Hacker News Reader

In my experience I had a negotiator call me the next day after filing a complaint with the public service commission about a DSL line. Cable isn't regulated by the PSC so your only recourse is through the courts if you cannot get their customer service to help you.

Of course, public service/public utility commissions were set up in a time when the law was often written to be equalizing rather than to simply entrench power.

If there were something like a PSC for larger, systemic social media etc. it could, depending on how it gets set up, be a total positive. I appreciate reasons to be skeptical it would have that effect.

I both agree and disagree. Your proposed solution is a good one (for other reasons too) but regulatory consequences can be effective if those consequences are serious enough and are actually being enforced. After the first couple 100k$ fines per banned user I will bet you good money nobody will ever be banned.

It does heavily depend on what form those regulations take though, I think there are valid reasons to ban users from a platform or prevent them from using it in particular ways (either for safety reasons or making the platform a more pleasant experience for everyone else). I can easily imagine some governments would co-opt this kind of regulation to benefit themselves or punish people and companies who aren't sufficiently supportive

Personally I think the mandated interoperability/public API is a better solution, in the best case it could lead to some actual competition and if that didn't happen atleast people who chose to leave Meta/FB would have options for maintaining the social connections

I like these two posts -- yours and the one above. It makes me think: If gov't is going to add regulation for social media accounts (something that I support), should it be a requirement to identify yourself to the social media network owner? My point: Some kind of national ID tied to your name, but kept private, so the company can absolutely say if you do or do not own the account. I know, I know, there are all kinds of holes. However, consider the alternative: What if it was not required (real ID for your social media accounts)? How could these companies reliably tie the account back to a real person making a claim? Require 2FA via YubiKey? I have learned from HN that a mobile phone + SMS just isn't secure enough in many jurisdictions. It is too easy to use social engineering to takeover a mobile phone.

Edit: I have mentioned before in previous comments (not this post): After Dodd-Frank regulations in the US, global investment banks really changed their behavior when fines became massive. So massive, it was seriously altering quarterly revenues and hurting stock prices. I favour the same type of regulation for social media network companies. It is the only way to make them listen to the law.

Yeah personally I'd rather stick to letting the companies ban who they want and letting me do what I want. If there's any ID related law, I'd rather they be FORBIDDEN from collecting IDs.

You really want social media to have the same type of access to your personal information that banks have? A know your customer type of regulation?

It amazes me that on one hand, every law related to technology that the government passes in the US, HN is almost universally opposed to. But they trust the same lawmakers “this time to get it right”.

You wrote: <<You really want social media to have the same type of access to your personal information that banks have? A know your customer type of regulation?>>

Would you support if the data leak fines were similar? I would. To be clear, I am talking about global investment bank-style "know your customer" (KYC). If retail/commercial banks leak customer PI, the fines are _immense_ in 2022. Most of them now have enormous security teams, or they pay AWS/Azure/G to do they same via consulting / cloud fees.

My financial information is much more important to me than social media.

And they don’t pay cloud providers to ensure security. AWS [1] for instance always stresses the “Shared Responsibility Model”. AWS is responsible for security “of the cloud” the customer is responsible for security “in the cloud”.

https://aws.amazon.com/compliance/shared-responsibility-mode...

There is no way in the world that any cloud provider would ever take responsible for customer workloads. If you make your S3 buckets world readable - which is really easy to do. That’s on you.

[1] I work in consulting at AWS, all opinions are my own.

It would help - immensely - if world readable wasn’t the S3 bucket default.

Defaults matter, and AWS cares more about ease of use over security. Which helps explain their security position.

World readable is not the default. You get scary warnings when you do it and you can set it up on the account and the organization level to block it. There is no “click a button to make it world readable”. You have to know the JSON policy.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/access...

You're right. It's changed - good.

However, you do not need to use custom policies - it's checkboxes on the S3 bucket creation page. And the wording on them is obtuse AF, and I know what I'm doing with AWS IAM.

Somewhat related, at least with regards to government-issued digital ID, but what are your thoughts on:

https://williamcotton.com/articles/the-tyranny-of-the-anonym...

I’m of the opinion that entities other than, eg Meta, should be responsible for identity verification.

