The nightmarish SOPA hearings - <AUTHOR> http://www.washingtonpost.com/blogs/compost/post/the-nightmarish-sopa-hearings/2011/12/15/gIQA47RUwO_blog.html <comment><USER2> For some time now it's been clear to me that as society grows ever more technical, it's leaving legislators behind.

At the same time, the background of lawmakers has increasingly narrowed.

In Australia, for example, it used to be commonplace for the Parliament to contain people whose first careers were as teachers, farmers, train drivers, engineers, small businessmen and so forth.

Not any more. Today it's an almost wall-to-wall collection of law students who were all groomed by party machines. Go to uni, join political club, graduate and work in minister's office/a union/a politically-connected law firm, get pre-selected at the local branch, elected to Parliament.

At no point has this person a) studied something other than law or b) held down an ordinary job or run a small business. I imagine the pattern is similar elsewhere.

And so our law making bodies are filled with folk whose main skill is forensic disputation. This is problematic when technical debates are held because politicians are often mistrustful of experts outside their circle of loyalty -- because for any expert I can procure, someone else can get an expert to say the opposite.

Having experts inside the circle of trust is golden. The classic example is the banning of CFCs. Margaret Thatcher's undergraduate degree was in chemistry and so she understood the mechanisms. In turn she was able to assure Regan that the phenomenon was real and serious and the rest is history.

I have for some time toyed with the idea of forming a non-partisan organisation whose purpose is helping STEM professionals to get elected. Please contact me by email (check my profile) if you are interested.

<comment><USER3> Perhaps the House of Representatives should be populated like a jury. Hundreds of regular "Joe Citizens" are randomly selected and then voted on each year. No more career politicians selling out citizens for kickbacks. No more career politicians not doing their job because they are on the campaign trail seeking reelection.

Then revert Senate seats to be appointed, not elected, positions. The Senate and President will (hopefully) squash crazy ideas that may escape the House.

William F. Buckley said, "I'd rather entrust the government of the United States to the first 400 people listed in the Boston telephone directory than to the faculty of Harvard University."

<comment><USER4> The Canadian Senate is appointed, and as a result it's mostly become a rubberstamping organization. Almost every time the senate approves whatever comes out of parliament to the point where many Canadians don't even know of it's existence.

I don't know how the jury mechanism will prevent people selected abusing their position much when they have it. Or even worse being quickly manipulated, since the house is a law creating body.

<comment><USER5> Well, the House and Senate consists of 100+ people with about equal power, and there is also the separation of powers between branches.

</comment></comment></comment></comment><comment><USER6> Nice post from Felix Salmon on the topic:

[http://blogs.reuters.com/felix-salmon/2011/12/15/do-any- real...](http://blogs.reuters.com/felix-salmon/2011/12/15/do-any-real-people- support-sopa/)

He makes the point that virtually no average citizens support this (either they're against it or they don't know anything about it.) People often worry that congress fails when they can't agree on anything, but this makes me think that the time to really worry is when they do agree. When they disagree, they're at least probably mirroring the electorate.

<comment><USER7> Well put. Lately I worry the most when Dems and Repubs find something that they can slam-dunk agree on.

<comment><USER8> Example: NDAA

<comment><USER9> And the PATRIOT Act, and the DMCA.

<comment><USER10> And Prohibition (aka the War on Drugs).

</comment></comment></comment></comment></comment><comment><USER11> I watched roughly 2-3 hours of the hearing. I could be wrong, but I thought in general there was actually a bi-partisan agreement that they needed experts in on the conversation. Unfortunately it didn't mean much when it came to voting on amendments (as most were shot down).

Where it got interesting is when Mel Watt came out and said "We all know that everyone in this room on both sides has enough resources to pull in experts that will aid their side of the argument equally, so we're going to get into the same mess we did when we talk about derivatives being the most evil things on earth by one party and the saving grace by another". Good point, but the difference here is that not all parties that are for SOPA have purely financial incentives as the banks did.

<comment><USER12> > Where it got interesting is when Mel Watt came out and said "We all know > that everyone in this room on both sides has enough resources to pull in > experts that will aid their side of the argument equally, so we're going to > get into the same mess we did when we talk about derivatives being the most > evil things on earth by one party and the saving grace by another".

That's truly frightening. "We have no clues and we both invite biased experts so let's just disregard facts and vote according to our ideology."

It is OK for a politician to vote on laws about things he does not completely understands, the catch is that the JOB of a politician is to know WHO to ask to get an expert advice. If they can't do that they are simply not fit for the job. The rush without reason should indicate to them that something screwy is happening. Yeah, "screwy", come on, politicians can not even identify THAT ? It is either gross incompetence or conspiracy. Since the W Bush administration I no longer bet on which one is the correct option.

<comment><USER13> That Bush bit is a little biased, Clinton was just as bad. Both had loose screws and power grabs, they were just in slightly different places. Go read Bovard's books, _Feeling Your Pain_ and _The Bush Betrayal_ , then tell me that you could see any significant differences between them.

<comment><USER12> Clinton was bad, but GWB was dumb. I was almost a 911 conspiracy theorist because I refused to believe this level of incompetence was possible. Under Clinton a carefully crafted incident was more likely than a "ooops"

</comment></comment></comment></comment><comment><USER14> I've listened to the hearings a little bit today and in particular I heard the amendment about not removing the ability to target IP addresses. Listening to him, it just made sense: one address can be the front of multiple websites, one website can have multiple IP addresses, addresses are moved around dynamically, etc. We all know that and his explanations were _very_ clear.

So I was a bit confused when later on I was hearing a lot of "No"s. Had I missed the vote for that amendment and they were voting on something else? Nope. They were just denying common sense.

I'm not even sure how they would do it on a per domain basis. What about subdomains? One guy posts something on his Tumblr and all the Tumblr's go down? I'm sure they have no idea what that means and would just say "take down all the sites!"

On another note, though I don't mind the term generally, I was annoyed by them referring over and over to "nerds". "I'm not a nerd", "Bring in the nerds"… It's fine in some contexts but in the context of discussing a law, I think "technical experts", "people who have a clue" is more appropriate.

<comment><USER2> > So I was a bit confused when I was hearing a lot of "No"s later on.

A common political tactic is to automatically vote "no" for anything you don't understand or for which you have not received instructions from factional/party leadership. After all, it might a trojan horse that undermines your own goals.

<comment><USER14> It just made me wonder what the point of having these hearings was. I'll admit I'm not very familiar with the process.

But it looked like it was the time to present why such and such amendments should be added, and then vote on it. If they can't decide on the spot, why have the vote on the spot then?

That particular amendment was especially surprising to me because of how obvious it is (for us "nerds" that is), and because his explanation was pretty clear. But I know what you're saying, it's not how the game is played…

<comment><USER2> Most political business is done behind closed doors; the speeches and votes are mostly performance art.

There's a great deal of exchange between politicians in different countries -- the International Parliamentary Union, various politically-aligned groups like the International Democratic Union and so on. Plus exchanges for young aspiring politicians. So practices and techniques tend to pop up all over the world. Maybe the "Default to No" came from Australia, or Britain, or the USA. I have no idea.

<comment><USER15> Defaulting to no is just common sense. It's a lot easier to undo a no than to undo a yes.

In a similar vein to Heinlein's idea of creating a house of legislature whose only power it is to repeal laws, I have thought that one of the underlying problems we have with government is this one-way trap of legislation; once a thing is enacted, it pretty much stays enacted forever. There's virtually no equivalent way to get something off the books. It's no wonder we just have more laws and more laws and more laws; how would the opposite result occur?

<comment><USER4> I've read in various new acts saying "such and such section in this act does not apply/ is void/ etc". It's a purely cultural problem preventing this, not anything written in law as far as I know.

<comment><USER15> Certainly there's no technical problems with it, but there's clearly a practical problem with it. Laws are rarely simply removed. Clauses may be struck, future laws may rewrite (and inevitably expand!) past laws, but it's very, very rare for something to simply be unambiguously removed. When's the last time the government simply eliminated an agency, for instance? It's not zero, but it's one of those cases where simply the fact that one must _hunt_ for an exception to argue against the point is something I'd cite as evidence for my point.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> Just remember to add "in the United States" to the end of each dire prediction. Try it:

SOPA will cause rampant censorship of the internet... _in the United States_.

I am a US citizen, currently living in the US, and I hate this, but even so, it makes me feel better to remember that there's a big, big world outside our borders. If the US flies off the rails on this, I fully expect the rest of the world to shrug and move on. The internet and the Americans have been closely intertwined since the beginning but I don't expect it will always be that way. The America that created the internet is more or less gone now. Its time for the rest of the world to step up.

<comment><USER17> The UK, France and Germany will follow suit within a few months. I'm German and I'm absolutely certain our politicians and lobbyists are already working on their own version SOPA which they'll introduce as soon as the US is done. You guys need to understand that you're the Western precedence society. Whatever you do, we'll copy it, especially if it's something authoritarian (which is kind of "our thing" here in Europe anyway).

Another problem is that it doesn't matter how many times a SOPA-like law is stopped in time. It will simply return as many times as needed until it finally passes. And once legislation passes, it becomes immortal.

<comment><USER16> I wish I could wave a big flag and yell "don't follow us! we're as lost as you are". To top it all off, we've not exactly been doing an exemplary job of finding our own way of late.

</comment></comment></comment><comment><USER18> SOPA is horrifying. No doubt about it. But it's funny how many people I meet who share this view, yet think Congress is perfectly capable of regulating just about everything else. Because Congress understands that stuff. Like economies. Those things are simple. </LibertarianThursdays>

<comment><USER19> By the same token...

