timdev2

Why do you believe that "Section 230 differentiates between publishers and platforms"?

Thanks for sharing. After digging in, it appears that something very similar happened here, after all. It looks like an access key with admin role leaked some time ago. At first, they just ran a quiet GetCallerIdentity, then sat on it. Then, on outage day, they leveraged it. In our case, they just did the SES thing, and tried to persist access by setting up IAM Identity Center.

These were accounts that shouldn't have had console access in the first place, and were never used by humans to log in AFAICT. I don't know exactly what they were originally for, but they were named like "foo-robots", were very old.

At first I thought maybe some previous dev had set passwords for troubleshooting, saved those passwords in a password manager, and then got owned all these years later. But that's really, really, unlikely. And the timing is so curious.

I would normally say that "That must be a coincidence", but I had a client account compromise as well. And it was very strange:

Client was a small org, and two very old IAM accounts had suddenly had recent (yesterday) console log ins and password changes.

I'm investigating the extent of the compromise, but so far it seems all they did was open a ticket to turn on SES production access and increase the daily email limit to 50k.

These were basically dormant IAM users from more than 5 years ago, and it's certainly odd timing that they'd suddenly pop on this particular day.

I find your public road network analogy interesting. Should your car require you to prove your age before it will start? How else can we protect your kid (and others) from the dangers of an 8 year old taking the family sedan for a spin?

Isn't strident opposition to "neo-Marxist philosophy" actually highly correlated with weird/reactionary ethno-nationalism?

I think there's diminishing returns. A broad, liberal arts, undergraduate education develops critical thinking and reading skills in a zero-to-one kind of way. Once you've attained those skills (whether through a college degree or some other way), further enrichment via self-study is much more easily doable.

I don't get your strong objection. A 1.0 release that is fit for use by >80% of the addressable market, and gets high marks from those users is a "boondoggle"?

Perhaps you overestimate the fraction of taxpayers that itemize deductions, have gig/rental/business income?

You can use Caddy's CertMagic library in your own server, if you want something super-lightweight.

Structuring (splitting up cash deposits to a bank so that they don't trigger the bank to file a CTR) comes to mind. It does have a mens rea component, but the money being entirely clean doesn't make the act not-structuring, IIUC.

Monopoly concerns are better addressed by going after monopolies for being anticompetitive. Intermediary liability seems pretty orthogonal to competition concerns. I would need a lot of convincing to start believing that categories like search or even social media (despite network effects) are natural monopolies akin to railroads or POTS-type phone companies of yore – where you can't have efficient competition, and don't have thorny 1A issues to deal with, so common-carrier approaches are defensible.

As an aside, one reason I think 230 pretty much correct is that authoritarians on both sides of the spectrum want to axe it, but for different reasons.

That thinking strikes me as "clear, simple, and wrong". (I appreciate that 230's bright-line rule may also be clear, simple and wrong)

Consider defamation. Often, the difference between a defamatory and non-defamatory statement is truth. Expecting websites to distinguish true statements from false ones is a non-starter.

Let's say my family has a horrible experience with a youth pastor. I post about it on facebook to warn people in my community. If my claims are false, they're almost certainly actionable defamation. If my claims are true, disallowing them to mitigate Facebook's potential liability is also bad, but not in a way that affects Facebook.

The idea that there's an indistinct difference between "publisher" and "common carrier" doesn't seem right. Google or Facebook are not, and have never been, common carriers. The entities that most resemble "common carriers", as that term is historically used, are infrastructure-layer companies. I don't see how the distinction could be sharper.

The "idea that these providers are simply neutral carriers of content" is a false premise, isn't it?

The piece you link is ... weird. First, it doesn't really describe the problem it's trying to solve. Then it presents some very vague policy prescriptions like "site[s] should be regulated by sector-specific rules that apply to that particular line of business".

My use-cases are pretty basic, and my use isn't all that frequent, but I've been very happy with: https://zellij.dev/

If that's true, they're uncharacteristically quiet about it!

How do those people feel about wearing pants at the point of a gun?

Is this person a lawful agent of a legitimate government? Is the ice cream policy reasonably connected to some compelling government interest, like public health?

Pants-less transit civil disobedience when?

Lower costs for everyone. Including people you don't like. Yes.

I'm not understanding how two staircases are more accessible than one. Can you elaborate?

Of the half that are dark, how many are working late, out to dinner, out of town, etc?

That half the units are dark from 7-9PM doesn't mean they're not someone's primary residence.

The article does acknowledge the existence of real fraud. It distinguishes it from honest errors. It goes on to point out that sometimes institutions (financial and state) sometimes fail to adequately distinguish the two.

Maybe it could have included more on bona fide fraud. But it doesn't contain an assumption that true check fraud is non existent. And it certainly doesn't devolve into any sort of rant.

I don't think that's a fair reading. At most, the piece describes a common political rant, and then says "Phrased that way, it sounds almost fantastically unjust. And… it’s complicated."

Your comment, in contrast, strikes me as being much closer to a reflexive political rant than the essay.

Someone should do "Uber for Notaries Public"

Yes, exactly that.

That's not true. As far as the law is concerned, users/providers are shielded so long as they don't take part in authorship. You be as despotic or biased as you want, and you're still not considered the publisher of content provided by another user/provider.

Does anyone know if section 230 of the DMCA shields Reddit from liability as-is?

It does. (And 230 isn't part of the DMCA, it's the only surviving bit of the CDA).

My understanding is that they'll give the subject the warrant, which just describes what they're allowed to search for and where. The affidavit submitted the judge, which describes the evidence that established the requisite probable cause, is not provided.

If the search turns up evidence, and the government wants to use that evidence at trial, then the affidavit is available in discovery.

If no trial results, I don't think there's any reliable way to get at the affidavit.

Caddy works quite nicely in front of php-fpm, as a replacement for apache.