top | item 23774394

Reddit's website uses DRM for fingerprinting

1099 points| smitop | 5 years ago |smitop.com | reply

540 comments

order
[+] echelon|5 years ago|reply
While many Redditors are changing their "avatar" to dancing rainbow cockroaches, I had the idea to set mine to the Digg logo as an act of protest. I'm hoping it catches on. I suppose Reddit's new userbase may not even know what that means.

Why the hell do we need avatars on Reddit anyway? Most of them are animated, strobing distractions.

Reddit has jumped the shark. If there weren't significant opportunity cost, I'd happily work on a replacement. It's become a low-signal, high-noise ad-laden dumpster fire.

Advertising is eating the Internet alive. I fucking hate it.

[+] FridgeSeal|5 years ago|reply
I'm going to sound maximum hipster/back-in-my-day/gate-keeper here, but Reddit circa 2015 and earlier was far better.

Nobody wants the redesign. Reddit doesn't need avatars. It used to nicely tread the line between enough people to make it active, but not so many that it didn't still feel niche. It feels very mainstream now, and I think it's lost a lot of what made it actually good. It's asymptotically approaching a social network, but to no benefit, and only the downsides that come with that.

[+] zwaps|5 years ago|reply
I have a question regarding the reddit redesign (of a while ago). This is not a joke. I literally have trouble reading relevant comments there now.

I guess I don't understand how to browse reddit correctly. Say there is a thread and it has replies. Now I want to read the replies. Via "old.reddit.com", the replies are listed below.

In the new reddit, most replies are hidden. If I click on "continue thread etc.", then again a window opens where some replies are shown, but not all - neither in the branch of the thread nor generally. If I scroll down, I end up in a different reddit thread altogether.

I have to frantically click several links to find all replies, or alternatively I switch to the old layout.

I am convinced I am just dumb, but I just don't get the interface. So let me genuinely ask: How does one browse reddit correctly nowadays? There must be some logic behind the redesign that I don't get.

[+] paranoidrobot|5 years ago|reply
You can continue using the old design, where avatars don't show. Check under your account preferences[0] where it's either "Opt out of the redesign" or "Use new Reddit as my default experience" (I remember seeing the first, but checking just now on the old design it shows the second)

I prefer it, even though they regularly "forget" that you've opted-out of the redesign, on desktop, and "forget" that you don't want the Mobile version of their site on phone.

[0] https://www.reddit.com/prefs/

[+] ddingus|5 years ago|reply
Prior to the initial sale of Reddit, it was self sustaining. At the least, modest means would have been necessary to continue.

It sold for a lot, and suddenly the new owners are eager to get returns on that investment.

And here we are.

A new Reddit, that somehow does not get sold, would run just fine without all the BS and people would love it and do damn near anything for it.

I consider Reddit a great example of why a public utility type model could work and serve users much better than what exists right now.

Or... some other ownership model that does not include a billion dollar exit would do the same and mean a very nice living for whoever does it.

[+] entropie|5 years ago|reply
I love and used reddit over the last decade. The day they force me to use the redesign will be my last day.

I really hope we will have an alternative or some 3rd party client because reddit is still a great way to get information or "socialize" with same minded people.

[+] cwperkins|5 years ago|reply
I deactivated my account of 13 years, 4 weeks ago. As far as I'm concerned, its a propaganda machine the Soviets only could have dreamt of.

Its a shame because I got to briefly meet Alexis Ohanian in person and he's a great guy. I remember when redditors used to speak of the hivemind, but you don't hear about it anymore.

I was one of the Digg refugees from 2007.

[+] Jestar342|5 years ago|reply
old.reddit.com is still there and removes a lot of the dross. There's also extensions to ensure you always get redirected to it from any reddit link you follow.

But it's still a dumpster fire of hate, bots and/or paid-for responses, for any sub that reaches critical mass.

[+] footlose_3815|5 years ago|reply
I was there when everyone left Digg. They definitely have turned into another digg 4.0

https://en.wikipedia.org/wiki/Digg#Digg_v4

* Waste of real estate with redesign

* pushing users towards more social features

* Increasing ad presence in feeds instead of just the sidebar

* Taking no steps to stop the hategroups that flocked to it in 2015.

