Resident of the world, traveling the road of life
63795 stories
·
21 followers

Pluralistic: Live Nation/Ticketmaster is buying Congress (30 Apr 2024)

1 Share


Today's links



The Capitol building. Before it sits a vast pile of hundred dollar bills in rubber-banded packets. Behind it is a set of stadium concert lights. Overhead hangs a crooked, dirty sign bearing the Live Nation wordmark. The Capitol building is a-crawl with vivid green tentacles.

Live Nation/Ticketmaster is buying Congress (permalink)

Anything that can't go on forever eventually stops. Monopolies are intrinsically destabilizing and inevitably implode…eventually. Guessing which of the loathsome monopolies that make us all miserable will be the first domino is a hard call, but Ticketmaster is definitely high on my list.

It's not that event tickets are the most consequential aspect of our lives. The monopolies over pharma, fuel, finance, tech, and even beer are all more important to our day-to-day. But while Ticketmaster – and its many ramified tentacles, like Live Nation – may not be the most destructive monopoly in our world, its monopoly pisses off people with giant megaphones and armies of rabid fans.

It's been a minute since Ticketmaster was last in the news, so let's recap. Ticketmaster bought out most of its ticketing rivals, then merged with Live Nation, the country's largest concert promoter, and bought out many of the country's largest music, stage, and sports venues. They used this iron grip on the entire supply chain for performances and events to pile innumerable junk fees on every ticket sold, while drastically eroding the wages of the creative workers they nominally represented. They created a secret secondary market for tickets and worked with ticket-touts to help them run bots that bought every ticket within an instant of the opening of ticket sales, then ran an auction marketplace that made them gigantic fees on every re-sold ticket – fees the performers were not entitled to share in.

The Ticketmaster/Live Nation/venue octopus is nearly impossible to escape. Independent venues can't book Live Nation acts unless they use Ticketmaster for their tickets. Acts can't get into the large venues owned by Ticketmaster unless they sign up to have Live Nation book their tour. And when Ticketmaster buys a venue, it creams off the most successful acts, starving competing venues of blockbuster shows. They also illegally colluded with their vendors to jack up the price of concerts across the board:

https://pascrell.house.gov/uploadedfiles/ful.pdf

When Rebecca Giblin and I were writing Chokepoint Capitalism, our book about how tech and entertainment monopolies impoverish all kinds of creative workers, we were able to get insiders to go on record about every kind of monopoly, from the labels to Spotify, Kindle to the Big Five publishers and the Google-Meta ad-tech duopoly. The only exception was Ticketmaster/Live Nation: everyone involved in live performance – performers, bookers, club owners – was palpably terrified about speaking out on the record about the conglomerate:

https://chokepointcapitalism.com/

No wonder. The company has a long and notorious history of using its market power to ruin anyone who challenges it. Remember Pearl Jam?

https://www.rollingstone.com/music/music-news/pearl-jam-taking-on-ticketmaster-67440/

But anything that can't go on forever eventually stops. Not only is Ticketmaster a rapacious, vindictive monopolist – it's also an incompetent monopolist, whose IT systems are optimized for rent-extraction first, with ticket sales as a distant afterthought. This is bad no matter which artist it affects, but when Ticketmaster totally, utterly fucked up Taylor Swift's first post-lockdown tour, they incurred the wrath of the Swifties:

https://www.vox.com/culture/2022/11/21/23471763/taylor-swift-ticketmaster-monopoly

All of which explains why I've always given good odds that Ticketmaster would be first up against the wall come the antitrust revolution. It may not be the most destructive monopolist, but it is absurdly evil, and the people who hate it most passionately are the most famous and beloved artists in the country.

