Hacker News new | ask | show | jobs
by _jomo 2649 days ago
You seem to ignore that this constrains abusers as much as it does legitimate users. Collective punishment in order to mitigate abuse by a few is the wrong way to go.
3 comments

Easy to say until you're running a service that's a target of said abuse. Do you have a better solution?

If you do, it'd be quickly adopted because no one likes adding unnecessary friction.

Invest in your content moderators and in tools to track and trace them. Very few firms seem to have any interest in how or why they are selected by abusers or in the dynamics of the abuse that takes place on their platform. People pointing out abuse are usually treated as an annoyance, when in fact they may have considerable knowledge about the bad actors exploiting the service.

A very low-cost approach suitable for a small firm would be that if someone is abusing your platform, you expose their account history.

What if it's not a content site? But abuse of "free" resources/trials?
Then you can adjust the meaning of my comment to encompass that. I'm not trying to describe all conceivable use cases.
This is, you might say, not just an important problem in society, but the only problem in society.

"Why do I need a driver's license? It's just bureaucracy and a revenue collection scam." Except, when you don't test drivers or provide a mechanism for taking bad drivers off the road, a few bad people spoil it for everyone.

And so on, and so forth. That is not a justification for any one thing like this, but the general principle is that when the bad actors make things toxic enough for the mainstream users, somebody has to step in, or a social platform quickly degrades until it becomes 4Chan, or Gab, or whatever.

Same reasoning behind moderation here on HN.

> "Why do I need a driver's license? It's just bureaucracy and a revenue collection scam." Except, when you don't test drivers or provide a mechanism for taking bad drivers off the road, a few bad people spoil it for everyone.

This is an atrocious analogy. The reason we require licenses for motor vehicles is that they are very dangerous pieces of machinery that can easily do fatal damage to car occupants and pedestrians, as well as property damage. Likening such a domain with that of communication and speech (what we're discussing here) is ridiculous.

Think through this analogy a little more thoroughly. Freedom of speech is an important issue precisely because it’s dangerous. Speech can ignite revolutions against unjust tyrants, and speech can also mobilize hate and terrorism.

Speech is not without consequence to society. If it was not dangerous to the lives and property of others, it wouldn’t matter so much.

I think the argument that speech is less dangerous than the right to drive a car is naïve and uninformed by both history and what we see in plain sight.

I mean seriously, can you look at white supremacist terrorisms radicalized online and tell me that speech has no consequences?

Of course it has consequences. If speech didn’t have consequences, it wouldn’t be worth defending.

———

But even if you refuse to accept that speech is dangerous, you must accept that it has consequences, that it can affect the experience of other people.

If it didn’t, there wouldn’t be a need to moderate speech on this very platform. Everyone could post anything they like. It would be more like... Maybe the right to park your car on a busy street during rush hour.

Nobody will slam into your car, but it will certainly affect their use of a common resource.

Unrestricted use of a common resource leads to a tragedy of the commons, and nobody ends up enjoying it except the vermin, who reduce each other’s enjoyment to the barest minimum.

There are two ways of dealing with the issue. You can default-deny, like only allowing people to drive after a test, or you can default-allow, like just like anything else.

We usually use default-deny only where the severity of bad behavior is very high. That's because it has a high cost for both most people and the test-issuers, and it has a very high cost to the few people caught as false positives. It is a very damaging mode for society. We are also migrating into only using default-deny on the internet, even on consequence-less contexts, and the previous paragraph still applies.

We may get a better world if we take some of the privacy away from the network level, we may even get to keep more of it overall.

Well, it works, and it's a minor annoyance at most for our legitimate customers.

Abusers, on the other hand, have to burn a phone number on each account that gets locked.

I think you don't get it. It's not about annoyance. It's about the complete unreliability of any online service today. All and every customers show (and should rightfully show if they don't yet) complete distrust for a good reason.

You are asking my phone number today and next day I will find it out in the open because of your and others' businesses don't give a .... when it comes to security.

And don't tell me that's only a minority or the exception. Because that's just simply not true.

500px, Quora, Facebook, Twitter, Equifax among others all have been hacked at one point or have been exposed as unreliable and untrustworthy. It's just simply not a logical proposition to trust any online platform with private and/or sensitive data.

We do care about security and hash the phone numbers after sending the verification SMS (we only need to determine whether a given phone number is associated with a locked account - a hash is good enough for that).

Our problem is that criminals open hundreds of accounts with fake data and stolen credit card data, abuse our services until we get abuse complaints or detect it and lock them, then repeat that. This leads to legitimate customers suffering from bad IP reputation and is expensive to clean up.

Requiring phone numbers and blacklisting known throwaway providers has been extremely effectively in preventing this, without generating complaints from our legitimate customers. We don't want to use browser fingerprinting or other intrusive mechanisms for detecting sybil registrations.

What else do you suggest we do?