This is your brain on fraud apologetics
In 1998, two Stanford students published a paper in Computer Networks entitled “The Anatomy of a Large-Scale Hypertextual Web Search Engine,” in which they wrote, “Advertising funded search engines will be inherently biased towards the advertisers and away from the needs of consumers.”
https://research.google/pubs/pub334/
If you’d like an essay-formatted version of this post to read or share, here’s a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:
https://pluralistic.net/2023/02/24/passive-income/#swiss-cheese-security
The co-authors were Lawrence Page and Sergey Brin, and the “large-scale hypertextual web search-engine” they were describing was their new project, which they called “Google.” They were 100% correct — prescient, even!
On Wednesday night, a friend came over to watch some TV with us. We ordered out. We got scammed. We searched for a great local Thai place we like called Kiin and clicked a sponsored link for a Wix site called “Kiinthaila.com.” We should have clicked the third link down (kiinthaiburbank.com).
We got scammed. The Wix site was a lookalike for Kiin Thai, which marked up their prices by 15% and relayed the order to our local, mom-and-pop, one-branch restaurant. The restaurant knew it, too — they called us and told us they were canceling the order, and said we could still come get our food, but we’d have to call Amex to reverse the charge.
As it turned out, the scammers double-billed us for our order. I called Amex, who advised us to call back in a couple days when the charge posted to cancel it — in other words, they were treating it as a regular customer dispute, and not a systemic, widespread fraud (there’s no way this scammer is just doing this for one restaurant).
In the grand scheme of things, this is a minor hassle, but boy, it’s haunting to watch the quarter-century old prophecy of Brin and Page coming true. Search Google for carpenters, plumbers, gas-stations, locksmiths, concert tickets, entry visas, jobs at the US Post Office or (not making this up) tech support for Google products, and the top result will be a paid ad for a scam. Sometimes it’s several of the top ads.
This kind of “intermediation” business is actually revered in business-schools. As Douglas Rushkoff has written, the modern business wisdom reveres “going meta” — not doing anything useful, but rather, creating a chokepoint between people who do useful things and people who want to pay for those things, and squatting there, collecting rent:
https://rushkoff.medium.com/going-meta-d42c6a09225e
It’s the ultimate passive income/rise and grind side-hustle: It wouldn’t surprise me in the least to discover a whole festering nest of creeps on Tiktok talking about how they pay Mechanical Turks to produce these lookalike sites at scale.
This mindset is so pervasive that people running companies with billions in revenue and massive hoards of venture capital run exactly the same scam. During lockdown, companies like Doordash, Grubhub and Uber Eats stood up predatory lookalike websites for local restaurants, without their consent, and played monster-in-the-middle, tricking diners into ordering through them:
https://pluralistic.net/2020/09/19/we-are-beautiful/#man-in-the-middle
These delivery app companies were playing a classic enshittification game: first they directed surpluses to customers to lock them in (heavily discounting food), then they directed surplus to restaurants (preferential search results, free delivery, low commissions) — then, having locked in both consumers and producers, they harvested the surplus for themselves.
Today, delivery apps charge massive premiums to both eaters and restaurants, load up every order with junk fees, and clone the most successful restaurants out of ghost kitchens — shipping containers in parking lots crammed with low-waged workers cranking out orders for 15 different fake “virtual restaurants”:
https://pluralistic.net/2020/12/01/autophagic-buckeyes/#subsidized-autophagia
Delivery apps speedran the enshittification cycle, but Google took a slower path to get there. The company has locked in billions of users (e.g. by paying billions to be the default search on Safari and Firefox and using legal bullying to block third party Android device-makers from pre-installing browsers other than Chrome). For years, it’s been leveraging our lock-in to prey on small businesses, getting them to set up Google Business Profiles.
These profiles are supposed to help Google distinguish between real sellers and scammers. But Kiin Thai has a Google Business Profile, and searching for “kiin thai burbank” brings up a “Knowledge Panel” with the correct website address — on a page that is headed with a link to a scam website for the same business. Google, in other words, has everything it needs to flag lookalike sites and confirm them with their registered owners. It would cost Google money to do this — engineer-time to build and maintain the system, content moderator time to manually check flagged listings, and lost ad-revenue from scammers — but letting the scams flourish makes Google money, at the expense of Google users and Google business customers.