SOPA is horrifying. No doubt about it. But it's funny how many people I meet who share this view, yet think giant multinationals are the best suited institutions for running the world. Because media conglomerates have our best interests at heart. Like our rights. Those things are universally respected. </SocialDemocratThursdays>

Yeah, yeah, libertarians don't believe corporations should corrupt the political process, reign supreme, etc. For that matter, though, neither do people on the Left think government should make bad corrupt laws.

</comment></comment><comment><USER20> I tried watching the hearings but I couldn't stay awake through the reading of the bill. My heart goes out to the poor clerk who had to read it out!

"There ought to be a law, I think, that in order to regulate something you have to have some understanding of it."

Ne'er were truer words written. Why on earth do we allow people who have no real understanding of technology to regulate it so closely? It's a train wreck in the making, one you'll be hard pressed to avoid should this bill get approved.

<comment><USER21> The problem is simple: how do you define having understanding of something? :)

<comment><USER20> Let's start by being able to talk about the basics like IP addresses, servers and domain names? The baseline doesn't have to be very high to weed out the ignorant.

</comment></comment></comment><comment><USER22> I've been watching all of this for the last 3-4 hours.

I am amazed at how most of the committee do not want to hear from experts, and ignore the facts with a quick dismissal like "Oh, I'm not a nerd, I don't understand, but what I do know is that piracy is theft and we must stop it.".

How can they not listen to the experts?

EDIT: Here's a livestream <http://www.justin.tv/unearthed365#/w/2249527504>

</comment><comment><USER23> What is it about technology that makes people proud to announce they know nothing about it while simultaneously assuming positions of authority and power over it? At least in other domains people put up a pretense of having knowledge about areas they are taking crucial decisions on. Something about technology and especially the internet seems to evoke this phenomenon.

<comment><USER24> A sort of myopia seems to be rife through all the specialist fields - STEM, medicine, law, and politics all host individuals with a nasty combination of elitism and borderline-religious opinions. Whether or not they've actually studied the subject is irrelevant - everyone from the least educated bumpkin to the foremost authority may speak on it, and everyone else will take their opinions with a grain of salt and continue with their existing ideology, rather than try to dissect the logic.

Worse yet, it's possible for people to study the subject and still exhibit strong myopic symptoms. This is the origin of cargo-cult programming(to name one example).

</comment></comment><comment><USER25> I am not sure if you see the same ads as I've seen on TV lately from SOPA sponsors but it's pretty darn obvious that the only reason this bill exists is that the lobbyists simply paid for it to be created.

Like the "Patriot" Act they have no clue what exactly they are voting on, and I don't think they care, they are doing what they are bribed to do. The hearing is just theater, it's meaningless, they've already decided to get in on the take.

<comment><USER26> To be clear, nobody bribed anybody on PATRIOT; it's just that the folk in congress apparently lack the rest of the country's visceral suspicion of the phrase "national security".

</comment></comment><comment><USER27> Does anyone have a list of where each representative is leaning on SOPA?

Edit: some reps against sopa, for an open internet:

@RepJohnCampbell

@jasoninthehouse

@RepLloydDoggett

@USRepMikeDoyle

@RepAnnaEshoo

@RepZoeLofgren

@jaredpolis

</comment><comment><USER28> My local congressman, also a co-sponsor and co-author of the SOPA bill, held a public phone conference the other night. You could press 0 to enter a queue to ask a question, so I did, but after 2 hours I was tired of waiting and I had a term paper to write so I gave up. I kind of regret it now, because I wanted everyone to hear just how little he, a co-author, knew about the subject. He's not one for listening to his constituents. I had already written him a letter and tried to call his office and no reply for either.

<comment><USER9> I always get replies from my Congresspeople. Unfortunately, they're usually along the lines of "SOPA will save America from sinking into the ocean" or some similar bullshit.

</comment></comment><comment><USER29> Thank God for government regulation. I'm so glad we have progressives like the Democrats and Republicans in office to curb the evils of industry.

Without regulation the Internet would be monopolized by big business and criminals will prey on your children.

Good thing the State is there to protect us. Don't forget to pay your taxes, and have a happy holidays!

</comment><comment><USER30> It's weird, it seems like there's an amendment suggested, with lots of reason behind it, but fuck it we're going to say no anyway. WTF.

</comment><comment><USER31> Has anyone seen the TV ad? "Illegal downloads on foreign websites, stealing AMERICAN jobs......"

It was frighteningly manipulative.

<comment><USER32> I'd say that piracy creates way more jobs than it does destroy them. Maybe not only American jobs, sure, but we live in a globalized world. Nationalism won't do away with that, either.

Also, who's loosing their job, really? RIAA lawyers? Entertainment industry bureaucrats? Excuse me for being snarky, but oh no what a tremendous loss for society!

</comment></comment><comment><USER33> "We have had no hearings and no testimonies on the technical issues"

\- Congresswoman Zoe Lofgren, 20:15 (<http://www.justin.tv/unearthed365/b/302702510?>)

</comment><comment><USER34> I highly recommend contacting your Representatives/Senators immediately. It amazes me that both of the California Senators are cosponsors of this turd. I would think they are among those who can be swayed.

<comment><USER35> They are easily swayed (as they all are), but remember Hollywood is in California.

</comment></comment><comment><USER36> I've sort of viewed the entire circus in a defeated light. If SOPA goes down another version will crawl up either on its own or stapled to the "think of the children" act of 2012, 2014, or whenever they get enough campaign funding to draft it.

But what does that mean for Hackers? I think with enough work we could make a network off of the regulated lines. I live in a rather sparse city and even now I can throw a ball far enough to hit the next techy over. Push comes to shove we could have a mini network several blocks wide that doesn't touch a single www link.

Wireless is almost ready, security is probably the biggest issue right now but the technology is available, just not affordable. But what about the tech giants against the SOPA? If "push comes to shove" would they fund a new network that has less control?

Then at what point is the government allowed to intervene? If a sizable network was built from the ground up separate from the internet are they allowed to slap down regulations? I want to say no because they didn't fund it, but then at the same time what's really stopping them? If they're able to throw SOPA through, convincing these dweebs that a private uncontrolled network is not worthy of SOPA2.0 would not be difficult to do.

Can I get some hacker-friendly input? I know a lot of us here are software oriented but I'm certain I'm not the only one that lurks this site with background in network provisioning.

<comment><USER37> Something like this was done in the Cory Doctorow book Little Brother. It's surprisingly relevant to the SOPA discussion.

</comment></comment><comment><USER38> Looks like a big joke to some people in the room!

<https://twitter.com/#!/SteveKingIA/status/147371129177255936>

<comment><USER39> Bad link, please update?

<comment><USER40> "We are debating the Stop Online Piracy Act and Shiela Jackson has so bored me that I'm killing time by surfing the Internet."

</comment></comment></comment><comment><USER41> I think this is a really good analysis of what is going on in Washington. I have always found it worrying when politicians walk into a field which they have little knowledge about and try to pass laws. Anyone can become an elected official and the power they yield over things they have no background in is scary. In the UK a person can effectively go from University >> Elected Official >> Misc Support Roles >> Secretary of State. Or... Student >> MP with 1 or 2 staff >> An advisor to someone >> Budget of billions, hundreds of thousands of employees.

In business you would work your way up. Employee >> Supervisor of Employees >> Manager with budgets >> Area Manager >> Country Manger >> CEO. You gain responsibility as you go. MP's do not have this. They fall into a job which they are almost never qualified for. Some do OK. However.. if you look closely at the majority you will see mistakes that anywhere else would see them fired.

In the states these dubiously qualified MP's are now looking to legislate an global network as a single nation... I am sure that some of them cannot even comprehend what the Internet is.

</comment><comment><USER42> I haven't listened to the hearing, so I'm curious (and slightly facetious) -- when the RIAA inevitably flags videos on YouTube that are using copyrighted music -- will it be legally fairly simple for the industry to request a DNS take-down of the whole site? Will site owners have any recourse or will they just wake up in the morning and be completely out of business?

<comment><USER43> The problem is that there's not going to be a government attorney that will go to a judge and ask for the seizure of youtube.com.

This will only be enforced against sites that are small or controversial enough that it won't cause general outrage when they're disappeared from the web.

Yet the looming threat that someone _could_ remove YouTube from the web will be enough to keep the next Google from buying/creating the next YouTube.

<comment><USER44> Eh? SOPA has a private right of action.

<comment><USER43> You're right. SOPA does so much it's hard to keep track of. I'm barely able to keep from turning off my TV while listening to the hearings.

</comment></comment></comment></comment><comment><USER45> Too bad we don't have some sort of upper age limit on electing officials.

<comment><USER46> Why the downvotes? If we can have a lower limit then why not upper limit. They may have an advisory status but voting rights should not be given to "old" people.

</comment></comment><comment><USER47> Can someone who is following this more closely than myself (as in actually watching this on CSPAN) please post the names of all the senators, representatives and other elected officials who are blithering idiots in support of this.

I would like to vote any of them that may be in my district out of office as soon as possible.

Thank you.

<comment><USER48> I found a list of sponsors of SOPA and PIPA: <http://thomas.loc.gov/cgi- bin/bdquery/z?d112:HR03261:@@@P>

<http://thomas.loc.gov/cgi-bin/bdquery/z?d112:SN00968:@@@P>

</comment></comment><comment><USER49> What will it take to elect technical people to public office?

<comment><USER50> Technical people will need to grow some balls and stop treating politics like a dirty word

</comment></comment><comment><USER51> The real issue here is corruption. That's why you keep get these ridiculous bills. Lessig explained the issue in a recent post:

[http://lessig.tumblr.com/post/13119510676/me-mia-on-the- sopa...](http://lessig.tumblr.com/post/13119510676/me-mia-on-the-sopa-soap- opera)

</comment><comment><USER52> I greatly enjoyed reading this thread and peoples' well-expounded opinions on history and the Constitution. I can't add much but this quote seemed apropos. The author was a US Senator from South Dakota during the critical period of the late 19th-early 20th century.

"Two per cent of the people of the United States own sixty per cent of the property of the United States. Yet they produced none of it. By legislation, by craft and cunning, by control of Congress and the courts, they took to themselves what others produced. Sixty-six per cent of the people of the United States own five per cent of the property of the United States. Yet they produced all of the wealth and have none of it. Why do not the producers of this wealth have what they produce? Because the making of the laws and the control of the courts is in the hands of those who do not work, and this has been true from the beginning of the Government. The convention which framed the Constitution of the United States was composed of fifty-five members. A majority were lawyers—not one farmer, mechanic or laborer. Forty owned Revolutionary Scrip. Fourteen were land speculators. Twenty-four were money- lenders. Eleven were merchants. Fifteen were slave-holders. They made a Constitution to protect the rights of property and not the rights of man, and, ever since, Congress has been controlled by the property owner, and has framed laws in their interests and their interests only, and always refused to frame any laws in the interest of those who produce all the wealth and have none of it."

TRIUMPHANT PLUTOCRACY by Senator Richard F. Pettigrew, 1921 pg.407

</comment><comment><USER53> I think the heart surgery analogy is excellent. I would never, unless it were an extremely dire situation with no doctors, attempt any kind of surgery on someone. Nor would I ever start dictating to doctors how the perform their procedures.

Yet that is what government does, day in and day out. They regulate industries which work in ways they don't understand, and they do it primarily for political motivations.

The MPAA may want tools to fight piracy, but to politicians, who don't really care about piracy, this is an opportunity to have something to campaign on, and it gives the government more power.

More power means more prestige and more money for them, if not now, in their post career lives when they lobby, etc.

More regulations gives them more control over industry- the power to threaten to make the regulations even worse, or the threat that their opponent will do that if they don't get re-elected (so please give generously!)

I don't think these people are "well intentioned". They don't actually want to help anybody. Theft is already against the law. SOPA won't change that, it won't stop piracy, and its not criminalizing piracy.

No, they're politicians. And they're not even _corrupt_ politicians. This is simply the nature of what they do. They pass laws, they shake down industry, and they get paid for passing ever more laws without regard for the impact of those laws.

Hell, when those laws cause massive destruction to the economy, what do they do? They turn around and say "Well, If we'd been able to pass the law _I_ proposed, this wouldn't have happened! Here, we need to rush into force even more regulations to make sure this never happens again!"

There's a famous(?) libertarian author by the name of L. Neil Smith who's got a saying that's very applicable here:

"Government is a disease masquerading as its own cure."

I hope we stop SOPA. But the lesson I would hope a lot of you take away from this is that SOPA is not an isolated incident, it is one of thousands of incidents, most of which go by completely unmentioned each year, where the system works to undermine human rights and make people's lives worse. These guys aren't corrupt, the system is corrupt.

The constitution, in the enumeration clause and in the Bill of Rights, attempted to prevent this. The enumeration clause limits the powers of the federal government to _only_ those enumerated in the constitution.

Regulation of the internet, or communications of any kind, is not an enumerated power of the Federal Government. This means that when the federal government does this, it is doing it without authorization. Further, the Bill of Rights forbids congress from engaging in censorship. SOPA clearly authorizes censorship so they're also in violation of the Bill of Rights.

These words in the constitution, in this day and age have very little teeth. The PATRIOT act runs afoul of them as well, but nobody has succeeded in getting it overturned.

The situation will continue to get worse. Even if SOPA is defeated-- this isn't the first attempt-- it will come back in a few years.

I think that the only possible solution is a technological one. I think that the only way to to fight them is with technology and disobedience to the very idea that they have the right to restrain speech or control the internet.

The courts will not help us, and they certainly won't, and every election is so stage managed that nobody who actually knows the difference between a domain name and an IP address will ever get elected.

Help us with technology, its our only hope!

<comment><USER21> Wow. I hate SOPA. But I'm sorry, you are so wrong about some of your Constitutional reading. I'll ignore the remarks about economic disruption because of regulation because they seem to veer a bit too far from the topic at hand.

"Regulation of the internet, or communications of any kind, is not an enumerated power of the Federal Government. This means that when the federal government does this, it is doing it without authorization."

What? In what universe could the Internet NOT be considered interstate commerce? Or international commerce? It is both! There is no argument whatsoever that you can make that says it is not Constitutional for Congress to pass laws about the Internet, especially piracy, which is the very essence of interstate and international commerce.

"Further, the Bill of Rights forbids congress from engaging in censorship. SOPA clearly authorizes censorship so they're also in violation of the Bill of Rights."

Unfortunately, this isn't as straightforward as you make it seem. The Constitution doesn't just say you can't limit speech. There are years of jurisprudence and years of common law precedent that form the true vision of what the First Amendment means today. The fact that you can't falsely yell fire in a theater is a typical example. And there are even other parts of the Constitution—including the right to pass laws to protect "To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries". All of these temper the First Amendment, as the First Amendment tempers them. You can't just ignore them because you disagree with a law.

Thus, while I think SOPA is a terrible, terrible law, and that its implementation would be catastrophic to the very progress that the Congress is claiming to promote, I don't know that it is unconstitutional, if they truly believe (as some may well do) that it will promote this progress. To ignore this gray area dilutes one's argument to the point of being inconsequential in a true debate about this horrible piece of legislation.

"I think that the only possible solution is a technological one. I think that the only way to to fight them is with technology and disobedience to the very idea that they have the right to restrain speech or control the internet."

I agree that disobedience is a solution. Indeed, it is and has always been the ultimate and only solution when the government ignores and harms its people.

"Government is a disease masquerading as its own cure."

Thus the irony that groups have never successfully lived without one for any measurable period of time. Government is another word for hierarchy. We may be approaching a time when we can break free of hierarchy, but I do not think we are there yet.

<comment><USER53> The federal government does not have the power to regulate interstate commerce, as you're describing, under the constitution. The federal government has the power to ensure that no states forbid the importation of other states goods, or apply duties or tariffs to them. You're using "regulate" in the modern form and applying it to language that was written when the term had a different meaning. "Well regulated militia" means a militia free of encumbrances such that it can be functional, not one with a lot of extra- legislative rules applied to it. This is logical if you think about it- if they wanted the militia to be regulated, they would have laid out the ways he militia should be regulated, or at least enumerated the power _to_ regulate the militia, in the enumerated powers clause. They did not. Further, "regulations" as we commonly understand them, are forbidden by the constitution, which explicitly denies the legislative branch the power to delegate its power to unelected bodies or to other branches.

The fist amendment states, _"congress shall make no law abridging freedom of speech"_. Blocking access to websites clearly violates that. Thus congress is explicitly in violation of the constitution, without regard to anything any court might say. Further, US Code 18-242 makes it a crime (a felony if one is armed) to violate the constitutional rights of any citizen. This means that passing SOPA would be, itself, a crime, at least in my interpretation.

The "shouting fire in a crowded theater" example does not refute the protections for free speech. In that case, the crime is not speaking the word fire while inside a theater, but in causing a panic, which is quite different.

I'm sure the word "Fire" can be heard, often shouted, on broadway quite regularly, when the author of the play included it in the dialogue.

I suggest that you take some time and read the constitution in its entirety. In fact, even better would be to get one of the many books that cover its writing, including citations of the intents and comments of the writers and past editions. The constitution is quite readable and quite explicit.

It is also quite different from the result after "years of jurisprudence" and precedent, which, like I pointed out in my original post, suffer from the intrinsic corruption endemic to government.

As Lysander Spooner once said, "either the constitution authorized such government as we have, or it has failed to prevent it." No ruling of any judge can overrule what is said in the constitution, and the constitution does not need to be interpreted very much, it is quite straight forward.

The reason it is this way is that the founding fathers were no fools. They knew judges and politicians would use emotion, expidents and pressures to try and change the system for their ends. It is a testament to their foresight that the system has lasted as long as it has, but they knew it would ultimately fail.

Thus they wrote a constitution that any american could read and comprehend, and they were quite clear that americans needed to take up arms against their government to ensure that the government remained restrained by the constitution:

"The tree of liberty must be renewed from time to time by the blood of patriots and tyrants, it is its natural manure."

To the extent that our government bears little resemblance to the one outlined by this document, our government is one that is _not_ authorized by the document, and thus wholly illegitimate. No amount of laws or court rulings can change this.

To the extent that this divergence has persisted, we as a people have failed to uphold the vigilance that was required of us.

Hierarchy simply means an arrangement between people with division of roles. Corporations are hierarchies but they are not governments.

There is a key difference. Governments impose their will on those who are subjugated by force, with violence. If you're subject to the rule of a government you don't have a choice, even when the government is violating your rights (as it would be with SOPA).

This is not the case with corporations, as employees, customers and owners of corporations all participate in the hierarchy on a voluntary basis. You are free to boycott them, resign your position, or sell your shares, if you disagree with the policies of the corporation.

