It is my opinion that you do not need to responsibly disclose &quot;security by obscurity&quot;Additionally, what is irresponsible here? Its not like this gives you the capability to clone tickets without first having a ticket in the first place.

How is this a security vulnerability? It&#x27;s displaying the exact bits Ticketmaster uses and explaining what those bits are. They&#x27;re not circumventing security systems, just the requirement to use the app.

The app-based barcodes don’t seem to be solving a security problem for customers - they seem to be for the purpose of ensuring that traditional scalping doesn’t work, forcing ticket resale into a market that TicketMaster can profit from.I would consider it unethical to publish details of an unpatched vulnerability that allowed ticket forgery, but I don’t think it’s unethical to bypass DRM-like controls for personal convenience rather than commercial purposes.Of course opinions may differ on this.

Responsible disclosure is something you pay for, not something you are entitled to.

It requires sniffing your own session credentials first, which I don&#x27;t see as a security vulnerability.The only thing it allows you to do is sell your ticket, which is legal to do.

Except for a lot of performers and venue operators. Ticketmaster is paid well to be the bad guy. They often share the fees with both the performer and the venue.

The public prosecutor does not pursue cases where responsible aka coordinated vulnerability disclosure was applied. I&#x27;d say that&#x27;s a legal shield of some kind at least, and it is generally also considered best practice in the industry. There&#x27;s exceptions to everything but, in the general case, I&#x27;m not sure where you&#x27;re getting these viewpoints from

&quot;Responsible disclosure&quot; is poorly defined corporate wishcasting, and certainly not any sort of best practice or legal shield.

Nah. Ticketmaster is unethical enough that spreading information that harms them or helps them go out of business is ethical.

That&#x27;s exactly the same policy I apply to AGPL software. I paid for it ($0, as mandated by the developer) and it runs on my CPU.

If it runs on my CPU and shows up on my screen after I paid for it, it&#x27;s mine and I can do whatever I want. Anybody who thinks otherwise can fuck off outright.

I&#x27;m struggling to come up with a good basis for a lawsuit. CFAA abuse is the first thing that comes to mind, but this is a real stretch for that, and SCOTUS shut that stretching down a while ago. DMCA doesn&#x27;t come into play, since this isn&#x27;t circumventing any copyright protection schemes. So this kind of leaves you with some form of contract violation, but even that seems like a stretch here. Tortious interference or interference with prospective business? I mean, I don&#x27;t see any events complaining about this (hell, Ticketmaster itself arguably has some contract liability issues with the fact that their technology relies on cell service which tends to be spotty in dense crowds). So you&#x27;re kind of left with some individual contract liability issue, which is literally not worth the cost of litigation.

Isn’t this a bit like irresponsible disclosure? Since this may be considered a security vulnerability. Although it’s all client side, I’m sure there’s some basis for a lawsuit here.

&gt; &quot;The risk with printable tickets is...&quot;

&gt;is that a seller could sell it to multiple people, who all print it outThey can&#x27;t &quot;print it out&quot; because it&#x27;s a rotating code.

Previous sentence:&gt; If you bought the ticket off the event’s official ticketing agency (not a sketchy reseller)

&gt;Ticketmaster has a system for transferring tickets, if you want to buy or sell ticketsSure, and it is terrible.They can block you from transferring the ticket you bought, and can set a minimum resale price (effectively ensuring you cannot recoup anything)You should to own what you purchase, simple as.

Ticketmaster has a system for transferring tickets, if you want to buy or sell tickets.There could very well be a reason for someone to only sell a physical ticket, or not transfer it through ticketmaster, but I have yet to find anyone but scammers that want to do that.The reason is, just as you mention, that scammers will try to sell multiple tickets. Then one (or many) sucker turns up to the avenue, only to discover that the ticket has already been validated.

&gt; The risk with printable tickets is that a seller could sell it to multiple people, who all print it out, but then only the first person who uses it can get in?Note that the portion of that you&#x27;re quoting that you didn&#x27;t quote is &quot;If you bought the ticket off the event’s official ticketing agency (not a sketchy reseller)&quot;I.e., we&#x27;re specifically talking about someone holding a ticket that they purchased from Ticketmaster. If there are multiple copies floating about, presumably at some point the artist (&#x2F;the actual event) is going to be unhappy that Ticketmaster is screwing their fans&#x2F;attendees over.

&gt; There’s no risk that your ticket won’t get you inIsn’t this not true? The risk with printable tickets is that a seller could sell it to multiple people, who all print it out, but then only the first person who uses it can get in?Even if the venue doesn’t check to see if a ticket has already been used, only one person can sit in the actual seat.

&gt;They can’t have robust DRM on their tickets if those tickets can still be viewed offline.<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Trusted_Computing" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Trusted_Computing</a>

The thing is, unlike most of Europe, the US doesn&#x27;t have a legal mandate for anyone to possess an ID card, and so in practice you got 50 states worth of driver&#x27;s licenses, library cards, military or government employment IDs that can be used (or faked)... so you can&#x27;t really use these for legitimately verifying anything unless you want to spend a lot of time and money to train your staff to spot fakes. Banks can do that but no one wants to do that for the goons that run security at venues for minimum wage.

Huh, weird, a turns out an old, low-tech solution is much more secure than Ticketmaster&#x27;s roll-your-own weird TOT-QR &quot;security&quot; (even considering the magic animation that that makes it &quot;in a sense, alive&quot;)(Not that requiring ID doesn&#x27;t raise the same and also other consumer rights issues)

&gt; This is a contradiction in TicketMaster’s marketing. They can’t have robust DRM on their tickets if those tickets can still be viewed offline.The &quot;robust DRM&quot; is called &quot;ID cards&quot;. Here in Europe, it&#x27;s become commonplace to tie soccer tickets to ID cards that are verified at the gates to keep hooligans (or those suspected of being hooligans, which is a status that is way WAY easier obtainable than one might reasonably assume) out, and high-class events that attract scalpers like a pile of dungs attracts flies have been doing that for even longer.

And this is why those companies love DRM&#x27;d (non-rooted) devices and try to detect when you broke this form of DRM: you can&#x27;t get at your data, not even to make a backup of it; they&#x27;re in full control. Also for security (can&#x27;t grant root to malware if you don&#x27;t have the permission to grant that), but also for everything else

You could extract the barcode at all times in the future by setting the system clock (you can do this on non-rooted phones, and keep it that way at least if you do it in airplane mode).The Android docs mention a &quot;secure timer&quot; in the hardware security module, but I&#x27;m not sure that it can be used to prevent this.<a href="https:&#x2F;&#x2F;developer.android.com&#x2F;reference&#x2F;android&#x2F;security&#x2F;keystore&#x2F;KeyGenParameterSpec.html" rel="nofollow">https:&#x2F;&#x2F;developer.android.com&#x2F;reference&#x2F;android&#x2F;security&#x2F;key...</a>

v2 of this will require an Android&#x2F;iOS app which will make use of the platforms secure storage abilities for the key.On non-rooted devices, those are pretty much impervious to the user trying to inspect their contents.

The underlying issue is that those tickets have a &quot;no resale&quot; provision that doesn&#x27;t apply when the original seller acts as a broker.Do other brokers, when they go and work around that limitation break the sales contact? Maybe. The legal system would churn an answer in a few years.Do AXS et al with their &quot;only we are allowed to engage in a secondary policy&quot; are abusing their monopoly on original sales? The legal system would churn an answer about the legality of this in few years, but I think it&#x27;s obvious they at least break rules in the spirit.

I dug up the court docs referenced in that article, it&#x27;s pretty interesting-AXS Group LLC v. Internet Referral Services LLC (2:24-cv-00377)
District Court, C.D. CaliforniaAmended complaint: <a href="https:&#x2F;&#x2F;storage.courtlistener.com&#x2F;recap&#x2F;gov.uscourts.cacd.911397&#x2F;gov.uscourts.cacd.911397.39.0.pdf" rel="nofollow">https:&#x2F;&#x2F;storage.courtlistener.com&#x2F;recap&#x2F;gov.uscourts.cacd.91...</a>Docket: <a href="https:&#x2F;&#x2F;www.courtlistener.com&#x2F;docket&#x2F;68163191&#x2F;axs-group-llc-v-internet-referral-services-llc&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.courtlistener.com&#x2F;docket&#x2F;68163191&#x2F;axs-group-llc-...</a>One item of the complaint is regarding the &quot;secure.tickets&quot; site, which I wrote about in an earlier comment below (<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=40906148#40910690">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=40906148#40910690</a>).Basically, brokers are using the &quot;secure.tickets&quot; and similar websites to proxy ticket barcodes to buyers, without going through the actual ticket transfer mechanisms on the primary ticketer AXS&#x2F;TM, (similar to how this blogger does). Then resellers are delivering these ticket URLs, hosted on random websites, to Seatgeek and Stubhub customers, and those platforms are supporting their delivery by telling their customers that the tickets are legit. Sounds like AXS is fighting back against this practice.

If you don&#x27;t have a patent on an invention then how do you protect it from people who will just steal what you have spent time&#x2F;money creating?

I love it when a system has been working for hundreds of years through by far the most prosperous time in human history but people on the internet are sure it is wrong. No proof, no evidence, not even logic, just certainty.Also, I don’t think any of the issues with Ticketmaster have anything to do with patents.

What patents does Ticketmaster have that stop competitors from selling tickets?

Monopoly is the keyword here. Ticketmaster and Boeing and all the other nefarious companies here use PATENTS to prevent competitors from eating their lunch. Patents need to be done away with to allow free competition, don&#x27;t believe the propaganda about patents helping creators

Really good post! I also found this quote which distilled their position in the 404media coverage of the situation.&gt; “What I can say for sure is that TicketMaster and AXS have had every opportunity to support scam-free third party ticket resale and delivery platforms if they wished: By documenting their ticket QR code cryptography, and by exposing apps and APIs which would allow verification and rotation of ticket secrets,” Conduition told me in an email. “But they intentionally choose not to do so, and then they act all surprised-pikachu when 3rd party resale scams proliferate. They&#x27;re opting to play legal whack-a-mole with scammers instead of fixing the problem directly with better technology, because they make more money as a resale monopoly than as an open and secure ecosystem.”from <a href="https:&#x2F;&#x2F;www.404media.co&#x2F;scalpers-are-working-with-hackers-to-liberate-non-transferable-tickets-from-ticketmasters-ecosystem&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.404media.co&#x2F;scalpers-are-working-with-hackers-to...</a>

Another case of abusing ToTK, an excellent technology that promised convenience, security, and offline access. Similarly, Duo builds their stuff off ToTK and then fending off (or makes it very, very hard) you from using a third-party ToTK authenticator with their sites.
This company just jettisons the fine promise of available offline that was made by ToTK.

They mentioned avoiding google wallet, so we can assume android, and that apple wallet wasn&#x27;t considered for not being an option for them.

So items inside google&#x2F;apple wallet don&#x27;t need to be &#x27;static&#x27;?

I just added a ticket to my Google Wallet for a concert last night and it was very similar to the Ticketmaster&#x2F;LiveNation app. The PDF417 barcode changed and had an animation around it. My guess is that it is the same or very similar on Apple devices.

Just recently dealt with this for a big Ticketmaster event. The Apple ID has to match the email address on the Ticketmaster account, or the ticket will show as Void in the Apple Wallet.But it does solve the offline issue that the blog author was experiencing.

Yes, it is available offline if you “Add to Apple Wallet”.The ticket in Apple Wallet is still revocable if you transfer the ticket to someone else using Ticketmaster’s website, probably through an update that Ticketmaster pushes to the wallet [1].[1]: <a href="https:&#x2F;&#x2F;developer.apple.com&#x2F;library&#x2F;archive&#x2F;documentation&#x2F;UserExperience&#x2F;Conceptual&#x2F;PassKit_PG&#x2F;Updating.html" rel="nofollow">https:&#x2F;&#x2F;developer.apple.com&#x2F;library&#x2F;archive&#x2F;documentation&#x2F;Us...</a>

The barcode in apple wallet also auto-updates.

How about the “Add to Apple Wallet” option? He did not talk about that at all, but AFAIK the ticket would be fully available offline and not in Ticketmaster app, no? It’s actually an elegant solution IMHO.

Yes, these systems are getting more popular recently, I believe they are typically being run by large ticket broker platforms.I don&#x27;t know about the specific site you mentioned, however the large broker platform Automatiq runs a number of domains like this, where they effectively proxy the original ticket token, recreate it with TOTP just as in this article, and display it to any user who has the right link in a similar format to how TM displays it. They advertise this service as &quot;Transferless Delivery&quot; to their ticket reseller customers. The main Automatiq one is called &quot;secure.tickets&quot;.It reduces work for sellers, because they never even have to transfer the tickets out of their Ticketmaster account anymore. Of course, it&#x27;s horrible for buyers because they have no idea whether the random website link they were sent is actually going to serve them a barcode corresponding to a real ticket or not, or whether the site will be up, and they have no rights to the ticket as far as the primary ticket issuer (TM) is concerned, buyers don&#x27;t even know the name on their own tickets.Seatgeek and StubHub seem to be aware of these systems because of how closely they work with ticket brokers, and just coach customers to accept them if they are from any of the domains known to them. See <a href="https:&#x2F;&#x2F;support.seatgeek.com&#x2F;hc&#x2F;en-us&#x2F;articles&#x2F;20740307164435-Wallet-ticket-transfers-FAQ" rel="nofollow">https:&#x2F;&#x2F;support.seatgeek.com&#x2F;hc&#x2F;en-us&#x2F;articles&#x2F;2074030716443...</a> the Automatiq site is called out specifically on that page.

I recently purchased tickets via SeatGeek and was provided a link to one of these barcodes, which accepted as a querystring parameter an access token that seemingly had a long expiration attached to it. It was hosted on “downloadmytickets.com”, which doesn’t look legitimate and caused me to do this same type of analysis to see how it all worked. Whether or not this was a way to bypass the “security” to enable sale via third parties, or just a very untrustworthy-looking official domain, I don’t know. But in the end it worked fine at the venue. Definitely more stress involved than I would have liked though.

I have to presume that the driving impetus of all of this is that they&#x27;re trying to avoid the actual requirement of checking the ID. Like, they want to improve the flow of traffic through admissions.But I mean, obviously, any kind of system like this strikes me as the same sort of thing as DRM. That you can somehow protect the message from the person you&#x27;re sharing the message to. How can you avoid reselling if you don&#x27;t verify the original purchaser? It just seemes ridiculous on its face.

Yeah I agree, they are not incentivized to fix scaling&#x2F;bots because they get a fee every time a ticket is sold. It is in their best interest for the ticket to be sold as many times as possible.

Yup.I have to believe the reason the likes of ticket master isn&#x27;t fixing this is because they are selling&#x2F;auctioning&#x2F;reserving some percentage of tickets to scalpers or &quot;3rd party sellers&quot;.Requiring ID is such an obvious solution that I have to believe these convoluted approaches are only there so the secondary market can exist and so ticket master can wash their hands when prices get out of control on that market.

Or just scan your face with the new Digital ID rolling out. It&#x27;s actually quite nice.

I flew about 3 days ago and they only asked for my minor children’s boarding passes.

Hell, you just scan your ID at TSA nowadays.  They don&#x27;t need your ticket.

Even allowing that but requiring your valid ID must be taken into the venue by yourself (or by your friends eg if you get sick and can&#x27;t go) would be a big improvement, meaning ticket scalps would have to actually go or have someone on their team go along with every ticket they resell.

