Symantec throws up hurdles to independent software developers - <AUTHOR> http://www.codeandweb.com/blog/2012/06/23/how-symantec-ruins-independent-developers <comment><USER2> I worked at Symantec on the reputation team, tools I worked on directly generated the reputation behind the WS.Reputation.1 message.

First: file a false positive report at <https://submit.symantec.com/false_positive/> . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight")

This goes directly to the team and they should have your programs whitelisted within a few business days.

Second: sign your executables. This goes a long way. And no, it doesn't have to be Verisign.

Third: don't change domains. This wiped out your known reputation. (Would have been acceptable if your binaries were signed)

Symantec is not out to squish the little guy. Sometimes you do have a few more hoops that you are required to hop through. Symantec should have better transparency on how this process works, it's something I pushed for pretty heavily but never had the power to get done.

Don't worry, you're not alone. Example: We weren't able to get Mozilla to sign their beta or developer builds that are shared on multiple mirrors (domains not related to mozilla). We'd get lots of angry (understandably) reports of reputation issues on these builds.

If anybody has any questions within reason, I'll be glad to answer them.

<comment><USER3> Is it actually possible for everyone to sign their executables? Last time I did it, I had to fork over something like $250/yr for a signing key along with providing copies of various documents. This seems a little high for someone who just, say, wants to make free utilities available to the world.

In the case of Firefox, one would think it would be possible for you guys to do something about it on your end, because you're the ones who added this reputation system that's causing users grief. Record known-good SHA or MD5 sums of unsigned apps like Firefox that you know are okay, for example. Or just not default this feature on.

<comment><USER4> So, I also worked on this team (and am good friends with mjard). At some point there was a big decision made to heavily bias the engine against "unknown" executables. I said it was a bad idea then, and I still think it is now. The only way it can "know" about an executable is via its source, or its signature, or if it is on other users machines. This creates the obvious huge problem for "the little guy" distributing software. They actually think this is no big deal, and when it steps on toes, the distributor can just use their dispute system and eventually they will fix it. And if you don't like it, you can just get your software signed. I was of the opinion that this was bad behavior and unreasonable. They really liked what it did for review scores (surprise, we detect everything!). I lost.

Create a harmless helloworld.exe and put it on a random website. Download and run it. If things haven't changed since I left, it will get flagged as malware.

What I can say is that this has nothing to do with trying to crush the little guy or malice. With some exceptions, there is a general attitude there of not caring, or caring about the wrong things. Hanlon's Razor a little bit.

<comment><USER5> Wait... A Typical gamedev studio uses 50-100 own executables, if not more. Directly fro perforce/svn/etc. In between studios.

....

<comment><USER2> Version control products wont have to deal with the reputation engine.

</comment></comment></comment></comment></comment><comment><USER6> It's not just Symantec.

I've had issues with multiple AV companies that pertained to binary-string signatures in my code. The AV companies I've dealth with all seem to have online ticketing systems that allowed for rapid correction of these situations.

A few months ago, I found that a command-line screen-capture tool that I publish was flagged as malware by multiple AV products due to behavioral characteristics.

In ScreenKap, I was experimenting with obfuscation of text-strings used by the code. I removed the obfuscation from the code and resubmitted to VirScan.org. I received a clean bill of health.

Note that I did not formally pursue this with any of the AV companies as the string obfuscation was an experiment and was nothing that needed to remain an integral part of my product. If my assumption is correct ( please note that it is an assumption ), we might be restricted to coding in the way the AV companies think we should code.

</comment><comment><USER7> Norton has caused a large amount of frustration for our GitHub for Windows users - Symantec will basically block any EXE using MSys, because of its use of the CreateRemoteThread API. There is no way I am going to submit all of the 200+ EXEs that comprise MSysGit to that web form, though we will try signing all of the EXEs.

<comment><USER2> Argh, that's rough, submit a few mention there are more, the team will be able to vet the entire collection.

</comment></comment><comment><USER5> We have Symantec AntiVir at work.

Few months ago I was researching way to make DLL's behave like OSX/linux - e.g. while they are loaded, they can get replaced. This is doable with the compiler option /SWAPRUN:CD,NET - e.g. if your dll/exe was running from CD or Network, and the media went down, it should still work. This somehow pulls the whole data somewhere (I guess in the page file), and it can be replaced.

Anyway, as soon I as started using this Symantec started reporting virus reports - not for everything - but few were enough for me to stop.

</comment><comment><USER8> Suppose Symantec started a program where companies were allowed to pay for their apps to be white listed would and precluded from this check. Could this be considered a protection racket under anti-trust rules?

<comment><USER9> No. There's nothing remotely resembling a monopoly here, just a garbage product.

<comment><USER10> A garbage product that is unfortunately pre-installed on hundreds of millions of windows PCs. Its actually quite difficult to remove _all_ of its components; its not just a one click operation as it should be.

<comment><USER11> I have had some success with <http://www.symantec.com/nrt> .

</comment></comment></comment></comment><comment><USER12> Is there even much point in using AV software?

I ask this because I have never installed any on my computer (including on Windows) and I have only ever _knowingly_ been infected once in the last 10 years (I think this happened because I didn't update Windows Media Player and it was still associated with a file type and somehow a rogue media file streamed from a website attacked it).

On the other hand people I know who have things like Norton etc installed seem to have _way_ more problems with their computers than me (including fairly tech savvy people). For example programs randomly breaking, tracking cookies being flagged as "malware" , general slowness of the system , nonsensical warning messages etc. Besides that they still seem to end up infected with malware more often than me and usually re-format their systems once every few months.

On that one occasion that I did end up infected , I had to install 3 different AV programs and do full scans before it was even detected.

Mac and Linux users never bother having AV installed and as far as I am aware there is nothing inherently more secure about either of these systems than there is Windows 7.

If you are running a network , surely it would be simpler just to disallow any executable files apart from those explicitly whitelisted and to make sure security patches are installed?

<comment><USER13> In the past, on Windows and Macs (pre-OSX), it was pretty much a requirement unless your machine was really stand-alone and you never dealt with files from any untrusted sources.

These days, if you keep your system patched, use an unprivileged account for your normal activity, use a local firewall and/or NAT, and stay away from shady websites you are probably pretty safe.

I have similar experiences with a friend who's constantly getting malware even though he's running Windows 7 and Microsoft Security Essentials. The main vector seems to be PDF files; he deals with a lot of them via email as part of his job, and he's very much in the habit of just opening PDFs in email before he even really looks at who the sender is.

I agree that many AV programs slow the sytem way down, and in general cause problems, and don't seem to really guarantee that you won't get infected. And FUD is a huge part of how it's marketed. Even Windows itself will nag you with ominous warnings if you don't have any AV software installed.

<comment><USER12> There is possibly a problem with user education here.

Running software on your computer that is not set to automatically pull down and install security patches to me seems like a far bigger problem than not running AV software. Windows does warn you if you turn automatic updates off , but afaik there is rarely such a warning about third party software.

In your friends case it would seem that he is not getting updates from adobe, since viewing a PDF file should not cause third party code execution so he must be getting PDFs that are exploiting his PDF reader (presumably adobe fixes these quickly as they arise).

</comment></comment></comment><comment><USER14> Why isn't this grounds for a product-disparagement lawsuit?

</comment><comment><USER15> I once worked for a company that ran into this same problem, hence, I have a whole lot of sympathy. However, I also sympathize with Symantec.

The biggest problem with the AV world is that it tends to be reactive. A criminal releases a piece of malware, it infects computers and then there is a fix released. The problem is that there is a gap between release and fix and criminals exploit this gap to steal information.

Reputation analysis is one possible solution. Alas, when it fails, it fails big (and hurts primarily independent developers).

</comment><comment> n-gauge Hence why I don't install rubbish virus checkers. It also gets confused on those 4k demos (due to the packers they use probably)

</comment><comment><USER16> Software that does this should become illegal. This is technical slander.

They are not even trying to explain what this means, the reason for this is simple: they want to show off, how many times they "protected" their customers, so that they are fooled to believe that AV products actually have value in them.

</comment><comment><USER17> When I used to write Windows software, Authenticode signing solved this sort of issue. Does that no longer work?

<comment><USER3> Last I checked, Authenticode certificates are not cheap.

</comment></comment><comment><USER18> Are your executables signed?

<comment><USER19> Signing doesn't always solve the problem.

<comment><USER20> Signing should allow reputation from previous versions to apply to updates, if implemented correctly by the antivirus vendor.

<comment><USER21> The product is out for about 1.5 years now but I moved to a new domain (from texturepacker.com to codeandweb.com). This is when the trouble started. I have not signed it yet - just learned about the issue some days ago.

</comment></comment></comment></comment><comment><USER22> Companies pay to get stuff listed. Someone paid to get rid of your product.</comment>


Twitter bug: Make anyone follow you on Twitter - <AUTHOR> http://blog.gcg.me/post/587047998 <comment><USER2> I would guess this exploit has always been possible until today? What's interesting is that someone has probably been wielding this secret power well before it got outed here on hacker news.

<comment><USER3> Or, is there anybody whose career took off due to this bug? For example, a musician who got signed primarily because all of the top 50 music producers were following him on twitter.

<comment><USER4> I have written a script to follow 1000 users on my niche every day. I find that around 15% of users follow me back. In the next couple of days, I remove the rest 85%. I have been doing this for a few months now and I have a few thousand followers on a few twitter accounts. I have set up websites for each of those niches and get decent amount of traffic though twitter. Been banned the first few times, but I have found my ways around it (mostly).

<comment><USER5> Please stop doing that. It's bad for the world.

<comment><USER6> Please stop caring. Its bad for your blood pressure.

Seriously, it's only Twitter. Conflict, famine, and poverty are bad for the world, but Twitter doesn't matter.

<comment><USER7> Destroying communities for your own personal gain is a problem that extends much beyond Twitter.

<comment><USER6> Twitter is not a community. Twitter is a tool. A community can use Twitter, but I think describing spamming Twitter as destroying a community is disingenuous. The success of email, usenet and blogs/microblogs etc depend on their openness and easy access to all. Which also means people can and will spam them. So spam on twitter should be seen as a natural and nessecary side- effect, not the end of twitter. Berating the spammers will only increase your blood pressure - the spammers, tweeters and Twitter itself will continue as always.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Official:

[http://status.twitter.com/post/587210796/follow-bug- discover...](http://status.twitter.com/post/587210796/follow-bug-discovered- remedied)

<comment><USER9> Doesn't seem like a bug to me, it looks like a poor design choice. How many other "special" tweet commands are there?

edit: anyone downmodding care to suggest how putting "accept[username]" in a tweet would be considered a 'bug'?

<comment><USER10> It's not that writing "accept [username]" is a bug — the bug is that you can use it to accept people who haven't asked to follow you. Similarly, OK buttons in dialogs are not a bug, but it would be a bug if they all had the same effect as the OK button in the dialog "Are you sure you want to erase your boot drive?"

<comment><USER9> I still don't understand what you're saying.

It's obviously not a bug. It's a hidden feature. An easter egg. A floor in their design.

They didn't "accidentally" make a special command in tweets that can cause others to follow you. They specifically intended for it to be that way.

Suggesting it's a "bug" is silly. Suggesting they "fixed the bug" is misleading.

<comment><USER11> They specifically made a feature that allows you to respond to follow requests by tweeting "accept username". The bug is not checking that the person has actually requested to follow you when processing that response.

<comment><USER9> That's an oversight IMHO. A bad design decision. It's not a bug. But we're arguing semantics I guess.

Is the feature documented then? I assumed it was a hidden secret thing.

<comment><USER10> By the same logic, a crasher because you forgot to check for NULL is an oversight rather than a bug. Both are cases of checks that should have been done and incorrect behaviors caused by failure to perform those checks. I say, if a piece of code does something it isn't intended to do or fails to do something it is meant to do, that's a bug. The bug might be the result of a poor design decision, but unless the behavior is intentional, it's a bug.

<comment><USER9> I wasn't aware that the feature was public. If it was a public feature, and it was failing to check that the target had actually added you, then sure - it's a bug.

I assumed that it was more of an intentional 'backdoor'.

<comment><USER10> As far as I'm aware, it's a feature that's meant to allow users to accept followers by text (there's a separate interface on the website for accepting follow requests). The bug is that it didn't check whether those people had actually _requested_ to follow you. That's what articles on the subject have indicated, anyway.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> amazing. They found out, it seems: right now everyone seems to have 0 following and 0 followers.

<comment><USER4> Thank god. Its everyone.

<comment><USER13> I had the exact same feeling of panic, then relief to find out I'm not alone.

</comment></comment></comment><comment><USER14> Its coincidental that Conan tweeted this message a couple days ago:

 _"If it ever says I'm following more than one person, I've been hacked. I'm a completely monogamous Twitterer—I only follow Sarah Killen."_

<http://twitter.com/ConanOBrien/status/13631062967>

<comment><USER15> Wow, Conan's Twitter account is not only a test, he's got a user story (that just turned red):

In order to provoke curiosity and amusement

As a celebrity comedy writer and television host

I want to only be shown as following one otherwise-unknown person in Michigan

</comment></comment><comment><USER16> If you tweet "accept [Twitter Username]", the other user will automaticly follow you.

eg. "accept snoopdog"

</comment><comment><USER17> Wow, this works. SnoopDogg is now following me: <http://twitter.com/snoopdogg>. I'm the cartoon figure.

<comment><USER18> Bad plan to try this out with an account you value - if they can identify who has used the exploit they will probably ban you when the dust settles.

<comment><USER17> Is it an exploit or is it a valid command? I don't think we hacked anything, we just typed in some text that causes people to follow us, for all we know that's a new feature of twitter.

<comment><USER19> Unfortunately, they can probably do whatever they want with this, whether people think it's fair or not.

</comment></comment></comment></comment><comment><USER20> I don't think they've actually wiped out your followers and people you follow. I think they just prevented us from accessing those tables because I'm still getting tweets from people I follow, I just can't see the lists.

</comment><comment><USER21> Wondering if there will be repercussions for people using this, or if they are able to track it? They aren't able to keep a lot of logs due to the volume.

<comment><USER22> They are at least able to tell if you've used it--my account just lost all its followers. <http://twitter.com/sjwalter>

I'd had a legitimate 30ish followers, used this bug a few times, now 0.

<comment><USER23> I think everyone is at 0. I didn't use the bug and I'm at 0/0

<comment><USER13> confirmed, everyone is at 0

</comment></comment></comment></comment><comment><USER24> Twitter damage control: TRUNCATE followers;

</comment><comment><USER3> I can't believe they didn't create an OOB mechanism for accept/deny requests, especially since they send so much meta data w/ each tweet anyway.

This seems like an extremely basic design flaw.

</comment><comment><USER22> Heh, I used this a bunch of times. It did work just fine, I had all sorts of people following me who really shouldn't care about me. And now I have 0 followers.

<comment><USER25> I went crazy and start adding the top 200 twitter accounts: <http://twitaholic.com/top100/followers/>

Thought I could sell it afterwards or something. lol

<comment><USER4> I only added top people on my niche!

</comment></comment></comment><comment><USER25> Sweet works for me. Check my followers: <http://twitter.com/chegra>

<comment><USER25> Game is over, I have zero followers now.

</comment></comment><comment><AUTHOR> the user who found this says he was trying to tweet "accept pwnz" where accept is a music group name.

<comment><USER26> Yeah! BALLS TO THE WALL!

This is such an odd bug. I guess it goes to show that nobody knows what strange code which should have been removed four years ago lurks in the heart of Twitter.

</comment></comment><comment><USER27> The Turkish user who found the bug explains it here (in Turkish): <http://inci.sozlukspot.com/e/4266098/>

And people wondering why Axl Rose is following him here :) [http://www.mygnrforum.com/index.php?showtopic=164026&st=...](http://www.mygnrforum.com/index.php?showtopic=164026&st=0)

</comment><comment><USER28> That's an utterly insane bug! Some kind of debug accidentally left in? Or an admin phrase not authorised properly?

<comment><USER29> Laziness and security by obscurity.

</comment></comment><comment><USER30> better question: does it produce a full follow ie- if i did this bug, would billgates actually see me in his stream? OR does it just increase the follower count+i show up on his sidebar. if its the former, then wow. I know they're clearing it out now, but somebody must have been using this for a while.

<comment><USER31> I tried it between my main account and a disused one and tweets from the attacking account showed up both through the web interface and through the API.

</comment></comment><comment><USER32> Update (6:30 PM PST): We've finished our cleanup of the spurious followings generated a result of this bug. If you are still seeing folks you are following who you didn't choose to follow, please use the block or unfollow tools to remedy.

Obviously, their so called "cleanup" is incomplete, at least for me :)

</comment><comment><USER33> Allegedly fixed, twitter is working on rolling back abuses of the hack.

[http://status.twitter.com/post/587210796/follow-bug- discover...](http://status.twitter.com/post/587210796/follow-bug-discovered- remedied)

<comment><USER34> Fortunately for Twitter it's incredible easy to track (/^accept \w+$/)

<comment><USER33> Not quite. _accept <username>_ is a perfectly valid command, but it is designed to allow someone requesting to follow you to follow you. Twitter needed to find accept requests which did not have matching follow requests, which is a bit more effort (but not much, I'd imagine).

As of now the problem appears to be fixed for a lot of people already.

</comment></comment></comment><comment><USER35> Yes, this does work. Now what's the opposite verb to make someone unfollow me?

<comment><USER36> "block" :P

</comment></comment><comment><USER37> watch everyone play!

<http://search.twitter.com/search?q=accept>

</comment><comment><USER38> Wow, tested and verified.

Somebody is working late tonight.

</comment><comment><USER17> I wonder if they are going to be able to undo this. Do they have a two sided log of the follow process? If it's just one-sided, they may be able to fix the bug but not to reverse the damage.

<comment><USER39> I suspect the Summize technology is better than they let on, and they can just do a search for tweets starting with "accept." I doubt there are many legit ones like that.

</comment></comment><comment><USER40> Interesting. My "following" and "followers" counts just dropped to 0.

</comment><comment><USER41> Jason Calacanis dream come true :P

</comment><comment><USER42> Seems that the fix is just a filter. Is anyone else trying to bypass with html ascii? A few minutes ago, a prompt with the html ascii returned a +0x36 on every char. Now it does not give feedback.

"accept BillGates": &#61 ;&#63 ;&#63 ;&#65 ;&#70 ;&#74 ;&#20 ;&#42 ;&#69 ;&#6C ;&#6C ;&#47 ;&#61 ;&#74 ;&#65 ;&#73 ;

Maybe they already _really_ fixed this bug (I hope).

</comment><comment><USER43> There could be notoriety for anyone who does this to Conan O'brien. He only follows one person AFAIK.

Edit: Looks like this probably already happened.

<comment><USER44> ConanOBrien was following 190 a few seconds ago, now there are 266 and its rising.

<comment><USER13> Now he's at 0 along with everyone else

</comment></comment></comment><comment><USER45> Whatever it was, got removed or keeled over...

<comment><AUTHOR> i thought tumblr removed the post, but it seems like it is working now.

</comment></comment><comment><USER46> Even without this bug, I dont think they should still allow commands via tweet at all. It made sense when most tweets were via SMS, but not anymore...Maybe for emerging markets with heavy SMS usage, add a 2nd number to send commands to isolate the two?

