I wanted to address the points
Crispy raises separately from above. Mostly because there's an extreme level of retardation needed to hold some of those points of view and it's quite mind boggling.
If it's fair for us to "gossip" about users in the Admin forum and post personal, completely non-related-to-their-Codex-activities info therein, why isn't it fair for others to post your personal, non-Codex-related info that you yourself posted both in a blog and also at one point on your Steam account? All that resulting in multiple people being banned here.
If you genuinely think that your real name, my real name, and every other detail known about staff isn't being bandied around Discord, Private Message groups, and other non-Codex means of communication by Codex users then I've got news for you Crispy. How do you think Infinitron's name became known in the first place?
Doesn't even qualify as doxing because it didn't happen in public.
This is the crux of the problem.
If someone other than a Codex moderator or administrator can gain access to the info that's posted in that private forum, it's no longer private; it's become public. It might only be a small leak, if you will, but if it's one via which Luckmann's real name, and whatever other personal shit was in that blog, are revealed, then that's a legitimate problem.
You're confused between concern over the information being posted or discussed at all, with concern about the information being leaked. They're two separate issues.
Discussing information you've found on the internet about someone isn't actually a crime. What we decide to allow on the Codex though, is entirely within our purview. Especially if it's some kind of attempted power-play or people playing silly games. As I said above, some common decency would be nice.
For the staff to be discussing information about our users, in a thread about our users, where we literally discuss who should be banned, in a way that is about that exact topic, is entirely appropriate. That we can find that information through whatever legal access to information we have is also entirely appropriate.
Maybe all of this occurred accidentally. I'm certain Infinitron had no intention of "doxxing" anyone. But doesn't it seem unfair to apply the private info sharing rule to others (DU banning a bunch of people) if non-moderators and non-administrators somehow have access to their private info?
What didn't happen is Infinitron did not keep posting that link repeatedly saying HEY GUYS I FOUND SOME INFORMATION WE CAN USE. Use that as an attempt to provoke or annoy the user in question. Or take it any further than, hey so this guy is posting on our website. By the way, you know how someone tried to take us offline recently because of exactly those types of people posting on our website? Yeah this might be a legitimate problem to discuss. And one we have discussed many times in both the admin forum and private messages.
Grapsing that concept is important if you want to be on staff here.
The other thing is that if DU himself admits that there have been known "rats" in Admin before, then why is anyone's personal, private information ever being posted in there in the first place?
There's a reason we have 2 Admin forums. And you aren't in the second one. Nor are any of the known rats. The main admin forum is for shit-talking about the users, identifying issues, gathering intel, and counter-trolling operations. The serious admin forum is for serious business like all the features we wanted that I've never fixed,
Taluntain trying to
identify all the Poles, and
how to use Crispy effectively.
That there are people with access who "leak" information from the main admin forum is something that will never be stopped, given this is the Codex. I expect some of the staff to stir shit up. No, it's not ideal but it doesn't happen often enough or seriously enough to warrant further action.
I actually agree that with Admin we need to reserve the right to talk about potentially personal details about our users, but only for purposes of them potentially either becoming a problem for other users here or if something dire arises, such as an illegal post or some sort of suicide threat or something like that.
[...]
If that's where you want to go, it's simple; when all the Infinitron naming thing was going down, I was still under the impression that RPG Codex wasn't doing something similar behind closed doors unnecessarily. I think I was acting in good faith (upholding our rules of not getting personal).
Now that the fact that Infinitron bent those rules, albeit in the private Admin forum, has become public knowledge, I've changed my mind about it.
Except, as I said above, he didn't bend those rules. We legitimately had to deal with a legal threat against the Codex recently,
targeted at taking us offline entirely, precisely because of those types of users. Shouldn't we discuss who they are if it's going to threaten the Codex? Shouldn't we be able to discuss what we should do about it, in the event any of that sort of information comes to light? Because let's be honest, if someone on the Codex can find it, it's not that well hidden.
We have a rat in Admin. Someone, somehow, found out that Infinitron posted that link. Why that blog about Luckmann was originally posted is immaterial; it's about his personal life and -- as potentially despicable a life as that may be (I didn't really read the blog about him) -- I'm pretty sure none of it has anything to do with:
- Why Luckmann posts here
nor
- What Luckmann posts here
Therefore we have a double standard.
Incorrect, as stated above. Infinitron didn't use the information against Luckmann. He didn't post it around publicly saying HEY LOOK AT THIS GUY. He posted it in the admin forum, where admins are supposed to discuss admin things like, "Who's going to be the most responsible for trying to take down the Codex today?" and "What are we going to do about that?".
And for the record, if we were any other forum, Luckmann would've been immediately banned based solely on that information alone. And there's nothing illegal or unlawful about that, for those who want to argue the legal point. We just choose not
to go down that path. The time may yet come when we regret that.
Is it an egregious one? It depends on whom you ask. What about all those people who got banned that now know about Infinitron's inquisitive nature? How do you think they feel?
As Infinitron alluded to in Shoutbox, we already have more than enough information to be able to identify most users on the Codex. It's how that information is used that's the issue.
For example, any Administrator on the website can access your profile. In that, we can see your email address. I can take that email address, google all or any part of it (which for most people is fairly unique) and find instagram accounts, twitter, old dating profiles, facebook, your employment, the list goes on. Most social media apps these days have a function that allows you to find users based on their email address.
We can go one further and cross reference with everything you've ever posted. You mentioned a favourite taco joint, or a school you went to, or your home town? We can check that against your time-zone (and let's be honest, most of you chose your local time zone didn't you? You'd be surprised at how easily that narrows your location down). Hell, there's even a field for date of birth on here.
Up next, we can pull your IP address, which is saved with every post you make, over the 10+ years some users have been posting here. Did you remember to use your VPN every time? I mean, every single time? Because I can download
public lists of VPNs and
TOR exit nodes, compare them to every IP you've posted from, pull out the ones that don't come up as public proxies, and check if there's a pattern. Maybe it's always the same exit node, maybe it's always a VPN from the same country, maybe you forgot just that one time and posted from your mobile device.
We then have the users' extended fingerprint: operating system, screen resolution, browser. Most people don't realise that those 3 alone can
identify specific users (not everyone uses that exact resolution, with that OS, with that browser version - and the privacy browsers are even better, they're the odd ones out and easily identifiable in a crowd of Chrome and Firefox).
There's always a risk that a rogue admin could abuse this information. And there are forums where that's happened. There are also forums that have been hacked and had user information revealed. Some of those we can help, some of those we can't and can only mop up afterwards.
And I haven't even gotten onto the most basic aspect of the website. Everything above is stored in a database on our web host. Anyone with access to that web host, or that database, can see it all, including everything you've ever posted. And private messages too. Over my 20+ years administrating forums I've seen passwords to other websites, email accounts, and all sorts shared in private messages between users. All unencrypted, sitting in an SQL dump file.
As I said before, there are some people here who need to seriously re-consider what they're posting on an RPG discussion website.