Airlines are preventing a secondary market. Unfavorable for your use case, but also prevents scalping airline tickets (while allowing airlines to attempt to maximize revenue). There are always tradeoffs and compromise.To hack around this, I&#x27;ve used Southwest Airlines; I can buy tickets for folks and if they can&#x27;t travel, we cancel the ticket(s) and keep the travel funds banked for another time. I hope this is potentially helpful information.<a href="https:&#x2F;&#x2F;simpleflying.com&#x2F;why-airlines-dont-allow-name-changes&#x2F;" rel="nofollow">https:&#x2F;&#x2F;simpleflying.com&#x2F;why-airlines-dont-allow-name-change...</a>

But also, the hell with this. I&#x27;m still sour enough about the TSA without the concept of, &quot;I&#x27;ll buy tickets for me and three of my friends then see who wants to go,&quot; becoming impossible or gated by ticket transfer fees.

Would be awesome if it were true for airplane tickets

One ID for the entire order would be fine. You can buy 4 tickets, and go into the concert with your 3 friends. It often works this way even with no ID involved, I buy two tickets, add them both to my wallet, scan them both when my GF and I go to the show.You COULD still scalp tickets if the person who bought them from you is going to walk in with you. But the scalper would have to eat the cost of one ticket to do it, and it&#x27;s probably onerous enough to severly reduce the impact of scalping.

People often buy tickets without knowing exactly which of their friends are going to attend with them. This is not true of airplane tickets.

&gt; Which is going to be a problem if tickets need to be transferred in contexts where users don&#x27;t have internet access (but they do have local connectivity between devices) or in contexts where the venue doesn&#x27;t have internet access.You know as well as I do that TicketMaster won&#x27;t allow any of that, because it means they miss out on selling another ticket.

That requires a single source of truth for which names go with which tickets. Which is going to be a problem if tickets need to be transferred in contexts where users don&#x27;t have internet access (but they do have local connectivity between devices) or in contexts where the venue doesn&#x27;t have internet access. Or in cases where the single source of truth might be vulnerable to attack or doesn&#x27;t have the resources to handle the load at certain times.I don&#x27;t have the solution explicitly, but it seems like it ought to be possible to do this such that PII need not be collected. Tickets could be cryptographic proofs that a chain of custody exists and meets certain criteria. The proofs could be constructed at transfer time and verified at admission, no servers in the loop anywhere. Yeah, we&#x27;ll come up against the CAP theorem eventually, but we might find that the imposed constraints are workable.

&gt; Flying requires an ID. Attending a concert should not.Why though? Not disagreeing per say because I&#x27;d have thought so too, but upon reflection...I assume the main reason airlines require an ID is safety and security. We maintain a denied parties list and use identity verification to make it as difficult as possible to fly a plane into a crowded venue. Border control is another issue, but there&#x27;s plenty of intra-country or intra-state flights where this isn&#x27;t an issue.Ticketmaster sells unverified access to crowded venues.

that&#x27;s really just an opinion. and I&#x27;d argue that if people really care about a fair and sustainable concert going, given how ridiculous the live event situation is, you&#x27;d support pretty common and standard requirements like ID to be shown. as others said: ID is already required to validate age in many events&#x2F;venues

How are you getting into shows without presenting ID for age? Every (well, every legal...) venue I&#x27;ve been to in NYC cards to see if you are 21.

Depends a lot on the country you live in. In most European countries &quot;carrying an ID&quot; is legally required if the police stops you anyway (they do need a reason to see it though), so &quot;show an ID at the entrance&quot; is no big deal.It&#x27;s to my understanding mainly the US where ID requirements are often side eyed because many people don&#x27;t have them and there&#x27;s no national standard (and due to a variety of political reasons there probably won&#x27;t ever be any.)

Flying requires an ID. Attending a concert should not. Any solution that is solved by &quot;simple, just require an ID&quot; is not a solution.

Today&#x27;s digital entry experience is far from frictionless. Might as well add a scan of the PDF417 barcode on the back of the latest state ID cards.I just went to a MLB game yesterday, and the digital process was:<pre><code> - Open ticket app
 - scan ticket 1
 - scan ticket 2
</code></pre>
I imagine this could have been:<pre><code> - Open ticket app
 - scan PDF417
 - scan ticket 1
 - scan ticket 2</code></pre>

I keep reading about this argument but Olympics and World Cup matches are arguably as large events (if not larger) and they place name on ticket and check ID at entrance.people complain at ticketmaster yet seem to bend over backwards to justify the state of affairs

The issue is most likely about throughput.  You want to let fans enter the venue as quick as possible.  Most venues have lots of gates, but still the latency at each gate has to be a handful of seconds per ticket.  Having to validate both ticket and ID would easily double or triple that time.

I’d rather not solve it than let the state have more information about my transactions

Because this, and more very strange rules it is very hard for ticketing systems to get into the Italian market. 
Some examples:- not allowed to change to time or name of the event after the 1st ticket is sold- only allowed section names in halls from a know list- free tickets on events... can only do this under strange conditions- smart card application, for encryption, must run on a physical server in Italy. You should not be able to log into the ticketing box office if that smart card application is not running.

Italy solved this. Five years ago, a new law enforced ID-checking when you enter any big events (like concerts with an audience larger than 5000 people).Tickets have your name on it, and you can only change the name or resell them through the official seller (so, third party resellers are out of the game). Also, every reselling transaction is registered and can be inspected by the Italian Rightsholder Agency (SIAE).

How often has this been a problem though? How about not keeping your boarding pass, or ticket, or credit card for that matter, visible for the world? Just put it in your wallet, I don&#x27;t know.This is security FUD. Stop solving problems that do not exist to the point where it makes the news when they do happen, once a century.This DRM scheme concretely creates millions of small annoyances to millions of people and wasting our time as a society.

This improves the security over airline tickets.There was a recent story of someone taking pictures of other people&#x27;s boarding passes, and using that to board the plane.With this ticketmaster scheme, unless the person has access to the secret keys, the pass would only be valid for a few seconds, likely defeating this attack against boarding passes.<a href="https:&#x2F;&#x2F;www.nbcdfw.com&#x2F;news&#x2F;local&#x2F;texas-news&#x2F;texas-man-boards-delta-flight-using-a-photo-of-a-girls-boarding-pass&#x2F;3494722&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.nbcdfw.com&#x2F;news&#x2F;local&#x2F;texas-news&#x2F;texas-man-board...</a>

Airlines are starting to use rotating barcodes as well. Heck some are even switching to purely facial recognition.

Exactly. The privacy characteristics of government ID cards are worse than any other solution. When sharing such an ID, a person is providing several global, stable identifiers (e.g. ID number, full legal name). For adtech and data brokers, this is the ultimate fingerprint for tracking and matching.In a perfect world, the digitization of these IDs would come with modern digital privacy and security. Scanning your ID number would only provide a recipient-specific ID that couldn&#x27;t be matched with other vendors. Age eligibility and driver&#x27;s licensing status would be presented as separate signed attestations that share no other data.We aren&#x27;t even heading in that direction yet.

I’m not sure that would fly in Europe. And I personally don’t want to hand over my id to use a ticket

...yet you have a phone (for the moving barcode and whatnot) which is heavier and bulkier than a card?

I wouldn’t bring my ID to a concert. I don’t have my wallet with me and even if I would they wouldn’t like me to have a backpack. I‘m coming as light and minimal as possible and also would hate to lose my ID jumping around at a concert.

Some venues do this already and the scalpers buy an additional ticket to burn on themselves so they can get their customer in the gate. It just goes into the cost of doing business. I agree this is probably one of the best ways to stop scalpers but it&#x27;s not foolproof.

how is this not the same as 8 people trying to find airline tickets for everyone? you can buy tickets for different passengers. some airlines&#x2F;travel agencies even allow for name change for a fee.

This is trivial and solutions exist in the wild already. If you buy tix for the Paris Olympics, you can transfer them to your friends or you can assign their names to the tickets directly.The interesting mechanism there is that you can buy a lot of seats at once, but you don’t get to choose where they are exactly, only the section. So in every case you’re going to have people buying big lots of tickets and distributing them to friends and family after the fact.

