Daily Tildes discussion - allowing users to post anonymously?
It's a long weekend in Canada and I'm going to be quite busy, so this is going to be the last daily discussion until Monday. Because of that, I figured I'd pick one of the more interesting topics. This isn't necessarily something that will be implemented particularly soon, but it should be good to discuss anyway:
Should we support the ability for users to make some posts anonymously?
General notes/thoughts:
- If the site itself doesn't support it, people will just create throwaway accounts and effectively post anonymously anyway. This is worse in some ways (causes a lot of abandoned accounts and wasted usernames) and especially doesn't work well while the site is invite-only, since people have to use one of their invites to create a throwaway.
- The user making the posts would still be tracked internally, so anonymous posting wouldn't be free of potential consequences. This association would probably be removed after 30 days, like most other private/sensitive data.
- There would be some sort of anonymous identifier that would change on a per-thread basis, so that multiple posts from the same anonymous user can be recognized.
- Once we start working towards a trust/reputation system, having the anonymous posts be linked to the user's real account would probably have a number of benefits.
Let me know what you think about the idea in general, and what concerns you think we'll need to be careful about if we decide to implement it.
One other, unrelated thing as well: it's been a while since we gave out invite codes, so I've topped everyone up to 5 invite codes. You can get to them here (linked in your userpage sidebar): https://tildes.net/invite
This was my main concern, and you didn't even let me get to the end of your post before allaying my fears.
gg, I'm in favor.
I realise I'm a bit late on the response here, but anyone who wants to post anonymously and suspects they will receive a consequence for it, will just make a new account and ignore the existence of the "make anonymous" feature.
For the moment, that's unlikely to be an issue, since Tildes is still invite-only (iirc, at least). In the longer term, I think the idea is to make contributing from a new account sufficiently painful that people are disincentivised from making throwaways.
I see. But im not sure this site will remain invite only forever.
Just chiming in to say that I'm 100% for it as well. I'd much rather just toggle an option than create a throw-away account, which besides everything else, would bias website statistics.
One aspect that hasn't been brought up yet in this thread -- at what point does anonymity gets in the way of effective moderation? Do high-ranking moderators have the power to de-anonymize comments (for their own investigations)? Does that ruin the point of anonymous posting in the first place?
Effectively this would made it impossible for moderators to correlate questionable comments to a username (or, more importantly, post history). For example in /r/listentothis, we get a fair number of sock-puppet accounts upvoting / promoting their own content -- now if a user creates 3-4 accounts on ~'s, they have 3-4 completely untraceable accounts with which to sock-puppet with. Further, even if we do grant some de-anonymization powers to the moderators (I'm still not sure that's a good idea), the 30-day sunset clause means that the association between "this user commented on band Y the last 5 times band Y was posted" is likely gone by the time the moderator notices something is up and decides to dig further.
Further, I have some concerns about what we do when there's brigading, or other large-scale patterns of rule-breaking. The moderators of a group (likely) wouldn't be able to really trace the behavior back to the source or do much at all beyond "elevating" the issue to people above them (high-ranking mods? admins?). We've all learned how badly this bottlenecking of authority can be to deal with when you're the moderator of a group (who really feels like throwing mail into the black-hole of /r/reddit.com on the off-chance that you get a reply?)
Overall I'm in favor of allowing anonymous posting -- it is a pretty neat fit with the privacy goals of the site -- but we need to think long and carefully about how it's implemented to avoid hamstringing moderators. It's possible that the trust system, if properly integrated, could mitigate some of these issues (e.g., does anonymous posting require a certain level of trust?), but it's something to think about for sure
This could be solved, with reputation system, this way:
We could as well make moderating anonymous posts easier, so when anonymous post breaks rules, it takes less high-reputation users to remove the post, potentially even banning the user from posting anonymously (assuming high-reputation users will be used as moderators).
We should create a list of all the trouble anonymity would create and try to solve them one by one
Thanks, very good thoughts and definitely things that will need to be kept in mind if we decide to add this.
You could still see stats of the real account this could be one of the advantages gained with a trust system. You could have two reputations one for you real account one for the sum of you anonymous account. How you use that is up to you.
