So Reddit has decided that plain HTML is unsafe
75 points by cole-k
75 points by cole-k
One cannot find a better example of enshittification of social media than the switch from old to new Reddit. Sure the old one is a little ancient, but it's just so functional, for lack of a better term. It loads fast, it's no-nonsense, you can load dozens of replies without the browser breaking a sweat, and if you really hate some part of it, there's a wide variety of pre-tools (RES, Toolbox, etc.) to make your experience better.
I give the new site a shot every couple of months, but I just cannot vibe with it, despite having joined the site nearly 15 years ago. It's just... noisy, I guess. There's two huge sidebars taking space, opening threads is slow and disorienting, loading comment chains is finicky and sometimes causes a page reload, meaning you lose context.
There are good features, sure. Having built in image posting is nice. Polls are nice. Heck, the new mod tools are decent too. But despite all of these I still default to the old version and I don't see it in the company to ever start catering to user friendliness again.
Which is a dreadful prospect, when they just softened their stance from supporting the old site indefinitely to "not right now".
The old web, the old Reddit which was social and had lots of small communities… all of this stuff has steadily been dying. When they finally kill Old Reddit, that will just accelerate the death, because a lot of the remaining users of that facet of Reddit will stop using and possibly outright delete their accounts, me definitely included. The one subreddit I’m commonly involved in, /r/rust, (though not as often as ten years ago; its quality has dropped enormously due to Rust maturing and being too mainstream), will probably fold due to losing most of its moderators and long-time users. New Reddit is just a completely different product, better for the direction the company wants to take it, hopeless for the old web.
The old web, the old Reddit which was social and had lots of small communities
I reckon the "old web" died even earlier, when Reddit became big. Before that every hobby and community had its own phpBB instance. Reddit brought with itself centralization, which people welcomed for its convenience, but it completely murdered the culture of frequenting several different sites.
because a lot of the remaining users of that facet of Reddit will stop using and possibly outright delete their accounts, me definitely included.
I've read many such statements, but I'm sadly a little cynical about whether it'll have any impact and how many will actually go through with it. Social inertia is a hell of a strong power. Don't get me wrong, I'm not accusing you (or anyone specifically) for lying or virtue signalling, I just feel a little skeptical about these boycotts since the last big Reddit blackout. Lemmy never got the right traction, despite the perfect opportunity.
I say: of that facet of Reddit. They’ve steadily marginalised that portion of their user base in various ways (New Reddit being the most obvious), and lost a lot of them; but their newer target audience is much bigger (and they can make a lot more money out of them).
It won’t be a boycott, it will just be a “okay, I get that I’m not wanted, and you have finally made it too difficult for me to stay, so bye” from a minority that had long been dwindling. The real tragedy is that I think most of these people and communities won’t go to alternative venues—they’ll just stop doing what they were doing and disappear.
At present, I think there would be just a little too much uproar for their liking if they shuttered Old Reddit. But I don’t think it’ll be much longer before they decide it’s worth it.
They want it to become tiktok. I think people will leave but the old-web types are not the majority of their users any more. A lot of people I know go on reddit as lurkers and don't even know what a subreddit is, or that there is a way to curate what you see.
The Old Reddit is dead; long live Discourse!
Ugh, I dislike Discourse. Essentially flat (limited threading at best), styles too spacious (often see two or three comments instead of ten), more than half broken sans-JS (used to be entirely, then for some time 80%), painfully slow, and hostile to native find-in-page.
It might sound crazy but I use old reddit even on mobile. Yes it's tiny but it's just so must faster
It doesn't sound crazy one bit. The new reddit is basically impossible to use on mobile, probably on purpose, to force people into installing the app.
My wife was using it for quite a while, but now it just flat out blocks you unless you are logged in. She just browses with desktop mode turned on lol
They only prompt you every single day to switch to the app. As if I am going to forget, or was somehow not aware of the eleventy thousand times you've prompted me already.
Consider RedReader, it's not as good as Reddit is Fun was or similar apps, but it's imo much better than anything else present on mobile.
After they banned RiF and BaconReader and all the other 3rd party apps RedReader was the only acceptable alternative, but they to have had to get around some reddit shenanigans like the audio not playing on videos etc. I will say they have been prompt on getting workarounds or the final fix communicated to users. Wonder how long it is until they are targeted too, is there a reason RedReader gets a by while the others were nuked.
If I remmeber correctly RedReader got official permission to remain by Reddit, apparently because they are obligated to provide an app for people with disabilities and RR fit the bill. So it's unlilely to go away, but yes, it's much rougher than what came before.
And don't overlook https://github.com/QuantumBadger/RedReader#:~:text=Sponsor%20this%20project because they are responsive to bugs and generous enough to make their hard work available under a permissive license
I personally loved it back when I was on Reddit but I appreciate that everyone's expectations for a client are their own preferences
Did you know about the .compact version? It was good for such purposes, looked like an iPhone 1 app or so. But they finally culled that three years ago.
