Passcard - <AUTHOR> https://passcard.info/ <comment><USER2> But what is it? What does it do?

"Introducing your passcard!", "Choose a registrar", "Your all access pass to everything.", "A system giving users control of their identity."

I still have no clue what this thing is, or why I would want it.

<comment><USER3> See this blog post for the appropriate context:

[http://blog.onename.com/passcards/](http://blog.onename.com/passcards/)

This was submitted to HN earlier in the morning [1]

[1] [https://news.ycombinator.com/item?id=9524702](https://news.ycombinator.com/item?id=9524702)

<comment><USER4> That's information that should be on the homepage, not hidden away on some blog.

</comment></comment></comment><comment><USER5> I keep looking over the main page of this site to see if there's anything I missed, but it really does seem like either this is a joke that I don't get, or there is no information whatsoever to say what this actually is, how it works, what is involved from my end. There seems to be a lot of expectation from this page that users will dig into documentation or other resources on something that apparently controls or maintains their identity (?) instead of just ignoring it and moving on.

EDIT: I see there is an FAQ page if you click on the "☰" at the top. It is mostly just as vague, though it talks blockchains -- something I'm very unfamiliar with. Is it to be assumed that this is a product for very specific tech people who are familiar with blockchains?

<comment><USER6> It seems more that the reason the copy is as vague and doesn't directly mention blockchains on the homepage is because this is supposed to be a project for non-tech people - personally, I'd find a decentralized blockchain- based identity system very difficult to describe in simple non-tech terms to anyone, so good copy is clearly a challenge.

</comment></comment><comment><USER7> This is an interesting idea, but every time I see these sorts of "reduce the number of items in your wallet, passwords in your brainbank, and keys on your keyring" products my knee-jerk reaction is, "okay, so now all an identity thief has to do is take my one item/password/key and they have access to my everything?"

<comment><AUTHOR> Yeah, that is my concern as well. I think the idea here though is more like a Mozilla Persona service via Namecoin

<comment><USER7> Idk, they mention eventually using it as both digital and physical identification:

> "At first, you'll be able to present your digital passport when logging into > applications, and eventually you'll be able to use it when asked to present > identification in an in-person context (as you would with a passport or > driver's license)."

Pragmatically, it seems like a good idea. It just makes me nervous.

</comment></comment></comment><comment><USER8> Why are major app vendors going to deploy another federated identity system that virtually none of their users will use? OpenID was a fiasco. This seems _even more complicated_ than OpenID; at least in OpenID, there were huge sites you already used that could serve as anchor identities.

</comment><comment><USER9> "Passcards are securely encrypted and then stored across a secure network of computers (also called the blockchain)."

Is this where we're headed? Take any idea, then tack on "stored on the blockchain" to the end?

<comment><USER10> If you create something that is "Uber for X, stored on the blockchain, anonymous & ephemeral" that's like 80B valuation right there.

"Uber for x, blockchain, anonymous, ephemeral" -> the evolution of "Social/Local/Mobile"

</comment></comment><comment><USER11> Choose a passcard Registrar:

      * ONENAME
      * NAMECOIN
      * NOPE

I'm not interested in this rehashed blockchain crap. Why do people think this is the future?

<comment><USER12> Because it provides a decentralized mechanism to verify things without a central authority? It may or may not be the future, but it's pretty much what we have right now.

<comment><USER13> Well, in those terms, how does this solve anything that the PGP web-of-trust fails at?

<comment> jude- (Disclaimer: I work part-time for Onename).

The key difference is that Passcard requires a quorum of mutually-distrustful blockchain peers that attest to the validity of your public keys. We believe this is a much stronger guarantee than a web-of-trust, since it (rightfully) does not assume that trust is somehow transitive.

<comment><USER13> I guess I don't understand specifically why a distrusted "blockchain peer" is superior to a distrusted peer's digital signature.

The way I see it, blockchains use proof-of-work to enforce/record transaction sequences. It not clear to me what use transaction sequence is for establishing identity. If I'm looking for a quorum of distrusted endorsements, I just want to know how many endorsements exist, right? Where's the use of the transaction sequencing? Proof-of-work doesn't make one endorsement more trustworthy than another, does it?

Blockchains don't look at how many transactions an address has performed except to compute available funds for the transaction--otherwise they just check the signature validity. It's just not at all clear to me what's even trying to be achieved here.

<comment> jude- The intuition is that the cryptocurrency miners act as a large decentralized first-come first-serve notary for the transactions they append to the blockchain. If a peer submits a valid transaction and it gets included in the blockchain, it means the majority of the other peers have accepted the transaction as valid and will continue to serve it to other peers. As a side- effect, any data within a transaction gets included and served as well, and (this is where the proof-of-work comes in) it cannot not be retroactively altered without first retroactively altering the blockchain itself.

Onename leverages this fact to bind your human-readable username to the hash of your passcard in a first-come, first-serve basis. When you sign up for a passcard, the (username, passcard_hash) tuple gets submitted to the blockchain as part of a valid transaction, so that once the transaction gets accepted, the peers will continue to preserve this information. There's similar process for changing name ownership and revoking names and credentials.

The trust you place in the validity of Onename records on the blockchain comes from the steep cost of silently altering it. You have to launch a 51% attack to alter it at all, and you have to alter _every_ local copy of the blockchain without drawing notice to do so silently (otherwise, a fork will be observed). This means once you're committed the requisite information in a transaction, there's a good chance it will persist.

The situation is much more fluid with PGP, since the number of endorsers can be somewhat smaller than number of miners, and there's no guaranteed "paper trail" of what bindings have have processed (thereby making silent alterations easier to come by). Moreover, trust is not transitive--Alice trusting Bob and Bob trusting Charlie does not imply that Alice trusts Charlie--so the degree of trust you get from a web-of-trust is hard to quantify even in the absence of malicious behavior. This in turn makes it hard to reason about the strength of your endorsements, as compared to the strength of your adversary's claims against you.

At the end of the day, Onename gives me the ability to say "I am jude-, and my passcard is ..." in a non-repudiable manner, and I can quantify how strong of a testament it is by measuring the blockchain's hashing power versus my adversary's hashing power. The passcard itself is stored elsewhere (but its hash is incorporated into the blockchain), but the passcard can include information like your public keys, your identities on other services, hashes of digital assets you created (e.g. pictures, documents, etc.), and so on.

