Comment by _qulr
5 years ago
> E.g. if a spammer can pretend they're 10 million different people, and each of those "people" requests an explanation, the whole system grinds to a halt.
Again, it's not a "request".
If spam detection and account suspension can be automated, then suspension notifications can also be automated.
I'm not sure I understand where the 10 million number is coming from. Are you suggesting that 1 spammer can create 10 million accounts on your system (which appears to be Facebook)?
Regardless, no spammer has the time to get on the phone and personally dispute 10 million account suspensions — disputes which are unlikely to succeed if there is good evidence — so I'm not sure how the system grinds to a halt.
> How many innocents have to get caught in the crossfire before we start protecting them?
> Again, it's not a "request" [..] suspension notifications can also be automated.
Can you clarify what you mean by "protecting" them? I'm not sure suspension notifications qualify as meaningful protection
This was specified in my original comment: "At the very least, companies must be legally required to present you in writing with the so-called violation of terms they're accusing you of, evidence of the violation, and a phone # or other immediate contact so that you can dispute the accusations." https://news.ycombinator.com/item?id=26063660
Temporary account suspensions that you can quickly reverse on appeal are annoying but could be justified to fight abuse, as long as they don't happen too often. On the other hand, indefinite account suspensions that are impossible to reverse, such as the case of Andrew Spinks of Terraria, are simply indefensible, there's no justification whatsoever for that.
> I'm not saying that companies shouldn't be able to suspend accounts temporarily. I'm simply saying that there needs to be a way to get your account unsuspended if you're innocent. The way it "works" now is that innocent consumers are without any recourse whatsoever.
This is absolutely spot on, with the caveat that you do need to disaggregate from accounts to people, which is the hard problem. Having people call a phone number is definitely not going to work as a way of achieving this disaggregation. I'm pretty sure I could create a system to bring that call center to a halt with fairly minimal cost in less than a week of coding.
As an attacker, you can also hire people in call centers to make phone calls at scale for you.
1 reply →