Hacker News Reader

Comment by gojomo | Hacker News Reader

For 48-72 hours, some books appeared fewer places on Amazon's site.

Many of those same books got lots of extra attention from elsewhere, as examples of affected titles.

So some authors probably lost a little, others gained a little (by either being examples, or simply filling the slots emptied by affected titles).

If the loss to specific titles was significant, Amazon could easily restore the previous balance with a few days' enhanced promotion. So the amount of 'victimization' here is pretty small.

View on HN

Perhaps we are forgetting that Amazon is a victim as well. If Amazon is unable to seek punishment against malicious users of its site, it is forced to spend its time and money patching security holes and preventing future attacks, in addition to repairing lost good will from customers and authors.

It always surprises me how quick people are to jump to the conclusion that the website operator is at fault for these sorts of malicious uses. It flies in the face of simple economics. The burden on Amazon to protect its site probably ranges in the thousands or millions of dollars; the benefit to the malicious user is a couple of laughs and a funny blog post. It would seem economically inefficient to say that the burden lies on Amazon, in this situation, to protect itself.

(Indeed, I don't believe anyone would analogously say that a thief is not responsible for acts of theft, because they provide a "free lesson in home security" to the victim. Why the difference when we move to the online realm?)

Even if one could accept that Amazon cannot possibly plug all vulnerabilities and should not be expected to do so against all attacks, we're still left with the obvious mistake of implicitly entrusting their users with the ability to -- automatically and without proper vetting -- alter whether or not certain items display on certain areas of their site. This fact, given automation via a bug or not, means that the tactic could have been used more maliciously and more covertly to bring additional damage (say, by getting an author's book delisted).

At the end of the day, do I think Amazon really deserved to be "taught a lesson"? No; he could have just contacted them with the exploit and been done with it. Could it have been worse? Most likely, yes. Plus, I found the resulting e-uproar to be quite hilarious. To think, people actually believed Amazon would intentionally and openly discriminate against those groups out of no where... it's very laughable, you must admit.

But what if trusting users works 363 days a year -- it helps users find and buy more books, it makes authors and Amazon more money. Every once in a while, it causes an embarassing screwup that can be reversed in 1-3 days.

Is having that system in place a mistake? What if the alternative system, that never has a 2-day-screwup, also means fewer lehappy customers and less-profitable operations the other 363 days?

Reply on news.ycombinator.com