<comment><USER13> That is a flawed intuition and seems to misunderstand how bitcoin and namecoin fundamentally work. I don't have any reason to care _when_ a trusted or untrusted notary endorsed someone's identity. Particularly if they aren't doing any sort of identity validation at all.

Miners don't verify anything relating to identity beyond the correctness of the digital signatures vs signature hashes. So miners hashing on something doesn't represent any sort of endorsement that I should recognize at all. I don't see why I should trust one signature that appeared deeper in the blockchain vs a newer signature? Older addresses are _less_ trustworthy in bitcoin not more, that's why we use change addresses.

Sorry, this just makes no sense to me on a very basic level and I don't think you're answering any of the fundamental questions. Even in bitcoin, proof of identity goes into the encryption, not the proof-of-work. These are fundamentally different beasts.

<comment> jude- I think we're talking past each other.

> I don't have any reason to care when a trusted or untrusted notary endorsed > someone's identity.

Sure you do--you're doing it right now :) This is how usernames on websites work in general. The reason why someone besides you cannot create an account on HN with the username "fluidcruft" is because names are unique on this site, and _you claimed it first_. You, I, and the rest of the commentators here trust HN to ensure that this is the case for everyone--we each have the usernames we have because we claimed them first. I must emphasize that this is _orthogonal to authentication_ ; this is simply about preserving a common property of typical user account systems.

The goal of Onename is to provide a user account system that binds usernames to personal data of your choice without needing a central administrative entity to enforce the above property. Instead of everyone trusting servers controlled by a single administrative entity (like HN), we instead trust that the underlying storage medium that hosts each (username, principal) binding has the property that once a record of a binding gets written, it cannot be altered later. In the absence of compromises, the overall effect is the same as on HN--usernames are globally unique, and are bound on a first-come first- serve basis to principals.

You seem to be thinking that we're relying on the blockchain to do some kind of extra user validation. This is not the case at all. We're only using the blockchain to provide a highly-available write-once read-many (WORM) storage system for (username, passcard_hash) bindings. What I've been trying to argue is that the degree to which we can ensure immutability hinges on the WORM property holding true for the foreseeable future. My point was that there is reason to believe that a blockchain with many peers has the WORM property because by construction, it's costly violate this property, it's very difficult to violate without drawing attention to oneself, and it's financially desirable to to preserve anyway--the WORM property also guarantees the immutability of transaction histories. This is what I meant by "the blockchain peers attest to the bindings"\--by mining blocks and constructing the blockchain, they're preserving the property of the blockchain that makes it useful for constructing a decentralized user account system.

Because of the WORM property, you're guaranteed that the first occurrence of a (username, passcard_hash) pair you find for a given username was issued by the owner of that username. Any subsequent attempts at writing a different passcard_hash for that username can be ignored (preserving global uniqueness). Unless you can attack the underlying blockchain, you cannot trick someone else who audits the blockchain into finding a different original passcard_hash for the same username (ensuring everyone finds the same original username/passcard_hash binding).

Does this make a little bit more sense? Does this help you understand what it is we're trying to do?

<comment><USER13> Basically, you're using the blockchain as a decentralized passwd file. But again, I don't see why this is desirable in light of existing and much more powerful alternatives to passwd files (U2F for example)?

<comment> jude- > Basically, you're using the blockchain as a decentralized passwd file. But > again, I don't see why this is desirable in light of existing and much more > powerful alternatives to passwd files (U2F for example)?

Not quite. To use a UNIX analogy, we're using the blockchain to bootstrap a global, decentralized LDAP. We're making it so applications can resolve a username to its owner's information without users needing to trust us, without applications needing to trust us, and without users needing to trust applications.

Now, my "LDAP entry" (i.e. my passcard) can contain whatever information I want to put there. Anyone can verify the authenticity of subsequent updates to my passcard data by verifying that each update was signed by the same private key whose public counterpart got bound to my username when the passcard was created.

I _could_ put information in my passcard that further identifies who I am, and I _could_ put information that authenticates me to certain applications. These are some of the key use-cases of my passcard. However, what this information is exactly depends on the application. The only thing Onename concerns itself with is ensuring that the application can discover this information when given the username, and be assured that the information was generated by the same principal that owns the username _without having to trust Onename or the user._

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> I don't even understand how to sign up. It asks me to choose a registrar, I clicked Namecoin and it just brought me to the Namecoin site with no further instructions. At Onename I am already signed up, technically having a card there.

So what is Passcard.info for?

<comment><USER15> Namecoin isn't actually a "registrar" in this case, but the canonical blockchain used with Passcard.info. You can think of it as the self- registration alternative. The Namecoin link is definitely a conversion blackhole. This would be a bit better: [https://github.com/namesystem/namesystem/wiki/Namecoin](https://github.com/namesystem/namesystem/wiki/Namecoin)

Onename, which has designed Passcard.info, is attempting to standardize the identity protocol by decoupling it from its core identity registration service.

A somewhat fragmented space, here's an example of another blockchain based identity protocol using the id/* namespace on Namecoin: [https://nameid.org/?name=domob](https://nameid.org/?name=domob)

<comment><USER16> That link isn't any better than the first. Passcard bills itself as a service for non-technical users. Any and all sign-up links should point to clear, easy-to-follow, step-by-step instructions. Neither the Namecoin front page nor a wiki page about important Namecoin esoterica fit that bill. :)

Note: I'm not trying to shit on the project (just as I'm not trying to shit on your comment). I'm sure it was a substantial amount of work, and is at an early stage in its development. If, however, one is launching a project that has non-technical folks as its audience, appropriate documentation is _just_ as important as the software.

</comment></comment></comment><comment><USER17> That background color is really not that pleasing to look at. IMO it also fails to explain what exactly this thing is, how do I use it?

</comment><comment><USER18> Are you kidding me? This page renders absolutely nothing with javascript disabled. This crap has to stop.

<comment><USER19> Are you surprised that disabling part of the website renders the website inoperable?

<comment><USER20> What part of that website needs JavaScript?

<comment><USER21> Well apparently all of the rendering.

No part of your car would _need_ gasoline if it were designed in a way not to need gasoline. But it does.

</comment></comment></comment></comment><comment><USER22> Getting a blue page with ≡ and "passcard" at the top right corner and a strip of a black footer. Nothing else. That's not how it supposed to look, is it? Recent FF.

<comment><USER23> Welcome to the golden age of <body> <script></script> </body>

:(

</comment></comment><comment><USER24> Excuse the ignorance but is this OpenID all over again? if not, what's the difference?

<comment><USER25> In blockchain, Yes.

