eggbrain

About the same thing I saw. I kept having to increase my bid every day, and even at $4 CPC basically saw nothing converting.

As you said, it's also really hard to get visibility: metrics are poor, and targeting seems more like a whim/suggestion than anything else (their label for context hints basically tells you they only _might_ take your guidance on who they will show your ad to).

Audiences consists of hashed emails or phone numbers -- no targeting demographics, job titles, etc.

Overall it's just not there yet -- I paused my ads today.

Can you imagine a venue refusing entry to former clients 2% of the time just because they’ve “improved their experience”?

On the flipside, if a client enters enough venues that refuse entry to them because of something the client can fix on their end, eventually the client will probably change themselves -- "If you meet one asshole during your day" and all that.

To bring the analogy back to browsers, if a website works fine for a client, they'll have no pressure to change anything on their end -- why upgrade from Windows XP when the site looks fine in IE6? Eventually the client is forced to upgrade -- normally by their operating system. That works, but what if the operating system adds another 2 years to their end of life -- do you just hang on and hope the shim / hacks you added hold?

Gauntlet AI I believe is correlated originally with Lambda School (YC S17). YC founders I believe are able to post job postings on Hacker News, although this might stretch the definition a bit...

I feel we need a "proof of work by human" for emails. Something that could be signed that attests that someone took the time to write the email, not just sent a template / used AI to auto-generate a personal looking email, etc. Sure that could be gamed as well (have an AI write characters one by one to look more human-like), but taking more time usually is a fairly good blocker for spammers / salespersons / etc.

For those of us on subscription plans:

* From today through June 22, Fable 5 is included on Pro, Max, Team, and seat-based Enterprise plans at no extra cost.

* On June 23, we’ll remove Fable 5 from those plans. Using it after that will require usage credits. If capacity allows, we’ll extend the included window.

* After this point—when sufficient capacity allows us to do so—we aim to restore Fable 5 as a standard part of subscription plans. We intend to do this as quickly as we can.

The "offer, then remove" aspect is a bit eyebrow-raising -- it feels like they are trying to get subscribers to switch to usage-based billing, which makes me wonder if we'll ever get it after that June 22nd window.

[...] People do not realise how much of a toll it takes on you if you actually care about the environment, exploited workers, theft from the people who can least afford it, the impact on people's cognitive skills, the centralisation of power, the spread of disinformation, the ruination of the web and/or the destruction of entire career paths (not billionaire of course, that's always a safe one), and not endorsing (either distinctly or tacitly by using) AI.

I believe people do understand the toll caring about something deeply takes -- but caring about all these things at once, many which you personally can't control, feels more like atlas syndrome or compassion fatigue by the author.

I also find the author a bit all-or-nothing in general. Losing friends because they use AI? Why does the dichotomy have to be so black and white? Can people have moral quandaries about AI while still using it, or does the moral stance always have to be absolute?

[...] With organized criminals, you can't actually see what the abuse is 'worth' to them.

Even without collecting events, you can calculate what the abuse is worth to you, even if the math ends up being fuzzier.

At the small platform operator level (one guy running a platform, as this article), the cost can be as simple as "this pisses me off and I have weekends." They can burn forty hours bolting on JA4 fingerprinting and a disposable-email blocklist to stop an abuser whose dollar-EV to them was roughly zero. Looks irrational, and that's exactly the deterrent — abuse pricing assumes a rational counterpart, and a guy who'll overspend his own life-hours out of stubbornness is unpriceable.

At any scale larger than a small operator, you also do get real numbers -- you can't perfectly price reputation, but you can price traffic and ad conversions, operational costs, LTV of customers (and conversion funnel metrics) etc, all of which don't stay still while abuse increases.

[...] That's why it's worth collecting events before acting: what the account is about, which IP network they use, whether they fake devices, whether there's any warmup prior to registration. Because that's what helps estimate whether your mitigation will actually work, and lets you respond in a balanced manner instead of under- or over-reacting.

Isn't this just a way to estimate exactly how much the 'abuse' is worth to the abusers?

To the end platform, what's the difference? Mitigation techniques largely remain the same, in that you make it more time / energy / money than what the end result of their abuse is worth. The platform cares about stopping the abuse -- not neccesarily correctly identifying whether the people abusing their platform are small shop "bot farms" vs organized crime.

There will always be a subset of users whose goal is to not use your service, but to arbitrage your service into the maximum value for themselves.

