MyBlogLog, Flickr's sister company at Yahoo, has gotten dinged for banning a community member who exploited a security hole, and then posted instructions of how to use the exploit to impersonate other MyBlogLog members, providing names of several members to use. A bit of a blogstorm has ensued, and man, I've been in the middle of a bunch of these, and boy do I sympathize.

Adding fuel to the fire is the fact that MyBlogLog had no Terms of Service posted to defend themselves when the member was banned, and even though they'd announced before this situation that one was on the way, it wasn't there yet. This is a large and ugly oversight for sure, and I think they have to take their lumps for that -- and for some sloppy programming, which they're scrambling to rectify. You've gotta own up, then shut up and fix it up. God knows we've issued a mea culpa or twelve.

But I defend their position on banning the exploit poster, Shoemoney. I think he crossed the line from white hat to black hat when posting the identities of several community members. I think banning was the right thing to do, even without a Terms of Service to cover their ass.

Impersonating someone online is a kind of identity theft, and on a site where you're leaving traces of yourself, a kind of digital "Kilroy was here", using the names and identities of other community members to make a point goes fairly powerfully against the intentions of their product. I remember the early days when we celebrated our ability to be anyone we wanted to be online (remember all those earnest 1996-era conversations with Jean Baudrillard and Allucquere Roseanne Stone?). 10 years later, after we've been through Kaycee Nicole, companies inventing "bloggers" to market their products, and kids lying about their ages and identities online, The Well's credo You Own Your Own Words and the importance of real identity online become more and more apparent. To side with one user who abetted the misuse of the identities of several users doesn't seem right. But my Inner Community Manager tells me that there are dozens of circumstances in which it would be fine for Shoemoney to be unbanned and brought back into the community. I've seen the most egregious trolls clean up their acts and play nice, and I don't think social software should have a death penalty. (No Rez for You My Friend!)

One further note: the lack of a TOS, security holes, bugs and so on -- in this rapid development environment where people code and launch and build things in concert with users in real time -- release early and often! a method I completely endorse! -- this kind of thing is going to happen a lot, so caveat emptor. In the early days at Flickr, we depended on the Kindness of Early Adopters to help us spot exploits, forgive ugly errors and oversights, and help us make the product better. Arrington also agreed with that in his comments. (Anyone know why he always posts at 4:20?)

LINK | 4:55 PM | TB

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .