Why You Can't Get a Ticket to the NBA Finals - <AUTHOR> https://theringer.com/ticket-industry-problem-solution-e4b3b71fdff6#.z2zzl0jhc <comment><USER2> Yesterday: [https://news.ycombinator.com/item?id=11833484](https://news.ycombinator.com/item?id=11833484)

<comment><AUTHOR> Here's what I don't get. In previous versions of HN, my submission would be directed to the original. Why doesn't that happen any more?

</comment></comment><comment><USER3> Well this explains a lot.

I recently bought NBA tickets to Game 3 of the Western Conference Finals (Oklahoma City Thunder vs. Golden State Warriors), and I was absolutely pissed off at the whole process.

I went on a small Twitter rampage to vent about it, with a picture that shows NO TICKETS available LITERALLY THE SECOND they went "on sale" (10AM Thursday May 19, 2016), and then beside it another screenshot of ALMOST 1,300 TICKETS FOR RESALE at the exact same time.

[https://twitter.com/vlucas/status/733315798068953089](https://twitter.com/vlucas/status/733315798068953089)

I learned the system was rigged against me the hard way, and it totally sucked. It was painfully obvious that all the tickets were sold out well before the game, and that a whole lot of scalpers were making lots of money on reselling tickets that were not fans, and never had any intention of going to the game in the first place. The kicker is that the system actually seemed _designed intentionally for this to happen_ , screwing the actual fans in the process.

<comment><USER4> That's pretty intentional. A venue really doesn't care how many people go, they care that the show gets "sold out".

A couple of my friends are scalpers. They said there's a limit of 8 tickets for most shows per address, but if you walk in with thousands of dollars in cash that limit goes away. Online it's a little different since you need to put your address in for your credit card, but there's plenty of ways to get multiple addresses with your name for credit cards.

They make more than me as a software engineer, but they can easily lose thousands if a show doesn't pan out. They follow tours across the US and hope they find "the one" that makes them rich.

</comment></comment><comment><USER5> What's wrong with blindly auctioning off all of the tickets?

That way more tickets will be sold, the artist can't be accused of being greedy, there won't be much profit in the resale market, and everyone who attends the show will have paid an amount they thought was reasonable during the bidding process.

<comment><USER6> Because if the supply of tickets is lower than the demand, which it obviously is, tickets will essentially only go to the people able to spend the most money on them.

<comment><USER5> That's no different than now, except the money will go to the artists and producers and not some useless middleman with a fast web scraper.

<comment><USER6> Now I am bit confused. Yes, on the consumer side there will be no big difference as compared to the current situation but don't we agree that the current situation is not good or at least not optimal?

<comment><USER5> We're disagreeing on why the current situation is not good.

I'm mad that there's a class of a parasites getting rich off the backs of the artists and workers that create the value in the concerts.

I have no issue with poor people being unable to see live shows.

</comment></comment></comment></comment></comment><comment><USER7> It feels like the ticketing process in general is broken. There's too much demand for events, making the entire market dysfunctional.

Why don't we 1) make tickets non-transferrable (but refundable), 2) start pricing half the tickets as what the person will pay via auction and the other half as a fixed-price lottery? I'm not aware of many other ways to make things fair when demand outstrips supply so much.

<comment><USER8> I can't relate to any of the arguments in this thread!

Why does it need to be fair? It's a private business putting on an event that nobody needs to go to except as a luxury entertainment. It's not access to food and water. We don't expect that other limited luxuries should be available to everyone, so why concerts and sport events?

Surely tickets going to the people who'll pay the most is fair?

<comment><USER9> Selling some at a lottery provides a market for people who would be priced out very early along the curve.

If you want to avoid a Hunger Games situation where only the rich and famous enjoy your product (the NBA and many musicians care about this) that sort of person needs to be provided for

<comment><USER10> Here is the deal, they already give fans an in road on buying play off tickets. Be a season ticket holder.

Now some will argue this is not sufficient but the rub is, if your not going to support the team the full season then why should you have preference over someone who does?

So all teams provide for regular fans. However many people who do complain about the 'system' are fans of fancy, as in fans when the team wins and is in the playoffs.

There are similar passes and priorities for entertainment venues.

<comment><USER11> Season tickets cost thousands of dollars and in many cases have extremely long waiting lists. When I still lived in the DC area, the waiting list for Redskins season tickets was decades long.

It's important to keep the sport seemingly accessible for the long term prospects of the sport.

</comment></comment></comment></comment></comment><comment><USER12> A few years ago Louis CK started selling tickets for his shows exclusively from his website. His post announcing the process is worth a read. I bought tickets for that show from him and the process was as simple as he describes it.

[https://louisck.net/news/im-going-on-the-road](https://louisck.net/news/im- going-on-the-road)

<comment><USER13> He certainly doesn't still exclusively do that. Tickets for his current tour are sold through Ticketmaster.

<comment><USER12> I was not aware, but this is true. I looked through his latest tour and ticket prices vary, tickets are sold from various ticket outlets, and (depending on the outlet) additional fees may inflate prices. It seems like the only tenet that remains is that about ticket resale.

[https://louisck.net/tour-dates](https://louisck.net/tour-dates) : 'Regarding ticket resale: we take great efforts and have many methods of finding out what inventory is being sold on "broker" sites like Stubhub and Vivid Seats and immediately invalidating those tickets.'

</comment></comment></comment><comment><USER14> Good analysis that makes me slightly less upset about the difficulty of gaining entrance into the Western States 100. The WSER event organizers implement this article's primary recommendations: transparency and non- transferability despite the huge supply and demand disparity and market forces driving their automatic entry vs. lottery process: [http://www.wser.org/entry- process/](http://www.wser.org/entry-process/)

</comment><comment><USER15> I think this is like asking for 'Right to redressal for hurt feelings'. Simple economic logic dictates that those who pay highest for music/sporting events get privilege to watch that live.

These fans seems to be asking for Right to watch live. What if less popular artists/sports teams ask for Right to Audience? I think government should start looking into that also after all there must be lots of mediocre artists/sports persons/chefs etc looking for patrons.

<comment><USER16> That is _one_ solution for how to distribute a good that's available in limited quantities. It's not the only solution, or necessarily the "best" solution for any given circumstance.

Other examples include "Who's willing to wait in a 15 minute line for the water fountain," "Enter a lottery for the limited number of season football tickets," and "Only people with an even numbered license plate can buy gas today."

I think there are longer-term factors for the NBA here. If your fans can't get reasonably priced tickets to any of the games they're excited about because of scalping, some percent of them are going to get fed up and do something else with their lives. The NBA gets long term value out of fans being able to connect with their brand at the prices that the NBA is setting, but scalpers are scraping up the benefits from both sides and pocketing it.

NBA doesn't get the money that they could have earned by charging higher prices, and fans don't have a shot at affordable access to events.

</comment></comment><comment><USER17> Unrelated: Can't tell how I feel about Medium.com as a CMS compared to old Grantland. Reads great, but feels like standalone (could just be me.)

<comment><USER18> The customization looks ugly. Hopefully Medium will add more flexibility or become plug and play like Disqus.

</comment></comment><comment><USER19> A more accurate title would be something like "Why you can't get good tickets for popular events via the official websites."

</comment><comment><USER20> Nontransferable tickets seem terrible, mostly because they screw regular people as much as "devious resellers." Would no longer be possible to gift tickets or recover costs in the case of an unexpected cancellation.

I'm more curious why they have to be sold on a FCFS basis rather than an auction or via random selection.

<comment><USER21> If you just make them refundable then only the resellers get screwed.

