30
votes
An idea on how to allow anonymous posts/comments without ruining Tildes
@deimos has expressed before his dislike for alt-accounts, a position I happen to share. Alt-accounts makes users less accountable and more prone to misbehavior.
At the same time, deeply personal threads frequently require anonymity to be of any value.
To avoid alt-accounts altogether, I propose an anonymity with caveats:
- Only accounts older than 60 days can comment and create threads anonymously.
- Mods and admins can take action against the account that posted anonymously just like with any account
- For the most part, the identity of the poster will remain a secret even from mods and admins.
For practical reasons, in the case of banning a user from the entire website, the identity of the user would have to be revealed to the admin that banned him/her. But that will only happen after the action is taken.This seems like a bad idea.
EDIT: PLUS FEATURES
- The creator of the thread must tick a box to allow anonymous posts (they are opt-in).
- Moderators and admins have the power of disabling this permission if deemed necessary.
This really isn't something that needs a big, heated debate (and we've already done it multiple times in the past). It's not a high priority, but I'll almost certainly implement it at some point, and allow people to make occasional posts anonymously.
The account of who made the post will be tracked internally (probably for 30 days, like most other things), and then erased. The purpose isn't complete anonymity, even from the site admins. The purpose is to be able to participate in threads or post information that they wouldn't want publicly associated with their account. If someone abuses the feature for another reason (like trying to be an asshole anonymously), they will lose access to the feature and/or get banned, just like if they did it non-anonymously.
Most people's concerns about anonymous posting come from experiences on platforms where people aren't punished for harassment/abuse/etc., but that's not how it's going to be here. All possible downsides and abuses of the feature exist exactly the same if someone uses an alt account, that's just a less convenient and worse way of effectively doing the same thing.
We already have some "anonymous" posts on Tildes, where people have deleted their accounts and asked me to leave their posts up but remove their username from them. These show up with "unknown user" in the place where you'd usually see the username, you can probably find some if you look back at very old introduction threads and such.
It wouldn't be an open-source project without the occasional bikeshed.
I'd be interested in your reaction to this line in @mrbig's post:
My impression from discussions with you, and comments I've seen from you, is that you don't dislike alt accounts, as such - you just don't want them being used to manipulate the website's mechanics.
Yes, that's right. As long as the alt account is being used for a reasonable reason (e.g. someone separating their posts in ~lgbt from their "real" account), I don't mind at all. Malicious use, like creating an alt to harass someone through private messages or be able to double-vote is an issue, but the issue there is really with the behavior itself, not anything inherent about it being an alt account.
There's a section at the bottom of the Code of Conduct page about it: https://docs.tildes.net/policies/code-of-conduct#multiple-accounts
Thank you.
That means there's no desperate need for anonymous accounts here, because anyone can create a throwaway account to comment about something private or personal.
Sorry, I've been meaning to reply to this for a while - I don't really know, to be honest. I don't think the anonymous-posting is a particularly high priority and I don't plan to work on it anytime soon, so I haven't tried to think through all the details yet.
My inclination is generally that it should work similarly to non-anonymous posts as much as possible, which would probably mean that they get notifications and such, but there are definitely some tricky aspects to it since you have to worry about making sure they can reply back without accidentally revealing their account and so on. It may be safest to do something like prevent people from being able to reply to the same topic both anonymously and non-anonymously.
I don't want anonymous comments. If there's something I'm unwilling to say behind a pseudonym, I shouldn't be saying it.
I'm interested in hearing when people find an important and legitimate need for this. I cannot think of one, but I'm more than ready to have my mind changed.
I can see cases where allowing someone who is commenting about an employer to do so anonymously would let them be more frank about the employer.
Maybe it would also allow someone who hasn't come out to comment in threads about gender/sexual identity without worrying about outing themselves?
I don't really know. I can see some potential benefits but I can also certainly see potential problems and abuses.
Why can't they just create a new account and post under that one?
The premise of this post is that we want to discourage that.
If they misbehave, ban more than just the offending account.
People who are smart enough to circumvent this through VPN use and other obscuring methods are troublesome, but if they're smart enough to do that, they can do that right now.
