Dear Dash Users – A message to all Dash users from the Kapeli Blog

But I've lost trust in this guy after reading his blog posts and especially the phone call he published.

The only reason I can think of why the phone call took over 7 minutes is because he wanted to record it and publish it. Really. If you summarize the phone call. It's basically Apple asking him to publish that his account was indeed linked with the fraud account (not even that he's the one who committed the fraud) and he's working with Apple to resolve it, and rest is this dash guy complaining on and on which is completely unnecessary since Apple already knows that and is saying they understand and want to work with him to "make this right" (The Apple guy literally said "make this right").

Also it is very hard to believe at this point that a "relative" did all this. If I--or any normal person--was in the same situation (I am paying for a relative's developer account with my own credit card with my device and turns out that the relative is committing a fraud), my first reaction would NOT be telling Apple "This has nothing to do with me", but "I had no idea, I am still pissed that you guys didn't notify me, but I also understand your position and will talk to my relative to make sure this doesn't happen. After all, I am the one funding this fraud regardless of whether I was aware or not aware.")

You'd have to be mad to actually do that, though. We see quite clearly how Apple can react when they think they've been wronged, and who knows what that binary actually contains.

Seems like the best approach would be to open source it and convince somebody (perhaps several somebodies) to build it from source and put it on the store for free. Obviously, the source release would need to be under a license that was compatible with an App Store release (i.e. no GPL).

* Kapeli shared financial information and test devices with this other account, whether it was a relative or not.

The assumption here is that for some reason a credit card number and device identifiers (unclear where they come from...but maybe mac address?) are enough for Apple to "link" accounts. I contest this for the same reason I think someone knowing my birthday and social security number is _not_ enough for them to be confirmed as "me".

While I don't think Apple is wrong to use this as a psuedo-identifier, I do think it is wrong for them to insist that, "we did nothing wrong" and fail to reinstate the pseudo-linked account immediately after being contacted.

I don't know if Kapeli is telling the truth about the situation...and his reputation is tarnished my eyes, but I definitely don't think Apple should insist that the accounts _must_ (with 100% certainty) be linked based off of the circumstantial credit card and test devices registered to them.

At this point Apple should either reinstate the account or come out with all the information they have to justify their actions. But having "closed door" conversations and throwing allegations at one another without proof and documentation is ridiculous.

> same credit card + same hardware = same developer

is fine as a pseudo-identifier for fraud detection...but I don't think is actually an identifier. It's kind of like someone knowing my social security number and birthday but not actually being me.

IMO, Apple should have immediately reinstated the account once contacted about a potential edge case rather than insist that, "they did nothing wrong" because the implication of that is that the above two pieces of information is legally acceptable as personal identification and that the developer _did_ do something wrong.

I may not believe Kapeli 100% and his reputation is tarnished some in my eyes, but I don't agree with Apple standing on the notion that CC + device identifiers together are sufficient PII. Fine for fraud detection in a "pseudo-" context...sure...but not enough to deny immediate reinstatement.