Diseconomies of scale in fraud, spam, support, and moderation
danluu.com
danluu.com
One reason that the article does touch on is the detachment from support. Large companies no longer need to care about the individual consumer, so they stop doing so. A sort of corollary for this is the tendency for large companies to shift from "doing what they do" to protecting their market position. That means spending more time on non-core activities, and in some cases even trying to expand into totally unrelated markets (as seen with large conglomerates).
It is only when we talk about "economics" in the sense of money-making for an individual company that "economies of scale" are a good thing. In the sense of benefit to the overall economy, to the society in which that economy sits, or to humanity in general, virtually all economies of scale are actually harmful.
I think we should view economies of scale like the rampant growth of grass or weeds: they are natural phenomena, but that doesn't mean they're good, and in fact for most practical purposes they need to be actively opposed. It's natural for grass to grow, and if it doesn't, it may indicate a problem, but you should still cut the grass every so often. Likewise it is natural for companies to grow, but big companies should regularly be broken up simply because they have become big.
You had me until here.
Economies of scale in commodities is the thing that makes it so we don’t have to do sustenance farming and everyone gets to have sewn clothes on :)
There’s truth in both sides there - we want nail production to not be done by hand, but also real humans with power to change things to answer the phone when we call support.
The economies of scale that put food on your table and mine and clothe our kids - for all the horrors - will not be replaced by artisans doing small batch t-shirts from yard-grown cotton using hand made tools.
That isn't what I'm talking about. There is a lot between that and transporting everything multiple times across the globe just for the sake of making it as large scale as possible. What is the gain after you can reliably feed a few looms?
There are no better tools by the way. It's people sitting behind sewing machines, just on the other side of the planet.
I think my argument was mostly like - don’t throw out the baby with the bath water; economies of scale are a real thing that brings us real benefits, and that should go in the scale too.
I don't think obfuscating "there is a dropoff point in size where economies of scale stop being better for humanity and start getting worse" with "we must switch to artisinal backyard t-shirt making" is really steelmanning here.
The sheer size and scale of the economy we live in, and it's benefits, is so big that people tend to make sweeping pronouncements without really understanding their impact.
The point about industrially produced cotton is exactly right: people pick some niche thing they view as "wasteful" and vastly over estimate it's importance or impact.
In any case, I'm not sure I agree that economies of scale are the thing keeping food on the table. Like, yes, we want nails to be made in some efficient way, but that's not what I mean by "economies of scale". What I'm talking about is the size of the companies involved. If there are 10 factories making nails, I'd rather have them be run by 10 different companies than one. And you might be able to convince me that 9 or 8 or even 5 companies is reasonable, but not one or two.
The process that the companies use can involve something that you might call an "economy of scale" in the sense that you need to be making X number of nails before it becomes feasible to shift from artisans to factories. But you have to make sure that the economies of scale are facilitating the making of nails rather than the making of money for the nail companies.
I would say this: I agree with you that massive faceless monopolies with no accountability are terrible, and often a direct consequence of economies of scale.
It is also, simultaneously, true that the labour saving effects - human hours spent per calorie of food or pair of socks - is a number of orders of magnitude such that modern society (ie the not starving/not freezing part of it) could not exist without it.
These two things are simultaneously true, which is what makes the problem hard; we want one effect of economies of scale and not the other.
I feel like the main problem people are having with my comment is I said "virtually all" economies of scale and forgot to say "beyond a certain point". By "all" I meant "across all domains" (as opposed to just content moderation), not "of every possible size all the way down to individual artisans". I agree that there is some level of economy of scale that is probably required for things like production of clothes, but I think we should try to keep companies close to that level.
Your mention of 9 companies vs 2 also tells me you're trying to describe oligopolies.
Well, a nail is fungible, as are many other products. So what you'll end up with instead is a bad situation on its own.
The 10 nail factories win sales contracts by competing on price (obviously), so there is a massive incentive for the companies to undercut each other by going offshore, exploiting their staff (which usually leads to an enshittification across the industry), exploiting the environment (by "saving" on emission mitigation or outright handing waste over to the mafia instead of recycling) or by cutting corners in the process (water down the material composition with cheaper raw materials or be less strict in outgoing QA and hope the customer doesn't notice). In the end you have 10 companies shipping crap nails but since they were so much cheaper than what was there before, there are no high quality nails on the market, and no bank will give anyone a loan to try and start up a company selling high quality nails.
We've seen that happening quite often over the last decades... UK and German public transport where the "private" competitors have reduced staff and maintenance to the utter bare minimum, "chinesium" being so widespread it's a legitimate meme, or by Europe being completely dependent on India and China for basic pharmaceutical compounds.
In contrast, a government controlled (or outright owned!) monopolist has entirely different priorities, and the customers/citizens will get high quality products again.
There are really two different kinds of economies of scale.
One is the one you ordinarily think of, where you're big enough to amortize certain fixed costs over a lot of units so the fixed costs become a small part of the price. But the scale you need for this isn't all that large in most cases, and more than that leads to rapidly diminishing returns.
The other is market power. You're so big that suppliers and customers and governments have no choice than to deal with you and then you can dictate terms. This is where we're supposed to have antitrust laws, and not have regulatory capture by industry incumbents, and on that front we've failed spectacularly.
For example, for Boeing and Airbus these two scales are pretty close because modern airliners are very expensive per unit, and fixed R&D and tooling costs are sky high. Another example is TSMC.
However, none of that applies to internet search, social networks, web services, and most other goods and services.
Not as many as you might think.
> For example, for Boeing and Airbus these two scales are pretty close because modern airliners are very expensive per unit, and fixed R&D and tooling costs are sky high.
Things that are very expensive per unit are where you don't need economies of scale, because the unit cost can absorb a lot of bespoke custom work.
What's going on in the airline industry is regulatory capture. Instead of training pilots how to fly "planes" and requiring planes to have standardized controls, the law requires them to be trained on a specific plane from a specific manufacturer. So the law requires the pilots to have "economies of scale" in order to make new design viable, even though a given pilot is generally going to be flying the same type of plane all the time or only one of a very small number and individual pilot training is extremely expensive (also as a result of regulatory rules).
