tdrp

By the way how do you detect VPN traffic? For tor we just pick up the list of exit nodes but we've had trouble identifying VPN without using a 3rd party API.

It seems some of the decision hinged around this fact from the article: "self-inflicted wounds are not irreparable injury".

I wonder if there could have been a better sequence of events (e.g. sue first rather than sneaking it in)?

You would think a developer accused of something as serious as _fraud_ would have their apps at least removed from the app store... this whole thing is a little odd.

His app opens fine for me: https://apps.apple.com/us/app/attics/id1434981632

Does it normally disappear if a dev account is terminated?

Plus these games were pre-internet so when you got stuck or lost somewhere you got really stuck. I remember spending over a month looking for something called "the hall of the mountain king" in ultima 8, to the point that I had hand drawn a bunch of maps and carefully planned out exploration paths.

Not a lawyer but what does "conceal" mean when it comes to websites like forums? You often see probably illegal stuff show up on popular forums and they eventually get banned/removed by moderators. Does that mean the moderators "concealed" it and are therefore liable?

This. Some people seem to be on the "Apple deserves a cut of 30% because they run the app store and 30% is reasonable etc." but what if tomorrow Apple just said: "OK we've bumped up the 30% to 90%".

The exact same set of arguments would follow. The users already own the phones so for the "market to adjust" to such changes would take years.

Seriously. We generally release most of our new features at 10% of the users and then gradually increase the percentage on the server end. If there's any issue we can turn it off immediately rather than potentially waiting days for the app store to approve our fix.

They do, but a lot of the social good companies are not actually non-profits but more like low-profit/high-impact, or B-corp style. In fact a few states have Benefit Corp/Social Purpose Company LLC-like structures.

So it puts you in a somewhat weird spot since you will never be potentially worth a billion dollars (which is the guideline for the for-profit track of YC) nor are you a pure non-profit.

It'd be cool if they added such a track or loosened the non-profit restrictions so it's not necessarily a 501c3 structure.

I wouldn't call it a waste of time but it did feel like it was targeted more towards very early-stage start-ups, and was probably helpful mostly to them.

If you have some kind of traction and experience, the video conferences felt pretty awkward because a lot of the founders were completely inexperienced and would try to be helpful by giving you "advice" they'd read in a blog somewhere or really obvious stuff.

According to this TC article, it's basically illegal for a company to pay the ransom:

https://techcrunch.com/2020/07/25/garmin-outage-ransomware-s...

I sort of agree with that since if companies start paying up then suddenly that thing will be more and more widespread.

I think most tech founders are more than capable of getting a decent paying engineering corporate job if they choose to do so.

The problem (at least for me, who started off in FAANG initially) is that the longer you're in the start-up world, the more you hate the idea of going back to a corporate job.

So in my previous start-up I went all-in, racked up tens of thousands in CC debt and would have sold every single one of my possessions before letting it happen. When I missed my first rent payment, I ended up reluctantly selling the company and only accepted the offer on the condition that my transition period would be one month or less (i.e. I don't actually have to work for the acquirer).

Throughout that time, my previous coworkers/managers from the companies I originally worked for kept trying to convince me to come back.

Only slightly related, but back when GDPR was first enacted I mentioned that it would inadvertently open up some vulnerabilities and that it should have been reviewed by white hat security researchers.

- "Download all my data" was mandated by GDPR (article 20)

- Right to delete, right to access made it so that there is up to a ten million dollar fine if you refuse it, so you are more prone to social engineering attacks. Meaning if some user requests access or deletion, (e.g. having forgotten their password or username) you might not be 100% sure that it's him but arguing with him or asking too personal a verification proof can get you in hot water and you'd rather not get dragged into a fight with the European committee.

- While our users could initially create an account without e-mails and be relatively anonymous, a couple of "right to access" requests from "users who have forgotten their username" means you are basically forced to require e-mail, thereby carrying even more PII unnecessarily.

It probably wouldn't have slowed the hackers down much here though.

IIRC he allegedly also tried to wipe all evidence of it which is why it was hard to prove. So it seems he knew what he was doing.

Here's his own quote: "I downloaded this file with the intent to use it for the benefit of someone other than Google,"

https://www.nbcnews.com/tech/tech-news/former-google-self-dr...

As I mentioned in a different thread, I love it because it's so stable. There's no constant shaking or rocking, and you don't get woken up every 5 minutes by random minor turbulence - it just powers through it like the beast that it is.

Since nobody's mentioned it yet: I find they feel very stable in turbulence. I used to do the SFO-Europe route 10-12 times a year and whenever we were on an A330 and encountered even mild turbulence the food would end up on our face and neighbor's coffee on my lap.

I'm not an aeronautic engineer so I can't explain why but the ride was always smooth on 747s even in otherwise non-ideal conditions. I've flown the 787 since then and I don't even think it handles as well, but not enough data. I will miss it.

I was rejected for one a couple of months ago even though I could have paid it in cash a few times over.

