Comment by shaftway | Hacker News Reader

Comment by shaftway | Hacker News Reader

Parent Full thread

I completely agree. When rules aren't codified it invites biased interpretation of them.

However....

I've worked on an internal communications platform. For some reason people would forget that they were on a corporate site with their corporate email linked to it and spew garbage that any decent person would be embarrassed to say out loud.

So we deliberately didn't codify our rules. We chose not to because we were aware that if we did then people would deliberately cozy up as close to the line as they could, and that wasn't the kind of environment we wanted to foster.

We avoided bias by removing information about the flagger or flagee when content was flagged and judged it based on the content ourselves. After we judged we'd look up who was responsible for the content, and if we felt they were doing some penetration testing to see exactly where those lines were we would start to loop in their manager, HR, legal, and anyone else we felt should be aware. Our escalation procedure went up to banning, though nobody ever reached that point. And our content improved.

If the story ended there I would still be against not having codified rules, but begrudgingly accept that it worked in that situation.

Unfortunately the story doesn't end there. Staff was hired so that engineers wouldn't be responsible for this. The staff was less familiar with the ecosystem and they proceeded to clamp down more and more on acceptable content. They cozied up to HR and legal who were never really comfortable with the permissiveness of the platform, and received praise and additional funding to grow the team for these clampdowns.

I left the project and haven't looked back.

You're right, "I'll know it when I see it" is a garbage sentiment that at best is a cop out, but too often is used to withhold rules and keep people in the dark as a power play, or even squash dissenters with arbitrary and unbalanced application of force.

To begin with, I think they made it to accommodate Tencent, who once threatened to pull Wechat from App Store if they don't let them use their own payments.

First, they used them for transfers only, but later came games, and etc.

Because it is not about fairness or rules. It is about extracting as much values as possible from app developers.

That made sense when the Apple store was a small kind of start up enterprise. Nowadays, it should be regulated so all developers can use the platform in a level field where competition is real and it is not just a game for big corporations.

Regulating the app store isn't beneficial. They should be able to reject bad apps for being bad without having to go to court over it.

The problem is that they restrict the user from using any other app store. So then when they get it wrong there is nothing anybody can do. And then they have less incentive not to get it wrong, because it's much harder for them to lose users to a competitor, so then they prohibit things the user actually wants more often.

The reason why developers want to make apps for iOS is because there's a large market. That market exists because Apple has done a great job prioritizing the protection of their customers' privacy and payment information.

If third party App Stores are ever forced onto iOS devices, that market vanishes completely. Crashes, slowdowns, battery drain, malware, and information theft will become the norm. Go no further than your gaming PC to witness the nightmare that is multiple app stores all competing for CPU and control/surveillance of your system, all needing to bring their own flavors of information-harvesting/exposing DRM.

This new round of digital YIMBYism is profoundly anti-consumer and stands to destroy the trust that Apple has built with its customers. I sincerely hope that those of us who have trusted Apple with our data will start to speak out before Google-backed lobbyists tranform iOS into a malware-ridden hellscape.

I don't see that at all. The value Apple supposedly provides is safety. If consumers want the safety that Apple offers, they can continue to limit themselves to Apple's App Store offerings, while those who don't value safety as highly can use a different app store. Just because you value something in a certain way does not mean everyone else should be forced to adhere to those same values.

> If consumers want the safety that Apple offers, they can continue to limit themselves to Apple's App Store offerings, while those who don't value safety as highly can use a different app store.

I'm not even convinced that those who do value safety as highly wouldn't be better off with other stores. For example, Google Play has the actual Tor Browser, with all of the anti-fingerprinting work they've put into it, which isn't available on iOS because it isn't Safari. I think F-Droid does a better job of keeping out malware than Google or Apple, because by their nature they're more selective of what they put in. The platform's own store is going to be under a lot of pressure to include e.g. the Facebook app, whereas F-Droid is happy to not. And there is value in that to the user who places a high value on safety and security.

When you allow additional app stores, you encourage companies--like, say, Epic Games--to convince people who do not understand the ramifications or the threats involved with opening up past a rigorous review process to do so. And Epic isn't going to be following behind for the newly-credulous when they pick up another one and it's full of dangerous shitware.

Somebody who wants to not use the App Store can buy an Android device. It's fine. It's fine.