For a while, it looked like I was right. Ticketmaster's colossal Taylor Swift fuckup prompted Senator Amy Klobuchar – a leading antitrust crusader – to hold hearings on the company's conduct, and led to the introduction of a raft of bills to rein in predatory ticketing practices. But as David Dayen writes for The American Prospect, Ticketmaster/Live Nation is spreading a fortune around on the Hill, hiring a deep bench of ex-Congressmen and ex-senior staffers (including Klobuchar's former chief of staff) and they've found a way to create the appearance of justice without having to suffer any consequences for their decades-long campaign of fraud and abuse:

https://prospect.org/power/2024-04-30-live-nation-strikes-up-band-washington/

Dayen opens his article with the White House Correspondents’ Dinner, which is always bracketed by a week's worth of lavish parties for Congress and hill staffers. One of the fanciest of these parties was thrown by Axios – and sponsored by Live Nation, with a performance by Jelly Roll (whose touring contract is owned by Live Nation). Attendees at the Axios/Live Nation event were bombarded with messages about the essential goodness of Live Nation (they were even printed on the cocktail napkins) and exhortations to support the Fans First Act, co-sponsored by Klobuchar and Sen John Cornyn (R-TX):

https://www.nytimes.com/2023/12/08/arts/music/fans-first-act-ticket-bill.html

Ticketmaster/Live Nation loves the Fans First Act, because – unlike other bills – it focuses primarily on the secondary market for tickets, and its main measure is a requirement for ticketing companies to disclose their junk fees upfront. Neither of these represents a major challenge to Ticketmaster/Live Nation's control over the market, which gives it the ability to slash performers' wages while jacking up prices for fans.

Fans First represents the triumph of Ticketmaster/Live Nation's media strategy, which is to blame the entire problem on bottom-feeding ticket-touts (who are mostly scum!) instead of on the single monopoly that controls the entire industry and can't stop committing financial crimes.

Axios isn't Live Nation's only partner in selling this distraction tactic. Over the past five years, the company has flushed gigantic sums of money through Washington. Its lobbying spend rose from $240k in 2018 to $1.1m in 2022, and $2.38m in 2023:

https://thehill.com/business/4431886-live-nation-doubled-lobbying-spending-to-2-4m-in-2023-amid-antitrust-threat/

The company has 37 paid lobbyists selling Congress on its behalf. 25 of them are former congressional staffers. Two are former Congressmen: Ed Whitfield (R-KY), a 21 year veteran of the House, and Mark Pryor (D-AR), a two-term senator:

https://www.bhfs.com/people/attorneys/p-s/mark-pryor

But perhaps the most galling celebrant in this lavish hymn to Citizen United is Jonathan Becker, Amy Klobuchar's former chief of staff. Becker jumped ship to lobby Congress on behalf of monopolists like Live Nation, who paid him $120k last year to sell their story to the Hill:

https://www.opensecrets.org/federal-lobbying/clients/lobbyists?cycle=2023&id=D000053134

Not everyone hates Fans First: it's been endorsed by the Nix the Tix coalition, largely on the strength of its regulation of secondary ticket sales. But the largest secondary seller in America by far is Live Nation itself, with a $4.5b market in reselling the tickets it sold in the first place. Fans First shifts focus from this sleazy self-dealing to competitors like Stubhub.

Fans First can be seen as an opening salvo in the long war against Ticketmaster/Live Nation. But compared to more muscular bills – like Klobuchar's stalled-out Unlock Ticketing Markets Act, it's pretty weaksauce. The Unlocking act will "prevent exclusive contracts between ticketing services and venues" – hitting Ticketmaster/Live Nation where it hurts, right in the bank-account:

https://www.klobuchar.senate.gov/public/index.cfm/2023/4/following-senate-judiciary-committee-hearing-klobuchar-blumenthal-introduce-legislation-to-increase-competition-in-live-event-ticketing-markets

It's not all gloom. Dayen reports that Ticketmaster's active lobbying in favor of Fans First has made many in Congress more skeptical of the bill, not less. And Congress isn't the only – or even the best – way to smash Ticketmaster's criminal empire. That's something the DoJ's antitrust division could power through with a lot less exposure to the legalized bribery that dominates Congress.