They really don't like start-ups that don't have super regular income flows, and really don't look at much else if that condition isn't met. I assume a few people on here are in that bucket.

I mean you can store EU users' data on an EU server but if any US users are allowed to communicate/look at EU users then obviously the data is going to travel across the ocean. Maybe I'm reading too much into what constitutes as "personal-data" but last I checked they had broadened that a lot. What happens if I view a EU user's linkedin profile from the US - isn't that all personal data? I hope there's at least an informed consent opt-out for this.

If not, it's not super clear to me what the work-around is other than completely isolating the continents.

Is there some kind of "we are in the EU and understand our data will be stored in the US and can be surveilled" consent box?

What about platforms that connect people from all over the world? Yeah you can store EU users' data on an EU server but what if a US user checks out a EU user's profile. Or are we supposed to completely disconnect each continent?

We had a non-tech lead at some point (although his title was something like development manager) and he would praise my coworker for how many check-ins he did. Except that coworker would do things like:

1- Copy-paste an entire class into a new class and change a single constant in it, because he was too lazy to do inheritance.

2- "Solve" multiple bugs a day that he had introduced himself the day before.

3- Loudly complain about other people's frameworks/codes.

He was the super confident type even though he was wrong more often than not. But paired with a non-tech lead with his own impostor syndrome, it was a recipe for disaster.

It was horrifying to see how many config changes you have to do to basically beg facebook not to send back data to their server. Most of these were hidden in various corners of the documentation and I still suspect there's crap being sent back without permission. I would love nothing more than to disable the SDK entirely but we have a few hundred thousand users logged into our app via Facebook.

Here is our Android config in case anyone's interested:

<meta-data android:name="com.facebook.sdk.AutoLogAppEventsEnabled" android:value="false"/>

        <meta-data android:name="com.facebook.sdk.AdvertiserIDCollectionEnabled"
                android:value="false"/>

        <meta-data android:name="com.facebook.sdk.AutoInitEnabled"
                android:value="false"/>

They told us that explicitly. We had been using the URL-based login on the app (i.e. open a browser with the URL and use the redirect to continue logging in), for almost two years. Then about a year ago, they e-mailed us just before a holiday and told us we had less than a week to move all of our apps to SDK otherwise they'd just disable us. Their argument was that "it's not providing the best possible experience to our users". There hadn't been a single complaint about it though.

We had nearly 100,000 users logged into our app via Facebook login so we were basically strongarmed into complying. We somehow pulled it off before the deadline for both Android and iOS but felt really dirty afterwards.

Definitely extreme - ideally I would want something like a "restraining order" against the disruptive user that legally compels them to no longer use the website. If they still break that, then probably fines+damages of some kind. But you know, something.

The other extreme which some people are advocating "let the users do whatever the hell they want and it's your own fault if they keep spoofing fb accounts/phone numbers and creating new accounts" I find pretty bad and tone-deaf; it gives carte blanche to bad behavior. Any malicious user who is set on messing with you becomes a full-time job to deal with. Most people who run some kind of B2C website have run into this and once you hit 1M+ users you are bound to be dealing with a handful of those at any one time.

Thanks - I feel like there should be something to legally strong-arm banned users into staying away. CFAA is one of the most direct: “I have banned you from my site and you keep coming back so I will take you to court to make you stop”. For those users we don’t really want to get damages from them as much as we just really want to never have to deal with them again. I’d even be fine with a restraining order Against the person using the site kind of thing as the maximal punishment.

If it were a physical store and you kicked someone out for bad behavior and then they kept coming back by wearing different wigs or something, it would still be illegal.

It seems like any harassment complaint would have to be raised by the victims directly rather than by us, the service provider. In practice they just leave the site and never come back.

So what would the recourse be in this case for a bad actor? How about for one who generates dozens of accounts every day and spams others?

Thanks I agree. We thought the same and nowadays we look through the photo upload dates to get an estimate of when it was created. It was somewhat helpful.

I mean they would log in with FB, through a VPN, then verify a phone number which was usually some throwaway. I am not sure how we could be more strict short of asking all of our users for pictures of their IDs. We were explicit with the user that they were banned and not allowed on the site anymore. I wonder how we would have made sure that user never returned.

We had a bad user who we kept banning for harassing other users. He would come back over and over again, using different pictures, IPs, even throwaway phone numbers or FB accounts etc. We ended up stopping him by involving a lawyer who drafted a letter invoking the CFAA. But it revolved around him violating our terms of service (eg no harassment, banned users are banned forever etc.)

Anybody know: Would CFAA still apply here if EFF wins this case? Or are there any other laws which would cover this kind of unauthorized access?

Thanks!

For me it wasn't totalitarian but "corrupt beyond salvation" (think bottom 50 on corruption index). A friend of mine recently went back and lasted six months before he came back to the US - he opened a startup and had to deal with bribes, threats, blackmail and "forced partnerships". I myself would never go back there.