I was let go for refusing to deploy a dark pattern

This is the norm.

Eventually most states passed similar laws and so we opened it up to all US accounts. I'm not sure what the experience is like today.

I.e., user can cancel subscription on website, system automatically writes cancellation letter, letter is sent to corresponding company address. If cancellation fails, then an official complaint is served to the company, and from there it follows the usual court process.

so what that Microsoft isn't alone, their (poster) experience allows them to know unequivocally that Microsoft and the employees that work there make decisions that don't align with their personal ethics -- so they take out their anger on Microsoft.

the statement '...but we all lost a little bit of faith in shady subscription business models ' makes no sense -- the shady ones don't self identify, and it's not the methodology that is generally despised, it's the entities that that employ such methodologies against the public.

I haven't been in this situation, but I always imagined that there is a simple way out: send them a certified letter instructing them to cancel your subscription. If they continue charging after that, it's chargeback time.

Any opinions on whether or not this would work?

I will never use Xfinity/Comcast again in my life if I have a choice and will try to make sure everyone knows how shitty they are. Unfortunately they have monopolies in many areas and can be as shitty as they want, but if you have a choice I recommend never using them.

I can't believe that in 2021 these tactics are still legal. It's also stupidly shortsighted because in the long term I'm pretty sure they lose money by making everyone hate them. If it was easy to cancel, I would happily sign up again in the future without giving it much thought and would think positively of the company.

Edit: I also want to add that I was paying extra to not have a contract so I could easily cancel.

If you are optimizing for money made in the next month - or even next two years - then by definition making it hard to cancel will bring in more money. But it does hurt the brand long term (which is harder to measure)

The crazy thing is they replied, but refused to take me off the list unless I sent them an actual physical letter in the post. A few emails in they claimed it was due to a "technical" issue. That BS annoyed me so much, I am now into the 3rd decade of my own personal British Airways boycott

Edit: I realise that's insane but it makes me giggle everytime I deliberately don't book BA, and I wonder to myself how much money I would be willing to loose by going for the next most expensive ticket, just to keep my boycott going

No it's not. The VP is maximizing their bonus and career growth within the company. That is likely tied to relatively short term metrics and especially to not having drops in metrics.

> How many people decided to get the new Playstation next time because of a frustrating experience cancelling their xbox subscription

If you make it hard to unsubscribe when people are short on time/money/interest, they will probably be less likely to resubscribe when they have the time/money/interest.

Long-term customers on something like Xbox Live have a larger incentive to resubscribe to recover access to their game library.

On the other hand, random web site X is probably just looking to churn through subscribers.

It's something of a tragedy of the commons; the incredible difficulty of unsubscribing from (everything that's a monthly bill) makes people wary of subscribing to anything.

Companies rely too much on analytics.

On the other hand, it's quite well-known how easy it is to stop/start a Netflix subscription.

That's not true. Governments exist to deal with this kind of situation. If companies make it difficult for citizens to cancel subscription, it is time to regulate subscriptions.

Why is the responsibility of some developers to lose their jobs to stop a company doing something that is completely legal. If they have done that, they will have my gratitude and admiration. But, the developers are not "part of the problem". Microsoft is the problem, and the lack of regulation the other part.

The one I'm still hooked on, that this reminds me I've now given something like $3,000 dollars to over 3 years because I've been too lazy to make a phone call and wait on hold, is the YMCA.

Even religious nonprofits are engaging in dark patterns.

It’s possible for the argument to be true in this context and false in another context.

My tax preparer is something like $250 a year and reduced my liability in a very tumultuous year from about $20K to about $9K by understanding what I actually had going on and helping to work through it.

Also with a lot of these tools you can configure them to redact user input so you don’t capture too much.

The least you could do is post a blog post about the dark patterns you refuse to unleash on your customer's customers and why.

Am aware of several folks going to prison from confessions when they thought they weren’t being heard.

I don't have my beliefs on the topic clearly articulated, but I'll give it a crack. There's the argument that public information is public, and that there's no issue in aggregating it or otherwise making it more accessible, as long as the access is through legitimate means. I'm sympathetic to this and understand why people believe it, but I think it contradicts other consensus moral intuitions about privacy rights. A salient example that other HNers may be familiar with is the doxxing of Scott Alexander; any intellectually honest person familiar with the internet can tell the difference between "you can find out who he is if you do some digging" and "real name published by the NYT", despite the pathetic attempts at dismissing the possibility that doxxing him was bad (amusingly, including by people who I am 100% sure would find the bikini example to be a horrible violation). Hell, I was a reader of Scott's for years before I first came across his real name. The entire social Internet is built on security through obscurity, because opsec is hard and many people aren't constantly vigilant.