(Image: Matt Biddulph, CC BY-SA 2.0; Flying Logos, CC BY-SA 4.0; modified)


Hey look at this (permalink)



A Wayback Machine banner.

This day in history (permalink)

#20yrsago Charlie Stross’s future-rant https://web.archive.org/web/20040515161445/http://www.antipope.org/charlie/blosxom.cgi/2004/Apr/29

#20yrsago Apple’s new DRM reneges on your purchase conditions, picks your pocket https://web.archive.org/web/20040624182851/http://lawgeek.typepad.com/lawgeek/2004/04/meet_the_new_it.html

#15yrsago Solitary confinement is torture: psych expert https://web.archive.org/web/20090501235955/https://www.wired.com/wiredscience/2009/04/solitaryconfinement/

#15yrsago The Doctor Will Sue You Now: the missing chapter of Ben Goldacre’s “Bad Science” about the selling of vitamin therapy instead of anti-virals to AIDS patients in South Africa https://www.badscience.net/2009/04/matthias-rath-steal-this-chapter/

#10yrsago Rob Ford’s mayoral career considered as a reality TV show – straining suspension of disbelief https://www.theglobeandmail.com/news/toronto/the-ford-show-is-riveting-but-soon-well-stop-believing-it/article18232290/

#10yrsago Email considered harmful https://www.motherjones.com/environment/2014/04/smartphone-addiction-research-work-email/

#10yrsago WIPO sends criminal prosecution threats over publication of internal docs about its Director General’s corruption https://www.techdirt.com/2014/04/28/shameful-wipo-threatens-blogger-with-criminal-charges-accurately-reporting-wipo-directors-alleged-misconduct/

#5yrsago Jimmy Fallon played a video game on air, meaning that streaming your own game gets you taken down as a pirate, thanks to NBC https://old.reddit.com/r/beatsaber/comments/bi9cp5/beat_saber_stream_blocked_by_jimmy_fallon_show/

#5yrsago Thanks to the 2008 foreclosure crisis, a Kuwaiti ponzi schemer was able to single-handedly blight cities across America https://buffalonews.com/news/local/how-a-kuwaitis-ponzi-scheme-left-a-trail-of-blight-in-buffalo/article_7d39e12a-495f-5bba-b7f4-87d07eefa496.html

#5yrsago Uber drivers across America are going on strike https://philly.curbed.com/2019/4/25/18516670/uber-drivers-shutdown-strike-protest-philly

#5yrsago Facebook never delivered its “Clear History” feature https://www.tomsguide.com/us/facebook-privacy-problems,news-29944.html

#1yrago The seductive, science fictional power of spreadsheets https://pluralistic.net/2023/04/29/gedankenexperimentwahn/#high-on-your-own-supply


Upcoming appearances (permalink)

A photo of me onstage, giving a speech, holding a mic.



A screenshot of me at my desk, doing a livecast.

Recent appearances (permalink)



A grid of my books with Will Stahle covers..

Latest books (permalink)



A cardboard book box with the Macmillan logo.

Upcoming books (permalink)

  • Picks and Shovels: a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books, February 2025

  • Unauthorized Bread: a graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, 2025



Colophon (permalink)

Today's top sources:

Currently writing:

  • A Little Brother short story about DIY insulin PLANNING

  • Picks and Shovels, a Martin Hench noir thriller about the heroic era of the PC. FORTHCOMING TOR BOOKS JAN 2025

  • Vigilant, Little Brother short story about remote invigilation. FORTHCOMING ON TOR.COM

  • Spill, a Little Brother short story about pipeline protests. FORTHCOMING ON TOR.COM

Latest podcast: Precaratize Bosses https://craphound.com/news/2024/04/28/precaratize-bosses/


This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.