The incumbents like this because it makes it hard for anyone new to enter the market because customers don't want to recertify their pilots on a new type of plane. The rationale for this is nominally safety, but it's not accidentally structured in a way that creates a regulatory barrier to entry, and it's the thing that led to the 737 MAX debacle, which is not an instance of safety occurring.
You also have design vs. manufacturing. Boeing doesn't have to be a vertically integrated conglomerate. One company could design a plane and then license the design to arbitrarily many others to manufacture them. The manufacturing companies themselves wouldn't have to be vertically integrated, you could have separate companies each making screws and fuselages and doing final assembly.
The designs could be protected by patents which then expire, so that anyone could manufacture the already-certified design of a plane once the patents expire.
This is all happening the way it is because the laws are purposely structured to make it happen, not because of any intrinsic characteristic of the underlying economics.
> Another example is TSMC.
This is plausibly the best real example, but it's also kind of not. TSMC currently has the best process, but it's only marginally better than Intel or Samsung. There are instances where that matters, but even more instances where it doesn't, and it wouldn't be two years of TSMC resting on their laurels before they were overtaken. And there are a lot more companies in semiconductor manufacturing than even those three: Global Foundaries, Nanya, SK Hynix, Micron, SMIC, Kioxia, etc.
What's really happening there is that it's a highly competitive industry where spending more on R&D yields an advantage. That isn't exactly economies of scale, it's more like the other way around. You get lots of scale if you have a competitive process that customers want.
Conversely, you get a competitive process by spending a lot of money, which is fungible and doesn't inherently need to come from having any scale at all in the existing industry. People speculate about Apple designing their own semiconductor process even though they don't currently even have their own fabs, and they could viably do it, not because they have extensive existing internal fabrication volume but only because they have money.
And Apple gets their money from having a lot of scale in another industry, but you don't even need that. All it would take is a charismatic CEO capable of getting the investment spigot open and then the money comes from telling a story to investors rather than any existing business of the company.
Compare this to, say, auto manufacturing. There are typically only one or two fabs on the world's best process node at any given time and if you built one you'd be the new TSMC as fast as you could tell anyone about it. Whereas Tesla has car designs that people are willing to buy, but it will probably be a decade from the release of the Model 3 before they can manufacture as many cars as Toyota does, and as a result they currently have to amortize their R&D over fewer units.
The core idea of your post is "moral hazard"[0], which describes a state where you are divorced from the consequence of your decision. Your idea also uses the intuition that the risk of moral hazard grows quickly with the scale of human endeavor, and reaches ~1 at a certain size. Moral hazard encompasses both the harm you do to others directly, as with missing or malicious support, and the indirect harm you do, as with externalities like pollution or depressing a local economy.
I personally think your intuition is obviously correct.
Moral hazard disconnects the social corrective circuitry present in small human groups like families or villages, but it also enables the creation and accumulation of vast wealth. This problem is known in philosophical circles as "The Problem of Dirty Hands"[1].
https://thezvi.wordpress.com/category/immoral-mazes-sequence...
Subsequently, the industry of fraud is generally lucrative and is thus constantly growing.
When I worked at Blizzard, there were many mechanisms in place to spot fraudulent credit card transactions and cancel them before they actually billed the card holder, but there was no process for reporting the fraudsters to prevent them doing the same thing again tomorrow.
This is probably the same strategy that every company does, because there is no practical action any company can do to try make fraudsters accountable and thus discourage them from simply trying again.
So the problem of fraud is getting ever bigger and increasingly unmanageable and out of control.
The problem is a non-trivial political one, governments need to create task forces to work to reduce the size of the fraud industry, perhaps by catching fraudsters and making them accountable.
The problem is even harder than simple political will though, because it’s cross jurisdictional, meaning governments of different countries all need to work together on this.
This may seem impossible at the moment, but I believe until it is achieved fraud is only going to get increasingly worse.
>And if I ask who do I trust more, my local reputable electronics shop (Memory Express, B&H Photo, etc.), I trust my local reputable electronics shop more. Not only are they less likely to sell me a counterfeit than Best Buy, in the event that they do sell me a counterfeit, the service is likely to be better.
An international, multi-government taskforce is one solution, potentially. Maybe not. For the problem presented at the top of the article, shopping locally seems like an easy win in comparison.
Going to get the FBI involved for a $20 purchase?
Reminds me of Lebowski asking the cops about his Credence tape.
Sure, why not? And if you're at the scale is Blizzard I'm sure it's a lot more than $20.
We're collecting all kinds of information these days. Surveillance capitalism is a common term for it. Data is gold they say. So why not give that data to people that can use it to stop crime?
What exactly can FBI do about them?
1) There's certainly cards coming from non completely sanctioned countries. This means legal pathways.
2) If fraud is prevalent and these numbers can be tracked it makes for better policy decisions. It's not uncommon knowledge that we don't have the best privacy and security. This is at least ammo to do something about it.
Do you only do things that you get paid to do?
They offer MFA and that's all they should have to do.
> There is 0 incentive for them to care other than doing the bare minimum because it's not their problem, it's the credit card company's problem.
I don't buy this and it sounds incredibly myopic. If it wasn't "their problem" then they wouldn't be doing anything about it. Which the OP talked about. So they aren't just taking the money and letting the credit card companies handle it, that doesn't even make any sense. Credit card companies have to get the money back. Honestly, it sounds cheaper to report it if reporting it leads to a significant reduction because you then have to pay fewer people to deal with this issue and process far fewer charge-backs. It's not much work to do (literally create a program to automate filling out a forum to the gov). We're arguing over less than a week's amount of work.
Plus, it's the right thing to do. Idk about you, but money doesn't run my entire life. Letting it seems incredibly myopic as well. Money is just a tool to help me better my life but it sure isn't the only way to do that. And if we're not trying to do "the right thing" then the fuck do we even have a society for? Seriously, please reconsider your actions, because you're enabling the shittiness in society. I'm not saying you gotta be a saint, but if there's a pretty cheap action you can do to make your society any bit better, just do it.
"...He was going through emails in his inbox, then responding to questions in the craigslist forums, and hopping onto his cellphone about once every ten minutes. Calls were quick and to the point "Hi, this is Craig Newmark from craigslist.org. We are having problems with a customer of your ISP and would like to discuss how we can remedy their bad behavior in our real estate forums". He was literally chasing down forum spammers one by one, sometimes taking five minutes per problem..."
Seems like it's possible but not feasible to build a pipeline to scale out that sort of behavior.
Amazon should be able to keep on top of fraud easily, twice the sales means twice the revenue means they can afford twice the fraud checks, if they want to. That fake $30 "2tb microsd card" puts $30 of real money in their bank account.
But for something like Twitter, revenue is only vaguely related to number of tweets. That "elon musk wants to give you free dogecoin" tweet doesn't make them a cent.
The alternative is that we allow businesses to externalise those costs onto society.
Personally, I think it's reasonable to care about such things, and to try to do something about it. If no-one cares or tries, then sucky people will just suck even more.
Is there any reason why you did change mail away from Fastmail after such a long time and now use Google as Mailserver?
Legislation can be changed so people are considered responsible for the abuse that comes from their network unless they can pass the buck to someone else. This will quickly cause those Windows XP machines to fall off the internet unless their owners fancy constantly being bogged down in legal trouble.
> Going to get the FBI involved for a $20 purchase?
The alternative is effectively saying that theft under 20 bucks is decriminalized?
Those who tried to convince a police officer to investigate a bike theft can tell you that the threshold is actually higher.
To take an analogy I'll mention the drug war. The main target was always low level drug dealers and users. They're easy to arrest and easy to say you're doing something. But they are fairly inconsequential to the business of selling drugs and thus the availability on the streets. But it's orders of magnitude harder to go after the root of the problem. I don't want to detract this conversation with the other aspects or conspiracies (real or contrived), but just focus on the incentive structures. I think the same is here. Blizzard gets no short term reward for reporting fraudulent activity. It's hard to know if they get long term. But at the end of the day it would be the right thing to do.
That's what matters. Doing the right thing. Move fast and break things it's a great strategy. But it can't be used in isolation. If it is you're left with a trail of destruction which never gets cleaned up. It's hard to quantify objectives and so every objective function is misaligned. You need to rely on humans to see through that and correct the course as best they can. You need both the people pushing to move fast and the people pushing to slow down and repair. There's a harmony in that competition. Pick your camp but recognize that there's value in the other one too.
This might not be too different from the payment anti-fraud industry (which is just varying degrees of snake oil). There are solutions that can be implemented such as actually strong two-factor authentication that could cut down on payment fraud dramatically but this would significantly reduce demand for this industry, so a lot of the field has a monetary incentive to keep the underlying primitives not so secure as to keep demand for their snake-oil.
In a similar way, a huge amount of this fraud would disappear if we took more known-to-be-effective measures to combat poverty (because many of these fraud techniques rely on hiring a whole bunch of desperate people to help keep it going): things like providing housing, single-payer health care, and universal basic income.
No argument here, and it should be unsurprising I agree, since I'm arguing to not go after users. But also remember we can say the same about internet fraud. I'm all for addressing the roots of the problem. Big fan of ensuring there's a floor to living standards. But admittedly that's not the whole problem and fixing these things is incredibly complex. But I would say treating the addiction is a different side since that's downstream of production. Though complex because we do need to produce some drugs but we shouldn't need to spill blood to do so.
Indeed—that's basically my point, too! :-D
It's even less trivial when corporation-on-consumer fraud has been normalized (see dark patterns, or companies outright taking money for no/sub-par service). Suddenly starting to prosecute fraud would inconvenience some deep-pocketed entities.
what would be good incentives to make companies like blizzard start reporting fraudsters?
I am thinking along the line: companies can pay $X to make a report, and will receive $X5 if that reports leads to a fine. And they have to pay additional $X10 if that reports turns out to be frivolous. (If the report appears to be valid, but doesn't result in a fine, than they get no payoff).
My worry is that bad incentives would lead to over-reporting or some other bad thing.
Having someone to report them to?
If I provide Andy's small town taxi service and have a customer service issue, I deal with it personally and properly or I go out of business. If I'm uber I just ignore it. It has nothing to do with efficiency, it's just getting the monopoly power to treat your customers badly and get away with it.
Which, of course combined with the larger attack surface, is why bigger platforms do so much worse on spam/fraud/support.
In a very small town, you won't go out of business because you'll be the only taxi service in town. Everyone can establish their 'monopoly power' in a small enough area.
20 years ago my small town had around five fiercely-competing taxi services with cars arriving within 4-5 minutes of a phone call. In many respects that was better than the new times. Especially when it came to customer service.
It was an interesting case, a sort of a breakthrough in transportation habits achieved by loads of 15-years old right-hand-drive Toyotas converted into taxis. The cheapest ride was around $1 and people literally started riding taxis to the next building on the same street.
I’ve lived in a couple college towns and they tended to have smaller populations, but pretty good taxi services—which makes sense when you have a bunch of young people who want to go out to drink, might not have cars, and probably are willing to spend money on that sort of thing, and tend to all go to and from the same destinations.
I bet the hackernews demographic skews toward college educated, so I wonder if people are commenting with truthful experiences, but from that particular (IMO, at least questionably representative) niche.
Regardless of how permissive the regulations and bylaws are on the books.
And even when it's a second group of locals that want to establish a second taxi service, you can still establish your 'monopoly power' on one side of town, or specific areas. There's no practical bottom limit.
People don’t use Uber because they’re a monopoly. They use it because it’s convenient, it’s a known quantity, it’s mostly predictable, and they can use it almost anywhere they go.
People like to complain about Uber, but my pre-Uber experience with taxi services was far worse. The hypothetical case of Andy’s small town taxi service that provides exemplary service either didn’t exist or was such an outlier that you couldn’t reliably find it while traveling.
Did you live in a small city back then?
If you’re only remembering the gold standard small-town service that did everything perfectly, you’re looking back with rose colored glasses. The typical experience back then was not good.
However the apps were able to price-dump for around three years until all small players died, then hiked the prices back again.
I'm not saying anything about the "typical experience back then" however I do know that in right circumstances (high demand, cheap supply, no lock-in) competition between independent small companies can have remarkable results.
