3 ms·

I've spent an inordinate amount of time banning fraudsters from my own cloud platform. The bots that companies write to do this are designed to fight off other

I've spent an inordinate amount of time banning fraudsters from my own cloud platform. The bots that companies write to do this are designed to fight off other bots. If you have an appeals process, the humans that control the malicious bots will show up to abuse the appeals process. One of my favorite cases was a user that signed up with hundreds of stolen credit card numbers (all from the same IP address, as they are apt to do), got banned, and then opened an issue in our open source repo complaining of trouble logging in. Yeah, you're having trouble because I banned you and your entire network of bots. There is a balance, of course, but if you haven't seen how much automated abuse there is on the Internet, be careful of what you wish for. Even the tiniest of the tiny services suffer from massive amount of automated abuse. At that tiny scale, it was nearly impossible for me to keep up with the abuse without the help of automation, very broad bans, and deleting related accounts by walking a reputation graph (like Google is being criticized for doing here). At Google's scale, I don't think there are enough humans on Earth to deal with the abuse. As a result, there are going to be some innocent casualties. I don't think it's an ethics thing, it's simply not possible to run a business without some sort of process like this. There are laws, rules, and processes that could cut all this down to levels that could be managed by humans, but the cure might be worse than the disease. (For example, it would be great if there was a 1:1 mapping between your national ID card and your IP address. All of these stolen-credit-card users could then be imprisoned. But, you know that that's a terrible thing, because it will also be used against anyone criticizing governments or large corporations.)

nkrisc 5y ago
> At Google's scale, I don't think there are enough humans on Earth to deal with the abuse. As a result, there are going to be some innocent casualties. Perhaps they've scaled too large then. I don't think "we're too big to be held accountable for screwing innocent people" is a valid excuse.
matsemann 5y ago
While I see your point, when it's accounts with years of history, millions of downloads, thousands of dollars paid in sales etc., it should be easy to discern those from spammers creating thousands of new accounts with no standing.
- spookthesunset 5y ago
  Maybe. Or maybe the account in question has a long history but got taken over by a scammer. It’s the oldest trick in the book. Find long standing accounts and take them over. Boom, now they look totally legit! Shit is hard. If it was easy to tell fraudsters from real people we’d never be discussing this. The fraudsters are willing to invest unimaginable amounts of time and effort to get into your systems and do their dirty work. Every fix you make will eventually be routed around. Always.
geophertz 5y ago
> At Google's scale, I don't think there are enough humans on Earth to deal with the abuse. I disagree. Some time ago, a person (on HN, although it may have been somewhere else) did an estimate of what it would take for Google to review all 500 hrs of video uploaded to YouTube every minute. The result was that Google could more than afford it. Based on that I don't see any reason Google couldn't add more humans to deal with these ban appeals.
spookthesunset 5y ago
One thing that never gets talked about is how do we go after the actual fraudsters and bring them to justice? How can private industry work with law enforcement across the globe and get some of these dudes behind bars? I’m not saying it would be easy. Doing so would require insane amounts of coordinated with basically every country on the planet. But damn would it be nice if fraudsters couldn’t easily hide behind internet anonymity.

nkrisc 5y ago

> At Google's scale, I don't think there are enough humans on Earth to deal with the abuse. As a result, there are going to be some innocent casualties. Perhaps they've scaled too large then. I don't think "we're too big to be held accountable for screwing innocent people" is a valid excuse.

matsemann 5y ago

While I see your point, when it's accounts with years of history, millions of downloads, thousands of dollars paid in sales etc., it should be easy to discern those from spammers creating thousands of new accounts with no standing.

spookthesunset 5y ago
Maybe. Or maybe the account in question has a long history but got taken over by a scammer. It’s the oldest trick in the book. Find long standing accounts and take them over. Boom, now they look totally legit! Shit is hard. If it was easy to tell fraudsters from real people we’d never be discussing this. The fraudsters are willing to invest unimaginable amounts of time and effort to get into your systems and do their dirty work. Every fix you make will eventually be routed around. Always.

geophertz 5y ago

> At Google's scale, I don't think there are enough humans on Earth to deal with the abuse. I disagree. Some time ago, a person (on HN, although it may have been somewhere else) did an estimate of what it would take for Google to review all 500 hrs of video uploaded to YouTube every minute. The result was that Google could more than afford it. Based on that I don't see any reason Google couldn't add more humans to deal with these ban appeals.

spookthesunset 5y ago

One thing that never gets talked about is how do we go after the actual fraudsters and bring them to justice? How can private industry work with law enforcement across the globe and get some of these dudes behind bars? I’m not saying it would be easy. Doing so would require insane amounts of coordinated with basically every country on the planet. But damn would it be nice if fraudsters couldn’t easily hide behind internet anonymity.