It seems that Reddit who has lots of issues at the moment is down. Again. Here’s the view from Down Detector:
The question is, who is Reddit going to blame for this outage this time? During the outage that happened earlier this week, Reddit blamed the API protests. What’s their excuse this time?
This Reddit blackout situation just got really interesting. You might recall that the blackout in protest of Reddit’s changes to their API rules started today, and just before 11AM Reddit went down. Well, The Verge is reporting that Reddit is blaming, wait for it, the blackout for the crash.
According to Reddit, the blackout is responsible for the problems. “A significant number of subreddits shifting to private caused some expected stability issues, and we’ve been working on resolving the anticipated issue,” spokesperson Tim Rathschmidt tells The Verge.
On Monday morning, Reddit’s status page reported a “major outage” affecting Reddit’s desktop and mobile sites and its native mobile apps. “We’re aware of problems loading content and are working to resolve the issues as quickly as possible,” the company wrote on the status pagein a message at 10:58AM ET.
At 11:47AM PT, the company wrote that “We’re observing improvements across the site and expect issue to recover for most users. We will continue to closely monitor the situation.” Rathschmidt didn’t have an ETA for when things would be fixed, but the status has switched from “major outage” back to “operational.”
You can’t even make this stuff up. As in we’re unable to stay online because people turned off their subreddits. Now this could be true. But the cynic in me says that Reddit might have other issues unrelated to the blackout. And they are simply blaming the blackout for them. If that’s true, that’s pretty lame. And Reddit will have to come up with a better explanation for this. Right after they properly address the API issue and everything that surrounds that.
The Reddit blackout which started today and will continue for who knows how long has become a real dumpster fire. I say that because Reddit is being as reported as down by DownDetector:
When I looked at Reddit, intermittently I would see that nothing is loading with the top section showing the message “Something went wrong. Just don’t panic.” So something is clearly up. What that something is, I have no clue. But a situation that didn’t look good for Reddit a couple of hours ago has gotten worse.
I’ll be keeping an eye on this.
The Reddit community’s mass protest over the company’s controversial API changes has begun. By some counts that I have seen via a Twitch stream tracking the protest, over six thousand subreddits are participating in the protest by shutting down. Some for 48 hours which was the original plan, and some indefinitely because they are that mad at Reddit. This protest is due to Reddit’s API changes where Reddit will charge for API access. That move will basically kill third party Reddit clients, including Apollo which is the most popular third party Reddit client. But it will also hamstring community admins, most of whom are volunteers because it is easier to administer a subreddit with a third party client rather than the official Reddit app.
What doesn’t help matters much is that Reddit CEO Steve Huffman had a train wreck of an “ask me anything” last week where he did more to anger the Reddit community than to placate it. I’ve seen posts on Mastodon urging people not to log into Reddit and some subreddit admins have also set up Discord servers to encourage subscribers to stay off of Reddit. From what I see, the only big loser in this is Reddit. Now I’m not saying that Reddit should continue to give API access away. But that’s clearly not what they’re doing here. Not even close. And the fact that the Reddit community and beyond can see that is not a good look for Reddit. Steve Huffman has created a situation where the Reddit community has become so mad that they are considering moving their communities to someplace other than Reddit. Which is bad news for Reddit and Huffman as having those communities active gives Reddit the opportunity to make money via advertising. If you take away those communities, and the people who follow them, Reddit will have issues paying the bills. So If I were Huffman, I’d be rethinking my life choices at this moment because he’s the only one who will lose. And the sooner he realizes that, the sooner he can change course.
I recently told you about the fact that Reddit was going to start charging for access to its API, and that had many upset enough to plan to black out Reddit on June 12th. Related to this, it now seems that Apollo which is the most popular third party Reddit client is going to shut down on June 30th:
Eight years ago, I posted in the Apple subreddit about a Reddit app I was looking for beta testers for, and my life completely changed that day. I just finished university and an internship at Apple, and wanted to build a Reddit client of my own: a premier, customizable, well-designed Reddit app for iPhone. This fortunately resonated with people immediately, and it’s been my full time job ever since.
Today’s a much sadder post than that initial one eight years ago. June 30th will be Apollo’s last day.
I’ve talked to a lot of people, and come to terms with this over the last weeks as talks with Reddit have deteriorated to an ugly point, and in the interest of transparency with the community, I wanted to talk about how I arrived at this decision, and if you have any questions at the end, I’m more than happy to answer. This post will be long as I have a lot of topics to cover.
