Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deleting the golang subreddit

groups.google.com

Post reply on HN
Print view View original

241–250 of 389 posts

Re: Deleting the golang subreddit

#241

Post by zardeh »

jsprogrammer wrote: post #204
kps wrote: post #175

Earlier quoted context omitted.

More likely it's because the comment has nothing to do with editing users' content — unless it's meant to suggest that someone else faked Eric Schmidt's email (from the time 5+ years ago when he was CEO of Google) to incriminate him.

The comment has everything to do with editing content. Schmidt was effectively convicted on the content of his emails. I don't think Schmidt was able to edit an email used in that case. It is a positive example of what the poster I responded to was claiming. Additionally, this CEO (now of Alphabet) has continued to engage in seemingly illegal behavior over Google email. I'm not aware of Eric disputing any of these al…

What illegal behavior is that?

Re: Deleting the golang subreddit

#242

Post by rokosbasilisk »

rocketpastsix wrote: post #23
heroprotagonist wrote: post #18

So.. here's the thing. I think that spez did everyone a favor by editing those user comments. We know that politicians and corporations game the system already with fake accounts, presumably as a tool for manipulating public opinion. We know from the code that user comments aren't encrypted at all, or their voting tallies. It would require a very small tweak to manipulate things from the server side. Given that, user…

Not to mention, its pretty widely known that /r/the_donald uses bots to up the votes and push their stuff higher on /r/all. Not that Im thrilled that Spez did what he did, but /r/the_donald has been pushing the line ever since it was created.

after the election, I no longer believe the donald used bots. People just seriously under estimated trumps very large support.

Re: Deleting the golang subreddit

#243

Post by stouset »

SomeStupidPoint wrote: post #236
thewhitetulip wrote: post #144

Earlier quoted context omitted.

The symbolic gesture that the project is disassociating is okay. Deleting the repo is not. >It's just too unreliable of a platform to be official in any regard. The /r/golang subreddit is for devs who want answers and who don't want to be held up by the whims of stackoverflow mods. It isn't rocket science and even if we can't trust the answers, why would anyone edit the answers? If you remember, the reddit CEO only e…

The question I've had is why didn't reddit SREs stop the DB edits as an attack. Even using valid creds, the queries should've been anomalies and logging should've picked up the unusual access pattern. There's three possibilities that come to me: 1. The CEO explicitly told reliability/security staff to ignore his edits. Policy fail of epic proportions. 2. The edits were performed using designed tools and queries, whic…

> Reddit SREs

You've been working at Google too long. Reddit has on the order of a few dozen employees, not all of them technical. Welcome to how the rest of the Internet works.

Re: Deleting the golang subreddit

#244

Post by tscs37 »

bradfitz wrote: post #87

I was the one who proposed deleting /r/golang. It is not some official Go or Google position. As much as I used to love Reddit and was addicted to it, my personal position is that Reddit is no longer a trustworthy platform (if it ever was). Editing user content is beyond offensive. I never even considered such a thing in my years of running LiveJournal. That is a major violation of user trust and trust in the platfor…

>Now I'm brainstorming how one might build a federated Reddit with public, signed mutation log, ala CT or other chains. And then multiple UIs could render the same public & federated data set.

Your post to delete /r/goland triggered me to actually work out an idea for this ;)

The idea would be to use importers to provide reddit and other sources like mailing lists within the site and at the same time provide native content through Pubsubhubbub.

Of course everything uses Ed25519 Signatures for verification, including user-content.

Tho atm it's merely a pipe-dream with a short and shitty readme.

Re: Deleting the golang subreddit

#245

Post by JamesMcMinn »

pavel_lishin wrote: post #71

> It's a wretched hive of scum and villainy. The Go subreddit was the only thing similar to human and it is downright painful most of the time. How lucky that their group happens to be the good one!

The person who made this comment in the mailing list appears to have been made a moderator of subreddit 9 days ago...

Re: Deleting the golang subreddit

#246

Post by SomeStupidPoint »

stouset wrote: post #243
SomeStupidPoint wrote: post #236

Earlier quoted context omitted.

The question I've had is why didn't reddit SREs stop the DB edits as an attack. Even using valid creds, the queries should've been anomalies and logging should've picked up the unusual access pattern. There's three possibilities that come to me: 1. The CEO explicitly told reliability/security staff to ignore his edits. Policy fail of epic proportions. 2. The edits were performed using designed tools and queries, whic…

> Reddit SREs You've been working at Google too long. Reddit has on the order of a few dozen employees, not all of them technical. Welcome to how the rest of the Internet works.