This is a really easy problem to solve - add a scary sign and/or void the warranty when a user decides they want to use an alternative app store. Then they at least have the option - and if they take it and suffer, they're the only one to blame. There's absolutely no collateral damage among users, and this feature would not meaningfully weaken security (if implemented properly) - "the user could do something dumb that only affects them" is not reduced security.

"This user just gave a third party their entire contact list" certainly does harm other people.

"This user just had their entire camera roll exfiltrated" certainly does harm other people.

These are social devices. Their users are, by and large, non-technical and incurious. Expecting them to not just click past the "scary sign", and so condition to do it again and again, so they can play Fortnite is a level of lack of understanding that borders on incredible.

...neither of those attacks you gave are unique to smartphones. Someone can leak personal information through any number of other channels - for instance, entering someone else's personal information into a website that send out emails for a group party invitation.

> Expecting them to not just click past the "scary sign", and so condition to do it again and again, so they can play Fortnite is a level of lack of understanding that borders on incredible.

That's not an excuse. This is bad behavior. It doesn't matter if it's common, or expected - it's wrong, and their responsibility for correcting - not Apple's, and especially not at the freedom of other users who have nothing to do with these idiots. If this behavior is normal, then we need to make it not normal, not continue to compensate for their ineptitude. Fix problems, don't avoid them.

They did fix the actual problem here: the complete intractability, to the point where your dismissal reads as at best impossible optimism, of expecting users to secure their devices when given the opportunity to get a sick screensaver or a game.

I appreciate the fix. And I don’t want to be hectored by bad actors to fuck up my phone for their profit margin.

Buy Android if you do. That “freedom” is right there for you. I used to buy Android when I thought I cared about sideloading; I don’t, so I don’t. Do likewise!

> If this behavior is normal, then we need to make it not normal, not continue to compensate for their ineptitude. Fix problems, don't avoid them.

This sounds great in theory, but two decades of history of malware on Windows have already taught us it is hopelessly impractical.

Possible credulous users cannot be the one-size-fits-all excuse for blocking the freedoms of everyone. There are many ways to mitigate any conceivable concern without abrogating the freedom of a phone owner to run the software they wish on their own device.

You have a perfectly viable platform that lets you run whatever you want on it in Android.

Go do that if you feel the need. Nobody's stopping you.

> The reason why developers want to make apps for iOS is because there's a large market. That market exists because Apple has done a great job prioritizing the protection of their customers' privacy and payment information.

You vastly overestimate the number of figs the average user gives about most of the privacy problems that HN grapples with. The average user, after all, uses Facebook. What the average user wants is for shit to just work.

The reason that iOS is a huge market has less to do with that, and more to do with all the other aspects of what makes a good phone.

You argument is also somewhat undermined by the existence of... A rather large amount of crap on the App Store. Somehow, the iPhone has managed to survive.

... Also, cutting side-deals with apps created by billion-dollar players, and telling all other app developers to pound sand (Regardless of the quality of the apps in question) is the main problem we're talking about. Whether or not Apple does this has no bearing on the current quality of the iPhone (But has a lot of bearing on their bottom line), but has a large bearing on the future quality of the iPhone (A vibrant app ecosystem is healthier then one where a few hand-picked winners are rewarded, and their competitors can never compete on an even playing field. At least, that's what advocates of open markets tell me.)

Breach a user's trust and/or misuse their data and you'll know about it pretty quickly. I'd wager that the average user cares much more about protecting, say, their browsing history, than they care about petty B2B contract drama.

> Breach a user's trust and/or misuse their data and you'll know about it pretty quickly.

> I'd wager that the average user cares much more about protecting, say, their browsing history,

No, you won't, for a lot of reasons.

1. If people gave a fig about their browsing history, they wouldn't have Facebook accounts. (Which, combined with tracking cookies, do a great job of leaking their browsing history.)

2. If people gave a fig about their browsing history, they wouldn't use browsers with omnibars.

3. Or browsers which sync their accounts across multiple computers/devices.

3. People don't even understand which part of the tech stack (The OS, the app, the browser, the website, the third-party cookies served by the website) that they use actually compromises their information.

4. Unless you're a political dissident being hunted by the CIA, the House of Saud, and the Mossad, when this information is compromised, the harm is difficult to quantify, and is never directly linked to the part of the stack that caused the compromise.

