Reddit hacked
Update: Looks like the malicious code on the comments is now being replaced with "i am a terrible person". But it is still possible to submit malformed URLs, and it remains to be seen whether the exploit is completely fixed. — Digg this story if you want to read the comments of gloating Digg fanboys:
Context & Ripple Effects
The hack lands mid-rivalry. Weeks earlier, Digg's attempt to purge the '09 F9' HD DVD key triggered a full-scale user revolt over whether its democratic model was rigged — with bloggers accusing Digg of burying stories internally — and Reddit has been positioning itself as the unfiltered alternative. Now Reddit's own front page is compromised: malicious code ran inside user comments before being swapped out for 'i am a terrible person'.
What keeps this story open rather than closed is the confirmed detail that malformed URLs could still be submitted as of May 27, meaning the injection vector was not fully patched when the report went up.
First-order effects
- Every Reddit visitor reading comment threads during the window is exposed to attacker-controlled markup, and any user can still weaponize the unpatched malformed-URL path to run the same trick again.
- Reddit's admins face an immediate credibility test: a site whose pitch is community freedom has just demonstrated that unsanitized submissions execute on every reader's browser.
Second-order effects
- Digg partisans are gloating in the story's own comments, converting a security incident into competitive ammunition at exactly the moment Digg is defending itself against censorship charges — each site's scandal softens the other's.
- Rival social news operators now have to audit their own comment and URL handling, because an exploit demonstrated on one site is a template for the others within hours.
Third-order effects
- If user-submitted content executes by default, community-moderated platforms learn that openness without input filtering is a structural liability, pushing sanitization and submission validation into baseline platform engineering rather than optional hardening.
- Trust in these sites becomes two-sided: users judge not only what gets posted but how safely the plumbing renders it, making security posture part of the governance argument between 'rigged' curation and open submission.
The trend: As social news sites scale in 2007, security failures are becoming competitive currency, with each platform's exploits and moderation controversies feeding the other side's narrative.