5 ms·

Yes it does, not everyone gets a unique "deleted" account. Everyone's comment gets attributed to a single special "deleted" account.

Operyl 4y ago
The problem still remains: HN’s “API” is incredibly simple and people have full datasets downloaded locally for every comment. In this case, the OP is already out of luck if he’s looking for anonymity against a hostile entity.
- MerelyMortal 4y ago
  That problem seems like an extreme outlier. Such user protection would prevent "crimes of opportunity". The average person is not going to have a constant backup of HN in case one day they might want to spy on someone's past.
  - AnimalMuppet 4y ago
    And if they do, they're likely to start with Twitter or Facebook - something useful against more of the population. HN users are still very much a minority.
  - Operyl 4y ago
    The problem doesn’t appear to be that much of an extreme outlier, the thread poster is concerned about a specific tool. That tool has already downloaded the complete data set, he’s already lost.
    - MerelyMortal 4y ago
      And there's no guarantee that service will stay around, or that they won't accept requests. I still think it's worthwhile to reduce the attack surface.
- naniwaduni 4y ago
  Nothing going forward can help in that case, but we can still weigh impact on other threat models going forward.
- juancb 4y ago
  "We refuse to help because it's a mild inconvenience to us and we'll justify it by assuming that it won't help without knowing for a fact that it won't." That's a fascinating stance that you've outlined and that others have parroted. A stance that HN has implied with the reply to OP.
  - Operyl 4y ago
    I’m not in charge of anything at HN, so how can my statement say HN won’t do something?
sparky_z 4y ago
Not completely. For example, if the analyst has a large corpus from someone's main account to build up a profile, it seems plausible to me that they could identify individual comments under the "deleted" user as being written by the same person using a throwaway account, especially if they have a distinctive writing style.
- someweirdperson 4y ago
  I doubt a single post provides a sufficient amount of information for that.
someweirdperson 4y ago
Or a different deleted_user_<random or hash of post> for every post. But as the sibling post says... it doesn't solve anything.
philwelch 4y ago
So you run the stylometric analysis on each comment to cluster them into inferred user profiles.
- MerelyMortal 4y ago
  I'm okay with someone attempting to do that. I imagine it would be extremely fuzzy and not successful.

Operyl 4y ago

The problem still remains: HN’s “API” is incredibly simple and people have full datasets downloaded locally for every comment. In this case, the OP is already out of luck if he’s looking for anonymity against a hostile entity.

MerelyMortal 4y ago
That problem seems like an extreme outlier. Such user protection would prevent "crimes of opportunity". The average person is not going to have a constant backup of HN in case one day they might want to spy on someone's past.
- AnimalMuppet 4y ago
  And if they do, they're likely to start with Twitter or Facebook - something useful against more of the population. HN users are still very much a minority.
- Operyl 4y ago
  The problem doesn’t appear to be that much of an extreme outlier, the thread poster is concerned about a specific tool. That tool has already downloaded the complete data set, he’s already lost.
  - MerelyMortal 4y ago
    And there's no guarantee that service will stay around, or that they won't accept requests. I still think it's worthwhile to reduce the attack surface.
naniwaduni 4y ago
Nothing going forward can help in that case, but we can still weigh impact on other threat models going forward.
juancb 4y ago
"We refuse to help because it's a mild inconvenience to us and we'll justify it by assuming that it won't help without knowing for a fact that it won't." That's a fascinating stance that you've outlined and that others have parroted. A stance that HN has implied with the reply to OP.
- Operyl 4y ago
  I’m not in charge of anything at HN, so how can my statement say HN won’t do something?

sparky_z 4y ago

Not completely. For example, if the analyst has a large corpus from someone's main account to build up a profile, it seems plausible to me that they could identify individual comments under the "deleted" user as being written by the same person using a throwaway account, especially if they have a distinctive writing style.

someweirdperson 4y ago
I doubt a single post provides a sufficient amount of information for that.

someweirdperson 4y ago

Or a different deleted_user_<random or hash of post> for every post. But as the sibling post says... it doesn't solve anything.

philwelch 4y ago

So you run the stylometric analysis on each comment to cluster them into inferred user profiles.

MerelyMortal 4y ago
I'm okay with someone attempting to do that. I imagine it would be extremely fuzzy and not successful.