<comment><USER26> Follow and Block make sense as commands you can send through a message. But Accept? Why would you ever be able to control an action on someone else's account? It's rather odd that this exists at all.

<comment><USER47> If you've got your tweets protected (private), you have to _accept_ users to allow them to follow you.

<comment><USER26> I think you've missed the point here. This isn't a command that tells your account to accept follow request, or adds someone to your following list - this is a command that instantly makes other people 'accept' a follow request from YOU. This works completely differently in how it would consider the username parameter, and in that the change is applied to the other person's account, not yours.

</comment></comment></comment></comment><comment><USER48> They appear to be working on some sort of fix right now.

If you look at "following" lists, everything is showing up as zero for me right now, as in it shows that I'm not following anyone. All other users that I check are also showing that they aren't following anyone.

</comment><comment><USER49> Oooo approaching 2012 ;) Louisiana oil spill. Massive Twitter bug. Sticky finger Dow collapse. Facebook losing it's privacy mojo.

And to top it off, one line of code I checked in late last night prevented 200 new users from signing up on my freshly minted site.

</comment><comment><USER50> It appears that they just wiped everyone's list of followers? My feed still works though.

</comment><comment><USER51> This is up there with putting everybody in a root terminal by default on their Androids.

</comment><comment><USER52> Everyone shows 0 followers, but your stream still shows those you follow. Interesting.

</comment><comment><USER53> BBC has a report on this:

<http://news.bbc.co.uk/2/hi/technology/10106166.stm>

</comment><comment><USER54> Exploit is fixed, and follower lists are rolled back, but they didn't do a perfect job...

Felicia Day is still following me. ^-^

</comment><comment><USER55> Link doesn't work - does a server hammering lead to a 404? I didn't know it could...

</comment><comment><USER56> I would not want to be in the Twitter offices today. Good day to call in sick.

</comment><comment><USER44> Is it broken now? Both followers and follow count is 0 now?!

</comment><comment><USER38> Now I am getting a 502 when I try to post accept messages.

</comment><comment><USER17> Okay, all followers of everyone just dropped to 0...

<comment><USER17> And the command now gives "internal server error"

</comment></comment><comment><AUTHOR> here is the official twitter status blog: <http://status.twitter.com/>

</comment><comment><USER57> Wow they fixed that really fast.

</comment><comment><USER58> mirror?

<comment><AUTHOR> [http://eu.techcrunch.com/2010/05/10/does-this-twitter-bug- fo...](http://eu.techcrunch.com/2010/05/10/does-this-twitter-bug-force-anyone- to-follow-you/)

</comment></comment><comment><USER59> EDIT: My original message invited people not to try this. It turns out that everyone's counter is showing zero followers, regardless of whether you tried the hack or not. Thanks Travis for pointing this out. I was misled by my desktop client which cached my follower number.

<comment><USER60> even if you don't try it, you'll lose all of your followers</comment></comment>


An Open Letter to Solus Linux from Its Founder Ikey Doherty - <AUTHOR> https://www.phoronix.com/scan.php?page=news_item&px=Solus-Open-Letter <comment><USER2> So apparently Ikey has a kid now (or soon), which puts into perspective his absence. Glad that the Solus Core Team has been able to recover access to most of the project's accounts. Hopefully their application to the Software Freedom Conservancy goes well.</comment>


Android apps that fail to validate SSL - <AUTHOR> https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?pli=1#gid=1053404143

<comment><USER2> The spreadsheet links to Vulnerability Note VU#582497 ([http://www.kb.cert.org/vuls/id/582497](http://www.kb.cert.org/vuls/id/582497)). This links to additional information in CERT Oracle Secure Coding Standard for Java ([https://www.securecoding.cert.org/confluence/pages/viewpage....](https://www.securecoding.cert.org/confluence/pages/viewpage.action?pageId=134807561)). That states that a compliant solution example may be found in "Android Application Secure Design/Secure Coding Guidebook" ([http://www.jssec.org/dl/android_securecoding.pdf](http://www.jssec.org/dl/android_securecoding.pdf)). Which is written in Japanese.

</comment><comment><USER3> "Wow, this file is really popular! It might be unavailable until the crowd clears. Try again."

Surely Google's infrastructure can manage to serve a spreadsheet!

</comment><comment> V-2 It's down.

<comment><USER4> Yeah, I'm getting "This page isn't available offline. Connect to the Internet and refresh to view it online."

Obviously, I'm online.

</comment></comment><comment><USER5> Mirror: [https://docs.google.com/spreadsheets/d/1LZx6Bis0L9bZ-B4jDvma...](https://docs.google.com/spreadsheets/d/1LZx6Bis0L9bZ-B4jDvmamvQmnKpr- GVaDpokLR_b-HM/edit?usp=sharing)

</comment><comment><USER6> So what specifically are they meaning when they say "Fail to validate SSL"? Does that mean they are not certificate pinning?</comment>


Why men don't like funny women - <AUTHOR> http://www.theatlantic.com/health/archive/2015/11/plight-of-the-funny-female/416559/?single_page=true <comment><USER2> >It was a weighty subject, so occasionally she would inject a sarcastic comment about her own upbringing to lighten the mood.

...my first reaction to that was that sarcastic people aren't as funny as they think they are. Maybe I'm not alone.

"Think Sarcasm is Funny, Think Again" [https://www.psychologytoday.com/blog/think- well/201206/think...](https://www.psychologytoday.com/blog/think- well/201206/think-sarcasm-is-funny-think-again)

</comment><comment><USER3> I was expecting a rant, but actually this is quite a good article. Seems to look at a bunch of different data points, and while it is still opinionated I think the author goes to great lengths to justify their opinion (and intentionally evolves it).

Worth a few minutes to read even if it didn't really change my opinion about the topic at hand.

</comment><comment><USER4> I'm extremely drawn to funny women. I like that they play around mentally with cultural taboos and find creative ways of walking the line between making themselves laugh and making other people uncomfortable.

</comment><comment><USER5> Why was the title changed to say something the article does not claim?

<comment><USER6> Because the submitter editorialized, which violates the HN guidelines.

</comment></comment><comment><USER7> But I love funny women! I particularly like my funny wife.</comment>


Emergency parliamentary debate on surveillance powers - <AUTHOR> http://www.parliament.uk/business/news/2015/october/emergency-debate-the-operation-of-the-wilson-doctrine/ <comment><AUTHOR> When they're the ones being spied on, suddenly they show great concern.</comment>


Digital Design Principles from the UK Gov - <AUTHOR> https://www.gov.uk/designprinciples? <comment><USER2> I'm really impressed with the gov.uk project and have been following it for quite a while now.

We've been taking their lessons and applying them to a small municipal site we're building -- topic pages like their VAT example, flat document structure, really robust search. At first we were unsure how many lessons from a national government would apply to a village of a few thousand but it's turning out really well so far. It's a liberating data model in that we spend less time worrying about hierarchies ("is this for businesses or residents?") and more time curating content based on what users will need (e.g. what pages should be drawn into the residents' topic page in the springtime before an election).

They've also got a bunch of their code on GitHub: <https://github.com/alphagov>

<comment><USER3> Great to hear our model's been helpful. Do let me know if/when there's anything to look at as I'd love to see how it's translated.

</comment></comment><comment><USER4> If someone asked, I would say this is what I've spent the last 15 years educating myself to learn.

It might all seem simple, but take none of this for granted. If your work adheres to the concepts they've laid out, you will begin to make the world a better place.

Bravo, gov.uk

</comment><comment><USER5> I met one of the team on the train once (Jordan I think?) and he seemed like a passionate young guy. I hope the project is a huge success.

</comment><comment><USER6> Interesting site. I wonder whether the GDS team have any thoughts on how to reconcile some of this advice, and indeed their own site, with the EU cookie rules?

It seems the GDS also has a document floating around[1] that talks about implementing the Privacy and Electronic Communications Regulations on public sector web sites. This in turn cites ICO guidance[2] that says the Information Commissioner is "unlikely to prioritise" regulatory action against sites for using first party analytical cookies.

On the other hand, there is nothing in the actual Regulations to exempt analytics as far as I can see, and that same ICO guidance quite clearly states that "A first party analytic cookie might not appear to be as intrusive as others that might track a user across multiple sites but you still need consent". Moreover, using a service like Google Analytics, which relies on third party cookies and tracks users across sites, seems to have been squarely in the crosshairs of the EU authorities when they wrote the Regulations.

I'll be the first to agree that the current rules are not the most helpful idea I've ever encountered, and I'm about as convinced by the mess at the top of the ICO's own web site as anyone else, apparently including the webmasters of just about every other UK government web site. Still, as long as the Regulations have the force of the law and as long as the moratorium on regulatory action is due to end soon, it seems odd that the GDS is advocating the use of tools like Google Analytics.

[1] [http://alphagov.files.wordpress.com/2012/03/gds-cookies- impl...](http://alphagov.files.wordpress.com/2012/03/gds-cookies-implementer- guide.pdf)

[2] [http://www.ico.gov.uk/news/latest_news/2011/~/media/document...](http://www.ico.gov.uk/news/latest_news/2011/~/media/documents/library/Privacy_and_electronic/Practical_application/guidance_on_the_new_cookies_regulations.ashx)

</comment><comment><USER7> I really like this project. One of the few things that the government seems to be getting right at the moment.

If you've not already seen them, the BBC's design guidelines are also very good (though obviously somewhat different in scope): <http://www.bbc.co.uk/gel>

<comment><USER3> The BBC approach has definitely influenced our work on these principles and there's a lot of great thinking captured in them.

Ben Terrett (GOV.UK/GDS Head of Design) talked about that a bit in one of the blog posts introducing our design principles: [http://digital.cabinetoffice.gov.uk/2012/04/03/design- princi...](http://digital.cabinetoffice.gov.uk/2012/04/03/design-principles- alpha/)

</comment></comment><comment><USER8> Huh. Apparently people are using "digital design" to mean graphic and webpage design. I've always associated the phrase with circuit design.