The accounts will end up being judged accordingly. If something is just a troll post with an anon. Then you lose anon rep. If you post something meaningful you gain some. Each anon post is not related. If you want to gain a rep with your username then you do you. Of you end up with a negative rep that is your fault.
If mods could see identity I don't think it would ruin the benefit I'm most interested in, which is that anyone scraping the public website could use users posts to build a profile on them. Even doxxing them if they have enough information. If when commenting I can anonymize posts then private mod access wont negate this, Unless the mods can somehow scrape the data, then potentially that could be abused to de-anonymize at a public scale if the data leaked.
Perhaps if mods had the ability to lock anonymous posting as per requirement. Plus places like /r/listentothis don't seem to have a great need for anonymous posts being largely superficial.
Seems like an interesting idea, would that mean people have something like a 4chan tripcode so they can still be verified as being the same person in the thread?
Probably just something like an anonymous "username" in the thread. Like how Google labels people as things like "Anonymous Giraffe", "Anonymous Fox", and so on. Probably not using animals, but that sort of thing.
It would be useful to have the option to reuse an anonymous username in a follow up post. For example, on r/legaladvice people often make update posts, sometimes to let people know how things turned out and sometimes to ask new questions as the situation changes.
Markov create usernames using those of the existing userbase :P
This is a great idea
creates a tonne of alts to poison the markov pool
https://en.wikipedia.org/wiki/Markov_chain
And for a real world example of them in action, created by @deimos no less: /r/subredditsimulator
When I click your link it says "You don't currently have any invite codes available." :\
You registered after I had already sent them out, I've given you 5 now.
Thank you so much! I really appreciate that. :)
I do like the option to make some posts anonymously, especially if that links back to the primary account. Not needing to make throwaways is good, and central tracking of the users' activity (within the privacy guidelines of ~) is great.
It would be useful for the user to have their activity centrally managed, too. That way you don't have to switch back and forth between accounts to check for replies.
Another side consequence of throwaway accounts is that it makes it harder to track / reduce sock puppets. So allowing the user to toggle anonymous posting is a win in that regard as well.
I'm just worried about people using that as a default way to post. I don't want every ~technology post to be made by anonymous. Any idea how to solve that?
Also I have no friends, can I just post my invites to /r/tildes?
You can, but it might be better to ask people to PM you for one so you can take at least a quick glance at their history before inviting them. If someone repeatedly invites users that cause issues, there could be consequences for the inviter as well (probably just not giving them any more codes in the future, but potentially worse if it's egregious).
I've never really liked the idea of holding the inviter accountable for other users' actions. I understand in principle why it's done, but it just makes me afraid to use my invites.
This is pretty off-topic, but I just want to say that I think that fear is a feature, not a bug. If you're not confident enough to put your reputation on the line for someone, I don't think you should invite them because that fear is based on doubts that the user would abide by the rules. I'd much rather people invite those they trust to follow the rules.
To add, I would imagine that no one would be banned based on the actions of a single invited user but that it would need to be a pattern of behavior from the invited.
Even in the worst case, a single instance can be seen as an innocent accident.
Edit: Hopefully this makes sense... happy hour after work :)
I think I would have been banned pretty quickly myself if that were not the case, since I'm pretty sure 3 of the banned users so far were invited by me. But 3 bad apples out of 2000+ invitees is not a bad ratio. ;)
This is something that is important to think about. Possible modifications to anonymous all the time might be that certain ~'s would not allow anonymous postings ever e.g. ask a historian, some would limit anonymous postings to second level comments or a certain number of anonymous comments per day e.g. allowing you to say you don't mind using windows in a linux group, and others would allow anonymous posting all the time if the user chooses e.g. safe spaces groups.
Seems like a good idea, the only problem is it might be hard to get it set up. Having to go through all of the communities and setting the rules for each one separately would take so much time
What if this was a group-level setting that the group's moderators could set up for themselves? So, at a central level, Deimos creates a feature that allows groups to decide whether they'll allow anonymous posting, and in what ways. A group's moderators then decide to adjust the settings for their group to align with the group's goals and culture:
The moderators of ~health.psychology.rapeadvice might choose to allow posts to be anonymous.
The moderators of ~science.ask might choose to require top-level comments to be identified.
... and so on. It could be just a series of settings that the moderators of each group can customise for their own group.
