Redlib is a private front-end like Invidious but for Reddit.
- 🚀 Fast: written in Rust for blazing-fast speeds and memory safety
- ☁️ Light: no JavaScript, no ads, no tracking, no bloat
- 🕵 Private: all requests are proxied through the server, including media
- 🔒 Secure: strong Content Security Policy prevents browser requests to Reddit
- Self-hostable
Redlib currently implements most of Reddit’s (signed-out) functionalities but still lacks a few features.
Redlib Instances
(If a particular instance doesn’t work, try others to see if they work)
Comparison
This section outlines how Redlib compares to Reddit in terms of speed and privacy.
Speed
Last tested on January 12, 2024.
Results from Google PageSpeed Insights (Redlib Report, Reddit Report).
| Performance metric | Redlib | |
|---|---|---|
| Speed Index | 0.6s | 1.9s |
| Performance Score | 100% | 64% |
| Time to Interactive | 2.8s | 12.4s |
Privacy
Logging: According to Reddit’s privacy policy, they “may [automatically] log information” including:
- IP address
- User-agent string
- Browser type
- Operating system
- Referral URLs
- Device information (e.g., device IDs)
- Device settings
- Pages visited
- Links clicked
- The requested URL
- Search terms
Location: The same privacy policy goes on to describe that location data may be collected through the use of:
- GPS (consensual)
- Bluetooth (consensual)
- Content associated with a location (consensual)
- Your IP Address
Cookies: Reddit’s cookie notice documents the array of cookies used by Reddit including/regarding:
- Authentication
- Functionality
- Analytics and Performance
- Advertising
- Third-Party Cookies
- Third-Party Site
Redlib
Server
-
Logging: In production (when running the binary, hosting with docker, or using the official instances), Redlib logs nothing. When debugging (running from source without
--release), Redlib logs post IDs fetched to aid with troubleshooting. -
Cookies: Redlib uses optional cookies to store any configured settings in the settings menu. These are not cross-site cookies and the cookies hold no personal data.
Settings and subscriptions are saved in browser cookies. Clearing your cookies will reset them. You can restore your current settings and subscriptions after clearing your cookies using the link given in the settings menu.
[TIP] 🔗 Want to automatically redirect Reddit links to Redlib? Use LibRedirect or Privacy Redirect!
Note: The above text presents an abridged and modified version of information found in the developer’s documentation. Some context has been removed or altered for brevity. For the full and unmodified documentation, please see the original source. Furthermore, it is important to note that the purpose of this post is not to endorse the use of Reddit (
), but rather to inform users of a privacy-friendly approach in case they need to utilize the platform.
Additional Information on Frontends from Privacy Guides
Sometimes services will try to force you to sign up for an account by blocking access to content with annoying popups. They might also break without JavaScript enabled. Frontends can allow you to get around these restrictions.
If you choose to self-host these frontends, it is important that you have other people using your instance as well in order for you to blend in. You should be careful with where and how you are hosting, as other peoples’ usage will be linked to your hosting.
When you are using an instance run by someone else, make sure to read the privacy policy of that specific instance. They can be modified by their owners and therefore may not reflect the default policy. Some instances have Tor .onion addresses which may grant some privacy as long as your search queries don’t contain PII.
I don’t understand, there are hosted instances? How do they freak with the API restrictions?
I run a personal API client and it stopped working from my vps unless I log it in. It does work when I run it from home. It’s a very low volume thing though.
Quickly skimming the readme, it states:
- OAuth token spoofing: To circumvent rate limits imposed by Reddit, OAuth token spoofing is used to mimick the most common iOS and Android clients. While spoofing both iOS and Android clients was explored, only the Android client was chosen due to content restrictions when using an anonymous iOS client.
- Token refreshing: The authentication token is refreshed every 24 hours, emulating the behavior of the official Android app.
- HTTP header mimicking: Efforts are made to send along as many of the official app’s headers as possible to reduce the likelihood of Reddit’s crackdown on Redlib’s requests.
It’s a lifesaver for when the only useful search result leads to reddit.
I absolutely love the token spoofing and hope more developers pursue that solution. The more unpaid API access, the better.
I hated being forced to use Reddit. If we consider the situation of search engines today we need Reddit’s results in some areas. Addons like LibRedirect and projects like this are really needed. Thank you!
