Medium's Policies and Guidelines | Hacker News Reader

Medium's Policies and Guidelines

github.com

37 pointssamsolomon22 comments

The title seems to have changed in the last couple minutes from "Medium puts their terms of service on github" to "medium's policies and guidelines".

Just in case anybody is wondering why medium's terms of service are at the top of HN right now

I don't know if there are other companies doing this, but putting privacy and terms of service updates on GitHub seems like a simple way to be transparent. It makes it easy to see what has been added and removed from previous updates.

All of my employer's legal documents are available on GitHub as well under the same license: https://github.com/Automattic/legalmattic

We also keep a changelog on our site as an alternative: https://wordpress.com/tos-change-log/

We've been doing this for a while at Clever: https://github.com/Clever/policies and got some other folks in the EdTech world to join us: https://www.edsurge.com/news/2015-04-08-edtech-companies-ope...

(Privacy policies are a hot topic in EdTech these days!)

We've been doing that, and every time we push it auto-pulls from GitHub. Works like a charm, and feels way more transparent.

http://readme.io/tos/

We've been doing this for a while now, which may be unique in the banking space.

https://github.com/SimpleFinance/policies

It's important to note that a malicious organization could always backdate revisions, and force push over the github repository.

All it takes is a single person having it cloned, who can call them out because the hash values would have changed. This isn't really a realistic threat.

That single person who cloned it could also backdate their hashes and claim things changed when they didn't.

Not with matching SHAs though, so someone dedicated to tracking changes would know.

Git's hashing is not cryptographically secure.

Imho such legal documents should be kept on machines under more direct control. You want to, at a minimum, be able to pull the plug if someone starts messing with the contract between you and your customers. They can do too much pr damage too quickly. I'm even hesitant to endorse hosting them via clouds.

That's really more of an issue if you are serving them directly via GitHub, or linking to GitHub. Presumably they have a local repo, so if someone did something nefarious with the revision history, it would be easy to detect, but having it online with revision history does make it more transparent.

Really, what we have here is the draft documents from which they publish their policies and guidelines, just like a public source repo is a draft repo from which production is deployed (hopefully).

There are copies of these on medium.com:

https://medium.com/policy/medium-terms-of-service-9db0094a1e...

https://medium.com/policy/medium-rules-30e5502c4eb4

https://help.medium.com/hc/en-us/articles/214151487

I don't see an indication that the GitHub version is legally binding.

Ah. Then they probably already have someone like me in their organization.

Arguably, if your code is hosted by a third-party, the legal document is the least of your problems. If someone modified your legal documents without your knowledge, you are likely to be able to fight it as having been a victim of fraud yourself, and you wouldn't be expected to abide by fraudulent contracts created by a third party impersonating you, right? (I don't really know for sure, you are the attorney, but I'd be surprised if you were liable for forged contracts)

On the other hand, if your code is modified, it can exfiltrate data that you are never getting back, no matter what the legal system says. Even credit card numbers are not the worst, since in theory you can end up reversing every single fraudulent transaction made, and insurance might cover your liability. But in the case of Medium, it could, say, leak the real world identity of a blogger or citizen journalist in a place where doing so would put their lives at risk. So if you are already trusting a third party with the lives of your users who are trusting you with their lives (whether they should or not), is having the text of your EULA swapped by the lyrics of "I am never gonna give you up" really a worst case scenario?

At this point, given how many people use it as the authoritative source for their software, GitHub is already critical infrastructure, on par with GPS and the electrical grid of many countries. So if GitHub goes rogue or is compromised, the damage can be pretty catastrophic. Brave new world, ain't it?

>> Arguably, if your code is hosted by a third-party, the legal document is the least of your problems.

It depends on who you talk to. The legal dept would say that code can be replaced. The coding people similarly look down on contracts as paper anachronisms. Which matters more depends on the situation. The one that matter in any moment is whichever has been attacked most recently.

I would say that errors in a contract are more expensive to fix than code. A change to code can be patched once detected. But drop a key line from a contract, perhaps the limitation on jurisdiction or arbitration, and you might be stuck with costly litigation even if you make a change asap.

But would you be actually responsible for it if someone changes your contract without your knowledge? Even if you are the one serving it?

So, if I went to a car dealership with my own modified contract in hand, and surreptitiously changed it for the one being put forth by the dealer and got him to sign it, would he be bound by that contract? (independent of whether or not I am committing a crime in that scenario)

Re: The code can be replaced. Sure, I am not worried about losing code at rest, for anything non-trivial you should have plenty of copies of a git repository anyways. But if modified code gets deployed, then suddenly you can take actions that might cost human lives or leak sensitive data and that genie can't be put back in the bottle, at any cost.

Whatever happened to that XML alternative Linus was working on? It was supposed to be very similar to git but document-focused.

Intriguing. Where'd you hear about it?

I read about it here on HN but this seems to be the original post: https://plus.google.com/+LinusTorvalds/posts/X2XVf9Q7MfV

I think have seen this used for laws and law changes. Im surprised it has not been massively adopted

Reply on news.ycombinator.com