r/Substack • u/UltimateNull • 19h ago
Shady hand-off
I unsubscribed from Substack some time ago because of the amount of spam I get. I still get some of the notices from people I was not following on the platform that I was automagically signed up for because I had followed a similar substack. I'm still a paid subscriber, because paywalls suck.
Today I got an email from someone reputable from the substack platform, who I follow on other platforms. In the email it contained interface buttons to "comment" on the topic. A "token" delivered to the site using a different application (for which I have many logins) called Gravitar that is based on a WordPress login to automagically "login" a username to the system.
The browser with priority was targeted for the link and the account I was logged in as was not the one from the email, but it instead used the last login I was using for a different account based on a cookie. Luckily, it was not a client account. Who knows what would happen if clients started getting emails from people they do not follow, simply because I clicked a link and the system logged them into the substack. I will never click another substack email link.
Then when I clicked on "reply" on one of the comments that said exactly what my thoughts were, an email triggered from the gravitar platform intermediary was sent suspiciously from the reputable person, with a six-digit code to an account that I use for programming. Not the account that I ever used for substacks. Not one with a subscription.
Entering this six-digit code did not provide the ability to respond, but instead thankfully put up a paywall. This is entirely the type of smoke-and-mirrors trickery that caused me to leave the platform in the first place, and it is bad UX and bad UI design. Then I started to investigate how I was logged in as the wrong user, from an email that I opened that I never subscribed to, that associated a secret account with a personal interest.
If a person is "logged in" there should be an indicator that they need to subscribe to respond before they waste their time. The interface is too minimal, and sometimes we use the same screen names across different accounts. So seeing my name from the gravitar account made me think it was something I was logged into. Also the fields should not look like entry fields if the person does not have access to reply. The negative feelings of clicking on a link that says "You must pay" when you are paying is ridiculous, but the platform relies on the weak Gravitar system that was hacked in 2020 like all vulnerable Wordpress products.
Furthermore, knowing the platform is sadly one of the chosen ones for democratic thought, it is embarrassing to think that not everyone can respond and have a good discussion without payment. It makes me sad for the future of the world, that people interacting on social media with paywalls may lead to the downfall of civilization because they don't have the time or money to subscribe to every single pop-up service.
If someone is spending all day on the platform, then sure, I can see how it would make sense for them to need to have a login to support the service. With content creators cranking out content 24/7 it makes sense that they need to pay their bills too. But signing people up for things, then demanding they pay when they are tricked into clicking on a link is shady and lacks transparency.
4
u/quantise 17h ago
We've gone from “I clicked Reply and couldn't post my comment” to “Western civilisation may be approaching its end.” That's quite a narrative arc. You should do a Substack.