4 ms·

> pretty insignifiant in the grand scheme of things. It was super significant in that it was evidence that Reddit employees have the ability to edit messages w

> pretty insignifiant in the grand scheme of things. It was super significant in that it was evidence that Reddit employees have the ability to edit messages with no audit trail and no governance. So while the individual edit was not important, the fact that it happened was. And there is an unknown number of other edits that were never disclosed and is unprovable. So Reddit broke the one thing it’s supposed to do- allow users to talk to each other. Important for this article too because Knight claims her boyfriend’s Twitter account was hacked and someone else posted about fantasizing about kids. If it was Reddit we wouldn’t be able to know if it was Knight’s boyfriend, hackers, or some Reddit admin.

pen2l 6y ago
> It was super significant in that it was evidence that Reddit employees have the ability to edit messages with no audit trail and no governance. Yeah this is an issue, but let’s be real here, this matters to you me and a few other people here, and outside in the real world no-one cares. Even this expectation is new, any admin who was hosting phpbb forums or whatever else had this freedom to change a few entries in their Mysql Db, heck there was an engineer who was able to go inside people’s private gmail (https://www.wired.com/2010/09/google-spy/ https://www.wired.com/2010/09/google-spy/) — and Google is a company we expected to have better safeguards. Better security measures, sophisticated software architecture to prevent this, these things only happen after a startup reaches a high level of maturity in its timeline, Reddit hadn’t quite reached that point when this happened. I would be concerned if such a thing happened now though. Now these safeguards do exist on Reddit so there’s that.
- ALittleLight 6y ago
  It mattered a lot to the people in the subreddit who were upset enough about that and other things to create their own website and move their community off reddit. I think it's less about the technical aspect and more about the expectation that people with the ability to change your comments won't do that. If you wrote an opinion letter to a magazine, and they published it, but only after changing a few words in your letter to make you seem dumb, everyone would understand why you were upset even though nobody would doubt that magazines have the technical capability to do this.
- prepend 6y ago
  One of the things I first set up in systems like this is to really lock down who can change and do stuff like put content into immutable read only stores so it’s hard to change. And I also set up audits and alarms so if someone does change things that shouldn’t be changed then alerts get pushed out to the right places for review. Even if it’s simple stuff like putting a trigger on a column that shouldn’t change so it’s logged and reviewed when someone changes it. This is just a reasonable thing for an admin to set up. Decades ago, I got really pissed when sysadmins were just reading email and worked to set up controls so people could only do this with the right controls and reading a users’ content was a big deal that was super hard, hopefully impossible to do inappropriately. There are situations where this has to happen right- HR investigating a complaint, laws, audits, etc- and that’s still possible. But casually browsing and changing without anyone knowing should not be allowed in any serious business. It’s not that hard to set up.
slg 6y ago
>Reddit employees have the ability to edit messages with no audit trail and no governance. How did you come to this conclusion? It is entirely possible that there was an audit trail and governance, spez simply ignored the governance, and he would have been fired after an examination of the audit trail if he was anyone else but the co-founder/CEO.
- trident5000 6y ago
  "he would have been fired after an examination of the audit trail if he was anyone else but the co-founder/CEO" That assumes theres an ethical corporate culture which many doubt.
  - slg 6y ago
    I'm not going to defend Reddit's corporate culture, but you are making a much more nebulous complaint here than OP did when they stated rather definitively that there was "no audit trail and no governance".
    - trident5000 6y ago
      Think you're replying to the wrong person. Im not username "prepend" above.
      - slg 6y ago
        I realize that and it is why I referenced “OP” in that comment. They made a specific and direct statement which was in my opinion unsupported by the evidence. You countered my response with a more general and vaguer complaint that I can’t really disagree with but isn’t directly related to the original complaint I was refuting.
- prepend 6y ago
  If someone can ignore the governance process then it’s not an effective governance process. If there’s not auditing to identify when someone bypasses governance, then that’s not effective auditing. Assuming effective controls are in place without any description of them and evidence that they fail is foolish, I think. Reddit could have shown off their governance and audit process, but didn’t. I’ve worked on similar systems where someone can just edit the db records and there have been places with no and decent governance. It’s more likely that anyone with admin rights can change stuff. This is bad for a company as big as Reddit with as many users.
irrational 6y ago
>that Reddit employees have the ability to edit messages with no audit trail and no governance. Help me understand this. Reddit is a private company. Is there some sort of contract somewhere that says they won't edit messages and will maintain an audit trail? I mean, I might not like that they are doing it, but I'm also not paying a dime for Reddit (and I have all ads blocked, so they doubly aren't making any money off of me) so I don't see where I can be upset if Reddit does this. You get what you pay for. If we want governance and audit trails, it either needs to be maintained as a public resource, paid for out of tax dollars, or needs to be a fully paid for product that involves entering into a 2 way contract. Otherwise, I think they are free and clear to do whatever they want to do with any subreddits, posts, or comments.
- bloopernova 6y ago
  The content of Reddit comments have been used in legal proceedings. It's a huge deal that the CEO has edit permissions in the main Reddit site database, they simply shouldn't have that access at all.
  - irrational 6y ago
    The fact that Reddit comments are admissible in a court sounds insane to me. I can't believe people actually take Reddit that seriously. It's like taking preschoolers yelling at each other seriously, but with anonymity thrown in. The fact that adults can take it seriously enough to use it in court cases is crazy.
    - Larrikin 6y ago
      Just because you don't know the reddit user in real life doesn't mean other people don't know each other in real life. If someone says they're going to kill someone for a comment, and then that user ends up dead, I don't see why it would be shocking that might be used as evidence in a court case. It was a pretty common occurrence on Twitter back when people posted their gang crap everywhere.
  - deleted 6y ago
    [deleted]
justbored123 6y ago
> If it was Reddit we wouldn’t be able to know if it was Knight’s boyfriend, hackers, or some Reddit admin. Sorry I don't see your point, I work in systems in very large e-commerce multinationals and I have been given the production database credentials many times allowing me to change anything of any user or any product using the mandatory company VPN and the admin account. What are you going to track? The VPN IP and and the general admin credential that can be 100 different people not including hackers that could have compromised any of our PCs? The only important thing is that she doesn't stand behind the comments, she denies them. So that's it. She clearly doesn't support those statements, end of story. Doxxing on the other hand is a federal crime in the US and thus is not considered "free speech" and must be censored according to https://www.law.cornell.edu/uscode/text/18/2261A https://www.law.cornell.edu/uscode/text/18/2261A Whoever with the intent to kill, injure, harass, intimidate, or place under surveillance with intent to kill, injure, harass, or intimidate another person, uses the mail, any interactive computer service or electronic communication service or electronic communication system of interstate commerce, or any other facility of interstate or foreign commerce to engage in a course of conduct that causes, attempts to cause, or would be reasonably expected to cause substantial emotional distress to a person described in clause ...
whymauri 6y ago
>It was super significant in that it was evidence that Reddit employees have the ability to edit messages with no audit trail and no governance. Uh, this was already known by then, though. What made it significant is that it happened to be spez.