Please note that I recorded all my calls with Reddit, so my statements are not based on memory, but the recorded statements by Reddit over the course of the year. One-party consent recording is legal in my country of Canada. Also I won’t be naming names, that’s not important and I don’t want to doxx people.
I encourage you to read the full post, but to be honest, this post does not paint Reddit in the best light as you can make an argument that Reddit is simply using charing for access to their API as cover to kill third party clients. That makes Reddit a way less appealing place to be. Much like Twitter. Minus the Twitter levels of hate, bigotry and everything else. This is sure to generate a lot of negativity towards Reddit, and you have to wonder if this will force Reddit to course correct. Or they simply don’t care and are going to push ahead with this ill conceived idea to kill third party clients.
In an Elon Musk like move, Reddit announced that is going to raise the price of API access, which by extension will likely kill Reddit access by third party apps like BaconReader and Apollo. For example, the developer of Apollo said that these changes would cost them $20 million a year. Which from my perspective is something that third party developers can’t sustain. The cynic in me says that this is a move by Reddit to kill third party apps and force people to use their app or the Reddit website instead. Which if that sound familiar, is what Twitter did when they pulled a similar stunt.
The difference is that unlike Twitter, Reddit users are rising up against this move:
On June 12th, many subreddits will be going dark to protest this policy. Some will return after 48 hours: others will go away permanently unless the issue is adequately addressed, since many moderators aren’t able to put in the work they do with the poor tools available through the official app. This isn’t something any of us do lightly: we do what we do because we love Reddit, and we truly believe this change will make it impossible to keep doing what we love.
The two-day blackout isn’t the goal, and it isn’t the end. Should things reach the 14th with no sign of Reddit choosing to fix what they’ve broken, we’ll use the community and buzz we’ve built between then and now as a tool for further action.
This isn’t a trivial move as Reddit like Twitter relies on user interaction to make money. But unlike Twitter who has seen a large amount of users abandon the platform, Reddit users are a much more militant bunch who will stand and fight this move and escalate if they don’t get what they want. This is going to be a problem for Reddit as I am sure that the company thought that they could push this through with little or no pushback. But clearly that is turning out not to be the case. And it will be interesting to see how Reddit deals with this. And how quickly this escalates.
Last night via the official r/reddit community, Reddit disclosed that they were pwned:
On late (PST) February 5, 2023, we became aware of a sophisticated phishing campaign that targeted Reddit employees. As in most phishing campaigns, the attacker sent out plausible-sounding prompts pointing employees to a website that cloned the behavior of our intranet gateway, in an attempt to steal credentials and second-factor tokens.
After successfully obtaining a single employee’s credentials, the attacker gained access to some internal docs, code, as well as some internal dashboards and business systems. We show no indications of breach of our primary production systems (the parts of our stack that run Reddit and store the majority of our data).
Exposure included limited contact information for (currently hundreds of) company contacts and employees (current and former), as well as limited advertiser information. Based on several days of initial investigation by security, engineering, and data science (and friends!), we have no evidence to suggest that any of your non-public data has been accessed, or that Reddit’s information has been published or distributed online.
Reddit claims that user data is secure, but:
Since we’re talking about security and safety, this is a good time to remind you how to protect your Reddit account. The most important (and simple) measure you can take is to set up 2FA (two-factor authentication) which adds an extra layer of security when you access your Reddit account. Learn how to enable 2FA in Reddit Help. And if you want to take it a step further, it’s always a good idea to update your password every couple of months – just make sure it’s strong and unique for greater protection.
Also: use a password manager! Besides providing great complicated passwords, they provide an extra layer of security by warning you before you use your password on a phishing site… because the domains won’t match!
Now I can’t tell if Reddit is saying this because there is a legitimate threat out there that they haven’t disclosed, or this is generally good advice. Which it is good advice from my view. But if you’re a Reddit user, you should likely take their advice just in case this turns into a LastPass type of situation.
UPDATE: Monti Knode, Director of Customer Success at Horizon3.ai has this comment:
“Another successful phishing campaign isn’t a surprise and shouldn’t be. This attack vector is successful because it can look so legit, from plausible prompts to cloning their intranet gateway. This attack further reinforces the fact that the old perceptions of a perimeter are dead and gaining access is almost trivial, while understanding the blast radius of a successful attack matters more than ever.
“What can an attacker do if they landed on a specific asset? What could they do with a specific credential? In what scenario is our sensitive data at risk? These are the questions we should all be asking, because it’s not a matter of if, but when.”