Ask five different people 'Who knows your browsing history?', and you will get five different answers, all of which will be wrong. If normal people cared about this in the particular, they'd be tech-literate about this sort of thing. They aren't. As long as some asshole is not using that compromised browsing history to harass them personally, as long as it's being used in the abstract, by some information broker to show them ads, most of them don't give a damn. I know that they don't, because they don't take any steps to secure it.

Obviously, the users don't care about the B2B spat between Apple and developers. I'm not asking them to - I'm pointing out that rigged markets rarely produce good products.

This is a good example of the contradictions in free market dogma. The reality is that the Facebook as it exists in the "rigged market" of the App Store violates users' privacy less than the "free market" versions on other platforms. Apple's restrictive policies have made them the only company to (have the power to) put checks on Facebook's information harvesting.

The issue is not that Facebook is restricted from doing some things in the App Store, that they aren't on other platforms. That's a strawman, that nobody in this thread is complaining about.

The issue is that the rules for Facebook on the App Store isn't subjected to the same rules as <Small competitor> on the App Store.

> I sincerely hope that those of us who have trusted Apple with our data will start to speak out before Google-backed lobbyists tranform iOS into a malware-ridden hellscape

Ive had iPhone for the past year, but before that I had many years of Android. I really don’t see my years on Android as hellscape. I never had any malware, I mostly used google play store but also sideloaded some “grey” software (a mobile hearthstone client before the game had a real mobile client). I think at some point I installed amazon App Store but not sure why.

I also can’t say that my recent Apple experience is smoother than my android experience. On my iPhone 11 Pro I’ve had multiple experiences where some app after a while started to crash on startup and clearing data didn’t help. They had to be explicitly removed then reinstalled. My previous phones (Samsung S8 was my last Android) didnt have this or really any issue.

> I never had any malware

I think you need to be careful about taking your experience as a sophisticated user that understands how to avoid malware and extrapolating that experience to the general population.

There's a reason fake Fortnite APK links have been plastered all over the internet and are successfully tricking less knowledgeable users into installing things they did not intend.

This argument doesn't hold water because it applies as much to the choice of phone as the choice of app store. There have been phones that come with malware preinstalled:

https://www.zdnet.com/article/more-pre-installed-malware-has...

A user who acts without knowledge or advice buys that phone and is infected. A user who acts without knowledge or advice buys an app from a store operated by the people who made that phone and is infected. It's the same scenario.

So how do you justify forcing the people who do know what they're doing to choose which app store they want to use based on which phone they want to buy, instead of allowing them to choose independently?

> There's a reason fake Fortnite APK links have been plastered all over the internet and are successfully tricking less knowledgeable users into installing things they did not intend.

There is a reason, but it's not the one you're implying.

The problem with having a single dominant app store is that it has given people no experience in how to be safe in installing apps from other sources, so then when an app they really want gets kicked out of the dominant store, they mash whatever buttons they think will get it back. Whereas if there were multiple major trustworthy stores, the users of an app whose developer is having a dispute with one the stores could safely and easily switch to another well-known store.

Meanwhile the users with iPhones can't mash buttons to get somewhere stupid, but they also can't do anything to install Fortnite on their phone right now, which is still worse for them than having it available in a trustworthy store other than Apple's -- which would keep them from getting the point of wanting to mash buttons.

> This argument doesn't hold water because it applies as much to the choice of phone as the choice of app store.

That's silly. The number of people who might buy a specific no-name budget brand of phone with this problem is much, much smaller than the number of people that search for "how to install Fortnite" on Google or Youtube and end up clicking on a fake installer instead of the real one, because they can't find Fortnite in the Play Store like they can with all their other apps.

The implication of your argument is ridiculous. Oh, you might accidentally buy a phone pre-loaded with malware, so we might as well give up and not bother taking any other steps to prevent the spread of malware on the rest of our phones?

> The problem with having a single dominant app store is that it has given people no experience in how to be safe in installing apps from other sources, so then when an app they really want gets kicked out of the dominant store, they mash whatever buttons they think will get it back.

So the fact that Windows has never had a single dominant app store means Windows users must be particularly experienced in how to be safe in installing apps from other sources? This does not match reality.

> The number of people who might buy a specific no-name budget brand of phone with this problem is much, much smaller than the number of people that search for "how to install Fortnite" on Google or Youtube and end up clicking on a fake installer instead of the real one, because they can't find Fortnite in the Play Store like they can with all their other apps.

If you search for "how to install Fortnite" then you get this:

https://www.epicgames.com/fortnite/en-US/download

Which is actually how you install Fortnite and not a fake installer.

People end up with the fake installer in the same ways they end up with the malware phone.

> Oh, you might accidentally buy a phone pre-loaded with malware, so we might as well give up and not bother taking any other steps to prevent the spread of malware on our phones?

There are a hundred ways to prevent the spread of malware without prohibiting multiple app stores. Allow third party apps but scan them for malware first. Get your apps from another app store, but that store checks it for malware. The only thing we give up on is the thing which is anti-competitive.

> So the fact that Windows has never had a single dominant app store means Windows users must be particularly experienced in how to be safe in installing apps from other sources? This does not match reality.

Have you used Windows lately? It comes with built in virus and malware detection for free and which doesn't expire. People are increasingly getting their software from stores like Steam and EGS which evict malware, which they can do even when they have competitors. Or getting it directly from well-known developers who they trust, like Mozilla or Adobe. Things that have no reason not to be web pages, are web pages. It works fine, even though you can still technically click through five warnings and run random garbage from the internet, because people have actually learned not to do that.

The people who haven't aren't the majority, they're the same people who buy the malware phone.

The problem is not everyone clicks on the right link. Non-sophisticated users looking for Fortnite don't even know what Epic is or whether or not they're the official place to get it.

https://blog.malwarebytes.com/cybercrime/2018/06/fake-fortni...

> There are a hundred ways to prevent the spread of malware without prohibiting multiple app stores. Allow third party apps but scan them for malware first. Get your apps from another app store, but that store checks it for malware.

The App Store review process checks for more than just malware. It also enforces privacy restrictions and ensures that developers aren't abusing legitimate APIs for malicious purposes. Malware scanning isn't going to prevent third-party apps from slurping all your friends phone numbers and selling that data to advertisers.

> People are increasingly getting their software from stores like Steam and EGS

Which is why we now have malware floating around masquerading as the Epic Games Store.

https://www.zdnet.com/article/new-lokibot-trojan-malware-cam...

I think you're making the same fallacy as the person I originally replied to, which is taking the experience of a highly technical user and assuming everyone else knows how to do the same things you do. I use all four platforms (iOS/Android/Mac/Windows) regularly. I've personally never had problems with viruses/malware on Windows, even back in the XP days before Windows Defender was a built-in thing. But simultaneously I don't believe my experience is typical of the majority of users on those platforms.

Maybe because Amazon App store used to cough up one paid app for free / day to get users to use their store.

If consumer trust were the foundation of Apple's growth, they wouldn't have to worry about folks defecting to another app store if it was available.

The reality is that, having created a great market, they are now extracting rents by using their ability to exclude apps to enforce things that don't benefit users but expand their margins (like forcing use of their identity and payment systems).

> If third party App Stores are ever forced onto iOS devices, that market vanishes completely. Crashes, slowdowns, battery drain, malware, and information theft will become the norm.

This is a wild projection. Having alternative app stores on iOS, especially if gated behind a hard-to-find switch with a scary warning sign, will be totally different than any PC experience, partially because iOS has a sandboxed architecture (and incredibly solid engineering in general) that is far more secure than Windows, and partially because Windows allows you to install stuff incredibly easily with no signing or app store required. It's really obvious that iOS will have a fraction of the security issues that Windows has had over its lifetime.

I mean, is it really that far out there if you look at the past two decades of history of malware on Windows and particularly Android?

Sandboxing has not prevented the proliferation of malware on Android, why would it be any different on iOS?

Sandboxing also doesn't really address the other major risk which is theft of personal information by supposedly "trustworthy" apps.

Malware is less of a problem for Android now than any point in Windows' history except for possibly the past few years, so I think that sandboxing has succeeded rather well, given that Windows has had 34 years to evolve defenses and Android has only had 11. Even early on in its life, Android was still better off than Windows at the time, and what do you know - Android has allowed sideloading and alternative app stores this entire time. That is, Android is doing now what we're discussing what Apple might do, and it's worked out pretty well for them.

That's not exactly a ringing endorsement, is it? Sure, the malware situation on Android is better than Windows. It's still far worse compared to iOS.

https://arstechnica.com/information-technology/2020/02/resea... (Note the date. This is an ongoing problem.)

https://www.theverge.com/2019/7/10/20688885/agent-smith-andr...

https://securelist.com/skygofree-following-in-the-footsteps-...

https://arstechnica.com/information-technology/2016/07/virul...

