It would not shock me to see some Amazon IoT gadgets have a TI CC1101 chip inside them (what powers the flipper). It's a very common line of chips for wireless comms on sub-ghz bands.
That's interesting. I have a site I visit about once every three months that requires a mag key and three different keyfobs. I had been looking at this as a fun way to declutter my access into this facility.
What? That is a legitimately insane leap of logic to infer from what I said.
The TI CC series of wireless chips are _decades_ old and in use with thousand and thousands of devices. You almost certainly are surrounded by multiple CCxxxx chips _right now_ in any little wireless remote control or iot gadget. These are extremely common chips and banning the flipper because it's a hacking device or whatever is just silly since it's not any more problematic than the TI CC wireless dev boards and devices.
I mean theoretically you can make a card skimmer with pretty much any programmable interface, just like how you can make a gun out of anything that can hold gunpowder, or kill someone with anything pointy.
I'm no policy maker, but I'm sure the convenience is the deciding factor. This device allows amateurs to perform a wide range of sophisticated security breaching tasks, for example.
NFC dev boards are just as ubiquitous, they're even on your phone. An Android phone with NFC can read and write NFC cards right now too.
The root problem here is sloppy security through obscurity practices. If you use proper security like RSA certificates on NFC cards then there is no way a simple clone and replay attack (like a flipper or Android phone with NFC can do) will work, it is 100% impossible without breaking RSA encryption (which would be a lifetime achievement/Nobel prize worthy feat).
Yes, they are ubiquitous, but I guess my point is that if you market a product for a specific use-case that sellers don't want to associate with then you will probably get that your listing removed (i.e. if I have a hammer and advertise it for DIY I will be fine for Amazon, but if I sell that same hammer but call it "Murder Hammer - Best Hammer For Personal Protection!" I will have that product removed even if hammers are ubiquitous and in every toolbox. Same item different product).
As Flipper Zero is marketed as a 'hacking tool', discusses use-cases as cloning cards and acting as a 'bad USB' device, has a indie go-go page that implies that you could use it to break into car parks, I'm not entirely surprised that Amazon wouldn't want to stock it.
This doesn't mean I don't think it's a great product - I want one and I'm glad it exists. I'm just also not entirely sure I would want to sell it if I was a global retailer.
What a product is marketed as matters in these cases, for liability purposes. You can sell carving knives and not worry about people using them as murder weapons, but if you took the same knives and sold them as 'Extra-lethal murder knives, very good at killing people unlawfully', you might be on the wrong end of some lawsuits.
eta: As a non-US person, I honestly find this incomprehensible. If you've taken the customers' money and the goods have been supplied, then the middleman hanging on to that money is called theft in most parts of the world.
By having more lawyers/money and thus being able to drag it in courts until the other side is bankrupt.
(well, the underlying problem is that the US takes an extremely caveat emptor attitude to consumer protection and almost everyone in politics would rather play high stakes culture war issues than deal with boring stuff like making sure that corps can't rip people off)
No, they're threatening to hold the money of sellers who don't comply with their policy.
It's probably legal in that Amazon's seller terms already specify they can hold the money from any purchase for up to N days (say, net 30) and that they can suspend seller accounts for certain reasons. So they will have already paid the seller for orders more than 30 days in the past and the rest they can hold.
Note that they are not saying funds may be held due to this incident.
They say that the seller should check their other product listings and get rid of any others that violate policy. It's if the seller doesn't do that that Amazon says they might permanently hold the seller's funds.
Amazon isn't saying that either, it just doesn't want to be associated with it, just like how you can't buy guns at Amazon... I... assume... wait, can you buy guns via Amazon in the US?
> You can buy gun-related items like magazines and such
Magazines are banned. Some other accessories are permitted, like holsters, night vision scopes, devices to reload magazines except for those designed to reload magazines for these specific rifle cartriges: .223/5.56, 7.62x51, 308, 7.62x39, 5.45x39. Ejection port covers are banned, but butt plates are not.
Magazines keep showing up in search in the marketplace, apparently because bb-gun and airsoft magazines are allowed and it's hard to tell which are which.
Those air rifles can do more than that. In the .457 build, the marketing says the muzzle energy can reach 450 ft-lbs. Non +P 9mm has ~350 ft-lbs of muzzle energy. Even the overpressured 9mm rounds are only slightly higher than the .457.
This has me curious what muzzle energy is actually measuring. ft-lbs is usually a unit of torque, but I don't think there's any rotation in a relevant direction here?
I actually owned a couple of these to reprogram cards at university. One of them came with a piece of paper that had a link to an app that made it possible to bulk collect cards when read! It was just a random piece of paper in the box, with absolutely no instructions and it was just some random URL to an exe.
> However, not all Flipper Zero potential buyers will be upset by the Amazon ban since those selling it on Amazon were doing it at a markup. If you want to buy a Flipper Zero, you can still get one from the maker's official store, which gets restocked regularly.
In other words, all the listings were unofficial resellers, none belonged to the people behind the hardware.
Also, I can kind of see Amazon's point. Not that hardware like this shouldn't exist—I've been sorely tempted to buy one myself, because it looks like a lot of fun!—but if Amazon doesn't want to sell pentesting tools (just like they don't want to sell lock picks), that seems reasonable to me.
And I hate to admit that there is a point there. Still, Amazon brought it on itself by allowing third parties to sell on its 'market'. I guess now it is trying to clean up.
The actual source of Flipper is a Russian company. Forming a shell company in the US doesn't change that. Sadly the Flipper team is a casualty of Putins ambitions, because they seem a good team of hackers that did a good job with their product. But the platform and software updates they provide may be susceptible to Russian gov coercion, which is I suspect the risk that many are concerned about.
[edit-to-add] that issue is orthogonal to Amazon yanking it for being a tool that could be used for potentially criminal activity. but maybe added to their decision..
It's also orthogonal to the question of how they get the money. The US entity can get paid, the question is whether the US entity is able to pay Flipper employees.
I suspect sanctions and international finance laws are a bit more complex than that. It could be that a US legal entity that is fronting for a sanctioned country can indeed be blocked from receiving money, but you'd have to get a quorum of international finance lawyers to hammer out an agreement on that to have any chance of drawing a conclussion...
Yep makes perfect sense. You cracked the case! We are all so much better to have people like you on the hunt for this stuff. Please indulge us with where you see other Russian conspiracies elsewhere, I'm sure it will help us all!
I think you're misunderstanding the motive behind these rules. I don't think these bans are meant to make society safer, but instead they're meant to reduce the risk of "The Killer/Thief bought his tools and weapons off Amazon" headlines. Many of their rules are simply weird; for instance the rules permit selling a glock holster but not a glock magazine. I think this is all about balancing the risk of reputational harm with their desire to profit, not about security at all. Which explains why their enforcement of many of these rules is lackluster, having the rule officially is the most important part. If some newspaper does decide to blame Amazon for providing the tools for a crime, Amazon can at least claim to be the victim of a third party seller violating their rules.
I'm not sure the Glock holster vs Glock magazine example supports your claim at all; there are a huge number of regulations surrounding magazines around the world and even within the US that mean the same magazine legal in Montana is banned in CA, CT, NY, etc. It is far easier to blanket ban selling regulated gun parts than to try to enforce the rules for each place. I'm not aware of anywhere that Amazon is operating where a holster is a prohibited item; certainly nowhere in the US.
Maybe in the case of magazines they have legal motivation to prohibit it, but there are many prohibited firearm accessories for which that isn't a plausible explanation. For instance they forbid ejection port covers.
Also, they explicitly permit the sale of some items which have geographic restrictions, such as airsoft guns, replica and toy guns, and night vision or infrared scopes. I think these are probably all county wide restrictions rather than state specific (night vision cannot be exported due to ITAR, for instance), but I could be wrong.
This is mostly true. The out of the box functionality even with custom firmware is not spectacular. There are a lot of functions with no suggestions of why I would care to use them.
I am hopeful that this device gains enough of a following that it becomes more usable over time, because the concept is great. Even though the TVbgone has existed for decades it’s still a great party trick. And I don’t mind having a single device that can back up fobs, either.
Good thing I let my Amazon Prime subscription expire. I've found that life hasn't really been any more difficult without them. The main thing they did was reduce friction and make shipping more predictable and quick. But with password managers automating account creation and login, the friction isn't that bad anymore. And do I really need things in a day or two? Also, I found that getting products directly from manufacturers has ensured better quality.
Amazon can sell/not-sell whatever it wants, but I'm not sure what internal policy allows for selling lock-pick kits (solely intended for opening locks without a key), but not small handheld computers (multiple functions).
Do you have an example of products they allow that violate this rule?
Flipper Zero isn't just a small handheld computer. How it's marketed makes a big difference in how it will be used, and it's explicitly intended for pentesters. That's great, and I'm glad it exists, but it's perfectly consistent for Amazon to decide they don't want to sell it.
They don't allow lock-pit kits, so it's entirely consistent.
Sometimes you'll find third party sellers selling lock-pick kits using weird terms in bizarre categories with zero reviews, because they're trying to get around the policy. The listings are usually taken down by Amazon pretty quickly.
Amazon UK have many pages of lock picking sets, not at all oddly named, categorised under "DIY & Tools". The set I bought in 2019 is still on sale at the same listing.
Hopefully this HN comment thread doesn't tip them off and cause them to enforce the policy, that would be a shame.
Yup, I'm not sure how prevalent it is any more, but you used to be able to buy suppressors ("silencers") for guns on Amazon, that were mostly advertised as "lawnmower mufflers" with very blatant wink-wink descriptions, like "this particular muffler works on 9mm exhausts, and will let you mow all morning long without overly disturbing your neighbors".
I've kinda wanted one for a while, but the 3-4 times I've looked in the past, it was always sold out. And it was always listed at scalper-level prices on Amazon and ebay. I thought maybe they had stopped making the device.
I ordered one the last time they came in stock just for a rainy day. It's still in the box, untouched aside from opening to take a look. Real nice packaging. Haven't found a direct need for it yet but I am sure the time will come.
I'm like you, but mine has come out of the box. I've turned my TV on and off a few times, and test scanned a handful of my Amiibo. A fun toy, but still waiting for the use case that has me playing with it more often.
> One order can contain up to:
2 Flippers,
3 Silicone Cases,
3 Wifi Devboards,
5 Screen Protectors,
5 Prototyping Boards,
If your order violates these limits, it will be canceled.
… so why does the ui allow this order to be placed in the first place? Seems silly.
This reminds me of Pine64 not letting you order things with a battery at the same time as things without, but it will all go into your cart and just show up like they don't ship to your country or something. Insane to me they never fixed this. People came to the IRC confused over this constantly. Also it sucks you can't combine them because their shipping isn't cheap.
I got mine very early, it’s kind of neat. I do no security for my job so it’s purely a hobby thing. And although I like things like robots and raspberry pis, I’ve found myself mostly at a loss for what to do with the Flipper, aside from some fun yarns like replaying keyfobs or copying rfid tags.
And funny enough that site seems to use Amazon AWS, along with far too many others such that it exhausted my little snitch patience. Shame, sounds like a fun gadget.
The problem for me is that even the official price is extremely high. At least by EU standards. And when you include VAT. That put me off buying one. Though I work in security and we might get one for work eventually
There are two different interfaces.
One exposes the number + name + expiry over unencrypted ISO 14443 interface. Readable by any compatible reader (IE, every NFC enabled téléphone - https://www.apkmonk.com/app/com.github.devnied.emvnfccard/)
The EMV / payment interface is a different interface and fully encrypted.
Not a gimmick, but also not perfect. Probably better than nothing :) Good quick explanation by Deviant Ollam at around 7:30 in this video: https://www.youtube.com/watch?v=Qt2Gn2CoJ74
It's mind boggling how they just decided to throw basically any semblance of security completely out the window by putting NFC on credit cards for convenience.
Flipper has no mechanism to read a magstripe, so no, I don't think so. But it's possible to clone all kinds of other things. I cloned my SO's old building key (Mifare 1k classic) so she wouldn't need to "buzz" me up.
If the actual pipeline for sales goes China -> US affiliate, they avoid sanctions.
Now all the money they get from selling in the USA may be stuck in the USA until such time as the sanctions end, but there are methods more or less legal to route around that.
I recommend only buying Flipper Zero from the official source. There are too many scams out there for this device.
In many cases--like the vendors in Instagram--you don't get a device at all! You'll get a fake letter saying that your device was "seized by customs." (I imagine people who order from Amazon will receive some sort of actual device.)
Customs does seize stuff, and I've gotten those letters when buying drugs from abroad with no reason to question the seller's integrity-- they usually reshipped without incident, marking the package as something less honest the second time.
The "scam" is run by Customs themselves in that they want you to admit on record that you're importing something illegal before they release it ;)
This post kind of worked out great for me, since they've been out of stock on their main website every time I've tried to get one, but it looks like they're back now and I was able to make an order. Wouldn't have realized without this post reminding me to go check, so talk about silver linings, haha!
lol same, I have always wanted one but for the past couple of months, every time I checked they were out of stock, so I kinda just gave up until this post showed up.
Shit boys what are they going to do about those NFC phones with type-c adapters modders can just discretely turn those into skimming devices and often for less than a Flipper Zero.
eBay has also banned Flipper Zero in recent months.
I tried to sell a Flipper Zero on eBay twice. The second time that they canceled my sale, they explained it was banned because the Flipper Zero can be used to clone RFID tags.
I wonder whether someone in govt/business spoke to eBay and Amazon specifically about the Flipper Zero, or staff was proactively looking for SKUs to ban, or someone is reporting listings and then staff decides it's banned.
This has been going on for months. eBay doesn't block it from being listed, but often removes it within hours. Some of those listings will get canceled before purchase.
Some listings might sell before whatever eBay mechanism cancels listings, at least initially. But I've heard of eBay canceling sales that have already happened, regardless of whether payment happened or shipment happened.
(I bet eBay would refund the buyer's money, but it could be at least a small headache for the buyer, and a bigger problem for the seller. The buyer headache could also get bigger, if the buyer is honest, and especially if there are bureaucratic mess-ups by others who are confused by the unusual situation and suspect that the honest buyer was defrauding. Never underestimate the power of incompetence/indifference to make a shocking amount of trouble for others.)
(Side note, as someone from a startup that intentionally used unclonable/cloning-resistant tags, because we knew we needed to defend against cloning, and which is why I bought a Flipper Zero multi-tool in the first place... I suppose that eBay trying to ban electronics that can, among other abilities, clone RFID tags, is a response to legacy systems that didn't have cloning in their threat model. And/or a response to various half-baked new projects that totally ignore threats that they should know about (which is almost the norm lately). Maybe banning tools in this case is a responsible mitigation for legacy systems that can't handle current threats, and I can't fault eBay for not wanting to get involved in that mess. But it's unfortunate for people who are trying to design and build systems responsibly, yet have trouble getting the tools they need for their work.)
129 comments
[ 4.2 ms ] story [ 197 ms ] threadIt's about the software inside + the community around it.
A random Amazon Choice Bezos Zero won't work.
The TI CC series of wireless chips are _decades_ old and in use with thousand and thousands of devices. You almost certainly are surrounded by multiple CCxxxx chips _right now_ in any little wireless remote control or iot gadget. These are extremely common chips and banning the flipper because it's a hacking device or whatever is just silly since it's not any more problematic than the TI CC wireless dev boards and devices.
I'm no policy maker, but I'm sure the convenience is the deciding factor. This device allows amateurs to perform a wide range of sophisticated security breaching tasks, for example.
i.e. Selling air-duster to dust things is different to selling air-duster to get high, even if it's the same product you are selling.
The root problem here is sloppy security through obscurity practices. If you use proper security like RSA certificates on NFC cards then there is no way a simple clone and replay attack (like a flipper or Android phone with NFC can do) will work, it is 100% impossible without breaking RSA encryption (which would be a lifetime achievement/Nobel prize worthy feat).
As Flipper Zero is marketed as a 'hacking tool', discusses use-cases as cloning cards and acting as a 'bad USB' device, has a indie go-go page that implies that you could use it to break into car parks, I'm not entirely surprised that Amazon wouldn't want to stock it.
This doesn't mean I don't think it's a great product - I want one and I'm glad it exists. I'm just also not entirely sure I would want to sell it if I was a global retailer.
It's probably just not been flagged to them yet.
How is this at all legal?
eta: As a non-US person, I honestly find this incomprehensible. If you've taken the customers' money and the goods have been supplied, then the middleman hanging on to that money is called theft in most parts of the world.
(well, the underlying problem is that the US takes an extremely caveat emptor attitude to consumer protection and almost everyone in politics would rather play high stakes culture war issues than deal with boring stuff like making sure that corps can't rip people off)
Wonder if the customer can then just challenge this in a small claims court as a European (if your country has something like this.)
It's probably legal in that Amazon's seller terms already specify they can hold the money from any purchase for up to N days (say, net 30) and that they can suspend seller accounts for certain reasons. So they will have already paid the seller for orders more than 30 days in the past and the rest they can hold.
