Thank you. Just did.
243 karma · joined March 13, 2014
Certainly the pandemic helped with mass adoption but they've also just built a more competitive product.
Thanks for laying all of this out. Hopefully some politicians will take notice.
It sounds like it's basically impossible to run a business without paying bribes. I imagine even if you got through the NA certificate process, they would come around later for "inspections."
To be honest, most Chinese restaurants probably serve more vegetables (and roughly the same amount of fat and carbs) than a meal at a non-Chinese restaurant at the same price point.
From just personal experience over the last two decades, the number of "authentic" Chinese restaurants has increased a lot in most of the places I've lived. So has the number of Thai/Korean/Japanese restaurants run by Chinese owners, as more savvy Chinese restauranteurs seek out higher margins.
Everybody loses money to fraud, but as long as they invest enough money and resources they can keep those fraud losses to an acceptable level. Because criminals are infinitely creative, the problem will never be "solved." There will always be new moves and new countermoves.
Total security is an illusion. Everyone who's worth hacking or worth defrauding will get hacked or defrauded sooner or later. The people who have made the necessary investments are able the contain the damage. The other ones, or the really unlucky ones, end up dying off.
switch off of the web into an App: Can't just shut down your website. Also, device farms and VM farms are super common so it won't even help.
require sign-ons against an internal system for authentication: Sure, you can require your users create an account. Accounts can be created by the thousands by bots. Even if you use captchas, captchas don't work, and even if they did I can find you 100 people who will sign up for accounts manually and sell them to you for 10 cents a piece.
policy people actively: I assume you mean police people effectively. Kind of hard to "police" your customers when a huge percentage of them sign up once, buy something, and maybe only come back 3 years later. In the meantime, their super simple passwords may have been hacked and leaked 10 times already. Maybe you should require your customers all use 2FA. Let's see how many customers you have remaining once you turn that on.
One group of "bad guys" are the ones who want to track what you're doing even after you've cleared your cookies or track you across different domains or different apps. I would argue that this group is the smaller group, but browsers have been taking actions to make their jobs harder, including the "Facebook fence" that Firefox implemented.
There's a second group, which is the cybercriminals (or maybe just grey-market). Think Russian bot farms and purchase fraud bots, but also the guys who sell clicks and followers and rankings, and the ticketmaster bots and black friday bots and such. Those guys do their business by creating thousands or millions of fake accounts, and then funneling their transactions through them. They generally use scripts and cloud farms (sometimes even physical device farms). So app makers and websites need a way to detect when they're being attacked by one of those guys, and the way they do it, is more and more, through fingerprinting.
So every step browser and OS makers take to make the first group of "bad guys" jobs harder also makes the second group of "bad guys" jobs easier, because it makes it easier for them to pretend to be legitimate users.
The problem is that it used to be good enough to block "known-bad" IPs but now with AWS and cloud services it's very easy for cybercriminals to get around IP blocks.
For normal users, tracking can be done with cookies, so fingerprinting isn't really needed for normal users anyways (not entirely true if you're a totally bad actor, which is why browsers have been trying to block some of the more common ways to fingerprint).
But for a script that spawns a thousand AWS instances to sign up 1000 bot accounts that can then be used to sell likes for example, it's pretty easy to tell that it's a script instance because all of them will behave in almost exactly the same way (processor performance, installed plugins, reported screen size, etc. etc.).
An "alternative" to using fingerprints would be to use captchas instead, but bots have gotten much much better at solving captchas. So in fact, ReCaptcha will also use a number of fingerprinting techniques, which is why in many cases you can just click the check box instead of solving a captcha.
Sending data to Google, FaceBook and AppsFlyer (and other American companies) is generally legal under GDPR.
All three companies are covered under the US-EU Privacy Shield framework: https://www.privacyshield.gov/participant_search
Furthermore, sending PII data to a non-EU country is also allowed under GDPR as long as the company in question obeys the GDPR rules. Like I said, those rules are complex, and there could very well be some technical violations by TikTok, but that's not demonstrated here.
Browser/device fingerprinting for anti-fraud is a well established industry practice. Browser makers don't like this practice and have taken steps to make it harder, but the truth is that it's used across the industry.
The open source license violations could be actual civil, but not criminal, violations. TikTok does maintain a list of open source licenses here: https://www.tiktok.com/legal/open-source?lang=en It looks like it's only for its app and not its website though. Violations of the MIT/BSD license by using a npm package and forgetting to include it in the documentation, unfortunately is pretty common across the industry. That doesn't make it right, and we should hold big companies to a higher standard of compliance, but if anybody wanted to make a complaint it would have to be the copyright holder.
TL/DR: I don't think the author demonstrated anything illegal here or out of line with normal industry practice. You can argue about the morality of certain industry practices (like fingerprinting) but TikTok is far from an outlier here.
The appraisal system is often massively overinflated, however.
You won't receive anywhere close to what you paid for, much less the the overly inflated appraisal that you got, on the secondary market. Rule of thumb is maybe 30% or less if you bought it from a mall store. But there is a thriving second hand market.
Would you pay 13.5% more per account for a company that's growing at least 5x, if not 10x as fast? I know I would in a heartbeat, all else being equal.
Now, not all else is equal, so you can make an argument either way, but I wouldn't call Robinhood's valuation "insane."
The problem with Robinhood, like many startups, is an issue of profitability and monetization. They've been switching up Robinhood Gold to try to get more customers to sign up. I'm sure that's where a lot of their effort is being put as they approach "have to IPO" valuations.
This low dollar amount round is also an indication that while they are still burning money, they may not be burning as much as they may have in the past. If I were to guess, turning on self clearing was a big part of that.
People often focus on the HFT payments for order flow, but another important leg of the stool (along with stock lending, and the premium tier/margin lending) is the interest rate differential.
If rates were going to 5%, that'd be one thing, but with rates at 2-2.5 and a couple of cuts being priced in, that's going to decrease profits there.
Also it's kind of hard to launch a 3% cash management account when the ten year is yielding 2.3%.
That's not going to be good enough for Huawei.
Similarly, all of those alternative OSes aren't going to work if they're not binary, and more importantly API compatible with Android + GMS.