Hacker News Reader

Comment by tptacek | Hacker News Reader

It's a good question, and we don't have a good answer for it yet. You're not wrong to be annoyed by this. It's a consequence of us being a young team with limited resources; if you do nothing to qualify free-tier users, then several people end up with the full-time job of tracking and shutting down abuse.

It won't make you feel much better, but this issue is very close to the top of our stack (we'd also convert visitors and window-shoppers better if they could boot something up without a credit card). The incentives are there for us to fix this; it's mostly a matter of time.

I'm glad you called it out.

View on HN

Have you considered phone number verification? Both minors and people in non-western countries are a lot more likely to have a phone than a credit card. Not sure how easy it is for fraudsters to get their hands on large quantities of phone numbers though.

I wonder, because Github actions are a thing, Github is likely to be facing the same issue, and is likely to have implemented mitigations already. Maybe you could piggyback on that effort and require Github auth?

We're taking notes on all this stuff, for what it's worth.

Free phone numbers to receive sms's are ubiquitous. Its trivial to bypass.

Github actions wears the cost as a huge multinational and has anti-abuse mechanisms in place for CI runners but not account signups which again are simple to automate if it means free compute.

None of these things are actual solutions, people abuse free tiers to run cryptominers and commit crime, they don't get dissuaded by that. A CC number is a much more serious threshold that solves nearly all of your problems in a day.

Perhaps you can work with faculty or universities and verify students with email from that institution. You are also getting them while they are young for what it's worth.

JetBrains manages academic email domains list: https://github.com/JetBrains/swot

This assumes your school actually provides email addresses, which just isn't the case in certain countries, not outside of higher education.

Idea: give an option for developers to qualify by proving ownership of an active GitHub/GitLab/Sourcehut profile?

I like the idea but part of me worries that it’d just end up being the Hackoberfest nonsense again? Manual verification perhaps? Seems like a lot of work though…

To some degree that can be faked: https://github.com/artiebits/fake-git-history

Also if it requires internet points rather than self commit history, we'll see Hacktoberfest storm again.

Reply on news.ycombinator.com