...for 30 days. Is what any reasonable human would assume.
You can still make a bank transfer to someone even though you banned them from your own platform.
They say that the seller should check their other product listings and get rid of any others that violate policy. It's if the seller doesn't do that that Amazon says they might permanently hold the seller's funds.
As in steal the money that customers paid for products that were delivered?
https://www.amazon.com/MSR90-Magnetic-Credit-Reader-Deftun/d...
Owning one of these or a Flipper Zero doesn’t make you a criminal.
You can buy gun-related items like magazines and such, and there are some things like knives that say "cannot be shipped to New York" and similar.
There are some air rifles that could incapacitate small animals: https://www.amazon.com/Benjamin-Bulldog-Sportsmans-Pack-Rifl... (3000 psi!)
Magazines are banned. Some other accessories are permitted, like holsters, night vision scopes, devices to reload magazines except for those designed to reload magazines for these specific rifle cartriges: .223/5.56, 7.62x51, 308, 7.62x39, 5.45x39. Ejection port covers are banned, but butt plates are not.
You can read these arcane rules here: https://sellercentral.amazon.com/help/hub/reference/external...
Incidentally this is the rule set under which flipper was apparently banned: https://sellercentral.amazon.com/help/hub/reference/external...
Bans: Lockpicking devices, Devices designed to duplicate a key, Shoplifting devices, Card skimming devices, Code grabbing devices, Master keys or skeleton keys.
I'm pretty sure one of those could kill a human.
Just like miles per hour can be a speed or a battery recharging measurement.
Customary units, bleh :)
I'm incredibly glad there was no metric/customary split in electricity.
How is that not a card skimmer?
In other words, all the listings were unofficial resellers, none belonged to the people behind the hardware.
Also, I can kind of see Amazon's point. Not that hardware like this shouldn't exist—I've been sorely tempted to buy one myself, because it looks like a lot of fun!—but if Amazon doesn't want to sell pentesting tools (just like they don't want to sell lock picks), that seems reasonable to me.
https://www.flipperdevices.com/
[edit-to-add] that issue is orthogonal to Amazon yanking it for being a tool that could be used for potentially criminal activity. but maybe added to their decision..
So, not orthogonal?
Yep makes perfect sense. You cracked the case! We are all so much better to have people like you on the hunt for this stuff. Please indulge us with where you see other Russian conspiracies elsewhere, I'm sure it will help us all!
> our French lawyers (for a French company, and a French account)
> PayPal Luxembourg is now claiming that the CSSF has no jurisdiction over them, because the accounts are French / HK / Australia
How are they Russian?
https://www.amazon.com/s?k=lock+pick+set&crid=28MGQBDLXRA2J&...
One a side note; banning tools that reveal weak security is the stupidest security-through-obscurity ever.
I think you're misunderstanding the motive behind these rules. I don't think these bans are meant to make society safer, but instead they're meant to reduce the risk of "The Killer/Thief bought his tools and weapons off Amazon" headlines. Many of their rules are simply weird; for instance the rules permit selling a glock holster but not a glock magazine. I think this is all about balancing the risk of reputational harm with their desire to profit, not about security at all. Which explains why their enforcement of many of these rules is lackluster, having the rule officially is the most important part. If some newspaper does decide to blame Amazon for providing the tools for a crime, Amazon can at least claim to be the victim of a third party seller violating their rules.
I think this is probably because they often have edgy shit written on them: https://duckduckgo.com/?t=ffab&q=ejection+port+cover+&iax=im...
Such ejection port covers have been the subject of public controversy: https://www.aclu.org/news/criminal-law-reform/youre-fucked-a...
Also, they explicitly permit the sale of some items which have geographic restrictions, such as airsoft guns, replica and toy guns, and night vision or infrared scopes. I think these are probably all county wide restrictions rather than state specific (night vision cannot be exported due to ITAR, for instance), but I could be wrong.
I am hopeful that this device gains enough of a following that it becomes more usable over time, because the concept is great. Even though the TVbgone has existed for decades it’s still a great party trick. And I don’t mind having a single device that can back up fobs, either.
people behind the hardware are in russia. I suspect there might be further problems sending money to russia.
I've also been spending a lot less money.
Do you have an example of products they allow that violate this rule?