No, it&#x27;s not. At my work here we&#x27;ll all go online to try and get tickets to a big gig. One of us might get in, so that person will get ~8 tickets or whatever the maximum is. And then we split them between us, transfering over cash etc. If we have a few left over we&#x27;ll sell them to friends for the ticket value.But none of us have any intention of lining up with the others to get in. We want to go with our partners, our own friends etc.I want Bob, Terry or Bazzy to by able to buy tickets for me (or me for Bob, Terry or Bazza) but I do not want to have to meet up with Bob, Terry and Bazza and stand in line with them all to get in.So yea, it&#x27;s not trivial. I wish it was, I farkin&#x27; hate scalpers.

Where has rules prohibiting it?  Maybe will move. :D

Yeah, except NO.A lot of people think live event ticketing is the same problem as airplane tickets, but they really aren&#x27;t. As an example, there are rules about requiring identification for commercial flight. There are rules against requiring identification for live events.

+1 to this. also doesn&#x27;t Olympics and World Cup class events also face similar issue as concerts, and they allow for fair&#x27;ish purchase and resale by private people, but only through their platform?

If the government needs people to have IDs, then maybe the government should provide those IDs for free...

I’ve heard the argument that forcing people to have an ID is anti folks with disabilities and anti-poor since it requires someone to go to an issuing agency to obtain and pay for one, which could be putting someone out who has a mobility disability or doesn’t have a lot of money.I’m not making the argument but it’s an argument I’ve heard.

I was recently at a Festival that requires ticket + ID (<a href="https:&#x2F;&#x2F;www.resurrectionfest.es" rel="nofollow">https:&#x2F;&#x2F;www.resurrectionfest.es</a>). The key to success was to put a little more personal at the gates, maybe 15 people instead of 10. But it is also true that we have the ID document issued in our early teens it not before. Each ticket verification takes 3 more seconds extra to verify the ID matches, no big deal.Said festival does their own ticket re-sale to avoid scalping but mainly to avoid shady sites that are known to allow the selling of counterfeits. You can only cede your ticket, not sell it. It is not perfect (e.g. if you don&#x27;t find a buyer for the same price, you can&#x27;t sell it at a lost to recoup some money. You get your ticket back) but at least is not as bad as the one from Ticketmaster.

I agree, mostly.  What do you do for people without an ID (and without a parent)?  Think of the number of people at a Taylor Swift concert who are under 18 -- a lot.  Also, checking the name between ticket and ID will slow down entrance by 2-5 times, I guess.

This has its own problems.
It makes it difficult to swap tickets.A music festival I went to recently charged 30 euro to change the name on a ticket.

This is a horrible horrible idea.It&#x27;d then be impossible to buy a few tickets to an event with the intention of finding people to come after the fact.

A lot of concert goers are under 18 and dint have valid state id.

This sort of ticketing thing is a trivially solvable problem. It is solved at every airport in the entire world millions of times per day. You provide the name of each concertgoer when you buy a ticket, and they show up with their ticket and ID. You often need to show your ID at these kinds of venues to prove you&#x27;re old enough to drink beer anyway.

actually, aged ticketmaster accounts are worth something! people will buy them for a few dozen dollars, as they get priority in ticket queues.

Based on the highly questionable PS&#x2F;Xbox accounts sold on eBay, I think that&#x27;s just what scalpers could do as part of their everyday job.

Setting up separate accounts for every ticket purchase seems like a LOT of overhead (especially scalpers buying many tickets at once and piecemealing them out), and is easy to defeat, e.g. require out of band auth via the phone number associated with the account before logging in for the first time on a new device.

Well you can transfer the ticket to someone else for free anyway, so not really an issue.Or you can transfer it to another name and print it out - just the name on Ticketmaster&#x27;s system has to match some ID you have in the print scenario.

Isn&#x27;t this vulnerable to ticket &#x27;selling&#x27; by simply sharing the username and password of the ticketmaster account?it&#x27;s not like a ticketmaster account is &#x27;worth&#x27; anything, so the seller can simply set up a new one for their next purchase.

You&#x27;re trying to get quantitative about a qualitative problem.

It&#x27;s like porn. You know it when you see it and also there&#x27;s quite a lot of it.

It&#x27;s not hard if you remove the self delusion. Removing the self delusion is maybe tricky for the individual, but it&#x27;s easy for people around the individual to see. Societal tools like shame are generally used to encourage people in the right direction, but we don&#x27;t do a great job of this in America, because money tends to override everything else and I don&#x27;t think we have good structures around expressing non-monetary values like honor.Especially on the west coast, we&#x27;re so passive in our shaming of people that it probably doesn&#x27;t translate to action. There are people who work at Evil companies like Facebook, etc, who are otherwise nice, but I find myself not including them or turned off to them as friends because this sort of contradiction is hard to square in my brain. Of course I wouldn&#x27;t communicate to this, being a passive PNW raised wimp, and it&#x27;s not even super explicit in my mind, it&#x27;s really more of a bad vibe than anything else. I imagine over time if enough people act like I do, it doesn&#x27;t actually translate to different decisions from the individual in question, but instead translates to them waking up one day feeling distant and unfulfilled, which is probably the worst of all outcomes. They still work for Bad Company, but are also sad about it, and there&#x27;s a general sense of malaise pervading life that&#x27;s hard to pinpoint.*Obviously this all ignores the people who don&#x27;t have a choice of employment. But here I&#x27;m generally referring to software people who have high pay and career mobility. Things get murkier when the conversation is opened up to people who are just trying to survive.

If you&#x27;re asking the above question, it means you already think the company is bad according to your own morals.

As one grows older, they may find that not everything in reality can be quantified or put into words.And trying to objectify value judgements is another whole area of contention that inevitably leads to itself.

&gt; Now all that remains is a good, measurable definition of what a bad company is.Lets re-invent religion.

I&#x27;m glad we cleared that up. Now all that remains is a good, measurable definition of what a bad company is.

&gt; Asking if a person or a company is good or bad isn&#x27;t a question that can ever have a well-defined answer: the answers we give are rounded according to our own values.Counterexample:Was Hitler bad?

It doesn&#x27;t need a well defined evaluation scheme. You&#x27;re the one asking the question, you can provide your own scheme, and come up with your own answer. Whether you&#x27;re honest with yourself in this process is up to you.It&#x27;s still useful to point out that IF you think your company is bad THEN you should do something about that. It establishes that &quot;I was just following orders that I know are wrong&quot; isn&#x27;t a valid excuse (e.g. like if you end up in court for something you did on the job).

&gt; the answers we give are rounded according to our own valuesI agree with this entirely.And rounding does not change the answer in most situations.Something that isn&#x27;t well-defined can still be mostly-defined.I have no idea what the point of that strawman is in your last paragraph. It doesn&#x27;t make sense with or without rounding. Maybe if you round every single value to infinity, but that&#x27;s not what &quot;rounding&quot; normally means...

And pretty much every company is bad. But this is a wrong answer because the question is actually nonsense.The answer to &quot;What happens when you move faster than light&quot; is not &quot;nothing&quot;, it is undefined because the question is invalid. Asking if a person or a company is good or bad isn&#x27;t a question that can ever have a well-defined answer: the answers we give are rounded according to our own values. To get more specific, not all of us have a huge amount of choice in who we work for.If apenwarr believes I want to be a good person they should hire me at Tailscale. What&#x27;s that, they won&#x27;t? They don&#x27;t have openings, or I&#x27;m not qualified? I guess they&#x27;re the bad person because now I have to work for a bad company or lose my income. And if I lose my income, my co-habitants lose their housing, and my donations to good causes dry up. Do I just not do enough good for apenwarr? They must be a paragon of virtue. Surely they don&#x27;t eat meat, or even associate with meat-eaters. Surely they don&#x27;t fly in airplanes.

I think we should make an exception for saboteurs.

Does this extend to where you live and pay taxes?

All company&#x27;s are &quot;bad&quot; in some way... does that mean all employees are bad?&gt; No.

