News for hackers. Stuff that matters.

jumhyn

Re:Passwords and Power Drills on Saturday October 25, 2025 @05:52PM (#45707291)
But the additional cards may very well have been necessary to understand “there is something wrong with our usage of the cards, this error is not a one-off failure due to corrupted data or broken hardware or other problem local to the California card(s)”. Having multiple independent reproductions of an issue helps you narrow down what the commonalities are!
I believe it’s a cheeky reference to humans intentionally cultivating hot peppers specifically because of their capsaicin-producing quality. :)
> it's in the signup for the downloading accounts

That's certainly not the only misrepresentation Smith made throughout this scheme.

I'm having trouble understanding why you think it's particularly relevant whether these were free or paid accounts (as alleged in the indictment, the fraud made substantial use of paid family plan accounts).

It's worth noting that the scheme here was not merely bilateral between Spotify and Smith--it involved multiple streaming services, multiple distribution companies, the "Rights Organizations", and financial service providers who were all part of the overall scheme of delivering unearned royalties to Smith based on fraudulent streams.

If the facts alleged in the indictment are true, it seems immensely clear to me that Smith made multiple false representations to each of these parties as part of the scheme to have them deliver streaming royalties to which he knew he was not entitled. Among those false representations were: - false names provided on accounts for the purposes of concealing his identity - statements to financial service providers in order to obtain debit cards in those false names - agreement that he would refrain from engaging in manipulative streaming activity - insistence that he was not engaging in such manipulative activity when suspicion s arose

Smith directly responded to the suspicions that arose as early as 2018, but the scheme continued for years afterwards. So even if one were to make the case that he was initially unaware of a clause buried deep in the TOS, he was made expressly aware that he was in violation of those terms and chose to continue deceiving the parties (and indeed increased his efforts to conceal the fraudulent activity from the streaming platforms).

Now, it may be the Spotify alone wouldn't have a case for damages here since his activity didn't directly cause them to pay out more total royalties, and his subscriptions increased the total pool. But this isn't a civil case where Spotify is suing for breach of contract to claw back the royalty payments; there was $10M in royalties paid out to Smith that came from somewhere which was owed to someone other than Smith. Smith lied to multiple parties involved in the music steaming business in order to induce them to make those royalty payments.

I'm no lawyer, and so don't have a great idea if there's technical elements to the charges here that will be difficult to prove beyond a reasonable doubt, but I think it's more than clear that this was not 'fair play' on the part of Smith. I am reminded of the viral 'free money glitch' that went viral several weeks ago on TikTok: people were writing fraudulent checks, depositing them at ATMs and then withdrawing the cash portion that Chase permits you to withdraw before the check has fully cleared. That the automated systems for preventing this sort of abuse were imperfect does not somehow make it not fraud.

> The question is whether their actions were misrepresentations. This is unclear.

Accepting the facts in the indictment at face value, I really don't see how this is unclear. The contract between Smith-the-artist and Spotify was that they would pay him royalties for legitimate streams which were not the result of manipulation, and that he would not deliberately manipulate the streams.

Smith then knowingly violated these terms, attempted to conceal his violations from Spotify, and continued to accept the royalty payments to which he knew he was not entitled. Aside from the misrepresentations required to initially set up the scheme (e.g., signing up bot accounts under fake names), he also repeatedly and directly denied participating in the exact sort of scheme he knew he was perpetuating: "I have never done anything to artificially inflate my streams". The allegations in paragraphs 26-30 cover several instances of this.

> If I upload a song to Spotify I am not promising anything wrt to who listens to it or how.

I'm not sure how you are squaring this with the quoted portion of the indictment from my prior comment. Smith did, in fact, make promises regarding who would listen (and how) to the songs he uploaded: namely, that he would not personally or via a third party listen to the songs in a manipulative manner.

> There's a real problem in saying that whatever BS a company puts in its TOS defines fraud and if you dont do that you're defrauding a company. If that's true, then you're probably defrauding companies all the time, as are many.

That's simply not the case here. Smith was not inadvertently running afoul of fine print buried deep in TOS that he never read to trivial detriment of some corporation. He was engaged in repeated and deliberate misrepresentation with the intent of inducing Spotify and distribution companies to pay out royalties in excess of $10M to which he knew he was not entitled.

For those that are arguing that this is simply a legal arbitrage, or financial engineering of some sort, I suggest reading the actual indictment. From page 4:

> at relevant times to this Indictment, a Manhattan-based music distribution company ("Distribution Company-1 ") [...] required customers, such as SMITH, to "agree not to engage in (or to permit, encourage, enlist, retain, or employ third parties to engage in) [...] any activity and/or method which involves the artificial creation, by human or non-human means, of online or offline plays on audio and/or audio-visual streaming services, where such plays do not represent bona fide end-user listening and/or views initiated by genuine consumers and taking place in the reporting country."

The issue here is not a TOS violation on the subscriber side. Smith had an obligation not to engage in streaming manipulation as an artist receiving royalty payments, and deliberately skirted that obligation (while attempting to conceal his activity) with the intent of inducing Spotify to pay him royalties which he was not legitimately owed. That's fraud.

You're overthinking this. From the indictment (page 4):

> at relevant times to this Indictment, a Manhattan-based music distribution company ("Distribution Company-1 ") [...] required customers, such as SMITH, to "agree not to engage in (or to permit, encourage, enlist, retain, or employ third parties to engage in) [...] any activity and/or method which involves the artificial creation, by human or non-human means, of online or offline plays on audio and/or audio-visual streaming services, where such plays do not represent bona fide end-user listening and/or views initiated by genuine consumers and taking place in the reporting country."

Moreover, the arbitrage available here doesn't really have anything to with "burning investor money". Aside from the fact that Spotify has been profitable so far in 2024, this fraud would be possible even if they had been profitable during the whole time the fraud had been carried out: it doesn't require that Spotify's royalty outlays be greater than their subscription/ad revenues in the aggregate. Rather, it relies on the fact that royalties are calculated in terms of total streaming volumes, but subscription prices are volume independent.

So while it's possible for a single individual to abuse the system and generate more royalties for themselves than what they pay in subscription revenues, it wouldn't work as a method in the aggregate for Spotify users to en masse produce royalties that exceeded streaming revenues. Even in unprofitable years their revenues greatly exceed their royalty payments. E.g., Spotify reportedly paid out $9B in royalties for 2023, on over $14B of revenue. At that point they were still operating at a loss due to R&D, marketing/sales, and administrative expenses, but that's all quite aside from their royalty calculation system.

Re:The Chancellor's Excellent Questions on Saturday August 24, 2024 @12:07AM (#41335538)
Yeah, I suppose I went in primed for a more opinionated style just because of the fact that I was reading an unknown author’s Substack rather than something that purported to be news. I definitely take your point about moving the partisan comments up front.
Re:The Chancellor's Excellent Questions on Friday August 23, 2024 @01:36PM (#41331099)
Honestly, I feel better if an author makes their personal biases known rather than try to conceal them beneath a facially impartial analysis. It naturally invites more scrutiny on the claims being made, but IMO it’s more intellectually honest to invite that scrutiny explicitly. Those with an axe to grind about any given topic who are reasonably rhetorically capable could write an ostensibly nonpartisan account which nonetheless leads readers to the authors preferred conclusion.
Re:Pi calculation world record with over 202T digits on Monday July 15, 2024 @10:59PM (#40973356)
IIRC the property ‘each single digit has the same density’ is the definition for a ‘simply normal number’ (in a given base), while ‘each finite string of a particular length has the same density as all other strings of that length’ is the definition for a ‘normal number’ (in a given base). And then ‘normal in all bases’ is sometimes called ‘absolutely normal’, or just ‘normal’ without reference to a base.
Sure, but it is an option (as well as everywhere along the spectrum up to maximization), and so ‘people want to move there’ is not on its own a justification for ‘prices must go up’.
But this doesn’t offer any justification for why, for locations that people highly value living in, we as a society ought to do anything other than maximize the number of people living there.
There are many homeless people who are not living on the streets: those living in shelters, or cars, or who are frequently moving between temporary living situations with friends or family. And they may even be holding down a job, and/or relying on local support systems for, say, child care, which could make ‘move where it’s cheaper’ an untenable or very risky option.
Re:Writing Gnome Apps with Swift on Wednesday March 27, 2024 @07:07PM (#39845717)
FWIW the concurrency story has been getting substantially more attention over the past couple of years with first-class language support. Swift 6 aims to be data-race-safe by default.
Re:Interoperability: Swift’s Super Power on Friday September 22, 2023 @11:56AM (#37613673)
There's some elaboration in this forums post on "Embedded Swift": https://forums.swift.org/t/embedded-swift/67057
Re:Insider trade on Splunk acquisition for 45,650% return on Thursday September 21, 2023 @01:02PM (#37600555)
Right, the SEC’s guidance[1] on this specifies that merely trading on MNPI alone is not enough:

> Illegal insider trading refers generally to buying or selling a security, in breach of a fiduciary duty or other relationship of trust and confidence, on the basis of material, nonpublic information about the security.

If you have no fiduciary duty or other relationship of trust and confidence, it’s not insider trading. So to my understanding, if you, say, overheard two execs chatting about this in an airport lounge you’d be free to trade on it.

Note: this only applies to the US! Different countries may define things differently.

[1]: https://www.investor.gov/introduction-investing/investing-ba...

Re:Frank Rosenblatt on Friday April 07, 2023 @08:36AM (#35480953)
It’s not quite self-driving cars but Snow Crash has a very similar plot detail.
Re:Reference count, don't garbage collect on Saturday July 30, 2022 @12:40AM (#32284336)
No, the SO post is accurate—it’s trivially easy to create strong reference cycles in Swift and @escaping annotation is only of limited use in detecting strong reference cycles. Though Swift also broadly pushes towards the use of value types for which creating reference cycles of any kind is impossible since they’re values, not references!
Re:Zipf's Law (2008) on Sunday June 05, 2022 @10:28PM (#31636794)
Example of a distribution which would not fit this description:

1. 4096

2. 2048

3. 1024

4. 512

5. 256

6. 128

...

