Internet traffic for Google, Facebook, Apple was briefly rerouted to Russia - <AUTHOR> https://bgpmon.net/popular-destinations-rerouted-to-russia/ <comment><USER2> This is a well known "feature" (because it is not a bug) of BGP and every ISP worth their salt ought to be doing route filtering to prevent this sort of thing. If they're not, then the traffic can be diverted to Russia or the proverbial bit bucket rather trivially.

I understand that less network savvy readers think this story is about Russia, but it really is about ISP's and the old issue of lazy network admins who do not filter routes and what happens. You can replace "Russia" with "Canada" and it wouldn't change the meaning. The country attribution is based on the AS (Autonomous System) registration. If these were really the malicious state actors, they'd probably use an AS registered in another country to cover their tracks. This is either an honest mistake or possibly a "let's see what would happen" prank.

<comment><USER3> I understand ISP's are to blame here, but how is it _not_ about Russia, the article specifically states that only certain entities were targeted in a suspicious manner. Seems like nefarious purposes at work here no?

<comment><USER2> > how is it not about Russia

It could be, the key missing piece of information is the physical location of the actual router that is the ultimate source of this. It is only known by their peers or upstream and is not easily traceable (in the US it's usually under NDA and you'd need court order to find out "officially"). Some network admin somewhere probably knows. May be he/she reads HN. The second question is whether that device is hacked and is doing it unbeknown to its admin.

But without this information, the fact that this is an AS registered with a bogus .ru domain doesn't mean anything, this could be coming from Liechtenstein or Bolivia.

</comment></comment></comment><comment><USER4> The open trusting nature of BGP is kind of problematic isn't it?

[https://en.wikipedia.org/wiki/BGP_hijacking](https://en.wikipedia.org/wiki/BGP_hijacking)

<comment><USER5> Yes, but to be honest, it's not just BGP. One of the things that BGPMon won't tell you about since they're in the business of monitoring BGP is that the same attack is often performed by changing forwarding tables i.e. in network's data plane.

An attacker compromises a router (there are known vulnerabilities and back- doors) or gains leverage over a technician authorized to configure routers in some network. The attacker then manually changes the router's local routing table to forward packets to specific destinations through a different path. In such cases, the BGP path and announcements look absolutely fine and you'd need to look at the actual path at the data plane level to detect that something is wrong.

This is often done in big exchange points where many networks interconnect. These are places in which routers from major western countries can sit basically side-by-side with routers from Russia and China.

This isn't a paranoid fantasy by the way, I work for a company that monitors these kinds of attacks for a living.

<comment><USER6> > This isn't a paranoid fantasy by the way, I work for a company that monitors > these kinds of attacks for a living.

Then you'll certainly be familiar with some citation or documentation of evidence? I'm curious to see some.

<comment><USER5> I've asked around the company and unfortunately I can't talk about attacks (and/or suspicious "configuration errors") we've detected. There are legal issues involved, plus some of these cases are currently being investigated by law enforcement. Moreover, I don't know of any other company or person that deals with such attacks, so I have no one to quote. The only thing I can do is to offer some hand waving:

1\. It's known publicly that nation states as well as criminal organizations are deflecting Internet routes. There are numerous reports of such cases; these cases aren't that hard to find since BGP information is (mostly) public. A few published examples:

\- Russian network "Rostelecom" hijacks sites of financial services: [https://arstechnica.com/information- technology/2017/04/russi...](https://arstechnica.com/information- technology/2017/04/russian-controlled-telecom-hijacks-financial-services- internet-traffic/)

\- Global Large scale BGP hijacks in 2013, some through "Rostelecom": [https://arstechnica.com/information- technology/2013/11/repea...](https://arstechnica.com/information- technology/2013/11/repeated-attacks-hijack-huge-chunks-of-internet-traffic- researchers-warn/)

\- Spammers use BGP to announce fake IP addresses to spam yahoo mail users: [https://ripe72.ripe.net/presentations/45-Invisible_Hijacking...](https://ripe72.ripe.net/presentations/45-Invisible_Hijacking.pdf)

\- Traffic to UK organization that deals with nuclear weapons hijacked using BGP to the Ukraine: [http://hub.dyn.com/dyn-research/uk-traffic-diverted- through-...](http://hub.dyn.com/dyn-research/uk-traffic-diverted-through- ukraine)

\- BGP hijack of bitcoin miners: [https://bgpmon.net/the-canadian-bitcoin- hijack/](https://bgpmon.net/the-canadian-bitcoin-hijack/)

\- "Hacking Team" (Italian company selling spyware to law enforcement) helps Italian police perform BGP hijack: [https://arstechnica.com/information- technology/2015/07/hacki...](https://arstechnica.com/information- technology/2015/07/hacking-team-orchestrated-brazen-bgp-hack-to-hijack-ips-it- didnt-own/)

\- Chinese hijack of US military an governmental networks (2010): [http://www.theregister.co.uk/2010/11/17/bgp_hijacking_report...](http://www.theregister.co.uk/2010/11/17/bgp_hijacking_report/)

2\. There are known attacks against routing protocols which aren't BGP (e.g. OSPF, Black Hat 2011) and against routers (see CVEs for CISCO IOS).

3\. Routing changes that happen within an autonomous system leave a much smaller footprint compared to BGP.

4\. Nation states are known to have an interest in direct access into routers:

\- Suspected NSA example: [http://www.theregister.co.uk/2015/09/15/compromised_cisco_ro...](http://www.theregister.co.uk/2015/09/15/compromised_cisco_routers/)

\- Suspected Chinese example: [http://www.abovetopsecret.com/forum/thread350381/pg1](http://www.abovetopsecret.com/forum/thread350381/pg1)

5\. Network connect to each other (mainly) in central exchange points. In these exchanges networks can pay for a direct point-to-point connection from network to network, or use open peering through a layer 2 switch that aggregates connections from dozens or hundreds of different networks at once (Example: [https://www.de-cix.net/en/de-cix-service- world/globepeer](https://www.de-cix.net/en/de-cix-service-world/globepeer)). Hundreds of networks use these switches with very little visibility. Everyone can talk to everyone else on the same switch without leaving a trace. If a router connected to such a switch is locally configured to forward traffic to some other router on the same switch, it can do so regardless of BGP routing or any common sense.

</comment></comment></comment></comment><comment><USER7> 'normally' it gets routed to US (even if they have servers elsewhere to handle same shit...), which for most countries is actually more worrying...

<comment><USER8> If you believe that Russia is less worrying than US, then... err... I don't believe you exist actually.

<comment><USER9> Well, if you are a security researcher, Russia is less apt to redirect your flight mid ocean and arrest you in a country you weren't even going to. So I guess the US _just might_ be more worrying to particular people based upon their occupation.

<comment><USER10> Security researcher is a pretty loose and fear mongering title to describe Snowden's actual role - Taking sensitive government secrets to a hostile foreign power in the name of whistleblowing.

But please, don't let my clarification get in the way of your whataboutism.

<comment><USER11> 'to a hostile foreign power'? You mean the public? The US government is why Snowden is in Russia, not Snowden. He didn't go to Russia. His flight was forced to land there when the US revoked his passport mid-flight.

<comment><USER10> Yes, to a hostile foreign power. The public isn't a place you can reside. Russia is, however.

> The US government is why Snowden is in Russia, not Snowden

The US government is not why Snowden is in Russia, Snowden is why Snowden is in Russia. He _went_ to Russia intentionally. He wasn't kidnapped, he chose Russia as a destination specifically due to their reluctance to cooperate with the US.

> He didn't go to Russia. His flight was forced to land there...

That's not what happened, please reread his flight history because the facts are well known at this point. He told his superiors at the NSA that he was headed to the mainland USA for medical treatment, but instead flew direct to Hong Kong where he lived for over a month. 30+ days after arriving in HK he fled to Russia, with the intent of fleeing to Cuba the next day.

> ...when the US revoked his passport mid-flight.

His flight wasn't forced to land mid-flight because Snowden never even boarded the plane that day. His passport was revoked before the Cuba trip, leaving him stranded in the Russian airport.

If you're going to shill for someone who is unwilling to come back to the US to be held accountable (rightly or wrongly) for his actions, please be factually correct about it.

<comment><USER12> >The US government is not why Snowden is in Russia, Snowden is why Snowden is in Russia. He went to Russia intentionally. He wasn't kidnapped, he chose Russia as a destination specifically due to their reluctance to cooperate with the US.

He chose Russia as a layover location, Hong Kong has a limited number of outgoing flights and that likely was the one the US would be least able to grab him. However, the US is why he is in Russia now. You mention that he had a flight to Cuba booked, and his ultimate goal was Ecuador.

There is no proof that he took "state secrets" to Russia. By his account he had destroyed any of his remaining copies before leaving Hong Kong. This is a far more egregious error than confusing a layover stop for being forced to land.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> In 1998, a hacker collective known as the L0pht testified in Congress that they could take down the Internet in 30 minutes.

It is believed BGP black holes could be one way of achieving this.

Basically tell every node "I've got the lowest routing cost to every node, send me all your traffic", and then drop all the traffic.

<comment><USER14> This is much better nowadays but bgp is still problematic.

<comment><USER5> It's not really better today. Possibly even worse.

In 1998 there were fewer than 5000 different networks (Autonomous systems) on the Internet. Today that number is over 80K. Network operators used to personally know each other and their clients.

So the automatic filtering is better today than it was in 1998, but it can still be easily bypassed.

I know for a fact that even as a tiny network, all you need to do to get the some of the biggest networks in the world to accept your (real _or fake_ ) BGP announcement is to email their support center.

<comment><USER15> Aren't ASNs capped at 2^15 (65k and change)? Or has the IPv6 expansion already started happening?

<comment><USER16> ASN's switched over to 32 bits around 2007

<comment><USER15> Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER17> Could someone explain in laymen terms what happened and what that means?

<comment><USER18> Basically, a router somewhere in Russia claimed to be the owner of some ip addresses belonging to Google, Facebook, etc. Other neighbouring routers began forwarding packets from actual users to this router. The packets contain the HTTPS requests people were making to these sites.

<comment><USER19> Bit late to the party but what could be done with the information that they got their hands on?

</comment></comment></comment><comment><USER20> If this is not a reason to punish (blackhole?) that AS I don't know what is.

<comment><USER5> Sure, it's a reason to blackhole the isp, but this is the Internet we're talking about. So say its upstream providers will backhole it, say even the tier 1 providers do the same.

That won't stop it from connecting to smaller networks and announcing the same fake routes there. And even if the small networks blackhole it, the attackers can just register a new AS.

Also, there are cases in which attackers are performed from large networks, with millions of users. Are you going to blackhole such a network? They'll apologize and claim that it was a configuration error.

Note that these types of attacks are generally not performed by amateurs. They're performed by states, intelligence agencies, criminal organizations and the like.

</comment></comment><comment><USER21> Is it fair to say BGP in general relies on "good will" trust model? I wonder if there exists an authoritative mechanism similar to browser punishing rouge or incompetent CA. I supposed the integrity and the authentication is achieved by implementing and deploying RPKI, but what about punishment?

<comment><USER5> > Is it fair to say BGP in general relies on "good will" trust model?

Yes.

> I wonder if there exists an authoritative mechanism similar to browser > punishing rouge or incompetent CA

Not really. Although if you get a reputation for being notoriously problematic, the "big boys" \- the large networks who are the responsible adults in this game might deny you service or stop accepting your announcements.

> I supposed the integrity and the authentication is achieved by implementing > and deploying RPKI

RPKI doesn't really solve the issue. It validates only the initial announcer, so BGP hijacks can still occur. It would however help reduce hijacks due to mistakes in configuration.

</comment></comment><comment><USER22> What is a prefix (in context), and what does it mean to 'announce' one?

<comment><USER23> A prefix is an IP subnet, basically.

Most here are familiar with Google's public DNS resolver, 184.108.40.206, so let's use that as an example.

Google has been assigned the autonomous system number (ASN) 15169. The 18.104.22.168/8 IP address space was allocated to Level3 and they have reallocated a small part of it, 220.127.116.11/24, to Google.

Google, when speaking to their BGP peers, "announces" routes, including an announcement for the 22.214.171.124/24 prefix.

An announcement is basically Google's router telling, for example, Level3's router, "Hey, I know how to get to 22.214.171.124/24\. If you have traffic going there, you can send it to me."

Level3 then passes that along to other peers, like me. Level3 says, "If you have traffic for 126.96.36.199/24, you can send it to me and I'll send it on towards its origin". The announcements continue to be passed along to other peers.

A withdrawal is the opposite of an announcement: "Hey, I don't have a route to 220.127.116.11/24 anymore" or, in many cases, "the route to 18.104.22.168/24 has changed, here's the new one".

Here's a (slimmed down) example from one of my routers:

      # sh ip bgp 22.214.171.124/24 | b 3356
        3356 15169, (received & used)
          184.108.40.206 from 22.214.171.124 (18.104.22.168)
            Origin IGP, metric 0, localpref 100, valid, external, best
            Community: 3356:3 3356:86 3356:575 3356:666 3356:2042

This shows the "AS path" (the path through the various ASNs back to the origin), "3356 15169". AS3356 is Level3. We can see that AS15169 (Google) originated the prefix (220.127.116.11/24), and announced it to their BGP peer, Level3. Level3 then passed that announcement along to my router.

Here's the same thing for 184.108.40.206/24, mentioned in the article:

      # sh ip bgp 184.108.40.206/24
      BGP routing table entry for 220.127.116.11/24, version 1125190207
      Paths: (1 available, best #1, table Default-IP-Routing-Table)
        Advertised to update-groups:
              4
        3356 209 40839, (received & used)
          18.104.22.168 from 18.104.22.168 (18.104.22.168)
            Origin IGP, metric 0, localpref 100, valid, external, best
            Community: 209:209 209:13070 3356:3 3356:22 3356:86 3356:575 3356:666 3356:2042

The AS path here is "3356 209 40839" which shows that traffic from me to 220.127.116.11/24 will first go to Level3 (AS3356), then to Qwest/CenturyLink (AS209), and finally to AS40839 (Kohl's Department Stores).

With regard to the hijack described in the article, this means that another organization announced the prefixes into BGP, effectively saying, "So, all of that traffic you have that's going to Apple/Facebook/Google/etc., just go ahead and start sending that to AS39523 now". Instead of ending up at Apple/Facebook/Google, it'll instead be redirected to this unknown organization in Russia.

(N.B.: Before anyone chimes in to "correct" something, this is a bit simplified. There's much more to BGP than this and there are a number of different factors which determine which route is chosen. A longer prefix -- mentioned in the article -- is one way to "defeat" a better route.)

<comment><USER24> One curious thing about 18.104.22.168 (and 18.104.22.168) is that it gets redirected to the closest Google CDN.

<comment><USER25> > One curious thing

DNS is something that's commonly Anycasted. In laymen's terms, basically what that means is rather than 220.127.116.11 pointing to one server (or a load balanced cluster in one DC) as you might expect, it rather points to potentially thousands of servers all over the globe and the closest one (BGP route wise) is the one picked for you.

<comment><USER26> 220.127.116.11 is already an IP address so DNS is not involved. The anycast is handled by just BGP.