[+] henriquez|5 years ago|reply
That’s kind of a defeatist attitude. It’s not worth doing something so I’ll just change my avatar in a glorious show of passive aggressiveness. If you really believe what you’re saying then delete your account and find new ways to spend time online. I did, and I survived.
[+] seisvelas|5 years ago|reply
I recently started using lainchan, an imageboard, and I really enjoy the security board. It has some of the toxicity inherent from the chan culture, but otherwise I've been pleasantly surprised with the quality and depth of discussions I've read so far.
[+] _ps6d|5 years ago|reply
(Disclaimer: promoting my own site)

I worked at reddit for 4 years but quit in late 2016, largely because of the direction the site was starting to go even then. They've taken $500 million in venture capital in the last 3 years, so it's only going to keep getting worse as the pressure builds to create a return for those investors.

A few months after leaving, I decided to start a non-profit so I could work on building a community site that would be able to stick to the principles I believe are important: no advertising or investors, open-source, privacy, higher-quality non-fluff content, etc. There's more info about the site and its goals in the original announcement post: https://blog.tildes.net/announcing-tildes (HN discussion of the announcement here, but note that it was completely private at the time and you couldn't even view it without getting an invite first: https://news.ycombinator.com/item?id=17103093)

It's still invite-only for registration, but it's relatively active and consistently gets several hundred posts/comments a day. If you (or anyone else here) is interested in an invite, please read the blog post I linked above and send me an email at the address listed in there and I'll be happy to give you one. It's not intended to be much of a barrier, I just want to keep the growth controlled while we continue to get the site culture built up.

I've already paid that opportunity cost to get most of the basic functionality built, so if you're interested in helping with development on Tildes itself or even adapting it for your own similar site, it might be worth taking a look at the code as well. This is probably the best place to start: https://gitlab.com/tildes/tildes/-/blob/master/CONTRIBUTING....

[+] pippy|5 years ago|reply
I had the idea to set mine to the Digg logo as an act of protest I'm protesting by not using Reddit. Ruqqus has so far been an OK alternative, though it's a bit slow both in terms of content and site speed.
[+] toddmorey|5 years ago|reply
It's not even a website now. It just a wall that begs you repeatedly to download the damn app. I don't want the stupid app. You just want better tracking.
[+] bovermyer|5 years ago|reply
Can I interest you in the word of Gopher?
[+] zelly|5 years ago|reply
Reddit was always cringe.

The best internet communities are ones that don't need to be a "company".

HN is a great example. HN is run by a rich guy as a hobby. There will never be ads, there will never be a board of directors, the UI will basically never change, there will never be consultants hired to figure out how to make money off of us posting. Yeah you probably could put ads on HN or data mine and make some money, but it won't be enough money for Paul Graham to get out of bed for.

Twitter is also like this. Jack makes his real money from Square. He can run Twitter like his hobby. That's what makes it so great.

[+] biophysboy|5 years ago|reply
I'm not a web developer, so I'm curious to see if you guys could answer this for me: why are social media feeds so narrow on desktop now? Both Twitter and Reddit have feeds that are less than 1/3 the width of the screen. Is it because advertising feels more sparse if you pepper it along a long skinny string? Is it because they are using inflexible design frameworks for all devices? I seriously don't understand, I hate it, there's so much wasted space.
[+] holler|5 years ago|reply
> significant opportunity cost

Definitely agree, it's a long and challenging journey to build any new product, and more so with no guarantee anyone will use it. I'm working on a new hybrid discussion site after being exhausted from using reddit and other sites for the past decade. There will _never_ be animated avatars on this site. Still in active dev but feel free to check it out! https://sqwok.im

[+] ganeshkrishnan|5 years ago|reply
> Advertising is eating the Internet alive. I fucking hate it

Advertising is one of the biggest factors for wealth disparity. What used to be thousands of people handling marketing now consists of millions of people gambling away their life savings on ads in hopes of making it big.

I speak to at least 20 sellers a week and some of them have acos of more than 60% taking in a loss for months in hope of making it big. Most of them go bankrupt.

The house always wins.

[+] uniqueid|5 years ago|reply

    > I suppose Reddit's new userbase may 
    > not even know what that means.
Is digg.com some new-fangled take on blogdex.net?
[+] rozap|5 years ago|reply
It's so bad. It showed me a notification on the messages icon, so I thought I had a PM. Click on it and it's some stupid "check out this subreddit you haven't heard of" noise that some "growth hacker" added. It's crazy how quickly after taking VC money they were able to run usability into the ground. It's a dumpster fire now.
[+] vkgfx|5 years ago|reply
Sadly, there are a number of replacement sites and almost without exception they're most of the way towards being Voat 2.0
[+] dredmorbius|5 years ago|reply
This reminds me of when Google+ implemented an always-visible, always-above-the-fold, animation-permitted profile image.