Flipper Zero isn't just a small handheld computer. How it's marketed makes a big difference in how it will be used, and it's explicitly intended for pentesters. That's great, and I'm glad it exists, but it's perfectly consistent for Amazon to decide they don't want to sell it.
https://www.amazon.com/Relnemul-Outdoor-School-Locker-Brass/...
https://www.amazon.com/Performance-Tool-5Pc-Hook-Pick/dp/B0B...
Search for lockpick shows this:
https://imgur.com/a/Qgg73av
Might be US thing tho
I mean so can a lockpick, but just a lockpick won't start a car these days and if you just want to get into a car, a brick also works.
Sometimes you'll find third party sellers selling lock-pick kits using weird terms in bizarre categories with zero reviews, because they're trying to get around the policy. The listings are usually taken down by Amazon pretty quickly.
https://imgur.com/a/Qgg73av
Hopefully this HN comment thread doesn't tip them off and cause them to enforce the policy, that would be a shame.
I've kinda wanted one for a while, but the 3-4 times I've looked in the past, it was always sold out. And it was always listed at scalper-level prices on Amazon and ebay. I thought maybe they had stopped making the device.
… so why does the ui allow this order to be placed in the first place? Seems silly.
This is an unencrypted interface supplied by the cards, which means it is readable by any NFC-enabled device (including any android device...)
This interface is different from the EMV (payment) interface, which is encrypted. The Flipper cannot clone EMV cards.
The problem here is that cards transmit their card info to anyone who asks, not that Flipper is a malicious device.
The EMV / payment interface is a different interface and fully encrypted.
Web site shows a Delaware address but all job ads are in Cyrillic.
Now all the money they get from selling in the USA may be stuck in the USA until such time as the sanctions end, but there are methods more or less legal to route around that.
In many cases--like the vendors in Instagram--you don't get a device at all! You'll get a fake letter saying that your device was "seized by customs." (I imagine people who order from Amazon will receive some sort of actual device.)
https://www.reddit.com/r/flipperzero/comments/y27qi4/importa...
Customs does seize stuff, and I've gotten those letters when buying drugs from abroad with no reason to question the seller's integrity-- they usually reshipped without incident, marking the package as something less honest the second time.
The "scam" is run by Customs themselves in that they want you to admit on record that you're importing something illegal before they release it ;)
Yes, I'm sure. People were getting letters on badly reproduced letterhead with mispellings
I tried to sell a Flipper Zero on eBay twice. The second time that they canceled my sale, they explained it was banned because the Flipper Zero can be used to clone RFID tags.
I wonder whether someone in govt/business spoke to eBay and Amazon specifically about the Flipper Zero, or staff was proactively looking for SKUs to ban, or someone is reporting listings and then staff decides it's banned.
Meanwhile...
https://www.ebay.com/itm/185771423356
https://www.ebay.com/itm/403393330921
And there are others, including multiple ways to build one using generic hardware that they have no way to block without harming their own business.
I see many Flipper Zero listings, both current and sold. <https://www.ebay.com/sch/i.html?_from=R40&_nkw=flipper+zero&...> Maybe the ban has been lifted?
Some listings might sell before whatever eBay mechanism cancels listings, at least initially. But I've heard of eBay canceling sales that have already happened, regardless of whether payment happened or shipment happened.
(I bet eBay would refund the buyer's money, but it could be at least a small headache for the buyer, and a bigger problem for the seller. The buyer headache could also get bigger, if the buyer is honest, and especially if there are bureaucratic mess-ups by others who are confused by the unusual situation and suspect that the honest buyer was defrauding. Never underestimate the power of incompetence/indifference to make a shocking amount of trouble for others.)
(Side note, as someone from a startup that intentionally used unclonable/cloning-resistant tags, because we knew we needed to defend against cloning, and which is why I bought a Flipper Zero multi-tool in the first place... I suppose that eBay trying to ban electronics that can, among other abilities, clone RFID tags, is a response to legacy systems that didn't have cloning in their threat model. And/or a response to various half-baked new projects that totally ignore threats that they should know about (which is almost the norm lately). Maybe banning tools in this case is a responsible mitigation for legacy systems that can't handle current threats, and I can't fault eBay for not wanting to get involved in that mess. But it's unfortunate for people who are trying to design and build systems responsibly, yet have trouble getting the tools they need for their work.)