6 ms·

Reading https://www.buymeacoffee.com/terms https://www.buymeacoffee.com/terms These potentially seem like some fairly onerous restrictions, and would potential

by cwkoss 7y ago

Reading https://www.buymeacoffee.com/terms https://www.buymeacoffee.com/terms These potentially seem like some fairly onerous restrictions, and would potentially exclude nearly all of my favorite youtube channels. What is your definition of "creators who involve with:" - does this only cover content posted on your site, or any content the creator makes across any publicly available service? To what extent can creators discuss these topics if they don't actively manufacture/promote/distribute them? Could you be more specific about creators that are "involved in weapons" - is this anything that can be used as a weapon or specific to military/semi-military applications? Would Joerg Sprave's slingshot channel be prohibited? What about someone who makes videos about forging/sharpening knives? Are creators who discuss war journalistically or historically disqualified? Non-miltary RC drone hobbyists like Tom Stanton? "Chemicals" seems pretty vague. Does this preclude all chemistry and biochem related content? I'm a big fan of channels like NileRed, CodysLab and ThoughtEmporium, would they be prohibited? Would videos which discuss water treatment or concrete chemistry or metallurgy be disqualifying? "seeds or plants" - are creators who discuss gardening or farming disqualified? Cooking vegetables? Primitive Technology-style makers which discuss creating objects from plant materials? How do you define "adult" content? Does this include creators working on LGBTQIA activism? Does this include creators who create instructional content while showing non-nipple cleavage? Does this include creators involved in sex-ed/harm reduction campaigns? Also, are there any geographic restrictions? Can creators outside the US use your service (in countries which are NOT on the US OFAC sanction list)?