<comment><USER25> Kelnos was correct, the service that 220.127.116.11 provides is DNS, hence the relevance when talking about 22.214.171.124 being anycasted.

<comment><USER26> Man, I must have been asleep this afternoon because I could not figure out what a bare IP address had to do with DNS. I get it now.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> I've often said it's just as well that the public doesn't understand how BGP actually works.

<comment><USER5> It's not just the public, it's professionals too.

There are probably more brain surgeons on earth than people who understand how BGP works.

</comment></comment><comment><USER28> basically, a more specific routing address is used to direct packets through a specific route. In the earlier instance( the second example) Japan was the target. It is easy to see how the routing system in japan could have been crashed through such an overload (basically a ddos). Who would do that to Japan? China? Korea?

In the more recent instance, all the traffic from google, facebook, apple, and other major players was routed through russia. Is this china making russia look evil? after all, if the traffic is going through russia, all russia has to do is turn off the power for that router to momentarily stop all traffic.

or is this the NSA trying to #uck w russia and at the same time trying to create an incident so the fcc kills net neutrality to provide 'security'.

This is state of the art espionage

</comment><comment><USER29> This is not the first time when BGP is misused this way. I think governments should regularly perform live tests to check whether their countries' AS's can be hijacked.

<comment><USER5> > I think governments should regularly perform live tests to check whether > their countries' AS's can be hijacked.

That's a waste of money and effort. They should just write "yes" on a piece of paper, there's really no reason to check.

</comment></comment><comment><USER30> That AS was registered to dv-hyperlink.ru which is not in whois database

Looks suspicious. How did they register an AS to a non-existing company to begin with?

<comment><USER31> It was assigned by RIPE to "Vasilyev Ivan Ivanovich, 8 Pionerskaya st., office 10, Nekrasovka, Khabarovsk region Russia".

ALFA TELECOM s.r.o., in the Czech Republic seem to have acted as sponsoring LIR for the allocation.

RIPE rules require that the sponsoring LIR submit documents to them showing the legal standing of the organisation that will use the resources. So in theory that should have happened here.

</comment></comment><comment><USER32> I always wonder how Russian people, either Russian Americans or Russian citizens, feel about all this Russia hysteria.

<comment><USER33> Putin's approval rating is in the 80s.

That should be enough to tell you what they think of you without looking at polls.

(IIRC they were trying to shut down the one independent poll firm recently)

</comment></comment><comment><USER34> Isn't that what https is for ? So no one can read the traffic ?

<comment><USER35> Even with encrypted traffic, an attacker can learn things, especially if you get DNS and SNI data

I suspect (but cannot prove) that this might have been a leak from Russia's internal internet into the wider global net. Since Russia isn't well known for it's privacy respecting nature, it might have been a traffic scanner to see if people are being good citizens. However, that is just speculation and I hope it's wrong.

<comment><USER36> Yep, all you need to know is the IP addresses of certain domains (say Facebook) and then look for user IP transferring a lot of data to it meaning they are probably uploading a photo. Now tie that IP to an ISP and maybe a user and you can find out who might be posting derogatory memes about Putin.

<comment><USER29> But you don't have to change routing for that - you can do that with just passive monitoring. And by the way, the law [1] that requires ISPs to store up to 6 months worth of traffic is coming into effect next year. So even monitoring won't be necessary.

Maybe they were testing effective ways to block foreign sites?

[1] [https://en.wikipedia.org/wiki/Yarovaya_law](https://en.wikipedia.org/wiki/Yarovaya_law)

</comment></comment></comment></comment><comment><USER37> hopefully Comcast and AT&T will fix this soon

</comment><comment><USER38> Someone should make a blockchain-based routing system.

<comment><USER39> It's called UUCP.

Transactions take 3-5 days to process, are sometimes lost, but hey, it's the next great thing, so worth every expensive penny.</comment></comment>


Ask HN: How to monitor what happens to device examined at US border? - <AUTHOR> If these folks are going to monitor us and take our electronic devices, we might as well monitor them whilst they do so...hypothetically speaking of course.
So what are your suggestions for software that would monitor everything that happens to the device?
I'm talking both phones and laptops or any other devices you carry. <comment><USER2> For iPhone owners for example, use 3rd party apps for contacts, emails, web browser, etc. Typically google apps like chrome, gmail, etc. Delete them right before the border check. Clear your caches just in case. Then re-download them when you're done.

Long story short, move all your data to the (evil) cloud and just synch so you never lose your history and configurations.

<comment><AUTHOR> Good advice, but this doesn't answer the question posed though.

</comment></comment><comment><USER3> If I ever* travel to the US again I shall avoid all of the above by NOT taking my real laptop and phone; I may take fresh ones or buy/borrow while in the US to finesse the issue.

I know it doesn't answer your question directly, and whatever other answers you get may still be applicable to fresh kit brought in.

*In the foreseeable future, with fingerprinting and device scanning and generally treating all visitors as at least a nuisance...

<comment><USER4> There was extensive discussion about this in another thread, and the basic idea was that it doesn't matter if you carry dummy devices. They can just force you to login to your accounts.

At a minimum you'll need an email and facebook to appease them, likely. If you're targeted.

<comment><USER3> I simply won't be carrying my passwords with me, and I don't have them memorised.

I would use fresh accounts while travelling and not update social media.

I would apply the same rules to China, but nowhere else that I can think of right now. Maybe Russia.

</comment></comment></comment><comment><USER5> How often does this actually happen? Never been to the states, keep hearing rumors of illegal device searches like that.

<comment><USER3> I gave up travelling to the US approximately at the intersection of the time that (a) automatic fingerprint scanners were brought in at US borders and (b) the TFA lost a copy of all its own staff's confidential data. I can't afford to replace my fingerprints when the TFA discloses that data. Plus from other environments I know that my fingerprints don't scan very reliably for whatever reason.

Also I realised that on every visit that I could remember I was getting my baggage searched like some kind of persona non grata, which annoyed me a lot when I thought about it. And this on various flavours of visa/waiver coming from the UK.

So searching laptops etc just for the sake of it, never mind necessity, utility, privacy or courtesy, is a logical (unwelcoming) extension of this.

<comment><USER6> I'm from the US, got my stuff searched both times I went out of the country by that country's border patrol.</comment></comment></comment>


Rockerbox - Your machine-learning personal shopping assistant - <AUTHOR> http://getrockerbox.com/ Check out Rockerbox! Rockerbox learns your unique tastes and guides you to what you'll actually want. Shopping used to be hard...until Rockerbox. <comment><USER2> Just a nitpick:

"Stop struggling to find products and let Rockerbox give you hand."

You're missing an "a" between "you" and "hand."

<comment><AUTHOR> Thanks! Fixed.

</comment></comment><comment><USER3> hopefully this will be a bit more personalized, sometimes amazon takes to heart those stupid links i click and thinks I like shirts with wolves...

<comment><AUTHOR> Exactly. We're trying to _actually_ learn what you'll like and showing you only those products. Not just a "Customers Who Bought This Item Also Bought..."

</comment></comment><comment><USER4> why is it called rockerbox? what does that name have to do with shopping?

<comment><AUTHOR> Rocker boxes used to be used by gold miners to separate gold from sand / gravel. We're trying to do the same for products - helping you find the "golden" product that is best for you.

Somewhat of a stretch...but it works.

<comment><USER4> i had no idea what a rocker box was (and i would guess most people would be in the same boat). it sounds like it has something to do with music.

</comment></comment></comment><comment><USER5> So, this just gives me ads?

<comment><AUTHOR> Nope. You swipe through products, liking or disliking each one. We learn what sort of things you like and guide you to the right ones. We want to help you browse for products.</comment></comment>


Show HN: Minecraft Ipsum, my first side-project ever - <AUTHOR>

http://minecraft.gdwsk.com<p>I go to school at California Institute of the Arts for Music Technology, so programming and web dev and the likes aren't quite my forte. In the Music Tech program, we are required to take a couple programming classes (ChucK, Processing, Arduino), so I figured it's summer and I have plenty time to work on a side-project. I'm an avid Minecraft player, and, given the vast number of blocks and items in Minecraft, I decided to create a simple website to generate placeholder text (lorem ipsum dolor blah blah blah) using Minecraft words! I created the website using Bootstrap, with an external JavaScript file to generate the text. The site itself is hosted on Amazon S3 for the time being. <comment><USER2> Cool project! Have you considered some sort of a selector that lets you choose how much text you want to generate? Generally you'll want more than a sentence of filler text.

<comment><AUTHOR> Thanks! Yea, that'll be my next step forward. Because of the absurdly strange way I came up with of generating the sentences, I'm having a difficult time figuring out a way of doing that without completely re-writing my function. I'm sure I'll get that functionality working eventually, just need to learn more about JavaScript at this point in time.

<comment><USER3> A loop and an array is all you really need.

        for amount of lines needed:
            array.append = function call()

Then iterate over the results to display them. Not perfect, but will work without changing much.

</comment></comment></comment><comment><AUTHOR> Clickable: [http://minecraft.gdwsk.com](http://minecraft.gdwsk.com)

</comment><comment><USER4> This is hilarious. Next up, Minecraft Haiku's?

<comment><AUTHOR> Haha thank you, maybe I'll add that functionality in!</comment></comment>


Firefox 8 is 20% faster than Firefox 5, matches Chrome 14 - <AUTHOR> http://www.extremetech.com/internet/89570-firefox-8-is-20-faster-than-firefox-5-matches-chrome-14

<comment><USER4> Mozilla needs to do something to de-dramatize what some people see as version inflation. A lot of people get anxious to see these very frequent bumps because major x releases are associated with add-ons not working, bloat, etc.

<comment><USER5> True, but on the other hand people will get used to it, just like they did with Chrome. The version number doesn't matter, all that matters is that it works.

I _like_ to see Mozilla responding. I don't know if development has speeded up, but it seems to have done. If they can keep this up without letting security slip I'll be impressed.

<comment><USER6> The problem with Mozilla is that they make the actual number an important part of their communication. With Chrome on the other hand, you rarely hear about version numbers - you just know they exist and that you don't need to care.

<comment><USER7> Not anymore. Mozilla is dropping the version number everywhere, except where it matters. Notice how in the blog posts that there's no version numbers mentioned, anywhere:

[http://blog.mozilla.com/futurereleases/2011/07/07/firefoxaur...](http://blog.mozilla.com/futurereleases/2011/07/07/firefoxaurora7/) [http://blog.mozilla.com/futurereleases/2011/05/27/firefoxaur...](http://blog.mozilla.com/futurereleases/2011/05/27/firefoxaurora/)

<comment><USER8> And it matters to extension makers. And those need constant repackaging especially for addons that are no more under active development.

<comment><USER9> That's no longer true.

<http://www.pcmag.com/article2/0,2817,2387399,00.asp>

</comment></comment></comment></comment></comment></comment><comment><USER10> You couldn't have a better demonstration of why competition is good.

I stick with FF because I prefer the interface, but there's no question that all web browsers have become much better since Chrome's introduction. And if you're willing to drop support for IE6, web development is really a pleasure compared to five years ago.

<comment><USER11> I switched to Chrome because of all the memory issues and crashing. But there are so many little details as well as add-ons that I miss from FF that I'm pretty excited about version 8. If it proves out, I'll switch back.

</comment></comment><comment><USER12> What about type rendering?

If FF on OSX no longer uses quartz to perform drawing operations, what implications are there for type rendering? Will OSX users be subjected to the (IMO) ravages of freetype? Or will each platform continue to use native type rasterization?

<comment><USER13> AFAIK Firefox still uses Quartz; in fact it's now supposed to be Quartzier with less Cairo overhead.

<comment><USER12> RTFA: "Azure removes the Direct2D and Quartz (OS X) go-between and allows Firefox to write directly to the underlying 3D subsystems (Direct3D and OpenGL)."

<comment><USER14> That seems like a journalistic misunderstanding; I'm pretty sure Azure is designed to replace Cairo as the layer between Firefox and Direct2D or Quartz.

</comment></comment></comment></comment><comment><USER15> I'm all for speed improvements, feature parity, etc., but my question is why has it taken a (somewhat) radical change to versioning/release-schedules to realize these performance improvements?

If these latest benchmarks hold up, then Mozilla will have noticeably reduced the memory footprint in FF7 and then again noticeably sped up the browser itself in FF8 (all of this coming within a matter of _weeks_ ). Can it really be that these two (suddenly important) features went largely unaddressed in Firefox 3 and 4 because of a different release cycle?

I'm very happy to see the competition, but if Mozilla has been able to address these two long-standing gripes in a matter of weeks, then I find it somewhat implausible that it was ever a technical issue.

<comment><USER16> Firefox 4 was a lot faster than Firefox 3.6 in all sorts of ways.

Some of those improvements were checked in before Firefox 3.6 was even released.

The only reason it looks like they took a long time to do is because the release cycle for Firefox 4 was long, so you didn't see the improvements until the final release of Firefox 4.

So all the release schedule is doing here is getting improvements out to users closer to when the code is written.

</comment></comment><comment><USER17> Chrome's killer feature for me is still process separation. Slow pages kill my entire browsing experience in firefox, and when I have 20+ tabs open, that can be really annoying.

<comment><USER18> You know Mozilla's working on that, right?

<comment><USER17> I didn't, but that's really good news :)

</comment></comment></comment><comment><USER19> Firefox 8? What happened to 6 and 7? I see 7's mentioned in the article, but there's not hide nor hair of Firefox 6.

<comment><USER20> 6 is in beta now. Nightlies were 7.0a a few days ago, but if you update.... yep, 8.0a1

PS. Nightly has been incredibly stable on my Mac. I actually use it in production, for no other reason than I was testing it and have no reason to get an old release since it's never crashed and is incredibly fast.

<comment><USER19> > Nightly has been incredibly stable on my Mac.

As stable as Chrome dev channel? I use Chrome dev channel (on Linux), but I'm still a bit hesitant about using the Firefox nightlies.

<comment><USER20> Zero crashes, zero manual restarts, zero lag.

<comment><USER19> And addon support?

<comment><USER21> I run Aurora and use the Add-on Compatibility Reporter[1] to disable version checks and run any add-on I want. For most of my add-ons this works fine, but if there is a significant API change an add-on might not work correctly. But if you were scared of that you wouldn't be using Nightly or Aurora.

[1]: [https://addons.mozilla.org/en-US/firefox/addon/add-on- compat...](https://addons.mozilla.org/en-US/firefox/addon/add-on- compatibility-reporter/)

</comment></comment></comment></comment></comment></comment><comment><USER22> Just had a play with Firefox 8. It's certainly fast but they've copied Opera & Chrome with removing the "<http://> from the URL bar. I can see the arguments for the change but this feels really wrong to me. I hope there's an about:config tweak somewhere to change it back; even if there is, it's a shame Mozilla have gone down this route.

<comment><USER23> browser.urlbar.trimURLs

I don't like the change either. It's one of the many reasons Chrome's UI is terrible. Opera actually implements it pretty well through, since when you click in the location bar the part to the left gets replaced with <http://>.

</comment></comment><comment><USER24> I was expecting a parody of version number inflation, but it seems to be a real article. So FF really jumps to version 8?

<comment><USER25> No, but 8 is the version in development right now. 6 and 7 are being tested.