I immediately set mine to a nausea-inducing (or worse, apologies) red-green-blue strobe. In protest.

That was ... eventually ... fixed. But yes, gratuitous user-specifiable animations are horrible.

Reddit decidedly has problems.

[+] kernel_pancake|5 years ago|reply
Checkout dev.lemmy.ml for an alternative. It will be federated soon, very promising!
[+] DarkmSparks|5 years ago|reply
I quite enjoy browsing through the deleted reddit posts on ceddit.

Much better signal to noise ratio.

[+] DaniloDias|5 years ago|reply
The Internet is still pretty rad if you avoid sites with the chode-monetization business model.

I agree with everything else you’ve stated.

[+] sockgrant|5 years ago|reply
Advertising is eating the internet alive? Advertising has made the internet as we know it possible.
[+] manigandham|5 years ago|reply
If nobody wants to pay for forums and content then ads become necessary.
[+] indolering|5 years ago|reply
The title is misleading because they are not using DRM to generate a unique identifier like, for example, Netflix would use. Instead, it is using the type of DRM implementation for fingerprinting/bot detection. It's just a few more bits of unique entropy, along the lines of your screen size and user agent.

This might seem like a small difference, but reason activists hate DRM is that it enables service providers to go a step beyond traditional fingerprinting and gain a truly unique identifier.

[+] TheAdamAndChe|5 years ago|reply
How has Reddit not had its Digg 2.0 moment yet? They are blatantly user-hostile in so many ways nowadays.

For those who don't know, a UI change at Digg triggered a mass exodus to reddit years ago.

[+] userbinator|5 years ago|reply
i.e. the main redesign domain, not old.reddit.com

If the old one didn't do this, there's yet another reason to use it...

I still believe that part of the reason a lot of sites are moving to JS-only SPAs and the like is that it becomes much harder to block things like this. Regardless of sandboxing, the idea of letting a site execute Turing-complete computations on its visitor's computers, just to display what could be done without, is quite repulsive.

[+] yalogin|5 years ago|reply
It real stupidity to push for that 2.0 UI. I don’t know why reddit insisted on that. It’s honestly really bad, pages feel real heavy and wastes a lot of screen real estate. The only reason people haven’t migrated away is because there isn’t an alternative.
[+] llacb47|5 years ago|reply
@OP and others, here's how to enable this flag temporarily.

In the pretty printed version of https://www.redditstatic.com/desktop2x/Reddit.de2e3f279d82ee... add a breakpoint to the first line of this part of the code.

    if (!as(e))
        return;
    const t = e.user.account ? Jt()(e.user.account.id).toString() : void 0
      , s = document.createElement("script");
    s.src = Object(es.a)("https://s.udkcrj.com/ag/386183/clear.js", {
        dt: "3861831591810830724000",
        pd: "acc",
        mo: 0,
        et: 0,
        ti: $t()(),
        ui: t,
        si: "d2x"
    }),
Then when you are paused on the breakpoint evaluate this in the console:

  e.runTimeEnvVars.staging=true
[+] tptacek|5 years ago|reply
Lots of sites use "DRM" (content protection, obfuscation) techniques to fingerprint for anti-abuse. Somewhere, there's a truly excellent writeup from (I think?) Mike Hearn about the work they had to do to build anti-abuse for Youtube; it involved nested VMs implemented in Javascript.
[+] arnaudsm|5 years ago|reply
That's why I'm so happy that HN stayed roughly the same : fastest UI in the west, respectable community, and non-profit. Just like Wikipedia and Craigslist.

I wish we had an equivalent for every big website.

[+] kahlonel|5 years ago|reply
Just another reason why I am never going to touch the new reddit with a 10-foot pole. If they phase out the “old” design, I’m done with it.
[+] tlear|5 years ago|reply
Reddit as of late has crossed my enough is enough line, used extension to wipe out 8+years of posts and deleted my account.

Alternative will happen, there is a pile already being promoted we will see who wins.

[+] kbenson|5 years ago|reply
Is Reddit not doing enough to identify and remove bot accounts and bad actors, or are they doing too much fingerprinting? The former is definitely a problem, and I imagine most users care about it to some degree.