With regards to the end of the article.&gt; Can I work for a bad company and still be a good person?&gt; No.<a href="https:&#x2F;&#x2F;apenwarr.ca&#x2F;log&#x2F;20201121" rel="nofollow">https:&#x2F;&#x2F;apenwarr.ca&#x2F;log&#x2F;20201121</a>

That&#x27;s because there isn&#x27;t a difference between a &quot;legit purchaser&quot; and a scalper except their intentions, which you can&#x27;t get from amy kind of barcode.

&gt; The &quot;true solution&quot; is to sell tickets at their actual market priceThat is *a* solution but it isn&#x27;t *the* solution. The fact that many smart people are not choosing that solution is an indicator that there are some factors to the problem that you aren&#x27;t considering.

IOW the true solution to scamming is to raise prices so high that only the extremely wealthy can afford them, regardless of how accessible the actual concert&#x2F;act&#x2F;group&#x2F;promoter wants the show to be.The &quot;real&quot; solution here would be for Ticketmaster (or whoever) to actually make a ticket non-transferrable somehow, and then allow for tickets to be transferred directly through the original website for at most the original ticket price, and refund me the money.For example, if I have a $200 ticket and I can&#x27;t make it and want to sell it, I can post up a link to the original ticket seller&#x27;s website (in this case Ticketmaster) where someone else can go buy it, and, if they do, I get a refund of the amount they paid. I can say how much I&#x27;m willing to accept (full price, $150, whatever) and someone can go buy &quot;my&quot; ticket, potentially at a loss if I&#x27;m willing to accept it. Ticketmaster can make money on these tickets by charging a non-refundable processing fee or whatever to everyone (the original buyer and any subsequent re-buyers). They make a tidy profit, everyone gets what they want.The only complications are1. making the tickets non-transferrable but also work offline is a difficult technology problem
2. Ticketmaster is an unregulated monopoly and thus has no incentive to behave in the best interests of the market or its customers when they could rake in millions more by screwing everyone except the scalpers

&gt; Buying something at a low price and selling it at a high price is arbitrage 101 and is free money.A bit of a nit pick, but this isn&#x27;t &quot;free money&quot; unless you have a guarantee that someone will actually buy at the higher price. You could buy low, be unable to sell, and end up eating the &quot;buy low&quot; cost.&gt; sell tickets at their actual market priceHow do you know what their actual market price is? You have to open it up to a market, where supply&#x2F;demand get to play out.IIRC some ticketing company tried doing something to this effect by scaling prices in realtime based on how many people were also trying to buy. I believe it was widely criticized as unfair&#x2F;exploitive.So you&#x27;re back to square one then, where you have to set some price.

It&#x27;s only free money if there&#x27;s no risk, and if there&#x27;s no transaction cost to acquiring at the lower price. If there&#x27;s no risk in buying something low and attempting to sell it high, then that thing is mispriced.

People will scream (including in this thread) that it’s “unfair” that ‘only the wealthy can afford them then’ but their beef is with scarcity and thus with reality. It’s always “unfair” to the 10,001st person who wants to attend the concert with 10,000 capacity. Today it’s a weird lottery with 6 different fan and credit-cardmember presales, which each sell out immediately, and the “backstop” at the end which is the ability to buy expensive scalped tickets.There are finite tickets but unbounded demand. A lottery means you can slightly adjust the distribution of poor vs rich, but in practice today it still advantages those comfortable enough to sit around refreshing their computers at the right moment, instead of working. And lots of opportunists will snap up those tickets you are hoping poor people will get, to sell them to the wealthy.In my opinion for in-demand shows it should just be a Dutch auction (all of the highest 10,000 bids win, awarded at some fixed cutoff date before the event). If not enough bids are received, the concert isn’t sold out, so then the rest go on sale for the lowest bid.

The reason they don&#x27;t do that is to have an organic fan base of poor people who drive up the prices for the rich people. If you eliminate the poor people, the rich people aren&#x27;t going to take the band forward. They&#x27;ll move on to whatever the next shiny thing is. You need a hardcore fan base of poor people to support and grow your valuation.

Buying a single-use item at any price and then selling it on at any price to multiple people is fraud.Fiddling with the prices does absolutely nothing to fix that problem, because it isn’t a problem with price, but a problem with developing an unduplicatable token.Ticketmaster is evil, and most resellers are fine, but some are evil and that’s a problem this at least attempts to solve.

The market sets a clearing price for the ticket as commodity (i.e. for a single event). However, the iterated game that is the spectator-performer relationship, the seller may _strongly_ prefer yielding some of their benefit to the buyer in exchange for long term EV, positive PR, or just plain old goodwill.The problem is maintaining a mutually-beneficial but economically suboptimal equilibria.

As far as I understand, this can&#x27;t be done due to PR.&quot;evil scalpers are exploiting this poor artist by charging outrageous prices and preventing many fans from going&quot; is a far better look than &quot;evil artist is exploiting their poor fans by charging outrageous prices and preventing many fans from going.&quot;To prevent scalping, you&#x27;d need a massive price increase, and very few artists are willing to be the first to do this.

It&#x27;s interesting how the real problem here is that our economic system has no way to sell a product at what the seller will bear, only what the buyer will bear.I think this is a fascinating feature, a lot of artists would be more than happy to make $X for a show so that their fans can come see them. The problem ends up that a free market has no mechanism for that, the artist can sell the tickets such that they end up with $X but then you get things like scalpers who don&#x27;t want to see the show but do want money and act like artificial demand. They know that regardless of what the seller wants there are buyers that will pay $X+N and want to capture that $N.The scalper provides no value to the market, but they get $N, which seems like a market failure to me. The fans lose $N, the artist still only gets $X and they also get reputation damage because fans are upset that things cost $X+N.And that&#x27;s just the end of it. The artist literally can not perform for their fans at a venue for $X even if that&#x27;s what they want, there&#x27;s just no mechanism in the free market to make that function correctly. I find market failures like this fascinating because it really shows the limits of how &quot;free&quot; markets operate. The only person that isn&#x27;t free to do what they&#x27;d like is the producer of the good being sold, they literally can&#x27;t sell it for less than the market will bear.And I suppose this plays out for every part of the market, if I can produce apples and make a profit for $1 a bushel and that&#x27;s plenty of money for me, I don&#x27;t want any more, tough shit. Arbitrage will make sure that people pay more for those apples. If people are willing to pay $5 a bushel then someone will snap up my cheap apples, mark them up and make a bunch of money for doing nothing. Even if I were willing to do all the distribution myself, if the person conducting arbitrage adds no value to the system (the common argument being that they deserve the money for finding cheap apples and connecting people that demand apples with a supply of apples), it just can&#x27;t happen. The incentive to make that free money means everyone loses, I don&#x27;t get to give people cheap apples, people don&#x27;t get to enjoy cheap apples, everyone is worse off except for the person doing arbitrage.

Buying something at a low price and selling it at a high price is arbitrage 101 and is free money.The &quot;true solution&quot; is to sell tickets at their actual market price instead of pretending that the face value of concert tickets isn&#x27;t increasing due to a larger population and greater demand.

&gt; Scalpers are the problem that you have to accept.Several European countries ban reselling tickets for more than the original cost.

I agree with the bad implement but the opening complaining that &quot;old way of printable tickets was great why change it&quot; have so many problems.Scalpers are the problem that you have to accept. At the time of purchase, there&#x27;s no way to tell the difference between a legit purchaser and a scalper or even someone who bought it and simply can&#x27;t go and needs to resell.IDs, ticket limiters, CCs, etc, etc. All methods can be circumvented by someone dedicated enough. You can only make it &quot;not scalable&quot; but the tickets still need to be transferable, securely.Unless we&#x27;re willing to go ID checking at the gate, there&#x27;s not going to be a true solution.

You can find a bar with a band playing. I suggest Kingston Mines if you&#x27;re in the Chicago area.Ticketmaster doesn&#x27;t own have a monopoly on music. You can vote with your wallet.

I agree that experiencing music is a fundamental part of human life, but experiencing specific musicians at specific venues is not. It is very easy to find free live music without Ticketmaster or online portals.

