Dang said exactly that. What’s your email, I’ll forward it.
Changing my username to something random doesn’t help, because it’s trivial to find a comment or two that make it clear that random user ID is me, and then you can see all my comments.
There are two much better approaches.
1. Make every single comment of mine a new random user if so they’re all separate.
2. Make the user id of everyone who has ever asked for deletion ”deleted-user” so my comments are lost in the sea.
Either of those approaches would make it impossible to find all my old comments and know they all belong to the real me in the real world.
Please help. Death threats are not fun, especially when you have a 2 year old daughter. There is a 100+ page forum thread of people betting on when I (real name, real person) am going to die. Just saying that somewhat Doxxes me.
My email is the same as Dan's. hn@ycombinator.com. Yes you can forward it and I'll read it straight away.
We can't necessarily do the exact things you've asked, because it makes all the discussion threads you participated in incoherent. We can take reasonable steps to disassociate personally-identifying comments from others.
Please help. Death threats are not fun, especially when you have a 2 year old daughter. There is a 100+ page forum thread of people betting on when I (real name, real person) am going to die. Just saying that somewhat Doxxes me.
This sounds terrible, and of course we don't want anything like that for you. It's just not clear (and I still haven't received an email from you so I can't look into the details of the case) how the actions you're specifying that we need to take on HN will fix this issue on some other website. I don't know any details other than the limited information you're sharing here. I can't find any emails about this matter linked to the username you're commenting from here.
It seems like you should be able to do a middle ground that preserves the commenter identity in each individual thread, while destroying the links across different threads.
For example, reserve the usernames 'deleted-xxxx' where x is a number. Then when someone wants their history obliterated, loop over every thread they have commented in. For each thread, choose a random number deleted-xxxx and assign that username to every comment of theirs in that thread.
Thus comments in the thread remain linked with one another, other deleted users in the thread remain distinct, and comments in one thread aren't linkable to a user's comments in another thread (perhaps lamentable, but required for unlinking spilled personal info in the general case)
(I chose random numbers rather than incrementing so that one can't start making inferences about users based on deletion order)
It should just be randomly generated when the page loads. "Oh, this user has the 'dormant' flag set? Generate a uid on page load" so all their comments have consistency for that one viewer for that single page load. Then if you click that user to see all the posts by them, you get an empty set. (Have the search queries return nothing for dormant users.)
Both the null search and dynamic generation per pageload (or any other randomisation across accesses or sessions) would reveal which comments/posts have been anonymised. That might be a cue to an adversary to dig deeper.
That information might be possible to determine from a comprehensive archive of HN, but it would be much harder to obtain.
The ability to disown a specific set of content (I'm not sure HN permits this) would avoid that issue. The associated account would just have a limited history, not an empty one. That would be equivalent to an after-the-fact throwaway account, which is much less attention-grabbing.
The only thing they do is change your username on every comment you’ve ever made to something else. But they’re all the same , so you can still link all the comments to one identity, and if even one comment makes it clear it’s a real person, then they all are.
Requesting anything more results in them saying “oh yes, we respect users wishes, blah, blah” and no action.
As a third party observer, it feels like "work with" could still be hiding a lot of thorny differences in judgement over what constitutes material that should be removed. That's why I was outlining a broad-brush mechanical policy that would cover most of the cases (unlinking a user's contributions across different threads from each other).
The problem is that each case is different, and there's no one approach that would cover all of the cases. Indeed I can see that it doesn't actually address the concern in this case, now that I've been able to find out what the account is and investigate the issue.
More broadly, this is why it's extremely unfair to make public accusations the way this user has done in this thread. The way we handle these cases actually takes far more time and involves more effort and care than it would take to implement the approach being advocated here.
Comments
Dang said exactly that. What’s your email, I’ll forward it.
Changing my username to something random doesn’t help, because it’s trivial to find a comment or two that make it clear that random user ID is me, and then you can see all my comments.
There are two much better approaches.
1. Make every single comment of mine a new random user if so they’re all separate.
2. Make the user id of everyone who has ever asked for deletion ”deleted-user” so my comments are lost in the sea.
Either of those approaches would make it impossible to find all my old comments and know they all belong to the real me in the real world.
Please help. Death threats are not fun, especially when you have a 2 year old daughter. There is a 100+ page forum thread of people betting on when I (real name, real person) am going to die. Just saying that somewhat Doxxes me.
My email is the same as Dan's. hn@ycombinator.com. Yes you can forward it and I'll read it straight away.
We can't necessarily do the exact things you've asked, because it makes all the discussion threads you participated in incoherent. We can take reasonable steps to disassociate personally-identifying comments from others.
This sounds terrible, and of course we don't want anything like that for you. It's just not clear (and I still haven't received an email from you so I can't look into the details of the case) how the actions you're specifying that we need to take on HN will fix this issue on some other website. I don't know any details other than the limited information you're sharing here. I can't find any emails about this matter linked to the username you're commenting from here.
It seems like you should be able to do a middle ground that preserves the commenter identity in each individual thread, while destroying the links across different threads.
For example, reserve the usernames 'deleted-xxxx' where x is a number. Then when someone wants their history obliterated, loop over every thread they have commented in. For each thread, choose a random number deleted-xxxx and assign that username to every comment of theirs in that thread.
Thus comments in the thread remain linked with one another, other deleted users in the thread remain distinct, and comments in one thread aren't linkable to a user's comments in another thread (perhaps lamentable, but required for unlinking spilled personal info in the general case)
(I chose random numbers rather than incrementing so that one can't start making inferences about users based on deletion order)
It should just be randomly generated when the page loads. "Oh, this user has the 'dormant' flag set? Generate a uid on page load" so all their comments have consistency for that one viewer for that single page load. Then if you click that user to see all the posts by them, you get an empty set. (Have the search queries return nothing for dormant users.)
Both the null search and dynamic generation per pageload (or any other randomisation across accesses or sessions) would reveal which comments/posts have been anonymised. That might be a cue to an adversary to dig deeper.
That information might be possible to determine from a comprehensive archive of HN, but it would be much harder to obtain.
The ability to disown a specific set of content (I'm not sure HN permits this) would avoid that issue. The associated account would just have a limited history, not an empty one. That would be equivalent to an after-the-fact throwaway account, which is much less attention-grabbing.
HN will not do this.
The only thing they do is change your username on every comment you’ve ever made to something else. But they’re all the same , so you can still link all the comments to one identity, and if even one comment makes it clear it’s a real person, then they all are.
Requesting anything more results in them saying “oh yes, we respect users wishes, blah, blah” and no action.
We are willing to do this.
We gladly work with users to redact any material that identifies a person or reveals their location, or that otherwise poses risk to their welfare.
As a third party observer, it feels like "work with" could still be hiding a lot of thorny differences in judgement over what constitutes material that should be removed. That's why I was outlining a broad-brush mechanical policy that would cover most of the cases (unlinking a user's contributions across different threads from each other).
The problem is that each case is different, and there's no one approach that would cover all of the cases. Indeed I can see that it doesn't actually address the concern in this case, now that I've been able to find out what the account is and investigate the issue.
More broadly, this is why it's extremely unfair to make public accusations the way this user has done in this thread. The way we handle these cases actually takes far more time and involves more effort and care than it would take to implement the approach being advocated here.
So then you should implement the approach being advocated here.
You said yourself it would take less effort, and the outcome is better.
Win, win.