Who should be shamed, and who not? - <AUTHOR> http://marginalrevolution.com/marginalrevolution/2017/08/misgivings-tone-emphasis-headed.html <comment><USER2> Shaming people doesn't change their behaviors, it just hurts them and makes them hostile to you. It's always counterproductive. If you want vengeance for something there are more satisfying ways to hurt someone, if you want to cause change shame is the wrong way to go about it.

<comment><USER3> Shaming is a deep-seated evolutionary mechanism to somewhat gently encourage people to conform to the norms of society. It works pretty great on almost everyone.

I'm also wondering why HN is having dozens of articles hit the frontpage defending white supremacists. I distinctly remember a general agreement of get-a-job when Occupy Wall Street was forced off the streets by police.

<comment><USER4> _Dozens_ of pro-white supremacist articles? Please provide links. I haven't seen a single one.

And I don't know what that has to do with OWS or the feeling that they should get jobs.

<comment><USER5> > Dozens of pro-white supremacist articles? Please provide links.

Some people conflate defending the free speech rights of white supremacists as being pro-white supremacist.

<comment><USER4> That's why I asked for links - I simply don't believe there has been even a single pro-white supremacy article.

<comment><USER6> I hesitate to comment because I don't think this conversation is productive. But I'll stray in. Your request for links is strange because Matt never said there were pro-supremacy posts. He said there were posts defending white supremacists. You have conflated the two concepts.

<comment><USER7> Defending the right to free speech for everyone is not the same as defending white supremacists, so it sounds like you are the one conflating two concepts.

<comment><USER6> My apologies if I gave you this impression. I only tried to clarify what was in Matt's post. I didn't think I was making any positive claims myself, but apparently I gave that impression. I'm sorry to have posted in this conversation and I wish I could delete my comment. I feel very sensitive to receiving downvotes.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I guess I view extreme-right-wing ideologies like opioid abuse: We know that criminalizing drug abuse doesn't really solve the problem.

<comment><USER9> I find the sweeping generalizing of groups that people are directing their hate towards to be incredibly toxic.

The Boston protests (for example) were purely about Free Speech: [http://i.imgur.com/abhmjW8.png](http://i.imgur.com/abhmjW8.png)

Yet thousands of protesters show up, shout slurs and weave their own narratives that the protesters are nazis which then justify their directed hate.

It's disgusting: [https://www.reddit.com/r/AskThe_Donald/comments/6utjoi/anyon...](https://www.reddit.com/r/AskThe_Donald/comments/6utjoi/anyone_attend_the_boston_free_speech_rally_share/dlvkv0d/)

It's just mobs justifying hate, its the most ironic shit I've ever seen. It just fills me with more discontent and distrust of the majority and the mob.

Idiocracy is getting less and less satirical by the day.

<comment><USER10> You're upset because other protestors showed up and exercised their right to free speech? Sorry you're disgusted, but it's free speech, you know.

<comment><USER9> I'm not disgusted by their right to do it.

I'm disgusted with the lack of critical thinking it represents.

<comment><USER10> So, it's OK if they think as long as they think the way you want?

</comment></comment></comment></comment></comment><comment><USER11> In today's never-forget internet, shaming has become a lifelong death sentence. There is no escaping it.

<comment><USER12> That's a bit of hyperbole. There are clearly those that are able to live fruitful lives after being shamed. Americans especially love a comeback story. There are numerous people that have done stupid things and come back from them, a pretty public one is Robert Downey Jr.

<comment><USER13> From [https://en.wikipedia.org/wiki/Robert_Downey_Jr.#2001.E2.80.9...](https://en.wikipedia.org/wiki/Robert_Downey_Jr.#2001.E2.80.932007:_Career_comeback) :

> Downey was able to return to the big screen only after Mel Gibson [...] paid > Downey's insurance bond

> [...] for which producer Joel Silver withheld 40 percent of his salary until > after production wrapped as insurance against his addictive behavior. > Similar clauses have become standard in his contracts since then.

He's going to carry this stigma for a looong time. If he were only a supporting actor without influential friends he wouldn't be worth the risk; he'd have been fucked.

<comment><USER14> I was completely unaware of Robert Downey Jr's drug-addled past - I just knew him as Iron Man and Sherlock Holmes. I think the public's memory may be a lot shorter than yours.

<comment><USER13> The problem isn't the audience, it's every employer he'll ever have.

</comment></comment></comment></comment></comment><comment><USER15> The article makes many good points. There doesn't appear to be a line -apparently- in who gets shamed. Nor is there an innate male need to shame others (or at least I've seen both men and women do it, white, black, yellow, Indian, ...).

Even when you look at Nazis you will see a lack of historical consistency : shaming Nazis was impossible in polite company until something like 1941. It was possible when the Nazis were only in a few cities and not yet even a German movement, but by the time they had grown internationally to become an important part of international socialism, they were unassailable. Granted the exact point where it became possible varies somewhat depending on where you were, but not that much. Most socialists accepted Nazi control of France, for instance, as a prelude to a reorganization into a socialist state of that country. That is a viewpoint you find defended in New York newspapers in 1941 ... and there ideas were just the same back then. Kristallnacht had happened and was widely known and reported on and reports of state "disappearances" had leaked, some were well known. But that didn't matter. What mattered, it seems, is the opening of the second front against the Soviets. It is very clear that that was were the Nazis lost their victim status (I'm not kidding, they always played the victim card. I'm even willing to say that in some cases they rightly did so. Certainly a few of their grievances were legitimate)

Likewise communism and even to a lesser extent the Soviet system was unassailable in Western press until it was very clear (mostly through the Berlin wall) that the Soviet bloc was crumbling. It was still very powerful when criticism started, but it was clearly on the way down at that point. And criticism grew stronger the weaker the Soviets became. Coincidence ? I think no.

So I submit there is one line that I truly feel is a line in who we shame. It's the only line that I've consistently seen applied :

We shame the weak.

Those that either can't, or to a lesser extent those that for some reason won't, defend themselves against the shaming.

If there is a serious risk of getting attacked in the street, we don't shame ideas. That was true of Nazi ideas in the runup and early phases of WWII, and is equally true today.

We can name plenty of ideologies that have extremely unacceptable ideas and components. Ideologies that have historically or even contemporarily committed genocide and may even deny doing so (a certain EuroAsian state comes to mind), and yet ... no shaming. Religions and ideologies with laws that are racist, sexist, and frankly disgusting are a dime a dozen, and all the big ones of course have this. And let's just shut up about the role models of ideologies. Jesus may not have killed and even prevented others to lift a sword on his behalf, but to say that this is uncommon behavior is ridiculous. There is no one else who's done so. Most religious leaders demanded the opposite: that their followers fought, commit genocide and died on their behalf. And yet very little criticism, and even that little bit is getting attacked.

So, reality, sadly, is very simple: we shame, and otherwise victimize, the weak. This is the very same impulse that causes racists to attack others.

<comment><USER8> We (the outside world) didn't really know the extent of the holocaust until after WWII. The Nazis were very good at keeping it a secret from the civilian Germans.

Did 1941's New York really know what the Nazis were doing? I just don't know enough about history to know what was known.

<comment><USER16> It was a capital offense to discuss to spread rumors about the camps, whether or not they were true.

</comment></comment></comment><comment><USER17> > What if sexual bullying lies deep in male DNA? Not for everyone of course, > but for some people.

This is a _deeply_ ignorant question. There are plenty of pleasant little sub- cultures in those more progressive parts of the world which for decades-- if not centuries in some places-- have codified their own approaches to this problem (regardless of whether it comes from DNA or learned experience). I'm not saying they are perfect in any way. But the problems these sub-cultures deal with are several levels above the beginner's question of what to do if some people happen to get pleasure out of inflicting pain.

<comment><USER8> A think a different way to see the article is, "condemn the behavior, not the person."</comment></comment>


This could save you from ISP who sells your personal activity online - <AUTHOR> https://github.com/nikshepsvn/py_noise <comment><USER2> IIRC there was a project to swap tracking cookies with random strangers to mess up with all kinds of analytics.

</comment><comment><USER3> The ISPs will be selling Web sessions, identified by cookies. The traffic from pyNoise does not mix with the browser session and will appear separate.

It appears it might be better to enable private browsing (aka incognito mode) in order to make your browsing session as short (and unidentifiable) as possible.

</comment><comment><USER4> There are no sources for the drivers. It is very problematic to run untrusted code.</comment>


LastPass Security Notice - <AUTHOR> https://blog.lastpass.com/2015/06/lastpass-security-notice.html/ <comment><USER2> While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk.

If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one.

Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which you have no control seems inherently risky. Lastpass is a huge target, and while I believe they generally take reasonable security measures, for many the risk of compromise may be greater than an encrypted stand-alone password database. Use a password manager, please, but keep it offline and don't aggregate it with loads of other people's databases.

This is one area where I feel strongly that the conveniences of 'Cloud' are outweighed by the risks.

<comment><USER3> But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting _numerous_ third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it.

I agree with you that an offline password manager is better in theory. But the problem is that I am aware of no such service that is easy to use across numerous devices, so much so that none has struck me as a viable option given my patterns of usage. Maybe there are people out there who will accept much more inconvenience in exchange for avoiding the risk associated with a cloud- based service. But, for me, the inconvenience is simply too much.

So the choice once more, for me, becomes cloud-based password manager or no password manager at all.

(Though if you've found a good option, that will allow me to easily sync across my home desktop, laptop, office pc, tablet, and smartphone, without using the cloud, I would absolutely love to hear about it! Maybe something Bluetooth based?)

<comment><USER4> My compromise has been to come up with a password permutation scheme-- I have a long, secure, high-entropy password which I can modify/salt in a way that's predictable (to me) across sites, such that each site's credentials are unique. Obviously this works across all devices, because the scheme is in my head, and it's simple enough to remember. I don't use any password manager, because like OP, that seems like too much of an eggs-and-baskets risk for my taste.

A catastrophic compromise would require an attacker to see actual credentials (not just the hashes) across many sites, and on top of that reverse engineer my specific permutation scheme. This seems much less likely to me than a very public, high-profile centralized cloud service forgetting to cross a T somewhere and getting hacked.

