Hacker News Reader

Comment by have_faith | Hacker News Reader

> Hacker News

> Impossible

Not sure how I feel about this one. I think it's a nice gesture to respect someones wishes to delete their contributions regardless of the technical fact of external archives etc.

View on HN

Dang's response to a similar (but slightly more confrontational) comment from me: https://news.ycombinator.com/item?id=19459658

While I mostly agree with what he said, I think there are some things they could do to give users more control without "gutting" threads.

1. Allow accounts to be deleted, with all of all their comments and submissions reverting to a [deleted] author.

2. If conversations require author continuity, anonymize the author per-thread to something like the Google docs anonymous usernames

3. Include a deletion request with clear guidelines for reasons why something can be deleted.

Of course they won't do these things because 1) it's only two people and these features will require development and maintenance 2) an opaque and uncertain process ensures that they'll only receive requests in the most necessary cases 3) people might think more about what they write if they can't easily take it back

What they could really do is add a warning to the account creation, submission and comment forms telling users that their submissions are not retractable past the grace period.

GDPR: https://gdpr.eu/article-17-right-to-be-forgotten/

It’s often the easiest way to comply with GDPR just to allow any of your users to rage quit and delete all their stuff. That way you don’t run afoul of the EC if you accidentally mis-identify an EU citizen as not being from the EU.

EC doesn’t care about conversation continuity.

It’s especially annoying because the fact that you can’t delete an account is not disclosed up front.

There is double standard favoring HN. If Reddit or Facebook didn't allow you to delete your account or comments and said it wanted to maintain a permanent record of you, they would get eviscerated.

There are many questions going back on HN itself and the answer had always been no, but from what I understand they have renamed a few accounts. But it isn't something that they will apparently do for everybody.

There's a major difference between sharing very personal information with close people, and stating your opinions in a public forum. Additionally, hn does not openly collect much metadata etc from your usage. You are right, that this is a double standard, but the sensitivity of the data is very different.

That may be true, but I believe the information hackernews collects is still enough to be potentially personally identifiable. This makes we wonder if the inability to delete here might be at odds with GDPR compliance in the EU.

But YC probably have no ties to the EU, so they can't be held accountable.

GDPR applies to any company that handles the data of EU citizens, regardless of whether that company is located in the EU or not.

EU citizens OR residents

What happen if the non-EU company won't comply? Can EU sue it? Or block its website?

GDPR has little or nothing to do with citizenship. It focuses on presence in the EU, not on citizenship in the EU. See Article 3.

It applies to:

1. Processing that takes place in the context of processors and controllers that are in the Union, regardless of whether or not the processing itself takes place in the Union.

2. Processing the data of subjects who are in the Union by controllers or processors who are not in the Union if the processing is related to offering goods or services to such subjects in the Union or the processing is related to monitoring the behavior of such subjects that takes place in the Union.

One of the recital elaborates on offering goods or services to subjects in the Union, and that includes this:

> In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

I'd guess that HN would argue that they are not in the Union, so don't fall under #1, and not monitoring behavior, so don't fall under the second prong of #2, and that they did not envisage offering goods and services to people in the Union, getting them out of the first prong of #2.

The GDPR only applies to entities it can be enforced against.

There's a whole world outside of Europe, which does not follow European law.

There was a post maybe a year ago about GDPR, and the general feeling on HN was the all websites should follow it in principle even if not required by law.

I guess that means all sites, except HN.

I think you are mixing up right to be forgotten, and GDPR here a bit.

Excuse me, but what information are you referring to? user: 0xfffafaCrash created: October 6, 2014 karma: 203

This information? That was all I, as a fellow user, could see. Rest of the information is not public.

GDPR is about personal data and extra data (metadata) that is used for non-essential business needs like marketing, so user can ask to remove that extra data. But if the data is required for the entity to do business and by law you can't expect it to be deleted. Like you can't demand some e-commerce site to delete all your order information and associated delivery addresses, phones, contacts, you can however ask them to remove the account, so you lose access to orders and they in theory can't associate it with you anymore, or at least use to build profile on what your buying habits are.

So you can't demand (under GDPR) from HN to remove your data, maybe remove account but handle is not personal data so it is a stretch.

Wait, what? You can go back and see all their comments and submissions. That will quite possibly have a lot of PII, but cannot normally be deleted.

FWIW, this is something HN has to fix, if you ask me.

If you send a request to the moderators and cite the GDPR I would expect them to delete it. The GDPR doesn't require the deletion process to be automated.

So I guess the Just Delete Me link should be mailto:hn@ycombinator.com?subject=Please%20GDPR%20my%20account

That sounds more accurate than "impossible" does to me

> That may be true, but I believe the information hackernews collects is still enough to be potentially personally identifiable.

Imho there's still a massive difference between "potentially personally identifiable" and running a whole business on identifying people and selling that information as Facebook or Google does.

Reddit is a weird middle-ground: Afaik they don't make a business out of selling ad targeting profiles as Facebook or Google do. But due to Reddit's nature with subreddits for even the weirdest of interests, they do have massive potential for it.

In the big picture, subreddits are not that different to Facebook groups surfacing preferences on all kinds of topics, thus analyzing a Reddit users post history [0] and subreddit preferences (u/leansbot) can also give quite a good profile about somebody.

HN couldn't even compete with that if it tried, HN is pretty much just one big main forum where certain topics simply don't get discussed, as such users don't even have the opportunity to surface personal preferences about them, compromising their own privacy.

[0] https://atomiks.github.io/reddit-user-analyser/

> There is double standard favoring HN.

The term "double standard" means two standards are applied to two different things (or group of things) when the differences between the two things are irrelevant to the standard. "You're not allowed to play baseball because you are a girl, but your brother can because he is a boy" is a double standard because gender has no relevance to playing baseball.

Whether a site should programmatically allow the deletion of accounts/comments is surely related to how they handle the collection and pursuit of PII. HN quite obviously is not the same as Facebook in that regard, and unlike the baseball example, that behavior is relevant to the standard being applied.

That said, I could get behind a mechanism where a user can, one-time, change their username, with the effect of disabling their account forever. This would allow people who use their real name[0] as their username to change it to something pseudonymous, without allowing some of the less social behavior a more open name changing system would allow.

[0] - I'm not the 'real' Clark Griswold. Sorry. :)

The double standard is that the HN hivemind, speaking broadly, demands practices of other sites (Facebook, Reddit, etc.) which aren't provided by HN, and are defended by some users of HN.

My view is that HN should have a clearly stated, and effective, account and content deletion process, and that it's a shame and embarrassment it doesn't.

Maybe. But it (at least) feels like HN sets some different expectations upfront (e.g. not being able to edit a post after a certain amount of time).

HN also has a pretty benign sign up process (i.e. relative to most sites, you don’t really give out any infomation, you don’t even _have_ to confirm an email).

I think people feel differently towards HN because HN treats people differently. (Just my 2 cents)

FWIW, reddit doesn't require to confirm an email, though it employs a plethora of dark patterns to make you believe you have to.

Yeah it's pretty crappy, but it's not a plethora, you just don't put anything in the "email" text box and click <next>, that's not really a plethora.

I have no skin in this game, but I am tempted to side with you on this one, especially because the replies with attempted justification are actually just showing how weak of a defense there really is. It’s a forum, you post things. It’s not that different from other forums.

Personally I don’t think I will ever want to delete my HN account because I’m just some random dude, but I think it should be possible to at least delete your profile and leave your comments/submissions orphaned. Reddit does it.

I do hope people eventually come to the conclusion that everyone says regrettable things on occasion so they can stop digging through endless archives of comments and posts looking for dirt. I feel this is a huge component of why people want deletion.

> I do hope people eventually come to the conclusion that everyone says regrettable things on occasion so they can stop digging through endless archives of comments and posts looking for dirt. I feel this is a huge component of why people want deletion.

I don't think that's going to happen until society agrees that such digging is universally immoral. Until then, people are going to listen when the results are publicized.

that really goes against human nature

> If Reddit or Facebook didn't allow you to delete your account or comments and said it wanted to maintain a permanent record of you, they would get eviscerated.

By whom?

There's always a danger of falsely claiming a double standard when in fact you're just trying to judge one community by the standards of another.

By most HN comments. That’s patently obvious if you have been around HN for even a month.

Right. But HN is a public website and not a walled garden. If Facebook were open to everyone with an internet connection and had no direct or private messages or anything secret I think you'd see a similar standard applied there.

I was responding to the “by whom”.