</comment></comment><comment><USER22> > A couple of my friends are scalpers.

You have bad friends.

Edit: Aren't scalpers viewed as the scum? Why the downvotes?

<comment><USER23> Probably because it wasn't substantive. There's also something uncivil about reducing a complex thing like lutefisk's comment to the most-easily-denounced bit, then denouncing it. It shuts down conversation instead of taking it in an interesting direction.

We detached this comment from [https://news.ycombinator.com/item?id=11837077](https://news.ycombinator.com/item?id=11837077) and marked it off-topic.

<comment><USER22> Thank you</comment></comment></comment>


Facebook has asked U.S. banks to share financial information about customers - <AUTHOR> https://www.wsj.com/articles/facebook-to-banks-give-us-your-data-well-give-you-our-users-1533564049 <comment><USER2> _Facebook said it wouldn't use the bank data for ad-targeting purposes or share it with third parties._

 _"We don't use purchase data from banks or credit card companies for ads," said spokeswoman Elisabeth Diana. "We also don't have special relationships, partnerships, or contracts with banks or credit-card companies to use their customers' purchase data for ads."_

How do journalists expect me to interpret this? The first sentence says Facebook made a promise, and the second paragraph reads like a supporting quote. The quote doesn't make the promise claimed in the first paragraph. Should I assume that a Facebook representative made the promise, but the actual quote got cut. Or should I assume that three different authors can't critically read a sentence to tell that the quote only makes statements about current practices? Why do we accept articles from major outlets without publishing the full text of the interview with Facebook?

<comment><USER3> "We're not doing X for purpose Y!" (translation: "We're doing X not for purpose Y, we do X for other purposes. Luckily, nobody thought to ask us about those, and we certainly won't mention those purposes ourselves, heh, heh, heh.")

Technically, telling the truth, in a weasely way.

<comment><USER4> Freedom of the press as commonly understood in the US is a misnomer. Today we are most limited by access-based journalism. Journalist careers generally depend more on access than anything else. As such, their subjects have tremendous power if wielded smartly. PR departments are tasked with wielding this most efficiently.

By being vague in the pretense of that power-wielding landed this subject the benefit of the journalist doing the last mile dirty work of being specific. The hope is that this will buy her another interview, and another interview, and so on. They (the journalist) may have another plan in mind, but their power to execute it is limited by their professional mobility and utility to the subject.

<comment><USER5> >"Freedom of the press as commonly understood in the US is a misnomer.

No "freedom of the press" in the US is commonly understood to mean that the press is free to publish any opinions they wish without being subject government censorship. It is codified in the First Amendment with:

"Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press"

"Freedom of the press" has absolutely zero to do with freedom of access to subjects the press might be reporting on. And it certainly has nothing to do with PR flaks at powerful companies. These are not even a common misconceptions either. So no "Freedom of the press" is not a "misnomer" at all.

<comment><USER4> I think my elaboration would have been sufficient for you to realize there is no disagreement here.

My point is just that a free press, as _commonly understood_ and as in the constitution, is not free. Americans are quick to get upset when legal regulations are placed on press freedoms but slow to recognize the less obvious.

I'm not interested in discussing any further. You appear to just be looking for a disagreement. Good luck.

<comment><USER5> >"My point is just that a free press, as commonly understood and as in the constitution,"

And your point is patently untrue. Freedom of the Press is not "commonly understood" in that incorrect way in the US.

Honestly it sounded like you yourself didn't understand the meaning of the phrase "Freedom of the Press." You even called it a "misnomer." Accusing people of "looking for a disagreement" simply because they corrected you seems kind of lame and uncalled for.

<comment><USER6> the OP's post, and your post are not mutually exclusive. I think you both point out inherent flaws in the term "freedom of press" as it is currently understood in society. His point is that they are incentivied not burn bridges with large corps, and your point is they can say whatever the f __* they want with zero governmental oversight.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> > The social media giant has asked large U.S. banks to share detailed > financial information about their customers, including card transactions and > checking account balances, as part of an effort to offer new services to > users.

s/offer new services to users/increase revenue per user/

Once you've reached the levels of market saturation that Facebook has the only way to grow is value _per-user_ , specifically in 1st world countries where there's actual value to be had.

> One large U.S. bank pulled away from talks due to privacy concerns, some of > the people said.

Good for them. I wish I knew which one.

> Banks face pressure to build relationships with big online platforms, which > reach billions of users and drive a growing share of commerce. They also are > trying to reach more users digitally. Many struggle to gain traction in > mobile payments.

That's an industry problem, not an individual bank problem. Also, credit cards are already _very_ convenient and near universally accepted. It's hard to compete with that. Only the uninformed would use a different payment technologies with less convenience and weaker chargeback/fraud guarantees.

> Bank executives are worried about the breadth of information being sought, > even if it means not being available on certain platforms that their > customers use. It is unclear whether bank customers would need to opt-in to > the proposed Facebook services or what other privacy protections might be > offered.

It's unclear to me what segment of bank customers would knowingly agree to anything remotely close to this.

<comment><USER8> > Good for them. I wish I knew which one.

Don't ask me how I know, don't believe me, but its Wells Fargo.

> It's unclear to me what segment of bank customers would knowingly agree to > anything remotely close to this.

Customers would not agree much, correct. However since credit cards are not your money, you are limited in the ways to tell the bank how and what to share or not to share with other players on the market, since its bank's money you operated with, and bank's goal is to make as much money off of lending it to you as possible. (of course I don't like; jsut so you know before you downvote)

This is in fact even right in your face. Any new card (or renewal you got in mail) has a few pages attached to it, called something like "what do we do with your information and how can you stop us", where it clearly draws a matrix table with YES/NO of what information they share, with whom, and in which example you can change their default behavior (hint: not always)

<comment><USER9> >Don't ask me how I know, don't believe me, but its Wells Fargo.

I'd be surprised if it wasn't. Wells Fargo is still asking for forgiveness in their Jon Hamm narrated _Earning Back Your Trust_ [0] commercial. It would be incredibly stupid of them to engage in another scheme to take advantage of their customers _at this time_.

[0][https://www.youtube.com/watch?v=1rrivHxCeeY](https://www.youtube.com/watch?v=1rrivHxCeeY)

<comment><USER10> Funny enough I had no idea that Wells Fargo was mixed up in any scandal before I saw these ads. Even then I didn't know what scandal was about, and finally this comment prompted me to look it up. :)

<comment><USER11> US media has more important issues to cover than major banking scandals.

<comment><USER12> Huh? The Wells Fargo stuff was all over the news.

</comment></comment></comment></comment></comment></comment><comment><USER13> This article has many, many problems, and misrepresents what's actually being proposed. No data is shared in either way without clear consumer opt in. No bank is randomly giving data to Facebook. Facebook is not buying data from the banks.

The totally misconstrued experience the article appears to be about is primarily for messenger chatbot approaches that are already in use for paypal and a few banks (BMO, Wells Fargo to name two) across the world. The user has to volunteer to start the chatbot in FB messenger, then go through a myriad of permission screens (including an oAuth) to give permission to the chatbot to see some transactions and answer a few other basic account questions ("How much do I spend on groceries?" "When is my payment due?"). Privacy policies for existing chatbots describe all data usage. Users can easily revoke their permissions and remove the chatbot.

This is the same level of data you've given to various PFM apps like Clarity or Mint. And if you haven't, cool, you won't want to do this with Facebook either, no problem. It's with clear and conspicuous permissions. Facebook has publicly and clearly said that they won't use the data to target ads, and they would be sued by everyone if they turned out to have lied about something as important as credit card or bank data. Not to say they won't get caught a year from now abusing the data, nor can anyone say that banks won't abuse any data they get from FB... but if you believe this, don't use the chatbot and they won't see your bank data nor let the bank see your FB data.

