Just some random questions, mostly out of curiosity more than anything else:
- Does SN (or its devs) know who tips who (amounts, time of tipping, etc)?
- Does SN know when I am logged in?
- Does SN know when I log out of my main account and log into a throw-away account?
- Related, does IP get tracked?
I think reading somewhere that SN follows a stateless approach, but I am not fully sure what this means other than that the server does not retain any information about the user's interactions between different requests. Would this imply that the answer to all my questions is no?
Yes, we need that for the ranking, trust graph, rewards etc.
The frontend polls your user every 5 seconds, so you should assume yes.
We could correlate logouts and login to make educated guesses. For example, if the switch from account A to account B always happens within a few seconds, it's highly likely that's your alt.
A while ago, I wrote code for account switching but the code was messy in parts where we certainly don't want to be messy (the authentication layer) so we didn't ship it. But when we release account switching, you don't have to logout anymore.
But since we didn't find a secure way to only send the cookie of the account that you switched to (since the actual cookie used for authentication is HTTP only as it should be), we could look at the request cookies since they will contain all accounts that you can switch to. So it would actually be easier then to link accounts if you use the account switching feature.
When I take another look at the code, I might find an approach that works that keeps accounts unlinked. Open for ideas on this.
No, we never store IPs on purpose but they might get stored in some rotating AWS logs but @k00b would know more about that.
I assume people wouldn't like themselves to be outed like that but one could make like a 3d network graph about this. I bet there would be clusters like in the wikipedia graph (#528996). But feels like some sort of privacy violation...
Thanks for detailed answer.
Yes.
Yes, roughly. We know when you last visited as a certain nym, but we don't know if you're logged in/out otherwise. e.g. we can see that someone last visited a week ago but we don't know if they've logged out or simply haven't returned.
No. We don't do any cross-account tracking. Alt with abandon.
No, we do not store IPs, certainly don't track them, and never associate them with your account. But, importantly, your IP could be logged by things outside of our control or by tools that we aren't aware of. I recommend using a VPN if your IP address is sensitive.
Our authentication uses stateless tokens, which is what I think this is getting at, but we do store your posts/comments/etc (ie state) for obvious reasons.
https://m.stacker.news/31945
Good guy @k00b. Logging out of his main account and using the @anon account to warn us about him working for the FBI~~
Love this meme.. a Darth favourite as well.
This comment is more for other readers than yourself, since you're already acquainted with the source code.
It's great to ask these questions. It's even better that verified team members answered them in a detailed fashion. I still recommend that one goes and reviews the source code (see link in page footer), since it's open source.
It's been discussed before, but how do we verify that the code running at https://stacker.news is the same code in the referenced GitHub repo? I guess we can't. But in the spirit of bitcoin: don't trust, verify.
Interesting. @ek, how do I find out about my trust graph? Im a bit curious if I am doing an okay job.
What you didn't mention is how much one can learn about you from scraping the 1400 items you wrote on here.
Most people would be surprised with how little information you can already be sorted into cohorts. Google/Facebooks do this for ads. Even stuff like your writing style or words used can extrapolate/guesswork a lot.
And in 2024 it's even much more easy than it was 2 years ago - scrape the website, load it into a vector store and ask an LLM AI to guess some stats.
Lol wait till koob strikes a deal with OpenAI and Google to sell our data, then we we can just ask an LLM what they know about us
https://media.tenor.com/11FHLgWrYPUAAAAC/zach-mdx-mandala-exchange.gif
You’re always trackable to SOME degree. Especially if your on mobile and utilizing cell towers
Ulitmately, the user is responsible for their own security. You cannot entrust this with the service operators.
Yes, it's planned