</comment></comment><comment><USER26> If this is meant to provide secure identity checks [1], how does this compare to keybase.io?

[1] Not sure, because of lack of information on the site.

</comment><comment><USER27> Hypothetical:

I have a gambling problem. I store my banking information in my Passcard tied to my iWatch. I don't pay my bookie. He beats the crap out of me and takes my iWatch along with my banking information. Am I broke now?

<comment><USER28> Doesn't it deauthenticate when it isn't on your wrist?

</comment></comment><comment><USER29> something resembling real information:

[https://github.com/namesystem/namesystem/wiki/FAQ](https://github.com/namesystem/namesystem/wiki/FAQ)

</comment><comment><USER30> Design question: why is the "☰" (hotdog / hamburger button) migrating into desktop versions of websites?

<comment><USER31> No practical purpose. Probably done to make the page look "cool" and clean, at the expense of actual usability and proper navigation.

</comment></comment><comment><USER32> The site does a poor job explaining what it actually is. How exactly does it replace the keys to my apartment?

</comment><comment><USER33> How is this different from iNames, OpenID, CardSpace, and all the decentralized identity platforms that came before it? Federated identity isn't anything new, and throwing a blockchain behind it is just an implementation detail.

The concept of a single, verified digital identity is going to be an even harder sell now than it was ten years ago, with people concerned about governments spying on their online activity. People are trying to be more anonymous, not less.

I'm going to sign up for an account anyway because I'm a sucker for new digital identity solutions. And I might teach myself Python to contribute some code. But I don't see what's going to drive Passcard adoption. Microsoft couldn't even sell the concept of identity cards in their heyday.

</comment><comment><USER34> Oh look it's another Identity and Access Management for The Real World company trying to turn your phone into the Thing That Unlocks. Interestingly enough there's actually not a lot of companies out there trying to be this ambitious about using your phone to unlock things- sure there's Lockitron and Knock[1] but those are individual apps, not one huge holistic app that will replace username/password combos for online and software plus replace anything else that requires you to verify your identity in some way (credit card transactions, Gov ID, School ID, keycard for work, etc etc).

As of a year ago when I was working for a company trying to make pretty much this exact product, the prevailing wisdom was you'd secure it with biometrics (for those of you wondering how you'd secure it if your bookie beat you up and stole your iWatch).

Why it won't work, and why it didn't work for the company I worked for (and why I got laid off), and why it will probably never ever work in the way that everyone envisions is that getting all these disparate entities to agree to utilize this one app for access management just WILL. NOT. HAPPEN. As a company trying to build an app like this, you have to negotiate with every entity separately- so you have to negotiate with every state separately if you want to display state IDs on a mobile phone and have that be an accepted display method (didn't work- they wouldn't even talk to us). You have to negotiate with every separate credit card issuer who are all working on their own "Use your mobile as a credit card" idea. You have to negotiate with every separate access management company (Assa Abloy, etc etc) who are all ALSO working on their own mobile app to replace keycards... and on and on and on.

Plus then on top of all that there's Apple, who wants the mobile phone to be the ubiquitous access device more than any other company out there, and who actually has the time and the money and the chops and the influence to make it happen, if anyone can make it happen. It's an impossible goal right out of the gate, and if you scale down the operation at all (focusing on logical access instead of logical + physical, for example) there's already an app that does it and does it better and has been doing it for longer.

AND THEN you get to the consumer side of things where instead of simply typing in a username and password to get into a website (the standard way) or whacking your iPhone a preset number of times (as with Knock) you have to pull out your phone, unlock your phone, go to the app, scan the QR code or whatever, and then hope that the servers haven't crapped themselves for the tenth time today and will let you log into your damned computer already.

No, I'm not pessimistic, why do you ask?

[1][https://itunes.apple.com/us/app/knock-unlock-your-mac- withou...](https://itunes.apple.com/us/app/knock-unlock-your-mac- without/id692929970?mt=8)

</comment><comment><USER35> Another scheme to get money in seeds funding form VCs, split biggest shares among co-founders and then BYE. Very "Innovative" idea.

</comment><comment><USER36> One thing which I don't get is why the DNS system isn't used as a authentication system. A domain name is really cheap these days and it is a great way of authenticating. It just requires some work to interface with public keys. Maybe you can set your public key at the registrar?

<comment><USER37> DNS is not encrypted, not authenticated, can be spoofed and someone can hijack your authentication by hacking one company or exploiting some issue where the domain gets the ownership transferred forever... (or with months-long dispute time potentially) And that's before we go into most domains being owned by the US, other domains having interesting restrictions on usage and content, etc.

I like DNS, but unless you're big enough to raise your issues personally with the registrar and get heard, I wouldn't use it for any kind of auth.

</comment></comment><comment><USER38> "When you sign up for a passcard, your registrar will give you a secret key"

How is this decentralized if the registrar issues your secret keys for you? Couldn't they hijack your identity at any time?

It sounds more like a federated system of identity providers like OpenID.

</comment><comment><USER39> Such great modern web design - no Javascript means a plain white page.

If there's no fallback for something as simple as a web page, I dread to think how well the 'all access pass' works under stress.

</comment><comment><USER40> No idea what it is but I reserved my username in case it becomes a thing

</comment><comment><USER41> I assume it is no coincidence that I read about this on the same day that Microsoft published that Microsoft Passport will be integrated in their new browser.

</comment><comment><USER42> not really talking about the idea behind it, but why .info?

i own passcard.id (and some other .id such as awesome.id, privilege.id and printed.id), contact me at my username at gmail.com if you're the maintainer and interested in acquiring it.

</comment><comment><USER43> Everybody should be their own registrar! Decentralization! Hurrah!</comment>


Uber bills extra,customer mistaken for driver and advised to keep extra money - <AUTHOR> http://wisetechie.com/blog/2017/03/27/uber-overcharges-toll-on-a-ride-thinks-i-am-the-driver-when-i-complain-tells-me-to-keep-the-extra-money-and-forget-about-the-overcharging/ <comment><USER2> Hello, customer here.

They have told me multiple times that they wont refund the money. 9 times to be exact :)

</comment><comment><USER3> I've been mistaken as the driver instead of passenger when contacting support too, and that was ~2 years ago. Strange they haven't figured how to handle that yet.

<comment><USER2> lol, seriously :)

</comment></comment><comment><USER4> I'm reading through the support messages that were posted. Where exactly did they say they wouldn't refund the customer? It was an assumption made by the author that since they didn't ask for the money back from the driver, the customer wouldn't get a refund. It is possible that Uber ate the difference, rather than ask for money back from the driver.