Facebook has done and facilitated some dreadful things, but letting folks access their banking data with permission via chat is the US catching up to what WeChat already has: millions of people accessing their banking via chat.

<comment><USER14> The problem with Facebook chat access to banking is Facebook. I don't want Facebook to become just like WeChat where you pretty much have to have WeChat to engage in many forms of commerce in China. I want less Facebook pervasivness — not more of it. iMessage for Businesses is far better from a privacy standpoint as well as usability. Facebook apps on iPhone are notorious battery hogs not to mention have a history of very sketchy practices. Facebook lost my trust long ago. The only way I'd use Facebook again is if Tim Cook ran it. In the meantime, I can simply open the Chase app and see my balance in literally one-tap (assuming FaceID is turned on.) Much faster than typing a Messenger message. I don't want Facebook having access to my bank balances either.

<comment><USER15> That's fine, you don't have to use the feature.

The point is that the issue is being misrepresented, not how popular or not FB is.

If you don't trust them, don't use it.

Also Tim Cook is doing the same thing FB ever did, it's just that Apple has the advantage of making $$$ by selling hardware, not personal information. They are in the enviable position of not primarily selling ads.

<comment><USER16> that may be true now but I think its fair to say that the fear is it will lead to banking data being sucked into the FB ecosystem followed by any number of scary scenarios.

if your argument is 'oh you dont have to use it', that doesn't works either because they can offer you a slight service/rate discount depending upon the desperateness of you situation. remember FB already has access to a lot of your data through FB/whatsapp/insta & pretty pervasive tracking everywhere. they are rapidly achieving monopoly status in many communication forms so some panic is warranted when they go after your banking or healthcare data.

let me paint a picture not too implausible for you. you walk into a hospital, as it stands today there is no way you can find out the costs of services you are gonna consume without having to go through the complicated dance of billing/negotiation/copays etc. Now say there is a tie-up between FB/Banks/Insurance companies (and hospitals because why the heck not). they can track you, find exactly how much money you have & what your cash flow looks like. you have to be incredibly naive to think they will not use this information to create some kind of 'adaptive pricing' to squeeze every last penny out of you before they let you go. now let take this a step further, how about FB turning into a kind of payday lender for your unpaid hospital bills? All you need is one in-elastically priced service to monetize the shit out of that.

this is just one example that took me 2 minutes to think, it can get WAY worse!

the bigger issue that (IMO) bothers people deeply but they are often dont articulate is tech used to be about building bridges but now tech is basically trying to turn everything into a toll-booth.

<comment><USER15> "ou have to be incredibly naive to think they will not use this information to create some kind of 'adaptive pricing' to squeeze every last penny out of you before they let you go."

No, you have to be highly conspiratorial to wrap up hospitals, Facebook, the banking system all working together to concoct an illegal, real-time price discrimination scenario.

What you described is not plausible, moreover, if you don't want your finances integrated into your social feed ... then don't integrate. I'll imagine that most won't.

<comment><USER16> "No, you have to be highly conspiratorial to wrap up hospitals, Facebook, the banking system all working together to concoct an illegal, real-time price discrimination scenario."

If you go read the comments on the original WSJ story you'll notice a pattern, not a single comment echoing your sentiments, in fact, most of them fear almost exactly what I described. so basically the whole world has become conspiratorial.

Given the casualness of your response to something so serious, it makes me think you are a Fb shill or somebody who has invested a lot in FB stock. BTW since the announcement FB stock is up 5pc+, that makes me think market is pricing in such predatory scenarios.

<comment><USER15> Yes, populism is like that - people are conspiratorial and easy to rile up by the press who are always looking to spook us a little bit.

To the point wherein if someone doesn't buy into their conspiracy, they immediately call others 'naive' and then claim they must be 'paid secret plants' by said organization.

The scenario you described is not going to happen, and analysts are not remotely 'pricing it in'. They're not even thinking about that.

They are however thinking that if FB gets into 'current account banking' for folks ... then that could be a very popular thing.

You may be surprised to find that most product managers and analysts are surprisingly normal people.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> This is so nutty, that all our private matters are just being bartered about without our explicit permission. All because we don't have any good regulation in the US regarding data sharing.

This is not the same as Plaid and Mint, where we explicitly give those services access to our accounts in exchange for direct benefits to us.

<comment><USER18> I wonder what the average American citizen could do that would help to get such legislation passed. Any ideas?

<comment><USER19> We can start by voting against every incumbent on the ballot this fall. Congress continues to act against the public good, except for a few (mostly) Democrats, and they all deserve to be fired.

Take it a step farther and vote against anyone with a (D) or (R) next to their name on the ballot.

<comment><USER20> This will not work. You can not expect to achieve your ends by acting in random fashion. You're going to actually have to do the hard work of figuring out who's good on this issue and who's not.

<comment><USER21> Everyone needs to run for office and vote for themselves. Failing that, find out who is running that most faithfully represents your interests, and vote for them.

The current federal government is so far out of step with the populace that a blanket anti-incumbent rule doesn't seem all that bad. The only real question is whether to vote against them in the general election, or just the primaries.

There is a very real possibility that someone else on the ballot is actually _worse_ than the incumbent, which barely seems possible, yet here we are.

</comment></comment></comment></comment></comment><comment><USER22> _Facebook said it wouldn't use the bank data for ad-targeting purposes or share it with third parties._

Why on Earth would/should anyone believe this after Cambridge Analytica?

<comment><USER23> They will use the data for ads.

Then in a few years when we discover it, they'll say they're sorry and they're trying to do better.

Facebook is changing.

<comment><USER24> Probably not directly, but I can't imagine what purpose this would be except to sell ads. That's what Facebook's business is all about.

I wouldn't be surprised if they were trying to run some sort of regression of behavior against bank balance and debt load. So sure, they're not using your bank account for ads, just a proxy of your bank account for ads.

Finding proxies for income is decades old (zip code and magazine subscriptions being the classic example), but I'm not aware of anyone doing at this scale and with direct input from banks as opposed to volunteered information.

<comment><USER25> To launch a paid subscription version of Facebook with loyalty discounts?

 _Get in Facebook, get your LinkedIn subscription 50% off for coming 20 years!_ (this is made up)

Disclaimer: Not a Facebook employee.

</comment></comment></comment></comment><comment><USER26> Reminds me of that line from the show Narcos that translates to, "Silver, or lead."

What is a retail bank but some product ledgers and user identities? Banks understand that they are rapidly being reduced to artifacts of regulation. The ones I have spoken to have a primary mandate to "preserve the business model."

The identity information FB has is often more reliable and valuable than the documents governments provide. Perhaps to coin a phrase, what FB and other social platforms have is "collateralized identity," where your relationships and personal behavior data are the collateral on the assertion of identity. The documented one relatively is just a "registered identity."

Difference is the amount of friction, authentication, and recourse you have to each of them. A registered identity is mainly for legal recourse (tax, travel, and law enforcement.) What FB has might lack a bit of recourse, but it has anti-gravity frictionlessness, and a high degree of authentication.

The point at which an institution becomes indifferent to the level of recourse in the identity and switches to one with less friction, more data, and more authentication - looks pretty similar. In fact, the ones who demand registered identity are at a structural disadvantage to orgs who provide services using collatoralized identity.

There is very little to keep FB from becoming a global bank, and current banks will have the option to participate, or compete against the ones who do. It's strategic in so many ways. I don't think this is a normal business arrangement. It may more resemble offering terms on which FB will accept the banks' surrender.