For example -- let's say you offer $100 in free AWS credits by signing up to your platform. Expect a malicious user to eventually come to your platform, realize they can resell those $100 in credits for $50, and start using your platform for their own gain. Unless the mechanisms you add in place to reduce fraud / second sign ups / etc is greater than the value that they are receiving ($50), they will continue.

With sites where the platform is free, the math almost always makes sense for these malicious users to eventually abuse. In this case it was leveraging the email reputation of another domain at no cost to their own (along with the added value of anyone getting phished), but on other sites it's public profiles being used for backlinks / spam, etc.

The value of human interaction cannot be overstated -- and the writer did a beautiful job outlining how AI isolates us. But there are also hidden difficulties in human interaction that AI helps ameliorate.

- My doctor friend does not wanting me pinging them asking for free medical advice every time I get health anxiety

- My chef friend does not want me calling them every time I'm struggling with a recipe

- My author friend does not want to read the 20th draft of my book, in which I've changed perhaps 10% of the content from the last draft

In these, the cost is a tax on the relationship -- relying on someone else too much to the point where it could potentially be impacting _their_ life.

Similarly, there are enough communities out there that are not accommodating -- even if I wanted to get a human answer and/or connect with someone, the interactions themselves can be painful. Do we remember what it was like posting on Stack Overflow? Do we believe Stack Overflow was a one-off outlier?

I also believe human imagination and knowledge shouldn't be bound to the relationships you have around you. What if my social group is small, or diversity of knowledge that my social group has is small? Should I not be able to think and explore an idea because my best alternative would be to contact a professor at a university that 99% of the time will not answer me?

I do believe that many people use AI now instead of learning and connecting -- I know my own programmatic knowledge has weakened now that AI has acted as a superhuman autocorrect. But on the other hand, with the help of AI I've also learned about a ton of things that would have otherwise been unavailable to me -- and I believe has improved me on the whole.

Normally, I separate the download filename (what the server / person chose to call the file) from my own organization system file name.

So if I download or get sent "Book.pdf", I'll rename it to how I'll remember it -- "Book Title - Author.pdf", etc.

That being said, I don't think there's any right answer here, it's usually just a matter of time and energy. If I had to enrich every single file I download with a great title / detailed metadata / etc that I'd need to find that file later, that's all I'd do all day.

Stripe (their payment process) will handle adult content payments. It puts the account into the high risk category due to the high rate of fraud in those categories.

Stripe _says_ they will handle these type of payments, but more often than not, within roughly a year of implementation you'll get an email from them kicking you off their platform, no matter how vigilant you were, or even if the things you were selling were more rated R than rated X. Source: my own insider knowledge along with colleagues in the space.

Lately I've been building Aho (https://aho.com) -- an API for verifying age, credentials, and identity using cryptographic proof from digital wallets instead of document inspection.

For context, I built out Playboy's age verification system, and watched as it hurt conversion (nobody wants to upload an ID to an adult website, who would have thought!). Cryptographic signatures from issuing authorities (DMVs, universities, employers, etc) with selective disclosure (e.g. you don't need to upload your full ID, just the fields that matter) is how verification _has_ to work going forward -- AI can fake documents, but not private keys.

I've been working on this 6 months full time, and implemented all the W3C VC, OpenID4VCI/VP, SD-JWT specifications myself.

Would love to get people's thoughts on it!

There are two opposite answers here, and I feel like I could argue either one:

1) Humans were never held accountable, really

Outside of a few regulated industries, the worst that happens to an engineer who pushes negligent code is that they get fired. But after that happens, what actually changes? The organizational structure of the company that allowed the employee to push bad code still exists.

2) Humans will still be held accountable

If a human (managing a fleet of AI agents, let's say) ends up deploying bad code to production, they won't be able to point to the AI agent and say "it was them that did it!" -- it will still be the human at the end of the line that is held responsible.

Your comment seems to imply AI is currently at a junior developer's level -- 12 months ago I would have agreed (like I mentioned in my parent comment, both near the end and about the "latter" team I was a part of), but it's gotten quite good over the past few months.

When even Linus Torvalds compliments AI code (ref: https://www.reddit.com/media?url=https%3A%2F%2Fi.redd.it%2Fa...) I think we can say he wouldn't have said that about any junior engineer.

That's not to say it won't ship bugs, but so does any engineer (junior or senior). It's up to you as to what level of tooling you surround the AI with (automated testing / linting / etc), but at the very least it doesn't also hurt to have that set up anyways (automated tests have helped prevent senior devs from shipping bad code too).