el_dev_hell 7y ago
> Can creators outside the US use your service (in countries which are on the US OFAC sanction list)? It looks like both payment processor integrations (PayPal and Stripe) are US based, so I think it's safe to assume there will be restrictions on sanctioned countries.
- cwkoss 7y ago
  Oops, dropped the NOT when rephrasing for clarity, thanks - fixed.
jijosunny 7y ago
>Also, are there any geographic restrictions? Can creators outside the US use your service (in countries which are NOT on the US OFAC sanction list)? Yes, Buy Me A Coffee is available to creators in almost all countries. Here is a breakdown of all accepted countries: https://help.buymeacoffee.com/en/articles/3314992-countries-supported-by-buy-me-a-coffee https://help.buymeacoffee.com/en/articles/3314992-countries-... >How do you define "adult" content? Does this include creators working on LGBTQIA activism? Does this include creators who create instructional content while showing non-nipple cleavage? Does this include creators involved in sex-ed/harm reduction campaigns? None of these are against the terms AFAIK. We unpublish creators who promote explicit pornography or nudity. Broadly speaking, we abide by the content restrictions of the vendors and payment processors we work with. More on that can be found here: https://stripe.com/restricted-businesses https://stripe.com/restricted-businesses
- danShumway 7y ago
  > None of these are against the terms AFAIK How can this be AFAIK? Aren't you one of the founders? If you don't know what your site allows, who does? At the end of the day, someone has to make the final decision over whether to ban an LGBTQ+ activist. Who is the person who will make that decision on BMaC? I get that you're beholden to your vendors, and to a certain extent there's nothing you can do about that. But I also assume you're not planning to just forward literally every content decision you have to make to Stripe's legal team for their input. So if a vulnerable person starts using your service, they need a better guarantee than "dunno, we'll have to flip a coin and see." You're still one of the people who are going to be enforcing this, you're still one of the people who have the power to decide how this will work.
  - jijosunny 7y ago
    To be clear, there are no circumstances under which we'll unpublish an LGBTQ creator. Here's a fantastic writer that I've been following for years who recently joined Buy Me A Coffee - https://www.buymeacoffee.com/pSzjB85 https://www.buymeacoffee.com/pSzjB85 Our community manager deals with account reviews, and she is more knowledgeable to answer the initial question. I shouldn't have said 'AFAIK' either way, my apologies.
dessant 7y ago
> Do not attempt to decompile or modify engineer any software included on Buy Me A Coffee site. This is also a bit dated policy. I've reported bugs on Patreon before that involved looking at the source code and modifing it, but it did not cross my mind that they'd reserve the right to ban users for doing so. I think this is a case of copying TOS sections from other places which are not a good fit for this service. That said, Patreon has destroyed their user interface in the past year, profiles on desktop barely contain any information above the fold, so we need competition in this space.
- jijosunny 7y ago
  We do have a bug bounty and encourage bug reports from our users (https://twitter.com/PJijin/status/1186904518341955584 https://twitter.com/PJijin/status/1186904518341955584). The policy mentioned above is to avoid any damages to the creator(s) on the platform. Thanks for the feedback!
  - wizzwizz4 7y ago
    Instead of "you are not permitted to reverse-engineer", maybe "you are not permitted to interact with the server except through the user interface produced by a web browser in accordance with the HTML-based instructions sent to your machine by our web server unless given explicit permission by us"; that effectively prevents people from using that reverse-engineered knowledge to attack your site, whilst still permitting bug reports.
  - danShumway 7y ago
    I also want to push back on this. You have a policy that guarantees every single security researcher that inspects your platform will be in violation of your TOS. But you're telling us on an Internet forum that you won't use that policy unless someone does something completely awful. That's asking us to put a lot of trust into you -- trust that you're not willing to reciprocate back to us. People shouldn't need to break your TOS to report a bug to you, and they shouldn't need to rely on purely your goodwill to protect themselves. Security disclosure is already a really scary process, researchers need explicit guarantees that they won't be prosecuted or sued. If a company tells me that I should just trust them that they won't sue me or ruin my life over a bug report, I stop going through their official disclosure channels, because it's no longer worth the risk. Policies like this are a really good way to get security bugs reported as anonymous Pastebins in the press instead of to your official channels. I would also note that outside of security research, this bans people from building tools around your site -- browser extensions that automate common tasks or alternate clients that call into unsupported or private APIs. I think that's a really regressive restriction for something as fundamental as a payment platform to have. Again, maybe your actual policy will be not to go after people who build useful tools -- but in that case, why start out with a TOS that encourages an unhealthy power dynamic, that means you could shut down someone who interops with your service for any reason? The point of a TOS is to create clarity -- it's an agreement so that both users and platform owners know what's expected of each other. I don't expect a TOS to enumerate literally everything that might happen, but I instinctively recoil away from a TOS that includes onerous restrictions that I'm told to just ignore. A rule that everyone is expected to break is really just a blanket license to selectively punish anyone on your platform for any reason. Why should I as a user trust you with that kind of power? In regards to protecting creators and avoiding creator damages -- hacking is already a federal crime. What's something that this policy protects you against that couldn't be handled by the Computer Fraud and Abuse Act?

by cwkoss 7y ago

el_dev_hell 7y ago

> Can creators outside the US use your service (in countries which are on the US OFAC sanction list)? It looks like both payment processor integrations (PayPal and Stripe) are US based, so I think it's safe to assume there will be restrictions on sanctioned countries.

cwkoss 7y ago
Oops, dropped the NOT when rephrasing for clarity, thanks - fixed.

jijosunny 7y ago

>Also, are there any geographic restrictions? Can creators outside the US use your service (in countries which are NOT on the US OFAC sanction list)? Yes, Buy Me A Coffee is available to creators in almost all countries. Here is a breakdown of all accepted countries: https://help.buymeacoffee.com/en/articles/3314992-countries-supported-by-buy-me-a-coffee https://help.buymeacoffee.com/en/articles/3314992-countries-... >How do you define "adult" content? Does this include creators working on LGBTQIA activism? Does this include creators who create instructional content while showing non-nipple cleavage? Does this include creators involved in sex-ed/harm reduction campaigns? None of these are against the terms AFAIK. We unpublish creators who promote explicit pornography or nudity. Broadly speaking, we abide by the content restrictions of the vendors and payment processors we work with. More on that can be found here: https://stripe.com/restricted-businesses https://stripe.com/restricted-businesses