<comment><USER27>
      Reminds me of that line from the show Narcos that translates
      to, "Silver, or lead."

In case someone misses this meaning, silver or lead refers to either accepting a bribe (silver, money) or taking a bullet (lead).

<comment><USER28> In French, the word for money is the same as the word for silver ( _argent_ ). Is it the same in Spanish by any chance?

<comment><USER29> Depends on the country. The regular word is "dinero". In Spain it's not common to use "plata" (silver) for money, but in Argentina it's what everyone uses. In Mexico they use "lana" (wool).

<comment><USER28> What about Colombia?

<comment><USER29> No idea...

¯\\_(ツ)_/¯

</comment></comment></comment></comment></comment></comment><comment><USER30> Perhaps Facebook should also scoop up my medical records, so drug companies can improve the way they advertise to me. I'm sure all those posts about my beer reviews will help my doctor diagnosis my chronic gout. Seems like a 2-sided deal.

/sarcasm

<comment><USER31> They already do.

My wife had a very early ruptured ectopic pregnancy (which she wasn't aware of), which nearly killed her. On the week that the baby would have been born, Enfamil launched an acquisition campaign targeted at expectant mothers that month, kicked off by a Fedex package containing bottled/powered formula (worth about $60) and including Facebook campaign targeting new mothers.

This was very upsetting to us, so I dug in, found out from the company where they obtained out information, and obtained the list. I spoke to a couple of physician and nurse friends who are pretty confident that it was a combination of the ER admission, an imaging claim, and a drug that was prescribed and filled in the hospital that made it highly likely to an observer that she was pregnant -- but didn't provide enough detail to determine that she left the hospital not pregnant.

It turns out that information regarding hospital admission, insurance claims and prescription fulfillment is available and slurped up by various parties, who are able to de-anonymize it. It contained alot of information, including accurate salary history, cars we owned, approximate credit score, where we bought baby stuff for our previous child, etc.

I make it a point to share this whenever appropriate, as it was a very painful violation of our privacy, and really threw me for a loop, as I couldn't fathom that our medical providers were selling our data to help pitch diapers and formula. Facebook and many other companies either has access to this information by buying lists, or can extrapolate by looking at advertiser patterns.

<comment><USER32> While there are multiple steps and items that can be combined together in your example, it does reinforce why I make sure to use cash for some transactions. I really don't want my ad targeting profile to change to "likely has children" when I buy things for my nieces and nephews.

A few years back there was the case where Target was using mailed ads specific to the profile they'd built for the recipient, and a man went in angry about the pregnancy stuff being advertised to his daughter. He went into the store outraged. Turns out, she actually was pregnant and hadn't yet told her father.

Ever since then, I've been more conscious of my purchasing patterns. I'm sure there are still technological advancements to track cash transactions, but it at least makes it more difficult.

[https://www.forbes.com/sites/kashmirhill/2012/02/16/how- targ...](https://www.forbes.com/sites/kashmirhill/2012/02/16/how-target- figured-out-a-teen-girl-was-pregnant-before-her-father-did/#3aa98fe26668)

<comment><USER33> If your photo has been associated with an other than cash transaction, pretty much game over. You will have to up your game and put on zebra makeup when out making cash purchases

<comment><USER32> I'll consider dressing in drag, bringing along masks, or buying a large number of Halloween costumes. Surely if enough people went to the store with a Donald Trump parody mask on they couldn't trace us all!

...though the anonymous mask would work just as well.

<comment><USER33> Not sure if you are shooting the messenger or riffing but start here [1]

[1] [https://www.facefirst.com/](https://www.facefirst.com/)

</comment></comment></comment></comment></comment></comment><comment><USER34> Any bank that gave my information to Facebook without my explicit, opt-in consent would immediately lose me as a customer.

(Heck, I might switch just for asking.)

Luckily I bank with a credit union (not for profit) which does not constantly try to monetize me.

</comment><comment><USER35> This spring, Facebook committed to ending their third party merchant data integration with advertisers.[0]

Now they are directly partnering with the banks to gather this data and more, with the stated purpose of offering products based on this data.

Why is it OK for Facebook to use this data to sell things directly, but not when they partner with external advertisers? Why should the public trust Facebook with this highly sensitive data?

[0] [https://www.washingtonpost.com/news/the- switch/wp/2018/03/29...](https://www.washingtonpost.com/news/the- switch/wp/2018/03/29/facebook-longtime-friend-of-data-brokers-becomes-their- stiffest-competition/?utm_term=.885d732488d3)

<comment><USER36> > Why is it OK for Facebook to use this data to sell things directly, but not > when they partner with external advertisers? Why should the public trust > Facebook with this highly sensitive data?

It's, in theory, vaguely better. When partnering, they have a contract with the external party, and not you. So there's nothing stopping their partners selling it to whomever.

That being said, Facebook is already on 'thin ice' with me. But it doesn't seem to deter them too much, other than feel good ads about how Facebook loves us all.

</comment></comment><comment><USER37> Good way to trigger a bank data run, where customers remove their money & data en-masse from the bank that leaks their info to Facebook.

<comment><USER38> I'm going to say something terrifying, and it should cause you terror indeed: Most people don't shop banks.

Ask random coworkers why they use the bank they do - "Well, that's what my parents used" or "that's what was convenient" is the usual reply.

Anytime I ask people if they pay fees for regular banking, they look at me like I'm a crazy person - "of course I pay fees all the time, but I don't pay very much..." Most banks are terrible and treat you terribly unless you keep enough money with them to get the special treatment.

<comment><USER39> I think even more terrifying is that most people might need to "shop" banks. I say that because in reality for your standard checking bank fees are non- existent if you have over $1000 in the account even at the worst of banks (some much less).

For savings accounts the value of shopping becomes more apparent. But if you are getting hit by bank fees then savings account APY is really not a primary concern.

<comment><USER40> Yeah the difference you see between the banks that actually give good rates and not is amazing.

Ally is offering 1.80% on savings right now. Wells fargo is offering at most 0.15%.

Wells Fargo has obviously done the math and realized that their customers simply do not care to switch accounts even though the interest they offer is abyssmal. Pretty weird stuff. As rates rise slowly it will be interesting to see whether the frogs finally get hot enough to jump out of the pan and abandon wells fargo, forcing them to raise rates.

[https://www.wellsfargo.com/savings-cds/consumer-account- rate...](https://www.wellsfargo.com/savings-cds/consumer-account-rates/) [https://www.ally.com/bank/view-rates/](https://www.ally.com/bank/view-rates/)

<comment><USER39> Or there are people like me who hold their business & personal accounts at wells fargo, but have savings accounts at banks such as ally & citizen's access. You don't have to go all in on a single bank.

</comment></comment></comment></comment></comment><comment><USER41> If you believe that a company whose whole purpose is to use data on you to sell ads won't use data on you that it collects to sell ads then I have a bridge to sell you.

Funny that people complained so much about GDPR being bad for business and then get upset when things like this happen. It's almost like the two are related or something...

<comment><USER12> > If you believe that a company whose whole purpose is to use data on you to > sell ads won't use data on you that it collects to sell ads then I have a > bridge to sell you.

On _this_ particular case I would probably agree with you, but I'm not sure it's true in general. From what I understand, for example, Facebook doesn't use your messages for ads. It seems unlikely but not 100% implausible that it could be the same here.