<comment><USER5> If your password for foo.com is foo-hunter2-XYZ and your password for bar.com is bar-hunter2-XYZ, you've got problems.

<comment><USER6> But if your password for foo.com is 10,000 rounds of PBKDF2-SHA256(foo- hunter2-XYZ) and so on, this is extremely effective.

<comment><USER7> Yeah that would be nice. I actually think browsers should have this as a feature.

But the problem is that not all websites accept long passwords. My bank wouldn't take longer than 8 characters and doesn't even have a second factor auth.

Office 365 wouldn't accept more than 16 characters. I think it was Paypal who wouldn't take more than 10.

<comment><USER8> Be happy, one of my banks has a 6-digit numeric PIN (I shit you not) as their "security".

<comment><USER9> Banks also lock the accounts after 3 failed attempts though. The short passwords are to avoid having to deal with phone calls that go something like, "Hello, I forgot my password."

<comment><USER7> Overlooking 6 characters vs 20 over a shoulder is must easier though.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> See quite a few nods to 1Password in here, which is good, although I tend to favor KeePass myself, given that it's FOSS.

It also has a way better Firefox add-on than any of the others I've seen (which is my main browser), and the Android apps, if unofficial, aren't bad either [0]. Importantly, they feature the ability to either pull from a local Keepass DB or to get it from a connected Google Drive account. I've taken to using the latter to make sure my database is synced across all my devices.

At this point it works fairly well across everything I use, with the one exception that trying to keep the database synced on my Windows box requires an extension that looked a tad shady to me [1], so I opted to simply manually upload a new version each time instead.

[0]: [https://play.google.com/store/apps/details?id=keepass2androi...](https://play.google.com/store/apps/details?id=keepass2android.keepass2android)

[1]: [http://keepass.info/plugins.html#kpgsync](http://keepass.info/plugins.html#kpgsync)

<comment><USER11> I don't understand why 1Password's approach to the cloud - syncing via Dropbox or Google Drive - is considered that much more secure than LastPass. If anything relying on Dropbox has always seemed to me to be a huge liability

<comment><USER12> If you wanted security, you'd use a SHA256 hash of a master-password + domain name.

[http://angel.net/~nic/passwdlet.html](http://angel.net/~nic/passwdlet.html)

Storage is unnecessary. LastPass, 1Password... every one of them has centralized storage. No one needs a central server, but a central server is the only way a "service" can sell itself.

<comment><USER13> There are multiple problems with this approach. SHA is way too fast, some site is always going to have Auth requirements that won't be the same as the ones you have set (one service wants mandatory special characters, one wants mandatory alphanumeric only), and, most importantly, you can't change the passwords unless you change the master password and remember which you used where.

<comment><USER12> Fair point. But proper key strengthening is a well-known solution to this well-known problem. The general methodology of using password-safe hash + master password + domain name is useful.

As you note, SHA isn't appropriate for this purpose. PBKDF2-strenghtened SHA, SCrypt, BCrypt and other functions should be used.

<comment><USER13> I agree, I wish browsers performed some key strengthening built in.

</comment></comment></comment></comment></comment></comment><comment><USER14> I don't use LastPass, but one thing that impresses me about their blog post: they didn't hide behind "your passwords are hashed" or something equally weaselly, but instead said exactly and clearly how passwords are hashed. Every online company should take note.

<comment><USER15> I would however appreciate more detail on the breach. This would at least give an indication of their general security posture.

I'm reading this as an embarrassing security lapse in general security, so they misdirect by talking in depth about password hashing.

<comment><USER2> I would also appreciate more detail, but that shouldn't be their first priority.

They note that they discovered the breach on 'Friday' so I imagine they have an ongoing Incident Response right now. They may not have or be ready to share this information at this time, and that's fine. They might be working with law enforcement, further hardening systems, and continuing to confirm their findings to date to ensure they've mitigated the full impacts.

What's important now is conveying how users are impacted and what steps they should take to protect themselves; hopefully the rest comes in time.

<comment><USER16> Another pain point is the delay from Friday's discovery to Monday's disclosure. While it's better than the sometimes _weeks_ other companies have taken, it screams of the discovery happening at 4pm on a Friday, and everybody then saying "bah fuck it, go home for the weekend, we'll work on it Monday". A security compromise like this should have been made known by Saturday at the latest, and worked on over the weekend. 3 days is a long time for leaked passwords to go unnoticed to users, regardless of the encryption scheme being used.

<comment><USER2> I feel like that's a reasonable timeframe from 'hmm, something is odd' to 'we're pretty sure we fully understand the impact, time to notify users.'

There's a balance between early notification and misstating the impact.

</comment></comment></comment></comment></comment><comment><USER17> No mention of pass?

[http://www.passwordstore.org/](http://www.passwordstore.org/)

gpg password storage. Synchronization with rsync.

Beats the heck out of proprietary cloud hosted software.

<comment><USER18> I like pass a lot and it's pretty darn convenient and fast. It's my password manager of choice. GPG encrypted text files, simple, secure.

</comment></comment><comment><USER19> Do they know how they were compromised?

<comment><USER2> "Answer unclear, ask again later"

<comment><USER19> I get why they can't provide details. But a close read of that incident report doesn't answer whether they even know how it happened. Did I miss something?

<comment><USER20> With these types of incidents, you want to make sure you have the facts before you make claims. They are probably doing tons of investigation to figure out what actually happened. This could be difficult depending on the level of sophistication of the attackers.

If LastPass says "Attackers took everything" when the attackers only took a few non-identifiable pieces of info; it will be a huge non-recoverable media event about attackers taking everything even if it's not true.

If LastPass say "Attackers didn't do anything" but stole a lot of sensitive info, then it makes LastPass look incompetent.

This is really a situation where they need to understand the scope of the situation before making a detailed comment.

</comment></comment></comment></comment><comment><USER21> I've been using LastPass for a while now, but I was recently evaluating the landscape for something more open. I came across Mitro[0], and it looks like it fits the bill. Unfortunately it doesn't look like it has been much maintained since its open-sourcing last year.

Mitro checked a lot of boxes on my checklist, so it's a bit disappointing that it has a smaller community.

[0]: [https://www.mitro.co/security-faq.html](https://www.mitro.co/security- faq.html)

</comment><comment><USER22> I'm now too paranoid for lastpass ever again.

Sandstorm made setting up a private gitlab about a 5 second thing. I'll just checkin gpg encrypted textfiles once more.

There's a bunch of shell scripts called pass [http://git.zx2c4.com/password- store/](http://git.zx2c4.com/password-store/) which know about gpg, git and this format of text files. There's browser and android plugin as well. Amusingly it has basic import/export from every other password manager. I exported from lastpass and now all I have to do is switch to a new gpg key and buy all new hardware

<comment><USER23> Excellent. I've used this for the last 3 years. The mailing list has a good community.

</comment></comment><comment><USER24> I just deleted, regenerated, and re-associated Google Authenticator and then altered the number of iterations from 10,000 to 10,001 (causing it to re- encrypt the database). None of this is really required but it has invalidated much of the information they could have stolen.

The thing that really bugs me about this, is the email address. I have a very low spam level on that account (sub-1 per day on average) and I want to keep it that way. Last thing I need is someone to dump this theft onto a Pirate Bay-like site and then to get spammed by everyone and the kitchen sink.

<comment><USER25> How will that invalidate the info they have?

<comment><USER26> I presume he is under the assumption that the secret seed to the OTP algorithm was compromised.

By disabling / deleting your OTP token and re-adding it, you are essentially re-generating this seed.

I am not sure I understood the comment "altered the number of iterations from 10,000 to 10,001 (causing it to re-encrypt the database)", care to elaborate @Someone1234?

<comment><USER24> LastPass double-hashes (ignoring iterations) master passwords. It has a client component based on PBKDF2 and a server component (per this article) also PBKDF2 based.

If the bad guys stole the hashes after they were hashed by LastPass's servers then changing the client iterations wouldn't do a damn thing. However because LastPass have an unknown network compromise one could worry that the bad guys intercepted LastPass client-hashed passwords between the client and server.

IF they modified the LastPass client, they could have it send LastPass's servers the already client-hashed password and therefore login even without knowing someone's plain text master password.

By altering your account iterations even by 1, you've now effectively forced them to decrypt the client hash (to plain text) before they could use it to login to LastPass's servers.

Again this only helps if they intercepted network traffic on LastPass's internal network.

PS - The OTP thing is as you said. PPS - A better idea is just to change your master password.

</comment></comment></comment></comment><comment><USER27> I've learnt a lot reading this thread. Thank you all.

But I can't believe almost everyone here, talking about security, is talking about Dropbox even as a hypothetical cloud option for storing password related info.

\- Dropbox (and most of the other cloud storage services) do not encrypt your data, or if they do now as they claim, with SHA256, I'd say they must be able to decrypt it whenever they want to, as they give you the "Did you forgot your password" option to change it, so they have to be able to decrypt it and encrypt it with your new password o whatever they use to encrypt) and they hired ¡Condoleeza Rice! for their board of executives (she puts "national security" over any privacy so...), so you can count any worker at Dropbox can peep at everything you upload whenever they want to.

Of course you'll think: "I'm not a terrorist, I don't care." Well, if a worker can take a look, and you don't even know him... The threat is quite clear to me.

MEGA, for example, does encrypt everything you upload taking as seed some derivation of your password, but they DO NOT store your password, so they can't ever decrypt it for themselves. Probably no one could know even the names of the files you have uploaded unless they already had your password (of course, if you lose it, you lose all of the files uploaded!!! Beware!!!).

I rather trust MEGA than Condoleeza's (big-brother government) Dropbox, seriously.

There must be other cloud storage services which encrypt data not storing enough info to decrypt it without your input. I just stumbled upon MEGA and liked the synch app.