Jesh Sax, Technical Account Manager at Tanium adds this:
“The techniques used at Reddit are all too familiar. Attackers are adapting to security techniques like multi-factor authentication and organizations need to take measures to mitigate potential vulnerabilities. Whether it’s physical security tokens or finding ways to authenticate both the user and the device that they’re logging in from, security teams need to continue to evolve.
“However, the fact that the user self-reported and the security team was able to catch things early on prevented this from becoming a much larger story. This speaks volumes to the culture that the security team has promoted at Reddit, where users feel comfortable speaking up when they’ve clicked on a phishing link. This type of security-aware culture is what every organization should strive for.”
Earlier this week I posted a story about what Reddit was doing to fight Russian disinformation. At the time I said this based on the fact that Reddit was only hiding Russian subreddits rather than deleting them:
Frankly an outright nuking of the subreddits in question would be better as the potential for disinformation to spread still exists due to the fact that the subreddits in question still exist. But I guess this option is better than doing nothing.
I guess Reddit must have heard that from a lot of places as this Tweet appeared yesterday:
You can read the blog post in full here. But here’s some of what Reddit is doing now:
Reddit also says this:
This is a live situation, and our response is evolving every day as we gain new information. The measures above are not a complete or final list of what we’re doing, but we hope it provides some insight into our efforts right now. Reddit, at its core, is about community, and we will continue to do whatever we can to ensure that our platform remains available for people to connect, support each other, access reliable information, and express their authentic opinions and feelings during this difficult time.
My feeling is that Reddit needs to do more. And we will likely see more from Reddit in the coming days.
When I did the round up of companies that are taking action against Russia for invading Ukraine, I missed Reddit and I should not have because they have decided to “quarantine” two subreddits related to Russia called r/Russia and r/RussiaPolitics for spreading disinformation.
First, let me explain what a “quarantine” is. It’s basically a shadow ban as per this document:
“the purpose of quarantining a community is to prevent its content from being accidentally viewed by those who do not knowingly wish to do so, or viewed without appropriate context.”
And if you try to go to the community in question, you get this:
Frankly an outright nuking of the subreddits in question would be better as the potential for disinformation to spread still exists due to the fact that the subreddits in question still exist. But I guess this option is better than doing nothing.
Reddit’s CEO Has Completely Lost The Plot
Posted in Commentary with tags Reddit on June 16, 2023 by itnerdSteve Huffman who is the CEO of Reddit had an interview with The Verge. And it went as well as you’d expect. Which is badly. In the interview, he said this:
We offer the API so the vast majority of our use of the uses of the API — so not these, the other 98 percent of them that make tools, bots, enhancements for Reddit — that’s what the API is for.
It was never designed to support third-party apps. We let it exist. And I should take the blame for that, because I was the guy arguing for that for a long time. But I didn’t know — and this is my fault — the extent that they were profiting off of our API. That these were not charities.
The ones that actually are doing good for our users — RedReader, Dystopia, Luna — like actually adding real value at their own cost? We’ve exempted. We’ll carry that cost.
Huffman “didn’t know” what was going on? Um, he’s the CEO, he’s supposed to know. That’s either a dodge or he’s asleep at the switch. That’s eye opening either way.
But there’s also this:
I want to stop you for a second there. So you’re saying that Apollo, RIF, Sync, they don’t add value to Reddit?
Not as much as they take. No way.
Um, let me point out something here. The native Reddit app sucks. And I don’t mean it kind of sucks, or it sort of sucks. I mean that it is really, REALLY BAD. Third party apps for Reddit are, or were orders of magnitude better than the native Reddit app. Maybe he should go do something about that because those apps were likely a factor when it came to people being on Reddit. Without them, the willingness for people to be on Reddit drops.
But it also seems that Reddit is going to force subreddits that have been dark back online.
This guy is one of the moderators of the r/Apple subreddit, and according to him, Reddit is threatening to remove moderators of subreddits that are blacking out indefinitely. Excuse my French here, but that’s a dick move by Reddit and illustrates that this protest is likely hurting them more than they are letting on.
At the end of the day, this will be a case study of how to anger the users who generate the content on which your platform is built on, with the net result of the platform imploding. That’s what Huffman is doing here. The question is, will he get a clue and change course in time to save Reddit before the users that he needs to generate content that encourages people to visit the platform leave for other places and put a bullet in his plans to have the platform generate income?
UPDATE: According to AppleInsider, the r/Apple subreddit has reopened under duress because of the threats made by Reddit. Like I said earlier, this is a dick move by Reddit.
Leave a comment »