I find people over-rotate on whether we should be reviewing AI-produced code. "What if bad code gets into production!" some programmers gasp, as if they themselves have never pushed bad code, or had coworkers do the same.

I've worked at places where I've trusted everyone on my team to the extent that most PRs got only a quick glance before getting a "LGTM". On the flipside, I've also worked on teams where every person was a different kind of liability with the code that they pushed, and for those teams I implemented every linting / pre-commit / testing tool possible that all needed to pass inspection (including human review) before any code arrived on production.

A year ago, AI was like that latter team I mentioned -- something I had to check, double check, and correct until I was happy with what it produced. Over the past 6 months, it's gotten closer (but still fairly far away) from the former team I mentioned -- I have to correct it about 10% of the time, whereas for most things it gets it right.

The fact that AI produces a much _larger_ volume of code than the average engineer is perhaps slightly concerning, but I don't see it much differently than code at large companies. Does every Facebook engineer review every junior engineer's pull request to make sure bad code doesn't slip in?

That isn't to say I'm for letting AI go wild with code -- but I think if at worse we consider AI to be a junior engineer we need to reign in with static analysis tools / linters / testers etc, we will probably be able to mitigate a lot of the downside.

Many of today's news websites (tech or otherwise) cashed in their goodwill / reputation / page rank to sell ads.

The first shoe dropped when news websites realized they weren't generating content fast enough. Hard, in depth journalism takes time, but when people want to know something that happened _today_, they don't want to wait a week for all the facts to come out, and so the major websites started losing traffic to websites that churned out articles fast.

The additional benefit of churning out articles was that you could match against more and more long tail keywords, which lead to more traffic and more ability to sell ads. To keep up, many websites dropped quality for speed, and consumers noticed.

The second shoe then to drop was with affiliate marketing -- articles on CNET / Wirecutter etc were already ranking and rating products, so they figured "[...] why shouldn't we get a cut if someone ends up buying a product we recommend"? The challenge then became that consumers couldn't tell the difference between a product that was recommended because it was good, or because the product gave the biggest "kickback" to the website for using the affiliate link. Thus, people that gave "honest" opinions on products (e.g. people asking on Reddit, at least for a while, as the article suggests) became the new source of truth.

The result of this means that these days, if you read a lot of articles on the major tech websites, they feel more like they've been optimized for speed (e.g. churning out an article fast), SEO, and not much else. Many people have talked about how recipie websites are now short story generators more than food instructions, but it's been common for a while where I go to a tech website to read about something I specifically Googled, only for it to feel more like it was written _specifically_ to capture traffic for a keyword, rather than actually solve the issue or question I came into the website with.

The cherry on top is that AI has none of these problems (so far) -- yes, there's some movement on trying to do SEO for AI, and of course ads will eventually come to AI like it has everything else, but currently, you can get the answers you want, described to you exactly how you'd like to hear it -- who wouldn't want that?

I'm curious -- are there any stories of projects that launched on Hacker News, Hacker News loved it, and it ended up _also_ being a big success?

E.g. we have stories like Dropbox where HN seemed to be dismissive only to be proven wrong, and there are numerous launches where HN was dismissive and they were proven right, but I'd be more curious when the HN crowd got it right in a positive way.

If we assume token providers are becoming more and more of a commodity service these days, it seems telling that OpenAI specifically decided to claw out consumer hardware.

Perhaps their big bet is that their partnership with Jony Ive will create the first post-phone hardware device that consumers attach themselves with, and then build an ecosystem around that?

I’m glad someone called this out. “Let’s just use vanilla rails” — sure, except basically every version of rails for the past 5 years has decided to completely change how they do JS.

So many gems are also still built on sprockets — even when you want to use the “rails” way, you are stuck now with a hodgepodge of JS anyways.

It’s a mess — maybe one day we’ll get it fixed, but don’t pretend it’s not partially rails fault as well.

Another potential self-selection bias -- if people know they are signing up to have a conversation with a stranger, perhaps they are already predisposed to be more "pleasant" in conversations, vs a potential curmudgeon who doesn't ever want to speak to anyone, even for money.

There's also the magnitude of a negative interaction as well to consider.

If I have 99 great interactions with someone, but one REALLY bad interaction (they insult me deeply, or say something irredeemable), that can also sour the whole relationship.

It would be interesting to research commonalities amongst bad interactions -- are there patterns that emerge from certain personality types, politics, etc? What about a few "sour" people that will take any interaction and make it bad regardless of matchup -- if we removed them from the interaction pool, do the stats suddenly adjust quickly?

In my mind this would have big implications for social media sites -- not that all bad interactions need to be quelled, but if you are trying to keep conversations civil, attempt to implement X strategy or Y strategy.

Limiting by referrer seems strange — if you know a normal user makes 10-20 requests (let’s assume per minute), can’t you just rate limit requests to 100 requests per minute per IP (5x the average load) and still block the majority of these cases?

Or, if it’s just a few bad actors, block based on JA4/JA3 fingerprint?

Thanks Zak, appreciate your thoughts.

I hope to have some of the followup posts soon, although you are right that my idea is based around a centralized platform with ID Verification.

RE: How to solve for enshittification, I'd mention two things:

1. I think a good product can _stay_ good over time with strong centralized leadership, aka a "benevolent dictator". Think Steve Jobs at Apple, DHH at 37 Signals, etc.

  - Once that power structure changes, however (new leader, etc), that can quickly fall apart, so it's definitely not a bulletproof solution.

  - If you have to choose between customers who give you $0/month and advertisers who will give you $1000/month, you'll eventually choose the advertisers to the detriment of the users.

Care to give an argument to substantiate that?

Because eventually bad actors take any decentralized platform / standard and ruin it for the rest of us, leading us to trust the few good players that remain (see: email). Sure, technically you can spin up your own mail server -- but because of the copious amount of spam from people who have done that in the past, you'll go through so many hoops that eventually you'll throw in the towel and probably use GSuite or a known major provider.

As Ben Thompson says:

[...] centralization is a second order effect of decentralization: when all constraints on content are removed, more power than ever accrues to the entity that is the preferred choice for navigating that content.

[...] Its 100% about getting people to stay on your platform as long as possible and engage with your content. Usually that means creating content that gets people to negatively engage with your content. So much so, its now referred to as "rage bait" where Only Fans women purposely post content that gets men to engage with their posts in order to make more money. Political posts are made to inflame either side and get more shares and upvotes.

I touch upon this in https://www.scottgoci.com/social-media-platforms-whats-wrong... and https://www.scottgoci.com/social-media-platforms-whats-wrong... -- but as you mention, this is a result of engagement being a core metric of social media platforms, and users attempting to game the platform's algorithm for their own purposes.

An easy way to solve for this is customization -- if no two users have the same "algorithm" powering their feed, it becomes hard for anyone to do this, because perhaps one user's algorithm filters out anything tagged with politics, or with a low Flesch–Kincaid score, or non-text posts, etc.

I agree both with you and the OP comment here.

Ideally, I think if we could, we'd only get content from the creators or people we care about -- but that content runs out eventually, and yet our minds still want to be stimulated.

To bring it back to your food analogy, if I had a personal chef that made delicious food whenever I wanted it, I'd probably not indulge in fast food very often -- but if I needed a quick bite to eat, I'd probably still jump into a McDonalds.

I guess we have to assume that Mastodon is not "large" by the author's definition.

It's a fair point that Mastadon was left out, and yet it does tackle some of the problems I mention -- perhaps worth a followup post. That being said, I feel like federated social media platforms are not going to be the answer in the end -- and although its adoption has grown in the coming years, I think it's always going to lag behind others.

Practically speaking, the existence of a large social media platform requires investors seeking unlimited growth, and that's the predictable recipe for enshittification [...] What's the author's escape route to avoid this trap?

I think reddit, to some extent, can be considered a success story here -- it grew fairly slowly compared to other social media platforms, but now feels like it has quite a lot of staying power (although as it approached its IPO it did indeed start to enshittify).

That being said, I think a lot of problems I mention can be solved just by giving the customer (e.g. the user on the social media platform) more choice. Imagine you had a platform that asked you how you wanted to pay to use it: with your data, with advertisements, or with a membership of $XXX/month, amongst other options.

An interesting thought (to your point) is what people hope social media can actually become -- in the ideal scenario, is it just us being able to engage with people online in better ways? Is it us being able to consume content from others in the ways we want?

I can see a platform that gives you just the data you need to stay informed working, although what data you wish to receive and how quickly seems like a potential stumbling point.

Perhaps you don't want to receive news about celebrities, _unless_ it involves someone you care deeply about, for example Michael Jackson. It would require quite a bit of tailoring for a platform to be able to curate for that.