<comment><USER5> Hm. He _is_ the customer. So I think we can safely assume that the customer didn't get a refund for the charges.

</comment></comment><comment><USER6> Just dispute it with your credit card company and let _them_ try to prove they are right and get their money back.

<comment><USER7> Many credit cards these days don't work like they used to. You the consumer are no longer automatically right

<comment><USER8> Chase especially has been siding more and more with the merchant rather than the consumer.

</comment></comment></comment><comment><USER9> Maybe it's time to gauge interest in "Demand Letters as a Service"</comment>


There's Still a Gaping Hole in the Economy - <AUTHOR> https://www.bloomberg.com/opinion/articles/2020-07-02/june-jobs-report-shows-huge-gaps-from-pre-pandemic-employment <comment><USER2> While some of the industry changes in the article are clearly just a result of the pandemic (like air transportation, performing arts and spectator sports, amusements and recreation, etc.), I feel like a lot of these are actually just condensed timescale changes that were happening anyways. Recessions tend to do that, this once was just incredibly abrupt and compact.

Industries like movies, travel arrangement services, museums, etc. were all on the decline and now will simply be reduced to a minimal existence. Supercenters, couriers and messengers, postal services, etc. were all increasing in importance due to a more digital consumer pattern and increasing economic inequality. Now their growth is rapidly accelerated and the cultural shifts that have gone on for the last decade have been amplified.

I'm curious to see how this all plays out. The divide between the "haves and have-nots" is growing and this pandemic has just amplified how screwed a large class of workers are.</comment>


Netgear 0-day vulnerability analysis and exploit - <AUTHOR> https://blog.grimm-co.com/2020/06/soho-device-exploitation.html?m=1 <comment><USER2> The worst part is this isn't even just going to affect folks that would never think to update their router firmware. The firmware they _do_ push out is frequently a massive downgrade.

About a year ago, I tried to update the firmware on my Netgear router. It was the exact model from the article, the R7000. I assumed "new update" for router firmware would involve some critical security updates, and maybe some stability fixes, but it basically rendered the router unusable. It would crash every few hours with normal usage. I googled around and turns out it was a known issue, the only recommended fix was "roll back to version x.x.x (2 versions prior). I found this fix months after it had been posted, and there had still been no new patch released to fix the issue.

When my relatives call me to fix their wifi, I now have to think twice about updating the firmware. These days I recommend the google wifi mesh router(s), because they just involve the least maintenance effort. They have less fine- tune controls and the wifi speed is slightly slower when you start approaching gigabit speeds (vs other high-end consumer routers), but it's definitely worth the trade off for me. Plus, anyone calling me to help with their wifi won't notice either of those things :)

<comment><USER3> The best thing about setting up Google wifi routers for your relatives is you can set yourself up as the manager of them, and manage them with the Google Wifi app from anywhere. So before Uncle Bob calls you about the wifi you'd already have got the notification that his cable service is down again.

<comment><USER4> Sorry to be "that guy", but how about not giving an advertisement company access to all your network traffic (while _paying them_ for the privilege)...

Almost every router supports some form of remote management (or just put TeamViewer on their machine). Most also support dynamic DNS so you can set up a ping check for the "its down" notification.

<comment><USER2> The fact that I've paid them for the hardware gives me more confidence that _I 'm_ not the product. Ironically, the fact that I can get TeamViewer for free and use it to get remote access others' computers makes it feel like a higher threat attack vector for me.

Before I bought the Google mesh wifi, I already had android, chrome, project Fi, and Google's DNS (router level) at various levels of my request stack. That's not even counting search, gmail, and calendar. If Google are playing shady games with my network traffic, whatever marginal gain they get from having software on my router is negligible. Especially compared to the awful PR backlash they'd get once somebody hooks some monitoring gear up to their hardware and exposes it.

<comment><USER4> > the fact that I can get TeamViewer for free and use it to get remote access > others' computers makes it feel like a higher threat attack vector for me.

I agree. I gave that example because I personally use it, but would prefer to move to a self-hosted or inexpensive paid solution. I've always assumed the free version has sufficient business value as a lead-generator for the enterprise version, but there's no reason to assume they don't _also_ monetize usage data.

> I already had android, chrome, project Fi, and Google's DNS ... whatever > marginal gain they get from having software on my router is negligible.

That's a totally fair way of looking at it, and I'd probably use Google Wifi with little hesitation if I were you. But this isn't the case for everyone. IMHO tech folks need to be mindful of privacy implications when recommending tech to non-tech folks, because we have the benefit of understanding those implications. FWIW, my immediate family would be displeased if I installed a Google router for them and they later figured out Google's conflict of interest for themselves.

</comment></comment></comment></comment></comment><comment><USER5> I am sick of having to assume my network hardware is trivially compromised.

What will it take for me to be able to purchase a microkernel driven router/access-point with audited drivers (or Rust based)? I would settle for mediocre performance (ie no gigabit) if I could have some strong security guarantees.

Can I setup Redox or seL4 as home network hardware at this point? Or would the pain threshold still be quite high?

<comment><USER6> > I am sick of having to assume my network hardware is trivially compromised.

I don't have the gateway my ISP gave me on my LAN for this reason. I do have to laugh a little bit about people who use a VPN to hide requests (DNS? Because most of the web is HTTPS, now) from their ISP when _their ISP has a device on their network_.

<comment><USER7> Even personally owned hardware has its risks from today's ISPs. DOCSIS standards require every off the shelf cable modem to basically have giant "management" back doors for the ISPs. They can remotely install firmware updates to your modem that you own for "your safety" and there's not much you can do about it.

</comment></comment></comment><comment><USER8> It's another reason once you bought a router to reflash it with alternative firmwares as OpenWRT or DD-WRT

<comment><USER9> The last time I looked into OpenWRT/DD-WRT (years ago), it seemed disadvantageous to switch to them because they would be slower than stock firmware due to missing some kind of hardware support. Is this still the case these days?

EDIT: It sounds like the situation for my router (R7000) is quite the opposite now, apparently being almost twice as fast due to new hardware acceleration features.

<comment><USER10> DD-WRT is has access to some proprietary (Broadcom?) code which enables NAT acceleration on some models which, at least in my case, greatly improved performance over OpenWRT.

<comment><USER8> Exactly. They have signed an NDA with Broadcom: [https://openwrt.org/meta/infobox/broadcom_wifi](https://openwrt.org/meta/infobox/broadcom_wifi)

"DD-WRT has a license agreement and NDA in place with Broadcom that allow usage of better, proprietary, closed source wireless drivers (binary blobs) which they are not allowed to redistribute freely."

</comment></comment></comment></comment><comment><USER11> I noticed there's a gap in some of the affected lists. (Mainly the MediaTek/Ralink mipsel hardware) They don't appear to have the same httpd binary talked about here. (Instead they have a mini_httpd?)

They do appear however to be still very vulnerable to CVE-2020-8597 (no PIE or stack cookies, probably RWX stack) and for the one device I took a look at (R6700v2), the firmware image hasn't been updated since last September.

Oh well.

</comment><comment><USER12> I've used Apple routers for many years, but since they've been discontinued I wonder what I'll do when I need to replace them. All the major alternatives seem to have crap software that requires frequent reboots and has security issues.

Can anyone recommend an awesome wireless router that works great off the shelf? I don't want to have to learn how to flash it with DD-WRT.

<comment><USER13> Eero

<comment><USER14> I almost went full Unifi, got lazy and got Eero. So far everything has been fantastic. It's not perfect but it works and delivered on its promise. Speed is fast, it's not Wifi 6 but neither are any of my devices. Paid full price too, not a shill here.

<comment><USER7> Ubiquiti has a consumer/prosumer brand called Amplifi now. It's got the ease of something like Eero but the decade of experience of Unifi. (They also already have a WiFi 6 mesh router at the top of the line on the prosumer side.)

<comment><USER15> I recommended an Amplifi to some friends that aren't computer-savvy, and didn't hear back. (Their previous router was crashing frequently.)

I visited them a few months later and noticed it, so I asked about it.

They had kind of forgotten about it. There were zero problems setting it up and zero problems since. They said they thought it was kind of pricey.

If I remember right, it was $50 more than the cheapest (but terrible) one with similar specs. It was $100 less than an expensive, terrible and comparable one.

I can't imagine a more favorable review of consumer networking gear. :-)

Also, I have had zero issues with the Ubiquiti access point I use at home. I have a pcengines apu2 OpenBSD router, so I can't say much about their routers.

<comment><USER7> Very similarly, I recommended Amplifi to my parents. They've had a couple issues with it, but that's due to a complicated bit of their new house more than Amplifi itself.

The house they just moved into had a strange audio LAN wired through the house when it was built. The audio LAN had a couple CAT-5E ports for "expansion" (presumably?) on each floor just about perfectly located for WiFi AP backhaul. So I worked with my parents on a plan to try three of Amplifi's routers rather than one AP and two "Satellites".

This seemed to work alright. The Amplifi phone app wasn't great about setting up a multi-AP mesh of that sort just yet (as opposed to the focused use case of one router/AP and several "satellites") and didn't always have the best experience (in navigation/details), but other than UX complaints, the system just works as expected.

However, my parents then discovered that there were "hidden" components also wired to the Audio LAN somewhere between the primary Audio LAN router and the "expansion ports", which meant that some of the system's speakers stopped operating. (It would have been great to have a wiring diagram of the whole LAN. We did a lot of trial and error discovery on this.)

So my parents decided to "turn off" the backhaul by reconnecting it to the Audio LAN. There was angsty confusion that they "broke" the WiFi because they ignored/forgot my explicit instructions to disconnect the router's WAN cables on the house ports that were now again Audio LAN ports. As I had expected, once disconnected from the confusing (to people and devices alike) Audio LAN, the Amplifi Routers straightened themselves out and switched to a more traditional bridged mode ("wireless backhaul") as if they were mere "satellites".

According to the math I did, my parents paid a lot less for that experiment with all Amplifi routers than if they'd tried it with "full" routers of any of the other brands we'd comparison shopped (and none of them seemed to offer an ala carte buying experience similar to Amplifi's section of Amazon), though obviously more than if they'd bought only one router and two satellites of any of the other brands in the first place. The extra LAN port on the Amplifi router is still critical to them on one of the floors (a home office VOIP system that "requires" a wired connection) and they couldn't easily swap at least one of the routers for a Satellite anyway.

Other than the crazy backhaul experiment confusion, my parents haven't had any problems. I don't think we could have ran that experiment with any of the other brands. My parents seem happy with the purchase and the quality of their WiFi on all three floors, which was the important thing for them, and I get the feeling they were happy with the price despite "over-paying" a tad due to the experiment.

</comment></comment></comment></comment></comment></comment><comment><USER16> Treat these devices like PCs:

See the installed system as "example installation to demonstrate functioning". Like HP with the bundled Crapware on PCs.

Just install OpenWrt as soon as you did a basic function test. And only buy hardware you know to be compatible.

<comment><USER11> The problem with than plan however, is that many of these devices tend to depend on arcane network hardware acceleration features in order to reach decent switching throughput.

Which rules out OpenWrt on some of the lower-spec pieces if you have a faster WAN connection (Ie. 1gbit), as I don't believe they have support for these on many platforms. (MT7621 is referenced as supported, and Qualcomm's "SFE" being supported in community builds)

<comment><USER17> Qualcomm SFE has been replaced in OpenWRT with the more generic "flow offload", on an R7800 you can get gigabit speeds lan to wan.

Wireless is still lagging as the IPQ8064 has two NSS packet processing cores which, amongst other things, also accelerate crypto, including WPA.

I've got an R7800 running router duties on OpenWRT and then a Netgear Orbi RBK50 set running in AP mode which works well for my needs.

There IS a community effort to port the NSS acceleration (which accelerates qdisc and therefore traffic shaping with SQM) from the QSDK sources, but it's slow going.

</comment></comment></comment><comment><USER18>
       In SOHO devices like the R7000, the web server must parse user input
       from the network and run complex CGI functions that use that input.
       Furthermore, the web server is written in C and has had very little testing,
       and thus it is often vulnerable to trivial memory corruption bugs.

I wonder why these network equipment manufacturers are still using CGIs in their firmware?! Is it because the MCUs they use in their hardwares are too weak to run modern version of the linux with reasonable choices to build a custom compiled version of the web server in Rust not C?

<comment><USER19> They're running CGI and writing homemade web servers in C because they haven't maintained or upgraded their software in decades.

I don't think they are low power devices. My bet would be they're relatively normal hardware running a light linux. It takes quite a bit of power to route gigabit ethernet or ac wifi.