</comment></comment><comment><USER26> 20% sounds good, but unless versions 5, 6 and 7 also had 20% improvements, it would still be slower than the current version of Chrome on canvas stuff.

For the relatively simple canvas rendering I'm doing, I can watch Firefox chugging along at 10fps struggling to render a few dozen filled rectangles, while Chrome is happily pegged at 60fps (via RequestAnimationFrame).

It's just night and day.

<comment><USER23> Canvas on Firefox is hardware accelerated (at least on Windows), so it's really fast. I don't have Chrome installed, but I'm pretty sure it chokes on the FishIETank benchmark with 1000 fish: [http://ie.microsoft.com/testdrive/Performance/FishIETank/Def...](http://ie.microsoft.com/testdrive/Performance/FishIETank/Default.html). Firefox on the other hand easily gets 60 fps with those many fish.

<comment><USER26> Excellent example. On my system, Chrome12 will do 100 fish at 25-30 FPS, while FF5 chugs along at 7-10fps.

Neither is particularly good, but the Chrome one is at least watchable.

<comment><USER23> That just means your Firefox isn't benefiting from GPU acceleration. It could either be because your OS or hardware doesn't support it or because your graphics drivers are out of date.

<comment><USER26> The reason why is unimportant. The end result is the same: terrible performance on Firefox, good performance on Chrome. It's not up to the end user to know or care why.

<comment><USER23> Terrible on YOUR machine. On something like 45% (and increasing) of vista or win7 machines the story is the opposite.

</comment></comment></comment></comment></comment></comment><comment><USER27> I might go back to Firefox when it no longer consumes gigabytes of RAM after a few hours of operation. Until then, I'm with Chrome. I don't care about speed as much -- so long as it's reliable, and doesn't grind the rest of my machine to a halt, it's all good.

<comment><USER28> Chrome is very wasteful; only after many hours of operation in which you opened and closed dozens and dozens of tabs, it starts to be better than Firefox; as Firefox fragments memory and doesn't release it properly when closing a tab.

But for my usage patterns; with many tabs opened after a few hours of operation, Firefox consumes less RAM for me.

Also, don't confuse memory waist (coming from bloat and fragmentation) with memory used for improving the browsing experience, like caching. These browsers are doing a lot of caching and I personally don't like having 4 GB of memory and being left unused.

<comment><USER29> memory footprint or not, chrome is faster than firefox. both in terms of page loading, and raw operation. i might reconsider firefox when it doesn't take 4 times longer to boot up.

<comment><USER28> I am on Firefox 5 and I don't see visible differences between them anymore. Yes, Firefox 3.x used to be visibly slower.

I also don't see visible differences in boot time, but this depends a lot on how many extensions you have -- I only use Firebug and the Web Developer toolbar. And at least Firefox has plugins that aren't totally useless.

<comment><USER30> I think it depends on what hardware you're running. On my laptop Chrome is so noticeably better I only keep Firefox around for testing. On my maxed out desktop I can't tell the difference.

</comment></comment></comment></comment></comment><comment><USER31> Hmm.. If a browser really wants to make a dent I think they need to diversify their marketing push. It needs to be cool to the people who need cool, safe and trustworthy to the people that need that, technically sound, exciting and promising to us geeks.. At the moment it seems that they try to do a bit of all this at once, but maybe separate voices focussed on these markets would be more effective?

</comment><comment><USER32> Peacekeeper Benchmark

Firefox 5.0 - <USER2>

Firefox 8.0a1 - <USER3>

19.5% improvement. Pretty much dead on.

Specs: Core i3 M330 2.13 GHz, Linux i386

<http://clients.futuremark.com/peacekeeper>

</comment><comment><USER33> I am using it on my macbook pro. FF8 is faster compare to FF5 I was using. Schubert-it PDF plugin, Adblock, XMark, Flashgot works. Firebug, Google Dictionary, Download statusbar don't work... and there are some minor bugs with mouse hover effect.

<comment><USER34> Yeah, I just downloaded firefox-trunk in ubuntu, and it certainly is fast, fast enough that I can go back to using it for Microsoft Exchange webmail (which was the real killer before.) But not having the extensions is going to be a pain. I think I might try to port "It's All Text!" to 8...

</comment></comment><comment><USER35> This is pretty crappy. What is the rendering difference of 5 to 8? How many versions am I as a web developer going to have to support. short dev cycles and fast releases like this are stupid.

<comment><USER36> FF is now autoupdating, so once 5 was out 4 stopped being supported, and this will now continue.

So you only have to support the latest version.

<comment><USER37> And 3.6, at least for a little while.

</comment></comment></comment><comment><USER38> It seems to me that the point of having a version for a browser is for developers. Otherwise, it shouldn't matter.

What browser do you use? Safari. Chrome. Firefox. IE.

</comment><comment><USER39> Why don't they just make 5 faster and make five be the top number and make that a little faster?

</comment><comment><USER40> So Firefox took 10 years to go from version 1 to 3. And took 1 year to go from version 4 to 8.

</comment><comment><USER41> Can we assume that the benchmarks mentioned for OSX apply equally to Linux?

<comment><USER13> No, but it looks like performance is improving on all platforms.

</comment></comment><comment><USER42> Firefox 18 is going to be 23% faster than Chrome 34

</comment><comment><USER43> What happened to Firefox 6 and 7?

<comment><USER44> Ain't released yet. <https://wiki.mozilla.org/RapidRelease/Calendar>

</comment></comment><comment><USER45> wow guys, slow down a little bit...

</comment><comment><USER46> I find the innovation that competition spurs to be beautiful, even if that innovation is "just" squeezing performance out of every crevice you can find.

</comment><comment><USER47> So then Firefox will still be behind Chrome? Firefox 7 will be the one launched in the same time with Chrome 14.

Chrome 14 should be stable in about 8-10 weeks. Firefox 8 won't be stable until 14-16 weeks from now. That's around the time Chrome 15 will be out.

<comment><USER48> The release number should just be the date. That way geeks can stop worrying about the number, and get back to work.

<comment><USER49> It's incredible the sound and fury generated by version numbers. Ubuntu is almost there if they would just drop the rather silly animal names and stick with 10.04, 10.10, 11.4, 11.10 et cetera. Also having such a easy to remember and unique string makes searching for support and technical questions nice.

<comment><USER50> Ubuntu's animal names make it _easier_ to search for support and technical questions-- "maverick", "natty", and "lucid" are all much more likely to be associated with Ubuntu than numbers like 10.10.</comment></comment></comment></comment>


The TSA's True Focus Isn't Safety - It's Self-Preservation - <AUTHOR> http://www.techdirt.com/articles/20121217/17563321412/tsas-true-focus-isnt-safety-its-self-preservation.shtml <comment><USER3> See Pournelle's Iron Law of Bureaucracy: [http://en.wikipedia.org/wiki/Jerry_Pournelle#Iron_Law_of_Bur...](http://en.wikipedia.org/wiki/Jerry_Pournelle#Iron_Law_of_Bureaucracy)

 _In any bureaucracy, the people devoted to the benefit of the bureaucracy itself always get in control and those dedicated to the goals the bureaucracy is supposed to accomplish have less and less influence, and sometimes are eliminated entirely._

<comment><USER4> This is why these hit pieces are completely unfair to the TSA. Just about every organization becomes self-preserving as its primary function. Government and non-profit are the most obvious but the bureaucracy of for-profit companies and even individual divisions inside of those companies follow the same rules.

I was just looking over the recent Android handsets via tmobile and was shocked at the nightmare of tacked-on apps and other carrier garbage on them. All these divisions in t-mobile are trying to justify their existence by dropping various apps on the handsets like music managers, music stores, t-mobile tv, AV, security, etc etc. No one wants or needs these and the few that do will find them in the play store.