<comment><USER28> sync.com

</comment></comment><comment><USER29> "Service as a software substitute"

[http://www.gnu.org/philosophy/who-does-that-server-really- se...](http://www.gnu.org/philosophy/who-does-that-server-really- serve.en.html)

</comment><comment><USER30> If you are using LastPass without 2FA (YubiKey, etc), people attacking LastPass itself is really the least of your problems. I'd be much more concerned about keyloggers grabbing your password. BeEF can pop up a LastPass phishing prompt if you just happen to load the wrong javascript file.

Using just one string of characters to protect ALL of your passwords is insane.

<comment><USER31> > If you are using LastPass without 2FA

There is no 2FA with LastPass.

Don't believe me? Set up a LastPass account and turn on 2FA. Go log in on an untrusted browser. Enter your password. At the 2FA prompt screen, there is a giant red "If you lost your Google Authenticator device, click here to disable Google Authenticator authentication" link.

That's right. They give the attacker the option to disable 2FA for your account.

<comment><USER32> They send you an email and only with the link in the email can you login. Email is the second factor here.

</comment></comment></comment><comment><USER33> Slightly off-topic: am I naive to believe that my personal system of password management is just about as good something like 1Password or LastPass? Hear me out. My passwords are generated as follows:

[Low|Med|Hi] + [Key] + [Initials] + [Number]

Low|Med|High = One of three keys based on how sensitive the site is. High: banking / work / email, Low: I don't trust the site, Med: other.

Key = Random string that only I know, with the most important accounts having a unique string

Initials = Initials of site name based on domain name + TLD, with the initials moved up x letters (for example, capitalone.com -> COC -> DPD)

Number = One of three random sets of numbers I use. Sometimes I forget which number I use for each site, but I can figure it out after a few incorrect attempts.

This means a unique password for every site generated by a system that only I know with no central storage except my brain.

What is wrong with this? What would be the advantage to using 1Password / LastPass over this?

<comment><USER34> > What is wrong with this? What would be the advantage to using 1Password / > LastPass over this?

My Keepass database currently has 221 entries in it. Some of these I only use once per year. There's no possible way for me to manage that without a program to help me record them.

</comment></comment><comment><USER35> Password reset page is down:

"Oops! Our servers are a bit overloaded right now.

Please try your password change again shortly, we will catch up soon."

<comment><USER26> I am sure they are just overloaded with legitimate requests. But it that would be pretty interesting if the attackers first stole data from their servers and promptly followed this attack with a DDOS attack to their password reset endpoints!

<comment><USER36> Imagine if the blog post was malicious and the password reset endpoint was actually a honeypot to collect your master password?

No thank you, I'll trust the encryption to do its job. Don't see how changing the master password is going to help any.

</comment></comment></comment><comment><USER37> Oh great, just the day before yesterday I finally jumped to LastPass (because obviously WinKee is not compatible to my new Lumia phone), using my best password (long, no real syllables, memorized).

It sounds like the password is still safe enough, but it's a very unfortunate, inconvenient timing indeed.

<comment><USER38> Try 1Password.

<comment><USER37> I did just quickly evaluate it on my iPad (got it in some promotion ages ago), but it didn't "click" with me.

OTOH I'm not terribly sold on LastPass's UI, either.

I don't know, but I'm going to sleep a few days over it and check out my options on the weekend. This isn't an "everything's on fire" event, anyway.

<comment><USER39> LastPass's UI is one step up from atrocious, but I stuck with them because it works, is convenient, and doesn't charge me per-OS/device. :/

</comment></comment></comment></comment><comment><USER40> Why not just use KeePass? It seems to work great. A bit less convenient, but overall a nice option.

<comment><USER41> > A bit less convenient

This is why I use Lastpass.

</comment></comment><comment><USER42> Hi, creator of StrongBox Password Safe ([https://itunes.apple.com/us/app/strongbox-password- safe/id89...](https://itunes.apple.com/us/app/strongbox-password- safe/id897283731)) here. I think LastPass have done a pretty good job of being upfront and honest about their techniques and have a handy little product. Comments above mention the centralised nature of storage and indeed it is an issue as it becomes a real bullseye for hackers. Ultimately it's a tradeoff between convenience and security. For what it's worth my app uses the standard Password Safe format ([http://passwordsafe.sourceforge.net/](http://passwordsafe.sourceforge.net/)), designed by Bruce Schneier. It can store your encrypted password databases locally on device or on Dropbox or Google Drive. This can be easily exported or imported. An added bonus is you can store other tidbits of information in there, notes of any kind, not just passwords. Might be useful for those of you with more stringent security in mind, or more general encryption requirements. It's also free.

<comment><USER43> I like Bruce. I trust Bruce. However, as far as I can tell, this is a black box. There is no documentation on formats, protocols, and similar. I have no reason to trust the security of this system. The closest I could come would be to read the source code.

<comment><USER42> Sorry, should have mentioned a bit about that. The Password Safe format is public, open, and available here [1]. There's also plenty of code/libraries you can use to write your own clients, e.g. Javascript [2], Java [3], Python [4]. For what it's worth the core data encryption is done using the Twofish cipher. Hope that helps.

[1]: [http://sourceforge.net/p/passwordsafe/git- code/ci/master/tre...](http://sourceforge.net/p/passwordsafe/git- code/ci/master/tree/docs/formatV3.txt)

[2]: [https://github.com/scintill/pwsafejs](https://github.com/scintill/pwsafejs)

[3]: [http://sourceforge.net/projects/jpwsafe/](http://sourceforge.net/projects/jpwsafe/)

[4]: [https://github.com/ronys/pypwsafe](https://github.com/ronys/pypwsafe)

<comment><USER43> That both does and doesn't help. There is the format, which looks sensible. There are the protocols around it, key generation, salt generation, overall design, etc. which are not.

What actually scares me about the design is if my machine is compromised, an attacker can grab my Password Safe file (plus keylogs or whatever) and has access to all of my passwords. The design seems not very robust at a designs+protocols level.

(In contrast, right now, if a machine is compromised, it only compromises the passwords I've used from that machine).

</comment></comment></comment></comment><comment><USER44> Title should be edited to be more specific:

 _" [W]e have found no evidence that encrypted user vault data was taken, nor that LastPass user accounts were accessed. The investigation has shown, however, that LastPass account email addresses, password reminders, server per user salts, and authentication hashes were compromised."_

So, a breach of LastPass itself but not a breach of its users' non-LastPass per-website passwords/data.

</comment><comment><USER45> Now I don't feel so out of touch for not using last pass. It always seemed like a bad idea to put all of your trust in a single point.

<comment><USER46> What do you use instead? Do you ever reuse passwords?

<comment><USER47> Reusing passwords is not a crime.*

*Unless it's your email password or your bank password, basically.

People have been scared into this "unique password for every site", but let's be honest: My Hacker News password getting hacked doesn't cost me anything. Why does it need a unique password with some random other forum I comment on that has no personal information on it?

</comment></comment></comment><comment><USER48> The LastPass blog won't let me post any comment that mentions KeePassX, so I'm mentioning it here.

Other security folks might recommend other password managers that they prefer (e.g. 'tptacek likes 1Password). Generally, you should listen to them over me.

KeePassX is open source and NOT cloud based, so if those are two points on your mental checklist, it's worth checking out.

</comment><comment><USER49> Thoughts on LastPass vs 1Password?

<comment><USER50> I use 1Password for personal/family stuff. It's a much better interface and has many fewer bugs.

I manage a Last Pass Enterprise instance at work. I love/hate it. The interface is terrible and buggy. However, it's the only tool I've found to manage passwords across many users (some medium to non-technical) who need access to shared accounts within an organization. 1Password doesn't really do this, and sharing vaults over Dropbox doesn't really cut it. Despite all the bug pain, it's so much better than what we were doing before, sharing passwords via email and other embarrassing methods.

How can there really only be one company doing what LastPass Enterprise does? There must be other systems that I just can't find in my research. Any recommendations for other managed password stores for organizations?

<comment><USER51> Hi, creator of Turtl here ([https://turtl.it](https://turtl.it)). Turtl is not a password manager per-se, and is still fairly early in development, but is a client-side encrypted note-taking tool. It could conceivably be used as a primary password manager service.

Some features that are useful: client-side crypto (key is derived from username/password, ALL data is encrypted by default), sharing between accounts via asym encryption, open source client & server means it could be run completely in-house if required (as opposed to using the hosted service).

It doesn't have mobile apps right now, but those are coming pretty quick (either end of June or in July).

One of our slated features is a password note type, and possibly eventual integration with browsers.

Might be worth a look. Like I said, Turtl is new and is missing a lot of features you'd want in a pure-password-manager solution, but it has the potential to grow into this space a lot due to its security, sharing, and hosting features.

</comment></comment></comment><comment><USER52> I found out from an article on Lifehacker. Still have yet to get an announcement in email, extension or app from LastPass themselves.

While the blog post was nice, it would have been better to directly let subscribers know.

I am a premium subscriber with 2fa enabled.

Just received the announcement at 6:54pm CT:

Dear LastPass User,

We wanted to alert you that, recently, our team discovered and immediately blocked suspicious activity on our network. No encrypted user vault data was taken, however other data, including email addresses and password reminders, was compromised.

We are confident that the encryption algorithms we use will sufficiently protect our users. To further ensure your security, we are requiring verification by email when logging in from a new device or IP address, and will be prompting users to update their master passwords.

We apologize for the inconvenience, but ultimately we believe this will better protect LastPass users. Thank you for your understanding, and for using LastPass.

Regards, The LastPass Team

</comment><comment><USER53> _Schneier 's Password Safe_ is the real deal:

[http://passwordsafe.sourceforge.net/](http://passwordsafe.sourceforge.net/)

I use it on:

\- Ubuntu

\- Windows

\- Android

Synchronisation of the password db files is accomplished by storing a master file on Google Drive (Multi-Fac Auth here). I only change passwords on Ubuntu - upload to Drive and download to Android and Company.

</comment><comment><USER54> Any good tricks on how to generate a new master password that is a) secure enough and b) I can memorize?

