{"slug": "so-reddit-has-decided-that-plain-html-is-unsafe", "title": "So Reddit has decided that plain HTML is unsafe", "summary": "Reddit is now requiring users to log in to access old.reddit.com, citing abusive scraping and automated traffic as the reason. The company claims the legacy frontend lacks the modern security stack of New Reddit, but critics argue the move is designed to block data extraction for AI training. The change affects users who prefer the simpler, text-based interface and rely on it for search results from genuine human discussions.", "body_md": "# Reddit-The-Company\n\nIf you don’t know Reddit, it basically is the host of many popular forums. And like any company which encourages you to “come for the cats [and] stay for the empathy,” Reddit seems to be in the business of extracting as much value as it can from said forums without completely destroying them.\n\nAfter all, simply fostering community is not a noble enough goal for the New\nTech, and fortunately for Reddit, genuinely human-generated data is now gold in\nthe LLM Age. [You are welcome to read about the last time they decided to pluck\nthe metaphorical liver from their\ncommunities](https://en.wikipedia.org/wiki/Reddit_API_controversy).\n\n# Reddit-The-Search-Results\n\nWhile I no longer wish to engage with Reddit, I still visit it occasionally,\nespecially in the LLM Age. This is because appending `site: reddit.com`\n\nto a\nsearch query is basically a surefire way to find results written by genuine\nhumans. Which, just to be *extremely* clear, I still find desirable.\n\n# Now behind a login… sort of\n\nAfter doing such a query yesterday, to my absolute delight I was greeted with\n\nI guess this makes me old, but I use the original frontend for Reddit,\n`old.reddit.com`\n\n. I’m going to try *really* hard not to preach about why it’s a\nbetter frontend, but that’s all it is! A design for Reddit.\n\nLook, I know I’m a fringe user. I use Firefox. I noscript! I am no stranger to being forced off a product that worked just fine because someone decides to no longer support the two people who still use it.\n\n-\nIt happened to my phone of 8 years, which works fine by the way, but is on too outdated of an OS. May it rest in peace in its tiny glory.\n\n-\nIt happened to my tablet of 10 years, which works even better than my phone and holds a charge like champ, for the same reason.\n\n-\nIt happened to the API for Stack Exchange used by my copy of their outdated app long removed from the app store. This one hurt me the most.\n\n[1](#fn:1)\n\nWhere I feel like things get personal here is that Reddit is saying that this is all\n\nTo keep Reddit safe\n\nKeep Reddit safe from **whom** exactly? Me? My desire for knowledge??\n\n# Safety is what exactly?\n\nSo let’s see what they have to say on this matter by going to the announcement,\nwhich of course I didn’t see because I don’t read Reddit anymore:\n[https://old.reddit.com/r/modnews/comments/1ujtebf/logging_in_to_use_old_reddit/](https://old.reddit.com/r/modnews/comments/1ujtebf/logging_in_to_use_old_reddit/).\nHope you’re logged in.\n\nOld Reddit’s logged-out experience is a significant source of abusive scraping and automated traffic on the platform.\n\nHmmm, OK. But then why is New Reddit still accessible logged out? Oh, someone asked that.\n\n[[Question]]: What’s so different about new reddit that people don’t try to scrape that? Seems to me like it would be better to just implement that on old reddit too. Besides, won’t this just cause people to try and scrape new reddit?\n\n[[Admin reply]]: I was about to type an answer but just saw u/Nestramutat- gave a really eloquent answer in another comment!\n\n[[The comment (snipped)]]: … To your first question, the shape of malicious traffic is always changing. It’s going to be a constant cat and mouse game as you ban one method, a new one gets developed. It’s easy to see abusive traffic in hindsight, but it’s harder to pre-emptively block it. Given that they’re claiming Old Reddit doesn’t have the modern security stack, this is likely proving to be an even greater challenge…\n\nSo it doesn’t have “the modern security stack.” Now I may not have really earned\nmy Full Stack stripes, but I **can** right click and select *Inspect\nElement* so I’d say I’m qualified enough to see why.\n\n# Old versus New\n\n## Old Reddit\n\nLet’s start by — begrudgingly — logging in to see what is so insecure about\n`old.reddit.com`\n\n. I’ll use their announcement thread to test. Ahhh, so much\nnicer.\n\nLet’s check what Old Reddit is doing that makes it so insecure. The best I can guess is that their precious, precious user-created content is available in plain HTML, since that’s basically all Old Reddit does: you don’t even need JS unless you want to load more comments (ask me how I know).\n\nIt DLs about 1 megabyte and sends about half a megabyte. It’s not shown there, but the page’s HTML itself comprises most of the response. I’ve certainly seen worse, but what’s with the load time? GitHub loads its massive payload about 4x as fast (relative to size).\n\nOh… 2 whole seconds of waiting for a reply. Smells of rate-limiting. Or was Reddit always this slow?\n\nLet’s load some more comments. (Reddit never loads all of the comments initially)\n\nWell that was nice and lean, and pretty snappy. I don’t see my secrets being sniffed. All I got here is that Old Reddit is a pretty normal webpage, which I guess makes it insecure in comparison to…\n\n## New Reddit\n\nLet’s see why New Reddit is so much better. In case you have unrealistic expectations, let me right them: New Reddit will not load anything more than the post itself without Javascript (JS). That’s probably what makes it more secure.