One of the saddest things about my time at Microsoft: I designed a privacy-preserving tip-jar system, where it would be possible for people to embed identifiers in their work (video file, web page, game, whatever) and any viewer (or program itself for programs) that wanted to support the system could record the amount of time spent with it and the user could decide how the reporting was scaled. Content providers would be able to tell whether the visitor subscribed to the system, but not who they were.
Users would pay either a flat fee or different tiers. At the end of a month, content creators would get a report of how many views they got and a payment. The company operating the system would have no visibility into what the users saw, but individual users would be able to get a report of where their money went. The operator would be able to de-list fraudulent or illegal providers so that their revenue shares should be discounted and they wouldn’t count.
The operator would be able to take a flat percentage for providing the payment service and any provider in the system.
Every part of was buildable, including verifiable security guarantees, with the technology available five years ago.
The problem? Microsoft would have no moat. Google would be able to trivially deploy such a system by making it a switch in their ads platform: if you are subscribed to the system, Google Ads don’t track you at all and the creator gets revenue directly. They’d be able to flip a switch and immediately opt most Play Store apps and an enormous number of web sites into the system, so even if Microsoft shipped it first, Google could dominate the market. The chief economist, correctly, identified that Microsoft would be spending a load of money to give Google a new revenue source, because a system like this is a natural monopoly.
My starting observation was that users don’t really like paying for individual things but they do like:<li>Paying a <em>known</em> and <em>predictable</em> amount for stuff that they like.</li><li>Knowing that people who created things they like are paid.</li><li>Not being tracked in their viewing habits.</li>
The system was designed to support all of these things.
David Chisnall (*Now with 50% more sarcasm!*)
npub13g…dk50d
2026-08-02 13:38:23 UTC
in reply to nevent1q…8hrw
Author Public Key
npub13gcwraghdcw9xzkg3tky24feu0lzkhtlt57wpdn58y4m4tyr9qdsxdk50dPublished at
2026-08-02 13:38:23 UTCEvent JSON
{
"id": "23f98186bfb01afcd598b84e1bf362049c78cd85fcaf2df346483e88791bb87e",
"pubkey": "8a30e1f5176e1c530ac88aec455539e3fe2b5d7f5d3ce0b674392bbaac83281b",
"created_at": 1785677903,
"kind": 1,
"tags": [
[
"p",
"0872e11215a110c30f7d340b77386b5f9fae2828c387ffe4c5684045f9c19aee"
],
[
"e",
"2de2ef1ef24996eb9d73da14c31887a2a4e8ed9da206486926f7cf098a84e46e",
"",
"root",
"0872e11215a110c30f7d340b77386b5f9fae2828c387ffe4c5684045f9c19aee"
],
[
"proxy",
"https://infosec.exchange/@david_chisnall/117026187114167861",
"web"
],
[
"proxy",
"https://infosec.exchange/users/david_chisnall/statuses/117026187114167861",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/david_chisnall/statuses/117026187114167861",
"pink.momostr"
],
[
"-"
]
],
"content": "One of the saddest things about my time at Microsoft: I designed a privacy-preserving tip-jar system, where it would be possible for people to embed identifiers in their work (video file, web page, game, whatever) and any viewer (or program itself for programs) that wanted to support the system could record the amount of time spent with it and the user could decide how the reporting was scaled. Content providers would be able to tell whether the visitor subscribed to the system, but not who they were. \n\nUsers would pay either a flat fee or different tiers. At the end of a month, content creators would get a report of how many views they got and a payment. The company operating the system would have no visibility into what the users saw, but individual users would be able to get a report of where their money went. The operator would be able to de-list fraudulent or illegal providers so that their revenue shares should be discounted and they wouldn’t count.\n\nThe operator would be able to take a flat percentage for providing the payment service and any provider in the system.\n\nEvery part of was buildable, including verifiable security guarantees, with the technology available five years ago.\n\nThe problem? Microsoft would have no moat. Google would be able to trivially deploy such a system by making it a switch in their ads platform: if you are subscribed to the system, Google Ads don’t track you at all and the creator gets revenue directly. They’d be able to flip a switch and immediately opt most Play Store apps and an enormous number of web sites into the system, so even if Microsoft shipped it first, Google could dominate the market. The chief economist, correctly, identified that Microsoft would be spending a load of money to give Google a new revenue source, because a system like this is a natural monopoly.\n\nMy starting observation was that users don’t really like paying for individual things but they do like:\u003cli\u003ePaying a \u003cem\u003eknown\u003c/em\u003e and \u003cem\u003epredictable\u003c/em\u003e amount for stuff that they like.\u003c/li\u003e\u003cli\u003eKnowing that people who created things they like are paid.\u003c/li\u003e\u003cli\u003eNot being tracked in their viewing habits.\u003c/li\u003e\n\nThe system was designed to support all of these things.",
"sig": "7751529fbb485757f8e3da10c23507ba172fdd0bdfe4a22bf38e7f653f462fc5cc008d3c4924a900a34a5c6755ec947d379b0ef9a2b9e17b24d23b50cc236b37"
}