<comment><USER9> If you actually read the linked article you'll see it has almost nothing to do with graphic or web design, but rather digital design is used as a less highbrow synonym for "information architecture".

<comment><USER8> I did "actually" read the linked article. I also did a Google search for "digital design" to see how it's most commonly being used. I'm comfortable lumping everything I saw into "graphic and webpage design," with the assumed understanding that "webpages" are basically applications now.

</comment></comment></comment><comment><USER10> When I accessed the site and saw the notice about using a carrot rather than stick approach I was turned off since I believed that stating that this was their approach just showed that this isn't the standard culture, however, that said, this is an excellent list of principles. I'm going to take notes. :)

</comment><comment><USER11> Principle 0: use 72 points fonts.

<comment><USER12> It doesn't quite seem to match the Typography section.

Where it says "We're using Georgia for body text." and that they're using em for sizing it appears to be styled as "Helmet,Freesans,sans-serif;" and using px+% (like YUI).

Also main.css has 7 declarations at the top of just the font-size for html object - which looks weird. Deleting all but the declaration "html {font-size: 62.5%;}" appears to right-size the fonts for the page.

I can't see where the web-font is supposed to be being downloaded either but I've only taken a quick glance.

Edit:

Looks like it's browser specific - this is FF11 on Linux. Somehow not applying the @media declarations correctly? Also looks like the little script isn't giving me the fastfonts css.

<comment><USER13> Thanks, I'm also F11 on Linux and wondered why no one else seemed to shudder at the huge text.

<comment><USER3> If you could email a screenshot and your browser details to govuk- email@example.com someone will have a look at that. thanks!

<comment><USER13> Thanks, done.

</comment></comment></comment></comment></comment><comment><USER14> I'm impressed by those design principles, even more so because they come from a government agency.

Measured by these principles UK government IT is light years ahead of the crap you've to cope with in Germany.

<comment><USER15> Er, I assure you it's not. This is a brand new site from a brand new team to try and clear up the mess that is government websites. There's hundreds of them just now.

<comment><USER14> Sure, having such principles and applying them is something entirely different but at least they've recognized that there's something wrong with their IT projects, which already is a huge leap ahead.

</comment></comment></comment><comment><USER16> this is well written and quite interesting... unfortunately the initial pink dialog box distracted from the content.

</comment><comment><USER17> Holy crap, much of this makes sense. Who are these people and what have they done with the real government? I'm not falling for it. Must be a late april fool.

<comment><USER18> Unfortunately, the amount of difference this kind of thing will make is minimal. For services supplied to Government, the decision making for anything non-trivial is made at appointment after tender: and these principles aren't embedded into procurement.

It also won't apply to the various Quangos, whose spending is publicly funded but nowhere near as transparent as direct Government spending.

There have been a similar set of open source principles in Government for something like six years now. They made practically no difference.

<comment><USER3> There's definitely been a lot of good thinking and guidance around the government for a long time.

The real difference here is that the Government Digital Service is empowered to actually build some of this in-house and so the principles are emerging from actual practice. We're also able to get involved in some procurement processes very early on and work with the appointed suppliers. We're also hoping that other people putting them into practice will come back with feedback we can incorporate to make them better and illustrate them more fully.

Getting these principles thoroughly embedded is going to be a long journey, but they're a far cry from being just another good practice document that'll be ignored.

<comment><USER17> I agree that there has been loads of good thinking around the government, I was just unaware that any of it had managed to filter inside.

While you are at it, can you try and get the whole government onto github so we can fork it ;)

<comment><USER3> Not sure about the whole government :)

But we're getting most of our code up there and beginning to convince others that code funded by taxpayers should be released as openly as possible.

We've received some interesting pull requests along the way, eg. <https://github.com/alphagov/calendars/pull/1>

<comment><USER17> I sincerely wish you the best of luck with this.

Any chance on getting similar standards applied to the ordinance survey data?

</comment></comment></comment></comment></comment></comment><comment><USER19> Slightly off topic, but relevant in this discussion.

I worked in IT in local and central government in the UK, all departments of which I was in would have completely ignored these guidelines for their own petty reasons of security, people skills, costs(!), supplier lock-ins etc

Neither does this address bigger picture stuff such as supplier favouritism, lack of single systems across multiple councils (eg council taxes) open hostility to open source, total lack of fair tendering or the fact most IT spending is authorised by people who's only qualification is they studied history at the same college in Oxford as the CEO or go to the same golf club.

I could name several examples of the above from the security services but would probably be immediately arrested because of that pile of steaming shit called `the official secrets act'</comment>


Google Keep: Another Google product i won't use (and why) - <AUTHOR> http://www.techpost.ug/1906/google-keep-another-google-product-i-wont-use-and-why/

<comment><USER2> I find it interesting that the trend is to say 'I won't use Google product X and here's why' rather than writing articles 'I will use Google product X and here's why' – I mean when was the last time you could, per default, assume 'everybody' would be using some company's new product?

<comment><AUTHOR> CLadius, by that i assume you won't be using Google Keep. Anyway it's not an assumption. Even Phil Libin, Evernote CEO acknowledges the bare fact that Google Keep will be driving fierce competition against his company -- implying that by default users are bound to plunge into using Google's product.

<comment><USER2> > implying that by default users are bound to plunge into using Google's > product.

Yes, and that's the interesting point. There are very, very few companies on that planet that can just bring out basically any product and be reasonable sure that users will adopt it.

And yes, you are right, I won't be using Google Keep, simply because my phone likely doesn't support it and org-mode works quite excellently for my laptop.

<comment><AUTHOR> Okay. Meanwhile thanks for reading the article and for commenting.</comment></comment></comment></comment>


The Clipper Chip - <AUTHOR> https://en.wikipedia.org/wiki/Clipper_chip <comment><USER2> Thanks for posting this. Throughout this discussion about Apple, The FBI, Tha All Writs Act, etc. I've been saying we have already had this discussion some 20 years ago and the key point made then is still relevant today. If you create a key for Government, the Government cannot prevent bad actors from using those keys.

The only thing of substance to this discussion that has changed since then is we have multiple robust open source cryptography implementations, which ensures that if the DOJ can lobby congress to make some laws requiring back doors or key escrow, that only criminals will have access to robust cryptography. And it will likely kick off a cryptography arms race, which will only make their job more difficult than they are saying it is already.

I doubt however the Legislative Branch will give them the laws they want. The last thing our legislators want is to make it easier for the FBI to spy on them.

<comment><USER3> > _The only thing of substance to this discussion that has changed since then > is we have multiple robust open source cryptography implementation_

We had some decent OSS crypto in the Clipper time frame.

What's changed is that strong crypto is now much more wide-spread in _NON_ open-source consumer products.

Crypto is not just for governments plus a handful of geeks any more. That's the big change.

<comment><USER4> In reading the article over lunch, I realized something else changed as well: the government now has the capability to data mine without human intervention on a massive scale. (Which I strongly suspect they didn't in the early 90s)

That substantially changes the key escrow argument.

What the NSA et al want is not the ability to decrypt communications, but the ability to _search_ all communications to generate intelligence. Naturally, this only works if the stored take is searchable, which encrypted content is not. (For practical and flexible purposes)

So the very existence of key escrow coupled with the desires of the NSA would almost mandate that any escrow keys available to the government be used continuously and automatically to decrypt content into a searchable data warehouse. Which is why if we allow this then in 5 years or less we're going to be having the Person of Interest "It's not a violation of your privacy if only an algorithm is looking at your data" discussion.

Or to quote Strangelove, "Mr. President, it is not only possible, it is _essential_. That is the whole idea of this machine, you know."

<comment><USER5> > we're going to be having the Person of Interest "It's not a violation of > your privacy if only an algorithm is looking at your data" discussion

There are signs in the Snowden documents that this view is already pervasive in the government.

<comment><USER6> Not only is it already pervasive in government, this type of dissembling has also been policy at Google for a long time.

        LIZ FIGUEROA, (D) State Senator, CA, 1998-06: We walk into this room, and it's myself
        and two of my staff— my chief of staff and one of my attorneys. And across from us
        was Larry, Sergey, and their attorney.

        All of a sudden, Sergey started talking to me. He said, "Senator, how would you feel
        if a robot went into your home and read your diary and read your financial records,
        read your love letters, read everything, but before leaving the house, it imploded?"
        And he said, "That's not violating privacy."

        I immediately said, "Of course it is. Yes, it is." And he said, "No, it isn't.
        Nothing's kept. Nobody knows about it." I said, "That robot has read everything.
        Does that robot know if I'm sad or if I'm feeling fear, or what's happening?"
        And he looked at me and he said, "Oh, no. That robot knows a lot more than that."

(from PBS Frontline's "United States Of Secrets", part 2)

</comment></comment></comment></comment></comment><comment><USER7> This was showcased during the last episode of the John Oliver show [https://youtu.be/zsjZ2r9Ygzw?t=522](https://youtu.be/zsjZ2r9Ygzw?t=522). Here's what happened : [http://www.nytimes.com/1994/06/12/magazine/battle-of- the-cli...](http://www.nytimes.com/1994/06/12/magazine/battle-of-the-clipper- chip.html?pagewanted=all)

<comment><USER8> That was a great article, thanks for sharing. This snippet puts things in perspective:

The agency is really worried about its screens going blank" due to unbreakable encryption, says Lance J. Hoffman, a professor of computer science at George Washington University. "When that happens, the N.S.A. -- said to be the largest employer in Maryland -- goes belly-up. A way to prevent this is to expand its mission and to become, effectively, the one-stop shop for encryption for Government and those that do business with the Government."

<comment><USER9> > "When that happens, the N.S.A. -- said to be the largest employer in > Maryland -- goes belly-up. A way to prevent this is to expand its mission

The article is from 1994 and I believe my reaction is as true then as now.