You have almost no recourse when you disagree with government.

People can live in peace, and they can do it without governments, and they have successfully for centuries, under quite a variety of arrangements. The only reason for the prevalence of government we see today is the technology of warfare gave small bands of people the power to conquer and subjugate larger populations.

But it is not the natural state of man, any more than other forms of slavery were a natural state when they were more prevalent.... and slavery in the form practiced in the United States in the past, and elsewhere in the world has lasted essentially as long as governments.... for exactly the same reason.

<comment><USER21> "You're using "regulate" in the modern form and applying it to language that was written when the term had a different meaning."

The meaning of language, as with the meaning of law, evolves with the times. It's irrelevant what they meant in 1787. In 1787, landowners were a minority of the population, we were barely figuring out how to make machines, the concept of a calculating machine was a century away (ignoring, admittedly, the abacus), and communicating from one end of the then-tiny-by-comparison US to the other was a multi-day affair at best. Everything had a different meaning. Judicial review and amendment are the two processes that exist to help the law evolve with the times. What I am stating isn't my own interpretation of the regulation of interstate commerce, it is the current interpretation as the law of the land. I'm sorry you have a problem with that, but that's what the amendment process is for.

"Further, "regulations" as we commonly understand them, are forbidden by the constitution, which explicitly denies the legislative branch the power to delegate its power to unelected bodies or to other branches."

You are once again acting as if judicial review is nonexistent. Your love of the Constitution evidently excludes a love of the underlying system that carries it forward, even though these are part and parcel of the package of American government. You don't get one without the other. If something is interpreted incorrectly in your mind by the Court, the thing to do is to amend the Constitution to make it clearer what the correct interpretation is.

"The fist amendment states, "congress shall make no law abridging freedom of speech". Blocking access to websites clearly violates that. Thus congress is explicitly in violation of the constitution, without regard to anything any court might say. Further, US Code 18-242 makes it a crime (a felony if one is armed) to violate the constitutional rights of any citizen. This means that passing SOPA would be, itself, a crime, at least in my interpretation."

If you argue that there is no power to regulate interstate commerce in the modern sense, obviously this follows. However, you are factually wrong, as current interpretations of the Constitutional allowances on interstate commerce clearly allow regulation of the Internet. Again, this is not to mention the Constitutional allowances for copyright enforcement. At which point, free speech is a much less clear argument, as it clashes with other provisions in the Constitution. In these cases, it is up to the judicial system to decide where that blurry line is.

The argument being made for SOPA, not that I agree with it, is that piracy is harmful to the creators of Art, much like the panic would be harmful to the people within a theater.

"It is also quite different from the result after "years of jurisprudence" and precedent, which, like I pointed out in my original post, suffer from the intrinsic corruption endemic to government."

There it is again.

(a) The Constitution _does not stand alone_. It stood alone for as long as it took to people to start interpreting it in court. The very fact that the meaning of the document has evolved makes it obvious that despite how readable and explicit it may seem to be, there are many nuances to be found.

(b) It is not 1787. It will never be 1787 again. Things change. The Constitution has some great concepts that we have moved away from and should perhaps move back towards, and it has some really shitty concepts that we tossed by the wayside, and good riddance. But to hold it up as a golden example of everything that was ever right with this country, and state repeatedly that if we only returned to its silken word everything would be glorious once more, is... Just incredibly frustrating.

"The tree of liberty must be renewed from time to time by the blood of patriots and tyrants, it is its natural manure."

We do need periodic reminders that Thomas Jefferson could be a total nutcase, so thanks for that. The fact that he spoke the words doesn't make them scripture (and yes, I am getting more sarcastic as the arguments turn more religious).

"Hierarchy simply means an arrangement between people with division of roles. Corporations are hierarchies but they are not governments."

Corporations only have no consequence if you can find another job once you leave. Arguably the current recession is an excellent example of a place where, for many people, corporations are like government, insofar that you have a choice of working for the corporation, or starving. Except you won't starve, because the government will provide some modest attempt at letting you survive.

That said, you bring up governments and their imposition via violence. Yes. As it turns out, a hierarchy is meaningless if there is no enforcement of the decisions made higher up. In the case of government, your recourse is to leave your country and its government and go elsewhere. Especially as a US citizen, that is easier for you than it is for other people.

I do want to see the examples you have of sustained, government-less establishments. I suspect that it will reveal more about what you define as government than it will new insight on the human condition.

\-----

All of this said, by the way, I don't necessarily think SOPA is Constitutional. It seems like it may very well not be (or perhaps more accurately _should_ not be), and I don't like it one bit. But your dogmatic interpretation of the Constitution, and your lack of acknowledgement of the entire judicial infrastructure that keeps it functioning and evolving, is just as harrowing.

<comment> mkr-hn The quote is more reasonable in context: [http://www.theatlantic.com/past/docs/issues/96oct/obrien/blo...](http://www.theatlantic.com/past/docs/issues/96oct/obrien/blood.htm)

He's referring to this: <http://en.wikipedia.org/wiki/Shays_Rebellion>

</comment></comment></comment></comment></comment><comment><USER54> I'm voting against every fucker in my district who supports it. That's the only non-violent way.

<comment><USER55> Additionally, you could also boycott all the products of SOPA backers such as the MPAA or RIAA.

Unfortunately, every time I try to explain to my friends that I don't want to see a Pixar movie and would rather see a movie at an indie theater instead, no one seems to really understand what the problem with Pixar or Disney or Sony or UMG is.

It turns out, almost no one cares about the DMCA or SOPA or Protect-IP or anything that requires more than 30 seconds to explain. It is quite depressing...

<comment><USER56> > Additionally, you could also boycott all the products of SOPA backers such > as the MPAA or RIAA.

And by that, you mean the artists and actors and directors who the MPAA and RIAA claim to speak for.

<comment><USER55> Are you trying to imply that by seeing an indie film, you are somehow not supporting artists and actors?

<comment><USER56> No, not in the least. I'm obviously referring to artists and actors that belong or work with these groups.

</comment></comment></comment></comment></comment><comment><USER57> Why is everyone so worried about SOPA?

patriot act has already passed.

</comment><comment><USER58> It's rather interesting to see members here proclaim in one breath that legislators are money-grubbing old-fashioned idiots who are just out to make a bunch of laws, and in another remark complain of them calling people "nerds". Other groups garnering mentions are corporate, capitalist monsters and economy-destroying bankers.

As I see it, the biggest problem gripping our country right now is a refusal to understand someone else's point of view and come to a reasonable solution that is pretty good for everyone. All we seem to have are multiple sides shouting over each other, simultaneously ignoring everyone else and complaining that no one is listening to them. It is as though somewhere along the way we forgot how to be reasonable adults and have normal conversations. People cease to be caricatures when you understand their concerns and motivations.

I agree that some of the SOPA proposals are way out of line, and I also agree that people passing laws without a full understanding of the ramifications are not helping matters. But _we_ also are not helping matters by trying to oversimplify everything and fit everyone and everything into neat little boxes. That's simply not how the world works.

There's no fundamental reason why Google can't provide media companies and luxury goods manufacturers with easy tools to report issues of copyright and counterfeit goods. Sure, it will cost development money that should be borne by those who stand to gain from the tools, but those are details. The point is, working together we actually have a chance to solve problems. Shouting past each other and appealing to authority (read: lobbying Congress) is never going to solve anything.

So let's try to understand the problems and work together to solve them. It's ludicrous to expect that kind of behavior from our politicians but not to exhibit it ourselves.

<comment><USER36> You're right when you bring up things like "confirmation bias" where people believe "my opinion is just as valid as your facts" but that is the problem we're seeing here.

It has nothing to do with the fact that one side may not understand one another, that's the point of debate: to persuade the other or a group. What we're seeing here is one side plugging their ears and shouting "LALALALLA" when the opposition tries to create a point.

We simplify stuff for the less tech oriented to help them understand. This committee sitting for SOPA doesn't understand the internet yet they're trying to regulate it. When someone with knowledge comes along and wants to make an analogy to something they will understand they have none of it!

I understand your points but you're viewing everything through rose coloured lenses. What you want is unattainable because you need complete cooperation from all sides; if even one player breaks the rules then the whole system crumbles back to where we are now. Sure Google could provide those tools but the moment one party doesn't get their way (probably because it wasn't fair to the others) they'll go shouting to congress to make it happen, just like we have now. DMCA wasn't enough for MPAA/RIAA so they're in the back pocket of the government to make it worse. Hell, look at what's happening between UMG and MegaUpload right now!</comment></comment>


"We take security seriously" - <AUTHOR> http://www.troyhunt.com/2015/07/we-take-security-seriously-otherwise.html <comment><USER2> Security is a business cost like anything else and there are tradeoffs. All of these companies have decided that the risk of losing this data was worth the cost savings of not protecting against the attack. So far they all seem to be right (not even Sony went out of business after their massive breach).

So it's perfectly reasonable for them to say they take security seriously and then have these breaches. They take it exactly as seriously as needed to keep their business alive.

Having been on that eBay security team mentioned, I can tell you that we did in fact take security seriously. And sometimes what we recommended was done, and sometimes it was decided the cost wasn't worth the risk. But we were always serious about it.

<comment><USER3> Most of the cost of bad security of a business are not borne by the business, but by its customers. Business often do a bad job of weighing externalized costs, and security is no exception.

<comment><USER4> The business is responsible for the costs against itself, which include any fines, any damage to their revenue due to customers leaving, and any resulting litigation, to name a few. The business isn't responsible for costs borne by customers which don't translate to those customers paying less money.

