3 ms·

> It was super significant in that it was evidence that Reddit employees have the ability to edit messages with no audit trail and no governance. Yeah this is

by pen2l 6y ago

> It was super significant in that it was evidence that Reddit employees have the ability to edit messages with no audit trail and no governance. Yeah this is an issue, but let’s be real here, this matters to you me and a few other people here, and outside in the real world no-one cares. Even this expectation is new, any admin who was hosting phpbb forums or whatever else had this freedom to change a few entries in their Mysql Db, heck there was an engineer who was able to go inside people’s private gmail (https://www.wired.com/2010/09/google-spy/ https://www.wired.com/2010/09/google-spy/) — and Google is a company we expected to have better safeguards. Better security measures, sophisticated software architecture to prevent this, these things only happen after a startup reaches a high level of maturity in its timeline, Reddit hadn’t quite reached that point when this happened. I would be concerned if such a thing happened now though. Now these safeguards do exist on Reddit so there’s that.

ALittleLight 6y ago
It mattered a lot to the people in the subreddit who were upset enough about that and other things to create their own website and move their community off reddit. I think it's less about the technical aspect and more about the expectation that people with the ability to change your comments won't do that. If you wrote an opinion letter to a magazine, and they published it, but only after changing a few words in your letter to make you seem dumb, everyone would understand why you were upset even though nobody would doubt that magazines have the technical capability to do this.
prepend 6y ago
One of the things I first set up in systems like this is to really lock down who can change and do stuff like put content into immutable read only stores so it’s hard to change. And I also set up audits and alarms so if someone does change things that shouldn’t be changed then alerts get pushed out to the right places for review. Even if it’s simple stuff like putting a trigger on a column that shouldn’t change so it’s logged and reviewed when someone changes it. This is just a reasonable thing for an admin to set up. Decades ago, I got really pissed when sysadmins were just reading email and worked to set up controls so people could only do this with the right controls and reading a users’ content was a big deal that was super hard, hopefully impossible to do inappropriately. There are situations where this has to happen right- HR investigating a complaint, laws, audits, etc- and that’s still possible. But casually browsing and changing without anyone knowing should not be allowed in any serious business. It’s not that hard to set up.

by pen2l 6y ago

ALittleLight 6y ago

It mattered a lot to the people in the subreddit who were upset enough about that and other things to create their own website and move their community off reddit. I think it's less about the technical aspect and more about the expectation that people with the ability to change your comments won't do that. If you wrote an opinion letter to a magazine, and they published it, but only after changing a few words in your letter to make you seem dumb, everyone would understand why you were upset even though nobody would doubt that magazines have the technical capability to do this.

prepend 6y ago

One of the things I first set up in systems like this is to really lock down who can change and do stuff like put content into immutable read only stores so it’s hard to change. And I also set up audits and alarms so if someone does change things that shouldn’t be changed then alerts get pushed out to the right places for review. Even if it’s simple stuff like putting a trigger on a column that shouldn’t change so it’s logged and reviewed when someone changes it. This is just a reasonable thing for an admin to set up. Decades ago, I got really pissed when sysadmins were just reading email and worked to set up controls so people could only do this with the right controls and reading a users’ content was a big deal that was super hard, hopefully impossible to do inappropriately. There are situations where this has to happen right- HR investigating a complaint, laws, audits, etc- and that’s still possible. But casually browsing and changing without anyone knowing should not be allowed in any serious business. It’s not that hard to set up.