4 ms·
Medium's Policies and Guidelines
- samsolomon 11y agoI don't know if there are other companies doing this, but putting privacy and terms of service updates on GitHub seems like a simple way to be transparent. It makes it easy to see what has been added and removed from previous updates.
- Viper007Bond 11y agoAll of my employer's legal documents are available on GitHub as well under the same license: https://github.com/Automattic/legalmattic https://github.com/Automattic/legalmattic We also keep a changelog on our site as an alternative: https://wordpress.com/tos-change-log/ https://wordpress.com/tos-change-log/
- gkoberger 11y agoWe've been doing that, and every time we push it auto-pulls from GitHub. Works like a charm, and feels way more transparent. http://readme.io/tos/ http://readme.io/tos/
- 2arrs2ells 11y agoWe've been doing this for a while at Clever: https://github.com/Clever/policies https://github.com/Clever/policies and got some other folks in the EdTech world to join us: https://www.edsurge.com/news/2015-04-08-edtech-companies-open-source-privacy-policies-on-github https://www.edsurge.com/news/2015-04-08-edtech-companies-ope... (Privacy policies are a hot topic in EdTech these days!)
- tadfisher 11y agoWe've been doing this for a while now, which may be unique in the banking space. https://github.com/SimpleFinance/policies https://github.com/SimpleFinance/policies
- sandworm101 11y agoImho such legal documents should be kept on machines under more direct control. You want to, at a minimum, be able to pull the plug if someone starts messing with the contract between you and your customers. They can do too much pr damage too quickly. I'm even hesitant to endorse hosting them via clouds.
- kbenson 11y agoThat's really more of an issue if you are serving them directly via GitHub, or linking to GitHub. Presumably they have a local repo, so if someone did something nefarious with the revision history, it would be easy to detect, but having it online with revision history does make it more transparent. Really, what we have here is the draft documents from which they publish their policies and guidelines, just like a public source repo is a draft repo from which production is deployed (hopefully).
- geofft 11y agoThere are copies of these on medium.com: https://medium.com/policy/medium-terms-of-service-9db0094a1e0f https://medium.com/policy/medium-terms-of-service-9db0094a1e... https://medium.com/policy/medium-rules-30e5502c4eb4 https://medium.com/policy/medium-rules-30e5502c4eb4 https://help.medium.com/hc/en-us/articles/214151487 https://help.medium.com/hc/en-us/articles/214151487 I don't see an indication that the GitHub version is legally binding.
- sandworm101 11y agoAh. Then they probably already have someone like me in their organization.
- lazaroclapp 11y agoArguably, if your code is hosted by a third-party, the legal document is the least of your problems. If someone modified your legal documents without your knowledge, you are likely to be able to fight it as having been a victim of fraud yourself, and you wouldn't be expected to abide by fraudulent contracts created by a third party impersonating you, right? (I don't really know for sure, you are the attorney, but I'd be surprised if you were liable for forged contracts) On the other hand, if your code is modified, it can exfiltrate data that you are never getting back, no matter what the legal system says. Even credit card numbers are not the worst, since in theory you can end up reversing every single fraudulent transaction made, and insurance might cover your liability. But in the case of Medium, it could, say, leak the real world identity of a blogger or citizen journalist in a place where doing so would put their lives at risk. So if you are already trusting a third party with the lives of your users who are trusting you with their lives (whether they should or not), is having the text of your EULA swapped by the lyrics of "I am never gonna give you up" really a worst case scenario? At this point, given how many people use it as the authoritative source for their software, GitHub is already critical infrastructure, on par with GPS and the electrical grid of many countries. So if GitHub goes rogue or is compromised, the damage can be pretty catastrophic. Brave new world, ain't it?
- nyfresh 11y agoI think have seen this used for laws and law changes. Im surprised it has not been massively adopted
- rpgmaker 11y agoWhatever happened to that XML alternative Linus was working on? It was supposed to be very similar to git but document-focused.
- notatoad 11y agoThe title seems to have changed in the last couple minutes from "Medium puts their terms of service on github" to "medium's policies and guidelines". Just in case anybody is wondering why medium's terms of service are at the top of HN right now
- JacobHenner 11y agoIt's important to note that a malicious organization could always backdate revisions, and force push over the github repository.
- jdminhbg 11y agoNot with matching SHAs though, so someone dedicated to tracking changes would know.
- startling 11y agoGit's hashing is not cryptographically secure.
- arjunnarayan 11y agoAll it takes is a single person having it cloned, who can call them out because the hash values would have changed. This isn't really a realistic threat.
- gcr 11y agoThat single person who cloned it could also backdate their hashes and claim things changed when they didn't.