I just don't see why an entirely new functionality needs to be built to solve a problem that can currently be solved through existing functionality?
I kind of addressed that here, but basically there are probably threads I (and others) could / would participate in anonymously that I opt to not participate in because I'm not interested in making an alt account.
That said, on the scale of feature importance, this ranks near the bottom for me.
This is vague enough that you could use it to similarly argue against...really any kind of quality of life improvement at all. Like why program a markdown preview feature if people can just posts first and fix any errors in edit? Or why have an edit feature if you can just delete and repost?
If people are already going to do try to post anonymously, and the current way to do it actually produces some issues for the site, then it seems entirely reasonable to implement an easier anonymous posting system at some point, not as a high priority but as a nice feature regardless. That's pretty much in line with the "trust users, punish abusers" philosophy as well, and it'd probably help differentiate the people abusing alt-accounts from people who just don't want a specific post tied to a specific username.
Posting on a different account doesn't magically make someone exempt from Tildes' rules and guidelines. People are still accountable, even when using alt accounts.
I can already do those things on this account though. Can't you on your account?
I wouldn't mind people having an account they share with their parents/friends/families etc. and then having a completely anonymous, separate and alternate account.
If I'm not willing to put a fictive, nondescript username to my opinions, again, I don't think it'd be smart for me to say those things. There are additional issues of possible misuse of anonymous comments, but I'm not particularly worried about that.
It takes a surprisingly small amount of information to uniquely identify a person. Posting anonymously or from an alt/throwaway account means that I don't have to worry too much about whether a post that is innocuous by itself is adding the final puzzle piece to my post history that leads to me accidentally doxxing myself.
Personally, I tend to not want to take the time to create another account, so there are lots of times where I just don't post comments because they might provide significant insight into my real life identity.
Sure, but then again I try to be careful not to post potentially identifying info about myself. I also really try to make sure nobody I know irl knows my usernames here or on reddit. But not everybody does that. If I've posted things about the town I live in, my work, my hobbies, my family, that can be enough for somebody with malicious intent to dox me.
Hard disagree. Lots of people ask about things online because they don't want people in their personal lives finding it. People who are curious about how to get access to healthcare or mental health services against their parents' wishes, people exploring their sexuality, people blowing the whistle on bad behavior with their employer, people stuck in abusive relationships looking for help or support. . .
I respect our point of view, but I do think there are situations where anonymous comments are not only valid but required, especially in threads about very personal issues that some people might not want to associate with their main identities — which are sometimes linked to their real identities.
A few examples would be comments about:
None of these go against any of the Tildes' principals, and we might be missing out on valuable content.
Besides, if there are no anonymous mechanics people will just create alternative accounts, which will be much harder to moderate.
If you wanted to, you could trivially track down who I am in real life and attribute everything I say to me. You can do this across multiple platforms. There are things that I don't share that are deeply personal because I don't want to share deeply personal things with people and have them be made public. This is likely the case for a non trivial amount of people.
I don't want to (and will not) create an alt account for taking place in threads where I would require anonymity. It would be better if I could just turn on "anonymous answer" mode, and anonymously answer. This is a baseline requirement for me to participate in any deeply person or controversial thread.
Now realistically, I would actually rarely use this feature. There aren't a lot of things that I'm not comfortable saying, and I do believe that if I write something down, I should stand by it. There's also the consideration that I should not be lulled into writing deeply personal things since at some level it could potentially be tracked and then leaked. But that's the reasoning that I would use to support this feature.
I've been saying some things in recent gender and sexuality threads that could harm me if connected to my real world identity. There are others who've expressed that they're in that situation as well. Like, jail time or job loss or uninsurability or divorce or physical assault kind of harmed. I expect some Tilders would have pithy, and potentially significant public interest, things to say about their employers or governments, subject to the same risks. These aren't trivial concerns.
No one practices perfect opsec all the time. Keeping totally separate alt accounts and ensuring that there's no relationship whatsoever between them is a challenge I've failed at repeatedly. Even for trivial uses, a nym accumulates a recognizable personality and style that can be associated with other accounts through current ML tools. At least some of us could probably be doxxed from what we've revealed on Tildes. That's a real worry as the site grows and there's less basis for implicit trust through founder connections.