[0] Not quite zero. I always got an immediate computer-generated email telling me I'm important and that my complaint is of utmost importance. Drivers never had repercussions from the companies though; every once in awhile if I had concrete evidence of running over a pedestrian's foot or something I could get law enforcement to care, but the companies DGAF.
Things normalized a few years later. I think the biggest lesson was that clients were willing to endure a lot of hardship for a 50% discount.
Still, even today (and with Uber mostly having lost the market to Bolt), the average ride is much, much better than the average taxi ride ever was (and I was a regular user of both). The cars are still cleaner, and it's virtually unheard of to have drivers try to overcharge or otherwise scam you - which were both regular occurrences with taxis.
Now Uber/Lyft aren't great, but it's still way better seeing the driver on the map when they're running late than having literally no idea and having to call dispatch who themselves will begrudgingly call the driver who will just give a bs status anyway
so why not go back to taxis?
We know this isn’t true, though; taxi services sucked before Uber. In small towns, there wasn’t competition at all, so know reason to fix issues. In larger cities, most taxis were hailed on the street or sent from a central dispatcher, so no individual taxi driver cared about their reputation… people weren’t choosing a specific taxi, and there was little repeat business, so customer service wasn’t important.
> The only thing that scales with the community is the community.
The point being, you have to grow users into moderators. Any other way of acquiring moderators is unsustainable.
[1]: http://discourse.bridgefoundry.org/t/link-to-jeff-atwood-tal...
My Facebook feed as it used to be, general life updates by various friends, is pretty much dead. Nobody posts these things anymore. However, neighbourhood groups, Buy Nothing groups, and other local special interest groups thrive, I see several daily posts in each. Plus Facebook constantly recommends me more groups. This is a n=1 experience but I wonder whether Facebook is 'falling apart' into these groups.
The admins of the groups are responsible for managing the discussion in groups including frontline anti-spam against the porn bots and the shoe bots and whatever. So it's semi-distributed moderation. (Assuming group admins care, but if they don't then users just abandon the group.)
Compared to e.g. Reddit, FB groups aren't as world readable or writable as subreddits are so you don't really get that classic inter-subreddit drama.
Where global moderation is still needed from FB's perspective is when group activities start spilling outside of that group, e.g. because they're coordinating extremist activity.
This probably won't be the result of user reports though. For privacy and scalability that implies an automated system which (hopefully reliably but only rarely) flags posts to a human working for FB.
Then again the wikipedia community is full of drama.
Facebook (like most corporations) operates an autocracy. However, unlike most corporations Facebook generates 100B+ in revenue per year (more than most countries), is worth $1T+ (again, more than most countries), and home to 3B+ users daily lives (trifecta, more than all countries). It's time to acknowledge the company that walks like a duck and quacks like a duck, is a duck.
If Facebook was so inclined to change their governance model, a plethora of prior art exists, in public sector government implementations, for them to build from. An endeavor of this magnitude is neither easy nor simple nor palatable to more engineering-inclined minds, but it's perhaps generational opportunity for a person/company to truly lead and innovate on such a ubiquitous digital platform.
Are you trying to imply that Facebook is a country? Because this doesn’t make any sense. Countries have an entirely different set of obligations, duties, and jobs to be done than a website dedicated to light communication and entertainment.
Moderation then becomes: what do the local cops tell people to stop saying. Government moderation policy thus approaches social media moderation policy.
And no, I'm not advocating for Facebook to be nationalized or broken up. I'm specifically pointing out the thought that Facebook could innovate here; they have an opportunity to establish the first truly global self-governing internet-based company in history.
> a website dedicated to light communication and entertainment
This statement is deliberately obtuse. Facebook is a communal space used by 3B people every day to mediate conversations, transactions, news consumption, business, events, etc. I'd hardly say people building their livelihood off of Facebook is "light communication" or "entertainment". Again, look no farther than HN to find examples of Facebook's governance policies harming their users with no explanation or due process: https://news.ycombinator.com/item?id=29614629.
This is essentially what Reddit does. It mostly works for communities about headphones, bicycles or water bottles, but not Donald Trump, piracy or child porn. Reddit had to close some subreddits down, not because their users complained, their users were perfectly happy and considered the moderation to be just fine, but the harm to society / the company's PR image / advertisers was too great.
User: "AI, what's my current reading status?" AI:"We're on your EveningSurfMood2, emphasizing StuffFromFriends, and your EclecticTopicsLarge (with Dang's HighQ Discussion v3, Alice12's Clueful Author Making Coherent Argument Filter, and hugging's UnusuallyInsightful51)." ... Later while reading, AI: "We've received a rating request from Mastatron: Is this post underappreciating the opportunity for rich human-ai computation hybrids at scale?" User: "Oh yeah".
When a post is rated, a system ideally learns about the post, the poster, the rater, and the rating question. The candy machine which bribed undergrads to redundantly grade CS exams, the responses giving insight into the grader, the gradee, the exam, and the instruction.
People are multifaceted. I'm interested in someone's apps, but not their cat. In <wizzy biology researcher> when they are writing about their research focus, not on their gone-full-nutter <other biology topic>. It would be nice to be able to stream one's own diverse interests, without burdening people who wish to follow only one of them.
Sites, group moderation, and thumb ratings, are units of very very very course grain selection. Imagine tiktoc or netflix with everyone sees the same thing, one size fits all, and if you want something else, go somewhere else. I don't even want the same thing from hn comments at different times of day. Our capabilities are oddly impoverished - even last-century usenet had "I don't want to see any more comments from this person". Skimming hn comments for ones which match my preferences of the moment, when feasible to delegate to personalized automation, the system design could facilitate that.
User customization could be open, transparent, and collaborative. Not "you looked at this once weeks ago, so here's more, and you can't stop me". Composably collaborative - not a swamp of manually-viewed isolated playlists, but accessibly searchable/queryable - intersect playlists which include this video. Beyond "this person does good videos", to "this person does good video ratings", to "these people are good raters", to "these people do good ratings of raters"... for your personalized interests of the moment.
It's late, but hopefully those are clarified highlights.
