Hacker News Search

MerelyMortal 4y ago

Then for the threads to be preserved, the content should remain, but the associated username should just be changed. I imagine if HN created an account with the username "DELETED" or similar, that a script could just change comment ownership from the account to be deleted to the special "deleted" account - that would be the easiest to implement as well as keep thread continuity. (Don't delete the comment just delete the connection to the user.)

philwelch 4y ago
That still doesn’t account for the stylometry.
- MerelyMortal 4y ago
  Yes it does, not everyone gets a unique "deleted" account. Everyone's comment gets attributed to a single special "deleted" account.
  - Operyl 4y ago
    The problem still remains: HN’s “API” is incredibly simple and people have full datasets downloaded locally for every comment. In this case, the OP is already out of luck if he’s looking for anonymity against a hostile entity.
    - MerelyMortal 4y ago
      That problem seems like an extreme outlier. Such user protection would prevent "crimes of opportunity". The average person is not going to have a constant backup of HN in case one day they might want to spy on someone's past.
      - AnimalMuppet 4y ago
        And if they do, they're likely to start with Twitter or Facebook - something useful against more of the population. HN users are still very much a minority.
      - Operyl 4y ago
        The problem doesn’t appear to be that much of an extreme outlier, the thread poster is concerned about a specific tool. That tool has already downloaded the complete data set, he’s already lost.
        MerelyMortal 4y ago
        And there's no guarantee that service will stay around, or that they won't accept requests. I still think it's worthwhile to reduce the attack surface.
    - naniwaduni 4y ago
      Nothing going forward can help in that case, but we can still weigh impact on other threat models going forward.
    - juancb 4y ago
      "We refuse to help because it's a mild inconvenience to us and we'll justify it by assuming that it won't help without knowing for a fact that it won't." That's a fascinating stance that you've outlined and that others have parroted. A stance that HN has implied with the reply to OP.
      - Operyl 4y ago
        I’m not in charge of anything at HN, so how can my statement say HN won’t do something?
  - sparky_z 4y ago
    Not completely. For example, if the analyst has a large corpus from someone's main account to build up a profile, it seems plausible to me that they could identify individual comments under the "deleted" user as being written by the same person using a throwaway account, especially if they have a distinctive writing style.
    - someweirdperson 4y ago
      I doubt a single post provides a sufficient amount of information for that.
  - someweirdperson 4y ago
    Or a different deleted_user_<random or hash of post> for every post. But as the sibling post says... it doesn't solve anything.
  - philwelch 4y ago
    So you run the stylometric analysis on each comment to cluster them into inferred user profiles.
    - MerelyMortal 4y ago
      I'm okay with someone attempting to do that. I imagine it would be extremely fuzzy and not successful.
- matrix_overload 4y ago
  It does if the content from ALL deleted users gets merged under the same metauser. Stylometric average of all deleted users' comments is pretty useless.
deleted 4y ago
[deleted]
sparky_z 4y ago
I don't have a good suggestion here, but I have to point out that that does not fully address OP's stated concern about the use of text analysis techniques to figure out who wrote what, even if the username is different. (It does probably make those techniques more difficult since it would mix comments together from multiple authors under the "deleted" username, but it doesn't fully remove the danger.)
- MerelyMortal 4y ago
  If you took all the sentences out of all of the books in a library, and mixed the sentences together under one fake author name, I think it would be impossible to correctly attribute 99.99+% of the sentences to a correct author. I think that is sufficient.
  - sparky_z 4y ago
    But we're not going to delete everybody's account and mix them all together, are we? If I took a bunch of "minor" writing and mixed it together under one fake name name, but some of it was written by a famous author under a pen-name, then yes, in theory it could be possible to identify those.
    - MerelyMortal 4y ago
      Okay, 1% of the library. I see threads here every-so-often asking about deletion, and I imagine there are more people who would like the opportunity but already know the answer and doesn't ask.
      - aliqot 4y ago
        Curious what happens when an HN user inevitably wants their dead-name changed but retain their history, and whether that would be a harder path to march than being deleted for privacy reasons.
        MerelyMortal 4y ago
chinathrow 4y ago
I disagree. If a user asks for their comment to be deleted, then the right thing to do is to delete them. Period.
- andybak 4y ago
  I respectfully disagree that it's always the right thing to do. Outside of issues of safety, I think the balance shifts. Safety issues are a different matter of course
- pbhjpbhj 4y ago
  What makes it the right thing to do?
  - chinathrow 4y ago
    Just imagine yourself in the position having something to be deleted posted by an earlier you and/or about yourself. If people ask nicely, can confirm ownership/authorship of the record/data in question, then why would you be in a position to deny such a request?
    - fsflover 4y ago
      You imply that the (unconfirmed) harm to the individual is more important to avoid than the harm to the society done by removing potentially insightful comment thread. Why is that?
      - chinathrow 4y ago
        Not sure - but your question implies that there is harm to the society done, and from your first part of the sentence, isn't that also unconfirmed?
        fsflover 4y ago
        I think it's clear that removing discussions from HN harms everyone, because there are many interesting ideas here.
chrisandchris 4y ago
Probably web.archive has indexed one of your posts _before_ your account name changed to DELETED, so your change will be useless. The internet never forgets.
- MerelyMortal 4y ago
  Possibly, it doesn't hurt to try to reduce the attack surface though. A lot of the stuff I wrote on old popular, public websites (that still exist) can no longer be found via search engine, and I did not take any action, it just disappeared on its own.
  - shagie 4y ago
    You can take the possibility out of it when you look at Google's big data. It's not a question of "if it exists out there" or "how often it is updated if it exists out there." https://console.cloud.google.com/marketplace/details/y-combinator/hacker-news https://console.cloud.google.com/marketplace/details/y-combi... is updated daily.
    - MerelyMortal 4y ago
      There is no guarantee that copy will always be available or that they won't remove data. Just because there happens to be a copy already, doesn't mean that the original can't be removed to prevent others from making copies in the future.
- counttheforks 4y ago
  Then you send them GDPR right to be forgotten requests next. Alternatively, HN can force them to delist to the content.
- Zababa 4y ago
  It does actually. At least once a month I go on an multiple hours long quest to find an old thing, and frequently I can't find it.
altairprime 4y ago
So long as the account is permanently locked from ever participating again in any way, I think renaming is great. Otherwise it needs to be left as-is. But the comments need to remained owned by the account that created them, so that we can consider the history of each commenter when reviewing their comments in the future. Merging them all into DELETED inappropriately coalesces those histories. I feel for those who are just now realizing that they can be located by their stylistic tendencies. It’s Dejanews all over again.
threatofrain 4y ago
Then someone might use an archived version from the trivially scrapable API to recover the information. This is a site for hackers after all.
jll29 4y ago
It should not be ONE account, or it wouldn't be possible to distinguish individual users in a conversational thread from one another: DELETED_USER: I agree. DELETED_USER: No, that's BS. DELETED_USER: He has his point. Better would be: DELETED_USER_1: I agree. DELETED_USER_2: No, that's BS. DELETED_USER_3: He has his point.
Zababa 4y ago
4chan, that's usually fully anonymous, has on some boards threads IDs. You can see that this is the same perso in that thread, but can't link it to another person in another thread.