> The abusive company can still delay and disrupt the user, force them through lengthy and Byzantine arbitration and act like total cocks because the fines are fiddling small change.

So the fines should be substantial enough to act as a deterrent. Then another option is that, for instance, if Facebook gets sued and judge agrees to take the case then Facebook should pay for the claimant's lawyers the same amount Facebook pays their own so they have a fair chance. E.g. if Facebook budgets $5m for the particular case legal defence team, they should give the claimant $5m to spend on their legal team.

Interoperability would go a long way, but if they're still expected to hold moderation privileges on their platform, they could just as easily block communications from a user who is using a non-Facebook federated system. If Facebook became decentralized, it's inevitable that there would be more spam and automated bots to deal with, so moderation would be key.

This could possibly be mitigated by giving group moderators higher privileges than Facebook moderators. So Facebook could submit a ban request, but the group admins would have to approve it. Facebook could block a public feed but not full functionality.

And how forced interoperability would work would differ in each country, but at least in the US, this could be accomplished imply by tying Title 42 privileges to federated interoperability standards.

Interoperability is great, but I think we need more than that. We need a user's bill of rights that applies to all online accounts. We need legitimate appeals processes where companies can be forced to justify their decisions to block access to accounts.

This goes beyond social media. Consumers are being asked to "buy" content that is associated with a single account that can be banned at will. "Free" email accounts are a critical part of many people's online identity.

We need regulation that protects users from capricious bans and forces companies to be able to justify their decisions to ban and face consequences when they get it wrong. I'd be fine if such regulations also included consequences for users who abuse the appeals process.

Would that also apply to Truth Social? Should HN not be allowed to ban me?

Do we want to establish a “Department of Social Media Enforcement?” Should “Christian Mingles” not be allowed to ban people that it wants?

There are already reasons that are illegal (i.e. member of a protected group that you can't descriminate against.) for ”Christian Mingles” to use to bad someone.

I am not proposing any further restrictions on what reasons an be provided to ban people.

I do think that plaforms that encourage people to become invested in them (email providers, social networks, online media "sales” patforms, etc) should have a legal obligation to explain the reasons for the ban and provide the banned user the opportunity to correct any incorrect information that led them being banned.

I don't know if a standardized arbitration process, and expansion of the civil court system, or something entirely different is the best way to approach this.

You tone comes off as very combative, like you are looking for a fight and making assumptions about my political stances that are both incorrect and detract from your ability to have a conversation.

I assume that you want more government control. Laws by definition always give the government more power over individuals. The last thing I want is government interfering with private enterprise when all people have to do is go to another website.

> Laws by definition always give the government more power over individuals.

Factually false. Some laws reduce that power. For example, a law that made it illegal for police departments to keep the proceeds of asset forfeiture would reduce the power of government over individuals, not increase it.

In this case, it does indeed create more government control, though it could be designed to limit the amount of additional control that is granted.

> all people have to do is go to another website

How does that help me when the email account I lost access to is already tied to most of my online life?

How does that help me when the music, books, movies or software I paid for is tied to the account that was banned?

How does that help me when the "website" is part of a market duopoly and losing access to it means my company will go out of business and I'll have to fire all my employees?

"go to another website" simply is not an adequate response to any of the above scenarios. Please proffer an alternative other than "it sucks to be you". The only other option I see is to make these companies common carriers and mandate interoperability / account portability. That seems like it gives the government far more power than simply mandating a fair dispute resolution system.

Forced interoperability does sound good. There are already proposals in the European Parliament for forcing interoperability on social networks.

Not only proposals: https://www.europarl.europa.eu/news/en/press-room/20220315IP...

yes because government and more laws are the answer. It couldn’t possibly make things worse to allow outside companies access to your data.

https://en.wikipedia.org/wiki/Cambridge_Analytica

Does that also mean that the company has access to all of your friends data?

Look no further than the 12 chapter 99 section GDPR and the shit ton of cookie banners it brought the web.

Would you let any company have unfettered access to your product via APIs? Should they have rate limits? Should they have to pay for access? How do you prevent a third party API from posting spam? What are the rules around being able to block the API when it behaves maliciously? Who gets to decide what malicious behavior is? How do you protect the data that is siphoned off from the API?