Comment by cwkoss | Hacker News Reader

Comment by cwkoss | Hacker News Reader

Reading https://www.buymeacoffee.com/terms

These potentially seem like some fairly onerous restrictions, and would potentially exclude nearly all of my favorite youtube channels.

What is your definition of "creators who involve with:" - does this only cover content posted on your site, or any content the creator makes across any publicly available service? To what extent can creators discuss these topics if they don't actively manufacture/promote/distribute them?

Could you be more specific about creators that are "involved in weapons" - is this anything that can be used as a weapon or specific to military/semi-military applications? Would Joerg Sprave's slingshot channel be prohibited? What about someone who makes videos about forging/sharpening knives? Are creators who discuss war journalistically or historically disqualified? Non-miltary RC drone hobbyists like Tom Stanton?

"Chemicals" seems pretty vague. Does this preclude all chemistry and biochem related content? I'm a big fan of channels like NileRed, CodysLab and ThoughtEmporium, would they be prohibited? Would videos which discuss water treatment or concrete chemistry or metallurgy be disqualifying?

"seeds or plants" - are creators who discuss gardening or farming disqualified? Cooking vegetables? Primitive Technology-style makers which discuss creating objects from plant materials?

How do you define "adult" content? Does this include creators working on LGBTQIA activism? Does this include creators who create instructional content while showing non-nipple cleavage? Does this include creators involved in sex-ed/harm reduction campaigns?

Also, are there any geographic restrictions? Can creators outside the US use your service (in countries which are NOT on the US OFAC sanction list)?

> Do not attempt to decompile or modify engineer any software included on Buy Me A Coffee site.

This is also a bit dated policy. I've reported bugs on Patreon before that involved looking at the source code and modifing it, but it did not cross my mind that they'd reserve the right to ban users for doing so. I think this is a case of copying TOS sections from other places which are not a good fit for this service.

That said, Patreon has destroyed their user interface in the past year, profiles on desktop barely contain any information above the fold, so we need competition in this space.

We do have a bug bounty and encourage bug reports from our users (https://twitter.com/PJijin/status/1186904518341955584). The policy mentioned above is to avoid any damages to the creator(s) on the platform. Thanks for the feedback!

Instead of "you are not permitted to reverse-engineer", maybe "you are not permitted to interact with the server except through the user interface produced by a web browser in accordance with the HTML-based instructions sent to your machine by our web server unless given explicit permission by us"; that effectively prevents people from using that reverse-engineered knowledge to attack your site, whilst still permitting bug reports.

I also want to push back on this.

You have a policy that guarantees every single security researcher that inspects your platform will be in violation of your TOS. But you're telling us on an Internet forum that you won't use that policy unless someone does something completely awful. That's asking us to put a lot of trust into you -- trust that you're not willing to reciprocate back to us.

People shouldn't need to break your TOS to report a bug to you, and they shouldn't need to rely on purely your goodwill to protect themselves. Security disclosure is already a really scary process, researchers need explicit guarantees that they won't be prosecuted or sued. If a company tells me that I should just trust them that they won't sue me or ruin my life over a bug report, I stop going through their official disclosure channels, because it's no longer worth the risk. Policies like this are a really good way to get security bugs reported as anonymous Pastebins in the press instead of to your official channels.

I would also note that outside of security research, this bans people from building tools around your site -- browser extensions that automate common tasks or alternate clients that call into unsupported or private APIs. I think that's a really regressive restriction for something as fundamental as a payment platform to have.

Again, maybe your actual policy will be not to go after people who build useful tools -- but in that case, why start out with a TOS that encourages an unhealthy power dynamic, that means you could shut down someone who interops with your service for any reason?

The point of a TOS is to create clarity -- it's an agreement so that both users and platform owners know what's expected of each other. I don't expect a TOS to enumerate literally everything that might happen, but I instinctively recoil away from a TOS that includes onerous restrictions that I'm told to just ignore. A rule that everyone is expected to break is really just a blanket license to selectively punish anyone on your platform for any reason. Why should I as a user trust you with that kind of power?

In regards to protecting creators and avoiding creator damages -- hacking is already a federal crime. What's something that this policy protects you against that couldn't be handled by the Computer Fraud and Abuse Act?

> Can creators outside the US use your service (in countries which are on the US OFAC sanction list)?