Don't you think there's a direct correlation between the ability to install APKs from random shady internet sources and the spread of malware on Android? Even macOS has a worse malware situation than iOS for the exact same reason.

If you believe this has "worked out well" for Android, you and I must have very different definitions of the phrase.

You also didn't address my other point, which is sandboxing is only meant to address operating system level security, not developer abuse of legitimate APIs.

> That's not exactly a ringing endorsement, is it? Sure, the malware situation on Android is better than Windows. It's still far worse compared to iOS.

> If you believe this has "worked out well" for Android, you and I must have very different definitions of the phrase.

Yes, it's a ringing endorsement. Android is good enough - actually, better than good enough. I've seen at least five cases of Windows malware from friends and family over the years, and zero Android cases.

As the article you listed above shows, xHelper has had 33K detected cases. That's literally two decimal orders of magnitude less than Conficker, which had over 9M cases, in 2008, when there were, if anything, fewer Windows devices than there are Android devices now.

iOS is only better than Android because it sacrifices a lot of user freedom for a little security - which is not an acceptable tradeoff. If I pay for a device, I (should) own it - not the company. If you, personally, are not going to check the box that says "let me install third-party apps" then you, personally, are at no risk of infection, and you have absolutely no right to tell me that you think that I should not have the right to check that box.

> Don't you think there's a direct correlation between the ability to install APKs from random shady internet sources and the spread of malware on Android? Even macOS has a worse malware situation than iOS for the exact same reason.

Yes, there's a direct correlation. If you give users sharp tools, the dumb ones will stab themselves. This is normal, and good. Users deserve the sharp tools. Put a sheath around them, but device makers intentionally restricting users from things that they might reasonably want to do, for the sake of their own profit, is borderline theft.

> You also didn't address my other point, which is sandboxing is only meant to address operating system level security, not developer abuse of legitimate APIs.

Yes, because developer abuse of legitimate APIs is irrelevant to what we're talking about here, which is whether or not to allow third-party app stores. Why? Because (a) both Apple and Google's app store review processes have let malware through before and (b) sandboxing, which doesn't necessarily prevent developers from abusing legitimate APIs, is necessary for it - and both iOS and Android take advantage of sandboxing to make it harder for devs to do bad things. For instance, iOS (now) gives you a notification if an application accesses the clipboard. Even better, there are modifications for Android that allow you to intercept and fake API data (so that an application doesn't refuse to work if you deny it access to an API) - which is significantly better than anything you can get on iOS.

Sorry I didn't see your reply earlier.

> As the article you listed above shows, xHelper has had 33K detected cases. That's literally two decimal orders of magnitude less than Conficker, which had over 9M cases, in 2008, when there were, if anything, fewer Windows devices than there are Android devices now.

That's some odd cherry-picking when I actually listed several different articles with much larger case counts. If it's magnitude you're looking for, HummingBad has infected 85 million Android devices, Chamois has infected 199 million, SimBad has infected 150 million. If you total up all of the Android malware attacks since the platform launched you're looking at several hundred million infections at the very least. This is not a small problem and is far from "good enough".

> Yes, because developer abuse of legitimate APIs is irrelevant to what we're talking about here, which is whether or not to allow third-party app stores. Why?

Sorry, I disagree. There are many APIs that can be used for legitimate purposes (for example loading my contacts so I can message my friend) that can be abused by developers who don't care about privacy (for example subsequently scraping my contacts and selling them to advertisers without my consent). Sandboxing or permissions or notifications don't really help address this issue, whereas at least with an app review policy you can say this behavior is unacceptable and you will be banned if you abuse it. Will the review process catch all of theses abuses? No. But it serves as a deterrent, and if you're comparing an app that is distributed via the App Store and subject to its privacy rules versus a version distributed directly via their website where they can do whatever the hell they want, I'd prefer the former any day. That's why it's relevant to the discussion of third-party app distribution.

> both Apple and Google's app store review processes have let malware through before and

No process is perfect and of course sometimes things will slip through the cracks, that doesn't mean there isn't value in the process. The statistics indicate that malware is a significantly larger problem on the Android platform compared to iOS and this is directly tied to the existence of side-loading and third-party App Stores.