pen2l 6y ago

> It was super significant in that it was evidence that Reddit employees have the ability to edit messages with no audit trail and no governance. Yeah this is an issue, but let’s be real here, this matters to you me and a few other people here, and outside in the real world no-one cares. Even this expectation is new, any admin who was hosting phpbb forums or whatever else had this freedom to change a few entries in their Mysql Db, heck there was an engineer who was able to go inside people’s private gmail (https://www.wired.com/2010/09/google-spy/ https://www.wired.com/2010/09/google-spy/) — and Google is a company we expected to have better safeguards. Better security measures, sophisticated software architecture to prevent this, these things only happen after a startup reaches a high level of maturity in its timeline, Reddit hadn’t quite reached that point when this happened. I would be concerned if such a thing happened now though. Now these safeguards do exist on Reddit so there’s that.

ALittleLight 6y ago
It mattered a lot to the people in the subreddit who were upset enough about that and other things to create their own website and move their community off reddit. I think it's less about the technical aspect and more about the expectation that people with the ability to change your comments won't do that. If you wrote an opinion letter to a magazine, and they published it, but only after changing a few words in your letter to make you seem dumb, everyone would understand why you were upset even though nobody would doubt that magazines have the technical capability to do this.
prepend 6y ago
One of the things I first set up in systems like this is to really lock down who can change and do stuff like put content into immutable read only stores so it’s hard to change. And I also set up audits and alarms so if someone does change things that shouldn’t be changed then alerts get pushed out to the right places for review. Even if it’s simple stuff like putting a trigger on a column that shouldn’t change so it’s logged and reviewed when someone changes it. This is just a reasonable thing for an admin to set up. Decades ago, I got really pissed when sysadmins were just reading email and worked to set up controls so people could only do this with the right controls and reading a users’ content was a big deal that was super hard, hopefully impossible to do inappropriately. There are situations where this has to happen right- HR investigating a complaint, laws, audits, etc- and that’s still possible. But casually browsing and changing without anyone knowing should not be allowed in any serious business. It’s not that hard to set up.