Given that the listed businesses are still operating and in most cases continuing to turn similar profits to what they were doing before, they appear to have done an excellent job weighing the costs in play.

You're welcome to think that the cost to the business should be higher, either due to the public caring more (most paying customers at the moment don't even consider whether the businesses they support care about security) or due to increased fines and penalties for security failings. It may very well be that we need to adjust those things via raising awareness or changing legislation. But based on the current state of the world, these businesses all weighed things in a way that kept them doing what they do.

<comment><USER5> You guys use the word "seriously" here in an entirely different sense than these statements intend.

These aren't statements made to the board, they're PR statements made to outsiders after huge breaches of customer/employee personal info. No one is reassured in these times by a company being "serious" about security in the sense that they have supposedly calculated its expected impact on their profitability.

> Given that the listed businesses are still operating and in most cases > continuing to turn similar profits to what they were doing before, they > appear to have done an excellent job weighing the costs in play.

You can't know whether (even in an internal bookkeeping sense) the "tradeoff" was net positive. The incidents still cost the companies money.

BP still exists and is highly profitable despite the spill and the ongoing costs incurred. That doesn't mean, hey they must have given it serious thought and found it costs more to inspect and maintain the rig than the $50B+ spent cleaning it up.

<comment><USER6> >You guys use the word "seriously" here in an entirely different sense than these statements intend.

I don't think security can be taken seriously unless specifically compliance is taken seriously.

I claim something that few security professionals would say in their career: Compliance is the magic bullet to taking privacy and security seriously. But to understand why, we have to think about the the most reasonable alternative to compliance as an approach to security.

Do you know what "full content packet capture" means? It's when you're able to grab every piece of data transmitted over a network using a tool called tcpdump. You can use another tool to reassemble those collected data packets into complete applications, movie or music files, even video chats and phone calls.

As a joke, an instructor once told me that when they went onsite to do security investigations, they would do a full content dump; if someone was downloading videos at the time, my instructor would say, "Thanks for the movie, guys!"

This is what the Utah Data Center is doing. All packets are collected using a tool like tcpdump, and then the Center reassembles them and categorizes the content into data cubes (e.g., movies, video calls, emails) that are easily findable with open source search engines such as Lucene and Solr. Is this taking security seriously? You bet!

Enhanced Intrusions Detection Systems is how security is being taken seriously and with a cost to privacy. If a hosting provider like Akamai — which, runs 15% of the world's web traffic — is able to reassemble your packets, and even archive them, is that what you want security to be?

Probably not, but when a security professional says "let's take security seriously", to them it means just watch all the things. I remember in 2006, after my IDS training, I was all for collecting every single packet (no matter what) because I was taught as a security professional, that was the only way I could do my job: watch everything, since we need to know everything about anything. If you watch everything, that's inherently security, and the world is protected. That was my modus operandi for many years.

This is why taking privacy and security seriously really means taking compliance seriously. Compliance lassos in "watch everything" while also providing validation and proof of security. If we're doing good hygiene (e.g. Key rotation, log review, Change Control) on our systems, there's no reason to collect and watch everything.

The recipe to collect everything already exists but that means only security is being taken seriously. I hope we start to take compliance seriously and bring that into the privacy/security equation.

<comment><USER7> You seem to be conflating "security" with "insecure communications"

<comment><USER6> Share with me what you think are the most reasonable approaches to security and privacy?

Option 1. Collect all the things.

Option 2. Just do good hygiene.

Aside from these two options, what else is available to provide a most reasonable approach to protecting our customer's sensitive data?

EDIT: I'm the head of a compliance agency

<comment><USER4> You should probably point out that you're the head of a compliance-focused company.

Your previous 2 comments seem to be drawing a very strange dichotomy where the only options for "security" are "capture all traffic" and "compliance". I'm not even sure where to begin in responding to that, because it's so far beyond any facts you provided in either update.

Neither compliance nor traffic capture are "security". Capturing _and analyzing_ traffic can be a facet of a security stance, and structured compliance frameworks can provide structure and goalposts for measuring your security stance, but there's a near-infinite range of other factors at play here.

<comment><USER6> I'm not sure I understand what you're saying. Capture all the things is exactly what security professionals are asking for as the most reasonable approach to securing sensitive data.

This video is proof: [https://www.youtube.com/watch?v=R63CRBNLE2o](https://www.youtube.com/watch?v=R63CRBNLE2o)

Other security researchers have gone so far as suggesting Penetration Testing and Risk Assessment are the most reasonable approaches to providing security for sensitive data.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I don't understand the criticism, what are they supposed to say instead? When an attacked company says "we take security seriously" it's probably a statement made by someone in the company who really does care about it and is probably pretty upset about the whole ordeal and wants to fix it. This whole attitude about corporations always being these evil lifeless monoliths who don't care about anything and are just saying whatever they need to stands in contrast with any place I've ever worked. Some of these companies are staffed by people who do care and want to do the right thing and I don't understand what the OP thinks they should say instead.

<comment><USER9> "Caring" doesn't matter though, only execution does. Everyone cares about obvious things that people should care about, it doesn't matter though if you fail at what you are supposed to do. Only execution matters in business.

<comment><USER10> But the fact is no matter how much money and effort you put in to it, someone determined enough will find a way through.

What most people don't realise when it comes to computer security is, the foundation on which our modern systems are built never anticipated this much growth.

I think I am happy with companies that care enough to come forward and admit their mistakes. IT security is hard, very very hard.

</comment></comment></comment><comment><USER11> This article makes fun of people who get breached. This is less than helpful.

> "We take security seriously", otherwise known as "We didn't take it > seriously enough"

This implies that if only the companies that got breached had taken security more seriously, they wouldn't have gotten breached. In a world where databases are valuable (the AFF example cited in the post, for example), software is virtually impossible to get to zero defects, and where zero-day vulnerabilities are traded on the open market, some big fish are going to get popped.

The idea that getting breached means you're incompetent is toxic and needs to stop; it just means that you're a sufficiently high-value target. It's very possible (and quite likely) that many of those breached expended extensive efforts in defense. The idea that they would've been fine modulo more security expenditure not just a baseless assumption, it is in many cases patently false (granted, there's plenty where it's true). As a security professional working in customer-facing security, I'm helping exactly the people who are getting breached, therefore I say that having a monetary motive to say that they _aren 't_ spending enough efforts and should give me more money ;-)

The article also ignores that knowing that you got popped probably already means that you're in one of the higher percentiles of security posture... That's sad, but, again, blaming the victims here helps no-one.

(By the way, if you too would like to help people who get breached instead of making fun of them, we're hiring. Contact info in HN profile.)

<comment><USER12> As far as I know the most successful attacks on companies were based on very simple techniques like phishing or similar easy techniques like SQL-Injection. When we talk about data breaches of companies, it mostly hasn't something to do with high sophisticated attacks using 0-days I guess. I'm not sure, would you agree?

Of course companies tell you that there were victims of high sophisticated APT attacks, otherwise they would have to admit, they had been compromised by simple script-kiddy attacks.

Of course blaming victims doesn't help anyone. I want to emphasize here, that not only the companies are victims but also the users and customers, who mostly never received compensations after security failures.

</comment></comment><comment><USER13> The Adult Friend Finder attack in particular is awful - the leaked data is incredibly sensitive and could be used to blackmail or manipulate the victims.

<comment><USER14> I'd feel awful too if my name was 'nailer' ;-)

<comment><USER13> I'm not in there. But thank you for the threat.

</comment></comment></comment><comment><USER15> Anytime I see "We take security seriously" I get double skeptical about their security stance. This is something that's best demonstrated by simply doing it and the results speak for themselves. There's an obvious contrast between organizations with well-managed INFOSEC and those that pretend. Especially when a vulnerability is reported or a breach occurs. Extra-obvious then.

Businesses, just practice INFOSEC instead of preaching it. Better that way.

</comment><comment><USER16> Though the words are nominally the same, the FBI quote has a distinctly different meaning than all the others—I don't think it's quite fair to lump it in with the rest. The FBI saying "we take threats seriously" means they are willing to throw money at investigations and prosecutions. The other companies don't have that particular power.

</comment><comment><USER17> It's not exactly fair because security is a process. Even following all best practices, new attacks happen all the time. Sometimes the security process includes post-attack investigation and mitigation.

It's quite easy to point a finger when you have a few servers that you spend all of your time securing and monitoring. It's something else when you have departments of people connected to your network and running services, breaking policies, taking laptops out of the office, etc.

Nobody wants to see their data being breached. I applaud companies for publicly sharing their investigation and response.

</comment><comment><USER9> Taking security seriously, and knowing what you are doing are often mutually exclusive in business.

</comment><comment><USER18> Hackers takes _your_ security (and your money) seriously too.

</comment><comment><USER19> Is the issue that there was a lack of technical investment in security or a shortcoming in their ability to communicate with their customers?

I'd argue many of the companies mentioned have invested heavily in security. Whether their investment will prevent a compromise from a determined adversary is likely unrelated to their investment.

Unfortunately, I suspect many of the mentioned companies had not equally invested in how to properly communicate a compromise with their customers.

</comment><comment><USER20> This is human nature: we usually take actions after the fact.

</comment><comment><USER21> People in the know: how do these breaches keep happening?