&gt; Ticketmaster ultimately provides a luxury. You don&#x27;t need to see a concertI don&#x27;t agree. Entertainment&#x2F;recreation is a need. Music is an important part of the human experience, and seeing it live, with other fans, is really valuable to some people. And the fact is, the value a person places on the experience is totally orthogonal to their ability to use&#x2F;afford Ticketmaster. And it&#x27;s not just about Taylor Swift - even local shows can be difficult to access without quarrelsome online portals. (But also, someone being obsessed with Taylor Swift isn&#x27;t a personality flaw.)

You’re not considering the stagehands and artists who have to live under Live Nation’s vertical monopoly. I was chatting with a former tour guy the other day, someone who’s been a tech for major touring bands since the ‘80s, and he mentioned that he had to quit the business because Live Nation had driven wages down below poverty level while bringing in random unskilled labor to do highly-technical stage setups. (He quit after almost losing a hand to a large piece of unsecured stage equipment.) The enshittification of modern life is an inconvenience to most of us, but life and livelihood to many others.

&gt;Software developers are the wizards and shamans of the modern age. We ought to use our powers with the austerity and integrity such power implies. You’re using them to exclude people from entertainment events.I can definitely think of worse things programmers are doing aside from making it mildly difficult to see Taylor Swift .I have personal qualms with working in certain industries because of this, but Ticketmaster ultimately provides a luxury. You don&#x27;t need to see a concert, and if you have such an issue with their business practices you can do something else with your Friday night .I&#x27;ve actually never had an issue with Ticketmaster. At a point a certain other ticket provider just blocked me without any explanation, and I had to go down to the box office to buy tickets. That sucked, but compare to airlines who do weird things like print off tickets without the actual seat number, Ticketmaster doesn&#x27;t bother me too much.

It was not true of this world 150 years ago that any person with sufficient learning could tap buttons to create an experience to be found in the hand of the majority of living humans.I agree power and greed go hand in hand - absolute power corrupts, absolutely - but this bit? This is new.

This is not only a truth of the world we currently inhabit, it has always been a truth, of all the worlds we have inhabited. Power and greed go hand in hand for a reason and the struggle to find the balance is, and will always be present.

<a href="https:&#x2F;&#x2F;www.amazon.com&#x2F;New-Kingmakers-Developers-Conquered-World-ebook&#x2F;dp&#x2F;B0097E4MEU" rel="nofollow">https:&#x2F;&#x2F;www.amazon.com&#x2F;New-Kingmakers-Developers-Conquered-W...</a> (&quot;The New Kingmakers: How Developers Conquered the World&quot;)<a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20200915000000*&#x2F;https:&#x2F;&#x2F;try.newrelic.com&#x2F;rs&#x2F;newrelic&#x2F;images&#x2F;The_New_Kingmakers.pdf" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20200915000000*&#x2F;https:&#x2F;&#x2F;try.newr...</a> [pdf]

It&#x27;s okay to shame bad actors.In fact, society would likely be better off if e brought back more public shaming

We wouldn&#x27;t. You might expect that on an indivudual level. But at a society level, I would expect any company that&#x27;s doing things that are specifically allowed by our goverment (who did approve the Ticketmaster Live Nation Merger) to get their jobs filled just like any other. I think Ticketmaster is evil, another developer might not. That&#x27;s fine, they&#x27;re not killing people or dumping toxic chemicals into reservoirs, we can agree to disagree.My outrage is directed entirely at the government agencies whose job it was to stop this, not the developers making a ticketing app.

The fact we have had less than benevolent wizards and shamans, why would we expect to have modern day equivalent of only benevolent coders? It&#x27;s such a fairy tale level of expectation that it seems childish. Spending any energy in trying to make real world a fairy tale is just wasted.

I mean would you say that developers who work for Facebook have crossed that line?

&gt; I still don&#x27;t blame the developers, I blame government.Yes, but I think they still have some responsibility, even if they say &quot;I was just following orders!&quot; [1][1] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Superior_orders" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Superior_orders</a>

Even government software has issues (Vienna). I paid a €100+ fine for not having a ticket, even though I spent time going through the purchase flow. I have 100s of tickets purchased. Live agent and support agent just shrugged and told me I don&#x27;t know how to use the app, washed their hands of any responsibility or need for understanding.It&#x27;s like there&#x27;s no way to make the software human and humans in the loop have a crutch to lean on to not behave as a human. When I contacted the dev team directly, they shrugged too. No refund.To me it feels like software is the place where society can just exercise its cruelty and indifference, or maybe it is a reflection of society, it&#x27;s probably just like humans are. What we think software should behave like is not human.I had more pleasant experiences with London&#x2F;UK train ticket edge cases and felt like the system is built to deal with user&#x2F;server errors.

&quot;Developers are blameless&quot; is a uniquely HN take, for obvious site demographic reasons.I see a worthwhile product as a stool with at least three legs: Technical feasibility, business viability, and ethical acceptability. Take one leg away and the stool should fail. Yet, HN commenters endlessly discuss&#x2F;debate the first two and largely ignore the third. I think we all have a duty to work on projects that are ethically sound (defining that is a whole other discussion). There are plenty of companies out there and plenty of products to work on--it&#x27;s not like we have to pick an evil one in order to survive and &quot;feed our families.&quot;

I still don&#x27;t blame the developers, I blame government. It&#x27;s not the job of rank and file workers to police companies. I wouldn&#x27;t work for LN, but I&#x27;m not going to blame someone else for doing so. We&#x27;ve all gotta feed our families. (I realize there&#x27;s a line somewhere, you wouldn&#x27;t excuse a prison guard at Auschwitz the same way, but I can&#x27;t get too worked up about a developer making a ticketing app even if I hate the ticketing company.)Developed countries long ago came to the conclusion that companies should not be allowed to have monopolies because it is bad for society as a whole, and it&#x27;s hard to think of a current monopoly as egregious as this one. There is absolutely no reason one company should have exclusive rights to 85% of large venues, also be an evebt promoter, and also be the ticket seller.Anything their developers do is not the real issue, a society that allows this to happen in the first place is.

It’s interesting, the more we agree and hold strong, the higher the demand grows for engineers who would help some companies create their hellscape. The incentive will grow higher and higher until people break rank. And you start over.

Are there any documented examples of societies where &quot;magics&quot;, &quot;shamans&quot; or &quot;wizards&quot; were at the top of the hierarchy? I gotta say, I&#x27;m an avid reader of Ancient History and Anthropology and the closest I can think of is the Priest-Kings of Sumeria and your garden variety theocracy and the latter is much more of a priestly bureeacracy than anything else...

Yeah, we are more like masons. We have useful skills that enable building impressive things, but at the end of the day we are building someone else&#x27;s cathedral.

I think you don&#x27;t know what you think you know. My mom is a shaman type. These types often live at the outskirts of society where no well-to-do person would like to be seen. Zero political power but enough utility to keep at an arm&#x27;s distance -- further if possible while not needed.

&gt; Shamans and wizards (never heard this used to describe anyone in history but let’s assume it’s just any kind of supposed magic user) were people at the top tier of their societies in terms of political power. Not kings or chieftains, but above everyone else.I don&#x27;t know where you came by such a notion; Shamans, &quot;Wizards&quot;, witches, &quot;wise women&#x2F;men&quot;, are usually shunned from society such that they tend to live near the outskirts of towns or cities, nobody really wants to live close to them; and when &quot;bad things happen&quot; tend to be the first ones to get blamed for it; then they also are commonly used as scapegoats for whatever political, economic or religious effort some corrupt officials try to push.That doesn&#x27;t sound very societal top-tier to me.We&#x27;re definitely not witches or wizards, at most we are scholars or [specialized] craftsmen. &quot;Knowledge workers&quot; if you will. Not as unlikable as the wise folk that live towards the edge of town, and not as at risk of getting tied to a post and lit on fire because the bishop believes we commune with unclean spirits.

Agreed. We&#x27;re the blacksmiths making armor and swords and horseshoes.

