Posted by tosh 12/18/2025
Not an expert in the issues presented, but I see increasing numbers of single-point process failures, like what happened to Paris, being designed into our civilization.
The general risk of getting your account disabled for infractions, though, persists regardless of this specific triggering mechanism.
> I should probably start to work on self-hosting now that I can see I was incorrect to trust Apple...
Jumping to that conclusion might be worse. Don't think of trust as a binary bit. Better to ask:
1. To what degree can I trust Party to do Thing?
- what is Party's track record?
- what are Party's incentives?
- what is the probabilistic distribution of outcomes?
2. What is my best alternative to #1?
- ... track record?
- ... incentives?
- ... distribution of outcomes?
3. Pick the least worst for you
But the truly troublesome issue is how an entire ecosystem of (very expensive) hardware is allowed to be tied to an identity controlled by a giant black box of a corporation.
What I mean is: you can spend thousands and thousands on devices and configure them to be almost invaluable to your everyday life, but you are ultimately completely beholden to Apple. You require their ongoing permission to continue using those devices. You are completely at their mercy.
And sure, you can argue that people willingly sign up for that kind of agreement when they make the decision to purchase Apple/Google products but that's also missing the point. Phones are now essential utilities. Accessing vital services sometimes requires an iOS or Android device.
Permitting giant, uncontactable, merciless tech corporations to control the digital lives of virtually everyone on the planet is absolute insanity.
The scenario described in the OP's article should simply never be allowed to happen.
The way I see it resolved is for Google and Apple to link the accounts to a physical person via government ID so that if you want issues to be resolved you'd have to verify yourself. This would also limit abuse by bad parties.
Now, do you want all of your web accounts be linked to your government ID?
No, but I don't think that's actually necessary. My cloud storage account with Google could be linked to my government ID, and... that might be ok? This sort of plan wouldn't require, e.g., my HN account to be linked to my ID.
Yes, that would mean that some people (e.g. activists under repressive regimes) shouldn't be storing stuff that could get them in trouble in Google Docs or iCloud Photos, but... they probably shouldn't be doing that now anyway.
But this would still require governments passing laws to prevent arbitrary account closures. Linking an account with an ID doesn't automatically make Apple/Google behave. The legally-mandated process would need to be something like: automated system detects fraud, they call the police, police investigate, and either a) they see nothing and drop it, and Google/Apple are required to drop it, or b) they investigate, prosecutors bring charges, and the outcome of the court proceedings is binding on Google/Apple (conviction = account terminated, exoneration = no retaliation allowed).
It would be easy to fix this problem simply by charging a hefty up-front fee for direct connection to high-level human support, who will take the time to verify the user's identity using established KYC procedures and then take action to restore the account. The fee would then be refunded if the problem turned out to be on the company's end.
Companies like Apple don't offer that, because they don't GAF.
Is that the correct way to fix the fraud problem?
It's December holidays time, but I assume that most Apple gift cards that would be purchased for the holidays already have been, so...
Maybe people should also be urged to demand to return any Apple gift cards already bought. Arm people with a copy of the news story. If retailers resist, then regulators can get involved.
Silver bullets almost never beat fraud. Better to steel yourself for a never-ending grind against a horde of nameless adversaries.
I asked Gemini for some follow-ups, and lo! they are interesting to consider:
- "fraud is an evolutionary arms race fought in the trenches."
- "fraud is a siege where the attacker has infinite attempts, and the defender must succeed every time."
- "fighting fraud is not a battle, it is industrial waste management."
The only idea I can think of is a law that requires companies, once they reach a certain number of users or market share, to provide a formal process to restore accounts that are a certain number of years old. This could include paid arbitration or a similar mechanism.
I doubt such a law could pass at the federal level, but if it were passed in California, it would probably solve 80 percent of the problem.
Or is there a better solution?