<comment><USER22> It is dazzlingly expensive to run a 500+ seat IT organization in a matter that is meaningfully hardened against attackers. Meanwhile, IT budgets are calibrated against the last 20 years of typical IT expenses. That's despite that fact that the last 10 years have drastically increased the risk of IT security attacks, because:

* the technology adoption curve of attack techniques has made powerful attacks available to the "early majority" cohort of criminals

* computer science has demonstrated flaws in foundational technology that weren't widely known 15 years ago

* as online attacks have mainstreamed, an industry value chain has developed to monetize weaknesses

So it's business-as-usual in IT, despite the fact that when it comes to security, "usual" has been redefined.

Basically no medium/medium-large company in the world is willing to spend the amount of money (and make the usability sacrifices) it would take to reasonably ensure resiliency against attacks. The most secure firms spend anomalous amounts of money simply to elevate themselves to a point where they (a) aren't the easiest targets and (b) have bought enough time to detect and respond to incidents as they occur.

<comment><USER23> If one had an infinite monetary and user acceptability/retraining budget... what would a modern, secure 500+ seat IT infrastructure look like? Even in the broadest of terms.

<comment><USER22> * No unfiltered attachments in email, for definitions of "filter" that include "stripping out content and re-rendering in simpler formats", like "PDF->RTF" or something equally terrible.

* Fine-grained segmentation of all networks on need-to-know basis, informed by the org chart and detailed role descriptions for virtually all employees.

* No employee access to arbitrary Internet sites

* For employees that require Internet access, air gaps between computers that can hit Google and computers that can access company email

* Formal audits for minor software releases

* Expensive, heavily tested secure coding training for all developers

* Adoption of secure coding/design standards ("this is the XYZcorp way to make an SQL query" and "this is the XYZcorp way to render HTML"). Strict bans on deprecated interfaces.

* Employee access to sensitive internal applications (like document and image management) gated through Citrix-like environments, so you have to remote terminal in to get to the browser that actually talks to the application.

* Extremely minimal access provided to VPN users.

* Total 8021x-style lockdown of network ports and fascist policies against bringing own devices.

And so on.

There is zero chance this is ever going to describe any huge company.

<comment><USER24> If I worked as a developer inside such an organisation, I'd quit. A sad side- effect of rigorous IT security is the lack of productivity and day-to-day frustrations experienced by the staff.

I've experienced this myself inside a major central bank. Most development staff were a) demoralised and b) frequently adopting insecure work-arounds.

<comment><USER22> So would I. But another way to look at this is, instead of "I'd quit", saying "they'd have to pay me 3x more to work in a place like that". At which point you can again start looking at it as an economic problem.

<comment><USER25> You're right. I work at a place that does all but two of those, and I wouldn't if they didn't pay me as much as they do!

<comment><USER22> If you work at a company with more than 500 employees that does all but two of those, I'd like to hear more about that. As I wrote those bullets, I filtered them through my experience of consulting for F500 companies, and when I found myself writing something I'd seen _reliably deployed_ across _entire organizations_ , I edited the bullet until that was no longer the case.

About the closest I've come to seeing any of these bullets deployed reliably is Microsoft's developer training and deprecation of the standard C library, and that initiative was so out-of-the-ordinary that it was newsworthy, and widely reported.

But to actually earn that bullet, Microsoft would need to deploy those same measures across all its contractors, and, more importantly, deploy them on _internal IT and line of business systems_ , not just the Windows and Office codebases.

<comment><USER23> I imagine some government facilities could hit that mark—based loosely on descriptions of friends who have worked in such environments.

<comment><USER25> Bingo.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


A port of the GNU Privacy Guard to Javascript using Emscripten - <AUTHOR> https://github.com/manuels/unix-toolbox.js-gnupg

<comment><USER2> I'd be really interested to see how this would compare to an asm.js version, and how interoperable both are with a command line version.

I'd also be curious how many new corner cases would appear due to C-isms like overflow and undefined behavior not making a bit-for-bit translation.

<comment> TD-Linux Emscripten generates asm.js code by default.

Also Emscripten should be C standard compliant. So any behavior that isn't correct is likely an Emscripten bug.

</comment></comment><comment><USER3> Do we want to trust a transpiler when dealing with cryptography code? Building encryption that is resistant to side-channel attacks requires knowledge of the execution environment. When the environment changes drastically then many assumptions about the strength of the code need to be reevaluated.

Plus the usual caveat about trusting code that is downloaded from the internet. Although this also has a use in iPhone & Android apps that are written in Javascript. This lets you have encryption without using native code.

Somewhat tangential, but is Emscripten generated code being used in any production web apps? I don't think I've ever seen it for anything other then proof-of-concept demos.

(Answering my own question, doesn't Unreal Engine use Emscripten?)

</comment><comment><USER4> This sort of thing probably works better as an html5 app which is cached and not reloaded every time, less trust in the server.</comment>


The JustDecompile .NET decompiler engine has been open-sourced - <AUTHOR> https://github.com/telerik/JustDecompileEngine

<comment><USER2> How does this compare to dotPeek from JetBrains? [https://www.jetbrains.com/decompiler/](https://www.jetbrains.com/decompiler/)

<comment><USER3> Much better for newer features... for async/await dotpeek would show state machine ( which was actually cool to see), but JustDecompile would actually show me async await in decompiled code.

ALSO, coolest feature is decompile to csproj ... very nice ;)

<comment><USER4> I had the opposite experience. DotPeek created much better code. using statements were decompiled as usings, JustDecompile produced try/finally blocks.

</comment></comment></comment><comment><USER5> [http://ilspy.net/](http://ilspy.net/) is what I generally use. Functionally modeled after .NET Reflector.

</comment><comment><USER6> A .NET decompiler written in .NET: I bet "let's try it on itself!" was not an uncommon thought among its users already.

It wasn't this one, but years ago I remember using a decompiler to look through things like the system libraries and the (relatively few) apps written in it at the time, and it was quite interesting how much metadata was available (if it hadn't been obfuscated). I think it's fun and enlightening to take things apart, see how they work, and modify them, so that aspect of .NET really appealed to me, but I still prefer native code for its efficiency and succinctness...

<comment><USER7> Before Minecraft, there was "Infiniminer" \- a decompiler was involved:

Zachtronics discontinued development of the game less than a month after its first release as the result of its source code leak. As Barth had not obfuscated the C# .NET source code of the game, it was decompiled and extracted from the binaries. Hackers modified the code to make mods, but also started making clients that would target vulnerabilities in the game as well as build incompatible game forks that fragmented its user base. Barth, who was making the game for free, then lost interest and dropped the project, as development of the game had become too difficult. [http://en.wikipedia.org/wiki/Zachary_Barth](http://en.wikipedia.org/wiki/Zachary_Barth)

"Proto-MineCraft Abandoned Due To Epic Error" article: [http://www.rockpapershotgun.com/2011/01/20/proto- minecraft-a...](http://www.rockpapershotgun.com/2011/01/20/proto-minecraft- abandoned-due-to-epic-error/)

The Minecraft mods-support relies on a decompiler too: [http://minecraft.gamepedia.com/Programs_and_editors/Minecraf...](http://minecraft.gamepedia.com/Programs_and_editors/Minecraft_Coder_Pack)

<comment><USER8> Is it really an "epic error" to allow someone to see the source code of your program?

<comment><USER7> It's the headline of the rockpapershotgun.com article, that's simply their writing style. I added quote around the title, to make it clear that it's the articles title and not my opinion.

<comment><USER8> Sorry, I realize that; I just take issue with their claim.

</comment></comment></comment></comment></comment><comment><USER9> With the release of Roslyn wont writing things like these be a lot easier?

</comment><comment><USER10> This tool helped a lot back then. I would also use DotPeek.</comment>


How Banks Unwittingly Finance Mass Shootings - <AUTHOR> https://www.nytimes.com/interactive/2018/12/24/business/dealbook/mass-shootings-credit-cards.html <comment><USER2> But what do you want them to do? Have we lost the idea of consumer privacy? I know several people who have decided to prep for doomsday, often equipping a ranch with weapons. That shouldn't get you put on a watchlist. Or what if someone wants to purchase firearms before laws change? I know others who have done just that. Gun debates aside, should we really give the government influence over what we should and should not consume? Utah passed laws against certain explicit content, and this rationale was used to protest; why not here?

One of the best pieces of advice I got concerning terrorism was not to be too afraid. If we live in fear, we let the terrorists win. And if we give the government many powers to "fix it", then, as devs like to say, now we have two problems. Remember, what powers you give "your side" to fix a problem can then be abused by the "other side" when they get their turn.

I'm always open to solutions for such terrible problems as mass shootings. But curtailing individual liberty means that the terrorists win. Look at Xinjiang: that is where we are headed in 20 years. The only way to completely prevent terrorism is to lock down every aspect of every life. Hence Xinjiang. The question is simply how slowly our politicians will try to force this upon us.