Look at well run companies like Apple or Google. The iphone and the Nexus have none of this junk. I imagine their corporate culture is a lot less bureaucratic than that of a carrier like tmobile.

>in any bureaucratic organization there will be two kinds of people: those who work to further the actual goals of the organization, and those who work for the organization itself.

I like to think Apple and Google are the former and carriers in the latter.

<comment><USER3> > _Just about every organization becomes self-preserving as its primary > function._

But when they prioritize self-preservation over their intended goal, that's __bad __.

<comment><USER5> I think the real issue arises in organizations where self-preservation is actually at odds with, or at least orthogonal to, the organization's stated goal. Take the TSA, for instance (and many government agencies, departments within large corporations, nonprofits, etc.).

The supposed goal of the TSA is to efficiently and effectively protect travelers and the country from criminal and terrorist actions. In theory, if the TSA is doing its job well, it's actually _reducing_ budgetary needs and slashing fat in favor of efficiency. The TSA should be trying to become _clever_ and _nimble_ , moreso than massive and overhead-burdened.

But the self-preservation mandate suggests the opposite. Self-preservation, for a government agency, means making sure you preserve or grow your budget year over year -- because you're fighting other agencies for it. Every dollar you get is up for grabs by other agencies next fiscal, and vice versa. Accordingly, becoming expensive and inefficient works in favor of self- preservation. As any seasoned bureaucrat knows, not achieving results means asking for more money to throw at the problem. If the TSA demonstrated that it was achieving its goals at current budget levels, it wouldn't receive the same budget next year. Or even face a budgetary reduction.

<comment><USER6> I think most people are resigned to the existence of bureaucracies, _despite_ such problems as rent-seeking, inefficiency, etc, as long as they meet a few basic criteria:

(1) they serve some reasonably obvious positive purpose

(2) the negative effects of what they do aren't _too_ noxious, in particular when compared with (1)

The TSA, it would seem basically fails on _both_ points. Despite the good intentions with which it was formed, it's pretty clear that they don't improve safety in any significant manner (you might find people some disagree about this, because they believe the security theater, but I think the number is dropping). The _negative_ effects of their existence, of course, are legion, (I suspect it's quite hard to find anybody that disagrees on this point!).

So I'd suggest the public probably on average doesn't support the TSA to the same degree they might other bureaucracies, even those that they find annoying.

Unfortunately, of course, the public's opinion on the matter is of little importance once the system is in place...

</comment></comment></comment></comment></comment><comment><USER7> The TSA is good for a variety of business interests. One specific example is the manufacturers of back-scatter X-Ray machines. They're hideously expensive and pure security theater but, in large part thanks to the TSA, they're in most U.S. airports now. How would you like to own a company that makes a product that doesn't actually have to work in order for you to gross billions?

Now, if this bothers you, you should probably pay attention to the fact that the market for these toys is expanding. Rapidly.

[http://www.propublica.org/article/drive-by-scanning- official...](http://www.propublica.org/article/drive-by-scanning-officials- expand-use-and-dose-of-radiation-for-security-s)

You know when you're about to step through one of these scanners at an airport, but now one can drive right past you in your car without your knowledge! Despite their lack of concrete results in airports, the back- scatter X-Ray machine market is exploding into new form-factors, and it's all thanks to U.S. taxpayer dollars.

The horrible punch-line to this is that these back-scatter vans face an almost impossible task. It's hard enough to tell bombs from batteries in the controlled setting of a an airport security check-stop. Imagine trying to distinguish bombs from the random things people keep in their cars! The crews operating these vans must generate so many false-positives that, in order to reach the point where they can actually provide some real measure of security, they would need to be supremely competent, supremely dedicated, and entrusted with extraordinary powers to search suspicious vehicles. All of the above are improbable. I will eat my shorts the first time one of these back-scatter vans actually finds a real car-bomb.

<comment><USER8> The image of the RadPRO SecurPASS in that link is _outrageous_ with respect to actively exposing individuals to x-ray radiation. Inmates are x-rayed every time they return from work detail.

Why do we have to learn the lesson over and over again that x-ray radiation causes cancer? I hate the arguments that it _only hurts us a little bit each time_.

</comment></comment><comment><USER9> So they think patting down 5-year-old girls and 90-year-old grandmas and grabbing my testicles each time I have to fly - not actually making the country more secure? Banning cupcakes and handbags with gun-shaped emboidery is actually not protecting us from terrorists? I can't believe it...

<comment><USER10> The TSA is clearly flawed, but I'm happy that planting bombs on oblivious children and elderly is an ineffective tactic.

<comment><USER9> Was it ever?

</comment></comment></comment><comment><USER11> The whole trick of designing institutions is to make sure that when they act for their own self-preservation (as they will and do) they will simultaneously be achieving the goal we want them to be achieving.

<comment><USER12> So, ensure that organizations that fail to achieve their goal go away? This isn't complicated: if you want to keep your job, you need to do it, and meet some sort of standard in doing so.

The problem is we've somehow managed to create organizations that continue to exist even when they completely fail to accomplish the intended tasks. Once your method of self-preservation shifts from "functioning" to "lobbying", the whole thing needs to be dismantled.

The TSA is fortunate in that they have other people lobbying on their behalf, but that doesn't change the fact that they exist due to legislation rather than effectiveness.

</comment></comment><comment><USER13> Link to cut through the blogspam to actual Govt Accountability Office report:

<http://www.gao.gov/assets/660/650364.pdf>

<comment><USER14> I don't think it's "blogspam" to summarize and contextualize a dry government report.

</comment></comment><comment><USER15> HN has quite an anti-TSA bias. The TSA has problems, but so does every large organization. I suspect HN'ers glare at the TSA because they travel frequently, and it would benefit them disproportionately to cut down on travel time and inconvenience. This is like the trucking lobby arguing for fewer restrictions on driver safety--the perspective is not exactly objective.

<comment><USER16> That. Or, perhaps, the TSA is objectively awful.

Tell you what. Post an article that sings the praises of the TSA and I'll upvote it. Then we can have a discussion about bias.

<comment><USER15> A fair point. I spent only about 30 seconds on this, but found: <http://news.ycombinator.com/item?id=4943959>, "Surprise Gallup Poll: People Think TSA Does A Good Job". This is a poor article: it's merely reporting on a public poll of the TSA. I didn't expect the public to be so approving; I expected views of TSA to be like views on taxes: they're necessary, but everybody still hates them. But perhaps the public is so scared of terrorists on planes that the TSA is comforting to them.

It's not a report on TSA efficacy, but I didn't look for one; such a report is would not be worth much due to the difficulty of proving a negative: the TSA's objective is not to find 100% of contraband, but to prevent terrorist attacks. There have been no terrorist attacks (excepting the shoe bomber, but there have been no shoe attacks since shoes started to be inspected), but does that prove the TSA is effective? Hard to say.

EDIT: I submitted two more articles: <http://news.ycombinator.com/item?id=4944165> <http://news.ycombinator.com/item?id=4944163>

Still no upvotes, though.

<comment><USER17> > There have been no terrorist attacks (excepting the shoe bomber, but there > have been no shoe attacks since shoes started to be inspected), but does > that prove the TSA is effective? Hard to say.

No, really, it's not. Of prevented terror attacks since 9/11, TSA has prevented exactly 0% of them. The shoe bomber was on the plane with the bomb when he was subdued by fellow passengers. The underwear bomber also made it onto the flight.

Only for 2011, but you can bet the TSA wouldn't let you forget if they actually caught a terrorist: [http://www.schneier.com/blog/archives/2012/01/the_tsa_proves...](http://www.schneier.com/blog/archives/2012/01/the_tsa_proves.html)

<comment><USER15> One could make the counter argument that some terrorists are discouraged by the difficulty and no longer try. For example, how many plane bombings have their been since Lockerbie? None. Does that mean that we should stop inspecting luggage? Probably not.