Here, the frequency of a word is inversely proportional to its rank to the power of two, not the rank itself.

> And Apple's subscriptions expire immediately if you cancel during a free trial, whereas the Google ones will still let you finish the term of your trial.

Amusingly, this is only the case for Apple's first-party subscriptions. Third-party IAP subscriptions for which you are in the free trial when you cancel will continue to provide "access" until the trial period concludes.

Re:How does Google Authenticator work? on Saturday August 28, 2021 @04:29PM (#28341240)
May not make a difference if you don’t take Apple at their word but iCloud Keychain is among the services/data encrypted end-to-end[1] and there’s no exception mentioned for iCloud backup (like there is for Messages).

[1]: https://support.apple.com/en-us/HT202303

Re:How does Google Authenticator work? on Saturday August 28, 2021 @12:34PM (#28339344)
On iOS each password item in Settings.app has a "Share" button that lets you AirDrop to another device. I don't see another way to export from iOS.

Safari on macOS (at least in Monterey) offers a bulk export option, which can export all your passwords to an unencrypted CSV file. The information includes URL, username/email, password, and an "OTPAuth" column. For GitHub (the only account I've enabled native TOTP for while the feature is still in beta) the entry in that column looks like this:

> otpauth://totp/github.com:<username>?secret=<secret>&issuer=github.com&algorithm=SHA1&digits=6&period=30

So I'm not sure if that would be directly importable to another service, but at the very least you get the secret and so could transfer the data account-by-account if you had to.

Re:How does Google Authenticator work? on Friday August 27, 2021 @08:49PM (#28334552)
FWIW, iOS 15 lets you put a TOTP secret right into the saved password entry on your phone, and it will autofill the code just like it autofills your password.
Re:A deep dive into Swift’s function builders on Thursday September 24, 2020 @11:42PM (#24586365)
Great article! Glad to have that misconception cleared up.
Re:A deep dive into Swift’s function builders on Thursday September 24, 2020 @11:26PM (#24586298)
That problem could have been resolved via type erasure (either via `AnyView`, or, if SwiftUI had been designed differently, by having the `body` property be of type `View` rather than `some View`). In fact, opaque types (a la `some View`) were motivated by SwiftUI so that the type information could be preserved to enable the necessary optimizations/animations, without requiring users/library authors to write out/expose the complex type signatures that can arise from even simple view hierarchies.

Incidentally, if you use `AnyView` liberally you’ll likely see worse automatic animations and degraded performance [ETA: the “degraded performance” claim here appears to have been debunked—see the link below for more info!].

Re:A deep dive into Swift’s function builders on Thursday September 24, 2020 @11:08PM (#24586191)
From what I understand, SwiftUI uses this so that each "snapshot" of the View tree generated by the app can be intelligently diffed against future snapshots. This helps make rendering more efficient, as well as with things like animations. Consider a simple view like:

  var body: some View {
    if someStateBool {
      Text("True")
    } else {
      Text("False")
  }
Suppose that initially, `someStateBool ` evaluates to `true`, and then is updated to `false` (triggering an update. If the control flow were "flattened" (i.e., without `buildEither`), the two snapshots would look like:

  1. Text("True")
  2. Text("False")
The algorithm wouldn't be able to tell the difference between "same view with different string" and "different view entirely". With `buildEither`, the snapshots end up looking more like:

  1. ConditionalContent(first: Text("True"))
  2. ConditionalContent(second: Text("False"))
Now, the update algorithm can determine that the entire view was swapped out for another on the update, rather than just changing the text.
Re:Dots don't matter in Gmail addresses on Friday August 28, 2020 @10:43AM (#24305454)
Also doesn't work if I'm not using Gmail :)
Re:Dots don't matter in Gmail addresses on Friday August 28, 2020 @10:15AM (#24305082)
I've been using this trick for a while (usually 'firstlast+per_service_identifier') and I've encountered more than a few systems which erroneously claim that any email address containing a '+' is invalid.
The stat you link appears to be for "IT" jobs across all of the UK. Restricting the search to "Software Engineer" and "London"[0] bumps the number up quite a bit to £72,500 as of when I checked.

[0]: https://www.cwjobs.co.uk/salary-checker/average-software-eng...

Re:Dropbox: Tech's Hottest Startup (2011) on Friday July 10, 2020 @10:43PM (#23799021)
I worked in a research lab several years ago that used Dropbox as their version control system for all the data analysis scripts they wrote. It took a while but by the time I left I had convinced everyone to switch over to git.
It's unfortunately against Facebook's Developer Policy (if you're offering "Sign In with Facebook" functionality). To use that capability you are required to use the official SDK! I filed a (probably futile) issue with them here: https://github.com/facebook/facebook-ios-sdk/issues/1437

Older »