But consider all the social costs avoided. The burden of moderation and policy fights. The non-satisficing silos - "not here, but sort of there, but not really, want a little of both, so there's nowhere really, too bad, it would be nice". A wikipedia without deletionist-vs-inclusionist conflict, because both are supported, and fine grained - "my wp? inclusionist on programming languages, and deletionist on popular culture".
What if X could offer advertisers: everyone is on X all the time, so of course there's lots of ugly crazy, that's people; but you have excellent control of to whom, and in what contexts, your ads are shown. If you want your ads only on X/Mormon, X/PlumTV, or X/QAnon, but never near pets talking like a pirate, we've got you. Boycotting X infrastructure would be like boycotting the internet or print - not the right level of granularity. Whoever or whatever you wish to boycott, X is there for you - X/BoycottX is quite popular
Is this like, meant to be a good feature???
Aka free labor?
Those who work anti-fraud for platforms know that there is something like a market for fraud. There is a market clearing quantity of fraud that will be present on any platform, dictated by the gains from learning to execute the exploit, the effort necessary to do so, and the number of times one might be able to do it.
Small platforms have way less fraud because they are way less valuable to exploit, in general. And that's caused by _the very fact that they are small_.
The big platforms actually are radically more competent at anti-fraud / anti-spam / etc, but the scope of their operations make them such juicy targets that there is a lot of it anyways.
It the entire world of fraudsters against Amazon, or Google, or Facebook. That's a highly unequal battle and it's surprising how well the platforms fare, all things considered.
> Small platforms have way less fraud because they are way less valuable to exploit, in general.
Yes.
> The big platforms actually are radically more competent at anti-fraud / anti-spam / etc, but the scope of their operations make them such juicy targets that there is a lot of it anyways.
If their business model (scale above everything) results in shitty customer experience I don't really care how competent they are. They are fighting the problem they created themselves: a platform too valuable for scammers.
It's a tradeoff. If your customer service is good such that more people shop there, there will be more fraud attempts overall.
It's not that a platform is too valuable for scammers, it's that a platforms is valuable at all. All platform value is value for scammers, and the most useful platform will also have the most scammers on it
It's not true. Scale bring synergy and reduces costs. But it's a two-way road which works for scams too: scamming one big platform and fighting one anti-fraud system is ten times more cost-efficient than adjusting to ten smaller ones.
Irrespective of whether or not a platform is small or large, can they make their customer whole 100% of the time? Why or why not?
Just to work one (real) example:
1. Buy expensive face cream from Amazon
2. Take out the expensive stuff and replace it with junk
3. Complain to Amazon that you got junk and need a refund.
The challenge here becomes obvious. Even in claims where the customers was allegedly a victim, some portion of those customers are fraudsters. So any policy that results in a large, profitable company will likely result in something less than 100% of legitimate fraud cases from being satisfactorily resolved.
In the case of the small business, they are very unlikely to be targeted by industrial scale fraud and will probably just be able to solve this with personal relationships and human judgment.
That said, the price you pay the small operator is very likely to be meaningfully higher than the price of the scaled operator.
If you care more about having near 100% probability of having fraud/abuse cases addressed than you care about benefiting from the economies of scale, then yeah, go with the small operator.
In things like communities, my general sense is that there is almost no beneficial economies of scale. So I like to hang out in smaller places. But in things like information retrieval (ie. Google), the benefits are usually worth it for me to use that.
The question of the company itself being defrauded by some number of customers and having to defend against that as it becomes increasing larger is definitely valid and difficult to tackle at scale. However, I think it is a totally separate one. I do not think it is a necessity for the company to compromise the ability to make any one dissatisfied customer whole just because they are being targeted by a whole lot of fraudsters all at once. The company might have to increased their costs on their products to pay for things like additional training, tamper-evident packaging, improving supply chain management, and so on.
The correct amount of fraud the platforms tolerate against themselves is definitely >0%, and it's for the reason you're identifying.
It seems that you're assuming it's obvious to identify good-faith consumers and do right by them. In some cases that's true. If you're a loyal, repeat customer of Amazon's they will basically just do whatever you ask them (within reason). But there are many cases where the act of discriminating between fraudster and Good Samaritan is in fact the whole of the challenge.
Indeed, one of the most common exploits is to hack the account of good customers and abuse merchants that way.
There's a dark, dark underbelly of crime out there. And the cost of that is borne by all of us in occasionally-less-than-good customer experiences.
They do make their customers (i.e., the companies who pay them for access to their users) whole. But their users (at least the vast majority of them) are not their customers; they don't pay for the service. (It's true, as the article points out, that even paid support at the big platforms is very poor, but that's because the money involved is still not even rounding error compared to the astronomical profits being made from selling access to their users.)
They can't make their users whole, or even a significant fraction of them, without breaking their business model. That's why they don't do it.
There is a fair (but tolerable) amount of click-fraud, etc that you basically factor as a cost of doing busines.
I'm quite skeptical of the ad model myself, but I'm relatively sure that "you are not the customer" is not altogether the most salient argument to make in this thread.
"Meaningful amounts" to most ad customers is not the same as "meaningful amounts" to the platforms.
In my first read, I took that to mean from a process and inputs viewpoint.
But reading it again, I suppose the author could be taking a more consequentialist point of view. They are at least as good (or much better), largely because they don't have to do much.
I suppose that's fair, but also a lot of words in the OP to state a truism :-)
> The big platforms actually are radically more competent at anti-fraud / anti-spam / etc
No, they're not. They are purposely incompetent at those things, because it's part of their business model. They cannot implement actual competence (which would mean providing sufficient actual human support to deal with the volume of mistakes that their automated algorithms make), not because it would cost too much (the article quite correctly points out that their huge profits provide plenty of cash to pay for human moderation), but because it would reduce their value to their actual customers, who are not their users.
Perhaps I can squint and see how an email platform like Gmail could be read as a protection racket, but I don't see it in other platforms.
It doesn't; that's not the point. The point is, as I said, that the big platforms make money by selling access to as large a pool of users as possible, and that requires them to not crack down on spammers and fraudsters--because at their scale, it is impossible for them to reliably distinguish the spammers and fraudsters from the rest of their users. So they can't crack down on spammers and fraudsters without also reducing the size of their user pool and thereby killing their business model.
The article explicitly talks about this:
Either you have to back off and only ban users in cases where you're extremely confident, or you ban all your users after not too long and, as companies like to handle support, appealing means that you'll get a response saying that "your case was carefully reviewed and we have determined that you've violated our policies. This is final", even for cases where any sort of cursory review would cause a reversal of the ban, like when you ban a user for impersonating themselves. And then at FB's scale, it's even worse and you'll ban all of your users even more quickly, so then you back off and we end up with things like 100k minors a day being exposed to "photos of adult genitalia or other sexually abusive content".
Spam and fraud still generates "engagement" (whether the bad content itself or the people getting outraged by it) which contributes to the numbers they use to attract & bill advertisers.
The modus operandi of these platforms when it comes to moderation is to quickly take down whatever will get them in trouble fast with the law (DMCA takedowns, CSAM), or what will provide ammunition for attack pieces in the media (pornography, sometimes drug- or weapon-related content). But anything else is fair game to stay and earn "engagement" even in the face of user-submitted reports.
In the unlikely event that this "anything else" does get reported on in some big media, then it'll be taken down and they'll issue an apology and how they will do better in the future, and everyone seems to buy it no matter how many times they've done this.
The author addresses this point in one of the appendices:
>> A standard extension of this idea that I frequently hear is that big companies actually do have the best anti-spam and anti-fraud, but they're also subject to the most sophisticated attacks. I've seen this used as a justification for why big companies seem to have worst anti-spam and anti-fraud than a forum like HN. While it's likely true that big companies are subject to the most sophisticated attacks, if this whole idea held and it were the case that their systems were really good, it would be harder, in absolute terms, to spam or scam people on reddit and Facebook than on HN, but that's not the case at all.
This response makes intuitive sense. If the big companies are indeed more effectively competent at anti-abuse/anti-fraud measures, then the fraud that does slip through should be more subtle and less obvious, particularly over a prolonged period.
Reddit is not an example of being bad due to this affect, but an example of being good because of it. Reddit is not one huge platform but a combination of thousands of subreddits independently moderated. That is how reddit remains good, because small subreddits have small scale.
Running your own email server isn't a counterexample, but is legit terrible because in essence you aren't moderating a small community, you are moderating the whole world, but just your view of it, since anyone can email anyone. That is the worst because it is the worst of both worlds - no budget from being big scale but still all the problems of being large scale.
What?
> I got some very technical folks on the phone, but all they could say was that everything looked 100% fine and that something we were sending was tripping the spam filters
This “we won’t tell you what triggered it because it helps the spammers” is… questionable, and it feels like security by obscurity. Yes, it may help the spammers a little but not possibly enough to warrant the black hole of debugging legit issues.
The right way to fight spammers isn’t about arms racing with hyper-advanced content filtering. Instead, we need to make it uneconomical.
As for the support team on our email provider’s side, they didn’t know what was tripping it. We simply got to a point where we ruled everything else out. The only thing left was the content of the email being legitimately spammy, somehow.
Our email provider wasn’t the one that was filtering our emails, at any rate, rather it was the recipient email systems.
Wouldn't that be the "best case" for email because of the centralized idea? In reality it's a few huge companies that matter and if you end up on one of their lists because of some bad IP, missing header etc. you are a bit out of luck.
We now have several new social networks based on the ideas of open protocols and federation. They are not yet large enough to attract too much attention but we’ll see if the story rhymes.
I ran my own email for close to 15 years, most of that time on the same IP address and the same old domain. I could never get GMail to reliably accept my mail, and of course there is no support to find out why. I set up and tested their documented best practices, and had no issues corresponding with a lot of people.
Spam is not an issue in practice. Two basic filters drop 95% of spam without scanning the content, and an open source reputation+content engine drops the rest to the tune of maybe 1 spam a day. The two annoying parts are dealing with exceptions, often large companies misconfiguring their outgoing email; and the open-source nature of the filtering engine’s ruleset, meaning it occasionally completely breaks for a short while.
Sure, but you are still moderating for a small community. One person's spam is another's ham, so it's much more difficult for Gmail to be as accurate as my spam filter (which only needs to learn from a couple hundred people's preferences) because it will inevitably overfit.
Thats my takeaway here is that we should as a matter of regulation / spirit of market competition lean on incentivizing creating medium (mid?) size companies worth collective $100 billion+ than a few giant trillion dollar corporations, as it relates to majority software companies.
I think with hardware it’s A bit different when it comes to economies of scale so I don’t know how that could break down and I don’t want to include that for the sake of argument but there could be something there too
Ideally, IMO, we should aim to prevent monopoly, not just abuse of monopoly (which is what regulators currently do): https://pietersz.co.uk/2009/11/fix-capitalism
I would also point out that the centralization of companies into todays megacorps is influenced by many factors, economies of scale may be one, but so are intellectual property laws (we really dont need them!). In fact, I would venture a guess that most regulation is written by the companies that are being regulated, that keeps competition at bay, and they wont regulate themselves downwards in the food chain. Finally, I would say the centralization really took place during WWI/WW2, it was convenient for the government to shout orders at a whole 3 people to build tanks instead of automobiles; this centralization is a strategic goal of the united states government, and enacting it through secret deals (rather than law) is a preferable method to preserve state secrecy.
On the ad front, anyone who runs an ad for a third party should have to be able to produce the actual name and address of the advertiser on request, or accept responsibility for the contents of the ad. Businesses have no right to be anonymous. That is existing law in the EU and California.
Fraud is a problem because the major platforms get a free pass on supporting it. Not because it's hard.
Punishing scammers to dissuade and reduce the quantity of scammers is the government’s job and should not be laid on businesses, for a well functioning high trust society.
If international jurisdictions are a problem, then the national government needs to provide an identify verification API for businesses so they know the customer they are dealing with is subject to the legal system of the country.
We're talking KYC (or direct liability) for businesses here. There is nothing discriminatory about it.
A law that makes a bank liable for their customer’s illegal actions harms people who kind of sort of look like they could be doing something illegal, even if they are innocent. Plainly discriminatory.
A law that makes hotels liable for human trafficking harms people who “look” like human traffickers. Guess what, now people who want to pay with cash or don’t have an ID or don’t fit whatever other profile are no longer welcome at a hotel. Again, obviously discriminatory since people who didn’t do anything illegal are being punished.