I dont think it’s a truth.Shamans and wizards (never heard this used to describe anyone in history but let’s assume it’s just any kind of supposed magic user) were people at the top tier of their societies in terms of political power. Not kings or chieftains, but above everyone else.Programmers are just making a living selling their labor power like every other office drone in the world. We’re one of the most common lines of work out there.If you want the mysticism angle, we are like those kids they used to catch “witches”.

&quot;In effect, we conjure the spirits of the computer with our spells&quot;t. Introduction of SICP

architect+builder+plumber.The suits at TM couldn&#x27;t build the app+backend, even if they could hire someone to maintain and replace parts of it.

I personally think we are more like &quot;plumbers but with JSON&quot;. I have principles and apply them but I don&#x27;t expect the others to do that

Yes I think there is truth to this. Something I have seen lately with Rust for example, is because the language is harder to learn, the discourse, tutorials, libraries are all much higher quality.

&gt;Programmers being analogous to wizards or martial artists made more sense back when one used to need to train years or decades to become one.You can be a shitty wizard with only one year of training, same goes for programmers.

Programmers being analogous to wizards or martial artists made more sense back when one used to need to train years or decades to become one.With age comes wisdom.There has been a lot of good that came from making coding more accessible; I&#x27;m not trying to gatekeep. But I do think that this is one instance where the outcome is worse. The martial arts masters still unquestionably exist among us. It&#x27;s just that they&#x27;re now surrounded by younger, less-wise people with guns. Both types can fight an army, but only one has the wisdom to know when it&#x27;s better not to.

Congress is useless, along with the rest of the planetary corporate-fascist oligarch facsimiles of democracy.If software engineers united behind true ideals of freedom, we could automate the entire stack of &quot;leadership&quot; and raise the floor of society.Open source implementations of:Universal cryptographic identificationDecentralized voluntary anonymous voting, verifiable by every voterSovereign algorithmic monetary policyLiquid representationComplete digitization of all necessary information to audit any authorities, at any timeFull release of privacy for any &quot;public official&quot; -- service to society should be a burden, not a privilegeThis, and much, much more can ALL be done with software. An entirely new paradigm of society, with freedom unalienably encoded into the fabric of the social machine.Our rights digitized, our privacy, speech, and pursuit of happiness made into software.I would say software may have an impact, and the thinking of this impact extends far beyond the next quarter of profits. This mindset can extend into a multi-planetary society and beyond. A continuously evolving, open source mechanism of human governance.

&gt; The sooner we can agree to behave accordinglyPeople don&#x27;t code out of a sense of duty, they do so to earn money, so there is no mechanism to enforce &quot;behavior.&quot;&gt; our prospects for ripping the reigns of societyThere are too many industries that take the mantle of improving society on their back. This is a mistake. There is no natural representative mechanism that ensures your actions are aligned to required outcomes.This should probably be left to congress. If you&#x27;re concerned that they won&#x27;t do it then that should immediately suggest the appropriate course of action to you.&gt; of those whose only animating principles are avarice and exploitation.Short term thinking cannot lead to long term rewards without abject manipulation of the marketplace.

This is a wild take. Software developers do the dirty work. We&#x27;re one step below wall street.

Ah yes, The Roads Must Roll.It&#x27;s worth remembering that folks who can be bought, can be bought off and spend a lot of time enjoying their riches while true believers are somewhat more difficult to convince and don&#x27;t take any time off.That&#x27;s important because all of the big evils have been perpetrated by true believers in pursuit of their &quot;one true way.&quot; (Yes, some large evils have been perpetrated by folks chasing money. I&#x27;m talking about things like wholesale slaughter of as many people as they could lay their hands on.)

I cannot agree more. And this is exactly why the old Google motto of &quot;don&#x27;t be evil&quot; was so important. And the decline of Google is highly correlated with the removal of this motto from its culture.I sincerely hope all tech companies can take a page from old Google and truly instill an innate rejection of evil among all software engineers.

Except it&#x27;s not truth.You want truth?The Golden Rule: &quot;He who has the gold, makes the rules.&quot;Truth is that money is all that matters. Nothing else in the world of business matters not relationships, not customers, not Boards of Directors or CEOs. Money.Until a person realizes this, they will be forever caught in a cycle of thought that is not truth.&quot;Follow the money!&quot; is the best way to see how society works, and is why every government wants their hands in our money. Meaningful change in this world requires money. No amount of idealism or &#x27;using our powers&#x27; can change that.Do the wizards have &#x27;F-Off&#x27; money? No. Will they ever? No.

The worst are the programmers of the mobile games for kids.

&gt; Software developers are the wizards and shamans of the modern age. We ought to use our powers with the austerity and integrity such power implies.This is one of the most powerful truths underlying the world we currently inhabit. The sooner we can agree to behave accordingly, the better our prospects for ripping the reigns of society from the hands of those whose only animating principles are avarice and exploitation.

&gt; I now know everything I would need to duplicate TicketMaster’s barcodesUntil they change their encoding.Requiring the installation of a proprietary app to do anything should be forbidden.

I see what you mean. The barcode wouldn&#x27;t work offline.It seems like that didn&#x27;t matter at the venue though? The spotty internet connection not allowing the code to load was the first part of the article wasn&#x27;t it?

Except then I&#x27;d need to have a good data connection at the venue, and the odds of that are infinitesimally small.

Fantastic article. Really easy to understand.Side note: this is actually a great advertisement for server side rendering! If they didn&#x27;t do all this client side rendering, exposing data in JSON APIs, then I doubt this reverse engineering would have been possible.

Exactly all of this.I found the article really interesting from a tech perspective.And I have no love for TicketMaster, but the migration from paper&#x2F;PDF tickets to scannable changing QR codes is inevitable, precisely to combat scammers.TicketMaster does a lot of bad things, but this doesn&#x27;t seem to be one of them. And learning to download the digital tickets in advance -- either to the app or your Apple wallet -- is just a thing you learn to do, the same way you learn to download a bunch of podcasts before your airline flight that charges for (or doesn&#x27;t have) WiFi. (And if your ticket was a PDF, you&#x27;d similarly be stuck if you couldn&#x27;t get internet at the venue and hadn&#x27;t downloaded it in advance.)

Yes, &quot;phone&#x27;s wallet&quot; actually means Google Wallet or Apple Wallet.Stuff I add there works for me instantly every time, even with crowded venues and zero connectivity -- as long as I get it ready in advance.(Not that I am defending this. I&#x27;d rather carry a paper ticket, since paper is more durable and far less complex than a phone is.)

&gt;So do the digital barcodes if you add them to your phones wallet.??? Last I heard the adding the barcode to the phone&#x27;s wallet did not work, or at least not reliably. Some older folks I know struggled with it, and I specifically help setup the ticket master app and download the barcode. They mentioned that the app eventually logged them off when they got on site and had to struggle with poor wifi. Eventually got it to work but IIRC it took several minutes before they had a stable enough connection for it.Does it need an actually Google&#x2F;Apple wallet or something setup?

&gt; I remember a time when printable tickets were ubiquitous. One could print off tickets after buying them online or even (gasp) in-person, and bring these paper tickets to get entry into the event when you arriveI go to 1-2 concerts a month so I&#x27;m well aware of how scummy TM is, but the problem with PDF tickets is that people sell fakes or sell the same ticket multiple times. I know multiple people who&#x27;ve been scammed this way. I get not wanting to use your phone for everything, but the changing barcode isn&#x27;t just technology for the sake of technology, it&#x27;s actually there to solve a problem.&gt; PDF tickets work even if your phone loses internet connectionSo do the digital barcodes if you add them to your phones wallet.TM even sends you an email before every event that says:&gt;&gt; If you haven&#x27;t already, download the Ticketmaster app or sign into your Ticketmaster account via mobile web. From My Events, tap view then add tickets to your phone&#x27;s wallet for easy access at entry.TM&#x27;s help page for the Mobile Entry tickets also says (<a href="https:&#x2F;&#x2F;help.ticketmaster.com&#x2F;hc&#x2F;en-us&#x2F;articles&#x2F;9786597785617-How-do-I-use-Mobile-Entry-tickets" rel="nofollow">https:&#x2F;&#x2F;help.ticketmaster.com&#x2F;hc&#x2F;en-us&#x2F;articles&#x2F;978659778561...</a>)&gt;&gt; We encourage you to download your tickets to your digital wallet before you leave for your event. This ensures that you can always access your tickets.&gt; If you bought the ticket off the event’s official ticketing agency (not a sketchy reseller), you know for sure that they’re real.The problem is that that isn&#x27;t how the real world works. Ignoring the massive scalping problem currently happening (that TM is complicit in) sometimes plans change or people learn about events after the initial sale. Personally, any time I have to buy or sell through a reseller, I use StubHub, but I know plenty of people who don&#x27;t want to use them as they charge high fees and they aren&#x27;t much better than TM from a moral stand point.Also, I get the impression that if TM locked all tickets so that they could only be resold on TM, the author of this article would have a problem with that.