It is for all these reasons that the idea of "reporting suspicious behavior" bothers me. It is a perfect lever that will inevitably be used to political means or to settle grudges. It enables the use of the police as a club; think "swatting" but worse. Please don't support this sort of nonsense.</comment>


I love my ridiculous Neptune Pine - <AUTHOR> https://e14n.com/evan/note/KpWSklyGQUebQUBFq38eBw

<comment><USER2> Not quite right. Maybe "I like my Pine" or "I'm intrigued by my Pine"

<comment><USER3> Come now. He's giving up his iPhone to use it, despite some glaring flaws it has. Is that not love? :)

</comment></comment><comment><USER4> This is me. I do love it.</comment>


Automate Debian system updates using a cron job - <AUTHOR> http://linuxcommando.blogspot.com/2015/03/automate-debian-system-updates-using.html

<comment><USER2> Please don't. Maybe, just maybe, on a personal (desk|lap)top. But anywhere else, and even there, unattended-upgrades or cron-apt are a far better choice and much more configurable.</comment>


When is it time to quit my day job? - <AUTHOR>

Hello all,
I had written this earlier: http://news.ycombinator.com/item?id=3011961
My site is ready and mostly bug-free now. I'm getting decent traction (non-friends and family!), and even got a fairly decent write-up in a tech blog.
There are 2 other sites that got funded (one angel, one VC) that actually started way after me. We've been working part-time though, so they're in some ways ahead of us...but we're different enough from them to compete etc. etc. In a way having some competition is a good thing because it validates your idea.
I'm thinking I should cut loose from my day job and focus on this project full-time. I ran my finances very carefully yesterday and if I juggle things around a little I can support myself via consulting for 2-3 days a week. Market the site etc for the remaining part of the week, get more traction and maybe even funding.
But I'm a little nervous, and wanted to know what everyone thought. Note that I have a mortgage etc. I can't move back in with my parents :) <comment><USER2> I've just taken the plunge. Its been 30 days so far.

My plan is to consult 2/3 days a week and work on my startup the rest of the time.

So far I've had so much consulting work I've been working 6 days a week on that!

I'm not sure how this is all going to go, but what I do know is that I'm much happier not working for 'the man' anymore.

</comment><comment><USER3> Many people have had the experience of trying to mix consulting and startup activities and neither succeeding.

Risk aversion varies greatly for people, from my perspective it would appear you don't have enough runway to take-off and fly this startup yet. How long before you could build sufficient reserves to not need to do consulting?

<comment><AUTHOR> Great point. I'm definitely going to need some funding to make money. The only thing consulting will buy me is additional time to market the site/hack and get more users.

</comment></comment><comment><USER4> You could hire someone to market the site for you which would allow you to keep your job, give you more time to develop the site, and you'd take less risk.

Risk vs. reward. It's hard for us to determine what the correct answer is without having the necessary information and numbers.

But good luck!

<comment><AUTHOR> Funny, that's what my wife said too. I noticed from your other post that's what you do. Are you open to a phone call? :-)

</comment></comment><comment><USER5> "In a way having some competition is a good thing because it validates your idea."

No, it doesn't. Many people can be wrong about the existence of a market/problem. But to answer your question, "when you earn from your startup as much as you do from your job" is quite a safe point.

</comment><comment><USER6> Oooooooooooo brother. Don't sign mortgages! Stay footloose. Because of that mortgage, you're going to have to tread carefully. Otherwise, I'd tell you to drop that job like a bag of dirt!</comment>


How to Build a Product Loved by Millions and Get Acquired by Google: Firebase - <AUTHOR> https://hackernoon.com/how-to-build-a-product-loved-by-millions-and-get-acquired-by-google-the-firebase-story-82dab4e3e80c#.wtrv8jz5p <comment><USER2> Excellent article on how to build an actual dev community around a platform. I think my fav takeaway is to be honest with devs, something a lot of platforms tend to fail at, as they tend to focus on how they are the best for all use cases.

</comment><comment><USER3> Wasn't Firebase or Firebird a fork of the Borland Innerbase or whatever database? They could not sell it so they created a free and open source version of it, and then someone ported it to different platforms, etc.

It was supposed to compete with MySQL, PostgreSQL, Oracle, SQL Server, etc.</comment>


Ask HN: SaaS pricing: free basic plan / free trial / paid only - <AUTHOR> For a SaaS project that's directed mainly to software developers and people that have side projects. What's best as a first pricing approach, immediately after release? Would appreciate if you know cases of people that switched from a pricing model to another. <comment><USER2> Probably depends on what your selling?

How much cost do you have involved in the service?

What pricing range your talking about?

How else would you be marketing it besides free tier?

What your competitors are offering?</comment>


The Most Important Job Factors for Developers - <AUTHOR> http://jobfactors.workshape.io/ <comment><USER2> This is _fascinating_ stuff. What I find super interesting is that Industry becomes significantly more important the more experienced the developer.

The only thing I can think of that would make this even better is if I could filter the data by geographic region.

<comment><USER3> That would be a good addition. We'll consider adding it in later iterations for sure. Thanks.

</comment></comment><comment><USER4> I love this refreshing look of the world of hiring from the developers pov.</comment>


Pediatric Environmentalism - <AUTHOR> http://www.forbes.com/2010/04/16/science-education-environment-opinions-contributors-henry-i-miller_print.html

<comment><USER2> "Too often the objective of student projects seems to be "empowering" the kids and giving them a feeling of accomplishment instead of getting the right answer and learning scientific principles."

I would argue that these two goals are not mutually exclusive. If all you do is teaching kids the right answer, which is largely what schools do, then you end up exactly where we are today, where kids largely don't feel like science is about investigation at all but just about rote memorization of facts.

<comment><USER3> I would argue that nobody said they are exclusive, and diving down that mental path is a great way to end up talking yourself into a position in which you have justified to yourself that it's OK to lie about the science if it leads to Right Thinking.

Facts are a prerequisite to true learning. They are necessary to jumpstart the autodidact process. If you give up on them at the beginning, the children will notice, and you will end up with neither the autodidacts we desire nor people who even understand basic facts through rote memorization. Teaching children to investigate without giving them the proper basis of facts will result in them "investigating" up some homeopathy or astrology or other such things. Or stupid theories about electromagnetic OMGRadiation!!1! killz beez! (OMGRadiation!!1! being my personal pet name for the usual concept of radiation that people have hammered in them by Hollywood.)

False environmental consciousness isn't even a virtue. It's cute to see schoolchildren worry about the bees dying due to cell phone towers. It's somewhat less cute when they're still worried about that at voting ages. You get the double-whammy of them wasting economic resources trying to deal with a false threat posed by cell phone towers while the real threat goes unaddressed.

<comment><USER4> _False environmental consciousness isn't even a virtue._

See also: DDT, GMO, vaccines, and irradiation in the context of food safety. I really don't care if recycling becomes a secular religion even if it is a net waste of energy, but deeply held beliefs about the above four _kill people_.

</comment></comment></comment><comment><USER5> Oh my god -- a class of fifth graders in 2009 wasn't aware of two relevant scientific papers published in 2008?

 _The only way to explain these pre-teen children's ignorance of this knowledge is that there's a conspiracy dedicated to hiding the facts from them!_

No, in practice eleven-year-old kids usually aren't reading the current scientific literature -- they're learning from their teachers and reading texts that have been written for students, and it's not surprising that it takes a few years for new information to permeate the educational system.

I understand the concern the piece is raising, but surely there are better examples than that, right?

<comment><USER6> I thought the article was quite clear on this. The more important point is: _Probable causes? In fact, there's no scientific evidence that cellphones, pesticides, global warming or the alleged insufficiency of wildflowers are linked in any way to CCD._

Not knowing recent research on it might be fine. Maybe the articles were in Spanish and hard to find or something. But if the lesson ended up with kids getting concerned and writing letters, and they say "yea we're not sure, it could be some stuff that's unrelated", that sounds like a missed learning opportunity, maybe.

<comment><USER7> I don't think the kids are doing too badly on that one, though, because you'd get results not entirely dissimilar if you polled working biologists. CCD is a particularly tricky example because _everyone_ agrees that something is happening, but _no_ causes have proven links. Yet there presumably is some cause or set of causes, so scientists differ in their hypotheses as to what those causes might be. I suspect if you were to poll, you'd find that very few think a link to cell-phone towers is probable, but quite a few think a link to pesticides is probable.</comment></comment></comment>


Show HN: Sapient – Security Toolkit for HTTP-Based APIs - <AUTHOR> https://github.com/paragonie/sapient <comment><AUTHOR> This uses libsodium to encrypt or sign HTTP message bodies. It works either client-side or server-side, on requests or responses.

Features:

      - Symmetric-key
        - Encryption (XChaCha20-Poly1305)
        - Authentication (HMAC-SHA512-256)
      - Public-key
        - Sealing (X25519 + BLAKE2b + XChaCha20-Poly1305)
        - Signing (Ed25519)

If libsodium is not available (it currently has to be installed via PECL), sodium_compat will polyfill these features.

It works on PSR-7 interfaces, but for framework-specific adoption, we've created a few Sapient adapters and creating your own is relatively straightforward.

Specification: [https://github.com/paragonie/sapient/blob/master/docs/Specif...](https://github.com/paragonie/sapient/blob/master/docs/Specification.md)

Encryption specifics: [https://github.com/paragonie/sapient/blob/master/docs/Intern...](https://github.com/paragonie/sapient/blob/master/docs/Internals/Simple.md)

Class documentation: [https://github.com/paragonie/sapient/blob/master/docs/Intern...](https://github.com/paragonie/sapient/blob/master/docs/Internals/Sapient.md)</comment>


Sublime Text as an Arduino IDE - <AUTHOR> http://hackaday.com/2014/04/20/sublime-text-as-an-arduino-ide/ <comment><USER2> I'll welcome any alternative to Arduino IDE with open arms. I'm not sure why Arduino decided to reinvent a text editor instead of focusing on a plugin for a better text editor.

<comment><USER3> > I'm not sure why Arduino decided to reinvent a text editor

They didn't, they repurposed the editor developed for Processing ( [https://processing.org/](https://processing.org/) ).

> instead of focusing on a plugin for a better text editor.

Which cross platform editor should they have focused on in 2005?

