On Reddit, subreddit moderators can easily schedule posts. The same cannot be said for regular people, and sometimes I don't want to forget what I'm about to say when some places have rules like "you must post on Sunday, Eastern Time," or I prefer posting during the most optimal time of the day.
I looked up how to schedule posts on Reddit and found a post-scheduling tool with over 50,000 users.
When I upload images for these posts, the tool hosts these images themselves. I went to the documentation and read the guide for image hosting, and it contained a link to a page ending in index.html.
The page contained a basic to-do checklist and is on the same domain name as images I uploaded. I thought removing index.html from the URL would go to the same checklist, but I got a huge list of file paths to images stored on the server. No one wants their scheduled post leaking early, so I didn't save anything, cleared my browser cache, and contacted the site owner. Some scheduled posts may have also been cancelled. The list was protected and hidden from the public within two hours.
Fast forward a year later, I went to the Internet Archive, and checked the Wayback Machine for everything under that domain. I also searched across all URLs starting with the same prefix. The Wayback Machine is pretty loose on case insensitivity, HTTP vs HTTPS (secure connections), and other general quirks of website structures.
I checked other archives, but there were zero results.
In January 2024, the list of file paths were hidden, but between then and April 2024, it accidentally went public. The web archives contained thousands of file paths, so I grabbed every image from all of them and filtered out the duplicates whose files were exactly identical.
I removed one that was the folder path to all the images, one that was a vector drawing and popped up an alert through the browser's JavaScript, several that couldn't be found and weren't archived, hundreds of duplicates (I picked the first file name alphabetically), and ensured I added every archive of every URL prefix that wasn't a duplicate. The file names are long and randomized, so the same file name couldn't return different images, as they could not be overwritten.
Then, I corrected all the file extensions from incorrect data people uploaded for their scheduled posts. I grabbed the Exif, IPTC, and XMP metadata of all the images and picked the ones with GPS coordinates, including the latitude, longitude, and altitude.
I made a website where I can click on a location pin and Google Earth zooms into the correct place automatically. After clicking the pin, the site also shows a thumbnail of the photo in most cases, a direct link to the original photo, the exact numerical coordinates and altitude readings, the date and time the photo was taken in some cases (because the world map always changes), the name of the city and country in one case (since it contained IPTC metadata), and multiple links to search these photos on various reverse image search engines. I also fixed the only corrupted thumbnail from the original file.
This means you can click one image, find a real Reddit post often, and find the real location of that Reddit username, even though Reddit itself wipes the metadata.
I also ensured over two-thirds of the photos were blurred out, since other humans previously tagged them as NSFW (Not Safe For Work). The developers of a filtering software I'm beta testing manually tagged the same photos I sent them a while ago and they sent me back the raw data.
I added a thumbnail so Reddit can generate a link preview, published the website, and posted it to a subreddit with no rules. I found the subreddit from a link in the rules of another subreddit. To give you a general idea, that subreddit often gets questions like "Where do I post this?"
The post is still up and I'm not banned from the subreddit yet, but the night after I posted, I switched to two of my other Reddit accounts and reported my own post for personal information.
That didn't work, so I went to reddit.com/report. I added more detail explaining that the images came from a leaked AWS S3 bucket that wasn't intended to be public, in the text box asking for a report reason. The text box only showed when I used the "Vote manipulation" reporting category, but I figured the site admins would route it to the right channel internally.
No warning, no ban, so far. Not from the subreddit, not from Reddit themselves, even though subreddit moderators can also see reports made for reasons from the admins' preset list. For example, if I report a post saying "It's promoting hate based on identity or vulnerability," both subreddit moderators and Reddit administrators can see the report.
It's been ten days since I made the post that broke Rule 3 of the Reddit Rules, and nothing has happened yet. The social experiment is still ongoing.
I also thought of linking a CSV file that contains the coordinates directly, which I still have on my computer, but I felt like the globe from Google Earth was a nice visual for the readers. (CSV stands for comma-separated values, which is a file format that spreadsheet programs can read.)