danShumway 7y ago
> None of these are against the terms AFAIK How can this be AFAIK? Aren't you one of the founders? If you don't know what your site allows, who does? At the end of the day, someone has to make the final decision over whether to ban an LGBTQ+ activist. Who is the person who will make that decision on BMaC? I get that you're beholden to your vendors, and to a certain extent there's nothing you can do about that. But I also assume you're not planning to just forward literally every content decision you have to make to Stripe's legal team for their input. So if a vulnerable person starts using your service, they need a better guarantee than "dunno, we'll have to flip a coin and see." You're still one of the people who are going to be enforcing this, you're still one of the people who have the power to decide how this will work.
- jijosunny 7y ago
  To be clear, there are no circumstances under which we'll unpublish an LGBTQ creator. Here's a fantastic writer that I've been following for years who recently joined Buy Me A Coffee - https://www.buymeacoffee.com/pSzjB85 https://www.buymeacoffee.com/pSzjB85 Our community manager deals with account reviews, and she is more knowledgeable to answer the initial question. I shouldn't have said 'AFAIK' either way, my apologies.

dessant 7y ago

> Do not attempt to decompile or modify engineer any software included on Buy Me A Coffee site. This is also a bit dated policy. I've reported bugs on Patreon before that involved looking at the source code and modifing it, but it did not cross my mind that they'd reserve the right to ban users for doing so. I think this is a case of copying TOS sections from other places which are not a good fit for this service. That said, Patreon has destroyed their user interface in the past year, profiles on desktop barely contain any information above the fold, so we need competition in this space.

jijosunny 7y ago
We do have a bug bounty and encourage bug reports from our users (https://twitter.com/PJijin/status/1186904518341955584 https://twitter.com/PJijin/status/1186904518341955584). The policy mentioned above is to avoid any damages to the creator(s) on the platform. Thanks for the feedback!
- wizzwizz4 7y ago
  Instead of "you are not permitted to reverse-engineer", maybe "you are not permitted to interact with the server except through the user interface produced by a web browser in accordance with the HTML-based instructions sent to your machine by our web server unless given explicit permission by us"; that effectively prevents people from using that reverse-engineered knowledge to attack your site, whilst still permitting bug reports.
- danShumway 7y ago
  I also want to push back on this. You have a policy that guarantees every single security researcher that inspects your platform will be in violation of your TOS. But you're telling us on an Internet forum that you won't use that policy unless someone does something completely awful. That's asking us to put a lot of trust into you -- trust that you're not willing to reciprocate back to us. People shouldn't need to break your TOS to report a bug to you, and they shouldn't need to rely on purely your goodwill to protect themselves. Security disclosure is already a really scary process, researchers need explicit guarantees that they won't be prosecuted or sued. If a company tells me that I should just trust them that they won't sue me or ruin my life over a bug report, I stop going through their official disclosure channels, because it's no longer worth the risk. Policies like this are a really good way to get security bugs reported as anonymous Pastebins in the press instead of to your official channels. I would also note that outside of security research, this bans people from building tools around your site -- browser extensions that automate common tasks or alternate clients that call into unsupported or private APIs. I think that's a really regressive restriction for something as fundamental as a payment platform to have. Again, maybe your actual policy will be not to go after people who build useful tools -- but in that case, why start out with a TOS that encourages an unhealthy power dynamic, that means you could shut down someone who interops with your service for any reason? The point of a TOS is to create clarity -- it's an agreement so that both users and platform owners know what's expected of each other. I don't expect a TOS to enumerate literally everything that might happen, but I instinctively recoil away from a TOS that includes onerous restrictions that I'm told to just ignore. A rule that everyone is expected to break is really just a blanket license to selectively punish anyone on your platform for any reason. Why should I as a user trust you with that kind of power? In regards to protecting creators and avoiding creator damages -- hacking is already a federal crime. What's something that this policy protects you against that couldn't be handled by the Computer Fraud and Abuse Act?