Hoojah · White Paper
A White Paper
Most of what we call online discussion runs on machinery built for the wrong goal. Mainstream feeds are tuned to maximise attention, and attention is cheapest to buy with outrage, novelty, and heat. The predictable result is a public square where the loudest claim wins, the earliest vote drags the rest along, and a rude reply can change what you believe about a fact before you have finished reading it. These are not accidents of human nature. They are outcomes of design.
Hoojah is a working platform engineered for the opposite outcome. It is built on three signature mechanics. First, three-stance voting behind a secret ballot: you take an explicit position on a claim (agree, neutral, or disagree) rather than firing off a reaction, and nobody, not even the claim's author, can ever see who voted which way; the per-stance split, an aggregate that names no one, stays hidden until enough votes exist to protect each voter. Second, vote-to-respond: you cannot reply to a claim you have not taken a stance on, so commitment comes before contestation. Third, structured one-on-one debates: disagreement can escalate into a bounded, turn-based exchange with named phases, and once it concludes, spectators who watched it cast a single verdict on who argued better.
This is not a concept deck. The platform is live, deployed, and tested. The described machine runs in production on a Rails 8.1 monolith, with a test suite of 536 passing examples, zero failures, and zero static-analysis security findings. This paper lays out the problem Hoojah answers, the design that answers it, exactly what is built today, and what the same design logic puts on the roadmap next.
If you have ever watched a promising online conversation curdle into a shouting match, it is tempting to blame the people. The more useful explanation is the machinery. The pathologies of online argument are, to a striking degree, engineered outcomes of platforms optimised for engagement. Change the design and you change the outcome. Four findings make the case.
Falsehood and outrage travel faster than truth. A large 2018 study in Science traced the spread of true and false news on Twitter and found that falsehood diffused significantly farther, faster, and deeper than the truth, largely carried by humans rather than bots, because false stories were more novel and provoked stronger emotional reactions [1]. That emotional edge is measurable. Analysis of moralised political content found that each moral-emotional word added to a message raised its diffusion by roughly twenty percent, and that this contagion stayed mostly inside ideological in-groups [2]. A feed that ranks by engagement is, in effect, ranking by whatever spreads, and what spreads is novelty and moral heat. The everyday symptom is familiar: the angriest quote-tweet outruns the careful correction every time.
Visible early votes herd the later ones. When a platform shows you a running score, it is not neutrally measuring opinion, it is shaping it. A randomised experiment on a news-aggregation site found that a single early up-vote, applied at random, raised the probability of later positive votes by about thirty-two percent and inflated final ratings by roughly twenty-five percent [3]. The scoreboard distorts the very opinion it claims to report. You see that a comment already has two hundred likes and you nudge toward agreement before you have judged it on the merits.
Tone poisons perception of content. It is not only what people say, but how nastily they say it. In a controlled experiment nicknamed "the nasty effect," readers shown an identical article about a technology story formed more polarised views of the technology itself when the comments beneath it were uncivil rather than civil [4]. The rudeness of a reply changed what readers concluded about the facts. On an engagement feed, where uncivil replies are exactly the ones that surface, this effect runs continuously in the background.
Anonymity plus zero structure disinhibits the worst behaviour. The "online disinhibition effect" identifies a cluster of factors (dissociative anonymity, invisibility, asynchronous exchange, and more) that loosen the restraints people carry offline and license them to act out [5]. Anonymity is not inherently toxic. But anonymity poured into a structureless comment box, with no cost to a drive-by insult and no format to hold anyone to, reliably produces the behaviour we all recognise.
Read together, these are not laws of the internet. They are levers. Virality, vote visibility, reply tone, and the interaction between anonymity and structure are all design parameters, and a platform can set them differently. That is the thesis Hoojah is built to test.
Hoojah began with a civic instinct: Malaysian data for Malaysians. The founding idea was that a public reasons better when it can see its own mind, and that the record of how a society argues (what it claims, contests, and concludes) is a form of civic infrastructure worth building deliberately rather than renting from platforms optimised elsewhere. Debate, in this view, is not entertainment. It is how a public thinks out loud and discovers what it actually holds. Early framing placed the project against the broader arrival of social networking and the open question of whether we were ready for it [6].
That origin still supplies the motivation, but it no longer describes the product. The vision today is broader and more concrete: discourse infrastructure. Not a place to broadcast, but a machine that makes structured, accountable argument the path of least resistance. The rest of this paper is about that machine: how it is designed, what runs today, and what ships next.
Hoojah's design is a point-by-point answer to the pathologies of Section 2. Each mechanic exists to defuse a specific failure mode. Here is the model, part by part.