<comment><USER17> > One could make the counter argument that some terrorists are discouraged by > the difficulty and no longer try.

Well, let me know if you actually get around to making the argument. In the meantime, consider the basic economics of an attack as laid out by someone else: If the other passengers on the flight realise that you're up to something, _every single one of them_ has a clear motive to take you on in the fight to the death. Hi-jacking a plane has gotten orders of magnitude more difficult after 9/11.

> For example, how many plane bombings have their been since Lockerbie? None. > Does that mean that we should stop inspecting luggage? Probably not.

Good thing, then, that the suggestion on the table is a return to pre-9/11 security, not abolishing it.

EDIT: pre-9/11 security, plus the few things we've realised actually makes sense - such as reinforced, locking cockpit doors.

<comment><USER15> Blowing up a plane by embedding a bomb in a body cavity is still plenty easy post 9/11. The terrorist need only head into the restroom and detonate the bomb under the cover of privacy. Bomb making technology and the willingness to be martyred in a plane attack have increased since 9/11. This is the type of attack that full body scanners attempt to prevent.

EDIT: Witness new body cavity scanners on the horizon: [http://www.wired.com/dangerroom/2010/01/crack-new-scanner- fi...](http://www.wired.com/dangerroom/2010/01/crack-new-scanner-finds- explosives-inside-body-cavities/)

<comment><USER17> No, millimeter-wave scanners do not penetrate the skin, so they're ineffective against that type of attack.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Welcome to America's permanent big government state. This is a prime example of excessive government bureaucracy, and it demonstrates how inefficient and wasteful many of these govt. programs are but exist anyway to keep politicians happy. The only reason TSA is getting called out for its unnecessary bloat is because the public despises what they do.

<comment><USER19> The size of the federal bureaucracy has hovered around 2m +/- 10% for the last 50 years, even as the U.S. population has increased by over 70%.

<comment><USER18> I highly doubt the employee headcount of the federal government is a good indicator of efficiency. I would say not at all. There could be 10 total government employees but that wouldn't signify more well-oiled machine. My initial assertion stands true. The government is bloated, inefficient, and wasteful (now more than ever). TSA is merely a good microcosm for the system as a whole.

Side note: it's appreciated (expected?) to provide sources when throwing out stats.

<comment><USER19> Re: source, see: <http://www.opm.gov/feddata/html/ExecBranch.asp>

I think the headcount of the bureaucracy, relative to the size of the country being managed, is a very relevant metric of the efficiency of the system. I mean after all, in a private company it would be pretty impressive if the company nearly doubled in size without adding substantially to the number of managers.

The point isn't that the federal government isn't large, it's that it's a complete mispreception to assert that the TSA is a good microcosm of the federal government. The TSA is a traditional bloated bureaucracy, with tons of government employees doing not much of anything. That's not what most of the federal government looks like. I've worked in a federal agency and in the private sector, and if anything the federal agency was better run and more leanly staffed.

In reality, 95% of federal expenditures are just checks to other people. Checks to farmers to subsidize agriculture, checks to states to subsidize highway construction, Social Security checks, Medicare reimbursement checks, etc.

The fact is that people rant up and down about how bloated the federal government is, but nobody can ever point to non-trivial ways to reduce spending. And the reason is that it's not a matter of simply firing a bunch of bureaucrats that sit on their ass doing nothing--there just aren't very many of those people. Rather, it's all about not writing those checks. Writing a $20 billion check to subsidize suburban commuters instead of $40 billion, cutting grandma's social security check by 20%, etc. That's where all the money goes.

</comment></comment></comment></comment><comment><USER20> This is true of almost every government entity.

<comment><USER21> This is true of almost every entity.

<comment><USER17> Probably, yes. But at least private entities can be (and frequently are) killed by customers starving them of their income - this can happen passively by simply not buying their products anymore. Public sectors ones need politicians to actively invest political capital in not just removing it, but figuring out what it was meant to do in the first place, how to do it better and then setup a new entity that's better - so there's very high friction to take on the task. Obviously, also, anyone who takes on TSA opens himself up to being labeled "soft on national security".

Of course, there are many anemic private companies that are kept alive for various reasons long beyond their reasonable lifetime, but generally this holds. Private companies come and go much faster than public sector ones.

That said, I'm not sure airport security is necessarily a good fit for a private company.

<comment><USER20> I think a good example to point to would be Pinkerton security, which for example guards some military bases when needed for things like air shows. They are highly trained at security. The TSA seems to hire almost anyone that is breathing and hasn't been to prison. They seem completely unconcerned with security and more concerned with being rule-bent weirdos.

<comment><USER17> I'm not saying that the guards couldn't be privately employed (which is the case in SFO, for an example) - as long as they have to enforce TSA stupid rules, that doesn't matter (anecdotal evidence suggests the guards in SFO are friendlier than average, but this can have many causes).

I was referring to making security a private concern in the same way operating an airline is a private concern - that I struggle to see how would work: How do you align the long-term interest that a terror attack doesn't occur with the short-term horizon of an industry that bankrupts itself every decade?

On the other hand, FAA seems to be mostly sane and evidence-driven, so they might take on the task of creating and maintaining the regulatory framework that private airport security would operate under.

</comment></comment></comment></comment></comment><comment><USER22> I flew yesterday and found a rifle bullet+cartridge on the "secure" side of the TSA checkpoint. Yet somehow the gift-wrapped paperbacks in my checked luggage were deemed suspicious and unwrapped. Useless fools.

<comment><USER23> You know, it's not entirely unreasonable that someone could package a bomb to look like a gift-wrapped paperback. So if their technology can't distinguish your book from a potential explosive via X-rays alone, it may have to get opened. Explosives detection results in false alarms, unfortunately, but as far as I know most countries do it and it rarely results in such inconvenience to passengers.

The rifle cartridge is obviously on their contraband list, so it should have been caught. Someone probably brought it through accidentally. .22 LR?

<comment><USER17> My SO once bought a small blender (less the blade) through in her hand luggage - I understand and respect why they asked to take a closer look at that. But if a bomb is indistinguishable from a paperback, then a bomb is indistinguishable from a bag full of clothes. Which means that the current level of security is woefully inadequate and only by opening up all luggage and carefully sifting through every one inch layer of material can we find hidden bombs.

Rather, this seems like a perfect example of the self-perpetuation suggested in the article. It takes a while, so there's a line, it look very meticulous and the victim isn't going to complain, or he might risk finding himself on a do-not-fly or do-harass list.

</comment></comment></comment><comment><USER24> While the TSA is messed up and all that, Americans shouldn't be too quick to turn to private companies. Private companies would be profit focused, this means that any way to minimise costs will be taken which may compromise security. I give you Blackwater in Iraq as a good example

<comment><USER25> You trust a private corporation to strap you to a flying hunk of metal, but not to ensure your safety? Sounds logical..

<comment><USER19> Airlines, at least in the US, are quasi-government corporations run by courts and unions in a state of near perpetual bankruptcy.

<comment><USER26> The "majors" are, but Southwest and JetBlue are obvious counterexamples.

<comment><USER19> Right, I was thinking of Delta, United, etc.

</comment></comment></comment></comment></comment><comment><USER27> The <organization of any sort> True Focus isn't <organizations purported purpose> \- It's Self-Preservation

</comment><comment><USER28> So the TSA is like some kind of rogue AI just "tryin' to survive" - <USER2> that unlike an AI, it's incredibly stupid on a massive scale.

Doesn't bode well for our chances of fighting a real intelligent AI when it finally creeps up on us.

<comment><USER29> Why fight it? I for one embrace our AI overlord, maybe we can finally have the philosopher king we need.

