8 ms·

Vimeo Disabled My Account for Submitting HTML

85 points by hispanic 7y ago

s09dfhks 7y ago
Reminds me of that startup that recently got knocked off the web by digital oceans automated system. Scary to think that for us average Joes, our accounts can be nuked with no recourse unless you have a large Twitter following to get someone important to notice
- stcredzero 7y ago
  Scary to think that for us average Joes, our accounts can be nuked with no recourse unless you have a large Twitter following to get someone important to notice Wasn't Google the original author of this kind of customer service? Don't be Evil, but do go ahead and be Kafkaesque.
- netsectoday 7y ago
  You navigate these types of controls every day without realizing it. The web is now a nuclear testing range and these insanely aggressive countermeasures are necessary to operate. My assumption here is that they have a back-end system auto-blocking injected html that makes it to the server, and some ui-level filter failed. I'd love to hear the follow up and would expect this answer.
- wolco 7y ago
  I'm surprised customer service just doesn't exist. Google can get away with it but vimeo with 15% market share can't afford to throw in the towel on support already.
  - justinclift 7y ago
    > Google can get away with it ... It's interesting. They definitely feel they can "get away with it". However they're likely building up a sizeable group of people who they've negatively affected and will return the favour in spades when opportunity presents.
  - gowld 7y ago
    How much customer service should a $0/month subscription buy?
    - efraim 7y ago
      At least enough to unsuspend the account after they suspend it by mistake.
    - wolco 7y ago
      Put another way videos uploaded by the average user earned vimeo 'x' dollars over the last month. Without any revenue they close up. How many customers can they afford to lose? 5%,10%, 90% If they don't support the free tier users they will lose them. At one point vimeo was making a serious run for global marketshare.. now it looks like they are in a different market..
      - muglug 7y ago
        > At one point vimeo was making a serious run for global marketshare Vimeo hasn't been going for global marketshare of video watching in well over a decade - it ceded that competition to YouTube very early on by policing content more actively (Viacom sued YouTube in 2007 for $1B because of its lax enforcement of rules). Vimeo chose a different direction, launching a paid account in 2008: https://vimeo.com/1977937 https://vimeo.com/1977937
vortico 7y ago
I used to use Vimeo for hosting product videos that I embedded onto my website. It was better than YouTube because it didn't show "recommended videos" (often with competitors' products or useless videos) after it finished playing. But then Vimeo started doing it too for embedded videos, so I switched to YouTube since users are more familiar with its UI.
- Scaevolus 7y ago
  You can pass rel=0 to YouTube iframes to only recommend additional videos from the same channel. https://developers.google.com/youtube/player_parameters#rel https://developers.google.com/youtube/player_parameters#rel
  - duskwuff 7y ago
    For now, at least. "rel=0" used to mean "don't show related videos at all"; now it means "only show related videos from the same uploader", and I wouldn't be shocked if YouTube limited its functionality even further in the future.
jarfil 7y ago
At least they tell you what's going on, some other websites will just throw you a "login failed" and that's it.
muglug 7y ago
I work at Vimeo. We use automated detection to flag suspicious accounts. This was a clear false-positive, and the account has been unsuspended. We don't convert urls to hyperlinks in video descriptions when the user has signed up recently, because hyperlinked urls have been used by spammers to trick visitors into visiting fraudulent sites. This is clearly legitimate behaviour in context, but a brand-new user posting identical descriptions and urls on multiple videos is behaviour commonly seen in spam accounts, and we tend to err on the side of caution. Edit: clarified circumstances under which urls are converted
- anderskaseorg 7y ago
  That’s…what HTML escaping is for…?
  - SquareWheel 7y ago
    What do you mean? Escaping doesn't help with links to spam or fraudulent sites.
  - kazinator 7y ago
    What do you mean "HTML escaping"? If we escape HTML in the conventional sense, then it becomes literal text; you see <a href="whatever">...</a> instead of a clickable link because < is escaped as < and so on. User-submitted HTML content can be scrubbed against malicious tags such as scripts, cross-site exploits, or hacks involving broken syntax that disrupts the surrounding page into which it is embedded. But there is no simple way to allow a brand new user to embed a working URL, such that malicious URLs are prevented; basically you need a giant blacklist and whitelist of domains. A better UI here would be not to ban the account but just not allow the user to save the content containing HTML. The message should say "Sorry, brand new accounts are not allowed to post HTML content". Many new accounts posting HTML content are going to be legitimate.
    - blackflame7000 7y ago