<comment><USER42> Depends on what you mean by "ads". I stopped using FB since April but still use WhatsApp because my contacts use it. In the last 2 weeks, I've been getting email spam notifications to check what these WhatsApp contacts are doing on FB. i.e. FB has been sending me notifications about people who are both on FB and on WhatsApp, and only those with whom I message on WhatsApp on a regular basis. The likelihood of this being entirely coincidental is probably close to 0.

<comment><USER43> They may not use the content of the message but all its metadata which may even be more valuable, alone because it's easier to process automatically.

</comment></comment></comment></comment><comment><USER44> If Facebook could give the banks sufficient reason to actually develop an api for exporting data in a granular way, that would be a good thing.

I don't like entering my bank password in mint just for it to scrape the account balance. There should be a separate read-only service with a token that can send that information to services I want to have it. Coinbase seems to manage to do this pretty well.

<comment><USER45> WF can go build a bridge and then jump off it, but they do at least have a thing where you can create an additional read only log in.

</comment></comment><comment><USER46> How is it legal for the banks to share this? I'm confused.

<comment><USER47> The likely argument would be that within the TOS or elsewhere there is (broad) language granting them the ability to do so. Of course, because users dutifully accept/sign the documentation placed in front of them, such practices are legal, at least until users 1) strike such language from the contracts before consummating the relationship(s); or 2) successfully challenge such practices in court. However, users have most likely also agreed to settle their disputes in arbitration, thus waiving their right(s) to sue (in court). So, really the should be reverting to option 1 if they are going to "use" such services.

<comment><USER48> Please tell me how to strike such language from any electronically-presented contract whatsoever.

</comment></comment></comment><comment><USER49> Paywall bypass: [http://archive.is/uTZHO](http://archive.is/uTZHO)

</comment><comment><USER50> Facebook has to stay on top of competitors like WhatsApp and Instagram, which they ended up buying, and now they're worried about competing with services like Venmo. They have to or they'll lose marketshare. Although the market mechanism usually creates the right incentives for companies to act in their customers' interest this could be a new type of market failure. Imposing a cost on customers that wasn't agreed upon by reducing the cost of surveillance for hackers and governments. The "cost" is lower because the information is already collected and just needs to be obtained.

So how can we fix that? Putting the data in the hands of government, where it's probably more likely to be stolen? I assume that facebook has better cyber security than any government agency and a better incentive to keep their customers' data secure. Or maybe breaking facebook up into multiple companies in an anti-trust litigation that will take a decade to settle?

I might end up sounding like a blockchain proponent here. To be honest I think that most blockchain applications are scams or an overly complicated solution where an old fashioned data base would be totally sufficient. I actually think that blockchain technology has a very big draw back, because ownership is an important part of markets and creating the right incentives for companies. I'm very convinced that the majority of people who are working on some blockchain project don't have a clue about what they're talking about. I can't claim to really understand blockchain in every detail either. My credentials are that I studied undergrad economics at Columbia and helped found a bitcoin exchange software company in 2013 and worked there until last year.

So from an economics point of view, my guess is that blockchain, despite the drawback of eliminating ownership, could be a solution to this specific type of market failure. Here's a video that explores the trade off between ownership and censorship resistance in a bit more detail: [https://youtu.be/pHOYORGZrps](https://youtu.be/pHOYORGZrps)

</comment><comment><USER51> Perhaps relevant [0] another looney EU initiative /s

"Net neutrality" for the banking sector. [0] [https://en.m.wikipedia.org/wiki/Payment_Services_Directive](https://en.m.wikipedia.org/wiki/Payment_Services_Directive)

</comment><comment><USER52> IMO a clarion call to do one of two things: Either stop using Facebook. Or start pushing politically.

We either need people to have either greater control over the data companies have retain and use (Europe's approach). Restrictions on what that data can be used for and the ways in which companies and people may treat you differently due to that data.

</comment><comment><USER53> Once banks share the info with FB, expect more prosecutions by "parallel construction" using FinCEN databases, etc.

<comment><USER54> Metadata about who talks to who when, along with when cash is withdrawn, can likely pinpoint drug dealers. It likely isn't even that hard - a dumb algorithm of something like "rank people by how often their friends withdraw more than $100 of cash within a day of talking to them, divided by how often their friends withdraw more than $100 of cash" would hit a good number of them.

<comment><USER53> Right now, they are catching medium level drug dealers, prostitution rings, massage parlors, etc using SAR reports filed by banks. Basically, when someone deposits $4000 cash every month for a couple of years; expect him to get busted.

Once the guy gets busted, he must be thinking about how he got caught. It is banks' active spying: under regulation, banks have become active spies. It is a new way of spying: force private entities to comply for suspicious activity, with a huge discretion given to regulatory bodies on the scope of what the word 'suspicious' entails.

</comment></comment></comment><comment><USER5> >""We don't use purchase data from banks or credit card companies for ads," said spokeswoman Elisabeth Diana."

This sounds to be like typical FB weasel-wording. "We don't" as in "we don't currently"? Which is not the same as "We won't." But even if this statement lacked ambiguity does anybody believe anything FB says at this point?

We already know that FB purchases "offline" third-party data from data brokers[1], so why else would an advertising company buy even more data from if not to make more money from advertising?

[1] [https://www.propublica.org/article/facebook-doesnt-tell- user...](https://www.propublica.org/article/facebook-doesnt-tell-users- everything-it-really-knows-about-them)

</comment><comment><USER55> Now politicians will be able tug at the precise, dollar amount your heart needs to get you to vote for them.

</comment><comment><USER56> Facebook has also tried to get its hands on hospital data [1]. Add this to that and these are clearly the actions of a bad actor.

Its difficult to believe there are groups of people working on these kind of programs who do not see anything wrong.

At this point shaming will not work, people know what they are doing and can't claim ignorance. Perhaps there must be a wider acknowledgement of the ethical vacuum in technology, and we do not deserve the public's trust and are actively building the very dystopia some of us postured so heavily about.

[1] [https://www.cnbc.com/2018/04/05/facebook- building-8-explored...](https://www.cnbc.com/2018/04/05/facebook- building-8-explored-data-sharing-agreement-with-hospitals.html)

</comment><comment><USER57> "Facebook said it wouldn't use the bank data for ad-targeting purposes or share it with third parties."

Feel like this only pertains to time of publishing. They will just wait a month or two until everyone forgets and do it anyway.

</comment><comment> oh-kumudo Who gives FB the right to even ask for such information in the first place? So they don't see any legal challenges could arise from such request? Seems ridiculous to me.

<comment><USER58> And its not like FB arn't in trouble all around the world. Mark doesn't need some idiot manager in the company pinning please kick me sign on his back.

I where him id start firing one or two board members

</comment></comment><comment><USER59> Another paywall bypass as I'm having issues with the archive.is service...

[https://outline.com/waMHEq](https://outline.com/waMHEq)

</comment><comment><USER60> I think Facebook has basically reached the "do whatever we can imagine and occasionally apologize if it goes too far" phase.

When software can implement ideas in a short period of time, we need laws that can work even faster. Speed up the process somehow, and "default answer: No", or something...

</comment><comment><USER61> Could they be trying to build a payment service, something similar to PayPal or ApplePay or TenPay?

</comment><comment><USER62> cant the loophole here be simply that you have agreed to a TOS with FB, where they said they wont be sharing data, but you may have agreed to the TOS of the bank who says they share with third parties to determine credit worthiness etc.

so then FB pay the bank for your financial data anf FB then mines said data they purchsed from entity you authorised to do so... then FB "anonymizes" data which it in turn sells as a product whereby the completeness and/relevance value of the productized FB data is higher as it is informed by the data that they purchased.

pluas it is trivial for facebook to correlate you with your bank and etc...

so, yeah, looks like fb can evily get around stupid TOS checks.