</comment></comment><comment><USER30> Every organization tends to preserve the problem it should solve (don't remember the source, sorry)

</comment><comment><USER31> This is true of every institution.

</comment><comment><USER32> at times I wonder if this is not the unwritten goal of many agencies. We have an incredible duplication of effort on the part of many aid agencies and no progress is usually attempted to weed that out, how would we even begin with this one?

</comment><comment><USER33> In other words, the TSA is a self-licking ice-cream cone. <http://en.wikipedia.org/wiki/Self-licking_ice_cream_cone>

</comment><comment><USER34> this reminds me of another article written a little while ago [http://www.businessweek.com/articles/2012-11-18/how- airport-...](http://www.businessweek.com/articles/2012-11-18/how-airport- security-is-killing-us) which discussed how it is incredibly less safe to drive than to fly (even with terrorist attacks) and that the increased security of the TSA is making more people drive instead, which has caused a lot more accidents and deaths because of it. both interesting.

</comment><comment><USER35> This is not unique to the TSA, or bureaucracies in general, but more the universe. Every dynamic system feels the desire to grow and preserve itself.

</comment><comment><USER36> Now why isn't this sort of thing talked about during campaigns?

<comment><USER37> Because campaigns are run for the good of the candidate, not the good of the country or the people. If the campaign thought that promising to fix the TSA would be a net positive to attaining their goal of winning the election then they would do so.

The same analysis explains why very few important issues are discussed, and why even then, they are spoken of in a series of talking points previously gauged to insure a net positive result.

</comment></comment><comment><USER38> TSA: Out to photograph and grope your ass while covering their own.

</comment><comment><USER39> Why do people accept this reality when talking about the TSA, but not other government agencies? All government agencies are like this, especially the Federal ones.

<comment><USER12> The TSA is more actively harmful to the freedoms we (supposedly) cherish, and is a strong push towards a surveillance society and a police state. Many other agencies are equally unproductive (or actually do something useful, just in a very inefficient manner), but not actively working against something we care about.

<comment><USER3> The TSA is also extremely visible in the public's eye.

How many people do you know that have complained that the CIA was spying on them, vs. how many people do you know who have complained that they got government-groped?

</comment></comment></comment><comment><USER29> I paid extra to not fly though the US. I encourage other North Americans who can to avoid it to do similarly.</comment>


PayPal told customer her death breached its rules - <AUTHOR> https://www.bbc.co.uk/news/technology-44783779 <comment><USER2> In writing a program for a property management company the computer would send out letters if the tenant was behind in their payments.

The third letter the computer sent promised legal actions would be taken against the tenant. However, computers being computers it would send out this letter if you even owned just 1 cent!

I pointed out the cost of mailing the letter and the chance of sending it to some little old lady who miscalculated her payments and then asked for a low limit to prevent the computer sending out a letter.

I was told not to put in a limit for the letters, they would catch all the letters for small payments by hand.

I wonder how that worked out.</comment>


Obstacles to Developing Cost-Lowering Health Technology: The Inventor's Dilemma - <AUTHOR> http://jama.jamanetwork.com/article.aspx?articleID=2429454 <comment><USER2> I like the example of the MI and stroke reducing polypill. However, if the only reason why this pill's not sold is because it delivers a low return on investment due to the high cost of the clinical trials, why aren't countries where medical research is less privatized stepping in?

Surely, this miracle pill would be tested and ultimately sold in Cuba and some European countries with excellent medical facilities where the public sector shares a larger part in healthcare costs.

What's preventing this?

<comment><USER3> Um, the high cost of the clinical trials is not due to privatized medical research.

 _the cost of the large clinical trials required for FDA approval_

It is FDA regulations, not privatized medical R&D.

<comment><USER2> I didn't say that the cost was high because of private medical search. Only that a private pharmaceutical company will not want to have negative returns regardless of the origin of the costs.

<comment><USER4> Yes, a public good, which a country can decide to acquire and provide or not.

</comment></comment></comment></comment><comment><USER5> Oh dear christ.

A lot of the medical devices that could actually help people are well within the ability of even a small team of undergrads to produce--and many do!

It's the sheer fuckheadedry of the market and regulatory environment and capture of the FDA and insurers that basically make bringing anything to bear a tedious, hair-graying experience.

<comment><USER6> totally, who needs the FDA. a little thalidomide is good for you, nothing like untested and unproven stuff to shove into your veins.

let's also abolish the FAA, air travel needs to be freed from the shackles of safety.

because innovation and disruption and stuff.

<comment><USER5> How many things have _you_ gotten through the FDA, friend?

The fact is, and it's well-documented, that there are many scientifically unsubstantiated claims and procedures being done, that there is a vast paucity of decent software, that patients are being injured and maimed and killed and empoverished. And yet, there are these super-strict market-approval processes and weird regulatory requirements on where and how you can open hospitals (which is how they killed a lot of abortion clinics in Texas, by the way) and a cartel-enforced supply-shortage of trained physicians.

Things are fucked.

The interactions of the government and the not-quite-free-market have produced this sort of perverted and broken system.

</comment></comment></comment><comment><USER7> If there's $300B in annual costs due to health care expenditures and lost productivity which can be reduced with a $1/day drug, it seems like the medical insurance industry should be very interested in such a drug. Is the medical insurance industry unable to carry out the research or pay a research lab to do the work? Or are there other reasons they don't do this kind of research?

<comment><USER8> What makes you think the Medical Insurance Industry is interested in reducing medical costs? They benefit from higher costs.

If medical costs were much lower, fewer people would need/want insurance. Premiums would have to be lowered, which means less cash coming into the insurance company, and claims would be fewer and/or smaller which means less cash flowing through the insurance company. Cashflow is where the insurance company makes its profit.

The other profit center is captured premiums: money people pay in that they never get back out. The insurance company doesn't care how high your medical bills are or how much you wind up paying for them; the company only cares about reducing its share as much as possible. Lowering the overall cost doesn't alter the payment distribution, so the insurance company has no inventive to lower overall costs.

If there was a pill you could take which would allow you to pay a larger proportion of your medical costs, without reducing your premiums, the insurance company would be all over it.

</comment></comment><comment><USER9> > Although the polypill could produce substantial public health benefits, > people in the United States are unlikely to find out anytime soon. This is > because the pill's price is so low (≤$1 per tablet) and the cost of the > large clinical trials required for FDA approval is so high, it is > unattractive to investors.

Here are two great articles on this topic by Ben Roin of MIT:

 _Unpatentable Drugs and the Standards of Patentability_ : [http://dash.harvard.edu/bitstream/handle/1/10611775/Unpatent...](http://dash.harvard.edu/bitstream/handle/1/10611775/Unpatentable%20Drugs%20and%20the%20Standards%20of%20Patentability%20-%202009.pdf)

 _Solving the Problem of New Uses_ : [http://dash.harvard.edu/bitstream/handle/1/11189865/Solving%...](http://dash.harvard.edu/bitstream/handle/1/11189865/Solving%20the%20Problem%20of%20New%20Uses%20.pdf)

</comment><comment><USER10> Here is article about the pain of dealing with Medical Industry

[0] [http://www.washingtonmonthly.com/features/2010/1007.blake.ht...](http://www.washingtonmonthly.com/features/2010/1007.blake.html)

</comment><comment><USER11> 100% correct in my experience with medical device VCs.

</comment><comment><USER12> What were the drugs they wanted to combine?

</comment><comment><USER13> FFS Solution 6: Nationalise the pharmaceutical industry and get health experts deciding priorities

<comment><USER14> Sure. Creating an even greater bureaucracy unanswerable only to themselves with guaranteed taxpayer cashflow is certain to produce pure innovation.</comment></comment>