It was just an example of a sub that doesn't need to have anonymous posts
I don't think that's necessarily true though. Discussions on government surveillance programs, methods for getting around National firewalls, etc... many ~technology related subjects could warrant users having legitimate reasons to post and comment anonymously.
My point is 99% of ~technology doesn't need to be and shouldn't be anonymous
Why? At best it seems to me that either option is equally preferable.
I don't care who posted what 99.9% of the time. It's the content I care about.
With the reputation system, there could be disadvantages of using anonymous posting, for example capping maximum positive reputation per post, or even allowing only negative reputation to influence user's account.
How about simply giving no rep for anonymous posts?
-- reddit
this shouldn't be that big of a problem
Sorry, was in the same boat as Soptik here
That would allow users to ruin discussion, attack another users, etc with no penalty - that's what reputation system will be used to.
I was talking specifically about positive reputation. Negative rep should affect the user
Ok, sorry, I misunderstood it.
I don't know, that will be up to u/Deimos, I think there should be either no positive rep for anonymous posting, or maybe, (that might be even better), very small positive reputation cap. You can still make quality discussion as anonymous poster, so you should be rewarded from it, but we want to discourage users to post everything anonymously, so we will have to balance it right.
how about anonymous posts costs some of your rep?
As if on reddit, you can actually spend your karma to make anonymous posts.
What about a rep for anonymous posts? Each of the anon accounts could be tied to the same reputation . If your anon rep drops you lost credibility.
By whom? At the moment, everything is you. In the future, you'll have other admins (hopefully!) and various types of moderator-enabled trusted users. Who's going to be able to identify my anonymous post as coming from me?
I believe that sort of access should be extremely restricted. Otherwise, this isn't really enabling any privacy. It's just giving people a false sense of security.
Agreed, I definitely think it would be something very restricted. Possibly even to the point where there's no actual interface for it at all and it would have to be looked up manually in the database, to try to ensure that it's only done when it's essential.
After a certain amount of trust, it could be exposed as <User CBF43926> so that it doesn't expose user names or IDs but does allow a situation where if a moderator was looking at multiple problem posts made anonymously they could verify if they were made by the same person and take appropriate actions while still not knowing who OP is.
I still believe that users will end up creating a throwaway simply because there is still internal tracking as you've mentioned.
However the ability to reply anonymously is still good as it would allow people to speak freely without prejudice on their user history and what not, something that was an issue with on other websites.
...but then the reasons to do so would more likely be malicious, so a new account with no other activity could be a red flag in by itself.
(I've had the experience on Reddit where I needed to create a throwaway to post something sensitive, but since the throwaway was new and had no activity my post was caught by the mod bot. If there was a legit way to post anonymously then it would be perfectly fine to moderate new accounts by default, while if there isn't then it makes the whole point of throwaways moot.)
I'd note as a caution: here be dragons.
The throwaway option works reasonably well at some sites, notably HN and, more or less, Reddit. However it fared very poorly at Imzy. My experiences there.
I'd be very interested in hearing a post mortem by the Imzy crew -- McComas, Greenie, others, on what their perception of the dynamic was. Though I also suspect I might find that disappointing or unrevealing.
Another option is for anon posts to be approved by a third party, who becomes responsible tor the reputation / outcome (and could lose nominating/sponsorship privs). This requires checks against gaming.
Thanks for linking that long and detailed write up. There are a number of good points in there. There are some important lessons to learn from other communities.
My thoughts on all of this boil down to one main idea: Anonymous posting should be considered a privilege. I think the following would follow that principle and fit Tildes' ideals and design goals:
Anonymous posting should be the exception, not the rule. It's my opinion that commenting anonymously in a topic someone else posted should require more rep than posting and commenting in your own topic anonymously. That would reduce drive-by asshatery. Anonymous posts and comments should be easily filterable.
One idea I haven't seen mentioned yet: what if anonymous posts were initially visible only to people with high trust values, and they became publicly visible only after crossing a certain vote threshhold?
This would mean that trusted users would have to effectively vouch for anonymous comments before they became a full part of the conversation. Should anyone use the posting method maliciously/inappropriately, it would be seen and dealt with only by the trusted users, who would label it accordingly, prompting removal.