<comment> yjftsjthsd-h > They're running CGI and writing homemade web servers in C because they > haven't maintained or upgraded their software in decades.

Sometimes, certainly:) However...

> I don't think they are low power devices. My bet would be they're relatively > normal hardware running a light linux. It takes quite a bit of power to > route gigabit ethernet or ac wifi.

It doesn't take much compute to handle high-end eth/wifi if you offload it to hardware, and even doing it on-CPU (which I don't think is actually common) probably wouldn't impact RAM/storage, so you could still manage with a stronger CPU and comically tiny memory.

</comment></comment></comment><comment><USER20> I gave up on netgear long ago for access points. Been running stuff from [https://mikrotik.com/](https://mikrotik.com/) since 2016. They are a bit dated in some areas, but they are cheap and I've never had any issues.

</comment><comment><USER21> Reading stuff like this makes me glad I ditched consumer grade all-in-one stuff and went with a $REAL (feel free to substitute appropriate brand) router and stand alone AP.

<comment><USER22> That's not a workable solution for the vast majority of the population.

<comment><USER21> Sadly not. You generally have to be very technically inclined to use something like Mikrotik (which is what I'm using) and even the Ubiquiti stuff isn't as easy to use as it could be.

<comment><USER7> Ubiquiti has a consumer/prosumer brand now called Amplifi. I set it up at my parents' and it was a breeze. It's adapted well to some strange network situations they had. (A long story but they moved in to a place with an ancient audio LAN wired through the home and we explored various configurations of detaching portions of the audio LAN for WiFi backhaul.)

<comment><USER23> Does Amplifi require some cloud login before you can use it? One of my annoyances recently is that the WiFi providers have an iOS app but require you to log into their servers to configure the thing on your local network.

<comment><USER7> It's been a couple months since I set it up, but as I recall Amplifi did not require an account to set up your mesh.

It offered an optional "cloud" account system for remote administration (such as giving guest access when you are away or rebooting your mesh from your phone when your guest complains about the network not working, and so forth), but did not require it.

</comment></comment></comment></comment></comment></comment><comment><USER24> Predictably, the web servers are an afterthought for branding so that users don't have to edit configuration files and operate at a command line.

(a) 99%+ of people buying these things do not know or care about security, aside from someone stealing their WiFi bandwidth (b) the manufacturer does not care because of (a).

As follows, all they care about (WRT to the web server) is that they are easy enough for non-technical people to setup such that they don't end up on a tech support call or returning the device for a refund. That is it.

If you are the 1% that cares about security on your home network, it is far less stressful to simply conclude these products are not for you and move on with your life. You should be looking at enterprise hardware, open source router firmware, or rolling your own.

In any case, what surprises me is that over time the router manufacturers haven't simply built up a single, relatively patched-up, web server implementation that they re-use. Even without aligned incentives, you would think over years and years of development they'd have something at least as good as what you can clone out from from github for free.

</comment><comment><USER25> Why is this a big deal since you can exploit the vulnerability only when you are connected to the local network? (I've seen some of these exploits used to replace the installed firmware with openwrt)

<comment><USER26> In general, this is not a safe assumption to make -- for example, due to DNS Rebinding attacks.

The article also mentions that the exploit is working remotely:

> As the vulnerability occurs before the Cross-Site Request Forgery (CSRF) > token is checked, this exploit can also be served via a CSRF attack. If a > user with a vulnerable router browses to a malicious website, that website > could exploit the user's router. The developed exploit demonstrates this > ability by serving an html page which sends an AJAX request containing the > exploit to the target device.

Also, if you're replacing the firmware, the new firmware can create an _outgoing_ root shell to a destination of your choice. There's no internal limitation here.

</comment></comment><comment><USER27> Is there any mitigation for this? AFAICT netgear has not released a patched firmware for this bug yet. Anything else that can be done?

</comment><comment><USER28> [https://github.com/grimm- co/NotQuite0DayFriday/blob/master/2...](https://github.com/grimm- co/NotQuite0DayFriday/blob/master/2020.06.15-netgear/notes.txt)

>* R6300v2 version 126.96.36.199CH, 220.127.116.11, and 126.96.36.199

>* R6400 version 184.108.40.206, 188.8.131.52, and 18.104.22.168

>* R7000 versions 9.88, 9.64, 9.60, 9.42, 9.34, 9.18, 9.14, 9.12, 9.10, 9.6, and 8.34

Strange, my Netgear R6700 is not on the list. Does that mean it's unaffected, or they simply didn't have that model on hand to test against?

<comment><USER11> There is a much longer list within the comments of exploit.py

It appears they may have scraped the Netgear site and run all the images through binwalk + objdump to make the list.

</comment></comment><comment><USER29> Wow. This is gonna be bad.

<comment><USER30> Routers have been full of stupidly bad bugs for years; nothing really new here. I recall analyzing one a while back and finding that it used session tokens to determine whether one was logged into the interface. These were derived from the uptime with triple des, but the nonce was a constant string of text and the key was based off of interface mac addresses. One has to wonder, at that point, why do anything at all?

<comment> yjftsjthsd-h > One has to wonder, at that point, why do anything at all?

Still prevents the most casual attacks; obscurity is sorta technically better than nothing. (Or worse, of course, if it gives the incorrect appearance of actual security...)

</comment></comment></comment><comment><USER31> Reports of 0days always make me consider projects like OpenWRT and Tomato. I wonder how fast a non profit project can patch compared to OEMS.

</comment><comment><USER32> Im surprised no one has made the semi-obligitory "buy Ubiquiti Edgerouter X/Lite and throw in a NanoHD" comment.

<comment><USER33> As someone who recently got the Dream Machine Pro with NanoHD access point, most of the consumers will not want to deal with such a setup. Also, Ubiquiti has their own issues to sort out as well.

<comment><USER34> >Also, Ubiquiti has their own issues to sort out as well.

I also own a UDM Pro, and this is an understatement.

</comment></comment></comment><comment><USER35> Is Netgear the new Adobe (see: Flash) ?

</comment><comment> abc-xyz Slightly off-topic: any not-made-in-china router recommendations?

<comment><USER8> Mikrotik

<comment> g-b-r They _are_ made in china, at least the last I bought (at least the company and the software are not chinese, of course)

<comment><USER8> Yes, but OS (firmware) is built in EU.

Technically someone somewhere make a electronic plate and sold some elements on it.

But difference is who is wrote a software on top.

<comment> g-b-r ?