You don&#x27;t trust your OS to sandbox it? With a threat model like that, I wouldn&#x27;t use any apps other than the browser

What is the worst that can happen? I have it installed on my iPhone and deny whatever permissions it asks for.I have enough confidence in the sandbox that &quot;installing an app&quot; is basically never an issue (though I don&#x27;t out of the principle that most things companies have apps for just shouldn&#x27;t be apps).

There&#x27;s no way that I trust the developers of a company like Ticketmaster to install their app on my device.

...or just let us print g*d@mn paper tickets.

I used to work or a mobile event app company that made a lot of the big festival&#x2F;conference apps. Everything was built to function locally from a sqlite file on your phone that was constantly updated when you did have coverage.It was 100% expected that you would have no cell signal the entire event and we built in as many mitigations as we could think of.This was 2013ish, I think there are a lot more mesh network devices that can relay signal nowadays but I&#x27;m not involved anymore in that stuff.It was the best on-call I&#x27;ve ever had because.. nobody had cell signal while the event was on to complain about something.This person complains that people didn&#x27;t have network access on their phones when they were at the gate. I can only assume that they waited till they were at the gate to install&#x2F;use the app so it never got its offline data.Always open your event apps before getting to the event. Sometimes they&#x27;re completely bare bones and have to reach out and pull that apps specific database so its sure you have the latest. Most of the event apps are a template that is modified for each event and just has different assets&#x2F;sqlite.

Well, as it also notes, it works offline if you remember to open the ticket before you get there, and they don&#x27;t (or at least didn&#x27;t used to) give you sufficient warning. I found out that&#x27;s how it works the hard way when it was new by having to walk a half mile back from the venue to get service to load the tickets.There&#x27;s also the chance the ticketmaster app won&#x27;t work properly later even if you did do it. I&#x27;ve had other apps shit the bed for no apparent reason in offline mode before. I add them to my wallet now just in case.

Pleas notice the &quot;completely&quot; in my comment.

As the article notes, this ticket system does in fact work offline.

A few months ago I went to Las Vegas to watch U2 at the Sphere. When I learned that I needed to open the app or website in order to get in I panicked in fear of the shitty internet that is common in massive events, so I opened my tickets since I left the hotel. Unless this stuff works completely offline, it is a terrible idea.

Off topic (though the post does go into it a bit): Ticketmaster&#x27;s current form is entirely due to a failure of government. Decades from now, case studies will be written on how one company managed to have a monopoly on an industry that is so not a natural monopoly.

I&#x27;d argue that a few extra people sneaking in on the same ticket (assuming this is even possible) is more like sharing your Netflix credentials than ripping Netflix content and having it be shareable with the entire world.You&#x27;re also walking into a stadium&#x2F;concert in plain view of security cameras, so the stakes and deniability are different as well.

I doubt the second bit is true - they will still be marking the ticket as used in their backend.They are just trying to prevent scalpers printing off tickets 10 times and selling them outside the venues as a scam, which happened at every large concert I have ever been to until recently (so I assume this is working!).

It would be DRM if the barcode was copyrighted material, which it isn&#x27;t.

It&#x27;s piracy in a way that&#x27;s analogous to ripping like Netflix content. You are breaking away from DRM which is piracy. They also cite the potential to have multiple tokens valid per one ticket which would let multiple people get in with the same ticket.

Assuming that you can actually do that.If the seller re-opens the TM app and it generates a new token and invalidates the old one, then that&#x27;s not the case.

This way you can sell and have the ticket completely off of ticketmaster. That is a vulnerability. It lets users do something they explicitly don&#x27;t want to allow.

Scalping is still possible without understanding the tech - you could just stream a video of the bar codes and sell the stream instead of selling the ticket.

Piracy here means that you can sell 50k tickets to the same seat with a real valid rotating barcode.

Piracy here just means you can use it to sell your ticket without using their platform, which is analogous to just sending someone the PDF or handing over the piece of paper as always.While this has the upside of breaking you free from TM&#x27;s obnoxious practices, it also obviously opens up for scalpers and all.

&gt; The way this is already being exploited in the wild is that a scalper&#x2F;scammer buys 1 ticket, then resells the same ticket multiple times. Multiple people believe they have a valid ticket, show up at the event, but only the 1st ticket works. The other people who try to use the ticket are turned away saying that their ticket has already been used.That is one of many ways this is already exploited in the wild.

Do you have a source for this? What platform are they selling multiple copies of the ticket through, and what app are the buyers using that allows multiple buyers to receive and show the same animated barcode?

The way this is already being exploited in the wild is that a scalper&#x2F;scammer buys 1 ticket, then resells the same ticket multiple times. Multiple people believe they have a valid ticket, show up at the event, but only the 1st ticket works. The other people who try to use the ticket are turned away saying that their ticket has already been used.

Well it&#x27;s more like the &quot;security: they want is fundamentally is incompatible with support for ofline use in this case (as long as we have open computing platforms anyway).

&quot;Should happen remotely&quot; – according to who? What is the security risk for the end-user?&quot;this suggest a fundamental lack of security practices at the company&quot; – that&#x27;s a stretch of a conclusion to make. You&#x27;re being as hyperbolic as the original post.What didn&#x27;t I understand about the article? This still offers a slight increase in security over static barcodes, without introducing any new vulnerabilities.

&gt; the TOTP generation should happen remotely.It says that it is available offline (if you&#x27;ve viewed it in the last 20 hours), so the TOTP generation can&#x27;t happen remotely

Which would increase the problem he described--too many people trying to get in overloading the local bandwidth.It&#x27;s enough to defeat screenshotting and the 20 hour bit would defeat large scale malicious use.Not good security but probably good enough, especially in stopping the resale of stolen tickets.

Are you sure you understood the article? The token is supposed to be a secret and the TOTP generation should happen remotely. This is not the case and this suggest a fundamental lack of security practices at the company.

He was basically wondering if he could create two tickets each with different tokens. Tokens are valid for 20 hours but it probably doesn’t invalidate the old token (e.g. a request for a new token makes it to the internet but due to congestion, the response never comes back to your phone before timing out) and this could trigger multiple tokens for the same ticket and are all valid.

Thank you for posting this. This article left me super unsatisfied too.

I hate TM and ridiculous fees as much as anyone, but this article is overly hyperbolic.There&#x27;s a section named &quot;Pirating Tickets&quot;, that just explains how to re-create a barcode that you already paid for. You&#x27;re not using this to rob anyone of anything.And at the end, &quot;Have fun refactoring your ticket verification system&quot;. Why? There are no vulnerabilities here. A rotating barcode (even if following a known pattern) is still more secure than a static barcode on a piece of paper.

<a href="https:&#x2F;&#x2F;archive.md&#x2F;hrgE0" rel="nofollow">https:&#x2F;&#x2F;archive.md&#x2F;hrgE0</a> &#x2F; <a href="http:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20240521005653&#x2F;https:&#x2F;&#x2F;conduition.io&#x2F;coding&#x2F;ticketmaster&#x2F;" rel="nofollow">http:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20240521005653&#x2F;https:&#x2F;&#x2F;conduition...</a>

Reverse engineering Ticketmaster's rotating barcodes