Now, Google has an answer for this: they tell merchants who are being impersonated by ad-buying scammers that all they need to do is outbid them for the top ad-spot. This is a common approach — Amazon has a $31b/year “ad business” that’s mostly its own platform sellers bidding against each other to show you fake results for your query. The first five screens of Amazon search results are 50% ads:
https://pluralistic.net/2022/11/28/enshittification/#relentless-payola
This is “going meta,” so naturally, Meta is doing it too: Facebook and Instagram have announced a $12/month “verification” badge that will let you report impersonation and tweak the algorithm to make it more likely that the posts you make are shown to the people who explicitly asked to see them:
https://www.vox.com/recode/2023/2/21/23609375/meta-verified-twitter-blue-checkmark-badge-instagram-facebook
The corollary of this, of course, is that if you don’t pay, they won’t police your impersonators, and they won’t show your posts to the people who asked to see them. This is pure enshittification — the surplus from users and business customers is harvested for the benefit of the platform owners:
https://pluralistic.net/2023/01/21/potemkin-ai/#hey-guys
The idea that merchants should master the platforms as a means of keeping us safe from their impersonators is a hollow joke. For one thing, the rules change all the time, as the platforms endlessly twiddle the knobs that determine what gets shown to whom:
https://doctorow.medium.com/twiddler-1b5c9690cce6
And they refuse to tell anyone what the rules are, because if they told you what the rules were, you’d be able to bypass them. Content moderation is the only infosec domain where “security through obscurity” doesn’t get laughed out of the room:
https://doctorow.medium.com/como-is-infosec-307f87004563
Worse: the one thing the platforms do hunt down and exterminate with extreme prejudice is anything that users or business-customers use to twiddle back — add-ons and plugins and jailbreaks that override their poor choices with better ones:
https://www.theverge.com/2022/9/29/23378541/the-og-app-instagram-clone-pulled-from-app-store
As I was submitting complaints about the fake Kiin scam-site (and Amex’s handling of my fraud call) to the FTC, the California Attorney General, the Consumer Finance Protection Bureau and Wix, I wrote a little Twitter thread about what a gross scam this is:
https://twitter.com/doctorow/status/1628948906657878016
The thread got more than two million reads and got picked up by Hacker News and other sites. While most of the responses evinced solidarity and frustration and recounted similar incidents in other domains, a significant plurality of the replies were scam apologetics — messages from people who wanted to explain why this wasn’t a problem after all.
The most common of these was victim-blaming: “you should have used an adblocker” or “never click the sponsored link.” Of course, I do use an ad-blocker — but this order was placed with a mobile browser, after an absentminded query into the Google search-box permanently placed on the home screen, which opens results in Chrome (where I don’t have an ad-blocker, so I can see material behind an ad-blocker-blocker), not Firefox (which does have an ad-blocker).
Now, I also have a PiHole on my home LAN, which blocks most ads even in a default browser — but earlier this day, I’d been on a public wifi network that was erroneously blocking a website (the always excellent superpunch.net) so I’d turned my wifi off, which meant the connection came over my phone’s 5G connection, bypassing the PiHole:
https://pluralistic.net/2022/04/28/shut-yer-pi-hole/
“Don’t click a sponsored link” — well, the irony here is that if you habitually use a browser with an ad-blocker, and you backstop it with a PiHole, you never see sponsored links, so it’s easy to miss the tiny “Sponsored” notification beside the search result. That goes double if you’re relaxing with a dinner guest on the sofa and ordering dinner while chatting.
There’s a name for this kind of security failure: the Swiss Cheese Model. We all have multiple defenses (in my case: foreknowledge of Google’s ad-scam problem, an ad-blocker in my browser, LAN-wide ad sinkholing). We also have multiple vulnerabilities (in my case: forgetting I was on 5G, being distracted by conversation, using a mobile device with a permanent insecure search bar on the homescreen, and being so accustomed to ad-blocked results that I got out of the habit of checking whether a result was an ad).
If you think you aren’t vulnerable to scams, you’re wrong — and your confidence in your invulnerability actually increases your risk. This isn’t the first time I’ve been scammed, and it won’t be the last — and every time, it’s been a Swiss Cheese failure, where all the holes in all my defenses lined up for a brief instant and left me vulnerable:
https://locusmag.com/2010/05/cory-doctorow-persistence-pays-parasites/
Other apologetics: “just call the restaurant rather than using its website.” Look, I know the people who say this don’t think I have a time-machine I can use to travel back to the 1980s and retrieve a Yellow Pages, but it’s hard not to snark at them, just the same. Scammers don’t just set up fake websites for your local businesses — they staff them with fake call-centers, too. The same search that takes you to a fake website will also take you to a fake phone number.
Finally, there’s “What do you expect Google to do? They can’t possibly detect this kind of scam.” But they can. Indeed, they are better situated to discover these scams than anyone else, because they have their business profiles, with verified contact information for the merchants being impersonated. When they get an ad that seems to be for the same business but to a different website, they could interrupt the ad process to confirm it with their verified contact info.
Instead, they choose to avoid the expense, and pocket the ad revenue. If a company promises to “to organize the world’s information and make it universally accessible and useful,” I think we have the right to demand these kinds of basic countermeasures:
https://www.google.com/search/howsearchworks/our-approach/
The same goes for Amex: when a merchant is scamming customers, they shouldn’t treat complaints as “chargebacks” — they should treat them as reports of a crime in progress. Amex has the bird’s eye view of their transaction flow and when a customer reports a scam, they can backtrack it to see if the same scammer is doing this with other merchants — but the credit card companies make money by not chasing down fraud:
https://www.buzzfeednews.com/article/rosalindadams/mastercard-visa-fraud
Wix also has platform-scale analytics that they could use to detect and interdict this kind of fraud — when a scammer creates a hundred lookalike websites for restaurants and uses Wix’s merchant services to process payments for them, that could trigger human review — but it didn’t.
Where do all of these apologetics come from? Why are people so eager to leap to the defense of scammers and their adtech and fintech enablers? Why is there such an impulse to victim-blame?
I think it’s fear: in their hearts, people — especially techies — know that they, too, are vulnerable to these ripoffs, but they don’t want to admit it. They want to convince themselves that the person who got scammed made an easily avoidable mistake, and that they themselves will never make a similar mistake.
This is doubly true for readerships on tech-heavy forums like Twitter or (especially) Hacker News. These readers know just how many vulnerabilities there are — how many holes are in their Swiss cheese — and they are also overexposed to rise-and-grind/passive income rhetoric.
This produces a powerful cognitive dissonance: “If all the ‘entrepreneurs’ I worship are just laying traps for the unwary, and if I am sometimes unwary, then I’m cheering on the authors of my future enduring misery.” The only way to resolve this dissonance — short of re-evaluating your view of platform capitalism or questioning your own immunity to scams — is to blame the victim.
The median Hacker News reader has to somehow resolve the tension between “just install an adblocker” and “Chrome’s extension sandbox is a dumpster fire and it’s basically impossible to know whether any add-on you install can steal every keystroke and all your other data”:
https://mattfrisbie.substack.com/p/spy-chrome-extension
In my Twitter thread, I called this “the worst of all possible timelines.” Everything we do is mediated by gigantic, surveillant monopolists that spy on us comprehensively from asshole to appetite — but none of them, not a 20th century payment giant nor a 21st century search giant — can bestir itself to use that data to keep us safe from scams.
Next Thu (Mar 2) I'll be in Brussels for Antitrust, Regulation and the Political Economy, along with a who's-who of European and US trustbusters. It's livestreamed, and both in-person and virtual attendance are free:
https://www.brusselsconference.com/registration
On Fri (Mar 3), I'll be in Graz for the Elevate Festival:
https://elevate.at/diskurs/programm/event/e23doctorow/
[Image ID: A modified version of Hieronymus Bosch's painting 'The Conjurer,' which depicts a scam artist playing a shell-game for a group of gawking rubes. The image has been modified so that the scam artist's table has a Google logo and the pea he is triumphantly holding aloft bears the 'Sponsored' wordmark that appears alongside Google search results.]
2K notes
·
View notes
ok but like jack who loveeeess when hes under the weight of something, he sleeps with like four hundred stuffed animals weighted blankets are his jam, etc etc, and then davey comes along and just flat out sleeps on top of him 24/7. its a win for both of them. (sorry if this isn’t coherent im literally asleep)
(sneep i dont know if you're referencing the prompts list at all or if it was just deeply important to you that i know this but i'm writing about it anyways)
It's hard for Jack to keep his feet on the ground sometimes.
He can't quite put it into words. He's not really a words guy. It took him about a year and a half post-American-public-school-system to realize that he was actually smart enough to read books, let alone echo them. Colours, that's where Jack's mind lives. A big swirling sea of shapes and colours. Sometimes it's calm; the gentle blue strokes of a calm, well-rested morning; the occasional pops and starbursts of the New York streets - a baby babbling at their parents, a dog yipping excitedly, a song that's been stuck in Jack's head drifting out of the cracked window of a passing car - all painted in pretty pinks and bright, sunny yellows. He's nowhere near whimsical or delusional enough for the happy-go-lucky "where dreams are made of" view of NYC, the one that's been washed over in watery-pink with Gershwin plunking in the background - but he's not nihilistic enough to pretend it's nothing more than a tar-pit. There's plenty to love, to be inspired over, to leave happy little brushstrokes on his skin.
But sometimes - sometimes - he gets too swept up in it. All the movement, all the noise, all of it, it picks him up by the scruff and throws him, spins him around and kicks him right between the ribs, until he's drifting listlessly along the sidewalk like a scrap of paper, small and sensitive, marked by every fume of exhaust and drop of gutter-water.
It's the difference between being painted and being stained. That's the only way Jack can describe it. Paint, colours, it has a purpose to it. It presses into his skin and keeps him grounded to reality. A stain is just... Nothing. A tear, a black hole of graphite in his chest, sucking up all his being until there's nothing left.
He needs solidity, when he gets like this. He needs to be held in place until all that old, wasted paper is rubbed away, and he can grow into himself again, fresh and newly remade.
It starts with a pillow. His first night at Medda's - she gave him two instead of just one. He'd no idea what to do with it. He only needed one or else his head felt too high, and he didn't want to just chuck it on the floor or stuff it in his closet, Miss Medda might think he was rude, and he liked Miss Medda, he didn't want her to think he was a bad kid, she might get angry, might give him back... And then he was panting, trembling with every inch, tears stinging at his eyes as he tried to press his nails into his palm, hold himself together, but nothing was working, nothing was firm enough-
It was humiliating - as humiliating as everything else is for an eleven year old, but still, humiliating - to go to sleep that night, clutching a pillow to his chest as he squeezed with all his little might. But it pressed his lungs into the mattress, forced the air in and out, and the foam held tight against his sharp, scrabbling hands, not breaking, not pushing him away... It was just enough.
He almost would've been content with just that, hugging a pillow every now and then - but Medda and Siôn had this whole thing about 'making Jack understand his worth as a person', the nerve, and suddenly he was being given all he needed and more. A plushie, then two, then five. A throw pillow with Val Kilmer's face on it, because Siôn ("Just fucking call me Crutchie, dude, I won't break-") was just as much a cretin when he was a teenager than he is now. A weighted blanket for his birthday that redefined Jack's understanding of the word comfort.
And that could've been enough. It all could've been enough. Fuck, just a hug every couple of days would've been enough. It was certainly more than he'd earned.
He'd offhandedly said something along those lines to Davey - or "Library Guy" as he'd been referred to at the time, since Jack had only really met him three times in two weeks - who had calmly raised a finger, taken a long swig of his coffee, slammed his travel mug (reusable, of course, because Davey is the world's most irritatingly perfect saint) on his desk and given Jack a seventeen minute speech about humanity's relationship with validation through the lens of a capitalistic society - and all of a sudden, Jack wanted everything. Coffee. Dinner. Pet-names, hand-holding, lazy Sundays, teasing each other when they woke up and talking about bullshit until they fell asleep. And Davey gave him all of it without a second glance.
Jack was hesitant to ask, at first. They'd fallen asleep on the couch - they were supposed to be studying, but Davey had found out Jack had never watched any of the Lord of The Rings movies and had spent the entire evening pausing every five minutes to eagerly share his Silmarillion trivia (Jack still hasn't gotten him to admit it yet, but he's pretty sure he can pinpoint Davey falling in love with him to the moment Jack asked why Viggo Mortensen kicking a helmet was so funny to him) - and they'd inevitably fallen asleep on top of each other, with Jack flat on his back and Davey splayed over him like the world's sweetest, sleepiest octopus.
