Reverse engineering Ticketmaster's rotating barcodes

The underlying issue is that those tickets have a "no resale" provision that doesn't apply when the original seller acts as a broker.

Do other brokers, when they go and work around that limitation break the sales contact? Maybe. The legal system would churn an answer in a few years.

Do AXS et al with their "only we are allowed to engage in a secondary policy" are abusing their monopoly on original sales? The legal system would churn an answer about the legality of this in few years, but I think it's obvious they at least break rules in the spirit.

I love it when a system has been working for hundreds of years through by far the most prosperous time in human history but people on the internet are sure it is wrong. No proof, no evidence, not even logic, just certainty.

Also, I don’t think any of the issues with Ticketmaster have anything to do with patents.

If you don't have a patent on an invention then how do you protect it from people who will just steal what you have spent time/money creating?

What patents does Ticketmaster have that stop competitors from selling tickets?

Not all cryptography is blockchain

Hash chains already existed. But someone created blockchain anyway.

Just vote with your pocket and don’t buy tickets from them. I do that - yes I don’t get to go to major concerts but there are still so much more that is not on ticket master. I found a lot of new entertainment and was happy to pay $4 fee instead of whatever TM charges nowadays.

This began a lot more on third party sites like stubhub due to Covid and the massive amount of cancellations; before most places paid out after the sale, and if the buyer wound up having an issue (due to the seller mistake, selling it multiple times, whatever) they would charge the seller and usually assess a penalty.

But when everything in the world was being cancelled I assume they didn't have all the money just sitting around to reverse and it was a ton of thrash to deal with. As someone who had bought tons of tickets and sold some, it was a mess. I had a ton of credit card refunds back, the third party sites had to reverse payments, etc.

Waiting until after the event is just less overhead. Guarantees the transaction happened without a hitch.

There are some POS and broker sites that still pay on transfer, but none of the "primary" secondary market does.

I’ve never dealt much with TicketMaster, despite them being a monopoly. So my questions here may just be out of naiveté:

1) Why would TicketMaster pay event organizers ahead of time, if the event might be shit and attendees may demand their money back? Rather than having to deal with a lot of chargebacks and making it their own problem with the banks, they might prefer to make sure the event goes off without a hitch and refund people while they still can. Rather than subsidizing the refunds they make the event organizer have to get (and pay for) financing instead, backed by their payout. They might also offer such financing.

2) I get that they hold event organizers hostage by making contracts with the venues for years, that might be an antitrust issue but it’s separate from 1.

3) Why would TicketMaster make scalping easy? Middlemen would just buy up all the tickets and then pump and dump the price, much like early crypto investors in a meme token or altcoin do. So they don’t “deliver” the ticket to you until just before the event, exactly for that reason.

With ChatGPT it’s now easier than ever to impersonate thousands of people at scale, with credit cards and everything. But I will admit, showing up to an event at least once confirms there is a human behind the account. But a first-timer buyer? Shouldn’t be able to resell, no.

Tbf, this does sound like a fairly efficient anti-scalper strategy, so I guess there's at least some upside to this mess.

Wonder no more—yes.

They would need to solve that anyway in case 2 or more friends attempt to get in on the same ticket.

Not at all difficult - simply share screen a third device and display the rotating QR-code through e.g. zoom on individual phones. For additional trickery, try to split the group into joining multiple ticket scanning lines and timing the scan of the ticket to be as close as possible to eachother.

That does sound like a very reasonable thing to do. Otherwise you have a threat vector of steal card, buy ticket, sell ticket, pocket the cash, card owner disputes, now Ticketmaster has paid a stolen identity who took the money and ran.

Anything that can be used to monetize stolen cards will tend to be used for the purpose even if it's inefficient.

This is literally what the rolling codes prevent.

Scalping is still possible without understanding the tech - you could just stream a video of the bar codes and sell the stream instead of selling the ticket.

Piracy here means that you can sell 50k tickets to the same seat with a real valid rotating barcode.

"Should happen remotely" – according to who? What is the security risk for the end-user?

"this suggest a fundamental lack of security practices at the company" – that's a stretch of a conclusion to make. You're being as hyperbolic as the original post.

What didn't I understand about the article? This still offers a slight increase in security over static barcodes, without introducing any new vulnerabilities.

> the TOTP generation should happen remotely.

It says that it is available offline (if you've viewed it in the last 20 hours), so the TOTP generation can't happen remotely

Well it's more like the "security: they want is fundamentally is incompatible with support for ofline use in this case (as long as we have open computing platforms anyway).

Which would increase the problem he described--too many people trying to get in overloading the local bandwidth.

It's enough to defeat screenshotting and the 20 hour bit would defeat large scale malicious use.

Not good security but probably good enough, especially in stopping the resale of stolen tickets.

I doubt the second bit is true - they will still be marking the ticket as used in their backend.

They are just trying to prevent scalpers printing off tickets 10 times and selling them outside the venues as a scam, which happened at every large concert I have ever been to until recently (so I assume this is working!).

I'd argue that a few extra people sneaking in on the same ticket (assuming this is even possible) is more like sharing your Netflix credentials than ripping Netflix content and having it be shareable with the entire world.

You're also walking into a stadium/concert in plain view of security cameras, so the stakes and deniability are different as well.

It would be DRM if the barcode was copyrighted material, which it isn't.

> The way this is already being exploited in the wild is that a scalper/scammer buys 1 ticket, then resells the same ticket multiple times. Multiple people believe they have a valid ticket, show up at the event, but only the 1st ticket works. The other people who try to use the ticket are turned away saying that their ticket has already been used.

That is one of many ways this is already exploited in the wild.

Do you have a source for this? What platform are they selling multiple copies of the ticket through, and what app are the buyers using that allows multiple buyers to receive and show the same animated barcode?

Assuming that you can actually do that.

If the seller re-opens the TM app and it generates a new token and invalidates the old one, then that's not the case.

I have to presume that the driving impetus of all of this is that they're trying to avoid the actual requirement of checking the ID. Like, they want to improve the flow of traffic through admissions.

But I mean, obviously, any kind of system like this strikes me as the same sort of thing as DRM. That you can somehow protect the message from the person you're sharing the message to. How can you avoid reselling if you don't verify the original purchaser? It just seemes ridiculous on its face.

Yeah I agree, they are not incentivized to fix scaling/bots because they get a fee every time a ticket is sold. It is in their best interest for the ticket to be sold as many times as possible.

[flagged]

Airlines are preventing a secondary market. Unfavorable for your use case, but also prevents scalping airline tickets (while allowing airlines to attempt to maximize revenue). There are always tradeoffs and compromise.

To hack around this, I've used Southwest Airlines; I can buy tickets for folks and if they can't travel, we cancel the ticket(s) and keep the travel funds banked for another time. I hope this is potentially helpful information.

https://simpleflying.com/why-airlines-dont-allow-name-change...

Even allowing that but requiring your valid ID must be taken into the venue by yourself (or by your friends eg if you get sick and can't go) would be a big improvement, meaning ticket scalps would have to actually go or have someone on their team go along with every ticket they resell.

Depends a lot on the country you live in. In most European countries "carrying an ID" is legally required if the police stops you anyway (they do need a reason to see it though), so "show an ID at the entrance" is no big deal.

It's to my understanding mainly the US where ID requirements are often side eyed because many people don't have them and there's no national standard (and due to a variety of political reasons there probably won't ever be any.)

that's really just an opinion. and I'd argue that if people really care about a fair and sustainable concert going, given how ridiculous the live event situation is, you'd support pretty common and standard requirements like ID to be shown. as others said: ID is already required to validate age in many events/venues

> Flying requires an ID. Attending a concert should not.

Why though? Not disagreeing per say because I'd have thought so too, but upon reflection...

I assume the main reason airlines require an ID is safety and security. We maintain a denied parties list and use identity verification to make it as difficult as possible to fly a plane into a crowded venue. Border control is another issue, but there's plenty of intra-country or intra-state flights where this isn't an issue.

Ticketmaster sells unverified access to crowded venues.

How are you getting into shows without presenting ID for age? Every (well, every legal...) venue I've been to in NYC cards to see if you are 21.

I’d rather not solve it than let the state have more information about my transactions

Because this, and more very strange rules it is very hard for ticketing systems to get into the Italian market. Some examples:

- not allowed to change to time or name of the event after the 1st ticket is sold

- only allowed section names in halls from a know list

- free tickets on events... can only do this under strange conditions

- smart card application, for encryption, must run on a physical server in Italy. You should not be able to log into the ticketing box office if that smart card application is not running.

One ID for the entire order would be fine. You can buy 4 tickets, and go into the concert with your 3 friends. It often works this way even with no ID involved, I buy two tickets, add them both to my wallet, scan them both when my GF and I go to the show.

You COULD still scalp tickets if the person who bought them from you is going to walk in with you. But the scalper would have to eat the cost of one ticket to do it, and it's probably onerous enough to severly reduce the impact of scalping.

Would be awesome if it were true for airplane tickets

> Which is going to be a problem if tickets need to be transferred in contexts where users don't have internet access (but they do have local connectivity between devices) or in contexts where the venue doesn't have internet access.

You know as well as I do that TicketMaster won't allow any of that, because it means they miss out on selling another ticket.

I was recently at a Festival that requires ticket + ID (https://www.resurrectionfest.es). The key to success was to put a little more personal at the gates, maybe 15 people instead of 10. But it is also true that we have the ID document issued in our early teens it not before. Each ticket verification takes 3 more seconds extra to verify the ID matches, no big deal.

Said festival does their own ticket re-sale to avoid scalping but mainly to avoid shady sites that are known to allow the selling of counterfeits. You can only cede your ticket, not sell it. It is not perfect (e.g. if you don't find a buyer for the same price, you can't sell it at a lost to recoup some money. You get your ticket back) but at least is not as bad as the one from Ticketmaster.

how is this not the same as 8 people trying to find airline tickets for everyone? you can buy tickets for different passengers. some airlines/travel agencies even allow for name change for a fee.

This is trivial and solutions exist in the wild already. If you buy tix for the Paris Olympics, you can transfer them to your friends or you can assign their names to the tickets directly.

The interesting mechanism there is that you can buy a lot of seats at once, but you don’t get to choose where they are exactly, only the section. So in every case you’re going to have people buying big lots of tickets and distributing them to friends and family after the fact.

Or just scan your face with the new Digital ID rolling out. It's actually quite nice.

I flew about 3 days ago and they only asked for my minor children’s boarding passes.

Today's digital entry experience is far from frictionless. Might as well add a scan of the PDF417 barcode on the back of the latest state ID cards.

I just went to a MLB game yesterday, and the digital process was:

    - Open ticket app
    - scan ticket 1
    - scan ticket 2

    - Open ticket app
    - scan PDF417
    - scan ticket 1
    - scan ticket 2

I keep reading about this argument but Olympics and World Cup matches are arguably as large events (if not larger) and they place name on ticket and check ID at entrance.

people complain at ticketmaster yet seem to bend over backwards to justify the state of affairs

If the government needs people to have IDs, then maybe the government should provide those IDs for free...

Exactly. The privacy characteristics of government ID cards are worse than any other solution. When sharing such an ID, a person is providing several global, stable identifiers (e.g. ID number, full legal name). For adtech and data brokers, this is the ultimate fingerprint for tracking and matching.

In a perfect world, the digitization of these IDs would come with modern digital privacy and security. Scanning your ID number would only provide a recipient-specific ID that couldn't be matched with other vendors. Age eligibility and driver's licensing status would be presented as separate signed attestations that share no other data.

We aren't even heading in that direction yet.

...yet you have a phone (for the moving barcode and whatnot) which is heavier and bulkier than a card?

How often has this been a problem though? How about not keeping your boarding pass, or ticket, or credit card for that matter, visible for the world? Just put it in your wallet, I don't know.

This is security FUD. Stop solving problems that do not exist to the point where it makes the news when they do happen, once a century.

This DRM scheme concretely creates millions of small annoyances to millions of people and wasting our time as a society.

Where has rules prohibiting it? Maybe will move. :D

Oh cool, so when I buy a scalped ticket I'll simply order a quality fake ID as well.

Buying and using a scalped ticket isn't a crime for the concert-goer, using a fake ID (in most states) is meaning it puts significantly more pressure the consumer to not buy. Also, most people in the US over the age of 21 don't have fake ID's, so it's a reasonable detriment.

GenAI?

The solution doesn't have to be perfect. It just has to be good. Good enough is good enough.

It's like porn. You know it when you see it and also there's quite a lot of it.

As one grows older, they may find that not everything in reality can be quantified or put into words.

And trying to objectify value judgements is another whole area of contention that inevitably leads to itself.

> Now all that remains is a good, measurable definition of what a bad company is.

Lets re-invent religion.

You're trying to get quantitative about a qualitative problem.

If you're asking the above question, it means you already think the company is bad according to your own morals.

It's not hard if you remove the self delusion. Removing the self delusion is maybe tricky for the individual, but it's easy for people around the individual to see. Societal tools like shame are generally used to encourage people in the right direction, but we don't do a great job of this in America, because money tends to override everything else and I don't think we have good structures around expressing non-monetary values like honor.

Especially on the west coast, we're so passive in our shaming of people that it probably doesn't translate to action. There are people who work at Evil companies like Facebook, etc, who are otherwise nice, but I find myself not including them or turned off to them as friends because this sort of contradiction is hard to square in my brain. Of course I wouldn't communicate to this, being a passive PNW raised wimp, and it's not even super explicit in my mind, it's really more of a bad vibe than anything else. I imagine over time if enough people act like I do, it doesn't actually translate to different decisions from the individual in question, but instead translates to them waking up one day feeling distant and unfulfilled, which is probably the worst of all outcomes. They still work for Bad Company, but are also sad about it, and there's a general sense of malaise pervading life that's hard to pinpoint.

*Obviously this all ignores the people who don't have a choice of employment. But here I'm generally referring to software people who have high pay and career mobility. Things get murkier when the conversation is opened up to people who are just trying to survive.

Yes.

And whistle blowers. And double agents.

It doesn't need a well defined evaluation scheme. You're the one asking the question, you can provide your own scheme, and come up with your own answer. Whether you're honest with yourself in this process is up to you.

It's still useful to point out that IF you think your company is bad THEN you should do something about that. It establishes that "I was just following orders that I know are wrong" isn't a valid excuse (e.g. like if you end up in court for something you did on the job).

> the answers we give are rounded according to our own values

I agree with this entirely.

And rounding does not change the answer in most situations.

Something that isn't well-defined can still be mostly-defined.

I have no idea what the point of that strawman is in your last paragraph. It doesn't make sense with or without rounding. Maybe if you round every single value to infinity, but that's not what "rounding" normally means...

> Asking if a person or a company is good or bad isn't a question that can ever have a well-defined answer: the answers we give are rounded according to our own values.

Counterexample:

Was Hitler bad?

I mean Ticketmaster’s current best practice seems to be NFC tickets stored in a mobile wallet which do work offline

> I refuse to keep buying inkjets I only use a couple times a year.

Laser printers are the solution, and Brother laser printers seem to remain the most highly-regarded.

No, you actually can’t for the tickets the article is talking about. This is increasingly common. It’s insane

> Tho nowadays that means a trip to a FedEx store for me

I've really appreciated my local library for allowing 20ish pages of printing per day, which has allowed me to limp through the no-printer lifestyle. Plus I usually grab a DVD movie while I'm there.

Life's good in the mid-2000s.

Laser printers have solved this - I don’t expect to change the toner for a decade.

Stop buying overpriced ink jets. I get knock off laser cartridges for cheap and they last a couple years each. I did have to push a few random buttons on my Brother to let me do it, but it works now

Well there is an 8 year delta between your timeline and the OPs... so I don't see any contradictions here.

Glad to hear their security has improved since then! This was the 2014 Commonwealth Games and I had only recently learned about password hashing so I was particularly shocked that they were exposing passwords to thin clients used by front line employees.

As an engineer within Ticketmaster, I'd be curious to hear your take on the conclusion of the article.

> I think we can all agree: Fuck TicketMaster. I hope their sleazy product managers and business majors read this and throw a tantrum. I hope their devs read this and feel embarrassed. It’s rare that I feel genuine malice towards other developers, but to those who designed this system, I say: Shame.

> Shame on you for abusing your talent to exclude the technologically-disadvantaged.

> Shame on you for letting the marketing team dress this dark-pattern as a safety measure.

> Shame on you for supporting a company with such cruel business practices.

> Software developers are the wizards and shamans of the modern age. We ought to use our powers with the austerity and integrity such power implies. You’re using them to exclude people from entertainment events.

> Have fun refactoring your ticket verification system.

I wasn't talking about having the choice of using another agency, Ticketmaster is predatory and this is a problem.

I was talking about using Ticketmaster (for the lack of other choice) but using one of the more consumer friendly services Ticketmaster appear to provide. I am sure Ticketmaster won't mind, they get their share anyways.

What I wanted to say is that Ticketmaster may be responsible for your ticket costing $70 and not $60, but for all the other bullshit, they just do what is asked of them (by the artists, venue, event organizers, etc... maybe even the fans themselves). Or at least, that's how I think it is.

Just recently dealt with this for a big Ticketmaster event. The Apple ID has to match the email address on the Ticketmaster account, or the ticket will show as Void in the Apple Wallet.

But it does solve the offline issue that the blog author was experiencing.

So items inside google/apple wallet don't need to be 'static'?

...or just let us print g*d@mn paper tickets.

What is the worst that can happen? I have it installed on my iPhone and deny whatever permissions it asks for.

I have enough confidence in the sandbox that "installing an app" is basically never an issue (though I don't out of the principle that most things companies have apps for just shouldn't be apps).

You don't trust your OS to sandbox it? With a threat model like that, I wouldn't use any apps other than the browser

Well, as it also notes, it works offline if you remember to open the ticket before you get there, and they don't (or at least didn't used to) give you sufficient warning. I found out that's how it works the hard way when it was new by having to walk a half mile back from the venue to get service to load the tickets.

There's also the chance the ticketmaster app won't work properly later even if you did do it. I've had other apps shit the bed for no apparent reason in offline mode before. I add them to my wallet now just in case.

Pleas notice the "completely" in my comment.

I’ve never been clear what the main purpose of these things is but they do seem to get deployed for trade shows and such. Maybe for natural disasters?

Then there are microcells, which can be privately owned. I worked at a place that had one when I was in mobile. There was a period of time when one of the carriers would sell you one if you were having connectivity issues. It’s possible for instance, living on a hill, to have a cell signal on your roof but not in the rest of the house and they can work as a repeater.

>Ticketmaster has a system for transferring tickets, if you want to buy or sell tickets

Sure, and it is terrible.

They can block you from transferring the ticket you bought, and can set a minimum resale price (effectively ensuring you cannot recoup anything)

You should to own what you purchase, simple as.

> "The risk with printable tickets is..."

This is terrible - right now the random 17 year old middle-class kid at least has a small chance of getting a somewhat reasonably priced ticket to a popular show. In your model, they have zero chance.

Auction models are good for price discovery but this isn’t a price discovery problem, it is a supply problem. Believe it or not, artists don’t always want to maximize revenue from a ticket, they want fans from lower income brackets to be able to attend as well.

but how would the artist continue to pretend to be close to The People?

And (and I think you were implying this), Ticketmaster giving themselves complete control over the still existing scalping market which they use to boost their own profits without any benefits over the standard scalping market (arguably also including further downsides).

> What do you want, planned economy?

Every world economy is a mix of a market system and a planned economy. No economy is a pure market or a pure planned economy.

> bootstrap new legit users

Phone number? The friction/expense of a scalper getting a new one for every sale would seem sufficient. Although I guess the scalper could reclaim (via password reset or whatever) accounts after the show to some extent.

You can do time-based binding. Many TLS/Quic 0RTT take this approach; where the signature is only valid for a second or so. It's not as good as a real strike register, but probably ok for this kind of environment. Of course the barcodes would need to be more dynamic, but that's doable.

OK, but the "first sale" doctrine really just says that copyrighted works are like any other item that is bought and sold?

So I haven't read their fine print lately---is Ticketmaster is not selling you a ticket, but a non-transferrable license to attend the event?

You can find a bar with a band playing. I suggest Kingston Mines if you're in the Chicago area.

Ticketmaster doesn't own have a monopoly on music. You can vote with your wallet.

I agree that experiencing music is a fundamental part of human life, but experiencing specific musicians at specific venues is not. It is very easy to find free live music without Ticketmaster or online portals.

People will scream (including in this thread) that it’s “unfair” that ‘only the wealthy can afford them then’ but their beef is with scarcity and thus with reality. It’s always “unfair” to the 10,001st person who wants to attend the concert with 10,000 capacity. Today it’s a weird lottery with 6 different fan and credit-cardmember presales, which each sell out immediately, and the “backstop” at the end which is the ability to buy expensive scalped tickets.

There are finite tickets but unbounded demand. A lottery means you can slightly adjust the distribution of poor vs rich, but in practice today it still advantages those comfortable enough to sit around refreshing their computers at the right moment, instead of working. And lots of opportunists will snap up those tickets you are hoping poor people will get, to sell them to the wealthy.

In my opinion for in-demand shows it should just be a Dutch auction (all of the highest 10,000 bids win, awarded at some fixed cutoff date before the event). If not enough bids are received, the concert isn’t sold out, so then the rest go on sale for the lowest bid.

> The "true solution" is to sell tickets at their actual market price

That is *a* solution but it isn't *the* solution. The fact that many smart people are not choosing that solution is an indicator that there are some factors to the problem that you aren't considering.

> Buying something at a low price and selling it at a high price is arbitrage 101 and is free money.

A bit of a nit pick, but this isn't "free money" unless you have a guarantee that someone will actually buy at the higher price. You could buy low, be unable to sell, and end up eating the "buy low" cost.

> sell tickets at their actual market price

How do you know what their actual market price is? You have to open it up to a market, where supply/demand get to play out.

IIRC some ticketing company tried doing something to this effect by scaling prices in realtime based on how many people were also trying to buy. I believe it was widely criticized as unfair/exploitive.

So you're back to square one then, where you have to set some price.

It's interesting how the real problem here is that our economic system has no way to sell a product at what the seller will bear, only what the buyer will bear.

I think this is a fascinating feature, a lot of artists would be more than happy to make $X for a show so that their fans can come see them. The problem ends up that a free market has no mechanism for that, the artist can sell the tickets such that they end up with $X but then you get things like scalpers who don't want to see the show but do want money and act like artificial demand. They know that regardless of what the seller wants there are buyers that will pay $X+N and want to capture that $N.

The scalper provides no value to the market, but they get $N, which seems like a market failure to me. The fans lose $N, the artist still only gets $X and they also get reputation damage because fans are upset that things cost $X+N.

And that's just the end of it. The artist literally can not perform for their fans at a venue for $X even if that's what they want, there's just no mechanism in the free market to make that function correctly. I find market failures like this fascinating because it really shows the limits of how "free" markets operate. The only person that isn't free to do what they'd like is the producer of the good being sold, they literally can't sell it for less than the market will bear.

And I suppose this plays out for every part of the market, if I can produce apples and make a profit for $1 a bushel and that's plenty of money for me, I don't want any more, tough shit. Arbitrage will make sure that people pay more for those apples. If people are willing to pay $5 a bushel then someone will snap up my cheap apples, mark them up and make a bunch of money for doing nothing. Even if I were willing to do all the distribution myself, if the person conducting arbitrage adds no value to the system (the common argument being that they deserve the money for finding cheap apples and connecting people that demand apples with a supply of apples), it just can't happen. The incentive to make that free money means everyone loses, I don't get to give people cheap apples, people don't get to enjoy cheap apples, everyone is worse off except for the person doing arbitrage.

IOW the true solution to scamming is to raise prices so high that only the extremely wealthy can afford them, regardless of how accessible the actual concert/act/group/promoter wants the show to be.

The "real" solution here would be for Ticketmaster (or whoever) to actually make a ticket non-transferrable somehow, and then allow for tickets to be transferred directly through the original website for at most the original ticket price, and refund me the money.

For example, if I have a $200 ticket and I can't make it and want to sell it, I can post up a link to the original ticket seller's website (in this case Ticketmaster) where someone else can go buy it, and, if they do, I get a refund of the amount they paid. I can say how much I'm willing to accept (full price, $150, whatever) and someone can go buy "my" ticket, potentially at a loss if I'm willing to accept it. Ticketmaster can make money on these tickets by charging a non-refundable processing fee or whatever to everyone (the original buyer and any subsequent re-buyers). They make a tidy profit, everyone gets what they want.

The only complications are

1. making the tickets non-transferrable but also work offline is a difficult technology problem 2. Ticketmaster is an unregulated monopoly and thus has no incentive to behave in the best interests of the market or its customers when they could rake in millions more by screwing everyone except the scalpers

As far as I understand, this can't be done due to PR.

"evil scalpers are exploiting this poor artist by charging outrageous prices and preventing many fans from going" is a far better look than "evil artist is exploiting their poor fans by charging outrageous prices and preventing many fans from going."

To prevent scalping, you'd need a massive price increase, and very few artists are willing to be the first to do this.

The market sets a clearing price for the ticket as commodity (i.e. for a single event). However, the iterated game that is the spectator-performer relationship, the seller may _strongly_ prefer yielding some of their benefit to the buyer in exchange for long term EV, positive PR, or just plain old goodwill.

The problem is maintaining a mutually-beneficial but economically suboptimal equilibria.

The reason they don't do that is to have an organic fan base of poor people who drive up the prices for the rich people. If you eliminate the poor people, the rich people aren't going to take the band forward. They'll move on to whatever the next shiny thing is. You need a hardcore fan base of poor people to support and grow your valuation.

Buying a single-use item at any price and then selling it on at any price to multiple people is fraud.

Fiddling with the prices does absolutely nothing to fix that problem, because it isn’t a problem with price, but a problem with developing an unduplicatable token.

Ticketmaster is evil, and most resellers are fine, but some are evil and that’s a problem this at least attempts to solve.

It's only free money if there's no risk, and if there's no transaction cost to acquiring at the lower price. If there's no risk in buying something low and attempting to sell it high, then that thing is mispriced.

Nothing stops a (sufficiently motivated) developer from doing that. But it will stop a muggle.

I see what you mean. The barcode wouldn't work offline.

It seems like that didn't matter at the venue though? The spotty internet connection not allowing the code to load was the first part of the article wasn't it?

Based on the highly questionable PS/Xbox accounts sold on eBay, I think that's just what scalpers could do as part of their everyday job.

One possible reason I can think of is that phone camera apps will not proactively read PDF417 barcodes like they will QR codes, thus discouraging people from thinking they can scan and decode them.

PDF417 has non-square pixels (or rather as it's called in barcode nomenclature "modules") which feels very janky - it was meant for linear scanners after all.

Oh, and quoting Wikipedia:

In practice, a PDF417 symbol takes about four times the area of a DataMatrix or QR Code.

The thing is, unlike most of Europe, the US doesn't have a legal mandate for anyone to possess an ID card, and so in practice you got 50 states worth of driver's licenses, library cards, military or government employment IDs that can be used (or faked)... so you can't really use these for legitimately verifying anything unless you want to spend a lot of time and money to train your staff to spot fakes. Banks can do that but no one wants to do that for the goons that run security at venues for minimum wage.

OK - just general tin-foil hattery.

It's about 60% of large venues. The 80% is Ticketmaster's share of the ticketing marketplace.

There was an article in the LATimes article a few years ago with the former ceo of Ticketmaster who explicitly confirmed the above. Ticketmaster does a deal with the band to charge as much as possible and take all the negative blowback or whatever about it and then gives them a kickback.

The grandparent is implying that "Taylor Swift" and the "Evil Manager" are two sides of the same coin; they don't need to even be different people. The system lets a (big) artist extract value while keeping their public image clean. It's a shell game, and Ticketmaster plays the role of bad-guy-as-a-service.

Of course, their insane monopoly means they also get to take advantage of smaller artists, venues etc. None of this is good.

Hey now, it's 2024, anyone can twirl their evil mustache if they want to sport one. Just wash your hands afterwards.

If Britney Spears's book is to be believed, the talent can be kept in the dark.

There are a lot of journal articles about this, but here's a recent NPR story [0] and a Vox article from 2019 [1].

[0] https://www.npr.org/transcripts/154299904

[1] https://www.vox.com/the-goods/2019/7/22/20703858/live-nation...

Why shouldn't the artists get a cut of the greater-than-MSRP resale? Yeah, I realize that some pretend that the MSRP is the real price, but if anyone should get a cut of the jacked up fees, it should the people on the stage or producing the show.

There was a trial in 2009 that had Katy Perry’s contract with Ticketmaster released into the open - cannot find it at the moment but it was explicit about how many tickets would be available for her to sell etc

This is all open and documented in the upcoming prosecution by US attorney - also cannot find atm

I, too, love a good Tuvan throat death-metal band in the outer suburbs of Ulaanbaatar.

I can't confirm what they said, but TicketMaster does have a "partner" reseller program for scalpers where they have tools to help scalpers list and manage resale tickets in bulk. They also have events where they help teach scalpers how to make more money, which is good for TicketMaster since it makes even more money on secondary sales. Ticket scalping used to be illegal, and now TicketMaster is helping facilitate it.

Source: https://www.cbc.ca/news/business/ticketmaster-resellers-las-...

Scalping aside, TicketMaster is taking massive fees each time the same ticket is sold. For example, I went to an event last year and the fee was $50 on each ticket, and these were reseller tickets so TicketMaster had already taken a fee on each of those tickets at least once already (perhaps more than once).

TicketMaster also owns many venues or has exclusive deals with most large venues that prevent those venues from using any other ticket selling platform. The DOJ is currently investigating this monopoly. TicketMaster alleges it is not a monopoly since there are many smaller venues that they are not involved with.

LiveNation (who owns Ticketmaster) acknowledges that they do this with the artist's consent. https://archive.md/1JeG5

Even if it's true it's a conspiracy

> Conspiracy

> a secret plan by a group to do something unlawful or harmful.

It could be true but Ticketmaster is explainable by the purely mundane evil of a monopoly. I could be convinced but I too would want evidence.

> I still don't blame the developers, I blame government.

Yes, but I think they still have some responsibility, even if they say "I was just following orders!" [1]

[1] https://en.wikipedia.org/wiki/Superior_orders

Even government software has issues (Vienna). I paid a €100+ fine for not having a ticket, even though I spent time going through the purchase flow. I have 100s of tickets purchased. Live agent and support agent just shrugged and told me I don't know how to use the app, washed their hands of any responsibility or need for understanding.

It's like there's no way to make the software human and humans in the loop have a crutch to lean on to not behave as a human. When I contacted the dev team directly, they shrugged too. No refund.

To me it feels like software is the place where society can just exercise its cruelty and indifference, or maybe it is a reflection of society, it's probably just like humans are. What we think software should behave like is not human.

I had more pleasant experiences with London/UK train ticket edge cases and felt like the system is built to deal with user/server errors.

I mean would you say that developers who work for Facebook have crossed that line?

"Developers are blameless" is a uniquely HN take, for obvious site demographic reasons.

I see a worthwhile product as a stool with at least three legs: Technical feasibility, business viability, and ethical acceptability. Take one leg away and the stool should fail. Yet, HN commenters endlessly discuss/debate the first two and largely ignore the third. I think we all have a duty to work on projects that are ethically sound (defining that is a whole other discussion). There are plenty of companies out there and plenty of products to work on--it's not like we have to pick an evil one in order to survive and "feed our families."

> Shamans and wizards (never heard this used to describe anyone in history but let’s assume it’s just any kind of supposed magic user) were people at the top tier of their societies in terms of political power. Not kings or chieftains, but above everyone else.

I don't know where you came by such a notion; Shamans, "Wizards", witches, "wise women/men", are usually shunned from society such that they tend to live near the outskirts of towns or cities, nobody really wants to live close to them; and when "bad things happen" tend to be the first ones to get blamed for it; then they also are commonly used as scapegoats for whatever political, economic or religious effort some corrupt officials try to push.

That doesn't sound very societal top-tier to me.

We're definitely not witches or wizards, at most we are scholars or [specialized] craftsmen. "Knowledge workers" if you will. Not as unlikable as the wise folk that live towards the edge of town, and not as at risk of getting tied to a post and lit on fire because the bishop believes we commune with unclean spirits.

Are there any documented examples of societies where "magics", "shamans" or "wizards" were at the top of the hierarchy? I gotta say, I'm an avid reader of Ancient History and Anthropology and the closest I can think of is the Priest-Kings of Sumeria and your garden variety theocracy and the latter is much more of a priestly bureeacracy than anything else...

I think you don't know what you think you know. My mom is a shaman type. These types often live at the outskirts of society where no well-to-do person would like to be seen. Zero political power but enough utility to keep at an arm's distance -- further if possible while not needed.

Yeah, we are more like masons. We have useful skills that enable building impressive things, but at the end of the day we are building someone else's cathedral.

Agreed. We're the blacksmiths making armor and swords and horseshoes.

Yes I think there is truth to this. Something I have seen lately with Rust for example, is because the language is harder to learn, the discourse, tutorials, libraries are all much higher quality.

>Programmers being analogous to wizards or martial artists made more sense back when one used to need to train years or decades to become one.

You can be a shitty wizard with only one year of training, same goes for programmers.

We wouldn't. You might expect that on an indivudual level. But at a society level, I would expect any company that's doing things that are specifically allowed by our goverment (who did approve the Ticketmaster Live Nation Merger) to get their jobs filled just like any other. I think Ticketmaster is evil, another developer might not. That's fine, they're not killing people or dumping toxic chemicals into reservoirs, we can agree to disagree.

My outrage is directed entirely at the government agencies whose job it was to stop this, not the developers making a ticketing app.

It's okay to shame bad actors.

In fact, society would likely be better off if e brought back more public shaming

architect+builder+plumber.

The suits at TM couldn't build the app+backend, even if they could hire someone to maintain and replace parts of it.

Congress is useless, along with the rest of the planetary corporate-fascist oligarch facsimiles of democracy.

If software engineers united behind true ideals of freedom, we could automate the entire stack of "leadership" and raise the floor of society.

Open source implementations of:

Universal cryptographic identification

Decentralized voluntary anonymous voting, verifiable by every voter

Sovereign algorithmic monetary policy

Liquid representation

Complete digitization of all necessary information to audit any authorities, at any time

Full release of privacy for any "public official" -- service to society should be a burden, not a privilege

This, and much, much more can ALL be done with software. An entirely new paradigm of society, with freedom unalienably encoded into the fabric of the social machine.

Our rights digitized, our privacy, speech, and pursuit of happiness made into software.

I would say software may have an impact, and the thinking of this impact extends far beyond the next quarter of profits. This mindset can extend into a multi-planetary society and beyond. A continuously evolving, open source mechanism of human governance.

It was not true of this world 150 years ago that any person with sufficient learning could tap buttons to create an experience to be found in the hand of the majority of living humans.

I agree power and greed go hand in hand - absolute power corrupts, absolutely - but this bit? This is new.

Yes, "phone's wallet" actually means Google Wallet or Apple Wallet.

Stuff I add there works for me instantly every time, even with crowded venues and zero connectivity -- as long as I get it ready in advance.

(Not that I am defending this. I'd rather carry a paper ticket, since paper is more durable and far less complex than a phone is.)

The public prosecutor does not pursue cases where responsible aka coordinated vulnerability disclosure was applied. I'd say that's a legal shield of some kind at least, and it is generally also considered best practice in the industry. There's exceptions to everything but, in the general case, I'm not sure where you're getting these viewpoints from

That's exactly the same policy I apply to AGPL software. I paid for it ($0, as mandated by the developer) and it runs on my CPU.

Except for a lot of performers and venue operators. Ticketmaster is paid well to be the bad guy. They often share the fees with both the performer and the venue.