At first I thought maybe some previous dev had set passwords for troubleshooting, saved those passwords in a password manager, and then got owned all these years later. But that's really, really, unlikely. And the timing is so curious.

Client was a small org, and two very old IAM accounts had suddenly had recent (yesterday) console log ins and password changes.

I'm investigating the extent of the compromise, but so far it seems all they did was open a ticket to turn on SES production access and increase the daily email limit to 50k.

These were basically dormant IAM users from more than 5 years ago, and it's certainly odd timing that they'd suddenly pop on this particular day.

Perhaps you overestimate the fraction of taxpayers that itemize deductions, have gig/rental/business income?

As an aside, one reason I think 230 pretty much correct is that authoritarians on both sides of the spectrum want to axe it, but for different reasons.

Consider defamation. Often, the difference between a defamatory and non-defamatory statement is truth. Expecting websites to distinguish true statements from false ones is a non-starter.

Let's say my family has a horrible experience with a youth pastor. I post about it on facebook to warn people in my community. If my claims are false, they're almost certainly actionable defamation. If my claims are true, disallowing them to mitigate Facebook's potential liability is also bad, but not in a way that affects Facebook.

The piece you link is ... weird. First, it doesn't really describe the problem it's trying to solve. Then it presents some very vague policy prescriptions like "site[s] should be regulated by sector-specific rules that apply to that particular line of business".