</comment><comment><USER63> And here is when everyone's insurance premiums go up. It will work kind of like shadow banning on Twitter. The rates will go up based on your past purchases. Especially now that most credit cards provide level 3 transaction details.

</comment><comment><USER64> I wonder if the banks are going to provide enough meta-data about their customers that FB will be able to know which bank you bank at, what type of accounts you have, etc. no matter what, ahem, privacy settings you have enabled in FB?

<comment><USER54> It's going to wind up as a targeting option. You can sell a million impressions by people with a household income over $100k for far more than the untargeted impression.

How it currently works is that _Chase_ etc knows how much money you make and other banking information, so they can upload your contact info and run targeted campaigns with a combination of Chase's information on your banking & credit card info and Facebook's targeting. The change would allow Facebook to categorize you based off your Chase financial info and let _other companies_ start paying a premium to advertise to you as well.

In practice, it means that when you get approved for an auto loan and start shopping around, you'll magically start getting advertisements for cars and dealerships, since there's now something like an "approved for an Auto loan in the last 30 days" category that these businesses can target with their advertising. Or when you open a business checking account you'll start getting advertisements for point-of-sale systems.

</comment></comment><comment><USER65> This is so creepy, but expected.

Banks will say they are only handing over antonimized data... and Facebook will find away to pair spending with location and de-anonymize the data —- a move the banks anticipated and agreed to all along.

So shady.

</comment><comment><USER66> [https://www.amazon.com/Super-Sad-True-Love- Story/dp/08129778...](https://www.amazon.com/Super-Sad-True-Love- Story/dp/0812977866)

</comment><comment><USER67> Goodness, why can't Facebook just be a site used to connect people together? Nothing more, nothing less.

How is sharing financial information helping me to connect with my high school buddies?

</comment><comment><USER68> If you value your privacy, use cash.

<comment><USER69> or bitcoin?

<comment><USER45> Anymore bitcoin is getting harder and harder to obtain without some kind of paper trail to your real identity. The only bitcoin I'd consider to be private and untraceable right now would be bitcoin that was mined directly to a wallet. Cant follow the thread past its end.

</comment></comment></comment><comment><USER70> The usual Facebook move! Why are people surprised here?

</comment><comment><USER61> Are they trying to build something like Apple Pay?

</comment><comment><USER71> Now all my friends know my meager salary thanks to the latest breach at Chasebook.

</comment><comment><USER18> How can we determine which banks are participating?</comment>


CLisp needs maintainers - <AUTHOR> http://article.gmane.org/gmane.lisp.clisp.general/14256 <comment><USER2> You will see that a few people ask: why care in the face of such impressive native code compilers: Steel Bank, Clozure, and Embedded (although maybe ECL is short for something else; ironically they also needed a new maintainer as the previous guy became busy): porting and bootstrapping.

[https://www.common-lisp.net/~bmastenbrook/new- sbcl/porting.h...](https://www.common-lisp.net/~bmastenbrook/new- sbcl/porting.html)

With CLISP that worked on ARM, I am not sure how much slower it would have been to port SBCL to ARM architectures, which is less <1 year of usable, even though CCL had it for years (and why I started compiling CCL using the AUR mechanism on Arch Linux prior to using SBCL in the official repos, for later playing with RPi stuff).

So, thanks for the awesome Lisp, and thanks to you guys specifically because it is niche and thankless with so many jokes about the Lisp/CL community. Even on HN, you can hear the mumbling when people post Lisp articles.

(hail (clisp))

<comment><USER3> Thanks, I was looking for an excuse to try to help CLisp. This might be it.

<comment><USER2> Cool. And that is coming from me, someone who knows like %1 of anything CL/Lisp related.

Unrelated side bar for initiated: is the actual capitalization of this thing (beyond the terminal of course) CLisp or CLISP?

[http://clisp.org/](http://clisp.org/)

So I noticed that the original title of this link (at least when I started reading) was CLisp, and it had not even occurred to me it was C( language) Lisp maybe, but still I though the caps must br wrong. On their site it is full CAPS, even though that peeves a lot of Lispers who will tell you that is like original Lisp Lisps (or LISP Lisp family languages, to be funny).

So can someone chime in and tell us?

</comment></comment></comment><comment><USER3> Well, I just started reading Land of Lisp a few weeks ago. It recommends CLisp. I'm quite new to all of lisp, so, let's take a look:

        $ hg clone http://hg.code.sf.net/p/clisp/clisp

Wow, that took a long time to clone. How big is the thing?

        $ du -hs clisp
        147M        clisp

        $ cd clisp
        $ hg branches
        default                    15611:5c63938ef493

Hm, a moderate-sized repo, only 15611 commits and no branching to speak of. Let's look at the latest commits,

        $ hg heads
        changeset:   15611:5c63938ef493
        tag:         tip
        user:        Sam Steingold <firstname.lastname@example.com>
        date:        Wed Oct 22 12:04:12 2014 -0400
        summary:     Fix bug#668 posix:file-state always return NIL for :rdev

What! Last commit was from October last year? Clearly development has slowed to a standstill. Who is generally in charge around here nowadays?

        $ hg churn -r "date('2010 to today')"

        sds                        313529 **************************************
        email@example.com             194383 ********************
        vtz                          2723 *
        ampy                          801
        haible                        758
        email@example.com    627
        email@example.com            279
        firstname.lastname@example.com               239
        cvs2hg                         46

So for the past 5 years, it's been almost all the work of sds, Sam Steingold. Huh. I was expecting Bruno Haible to still be involved, but he seems to be doing almost nothing nowadays. Well, it's not unusual for a free project to be the labour of only a single person, but it's typical to have a lot of small drive-by contributions. Almost nobody except sds has done anything for CLISP for the last five years, which could explain why there have been no releases. But there's been a lot of work being done! Look at all those lines of code that have been modified! Maybe all they really need is a release manager.

Well, does the thing build right now?

        $ ./configure
        ...
        ./configure: libsigsegv was not detected, thus some features, such as
          generational garbage collection and
          stack overflow detection in interpreted Lisp code
        cannot be provided.
        Please install libsigsegv like this:
        ...

Okay, fine, I'll install it. Let me try again,

         $ ./configure
        ...
        ./configure: libsigsegv was not detected, thus some features, such as
          generational garbage collection and
          stack overflow detection in interpreted Lisp code
        cannot be provided.
        Please install libsigsegv like this:
        ...

What? Didn't I just do that?

        $ apt-cache policy libsigsegv-dev
        libsigsegv-dev:
          Installed: 2.9-4
          Candidate: 2.9-4
          Version table:
             2.10-4+b1 0
                 -1 http://ftp.ca.debian.org/debian/ unstable/main amd64 Packages
         *** 2.9-4 0
                500 http://ftp.ca.debian.org/debian/ wheezy/main amd64 Packages
                100 /var/lib/dpkg/status

Okay, maybe my version of libsigsegv is too old. But a version newer than Debian's oldstable is mighty demanding of a package whose development has slowed down to nothing. So at this point I'm considering if I want to debug their build system or not. I might. Or perhaps someone else will. My conclusion is that CLisp development is almost dead, yet there certainly is something worthwhile releasing here since the last release in 2010.

<comment><USER4> And that is why people shouldn't use configure [1].

[1] [https://www.varnish- cache.org/docs/2.1/phk/autocrap.html](https://www.varnish- cache.org/docs/2.1/phk/autocrap.html)

<comment><USER5> >Some day when I have the time, I will rip out all the autocrap stuff and replace it with a 5 line shellscript that calls uname -s.