There's even precedent for these intuitions outside of the social media context. It's uncontroversially okay for someone's face to show up in your photo taken in public; once you've taken it, nobody cares if you study the guy in the background. However, aggregate and operationalize this, and it changes not just in degree, but in character: It's practically a trope in thrillers for universal CC cameras + alphabet-agency elbow grease to stitch together comprehensive tracking of an individual, and the public is rightfully a little creeped out by the thought.

The main difference here is that technology, as always, is democratizing the ability to do this, pushing the threat model from the unrealistic "NSA spends huge resources to track you" to the prosaic "facial recognition can just track and store everyone's movements at low cost" (or "some under-the-radar shop is aggregating your bikini shots") and a million other mundane violations of our moral intuitions. To my mind, we're in the uncomfortable period before a new norm equilibrium is reached that matches the technological context. This has already happened locally: I'm sure this group knows people who have good opsec since the early 2010s, and "treat everything you post as if it's public" is at this point an age-worn piece of wisdom.

This is not sarcasm, or me trying to be mean.

ticket touting = ticket scalping.

Can you explain what this means and why it is a problem? --Confused

Edit: Maybe I get it. It seems certain states have made it illegal to run "happy hours", presumably because people drink too much and behave badly. https://spoonuniversity.com/place/why-did-these-8-states-mak...

I don't think there's anything about scraping that makes this disgusting. It would be equally bad if individual people uploaded compromising photos of their exes.

The issue here is that people need control — not ownership — over their image and personal data/information. (The difference I intend to draw between control and ownership, is that the legal notion of control would be written in such a way that the fine print is irrelevant. Most online systems have some fine print somewhere giving the site owner certain rights over your content. Such fine print about a person's image needs to be rendered such a risk that if a business owner suggests including something like that to a lawyer, the lawyer starts quivering in their boots. "If I include such a clause, I will never get paid, because within half a nanosecond of it being visible you will be sued into kingdom come and your great grandchildren will still be paying off your debts."

Assuming that the guy was running a happy hour in a place where they are banned, your argument reinforces the view that privacy is only needed for those who break the law.

Explaining why privacy is important is hard enough as it is. Please don't make it harder.

Happy hour here is just when you can get a $2 cheeseburger, or $0.50 wings on special. I had never even considered something like a happy hour being reflected on your insurance premium.

Also you can usually mail a check with a short letter explaining you are paying the estimated cost and caching the check is the same as honoring that estimate.

A month or so after an emergency visit to the hospital, I started getting random bills in the mail ranging in $50-$100 amounts. I went back to the hospital and asked them what the total was so I could just pay them the full amount right there, which was only about $1000. They simply wouldn't tell me. They told me to wait for all the bills. As I paid them off, there was no indication of whether I had completed all the payments.

Guess I missed one, as I also ended up in collections a year later for $50. My credit score was harmed instead of theirs.

I got the mortgage.

May I take issue with this statement?

Why do you say they are well-intended when you subsequently say that the intention is to make money? (compete to make money)

As someone who has worked with HIPAA data, I have personally seen the data treated with a great deal of thought around compliance. I think the numbers you cite are a result of that, not in spite of it. As your source points out, many of those complaints aren't eligible for enforcement. This isn't because HIPAA isn't enforced, it's because many of the people who are complaining don't know what HIPAA does.

But the US needs their own general privacy law too, GDPR is not enough, as it isn't applicable to a lot of software built in the US.

I think there is a fairly bright line in the sand for defining a dark pattern, and the line is between hiding and being open, between being misleading and straightforward, between trying to force someone to do something and seducing them with plain intentions. The later behavior can still really suck, without being dark.

Popup that asks for email address that doesn't have an 'x' (or the 'x' doesn't appear for a while) and the email address field secretly records what the user types and even though they clicked cancel their information was secretly shared: dark pattern

At what point does it not? Pop-ups exist to steal attention. It's abuse. Why do these marketers believe they are entitled to anyone's attention? They are not.

> a business owner can have a very hard time grasping why

Of course. Businesses generally couldn't care less about how much they're abusing their workers or their consumers. The only thing they care about is their profit. Dark patterns are just value extraction mechanisms, it's their abusiveness that makes them dark.

> they can often act like they're simply herding sheep. Users are ephemeral zombies to some, and from that lens, it's totally fine to capture them with sneaky tactics

Yes. It's an inherently abusive and sociopathic view. They don't consider us human beings.

I was acquainted with some black hats in junior high and high school. Guessing how they are as adults, I'm pretty sure you can always find someone who will do it for the lulz, if not for the money.

Edit: That got a lot of push back. I'm just saying, this is not the hill I'd die on. At best it would spare some small single digit percent of visitors 3 unwanted emails.

