Sony: All personal data stolen from PSN - <AUTHOR> http://blog.us.playstation.com/2011/04/26/update-on-playstation-network-and-qriocity/ <comment><USER4> I wonder how many times a company can install trojans on your computer, destroy your OS's security, secretly watch all your actions, then proceed to not properly protect your data when you voluntarily give it to them...before going out of business.

Sony's size and momentum must be pretty crazy. Or maybe it's our society. I just can't imagine a small record store in the 1960s, after being caught spying through the bedroom windows of its customers, _ever_ staying in business.

I feel terrible for anyone caught in this. But maybe, just maybe, Sony isn't the company to do business with anymore?

<comment><USER5> Don't read this as a defense of the company, but there hasn't really been a single, monolithic Sony for decades. Sony Music Entertainment, perpetrators of 2005's rootkit debacle, is pretty far removed from Sony Computer Entertainment, the division responsible for Playstation. Sony Electronics, makers of TVs, home theater systems, and Walkmans, is another silo, as is Sony Pictures.

Of course, every act of incompetence under the Sony name tarnishes that name, and in the marketplace, that's ultimately all that matters.

<comment><USER6> There have been rumors that Sony Music/Pictures has "oh no, piracy!" veto power over the rest of Sony, though. Either that or every division of Sony happens to be really DRM-happy.

<comment><USER7> Sony Music's meddling is the reason Sony failed to make a successful Mp3 player, all the more remarkable because Sony created the individual portable music market and dominated it with the Walkman.

<comment><USER8> Not only that, but they're responsible for the Minidisc's failure. That could have been a really nice format, but they had to slap a bunch of restrictions on it.

<comment><USER9> Not only the DRM restrictions, but that they limited manufacturing licenses to other companies. MinkDiscs are the perfect size and a little more durable (scratch resistent) imo. It's a shame CD's won out.

</comment></comment></comment></comment></comment></comment><comment><USER10> This is a much much bigger deal than the Gawker security breach. Sony had substantially more information on its users than Gawker could ever hope to dream of. Specifically information on real names, addresses, and potentially credit cards.

This is a big F'N deal and I wouldn't be surprised if it cost Sony more than Microsoft's infamous 1 billion dollar write-down with the Xbox 360's Red Ring of Death.

I don't think this will kill PSN or the PS3, but it's going to significantly dent things. I'm curious to see how much media attention this gets and if we'll see a macro shift towards the Xbox 360 and Wii.

If I was Nintendo and particularly evil I would leverage this opportunity to tout the new system and emphasize the cutting-edge online modes with rock solid security. And MS can also talk about their great track record in the online world.

<comment><USER11> "I wouldn't be surprised if it cost Sony more than Microsoft's infamous 1 billion dollar write-down with the Xbox 360's Red Ring of Death."

Banks, colleges, hospitals, and credit card processors do this all the time, and it doesn't cost them anywhere near a billion dollars despite the fact that they have vastly more personal information. Sure they usually only have a few hundred thousand records and not a few million, but even still the idea that this is going to cost them a billion dollars is absurd.

<comment><USER12> Numbers I've heard floated for leaks on the smaller scale are around $15-20 per person for post-leak mitigation and damages, which could push near $1b if the same per-person cost held with this size leak (which it might not). When my university had some data stolen, their lawyers advised them to buy everyone a year of some identity-theft insurance/monitoring package, which I believe cost them around $10 per person just for that.

<comment><USER13> Monoprice did the same thing when they were hacked last year. Two months after it happened, I got a letter from them with a few papers describing the identity theft monitoring service I would receive for a year.

</comment></comment></comment></comment><comment><USER14> There were sixty million[0] PSN accounts. This is impressive, and amounts to (judging by a quick search) the largest-scale ID (and possibly credit-card) theft ever [Not so, see child comment]. Not even factoring in credit card details, the usernames, emails, addresses, ages, passwords, mother's maiden names, favourite pets, of sixty million people is worth a hell of a lot.

I have to wonder how much data that is, in terms of storage. How could you even take that without someone noticing?

Hats off to whoever it was. Now, I'm off to change my passwords. Thank Christ I had the sense not to use a credit card to buy from PSN.

[0] [http://www.derangedshaman.com/2011/01/06/sonys-60-million- ps...](http://www.derangedshaman.com/2011/01/06/sonys-60-million-psn-users- means-zero-zilch-nada/)

[edit] On a related note, paypal refuses to let my change my password to something longer than 20 characters - or have spaces in my password. Why is this the case? Surely the only thing that an upper limit on the length of a password does is help the attacker.

<comment><USER15> Overestimating 100k per user, it would only be 6 terabytes. And all those low- entropy passwords etc should compress quite well.

<comment><USER16> They would only compress well if you stored them in plaintext...

</comment></comment></comment><comment><USER17> [http://psx-scene.com/forums/f177/sony-has-been-bad-boy-ridic...](http://psx- scene.com/forums/f177/sony-has-been-bad-boy-ridiculous-levels-spying-81093/)

"A well known hacker i don't want to reveal here had all the Sony PlayStation Network functions 100% decrypted as well as providing some nice info about how Sony dealing with PSN members privacy in their online servers.

Apparently, Sony server gathered everything they can from the PSN connected PS3 console. When i said everything, i meant it. Here, i make all the list of what they squeezed from the IRC chat logs conversation between the hackers.

 _Sony monitors all messages over PSN._ All connected devices return values sent to Sony server returns TV, Firmware version, Firmware type, Console model _They also collects data in your USB attached device._ Credit card sent as plain text, example: creditCard.paymentMethodId=VISA&creditCard.holderN ame=Max&creditCard.cardNumber=4558254723658741&cre ditCard.expireYear=2012&creditCard.expireMonth=2&c reditCard.securityCode=214&creditCard.address.addr ess1=example street%2024%20&creditCard.address.city=city1%20&cr editCard.address.province=abc%20&creditCard.addres s.postalCode=12345%20 *The best part of all, the list is stored online and updated when u login PSN and random.

But, that's not all, with the PSN functions fully decrypted, this hacker can use the function to get all games, DLC, you name it, from PSN store without paying anything."

<comment><USER18> > Credit card sent as plain text

This was debunked. It's encrypted on the wire.

<comment><USER19> What's your source on that?

<comment><USER18> It's talked about right in these very comments: <http://news.ycombinator.com/item?id=2487412>

The data is POSTed over SSL. C'mon, do you _really_ think Sony sends credit card data across the wire in plaintext? If so, it would have been discovered the day the PS3 launched, like five years ago. And, its discovery wouldn't have required any system hacking, as described above. Is it amateur hour here?

</comment></comment></comment></comment><comment><USER20> FTA: _we believe that an unauthorized person has obtained the following information that you provided: ...PlayStation Network/Qriocity password and login..._

I'm curious if this means they store everyone's password in plain-text, or if by "password" they really mean a hash of some sort.

<comment><USER21> Frankly I'm more concerned with their words about changing credit cards if you've made a purchase through PSN. This seems to be an admission that they were storing CC#'s in plain text.

<comment><USER22> How do you use stored credit card info if the cc# is not stored?

Unlike passwords, the encryption for the cc#s has to be reversible. That's part of the reason why they introduced CVCs, right?

<comment><USER23> You could at least have them encrypted on disk with a key only stored in memory, i.e.: when the system is turned on. Alternatively a dedicated crypo device where you feed it cipher text and it gives you plain text would also help as the attack wouldn't be able to get the key (even if they have the physical box (for good crypto devices))

While only marginally better depending on the type of attack and permissions gained by the attacker, if all they got was static data on disk, then it would be secure.

<comment><USER24> And what if that server needs to be rebooted some day? What if there's a hardware failure and it has to be powered off?

Something as big as PSN has multiple servers reading the same DB and must be able to tolerate failures without forcing everyone to re-enter their CC #. The keys must be stored persistently somewhere.

<comment><USER25> What we do where I work is take the newly generated key whenever we key or rekey the system, split it into multiple pieces using Shamir's secret sharing algorithm, and those pieces are distributed to several people.

Whenever the server needs to be started, two of those people must enter their key shares. That enables the server to reconstruct the key, which is then stored in memory.

</comment></comment></comment></comment></comment></comment><comment><USER26> This seems like a really big argument for never allowing your data to be stored by a 3rd party.

Does anyone see any reason why these companies should do anything other than store the data locally on your system, encrypted/obfuscated, and then only ever send once, via encrypted connection, and then immediately delete the info remotely?

I mean, if someone breaks in to my house and steals my PS3, they already have access to all of that information.

<comment><USER27> Much of ecommerce would go down the drain, if they got rid of remote storage of your details. No recurring billing, no "One-Click", no address books, etc...

<comment><USER12> It should at least be an _option_ for me not to store it, if I prefer not to use "one-click" and similar features. I understand why stores prefer to save the information without giving me a choice (reduces friction for future purchases), but I'm not sure that's a good enough reason given the prevailing security track records.

Either that, or perhaps there could be statutory penalties for data breaches. For example, if there was mandatory compensation of, say, $100/person for a data breach, companies might be incentivized to better think about whether they really need to store this data, and whether they're storing it safely.

<comment><USER28> Online retailers who handle their own CC processing tend to keep credit card information around if only for fraud/chargeback tracking in the future - <USER2> online opens you up to massive abuse if you don't keep it in check.

A big player like sony should have been complying with PCI standards - <USER3> from what I've seen, that's not so difficult to pass and then forget about - people take shortcuts - and how many companies out there have ever had their processing revoked for NOT complying with PCI? That would be an interesting statistic.

<comment><USER27> From my experience, PCI compliance does not require that you have everything perfect, as long as you have a plan to fix your deficiencies.

And as an employee at a couple of PCI compliant shops, I can attest that even full PCI compliance still leaves a lot of holes (enough that some organizations have formed their own compliance exams above and beyond PCI).

</comment></comment></comment></comment></comment><comment><USER29> Holy Cow! This has to be one of the most serious breaches I remember in recent times. While I dont work in security and my security foo is weak it appears that they did not have a strong layered security apparatus in place? Is it just a coincidence that this breach and geohotz exploit happened around the same time?

<comment><USER30> It really looks like the PSN architecture assumed that the clients were trustworthy. If so, that's an epic Security 101 fail.

<comment><USER31> And they used the same servers for development as for production. Isn't that non-PCI-compliant?

<comment> brown9-2 What is the source for the claim in your first question? I don't see this mentioned in the linked post.

<comment><USER31> I got this link from Slashdot:

[http://www.reddit.com/comments/gx6o4/im_a_moderator_over_at_...](http://www.reddit.com/comments/gx6o4/im_a_moderator_over_at_psxscenecom_the_real/)

But don't hold that against me. :-)

I clicked around a bit in the linked psx-scene forums and it looked like there was a decent basis for it.

</comment></comment></comment></comment></comment><comment><USER32> So it is as bad as we feared. The only silver lining I can see is that Sony made the difficult business decision to turn off the network until they were sure it was secure. While that doesn't make me feel better as a PSN user I do respect their honesty and commitment to fixing it.

Time to get a new identity! =)

<comment><USER33> _Time to get a new identity! =)_

That's what I was thinking: in most cases of user accounts being compromised, the solution is "change your passwords on this and other sites". Here you need to change your birthday, cancel your credit card, move out, change your name… kind of a hassle.

<comment><USER34> no problem!

<http://www.fakenamegenerator.com/>

<comment><USER35> How do they claim to own the MX for example.com? Aren't the example.* domains supposed to be reserved?

<comment><USER36> From the "click here to use it" page: "Fake Mail Generator changes the domain frequently in order to prevent the address from being banned, a problem which plagues other disposable email services."

Sounds like they added "example.com" into the list by mistake... It has no MX from what I can tell.

</comment></comment></comment></comment></comment><comment><USER37> _These malicious actions have also had an impact on your ability to enjoy..._

Interesting. Is it not fair to also say the _negligent_ actions that made these malicious ones _possible_ had an impact?

I'm completely sick of the way these press releases sound.

<comment><USER38> Reminds me of 9/11 and no one in government taking any responsibility. Except Richard Clarke.

</comment></comment><comment><USER39> I'm disappointed but not surprised. When I had to change my password a few months ago on the Sony developer's network site I was told that my new password was too similar to the last ones. I was wondering how they knew that, aside from storing the passwords in plain-text, something I'd assume they'd be too smart to do.

I guess I gave them too much credit.

<comment><USER40> Genuine Question: They let you change your password without having you supply the old one?

<comment><USER23> Password reset link?

<comment><USER40> That might explain it.

</comment></comment></comment></comment><comment><USER41> "Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information that you provided: ... PlayStation Network/Qriocity password and login,"

Seriously? Even Sony is keeping passwords in plaintext? There wasn't a single competent person involved in the design of PSN who might have mentioned that was a terrible idea?

<comment><USER42> It could be that they simply obtained a hash and salt, from which it is still possible to obtain plaintext.

</comment></comment><comment><USER43> Notice how they never apologize? The closest thing to apology, but it's not an apology, is:

> "We thank you for your patience as we complete our investigation of this > incident, and we regret any inconvenience."

Sony apologizes only to Chuck Norris.

<comment><USER44> The Japanese announcement is full of apology:

"2011年4月21日よりPlayStation®NetworkおよびQriocity™の障害が継続しており、お客様および関係各位に多大なるご迷惑をおかけしておりますことを深くお詫び申しあげます。"

Which is a polite and flowery way of apologizing for the ongoing interruption of service.

<http://cdn.jp.playstation.com/msg/sp_20110427_psn.html>

<comment><USER43> True, they are different probably because this (the Japanese announcement) is from Sony Corporation, and the link in English is probably from Sony Corporation of America.

<comment><USER45> In Japan lawsuits are less common, and an apology is expected even if it's not your fault, so it shouldn't hurt their legal defense if they apologize. I think it won't be interpreted as an admission of guilt like it could be in America.

</comment></comment></comment></comment><comment><USER46> Does anyone else find it odd that they "strongly recommend that you log on and change your password" instead of just force-resetting everyone's password and sending them an email with an activation link? Out of 60M subscribers, I'm certain that a large proportion will never see this message.

<comment><USER47> Agreed, not only that but you _can't even login right now_ , so in another week all 60M users are supposed to remember to go and futz around with the PS3's clunky account UI to change their password?

Personally, I have a couple passwords in use for low-risk services (like PSN) and just went and changed all my _other_ passwords :)

</comment></comment><comment><USER48> This is unreal. What bothers me the most, is that when this happened to me one time before, that particular company paid for a year of credit monitoring services.

In this case, Sony is too cheap to do even that, pointing you towards where you could download your credit report online. Ridiculous.

<comment><USER31> It's too soon. I don't think anyone knows what Sony's going to end up paying here (Sony included).

</comment></comment><comment><USER49> What the hell Sony? I just tried logging into <http://us.playstation.com/psn/playstation-home/> the SSL connection to <https://store.playstation.com> gave Error code: sec_error_unknown_issuer.

It's like you're actively trying to make me never trust you again.

<comment><USER31> Looks OK in my Firefox, says it's signed by Comodo UTN-USERFirst-Hardware.

I am not making this up.

<comment><USER50> Isn't Comodo the CA that was compromised recently?

<comment><USER31> Yep, through the usertrust sub-CA even.

[https://blog.torproject.org/blog/detecting-certificate- autho...](https://blog.torproject.org/blog/detecting-certificate-authority- compromises-and-web-browser-collusion)

</comment></comment></comment></comment><comment><USER29> Funnily enough the stock doesnt seem to have moved at all as a result of this news - <http://www.google.com/finance?q=sne>

<comment><USER51> Funny, Jim Cramer's thestreet.com upgraded it from hold to buy on the 25th.

[http://www.thestreet.com/story/11093134/1/sony- corporation-s...](http://www.thestreet.com/story/11093134/1/sony-corporation- stock-upgraded-sne.html)

<comment><USER51> I suspect Sony's stock is getting hammered tomorrow, and the lack official email to PSN users,makes me think it's gonna be more bad news.

</comment></comment></comment><comment><USER52> How could they have gained access to passwords? Do they mean, rather, gained access to your secure password hash, or did they simply store passwords in an unencrypted format? Being a member of PSN, this has me concerned. I'm making it a point to change all of my security questions and passwords all throughout all websites I use.

<comment><USER31> Not as easy as it sounds. You wouldn't believe the reaction I got from Mom when I asked her to change her maiden name.

<comment><USER15> Makes me wonder how many people just punch in "Maiden".

Of course those security questions are nearly useless anyway.

</comment></comment></comment><comment><USER53> So how do we sign up for the class action lawsuit?

<comment><USER54> You can do it right here. All you need is what, 30 people to get the class action status.

</comment></comment><comment><USER55> I can't even begin to fathom the magnitude of this considering how many people likely use the same login credentials for all of their sites.

The problem you run into is that communicating both the nature of the breach and convincing people to respond accordingly is incredibly hard.

This will continue to happen across many sites. I think after enough of these breaches, though, people will start to think about the protection of their online identities a lot differently, which is good, albeit at a painful cost.

<comment><USER56> This is a good time to purchase a password-vault app - AND USE IT!

<comment><USER56> Okay, I see KeePass and Password Gorilla recommended here in the other replies. I use KeePass actually, and I've seen PGorilla. But I'd like something that is integrated with the iPhone - and works with Linux and Windows too.

There's an app called Strip that looks pretty good. I'm listening to other suggestions.

<comment><USER57> I've used LastPass since the Gawker breach. It works with iOS and automatically syncs password databases across all browsers and mobile devices. I've been very happy with it thus far.

</comment></comment></comment></comment><comment><USER58> Interesting fact for the day: 75 million accounts is a new world record for information theft.

</comment><comment><USER59> It's too bad we don't know what's going on inside the sausage factory. It'd make for a very interesting post-mortem.

</comment><comment><AUTHOR> Giant Bomb is reporting that passwords are supposedly secure (of course, "no way" is clearly false), so I'm guessing there's at least a decent salted hash: [http://www.giantbomb.com/news/good-news-psn-back-maybe- withi...](http://www.giantbomb.com/news/good-news-psn-back-maybe-within-a- week-bad-news-everything-else-updated/3084/)

<comment><USER60> Salt is bad for you: <http://news.ycombinator.com/item?id=1209254>

<comment><USER24> Salted hashes are better than unsalted hashes.

<comment><USER60> Against a GPU that can calculate five million hashes per _second_ your salt isn't worth the paper it's printed on.

<comment><USER61> I don't know about you, but personally I think "crack one person's password in one day" is a much better situation than "crack everyone's password in one day".

</comment></comment></comment></comment></comment><comment><USER62> Wow this sounds really really bad. As much as I dislike sony's actions in the Geohot case, and as much as "this is what you get for failing at security", I feel pretty bad for them right now (and even worse for all of their customers)

>To protect against possible identity theft or other financial loss, we encourage you to remain vigilant, to review your account statements and to monitor your credit reports.

>We have also provided names and contact information for the three major U.S. credit bureaus below. At no charge, U.S. residents can have these credit bureaus place a "fraud alert" on your file that alerts creditors to take additional steps to verify your identity prior to granting credit in your name.

<comment><USER63> I fail to see why Sony should be pitied, unless the details of the attack are laid out, and Sony shows that it was following good security practice.

I see neither disclosure happening any time soon.

<comment><USER62> It's probably too much of my mother and not enough of my father, but I can't stand watching people fail, no matter how much I hate them.

I _hate_ sony, but I still feel bad for them.

</comment></comment></comment><comment><USER64> They say passwords were stolen. This must mean they are not properly hashing passwords with salts stored outside of the database.

How many times does this have to happen before people realize that passwords are never to be stored in plaintext? The only exception is a client-side program that needs to log you in and in an ideal world that would be handled by a Kerberos-like ticket system.

<comment><USER31> _They say passwords were stolen. This must mean they are not properly hashing passwords with salts stored outside of the database._

It could also mean that the attacker was in a position to observe the plaintext supplied by the user after it was decrypted (from SSL) but before it was authenticated (with a password hash algorithm).

Or it could be that they're just not being too particular about the details, on the side of being overly conservative.

</comment></comment><comment><USER65> I think that what we're seeing here is evidence that there's just too many ways to screw up handling personal information on line. The sane stance is to now assume that any profile you provide to any website will eventually become public, and proceed accordingly.

</comment><comment><USER66> I like the first comment on the post:

"Hope it come back quickly"

And ultimately that's what people care about, that information most of them already share it via Facebook for FREE, funny thing, is that we already get spam deliver to our homes in shape of publicity.

About the credit cards, these days most credit card issuers have pretty good security so they'll let you know and block your credit card if people used it in a weird way and believe me, I was a "victim" a couple of times already and it works very well.

I join the 1st commenter. I wont be changing my credit cards because of this and I just care about playing my online games again... really I already got bored of Gran Turismo, Final Fantasy offline ;-).

</comment><comment><USER67> This brings back memories of the Gawker breach, but Sony seemed so much more legitimate. It can happen to the best of companies, I guess. This is the worst security hack I've ever witnessed.

This spells for Sony, yes, but even worse for the uncountable people whose credit card numbers just got nabbed. One hacker on the loose...

The worst part is that this public breach is only a single event. All the companies that have our information _could_ be hacked and Sony is only a visible example. It's similar to the BP oil spill: what other oil companies weren't running tight rigs? The disasters happened to BP and Sony, yes, but it is a reflection on their industries.

</comment><comment><USER68> While it's a big deal, let's be reasonable with our expectations of privacy.

I know my street addresses, home and work, my e-mail addresses, significant URLs, credit cards, expired credit cards, buying habits, posts, messages, family relationships (mother, wife, ex-wife, kids, ex-girlfriends) etc are stored in a lot (probably more than a hundred) places. I have no expectation all that data will be kept secret for any length of time. I seriously doubt much of that data could be kept form a dedicated googler with lots of free time, much less from a determined criminal who wanted that data.

</comment><comment><USER69> This appears to also have affected Sony in Japan, as well.

It is interesting how this announcement differs from the Japanese announcement[0]. Japanese people are so paranoid about their identity that this cannot go well for Sony in Japan.

It does not seem like Sony is preparing people for any sort of identity theft in Japan other than calling the card companies. They apologized and remarked at how they are gearing-up to better protect their users when the service reopens.

[0] <http://cdn.jp.playstation.com/msg/sp_20110427_psn.html>

</comment><comment><USER70> Any idea who's behind the data theft? I'm much more interested in that...

<comment><USER71> The REAL anonymous.

<comment><USER72> Well any criminal would not want to be identified.

</comment></comment></comment><comment><USER73> Frankly I'm in shock. That a company as large and experienced as Sony would allow this to happen, well it beggars belief. The contempt shown to customers, not just by Sony but by other large tech companies (I'm looking at you Apple) is disgusting.

I choose not to be part of Facebook because I'd rather they didn't know every detail of my life. Now I have to consider if I want to use products from Sony because of concerns that they can't even protect my private data, which they force me to give them in order to use their services.

Unbafuckinglievable.

</comment><comment><USER74> For many folk who may not use PSN much or recently, the first concern I imagine would be to recall whether they ever provided Sony with the most sensitive things on that list.

A quick gmail search tells me that they had my mailing address and full name, but I have no idea if I ever gave them my CC or DOB or SSN or Gitmo prisoner bar code or whatever else.

I'm glad I use lastpass because I have a nice list of sites to update password info, but I imagine this process is going to take quite a while. Too bad I repeated that password so many times.

</comment><comment><USER75> I haven't seen this point mentioned anywhere yet, but...

How many of you are willing to bet Sony will use the intrusion as an argument for material damages in court against GeoHot, somehow linking his exploit with the mode of intrusion?

This is pure speculation of course. But I'm willing to bet serious money that Sony's "outside, recognized security firm" has been "requested (hint-hint, wink-wink)" to be on special lookout for any sign the exploit was a vector for the intrusion.

</comment><comment><USER76> > For your security, we encourage you to be especially aware of email, > telephone, and postal mail scams that ask for personal or sensitive > information.

Am I the only one reacting on this? It's like they make it sound like YOU need to take care when it's they are the one to blame.

Same with Skype on Android when they sent you an messaging telling you that YOU should be careful to install software because they have made a security hole for that software.

<comment><USER77> I think what they mean is that the information harvested may now be used to perpetrate such scams - imagine receiving an email specifically addressed to you, containing information that you thought only Sony knew about. Would be pretty convincing (and people fall for less convincing emails all the time). Or a phone call? "Hi it's Bob from PSN here, we need to update your account with new card details following the recent security breach" etc.

</comment></comment><comment><USER78> This is case-in-point for centralized log-archival-and-analysis tools like SenSage. No matter how secure you make your infrastructure, in situations like this you want evidence of all activity on your networks, computers, DB's, app servers, apps, etc. Storing log data related to this activity can consume petabytes over a multi-year span.

I don't know what kind of forensic tools Sony's using, hopefully they have something like SenSage.

</comment><comment><USER79> While I don't know the details of how this happened, it's a sure fire bet that they were not doing something right when it came to securing their infrastructure. How many times have we heard of big name companies running un- patched operating systems and SQL databases or even weak passwords? From the consumer end, this really sucks. Especially if their personal data was compromised.

</comment><comment><USER80> I'm just glad I got my Steam PC code from my Portal 2 disc activated just before PSN went offline.

</comment><comment><USER81> I haven't really been following this but there have been rumblings all week that a hacked firmware was released that allowed anyone who installed it, and twiddled with some other things, access to the PSN development and testing network. Anyone know more?

<comment><USER82> There was a reddit thread on this that explains the gist of it: <http://news.ycombinator.com/item?id=2482679>.

</comment></comment><comment><USER83> "We greatly appreciate your patience, understanding and goodwill" - I'm all out of good will for Sony. I already canceled the credit card I had on file with them, hopefully nothing happens with my personal info.

</comment><comment><USER84> an interesting update: [http://torrentfreak.com/playstation-network-shut-down- to-end...](http://torrentfreak.com/playstation-network-shut-down-to-end- piracy-free-for- all-110426/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Torrentfreak+%28Torrentfreak%29)

</comment><comment><USER85> Any idea if they properly Salted/Hashed the passwords, or if they just stored everything in the plain?

</comment><comment><USER86> Well, seeing it from a positive perspective, I did (finally) get the password changed on some sites =)

</comment><comment><USER87> Sad day, what's next for playstation owners Sony?

<comment><USER31> Ordinarily I'd just say reformat it and install Linux, but....

<comment><USER87> Linux installation is easy piece of cake to HN audience, but nightmare to normal people.

<comment><USER88> Sony yanked linux support from PS3s after thousands of users had already paid for it. Tally that in the "Reasons to no longer support Sony" column.

<comment><USER70> Somewhat untrue. You could still use linux, but just not in combination with continued (free) PSN access.

<comment><USER31> That was the theory anyway. Now we don't have PSN access either.

We kept the family PS3 patched-up in good faith. Is there now a reasonable way for me to install Linux?

Seriously, the kids are probably moving to Xbox and I have some supercomputing I'd like to do.

<comment><USER89> I'd like to know this too... I assume that now the keys have been discovered, PS3 should be fully retaskable?

</comment></comment></comment></comment></comment></comment></comment><comment><USER90> Thats ridiculous. Sony should feel in debt to their customers for such a security breach. I hope they catch the people responsible and give them jobs!

</comment><comment><USER91> Thanks for waiting a week to tell me my credit card info has been stolen Sony.

I am not a big fan of MSFT usually, but the next time I am buying a console I'm not buying a PS4.

<comment><USER92> The article says there is no evidence credit card information was accessed.

<comment><USER93> It also says it might have been, which is much more worrying to me than the lack of evidence; because before this sony had no evidence that their network was compromised.

This whole thing seems like a great example of incompetence.

<comment><USER92> This compromise happened DAYS ago. Google was hacked by China in mid-December 2009 they didn't publicly announce what happened until January 12, 2010. What started to look like a harmless intrusion turned into compromised gmail accounts turned into a highly sophisticated attack on Chinese dissidents turned into a full scale assault on their infrastructure. People were still figuring out the extent of that attack a couple months later.

While this is a bad security breach, if you follow security news at all you'd know computer security is a joke. The Rustock botnet operated for FIVE years with impunity on as many as 2.4 million rooted machines. People didn't even know they were owned; their computers worked perfectly fine like nothing was wrong. Every system at pwn2own gets owned in seconds and you can bet the black hats were there first. Everyone gets compromised. The only thing stopping a crippling cyber attack is whether someone feels it is beneficial to do so.

I do not especially fault Sony for this. Google gets hacked. Microsoft gets hacked. The NSA gets hacked. The DoD gets hacked. JP Morgan Chase gets hacked. Just add another multi-national to the list. It's a systemic problem that nobody really cares enough about nor can we do much about it if we did care.

EDIT: Just to give you another idea of how screwed we are from a security perspective. To paraphrase George Carlin[1], some programmers are really stupid. Did you ever notice how much stupid software you see? Think of how stupid the average programmer is, and realize half the programmers are stupider than that. And that bottom half? They probably work in IT, managing over engineered address books and accounting ledgers of the world while smarter people worry about cooler problems.

[1] <http://www.youtube.com/watch?v=8rh6qqsmxNs>

<comment><USER94> Being a security guy, I agree that no amount of planning and intelligence will keep out a significantly determined attacker. _However_ , this doesn't give you carte blanche to not think about security. All the evidence presented around this shows that they simply didn't make it difficult at all; as soon as the console fell, so did their system. They seem to have violated every rule in security. That is simply unacceptable.

It's one thing to be attacked by determined people and fail eventually -- given enough time, everyone does -- but it's a completely different matter to give the keys to the castle to anyone with a rooted PS3.

</comment></comment></comment></comment></comment><comment><USER95> Payback for GeoHot or what? Haven't heard anything about the source of the attack since the DDoS that Anonymous took credit for...

<comment><USER96> Anon actually didn't do the DDoS attack. From the press release-"For once we didn't do it"

[http://anonnews.org/?p=press&a=item&i=848](http://anonnews.org/?p=press&a=item&i=848)

<comment><USER97> Quoting Anonymous on their involvement is a moot point. The lack of hierarchy and completely radical differing opinions of members within the "group" allows for confusion and varying ideologies. Since a press release, in the mindset of Anon, is released by an individual or a group of individuals, they may not be aware that a separate member did perform the hack. In the end no one really knows until someone pretty much steps forward.

<comment><USER36> Quoting Anonymous on their involvement is a moot point.

a moot point? moot? really? i like your choice of words. Heh.

</comment></comment></comment></comment><comment><USER98> If someone has had their data stolen, are there any steps that they can take to ensure that they are not fleeced or does this mean that it's only a matter of time (or perhaps luck)?

<comment><USER6> Change your credit card number and password; everything else is information that is already known.

</comment></comment><comment><USER99> Japan Nuke Apology Two..same delayed response, same non-statement, same lack of transparency..

Where is Godzilla to stomp Sony's ass when we need him?

</comment><comment><USER100> Wait, "Password" was stolen? WTF they store unencrypted passwords?!?!?!!?! I sure hope they meant password hashes otherwise upset many people should be.

<comment><USER101> Even if hashes are stolen, you should consider the original password stolen as well, because it's only a matter of time and effort to brute force the original password from the hash. Even if you use a really good password with a really good hash (like bcrypt), it still doesn't mean that they can't find the password, just that it will take more time to do so.

<comment><USER102> A really good password with a really good hash takes more time for values of time exceeding far exceeding any human's lifespan.

Assuming a 10-character random alphanumeric, that'd be 62¹⁰ possibilities (26 uppercase + 26 lowercase + 10 numbers = 62). Even given an insanely fast brcypt of 1µs, that's over thirteen thousand years to get to a 50% chance.

Now, if your hash is a bad one, say MD5, then you're in trouble. GPUs could brute force that ten-character password within a year.

</comment></comment></comment><comment><USER103> "Wait, ENCRYPT credit numbers? I thought you said decrypt!"

</comment><comment><USER104> Poor Sony.

</comment><comment><USER105> Damn it, Sony.

</comment><comment><USER84> I think a lot of us are missing the big picture; thankfully not Tgebbs (see comment 22).

</comment><comment><USER106> "+ OreoPoptart on April 26th, 2011 at 12:58 pm said: JUST STOP! FIX THE GOD DAMN PSN FIRST THEN POST THIS CRAP UP GEEZ"

Heh.

</comment><comment><USER107> We've seen several examples recently of Japanese corporate culture's secrecy and lack of candor. Toyota, TEPCO nuclear plant and now Sony same pattern of not wanting to admit to the problem. I wouldn't bet on their long term competitiveness.

<comment><USER6> I think corporate ass-covering is pretty pan-cultural. See RSA's recent "we're answering every question other than the one that everyone is asking" PR about the SecurID thing.

<comment><USER108> I know, there was a previous article on the cover-up culture that once made it to the top at HN.

<comment><USER109> For the lazy

<http://news.ycombinator.com/item?id=2088469></comment></comment></comment></comment>


Judge Says No One Is Confusing Apple's App Store and Amazon's Appstore - <AUTHOR> http://www.wired.com/gadgetlab/2013/01/apple-amazon-appstore-for-android/

<comment><USER2> If Apple is so worried, why didn't they name it the Apple Store? Honestly, some of this stuff is only designed for court cases. How about some real brand identity, like putting the Apple symbol on the iPad/iPhone button. Patenting ideas is just crazy. Here's an idea for the new Apple logo - a black rectangle. I'd recognize it...

<comment><USER3> To be fair, they already have an Apple Store: store.apple.com (it's marketed as "Apple Store"). Also, they do put a pretty prominent Apple logo on each device: notebooks with nothing but a glowing logo on the back, iPhones / iPads with a reflective metallic logo, heck, even the power chargers have an embossed logo on them.

I'm not sure whether Apple should be able to patent the name "App Store," but it certainly does raise a question of what a brand is. Surely, before the iPhone, people off the street would be confused by the term "App Store". Yet, after the iPhone (iOS >= 2), you could pull someone off the street and they would say something like "oh yeah, that's where you buy apps for the iPhone." So I don't think it's reasonable to dispute that Apple popularized the term "App Store," essentially invented it in the public eye. That said, it is a store to buy applications, which Apple did not invent, even in the public eye.

There are lots of terms / brands which encode the product in the name in a fairly obvious manner. Should American Airlines be allowed to use that as their brand? Or is it too generic, given that there are many airlines based in America? Should a brand like KitchenAid be able to patent their name? Or is it too obvious of a name, given that the company produces aids in the kitchen? Should uniqlo be able to patent the term heattech, or is it obvious given that it's a technology designed to preserve heat? It's a very difficult distinction to make, and I'm not sure which side is right.

<comment><USER4> Nitpick: these are all trademark issues, not patent issues.

Less of a nitpick: because these are trademark issues, the holders of the mark _must_ attempt to defend them, or they are lost. While I happen to agree with the judge and feel that App Store is too generic to be upheld as a trademark (and agree with you about Apple Store, though mostly because most of the products there are made by Apple, unlike the App Store), I don't at all blame them for going after Amazon here - and I say that as an AMZN shareholder (AAPL too). It's probably in Amazon's best interest to rename simply because App Store is so firmly associated with iOS, never mind shutting up the lawyers and letting both companies focus on more important stuff.

Interestingly, the article mentions this was a suit over false advertising and copyright. I don't know if its wrong or our court system is that backwards, since that's very clearly not the actual issue at hand here. But then again, most of the Apple/Samsung battle should have been waged trademark grounds rather than patents too (analogy: knock-off handbag manufacturers are sued by the original designers under trademark laws too, which makes sense when you consider the concept of a trademark)

<comment><USER5> >, the holders of the mark must attempt to defend them, or they are lost.

OTOH, a pretty good way to lose them is to sue people and have the case go against you.

<comment><USER6> You're not saying anything. If you don't sue, you lose them by default.

<comment><USER5> I guess I'm saying you shouldn't apply for dubious trademarks.

<comment><USER6> See my comment on company names like Buffer and Stripe

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Nor would you confuse "App Store" if it was on Apple or if it was on Amazon. It's short for Application Store, which it always has been - whether Apple would admit that or not.

I don't think "Candy Store" was ever copyrightable ...

<comment><USER8> That's a rather poor argument as you present no reason justifying when a shortened name cannot be protected by trademark law. What about these Fortune 500 companies?

      Tech Data (short for technical data)
      Computer Sciences
      Waste Management
      Genuine Parts
      Health Net (short for health network)
      Applied Materials
      Whole Foods

... and so on? Those are all pretty generic names. Some are short for something else; others are self-descriptive. Which of those should not exist as a trademark and why?

<comment><USER9> All of them. If you start protecting words in the English language it requires us to expand the language thus diminishing it's usefulness in future. Personally I would say any word that is in a dictionary should not be possible for a trademarked name. Words that are added after the company for instance Skyping as a term for making a VOIP call or Kleenex as a term for tissue should be allowed to keep the name but as soon as it is entered in the dictionary all other companies should be forbidden to use it.

<comment><USER10> Which dictionary? Who defines it? Who decides when Kleenex or App are to be included? Are words ever removed from that dictionary? What about foreign language dictionaries? What about foreign words transliterations to a different alphabet? What about made-up words that sound like an existing word with different spelling? Acronyms?

<comment><USER11> These questions are are pretty well answered by trademark law. Most of it boils down to a judge's decision, who, by the way, _can_ decide that a hereforeto novel term has become generic (much as Xerox, Kleenex, and Photoshop are in danger of becoming), hence why you see ridiculous efforts by companies with household names to prevent verbification of their names.

<comment><USER10> I know, I was challenging the idea that it should not be allowed to trademark words in "the dictionary". It's a judge decision, there is no formal list of disallowed words, and my point is that there can't be one, in the real world.

</comment></comment></comment></comment></comment></comment><comment><USER12> Does any one find it funny that Apple is more worried about a rival store selling android apps than Google is.

<comment><USER13> Android never used the word "App" in the name for their store. First it was "Android Market" and now it is "Play".

I think it is silly that Apple is attempting to "own" the word "App", but the fact that they went after Amazon and not Google has no larger meaning other than the fact that Amazon was using the term "app store" and Google wasn't.

<comment><USER14> I refer to all app stores in the generic form for this very reason. The more people that use the term generically, the quicker Apple will have it taken away.

</comment></comment></comment><comment><USER15> Let's not think about patent/trademark issue for a second.

It's ludicrous why Amazon would name its store to something already similar. Whether or not Apple 'owns' the name, App Store, why would a huge company, with a clear brand, names its store that will only lead to customer confusion.

Are they trying to prove a point? Google's Google Play gives it a clear distinction, it even adds it's own name to the name. Why doesn't Amazon do this?

Short of trying to prove a point and sticking it to Apple, I don't see any merit for Amazon (not to mention it came after Apple's App Store) in naming its store Appstore. (or maybe they lack creative marketers to come up with a clever name?)

<comment><USER16> App Store = Application Store

Where do you draw the line? It's a shorthand word for "application". They named it "Appstore" because it is a place to buy applications. Every company that wants to should be able to have an Appstore or App Store, it's far too generic!

</comment></comment><comment><USER17> I think the title is a little misleading. The article deals with the dismissal of the passing off claim which would be framed by Apple as a deliberate attempt by Amazon to pass off their own store as being related to Apple's.

I highly doubt that Apple's lawyers thought there was ever a chance that this claim would be successful but nevertheless, there is no harm in at least trying on ancillary claims, even for the purposes of acquiring leverage for settlement negotiations.

However, in any event, even in the absence of passing off, confusion could still arise as it doesn't require any deliberate intent as it is based on consumer perception rather than service provider intent.

I don't think there's any question here of the term 'App Store being distinctive in its own right. The question for the judge will be whether through usage of the term by Apple, it has acquired sufficient distinctiveness so that it serves as a unique identifier for Apple's store.

</comment><comment><USER18> No, the judge is WRONG. Apple is RIGHT. I got confused when I visited wwww.amazon.com I thought it was the apple store and opened up my itunes in vain.

I also tried visiting store.apple.com and thought it was the Amazon's store, because it had the word 'store' in it. So, Amazon should sue Apple too...

Just one conclusion - Fuck apple anyway.

</comment><comment><USER19> This ruling by the judge is disastrous. Do you have any idea how many Amazon Appstore apps I had purchased from my iPhone before I figured out the difference? I wasted sooooooo much money. None of them will even run on iOS!</comment>


North Korea Linked to Digital Attacks on Global Banks - <AUTHOR> http://mobile.nytimes.com/2016/05/27/business/dealbook/north-korea-linked-to-digital-thefts-from-global-banks.html?_r=0&referer=http://freerepublic.com/focus/f-news/3434335/posts <comment><USER2> This assertion has a Bacon Number of Three.

1\. The link between North Korea and the SWIFT attacks is contingent on the link between North Korea and Sony.

2\. The link between North Korea and Sony is based upon assertions by the US Executive branch under a theory that North Korea was motivated to attack Sony because of Seth Rogen Movie.

3\. Throw in Steve Carell and you're at Kevin Bacon [i.e. Rogen's Bacon number is two].</comment>


You Pay to Read Research You Fund. That's Ludicrous - <AUTHOR> http://www.wired.com/2016/04/stealing-publicly-funded-research-isnt-stealing/?mbid=psocial_techreview <comment><USER2> Submitted last week, extensive discussion (160 comments)

[https://news.ycombinator.com/item?id=11519421](https://news.ycombinator.com/item?id=11519421)</comment>


Ask HN: What do you do with your free tier or dirt-cheap VM? - <AUTHOR> <comment><USER2> Host [https://femto.pw](https://femto.pw), a free file uploading and downloading service.

<comment><USER3> What do you use for storage?

<comment><USER2> MinIO, a S3-compatible file store, running on top of a cluster of ZFS VMs. It just uses the available disk space from my other servers.

</comment></comment></comment><comment><USER4> Host my automated newsletter [http://metadigest.uzpg.me](http://metadigest.uzpg.me) and my blog [http://uzpg.me](http://uzpg.me)

</comment><comment><USER5> Host a personal site and use it as an arbitrary shell box from which to test network stuff. I also have it set up so I can route through it when traveling to avoid crappy captive portals and suspect networks.

</comment><comment><USER6> I use the Digital Ocean $5/month VM to self host my static website (generated via Hugo although I'm not thrilled with it) on Apache, run Grafana and an InfluxDB server and experiment with Unix.

<comment><USER7> Serious question: why not use github pages to run your static website?

</comment></comment><comment><USER8> Try one of the awesome-selfhosted solutions.</comment>


Show HN: A Simple Diff-Based Copyediting Tool - <AUTHOR> http://diffly.heroku.com/

<comment><AUTHOR> I seem to do a lot of copyediting these days (of friends' papers, application essays, stories, letters, and the like), and keep wishing there was a super- simple way to track my changes and present them to the writer in a visually intuitive way.

This "diffly" app is my first cut at a solution.

It uses Google's diff-match-patch to do the diff. There's no toolbar or lasso or any of that - comments use the Markdown hyperlink syntax, and insertions/deletions are tracked automatically.

<comment><USER2> Does Google Doc's revision history not provide this?

<comment><AUTHOR> Google Docs will show you a diff, but without your comments. They also don't have a live preview of what your changes will look like. It also takes a lot more clicks (and time) to generate the revision history.

The overall point being that Google Docs does a lot more than I need. YMMV.</comment></comment></comment>


NeverSeconds blogger Martha Payne 'banned' from taking school dinner photos - <AUTHOR> http://www.bbc.co.uk/news/uk-scotland-glasgow-west-18454800 <comment><USER2> This title is incorrect the story is that the ban was lifted.</comment>


The IRS has granted nonprofit status to a daily newspaper - <AUTHOR> https://www.niemanlab.org/2019/11/meet-the-salt-lake-tribune-501c3-the-irs-has-granted-nonprofit-status-to-a-daily-newspaper-for-the-first-time/ <comment><USER2> Just my two cents: I grew up in Utah and did my undergraduate degree there. The Salt Lake Tribune is a great newspaper (I subscribed while living in the state) and it has been rough watching them downsize and lose some great staff over recent years. I am very much of the opinion that good local journalism is a necessity for holding people accountable. For example: the work the Salt Lake Tribune received a Pulitzer for [0]. Anything to help good local journalism continue and survive is nothing but a win in my view.

[0] [https://www.sltrib.com/news/2017/05/07/salt-lake-tribune- win...](https://www.sltrib.com/news/2017/05/07/salt-lake-tribune-wins- pulitzer-for-campus-rape-coverage-praises-victims-for-sharing-their-stories/)

<comment><USER3> I'm still here and this is incredibly important for our community. The tribune is the only major news outlet not owned by the LDS church, and is an important tempering force. Over the years they've given up some of their autonomy due to joint operating agreements with LDS Church owned Desert News, but without them salt lake would be a large metro without a non-church controlled newspaper. Which is really strange to write down.

Salt lake looks poised to elect its first LDS mayor in something like 50 years today which I think speaks volumes to the weakening of slc secular news sources. One could argue that it's due to the modernization of the church on some key issues, but based on the coverage of the candidates, I'm not so sure.

On a national scale, I'm really hopeful this trend continues. Newspapers do incredibly important work on "boring" local issues that no one else is able to do.

<comment><USER4> > The tribune is the only major news outlet not owned by the LDS church, and > is an important tempering force.

In Utah. Let's make sure that distinction is clear.

<comment><USER5> Do you think people are confused that most major metropolitan areas are not controlled by religious groups, or that Salt Lake City is in Utah?

<comment><USER6> In my experience, most people outside of the USA are not very familiar with anything between NY and LA. Usually I have to tell people, I live in Oregon which is north of California. Oh, California, yes we've heard of California. I doubt the majority of the world has even heard of Utah or has any concept of where it is or that SLC is the capital of the state.

<comment><USER7> Utah... is that the place with the large rocks in the desert? Lots of mormons? It shows up from time to time. Oregon I have no idea. Only thing that comes to mind is the Oregon Trail?

<comment><USER6> Oregon was the end of the Oregon Trail, but the trail itself extended 2000+ miles back to Missouri in the center of the continent.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> One of the subtle considerations when discussing non-profits is that any organization can be a non-profit, but in order to get tax exemption you have to meet certain requirements related to your mission and how your organization is organized [0]. One of the exempt requirements is education, and there are numerous ways in which it could be argued that a local news outlet can operate as a medium for educating local constituents of important events.

I spent a number of years working in public accounting in the DC area, almost exclusively with non-profit organizations on both the audit and tax side. Tax exempt organizations come under a fair amount of scrutiny, because of how valuable their tax exemption status is, and the government checks everything from executive compensation to programatic expenditures. Most have to get audited annually, and you can read their audited financial statements just like how you could read Apple's or Google's [1].

A key note about tax exempt organizations is that as soon as they start to earn income from activities that compete with typical for-profit organizations, they have to pay corporate taxes on that income. I saw some people implying that Amazon could become a subcompany of WaPo and avoid taxes, which, while technically is in the realm of possibility, would have 3 major consequences: firstly, the 501(c)3 non-profit parent organization can't make dividend-like disbursements to shareholders, so the money would be tied up in the non-profit, secondly, excessive compensation to employees could result in massive punitive taxes [2], and thirdly, the revenue that WaPo would receive would most likely be taxable unrelated business income. Bezos would be better off keeping Amazon separate and donating cash to WaPo -- at least then he'd be able to get a write off.

[0] irs.gov/charities-non-profits/charitable-organizations/exempt-purposes- internal-revenue-code-section-501c3

[1] There are several sites, but guidestar.org is the one I've mostly used.

[2] irs.gov/charities-non-profits/charitable-organizations/intermediate- sanctions-excess-benefit-transactions

</comment><comment><USER9> The requirement of 401c(3)s to be "non-political" looks like a pretty weird to someone that doesn't live in the US. Why do non-profits have to work with that suppression while for-profit companies won't? Does anyone here know the historical context for this?

<comment><USER10> I'm sure there will be some that will use any article on the opinion page that criticizes the government to use this to fight the non-profit status. After all, if there is one thing that stands out in the political landscape at the moment it is that the government is at war with those segments of the media that are critical of it.

<comment><USER11> This might make for an interesting relationship between the paper and the LDS Church, which is itself a 501(c)3 that gets involved in politics a lot.

<comment><USER12> Many non-profits have one or more sister 527 organizations that actually do the electioneering and other political activities.

</comment></comment></comment></comment><comment><USER13> The Texas Tribune is a non-profit[1] and has been so for 10 years.[2]

[1]: [https://www.texastribune.org/about/](https://www.texastribune.org/about/)

[2]: [https://www.texastribune.org/series/10th- anniversary/](https://www.texastribune.org/series/10th-anniversary/)

<comment><USER14> The Texas Tribune appears to have been created in 2009 as a non-profit. In contrast, the Salt Lake Tribune was founded in 1868, and has been for-profit until now. I believe the unique thing about the SL Trib is its transition from for-profit to non-profit.

[1] [https://en.wikipedia.org/wiki/The_Texas_Tribune](https://en.wikipedia.org/wiki/The_Texas_Tribune)

[2] [https://en.wikipedia.org/wiki/The_Salt_Lake_Tribune](https://en.wikipedia.org/wiki/The_Salt_Lake_Tribune)

</comment></comment><comment><USER15> Tax-deductible support of local news is a fantastic idea.

<comment><USER16> Why?

Creating yet more loopholes doesn't sound like a good idea.

<comment><USER17> "Yet more loopholes" is what happens when you refuse to think for yourself and instead need to cram everything into tiny, generalising, categories. A better framework for evaluating policy is to ask if their objective is worthwhile and if their mechanism is fit:

Local news is dying/dead in many regions, yet it is essential for the functioning of democracy. Asking people to make informed decisions without reliable reporting works about as well as a thermostat without a thermometer, i. e. it doesn't.

Since everyone profits when others make better decisions at the voting booth, there is a direct argument to be made that the benefit of people subscribing to a local paper goes not to them, but their community, especially since important stories also tend to reach non-subscribers.

Assuming one agrees with that point and isn't part of the all-journalists-are- corrupt-marxist-crowd (or the alternative some-blogger-can-do-it-better- crowd), one would want to find ways to support local news. But direct subsidies run into obvious problems.

Reducing taxes would then be an obvious way to allow journalism to function: Its benefit is proportional to revenue and therefore preserves the market mechanisms.

Books and newspapers actually are exempt/partially exempt from VAT in many countries. But VAT just isn't a relevant factor in most of the US.

You can consider this "just a loophole" in the way that "don't put arsenic on pizza" is "just another regulation".

<comment><USER18> How is local news essential to democracy or help make better voting decisions?

For example, according to Patch (which is not nonprofit) this morning, if I exclude the vast amount of advertising and pathological fake news and focus on actual local coverage, in my hometown the local electronics recycling program is temporarily moving because of road construction, and three miles across town the police have reported three recent delivery package thefts.

How would either story influence me being more or less likely to vote for Trump in 2020?

There's been an intense cultural shift towards not making informed decisions in the voting booth; one MUST either vote along demographic identity lines or optionally follow groupthink or keep very, very quiet lest suffer possibly violent consequences. If those cultural trends change, then there would be motivation for informed voting. However, "everyone in charge" at this time likes the system and its a disinformation to pretend informed voting is relevant at this time. The problem at this time isn't "voter education" but "conform to your group or be punished".

<comment><USER19> Local news won't help much with informed voting for national candidates, unless there's something specific going on like President X is working to close down the local industry etc.

It can be very helpful for informing about local candidates. Even the nearby metropolitan newspaper isn't going to tell me about the incumbent running for reelection who only showed up to one board meeting in the last term; I need the local county newspaper for that.

</comment></comment></comment></comment></comment><comment><USER20> Time for Bezos to register the Washington Post as nonprofit and make Amazon a subcompany.

<comment><USER21> Exactly my thought! This has "tax loophole" written all over it.

Company gets to subsidize favorable propaganda, while at the same time getting a nice tax write-off.

Edit: For those downvoting, would you care to elaborate? I don't see how this won't be abused. What am I wrong about here?

<comment><USER22> I would imagine a non-profit isn't able to well.... profit as much. And if I know one thing it is that a rich guy loves his money as much as a preacher loves the Lord.

<comment><USER23> Non-profits are allowed to profit all they want.

The NFL is a non-profit org.

<comment><USER24> The league is - the teams are not.

<comment><USER23> That's what I meant. Apparently it changed. But so what? The league itself made enough money to pay Roger Goodell $44M in 2013. As a non-profit.

<comment><USER24> I kind of figured you did, but I wanted to underscore the difference because I feel like this fact is usually trotted out for (and gets) a knee jerk.

To be fair, I think it's a dumb state of affairs too, but overhyping problems is often counterproductive.

<comment><USER23> Well, I do think it (was) dumb, but I also didn't bring it up to show a big problem. I just wanted a counter-example to the claim that profits are limited at non-profits.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> I'm going to push away the dubiousness due to the LDS issue and I'm going to assume that the SLT is a good newspaper in the following comment. To be forthright in my bias, my general views on Utah are not that great though... stemming from their stupid fucking criss-crossing streets and over usage of concrete barriers in the middle of the road all the fucking time.

Cough, excuse me.

I'm really curious about the repercussions of this. If this works out decently for them, I'm pretty sure other news outlets of all shapes and sizes will follow in the next few years. Maybe this is good. There's a potential here to revitalize the news system in general. They won't be so dependent on pandering to a select few corporations and bullshit advertising methods. Maybe this will bring some more unbiased... wait, no probably not. Not being funny, that just made me realize the folly. If donations are going to be a big play, the only way to really get good donations is to appease a certain viewpoint. I don't know... maybe there's a way to mitigate that? It does say no more political endorsements... eh... I doubt that'll happen. I was hoping to have a good, happy train of thought on this one. Then I remembered that all humans are assholes.

Fucking hate driving in Godless wasteland of a state.

<comment><USER26> Criss-crossing streets? You mean, a grid system? What's so bad about that?

<comment><USER25> Yea grid roads are unique to only utah... seriously?

Continously flow intersections and diverging continuous intersections. You end up driving on the left hand side and drive all wonky. Its terrifying to encounter the first time and makes no logical sense. They brought it to colorado springs and it's so amazingly pointless.

<comment><USER27> I'm not sure I understand the problem, but perhaps 'jughandles' as used in New Jersey are the solution?

</comment></comment></comment></comment><comment><USER28> the thing that sucks about 501(c)3 is that there are no deductible expenses any more

So they can be used in conjunction with other entities to really amplify the tax benefits

If you think of them like 401k on steroids It can help, as deductible contributions are unlimited up to 50% income and anything above that rolls over into the next year, and you can do a bunch with asset prices and velocity.

Different parts of the tax code pull deductions before or after AGI, so you can game this forever all while the masses can only express their discontent by targeting "income tax rates" and the edgiest of them all says "marginal income tax rates"

</comment><comment><USER29> What is a "legacy newspaper"? Is it just a newspaper?

<comment><USER30> "Legacy" just means _old_ or _traditional_ or _hailing from a past era_ , as distinct from publications that have been newly developed in recent times for modern markets and technologies. It's also distinct from established media orgs like PBS that have been nonprofit from the start.

</comment></comment><comment><USER31> How is that strange? All kinds of media are/can be nonprofit where I am from...

<comment><USER4> Who is saying that's strange? There are many non-profit news organizations:

* ProPublica

* The Texas Tribune

* NPR and all its affiliates

* PBS

<comment><USER31> > _Who is saying that 's strange?_

The grandparent (yoelo) who started this thread, for one:

"The requirement of 401c(3)s to be "non-political" looks like a pretty weird to someone that doesn't live in the US."

> _There are many non-profit news organizations_

Which is orthogonal, what's strange is why such a law, that they should be "non-political" exists...

</comment></comment></comment><comment><USER32> It is my opinion that in order to retain freedom of the press protections an organization should be required to be non-profit, not specifically 501c3 of course.

<comment><USER33> Having a non-profit tax status doesn't prevent you from paying large salaries if you make more money. That really wouldn't do anything to take away the incentive the press has to sell more news.

</comment></comment><comment><USER34> Why doesn't Bezos do this to the Amazon Post?

</comment><comment><USER35> Plenty of newspapers have been unprofitable for a long time. Oh wait... Headline was slightly different ;)

</comment><comment><USER36> Great - the IRS is now giving tax-free status to the mormon church's for- profit arms.

<comment><USER37> You understand that the Salt Lake Tribune has traditionally been dedicated to being critical of the Mormon church? Right?

<comment><USER3> They lost some of their teeth after the joint publishing agreement with Deseret News, but other than npr they are the only major news outlet of any medium in salt lake that is willing to be critical of the church. And it's not like KUER has much airtime devoted to local news.</comment></comment></comment>


Resumes are worthless: An unfiltered look at how one CEO hires employees - <AUTHOR> http://qz.com/717767/resumes-are-worthless-an-unfiltered-look-at-how-one-ceo-hires-employees/ <comment><USER2> Do you avoid surgeons who seem over-qualified? Do you avoid pilots who seem over-qualified? Do you want your autonomous car programmed by someone who doesn't own a driver's license? Sigh.</comment>


The printed future of Christmas dinner - <AUTHOR> http://www.bbc.co.uk/news/technology-12069495

<comment><USER2> Homaro Cantu and Ben Roche are more than just restaurant owners. They're innovators in the truest sense of the word.</comment>


Can a Human See a Single Photon? (1996) - <AUTHOR> http://math.ucr.edu/home/baez/physics/Quantum/see_a_photon.html <comment><USER2> Would there be any interest in a series I've been thinking of putting together about all the fantastically counterintuitive ways your eye fools you without you even noticing? Example:

[https://media.giphy.com/media/3o7btPOMufN5FziFWg/giphy.gif](https://media.giphy.com/media/3o7btPOMufN5FziFWg/giphy.gif)

The fact that colors influence colors around them means that there are far more than 256^3 viewable colors: the spatial axis is like a fourth channel.

Another fun one: If you take a paper plate and poke a hole in it, then take a toothpick and stick it in front of the hole, from the bottom, pointing upwards.... Then it'll look like it's coming _down_ from the top! It's very hard to explain in words, but basically it's a pinhole camera, so everything appears upside-down. Your brain tries to compensate and flips it right side up, but it can't quite do that with the toothpick-hole scenario. So when you push the toothpick up from the bottom, it looks like it's coming down from the top.

Lastly: [https://i.imgur.com/epXYhJd.png](https://i.imgur.com/epXYhJd.png) If you cover up the top half of the image, the bottom looks gray. But the strawberries look red.

A fun puzzle is, how do you see an individual pixel? Can you think of any common object that would help you do this? (No magnifying lenses, for example, and using a phone is sort of cheating.) Answer below.

...

Answer: pluck a hair out of your head and put it on your screen. The line along the edge of the hair will turn into a stairstep pattern, which is just another way of saying you can see individual pixels.

<comment><USER3> Perhaps a nitpick, but 256^3 doesn't really represent anything about human perception-- it's just how we store colors in computer memory. The human eye can perceive a far wider range of colors than any screen can (currently) represent. It's just as valid (and probably more accurate) to use floating point to store color (rather than bytes), and in many high-fidelity applications this is actually how it's done.

The bit about colors "looking different" in different contexts also isn't really an "extra axis". The example you give is just your brain (attempting to) separate out the illumination from the scene colors. The range of actual colors you can perceive isn't increased by this.

Fundamentally human color perception is three-dimensional, because humans have three classes of color receptors on their retinas. There are also rods in the retina (the cells that are color-insensitive and detect only brightness), and in principle they could inform color perception, but this does not seem to be the case-- the intensity of light only shifts things around in the original three-dimensional space.

There are also a very, very few people (women only) with genetic mutations that give them _four_ different color receptors in their retina. However, there is no evidence that their brains can take advantage of this extra information and allow them to perceive an extra "axis" of color. It is much more likely that the "mutant" receptors are lumped in with the stimulus of one of the others, which will shift their perception of color, but not expand it.

In short: There are three axes of color perception. Optical illusions don't change that.

<comment><USER2> Optical illusions reveal that we have more than three axes of color perception. The first gif and the last photo are examples of this, and the renaissance artists had a firm appreciation of it. (See DaVinci's journals, specifically the chapters on color.)

Part of the reason I want to put together this series is to rekindle this knowledge. It seems very much "lost": your comment represents the status quo of color science, but if you were an ambitious artist in 1450, you'd run experiments and determine that much of what we take as fact is actually quite a lot more complicated in practice.

The eye, and especially our perception of colors, is so complicated that entire tomes barely scratch the surface. And Munsell's discoveries were only made in 1900, barely over a hundred years ago. There's still a lot more to discover.

To be clear: it's true that our three receptors imply three axes of color perception. But when you assemble an image as a whole, the entire portrait results in an experience quite different than any individual color.

EDIT: _That the perception of color is influenced by surrounding colors is true, but that this adds a "fourth channel" is [citation needed]._

One of the most important aspects of color science is that you have to be willing to believe the possibility that some strange ideas are true.

In this case, I can dispel that illusion, but only if you're open minded to it:

Consider a painting. Why choose a certain shade of yellow? To produce an effect.

The above images demonstrate that _where_ you put that shade of yellow causes a very different effect.

Now, if you accept as an axiom that the only reason to choose a color is to produce an effect, then that means all three primary colors (red, green, blue) are different axes in your ability to cause an effect. But the fact that the arrangement of colors causes different effects means that the spatial arrangement is a fourth "lever" that you can use to change the experience. That implies it's accurate to call this phenomenon a fourth channel.

(I'd post this edit as a reply, but HN isn't having it right now.)

One interesting area of science to investigate is the frequency spectrum of natural images. Our brains are tuned to see certain frequencies more than others, e.g. blades of grass. And the reason colors produce different effects depending on where they are in relation to each other is to help us resolve different shapes in an image.

[http://web.mit.edu/torralba/www/ne3302.pdf](http://web.mit.edu/torralba/www/ne3302.pdf)

[https://www.cs.cmu.edu/~efros/courses/LBMV07/presentations/0...](https://www.cs.cmu.edu/~efros/courses/LBMV07/presentations/0208Gist.pdf)

<comment><USER3> The statement I take objection to is this:

> The fact that colors influence colors around them means that there are far > more than 256^3 viewable colors: the spatial axis is like a fourth channel.

That the perception of color is influenced by surrounding colors is true, but that this adds a "fourth channel" is [citation needed].

<comment><USER4> I'm not sure I buy that it means there are more absolute viewable colors there, but rather there are merely different interpretations of the same colors. We do have fairly strong confirmation that our brain doesn't interpret color absolutely but can adjust based on luminescence (see: all examples of shadow illusions) and patterns (see: [https://www.youtube.com/watch?v=mf5otGNbkuc](https://www.youtube.com/watch?v=mf5otGNbkuc)), perhaps that's what is meant by a "fourth channel"?

</comment></comment></comment></comment></comment><comment><USER5> Let me up the ante, not only can we detect single photons.

A pioneering study at the interface of biology and physics found, that isolated rod photoreceptors of frogs are sensitive to differences in the light sources statistical properties, e.g coherent (laser) vs thermal (sun, light- bulb) vs sub-poissonian (resonance fluorescence of quantum dots) light statistics:

"Measurement of Photon Statistics with Live Photoreceptor Cells" (2012) [1]

"The results indicate differences in average responses of rod cells to coherent and pseudothermal light of the same intensity and also differences in signal-to-noise ratios and second-order intensity correlation functions"

It seems Lorentz hypothesis in 1911 was right, that the boundaries of our perception are set by basic laws of physics, and that we reach the limits of what is possible.

===

[1] [pdf] [https://physics.aps.org/featured-article- pdf/10.1103/PhysRev...](https://physics.aps.org/featured-article- pdf/10.1103/PhysRevLett.109.113601)

<comment><USER6> I can't find what this Lorentz hypothesis of 1911 is, but surely you are claiming too much. Physical entities can detect X-rays, but humans haven't evolved that ability (except, recently, externally/collectively).

The idea that our perceptual apparatus is optimal, rather than a contingent product of a particular evolutionary path, is easy to refute -- but maybe that isn't what you mean by "reach[ing] the limits of what is possible."

<comment><USER7> We can reach maximum optimization of wathever physical property we use. For example our brain and it super efficiency vs a super computer.

<comment><USER8> But humans had millions of years to evolve.

The computer is only 70 years old. Give it 100 years and we will make it as efficient as a human brain, possibly even better.

Evolution is a slow process. Non sentient trial and error. We beat that in time easily.

</comment></comment></comment></comment><comment><USER9> > However, neural filters only allow a signal to pass to the brain to trigger > a conscious response when at least about five to nine arrive within less > than 100 ms. If we could consciously see single photons we would experience > too much visual "noise" in very low light, so this filter is a necessary > adaptation, not a weakness.

Wonder if this is related to what I experience. Visual snow - basically seeing static in your vision, especially at night. I sometimes don't notice it for weeks, but then I just pick up on it again and can't stop noticing. It's still hard for me to believe that it's not normal, given that it happens with any camera ever built, but apparently not many people experience it.

<comment><USER10> Visual Snow is a condition which very few people are aware of (including the doctors). I still remember the day I started experiencing the snow. It was a sudden trigger. I couldn't stop noticing it for an year mainly because I was scared whether I am going to be blind. I went to atleast 4 or 5 doctors and no one found any problem with my eyes and I often got ridiculed by friends for making up something which I apparently don't have according to the doctors. I came to know about visual snow after an year from Internet and I realised that many other people have this and they also had a similar experience as mine.

[https://www.youtube.com/watch?v=f34R3GC5I5k](https://www.youtube.com/watch?v=f34R3GC5I5k) [https://en.wikipedia.org/wiki/Visual_snow](https://en.wikipedia.org/wiki/Visual_snow)

If you are a billionaire you can support the fundraiser for finding a cure to Visual Snow which has only reached 1/5th of it's goal even after 40 months :(

[https://www.gofundme.com/visual-snow](https://www.gofundme.com/visual-snow)

<comment><USER11> Two thoughts, in order:

1) This isn't normal? I get this plus an auditory analogue (imagine an impossibly high pitched sound like crickets chirping) which I've always figured was just what my 'noise floor' sounded like.

2) Why would you see this as something to cure? (Edit: Assuming it's something you only see at very low light levels - if you get it all the time even in bright light then that would be pretty bad.) It's just what you get when your visual system's auto-gain tries to amplify darkness. I'm not sure what else you'd expect.

<comment><USER10> I see it all the time! A couple of years before I could look at the sky in morning or evening and enjoy the clouds. Going to beach and watching sunset was my favourites. Now it's a pain to do the both. I can see star like particles flickering in the sky and floaters. It's also uncomfortable to look at the monitor if the brightness is high. Because of all these visual snow patients also suffer from depression. My vision used to be like watching a movie in Full HD TV before. Now it's like watching a movie in an old crappy tv which is having a bad signal reception.

<comment><USER12> That's odd, in that I've probably noticed visual snow-like artifacts ever since I was a child, but it never bothered me even a tiny bit.

Couple of personal observations:

\- Most of the time I only notice snow or artifacts if I'm consciously looking for them or don't have anything else conscious occupying the brain (e.g. staring at a wall out of boredom, or closing my eyes and still paying attention to visual input)

\- Once you start looking for visual artifacts, you'll see them everywhere. Right now if I stare at my ceiling in dim lighting, I see little multicolored 'heat wave' patterns roiling about as my visual sensory system works overdrive to extract more signal that there actually is. I also notice a slight 'ringing' halo around bright objects. But as soon as I try to do anything at all, my brain apparently decides that other things are more important and actively filters all this stuff out

Don't discount the possibility that you're putting yourself in a vicious cycle here:

perception of something wrong -> heightened subconscious threat processing (your brain starts looking for a problem in your visual perception) -> more conscious awareness of visual artifacts -> perception of something wrong

The way to break that cycle is to just worry about more important matters, and it'll either go away by itself or you'll stop caring.

</comment></comment></comment></comment></comment><comment><USER13> Article is from 1996.

Another study was done last year and they also found humans can probably see single photons, though the study is limited as its sample size is n=3.

[https://www.nature.com/news/people-can-sense-single- photons-...](https://www.nature.com/news/people-can-sense-single- photons-1.20282)

<comment><USER14> > can probably see single photons

Photons don't exist in the first place. Science has moved on and modern models don't assume the existence of actual particles. It's only electromagnetic waves.

<comment><USER15> Ok, tell that to the Standard Model. [1]

Like it or not, in modern physics, "photon" refers to a particular type of discrete lump of momentum and energy. It is a thing you can definitely have one of.

[1] [https://en.wikipedia.org/wiki/Standard_Model](https://en.wikipedia.org/wiki/Standard_Model)

<comment><USER14> Then its not a particle with zero mass as often defined.

</comment></comment></comment></comment><comment><USER16> Under ideal conditions human can see 9th magnitude stars. We tried under real sky, and got 8.1 magnitude stars at 80% probability.

Not sure how it translates to photon counts.

</comment><comment><USER17> Discussed in 2008: [https://news.ycombinator.com/item?id=299724](https://news.ycombinator.com/item?id=299724).

</comment><comment><USER18> If you like the these kind of writeups, You might like the parent post, which have many such intresting articles from the Usenet Physics FAQ.

[http://math.ucr.edu/home/baez/physics/index.html](http://math.ucr.edu/home/baez/physics/index.html)

<comment><USER19> john baez is a brilliant guy.

and also he's the cousin of joan baez, which makes me appreciate both of them even more.

</comment></comment><comment><USER20> There is a well known (I heard about it in the late 70's) problem with these types of experiments. The assumption is that if the subjects' "guesses" statistically match the assumed hit rate of photons then there must be a cause and effect. This experiments seems to make no attempt to eliminate the possibility that this is completely random.

<comment><USER21> All of human reasoning and understanding comes from matching our observations statistically with potential causes.

You may heat up a tea kettle a thousand times with a flame and conclude that the flame is heating the tea kettle, but perhaps every time the flame was too small and too far and it was in fact another source of energy hitting it from the environment warming it.

Our understanding of the world comes from substantial enough correlation that it moves into the realm of cause-and-effect. Though admittedly we often assume this too quickly.

<comment><USER20> But you have to be able to have a control. I heard Barbara Sakitt speak around 1976-77. She was the author of the widely cited "Counting Every Quantum" (1972) and she basically said that her original methodology was flawed. Unfortunately, no one cites her later work and I don't have access to the full text of "Information received from unseen lights" (1976) which I think was the paper she was presenting.

</comment></comment></comment><comment><USER22> I would never have guessed this result, because it seems like a vast overoptimization for light detection: in what circumstances would a human being need to see a single photon? And if those circumstances are rare, then what is the cost (in fitness, energy, etc) that we pay to maintain that ability?

<comment><USER20> Rods can respond to individual photons, that is pretty much accepted. The issue is what can we perceive. The first nerve synapse screens out about 50% of isolated photons (ones that are not correlated from other rods) which has been estimated from modeling. Which means that some of those singular photons are getting through (perceived) and can be isolated from the background noise through careful experiments.

I don't think we evolved to see single photons, but that we evolved to be very sensitive to light while reducing the noise and that sweet spot means that we can quite possibly, under ideal conditions, see individual photons slightly more than we think we see non-existent photons.

</comment></comment><comment><USER16> Humans can see single gamma photons, even with closed eyes :-)

<comment><USER23> [https://www.orau.org/ptp/articlesstories/invisiblelight.htm](https://www.orau.org/ptp/articlesstories/invisiblelight.htm)

</comment></comment><comment><USER24> When we are able to guess, eg not have to be 100% accurate - all our sensors become super human.

</comment><comment><USER25> an aside, but an interesting one, Biophotons... was new to me, [https://www.ncbi.nlm.nih.gov/pubmed/?term=biophoton](https://www.ncbi.nlm.nih.gov/pubmed/?term=biophoton)

</comment><comment><USER26> Very nice write up on the experiment</comment>


How Much Damage Can the OPM Hackers Do with a Million Fingerprints? - <AUTHOR> http://www.nationaljournal.com/tech/opm-hack-fingerprints-china-20150714#hn

<comment><AUTHOR> _> problematic is that there is "no way to reissue a fingerprint," Lee said, meaning that once a set is in the hands of a foreign adversary they are vulnerable as long as that person is working in government.... That reality could create a squeeze on government for decades to come, as agencies may be forced to forgo fingerprints for things like two-factor authentication and instead rely on another biometric, such as facial recognition or iris scans._

I see people on HN say it all the time, biometrics are for identification, not authentication.</comment>


The Trouble with the TPP, Day 5: Rights Holders "Shall" vs. Users "May" - <AUTHOR> http://www.michaelgeist.ca/2016/01/the-trouble-with-the-tpp-day-5-rights-holders-shall-vs-users-may/ <comment><USER2> Read it. Not sure what the full ramifications will be in the end of going with such language but clearly protecting consumers is secondary and giving power to right holders is the intention.

As an aside and speaking as a Canadian citizen and resident, Geist is someone who has been very helpful for educating and directing consumers and helping protect our rights. He's very easy to understand, covers issues relevant to consumers as they are becoming relevant, and has obtained what is in my (lay) opinion a well deserved reputation as being someone you can trust to keep you edcuated and safe as a consumer. The work he does is really valuable, IMO. Plus, he let me (among many others) add him as a connection on LinkedIn, even though we've clearly never worked together, which somehow I find very neat :)

<comment><USER3> As far as I can tell, it's not just the general public that's being overlooked - every country that signs on to import the US's terrible policies (I'm a US citizen) is giving up future sovereignty. This boggles the mind. Governments of today are signing away the sovereign rights of governments of tomorrow to establish the rule of law as they see fit.

I'm not a New World Order conspiracy theorist, but am I misreading the impact on democratic societies to govern themselves that this represents?

And hey, if the US can export this set of corporate-protectionism laws to other democracies, do you really think they'll stop with the TPP?

<comment><USER4> How is that appeal to sovereignty not a charge you could level at _any_ treaty? Isn't that more or less the definition of a treaty?

<comment><USER5> No. Historically, a trade treaty is a bilateral agreement on the regulation of _goods_.

It's not about internal politics, or at least it shouldn't be. And it certainly is not about controlling the _actions_ of one nation's industry _inside other nations_.

<comment><USER4> Could you be more specific about the word "historical", so we can see how easily falsified that argument is? Give us a time period, and then we can go look at a bunch of treaties and see the extent to which they're specifically about _goods_.

It would also be helpful if you could define "goods".

If we find examples of similarly intrusive agreements in older treaties, will you be prepared to concede the argument?

<comment><USER5> Looks like I won't even have to: [https://en.wikipedia.org/wiki/Treaty_Clause#Repeal](https://en.wikipedia.org/wiki/Treaty_Clause#Repeal)

 _Congress can modify or repeal treaties by subsequent legislative action, even if this amounts to a violation of the treaty under international law_

So no, treaties do not affect US national sovereignty. Appeal to sovereignty is a charge you can not level at any treaty from inside the USA.

<comment><USER4> Are we arguing the same thing, then?

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Warren Buffet once said something like: there has been class warfare and my side won.

About 15 years ago I had an ongoing discussion with my neighbors (both retired medical doctors) about creeping corporatism. 15 years ago we all agreed that the best people can do is to be resilient by not being in debt, stay educated, have strong social networks; I think the way we agreed to describe it was to live like mice in the walls, comfortably and off the radar.

I still agree that this is the strategy: try to live a free and inspired life (to quote Katherine Austin Fitts) despite what is happening in the world.

<comment><USER7> I read similar shout how to survive in soviet Russia during the fall of communism. There is a blogger from a few years ago whose theme was about how US economy was moving toward collapsing, and how to survive like Russians did.

<comment><USER8> I'm curious if you could find a link to that blog, it sounds interesting.

</comment></comment></comment><comment><AUTHOR> There are 3 days left to submit public comments to the USTR on the labor impacts of TPP, [http://www.flushthetpp.org/your-chance-to-officially-tell- th...](http://www.flushthetpp.org/your-chance-to-officially-tell-the-ustr- what-you-think-about-the-tpp/)

 _" According to the Federal Register, the Office of the US Trade Representative announced on Dec. 28 that it "is seeking public comments on the impact of the TPP Agreement on U.S. employment, including labor markets." The open comment period extends until January 13, 2016. It is critical that as many people as possible write to them about this ...

Sample comment ... As a consumer I have been dismayed at the rising rate of cheap imports that are made by poorly compensated and often abused workers. The products are often shoddy. I would rather pay fair wages to American workers for products that will endure. In so doing I believe we not only lift up our own people and our own communities, but we lift up the rest of the world by no longer being a party to predatory labor practices abroad ..."_

</comment><comment><USER9> TPP, TTIP and the others are just and plainly the fairgrounds of the big corporations. They are those that shape the rules -- and the result is a global eroding of democracies and of peoples rights.

They are bad for environments, for health and many things that are second to the one thing that counts in this game: profits.

<comment><USER10> I think profit is part of it, but I think that people running multinational corporations with more money than they could spend on themselves for the rest of their lives if they tried would have interest in shaping law indirectly via the supranational tribunals that are part of these trade agreements.

There are other reasons besides money that people get into politics and this would allow corporate owners to directly manipulate politics for monetary and non-monetary reasons without having to do the whole lobbying and/or running for election thing.

I think that profit is a cop-out when it comes to understanding political motivations. Ideological motivations are real and not merely a cover for monetary profit seeking behavior. There's this assumed idea that we live in a post-ideological era and that all decisions are pragmatic or at worst, motivated by profit seeking. I think ideology is still there, but in our dumbed down world it's never explicitly mentioned as a motivation for anything except as a vague throwaway line (e.g "Let's Make America Great Again!").

<comment><USER11> So if the controllers of the corporations aren't seeking even more immense income disparity can you say what motivations you think they do have specifically.

Which laws do they want to force and why?

Profit motive may be a cop-out but it's based on the current facts, corporation rulers have manipulated law and made more profits and then sought to do the same again and again.

</comment></comment></comment><comment><USER12> See also Michael Geist's TPP presentation at CIGI:

[https://m.youtube.com/watch?v=VTrS1GeADQU](https://m.youtube.com/watch?v=VTrS1GeADQU)

<comment><USER13> I've watched about 30 minutes of this, and I am growingly disgusted by the TPP and the US government. I am a brit, and all though we aren't part of the TPP, we are still in the back pocket of the United States.

It's a shame that we rely so heavily on trade with the US, that we feel that we need to look past the so called "lobbying" and corruption in US politics, and implement such overbearing rules on behalf of Hollywood and others.

The stuff about the US putting Canada on "probation" and mandating that every 6 months Canada has to report back to the US "as if it was some kind of naughty student to the teacher" is just ridiculous.

This has to stop.

<comment><USER4> Your country happily joined ours to invade Iraq, which resulted in hundreds of thousands of civilian fatalities, but it's "Hollywood lobbying" that's the last straw for you?

Had the UK not signed on to the Bush administration's war, 2003 might have gone differently; Blair's alliance with Bush was a key "legitimizing" force.

My point, relevant to this thread, is that I don't think the UK is somehow coerced by US market power. The UK sees its best interests as mostly aligned with those of the US, which is not surprising when you compare the structure of our respective economies (for instance: London is the other Wall Street).

There are countries in the world with a reasonable claim against market-driven hegemony. The United Kingdom isn't one of them.

<comment><USER14> The UK and the people of the UK and the government of the UK are different things. The government signed on not the people.

<comment><USER15> > The government signed on not the people.

The same can be said about many nations. We should all contact our representatives regardless. However, the last time I did this, one of my supposed reps sent me a condescending form letter in response. She wasn't even gracious enough to lie to me and say she valued feedback from her constituents. It came across more like she knew better than I did and that's why she was voting against the interests of the people.</comment></comment></comment></comment></comment>