Who wrote a software (and designed and sold the whole thing) is _some_ difference, much better than nothing, but the "electronic plate" can still be filled with backdoors and other gimmicks...</comment></comment></comment></comment></comment>


Using AI to Combat the Menace of "Fake Accounts" on Social Media - <AUTHOR> https://blog.karna.ai/using-ai-to-combat-the-menace-of-fake-accounts-on-social-media-8af96bc71842 <comment><USER2> Not a bad approach to contextually identify similar content from different tweets. Wondering if similar approaches could be used to identify fake news by comparing their contextual similarity with an existing, known database of fake news.

<comment><USER3> Fake News is a harder problem due to two reasons:

1\. Fresh News constantly keeps cropping up. Its a dynamic problem, not something that can be done on a static dataset. 2\. Verification is a harder problem as compared to clustering. One of the problems is what data to treat as ground truth for verification. Technologically it is composed of hard problems : finding out each individual fact in a document and then verifying them from close facts from ground truth article.

</comment></comment><comment><USER4> useful</comment>


Facebook to add 3k people to community operations team to improve moderation - <AUTHOR> https://www.facebook.com/zuck/posts/10103695315624661 <comment><USER3> I wonder if they will push some politic agenda or if they will manage to stay neutral.

Even if I have own opinions on the subject, I think the whole "fake news" thingy seems to politicaly motivated. Doesn't mean they are wrong by doing this, but it's hard to be claiming they are still somehow neutral.

<comment><USER4> Neutrality is a mirage. Journalism can and should be fair without trying to appear 'balanced' or neutral. For example, there aren't really two sides to climate change when 99% of scientists and experts agree. It's really only the news who tries to position issues as if they are competing arguments like sports teams. This seems like it's had a negative impact over all by giving a false equivalency, for politically motivated reasons, to issues that are by and large not contestable or debatable.

<comment><USER5> >"there aren't really two sides to climate change when 99% of scientists and experts agree"

So what exactly is this one side that 99% of experts agree upon?

<comment><USER6> That it's happening, that we're causing it, and that if we don't change something, we are fucked.

The only disagreements are on extent to which we will be fucked - will we see hundreds of millions of climate refugees, or billions.

<comment><USER5> Can you be more specific? For example, I really doubt anyone thinks climate change is not always "happening" or that human activity has exactly zero influence on it.

<comment><USER7> A certain commander in chief has in public espoused that:

"The concept of global warming was created by and for the Chinese in order to make U.S. manufacturing non-competitive."[0].

There are plenty of misinformed people that will gladly tell you there is no such thing and if there was human activity has no effect. Pretending that there aren't and even if the issue is complex there isn't a set of clearly _wrong_ opinions is disingenuous to the extreme.

[0] [https://twitter.com/realdonaldtrump/status/26589529219124838...](https://twitter.com/realdonaldtrump/status/265895292191248385?lang=en)

<comment><USER5> I asked about "climate change". You are talking about "global warming" as if I asked about that.

Are you saying these concepts are equivalent to the aforementioned 99% of scientists and experts?

I'm really not trying to act dense, just figure out what it is people even believe about this topic.

<comment><USER6> This is splitting hairs. The consequences of human-driven climate change are widely understood to include net warming of the globe.

<comment><USER5> For example, if there is a new ice age triggered due to human activity, would that would agree with both the global warming and climate change ideas?

<comment><USER6> If cows were spherical, we could agree that cows were both cow-shaped, and sphere-shaped.

They aren't, though.

<comment><USER5> Sorry, I have no idea how this is relevant. I thought I was asking a pretty simple question: "What is it that the average person concerned about climate change actually believes is going on?"

It appears this is the wrong place to get an answer to that question.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> What's weird is that Facebook cannot rely on their users to report blatantly criminal acts witnessed by thousands of people. It probably says more about Facebook users than the platform and makes me doubt that doubling this or that team size can make a meaningful difference.

Especially with this approach of manual monitoring which will probably just result in more questionable deletions Facebook is already known for.

<comment><USER9> Users do report posts, from what I understand quiet regularly. It still requires manual moderation tho otherwise the reporting process can be abused (think anti-competitive purposes)

I've yet to hear of a way that this is solved without hiring thousands of people in what are horrible jobs (see Adrian Chen's excellent reporting on the issue[0][1])

I have no doubt that this will eventually be solves or assisted with ML, and that the solution is likely to come out of FB or G

[0] [https://www.wired.com/2014/10/content- moderation/](https://www.wired.com/2014/10/content-moderation/)

[1] [http://www.newyorker.com/tech/elements/the-human-toll-of- pro...](http://www.newyorker.com/tech/elements/the-human-toll-of-protecting- the-internet-from-the-worst-of-humanity)

<comment><USER10> Those Chen articles hit close to home when I read them, because I've had to verify and act on child pornography complaints at a hosting service. Almost eight years later, I still have nightmares about the (thankfully) little I've seen. When I got into hosting I didn't realize dealing with stuff like that is table stakes; that was my first, and last, hosting employment, but I'll carry that aspect until I die.

That experience really makes me feel bad for the 3,000 new hires, honestly. I couldn't imagine moderating the human condition, which one could argue Facebook basically is. They'd better not clean out Adecco, and actually pay those people with the long-term damage of the job in mind, but that won't happen. Would actually make for a good union...

<comment><USER9> Completely sympathize. I had an experience in my black hat days - broke into a server and found folder upon folder of JPG's. Stupidly downloaded some of them and opened the first to find an image so disturbing that I can't even begin to describe it.

We were a bit conflicted about what to do (more how to do it), and ended up reporting it to both the US and Australian feds (which I suspect may have given me a free pass on one of the crazier things I later did).

I really didn't take it well, but one of the guys in our group was inspired to start a vigilante group that would hunt these distribution networks down and it achieved some success in the 90s.

Hopefully these employees can be eventually protected with some basic level of ML that would filter out the worst of the worst (apparently Microsoft Research have a well-developed fingerprinting system for child exploitation images) - because i'd really hate to imagine the scenario you and Chen describe, and what I briefly experienced, as becoming more common.

</comment></comment></comment></comment><comment><USER11> 3000 persons on top of the current 4500 is a big addition. If all these persons are dedicated to the prompt elaboration of complains and violations of TOS, it might indeed make the difference.

I don't ask if it is economically viable, I guess he knows what he is doing. Facebook is not losing money anytime soon.

<comment><USER12> That's 7500 people whom will be "forced" as much as free employment can constitute force to do nothing but look at questionable often offensive content.