<comment><USER55> [http://world.std.com/~reinhold/diceware.html](http://world.std.com/~reinhold/diceware.html)

[https://www.random.org/](https://www.random.org/)

I believe the current suggestion is 7 words. It shouldn't be hard to come up with a mnemonic device to match your new password.

</comment></comment><comment><USER56> On a related note...I'm using KeePass+Yubikey but am a bit worried that the project is still hosted on sourceforge. The devteam seems to think it's no problem at least that's the impression I get from reading the forum.

</comment><comment><USER57> "LastPass strengthens the authentication hash with a random salt and 100,000 rounds of server-side PBKDF2-SHA256, in addition to the rounds performed client-side. This additional strengthening makes it difficult to attack the stolen hashes with any significant speed."

I wouldn't mention that if your data has just been compromised. Although it makes is hard to handle that data, it is more info about how the data is encrypt.

</comment><comment><USER58> I switched to lastpass a year ago for all non-critical accounts, basically everything thats not email or my personal finances. Its still a bit of a risk, but this way I only need to remember about 5 passwords. I guess I'll slowly be updating all the passwords on my lastpass sites and coming up with a new master password today.

In short, more major sites need to implement a Google Authenticator style service.

</comment><comment><USER59> Plug for [https://oneshallpass.com](https://oneshallpass.com). Open source. Your site-specific password is an HMAC; the key is your password and the payload is the site you're logging in to. Works perfectly offline. You can optionally store an encrypted list of the sites you use (and parameters like number of symbols) to the server.

</comment><comment><USER60> I commend them for their honesty, so thanks for the heads up :)

One thing i noticed: They used quite a few german words ("dennoch", "jedoch", "dann") which i haven't seen used elsewhere up to now.

Is that common? I know that quite a few words are used commonly in English like "kindergarten" for instance, but this is the first time i've seen those in an english blog...

<comment><USER61> Are you from Germany or do you have your Browser set to German? The first time I visited the site I got redirected to [https://blog.lastpass.com/de/2015/06/lastpass-security- notic...](https://blog.lastpass.com/de/2015/06/lastpass-security-notice.html/) (notice the "de" in the domain), which has the German words. The second time I visited the site I didn't get redirected to the German site and didn't see the English words. Maybe some weird automatic translation bug.

<comment><USER60> Yes and yes, so i guess that makes at least some sense :)

And yes, i've seen the same behavior - getting redirected on first visit and not on the second, so i guess you're right regarding a weird auto-translation bug...

</comment></comment></comment><comment><USER62> Time to kill the password.

Federated login using OpenID Connect seems like a far better solution. I can't fathom why so many web sites want the awful responsibility of storing your password. Why not leave that to Google, Facebook or Microsoft? Or you bank for that matter...

And yes - you should secure your IDP login with multi-factor authentication.

</comment><comment><USER63> Wow! More and more centralized services are being hacked. Time for something more decentralized.

</comment><comment><USER64> Phew. Good thing I use [http://www.passwordstore.org](http://www.passwordstore.org) and [https://git- annex.branchable.com](https://git-annex.branchable.com).

</comment><comment><USER65> Things like this are why I prefer Firefox Sync. Works across all my devices (home laptop, work laptop, Android phone), and uses _client-side encryption_ , so a compromise of the Sync server provides the attacker with nothing of value.

</comment><comment><USER66> I don't understand the use case for LastPass/Dropbox/FTP storage of password, 1Password (and probably others) allow to sync through wifi, isn't that enough? Why would you need to do it over the cloud?

</comment><comment><USER67> I have a German system from a German IP and some of the words in the article are German. Weird. Do they have some kind of auto translation that kicks in even though they didn't translate the whole article?

</comment><comment><USER68> Does LastPass keep the encrypted copy of the password file for non-premium accounts? For accounts that don't sync and just use it from a single browser?

<comment><USER69> All of the accounts sync even if you don't use mobile, if that's what you're saying. You can always log into their website and view your passwords.

</comment></comment><comment><USER70> Strange fact: changed my master password a few min ago. But there's a message saying it was changed _23_ hours ago.

</comment><comment><USER71> And now they are under heavy load because of people changing their master passwords. Can't change mine :)

</comment><comment><USER72> How many times does LastPass need to screw up before you guys flee it? Pick your security vendors carefully!

</comment><comment><USER73> This is what I recommend to non-technical users: [http://www.amazon.co.uk/Silvine-Executive-Pocket- Notebook-14...](http://www.amazon.co.uk/Silvine-Executive-Pocket- Notebook-143x90mm-x/dp/B006O8915M/)

I use a hand-rolled gpg + git + owncloud for myself, but that's not convenient if you don't routinely have terminal windows open.

</comment><comment><USER74> iCloud Keychain doesn't store your passwords on Apple-controlled servers when you do not configure an iCliud Keychain storage PIN; you can use it in a mode that simply syncs keychains across devices, all of which allow password-based encryption.

</comment><comment><USER75> Wouldn't the solution be something akin to enpass?

</comment><comment><USER76> One another incident that reminds me, why 2 factor authentication is absolutely necessary for important information.

<comment><USER77> If the authentication database is being breached, presumably the 2FA shared secret is going to be in the same database. Constructing the 2FA code would be trivial. After all, the server needs a way to check that a given 2FA code is correct for an authenticating user, so there has to be some way to generate those as well.

It would help protect against any other sites that you use the same password on, with a different 2FA shared secret.

<comment><USER78> So it would be wise to change the LastPass master password and also regenerate the Google Authenticator key. LastPass does enable you to regenerate this key from the account settings page.

</comment></comment></comment><comment><USER79> _" LastPass simplifies your online life by remembering your passwords for you."_

You had one job. And you blew it.

</comment><comment><USER80> The year is 2015 and they still dont have mobile site to change password. Amazing

<comment><USER81> Actually, master password changes require the decrypting and then re- encrypting of the entire database, done locally. Mobile javascript engines would die.

</comment></comment><comment><USER82> you had one job. one.

</comment><comment><USER83> I've always had the feeling that LastPass was held together by sticks and duct tape, especially the frontend.

<comment><USER84> Behind the scenes, most software is.

<comment><USER83> Bad software is.

LastPass' user interface is really badly designed. There's lots of bugs and weird behavior. Experienced web developers can tell it's made without care. You don't want a password manager where the company doesn't care about its product.

There were other weird bugs, like assigning users to teams was finicky. Shared passwords didn't show up.

All this doesn't come as a surprise. The LastPass team didn't know what they were doing.

</comment></comment></comment><comment><USER85> Perhaps this isn't the thread to discuss this but I feel like the state of access in 2015 is dismal at best...

Every option out there either sucks ass on mobile or only integrates with a TINY percentage of apps and on desktop they aren't much better. How does Chrome (on iOS and OS X) blow every other PW manager out of the water? It "Just Works (tm)" while every other PW manager makes me just through a shit ton of hoops... I want to be safe but I can't be the only one who feels "chore" doesn't even begin to describe what maintaining and using a PW is like. My "Master" PW is secure but I'm not typing that thing every 5 minutes, 1Pass got better with Touch ID but it still makes me want to smash my phone every time I have to use it (Also, 1Browser, yeah how about FUCK NO).

<comment><USER86> Every other password manager is an extension on top of a browser whereas Chrome itself is the browser. This means that non-Chrome password managers have many constraints that Chrome does not.</comment></comment>


Picwing (YC Summer 08) on Engadget - <AUTHOR> http://www.engadget.com/2008/08/25/picwing-intros-social-digital-picture-frame/

<comment><USER2> Great idea for a product to work on. Ballsy too, taking on hardware production & dealing with all that physical production, economies of scale, ploughing fields & the rest of that 19th century stuff. I can see a lot of potential for this.

Nice thing is that you have a product and you can just sell it, in exchange for money. Just like any web retailer. On that note, you might want to take advantage of some of this PR for SEO and give your site a quick once over.

I see that for digital photo frame, picwing appears 6-7 time in the first 100 Google results via reviews & press but your site doesn't even come up if you search 'social photo frame'.

</comment><comment><USER3> How about a version of this with an OLPC daylight-readable screen that doubles as an eBook reader? (How about a deluxe version in 8x10" format?) I could imagine one on the nightstand, the end table by the couch, or on the coffee table. It would be in a convenient place to pick up. You could make this touchscreen, but you wouldn't even have to do that. Just have simple D-pad navigation, perhaps behind the frame.

An add-on with some simple remote control facility would make it a 3-use device. (It should be possible to control a MythTV, Tivo or Front Row with this.) Again, it would be in a convenient place.

</comment><comment><USER4> Aww, common guys! Change the casing! You'll have the best of everything, but that casing will kill you. Your outside has to be the very best part of your frame, because it's decorative. Right now it's too big, the screen is depressed. People have to pick up the case and love the device. Right now it looks a bit...ugly.

I'm not an industrial designer, so I can't say how you can make it better. But I can say that the picture does not really appeal to me. It's not sexy just looking at it. That's what you need to change, because if you are offering a premium product, first make sure it LOOKS premium!

<comment><AUTHOR> Hey Max,

Thanks for the feedback. As with most beta products, we know that the design isn't great just yet. Design is really important to us, but we've been concentrated on having great functionality and usability for the past 3 months at YC.

With that said, I promist the final product WILL look much better in the end!

<comment><USER4> Okay, good that you guys are still going to improve the casing. If I were you, I'd take a look at the frames that really expensive paintings usually are in. Those frames are gorgeous, and your product should have something like that.

And please don't put "Loading..." when it starts. Make ripples or water droplets falling or even just a white line passing through like an EKG...

</comment></comment></comment><comment><USER5> This is a kickass product. Wish I had thought of it.

</comment><comment><AUTHOR> This came as quite a surprise to us, but hey we're glad it happened!

</comment><comment><USER2> Who's buying the things at this point?

I'd be putting money on people buying them for their mums. Could be a huge Mothers Day hit. Not beta friendly though.</comment>


Amazon Forms Team to Focus on Driverless Technology - <AUTHOR> https://www.wsj.com/articles/amazon-team-focuses-on-exploiting-driverless-technology-1493035203 <comment><USER2> No surprise. Given they have patents for airborne warehouses (dirigibles) and drone recharging stations on lamp posts and have been exploring driverless trucks equipped with drone delivery for the last mile and even underwater warehouses, it's about time they focused on near term driverless transportation systems. Their logistics expertise and experience with 30K+ robots in their warehouses gives them some advantages and 'street cred'.

