist" speech while racist subreddits against whites are okay because they are the majority (America is the only country that exists). Reddit has become such an echo chamber it's worse than Facebook now.

stevekemp 6y ago

I have recurring thoughts of implementing something like reddit, by writing a server which would present a list of groups/posts actually stored on an NNTP server. This would allow sharing posts, and decentralized hosting, because all the real content would be stored on the NNTP host. (A simpler approach would be to use an IMAP server - a different mailbox for each group, and threads naturally being stored as .. threaded emails.) Perhaps I should have a stab at actually implementing it!

jbb67 6y ago
this is his the d programming language forums work
Karrot_Kream 6y ago
I've been thinking about this for quite a while and finally worked out a way to do this in my head the other day and I plan on writing it down to code soon-ish. I'm glad to see others interested in this, and would love to collaborate if you're interested!

Accacin 6y ago

I wasn’t on Reddit often at the very beginning, I only really started to use it when I found out about rage comics and would log on every morning before university to check the new ones out. That must have also been around the time the same guy who introduced me to Reddit also asked me to check out a cool game he was playing called Minecraft!

avainlakech 6y ago

I sat this every time I see a post about Reddit - selete your accounts. I did this about two years ago and as a result I was multiples happier and more productive.

Quequau 6y ago

I've been a Reddit user since about the time that the Digg Patriots poisoned the well over at Digg... At least that's what prompted me to make an account. Reading through the comments here is a bit weird for me because it seems like I have a much different experience that most folks here. I suspect this is because a) I use the RES browser extension to filter out a great many useless or unpleasant subreddits and b) most of my time on Reddit is spent moderating. The redesign however, is a bit of disaster. Even though I don't care for the look I would have used it but when they rolled it out and made it the default experience it lacked the basic functionality for moderators which is where I spend the majority of my time on Reddit. For two years every time the admins released some improvement to it, I would go back and try to use it and couldn't... so I gave up and branded it "worse.Reddit" Anyway, I suppose it's about time to find an alternative to Reddit but I've yet to find a site where I can create and curate niche communities, like I do on Reddit or where I could somehow transfer the collected data and experience of the larger subreddits I moderate to some other site (which isn't already home to unpleasant extremists who left Reddit). So far I know about: https://tildes.net/ https://tildes.net/ and https://dev.lemmy.ml/ https://dev.lemmy.ml/. I sorta lean towards lemmy but I don't have a solid reason for that. Lastly fingerprinting on Reddit seems like a very useful and very needed solution to problems that have little to do with targetted advertising or selling private user data.

TheSpiceIsLife 6y ago
> Lastly fingerprinting on Reddit seems like a very useful and very needed solution to problems that have little to do with targetted advertising or selling private user data. Ohhhh cliffhanger! Tell us more? I suspect you're referring to abuse???

arnaudsm 6y ago

That's why I'm so happy that HN stayed roughly the same : fastest UI in the west, respectable community, and non-profit. Just like Wikipedia and Craigslist. I wish we had an equivalent for every big website.

yangminded 6y ago
Totally agree. This is also why I keep donating to Wikipedia.
Cthulhu_ 6y ago
Still wouldn't mind some basic formatting options in comments like bullet lists and code though. The equivalent for websites is probably reader mode supported in various browsers or addons, but that too is probably limited. Pretty sure it doesn't work for Reddit, but for Reddit there may be browser addons that clean up the interface by a lot.
- Wingman4l7 6y ago
  There is a pretty popular one for Reddit, yes -- it's called Reddit Enhancement Suite, adds a ton of features.

simonsaidit 6y ago

I joined reddit more than 14 years ago, before subreddits, when it was written in lisp and top posts were Paul graham essays and Joel on software. Today HN is the place for this kind of content. When digg died there was a fear what their user base would turn the site into. I have no issues with the design but probably because I’m mainly on my mobile. What did change for me though was the amount of toxic people in almost every subreddit I frequent.

sillysaurusx 6y ago
http://www.paulgraham.com/re.html http://www.paulgraham.com/re.html suggests the world may be getting “more toxic” (fragmented + interconnected), rather than some underlying force (“It’s because Digg’s user base invaded”).
- simonsaidit 6y ago
  Thank you!

est 6y ago

Is it possible to use DRM to display a captcha? I tried to lookup Chrome's DRM doc but it was removed and can be only accessed by DRM members.

jakub_g 6y ago

You know how this works those days on a big corp level: the CEO buys a "solution" from 3rd-party "vendor". The solution does things but no one cares what exactly and how. A few insider developers get upset when they run a debugger and notice weird stuff going on, but they don't have any power over it. Anyway rolling this kind of things on your own in a non-creepy way is not viable unless you're Google scale, so you pay the 3rd party like WhiteOps or Distil or Cloudflare or use Google captcha.

jaybeeayyy 6y ago

>"haha jit go brrrr"

Andrex 6y ago

> Contains what appears to be a Javascript engine JIT exploit/bug, "haha jit go brrrrr" appears in a part of the code that appears to be doing something weird with math operations. Ignoring everything else, this made me chuckle quite a bit. I can only imagine how much funnier it'd be if I actually saw that line while picking apart minified code.

peter_d_sherman 6y ago

There's an interesting philosophical question raised here, which looks like this: User Privacy Vs. Troll/Bot Protection If you want stronger privacy (weaker browser fingerprinting), then you must equal-and-oppositely accept that that allows Trolls and Bots to flourish on the network... On the other hand, you can have less Trolls and Bots on the network -- but this means that you must give up some of your privacy via stronger browser fingerprinting... So, the next logical question is, is there a way to have the best of both worlds, that is, more privacy (less browser fingerprinting), and less Trolls and Bots simultaneously? The answer I come up with at this time is: "No -- UNLESS Reddit were to call up every single user that registers, and voice verify them and/or make sure they have a credit card or other valid ID on file... and then they'd have to take extra steps to validate those..." So yes, it could be done... but then Reddit might lose its automated registration process -- and possibly casual users, who didn't want to provide all of that information as well... It's interesting, because all online user commmunities represent various types of compromises between the different factors I've outlined above (there are more factors, of course)... in the future, I should create a matrix of all of them, and see where other various famous online communities exist as points on it... I think such an exercise would be enlightening in some way or other...