These aren’t made up examples, these are real life examples. The government is literally telling a business they have to judge someone without the person being able to provide a defense, like they would in a court of law.
A law that says "Amazon must know their sellers and be able to pass the consumer on to those sellers, or it is liable itself as a backstop" might indeed shut some people out of Amazon's marketplace who cannot comply.
But those people would not be allowed to legally retail to the public anyway, as they couldn't fulfil those requirements
> The government is literally telling a business they have to judge someone without the person being able to provide a defense, like they would in a court of law.
A business, not a someone, and there are all sorts of compliance rules you could complain about doing exactly the same thing.
Government leaders just want to be able to point fingers at as many people as possible with KYC laws (which do more than just require the business to verify who they are doing business with).
A business should know who they are transacting with, but a business should not be vetting them for illegal activities. That is a job for courts. Businesses can even be required to report who buys what and how much (for example, bulk supplies to make methamphetimine or explosives), but the business should not be using nebulous heuristics such as credit score or income or other non illegal things to figure out who may or may not be a criminal.
Last example, the US government should require online marketplaces to know who they are doing business with, and it should be someone within US jurisdiction. The US government should also provide the online marketplaces with an identity verification API to do this. So when a product sold on Amazon causes a problem, it should be easily possible for the government to charge the seller with a crime, and dole out an appropriate punishment.
Normal business people will have yet another headache. Corner cases will exist where users are condemned to unending bureaucratic limbo. A human support person, if they exist at all, will repeat a meaningless mantra, "I'm sorry sir, we've been unable to verify your identity with the documents provided. This is a compliance requirement as per the online platform safety act of 2026"
All the while, scammers will be churning out new KYC'd accounts. The process will have nothing to do with safety, as the platform will only care about complying with the new regulation. Don't forget that Amazon still earns fees from each sale. Large platforms will enjoy the compliance requirements as an additional barrier to entry for competitors.
Not to mention the inevitable day when all of that personal data is released. Breeches exposed for all to see. Another headache the fraudsters won't have. The regulars of the ID fraud forum will probably enjoy it.
I could start my own VC fund if I had $1 for every post on HN claiming, "It is so simple and easy! We can fix this with more government!" It is never so simple when you are dealing with humans and incentives. Human societies are not codebases you can just patch to eliminate bugs.
The platform will care about costs to itself. One of the advantages these large platforms enjoy over smaller ones is their ability to pass the buck on consumer law, to their benefit and to the scammers. By making it the platform's liability, always, this could start to change.
If the companies that think of themselves as large 'platforms' end up erecting barriers to legitimate business in the process, then that becomes their problem and is likely to result in more competition in the market from companies who act as actual stores themselves.
It's not 'so simple' but a liability change, and an end to exempting retailers like amazon from their retailer responsibilities could start to rebalance things.
Maybe that's the true problem. At some point courts should stop settlements from happening due to the value of precedents to society as a whole.
That seems like a problem in our legal system though. It basically means you can force your opponent through a long & expensive legal process (hoping they'd give up or run out of resources in the meantime) and still not risk anything yourself as you can abort the whole thing the second the tide starts turning against you.
The civil legal system is designed to settle essentially private disputes between parties. It is not really a matter of public interest whether my neighbour or I bear the liability for the tree branch that hits my parked car during a storm.
Your discomfort arises because the actions of large companies are matters of public interest, such that a notionally 'private' dispute can still affect hundreds of thousands of people.
Class-action lawsuits are one way to shoehorn this sort of dispute into the court system, but the other way is regulation. Depending on the framework, regulators can issue orders themselves or bring court cases for the sake of public interest. Unfortunately, good, timely, and competent regulation is its own hard problem.
Based on a cmd-f, I don't see the words "myth" or "beautiful" in the article, and Luu writes:
It's easy to name ways in which economies of scale benefit the user, but this doesn't mean that we should assume that economies of scale dominate diseconomies of scale in all areas. Although it's beyond the scope of this post, if we're going to talk about whether or not users are better off if companies are larger or smaller, we should look at what gets better when companies get bigger and what gets worse, not just assume that everything will get better just because some things get better (or vice versa).
3 * 3
10 - 1
sqrt(81)
I can't see the number 9 anywhere above. Can you find it?
https://a.co/d/auXcxrZ ($29 for 1TB as their “overall pick”)
I have the non-technical people of my life insist on a terabyte for everything. One of them bought an iPad Pro just to have a terabyte of space. After 8 years of their prior iPad, they had used up all the space (64gb I think) and wanted to be sure they wouldn’t run out.
Improvements in cameras etc are causing the sizes of the photos and videos that people take to hugely increase in size. The prior ipad you spoke of might have only recorded 720p video, while the new Pro likely does at least 4k. If they use their ipad to record video of family events, that 1tb might represent the same usage as the old one.
It's more often the case that the device does present the advertised capacity, but with a massive "black hole" in the middle where any writes are silently discarded.
Depending on your filesystem, you don't need to write much data at all before you're likely to hit this "black hole" and start losing data.
I don't think they can stem the tide.
To ebay's credit, their support is very good once you are on the "press button, get called seconds later by a human" tier, but I also make ebay a lot of money, so I'm not sure how common it is to receive that level of service.
They have providence, maintaining custody from manufacturer to store shelf.
Unlike (e.g.) Amazon, where all vendors' have "identical" items thrown into one big "for sale" bin.
That's called provenance, not providence.
This is a tangent, but I just looked at Keychron's website, and I don't know how someone is supposed to choose from all the models and options. And there seems not to be a "comparison" page on their site.
IIRC Q is the full-fat, fully programmable, hot-swappable top of the range. V is like Q but a bit more budget-friendly, may have plastic cases etc. K is their 'standard' range, some have hot-swappable switches, some don't, generally not programmable. C is budget K, wired only.
But then there's various pro, max, god knows what variants. It's a ludicrously wide product range.
All I can say for sure is I really like my K8.
The KeyChron Discord has seen enough questions that it has many bot autoresponders to explain model differences. I thought the experience of selecting among the many very similar, poorly-named models was a frustrating slog, but it seems unlikely to change given that they sell out their production runs.