Reddit has a lot of that stuff and their geeky subreddits have the same amount of complaints of FB as HN. There likely is some overlap of users as well. And most likely overlap of the sort of users. There’s no standard being applied at reddit.

I hate seeing deleted comments in the middle of reddit threads though.

Somehow this problem didn't really exist in forums in the 2000s.

It did to some degree, but it was less visible (often times, such posts would be outright deleted, as opposed to merely having content wiped). Also, it's much more visible on a platform like Reddit, as it's a highly centralized discussion forum.

Contact an attorney and have them make the request. I'd bet it gets done that way.

Like everything else people most people won't do what they should unless they absolutely have to.

On what grounds?

Reddit doesn't allow you to delete your account either. You can only "deactivate" it, to delete posts you have to do it manually. Since the Internet has the attention span of a gnat, I can find no plausible justification to not delete one's contributions automatically. At most, a site may delay the delete by a few weeks out of respect for other users. After that, all conversations have long died and measurably nobody cares. Other than the Twitter cancel mobs.

> Since the Internet has the attention span of a gnat, I can find no plausible justification to not delete one's contributions automatically.

People often say things that have useful information in them?

The number of readers of forum comment decays exponentially over time. Is anyone reading years old forum comments looking for insights?

Yes.

It happens rarely, but it happens.

The first Usenet posts of Linus regarding Linux, or of Mike Godwin's coinage of Godwin's Law come to mind.

The question of how to determine cultural relevance is a hard one. Ordinarily, say, social utterances or discussions wouldn't qualify. If a participant or subject of that discussion ends up in a socially-significant role (high office, head of a major company, etc.), that might change.

Contexts vary, and can change over time.

At the same time, records are lost with time, there is a forgetting curve, and a few high-water marks stand out, though even those crumble in time.

Looking at HN's top-ever stories is an interesting exercise (either Lists or Algolia's search w/o any terms should give this).

Yes! It's so frustrating searching on Google, clicking a reddit thread just to find out the important post is already deleted.

I read old HN comments quite regularly. When I need insight about some topic, my first search is always through HN comments.

When researching a topic, I regularly use DuckDuckgo with `site:news.ycombinator.com` as part of the search term. Sometimes the older comments will be out of date but it's often the case that they contain information or insights that are still relevant and interesting.

There are some python scripts that will go through and scrub your contents. Not that it really matters, all the big guys backup reddit everyday for future reference, you're just probably protecting yourself from low level doxers and not state actors. Then again state actors can always go down to the hardware store and buy a $5 dollar wrench or rubber hose and beat it out of you

Unfortunate, given the recent reports of social media accounts being inspected by customs agents. Something you said years ago (and, hypothetically, no longer believe in) might get you in trouble and you have no way of purging that record. It ultimately will have a chilling effect on what you can say on the site.

Unfortunate, given the recent reports of social media accounts being inspected by customs agents.

And bosses. And landlords. And insurance companies. And credit reporting agencies. And police departments. And schools. And...

It’s fine. You just have to make sure you never say anything that could ever possibly be misinterpreted or used against you by anyone ever for the rest of your or your children’s lives. How hard could that be?

or your children’s lives

That's the even scarier part. There was a NASCAR driver a couple of years ago who lost his sponsorship because of something his father said before the driver was even born.

The sponsors are a business out to make money, not to make sound ethical decisions.

The way capitalism is supposed to work is that consumers (the capitalist synonym for “people”) avoid companies they don't like for whatever reason. The problem is this assumes consumers are reasonable.

The sponsor has little to gain by doing the ethically correct but publicly outrageous thing and standing by the innocent person, because there are more people in the angry mob than there are who would reward the sponsor for their sound ethics.

> The way capitalism is supposed to work is that consumers (the capitalist synonym for “people”)

“Consumer” isn't a synonym for people in capitalism, it's an economic role that all people assume in capitalism, but not in all interactions. (“Laborer” and “capitalist” are similar, though slightly less universal, roles; because they are less universal, the degree to which one tends to assume them also define economic classes in capitalism.)

> There was a NASCAR driver a couple of years ago who lost his sponsorship because of something his father said before the driver was even born.

In case anyone was curious, this appears to be referring to Conor Daly, as described in the following article: https://www.nytimes.com/2018/08/24/sports/autoracing/conor-d...

I read this as /s but it looks like:

a) I'm wrong and this is literal b) The crowd is wrong

I was being mildly sarcastic to make a point, which is: telling people to police their speech and to make sure they don’t say anything they might regret isn’t a workable solution, because it’s impossible to predict the future. And in the court of public opinion, it doesn’t matter if you’ve since changed your mind five, ten, 20, 30+ years later, people will still judge you for the tiniest sin. "Be careful what you say" is a lazy cop-out, honestly.

Also, laws change, governments change, social mores change. What is safe or acceptable to say today may not be so years from now.

If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.

- Cardinal Richelieu (supposedly)

> How hard could that be?

I do three things that make it pretty easy: I avoid nearly all social media in the first place; when I do interact online (such as here), I always use a pseudonym; and if any company or governmental body asks for my social media credentials, I tell them I don't have any (which happens to be 99% true).

Just don't use your real name.

How does this work wrt GDPR?

IANAL, but: if you are an entity that provides free services to citizens of the EU, and you process PII (e-mail address), you are subject to the GDPR's rules.

"Monitoring" is also a qualifier for whether the rules apply, so it could be HN will simply say this disqualifies them, and require someone to take them to court (which YC can afford). But HN does install cookies on your computer, so I think you could still win such a case.

https://ec.europa.eu/info/law/law-topic/data-protection/refo...

> IANAL, but: if you are an entity that provides free services to citizens of the EU, and you process PII (e-mail address), you are subject to the GDPR's rules.

Only to the extent the EU can hurt you.

Do you think every company is subject to US law?

Everything you write here will be saved whether it is stored or HN servers or not. That's just the reality. Some rulings may stop wayback machine but then there still will be tons of archivers accessible through dark web. Text is really cheap to store and that's moderated text where somebody else is already taking care of it not being just a bunch of random characters or somebody's else encrypted backup. It's just that regulations and our culture haven't yet fully catch up.

The only solution is to not use accounts which can be easily tracked back to you, and not post information which can be easily tracked back, either. Which used to be common practice. When and why did this change? With Facebook demanding that people link their offline social circle into its virtual one?

Well, you can go back to Usenet, and say that "respectable" people weren't pseudonymous there by and large, but that, one, wasn't universal, and, two, wasn't the practice of the 1990s Web fora which postdated Usenet's high period but predated Facebook. There weren't too many real names on high-period Slashdot, for example.

It's not a solution, but you can change your username to something random by contacting dang.

Reddit lets you make the choice on the spot and leaves the content with the user name marked as [deleted].

Although I'm sure this community is small and the great team here is responsive enough.

You can remove content on Reddit too.

HN is (intentionally?) a very manual and obscure operation.

I've contacted in the past for another account to delete a singular comment and was ignored :/

The mail may have been overlooked. I typically see a response within a day, often in minutes. Though not always.

AFAIU dang and sctb alone manage all email requests from all HN accounts, which is a fairly sizeable community.

Step 1: become CEO of Facebook and get oversight where your account data is

Step 2: find out data is not actually meant to be deleted

Step 3: shrug, because now you are the CEO

zuck actually deleting his account would cause a small headache with the number of old tests hard coded to his id. (4 is easy to remember.)

Thats misinformation. If you want a comment removed you can email the HN mods (I always forget the email). I feel like they could similarly delete your account upon request.

But why don't they automate it? 1. It's standard practice to have a delete my account option. 2. It's easier for users. 3. It's easier for admins. 4. The presence of the option makes clear that one can delete their account without much trouble. 5. With the option they don't get frowned upon, such as in this case.

In regards to posts you get an hour to edit / delete. Otherwise it stays once it gets replies just to keep history of conversations.

In regards to deleting accounts that is a good question above my responsibilities as a fellow user to answer. I would love to hear from mods about it. It certainly would suck if we see old convos lose context / content over the years.

I had a post yesterday that I wanted to delete. It was less than 30 minutes since the post, and there was no deleted button, but an older comment slightly more than 30 minutes old still had the delete button.

HN moderation is very secretive and manual, and that introduces a lot of opportunity for bias.

Edit: it's interesting that you cannot delete a comment with a reply, but you can edit it into nothing. I never noticed that. Seems like a useless distinction. So you can also force a comment to exist by just replying quickly so they cannot delete it. Neat trick.

I think that after a comment has a reply, it can no longer be deleted.

You also can't delete a comment that has replies, so maybe that's what happened.

Testing, can I delete this after I post a response that I then immediately delete?