      What if every link was encoded with something like a tinyUrl and then whenever the link was clicked, during the translation process, check if a link is blacklisted. This also has the added benefit of allowing statistics to be gathered on common links across multiple accounts.
Causality1 7y ago
>indicating that it may be in violation of our Acceptable User Policy. Well, was it? The author makes no claim that he didn't violate the policy.
- hispanic 7y ago
  I didn't find anything in any of their policies that submitting markup for inclusion in the video description is a violation.
andrewstuart 7y ago
It's important to quickly abandon companies that have automated account closure systems. The message has to be conveyed to these companies that automated account closures result in loss of business. Automated suspicious activity systems should be flagging the issue for human attention within that company, where presumably someone will make a considered decision about the issue and communicate effectively with the account holder about what the issue is to understand and resolve it. Auto account closures are completely unacceptable where someone is paying for that service.
- burnte 7y ago
  First, he mentioned explicitly that he did not pay for their service, he was a free user. Second, every system open to the public that has even a moderate amount of users has automated abuse detection and mitigation techniques in place. It's flat out irresponsible to not have such systems in place, ESPECIALLY if you have paying customers s the opportunity for abuse are huge.
- fao_ 7y ago
  It feels like this comes from a point of view of privilege. You would rather thousands of people work for a mind-numbing call-center-like task just so there are no false positives, and the company expend hundreds of thousands of dollars on this, rather than experience a temporary problem that can be resolved with one or two emails.
danShumway 7y ago
Something I've found to be true in both game design and software UX is that generally speaking, you want users to feel safe trying new things. This helps sidestep some problems that tech-illiterate users have where they become scared to guess where anything is and have to be shown how to do everything. In game design, it makes it easier to teach users new mechanics. It's also a prerequisite to having more intuitive, predictable interface. You can train people to just try clicking things or looking in their settings to see if something will work, but only if they're not worried that they're about to break the application. In a game, people will experiment and learn new mechanics, but not if they're worried that doing something wrong will come with severe consequences. Reading this, I'm suddenly struck that policies and terms are subject to the same rules. Of course I know that the point of having vague policies around stuff like this is very explicitly to not allow bad actors to feel safe probing your system. The point is to avoid the above scenario. But it occurs to me that this is a tradeoff. In order to keep bad actors from experimenting, you are also going to keep good actors from experimenting. People will be very careful not to go off the beaten path with your service, even to the point where they'll avoid building creative things. They'll contact support more often instead of just trying things, and they'll be less creative with how they use your platform. Back when Youtube still had annotations working, I saw people building weird overlays and choose-your-own-adventure videos. Seeing that I could get banned this quickly for even accidentally stepping out of line in one place, I would never try something like that on Vimeo. This doesn't mean that Vimeo's policies are bad. Vimeo may not even want people to experiment with their service. But the choice to immediately ban users, rather than popping up a notification or error message -- it's not just a policy decision, it's a UX/design decision, and it changes the way that ordinary people will interact with the company.
lone_haxx0r 7y ago
I'm thinking about making a website that lists all dark patterns and user experience fudges of a given service/app/website so that we users/customers can better choose where our time/money is going. Users would be able to complain about: Phantom credit card charges, captcha walls, requiring cellphone verification, random account termination, etc. What do you think about it? I think it's really susceptible to astroturfing, but maybe there's a way to fix that.
- deleted 7y ago
  [deleted]
- QuadmasterXLII 7y ago
  If I grabbed 50 friends and we all posted identical and untrue complaints on your website, stating that you randomly deleted our accounts, would you delete our accounts?
  - lone_haxx0r 7y ago
    Not those accounts specifically. Maybe I would have to implement a system that deletes accounts automatically when comments are identical. It's unlikely though, because I prefer to err on the side of deregulation and would not like to delete accounts, even if I'm 90% sure that those accounts are bots. I presume innocence until proven guilty (where guilty: breaking the site rules). It's impossible for me to know what complaints are true and which aren't for every complaint in the site, so I wouldn't delete any of them based solely on their truth value. I wouldn't even delete those that I know are false. It's all imagination though, I don't know if I'm ever going to create the site. I just wanted to gauge interest and maybe receive some criticism.