\n\nThere’s a lot loading here (about 5x Old Reddit), and this is why my analysis gets rather unscientific. Rather than try to get around the “security things” (whatever that means), I instead tried to do the bare minimum necessary to fetch the content. In browser — I did not feel like writing a scraper.\n\nThis led to me basically blocking all requests to domains (including `reddit.com`\n\n)\n*except* for\n\n`www.redditstatic.com/js/concat`\n\n`www.reddit.com/svc/shreddit/more-comments/`\n\n`www.reddit.com/svc/shreddit/comment/`\n\nWhen you do this, the page loads a lot less, but it *does* load. When you click\nto load more comments, it spins forever, but I inspected the request fired off\nand it *did* get a response with comment text. So as far as I can gather, simply\nrunning the JS on the page is sufficient to get enough information to get\ncomments. So I guess that’s what’s stopping the scrapers? Executing Javascript?\n\nJust for the heck of it, let’s load some more comments without the request filter.\n\nWell, that’s certainly less lean than Old Reddit.\n\nIn my (again, unscientific) experimenting, I reloaded the page several times and tried to load comments and replies and didn’t get any failures. One time, when I had the request filter off, I got redirected and saw a captcha field sent as a query param, but I couldn’t reproduce that. I don’t know whether you get a captcha if you just gun it directly for the comments.\n\nBut I did notice this helpful heartbeat sent back to Reddit every time I scrolled or moved my cursor.\n\nI guess that makes me feel safer?\n\n# So what’s safer?\n\nLet’s dispel any notion that there are *safety* issues arising from a frontend,\nbecause that’s pure PR crap. Instead, if we read between the lines, Reddit\ndoesn’t want people scraping (because it’s *their* gold, dammit!) and they think\nthat shafting a few Old Reddit users will disrupt the scraping enough.\n\nDoes this actually stop scraping? I don’t know!\n\nI won’t claim to have proven you can still scrape New Reddit: surely it must be harder, but it seems to just be that scrapers — surprise, surprise — prefer using a leaner form of Reddit. Which, by the way, loads 8x more comments by default (200 vs 25; yes, New Reddit really only loads 25 comments initially, going up to like 35 automatically if you scroll some).\n\nCynically, it seems like Reddit discovered they can make scraping harder by making your browser load more and work more, which they had already done by rewriting a nice piece of HTML into a 5x more bloated mess of web components or whatever. (I gave up trying not to editorialize, sorry)\n\nThe thing is that I wouldn’t have beef with Reddit if they had just quietly\nissued a 40X/30X error for`old.reddit.com`\n\n. Or if they had said “no one uses\nthis, we’re removing it.” This is upsetting but predictable. Claiming that they\nneed to rug-pull me because of vague assertions about security or scraping that\nare really not my problem? That makes me mad. I enable JS for Anubis, dammit!\n\n# Anyway\n\nI’ll have to ponder whom this blog endangers, seeing as its core functionality — like Old Reddit’s — is serving text in plain HTML. Although maybe it’s fine for me because my blog is my content, and as such is less valuable because it was already mine to begin with. Unlike the stolen hoard of user-created content which Reddit is trying to keep secure from Big Scraping. Finders keepers!\n\n# But why not…\n\n### Log in?\n\nSure. I might do that. Just let me be angry that I have to, please?\n\n### Use “New” Reddit?\n\nI might have to anyway, who knows if they’ll keep supporting Old Reddit. But\nmark my words, they *will* close the gates on logged-out New Reddit users if\nthey think they can get away with it.\n\n### Use an LL…\n\nAm I not allowed to bemoan the loss of the internet that once was and could still have been? Why must I consult the world’s smartest and most expensive computer just to read what people have to say about my random question? Is it so strange to want to read text written by humans?\n\n-\nStack Exchange’s hot new queue was the\n\n*perfect*replacement for Reddit on mobile when I curtailed my usage of it a long time ago. It turns out that what I liked in Reddit was reading interesting things and there was no shortage of interesting things on Stack Exchange (although they also have gone through several de-liverings which is too much of a digression even for a footnote). I now browse Wikipedia. Please don’t screw me over Wikipedia, I donated five bucks to one of your nags once.[↩︎](#fnref:1)", "url": "https://wpnews.pro/news/so-reddit-has-decided-that-plain-html-is-unsafe", "canonical_source": "https://www.cole-k.com/2026/07/21/reddit/", "published_at": "2026-07-22 08:48:18+00:00", "updated_at": "2026-07-22 09:53:56.290582+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-policy", "ai-ethics"], "entities": ["Reddit", "old.reddit.com", "New Reddit"], "alternates": {"html": "https://wpnews.pro/news/so-reddit-has-decided-that-plain-html-is-unsafe", "markdown": "https://wpnews.pro/news/so-reddit-has-decided-that-plain-html-is-unsafe.md", "text": "https://wpnews.pro/news/so-reddit-has-decided-that-plain-html-is-unsafe.txt", "jsonld": "https://wpnews.pro/news/so-reddit-has-decided-that-plain-html-is-unsafe.jsonld"}}