'War Dialing' tool exposes Zoom's password problems - <AUTHOR> https://krebsonsecurity.com/2020/04/war-dialing-tool-exposes-zooms-password-problems/ <comment><USER2> One positive thing about all these horrendous security flaws that have been recently discovered in Zoom, due to its popularity, is that the company seems to be taking them seriously, recently instituting a feature freeze to focus on fixing them: [https://blog.zoom.us/wordpress/2020/04/01/a-message-to- our-u...](https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-users/)

As a consequence, I suspect Zoom's security is more likely than not to improve going forward... although it will surely take a long while. Security is _Capital-H Hard_.

Also, I cannot think of any other multi-video-conferencing solution that "just works" and has been as thoroughly stress-tested and attacked by bad actors in the wild at such a large scale. If Zoom does a decent-to-good job fixing all the security issues, it looks likely to continue to dominate its market.

<comment><USER3> Why do people keep saying it just works? It just works if you install their app, probably. But audio doesn't work at all in Firefox. That's not really just works for me.

<comment><USER4> Yea, Hangouts is a lot more "it just works" than Zoom is for me. That being said, the quality of the actual calls on Zoom is _way_ better than Hangouts.

<comment><USER5> I mean, I don't really know how "consistently high call quality" is not the most important feature of any video chat application. My experience on hangouts has always been garbage. Delays, choppy sound, my machine starts going insane while rendering other people's live video. It may just work in the sense that you can immediately use it, but if even 20% of the time you use it the call quality sucks, then it's a crap product IMO.

<comment><USER4> > It may just work in the sense that you can immediately use it, but if even > 20% of the time you use it the call quality sucks, then it's a crap product > IMO.

"it just works" doesn't mean "its a superior product". I use Zoom over hangouts whenever I'm on a call with more than ~3 people, but automatic gcal integration + being fully functional from a browser means that hangouts makes more sense sometimes.

(I also don't have nearly the amount of issues you do with hangouts. The biggest problem for me is how much worse they handle crosstalk, which isn't an issue when there are only a couple of people on a call.

</comment></comment></comment></comment></comment><comment><USER6> I worked in videoconferencing for a while. When it comes to meeting identifiers, striking the right balance between ease of use and security is really hard.

On the one side, maximum ease-of-use is a name or code short enough for someone to say over the phone. "Here, just jump into the videoconferencing meeting 'mikefred' or 'john10' or '39584'". That works particularly well for small meetings where it's immediate obvious if someone else joins and you can stop talking and ask them who they are and kick them out if they shouldn't be there.

On the other hand is long random identifiers in a space large enough they're impossible to guess. If you're joining a meeting from a link then nobody cares, but if you're telling someone over the phone or typing it into the phone it _sucks_. (And you are _very often_ needing to jump from one form of communication to videoconferencing, where there's no way to "just paste a link" into the initial form.)

There's also no real difference between a short meeting name plus password and a long meeting name, except that passwords tend not to be displayed on screen so it's even harder to find it to tell someone over the phone.

Also there's another big issue in how easy or convenient you make it for people from within your domain/company to join, versus outsiders. Half the company wants to make it harder for outsiders to join (for security), the other half (salespeople) want it to be easier.

The only solution, unfortunately, is educating users to understand the differences. Zoom already has most if not all the necessary options, even modes like "waiting room". But the same options will never work for every meeting. Whoever hosts a meeting needs to understand the options. There's just no substitute.

<comment><USER7> This is a really good point, and I actually sympathize with how difficult it is for Zoom to strike the right balance here.

If the only method of operation here were for people to invite others by copy/pasting a URL, and the invitees' only method of joining were to click on that link, then long UUIDs or such would be just fine.

But Zoom lets you dial in audio-only from a regular phone. You simply just cannot use "long random string" as an identifier if you're expecting someone to punch it into a telephone keypad. Even having an 9- to 11-digit meeting code plus say a 6-digit passcode would be a burden for some people, though it's really the only way to do that portion of it right.

Now, one thing I do _not_ cut Zoom any slack for is having an API where you can request validity and status of any meeting ID, without any rate limits placed on it. That's Security 101 right there.

<comment><USER8> Meet has a 10-letters ID for meetings over HTTP and a 9-numbers ID (like zoom) for phoning in. It sounds complicated but in practice every Meet invitation has a single-tap phone link that dials the correct number _and_ input the conference ID after a pause, all encoded in the link. It works flawlessly and so it doesn't matter if that number is different from the concernce URL you click on a computer.

<comment><USER9> You are assuming a cell phone that calls in. But lots of people dial in manually from an actual telephone.

<comment><USER10> Do you have any statistics on "actual phone" usage? I'd imagine it's very low these days.

</comment></comment></comment></comment></comment><comment><USER11> This is what technical debt gets you.

I really don't know that zoom has a lot or much at all, but I do know that the number of viable solutions to this could be taken off the table internally because they probably made tech debt commitments in their architecture during their scale up phase that prevents bolting on obvious fixes. I have a lot of sympathy for their position. They aren't evil or bad, but they could do a massive mea culpa PR coup on the level of the netflix culture deck if they did a case study retrospective about the effect of tech debt on scale at critical moments.

It's also a product management fail, where that lack of transparency on encryption is what a project-manager would pull, where a smarter product manager would have weighed the cost of losing their e2e-crypto compliance market.

I can also see why they have security issues because today, security people are on a much longer tailed skill distribution than they were 10y ago and it's hard to listen to most of us. Getting someone to approach it as, "ok, we get that a 9-digit key is literally your product selling UX advantage, let's see what else we can do" is exceedingly rare. Privacy has massive brand implications. Remember blackberry? They launched a new flagship tablet product while their CEO got into an issue with government surveillance and the story became about their risk in India and Asian markets and not whatever that product was called. Zooms story is becoming about privacy problems too.

PMs need to be smarter about this.

<comment><USER12> I think you overestimate the reliability of the alternatives.

Zoom focused all their early engineering muscle on reliability. When we build new products, we don't have infinite resources to attack every front simultaneously. We have finite resources to prove a concept, and we incur debt in just about every other dimension.

Now that everyone is using them (precisely because of reliability) the emphasis becomes other things - UX, security, etc.

Tech debt is what the 2nd generation of engineers gets to complain about after the 1st gen made the product succesful at something.

<comment><USER11> That last statement, I'm there with you on. Tech debt is necessary, it could even be renamed "tech leverage," because that's what a lot of it is.

My thing is that there are tons of potential ways to mitigate zoombombing, even incrementally, and that they haven't or chose not to indicates it's because there were cost barriers to doing it. It has the tech debt smell, and it's what I've seen in other orgs.

<comment><USER13> Do any of those potential ways impact on the ease of use of Zoom? Do they make it harder to join a meeting?

<comment><USER11> There is a basic information problem, where good people have it and bad people don't. You don't need cryptographicaly strong approaches, you just need speed bumps that impose costs on specific classes of attacker that disrupts their economy of scale. It's not a secrecy solution, it's an economic nudge.

Then there are ones with vs. without user interaction.

Without user interaction:

\- rate limit join attempts so that you at minimum need proxies or a botnet to guess room names.

\- do a simple entropy measurement of multiple attempts and rate limit anything that exhibits symmetry or monotonicity.

\- add a "correct battery horse staple" style key to the url instead of or in addition to the 9 digit pin so the link is not easily guessable, but still has the mnemonic quality for people entering it manually.

\- static personal room ID's only work with a passwd/token (not pin) whereas ephemeral ones can be chosen from a much larger search space. (yes, just add entropy)

\- free sessions limited to 40mins or whatever should select from a name space large enough it will take a botnet to hit even one ephemeral session in the 40min timeframe.

\- separate the invite link from the login link so that session owners can specify that the user needs to click from their email invite so it gets bound to the browser, and you zoom can set a token before redirecting them to the live session.

with user interaction:

\- Obvious one would be a user PIN for ephemeral room IDs.

\- Next obvious would be to choose a real security protocol and key management scheme ([http://www.lsv.fr/Software/spore/index.html](http://www.lsv.fr/Software/spore/index.html))

Rest of user interactive ones is exercise to the reader, as those are all solved problems.

The challenge is that they require keeping logical state at the application layer, which is specifically the kind of complexity you avoid in your scale-up architecture - and it burns you down the road.

</comment></comment></comment></comment></comment><comment><USER14> TLDR: With 17 digits meeting password is not needed at all. If meeting will be 17 numbers it will be the same as to protect 11 length digit number with 6 digit password. So basically that's the trade off. One could say that password is not the same as meeting ID, but usually they both sent in one email/message and lifetime and protection for them is equal. Also it's easier to input one number than 2 different.

<comment><USER15> Please don't think of this in entropy terms alone. There is a massive usability difference between the two.

<comment><USER16> I'm not sure I understand your point. The usability of clicking a link stays equal regardless of the amount of digits in the ID. Adding a password reduces the usability.

<comment><USER17> An important Zoom feature is that you can dial in from a regular cell phone / landline and conference phones. That's one of the selling points of Zoom.

<comment><USER18> But when joining a Zoom call from your phone you dial a number, then enter the meeting ID. The meeting ID has the same number of digits as a US phone number, but it isn't the number you dial. The calendar invites generated by Zoom format the number + meeting ID in such as way that a user can tap them and it will dial the number _and_ enter the meeting ID.

Basically, in both cases (computer/app or dial-in), increasing the number of digits of the meeting ID has very little impact on the users. Forcing a user to enter a password after joining (which is just more digits) does impact the user.

<comment> kube-system >Basically, in both cases (computer/app or dial-in), increasing the number of digits of the meeting ID has very little impact on the users.

It is a frequent use-case that people join meetings from devices that are not running a calendar application, or the calendar does not have the meeting invite.

For example: conference rooms.

</comment></comment></comment></comment></comment></comment><comment><USER19> I feel a little bit sorry for the Zoom devs. All of a sudden there are a _lot_ of eyes on Zoom. Every design decision and mistake are under a big microscope, while also presumably having to deal with some major scaling.

<comment><USER20> It's a ~2k person company with a market cap of $34B. So the valuation is $17M per employee.

I don't feel sorry for them.

Also: this crisis is giving them vast amounts of marketing for free.

I'm based in Sweden. I was just vaguely aware of Zoom until a few days ago - now I suddenly hear of them all of the time from Late Night hosts on Youtube.

<comment><USER19> The developers are still people. Doesn't matter the size of the company, it's still a bunch of individuals who are likely suddenly dealing with a lot of stress and pressure that could never have been predicted, or have opportunity to scale up their engineering to meet.

<comment><USER20> Yeah.. no.

Only on HN could these winners become "victims".

<comment><USER21> > Only on HN could these winners become "victims".

Maybe because the users on here have an unique perspective on developers / development?

</comment></comment></comment></comment></comment><comment><USER22> Zoom is pretty lucky to get so much free security scrutiny. I hope they make the most of it and fix all of these issues..

<comment><USER23> Three of the big issues reported in the past week have also been corrected in the past week, so they're certainly trying.

</comment></comment><comment><USER24> > _" KrebsOnSecurity is not naming the companies involved"_

This chart suggests that one of the companies they found was an aerospace company: [https://krebsonsecurity.com/wp- content/uploads/2020/04/zward...](https://krebsonsecurity.com/wp- content/uploads/2020/04/zwardialmeetingsbyindustry.png)

I wonder if this is related to the news yesterday that SpaceX has banned the use of Zoom.

<comment><USER25> SpaceX seems big enough that they pay for a self-hosted meeting suite. I've worked at a couple places that use WebEx that is self-hosted. You can only access it via dialing the number (from any phone) or by being on the VPN to see the shared presentation. Trying to log into the public version of WebEx gives you an unknown user error. Someone could still wardial their way into the call but it would require getting the non-public phone number and guessing the meeting number AND possibly guessing a meeting password.

</comment></comment><comment><USER26> It's 1985 all over again: I'm in my bedroom running a ProDOS wardialer on my 300/1200 baud AppleModem; I have found zero computers, but it is fun watching the numbers flick past, hoping that I, too, can discover a WOPR and start global thermonuclear war.

<comment><USER12> Yeah but this time, it's an easy as guessing a world leaders zoom meeting, and tricking them into believing something preposterous

<comment><USER27> Modern Version: "Shall we play a game?" "Love to" "‼To play Global Thermonuclear War, you must first update your flash player. Click here‼"

<comment><USER28> An even _more_ modern version:

"Shall we play a game of Global Thermonuclear War?"

"Sure!"

"Updating Steam client... It seems you're connecting from a new device! Please check the 2FA code sent to your email... Downloading more updates... Here are some popups about unrelated games... Please register an account with MS Game Live!... Downloading patches... [error in wopr.dll]"

</comment></comment></comment></comment><comment><USER29> Shout outs to l0pht and cdc, but not to Minor Threat[1] ?

[1] [https://en.wikipedia.org/wiki/Chris_Lamprecht](https://en.wikipedia.org/wiki/Chris_Lamprecht)

</comment><comment><USER30> Not a good idea to use 9 to 11 digit long IDs with no password requirement by default; they should have used at least 128-bit random ids, i.e. 21 character long base64-encoded strings.

<comment><USER31> Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID

<comment><USER32> > Yeah but then it sucks for people calling in to have to punch in a 21+ > character long meeting ID

I may be out of touch with the average biz-guy, but how many people are realistically calling in manually, over traditional phone-lines these days?

Is it really a significant percentage?

<comment><USER33> Working in global research, 40% of our ROW (rest of world) sites and vendors use landline or cell pones to join our meetings, depends on their institutional security and IT settings.

<comment><USER34> Smart phones can dial a long code in software. Only dumb phones and landlines can't

<comment> kube-system Some smartphones, using some applications, and some input devices, can dial some long codes.

Jim from sales who is dialing in from his company's oddball calendar app over Bluetooth on the infotainment system in his rental car probably can't.

</comment></comment></comment></comment></comment></comment><comment><USER35> Not having password protection enabled seems like an unfortunate default, but I guess it's not that surprising given the number of "barriers" that Zoom attempts to bypass when you join a call.

</comment><comment><USER16> I always wondered why teleconferencing systems don't incorporate a workflow where people connecting in need an approval from the organizer before actually entering the meeting.

<comment><USER36> Most do, but in Zoom it's off by default. (Waiting room)

<comment><USER37> And it's a responsibility/pain for the facilitator when it's on. Often they'll be caught up in the meeting and leave anyone who arrived 3 minutes late to spend the rest of the meeting waiting to be admitted.

</comment></comment></comment><comment><USER38> Maybe naive, but why doesnt Zooom do something like SSO? Why is the identity of attendees not validated? Wouldn't that solve the problem?

<comment><USER39> Then they'd need to charge extra for the SSO tax ;)

[https://sso.tax](https://sso.tax)

</comment></comment><comment><USER40> I think a tool which is basically yet another webchat-solution but tries too push their omnipotent app onto you, no matter what, has some issues beyond security. All the "user"-friendly execution looks like some 2002 nigerian adware. I guess userfriendly is really easy if your app can never be closed (not sure about that), can't be uninstalled and you nag the user twice to actually really start that app before allowing to use a runtime under his/her control.

</comment><comment><USER41> Oh the number of times I've been on 20+ people Zoom meetings which were interrupted after a minute by someone asking "Hold on folks, who is the phone- user who just dialed in?" Or whenever someone connected who had the wrong nick set (happened on Linux) and hadn't turned the video on yet, which basically meant the conversation stopped until the new arrival had identified himself.

</comment><comment><USER42> Chatroulette Zoom Edition

</comment><comment><USER43> Why doesn't Google Hangouts/Meet have this issue?

<comment><USER44> Hangouts has this issue as well.

</comment></comment><comment><USER45> zoom is not showing real effort to hunker down on privacy. and can feel its consequences as its stock is already down by 8% over the week

</comment><comment><USER46> How hard is this for them to fix?

<comment><USER15> Generating a random 6-digit passcode for each meeting by default? Not hard at all.

Rate-limiting incorrect password attempts could take a bit longer to implement, but still not a particularly difficult problem to solve.

<comment><USER47> I never understood "presenter will let you in" security. It's based on someone letting me in if they recognize my recorded name and that I work there? Surely that wont backfire in a world where everyone post every detail about every day of their life online. I mean who even uses LinkedIn anyway?

<comment><USER48> You can also require users to be authenticated (through SSO or other mechanism) before they log in, which could defeat some impersonation attempts.

</comment></comment></comment></comment><comment><USER49> wow! haven't heard that term in a while.

we used to do this looking for modems to dial into.

<comment><USER13> I remember WarDriving - driving around to pick up WiFi SSIDs. That was about 20 years ago.

</comment></comment><comment><USER50> [deleted]

<comment><USER35> That wasn't really arbitrary code execution.

</comment></comment><comment><USER51> [https://unicorn.computer/zoom-wins-malware-of-the-year- march...](https://unicorn.computer/zoom-wins-malware-of-the-year-march-2020)

</comment><comment><USER52> Hey... I created a tool that can hack Zoom meetings faster.... let me tip Brian Krebs about it and advertise it to the world.

I don't understand why this article exists. It's like a beacon for all the bored skidz now.</comment>


Ask HN: What would you like to learn on the job? - <AUTHOR> A lot of companies seem to value continuous learning and professional development but I was wondering how structured that was for the HN community. What do you want to learn? Are you succeeding at learning it? <comment><USER2> I've learned a bunch of things on the job:

\- Picked up Finance on the go as it was required for the job. \- Learned a lot about concurrency, java, python3, modern C++, React as I needed them to get my projects to completions. \- Another thing which was completely orthogonal was political philosophy and it's interplay with economics, and to extend it further, behavioural economics. \- Then there are soft skills like writing concise emails, presentation skills and general witty banter which I picked up as well

</comment><comment><USER3> Every new job I get oh, I try to find a completely different tech stack.

This front loads a lot of learning on the job.</comment>


American Game Devs Can Make Four Times as Much in Japan, Company Says - <AUTHOR> http://www.readwriteweb.com/archives/american_game_devs_can_make_four_times_as_much_in.php?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+readwriteweb+%28ReadWriteWeb%29 <comment><AUTHOR> the asian market is for the most part untapped by the western world, sometime because of ignorance to the market and sometimes by culture difference. nonetheless the east asian market (china, korea and japan... especially the last 2) is probably the most digital of the world. I've never seen more screens in front of people's eyes as I have in my 2 years living here in korea, it's a gold mine if you know how to approach it... but there resides the challenge, approaching it, which for the most part is a close culture, takes local help and that's what I guess these guys are offering.

maybe we should keep an close look here and see what will they bring to the table. 'cause if it works it may be a new opportunity door to start making the cross over.</comment>


Seeking advice: How to manage IP conflicts in a Startup? - <AUTHOR>

I am teaming up with two other folks to create a software product. One of the person I am teaming up with runs a company already (legal consultancy). The product idea was originally his. His company will be the testing ground for the product and he will market it when we are ready to sell. He suggests that all the IP for the product we create be initially in the name of his existing company. When we are ready to sell, he says, he will transfer IP to the Startup. I am somewhat reluctant because I will be implementing the product (design, code) and would not be happy if I don't have equal stake from the beginning. Have you faced similar situations? How did you move forward? <comment><USER2> He's saying, in effect, that he doesn't trust you. But he's then forcing you to trust him. You might be able to save the situation by agreeing on some definite milestone that you could reach in, say, a month, and which if you reach it the IP goes to the company. Then your risk is capped at a month's work, and his is decreased by a month's data about your performance.

<comment><AUTHOR> Thank you, pg. He is a pragmatic person. Hopefully, we should move forward with an arrangement such as this.

</comment></comment><comment><USER3> It is vital to get these things properly resolved "up front" and to not rely upon promises of future action - it will all end in tears otherwise.

I would create a new legal entity to own the IP and divide the shares as seems appropriate to the founders. The new entity can enter into a license agreement (exclusive or otherwise) with the pre-existing business.

</comment><comment><USER4> I would make sure Newco has an ironclad right to use, sell, relicense, etc. all relevant IP from Oldco for a specific low fee or other immediate consideration. Otherwise there's lots of risk that customers, investors, acquirers, etc. could get spooked about unclear IP ownership at important moments.

Also, there's a risk that your partner (or others with influence in _his_ company) holds you over a barrel at some key point. Is your partner a lawyer giving legal advice for the whole Newco? If so, you may need to consult, even if just informally, another equally seasoned professional who can consider your interests and the Newco's interests without the mixed loyalties inherent in your partner and his company.

(If I sound wary, it's because I've seen a business partnership between one legally-savvy friend and another trusting friend degenerate into acrimony and lawsuits.)</comment>


Ask HN: Best way to raise money for a small charity trip? - <AUTHOR>

My little sister is in high school, and recently spent a week in Haiti on a medical mission with a group of doctors/residents (including my mom, who's a pediatric radiologist).
She's trying to brainstorm ways to raise money for the group's next trip. I believe the trips are semi-annual, and they need money for all sorts of things: medical supplies, food (both for the doctors and the patients, many of whom have to walk a full day to get to the clinic), transportation, lodging, etc.
I guess she could do a bake sale or something, but I was wondering if you guys knew of any interesting ways she could cast a wider net than just her high school community.
She has some pretty amazing photographs from the trip, so I was thinking that something as simple as a posterous page with a pledgie link would work; but I'm not very familiar with online charity strategies.
I'd be incredibly grateful for any cool ideas! <comment><USER2> I've seen Kickstarter fund much stupider ideas (not saying that your idea is stupid), especially related to sending someone on a faraway trip, so you could always try it. They prefer tangible rewards, so photographs from the future trip would be cool but also think about creative rewards.

Or you could also use causes.com to get the word out.

<comment><AUTHOR> Cool, thank you, causes.com looks like it would really useful.

</comment></comment><comment><USER3> High School? That can limit the options, I suppose. Cross country party tours can raise thousands: <http://causeitsmybirthday.com/></comment>


Windows Phone under 3% share worldwide. Is it finally dead? - <AUTHOR> http://blogs.computerworld.com/windows-phone/24202/windows-phone-continues-slide-now-under-3-share-worldwide-it-finally-dead <comment><USER2> Well, going from 3.8% to 2.7% surely isn't the right direction. And laying off half of Nokia after buying it maybe neither. I wonder what will be in store for Windows Phone. Pity. I think it's a really great take on the mobile experience and has lots of potential. Microsoft needs to get it together and launch new high and mid-range phones (seems most new Windows Phone 8.1 Lumias lately were low-end) and update the OS more often.

</comment><comment><USER3> 3% of the biggest hardware market in the world (and it's going to be growing for a while yet) is still a massive amount of revenue and potential profit. The management of the Windows Phone division are failing, but the proper response to that is to either help them improve or to replace them, not to abandon the market completely. There is enough room in the marketplace for more than just Android and iOS.

</comment><comment><USER4> I'm going with no, but hopefully their market share will be taken up by Mozilla. Mozilla will do a better job of keeping the big players honest and (IMO) have a better chance of putting out a decent product.

</comment><comment><USER5> It's a beautiful OS and Nokia had the best hardware design and quality for every price segment. Quite a shame the OS never took off and Nokia is gone.</comment>


Left with Nothing - <AUTHOR> http://www.washingtonpost.com/sf/investigative/2013/09/08/left-with-nothing/ <comment><USER3> Tax enforcement schemes are conceived, enacted, and executed by governments because they have a monopoly over the taxing power. If private profiteers are allowed to exploit local citizens, it is strictly because the entity holding that power has deliberately chosen to set up an enforcement scheme that arms those predators with everything they need to conduct their exploitation. The vultures, despicable as they are, would be powerless to do anything to delinquent but for being armed for the task by the enabling government. Is this abusive? Yes, it is massively abusive. But the remedy needs to go to the source of the abuse and that source is a faceless, uncaring local government that has elevated cost-savings over fairness and, when caught as it has been here, is trying to pretend that it can impose a few regulations at the edges to solve the problem. The real solution is to bring the enforcement back in- house where it historically resided and then collection procedures can be controlled and made fair to citizens. But, of course, that would vitiate the cost savings to the governmental entity from which it benefits under its current system. It should do it but don't hold your breath waiting for reform. It is much easier to blame the outside vultures (who are of course eminently blameworthy), impose a few patches to pretend to deal with the abuse, and go on with business as usual. Whichever way reform is done, if it is at all, one can only hope that it will be real and meaningful but I suspect it will not. Very sad to see the tragic consequences.

<comment><USER4> i don't get why the law is so coarse - why a lien worth less than the value of the house can be used to forclose the house?!

I understand if the value of the lien/debt is equal or greater than the value of the house. Otherwise, it's just like the article claims - highway robbery.

<comment><USER5> Any lien can be used to foreclose on property if the lien holder has no other way to force the owner to pay. Generally, the owner is entitled to whatever sales proceeds they have left after paying the lien.

</comment></comment></comment><comment><USER6> I'm all for making money, but this seems predatory and downright evil. Under no circumstances should someone be able to foreclose on a property because they hold a lien for less than 1/1000th of the value of the property, then take all of the equity. According to the article, this is only allowed in a small handful of jurisdictions - most require the proceeds above the amount owed to be passed along to the owner.

It's no coincidence that this is happening in Washington DC, the backyard of some of the most powerful and effective lobbying firms on earth. The set of laws that allow this insanity are almost certainly the result of lobbying efforts by tax lien buyers. Lobbying rules at the local and state level range from non-existent to very lax. As a result, getting a law or ordinance passed to benefit your company or industry at the local level is a relatively inexpensive and simple affair. People need to monitor laws and ordinances in their local jurisdictions, and speak up when they see things that don't pass the smell test. Otherwise, we'll continue to drown in this type of stuff.

<comment><USER7> I would like to know the names and a little background on the people involved in these practices. Why doesn't the article name names?

Who owns and works at Heartwood and Aeon Financial? Who are these people at the tax office facilitating the practices?

<comment><USER8> Aeon Financial, LLC, aka CapitalSource Bank

[http://www.ilsos.gov/corporatellc/CorporateLlcController?com...](http://www.ilsos.gov/corporatellc/CorporateLlcController?command=mms&fileNbr=02126966&type=MGR)

I'm not quite sure what the HN policy is on personal details, but you can find the individual whose name is on the ownership of Aeon Financial on court documents across the US for tax lien purchases.

It appears this document that appeared in a google search indicates that staff at CapitalSource were trying to separate the tax lien operation from the business by operating under the DBA Aeon Financial: [http://www.delaney2012.com/wp- content/uploads/2012/09/09-07-...](http://www.delaney2012.com/wp- content/uploads/2012/09/09-07-12-Delaney-for-Jobs-Backup.pdf)

Google "capitalsource bank fbo aeon financial" for a wealth of results.

</comment></comment></comment><comment><USER9> The logical outcome of this kind of predatory practice should be that the "investor" (the purchaser of the liens) gets $5000 out of the $197,000 sale, and the debtor gets $192,000. And even _that_ seem predatory, never mind getting _all_ the equity and forcing the person out of their place of residence.

<comment><USER10> when someone gets your $197,000 house for $134, they can sell it for $71,000 and take $6000 in legal fees, interest etc, as documented in the article.

The owner loses $130,000. Don't be surprised if the person buying the house for $71,000 is in on the game too.

<comment><USER11> This problem is indicative of how screwed up our legal system is. Lawyers harass regular folks at-will as most people have no recourse (i.e. money to hire their own lawyer, or knowledge of the expanding and complicated laws).

Two ways I can think of fixing it - one is offering simple, straightforward hearings in front of a judge with the power to use their own judgement (instead of relying on overly-specific, exploitable laws); the other is to implement some counterbalance punitive fee for wrongly harassing citizens - something that decreases the profit ratio for predators and makes defending people in otherwise unprofitable cases profitable.

<comment> do-it-good The complexity of the laws is not a coincidence:

1\. It gives more power to the government and less power to the people.

2\. The majority of lawmakers are lawyers - complexity means them more job/business opportunities and significance in society.

<comment><USER12> Law is ripe for disruption. We need something like IBM's Watson to fight the complexity.

<comment> do-it-good No, that won't help. When accountants got electronic spreadsheets, the complexity of accounting laws rised 50 fold.

</comment></comment></comment></comment></comment></comment><comment><USER13> Well there are two issues here.

The first is that laws that allow this to happen are scandalous. Worst case, particularly for the elderly, is that a lien is placed on the home such that it must be paid when the home is transferred in any way. So what if DC has to wait 10 years for $137 mistakenly not paid? Seriously.

Unless the debt exceeds some nontrivial amount, the county should be restricted from taking any action whatsoever. All this to recover $137? Seriously?

If it does come to foreclosure, it is utterly ridiculous that the "investor" (I prefer "predator") gets to keep the entire sale amount. Fees (that should be capped) may be retained with the rest being returned to the owner. Otherwise this is (or should be) the unlawful seizure of assets.

Secondly, if you are such an "investor" how exactly do you live with yourself as a human being doing this? Seriously. I couldn't sleep at night.

As for the county or state officials that make this possible, how do they live themselves doing this to their constituents?

<comment><USER8> Sir or mam, I don't know you, but you're my kind of people.

</comment></comment><comment><USER5> The article doesn't come out and say it, but the impetus for tax sales is that foreclosure proceedings are pretty onerous and take forever. At the same time, property taxes are the primary source of revenue for the local government and must be collected. So it doesn't seem ridiculous at face value to sell the debt to private investors and let them do the collection while being able to recoup the fees involved in foreclosure which can legitimately run into the thousands because the foreclosure is a process that drags on for six months or more (with various redemption windows after that which can be a year or more).

I'm skeptical of the "lien holder gets the equity" claim because it doesn't work that way outside of DC or in foreclosure generally, so I'd be very surprised it it wasn't a misunderstanding on the part of the author.

This article talks about DC tax lien sales, and doesn't mention keeping equity: [http://taxlieninvestingpro.com/category/statebystateguides/d...](http://taxlieninvestingpro.com/category/statebystateguides/district- of-columbia-statebystateguides/). It looks like a regular judicial foreclosure.

<comment><USER14> _I 'm skeptical of the "lien holder gets the equity" claim because it doesn't work that way outside of DC or in foreclosure generally_

I'm not sure I understand. Foreclosure means the lien holder takes title to the property, and the current owner, the one who owes the debt that the lien holder was unable to collect, loses title. Then the lien holder, who now has title to the property, sells it for whatever the market will bear, and pockets the sale price minus whatever costs he has to pay. That effectively means the lien holder gets whatever equity is in the property once he has foreclosed on it and sold it.

 _This article talks about DC tax lien sales, and doesn 't mention keeping equity_

Well, of course not, since it only talks about buying the tax lien and foreclosing on it; it doesn't talk about the part where once you've foreclosed, you sell the property and pocket the money.

The article does describe the foreclosure process the same way I did above:

"The District of Columbia statutes require that you file a judicial foreclosure on your lien. This means that your attorney will run title, notice all the parties on title and file a foreclosure action in the court to get a judge to issue a final judgment. Once the judge rules in your favor, you can go to the DC Office of Tax and Revenue, pay any outstanding taxes and bills that may be due, and get issued the tax deed."

So you buy the tax lien, and if the tax isn't paid, you foreclose, you pay off the outstanding taxes and bills, and you get the property. The now former property owner, whom you've just evicted, gets nothing. Then you can sell the property for whatever the market will bear. So who has the equity?

<comment><USER5> That's not how foreclosures work. In most states, foreclosure is a judicially supervised sale in which the lien holder does not take title, but instead is entitled to part of the proceeds of the sale. Multiple lien holders may collect in case of say home equity loans, but at the end the original owner is entitled to whatever is left after satisfying the liens.

In some rare cases, with underwater mortgages, the lender may be allowed to take title.

<comment><USER14> _That 's not how foreclosures work._

I do see plenty of web references that describe foreclosures the way you do, but they all talk specifically about foreclosures when the lien is a mortgage. Does the same process apply when the lien is a tax lien? What information I can find suggests it doesn't--or at least, there seems to be a lot of wiggle room.

</comment></comment></comment></comment><comment><USER15> Can someone point me to the laws and regulations that allow this? Someone who owns their home completely (with no mortgage) can lose the entirety of the home due to unpaid taxes? Even if the value of the home far exceeds the tax debt?

This is mindboggling to me.

<comment><USER16> The local county government can put a lien on your real property for failing to pay your property taxes, in some places, even for not mowing your lawn (an exaggeration of property maint. codes). In Texas, investors can buy a "Tax Deed" at auction. The property owner has two years to buy the lien back, for a defined price, IIRC the taxes owed + 50% for each year. After the 2 yr repayment window, the purchaser of the tax lien gets the title to the property.

[http://www.nuwireinvestor.com/articles/how-texas-tax- sales-w...](http://www.nuwireinvestor.com/articles/how-texas-tax-sales- work-51295.aspx)

[http://www.dallascounty.org/department/pubworks/documents/St...](http://www.dallascounty.org/department/pubworks/documents/StruckListtoPost.pdf)

<comment><USER17> Are tax liens different from other kinds? It's my impression that if e.g. a lender repossesses, they sell the house, pocket what you owe plus fees, and have to give you the rest back. It's strange to think it would be different for unpaid property taxes. Was Coleman truly "left with nothing" or did he get a portion of the sale proceeds?

<comment><USER16> The rights of the tax lien holder trump any other claims, AFAIK. That's one reason that mortgagors want you to escrow your annual property taxes with them.

edit: IRS liens in effect before the sale go with the property, and can delay the new owner in getting a title policy.

</comment></comment></comment></comment><comment><USER18> Tell me again how government does such a wonderful job protecting the weakest & most vulnerable.

<comment><USER19> Yet another thing I would do if I was rich: buy up the unfortunate circumstances and forgive them.

I understand how it would be hard for the government to implement a policy to do the same, but this situation is ridiculous.

<comment><USER20> you don't have to be rich!

[http://rollingjubilee.org/](http://rollingjubilee.org/)

[http://strikedebt.org/](http://strikedebt.org/)

[http://www.occupyourhomes.org/](http://www.occupyourhomes.org/)

[http://occupyforeclosure.org/](http://occupyforeclosure.org/)

</comment></comment></comment><comment><USER21> Meta note: this is what journalism can look like today. Made for the web first, not for the paper. Visualizations that are actually insightful - <USER2> most importantly a well researched story.

<comment><USER22> Absolutely - I noticed that too. Exceptionally well done from a web publishing standpoint.

<comment><USER23> They researched this for 10 months, not 10 minutes. The quality of the research shows.

</comment></comment></comment><comment><USER24> Sorry but WTH?!! 134/197000 is 0.068%. And if this was not enough, I read this -

        A 95-year-old church choir leader lost her family home to
        a Maryland investor over a tax debt of $44.79 while she
        was struggling with Alzheimer's in a nursing home.

Sometimes I wonder what's wrong with people in the world.

<comment><USER25> I think so too. Forget the laws, if you're a "investor" who bought a tax lean for $50, and that lean led you to own the deed to a $100,000-$200,000 house of Alzheimer's patient, don't you stop for a second and consider the moral and ethical implications of collecting on that lean?

<comment><USER24> Ethics? I would want to know how is that even an apropos penalty given the defaulter's age and mental health. This is literally bordering on the insanity!

</comment></comment></comment><comment><USER26> Queue up the Ayn Rand acolytes in 3...2...1

It's not a coincidence that this is happening to mostly elderly people who otherwise own their properties in the clear, people who are often burdened with serious health problems.

There is a simple fix. Require the liens to be paid off when there is a change of ownership. The city knows what it is owed, and that it will get the money eventually. If the city needs the money today, it ought to be able to borrow the funds (not all that different that accounts receivable factoring). Throwing people out of their homes over small amounts is inhumane.

<comment><USER27> Say what you like about Ayn Rand, but she was hardly a fan of out-of-control government/private collusion to seize individuals property in a manner completely out of proportion to the size of their debt.

<comment><USER28> That was the flaw in her reasoning that big business and govt can and will be somehow separate entities. They never are. They are effectively the same entity. Look at chiefs and heads of regulatory agencies, they are often ex or future CEO of industries those agencies are supposed to police. Look at many military industrial contractors they often hire ex-generals and so on. And all this in the land of "law and order". Imagine in other countries with less "law and order".

<comment><USER27> For sure. Good point about the contractors hiring generals. There are lots of different revolving doors in different industries.

If you work at a major investment bank, why would you speak out against government regulation of your industry when you might need a bailout some year in the future?

If you work at a government regulator (e.g. the SEC), why would you regulate the industry _too_ hard when they are going to be your biggest source of consulting fees after you leave your government employment?

For example, Bernie Madoff's brother was a director of SIFMA (Securities Industry and Financial Markets Association) for two years.

</comment></comment></comment></comment><comment><USER29> This story is not about a government department doing what it is charged with doing. This story is not about privitization of collections. This story is not about the well known DC corruption issue. This story is not about tax collection automation, ie removing the knock on the door. This story is not about people that buy tax liens, which as a side note do not know the circumstances of the lien.(barring collusion)

This story is about the fact that this man had no one. No one to make sure is ok. No one to ask if has been forgetting things lately. No neighbors that might have checked in on him. No family that was attentive enough to realise he may need help with the 10 giant boxes of mail by the door. No one that gave enough of a shit to just ask how he was doing.

When was the last time you checked in on that elderly lady that lives next door to make sure she is doing ok? When is the last time you did a little checking up on your elderly family? When was the last time you took the time to make sure the people around you are not getting to the point where they need help?

As a side note, please read the entire article.

</comment><comment><USER30> Does anyone have any idea how much it costs a traditional newspaper to produce an article like this? They've listed 15 people in the "Credits" section at the bottom. Seems cost-prohibitive.

 _Written by Michael Sallah, Debbie Cenziper, Steven Rich / Graphics by Ted Mellnik, Emily Chow, Laura Stanton / Photos by Michael S. Williamson / Editing by Jeff Leen, Steven Kress / Research by Jennifer Jenkins / Production by Chris George, Connor Jennings, Bronwen Latimer, Michelle Williams, Tim Wong_

Edit: clarity

<comment><USER31> The "producers" are likely just management and several of the rest may in fact be unpaid interns trying to break into the industry.

But researched articles like this are expensive to produce. That's why PR firms are so successful. Reporters need others to find and research stories for them.

<comment><USER32> Production has a different meaning in publishing than in movies, which is what I think you're referring to.

In print, production is the act of taking the raw inputs (copy, graphics, layout) and getting it out the door. E.g., the print production managers I know manage the physical details of the print medium. There is a similar meaning in advertising. [1]

Looking at the resumes of the first couple producers, one's a designer, the other lists himself as "Nerd". So I think they are using the meaning from publishing: people who produce the final product.

[1] [http://en.wikipedia.org/wiki/Advertising_agency#Production](http://en.wikipedia.org/wiki/Advertising_agency#Production)

</comment></comment></comment><comment><USER33> And yet I still see people saying "no, how dare you compare government to a bunch of thieves?".

<comment><USER34> The DC local government is somewhat remarkable in how corrupt it is. It seems like every other day some major political player gets indicted for corruption of some sort.

<comment><USER35> DC is in some ways an anomaly; US citizens deliberately disenfranchised by the Federal Government. It's not surprising that they might be extravagantly corrupt.

</comment></comment></comment><comment><USER36> In British Columbia you can defer your property taxes until the home is transferred (to anyone other than your spouse) or sold. That seems, to me, to be a much more fair and reasonable option than auctioning off these trivial amounts to the morally corrupt and destroying the lives of the indigent, elderly, or sick, as well as their families.

</comment><comment><USER37> Ironically, a lot of houses owned by banks as a result of foreclosures ("REOs") are in turn getting foreclosed for failure to pay taxes and HOA fees. Banks were/are not equipped to manage the number of properties they own as a result of foreclosures and they lack the basic infrastructure to maintain these properties not limited to paying taxes and HOA fees, but violations of certain civil statutes like failing to maintain lawns that result can result in fines upwards of hundreds of dollars per day for continued violation.

<comment><USER38> This simply means that the banks should hurry up and auction the houses instead of sitting on them and waiting for their value to increase.

<comment><USER37> Agreed, but there is a lot of debate on this for the following reasons. The banks own so many homes, that there is an argument that they could flood the housing market with under priced homes which would slow the housing recovering by driving down the prices of all homes. Additionally, there is a lot of speculation that part of the $1.2 trillion stimulus packages went directly to the banks to account for the above argument and actually requires the banks to slowly release their inventory of homes in order to prevent flooding the housing market with under priced homes (again because that would continue to drive down value across the board).

All that said, as mentioned above I do agree with you, because assuming banks are keeping homes off the market this only artificially keeps home prices stable, and many of those REOs are failing into disrepair. In my opinion it is better to have ownership and people in homes, even at a short term cost of flooding the market with under valued homes. After all it is the banks who originally to the risk on these loans they foreclosed on and they lost.

</comment></comment></comment><comment><USER39> Not sure if you guys have noticed this "In 2006, he forgot to pay a $134 tax bill, prompting the city to place a lien on the home and add $183 in interest and penalties. His son paid the $317 bill in 2009, records show, but that wasn't enough." His son did pay the tax later. I don't know how penalties/government fees are made and justified.

<comment><USER40> The writing is horribly obfuscated. What it means to say is that the original bill was $134. Presumably he received dozens of notices and warnings that it needed to be paid, before it was sold as a lien.

The lien holder would then have sent notices and warnings that the debt needed to be paid. Eventually after no response, it filed foreclosure proceedings in the court (at some significant cost). At that point, the son decided to pay the original tax bill, however the holder of the lien presumably wanted its legal costs paid before it would surrender the lien.

What happened next was very unjust. But would make more sense if the article was clear on the timeline of events.

</comment></comment><comment><USER41> This may not be the right place for this, but does anyone know who to contact about a similar instance? I have family members that experienced this and lost a house due to predatory lending practices, but there is little to no recourse or resources out there. If anyone has information about the Bank of America/Countrywide issues I would like to know about them.

</comment><comment><USER42> What a clever disruption of the property tax industry!

But seriously, things like this are why we must not get too carried away focusing only on market opportunity. Some ideas are profitable, but socially disruptive. In this case, public policy is enabling predatory with very obviously antisocial results, but I think there are plenty of cases where the government isn't so directly involved and the results aren't so obviously destructive, yet antisocial, nonetheless. This is really addressed to the small but vocal minority that seems infatuated with profit-seeking, without concern for anything else.

</comment><comment><USER43> Obscure program?? It happened all the time in the 1930's. If you couldn't pay your tax bill, your property was auctioned off on the courthouse steps.

<comment><USER44> Via private company operating for profit?

<comment><USER45> Issue is abuse of that system not the fact that it was by a private company operating for profit. Many prisons are run by for profit enterprises as well as hospitals. The way the program is run is the important thing not the type of enterprise handling the program.

Example: Small town with "speed trap" (not a for profit business) gives out excess tickets to raise money.

<comment><USER46> I hardly think citing prisons and hospitals is a ringing endorsement of the profit motive.

</comment></comment></comment></comment><comment><USER47> Reading something like that makes me very angry. What would be the highest punishment against people who do something like that? Personally, I would not have any problem to dish out the highest one.

</comment><comment><USER12> "Give me your tired, your poor and we will make them homeless"

</comment><comment><USER48> >owe $147

>you have to pay $5000

>you lose $197,000

How is this acceptable?

<comment><USER49> Well, the paper more or less put the article together because it isn't.

</comment></comment><comment><USER50> Property taxes are, effectively, rent paid to the local government by people who otherwise think that they _own_ said property. Fail to pay it, and you get evicted. It is quite a racket already, but combine this with crony deals with private companies, and corruption shows its ugly face. It is all "legal", since the ones carrying out the scheme also happen to make the rules.

</comment><comment><USER51> "No State shall make or enforce any law which shall abridge the privileges or immunities of citizens of the United States; nor shall any State deprive any person of life, liberty, or property, without due process of law; nor deny to any person within its jurisdiction the equal protection of the laws."

Why does that section of the 14th amendment not apply?

<comment><USER52> What makes you think the public tax sale took place without due process of law?

Straight from the article:

* Homeowners receive several warnings before their liens are put up at annual auctions.

* Once a lien is sold, owners have six months to repay the investor with interest. If that does not happen, the investor can move to foreclose.

The article even mentions the families getting their day in court over the post-tax-sale foreclosure.

I just realized I'm serial rage-replying on this article. You know that annoyed feeling you get when the news covers a subject you're familiar with? Well.

</comment></comment><comment><USER53> I don't mean to be taking the wrong side here but I'd be interested to know why didn't he didn't pay the money (It seems he was given warning). If he couldn't pay then I'm surprised he didn't sell his TV/remorgage his house/borrow money/ask friends or family to help or something. Perhaps I'm naive and he really couldn't do anything about this but it would have been nice if the article had covered this. Yes this is awful but I don't like the suggestions from some that the government simply shouldn't try to collect small debts. Surely no one would pay small debts they have then?

<comment><USER54> Maybe he forgot. Maybe he couldn't. Life is hard and complex. Not everyone is smart and clever. The weak side, for a debt of $40 gets all his properties auctioned and report a loss comparable to life-long savings. Totally reasonable and fair.

Agree with you, can't see anything wrong going on here too. (i'll state the obvious: i'm joking).

It's not simply a case that here we talk about: \- People with dementia or major problems \- Lonely \- Most of the times, old enough to be completely invisible

And the state, private contractors and greedy individuals use them to refill their bank accounts. And it's perfectly legal. And some people, as you are doing now, simply try to justify it.

I'll tell you what is fair here: \- He doesn't pay \- Warnings should be issued \- He should be given a greater amount to pay (i guess 100x the original amount should be enough) \- He still doesn't pay \- Insitutions try to understand why this person isn't paying \- Take appropriate actions according to the situation. If the lack is anyhow justified (eg. person incapable of self-support) simply drop it and warn social services. Otherwise proceed to court.

Seems a lot more reasonable. But ehi, this would mean lot of effort. Why not just raping and looting the weaks. Keep up with the great job!

<comment><USER29> \--- Institutions try to understand why this person isn't paying

How does a city like NY or LA scale this, when 1 or 2 out of hundreds or thousands is this type of situation. This situation only happens because a city doesn't have the manpower to do a social viability check on every tax lien.

I agree on principle, but the monitoring of elderly is not the role of government, but of community, neighbors, and family.

</comment></comment></comment><comment><USER55> the article's title makes it hard for me as a non-us citizen to understand what foreclosure means in this context.

what i got from the article is this: due to the financial situation of the owner, a small unpaid tax turns due to unfair practizes into a larger debt of like $5000, which then allowed a judge to enforce the sale of the house so that unpaid taxes could be paid off.

now if the house was sold for the mentioned 197'000, does that mean that the owner at least got the proceeds minus the debt? the title suggests that this would not be the case...

<comment><USER56> From what I read:

1) Owner of the house owes a minor amount of taxes. In most of the anecdotes, the homeowners have either no mortgage at all, or otherwise have mostly equity (tiny % of the total value of the home owed). 2) Since the city technically has a lien on the home (or gets one?), they are able to then sell the lien to an "investor", who pays whatever the tax bill is. 3) The investor demands payment, and begins charging huge fees. 4) After 6 months or whatever, the investor forecloses on the house, which is essentially taking ownership (basically a "repossession") 5) The investor sells the house for market value, or whatever price they want. 6) Since the investor is NOT a mortgage company or otherwise holding a mortgage lien, but is holding a lien originated by municipal entity, there is no rule in place that says they need to pay the original homeowner the profit. Therefore, they keep all of the money, minus the tax bill they paid at the start.

In the end, the article implies that this company is buying liens for as low as $50, and then selling the houses out from under the homeowners for hundreds of thousands of dollars.

At least, that's what I understood.

<comment><USER55> thanks. unbelievable - modern government sanctioned robbery

</comment></comment></comment><comment><USER57> Reading some of the comments here, everyone is talking about the laws being broken and how they need fixing but I don't think any amount of law writing can make up for the moral bankruptcy that has led to these situations and many others.

I think when people seek money they should ask themselves if what they are doing has any bit 'unethicalness'.. But who knows if those investors knew of the stories that made their investments possible.

We have the concept of a carbon footprint - what about an ethical footprint?

</comment><comment><USER58> This is why we hackers should all be helping Google get their self-driving cars on the road. It could save so many lives if people could have the option of living in their car.

<comment><USER59> The kind of people who would be able to afford Google cars are not going to be the kind of people who might end up having to live in them.

And if they were, the government would just make Google drive the car to an impound or something, probably, and they'd take that as well.

<comment><USER58> The guy in the article wasn't completely moneyless, he just came up against the recurring costs of taxes/rent which can trip up the unorganized.

Google car expense is overplayed. In mass production and with competition the cost would go way down.

Also, if the government makes the 'homeless' drive to specific places out in the desert or something, that's better than the current situation where you're exposed to other homeless and dangerous people.

I actually wouldn't mind going 'homeless' for a while to save money on rent, but currently it's really dangerous to do so. Moving to low rent places is also usually more 'dangerous', especially with children. With a driverless car you can just take your family out into the desert or forest and pretend you're camping.

The current system of full-time rv-ing is quite hard because of parking restrictions and because sending kids off too school and getting groceries from out of town is hard, and because the rv's are too small. With self- driving rv's you can have a few of them to space out in.

<comment><USER59> _Also, if the government makes the 'homeless' drive to specific places out in the desert or something, that's better than the current situation where you're exposed to other homeless and dangerous people._

But what if they're driving all of the homeless people out to the same spot in the desert? Cars, sure, are better than nothing but better still are cars the government can't use to expel or trap undesirables.

I'm sorry, but the idea of self-driving cars just creep me out.

</comment></comment></comment></comment><comment><USER60> I especially like how the people who made the laws are in no way to blame... Nope once again, it's the lobbyists and the evil corporations, never the people who actually made the rule that allowed it to happen...made the rule to retain power.. No they are the good guys.

<comment><USER61> What would be your solution? To not sell the liens to private investors and instead and have the government try to collect on them? I.e., is your alternative bigger government?

</comment></comment><comment><USER62> Thanks, I will definitely put this on the plate as I decide to apply for US citizenship.

<comment><USER63> No need. This is a bizarre story and not the normal - which is precisely why you are reading about it on the news.

Basically everything you read about on the news is what almost never happens.

</comment></comment><comment><USER64> Can someone please tell me, why do US courts keep approving things like this?

Like they can't just foreclose a house without government approval. Why does the court approve the foreclosure in the first place over such a small debt?

</comment><comment><USER65> I wouldn't be against this basically being a fraud committed by someone in the local government there. Who else would have the knowledge to have found the loophole? Who else could have abused it so well?

<comment><USER61> The six companies that dominate the auctions for those liens.

"When it was over, six companies had swept the bidding, snaring two-thirds of the liens, which totaled $5 million, on properties worth more than $666 million"

</comment></comment><comment><USER24> Does or shouldn't this contradict some law set by the government themselves? I need to do some research on the origins of taxes now. This seems unbelievable to me, I'm literally dumbfounded.

</comment><comment><USER66> As an external observer I find it ridiculous that the recovery of small amount of debt -- to the government no less! -- involves foreclosing on someone's home.

WTF is wrong with you America?

</comment><comment><USER67> I question if outrage articles like this belong on Hacker News. This is just a hot-button troll. Queue discussion regarding the decline of commenter quality on Hacker News.

</comment><comment><USER68> And this is what happens when you privatise the tax man.

</comment><comment><USER69> House of Fog shed light on this problem. it is tragedy.

<comment><USER70> I believe it was The House of Sand and Fog. And Ben Kingsley and Jennifer Connolly are amazing in it.

</comment></comment><comment><USER71> Maybe it's just me, but this reminds me a whole lot of all of the special pieces that the Times has released over the last year or so

</comment><comment><USER72> I really love the UI. Big ass photo with magazine like header. And followed by article. Salute.

</comment><comment><USER73> It's shit like this that makes molotov cocktails seem like rational behavior.

</comment><comment><USER74> Strange he cannot afford 134. He has articles in his house he could have sold no?

<comment><USER61> Less than 1/10th of the way into the article, they make it clear that he has dementia

</comment></comment><comment><USER75> Beautiful photography, I'm hooked before even reading a word

</comment><comment><USER76> Let's just target seniors and be done with it. Take everything they got because they're old and we're worthless scum. Tell it like it is.

</comment><comment><USER77> So, I generally disagree with libertarians (especially, the 25-year-old white male type who know nothing about the economy and have never met a poor person who tend to show up on HN) and one of those grating libertarian tropes is that government is essentially an extortionate body, insofar as it demands payment for non-refusable services and punishes those who do not pay. Now, in general, I would find this argument to be very silly.

However, this sort of behavior makes that "silly" libertarian smear appear to be, in fact, entirely spot-on. All of this, the extreme pursuit of small debts, the tacking-on of "legal fees" to skirt usury/extortion laws, and the transfer of debt to more vicious investors (who are more likely to engage in usury, extortion, et al) is textbook mob shit.

</comment><comment><USER78> How is there not a huge angry thread about this not being appropriate for hacker news. Seriously guys. Flag this.

<comment><USER79> It's at the top of HN because it's been upvoted by HNers. How is it irrelevant if the masses say it should be up there?

</comment></comment><comment><USER45> "All because he didn't pay a $134 property tax bill." [1]

What is the scope of the problem here?

Ok:

"Others weren't as lucky. Tax lien purchasers have foreclosed on nearly 200 houses since 2005 and are now pressing to take 1,200 more, many owned free and clear by families for generations."

Out of home many?

"The retired Marine sergeant lost his house "

Obligatory "and he was a good guy who fought for his country" added in for extra emotion (in addition the picture of course of a respectable citizen).

All this is sad and most certainly an interesting read. But it seems more suite for Taibbi in Rolling Stone.

Would be nice if in addition to writing emotional appeals they enlisted the help of someone (say a think tank) that could do further analysis and come up with some suggestions as far as reform that are backed up by research and in writing.

[1] Noting that this dates back to 2006 and yes if you ignore simple notices bad things happen. Don't pay your insurance bill? You won't have insurance if there is a fire. Etc.

<comment><USER80> The problem is, privatizing a state function -- collecting property taxes -- into a profitable enterprise. Ok, the guy owed $134, explain how under any reasonable financial theory, how this should be worth $5000 or $197,000. Why not a lien against his military pension? Why not negotiate a payment plan? Even the IRS has the courtesy to do that.

Let's take the best possible return, say 20% annual return, and let's say he owed this for 10 years, then at best, he'd owe $848. I don't see how a firm purchasing a $134 debt from the state can justify such a huge penalty/return.

<comment><USER45> Good points and agree. But I think when you get into "at best he'd owe $848" then you don't provide proper disincentive to prevent the behavior of ignoring tax bills and other notices.

As an aside as someone who has gone through significant pain trying to collect money from people that owe varying amounts (over the years) it's a process that given a bigger stick (not "ordinary" penalties) would go a long way.

Noting also that this played out over many years. He didn't just miss a payment of $134 and boom someone profits $5000 or $197,000.

<comment><USER81> No reasonable person would intentionally give up their house, paid off, for a tax bill of $134, many years or not.

The number of people this is happening to and (one third of them over a bill less than $1,000) suggest that something about the process is screwed up.

<comment><USER61> The owner had dementia, so may not have been able to make reasonable decisions.

</comment></comment></comment></comment></comment><comment><USER82> Islam has the most fair rules against Interest. The Quran says: Chapter 2 - Baqarah - Verse 275: [http://www.usc.edu/org/cmje/religious- texts/quran/verses/002...](http://www.usc.edu/org/cmje/religious- texts/quran/verses/002-qmt.php#002.275) (Read the next 10 or so verses) <USER2>
Chapter 3 - Verse 130: [http://www.usc.edu/org/cmje/religious- texts/quran/verses/003...](http://www.usc.edu/org/cmje/religious- texts/quran/verses/003-qmt.php#003.130)

"O you who believe! Devour not usury (interest), doubled and multiplied; but fear Allah (God); that you may (really) prosper."

Some more quotes: [http://www.answering- christianity.com/yahya_ahmed/riba.htm](http://www.answering- christianity.com/yahya_ahmed/riba.htm)

Allah (God) has declared war on those who take interest: [http://www.hilalplaza.com/islam/Interest.html](http://www.hilalplaza.com/islam/Interest.html)

<comment><USER83> As an English atheist, possibly surprisingly, I think Islam is right regarding interest. Unfortunately wrapping it up in mumbo jumbo doesn't give it any credibility. Also it isn't really related to the article.

<comment><USER84> At least inflation has to be added, and that's without calculating any risk. Otherwise I'll borrow from you $100K and return it 30 years later

<comment><USER83> Not really.

a) growth isn't required in all economic models so inflation isn't necessarily valid.

b) goods and services are perfectly good interest. Not that you'd have to borrow it if interest wasn't profitable (it would drive asset value down).

c) risk is irrelevant if lending isn't required.

you're too in the bank and growth model mindset. It doesn't work like that everywhere.</comment></comment></comment></comment>


Africa's Lost Kingdoms - <AUTHOR> https://www.nybooks.com/articles/2019/06/27/medieval-africa-lost-kingdoms/ <comment><AUTHOR> Hm, just realised that the shared link is behind the paywall, but the Pocket's version has full text: [https://getpocket.com/explore/item/africa-s-lost- kingdoms](https://getpocket.com/explore/item/africa-s-lost-kingdoms)</comment>


Relax your coding self with the soothing sound of rain - <AUTHOR> http://www.rainymood.com/

<comment><AUTHOR> Disclaimer: Not the coder nor part of the rainymood team, merely a fan who has used it while he works for over 6 months now.

</comment><comment><USER2> I open this site whenever I have difficulty concentrating...</comment>


Denver Post Rebels Against Its Hedge-Fund Ownership - <AUTHOR> https://www.nytimes.com/2018/04/07/business/media/denver-post-opinion-owner.html <comment><USER3> Since it's the Rockies first weekend at home, the Denver Post ran a "Guide to Coors Field" story yesterday. Except the story featured a large photo of... Citizen's Bank Park, which is in Philadelphia. Its an especially embarrassing mistake because, while it's also a baseball stadium, Citizen's Bank Park is branded "Phillies" prominently in multiple places.

People were real quick to point out "this is what happens when you fire half your staff."

The Phillies also couldn't resist a Twitter jab: [https://twitter.com/Phillies/status/982260422744027139](https://twitter.com/Phillies/status/982260422744027139)

</comment><comment><USER4> It's striking that the only mention of financials comes at the very end and as an afterthought.

I don't know whether the hedge fund is to blame for the demise of the Denver Post in specific, but in general, it's obvious print media is on a significant, general decline for all the reasons we here know about.

You can't have "quality" journalism without paying people for their talent. You can't pay people for their talent if you don't have revenue. You don't get revenue if your readership is moving to other platforms. Not once was any of this mentioned or alluded to.

Hedge Funds are easy to tar and feather, but doing so will do nothing to stem the Post's financial collapse. Who would they prefer as owner? Which financial decisions will keep high numbers of employees and high quality journalism...with decreasing ad revenue?

<comment><USER5> Perhaps the problem is the assumption that journalism organizations have to be run as for-profit businesses. There are many other models for institutions, from non-profits to public institutions (universities) to utilities to essential public/private institutions (hospitals) to etc.

Capitalism is very useful but it isn't the solution to every problem. Journalism, where the incentives of profit don't align well with the mission, might need another model. Newspapers have been for-profit organizations for generations, but perhaps times have changed; also, that model gave advertisers great influence over the news.

The model would have to be insulated from government interference, sustainable, insulated from public whim (the journalists should be able to report news that the public dislikes), and incentivize journalists to do a good job. Perhaps power split between several groups with checks and balances? Or how about a producer cooperative, if I'm using the term correctly - isn't the Guardian controlled by its journalists? Where does its money come from?

EDIT: Another model is the news associations, such as the AP. Also, I just came across the following, which is relevant:

[https://www.thomsonreuters.com/en/about-us/trust- principles....](https://www.thomsonreuters.com/en/about-us/trust- principles.html)

<comment> core-questions > Journalism, where the incentives of profit don't align well with the > mission, might need another model.

I agree with this sentiment, but I don't know that I've seen another model demonstrated that works much better. State-run media like the CBC or BBC are still incentivized by advertisers, and also beholden to government - <USER2> still sets an implicit bias, as viewpoints that would have the government reduce funding to the state-run media aren't likely to be heavily popularized on there (go figure), the same way viewpoints that are counter to what advertisers want their products associated with aren't going to be seeing much if any airtime.

> Another model is the news associations, such as the AP

What you have there is a media cartel, something that provides far too powerful of a megaphone. Just like that recent Sinclair clip that was going around last week with multiple newscasters reading the same script in sync, the AP has the power to set the tone and message for thousands of newspapers. I think the massive resulting feedback waves that come from such loud voices is damaging; it sets into play social oscillations so strong they can tear people apart.

If anything, I'd like to see a model that pushes for more decentralization, that puts more competition into the game, that makes the individual players smaller. Give me a reason to want to read one paper over another other than my own confirmation bias.

</comment></comment></comment><comment><USER6> The newspaper is such a pivotal piece of society. It's heartbreaking to go to a photojournalism conference that used to be 400 newspaper photographers, and now there's maybe a handful. Everyone is doing editorial or surviving on grants and corporate work.

I was in journalism school when the industry collapsed. I saw it coming early on and moved to TV work, an industry that I'm seeing make similar mistakes and is taking steps towards its own demise. But TV has a lot more money and will bleed out much slower.

My local paper in unbearable though. So much to the point where if it wasn't for a cops and courts section there wouldn't be much point to it at all.

But then again, NPR has it's highest ratings ever. So maybe there's some unknown hope still out there. Radio moved towards digital delivery and podcasts, but the newspaper is a far more complex problem. I don't think general society cares about real news anymore. Maybe we just don't have the attention span for what it takes to matter. I don't see a new medium making a difference.

<comment><USER7> > But TV has a lot more money and will bleed out much slower.

As someone who's working in the field, would you say that would be a similar tragedy to the demise of newspapers? I have the impression that TV in general in the US (and not just local) is no force for good at best, and a propaganda and pacification machine at worst. Then again I never watched much TV and never lived in the US.

<comment><USER8> There are certainly propaganda machines on American TV, but mostly its just niche programming and reality tv. I think its more fair to see American TV as a waste of time.

</comment></comment></comment><comment><USER9> A screengrab, a photo of the editor, and a link to a previous NYT article, but no external links in the article itself to the Denver Post opinion [0].

NYT supports embedded tweets and photos - so it supports hypermedia, but does anyone know why there are no external hyperlinks inside articles like this one? Is the abandonment or rarity of external links the key to newspaper success?

[0] [https://www.denverpost.com/2018/04/06/as-vultures-circle- the...](https://www.denverpost.com/2018/04/06/as-vultures-circle-the-denver- post-must-be-saved/)

</comment><comment><USER10> Newspapers and magazines should come up with digital subscription syndicate that works like Netflix. You pay $10-15 per month and you can read any article anywhere. From the local paper to the Economist or Denver Post to other local papers and Playboy.

<comment><USER11> The problem is they each want to be this syndicate and don't want to give up control to others.

<comment><USER10> It would not be giving up control. Just billing differently.

They already have print syndication but it's backwards format in digital era. Instead of users determining what to read, editors pick news from the print syndication to republish.

</comment></comment></comment><comment><USER12> As much as I want to blame the hedge fund for running this paper into the the ground, the reality is the paper was financially dead long before the hedge fund came along. The hedge fund ultimately prolonged the paper's life. Short of a billionaire buying into it as a money losing affair, this paper's days are numbered.

<comment><USER13> I have two perspectives on this:

1\. From what I have found, the hedge fund involved is big into distressed assets. That could mean either trying to turn them around or finding a way to profit from the eventual house clearing. My guess is the deal was structured so they could come out ahead in either result.

2\. Being in/from Denver - the post has long just reposted or otherwise used alternate media to be their sources. Meaning their journalistic side has been spotty for quite some time.

<comment><USER14> as a Denver native, I completely agree with point 2. The post hasn't produced much quality-original content for quite some time. I can't think of any specific type of coverage where they provide the best available. They're beat on national news by national papers, local news by several of our TV stations, sports by blogs like BSN Denver, and so on. There's nothing right now that makes me say "I think they could turn it around".

</comment></comment></comment><comment><USER15> A Denver Post editorial[1] links to the Digital First Media Workers campaign site[2] which aims to "win fair contracts with wage increases for the nearly 1,000 Guild-represented employees of Digital First Media."

The campaign site tries to lay out in more detail(s) how Alden Global Capital is supposedly taking profits from DFM media properties. As majority shareholders, Alden might be in their rights to do as they see fit, but at least a pattern of behaviour being called out.

[1] [https://www.denverpost.com/2018/04/06/as-vultures-circle- the...](https://www.denverpost.com/2018/04/06/as-vultures-circle-the-denver- post-must-be-saved/)

[2] [https://dfmworkers.org/about/](https://dfmworkers.org/about/)

</comment><comment><USER16> The main problem with these newsgroups is that they have _so_many_ competitors. Most people don't want to and don't have to pay to get around a paywall because chances are someone else offers a similar article for free. Even for local news you have tv stations, print outlets, and npr. It is a tough business.

<comment><USER17> If you live in a major city, perhaps. I get the town newspaper and there is plenty of information published there that will never appear anywhere else.

<comment><USER18> Yup, same story here in Norway - the smaller a population the paper covers, the better it does (generally speaking)

I can think of a few reasons why -

a) Local papers have gotten much of their revenue from subscriptions for a long time; their customers are used to this model.

b) Their ads are local, targeting perhaps a few thousand people at most. That makes a paper (with high penetration and trust in the target audience) a viable alternative to Google ads.

c) They provide news which doesn't have a lot of alternative sources, while still being of interest to the readers. This encourages readers to keep subscribing (providing stable income), and the continuing subscriptions encourages advertisers to keep spending their ad dollars (or kroner, as it were) on the local paper.

<comment><USER17> Things are a little different here, in that many of the small-town (when I say small-town here I really mean everything other than major cities) papers are not doing that well and are owned by faraway, faceless national concerns. But the fact remains that there's not a good replacement (the candidates, I guess, are Patch and town Facebook groups).

<comment><USER19> I follow the local reporter on twitter, who sits through the entire city council meeting every time. Except for rare cases, I just don't see volunteers doing that, because it is a huge time commitment, and while some issues get people worked up, there is often quite a bit of minutiae (what kinds of signs are allowed is a recent example).

<comment><USER17> That and some of the remarks are, frankly, insipid.

</comment></comment></comment></comment></comment></comment><comment><USER20> weird how hedge funds are evil yet everyone's with bezos owning wapo with his monopoly and 300million dollar contract with the CIA

</comment><comment><USER21> Facebook and Google control close to 85% of the digital ad market. The rest 15% goes to the content creators and to the journalism. If Google and FB would not be able to invade everyone's privacy, that would create a level playing field for national, regional, and specialized media to prosper. But because they know who you are, they can display an ad for you on any platform, say Candy Crush Saga. If you are from Denver, here's an ad for a Denver event on your stupid game. So who needs journalism if an article in Denver Post is on par to Candy Crush? Who needs quality content on the internet? There is a reason why there is no VC investment in the content whatsoever. For this miserable situation thank Google and FB. And say goodbye to your privacy and to ad-supported quality content.

PS Number of countries are looking into the destruction of the news media by Google and FB. The most notable is Australian ACCC efforts. [https://www.accc.gov.au/media-release/accc-seeking-views- on-...](https://www.accc.gov.au/media-release/accc-seeking-views-on-news-and- digital-platforms-inquiry)

<comment><USER21> Newspapers had a double whammy. One was Craigslist. But Craigslist at least was a new technology compared to the newspaper classified pages. People could post ads on the spot for free. Better technology, fair competition.

But what Google and FB have done is to learn about people based on their interests, based on what pages they visited, what newspapers they read, and so forth. And then GoogleFacebook NSA-type duopoly weaponized that knowledge against the content creators, and it's now killing the journalism.

<comment><USER22> >the content creators, and it's now killing journalism.

Nah. What has happened is that newspapers have lost their monopoly.

In most markets, there was one newspaper and that newspaper could charge advertisers far in excess of their costs.

Might as well been printing money with the presses.

Now, their monopoly rents have gone away. Now, they have to earn their money!

Earning money is hard compared to having a monopoly.

<comment><USER23> So what's the future of how we keep up with goings-on near where we live, after local news dies? Random yapping bloggers with Google AdSense? (Talk about monopoly rents...)</comment></comment></comment></comment>


Take a Peek at How Widespread Spying Has Become - <AUTHOR> http://www.ritholtz.com/blog/2013/09/take-a-peek-at-how-widespread-spying-has-become/

<comment><USER2> Though the author may be right, there is lots of speculation here, and some incorrect facts, which unfortunately for me, limit the validity of these arguments.

"In early March, at a meeting for the CIA's venture capital firm In-Q-Tel, CIA Director David Petraeus..." David Patraeus left the CIA in November of 2012.

One of the interesting things I find about all of these stories is that in this case, it is actually US that is making these tools and giving the government these capabilities.

As much as we may rile against the government data-mining massive amounts of phone records, in the end, it is hackers who are writing the programs to actually get the data. None of this would be possible if we weren't complicit.

Is money the only reason these devs are taking this work? Or do you think it is more of a 'boil the frog' issue, where they do one small, somewhat questionable thing, then another, then another, until we get to the point where we don't know right from wrong anymore?</comment>


DigitalOcean API v2.0 Enters Public Beta - <AUTHOR> https://www.digitalocean.com/company/blog/api-v2-enters-public-beta/ <comment><USER2> This looks like a really nicely designed API when compared to many others, good job team!

However, it doesn't appear anywhere near "fully" RESTful as described. The docs even link to [http://en.wikipedia.org/wiki/Representational_state_transfer](http://en.wikipedia.org/wiki/Representational_state_transfer) \- but I can't see any HATEOAS style support in there (only looking at the docs, I haven't started actually using the API yet).

I realise this is a topic that gets brought up again and again, I have done this myself several times, but I don't think we're going to see a paradigm shift in ease of use of APIs, or in how consumers of APIs work, until lots of API providers are supporting HATEOAS.

Sure, it's not very well defined yet, but it will become better defined with each provider that implements it and builds on what others are doing.

</comment><comment><USER3> The v2 API is a huge improvement, great work!

If you're in need of a Ruby client, check out barge: [https://github.com/boats/barge](https://github.com/boats/barge).

Additionally, Tugboat[1] will be moving from my github account over to the 'boats' org and using the new API. If you're interested in helping with an existing project (such as Tugboat or Barge), or a new one, please let me know!

[1]: [https://github.com/pearkes/tugboat](https://github.com/pearkes/tugboat)

<comment><USER4> Tugboat is a great tool!

We're trying to collect clients using APIv2 over on the community site. Barge is already listed:

[https://www.digitalocean.com/community/questions/what- librar...](https://www.digitalocean.com/community/questions/what-libraries- and-wrappers-are-there-for-digitalocean-s-apiv2)

</comment></comment><comment><USER5> Great to see an API improvement for DO! But at the same time, I wish they will provide a few more base features (at a price of course) like an equivalent of S3, EBS and load balancing. With at least those services in place, I will most likely start moving a few apps on DO (yes I know I can use S3 but you get the idea).

<comment><USER6> Tbh, given DO's price point, I think EBS would be more support headache than its worth.

Cloudfront & S3 [or equiv] you can already get elsewhere and it doesn't really impact the setup.

DO really, really badly needs highly available, multi-datacenter load balancers. Without highly available load balancing [even in-DC would be good enough] where you can failover the IPs from Load Balancer A to B...

I just don't see it moving outside of the hobby/staging/etc space. Projects that you can afford downtime on.

<comment><USER7> I have a handful of sites that are more than just hobby sites, but the number of 9's in the SLA won't affect the bottom line at all. 5 DO droplets = $25 / month makes significantly more sense in this case than paying over $150 for the equivalent at AWS.

And I think this use is a large enough market for DO to make a fortune.

<comment><USER8> Sure, but I'm willing to bet that if DO offered failover, you'd be willing to pay them more to take advantage of it. Perhaps not a lot more, but it's money they're leaving on the table.

I do think that offering IP failover would be a much better way for DO to pick up extra revenue in the future than offering a competitor to S3 or EBS or Cloudfront or whatever.

</comment></comment></comment></comment><comment><USER9> I just wish there was a way of letting multiple people log into the same account without sharing credentials.

<comment><USER10> You can generate personal OAuth tokens and let them use the API.

</comment></comment><comment><USER11> No HTTP PATCH support? Makes me a sad panda. PATCH > PUT.

<comment><USER10> It originally had PATCH in the design. I think it was a limitation of our tooling that made us reconsider. And that PUT was slightly more familiar for novice users. At the end of the day ... it doesn't matter. Either way is a huge improvement from all GET.

<comment><USER11> Totally agreed, but for us that also write and consume RESTful services, PATCH is the best way to prevent race conditions when you have multiple things updating at the same time. That and as a purist, I like the idea of updating the minimal amount vs the entire object all at once.

Regardless, this is a HUGE improvement, so nice work! Oh and please keep the interesting projects coming on github. I'm a fan of the docker + consul integration you've been working on.

</comment></comment></comment><comment><USER12> Good! Looks good and was a MUCH needed update. Their last version was a tad....unusable at times and lacked some much needed features. Glad to see an upgrade.</comment>