I've never worked at any company with more than 50 employees, and have worked on a team with as few as 5 engineers. Even without an explicit SRE role, someone is doing that work -- keeping the servers (reliably) on the internet and performing, mitigating attacks, etc.

You should be able to tag the row with a dirty flag on second (or later) write using rules internal to the DB without incurring a large performance penalty, if you already have any kind of sanity checking. So at a basic technical level, this is bad design or an intentional capability.

Similarly, even on the team with 5 engineers, our production DB didn't have a way to directly access it, and tunneling through an API box to get network access would trigger an access warning to the appropriate person, because you shouldn't be accessing prod API servers directly either. (Similarly, spinning up a new instance in a security group to inherit permission.)

This isn't detecting advanced exfiltration techniques using information theory... It's basic network topology and server monitoring. And I suspect that reddit has at least a couple ops guys.

This really smacks of intentional capability, followed to lazy design.

Re: Deleting the golang subreddit

#247

Post by personofpelican »

Buge wrote: post #214
BoorishBears wrote: post #11

This is asinine and it going through would seriously harm how mature I assumed the community around Golang was (actually reading through those posts already did, but either way I guess I'm just one person right?). The CEO edited a comment and admitted he edited it, and it was stupid, and he shouldn't have done it. I'm 100% sure there is a way for someone at any given platform they'd choose to replace it with to acces…

He edited comments invisibly (not showing the usual edit mark), replacing the content with content against the rules of the subreddit. Thus when subreddit mods saw content that was against the rules, they banned the victims' accounts.

> replacing the content with content against the rules of the subreddit. Thus when subreddit mods saw content that was against the rules, they banned the victims' accounts

Got a source for this? From what I've read about what happened (not a whole lot), this seems like it's been passed through multiple rounds of the telephone game.

All solid information I've heard, and seen directly admitted, is that he edited mentions of /u/spez to mentions of /u/ in a single thread in a single subreddit.

Re: Deleting the golang subreddit

#248

Post by GFK_of_xmaspast »

wtbob wrote: post #155
the_af wrote: post #109

Earlier quoted context omitted.

> this is an industry in which a CTO would fire an employee for using proper English[0] I disagree with this being a fireable offense, but I read the post and this wasn't about using "proper" English, since both pronouns were correctly used. It was about using unnecessary gendered pronouns when a neutral one would be more inclusive (i.e. it's wrong to consider the user a "he"). Again, firing would be an overreaction…

> the neutral pronoun is equally correct from an English language perspective The neutral pronoun in English is 'it,' and using it to refer to a human being is always wrong. The use of singular they is in a few contexts correct, but in many more contexts incorrect. The use of 'he-or-she' is inelegant and incorrect, and the use of generic she is less incorrect than silly. Seriously, this is remarkably silly. 'Girl' in…

"Singular they" is just as valid English as "singular you".

Re: Deleting the golang subreddit

#249

Post by eridius »

TeMPOraL wrote: post #129
nurettin wrote: post #59

Earlier quoted context omitted.

Willing to abuse it - that is conspiracy -. How do you know that something done once will repeat? Will google restart google buzz because they did it once? Will everyone jump ship to RoR because they did it before? I am doing everything I can not to create strawmen believe me, but your explanation simply does not cut it.

Because the power is there and it's tempting to use. Restarting Buzz may not have economic sense for Google, but abusing admin-edit powers has obvious value for the abusers and may be hard to catch if the abuser is not an idiot. "Opportunity makes a thief", and all.

The power has always been there. The fact that it's taken until now for the CEO to use it suggests that it's not actually ripe for abuse. And the fact that the CEO immediately reverted it, apologized, and is watching the community blow up, serves as even further motivation for not abusing this power again.

Re: Deleting the golang subreddit

#250

Post by Sphax »

johnnydoebk wrote: post #200
bradfitz wrote: post #87

I was the one who proposed deleting /r/golang. It is not some official Go or Google position. As much as I used to love Reddit and was addicted to it, my personal position is that Reddit is no longer a trustworthy platform (if it ever was). Editing user content is beyond offensive. I never even considered such a thing in my years of running LiveJournal. That is a major violation of user trust and trust in the platfor…

I'd make the subreddit unofficial, too but for other reasons. It is a very unwelcoming place. I'm not the first one who's saying this, but it's really a shame how toxic the /r/golang is.

Please show me how we are toxic. As far as I'm concerned, it's not true at all.
Post reply on HN