("You really know how to make a guy feel hot, y'know that?"
"Bold of you to assume octopuses are not hot. Tentacle porn exists for a reason, Dave."
"See, I want to be mad at you for bringing up tentacle porn at brunch, but I'm more offended that you called them octopuses and not octopi.")
It was nice, having Davey over him - which, yes, got him some eyebrow waggles when he first admitted it, but it really wasn't like that. It was the weight of it, the reassurance of Davey's warmth encompassing his own, knowing that Davey was here, and he was here, pressed down firmly to the ground and not going anywhere. The sensation of it - the firmness on his chest that makes him feel every breath and every beat of his pulse, that tells him he's here and he's fine - it's like his whole brain's been washed clean.
"Pressure stimming," is the word Davey uses about two months later, a short while after Jack had finally realized that they were actually, exclusively, undeniably boyfriends and not just 'friends who are kind of maybe dating if Davey wants that maybe'. He'd walked into his bedroom in his and Crutchie's apartment to find Davey already there, lying face down on the bed - and Jack might've left it be, because he's had plenty of days where he just needs to lie face-down for a whole hour, but Davey telling him that he physically couldn't get off the bed was the thing that sent him panicking.
"It's not a big deal..." Davey's forefinger flicks up-and-down, up-and-down against one of Jack's many pillows as he speaks, the way he does when he has just slightly too much nervous energy. "It's just something I need sometimes. The way my energy is, it's like everything I do starts weighing down on me - and sometimes I can just let that weight off every now and then, and I'm fine - but sometimes I just... Need something. To support me."
Jack nods slowly, thinking of pillows and plushies and weighted blankets, and hovers his hand over the small of Davey's back.
"You need something, like... On top?" He cringes, because there's no way for that to not sound like an innuendo, but Davey only snorts into the comforter and shakes his head against the soft fabric.
"You're perfect," he smiles, so earnest that it makes Jack's chest squeeze, "but - no. I don't really like that. Feels like I'm being restrained."
Jack frowns, adds that to the little drawer in his brain marked Davey - a drawer that is becoming so cluttered and full of tiny details and special memories that it's almost overflowing - and bites his lip.
"I could, um..." Slowly, like Jack might spook him, he lowers himself onto the the bed next to him, raising his brows in question. "If you want?"
Davey stares at him for a moment - and then it's as if all the tension in his body just bleeds out of him, as he makes wanton little grabby-hands in Jack's direction. Jack laughs quietly, grabs him gently by the shoulders and pulls, rolling them until he's flat on his back and Davey's spreadeagled on top of him - and they both sigh from somewhere deep in their bones as they lean and are leaned upon, pressing and being pressed against each other, two solid weights supporting each other in place.
"I like this," Jack murmurs into Davey's hair as they rest. Davey makes a quiet chuffing sound into his clavicle and wriggles slightly, like a cat kneading a pillow, pressing them both impossibly closer as he settles.
"Oh, yeah?" He says quietly. "You like having a big octopus on top of you?"
"My exact words were sweetest and sleepiest octopus." Jack teases, tugging lightly on one of Davey's curls. "C'mon, English Major, those're some important words, there."
"You're so weird," Davey mumbles, but Jack can feel his smile pressing through his shirt, all the way to his skin, through the muscle, until it prints like ink on his breastbone. It holds him there, keeps him perfectly still and secure - and Jack breathes like he's tasting the air for the first time.
"I love you," he says quietly, because it's the only way he can even think to put what he's feeling into words. Davey would know better than him on that. He could write sonnets about this, pages and pages of prose about how it feels just to hold someone - but Jack's not a words guy. Give him a few hours with a canvas, and maybe he can get down a fraction of what he's feeling now, the barest impression of the thousands upon thousands of colours dancing inside his head like grass in the wind. But for now, he'll just say "I love you", and hope that it's enough.
He can feel Davey's throat flex against his sternum, can feel the way his body tenses, then ebbs, like the pull of the tide.
"I love you, too," he whispers.
It's so much more than enough.
77 notes
·
View notes