It does reduce the immediacy of anonymous content, but I feel like that's a fair tradeoff since they should be vetted to a higher standard than regular ones.
I like the general thought, provided there's good solutions to @arghdos's points.
I'm just wondering how you would envision this. Would it be that at any point in time I could choose "post anonymously" or is it that there'd be certain threads where by default all answers are posted anonymously. And later on when there's some trust system, moderation, etc, will there be an option of not allowing anonymous posting at all, or allowing only after being screened by mods, or w/e?
The simplest form is probably just the ability to post any comment/topic anonymously, but yes, there are definitely a lot of other interesting possibilities with it as well.
This is actually a huge concern to me, imo this would encourage people to just create throwaways, I know I certainly would. I don't have a problem with internally keeping track of posts from anonymous users, but only if it is completely and utterly independent of the account it was created from. If I was worried that private information I was sharing under an anonymous account could be traced back to my main account in any way, I would just log off and make a throwaway, and I think many people share the same sentiment.
The purpose of the feature would be more "I want to post something without it being associated with my main user account", it's not intended to be impenetrable privacy (from the site admins, at least).
Either way, unless you're always using a VPN or something when you create (and post from) the throwaway account, it's probably going to be possible for me to determine who it belongs to, if I need to look into it.
Does admins here mean strictly people running the site/with database access, or would that include "trusted" users/moderators?
That would substantially change my usage of the feature.
I believe so, yes. Quoting another response to a similar question above:
Reading through this thread, there appears to be an inherent conflict between user privacy and strong moderation. In my opinion, if moderators (not admins) are unable to view the anonymity data, it would cripple their ability to effectively moderate the discussion and disrupt misbehaving users. The current public anonymity suggested is a more than reasonable compromise, and users cannot expect full privacy on the moderation side if quality is to be maintained.
At the end of the day, the Tildes opening statement primarily highlights itself as a platform that aims to take action against disruptive voices. Privacy should be a crucial but secondary consideration.
I discussed this early on and was in favour of it then. The only idea I've had since then would be to use a random word list of some kind to generate anonymous identifiers. Similar to the way gfycat.com generates URLs. They use
AdjectiveAdjectiveAnimalas the format, but there are lots of possibilities and using something like that over a pseudo-random identifier makes it much easier to distinguish multiple anonymous users in a single thread.The most difficult part would be generating an adequate word list, so you may want to crowd source that.
I'd also suggest that they are clearly differentiated from normal usernames, so it doesn't matter if someone has registered the same set of words as their username and that clicking on them displays all of the anonymous posts by that user in the same thread. Something like this.
Absolutely in support of this. Even with flaws, more customization is always better in my book.
I totally agree. I sent you my concept for something more twitter like and in there I basically said the same. My only fear would be false security if it's possible to deanonymize someone.
I wrote:
Sure, why not? Better than creating a fake account IMO.
As long as the anonymous post still goes towards/against your trust score, I'm good with it.
I'm fully behind this. The option of anonymity is often useful on a forum-like site, the toggle will prevent single use accounts, the account link will prevent abuse. This would be great
This sounds like a great idea, those are great ideas, and I can't think of any big downsides.
I generally like the idea, but I am more preoccupied with the proliferations of sock puppet accounts than I am with throwaways. If the recent 3 years of social media is anything to go by, I am worried that Tildes will be riddled with sock puppets, vote manipulation and brigading just like reddit currently is
Have you read the general concept of the trust system? https://docs.tildes.net/mechanics-future
One of the main purposes of it is to make manipulation/brigading/etc. almost impossible.
I have read it and thank you for pointing it out again. Perhaps this is not the place to discuss this (especially since you're off for a long weekend - have fun!), but I think these guidelines are still susceptible to manipulation. Users could abuse it by creating networks of connected accounts that upvote/give trust to each other and raise each other's profile over time.
How are high-quality posts different from popular posts? If we're giving more weight to users who voted for popular posts before they became popular, we're incentivizing people to trawl new topics and upvoting the first comments
I'm also worried that a system that involves a "voting-momentum" (trust) may be prone to positive feedback loops where high trust people can create more visible post which in turn gives them more trust.