It might encourage more open discussion if there's limited, carefully bounded opportunity to reveal personal or proprietary information with plausible deniability, where it's in the interest of the community to do so.
Allowing the creator of the thread to decide whether discussion is best encouraged by permitting anonymity seems like a reasonable way to determine this.
The sole purpose of this feature is to avoid coloring your own comments with your own reputation in the eyes of other users.
Let's say you're a celebrity/politician like Arnold.
Care to guess what the ramifications of his posting a political comment in a political discussion would be, for himself and for those who would know it was coming from him? His only recourse is to refrain from those conversations or to create an alt, which inevitably litters up the database with dead/inactive accounts and depletes the username pool. It also dilutes the reputation for that individual across multiple accounts.
There are plenty of reasons people will choose to use some form of anonymity while sharing personal anecdotes or personal opinions. They will do this with or without the site's support or endorsement. Better to support the feature natively. Supporting it also makes it easier to track abuse, not harder.
People are lazy, they'll gladly use the anon feature rather than make a new account which is far more work. This lets us make sure their anon comments count for and against their reputation/trust on the site, and also means they could still have access to elevated features that have to be earned while making anon comments.
Care to elaborate? How would you keep someone's identity a secret 'for the most part'? Are we talking about stuff like hash codes and encryption?
Not a programmer.
What I meant was: the mod/admin could take action against the anonymous poster without knowing its name. They could just click on the comment/thread and use the interface (which might create a temporary random username for that user just for practical reasons - I suppose reading hash codes is not very pleasant) to do anything they want without actually seeing its username.
In the case of a total ban from the entire website, the system would automatically disclose the username for the admin that took the action.
Am a programmer (not for Tildes).
This just isn't practical from a technical point of view. You're either anonymous or you're not. If you're storing enough information for the system to associate an "anonymous" post with a user account, then there's nothing stopping an admin from going and looking that information up in the database. Any rational person who understood how this hypothetical system worked would post "anonymously" from an alt account.
That doesn't change anything that I said. It's not anonymous if it is associated with your regular account, even if that association is never displayed. Admins go rogue. Servers get hacked. This is not a feature that replaces throwaway accounts.
Point isn't to hide from the admins it's to hide it publicly. I implemented a similar feature on a site I run except the association is stored permanently. Might not be best practice if anonymity is the goal but it doesn't get in the way of its intended purpose, which is preventing a comment from being associated with your username out in front of everyone. I think we're in the area of "perfect is the enemy of good" since if the server's hacked someone can just add logging code to vacuum up all associations including IP addresses which'll deanonymize even alt accounts. Unless you want to start using Tor or a specific VPN server for your alt posts only.
There are certainly different levels of anonymity and risk of identity disclosure.
At some level, a state-level attacker capable of carrying out end-to-end timing attacks would be able to uncover the identities behind even posts by throwaway accounts via Tor (and such attacks have been used against VPN users successfully), but that does not mean that users who can be identified in such a way are not anonymous with respect to attacks they are concerned about.
You could remove the stipulation that the anonymity can be overridden but still allow mods and admins to act on said account. But I suppose a programmer would have no trouble finding the username anyway.
I anticipated that. It is certainly a compromise that allows for things that one would rather keep anonymous but would not ruin any lives if revealed. If something is truly sensitive, it shouldn't be on the world wide web anyway.
I agree with nacho. What's the point of having anonymous posting? We're already anonymous by default unless we've shared personal details in which case that's something a user is going to have to take up with themselves.
I can understand not wanting to be attached necessarily to a personal experience by name, but I don't think anonymous posting brings anything to tildes that is productive. Anonymity is already abused on the internet and tildes isn't insular. I don't think there are enough good reasons to introduce it to the site as a feature.
Removing the incentive for alt-accounts would be a plus.
How big of a deal are alt accounts right now? I can understand this concern as the site grows and gets more people but I don't think anonymity is necessarily the answer. Maybe as a trial run and maybe as a smaller site it could work but I don't know how well it'd work as it scaled.
