ok well unfortunately I typed out a massive comment earlier then my net cut and when I refreshed it was gone. a brief/rewritten version of what was once more thorough and thoughtful:
(edit: not so brief lol, but probably comes off a lot blunter than my original version - everything said with the best of intentions!)

1) circumstances of the event

• The phishing happened as part of a game where shenanigans, manipulation, scheming, and deceit are all encouraged.

  • obviously, there are lines. You cannot break into the game host's house and say it was just part of the game.

  • This crossed that line

• Previous examples of shenanigans which were acceptable include:

  • Printing fake documents to manipulate people (Manifest 2026, Wasabipesto lost thousands of mana to this 'scam', misinformation disseminated to manipulate the crowd) -- as I understand it, acceptable, and part of the game

  • Colluding with the game host to force an outcome and split prize money (encouraged, part of the game)

• This example went beyond that, and was bad, but it was more of a personal betrayal than anything else. It was clearly inappropriate, bad judgement, and they acknowledged that during the public apology.

  • When it was suspected they stole the API key, they admitted to it, because they thought it would be seen as being caught within the game.

2) On-site vs off-site moderation, breach of terms, etc.

• We don't/shouldn't police people on Manifold for actions taken off site.

  • We don't censor people on Manifold for their speech on other platforms

  • We don't ban people on Manifold for being suspected of committing crimes (@LuigiMangione) - nor would we if convicted...

  • In general, policing off-site behaviour is ~impossible and leads to many things we don't want to deal with.

  • API keys are the user's responsibility to protect, and it was captured because of off-platform behaviour. This circumstance is unique because there is no ambiguity around whether or not it happened or how it happened, because he was open about it after the fact. Had they never confessed, how would we know? In the same way that, someone could go to your house, use your computer, and take actions on site. It's difficult to police and not something we want to do

• We DO moderate behaviour on site, with the goal of creating a safe/inclusive environment free from cheating and abuse.

  • @realTomBayes can no longer share links to anything on Manifold that requests personal/secure information that could be captured or used maliciously, including Manifold API keys.

  • It is possible the API key could have been used for something more malicious if his access were maintained during the game, but because it was caught beforehand when trying to figure out how he had information held only in unlisted markets, the API key got cycled.

Basically, based on all of this, my thoughts are that this was primarily a personal dispute, and to the extent that it involved the platform a 2 week ban seemed appropriate.

If I thought they would do it again I would ban them from posting/messaging, but that doesn't seem necessary. There were personal consequences, in person / real world consequences (we were all together at the event when it was revealed), and also a 2 week sitewide ban.

It doesn't mean we wouldn't permanently ban for this in other circumstances, but this was pretty unique and the conclusion seems to have mostly been positive so far. Writing this reply has used more of my time than worrying about a recurrence of this event, but I hope it was valuable and shares my thoughts effectively.

@Gen Got it, so if I steal someone's API key & it's funny enough to the right admin, no problems, even if I've got a history of violations. The rules are rules, except when they're not & the punishments don't matter.

@ChurlishGambit no, it wasn't funny, nobody thinks it was funny, and they were punished.

@Gen Can you explain which site rules are optional now? Is there any way to get permanently banned, or can we just repeatedly violate them with no real concern?

@ChurlishGambit no site rules are optional. It is possible to get permanently banned.

The circumstances of this were quite unique, and the ban given seemed appropriate. It seems after that punishment that it is extremely unlikely that they will do something like this again. If they did do it again, they would be banned indefinitely.

@Gen He's been punished multiple times before. Are we on a seven-strike system? Or how many is it? He bragged on Twitter about how many times he's been suspended, so he clearly doesn't take it very seriously.

@ChurlishGambit he seems to be making on-net positive contributions to the site, so I think the punishments have thus far been sufficient and successful

@Gen Right, so if the admins like you, you can violate the rules all you like.

@ChurlishGambit lol, I think we have been pretty consistent with punishments. You were never harmed in any of this, so I don't really understand your stake in it

@Gen As I've mentioned before, I was talked into investing in this disaster years ago. Seeing it mismanaged is very frustrating.

@ChurlishGambit I don't think banning this user would be good for the site or investors, but thank you for the input.

@Gen What would be good for the investors is managing to at least break even one time

Could one of the mods explain this, please? @Eliza any insight as to why hacking of other users is allowed? Are the site's terms no longer binding?

@ChurlishGambit it's not allowed and they did suffer consequences
they were banned for a decently long duration...?

there's also a distinction between malicious hacking and more prank-like hacking (i'm pretty sure the user in mention just used the api key to find some unlisted markets and that was it)

still bad nonetheless although i'd argue the punishment was pretty appropriate

@ChurlishGambit I banned him originally and then they had some kind of discussion where Genzy talked to each party and then came to a decision about what to do. So I guess they must have come to an understanding. I don't know the details. But I assume hacking other users is still a bad offense and not something we should do.

@Eliza He's also been suspended other times, right? So we can just break the rules over & over, without concern that we'll be permanently banned? Why are the rules even listed?

@bobalobascrob

>there's also a distinction between malicious hacking and more prank-like hacking (i'm pretty sure the user in mention just used the api key to find some unlisted markets and that was it)

There's no rule that says "if we decide it's fun you can do whatever you want." There is no distinction about "prank-like" behavior.

@ChurlishGambit well that's not my point, of course they should be punished, the question is to what extent

in that regard intent matters. there's a reason why first degree murder and third degree murder or manslaughter have different charges...

@bobalobascrob I don't think intent should matter much when it comes to compromising user accounts

"great people never suffer great consequences" or however that quote goes