Ask PG: Is voting on HN anonymous?
Not truly anonymous, but can someone with access to your server tell what stuff an account upvoted/downvoted?
21 comments
What's wrong, still thinking about that marijuana thread? Don't worry, we all believe you have really severe back pain... ;-)
Given the fact that you have to be logged in to upvote, and after you upvote you can't re-upvote - yes you can tell what someone upvoted.
After you've downvoted you cant upvote either, so there could just be a flag that says you've done one or the other.
Not just could, but as the parent comment implied, given the nature of the system the answer is unequivocally yes.
The system serves to record the arrows you've clicked, therefore this information must be stored somewhere. Someone with access to this this information should be able to determine "what stuff an account upvoted," unless the system has been designed to obfuscate the connections(i.e. accounts & clicked items) at the database level.
The system serves to record the arrows you've clicked, therefore this information must be stored somewhere. Someone with access to this this information should be able to determine "what stuff an account upvoted," unless the system has been designed to obfuscate the connections(i.e. accounts & clicked items) at the database level.
You only need to be able to calculate what a user has done when the user views the comment. You can imagine storing each vote as a hash of (voter, comment, direction). Then when rendering the page, you calculate all possible hashes on the page and look for hits. If the comment count per page isn't too large, it won't take that long. It's fairly intensive and probably not worth it for a site like this, but possible. It would also screw up any offline voting-rings detection.
Edit: should have clarified that by user I meant a hash of name and password, so it's infeasible to calculate offline.
Edit: should have clarified that by user I meant a hash of name and password, so it's infeasible to calculate offline.
I remember a thread long ago where a user complained that someone had systematically downvoted all his old comments. PG confirmed that it was one user that had done all the downvoting, and as a direct result voting on comments older than x hours was disabled.
So yes, PG can see what you voted. I'm pretty sure he won't use it against you though ;-)
So yes, PG can see what you voted. I'm pretty sure he won't use it against you though ;-)
Downvoting on old comments was disabled. You can still upvote them though.
> PG confirmed that it was one user that had done all the downvoting
This is trivial to deduce from the webserver log alone.
This is trivial to deduce from the webserver log alone.
Of course...
The owner of the server has the power to log each and every access to the site and that includes up and downvotes.
That said I'm pretty sure PG & company can be trusted wrt to such things, HN would die overnight if there ever were any question as to the ethics of the people running it.
There would be much more worrisome things for some people here, imagine being a VC writing here under a pseudonym and being unmasked or someone openly critical of their employer having their posting history revealed.
The owner of the server has the power to log each and every access to the site and that includes up and downvotes.
That said I'm pretty sure PG & company can be trusted wrt to such things, HN would die overnight if there ever were any question as to the ethics of the people running it.
There would be much more worrisome things for some people here, imagine being a VC writing here under a pseudonym and being unmasked or someone openly critical of their employer having their posting history revealed.
PG has mentioned that he uses (unpublished) algorithms to find "voting rings" coming from the same IP, or someone trying to vendetta-downvote another.
Interesting. I'll have to think twice before upvoting my housemate's comments.
news.arc is open source. Go see for yourself: http://arclanguage.org/install
I know you're being facetious, but asking someone to learn a new language and then familiarise themselves with a project's whole codebase just to answer a simple question about privacy is not exactly helpful. Especially when the site is served by Apache, a whole separate program which keeps its own completely distinct logs, so the suggested course of action is not only a huge imposition but can't actually answer the question anyway.
As others have said, the answer is obvious from the behaviour of the site. But even if it were not, other aspects of the server's configuration would be highly relevant, indeed central to the matter, and the source code is unavailing.
As others have said, the answer is obvious from the behaviour of the site. But even if it were not, other aspects of the server's configuration would be highly relevant, indeed central to the matter, and the source code is unavailing.
HN is not served by Apache. The Arc source includes the http server.
You know, I specifically checked that before posting. Where I went wrong is that I didn't look at the HTML page itself; I looked at the images and CSS, which I erroneously assumed to be handled by the same program.
All images and CSS for this site are served by Apache but the actual text/html request is not. However - my point still stands, as the primary request is proxied by Apache and proxy requests, IIRC, are included, or can be configured to be included, in the Apache logs.
update: I am going to have to eat my words here. I have no evidence news.ycombinator.com is proxied by Apache. All the css and images are served by Apache, but they're hosted on a different domain and a different IP at ycombinator.com. I am kind of amazed PG wrote an HTTP server but .. apparently he did. Kudos.
All images and CSS for this site are served by Apache but the actual text/html request is not. However - my point still stands, as the primary request is proxied by Apache and proxy requests, IIRC, are included, or can be configured to be included, in the Apache logs.
update: I am going to have to eat my words here. I have no evidence news.ycombinator.com is proxied by Apache. All the css and images are served by Apache, but they're hosted on a different domain and a different IP at ycombinator.com. I am kind of amazed PG wrote an HTTP server but .. apparently he did. Kudos.
HN stores the links you upvoted, you can view that list by clicking on the number of saved items in your profile.
Don't know about votes on comments.
Don't know about votes on comments.
While we're on the subject, I sometimes see some weird behavior with voting, in particular sometimes my vote doesn't "stick" until the 2nd or 3rd try. It only seems to be down-voting. And sometimes on the second vote it actually drops two points.
Anyone else notice things like that?
Or maybe I'm going crazy.
Anyone else notice things like that?
Or maybe I'm going crazy.
I've seen similar behaviour, but if I reload the page the score is correct. So it seems to be a client side problem which isn't that big of a deal.
I only notice it specifically if I do reload the page. Or are you saying you have to reload more than once?
hmm, might not be the same thing then. I've sometimes been able to upvote the same article or comment twice, but when I reloaded the page the score was as it would be if I only upvoted once.
Of course. Even a user who has never seen the source code can infer that.
Vote something up or down, log out, and come back. You will never see an arrow next to that entry again. Why? Because the intersection of your login and that entry must be storing that fact that you already voted on that.
(I cannot infer from this data alone which way you voted, simply that you did vote.)
Vote something up or down, log out, and come back. You will never see an arrow next to that entry again. Why? Because the intersection of your login and that entry must be storing that fact that you already voted on that.
(I cannot infer from this data alone which way you voted, simply that you did vote.)