And packagers will everywhere will hate you for it.

I've recently written many GNU Guix package recipes, and packages using Autotools are the ones I tend to have the least headaches with. CMake and Waf are so-so I think, perhaps lacking in maturity, but I didn't have that much experience with them. Custom/hand-written Makefiles and ./configure scripts are the worst.

Just learn Autotools, get over the fact that they contain backwards- compatibility crud (that you can just ignore, or how does it hurt you?), and stop the FUD. Even if only targeting GNU and BSD systems, there is already enough diversity and library detection boilerplate to make it worth using a proper build system, and Autotools is the most mature one out of the bunch.

It's even more important for unconventional systems like Nix/Guix where software is to be built in very special ways, where hard-coded assumptions in build systems hurt, especially if a custom one; if it's a known one then even if hard-coded it will probably conform to some typical pattern of use of that build system so one can use tooling to automatically fix packages using that build system, and in the case of Autotools that isn't necessary in first place because everything is parameterized and flexible to hell and back.

Also please do use pkg-config. Like Autotools, it's not perfect either, but I could write another two paragraphs on how helpful it is in bringing consistency, toolability, etc. into build/packaging systems...

<comment><USER6> My entire build can run in less time than a ./configure script.

It doesn't require developers to run ./autogen.sh, or to have autotools installed (in their correct versions).

It doesn't contain obscene amounts of indirection, where the actual libraries live in a hidden directory called .libs (looking at you, libtool).

It doesn't make you write m4, or Makefile.am files with all these magic incantations. It doesn't make you delve into the guts of these crufty systems when things don't work the way you expect.

If you want build systems to satisfy your use cases, publish some doc of best practices and capabilities that all build system interfaces should provide. If I'm convinced I'll be happy to conform to the _interface_ you need. But there is no way you're going to convince me that everyone needs to just keep using autotools (a specific _implementation_ ) forever. I hate them.

I mean, by that logic, why are you doing something new like GNU Guix when everybody already knows/uses APT, RPM, BSD ports, etc? "Just learn [them], get over the fact that they contain backwards-compatibility crud (that you can just ignore, or how does it hurt you?), and stop the FUD."

Or maybe it is worth breaking with the past sometimes, when you think you can do better.

<comment><USER5> Late reply but:

All of the things you list are annoyances with crud that exists to satisfy this or that use-case which I suppose you personally don't need, which doesn't mean they don't have purposes. I would also say they are all minor annoyances. Your builds run faster than a ./configure script? Not building particularly large projects I suppose. Installing autotools? Big deal! I don't know when one needs to write m4, but the Makefile.am format looks rather clean and minimal to me; I don't see how you could have something much cleaner without losing a lot of generality. And having to delve into the guts of some obscure system is _exactly_ what I had to do a few times because some piece of software refuses to keep with the convention and just use Autotools.

The documentation you ask for is idealistic and unrealistic. GNU Autotools are free software, and with decades-old proven maturity; I see no reason not to use them. The only pseudo-reasons I see are NIH, FUD, etc.; the usual.

GNU Guix (and before that, Nix) is fundamentally different from all other package managers, so that analogy makes no sense here unless you have some radically different innovative build system.

</comment></comment></comment></comment></comment><comment><USER7> I'm a bit confused. What is the relationship between CLisp and ANSI Common Lisp?

<comment><USER3> CLisp is a GNU implementation of common lisp. Other popular free implementations include SBCL and CMUCL, both of which have made recent releases. GCL is the other GNU common lisp, which also made a release more recently than CLisp.

<comment><USER8> This is true in the same sense that the GIMP is the "GNU Image Manipulation Program". It's just a label, and a license choice, without much real meaning behind it. GCL is also called "GNU Common Lisp".

CMUCL is not popular any more.

SBCL is popular, and so is Clozure CL.

<comment><USER3> Hm, indeed, I was expecting to see CLisp follow the GNU coding standards, but it doesn't seem to. I know GIMP does, though, and it consistently uses GNU terminology (free software, not open source, etc). Being GNU does mean something for most GNU packages. In Octave we also follow most of the GNU coding standards, for example, and we benefit from FSF and GNU infrastructure.

<comment><USER9> CLISP, historically (which takes us back to 1987), did not start out as GPL-ed software, and certainly wasn't part of the GNU Project.

First it became GPLed, over a heated dispute with Stallman w.r.t. its use of the GNU Readline library.

Evidently, it is now part of the GNU Project. (So there is justification in referring to it as "GNU CLISP".)

Programs aren't going to switch their coding style just because they join the GNU Project.

<comment><USER10> Yes, that was the thread where RMS argued straight-faced that having optional readline support made CLISP a derivative work of readline.

</comment></comment></comment></comment></comment></comment><comment><USER9> I sent a bug report to the clisp-list mailing list just days ago, but it didn't come through.

      Date: Mon, 04 May 2015 07:20:34 -0700
      To: Clisp list <email@example.com>
      Subject: Invalid backquote reduction: ,',@x

      Hi all,

      I've discovered that (admittedly, an old version) of CLISP is
      reducing a certain backquote syntax according to a hare-brained
      user expectation instead of diagnosing en error.

      Pardon me if this has been fixed more recently.

      In a double backquote, if you quote a splice, and then unquote
      the quote, the unquote and quote cancel out naively.
      (Is that, by chance, my doing???)

      CLISP:

         [1]> (let ((a '(1 2 3))) ``(a b c ,',@a))
         '(A B C 1 2 3)

      Of course the above quote form then eval-s to (A B C 1 2 3).

      Clozure CL:

         ? (let ((a '(1 2 3))) ``(a b c ,',@a))
         (LIST* 'A (LIST* 'B (LIST* 'C (LIST (QUOTE 1 2 3)))))
         ? (eval *)
         > Error: Too many arguments in form (QUOTE 1 2 3) .

      The Clozure output (IMO correct) illustrates precisely what
      wrong, so I almost don't have to say anything more.

      The construct ',@a is (QUOTE ,@A) which stuffs zero or more
      things into the QUOTE syntax where there should be exactly
      one, potentially resulting in an incorrect quote syntax.

      So given (UNQUOTE (QUOTE (SPLICE A))), then only if A
      generates exactly one item, are we justified in
      "canceling" the QUOTE and UNQUOTE! In other cases,
      it is invalid and should be diagnosed as an abuse of
      QUOTE.

      * * *

      Is there a possibility that this could be documented
      as an extension? I think it's too much of a special case
      in its present form, because it only works when the
      QUOTE form is an immediate argument of the UNQUOTE,
      as seen from this CLISP output:

         [2]> (let ((a '(1 2 3))) ``(a b c ,(list ',@a)))
         (LIST 'A 'B 'C (LIST (QUOTE 1 2 3)))

      We might imagine that a possibly meaningful
      extension (which swiftly reveals itself to be otherwise)
      along these lines:

         "If a splice is the child, direct or indirect,
          of an unquote, then the unquote *and all
          intervening syntax* distributes over the splice,
          as if by replication over the elements. That
          is to say ,(syntax ,@form) is treated as if
          it were ,(syntax ,(first form)) ,(syntax ,(second form))
          and so on, where form is evaluated only once,
          and the number of unquotes depends on the size of
          the output of form.

      According to the above rule, we would then expect:

         [2]> (let ((a '(1 2 3))) ``(a b c ,(list ',@a)))
         ;; FANTASY:
         (LIST 'A 'B 'C (LIST (QUOTE 1)) (LIST (QUOTE 2)) (LIST (QUOTE 3)))

      The problem is that this interferes with existing semantics;
      the structure ,(syntax ,@form) already has firm meaning,
      which is that form is evaluated to create arguments which
      are substituted into SYNTAX, and then this is unquoted, leading
      to the evaluation a single instance of SYNTAX as an operator.

      When SYNTAX is QUOTE, no special exception can be made;
      ,(quote ,@form) must also mean "zero or more arguments
      into quote which is then evaled in the next round, possibly
      leading to a quoting error".</comment>


Gmail Account Hijacking Vulnerability - <AUTHOR> http://blog.securityfuse.com/2016/11/gmail-account-hijacking-vulnerability.html <comment><USER2> There is no account hijacking vulnerability here. The researcher was able to send email as a non-existed Gmail account, they could have just as easily registered that Gmail account. The only place this becomes a vulnerability is if the account doesn't exists and you aren't allowed to register it (like email@example.com), or if there is a temporary bounce from a legitimate account.

Either way, it isn't a hijack, you can just send email from the "hijacked" account through Google's servers, you can't receive email sent to the account.

<comment><USER3> As mentioned in the article, you can hijack accounts if the recipient has blocked you.

<comment><USER2> It still isn't a hijack, it only allows you to send email as that user _through Google 's servers_. It is always possible to send email as anyone you want, just change the From address in your mail client [1]. Google attempts to prevent unauthenticated From addresses going through their servers. So it is a vulnerability because it bypasses intended restrictions (in some edge cases), it just isn't a hijack as the post's title says.

[1] Yes, you have SPF and DMARC to contend with.

<comment><USER4> We have different definitions of "hijack" then. I think "hijack" is broad enough to include sending mail _as_ someone, rather than just _spoofing_ them.

<comment><USER5>
      $ telnet localhost 25
      Trying 127.0.0.1...
      Connected to localhost.
      Escape character is '^]'.
      220 localhost.localdomain ESMTP
      EHLO jlgaddis
      250-localhost.localdomain
      250-PIPELINING
      250-SIZE 26214400
      250-ETRN
      250-STARTTLS
      250-ENHANCEDSTATUSCODES
      250-8BITMIME
      250 DSN
      MAIL FROM:<firstname.lastname@example.com>
      250 2.1.0 Ok
      RCPT TO:<firstname.lastname@example.com>
      250 2.1.5 Ok
      DATA
      354 End data with <CR><LF>.<CR><LF>
      From: President Barack Obama <firstname.lastname@example.com>
      To: willvarfar <firstname.lastname@example.com>
      Subject: LOLOL

      This is an account hijack!

      -BO
      .
      250 2.0.0 Ok: queued as 6AE031F5FE
      QUIT
      221 2.0.0 Bye
      Connection closed by foreign host.
      $

<comment><USER6> The difference between your example and the article's is that in the article's example the emails are signed with DKIM and SPF by google which marks them as legit emails vs your example which is not signed.

<comment><USER7> DKIM and SPF are intended only to authenticate the originating saver, not the actual user account from the originating saver. To my knowledge, there is no reliable mechanism (beyond PGP and the web of trust) for authenticating that a certain sender actually sent an email message.

<comment><USER8> > _To my knowledge, there is no reliable mechanism (beyond PGP and the web of > trust) for authenticating that a certain sender actually sent an email > message._

You can use S/MIME as well, which has its own tradeoffs like all PKI but also somewhat more widespread and mildly more seamless support. But your basic, unless the e-mail is cryptographically signed in some manner there's no significant authentication for email. If cryptographic signing was more widespread then issues with spam, phishing/spearphishing, etc could be significantly reduced simply by virtue of elimination of spoofing. That day does not seem likely to come any time in the foreseeable future however, given that if anything end-to-end cryptography in email (be it for signing or encryption) seems to be going backwards, not forwards. It'll remain an irritating situation for a long time to come.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> How is this a vulnerability?

1) Email addresses added to the 'send from' list in Gmail are used to send emails with an alternative From: address, but they always contain a correct envelope-from header, so the emails will typically show up as 'Google (sent by: email@example.com)', or something along those lines.

2) gmail.com doesn't have a forced-fail SPF record, so one could just send emails From: email@example.com using /any/ mail server, as long as the receiving mail server doesn't interpret softfail as fail -- and it shouldn't.

</comment><comment><USER10> Flagged, the title should be "How to take a gmail username, the hard way"

</comment><comment> hacked-gmail I'm looking for help. I suspect my google account has been attacked thru some un-published vulnerability.

An unknown computer is still showing up as gaining access to my google account AFTER I have done all the typical sanitation events to my google account: changed password, disconnected all apps and services, and using 2-Step authentication (even only using the Authentication, not SMS).

When my account was compromised ~10 days ago, the first event in the attack was some service/app being connected to my gmail account. I regretfully did not screen shot the event (google only shows the last 10 login-events on the account).

I suspect some devious 3rd party app was installed/connected to my google account and is still by by-passing all of the 2-step authentication, and "disconnect all account" actions I have taken.

UPDATE: Here is URL/info where unknown computer is showing up: [https://security.google.com/settings/u/0/security/activity](https://security.google.com/settings/u/0/security/activity)

Any ideas? How the hell does one contact google on this?

</comment><comment><USER4> It is sad that the researcher didn't get paid anything, and that many other 'minor' reporters don't get paid anything either.

Presumably the researcher expended a lot of effort probing gmail and was that time not worth a paltry reward?

vulnerabilities should be better rewarded.

<comment><USER5> I am 100% in support of bug bounty programs and the like but I can completely understand why they didn't pay for this one.

<comment><USER11> Can you elaborate?

<comment><USER12> Reading a bounce email is not exactly award-worthy pentesting.

<comment><USER4> The bounce contained the activation link and code that is used to actually confirm the mail redirection...

<comment><USER12> OK, and none of that is significantly complicated to discover, nor is the vulnerability particularly severe. I don't see any reason for why he should receive compensation for this, especially considering bug bounties are already at the company's discretion.

<comment><USER13> He basically did their QA work for them, not to mention a part of the work the developer should have put into thinking about security. It does seem like a minor vulnerability, but it could still be used to harass someone significantly. He definitely generated something of value, and he should be compensated. (Speaking as a veteran dev who knows that good QA can sometimes be the secret sauce that makes a coding shop into an awesome coding shop.)

<comment><USER12> Doing work for somebody does not automatically grant you the right to compensation. He did this on his own accord, without petition from Google. Google has no obligation to pay him at all.

The reason bug bounties exist is to reward hackers for reporting severe and/or difficult-to-find security issues, so that they don't publish it before it's fixed and so the company gets good PR.

In this case, the bug was clearly not that severe, and thus Google presumably decided it was not worth it for them to issue a reward. There is no right to compensation here, nor should somebody think they will definitely be paid if they do a company's work for them.

<comment><USER13> _He did this on his own accord, without petition from Google. Google has no obligation to pay him at all._

Well of course, but my reading of it is still that it's a damn shame he's getting nothing. Just because someone has no right to something doesn't necessarily mean they shouldn't get something.

<comment><USER12> That may be true, but I'd argue there's also a difference between whether somebody should get something, and whether it's a shame that they didn't. In this case, maybe he should have gotten something, but the fact that he didn't is not surprising and should be expected when doing free work.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Microsoft Windows 10 on 75M Devices in First Month - T-A http://www.bloomberg.com/news/articles/2015-08-26/microsoft-windows-10-reaches-75-million-devices-in-first-month

<comment><AUTHOR> Making some pretty big assumptions in that people who upgraded are assumed to have liked it.

Wonder if this counts the 8 virtual machines I had installed it on and then deleted.</comment>