I've yet to see any alt-accounts. Also I don't know that it's reasonable to call alt-accounts a problem...
My account is an alt-account, or rather, my other account is an alt. On most sites, I have a pseudonymous main account, which I use for most of my posts, and a completely identifiable account that I use for posts where, usually because of subject matter, I could be easily identified. This has usually worked well, and was accepted even when I was editing Wikipedia.
I've made no attempt to hide this from Deimos, and it isn't any sort of strong privacy, but it makes it much more difficult for someone trying to target me to find posts that I have made and try to take them out of context.
Honest question: do you have another suggestion that solves this without allowing for anonymous interactions?
Honest answer: I don't and I likely won't. What are we solving? Abuse of alt accounts? As far as I have seen on tildes and as long as I have been here, this isn't an issue, it is right now a marked opinion Deimos rightly has about alt accounts. Again, I can understand why people might want this feature and just because there are safety nets, doesn't mean it won't be abused. If someone wants to be a cunt on the internet, then that's what they're going to be, consequences generally damned.
If people want to talk anonymously about deeply personal things, maybe this isn't totally the place for it. I don't think providing an anonymous option to tildes is in any way an ideal solution. Maybe, maybe, maybe, you could consider a sub talk group like talk.anonymous or something akin to that.
The biggest issue with the fail safes is that it makes it not anonymous at all. There's no garuntee there won't be an abuse of power by mods or admin, or maybe somebody is extra mad that day and revoke the anonymousness of a user. It's not truly anonymous which defeats the purpose. I'm worried about what the anonymity might bring. There's nothing to stop someone from making and alt account and then posting anonymously. I personally think it brings too many things into play that make things more complicated. I also don't know how this would fair in terms of programming and how readily/well it would work.
I don't think this would ever be truly anonymous, that is not my expectation. I don't have that expectation about anything Tildes related.
It takes less information than people think to uniquely identify someone. Any one comment isn't likely to do it, but a determined person can go back and look at your entire comment history. If you have two or three comments with a lot of personal detail, they might not identify you individually, but provide enough information to identify you when taken together.
Yes, which is exactly what I was thinking of. It happens over on reddit plenty times; people divulge too much information or are inconsiderate of the bread crumbs they've left behind.
It's a real problem for reddit, for example I know some colleagues that go on some specific subreddits, if I post any discriminating information on these particular subs (e.g. post about a very specific movie I also talked about at lunch) they might recognize me and then can browse my whole shameful comment history.
Creating an anonymous account with the ability to de-anonymize is manipulative and dangerous. I don't like the idea of anonymous accounts, but I especially don't like the idea of them being able to be "figured out" by mods. This is a very bad idea, compounded with more bad ideas.
I did not think actually creating an anonymous account would be required, just hitting a switch that said "post anonymously until told otherwise" or something like that.
The way you describes it is kinda how it works today, you create an alt-account (that can be as anonymous as you want it to be) and start posting.
I did not mean "figured out" by mods, but rather "figured out" by admins, and only in one specific case. IDK if that makes a difference for you.
I'd like to add a thought I had while reading through this thread. The idea sounds simple, though I'm not sure how doable it would be in practice. Essentially, the idea is "linked anonymous accounts" where a single account "foo" can have multiple "linked" or "shadow" accounts (or however we want to refer to them). A moderator (or admin?) wouldn't be able to track "shadows" back to their source account, BUT any moderator actions taken against the shadow account(s) would affect the source account. Additively, where if all the shadow accounts linked to the main "bar" account keep getting reported then those would all be stuck to the main account.
Now, the first "glaring" problem with this would be the optics, that if someone (a mod) is able to view the strikes on an account, it would only be a matter of time and effort to track down the source account. That's not the highest priority to me, but others might view things differently.
Isn't this a problem that will solve itself when the site starts allowing open registration? Regardless of what anyone thinks about it, when it becomes possible to create throwaway accounts easily, people will do it.
I could be wrongly assuming that the site will go to open registration at some point though?
People can create throwaway accounts right now. They can just use one of their invite codes to invite themself. :)