Why can't NSA just switch to doing 90% information-assurance and work to secure US infrastructure?

Certainly there is more than enough work to go around, if they are looking for something to do I have some suggestions. The US military isn't really known for having secure communications or storage systems, maybe NSA should try to solve that problem (as a plus it is already part of their mission).

Is the claim here that NSA's budget would shrink if all they were doing was securing US systems and communications against foreign intelligence agencies? Does Congress consider that task unimportant?

<comment><USER10> I'm pretty sure they're focused on stopping terrorist attacks like 9/11 from happening.

Note that the NSA is not asking for Apple to give them a special key to the iPhone. The FBI is asking for it.

Note that a former NSA director (Hayden) and CIA director (Woolsey) have said they both support Apple in this case.

<comment><USER9> I'm reacting to a statement from 1994 in which it was claimed that the NSA wanted to expand its mission to ensure it could still employ the same number of people.

>I'm pretty sure they're focused on stopping terrorist attacks like 9/11 from happening.

That was not NSA's original mission and if congressional testimony is to be believed, not one NSA is particularly well suited to do. SIGINT/COMINT targeting the organs of the Soviet Union is a very different game than interrupting a terrorist plot by a small number of unknown actors.

>Note that a former NSA director (Hayden) and CIA director (Woolsey) have said they both support Apple in this case.

The FBI's position is so unreasonable that it appears nearly everyone that is well informed about the issue and isn't currently employed by the US government supports Apple, but we are talking about the Clipper Chip which was an NSA program.

</comment></comment></comment></comment></comment><comment><USER11> All of the current wishful thinking by Comey, Obama, Fred Wilson, and others boils down to "Let's do a variant of the Clipper Chip."

Until the position of the side of the FBI moves off this mark there is not much to discuss.

<comment><USER10> I strongly disagree! Until they move off, there is everything to discuss. _After_ they understand the economic and security impacts of what they are asking, then we can relax.

We need to be active in the conversation about this. As technologists, we are the ones who understand the tech side of this issue best, and we should be reaching out to our representatives and talking to friends and family about this issue.

There are anti-encryption bills looming, and sitting around waiting for them to be proposed in Congress after some future terrorist attack is not going to do us any good.

<comment><USER12> _After they understand the economic and security impacts of what they are asking, then we can relax._

They do understand.

They have different axioms & goals, so their conclusion is different from yours.

<comment><USER10> Perhaps. Regardless of which of us is correct, we should still be reaching out to our representatives and talking to friends and family about this issue. Unless Obama changes his mind to support encryption, this is a public debate which will eventually start happening in Congress. It's up to us technologists to inform others.

</comment></comment></comment></comment><comment><USER13> What if instead of the Clipper Chip the NSA/FBI opted to install hardware 'backdoors' that could induce Fault attacks, Side Channel attacks, etc? I just don't see why the government gave up on the chip so easily

<comment><USER10> They did find other ways to get what they wanted. It was on a more ad hoc basis. And there they were focused

There's a video of former NSA/CIA director Michael Hayden talking about the clipper chip, and how everyone was saying "we're going dark" around that time. They found other ways to get what they wanted, and that's why both he and former CIA director James Woolsey do not support the DOJ's position in the ongoing case against Apple. I can't find the video where he talks about the clipper chip right now.

<comment><USER4> There's not really benefit to the NSA/CIA from a Clipper Chip 2.0.

None of the non-US targets they're pursuing would or could be mandated to use it. And all illegal domestic surveillance aside, foreign intelligence is still their primary mandate and target.

So in return for no benefit they get a lot of headache. (As you know its use would find its way into the US government, and suddenly the NSA has to support it via its defensive mandate)

</comment></comment></comment><comment><USER14> They underlying cipher Skipjack was also found to be rather weak. Some attacks were found against reduced-round variants of Skipjack that would have disqualified an AES or SHA3 candidate.

[https://en.wikipedia.org/wiki/Skipjack_%28cipher%29#Cryptana...](https://en.wikipedia.org/wiki/Skipjack_%28cipher%29#Cryptanalysis)

<comment><USER15> I think this shows how confident the NSA was/is in its cryptanalysis. You can assume that the NSA knew about the 31 round attack before they released it. The fact that they released it at 32 rounds (exactly the bare minimum number of rounds to resist attack) and that in the past 25 years, no one has been able to extend the attack to 32 rounds is in my opinion pretty impressive. Just like you can't help but admire the prowess of a tightrope walker walking over the Grand Canyon, in the same vein, the NSA achieving security with exactly 1 extra round for 25 years is a demonstration of its crypto prowess.

</comment></comment><comment><USER16> <sigh> Depressing how little has changed in the policy debate, but does give me the opportunity to pull this out of storage:

[http://i.imgur.com/Plzevno.jpg](http://i.imgur.com/Plzevno.jpg)

[http://i.imgur.com/KlnsFJX.jpg](http://i.imgur.com/KlnsFJX.jpg)

</comment><comment><USER17> I feel like there's good theoretical comp sci work to be done here to show that this system won't work. I've outlined two open problems below:

APPROACH 1:

Suppose we have a state issued crypto-system F0(Tc) -> Tp. Alice decides to place another crypto-system F1 on top of that which the state doesn't know about.

Alice unlocks her phone which runs the state's system F0(Tp) -> T1. However, T1 is still encrypted by the unauthorized second-tier crypto-system, F1. This middleware piece of software then runs F1(T1) -> Tp and we have our plaintext. The state, of course, doesn't have the backdoor keys to F1.

The question is how can one prevent this secondary crypto-system from existing? And if one can't, doesn't it make F0 merely a useless ornament that unwraps one cyphertext matryoshka only to reveal another?

APPROACH 2:

idea: any system with a built in guarantee of access by a delegated third party is in contradiction with some theoretical constraints of a generalized security system and puts the whole construction in a lowered security 'level' which had a smaller set of assurances.

Given a user generated token Ku, ciphered text Tc, and plaintext Tp, you have decryption as a function:

F0(Tc, Kc) -> Tp

This requirement is for another key to exist for the State, Ka such that a decryption function F1 (which may or may not be the same as F0) yields:

F1(Tc, Ka) -> Tp

Ka is allowed to be a "salted" key on a per device basis so it can vary across devices as an input to F1.

It does this through another secret function, F2 whose input will be the per- device salt Ds, and a super-global law enforcement key Kl - our secretly held master key.

Law enforcement applies the secret key Kl on the Device and generates the device's master key, Ka by using the Device's Salt:

F2(Ds, Kl) -> Ka

This means that for the law enforcement it's

F1(Tc, F2(Ds, Kl)) -> Tp

Where F1, F2, and Kl are secrets. Tp, Tc, and Ds is known by us and we are free to change.

Here's the issues:

Kl is global across all devices.

F1() must always work regardless of user generated Ku although Ds is allowed to change as a function of Ku.

If I can generate as many Tc and Ds as I can, can we show that given a known F0, F1 and F2 can only be constructed from a exhaustibly reasonable finite set.

How about the idea that the cost of brute-forcing Kl, the master law enforcement key, continually decreases as the number of devices that Kl can open, thus the value of Kl, continually increases? What do the range of those slopes look like?

<comment><USER18> Any otherwise well-designed system with a built in guarantee of access by a third party is only secure if you can trust that third party. You don't need to prove any theorems to know that. I don't think anyone is arguing that such a system is impossible to build, they're arguing that no such trusted third party exists, and no one who actually cares about keeping a secret would ever willingly use such a system when alternatives exist.

<comment><USER17> I'm interested in the argument line that would be "Ok, let's assume you are impeccably honest, infallible, and have unwavering integrity and unstealable secrets ... even under those laughable, impossible conditions, it's _still_ a terrible idea because of the following..." and go from there.

<comment><USER19> The perfect recipient would still have to be sent backdoors from many creators. Many more people would be handling the secret, each one a target to be social engineered into handing it over. I imagine when a more typical backdoor is made, very few people even know it exists let alone know the key to open it. Mandate backdoors and everyone knows they exist so more people will work to find and crack them. They would be very high value targets. Once opened, a backdoor would take a lot of work and expense to be closed, if you even know it had been opened.

<comment><USER17> Yes, the whole idea is about as plausible as this april fools joke: [https://en.wikipedia.org/wiki/Evil_bit](https://en.wikipedia.org/wiki/Evil_bit) ... but it's been put forth and implemented too many times for comfort.

Each time these silly systems like DVD-CSS broke down and became worthless or like DIVX, were widely panned and rejected by the consumer.*

Showing how this will always and forever be the case at a more fundamental level to stop trying this deadbeat idea with different gift-wrapping would be great.

* Even in MP3, you have bits 29 and 30 which are for copyright. What were they thinking? people would re-implement /bin/cp to look for that and fail if the bit is set? Really? AAC has something similar. silly.

<comment><USER20> If all the vendors participate in the scheme, it works?

Ex: SCMS copy bit

[https://en.wikipedia.org/wiki/Serial_Copy_Management_System](https://en.wikipedia.org/wiki/Serial_Copy_Management_System)

</comment></comment></comment></comment></comment></comment><comment><USER21> Didn't know about this. Good timing.

</comment><comment><USER22> Sneakers had the best Clipper Chip ever, and in the 90's!

</comment><comment><USER23> Man the war against oppression / totalitarianism never ends.

Back in 1994 when David Letterman's top-ten lists were still a thing and funny, before instant make a t-shirt websites, I tried to bring attention and defeat the Clipper Chip by printing, selling and eventually giving away "Top 10 reasons to Say No to Clipper" shirts. My 15min of Internet fame (back when that was a saying).

excerpt from usenet post [http://archives.scovetta.com/pub/textfiles/digest/cpd/v5_045...](http://archives.scovetta.com/pub/textfiles/digest/cpd/v5_045.txt)

The front has a "Big Brother Inside" Logo, and a chip with the word "clipper".

The back has the following top-ten list (possibly with changed order or slight wording/spelling/grammer corrections);

"Top 10 reasons to Say No to Clipper"

      #1  "Can't trust Clinton not to read McDonalds recipes for Big Mac secret sauce."
      #2  "We all know its just so the FBI can get free phone sex."
      #3  "The spies at NSA will get eyestrain reading all of Santa's mail."
      #4  "Because a policeman's job is only easy in a Police State."
      #5  "The Clipper chip will cause it to be slightly less convenient to plan protests, revolutions, conspiraces, and bake sales."
      #6  "The 4th Amendment was a pretty good idea. Read it."
      #7  "If the Feds listened to my conversations they would be too bored and sleepy to defend our country."
      #8  "Responsibility and Government don't mix. See #10"
      #9  "It will get the stupid crooks out of the way for the government sponsored ones."
      #10  "If they learn how unhappy we are with the government they might start shutting down BBS's, killing off divergent religious groups, illegalizing art, conducting radioactive tests with us, censoring books, and keeping files on us.

btw #10 is all things US government had done. big bro inside was play on intel inside logo of the era [http://erik.co.uk/hackerpix/bigbro.gif](http://erik.co.uk/hackerpix/bigbro.gif)

<comment><USER24> this is crazy :))</comment></comment>


Oracle to start requiring subscription for Java - <AUTHOR> https://www.infoworld.com/article/3284164/java/oracle-now-requires-a-subscription-to-use-java-se.html <comment><USER2> Clickbait title. Oracle charges money for commercial support. In other news water is wet.

</comment><comment><USER3> Anyone care to explain the real benefits of this rather expensive product?

As I understand it, Oracle doesn't require it to enable anything ... is early access to new builds that important?

</comment><comment><USER4> This is necessary because why???

There's already the regular jdk, does this add anything. Is there anything in the professional package as for useful tools?</comment>


A brief history and future of credit scores - <AUTHOR> https://www.economist.com/international/2019/07/06/a-brief-history-and-future-of-credit-scores <comment><USER3> [http://archive.is/NtfoT](http://archive.is/NtfoT)

<comment><USER4> Thanks, economist.com is terrible

<comment><USER5> Meta comment but why do you say this yet read their content?

<comment><USER6> Their content is good but their site design is bad. Good thing we have nice users like GP who'll post the content in a readable form.

</comment></comment></comment></comment><comment><USER7> There's commentary abiut incidentally discriminating based on race (e.g. zip code aa an input can act as a proxy for race).

Would giving out more loans than is rational by excluding stuff like zip codes be a good thing? Wouldn't that lead to more defualts among those groups of people zip codes can discriminate against?

<comment><USER8> This brings up a bit of a "trolley problem" of an ethical dilemma. Say you're asked to create a machine learning system, but you know that the data quality is so poor that you're very likely to overfit in a way that will deny economic opportunities to underserved communities that currently have them. But if you don't create that system, you're denying economic opportunities to _other_ underserved communities that currently do NOT have them. Do you take the job? Moreover, if you'll do _less_ harm than someone else who might be hired, does that make a difference?

There's no Hippocratic oath for our profession, and in many ways that's important, because we create systems whose impact may very well outlive us and out-scale anything that a single medical professional could do. But that also doesn't mean we should operate in a utilitarian environment without constraints.

<comment><USER9> >>> no Hippocratic oath for our profession

Sadly there is no profession for our profession. I often think the model for any software profession (if we can create that - something I doubt) is railway engineer - where the professional signs off on the safety / completeness of work done on the railway - and that no train can travel without it. It leads to plenty of uncompetitive practises - but also to ... y'know ... people not dying in crashes.

How we start that is hard (probably something to do with safety critical software systems) because we aren't too sure what is _the_ right way to build software.

And then we have the fun problem of the members of the profession trying to decide the answer to your trolley problem. Sorry scratch that. The various legislatures proscribing the answer and the profession trying to implement the conflicting results !

</comment></comment></comment><comment><USER9> I often think _the_ most effective means to increase loan repayment rates is to provide the debtor with a effective accurate money management tool - <USER2> of like Mint but better. I am supposedly a well educated intelligent software engineer and yet trying to get a single unified view of what I spent is outrageously challenging or requires discipline at a level of dieting.

Apart from fraudsters, people who take out a loan want to pay it back but like dieting human failings cause the problems.

Just a instant check on what you have spent globally will make a huge difference in budget management.

<comment><USER10> That's part of the problem. A budget is a plan, not a running total. You budget what you can spend then change what you do spend to match. (If only it were that easy, though. I'm human too)

<comment><USER9> but an accurate and up to date running total of how you match to budget helps enormously (even if the budget is the default of "don't spend it all"

</comment></comment></comment><comment><USER11> I think it is important to realize that this is really a US thing. In my country people have a mortgage and that is usually it. The rest, we save money for and buy it when we have the money.

Our mortgages are pretty bad though and rent combined with housing prices pretty much adapt to the median income, imo, when rent goes down, housing prices shoot up to compensate and get monthly costs back at the same level where a median family need two working parents for a reasonable home in the city roughly. Now, rent has nowhere to go but up and housing prices will fall again, I predict.

<comment><USER5> It's not really a US only thing - based on your username I'm assuming Dutch? - a quick Google says that there was 6 billion euro in new consumer credit in the Netherlands last year, and it's been much more than that even in the past decade. People in the Netherlands seem jsut as likely to buy cars on finance and rack up credit card debt as everyone else.

<comment><USER11> Oh.. must be my bubble then :)

<comment><USER12> Also, due to massive migrations the distinctions between countries are disappearing. So traditional Dutch may behave exactly as you say, but if immigrants from the same source go to different countries (like Netherlands and US) but act similarly then they will push these economic metrics towards each other across their host countries.

</comment></comment></comment></comment><comment><USER13> [https://outline.com/zq5nfd](https://outline.com/zq5nfd)

</comment><comment><USER14> The key here being that non-financial data isn't actually useful in predicting ability to repay loans. I'm sure it'd be used somehow by modern financial institutions if it were predictive.

<comment><USER15> I find this interesting because when I applied for a mortgage at Wells Fargo they asked me for my race in the application process.

<comment><USER16> I get confused by those they claim some of these ML or NN algos are black boxes and so could be breaking the law. If you're not inputting illegal info (like race, sex, national origin, religion, name, etc. or corollaries), then it's not making its risk assessment on that basis. All you have to do is look at the inputs. It isn't unknowable whether or not it's breaking the law.

<comment><USER17> Let me try to clear your confusion: an input my seem innocent (e.g. zip code), but a zip code is likely to correlate to ethnicity and race in some regions. So even if the inputs seem legal, an ML model that's sophisticated enough can derive illegal results that discriminate against certain populations.

<comment><USER18> Are there any real-world examples of an ML system causing protected-class discrimination based on non-protected criteria?

<comment><USER19> A recruiting tool used by Amazon developed a bias against women despite not being told candidates' genders. It penalized candidates who were graduates of all-women's colleges and also those who had the word "women" in their resume (e.g. "women's chess club captain.") It had been trained on resumes submitted to Amazon during the previous ten years, so the tool's bias was likely reflective of real human bias in Amazon's recruiting process.

1\. [https://www.reuters.com/article/us-amazon-com-jobs- automatio...](https://www.reuters.com/article/us-amazon-com-jobs-automation- insight/amazon-scraps-secret-ai-recruiting-tool-that-showed-bias-against- women-idUSKCN1MK08G)

<comment><USER20> From my reading of that article, I think the recruiting tool was fed resumés and a data point saying whether or not the corresponding candidate was hired or not. As a result, the tool not only developed a bias against women, but was effectively evidence that there was bias against women in the original hire / not hire decisions.

<comment><USER20> I _just_ missed the deadline to edit my post, so I am replying to myself.

Looking at the parent comment again, I seemed to have just restated it without adding anything new of my own. I meant to add that my reasoning for why Amazon pulled development of this tool was not just because the tool's bias, but also because that the existence of the tool and its associated training data could open up Amazon to litigation claiming that their hiring decisions were biased against women in ten year span referred to by the article.

<comment><USER21> It's interesting that nobody even bothered to check whether the bias was illicit. They found something that sounds bad and the immediate response is "OMG bad PR, pull emergency shutdown."

They just assume that "women's" is coding for female candidates and not something more specific, like gender-segregated activities that may legitimately produce lower quality candidates than the equivalent integrated activities that exposed the student/candidate to a more diverse cohort population. Probably also doesn't help that some of the biggest gender- segregated institutions are penal in nature, i.e. "reform school for troubled girls" or "women's correctional facility."

Did anybody even check whether it also penalizes words like "boys" and "gentlemen's"?

<comment><USER20> To be fair, it would probably take more time and money irrespective of litigation to be sure that there was illicit bias than to just delete everything and call the exercise a failure.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> Using telco data to create credit scores based on prepaid sim activity in developing countries: Juvo.com

</comment><comment><USER23> [paywalled]</comment>


How Google Went Into "Code Red" And Saved Google Buzz - <AUTHOR> http://www.businessinsider.com/how-google-went-into-code-red-and-saved-google-buzz-2010-2

<comment><USER2> I think the verdict is still out on if it is saved. Also, if they had done a better job of figuring out the implications of their features, maybe the product would have launched with positive press. At the very least, they could have taken the weekend off and not caused people to worry about their physical safety.

<comment><USER3> Buzz as a product may fail, but they did save Google as a whole from much worse publicity.

They took a serious hit as it is, but they did a good job of damage control once they realized it was necessary.</comment></comment>


Ask HN: Do you use any code obfuscation? - <AUTHOR> Do you use or know of any code obfuscation products that can work across different languages ? <comment><USER2> That's a $5.00 word. Does that mean changing one language to another?

<comment><AUTHOR> Not changing. Just obfuscate binary files and JAR files (if it even makes sense)</comment></comment>


First ever film donation blockchain, help create motion pictures - <AUTHOR> http://www.ftwtokens.io <comment><USER2> Donation?

Will the funds be in blockchain escrow to assure Anthony Daniel who is the CEO of Dream Comet Studios will not misuse the funds, or pull an exit scam?

Someone already tried this, and they predictably setup LLC shell companies with empty office spaces.

[https://davidgerard.co.uk/blockchain/2018/01/26/children- of-...](https://davidgerard.co.uk/blockchain/2018/01/26/children-of-satoshi- an-ico-funded-tv-action-drama-about-bitcoin/)

<comment><AUTHOR> Review our Whitepaper and you will see we mean business. Anthony Daniel already has two feature films out worldwide along with TV series in the works. Dream Comet Studios has been around since 2014. Yes, there is an escrow along with a lot of plans for 2018.</comment></comment>


On Hiring Developers - <AUTHOR> http://blog.trackabout.com/2012/10/03/on-hiring-developers/

<comment><USER2> Re: Codility

> People who get offended too easily are probably those who you don't want to > hire (emphasis mine).

So basically it seems to be the thought process is:

1\. I want you to waste your time (but not mine, because I'm more precious than you are) doing an online exam before I am willing to talk to you on the phone, or meet you face-to-face like a normal human being.

2\. If you are offended by this, then you are wrong. It just proves that you are "difficult" and I was right not to hire you in the first place.

Way to go wining over developers. I wish you well.

<comment><USER3> I'm so with you on this, but also split. I _get_ it - you want someone to prove a baseline ability. However, I'd like to think someone who wants to hire 'awesome' developers will do some non-standard things like... you know, checking out that developer's code repos on github/bitbucket/sf, reading their blog, watching them present, etc. Granted, not everyone does this of course, but some do.

I applied some place (at the recommendation of a few colleagues who thought I'd be a good fit), and got extremely basic 'who are you?' sort of questions - the interviewer clearly hadn't read my resume at all. "What do you know about our service?" "Well... your marketing person tweeted and promoted some open source code that I released to run on your service last month..." "Oh". "And I've blogged about your service and published some user group videos about using your service over the last year or so". "Oh".

Just like employers want to avoid time-wasting candidates who can't do basic fizzbuzz stuff, many of us want to avoid wasting time with potential employers who can't extend a basic courtesy like doing 3 minutes of googling about a candidate before talking to them on the phone.

<comment><AUTHOR> I love it when a candidate has some kind of public presence. The very first question in our online application asks, "Do you code outside of your day-to- day job? If so, what have you built, and how recently did you work on it? Be specific. Provide links if possible." I look for developers who get out into the community to learn and teach new ideas, new approaches. They might attend user groups, present, contribute to open source projects, etc. These kind of activities prove the candidate really lives and breathes this stuff. It's tough to fake passion. We have developers with projects on the side, libraries of Pluralsight courses they've developed, well-read blogs, eBooks on development topics, and some who get invited to speak regularly on podcasts like Hanselminutes and .NET Rocks. We encourage all of the above.

The point about trying to save time from a recruiting perspective are spot on. We really can get buried with candidates, and there isn't enough time in the day to get through them all. We work hard to create a really great place to work and a good reputation so candidates will be willing to do something like take a Codility test.

</comment></comment></comment><comment><USER4> I have to admit, I don't mind tests, though they always make me nervous. I can, have, and do build quite good sized web apps from the ground up, but proving myself in programmer tests makes me want to jump out of my skin.

But, I like my IDEs. I did the demo test, and ended up glancing back at VS to get the darned using statement I needed. I can't say I like the thought of being tested against remembering all the namespaces.

That being said, I may do a few more practice runs on that site.

</comment><comment><USER5> It's always so exciting when companies decide their blog should target HN.

</comment><comment><USER6> What platform, languages do you use? I may want to apply to this company in the future! (Ruby on Rails programmer, currently working from home full time)

<comment><AUTHOR> Hi. We're primarily .NET, HTML/js/css, SQL. Sorry, no ruby.</comment></comment>


The State of JavaScript on Android in 2015 is… poor - <AUTHOR> https://meta.discourse.org/t/the-state-of-javascript-on-android-in-2015-is-poor/33889/3 <comment><USER2> Android phone manufacturers blindly push their hardware specifications--multi- core processors with weak individual cores. They promise the moon and deliver this. This is a test to see whether they are able to deliver. As a participant pointed out in the linked discussion, as a user I am used to the speed (or slowness) of my phone, so it doesn't matter much daily unless it is clearly slower than all other activities (my friends old Samsung takes a seconds to register each touch but he is okay with it but after trying a faster phone he fully realises what is possible)

As an Android user (Xiaomi Mi 3, Moto G) I never understood why some people were comparing the hardware specification of iPhone with the Galxys and acting all superior. I always felt they should instead focus on the performance of the two systems.

Apple's devices are snappier than Android in general (yes, even at the same price range)--time for smoothly loading background apps is the biggest noticeable event that I experience daily. But I will continue to be a Android user because I like having three buttons, not much concerned about the _quality_ of the available apps, the customisability of the OS and ease of transferring content to other phones and to my computer etc.

Android manufacturers need to get their stuff together.</comment>


10 Minute Mail - disposable emails - <AUTHOR> http://10minutemail.com/10MinuteMail/

<comment><USER2> These services claim themselves to be a spam fighting tool. Ironically, they facilitate another time of spam. Forum and Comment spam.

I'm definitely tracking a rise in the number of these types of services, used for posting comment spam - and signing up to post on forums.

(I've even seen normal email spam - 'appear' to come from disposable email addresses. There are so many services around - easy to find ones that don't setup SPF etc)

<comment><USER3> _creator of 10MinuteMail here_

I know many services, including mine, do have anti-abuse features (rate limiting address allocation, other pattern detection and blocking mechanism), however you can't always tell a legitimate user from an abusive user. For what it's worth 10MinuteMail gives out millions of addresses for each time I hear about anyone posting spam on a forum or anything like that, so I think that the "good" users far outnumber the "bad" ones.

At any rate, ignoring the flaws in the approach that a unique email address is a good way to tell good signups from bad ones, I guess I'd like to ask two questions:

1) Why are temporary email services that much different from GMail/MSN/Yahoo/Personally owned domains/etc... when it comes to abuse prevention on a given forum?

2) Does anyone have suggestions on improving the recognition and blocking of abuse versus legit usage? I absolutely detest forum spam and would like to prevent it if I can help.</comment></comment>


China's all-seeing surveillance network - <AUTHOR> http://mobile.abc.net.au/news/2018-09-18/china-social-credit-a-model-citizen-in-a-digital-dictatorship/10200278 <comment><USER2> Stuff like this will slowly stop further evolution of society and lock down the status quo. Right now we still have ways to change society peacefully but in a surveillance state either nothing changes or change has to come with force.

I think societies with massive surveillance will stagnate until they collapse.

<comment><USER3> Or more frightening, the Communist experiment is successful long-term and becomes the dominate model for 'stability' globally.

<comment><USER4> At first I was terrified of this, in the short term this could cause a lot of suffering but I've become convinced it will fail in the long term.

Human societies have evolved a very sophisticated mechanism for moving people up and down hierarchies using a distributed reputation tracking system. This system is interesting in that they're trying to centralise the reputation tracking system and thereby control it.

To the extent that it replicates what people, on average, think about you I think it'll work. But planned economies loose to unplanned ones because distributed decision making outperforms centralised decision making. Eventually this system will be misused, make bad decisions, or get ridiculously complex. Then people will loose faith in it. When that happens there's very little China's government can actually do to control 1.4 billion people. (That's not to say that there their remaining options aren't very worrying though, e.g. tanks)

<comment><USER2> With enough computing power and ruthlessness it may actually be possible to control 1.4 billions. I don't know how things would have worked out if Hitler or Stalin had had current or soon to be technology. Thank God North Korea doesn't have the money to buy or develop the latest surveillance tech either. They may have succeeded for much longer. In the end I think dictatorships will always blow up but tech makes their life much easier.

</comment></comment></comment></comment><comment><USER5> I think this is a horrible idea.

Just imagine how many times we have been wrong in our judgement of the behaviour of citizens. What would the social credit score of Ghandi or Martin Luther Kind have been, at the time of their prominent actions?

We have proven time and time again that there is no sure way to judge how "social and acceptable" something is, and the value of a behaviour to our society.

What is seen as "unsocial" today may be applauded by historians in the future.

<comment><USER6> I'm pretty sure that's half of the point, stop any radicals from forming large followings.

<comment><USER7> Where radical means those that those the people in power in any way.

</comment></comment></comment><comment> adam-a It's an interesting article but it is also worth remembering that western society is not all that far away from this vision. Credit scores are widely used, there are apps for them, they can prevent you from getting housing or loans. A criminal record likewise affects your employment prospects, and many other areas of your life. CCTV may be widespread in China but the USA and UK are still way out in front[0]. Lastly, for the suppression of the guy who uncovered party corruption, just look at the treatment of Snowden or many other whistle blowers.

0 - [https://www.statista.com/statistics/484956/number-of- surveil...](https://www.statista.com/statistics/484956/number-of-surveillance- cameras-per-thousand-people-by-country/)

<comment><USER8> stop this "what about the western world". I see this pattern every time there's a critical article about China. When there's an article about the west's censorship, we would be happy to talk about it, but for now, let's focus on the ridiculous and crazy to be put it mildly things going on in China.

<comment><USER9> Why? We are not chinese. We don't live in china. I'm more worried about censorship in the US and especially europe since europeans seem so intent on bringing their censorship to the US and the entire world. At least the chinese censorship affects their country mostly.

> I see this pattern every time there's a critical article about China.

Because we get the same story about china multiple times in a day.

Just from "abc.net.au" within the past 19 hours. The same story has been pushed onto the frontpage.

"China's all-seeing surveillance network"

[https://news.ycombinator.com/item?id=18030655](https://news.ycombinator.com/item?id=18030655)

"China is building a digital dictatorship to exert control over its 1.4B citizens"

[https://news.ycombinator.com/item?id=18026060](https://news.ycombinator.com/item?id=18026060)

I'd called this propaganda rather than news.

> let's focus on the ridiculous and crazy to be put it mildly things going on > in China.

Why? If china wanted to export their dictatorship to the US, I can see why we should be concerned. But they aren't. It's primarily europe and segments of puritanical leftists and rightist in the US along with parts of the tech leadership.

It's fine to have a story about china once in a while, but multiple times daily just reeks of propaganda.

<comment><USER10> China is already exporting its dictatorship (influence = power), look at their One Belt One Road project, and the predatory loans to African states.

And don't forget the clashes and island building on the South China Sea.

<comment> adam-a It remains to be seen whether the OBOR loans are predatory or not. Most of the projects are still underway at this point.

</comment></comment></comment></comment></comment><comment><USER5> I sometimes feel like currency is a primitive preliminary to this social points system.

People who show unusual or controversial behaviour (be it political or social) will soon loose sources of income and thereby social status.

People who stick to the accepted norms and ethics and do not act up will on average have the chance to move up the ladder and earn more money and prestige.

The analogy is not perfect, of course, but money has similar effects on our society.

<comment><USER4> It's similar, but in capitalist systems all get a weighted vote on how many points you get. (Either by buying your time/products or if I'm your boss I can promote/fire you). By the look of it, the Chinese system gives complete control to the government. So it's analogous to a fully planned economy.

<comment><USER5> I agree with your point.

I am sometimes baffled when people seem to think that the amount of money that is payed for a certain job is proportional to how beneficial that job or service is to the society. I mean, there are Bankers who make good money screwing everybody over. Yet somehow people seem to look up to them.

I'd like to think that there might be improvements in how we value/pay services. But letting the government decide that is also quite foolish.

</comment></comment></comment><comment> EZ-E The article confuses the Sesame score (credit score computed by Alibaba to be used within their app) and the social score (government project which isn't really deployed yet but intended to rely on multiple private sources like Alibaba's sesame score)

In the 2018 state of things, the social credit score is not (yet) as invasive as the article suggests. AFAIK it does not change according to your purchases, daily habits or online comments unless you get arrested. For now it mostly is influenced by credit repayments, debt and previous condamnations. I lived there 3 years and my "sesame score" as displayed on Alipay is still the default one.

</comment><comment><USER11> Better title - _Social credit: China 's digital dictatorship_

Pretty horrifying story, sounds like Black Mirror.

<comment><USER12> Yeah, the title is awful - I was happier with the article then I thought I'd be, as it did go in to some of the negative points. To point to any atomic automatic judgment of ones citizens based on their beliefs as a good thing is a bit of a weird view, however. The examples they give are all terrifying.

It's also not great that the lady they report as pro social credit is only revealed later on in the piece as being married to a high ranking party member. She's introduced as "a marketing professional" when I'd argue the most relevant facts towards her support/non-support of such a system would be that she is married to "a civil servant in the justice department, a loyal cadre to the party."

The article makes several strange emotional appeals regarding her, actually. For instance, I'm glad she "married for love", but I don't see why it would be relevant to the issue at hand unless it was an attempt to further humanize her and, by extension, this new Permanent Spotlight system.

<comment><USER13> > _I 'm glad she "married for love", but I don't see why it would be relevant_

They're just making the point that she didn't marry him for his social credit score, even though he happens to have a high score under the system.

To quote the article immediately prior to that section:

 _" Who your friends and family are will affect your score. If your best friend or your dad says something negative about the government, you'll lose points too. Who you date and ultimately partner with will also affect social credit."_

It seems like your social credit score is positioned as your key to happiness. Better not get a bad one or associate with anyone who did. Better not wreck your child's future by saying something bad about the government.

<comment><USER12> _> They're just making the point that she didn't marry him for his social credit score, even though he happens to have a high score under the system._

Yes, that makes sense. I still hold that the deliberate omission of her party relationship until later in the article is to initially position her as a third party positive voice who happens to support the system.

And yes, the network affects are particularly awful.

</comment></comment></comment></comment><comment><USER14> Thoughtcrime at its best.

The system wants to prevent the masses from thinking a different way, as the official way is.

This is 1984 and even better. By giving "credits" (gamification) the people are like the frog in the boiling water. When they recognize it, it is to late.

Is this the natural development of social media: Who does not conform to the masses, will be spit out by society?

Many dictators try to get their nations "in line" by using such tactics. "We are all one people -- we act as one people".

Is social media and gamification the solution for the wildest dreams of dictators?

Individualism must and will be killed in such a system. Only one Individuum can exist in the long run: The queen/king of the bee colony.

</comment><comment><USER15> Ironically Dandan is probably flagged now for agreeing to be part of this article ...

<comment><USER12> I'd imagine given her husband is a Chinese civil servant, this is either with approval or she has been asked to do it.

There's no way a marketing consultant and a civil servant don't understand the potential ramifications of being part of the article!

</comment></comment><comment><USER16> Future job role: Sesame Credit Optimisation (SCO)

There's going to be so many ways to game this system when it gains wider adoption, it's going to be insane.

</comment><comment><USER17> > Every step she takes, every one of her actions big or small — _even what she > thinks_ — can be tracked and judged. [emphasis added]

Can anybody shed upon how these Social Credit systems would be able to track what a person _thinks_?

<comment><USER18> Facial expression recognition. I was talking with one big data analysis vendor who claimed they installed expression recognition software outside toilet stalls in the Dubai airport. If you exited the khazi with a disgusted expression, the system would recognize it and dispatch a cleanup crew.

They also claimed they could detect if students were bored in class and feed this info back to the teacher. Up next: thoughtcrime.

<comment><USER17> I wouldn't have lumped expression recognition with what one is thinking.

It's feasible that a person could leave a toilet with a displeased expression while pondering some peculiar nuance of some specific domain of knowledge.

But maybe in this context you're right, the article meant to refer to expression recognition.

</comment></comment></comment><comment><USER19> This system is similar to ones already operating in MMORPG. And I'm sure that system in China is being exploited already. Finally only exploiters will get all the benefits leaving regular people far behind.

<comment><USER20> I'd say your actions as a citizen would only net you -100 to +100 points. If you really wanted the 'heaven on earth' they promise you would need a friend in government to give you the ol communist loyal bonus of +500, or loyal party member bonus of +1000 purchasable from your local party rep for only 5,000,000 RMB.

</comment></comment><comment><USER21> I expect those that defend the system see its appeal as a more rational alternative to guanxi, the informal networks of trust and reciprocal obligation that pervade Chinese society. Do you want a loan, or need a good hospital for your parent? You don't need to bribe or schmooze with the right person, only to be an orderly, hard-working citizen.

On the other hand, you're trusting your score to "the algorythm", and any SEO consultant can tell you how brutally flawed and unfair "the algorythm" can be, even without overt malicious intent.

<comment><USER22> with enough guanxi you will be able to change your score accordingly, so this credit system is solidifying the status quo

</comment></comment><comment><USER20> So much for chinese dominance as a superpower, they are really shooting themselves in the foot with even trying this.

<comment><USER23> Note that Soviet Union remained superpower for some 70 years after it shot itself to the foot with Ukraine famine. While I agree ultimately this will fail to produce a competitive society, it might take a long time before people will be able to change the things for the better.

<comment><USER20> Accurate, but that's 70 years of social development they'll miss out on. In the meantime the west will continue its shitshow into some undetermined darwinistic future, as it has always been. Things are speeding up so we both know it won't be 70 years, the social score thing is just an expression/attempt at central control, wich has never worked. Economy and social values as a chaotic system, predicting the future, etc.

</comment></comment></comment><comment><USER24> the irony here is that the premise might not even be true -- does social credit really provide the "control" or "stability" it aims to achieve? who is writing the algorithm that says "napkins" credit your social score while alcohol debits it? compare financial scores which are not perfect either but they are based on models that have some science behind them. what model underwrites the social credit system? is it valid? it's scary to think that it could be arbitrary

</comment><comment><USER25> Don't blame China. It is pretty much the same in many countries.

With a few exceptions in Europe, some sort of extreme surveillance state already exist in every country that can afford it.

</comment><comment><USER26> Obviously the camera system can track humans walking around, but does it actually identify specific individuals?

What does that number in the box with the chinese text mean?

Are they able to use facial recognition _everywhere_ and thus record where everyone is or, more importantly, was?

I am skeptical that this can pulled off with current technology?

Can it?

<comment><USER27> You could fuse the facial recognition data to phone radio base station tracking, bluetooth beacons and such to get multiple points of reference for verification. And tracking between workplaces, apartment buildings and transport turnstiles where you scan your personal ID.

</comment></comment><comment><USER28> So, does anybody know how far off this is? Is this real within 2 years?

<comment><USER29> The article says there's pilot programs already happening, and it will be full operation by 2020, so yes, it's real.

</comment></comment><comment><USER30> I think the concept of social credit has a lot of merits. But the risk for overreach is substantial unfortunately.

I'd love to get rid of people who are unable to ride a train like a social human from the trains and lock people out of cinemas who can't behave as one should expect.

<comment><USER31> And I'd love to give people who have similar views to you (on this matter) a -1 score for life. Who's right?

<comment><USER30> Well the rules should be known just as laws are, not a personal opinion by Mr Inifinitypants.</comment></comment></comment>