slg 6y ago

>Reddit employees have the ability to edit messages with no audit trail and no governance. How did you come to this conclusion? It is entirely possible that there was an audit trail and governance, spez simply ignored the governance, and he would have been fired after an examination of the audit trail if he was anyone else but the co-founder/CEO.

trident5000 6y ago
"he would have been fired after an examination of the audit trail if he was anyone else but the co-founder/CEO" That assumes theres an ethical corporate culture which many doubt.
- slg 6y ago
  I'm not going to defend Reddit's corporate culture, but you are making a much more nebulous complaint here than OP did when they stated rather definitively that there was "no audit trail and no governance".
  - trident5000 6y ago
    Think you're replying to the wrong person. Im not username "prepend" above.
    - slg 6y ago
      I realize that and it is why I referenced “OP” in that comment. They made a specific and direct statement which was in my opinion unsupported by the evidence. You countered my response with a more general and vaguer complaint that I can’t really disagree with but isn’t directly related to the original complaint I was refuting.
prepend 6y ago
If someone can ignore the governance process then it’s not an effective governance process. If there’s not auditing to identify when someone bypasses governance, then that’s not effective auditing. Assuming effective controls are in place without any description of them and evidence that they fail is foolish, I think. Reddit could have shown off their governance and audit process, but didn’t. I’ve worked on similar systems where someone can just edit the db records and there have been places with no and decent governance. It’s more likely that anyone with admin rights can change stuff. This is bad for a company as big as Reddit with as many users.

irrational 6y ago

>that Reddit employees have the ability to edit messages with no audit trail and no governance. Help me understand this. Reddit is a private company. Is there some sort of contract somewhere that says they won't edit messages and will maintain an audit trail? I mean, I might not like that they are doing it, but I'm also not paying a dime for Reddit (and I have all ads blocked, so they doubly aren't making any money off of me) so I don't see where I can be upset if Reddit does this. You get what you pay for. If we want governance and audit trails, it either needs to be maintained as a public resource, paid for out of tax dollars, or needs to be a fully paid for product that involves entering into a 2 way contract. Otherwise, I think they are free and clear to do whatever they want to do with any subreddits, posts, or comments.

bloopernova 6y ago
The content of Reddit comments have been used in legal proceedings. It's a huge deal that the CEO has edit permissions in the main Reddit site database, they simply shouldn't have that access at all.
- irrational 6y ago
  The fact that Reddit comments are admissible in a court sounds insane to me. I can't believe people actually take Reddit that seriously. It's like taking preschoolers yelling at each other seriously, but with anonymity thrown in. The fact that adults can take it seriously enough to use it in court cases is crazy.
  - Larrikin 6y ago
    Just because you don't know the reddit user in real life doesn't mean other people don't know each other in real life. If someone says they're going to kill someone for a comment, and then that user ends up dead, I don't see why it would be shocking that might be used as evidence in a court case. It was a pretty common occurrence on Twitter back when people posted their gang crap everywhere.
- deleted 6y ago
  [deleted]

justbored123 6y ago

> If it was Reddit we wouldn’t be able to know if it was Knight’s boyfriend, hackers, or some Reddit admin. Sorry I don't see your point, I work in systems in very large e-commerce multinationals and I have been given the production database credentials many times allowing me to change anything of any user or any product using the mandatory company VPN and the admin account. What are you going to track? The VPN IP and and the general admin credential that can be 100 different people not including hackers that could have compromised any of our PCs? The only important thing is that she doesn't stand behind the comments, she denies them. So that's it. She clearly doesn't support those statements, end of story. Doxxing on the other hand is a federal crime in the US and thus is not considered "free speech" and must be censored according to https://www.law.cornell.edu/uscode/text/18/2261A https://www.law.cornell.edu/uscode/text/18/2261A Whoever with the intent to kill, injure, harass, intimidate, or place under surveillance with intent to kill, injure, harass, or intimidate another person, uses the mail, any interactive computer service or electronic communication service or electronic communication system of interstate commerce, or any other facility of interstate or foreign commerce to engage in a course of conduct that causes, attempts to cause, or would be reasonably expected to cause substantial emotional distress to a person described in clause ...

whymauri 6y ago

>It was super significant in that it was evidence that Reddit employees have the ability to edit messages with no audit trail and no governance. Uh, this was already known by then, though. What made it significant is that it happened to be spez.