In short, it's a complex problem and I have more questions than solutions, but I'd love to discuss (and read more about) it
just give an option to not display OP's name in the post body. Don't differentiate their comments in the post with (OP) tag too
Anonymous posting should be enabled by mods in a specific ~ and set a quota on how many anonymous posts could be made per user per month, for example. I don't think there are cases where you would want to use this function very frequently
These seems like good ideas. I wonder how the use of anonymity would evolve compared to the use of throwaways.
Interesting! This sounds good as long as the points you mentioned are being implemented. Anonymity has its advantages on a social platform but then some type of checks are needed to prevent the detrimental behavior. And the 'change on a per-thread basis' would have to be user-friendly.
@diemos I know this is off topic here, but in the future will there possibly be a feature to save certain posts? Somewhere in our profile sidebar page maybe.
One point which I have yet to see raised is that an anonymous username won't do anything to keep a person from being recognized by their writing style. Granted, that isn't something on which many people focus, but those who know to look for it won't have much trouble comparing comments. As such, while I can see the surface-level value of offering the option to communicate anonymously, I think the mechanic is ultimately little more than an added deterrent (at best) or a placebo (at worst).
I like this idea quite a bit, this in particular is helpful - the ability to make an anonymous post without needing to create a junk account, but also not having to be tied to the post for the remainder of the site's life.
I'm against it, for similar reasons to why I'm against multiple accounts.
I haven't read every post here but I've read quite a few.
And I have yet to read what I would consider a good reason to allow anonymous posting here.
It all comes down to the reason anyone would want to say something that even they don't consider valuable enough to own up to saying. And it's usually because it's something they know is offensive or just factually wrong.
The trick is pretty simple. Anonymous posters are anonymous to users (and search indexing, and archived screenshots on other sites) but not to the trust system and site admins. If someone uses the anon feature to shitpost and stir up trouble, even with multiple names in multiple threads over a long period of time, that's going to strike against their real user account. It's also likely that new accounts will not have access to anon posting for a while after joining, so people can't just grab invites again and start trouble. They'll have to earn the privilege, however it is we decide that happens.
That correlating data will get wiped after 30 days or so, and if nobody noticed the shit post by then, it's hard to see how it was a problem in the first place. We should be so lucky as to have such a sweet honeypot to flush out the less intelligent trolls who will assume the anon feature lets them get away with being assholes.
Basically, I see no risks whatsoever in this feature if it's implemented like this. If you can still see a risk and I'm overlooking something, please tell us the ways this can still be abused.
Interesting, and I cannot disagree - thanks for explaining that.
Regardless of the outcome two things are certain: I will support the decision and continue here, happily. Because 2: the population of folks here is impressive, intelligent people and intelligent discourse. I'm very thankful... honestly. And because of the qualities of the community in general, I don't see the usual anonymous shit-talkers finding much motivation to come here spewing.
I do have a question - and perhaps I haven't read enough posts here yet - and this is NOT meant to instigate disagreement - as I said, I support this issue either way it turns out.
But while you explained HOW it could work - I still have to ask, what benefit is there to it? And why would someone want this feature?
PS: Thank you for your reply, and it's civil and courteous quality. (I'm not being sarcastic, I'm just a recovering Reddit user)
I certainly can - and we're all recovering from the internet in general going into the shitter, not just reddit. It's so terribly toxic out there.
For myself, sometimes I like to share stories or anecdotes that may reveal some personal information, such as a story about a specific adventure in a specific place at a specific time, or even something as simple as talking about how the weather has changed over the years where I live. These are all harmless enough on their own, but if you do this long enough over time, and someone has access to your posting history (or can hoover it out of google et al) it could become possible to make certain determinations.
You could derive someone lives in certain places, or has a certain kind of education, or likely age, or even pick up references to their accounts on other services if they share links to them. This could allow for a kind of profiling to take place and seriously compromise a user's privacy. Let's be honest, too - people don't really have the mindset of guarding their privacy, so making it easier like this will help them think better about online interactions.
Also, imagine a celebrity's use case. Say for example someone like The Governator or Wil Wheaton creates a user account for a public AMA, and that's kind of their 'official' public face when using their account. That person may, however, have other insights to share that they wouldn't want to publicly associate with their known identity. Imagine if Arnie got into it with libertarians on reddit - that shit would come back to bite him in seconds in the press. He's basically unable to share his personal stories under his public name. The anon feature would allow him to sidestep that problem, and comment as freely and as often as he'd like without any worries.
