7 ms·

It's worse than that. You omitted * User has no idea what they did wrong, and nor does anybody else. And the trouble with that is, nobody can learn what the o

It's worse than that. You omitted * User has no idea what they did wrong, and nor does anybody else. And the trouble with that is, nobody can learn what the offensive behaviour was. (Perhaps that's intentional?)

vkou 4y ago
It's not intentional against legitimate users, but it is intentional against people abusing the system, because telling them how they got caught will let them adjust what they are doing, to avoid getting caught in the future.
- mikro2nd 4y ago
  Yes. Exactly. Telling people what they've done wrong enables them to behave better in future. Isn't that what we want... rehabilitation?
  - vkou 4y ago
    That works on people who are using your system with good intentions. That does not work on people who are using your system with malicious intentions (and who face zero personal consequences when they get caught again, and again, and again). They don't get rehabilitated, when you tell them which rule you broke[1], they just adjust their malicious use to work around that rule. Rehabilitation is only possible when both parties are operating in good faith, which is why it is done with threat of prison, fines, revocation of parole, etc. It can't be done when the 'rehabilitated' party can just reneg on the agreement with zero consequences. The point of anti-abuse rules isn't the letter of the rules, it's the intent behind them. 'There's no rule that says a dog can't play basketball' only works in children's fairy tales. There's a reason why no large firm or financial institution will tell you the why. It's not because they think you have good intentions, and they hate you. It's because they are afraid you have malicious intentions, and they aren't interested in holding your hand as you defraud them. Of course, people in category one get burnt by this, and then complain on Twitter/FB/HN. [1] If you want to live in a world where anti-abuse systems tell you which rule you broke, you'll probably need to also live in a world where there are very serious consequences that are - with high consistency - inflicted on people breaking those rules in bad faith. We don't live in that kind of world, things like the CFAA are at the same time, both overly broad and draconian and largely toothless.
    - jjav 4y ago
      > The point of anti-abuse rules isn't the letter of the rules, it's the intent behind them. This is really indefensible abusive behavior by all these cloud companies. It needs to be made illegal. Imagine if the real world operated that way. The police arrest you and throw you in jail for unspecified reasons and you're not allowed to know why or defend yourself. There are excellent reasons why they must instead charge you with a specific crime and the laws that define those crimes are written down and you can look them up. And then they need to present evidence and you do get a chance to defend yourself.
      - vkou 4y ago
        > Imagine if the real world operated that way. The real world does operate in exactly that way, with a scant few exceptions. It's often even less scrutable than what I described. > The police arrest you and throw you in jail for unspecified reasons and you're not allowed to know why or defend yourself. Since you're saying this, it doesn't sound like you've had a lot of confrontations with police. (And if you ever do, I'd strongly advise against trying to 'defend yourself' from them.) The police can and absolutely do arrest, intimidate, harass, and violently assault people for unspecified, fabricated or utterly bullshit reasons, and then release them (because they can't justify those reasons in a court of law, but they have an incredibly broad, completely unaccountable amount of inscrutable discretion that they can use to make your life a living hell.) A store can absolutely throw a nuisance customer out, and ban them from returning, without specifying exactly how much of a nuisance they permit that customer to be. Hell, even in a court of law, one of the most deterministic billiard-ball-newtonian-world aspect of our life, the ultimate decision of life or death, freedom or innocence is decided by an opaque group of 12 neural networks, each full of their own biases, prejudices, and each heavily influenceable by courtroom demagoguery. Who don't - and aren't required to - explain their decisions. There's very few, very narrowly defined set of spaces in our society where the rules are clearly, fully spelled out, with little to no room for arbitrary interpretation, and where decisions can be scrutinized. They are an incredibly narrow exception, not the rule, and they tend to be more present in situations where the consequences of a mistake are more serious. (Questions of housing, credit, money, life and death.) Unfortunately, access to a rented VM doesn't quite rise to that level of seriousness. It does, however, tend to offend programmers, who are both over-represented here, and often mistakenly think that the world is a fair newtonian-billiard-table. In reality, it's neither fair, nor deterministic.
  - Shorel 4y ago
    "Your free instance used more than 12345* CPU credits under 24 hours, therefore you exceeded the threshold for automatic termination." This number is published, and someone creates a script to launch hundreds or thousands of free instances that all run exactly 12344 credits every 24 hours and are used as spam boxes, or cryptocurrency mining, or something similar that degrades the platform for all other users. * meaningless number, pulled out of nowhere, as an example.
    - sesm 4y ago
      Dedicated abuser can find this limit experimentally via binary search.
      - vkou 4y ago
        If you don't tell them which one of many rate-limiters they've tripped, it's going to take them a lot more effort than a simple binary search. The only secure system is one that doesn't work, perfect security isn't the goal. Good enough security is.
  - bowsamic 4y ago
    No, the goal is to identify problematic humans and blacklist them forever
    - yellowapple 4y ago
      Don't forget the assumption of guilt unless proven innocent.
    - account42 4y ago
      The only humans who are problematic are those without compassion.
      - bowsamic 4y ago
        I agree, we must eliminate them
- CamperBob2 4y ago
  Too bad. Tell them anyway, unless you want regulations to be passed that work like habeas corpus rights for users of your service. Companies with abusive ToS enforcement policies can do the right thing of their own volition, or they can be forced to do so by law. It's up to them. Continuing with their current policies under the delusion that being accountable to their users somehow "helps the bad guys" won't be sustainable in the long run.