How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/@pluralistic

Medium (no ads, paywalled):

https://doctorow.medium.com/

Twitter (mass-scale, unrestricted, third-party surveillance and advertising):

https://twitter.com/doctorow

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla

Read the whole story
mkalus
2 hours ago
reply
iPhone: 49.287476,-123.142136
Share this story
Delete

Fallout Cyberdeck

jwz
1 Share

This is very pretty! But...
  1. Anything claiming to be Fallout-themed that does not use a CRT is invalid.
  2. For both the claims of "it's a Faraday cage", and, "because of that it will survive an EMP"... Wow that is very much [citation needed].

Previously, previously, previously, previously, previously, previously, previously, previously, previously, previously.





Read the whole story
mkalus
2 hours ago
reply
iPhone: 49.287476,-123.142136
Share this story
Delete

Wagenrennen mit Motorrädern

1 Share

Motorcycle chariot racing war in den 1920ern eine Motorsportart, die vor allem in den USA und in Australien populär war und Motorräder mit dem klassischen Wagenrennen kombinierte. 10 Jahre später flachte der Hype darum wieder ab.


(Direktlink, via Messy Nessy)

Read the whole story
mkalus
14 hours ago
reply
iPhone: 49.287476,-123.142136
Share this story
Delete

Dekonstruktion und Restaurierung eines 100 Jahre alten Buches

1 Share

Die Autorin, Pädagogin und Buchrestauratorin Sophia Bogle zeigt hier, wie sie eine 100 Jahre alte Erstausgabe auseinandernimmt, um diese dann zu restaurieren.


(Direktlink, via Book of Joe)

Read the whole story
mkalus
14 hours ago
reply
iPhone: 49.287476,-123.142136
Share this story
Delete

How an empty S3 bucket can make your AWS bill explode

1 Share

A few weeks ago, I began working on the PoC of a document indexing system for my client. I created a single S3 bucket in the eu-west-1 region and uploaded some files there for testing. Two days later, I checked my AWS billing page, primarily to make sure that what I was doing was well within the free-tier limits. Apparently, it wasn’t. My bill was over $1,300, with the billing console showing nearly 100,000,000 S3 PUT requests executed within just one day!

Where were these requests coming from?

By default, AWS doesn’t log requests executed against your S3 buckets. However, such logs can be enabled using AWS CloudTrail or S3 Server Access Logging. After enabling CloudTrail logs, I immediately observed thousands of write requests originating from multiple accounts or entirely outside of AWS.

But why would some third parties bombard my S3 bucket with unauthorised requests?

Was it some kind of DDoS-like attack against my account? Against AWS? As it turns out, one of the popular open-source tools had a default configuration to store their backups in S3. And, as a placeholder for a bucket name, they used… the same name that I used for my bucket. This meant that every deployment of this tool with default configuration values attempted to store its backups in my S3 bucket!

Note: I can’t disclose the name of the tool I’m referring to, as that would put the impacted companies at risk of data leak (as explained further).

So, a horde of misconfigured systems is attempting to store their data in my private S3 bucket. But why should I be the one paying for this mistake? Here’s why:

S3 charges you for unauthorized incoming requests

This was confirmed in my exchange with AWS support. As they wrote:

Yes, S3 charges for unauthorized requests (4xx) as well[1]. That’s expected behavior.

So, if I were to open my terminal now and type:

aws s3 cp ./file.txt s3://your-bucket-name/random_key

I would receive an AccessDenied error, but you would be the one to pay for that request. And I don’t even need an AWS account to do so.

Another question was bugging me: why was over half of my bill coming from the us-east-1 region? I didn’t have a single bucket there! The answer to that is that the S3 requests without a specified region default to us-east-1 and are redirected as needed. And the bucket’s owner pays extra for that redirected request.

The security aspect

We now understand why my S3 bucket was bombarded with millions of requests and why I ended up with a huge S3 bill. At that point, I had one more idea I wanted to explore. If all those misconfigured systems were attempting to back up their data into my S3 bucket, why not just let them do so? I opened my bucket for public writes and collected over 10GB of data within less than 30 seconds. Of course, I can’t disclose whose data it was. But it left me amazed at how an innocent configuration oversight could lead to a dangerous data leak!

What did I learn from all this?

Lesson 1: Anyone who knows the name of any of your S3 buckets can ramp up your AWS bill as they like.

Other than deleting the bucket, there’s nothing you can do to prevent it. You can’t protect your bucket with services like CloudFront or WAF when it’s being accessed directly through the S3 API. Standard S3 PUT requests are priced at just $0.005 per 1,000 requests, but a single machine can easily execute thousands of such requests per second.

Lesson 2: Adding a random suffix to your bucket names can enhance security.

This practice reduces vulnerability to misconfigured systems or intentional attacks. At least avoid using short and common names for your S3 buckets.

Lesson 3: When executing a lot of requests to S3, make sure to explicitly specify the AWS region.

This way you will avoid additional costs of S3 API redirects.

Aftermath:

  1. I reported my findings to the maintainers of the vulnerable open-source tool. They quickly fixed the default configuration, although they can’t fix the existing deployments.
  2. I notified the AWS security team. I suggested that they restrict the unfortunate S3 bucket name to protect their customers from unexpected charges, and to protect the impacted companies from data leaks. But they were unwilling to address misconfigurations of third-party products.
  3. I reported the issue to two companies whose data I found in my bucket. They did not respond to my emails, possibly considering them as spam.
  4. AWS was kind enough to cancel my S3 bill. However, they emphasized that this was done as an exception.

Thank you for taking the time to read my post. I hope it will help you steer clear of unexpected AWS charges!

Read the whole story
mkalus
16 hours ago
reply
iPhone: 49.287476,-123.142136
Share this story
Delete

Wir hatten lange keine Supply-Chain-Apokalypse-Meldung ...

1 Share
Wir hatten lange keine Supply-Chain-Apokalypse-Meldung mehr. Hier ist eine nette.

Ein Typ meldet zum Testen einen S3-Bucket an. Spielt ein bisschen rum. Lädt keine Dateien hoch oder runter. Erledigt seinen eigentlichen Auftrag, guckt sicherheitshalber nochmal, dass er im Free Tier geblieben ist mit seinen paar Bytes Testtraffic.

Findet eine Rechnung über $1300 vor.

Stellt sich raus: Irgendein versifftes Open-Source-Projekt hat eine Backup-zu-S3-Funktionalität eingebaut, und in der Konfigdatei das Äquivalent von "example.com" eingetragen, und das war genau sein Bucket.

Ja aber er hat denen ja keine Permissions gegeben, da wurde also nichts hochgeladen!

Stimmt, aber AWS berechnet auch Fehlermeldungen. Wenn du also einen Bucket hast, und jemand den Namen raten kann, dann ist egal, wie geil deine ACLs gesetzt sind. Solange der aus dem Internet erreichbar ist, kann dir jemand die Trafficrechnung explodieren.

Aber was hat das mit einer Supply-Chain-Apokalypse zu tun, fragt ihr? Nun, er hat dann mal testweise für ein paar Minuten Upload-Permissions gesetzt, um zu gucken, wer da zugreifen wollte.

I opened my bucket for public writes and collected over 10GB of data within less than 30 seconds.
Ja geil ey! Früher musste man noch wo einbrechen, wenn man die Daten klauen wollte!

Oh und natürlich hat Amazon auch schon herumgetrickst, um die Kosten hochzutreiben.

Another question was bugging me: why was over half of my bill coming from the us-east-1 region? I didn’t have a single bucket there! The answer to that is that the S3 requests without a specified region default to us-east-1 and are redirected as needed. And you pay extra for that redirected request.
Da willst du doch Kunde werden, bei so einer Firma!!1!
Read the whole story
mkalus
16 hours ago
reply
iPhone: 49.287476,-123.142136
Share this story
Delete
Next Page of Stories