Claims and stances. The atom of Hoojah is a hujah: a claim, stated plainly. When you encounter one, you do not "like" it or fire off an emoji. You take an explicit position, agree, neutral, or disagree, and only then is your voice counted. Reducing a reaction to a considered stance is not a new idea; it has real research pedigree. ConsiderIt, a deployed public-deliberation system, structured opinion around pro and con points that people create, adopt, and weigh, and demonstrated that interface design shapes how people deliberate rather than merely hosting what they would have done anyway [7]. Hoojah takes the same lesson: make the first act a position, not an outburst.
Vote-to-respond. This is the mechanic that surprises people. On Hoojah you cannot reply to a claim you have not voted on. The reply gate is enforced in the authorization layer, not just the interface, and requires that you have already taken a stance on the parent claim before it will let you post a response. The effect is to abolish the drive-by pile-on. Contestation costs a commitment: to argue against a claim, you must first go on record about where you stand. This single rule filters out the reflexive dunk, the reply written to perform for an audience rather than to engage the claim.
The secret ballot. Votes on Hoojah are anonymous by construction, and the anonymity is enforced in code, not promised in a policy page. The split is deliberate: arguments are signed, so you own what you say and can be held to it, while votes are secret, so nobody can be identified by how they voted. There is no vote serializer anywhere in the system; a vote is never rendered to anyone as belonging to a named person. When you cast your first vote on a claim, the notification the author receives deliberately carries no voter identity, so the author cannot learn who voted or how. And the per-stance breakdown (how many agreed versus disagreed) is suppressed until a claim has gathered at least five total votes, at which point revealing the split no longer fingerprints any individual. That suppression applies to everyone, including the claim's own author, who is treated as just another observer. This directly answers the herding evidence [3]: if early tallies are hidden, an early vote cannot stampede the later ones. One further option gives a vote weight without breaking anonymity: a conviction vote permanently locks your stance. You can no longer change it. It is belief with a cost, recorded only as an aggregate count, never as an attributable act.
One-on-one debates. When disagreement is worth pursuing, it can escalate out of the comment thread into a bounded, formal debate. One person challenges another; the opponent accepts or declines. If accepted, the two argue in strict alternating turns through named phases: an opening statement, counter-arguments, responses, and a closing statement. There is a cap on the number of rounds, with a single mutual extension available only at the closing boundary, and a debate that goes idle for seven days concludes automatically. This structure is the anti-derailment device. A ten-month ethnographic study of Kialo, a structured pro-and-con debate platform, found that adversarial values were a recurring source of conflict and argued for using interface design to foreground positions and manage that conflict [8]. More broadly, the deliberative quality of an online forum is a product of design and choice, not a fixed property of the technology [9]. Hoojah's turn structure is that choice made deliberately: you cannot interrupt, cannot dogpile, and cannot flood. You take your turn, then you wait for theirs.
pending (challenge issued) → accepted opens an active debate, or declined ends it. In active, turns alternate through phases opening → counter-argument → response → closing, capped at the round limit (with one optional mutual extension). The debate reaches concluded when the closing turn is posted, when either participant ends it, or when seven idle days trigger automatic conclusion.Figure 2Spectator verdicts and a non-viral feed. A debate does not end in a mob verdict as it unfolds. Only after it concludes do non-participants who could see it cast a verdict: challenger, opponent, or draw, one immutable vote each. Ties, including a debate nobody judged, resolve to a draw; only a clear plurality crowns a winner. And the surface that surfaces claims is not an outrage engine. Hoojah's trending ranking scores a claim by its total activity divided by a time-decay factor (the same gravity idea behind Hacker News), so recent, broadly engaged claims rise and old ones sink, without ranking on the emotional intensity that engagement feeds reward. The feed measures interest, not fury.
Everything described in Section 4 runs in production. This is the current, shipped inventory, not a wishlist.
The full claim loop is live: post a claim, take a stance, and argue in stance-grouped reply threads, all with the vote-to-respond gate enforced. One-on-one debates are live end to end, including real-time turn delivery: when your opponent posts, the transcript updates over an authorized WebSocket channel without a page refresh. Spectator verdicts are live, with the draw-on-tie resolution computed on read. The social layer is built too: a follow graph with private accounts and follow-requests (following a private account creates a request the owner approves), bidirectional blocking that is enforced in the authorization layer so a block hides content both ways, a flag-and-moderation queue with dismiss, remove, and warn actions for moderators, earned badges, @mentions and hashtags, the trending feed, and a privacy-gated personal analytics dashboard.
The engineering posture behind that inventory is conservative on purpose. Hoojah is a server-rendered Rails 8.1 monolith using Hotwire (Turbo and Stimulus) with no separate JavaScript front-end framework. Authorization is per-action and deny-by-default: every controller action must explicitly authorize its request, and the base policy refuses anything not expressly permitted, so a forgotten check fails closed rather than open. The test suite reports 536 passing examples with zero failures and zero pending, the static-analysis security scanner (Brakeman) reports zero findings, the dependency audit is clean, and continuous integration plus automatic deployment are wired in.