I never visited Reddit much on mobile, but for maybe the last year I can’t even if I want to: I get the “Address Not Found” neterror (Firefox, Android).
if you're on iOS consider Sink It for old reddit, or using Dystopia. Both are preferable to shreddit.
One cannot find a better example of enshittification of social media than the switch from old to new Reddit.
A bold claim... Facebook inserting political ragebait and AI slop into what used to be a "friends and family" feed must be up there.
I give the new site a shot every couple of months, but I just cannot vibe with it, despite having joined the site nearly 15 years ago. It's just... noisy, I guess.
In general, I find the new desktop reddit harder to parse. Harder to scan for the post titles that might interest me. Harder to see what's relevant.
I think the main complaint here is that the PR text said "for security" but it should have said "to reduce scraping load on our servers". People who host a web site will know that this is a very legitimate concern these days. All the other text in the rant is the author being annoyed, for good reasons, but ultimately reasons that are kind of tangential to the problem at hand. :P
EDIT: I have my own example of "for security" pissing me off. I have some Philips Hue lights (or had, until a move recently), and the smartphone app for controlling them has had a banner for years now that they're going to disallow you to control your lights without a Philips account for security. Security is not phoning home, is keeping all communication within my network! Security is not getting external servers with an external authentication mechanism involved in controlling a device in my home network. Fortunately it seems they kept it at the warning as it still works fine without an account.
I have started reading "for * security" as "for our business security".
It is for security...of their business model.
The problem is that you are assuming a threat model like accessing other users private data, remote code execution or something like that. Reddit's thread model is "things that we fear will reduce profits". Classic security threat models are somewhat relevant (if someone uses SQL injection to drop their database it will hurt profits) but a tiny part of the larger story.
Yeah the hue security bullshit was what eventually lead me to an rpi, deconz dongle and nodered/homebridge. And I’ve never looked back!
Well my main complaint is that the login page says "for safety," the PR text say "for security," which really means "for OUR security" because they're getting scraped, and my best attempt at verifying that New Reddit is less scrape-able comes down to it being a... complex web app (resisting the urge to editorialize here).
My heart goes out to the small sites that are being crippled by scrapers, but Reddit? Not so much. If they have a fat stack of cash from Google or whomever is paying the big bucks for access to their API, then I don't understand why they can't continue to support Old Reddit sans login (if it's important enough to keep around at all). After all, I swear that I saw a captcha redirect --- is it so hard to add the same to Old Reddt?
Being extremely cynical here, my guess is that someone threw a 2s rate-limit onto Old Reddit, saw the scraping numbers were unchanged, and said "OK, let's close it down then" and this is the compromise after the ensuing internal fight.
Companies love to say everything is for "safety". I went to a convenience store many years ago and was told I wasn't allowed to bring my little carrying bag inside "for safety of yourself and other customers". Yeah, it is possible to whack someone with an empty bag, and they have been held up before (very, very, rarely and usually not at 10am lol), but pretty sure their main worry is about shoplifting...
If they were honest, they'd just s/safety/to maintain and grow our profit margin/g. tbh, I'd respect that a lot more. You're obviously in business to make money, after all.
Blatant lies are ridiculously common in these sorts of areas, and too often ignored.
Cloudflare challenges are another one. Until a few months ago, the wording was
example.com needs to review the security of your connection before proceeding.
A few months ago they finally made it more honest:
Performing security verificationThis website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot.
Google’s rationale for killing XSLT was another example. Early on, they said security was the main reason. But before they felt they could begin the process of actually removing it, they felt the need to provide a drop-in replacement implemented as an extension, thereby completely nullifying the security argument. Yet they continued to say “for security” as they started actually getting rid of it, even though that argument was now null and void. They should have been more honest about their actual, still-legitimate rationales. (Yes, I know that all the browser makers wanted to kill XSLT; but it’s specifically Google’s presentation of it that I’m baulking at.)
Just use redlib, libreddit, or teddit (read-only privacy front-ends for Reddit) via a redirect plugin such as libredirect. There's no reason for anyone except the developers of those interfaces to subject themselves to Reddit's latest bullshit.
Something I don't see a lot of people bringing up is how old.reddit.com lets you bypass the annoying login wall for subreddits considered to be "18+" (which includes not only sexual topics but some other sensitive things as well).
So this stinks even more if you don't have a reddit account and want to access certain topics, and reddit is still a really large resource, I tend to add site:reddit.com to my search queries quite often.
reddit has removed their json API as well, killing tools like lurker (https://tangled.org/oppi.li/lurker) that let me browse reddit without an account, without login walls, and without javascript. i knew this day would come obviously, high quality user generated data seems to be the moat.
There's another way in which old reddit is "unsafe" to reddit's business interests: New reddit now plainly refuses to work at all on a phone, force-redirecting you to download their app (which they control much more tightly than your browser, e.g. your normal ad blocker doesn't work there). The old site so far has still been available on mobile.
You can use "Request Desktop Site" to avoid being forced to use the app.
There are also adblock rules available, of you have a mobile version available to you.