</comment><comment><USER3> But while they're doing that, who's going to work on Amazon Forms?</comment>


Peas: Ruby-based Docker PaaS - <AUTHOR> https://github.com/tombh/peas

<comment><USER2> With the recent big reductions in AWS costs, and Heroku not helping pass that savings on to their users, I'm looking for a new platform to move my apps to. It would be nice to have something very heroku like.

<comment><USER3> [http://deis.io/overview/](http://deis.io/overview/)

</comment></comment><comment><USER4> Very excited to see how this project progresses. It appears to be right in line with what I need right now. I've standardized my app architecture on Docker, but have not had the time to mature the instance management and deployment process.

I'm currently using capistrano, but it's feeling limited for my use case as I have to manage several "always running" servers plus hundreds of cpu intensive workers. Finding a good way to manage those workers across several cloud platforms and my own hardware has not been simple.

<comment><AUTHOR> Thanks. Well fingers crossed it matures in the right direction. I'd hope that it'll become a simple solution to just throw up on a VPS and get apps deployed without the fuss of managing Apache, Virtualhosts, PHP/Ruby/Node/etc binaries, databases and whatnot. I like to think of Peas as the next logical step up from Dokku.

To be fair Deis already does a good job of this.

<comment><USER5> One issue with Deis is that it depends on Chef Server. As an admin, I've happily left that whole model far behind. For me that single dependency is a deal breaker.

<comment><USER6> Me too - dependency on Chef Server is instant no-go.

</comment></comment></comment></comment><comment><USER7> Speaking of Heroku-like deployments, is there something I can install on a blank DigitalOcean VPS and have it configure a simple PostgreSQL instance and whatever dependancies I have in my Gemfile?

Then I can deploy with a single command?

I have done this a ton of times with Capistrano but it's always a pain in the ass for new projects because I need to install Nginx, PostgreSQL, RVM, Ruby version, etc etc etc. Lots of busywork I don't really care about.

<comment><USER8> Try [https://www.cloud66.com/](https://www.cloud66.com/), it does what you want, but for some money.

<comment><USER9> Cloud66 is kind of incredible, I was an early beta tester for them and they really are hitting an interesting price/value point wrt managing complex systems.

</comment></comment></comment><comment><USER10> This is really awesome, let me know if you want some credit to test building it on DigitalOcean support, john@</comment>


Fuck You Startup World - <AUTHOR> https://medium.com/@shemag8/fuck-you-startup-world-ab6cc72fad0e#.aaqff0qp1 <comment><USER2> Honestly was expecting something about the $3000/month rent people pay to live in SoMa in order to look cool.

</comment><comment><USER3> This has apparently been posted many, many times today. The central discussion can be found at [https://news.ycombinator.com/item?id=12686634](https://news.ycombinator.com/item?id=12686634)

<comment><USER4> Nah [https://news.ycombinator.com/item?id=12682944](https://news.ycombinator.com/item?id=12682944)

</comment></comment><comment><AUTHOR> Hahahaha as someone who recently made the switch from corporate/tech-giant world to the startup world in the bay area, I can really relate to this article.

</comment><comment><USER5> I really enjoyed it except the knock of Pomodoro Timers. That one hits too close too home.

</comment><comment><AUTHOR> Also this is seriously gold - hardest I've laughed all day.</comment>


SproutCore Amber: A Report by Yehuda - <AUTHOR> http://blog.sproutcore.com/post/3075780393/sproutcore-amber-a-report-by-yehuda

<comment><USER2> This is Yehuda's m.o. -- take a framework and make it less monolithic before he extends functionality. He's done this with Merb and Rails. These have greatly improved those frameworks. I expect good things from Sproutcore.

</comment><comment><USER3> Somewhat OT, but perhaps related: I've watched SpoutCore and Rails 3 from a distance. My impression is that Rails 3 is still heavily dependent on Prototype.js (for scaffolding, etc.) though the majority of rails developers switch to jQuery for new projects.

Does the community believe that SproutCore is Rail's future javascript library? I realize that SproutCore is independent of any server infrastructure, but, given Yehuda's involvement in both, it seems fair to ask. Or is it the case that, since SproutCore is all about moving logic to the client, Rails would be a poor match -- too heavyweight to pair nicely with SproutCore?

<comment><USER4> It is not true that Rails 3 is dependent on Prototype.js. It is just that it is what Rails started with. You cannot just get rid of something that will break backward-compatibility.

Btw, Rails 3.1 will start supporting jQuery. [https://github.com/rails/rails/commit/708e09448ba41c45f189c6...](https://github.com/rails/rails/commit/708e09448ba41c45f189c6b1adc989eba8994b20)

That's a commit of mine. But, it won't be in the official release of any 3.0.X. It is currently only on the master trunk and soon it will be released together with Rails 3.1.

To answer your second question, I don't think that anyone in the Rails community will say that SC is the future of Rails 3 even though two of the core contributors of Rails are involved in SC.

And, don't forget that 37 Signals which is the company started Rails is going to release their Cinco javascript framework.

<comment><USER3> I'm confused how you can say that Rails 3 does not depend on Prototype.js, when if you generate scaffolded views they make heavy use of Prototype. I _do_ understand that you can use Rails 3 without prototype, of course. But it's definitely a dependency of the framework at the moment.

That's great about Rails 3.1 supporting jQuery -- I'm certainly excited about it. I'll go check out your commit...

Interesting about Cinco, I hadn't heard of it.

<comment><USER5> I wish that scaffolding would go. I've not used it in four years, apart from when inheriting code from Rails-newcomers.

</comment></comment></comment></comment><comment><USER6> Thanks Yehuda, this is really exciting. My startup (Matygo) launched an SC app a month ago and by far one of our biggest problems has been page load, performance, and size (especially on mobile).

A compile that only included the exact library files needed (and none other) would be the holy grail in this regard (like ProGuard does for java).</comment>


Proposed Bill Requires Travelers to Declare Bitcoin at US Border - <AUTHOR> http://www.investopedia.com/news/congress-bill-require-declaration-digital-currencies-us-border-bitcoin-homeland-security/ <comment><USER2> "Because digital currencies technically accompany a holder anywhere that he or she goes, including across a border, that traveler would need to declare his or her entire cryptocurrency portfolio every time he or she enters the United States."

No. At most, a key accompanies the holder. The currency itself is essentially located on the network.

</comment><comment><USER3> Scenario: A person has a CoinBase account with 100 Bitcoins and wishes to leave the country with $250,000. This person has chosen to download his bitcoin to a wallet that has no historical transaction history with CoinBase save for a fresh download the DAY AFTER he arrive in a new country...

How is the US Customs going to know where the physical location of that money is or went?</comment>


The Rust Programming Language Pre-Sale - <AUTHOR> http://www.nostarch.com/Rust <comment><USER2> Please update the link to [https://www.nostarch.com/Rust](https://www.nostarch.com/Rust) \-- the current link doesn't work for the shopping cart.

<comment><USER3> YES! the site should redirect immediately, which it does not.

<comment><USER4> Weird. We just completed a site migration. I'll have to make sure that the HTTPS is still working correctly on Cloudflare.

Thanks for the heads up.

</comment></comment></comment><comment><USER5> Is this a print of "the book" or is there some additional content here that we should be interested in?

<comment><USER6> To add on to what Manish said, it's important to us that the core docs remain free and accessible, which is one of the reasons why it was great to work with NoStarch; they're super happy to keep the book 100% open source. Win-win.

In addition, the plan is to donate the proceeds to OpenHatch.

<comment><USER4> 100% true

</comment></comment></comment><comment><USER7> The No Starch shopping cart is having issues for me. I'll come back later in the day and try again. I got to "Review your order", then "You have no items in your shopping cart."

<comment><USER7> Aha, changing the URL to [https://www.nostarch.com/Rust](https://www.nostarch.com/Rust) (https) worked for me.

<comment><USER4> We enforce https

<comment><USER4> I'll ask our developer to check on this tomorrow. Cloudflare settings appear to be correct.

</comment></comment></comment></comment><comment><USER8> What's the release date?

<comment><USER4> We've got it listed as an October release but basically, when it's done.</comment></comment>


Why I'm leaving Facebook - <AUTHOR> http://www.newyorker.com/online/blogs/comment/2012/05/leaving-facebookistan.html#ixzz1vnWOD9ss

<comment><USER2> I honestly don't understand the appeal of facebook. I have an account because I was urged to make one by friends but I haven't used it in the past 4 or 5 months. Why would anyone want to post all of their personal information on a public board that doesn't respect your privacy? I don't understand this.

</comment><comment><USER3> Why I'm not leaving FaceBook... Because I don't want to make a new account for every website that comes along.</comment>


Ask HN: How to land a job in functional programing - <AUTHOR> I'm very keen to get some time under my belt as a professional programmer in a functional language. I've not seen a job advertised locally that uses a functional language. Any tips on how to find / land one? <comment><USER2> Tempting to say "be lucky" but more kindly, be in a community. Be discussive, make contributions that get reference, add to the repositories, attend meetups.

I was a manager many years ago (not now) and a remarkably good candidate came up for a role who had worked in lisp on traffic control problems. I wish we'd appointed, her mindset and approach would have been beneficial. What I am trying to say here is that even a job NOT in Haskell may benefit from what FP had to give. Strong typing and lazy evaluation inform approaches to problem solving.

Yes, banking and finance. Please don't just go into crypto coins

<comment><USER3> Just curious how FP is used within finance and banking

<comment><USER2> (This is what I have been told. I don't work in fintech)

The old inner-core of most finance companies is a small body of code for the ledger system, which has to meet finance regulator approval. A lot of banks have greybeards who coded this in COBOL, hanging on by a thread. The newer banks have to meet the same level of QA assurance on the code to get certified.