It looks like both payment processor integrations (PayPal and Stripe) are US based, so I think it's safe to assume there will be restrictions on sanctioned countries.

Oops, dropped the NOT when rephrasing for clarity, thanks - fixed.

>Also, are there any geographic restrictions? Can creators outside the US use your service (in countries which are NOT on the US OFAC sanction list)?

Yes, Buy Me A Coffee is available to creators in almost all countries. Here is a breakdown of all accepted countries: https://help.buymeacoffee.com/en/articles/3314992-countries-...

>How do you define "adult" content? Does this include creators working on LGBTQIA activism? Does this include creators who create instructional content while showing non-nipple cleavage? Does this include creators involved in sex-ed/harm reduction campaigns?

None of these are against the terms AFAIK. We unpublish creators who promote explicit pornography or nudity. Broadly speaking, we abide by the content restrictions of the vendors and payment processors we work with. More on that can be found here: https://stripe.com/restricted-businesses

> None of these are against the terms AFAIK

How can this be AFAIK? Aren't you one of the founders? If you don't know what your site allows, who does?

At the end of the day, someone has to make the final decision over whether to ban an LGBTQ+ activist. Who is the person who will make that decision on BMaC?

I get that you're beholden to your vendors, and to a certain extent there's nothing you can do about that. But I also assume you're not planning to just forward literally every content decision you have to make to Stripe's legal team for their input. So if a vulnerable person starts using your service, they need a better guarantee than "dunno, we'll have to flip a coin and see." You're still one of the people who are going to be enforcing this, you're still one of the people who have the power to decide how this will work.

To be clear, there are no circumstances under which we'll unpublish an LGBTQ creator. Here's a fantastic writer that I've been following for years who recently joined Buy Me A Coffee - https://www.buymeacoffee.com/pSzjB85

Our community manager deals with account reviews, and she is more knowledgeable to answer the initial question. I shouldn't have said 'AFAIK' either way, my apologies.

> there are no circumstances under which we'll unpublish an LGBTQ creator.

Does that grant them immunity from rules violations, then? I think you said the wrong thing here; what did you intend to say?

IMO the intent is to say that they wouldn't unpublish anyone just because they create content around LGBTQ. However, if they violate any other rules, then they will go through the same consequences as a not-LGBTQ content creater would go through.

You're right. Thank you.

What is wrong with plants?

Natural drugs, maybe? Seems bizarre.

If I provide a service that uses Buy Me a Coffee but outside of that I make a personal donation to cannabis legalization, you reserve the right to restrict my usage of Buy Me a Coffee? In that case I would be a creator that supports cannabis. The phrasing suggests that these terms are dependent upon the creator and not the specifically associated content.

Thanks for the response.

I'd strongly recommend trying to clarify "chemicals" and "plants and seeds" as those are incredibly broad categories that encompass many use cases that stripe does not find objectionable as per the restricted-businesses list you linked. "Pharmacologically active, explosive or poisonous chemicals, plants, or seeds" may be suitably restrictive for your needs.

The "weapons" restriction would also be great to get some clarity on: a large proportion of makers do projects related to cutting tools, replica weapons for cosplay, etc. I think showing how they make blades/saws (that can be used as weapons, but often intended as tools or decoration) or replicas or sporting equipment are not necessarily something that Stripe would find objectionable.

I suspect that stripe does not restrict content related to the discussion of these items, but rather the use of these funds towards the purchase of these items. "build journals" may be permissible, but perhaps more of a grey area. I think their chief concern is the sale of these items. Ex. showing how you built an archery bow and tested it on a sport target seems quite distinct from selling the bow itself. Explaining and demonstrating the chemistry of exothermic reactions is very different than selling firecrackers.

Some clarity would make me more interested in using your service, but I currently am not inclined to sign up as a contributor or recommend your platform as it seems you could somewhat-arbitrarily decide to exclude ~90% of my favorite creators without warning after they have cultivated contributors on your platform.

Lack of clarity can be really disruptive for creators: as getting kicked off of a platform and disrupting an income stream they've come to rely on can be very disheartening - and I've seen this happen to a half-dozen creators on various platforms. Vague terms can lead to many makers to exist in a grey area with the threat of removal at any time, which I think is somewhat harmful.

Noted. We're working on a Community Guidelines page, and I'll make it a point to address these concerns. Thanks for taking the time to share this!

Reply on news.ycombinator.com