<comment><USER2> Had no idea it was that old, that completely makes sense for 2005.</comment></comment></comment>


Scribd.com - New Media Life Cycle Analysis - <AUTHOR> http://www.scribd.com/doc/13465814/New-Media-Life-Cycle-Analysis-Scribdcom With their formal publisher announcements this week, Scribd.com is officially entering the monetization phase of the life cycle. <comment><USER2> Original post (Which isn't on iPaper, and so is readable)

[http://blog.tippingpointlabs.com/2009/03/if-youre-not-on- scr...](http://blog.tippingpointlabs.com/2009/03/if-youre-not-on-scribd-you- should-be/)

<comment><USER3> Can you explain in simple words what value they add to documents, please? Is it the format conversion? The embeddability? I don't understand the market.

<comment><USER2> I don't think anyone does. It's an enigma.</comment></comment></comment>


The Insanity of Our Food Policy - <AUTHOR> http://opinionator.blogs.nytimes.com/2013/11/16/the-insanity-of-our-food-policy/ <comment><USER2> There's some truly nutty stuff going on with subsidies. One example is cotton subsidies. Right now we're subsidizing cotton by direct payments and crop insurance. In 2004, the WTO ruled these subsidies to be unfair in a dispute brought by Brazil. To reconcile the dispute, the US started paying Brazil about $150 million per year, instead of ending the subsidies. So now we're paying twice for cotton subsidies.

[http://en.wikipedia.org/wiki/Brazil%E2%80%93United_States_co...](http://en.wikipedia.org/wiki/Brazil%E2%80%93United_States_cotton_dispute)

<comment><USER3> It's hardly the most freaky, imho. The biggest one, to me, is how the enormous subsidies that US farmers receive directly contribute to global obesity and healthcare costs.

Here's a primer on what sugar (or more precisely, fructose) does by Dr Lustig (of UCSF, if memory serves):

[http://www.youtube.com/watch?v=dBnniua6-oM](http://www.youtube.com/watch?v=dBnniua6-oM)

I wouldn't be surprised if US agribusinesses ultimately end up on the receiving end of lawsuits across the world -- much like tabacco companies did.

<comment><USER4> Does any other expert agree with Lustig, or is it just him and a bunch of people who've watched videos by him?

<comment><USER5> Can't you make up your mind on your own based on information, without the need to appeal to expert consensus (which might as well be bogus and profit- driven?)

<comment><USER6> Not particularly reliably. Peer review by people who actually know what they are doing is going to beat my puny brain 99% of the time.

<comment><USER5> Wasn't that the exact same argument given to the expertise of priests and medieval scholars?

In any case, I wouldn't count on that. Recent meta-studies (if we are to at least believe those) show that a majority of scientific papers are non verifiable and non reproducible BS, contain fabrications and alterations, etc -- and that's talking about the "hard sciences". And having been involved with researchers, I don't doubt that at all.

E.g:

[http://www.economist.com/news/leaders/21588069-scientific- re...](http://www.economist.com/news/leaders/21588069-scientific-research-has- changed-world-now-it-needs-change-itself-how-science-goes-wrong)

and:

[http://www.economist.com/news/briefing/21588057-scientists-t...](http://www.economist.com/news/briefing/21588057-scientists- think-science-self-correcting-alarming-degree-it-not-trouble)

<comment><USER4> > Wasn't that the exact same argument given to the expertise of priests and > medieval scholars?

This is the "Experts were wrong before" dodge, which conveniently ignores how often individuals are wrong.

[http://rationalwiki.org/wiki/Science_was_wrong_before](http://rationalwiki.org/wiki/Science_was_wrong_before)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> One of the amazing things about our food subsidies is that they skew towards subsidizing things like row crops: wheat and corn, and indirectly subsidize grain-fed meat.

And they don't subsidize things like vegetables.

Now, what do Americans not eat enough of? And it's partly because they're too expensive compared to cheap grains and cheap grain-fed meat?

<comment><USER8> To be fair, the subsidies exist (if only theoretically) to ensure that America can feed itself in a large scale war. In WWII, the Allies had a lot of success with cutting off Germany's external trade, which significantly reduces their ability to make war. America wants to make sure that if that happens to them, there won't be a famine.

Vegetables aren't a priority in that situation, because they can be easily grown in backyard gardens. On the other hand, row crops tend to be carbohydrate-heavy (perfect for a famine), cheap to produce, _and_ they benefit significantly from economies of scale.

<comment><USER9> Row crops also store & transport much better than most vegetables.

</comment></comment></comment><comment><USER10> Look what happened with corn subsidies. Now corn is in EVERYTHING we eat. Literally everything. The beef, chicken, and pork you eat has all been fed corn. Every processed food has corn starch or corn syrup or some other product of corn. Most of the words you can't pronounce in the ingredients list are derivatives of corn. And it's all because of ridiculous bills and subsidies and money getting thrown around in big agro. Recommended Read: Omnivores Dilemma

</comment><comment><USER11> Stiglitz makes a good point about how farm subsidies made sense in the '30s when most farms were small and family owned. They were an antipoverty program then, and only since then were their rules exploited by ever-larger farms.

This kind of rent seeking should not surprise anyone. The market moves a lot more quickly than government. Today's reasonable policy is tomorrow's corporate welfare.

The lesson I take from this: other things being equal, err on the side of fewer programs and regulations instead of more. If you want to help the needy, it's better to use broad-based direct assistance (like food stamps or the EITC) than a more complicated program that singles out some sub-group like farmers.

<comment><USER12> Give poor people money to buy food, they will likely optimize in fat+ ways. Pay people to be healthy. The needy can be healthy. Put a floor under everyone and then progressively incentivize health.

<comment><USER13> Health is its own reward; paying people for healthy _outcomes_ == worse poverty for the chronically unhealthy, partially disabled, and (in the US) victims of the non-healthcare system.

</comment></comment></comment><comment><USER14> It makes sense when you understand how DC works, and how corrupt the government is .How many representatives have "farms" and get subsidies? There is no insanity here, it's by design.

Saying that things are "illogic" is insulting.Things make perfect sense, journalists just dont want to admit that US politicians are rotten to the core.

<comment><USER15> A statistic showing that many representatives have farms would be a lot more interesting than an insinuation that many of them probably do.

The excessively subsidized farms discussed in the article were collecting an average of $30,000 a year. That's nice money, but I can't see a significant portion of the body wasting their influence chasing that around.

<comment><USER16> > A statistic showing that many representatives have farms would be a lot more > interesting

[http://www.huffingtonpost.com/donald-carr/farm-subsidies- pai...](http://www.huffingtonpost.com/donald-carr/farm-subsidies-paid- to-112-congress_b_842704.html)

[http://www.ewg.org/release/members-congress- received-238k-fa...](http://www.ewg.org/release/members-congress- received-238k-farm-subsidies)

Just some interesting links I found while attempting to sate my own curiosity as to whether such a statistic has been compiled.

</comment></comment></comment><comment><USER17> Honestly, I was expecting to read some sort of defense of this corruption here in the comments.

There's a certain part of HN that is totally all about rent-seeking. It's what startups do when they create platforms that are only a slight twist on things in order to get everyone to use them, and then if they get enough market share, they can take in rents disproportionate to any value they add.

Sure, there's a lot of productive and ethical startup stuff too. But there's just the undercurrent that if someone is making good money in the marketplace, it's because they are a success and should be emulated. Many people fail to question whether the business is really founded in ethical practices.

I guess, so far anyway, when something is _that_ corrupt and unethical as the U.S. food policy, then even those who knee-jerk to defend anyone rich are not gonna be defending this nonsense. Everyone has a limit to their ability to be in denial about the corruption in our economy…

<comment><USER5> > _There 's a certain part of HN that is totally all about rent-seeking._

I find that modern day capitalism is ALL ABOUT rent-seeking.

That's what has halted major advances and innovations in favor of Tumblr's and Instagrams and reduced the number of Promethean Elon Musk like figures to people like Zuckengerg et al.

> _I guess, so far anyway, when something is that corrupt and unethical as the > U.S. food policy, then even those who knee-jerk to defend anyone rich are > not gonna be defending this nonsense. Everyone has a limit to their ability > to be in denial about the corruption in our economy…_

Well, there's a counter explanation, that they don't think they are defending rich people in this case (e.g they don't consider subsidised farmers that).

<comment><USER17> well, sure, I'm actually not going to disagree with you. Capitalism as we know it in real-life (whatever about fantasy and theory) is all about rent-seeking.

</comment></comment></comment><comment><USER18> Get with the program, welfare is terrible. Unless of course its welfare for the wealthy.

</comment><comment><USER19> It's helpful to realize that questions of price supports (or import tariffs) on agricultural products go pretty much to the very birth of modern economic thought. Smith discusses them in his _Wealth of Nations_ , and one of David Ricardo's first economic essays concerned the Corn Laws (restrictions on grain imports to Great Britain).

[http://socserv2.socsci.mcmaster.ca/~econ/ugcm/3ll3/ricardo/p...](http://socserv2.socsci.mcmaster.ca/~econ/ugcm/3ll3/ricardo/profits.txt)

All that's old is new again.

</comment><comment><USER20> Virtually no one in Congress has ever been hungry because they had little or no money and couldn't buy any. But they have lots of experience having people give them money to obtain more for the giver. So you wind up with feed the rich and starve the poor as good politics.

</comment><comment><USER21> Farmers are now 'the undeserving rich' -ha! Clearly they don't know any (I'm from an Nth generation farm family).</comment>