One piece deserves a direct word, because it is where policy meets code. Earlier in the project, the notification sent when someone first voted on a claim carried the voter's identity, which meant a claim's author could in principle de-anonymise their first voter. That vector has been closed. The current code sends the first-vote notification with no voter identity attached, the API has no path to reveal it, and a one-off backfill migration scrubbed the identity from every historical vote notification already in the database. Alongside it, the five-vote suppression threshold on per-stance tallies is built and applied uniformly, author included. The secret ballot on Hoojah is enforced in code, and pinned by tests that fail if a future change tries to reintroduce the identity link. It is not a promise in a privacy statement.
The same design logic that produced the platform points at what comes next. Everything in this section is proposed and on the roadmap, not shipped. It is grouped by theme rather than by sprint, and it carries no dates, only sequencing rationale.
Trust and identity. The largest planned addition is identity verification, which is significant enough to warrant its own future specification. Alongside it are the remaining privacy residuals from the secret-ballot work. Some aggregate counts are still exposed unfiltered in places (for example certain per-user vote totals), and one further secret-ballot hardening decision has been settled but not yet implemented. These are known, tracked, and low-severity given the core de-anonymisation vector is already closed, but they are on the list.
Depth of debate. A debate-won badge and milestone badges are proposed but blocked on first finalising how the verdict tally crowns a winner, so the badge cannot be awarded against a moving definition. Bookmarks and saves, so a reader can keep a claim or debate to return to, are proposed and not yet built.
Insight. The analytics dashboard today reports current state. Proposed next are trends over time, computed by a nightly background rollup job rather than on every page load, plus reach and impression metrics and follower-growth charts. These are deferred deliberately: they were gated on settling the vote-notification privacy question first, which has now been resolved, clearing the way.
Platform. Two structural items sit underneath the features. The first is tidying how vote data is stored: today the same agree/neutral/disagree fact is recorded in a few different places and formats, and the plan is to keep just one clean copy of it (while still preserving the historical record of how a voter's stance changed over time, which has research value of its own) so the different copies can no longer drift apart. The second is making the app's public API enforce exactly the same privacy and blocking rules the website already does, so nothing leaks through the programmatic door that the web interface closes. Native mobile clients come last, and deliberately so: shipping native apps locks the API in place, and it would be a mistake to lock it before the data tidy-up and the privacy parity above are done. Order matters more than speed here.
The argument of this paper is a loop, and here it closes: every pathology from Section 2 has a mechanic aimed at it.
| Pathology (Section 2) | Hoojah's answer (Sections 4-6) | Status |
|---|---|---|
| Falsehood and outrage outrun truth in viral feeds [1], [2] | Trending ranks total activity with time-decay gravity, not emotional intensity | Built |
| Visible early votes herd later ones [3] | Secret ballot; per-stance tallies suppressed below five votes, author included | Built |
| Uncivil tone poisons perception of content [4] | Structured turn-based debate; no interrupting, dogpiling, or flooding | Built |
| Anonymity plus zero structure disinhibits behaviour [5] | Secret ballot anonymises the vote while arguments stay signed and accountable; the vote-to-respond gate supplies the missing structure | Built |
Behind the table is a research bet worth stating plainly. Conversations that go bad tend to announce it early: pragmatic signals in the opening exchanges of a discussion predict whether it will later derail [10]. If failure is decided at the start, then the highest-leverage place to intervene is the start. That is exactly where Hoojah's structure bites: stance before reply, a formal opening statement, named phases with turns. The format fixes the opening conditions rather than moderating the wreckage afterward.
Two objections are fair, and worth meeting head-on. Structure kills the fun. It removes a particular kind of fun, the drive-by dunk and the pile-on, and that is the point; what it protects is the fun of actually winning an argument in front of people who watched it. Nobody accepts friction. The friction is deliberate. Vote-to-respond and turn limits trade reach for quality: fewer, more committed contributions instead of many disposable ones. Hoojah is a bet that a smaller volume of accountable argument is worth more than an unlimited volume of reaction, to the people having it and to anyone trying to learn what a public actually thinks.
Online discussion is not broken because people are broken. It is broken because the machinery rewards the wrong things. Hoojah is a working attempt to build the machinery differently: claims taken seriously, votes cast in secret, replies that cost a commitment, and disagreements that resolve in structured debate judged by the people who watched. It runs today, and its roadmap follows the same logic that built it.
If you are a reader, come take a stance. If you are someone who loves to argue well, come debate. If you are a founder, a product person, or a builder who thinks the public square deserves better infrastructure, come collaborate, and if the mission resonates, support it. For the full scholarly treatment of the ideas sketched here, two companion research papers develop the deliberation theory and the computational-argumentation design in depth. This white paper is the invitation; those are the argument in full.