Many of the online mortgage rate tools are really just lead generation sites, including some of the big name brand ones.

One wanted me to create an account, and I got about half way through (I stupidly gave my phone number) and then exited without creating account. I believe they had a sort of "enter email, next. enter phone, next" kind of page by page pattern.

Anyway, within an hour of exiting I was getting 3 phone calls per hour from mortgage companies soliciting me for business.

I’d agree with that as long as the text is visible before entering the email address, and the text also mentions that email will be saved before completing the form.

> I bet you will see at least 5 third-party tracking scripts

Analytics and tracking scripts is a good point. Sometimes it’s implemented in a way where tracking scripts don’t have access to keystrokes, for example by iframing them, and you’d hope that the web site owner would care enough about their own security to do that. But you’re right that unfortunately it’s common. In this case I think we need some legal protection in the US and elsewhere similar to GDPR that clarifies that collecting such information can only be done with explicit consent.

The free market only works to an extent, and harm to consumers is a valid reason for the government to step in.

Real example:

Client> We want the "I agree" button checked by default

Me> I'm not a lawyer, but I think this goes against the GDPR in that users must give their consent by action, not by inaction. I would advise to at least check with your lawyers first.

Client> Oh! I'm so tired of those laws, we'll get back to you after checking.

(a couple days later) Client> Yeah you were right, lawyers say we'd better leave it unchecked.

I know that client very well. I would have _never_ been able to convince them on a morality argument.

What's more, after a few interactions like the above now they don't bother going to the lawyers anymore. I just say "I'm not sure this is acceptable" and they immediately agree to whatever non-shady alternative I propose.

And what would the language you propose look like for this legislation that doesn't have loopholes, caveats, etc for people to get around once the lobbyists are done with it?

I think the question is, are developers engineers or just programmers? The responsibility of an engineer is to give pushback when it is deserved.

As you say, the responsibility is on decision makers. But they care about the politics. They will try to make it look like you're on your own. But if you clearly demonstrate the mood of the company's employees, they will reconsider their position. The result will be compromise not capitulation but it's better for something to be better even if it isn't great yet.

There's plenty of blame to go around. But at current, we really do have to do better as a community and refuse these requests far more often than we currently do.

it's understandable why people feel that way.

Then you have the coworkers that drink the koolaid and talk as if you were in a cult.

When my client made the initial request I responded with "I don't know if that's possible OR legal" and then a couple weeks later they sent me Zoominfo welcome emails and asked to integrate into their web forms.

FWIW, my clients' forms actually display the fields (none are hidden) so I at least can sleep a little better at night.

About Costco, I really don't know, but I know some big companies can have ethics because I've worked for one. It was the best place I ever worked.

Unfortunately, it is rare these days.

    I think there's a very reasonable general expectation on the web that your data isn't used until you've clicked submit/save/etc

I wonder: do non-engineers have this expectation? In 2021?

I've been involved with web development since the more or less earliest days. Back when websites were mostly static pages, and eventually spouted some forms here and there.

But, would a non-greybeard engineer have this expectation today now that UX is generally so different and "app-like" and anything you see in your web browser can basically be assumed to be in constant communication with the server(s)?

Please note that I don't think the current state of affairs is really an improvement. In fact, I more or less hate the "modern" web. I'm just curious about how user expectations have changed.

Such an important property of the web. Server sends a description of what it wants, client renders and handles interactions. Things like server side rendering are anti-web.

Server-side rendering, streaming video, and such aren’t incompatible with internet philosophies in the slightest, just not aligned with the intent of the www. Apps, even the ones that aren’t merely web views, are more www-like in this regard.

> it's very easy to create something spammy-looking.

...and then they list "good" uses that are... all spammy.

Software engineering is largely think-work. Some of it is creatively coming up with ways to solve novel technical problems, but an often understated part is thinking about how your implementations will affect your users, and optimizing for solving your users problems.

There's a principal-agent problem here. The owners of the company don't care about a random manager's feelings. The manager certainly does, however, so much of what any particular manager will require is more about making the manager feel better than about making profits. Other employees are correct to disagree with such misuse of resources.

Granted, if you refuse to do something your boss tells you to do because it violates your concept of professional and personal ethics, they may decline to continue employing you. And you might not have a legal basis to challenge your termination if what they asked you to do is legal. But walking away from a job may be the best option in some situations.

You say that you "click through to the page that finally shows the full price." So, you are explicitly submitting multiple times. There's a reasonable user explanation that your information would be received by the server.

In the author's example, they're describing something more insidious -- saving the user's information before they submit the form, thereby subverting user expectation.

https://www.darkpatterns.org/