Strongly typed languages with some assurances over data states can be beneficial for arguing about correctness and compliance. So re-implementing, or new banking, looks into it.

Quant statements about investment make finance people ask "show me how you can be so certain about this" because the inferential chains to justify investment make them nervous. FP means a lower bar to saying "I believe this" when you try to make them believe it: its demonstrably tighter code.

The obvious google search leads to: * [https://www.risk.net/risk- management/6395366/functional-prog...](https://www.risk.net/risk- management/6395366/functional-programming-reaches-for-stardom-in-finance)

<comment><USER3> I see thanks for replying

</comment></comment></comment></comment><comment><USER4> What about a popular language with functional support like JS, and Kotlin? You could start writing functional code and get some of the benefits.</comment>


Adams Complexity Threshold - <AUTHOR> http://dilbert.com/blog/entry/adams_complexity_threshold/ <comment><USER2> _The Adams Complexity Threshold is the point at which something is so complicated it no longer works.

The Gulf oil spill is probably a case of complexity reaching the threshold. It was literally impossible for anyone to know if the oil rig was safe or not. The engineering was too complex. I'm sure management thought it was safe, or hoped it was safe, or hallucinated that it was safe. It wasn't possible to know for sure._

Disagree. If the oil companies had put together a consortium to research such "worst case" scenarios and develop equipment and procedures to deal with them quickly, then this would have been preventable. (How about an even worse scenario: oil rig blows up, sinks, smashes the blowout preventer. Even Michael Bay can think of that one.) The oil companies could've done this, but chose instead to gamble on what they thought was a "good enough" lower level of safety.

No one can be 100% sure all of the machinery and safety mechanisms and procedures will work, but it is possible to make the likelihood reasonably small and then _add an additional fallback position_ that you are pretty certain will work. The oil companies didn't have a fallback beyond the blowout preventer that they knew would work in a short timeframe.

An unreasonable expectation? Perhaps. Technology companies do this with their data all the time. Of course, protecting data is 1) much cheaper and 2) is protecting an asset and not preventing an unfortunate externality.

<comment><USER3> > _No one can be a 100% sure_

The problem is complexity plus scale. Do something potentially disastrous a 100k times, then you need to be impossibly close to being a 100% sure you've made it safe for every case. 99.9% doesn't cut it. BP's fallback position is: if it blows, and we can't stop it, we'll drill a relief well. That's the kind of decision that looks ethically bankrupt, probably is ethically bankrupt, and is nonetheless going to be made every time unless all the other oil companies also agree, or are forced to have, the fallback already in place.

</comment></comment><comment><USER4> Pre-drill a relief well. It's not that complex. Actually, some countries already require it.

<comment><USER5> Drill a relief well. It's not that big of a deal.

</comment></comment><comment><USER6> _The Checklist Manifesto_ ([http://www.amazon.com/Checklist-Manifesto-How- Things-Right/d...](http://www.amazon.com/Checklist-Manifesto-How-Things- Right/dp/0805091742/) ) is exactly about managing excessive complexity.

</comment><comment><USER7> Adams is a smart and funny guy, but his great talent to simply often leads him to embarrassing oversimplification.

His bold assumption that no one could be sure if the BP rig was safe is complete BS. Watch the 60 Minutes report, listen to the interview, LOTS of people knew exactly how unsafe it was.

The same goes for Enron, both Bethany McLean and James Chanos pointed out the king is naked, long before Enron imploded.

Just because Scott Adams can't comprehend something, it does not mean that it is incomprehensible.

It is true that our modern lives are very complicated. But primitive people posses staggering amounts of knowledge, which just happen to be essential for their survival. We all had knowledge like that a long time ago. I have no idea exactly who knows more, but I bet we are all in the same ballpark, because we are all humans.

<comment><USER8> As they say, hindsight is 20/20.

It might be relatively easy post-hoc to trace a problem that has already occurred back to a relatively small set of causes, and then ask why these were overlooked - after all, an ounce of prevention is worth a pound of cure.

But when the system itself is so complex that any of a thousand other factors might have gone wrong instead, you're really comparing a thousand ounces of prevention to a pound of cure. You can get really caught up in all of the plausible contingencies, which grow disproportionately with complexity.

If you were to audit that oil rig inch-by-inch, you might have found dozens of things which could have led to a problem of near the same impact as the current leak. And you might have even focused on fixing _all_ of them. But you can't presume that some other factor that you didn't notice (or couldn't have noticed given the finite nature of your knowledge) wouldn't have triggered a slightly different failure, and you can spend an enormous amount of time fixing things that would not have caused a failure.

Adams makes a good point - the best way to ensure the reliability of a system is to understand the functioning of the system as a whole, and beyond a certain scale of complexity, this is extremely difficult and often impossible.

</comment></comment><comment><USER9> Not sure I buy his point about how engineers and other professionals are the only ones who manage complexity. I have never taken a poly-sci class before, but my guess is that the whole point is to work to reduce the enormous complexity of differing political systems into something you can understand. And, as a single data point, my English major/aspiring author friend is one of the deepest thinkers I know. He regularly surprises me by being able to distil complex situations into something manageable. Engineers definitely don't have a monopoly on that.

</comment><comment><USER10> _Complexity is often a natural outgrowth of success. Man-made complexity is simply a combination of things that we figured out how to do right, one layered on top of the other, until failure is achieved._

A great line... Reminds me of:

"Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it." -- Brian W. Kernighan

</comment><comment><USER11> Things like <http://abcnews.go.com/print?id=10763042> make me not convinced the BP was just an accident that could have happened to any of the oil companies.</comment>


Code Polution - <AUTHOR> http://dailyjs.com/2011/07/25/alex-kessinger/

<comment><USER2> Personally having encountered this issue, I do agree with Alex here. Most of the projects are left out unfinished, so collaboration sure does make sense here.</comment>


The U.S. Can No Longer Hide from Its Deep Poverty Problem - <AUTHOR> https://www.nytimes.com/2018/01/24/opinion/poverty-united-states.html <comment><USER2> This is the other side of globalization.

Globalization is super nice when you're secure in your job, "hey everything is getting cheaper!" but when your job is the one in the crosshairs what you're feeling is a pressure that is pushing the living standard of the third world and yours together. That's why I find it so annoying that this board is usually against abundant H1B's but for factory outsourcing. It's completely hypocritical.

And before I get jumped on, no I'm not against all trade. What I'm for however is noting that people don't live in the long-term, economically we are firmly short-term creatures. Good policy won't give everything up for the long-term, it will also protect people in the short-term, we don't need an end to trade, we need a curtailing of some trade.

<comment><USER3> Why should Bubba live a better life then Liu Chu just because he was born in one country and Liu Chu another? Globalization has reduced extreme poverty worldwide, to the point where it will not exist in a few years.

Globalization has very little to do with the plights of blacks in the Mississippi Delta. Old fashioned racism and a lack of jobs in sectors which aren't agriculture have a lot more to do with it.

<comment><USER2> Well Bubba has no more right to a good life than Liu Chu but if you live next door to Bubba and 7000 miles from Liu Chu I think you have a higher duty to him than her.

Second, you could consider that Bubba has the ability to vote in US elections and Liu Chu doesn't. Making Liu Chu better off is a nice moral deed, making Bubba better off is not just a nice moral deed but also a political obligation.

<comment><USER4> Bubba can vote, so he's able to represent his own interests. Liu Chu has no voice in the system.

It seems to me that if I have any obligation it would be to advocate for those that cannot advocate for themselves first.

<comment><USER5> Help given to Liu Chu will by necessity pass through many hands and you have no control over the ethical structure of Liu Chu's society. Helping Bubba is something you can verify, and it will also help Liu Chu when Bubba has more income and can afford to help others.

</comment></comment></comment></comment></comment><comment><USER6> > Beyond that, many Americans, especially whites with no more than a high > school education, have seen worsening health: As my research with my wife, > the Princeton economist Anne Case, has demonstrated, for this group life > expectancy is falling; mortality rates from drugs, alcohol and suicide are > rising

Yet in 2018, most diversity initiatives still focus on race regardless of socio-economic background.

<comment><USER7> Here we go again.

Race correlates _strongly_ with socioeconomic background. Insofar as diversity initiatives are actually attempting to improve the lives of disadvantaged people in this country, arguments like yours amount to relative privation.

Heart disease kills more people than lung cancer, but there's nothing wrong with raising money to research lung cancer.

<comment><USER7> I'm going to post this as a reply with the poster elided, since they deleted it and I think it's important:

>> Heart disease kills more people than lung cancer, but there's nothing wrong with raising money to research lung cancer.

> The difference is that face of diversity initiatives are zero sum.

No, they are not. Hiring someone from a disadvantaged group does not mean that you have to fire someone from a privileged group. That is what a zero-sum scenario would require.

Diversity initiatives level the playing field by increasing _opportunities_ for one group relative to another. That doesn't necessarily mean that the disadvantaged group has _more_ opportunities _than_ the privileged group -- it only means that they have more than they did _before_.

<comment><USER8> I just don't buy that. Not every company has infinite head count.

Universities for example only have so many spots they can offer. So if a university keeps 10% of the spots for diversity candidates, then only 90% of the capacity is for diversity candidates.

Compounded with non diversity candidates applying in a disproportionately high number to diversity. And the population of non diverse having a better education. You end up making it harder for non diverse candidates and raising their bar.

<comment><USER2> >You end up making it harder for non diverse candidates and raising their bar.

You're right but that's fine. The argument though is that society has already imposed a 'higher bar' on "diverse candidates" (let's just be honest and call them minorities and the poor.) Think of it like this. A poor black girl named Keycia lives at home with her single mother and three siblings. She's studious but attends a bad public school, she works after school to help out at home, she takes care of her little brothers and sisters. Now compare to Chad, a white boy from an upper middle class family. He's also studious and also attends a public school but a good one with AP/IB classes, dual credit and so on. He doesn't work but he does play on one of the best lacrosse teams in the state and also swims.