ilyt 4y ago

So not GDPR compliant ?

hijodelsol 4y ago
To my understanding they would still be GDPR-compliant if they delete your data upon receiving an email that you would like to exercise this right under GDPR, even if they don't automate that process but IANAL. Perhaps someone can confirm whether this has in fact worked for them in the past.
- ldjb 4y ago
  Although many large websites and services allow you to request erasure of your data in an automated way, this is not required by GDPR. GDPR allows individuals to request erasure verbally or in writing, and the data controller than has one month to respond.
- pifm_guy 4y ago
  There is no requirement to automate GDPR requests. However all organisations must be able to handle GDPR requests via any communication channel. Eg. They need to treat a data deletion request sent via twitter DM as a valid request if they have an official Twitter presence. It is insufficient to require the customer fill out a special web form.
  - misnome 4y ago
    Isn’t it all organisations _that do business_ in the EU? Since this is a free forum with no paid features, I wonder if it would be excluded?
    - chriswait 4y ago
      IANAL but I don't think it matters whether the purpose of collection is specifically to facilitate paid features. From the European Commission: > The GDPR applies to: [...] > 2. a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU. Assuming account names or the content of comments constitute personal data within GDPR, I think YCombinator falls into this group. Edit: I forgot HN collects an optional email address too, which is definitely personal data. Details here: https://www.ycombinator.com/legal/#:~:text=Hacker%20News%20Information%3A https://www.ycombinator.com/legal/#:~:text=Hacker%20News%20I...
    - wrs 4y ago
      The GDPR applies to the data of people residing in the EU. The location and profitability of the organization collecting the data isn’t a factor. (Though it may introduce questions of enforcement.)

ForTheWin98 4y ago

Even if GDPR does not apply, California's CCPA mandates a right to delete. I don't see any way around that.

lelandfe 4y ago
https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.105.&nodeTreePath=8.4.47&lawCode=CIV https://leginfo.legislature.ca.gov/faces/codes_displaySectio... > A business that receives a verifiable consumer request from a consumer to delete the consumer’s personal information pursuant to subdivision (a) of this section shall delete the consumer’s personal information from its records Is a comment personal information?
- ForTheWin98 4y ago
  Arguably, and in my own view, yes! The stylometry website linked comment texts to persons. The courts or legislature are the ones to decide this. I believe they could side with my view.
- shagie 4y ago
  https://calawyers.org/antitrust-unfair-competition-law/what-is-personal-information-under-the-california-consumer-privacy-act/ https://calawyers.org/antitrust-unfair-competition-law/what-... > The CCPA definition of personal information can be best understood by analyzing separately each of the four closely intertwined building blocks embedded in it: (i) “information”; (ii) “that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked”; (iii) “directly or indirectly”; (iv) “with a particular consumer or household”. A comment would likely not meet those tests. A user login maybe - though that is already covered in the faqs - https://news.ycombinator.com/newsfaq.html https://news.ycombinator.com/newsfaq.html > Can I change my username? > Yes. Email hn@ycombinator.com and we'll help. Which could then dissociate you sufficiently to pass the tests ii through iv. That might work for me (my user name is relatively unique and consistent) while throwaway123456 may have difficulty passing any of those tests.
  - 9wzYQbTYsAIc 4y ago
    > A comment would likely not meet those tests. The HN legal page ( linked at the footer of the site ) indicates that Y Combinator considers public submissions to HN (stories and comments) as a category of Personal Information.