1. Android is responsible for 47.15% of mobile malware infections compared to 0.85% on iOS. Windows accounts for 35.82% and IoT devices take up the remaining 16.17%. In other words, Android is now a larger malware vector than Windows itself, and your suggestion that malware is less of a problem on Android compared to Windows is statistically incorrect. (https://onestore.nokia.com/asset/205835)

2. Google's own reports show that Android devices that use side-loading have an 8x higher incidence of malware compared to devices that only use the Play Store, meaning it's specifically direct downloading and third-party stores that are the cause of the problem. (https://source.android.com/security/reports/Google_Android_S...)

> If third party App Stores are ever forced onto iOS devices, that market vanishes completely. Crashes, slowdowns, battery drain, malware, and information theft will become the norm. Go no further than your gaming PC to witness the nightmare that is multiple app stores all competing for CPU and control/surveillance of your system, all needing to bring their own flavors of information-harvesting/exposing DRM.

I am sorry but this is just FUD.

I own both a Macbook Pro and PC that I built and I have yet have these supposed "multiple app stores nightmare" that you are talking about.

Do you own a Windows machine yourself? Because the above comment doesn't seem to be done in good faith.

There is literally malware spreading by masquerading as the Epic Games Store: https://www.zdnet.com/article/new-lokibot-trojan-malware-cam...

I still fail to see how this will apply to iOS.

iOS doesn't magically lose it's sandboxing and become Windows just because 3d party stores are allowed.

Sandboxing didn't prevent fake versions of Fortnite and other serious malware from spreading on Android, nor does it generally prevent information theft and privacy violation through malicious use of legitimate APIs.

I don’t know if you have seen the trash heap of bad apps that is on the App Store. It gives the distinction impression that Apple does not reject bad apps, only apps they don’t like for arbitrary reasons.

I do agree that the best solution would be allowing third party stores.

Just because bad apps may make it onto the app store doesn’t mean Apple’s implementation is failing. Security holes are not discovered in a vacuum. It’s like playing wack a mole. For obvious points just like at how Epic got banned from the App Store. They snuck in a direct payment option and got approved for release, only later did Apple find out. It’s possible that those bad apps snuck in malicious codes and the app reviewer missed it. It happens. However without Apples review and ability to act as goal keeper there would be much more of those kind of apps,.

I’m not sure how third party stores are the best solution to this. That means users would have to trust another gate keeper for security and validation. 3rd party app stores will just increase the possible of malicious apps

Or just charge a flat review fee.

The only loophole I can see is to have web app stores because you can’t ban browsers. Web apps may improve greatly as lower level browser APIs like Houdini become available but I don’t think that will be enough. I think that html should be replaced by cross-platform native apps distributed over http.

Unfortunately, Apple controls the browser channel by mandating the use of their engine, WebKit, which is suspiciously limited on the features that make web apps close to native, Store-distributed apps.

The fact they need rules to enforce use of their inferior payment system shows how inherently anti-competitive IAP is. If it were optional and you could freely roll your own purchase mechanism, most (not all) developers would remove Apple IAP with the current 30% fees.

...and I would go from spending one or two hundred a month on IAPs, and spend zero instead. There is no way I’m giving an app my payment info.

How do you make online purchases? Do you just... not? Is the use of independent payment systems on the Web somehow different from in iOS apps?

Use an intermediary like google wallet or a one time virtual cc?

In which case OP should have no problem using the same solution for in-app purchases.

What about “roll your own” equates to google wallet? That’s very much not roll your own, and not what the grandparent was arguing.

You misunderstand. The customer can use Google Wallet if he wishes.

On the Web, payments almost always go through the credit card system, using one of many payment providers (PayPal, Stripe, etc.) set up by the seller. The customer also has the option of using a "safer" virtual credit card to avoid the possibility of credit card theft.

Yeah, the thing is to have codified questions. Seems weird but that's how the law does it. We are always asked to frame things in terms of what a reasonable person would find explicit, threatening, likely, implausible...basically, the law asks you: can you answer this question with a straight face?

I think there is a difference in kind over rules that govern paid employees, and rules that govern developers who are paying to be on the platform, and told to design and innovate, but if you step over a line we're not going to write down, we'll kick you off the platform and damage your business.

Doesn’t sound like a platform I’d want to bet my business on.

Your codified rule was “don’t habitually say stuff you don’t want to be attributed to you with your manager, HR, legal, and anyone else at work you don’t want reading it”.

Seems pretty straightforward to me.

Reply on news.ycombinator.com