Edit: my current set for uBlock origin, lifted wholesale from I forget where (probably Reddit)
www.reddit.com##.rpl-bottom-sheet
www.reddit.com##+js(remove-class, rpl-scroll-lock, body, stay)
www.reddit.com##+js(remove-class, scroll-is-blocked, body, stay)
www.reddit.com##+js(prevent-addEventListener, touchmove)
appending site: reddit.com to a search query is basically a surefire way to find results written by genuine humans.
Why must I consult the world’s smartest and most expensive computer just to read what people have to say about my random question? Is it so strange to want to read text written by humans
I've seen a lot of obvious bots and PR marketing on Reddit and the orange site. lobste.rs is one of the few places I interact online because I believe it to be mostly genuine humans.
I use old reddit for one reason and one reason only: on mobile, if you browse enough of a comment thread in new reddit, the site will throw up an uncloseable wall saying that Reddit Is Better In The App, and the only way to evade this wall without installing the app is to use old reddit. Presumably it's 'unsafe' to let you browse the lovingly crafted mobile website for more than a page or two, so this closes that hole in the app installation funnel. (Fuck you!)
I guess this makes me old, but I use the original frontend for Reddit, old.reddit.com. I’m going to try really hard not to preach about why it’s a better frontend, but that’s all it is! A design for Reddit.
Here's one: Append ?depth=1 to an old.reddit.com story URL to subsume all of the deeply nested comment trees into only one top-level comment. If you want to view a subtree, you can click the link to see the responses to that top-level comment.
It's great for stability if you're forced to use Google Chrome by corporate policy.
You cannot do this on new Reddit. The URL parameter is disregarded.
New Reddit is garbage.
The title is unfair. You just need to log in to get at <old.reddit.com>. That's not a great horrible imposition. They aren't charging for it.
The title is unfair.
You'll have to forgive me for not holding myself to a higher standard than Reddit's own PR team, who declare the login necessary "to keep Reddit safe."
They aren't charging for it.
Are you saying that I have no right to complain? Sure I sound entitled griping about something available for free. But consider how individuals like my past self have, for free:
I basically did all of these things (although I never modded for subs that mattered). I further don't believe that Reddit can charge for access, because their existence is built upon these free services they receive, which in turn are only provided because they provide free access.
There was a beautiful, if rose-tinted, era where this symbiosis felt fair: Reddit got the ad money and in turn we got our place on the internet. I don't know if it became unfair or I just got older.
I mean text/html seems to be the only thing they support in emails. Gotta make sure we have tracking tokens on our emails instead of plain, boring, fast text.
The fact that the old reddit UI has remained accessible at all, so many years after the "new" UI shipped, can only mean that it sees significant internal use. Otherwise they definitely would have eliminated it outright by this point.
I don't feel like browsing the announcement again, but the subtext I picked up was that Old Reddit was low usage among the general population but still had nontrivial use among mods. And if Reddit can learn anything from Stack Exchange, it's that you don't want to piss off the people who work for you for free.
But maybe it was that some higher up still believed in it, I think I saw mention of that in a news piece on this.
This is a very unpopular opinion, but I really feel like keeping old.reddit around after the UI redesign was a mistake. Power users are almost always going to be upset about UI changes no matter what. And when another design change comes along, there will be people who'll claim that the previous UI they hated was good and didn't need changing.
Keeping the initial version around just seems like it'd make people continuously hate the company's brand identity. My hunch is that if there was no old.reddit, people would be less upset at having to use regular Reddit by this point even if it is objectively worse than the old version.
I don't think it's an unpopular opinion insofar that it's just true --- at least from Reddit's perspective (though definitions of "mistake" may vary). Back when the New Reddit shift happened, they didn't even really need to keep Old Reddit around to appease the minority since their API was still free to use and anyone could've replicated the UI if they desired.
But if we stop talking about what is good for Reddit-the-company, then we enter tinfoil hat territory where we have to ask ourselves why they deemed New Reddit necessary, rather than applying a fresh coat of paint to the frontend they had. Perhaps in whatever year it was (god is it really more than 10 years ago?), the redesign was to make it look nicer, but now that they're clearly trying to sunset Old Reddit, one has to question whether it is just about appearance and not something more sinister.
I certainly have tried to give them the benefit of the doubt that maybe they just don't have the engineering staff to prevent abuse on the Other Frontend they've supported for no good reason. But it's hard to believe this, personally.
I think it's possible to justify or relate any decision to security whether it's true or not. I wrote about this in the past. I think of it in two dimensions: width (topic) and length (time). So any topic can be framed as security, forever, for any business quarter whether it's true/likely or not/fabrication. So, yeah, this OP as a journalism check on that.
I agree with your points but I'm a little surprised that you didn't try to investigate the requests sent when posting a comment on Old vs. New Reddit. I'd imagine there are some differences there as well, perhaps involving simple CSRF vs. browser JS fingerprinting, respectively.
This was in my blind spot honestly because I don't plan on commenting on Reddit ever again. And I had just figured that the issue was with scraping. But you're right that bots surely must be a problem now, I mean back when I was actually browsing it years ago I was still suspicious of bots or astroturfing.
But commenting requires being logged in, which permits Old Reddit usage... for now...