Edit: apparently you can delete a comment if the child comment is deleted.

You wouldn't need to fully delete all comments: updating the author's name to "deleted user" would already be an improvement.

Automate it can bring bugs. Automating it can make it hack-able. If you can mail, its enough, gives you some thinking time to.

Sometimes it depends on how the backend data is stored. I'm going to assume that HN uses linked data for your account name against posts and comments...

How do they deal with your delete account request? Do they just remove your account resulting in 'NULL' appearing against all your previous comments and posts? Do they remove all your previous posts and comments as well? This could result in broken comment threads - a workaround would be to replace your comments and posts with '[Deleted]' which could then make child comments lose their context.

If the whole thing was automated, what stops people abusing the system by creating, posting abuse, and then deleting the account? So many questions, and no easy/simple answers.

Deleting an active account on a busy site is rarely just a case of removing the user record from the users table.

I think it's unfair to label it as misinformation. We're talking about the ability to delete an account which HN's only option is to email and ask nicely. It would be fair to say then the feature doesn't exist. Whether that's a good or bad thing is a different matter.

I've asked nicely, many times. They keep saying no. My only victory was to get a name change, but it took a few years of asking.

I lost all hope and ended up just abandoning my old profile and starting fresh. It's not like karma has any meaning here.

> They keep saying no

Was any specific reason provided? I don't understand why just marking the user as [deleted] would be something that HN mods would have an issue with. Or is deletion meaning to delete all comments/posts made by the user too?

2016-04-20: initial request to rename or delete "Account renaming is something we plan to implement but haven't yet. You're welcome to email back in the future and check if it's done yet."

2016-07-26: check up "Not yet, sorry. There are some technical difficulties because YC uses HN IDs in its internal systems, which are separate, so we need to be extra careful not to make a breaking change. But we'll get there."

2017-02-20: me (falsely) claiming it's a matter of national security "That does sound urgent, so I'm sorry to have to reply this way, but we don't actually have the ability to do this. At some point we will have the ability to rename accounts to something anonymous, but unfortunately we don't have that yet either."

2018-02-22: another check up "Not yet, sorry, but it is coming. Do you want to be on an email list to get notified when it's ready?"

2018-09-06: no email. another check up after a small stalker scenario, and also a business associate mentioning they saw my HN profile while doing a Windows search for my contact info (thanks Cortana /s) "Yes—we can do account renaming now. Haven't announced it yet, but that's coming." rejoice

2019-04-18: check up on deleting "Hacker News doesn’t delete entire posting histories, and we don’t plan to because that would gut the threads others participated in. The intention is to address privacy concerns with account renaming or redacting personal information. "

> We're talking about the ability to delete an account which HN's only option is to email and ask nicely.

This means it's not impossible as the claim states. Impossible means you can't even email anybody to delete your account.

But they can still say “no”. Then what?

No, they will not delete the account. They can change your username to something random but answers / questions will stay. As much as I like being able to remove accounts on websites when I quit them, I side with HN here: there are some really interesting discussions here sometimes and removing all data would break the thought flow.

StackOverflow does the same.

It's actually quite easy.

Go get all your comments, and submit them to the copyright office. Remember, you have innate copyright even if it's not registered. But registering ALL your comments on HN can be done for $50.

Then file a DMCA against your content. If they don't remove, then you can sue up to $135k/violation.

You can also register as much content as one shot. So if you have the time, cover all your content, everywhere. And if some org gives you the run-around, DMCA'em.

Also technically, you can DMCA them without a copyright filing. But having that legal backing has real teeth.

Would this create a record of the comments at the copyright office?

The HN terms (https://www.ycombinator.com/legal/) have the very typical:

> By uploading any User Content you hereby grant and will grant Y Combinator and its affiliated companies a nonexclusive, worldwide, royalty free, fully paid up, transferable, sublicensable, perpetual, irrevocable license to copy, display, upload, perform, distribute, store, modify and otherwise use your User Content for any Y Combinator-related purpose in any form, medium or technology now known or later developed.

When you send someone a DMCA takedown you need to include "A statement that the complaining party has a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law" and "a statement that the information in the notification is accurate, and under penalty of perjury". [1] So you probably don't want to send someone a DMCA request after giving them a license to use your comments!

[1] https://www.aclu.org/other/text-digital-millennium-copyright...

Reply on news.ycombinator.com