Oh, and we're also going to allow for 'disassociation' of comments. Say you make a comment and some time later think better of it because it'll show up when HR goes through your social media profiles during an interview or whatever. You can go back to it and delete it, but that leaves the original thread in a rather sorry state if everyone does this sort of thing. Old threads turn into walls of 'deleted' just like on reddit lately. If instead you can simply disassociate it (or auto-disassociate all comments older than X time with a user account setting) this problem is ablated. It wasn't anonymous when you made it, but you made it anonymous and set it free later, for whatever reasons. It's your comment, Tildes takes the mindset that you own it, not the site, but we don't have to make deletion the only option.
This mechanism had an unexpected side benefit when we talked about what happens when a moderator type person edits a post title that you made - perhaps you want your username auto-disassociated when something like that happens, to avoid the issue of potentially putting words in someone else's mouth. I don't personally think that would happen here, but it never hurts to have insurance either, and many other users were keenly interested in this preservation of their account integrity on edit.
I think it may also tease out lurkers who simply don't even want any of their content to be associated at all with any of their other content. Imagine a blank user account with no comments associated, yet with ten years of trust earned from anon comments, and even potentially moderator powers earned. That does happen in the wild right now on some kinds of forums. I've noticed a lot of people on the chan boards (not just 4chan, there are thousands) seem to like having their social interactions this way. It's the most privacy-safe way to interact online without refraining from posting. It's not what I'd do, but then I'm hardly a typical user. :P
This stupid little anon feature has a rather dizzying array of use cases. We'd never have uncovered 3/4 of these without the discussions about them here on Tildes either. :D
Wow THANK YOU! That's all stuff I never thought about, and I am embarrassed by how narrow my thinking and conceiving of ideas has become in my recent past. Thank you for taking the time to explain all this stuff.
It all makes perfect sense now, most certainly!
I honestly wonder if perhaps my understanding of social media, not to mention my acceptance of it's mechanisms and peculiarities(!), has devolved back to my earliest days when I was part of a very small, very specific group (old school programmers) who used email and "listservs" and share and discuss ideas. A world where your email address, real name, employer or educational institution, even your phone number and office location - were all attached to every word you wrote! The notion of anonymous comments by anonymous users hadn't really been invented. It was a world where you knew that your comments were being read by a real person, and while that world was not eden and there were certainly conflicts, they were generally handled in a civilized way and often with a phone call or over coffee.
When I discovered a bug in our Unix mail system that allowed me to spoof an email to a faculty member I disliked from the chancellor of the university (this would be Syracuse University), it was because nobody ever imagined why anyone would ever want to send an email and not sign their name to it! LOL
I ramble :-/ I guess I really have to keep in mind how little I understand about social-media. One would think that it would be ever-present in my mind, this realization - as I signed off Reddit a month ago after just 2 or 3 months there - and signed off Facebook over a year ago, using the excuse that building my own web-site gave me more creative freedom. It did. I built a great site and love it. Too bad nobody but me ever went to it.
Thanks again mate
There are some personal things that people want to talk about, but don't want tied to their regular identity. Anonymity provides safety that allows people to open up in ways they wouldn't otherwise.
My issue is that what is the need for anonymous posting?
Anonymous posting or throwaway accounts are often used on forums when someone wants/needs to discuss something personal but are worried about people finding or stumbling upon it and linking it to them, like embarrassing medical issues, family or relationship problems. It is also useful when legitimately and in good-faith discussing things that may be controversial and bring trouble to the poster either by their employer, their community, or their government.
Fair enough. I'm just wary of anon-posting because people abuse it every time I've seen it made available.
I can see your point though.
Yup, the potential for abuse is an important point to consider in the design of such a system. There's been some discussion elsewhere in the thread about partial de-anonimization, certainly for admin(s) and potentially for moderators, to help deter malicious usage. If people have a reasonable anon posting ability, they're less likely to opt for throw-away accounts, which opens up some new possibilities when trying to detect and deal with people making multiple accounts since it will more likely be done for malicious purposes (duplicates to manipulate conversations, new accounts after bans, etc.)