So Reddit has decided that plain HTML is unsafe
Reddit-The-Company
If you don’t know Reddit, it basically is the host of many popular forums.<br>And like any company which encourages you to “come for the cats [and] stay for<br>the empathy,” Reddit seems to be in the business of extracting as much value as<br>it can from said forums without completely destroying them.
After all, simply fostering community is not a noble enough goal for the New<br>Tech, and fortunately for Reddit, genuinely human-generated data is now gold in<br>the LLM Age. You are welcome to read about the last time they decided to pluck<br>the metaphorical liver from their<br>communities.
Reddit-The-Search-Results
While I no longer wish to engage with Reddit, I still visit it occasionally,<br>especially in the LLM Age. This is because appending site: reddit.com to a<br>search query is basically a surefire way to find results written by genuine<br>humans. Which, just to be extremely clear, I still find desirable.
Now behind a login… sort of
After doing such a query yesterday, to my absolute delight I was greeted with
I guess this makes me old, but I use the original frontend for Reddit,<br>old.reddit.com. I’m going to try really hard not to preach about why it’s a<br>better frontend, but that’s all it is! A design for Reddit.
Look, I know I’m a fringe user. I use Firefox. I noscript! I am no stranger to<br>being forced off a product that worked just fine because someone decides to no<br>longer support the two people who still use it.
It happened to my phone of 8 years, which works fine by the way, but is on<br>too outdated of an OS. May it rest in peace in its tiny glory.
It happened to my tablet of 10 years, which works even better than my<br>phone and holds a charge like champ, for the same reason.
It happened to the API for Stack Exchange used by my copy of their outdated<br>app long removed from the app store. This one hurt me the most.1
Where I feel like things get personal here is that Reddit is saying that this<br>is all
To keep Reddit safe
Keep Reddit safe from whom exactly? Me? My desire for knowledge??
Safety is what exactly?
So let’s see what they have to say on this matter by going to the announcement,<br>which of course I didn’t see because I don’t read Reddit anymore:<br>https://old.reddit.com/r/modnews/comments/1ujtebf/logging_in_to_use_old_reddit/.<br>Hope you’re logged in.
Old Reddit’s logged-out experience is a significant source of abusive scraping and automated traffic on the platform.
Hmmm, OK. But then why is New Reddit still accessible logged out?<br>Oh, someone asked that.
[Question]:<br>What’s so different about new reddit that people don’t try to scrape that?<br>Seems to me like it would be better to just implement that on old reddit too.<br>Besides, won’t this just cause people to try and scrape new reddit?
[Admin<br>reply]: I<br>was about to type an answer but just saw u/Nestramutat- gave a really eloquent<br>answer in another comment!
[The comment (snipped)]:<br>… To your first question, the shape of malicious traffic is always changing.<br>It’s going to be a constant cat and mouse game as you ban one method, a new<br>one gets developed. It’s easy to see abusive traffic in hindsight, but it’s<br>harder to pre-emptively block it. Given that they’re claiming Old Reddit<br>doesn’t have the modern security stack, this is likely proving to be an even<br>greater challenge…
So it doesn’t have “the modern security stack.” Now I may not have really earned<br>my Full Stack stripes, but I can right click and select Inspect<br>Element so I’d say I’m qualified enough to see why.
Old versus New
Old Reddit
Let’s start by — begrudgingly — logging in to see what is so insecure about<br>old.reddit.com. I’ll use their announcement thread to test. Ahhh, so much<br>nicer.
Let’s check what Old Reddit is doing that makes it so insecure. The best I can<br>guess is that their precious, precious user-created content is available in<br>plain HTML, since that’s basically all Old Reddit does: you don’t even need JS<br>unless you want to load more comments (ask me how I know).
It DLs about 1 megabyte and sends about half a megabyte. It’s not shown<br>there, but the page’s HTML itself comprises most of the response. I’ve certainly<br>seen worse, but what’s with the load time? GitHub loads its massive payload<br>about 4x as fast (relative to size).
Oh… 2 whole seconds of waiting for a reply. Smells of rate-limiting. Or was<br>Reddit always this slow?
Let’s load some more comments. (Reddit never loads all of the comments initially)
Well that was nice and lean, and pretty snappy. I don’t see my secrets being<br>sniffed. All I got here is that Old Reddit is a pretty normal webpage, which I<br>guess makes it insecure in comparison to…
New Reddit
Let’s see why New Reddit is so much better. In case you have unrealistic<br>expectations, let me...