Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Personally I don't think that action in itself is a big deal, but it shows that Reddit has a lack of internal security i.e. reddit employees are admins in the old-school CMS/forum software sense: they simply can do anything. (Edit: Reply points out that spez says not all admins can do this)

For comparison, I don't expect that a Google employee, or C-level executive, has an "Edit" button next to every single post on Google Groups.

Being able to silently change the content appearing under a user's name is a big deal. It's a more significant capability than being able to e.g. take down content.



To be fair, nobody has an edit button on any Google Groups post anymore. Nobody has any buttons on them, in fact. Also, when it happened, he also pointed out that most reddit admins weren't able to do this.


> Also, when it happened, he also pointed out that most reddit admins weren't able to do this.

That’s worse though, right? Why does he have this special functionality the other admins don’t have? Why would the CEO ever legitimately need to personally edit a reddit comment? Surely he has many better things to do.


I'm sure he could just connect directly to the database if he wanted to. At some point people have enough access to systems to bypass any security checks put in place.


This is the guy who created reddit, by default he can do anything physically possible. The only way he wouldn't have this functionality is if one of his employees specifically added something to block him from being able to do it, and this addition could not be reversed.

And there are many very legitimate reasons to have the capability to modify entries in a database, but honestly even if there weren't, making a system where it's impossible for anyone other than the originating user to modify an entry is a challenging task.


Why does he have this special functionality the other admins don’t have?

He wrote the site's first version, and co-wrote the (modern) Python version. Lots of things stay in place in legacy systems.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: