Hacker News Reader

Comment by MerelyMortal | Hacker News Reader

Yes it does, not everyone gets a unique "deleted" account. Everyone's comment gets attributed to a single special "deleted" account.

View on HN

The problem still remains: HN’s “API” is incredibly simple and people have full datasets downloaded locally for every comment. In this case, the OP is already out of luck if he’s looking for anonymity against a hostile entity.

That problem seems like an extreme outlier. Such user protection would prevent "crimes of opportunity". The average person is not going to have a constant backup of HN in case one day they might want to spy on someone's past.

And if they do, they're likely to start with Twitter or Facebook - something useful against more of the population. HN users are still very much a minority.

The problem doesn’t appear to be that much of an extreme outlier, the thread poster is concerned about a specific tool. That tool has already downloaded the complete data set, he’s already lost.

And there's no guarantee that service will stay around, or that they won't accept requests. I still think it's worthwhile to reduce the attack surface.

Nothing going forward can help in that case, but we can still weigh impact on other threat models going forward.

"We refuse to help because it's a mild inconvenience to us and we'll justify it by assuming that it won't help without knowing for a fact that it won't."

That's a fascinating stance that you've outlined and that others have parroted. A stance that HN has implied with the reply to OP.

I’m not in charge of anything at HN, so how can my statement say HN won’t do something?

Not completely. For example, if the analyst has a large corpus from someone's main account to build up a profile, it seems plausible to me that they could identify individual comments under the "deleted" user as being written by the same person using a throwaway account, especially if they have a distinctive writing style.

I doubt a single post provides a sufficient amount of information for that.

Or a different deleted_user_<random or hash of post> for every post.

But as the sibling post says... it doesn't solve anything.

So you run the stylometric analysis on each comment to cluster them into inferred user profiles.

I'm okay with someone attempting to do that. I imagine it would be extremely fuzzy and not successful.

Reply on news.ycombinator.com