Hacker News Reader

Comment by jedberg | Hacker News Reader

Since I can't really say more than this: there's a lot of misinformation and misunderstanding in these comments. Don't believe everything you read on the internet and don't believe the conspiracy theories that this has anything to do with censorship or surpressing political (or any other) discourse.

It's really just making the math less complicated.

View on HN

The post where they describe what they're doing sure makes it look like that. From what was described, this is a massive refactoring and recalculation effort to pay down years of accumulated technical debt. Occam's Razor is probably good enough: they had tons of complicated rules in the system that goobered up their calculations, and they needed to get the large amount of ineffectual cruft out at some point.

There's even a clear note that the /top stuff should go back to normal after the recalc is finished and it's back up to speed.

Frankly, I was a bit shocked by the scope of it. Seems like a huge and terrifying update.

I'm not sure if there's a commonly accepted way to handle the logistics of this, but I'd love to see a blog post from them about how they manage this on a site with so many active users at all times.

I guess you start with backing up the production DB to an offline location. The fact that votes can be placed on old posts makes it difficult, I'd assume.

I'll see if I can find it, but there was a comment in an AMA on the topic where someone asked if they have a test server and they said no. Not because they're goofy noobs at the business, either, but apparently it's just too impractical. A lot of the testing really needs the load to be properly exercised, and simulating that is sufficiently hard to probably not be worth the effort.

So this update? Updating on Production, baby!

Edit: I bet they do have test servers, but nothing full scale. Which really may emphasize your point more: I would love to know how they tested it and merged it in when there's only so much they can do offline!

Trust is a fragile thing. Spez broke it repeatedly, even Ellen Pao said she would have fired him for editing user comments. Cant say I blame people for being paranoid.

The people who's "trust" was broken are paranoid conspiracy-mongers who are provably nasty actors who use any opportunity to spread anti-establishment vitriol.

Their paranoia is not justified, not to the extent of the conspiracy that they so routinely engage in.

Just this week a man brought a rifle into a restaurant a fired a shot because of the conspiracy and vitriol of that side of reddit.

Well thats just not true, the community managers and ellen pao understood the repercussions of it.

It destroys the legitimacy of all parts of the site and enflames conspiracies even more.

People are not stupid, my first thought was how many times did he do this without getting caught.

Reddit is a content management system for stupidity and spam. Let's not pretend it's some pristine, important institution. Trolling the_donald could only have been a step in the right direction.

You're fine with it today because it's a group you don't like. What about tomorrow when the same thing will be applied to a group you do like?

>You're fine with it today because it's a group you don't like. What about tomorrow when the same thing will be applied to a group you do like?

Then I'll leave. Simple as that.

I don't want an anarchist site where malicious actors and nasty people are free to race to the bottom because we're afraid of polite society.

The Founding Fathers of America differentiated between Liberty and Freedom.

Freedom is anarchy, but Liberty is freedom with common sense restriction. Liberty is freedom from onerous interference.

I don't want a Free Reddit, I want a Reddit that respects Liberty.

Not a Reddit which lets maliciousness exist because it can, but one which has common sense restrictions to create a better community.

It's no secret that far-more-strict control on Hacker News produces far-better outcomes for discussion than Reddit.

The hands-off approach to Reddit creates a race to the bottom for trolling and nastiness.

You raise a lot of good points here for sure. My main beef with reddit has been the lack of uniformity in application of the rules. It's better for everyone if there are clear rules, and the enforcement isn't capricious.

http://www.nizkor.org/features/fallacies/slippery-slope.html

I'm not a fan of reddit, but occasionally they have some brilliance.

- http://thehill.com/policy/national-security/296789-gop-chair...

- their AMA's with famous people are pretty amazing, steve wozniak's was great.

- Can't forget their net neutrality protest either http://www.bbc.com/news/technology-29127179

- Alot of the programming related subreddits are pretty nice. It's how I got connected with Django Girls.

I agree. I am absolutely shocked at how many simply do not get the ramifications of that simple action. In some countries you can go to jail for your post history.

I'm shocked at how many people are so upset. Maybe you should be PGP signing your posts if their integrity is your top concern.

So you're a media dsitribution contractor in Washington, DC and you don't see how covert editing of social media posts is upsetting, overreach, abuse, or illegitimate? And you're making fun of expectations of the integrity of social media posts?

I think editing critical Reddit comments as part of a prank or maybe as a jokey form of retribution is an extremely ill-advised and boneheaded move. I don't know if it was abusive and it was hardly covert, but it was definitely not cool. I doubt Spez will make that mistake again.

But did it tell us anything new? Are we surprised that Reddit admins have the technical ability to edit records in their own database? (As do the admins of other social media sites...)

It seems Reddit admins don't have that ability, if I read the thread correctly. Rather, Spez helped build the system and just knew how to manage the prank. It wasn't even really a backdoor thing, he just had the know-how to do it (like being able to log into the database and update a row).

That's the confusing bit about the outrage to me: I think people expected it to be secure and tight, and ... well... I'm not sure what led to that conclusion. I can easily imaging that until Spez pulled that stunt, they just figured it was too hard to screw with and that the databases were sufficiently secure. After all, the techs have full access to the machines*. It's like being surprised that your ActiveDirectory admin can change your password at will.

But you can bet your booties they'll try to lock it down a bit better now. Wouldn't expect it to be the TarSnap of forums, though. Reddit's not exactly a bastion of authenticity :P

EDIT: What I mean here is that someone has physical access to the machines, right? Or at least some amount of root? Or can log in? I guess to me it's like being outraged that the guy who targets the Hubble telescope abuses his position and points it at Earth or something as a joke; huge amount of time and money on the line and it would be a dumb thing, but it's also pretty harmless. Might still get fired for it, though.

Or use blockchain. https://steemit.com/

How would one PGP sign their post that prevent malicious editing after the fact?

If someone else edited your post, the signature would no longer be valid. So the attacker could remove the signature or sign it with a different key or leave it alone and hope no one notices, but they couldn't re-sign with your key since they wouldn't have access to your private key file.

Public key cryptography is really neat if you haven't played around with it before.

I was being half-facetious, but if you want to be able to prove that a post is actually written by you, you probably want something like PGP.

I still don't understand. If the edit left the public key as I left it, how would anyone know the difference?

Are you meaning a feature of the site that let's you sign your post with your key as opposed to pasting your public key in the post?

You don't just post your public key next to your comment, you use your private key to create a cryptographic signature of the contents of your post. Anyone with your public key can check that the signature is valid. Altering the text will cause that signature check to fail.

The issue here is that almost nobody actually checks the signature. Some people edit their messages to invalidate them just to see if they'll get called out on it - they almost never are.

So in theory, yes. But in practice - people are too lazy to validate or check the key (if the attacker replaces it with their own signed message) for every single post. This is a bigger issue the more users you have signing messages - as users begin getting lazier with checking each and every signed message.

Unless they are under a lot of eyeballs from people who do care. If Wikileaks "signs" a message and it doesn't verify or wasn't with their key - a lot of people will call it out. If I "sign" a message or use a different private key (very possible that I sign with the wrong key when I have multiples) - I doubt anyone would call me out on it.

I mean, call them what you want but it lead to Brad Fitzpatrick who works on Golang to propose deleting their subreddit [1].

[1] https://groups.google.com/forum/m/#!msg/golang-nuts/XoOhzUCl...

Reply on news.ycombinator.com