13 ms·

"Hi I noticed you weren't that online as recently as you were are you ok?" Wow that must be a lot of work Wow I feel for you, friend Yea id be happy to help

"Hi I noticed you weren't that online as recently as you were are you ok?" Wow that must be a lot of work Wow I feel for you, friend Yea id be happy to help out from time to time. --- But needs to happen with other things. Quite often seen in GitHub where an attacker can contribute to build trust. With Reddit, mini modding, regular submissions, good comments etc Defense includes not being shamed or pressured when life seems more important.

hu3 1y ago
But can any mod remove other mods? How does that work in reddit?
- vintermann 1y ago
  Seniority. Older mods can remove younger mods.
  - ahoka 1y ago
    So just try to buy or steal the most senior mod's account and then you have the mod for yourself? Ouch.
    - hpdigidrifter 1y ago
      Strangely not mentioned much in here is how these accounts are up for sale. It's definitely never mentioned on reddit because simply saying one of the websites in an offhand comment gets you a sitewide ban and your comment deleted.
vintermann 1y ago
The simplest thing is probably just to ask for it. I'm sure if you went now and asked to be moderator for a hundred different mid-sized subs, you'd get yes from a few. If you "seem trustworthy", probably more than a few.
gregsadetsky 1y ago
This was exactly the playbook that led to the xz backdoor. Just the quotes: https://news.ycombinator.com/item?id=39909905 https://news.ycombinator.com/item?id=39909905 Very long page but a lot more in depth. Search for “Jigar Kumar pressured Lasse Collin” https://securelist.com/xz-backdoor-story-part-2-social-engineering/112476/ https://securelist.com/xz-backdoor-story-part-2-social-engin... And an overview: https://en.wikipedia.org/wiki/XZ_Utils_backdoor https://en.wikipedia.org/wiki/XZ_Utils_backdoor
- thinkingemote 1y ago
  Yes, I had that in mind too. Its worth any maintainer to be familiar with these methods to build up defences. With a few sock puppet accounts a single person could do it on their spare time. A nation state or criminal full time enterprise could do several attacks. It's scary and immoral but I find it fascinating too. Like the dark side of the how to win friends books. Security.

hu3 1y ago

But can any mod remove other mods? How does that work in reddit?

vintermann 1y ago
Seniority. Older mods can remove younger mods.
- ahoka 1y ago
  So just try to buy or steal the most senior mod's account and then you have the mod for yourself? Ouch.
  - hpdigidrifter 1y ago
    Strangely not mentioned much in here is how these accounts are up for sale. It's definitely never mentioned on reddit because simply saying one of the websites in an offhand comment gets you a sitewide ban and your comment deleted.

vintermann 1y ago

The simplest thing is probably just to ask for it. I'm sure if you went now and asked to be moderator for a hundred different mid-sized subs, you'd get yes from a few. If you "seem trustworthy", probably more than a few.

gregsadetsky 1y ago

This was exactly the playbook that led to the xz backdoor. Just the quotes: https://news.ycombinator.com/item?id=39909905 https://news.ycombinator.com/item?id=39909905 Very long page but a lot more in depth. Search for “Jigar Kumar pressured Lasse Collin” https://securelist.com/xz-backdoor-story-part-2-social-engineering/112476/ https://securelist.com/xz-backdoor-story-part-2-social-engin... And an overview: https://en.wikipedia.org/wiki/XZ_Utils_backdoor https://en.wikipedia.org/wiki/XZ_Utils_backdoor

thinkingemote 1y ago
Yes, I had that in mind too. Its worth any maintainer to be familiar with these methods to build up defences. With a few sock puppet accounts a single person could do it on their spare time. A nation state or criminal full time enterprise could do several attacks. It's scary and immoral but I find it fascinating too. Like the dark side of the how to win friends books. Security.