If you as a user care about both, perhaps a nuanced opinion is warranted.

[+] codezero|5 years ago|reply
A lot of these bugs are used to test for fake user agents. Even sophisticated bots may not know that their fake user agent’s V8 version had a jit or rounding bug. If you watch change logs you can spot this stuff. Most of these are obvious and sophisticated fraudsters are well beyond that.

I could say it’s defensible but a big reason bots are a problem is the way the entire online ad system is still the Wild West. There is no regulation so I wouldn’t be surprised if a majority of the bots were just competitors. It has to be tempting to use that black hat fraud defense knowledge against your competitors, especially if there is so little regulation or transparency.

[+] stevekemp|5 years ago|reply
I have recurring thoughts of implementing something like reddit, by writing a server which would present a list of groups/posts actually stored on an NNTP server.

This would allow sharing posts, and decentralized hosting, because all the real content would be stored on the NNTP host.

(A simpler approach would be to use an IMAP server - a different mailbox for each group, and threads naturally being stored as .. threaded emails.)

Perhaps I should have a stab at actually implementing it!

[+] jakub_g|5 years ago|reply
You know how this works those days on a big corp level: the CEO buys a "solution" from 3rd-party "vendor". The solution does things but no one cares what exactly and how. A few insider developers get upset when they run a debugger and notice weird stuff going on, but they don't have any power over it. Anyway rolling this kind of things on your own in a non-creepy way is not viable unless you're Google scale, so you pay the 3rd party like WhiteOps or Distil or Cloudflare or use Google captcha.
[+] peter_d_sherman|5 years ago|reply
There's an interesting philosophical question raised here, which looks like this:

User Privacy Vs. Troll/Bot Protection

If you want stronger privacy (weaker browser fingerprinting), then you must equal-and-oppositely accept that that allows Trolls and Bots to flourish on the network...

On the other hand, you can have less Trolls and Bots on the network -- but this means that you must give up some of your privacy via stronger browser fingerprinting...

So, the next logical question is, is there a way to have the best of both worlds, that is, more privacy (less browser fingerprinting), and less Trolls and Bots simultaneously?

The answer I come up with at this time is:

"No -- UNLESS Reddit were to call up every single user that registers, and voice verify them and/or make sure they have a credit card or other valid ID on file... and then they'd have to take extra steps to validate those..."

So yes, it could be done... but then Reddit might lose its automated registration process -- and possibly casual users, who didn't want to provide all of that information as well...

It's interesting, because all online user commmunities represent various types of compromises between the different factors I've outlined above (there are more factors, of course)... in the future, I should create a matrix of all of them, and see where other various famous online communities exist as points on it... I think such an exercise would be enlightening in some way or other...

[+] simonsaidit|5 years ago|reply
I joined reddit more than 14 years ago, before subreddits, when it was written in lisp and top posts were Paul graham essays and Joel on software. Today HN is the place for this kind of content. When digg died there was a fear what their user base would turn the site into. I have no issues with the design but probably because I’m mainly on my mobile. What did change for me though was the amount of toxic people in almost every subreddit I frequent.
[+] mark_l_watson|5 years ago|reply
I just followed the privacy URI FOR iOS Reddit on Apple App Store, the link is no longer valid. I am searching and reviewing their privacy statements.

EDIT: their blanket policy I found on the web was what I expected. I donate money to Reddit and I wish that as a perk I had more privacy “We may share information between and among Reddit, and any of our parents, affiliates, subsidiaries, and other companies under common control and ownership.”

[+] Andrex|5 years ago|reply
> Contains what appears to be a Javascript engine JIT exploit/bug, "haha jit go brrrrr" appears in a part of the code that appears to be doing something weird with math operations.

Ignoring everything else, this made me chuckle quite a bit. I can only imagine how much funnier it'd be if I actually saw that line while picking apart minified code.

[+] idkcd|5 years ago|reply
Reddit died with Aaron Swartz. Check out r/watchredditdie and r/declineintocensorship to see blatant examples of how Reddit censors right wing opinion. I left Reddit when they recently banned 2000 subs to curb "racist" speech while racist subreddits against whites are okay because they are the majority (America is the only country that exists). Reddit has become such an echo chamber it's worse than Facebook now.
[+] AlexCoventry|5 years ago|reply
Does anyone know of a nice open-source desktop client for reddit which runs on Linux?