85 points by hispanic 7y ago

Reminds me of that startup that recently got knocked off the web by digital oceans automated system. Scary to think that for us average Joes, our accounts can be nuked with no recourse unless you have a large Twitter following to get someone important to notice

stcredzero 7y ago
Scary to think that for us average Joes, our accounts can be nuked with no recourse unless you have a large Twitter following to get someone important to notice Wasn't Google the original author of this kind of customer service? Don't be Evil, but do go ahead and be Kafkaesque.
netsectoday 7y ago
You navigate these types of controls every day without realizing it. The web is now a nuclear testing range and these insanely aggressive countermeasures are necessary to operate. My assumption here is that they have a back-end system auto-blocking injected html that makes it to the server, and some ui-level filter failed. I'd love to hear the follow up and would expect this answer.
wolco 7y ago
I'm surprised customer service just doesn't exist. Google can get away with it but vimeo with 15% market share can't afford to throw in the towel on support already.
- justinclift 7y ago
  > Google can get away with it ... It's interesting. They definitely feel they can "get away with it". However they're likely building up a sizeable group of people who they've negatively affected and will return the favour in spades when opportunity presents.
- gowld 7y ago
  How much customer service should a $0/month subscription buy?
  - efraim 7y ago
    At least enough to unsuspend the account after they suspend it by mistake.
  - wolco 7y ago
    Put another way videos uploaded by the average user earned vimeo 'x' dollars over the last month. Without any revenue they close up. How many customers can they afford to lose? 5%,10%, 90% If they don't support the free tier users they will lose them. At one point vimeo was making a serious run for global marketshare.. now it looks like they are in a different market..
    - muglug 7y ago
      > At one point vimeo was making a serious run for global marketshare Vimeo hasn't been going for global marketshare of video watching in well over a decade - it ceded that competition to YouTube very early on by policing content more actively (Viacom sued YouTube in 2007 for $1B because of its lax enforcement of rules). Vimeo chose a different direction, launching a paid account in 2008: https://vimeo.com/1977937 https://vimeo.com/1977937

vortico 7y ago

I used to use Vimeo for hosting product videos that I embedded onto my website. It was better than YouTube because it didn't show "recommended videos" (often with competitors' products or useless videos) after it finished playing. But then Vimeo started doing it too for embedded videos, so I switched to YouTube since users are more familiar with its UI.

Scaevolus 7y ago
You can pass rel=0 to YouTube iframes to only recommend additional videos from the same channel. https://developers.google.com/youtube/player_parameters#rel https://developers.google.com/youtube/player_parameters#rel
- duskwuff 7y ago
  For now, at least. "rel=0" used to mean "don't show related videos at all"; now it means "only show related videos from the same uploader", and I wouldn't be shocked if YouTube limited its functionality even further in the future.

jarfil 7y ago

At least they tell you what's going on, some other websites will just throw you a "login failed" and that's it.

muglug 7y ago

I work at Vimeo. We use automated detection to flag suspicious accounts. This was a clear false-positive, and the account has been unsuspended. We don't convert urls to hyperlinks in video descriptions when the user has signed up recently, because hyperlinked urls have been used by spammers to trick visitors into visiting fraudulent sites. This is clearly legitimate behaviour in context, but a brand-new user posting identical descriptions and urls on multiple videos is behaviour commonly seen in spam accounts, and we tend to err on the side of caution. Edit: clarified circumstances under which urls are converted

anderskaseorg 7y ago
That’s…what HTML escaping is for…?
- SquareWheel 7y ago
  What do you mean? Escaping doesn't help with links to spam or fraudulent sites.
- kazinator 7y ago
  What do you mean "HTML escaping"? If we escape HTML in the conventional sense, then it becomes literal text; you see <a href="whatever">...</a> instead of a clickable link because < is escaped as < and so on. User-submitted HTML content can be scrubbed against malicious tags such as scripts, cross-site exploits, or hacks involving broken syntax that disrupts the surrounding page into which it is embedded. But there is no simple way to allow a brand new user to embed a working URL, such that malicious URLs are prevented; basically you need a giant blacklist and whitelist of domains. A better UI here would be not to ban the account but just not allow the user to save the content containing HTML. The message should say "Sorry, brand new accounts are not allowed to post HTML content". Many new accounts posting HTML content are going to be legitimate.
  - blackflame7000 7y ago
    What if every link was encoded with something like a tinyUrl and then whenever the link was clicked, during the translation process, check if a link is blacklisted. This also has the added benefit of allowing statistics to be gathered on common links across multiple accounts.