As long as you happen to quote it, I forgot a key sentence in my story: I placed my order with the official Keychron store and it was fulfilled by Amazon.
I think legibility is one aspect of it, but I think another could very well be empathy. If you want to support a user who has a problem, then you have to want to help them and follow through. If you want to make a customer whole after they lost money on your platform, then you want to pay them back and follow through. If you want to stop your platform to be a tool used to disseminate hate, then you want that outcome and move heaven and earth to make it happen. You have to want to see the problems and you have to want to follow through and fix them.
well anything that comes out of any business has these intentions for sure, but statements could be like multi-dimensional vectors, they could be doing 2 things at once
the ROI for fraud is low for a smaller platform and so it doesn't happen for smaller scale companies as much as it does for bigger scale. but given the interested party who is explicitly looking for the target cohort even the smaller platforms see the fraud
so even if social media as whole were to split into multiple entities, the ROI would still make sense for fraudsters to continue the fraud.
even if you have 1000s of entities, there would be a startup who can build a wrapper out of those 1000s of entities to make the fraud ROI possible. just like how there are businesses that offer scraping competitors
I self-host Mastodon and my mentions are chock full of this one Japanese Discord cybercrime server[0]'s invites. This only started four days ago, but it's already making Mastodon almost as bad as Musk-era Xitter spam.
The front-line tool for moderating federated spam is to block the instance that sent it. A year ago, most spam were rando servers following everyone they could think of. However, the Japanese Discord guys are almost slightly kinda smart: they started registering accounts on smaller (non-single-user) instances. Because Mastodon doesn't support any kind of account verification[1], any instance with open registration (i.e. "just sign up") is effectively an open relay for spammers.
I don't consider this to be negating the post, but it is relevant context.
[0] They advertise DDoS, hacking, and stolen credit card services, or at least that's what I was able to glean from the Japanese language advert they sent
[1] This is why Google requires you to verify with an SMS code to do anything e-mail or YouTube related, for example - it lets them throttle how many registrations per year you can do with that number.
The small sites only lack fraud because the large platforms draw the fire.
Spammers and scammers have a fixed cost to initiate an attack and the potential return on investment is proportional to the user base. A platform below a certain size simply isn’t profitable to attack. It isn’t that small shops are going to be better at mitigating spammers and scammers as the article states, small shops just aren’t being attacked.
If the arguments were true that there are diseconomies of scale there wouldn’t have ever been consolidation in email hosting. Email providers all use the same protocols so the incremental cost of attacking a small provider is zero. A small company hosting their own email will quickly see their customers flee for the big providers as they drown in spam. Scaling spam management was the primary driver that drove consolidation in email providers in the early 2000’s.
This also drove consolidation in areas with similar economics such as e-commerce. The low cost of attacking a new player in the e-commerce space and the cost of scaling risk management drove a lot of the growth of PayPal and spawned the growth and consolidation of outsourced e-commerce fraud risk management.
The economics are going to be true of any n-squared business model where the value is in the size of the network. I go to LinkedIn because it has the lowest scam rates but because most of the people I work with are there.
While a wildly diverse ecosystem would be more resilient against fraud this is the internet, the biggest n-squared system of them all. It’s unlikely that the internet is going to devolve into small, diverse fiefdoms so the problem is here to stay.
His point of fraudulent Amazon SD cards makes sense but you could get fraudulent cards in other places too.
Amazon has one of the best return policies and support.
I once bought a portable AC from a small shop and they wouldn’t take it back even though it was quite noisy compared to what they had advertised.
Large platforms e.g Google and Meta pride themselves that they have billions of users with very few engineers.
The problem is Google thinks engineers should be isolated from users and support can be algorithmified. More often than not, it fails.
I am all for smaller companies when it comes for human touch.
However there is a case for economies of scale when a problem is simple and can be captured fully by an algorithm.
E.g YouTube only really works because they have algos to detect what background music is attached to what video. Imagine if humans were doing it? They wouldn’t be consistent.
The truth is that computers are slowly getting better at understanding the real messy world.
And the reverse problem is computers are also getting better are creating human-looking mess in the real world.
For meta, google, twitter et al, it's almost as if the users that fall through the cracks of the system are off-spec product pieces, where it's cheaper to get more instead of fixing existing issues.
What I find fascinating (and this is anecdotal) is that large companies that have few big customers ALSO suck at support, despite having relatively large portion of their headcount assigned to Customer Support. I would tend to agree with the article's author, that as an org grows, it becomes less able to perform its core functions.
If a "ban" was considered "defamation" and you could take a FAANG to court and be awarded $1 Million in damages, suddenly FAANGs would be superb at avoiding false positive bans.
Anyone who used to see your account and watched it suddenly go away is under the impression that you "did something bad which got you banned". That is a public statement about your character.
If you did NOT do something bad, that should be actionable.
In terms of content that is annoying or worse to the forum’s users, it’s probably broadly true. But it’s not necessarily true for content that the users of the forum are fine with, but society more broadly has issues with.
Take for instance forums which are devoted to sharing “revenge porn”.
Seems like it works exactly opposite of how Zuckerberg describes it. Not surprised.
Smaller platforms will not want to mistakenly ban users.
Though I do think reader mode can overestimate by a lot. Still a 53,000+ word article is going to take a long time to read.
Well Zuckerberg is correct in context. Politicians don't mean moderation as in everyone is being civil with each other or garbage results. That isn't a political issue. They mean things like supporting the local censorship regime which is usually country-specific. So from a political perspective, more centralisation is the only way to successfully implement moderation. Because moderation doesn't mean "behave to community standards" - it means "comply with politician's standards". Ie, moderating what people can say as part of their legal and political engagement with society.
I recall when Australia had a suppression order about Cardinal Pell, high ranking official in the Catholic church who was convicted of various sex offences. And in fairness the case was a political football so the order was reasonable. It was eventually overturned but reputational damage was done because, unfortunately for the courts, there are too many foreign news organisations so the block failed miserably and it was major news in Australia without any official Australian news sources covering it.
It would be relatively easy to enforce that sort of block if the major foreign distributors were just Facebook or YouTube. They'd probably cooperate with the Australian authorities on request.