vkou 4y ago

It's not intentional against legitimate users, but it is intentional against people abusing the system, because telling them how they got caught will let them adjust what they are doing, to avoid getting caught in the future.

mikro2nd 4y ago
Yes. Exactly. Telling people what they've done wrong enables them to behave better in future. Isn't that what we want... rehabilitation?
- vkou 4y ago
  That works on people who are using your system with good intentions. That does not work on people who are using your system with malicious intentions (and who face zero personal consequences when they get caught again, and again, and again). They don't get rehabilitated, when you tell them which rule you broke[1], they just adjust their malicious use to work around that rule. Rehabilitation is only possible when both parties are operating in good faith, which is why it is done with threat of prison, fines, revocation of parole, etc. It can't be done when the 'rehabilitated' party can just reneg on the agreement with zero consequences. The point of anti-abuse rules isn't the letter of the rules, it's the intent behind them. 'There's no rule that says a dog can't play basketball' only works in children's fairy tales. There's a reason why no large firm or financial institution will tell you the why. It's not because they think you have good intentions, and they hate you. It's because they are afraid you have malicious intentions, and they aren't interested in holding your hand as you defraud them. Of course, people in category one get burnt by this, and then complain on Twitter/FB/HN. [1] If you want to live in a world where anti-abuse systems tell you which rule you broke, you'll probably need to also live in a world where there are very serious consequences that are - with high consistency - inflicted on people breaking those rules in bad faith. We don't live in that kind of world, things like the CFAA are at the same time, both overly broad and draconian and largely toothless.
  - jjav 4y ago
    > The point of anti-abuse rules isn't the letter of the rules, it's the intent behind them. This is really indefensible abusive behavior by all these cloud companies. It needs to be made illegal. Imagine if the real world operated that way. The police arrest you and throw you in jail for unspecified reasons and you're not allowed to know why or defend yourself. There are excellent reasons why they must instead charge you with a specific crime and the laws that define those crimes are written down and you can look them up. And then they need to present evidence and you do get a chance to defend yourself.
    - vkou 4y ago
      > Imagine if the real world operated that way. The real world does operate in exactly that way, with a scant few exceptions. It's often even less scrutable than what I described. > The police arrest you and throw you in jail for unspecified reasons and you're not allowed to know why or defend yourself. Since you're saying this, it doesn't sound like you've had a lot of confrontations with police. (And if you ever do, I'd strongly advise against trying to 'defend yourself' from them.) The police can and absolutely do arrest, intimidate, harass, and violently assault people for unspecified, fabricated or utterly bullshit reasons, and then release them (because they can't justify those reasons in a court of law, but they have an incredibly broad, completely unaccountable amount of inscrutable discretion that they can use to make your life a living hell.) A store can absolutely throw a nuisance customer out, and ban them from returning, without specifying exactly how much of a nuisance they permit that customer to be. Hell, even in a court of law, one of the most deterministic billiard-ball-newtonian-world aspect of our life, the ultimate decision of life or death, freedom or innocence is decided by an opaque group of 12 neural networks, each full of their own biases, prejudices, and each heavily influenceable by courtroom demagoguery. Who don't - and aren't required to - explain their decisions. There's very few, very narrowly defined set of spaces in our society where the rules are clearly, fully spelled out, with little to no room for arbitrary interpretation, and where decisions can be scrutinized. They are an incredibly narrow exception, not the rule, and they tend to be more present in situations where the consequences of a mistake are more serious. (Questions of housing, credit, money, life and death.) Unfortunately, access to a rented VM doesn't quite rise to that level of seriousness. It does, however, tend to offend programmers, who are both over-represented here, and often mistakenly think that the world is a fair newtonian-billiard-table. In reality, it's neither fair, nor deterministic.
- Shorel 4y ago
  "Your free instance used more than 12345* CPU credits under 24 hours, therefore you exceeded the threshold for automatic termination." This number is published, and someone creates a script to launch hundreds or thousands of free instances that all run exactly 12344 credits every 24 hours and are used as spam boxes, or cryptocurrency mining, or something similar that degrades the platform for all other users. * meaningless number, pulled out of nowhere, as an example.
  - sesm 4y ago
    Dedicated abuser can find this limit experimentally via binary search.
    - vkou 4y ago
      If you don't tell them which one of many rate-limiters they've tripped, it's going to take them a lot more effort than a simple binary search. The only secure system is one that doesn't work, perfect security isn't the goal. Good enough security is.
- bowsamic 4y ago
  No, the goal is to identify problematic humans and blacklist them forever
  - yellowapple 4y ago
    Don't forget the assumption of guilt unless proven innocent.
  - account42 4y ago
    The only humans who are problematic are those without compassion.
    - bowsamic 4y ago
      I agree, we must eliminate them
CamperBob2 4y ago
Too bad. Tell them anyway, unless you want regulations to be passed that work like habeas corpus rights for users of your service. Companies with abusive ToS enforcement policies can do the right thing of their own volition, or they can be forced to do so by law. It's up to them. Continuing with their current policies under the delusion that being accountable to their users somehow "helps the bad guys" won't be sustainable in the long run.