All of which is to say it's two kids both working hard. Now, _even with_ diversity initiatives, who's got a better chance of getting into Stanford? Hell who's got a better chance of getting into Iowa State? Or even being able to attend? Diversity initiatives exist to put these two kids on even ground. That's what equality of opportunity means.

<comment><USER6> In an alternative universe, Chad is a poor white boy who lives at home with his single mother and three siblings. He's studious but attends a bad public school, he works after school to help out at home, he takes care of his little brothers and sisters. In this universe Keycia is a black girl from an upper middle class family. She's also studious and also attends a public school but a good one with AP/IB classes, dual credit and so on. She doesn't work but she does play on one of the best lacrosse teams in the state and also swims.

Now, with diversity initiatives that are geared against Chad and in Keycia's favour, who's got a better chance of getting into Stanford?

<comment><USER2> Sure! But that's an argument for more complex diversity initiatives (race, gender, AND poverty) which I'm totally fine with.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> This video from Anaheim (California) is reminiscent of travelling around Dehli (from 39' in - [https://www.youtube.com/watch?v=KF7hWzqdPDk](https://www.youtube.com/watch?v=KF7hWzqdPDk)). The level/amount of poverty in this video is shocking.

<comment><USER10> Probably worse in CA, but this exists on some level in every state. Here in NJ we have the same exact thing, just not along a bike path.

<comment><USER11> Berkeley has a tent community dead in the middle of downtown on some government property. Berkeley's homeless problem is really front-and-center. The otherwise nice parks in the area are pretty unusable.

<comment><USER12> I'm sorry, I have zero sympathy to people from Berkeley complaining. Considering the amount of money that Berkeley citizens collectively have and the progressive positions that they hold I am baffled why they do not add an addition $X thousand per year tax to everyone who makes more than a federal poverty level there to make sure that all out of luck homeless people have a real roof over their head, warm meals and medical care.

Unless of course the so called progressive population does not actually care that the middle of downtown Berkeley looks like a third world country.

<comment><USER11> It's a mix yeah? Berkeley as a whole has a poverty rate 6% higher than the national average. .6% higher than Oakland.

<comment><USER12> 2015 fiscal berkeley operating budget was 293 million.

[https://www.cityofberkeley.info/Clerk/City_Council/2015/05_M...](https://www.cityofberkeley.info/Clerk/City_Council/2015/05_May/Documents/2015-05-12_WS_Item_01_Proposed_FY_2016.aspx)

2017 homeless number is about 1000:

[http://www.dailycal.org/2017/05/29/berkeleys-homeless- popula...](http://www.dailycal.org/2017/05/29/berkeleys-homeless-population- nears-1000-homeless-shelter-crisis/)

If every one of them is provided a $3k/mo apartment, it would increase the budget by 36 million.

Berkeley population is estimated at 121k

[http://worldpopulationreview.com/us-cities/berkeley-ca- popul...](http://worldpopulationreview.com/us-cities/berkeley-ca-population/)

20% of berkeley population lives below powerty level. So lets say it is 100k that are left.

36M/100k is what? $360 per person? There, I just solved Berkeley homeless problem at a price of less than 5 bottles of Napa Valley Cab per person who screamed at the sky in the city of Berkeley the day Trump became President Elect.

</comment></comment></comment></comment></comment></comment><comment><USER13> _According to the World Bank, 769 million people lived on less than $1.90 a day in 2013; they are the world's very poorest. Of these, 3.2 million live in the United States, and 3.3 million in other high-income countries (most in Italy, Japan and Spain)._

I tried to track down this factoid. First I went to the world bank: [https://data.worldbank.org/indicator/SI.POV.DDAY?locations=U...](https://data.worldbank.org/indicator/SI.POV.DDAY?locations=US)

which does show 1% for the US. In the notes it says " Data for high-income economies are from the Luxembourg Income Study database." My next stop was there. From [http://www.lisdatacenter.org/frontend#/home](http://www.lisdatacenter.org/frontend#/home) I found that the source of their data was Current Population Survey (CPS) - Annual Social and Economic Supplement (ASEC) (United States). The Current Population survey has a table creator here: [https://www.census.gov/cps/data/cpstablecreator.html](https://www.census.gov/cps/data/cpstablecreator.html)

Although there is nothing that quite matches the 3.2 million figure cited, the LIS did some harmonization so the most likely ultimate source is the 3.446 million people living in households that were categorized as having "no income" in 2013. This is separate from the 2.775 million people that were categorized as living in households that have "$1 to $2,499 or loss" in income.

I'm very skeptical that this is an appropriate use of this data. The world bank poverty number is supposed to be about consumption--it has to do with people consuming very little in the way of goods and services. But no one at all can live on no goods and services. They'd die of hunger and thirst in far less than a year. It could in theory be the case that millions of Americans were living on less than $1.90/day in consumption but it cannot possibly be the case that millions of Americans are living on $0/day.

To the extent that the figure cited for "no income" means anything (and isn't just noise in the data), it doesn't mean what the world bank means when it says living on $1.90/day.

<comment><USER14> If the consumption comes from a market, then sure. But during the Depression, millions of rural Americans lived on $0 for years. Kitchen garden, a cow, a pig, some chickens and there you are.

So point is, maybe dollars aren't tracking what we think they're tracking?

<comment><USER13> The world bank attempts to measure consumption from all sources, not just those that result from market transactions. Which is a very good reason why it is inappropriate to source a number for the US from a survey that doesn't attempt to measure consumption that way.

I understand that the US isn't the primary focus of the project, nor should it be, but in the absence of good data it would be better to put N/A as it did for several other countries, rather than a misleading statistic.

There's some good information on measuring consumption starting on page 91 here: [http://documents.worldbank.org/curated/en/452741468778781879...](http://documents.worldbank.org/curated/en/452741468778781879/pdf/multi- page.pdf)

</comment></comment></comment><comment><USER15> Americans are slowly becoming more radical as a reaction to economic pressures. With each side's policies alien to the other, compromise becomes impossible. Eventually one side will have to win out and then things will get very interesting.

<comment><USER16> > Eventually one side will have to win out and then things will get very > interesting.

Well things _are_ pretty violent already, with the deadly class war the police is fighting against the population (~1k in 2017, [https://www.washingtonpost.com/graphics/national/police- shoo...](https://www.washingtonpost.com/graphics/national/police- shootings-2017/)) plus the countless arrests, macing, tasering and other violent actions of police against peaceful demonstrators, plus all the violence committed by Nazis (e.g. the Heather Heyer murder and the other actions counted as right-wing domestic terrorism). Add in the _huge_ number of weapons circulating in the US... when the poor people (or the armed rednecks) finally feel desperate enough that will be quite a bloodbath.

<comment><USER17> Police fighting a class war? The vast majority of those 1000 deaths are unambiguously from the justified use of force, in self-defense and the defense of others. Believe it or not, there's a lot of violent and bad people out there.

<comment><USER18> There are countless youtube videos of police arresting violent individuals in Europe where they would just be gunned down in the US.

If you want another comparaison, look up dog shooting in the US and in Europe, unless you really believe dogs are somewhat more dangerous in the US, the inescapable conclusion is that American cops enjoy the power trip of gunning down living creatures...

And why shouldn't they, it's almost risk free for them, which is the root of the issue.

<comment><USER6> Or taking Hanlon's razor, Americian cops have been institutionalised to use force, almost as if they're operating in a country with more guns than citizens (unlike anywhere in Europe, or the world for that matter).

</comment></comment></comment></comment></comment><comment><USER19> I don't understand how this is possible. We have a lot of programs to help people - food assistance, housing and health care assistance, disability... Are these benefits being counted when we say they live on $4/day?

<comment><USER20> These benefits are inaccessible without a long trip through some really Byzantine application processes where nobody is actually incentivized to help you. These processes ostensibly exist to block freeloaders but they also serve to prevent the needy from accessing the resource too.

<comment><USER21> I readily critize our grotesque engorged bureaucracy, but getting food stamps isn't difficult, as exibited by the 40+ million people who take advantage of them, and by personal anecdotal evidence.

<comment><USER22> I think it depends on where you are and how used to using bureaucracy you are. I know people who really struggled to wend their way through the bureaucracy that protects food stamps in order to get them.

<comment><USER23> It's also self-selecting: if you're good at navigating bureaucracy, you most likely won't be homeless.

</comment></comment></comment></comment></comment><comment><USER24> I welcome an absolute definition of poverty. We talk about the richest and poorest quintiles much more often, which is worse than a moving target. There will always be a lowest quintile. The cynic in me thinks this is a job protection program for those working in poverty reduction.

I wish we had more science here. The linked research points to the 1995 welfare reforms as causing a change. The way to prove effectiveness is with a well run trial - one that changes in federal policy make impossible.

Economic growth (or stagnation) is also crucial here to lower poverty rates. But all of macroeconomics suffers from the same basic measurement problem. Restated: what anti poverty program did hundreds of millions of Indian and Chinese families since 1995 participate in?

</comment><comment><USER25> It's not a poverty problem it's a cost of living problem. Those are two very different things (and becomes more and more severe the poorer you are)

You can't outsource your home to China.

Globalization does not make every day cheaper it just provides more choices and will in aggregate always increase the cost of living.

So as long as your job/income is on the right side of the rise of the cost of living you are fine but if you are on the other side with either no job or poorly paid job or as a freelancer (with no healthcare) then you are in trouble no matter how cheap flatscreen TV become.

<comment><USER26> And with a wave of her magic wand and the enunciation of the magic words "Ceteris Paribus", the Free Market Fairy made hookworm in Alabama disappear.

<comment><USER25> There is a big difference between just saying deep poverty and then qualifying what leads to this deep poverty.

Just saying poverty is the cop out here trying to qualify what drives this problem offers at least a way to look at the problem that doesn't end in tax the rich as that will not solve the deep poverty problem.

<comment><USER26> Meanwhile, in the real world, it is the demand of Capital to grow at %6 a year regardless of the health of the overall economy that is fueling the attacks on the social safety net.

<comment><USER25> That demand is by design and is the price of a stable economy and is followed by more or less every country in the developed world.