Causality1 7y ago

>indicating that it may be in violation of our Acceptable User Policy. Well, was it? The author makes no claim that he didn't violate the policy.

hispanic 7y ago
I didn't find anything in any of their policies that submitting markup for inclusion in the video description is a violation.

andrewstuart 7y ago

It's important to quickly abandon companies that have automated account closure systems. The message has to be conveyed to these companies that automated account closures result in loss of business. Automated suspicious activity systems should be flagging the issue for human attention within that company, where presumably someone will make a considered decision about the issue and communicate effectively with the account holder about what the issue is to understand and resolve it. Auto account closures are completely unacceptable where someone is paying for that service.

burnte 7y ago
First, he mentioned explicitly that he did not pay for their service, he was a free user. Second, every system open to the public that has even a moderate amount of users has automated abuse detection and mitigation techniques in place. It's flat out irresponsible to not have such systems in place, ESPECIALLY if you have paying customers s the opportunity for abuse are huge.
fao_ 7y ago
It feels like this comes from a point of view of privilege. You would rather thousands of people work for a mind-numbing call-center-like task just so there are no false positives, and the company expend hundreds of thousands of dollars on this, rather than experience a temporary problem that can be resolved with one or two emails.

danShumway 7y ago

Something I've found to be true in both game design and software UX is that generally speaking, you want users to feel safe trying new things. This helps sidestep some problems that tech-illiterate users have where they become scared to guess where anything is and have to be shown how to do everything. In game design, it makes it easier to teach users new mechanics. It's also a prerequisite to having more intuitive, predictable interface. You can train people to just try clicking things or looking in their settings to see if something will work, but only if they're not worried that they're about to break the application. In a game, people will experiment and learn new mechanics, but not if they're worried that doing something wrong will come with severe consequences. Reading this, I'm suddenly struck that policies and terms are subject to the same rules. Of course I know that the point of having vague policies around stuff like this is very explicitly to not allow bad actors to feel safe probing your system. The point is to avoid the above scenario. But it occurs to me that this is a tradeoff. In order to keep bad actors from experimenting, you are also going to keep good actors from experimenting. People will be very careful not to go off the beaten path with your service, even to the point where they'll avoid building creative things. They'll contact support more often instead of just trying things, and they'll be less creative with how they use your platform. Back when Youtube still had annotations working, I saw people building weird overlays and choose-your-own-adventure videos. Seeing that I could get banned this quickly for even accidentally stepping out of line in one place, I would never try something like that on Vimeo. This doesn't mean that Vimeo's policies are bad. Vimeo may not even want people to experiment with their service. But the choice to immediately ban users, rather than popping up a notification or error message -- it's not just a policy decision, it's a UX/design decision, and it changes the way that ordinary people will interact with the company.

lone_haxx0r 7y ago

I'm thinking about making a website that lists all dark patterns and user experience fudges of a given service/app/website so that we users/customers can better choose where our time/money is going. Users would be able to complain about: Phantom credit card charges, captcha walls, requiring cellphone verification, random account termination, etc. What do you think about it? I think it's really susceptible to astroturfing, but maybe there's a way to fix that.

deleted 7y ago
[deleted]
QuadmasterXLII 7y ago
If I grabbed 50 friends and we all posted identical and untrue complaints on your website, stating that you randomly deleted our accounts, would you delete our accounts?
- lone_haxx0r 7y ago
  Not those accounts specifically. Maybe I would have to implement a system that deletes accounts automatically when comments are identical. It's unlikely though, because I prefer to err on the side of deregulation and would not like to delete accounts, even if I'm 90% sure that those accounts are bots. I presume innocence until proven guilty (where guilty: breaking the site rules). It's impossible for me to know what complaints are true and which aren't for every complaint in the site, so I wouldn't delete any of them based solely on their truth value. I wouldn't even delete those that I know are false. It's all imagination though, I don't know if I'm ever going to create the site. I just wanted to gauge interest and maybe receive some criticism.