Even in countries like Denmark (which is where I am originally from) and who have high taxes and a high degree of redistribution of wealth, you will find people who are poor and homeless.

Add to that the discussion about relative poverty and you will have a problem that can never be solved unless you give everyone one exactly the same.

</comment></comment></comment></comment></comment><comment><USER27> I don't see a reason why the U.S. can't in this article. Or did I miss something?

It worked pretty good even when they've been in the open. Recently we had a topic here where people were reporting about homeless people being carried out of the cities.

It seems to me that the U.S. got quite comfortable with their poor. Probably even working as an negative incentive for the (still) employed. Don't forget the American Dream too. I mean according to that: it's just their fault...they COULD have been rich!

<comment><USER28> I think the end of the article is where the author(s) make the case for looking to help at home as much or more than abroad.

"The U.S." in this case is not the government or institutions, but rather the people who are willing and able to help others, and how the traditional "help poor countries" wisdom should be revisited and perhaps changed to "help poor _people_ ".

</comment></comment><comment><USER29> So what do Switzerland, Germany and Iceland better than the rest of the developed nations?

<comment><USER30> They haven't had decades of sustained mass immigration of low-skilled workers.

<comment><USER31> What a bogus , Switzerland has 40% foreigners which have immigrated , 30% of those have nowadays a citizenship and passport , read Swiss history before posting such crap!!!

<comment><USER30> The raw numbers aren't the issue. Switzerland hasn't had decades of sustained mass-immigration of low-skilled workers. The flow of immigrants to Switzerland is nothing like that into the United State.

</comment></comment></comment></comment><comment> d--b Mmmh, they say they adjust the poverty threshold based on actual needs, yet they use a single $4 threshold for the whole of the US, and the whole of Europe...

And then they're not critical about their methodology when it consistently shows that warmer countries have a larger chunk of the population that is very poor.

Perhaps it's easier to live on $4 in Spain than it is in Denmark. And perhaps it's easier to live on $4 in California than it is in Michigan...

When it comes to extreme poverty anyway, we're looking at the very tail of the bell curves, so the stats are somewhat shady there. It's not very clean to compare tail stats between countries.

The thing that can be compared is the evolution of these numbers over time. If in the US more and more people are living with less than $4 a day, that is concerning.

</comment><comment><USER32> It seems it can, from behind it's gated content community

In all honesty, though, I'd love to hear some stories from any social workers here as to their beliefs are regarding the extreme lows of poverty and maybe fix it.

I think we've all heard that we should change drug policy, expand government service for mental health and treatment, but does anyone have any other we don't normally hear about?

</comment><comment><USER33> I think in a few years, American will write off all debt. Quantitative Amnesia.

<comment><USER34> No we will just devalue the currency. There is no reason to default if you can just print more.

<comment> maze-le >> There is no reason to default if you can just print more.

Sure there is a reason, it is called hyperinflation.

</comment></comment></comment><comment><USER2> [https://outline.com/STFZAv](https://outline.com/STFZAv) paywall bypass

</comment><comment><USER35> probably a direct result of money in politics...

</comment><comment><USER36> Poverty is not a problem. It is the default state. Instead of asking what causes poverty, we need to ask what causes wealth. We also need to realize that being poor is not a good/bad thing. Again, it's the default state.

<comment><USER37> > being poor is not a good/bad thing

This is a silly line of reasoning. As more people grow wealthy, we find more ways to systematically mistreat those who have not. It's not just that the poor started poor and stayed that way, it's that the rest of us find ways to make things even harder for them as our comparative wealth grows. Being poor is most definitely a bad thing.

<comment><USER38> The fact remains that everyone starts with nothing. The parent questions why some are able to flourish, while others continue with nothing indefinitely.

<comment><USER39> The "fact" that everyone starts with nothing is obviously false. Even ignoring opportunity, the fetal health is highly dependent on the environment.

<comment><USER40> I think the point is being missed here. In an _inherent sense_ , humans start with nothing.

We (as a society) have hospitals available which greatly decrease infant mortality. We have widely available nutrition that keeps people from starving. These are steps that we, as a society, have taken to improve upon the default state (having nothing) of humans--including fetal health. Perhaps rather than focusing on how to make people in poverty more comfortable, we should focus on how to get them out of poverty.

That's not the same as claiming all people start on a level playing field.

<comment><USER39> In _no_ sense do people start off with nothing. People start off with the abilities or lack thereof possessed at birth. Compare a child with fetal alcohol syndrome with one without it. Do both start off with nothing? No. Clearly _one_ has _something_ the other does not.

Why do people insist on believing nonsense?

<comment><USER40> Of course individuals have different abilities. You're missing the point.

The claim is societal. We (as humans) started out with nothing. Over thousands of years, we built religions, governments, businesses, laws, science, and everything else, which ultimately resulted in a lot of us having a lot better quality of life. But our default state (as humans) is to have nothing. That some people are still in poverty shouldn't be seen like a disease to be treated--it should be seen as a condition all humans effectively default to. They just haven't benefited from all the systems and processes we've built that the rest of us have, and we should figure out how to get them to (or modify our systems so they do).

Again: This is in no way claiming each person starts on a level playing field.

<comment><USER39> Yeah, no. How can you claim we started off with nothing yet say over thousands of years we built things? Clearly we started off with something. You should be more precise in your language.

If you change "nothing", with "no possessions, talents, abilities, or skills", which is the same thing, then you'll see why what you're saying is illogical.

<comment><USER40> > Yeah, no. How can you claim we started off with nothing yet say over > thousands of years we built things?

I'm not sure how to respond to this. Have you read a history book? At one point humans were in caves, with effectively no possessions and terrible lives. That was poverty, and it affected everyone. Whether or not one cave man was born smarter than the other is irrelevant.

Over time, we developed all of these systems that made life better for the vast majority of us, yet some of us still live in poverty, because the default human state is to have nothing. That in no way implies a level playing field among two different people born today.

> If you change "nothing", with "no possessions, talents, abilities, or > skills", which is the same thing, then you'll see why what you're saying is > illogical.

You're still missing the point. I don't know how I can rephrase this in a way that won't be intentionally misinterpreted.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER41> The most bizarre aspect of it is that the very same people that lament that fact, are also the ones who support all its causes and throw the most violent tantrums to scuttle improving the situation. We have tried it their way for decade after decade after decade, and the astronomical cost has only led to barely measurable improvements at wild cost/benefit ratios, while being unsustainable on their own essentially everywhere those measures are not artificially scaffolded and have heavy layers of spin and blatant propaganda lies applied to it.

Maybe the worst part of it is that those very people don't even understand that they are doing any of that because they have been manipulated and lied to about both the causes and solutions as they have ever increasingly been drawn into a cult in which up is down, left is right, and only the con job leaders benefit from it. When you have fixed, preconceived notions about outcomes, don't be surprised that you cannot achieve them with the existing variables. You end up having to bend and manipulate and rig and patch things ever increasingly and more bizarrely in order to maintain the desired end state or outcome that the system becomes ever more unstable and fragile. See the mid aughts housing fraud, aka, housing bubble for reference. The conclusion was that house prices can only go up, so everything was subsequently rigged through self-perpetuating incentives to support that fixed assumed outcome. Precisely what keeps us repeatedly doing the things that have no effect on the desired outcome. But at least it supports a huge non-profit industry complex that perpetuates itself under the guise of "helping" .... itself to your money.

It's quite frustrating that in spite of the truth and solution being right before our eyes, because truth and reality is too inconvenient and difficult and uncomfortable because it does not fit with preconceived conclusions and assumptions, we simply want to ignore reality and substituted our own. And so goes the perpetual poverty "problem" that we are seeking "solutions" for. Organizations can't even move away from Microsoft products simply because they get money from the Gates foundation ... and we want to solve poverty? It's a bad joke.

As someone has said, our "help" and development money is taking money from poor American children, in order to give it to rich Africans ... who then scurry it away into offshore bank accounts.

I know this may make some arteries pop, but the President of Uganda puts it well: [http://thehill.com/policy/international/370435-ugandan- presi...](http://thehill.com/policy/international/370435-ugandan-president-i- love-trump-because-he-tells-africans-frankly)

</comment><comment><USER30> I'll go out on a limb and suggest that the U.S. immigration policy (or lack thereof) bears a signification part of the blame here.

Why in the face of globalization (and now increased automation) the U.S. continues to have an effectively open-door policy to low-skill workers makes no sense at all.

As a U.S. citizen, I'd like to see a return to the temporary moratorium that existed until the mid 1960s (say 10 to 15 years) on most immigration beyond high-skill (however that is defined) and an end to "chain migration" in which entire families are allowed to immigrate regardless of most other factors.

<comment><USER42> > Give me your tired, your poor,

> Your huddled masses yearning to breathe free,

> The wretched refuse of your teeming shore.

> Send these, the homeless, tempest-tost to me

I think it would be hypocritical at best, given America's history and current position to take such a stance. Surely the right thing to do is not to be scared of the immigration bogeyman and take some concrete steps towards the future, rather than closing the door and pretending things will get better by itself. It won't.

If you want to comfort yourself in a nice blanket of blame, go ahead and blame the immigrants rather than the people in power who have actually caused this.

<comment><USER30> That's from a poem tacked onto the Statue of Liberty in 1903, not U.S. law or policy. People quote that as if it's from the preamble to the constitution or something...

Mass immigration made sense when the U.S. was a manufacturing colossus, no longer. Immigration should be targeted and far lower than it is now.

<comment><USER42> Well it was also written specifically for the statue of liberty, and was 'tacked on' to it, not even 20 years after it was dedicated for a reason. Because that's literally what the statue represents.

It's kind of sad to see a nation built by, from and for poor immigrants completely forget their origins.

<comment><USER30> People haven't forgotten their origins at all; in fact most people are probably too overly proud of them.

But times also change. What may have made sense in 1903 may be detrimental to the descendants of those immigrants today. I believe we should have a sharp but temporary reduction in most immigration today to see if it benefits the lowest wage earners in the U.S. It's an easy policy to reverse if it doesn't.</comment></comment></comment></comment></comment>