What a funny way our economy has evolved. 100 years ago many of these people might have worked in farms, 50 years ago they might have worked in factories. Today they sit in an office looking at ostensibly offensive material that facebook deems the rest of society should not be exposed to.

<comment><USER13> So? We have 1000s in the bay are building the next chat bot, cat pic ai engine etc.

<comment><USER14> Equating these two classes of activity is not even wrong.

</comment></comment></comment></comment><comment><USER15> Since social media use itself contributes to lower self image and depression, how much are they going to look into their own product as contributing to a problem getting worse for an individual. It would seem that work being done to drive engagement is most problematic for those at risk.

<comment><USER16> Probably not at all. Facebook's collective desire for higher engagement and profit will likely outweigh any concern for individual or collective users.

<comment><USER17> I hear what you're saying, but from a slightly different angle. I wonder if the profit motive creates a conflict of interest the same way that corporate news tends towards bias to satisfy advertisers.

I am thinking of exiting Facebook for at least a couple of months because my posts/shares (which tend to have a political slant or at least broader perspective to them) don't seem to get any reaction or be shared anymore. Neither do music, alternative culture, or sustainability/environmental posts.

If Facebook is unable to give people the dignity to fail at debating one another and be challenged by new ideas, then that may not be compatible with democracy. I hope they fix whatever is going on with their feed algorithm, and maybe 3000 people training AIs will help, but I wonder if the problem isn't technology.

</comment></comment></comment><comment><USER18> I suspect the long term plan is to create a training dataset labelled by the 3000 people and, when they have sufficient training data, let machine learning / AI take over.

<comment><USER19> 100% automated ML doing this well seems far off to me.

Google's ML for rich snippets thinks a quarter is worth 50 cents. [http://imgur.com/1nNreR2](http://imgur.com/1nNreR2)

Really parsing language for meaning is hard. Sentiment analysis, which seems simpler than this problem, still has relatively poor accuracy.

I could see it perhaps thinning out how much has to be done manually, but I don't see it removing that need entirely.

<comment><USER20> That's amazing. Nearly every fact presented there is completely wrong.

Plus, the picture is a standing liberty quarter that is nearly 90 years old and pretty much completely out of general circulation.

<comment><USER21> Could you specifically address his concerns for those not in-the-know about ML?

<comment><USER20> Sorry, my comment was ambiguous -- I was referring to the Google result. Thanks for pointing it out. The commenter that I was responding to made a great point that I agree with and was highlighting as a particularly good example of ML gone awry in the wild.

Other than the subjective statement that quarters are "useful", every fact in the google response is wrong.

Quarters are:

\- Worth $0.25 (not $0.50)

\- Not the largest. (Dollar coins and half-dollars are larger)

\- Made of a blend of copper and nickel. (No silver content for circulating coins)

The picture depicts a standing liberty quarter that is no longer a circulating coin.

It's amazing that Google would put that in production.

</comment></comment></comment></comment></comment><comment><USER22> [https://www.buzzfeed.com/reyhan/tech-confessional-the- google...](https://www.buzzfeed.com/reyhan/tech-confessional-the-googler-who- looks-at-the-wo?utm_term=.voVYAdXJ7#.fjplEpV02)

The horrible reality of trying to keep offensive materials from appearing online.

1.86 billion FB active users divided by 3000 thought police equals 620k accounts per clean up team operative...

<comment> wu-ikkyu Buried somewhere deep inside their 1,000 page employment agreement is probably something along the lines of "you willingly agree to subject yourself to this obvious psychological torture and we are in no way responsible for the mental problems which will inevitably result from your job duties."

</comment></comment><comment><USER23> Was just talking last week that the last thing any of these large internet companies wants to do is hire a large room filled with low paid workers to do anything, especially here in the US.

If they are making this move they must see some large liability looming on the horizon.

<comment><USER24> I didn't understand the "especially here in the US" part of your comment. Can you explain?

<comment><USER25> its not like low paid and probably part time workers have many employment rights in the USA

<comment><USER26> Compare to Bangladesh, Vietnam, or the Phillipines. Low-wage American workers are not very competitive in a global marketplace. If the cost of shipping and importing goods and services < the cost of complying with U.S. regulations and paying American workers, there's every economic reason to have the work sent out to less regulated, lower-paid regimes.

The way to fix this is to even the playing field by ensuring that it's _not_ cheaper to pay to have this done overseas. Otherwise, the "American-made" companies just have to hope that's enough to convince customers to help them make up the gap in profits ... and it's usually not.

<comment><USER15> That would require a thoughtful examination of our housing policies in the US that are designed first and foremost to drive up property as an asset class. It's probably the single biggest driver of inflation in the US that necessitates increases in wages.

</comment></comment></comment></comment></comment><comment><USER27> I wonder if this will reduce the problem of fake accounts. I regularly get such friend requests, and it starts to get annoying.

Also, those seriously affect the attractiveness of ad campains. I dipped my toes into it once, but it looks like a large percentage of gained "users" are just fake ones...

<comment><USER19> My wife made an account for our dog, with an appropriate headshot as the profile photo, about 9 years ago. He posts regularly, and we tag him in photos.

My guess is that they only block fake accounts if they are manually reported by someone.

<comment><USER28> You would think this, but as a counter example Xbox (back in the 360 days) had a "report gamertag as offensive" (aka offensive username).

Users could pay $ to change their gamertag (~$10).

It was fairly common to see people publically asking "please report my name as offensive" as it was known that if you got enough reports, you would be "forced" to change your name for free. People who wanted to change their name anyway would solicit reports against themselves to avoid a $10 fee.

Clearly no human was reviewing these reports... and that was a paid service!

</comment></comment></comment><comment><USER29> Long overdue. I sort of get these online social media companies skimping on moderation while they are growing and don't have cash.

Facebook is rolling in cash and this has clearly hurt their brand. Hiring moderators to take out the worse of Facebook could help a lot to dealing with the utter bullshit that goes on.

Reddit and Twitter have similar problems, they want to either farm out moderation to volunteer users (Reddit) or automate everything and only step in when the NY Times gets a hold of something (Twitter).

Either way, their moderation leaves a lot to be desired.

Reddit is particularly strange. I don't know how this could be true, but they claim that without the volunteer mods, they couldn't exist. Either they are lying or are just awful at running a business, neither would surprise me.

Does anyone know if Reddit actually makes money? And if they do, how? Ads seem sparse and selling "gold" just doesn't seem like much.

</comment><comment><USER30> Slashdot's moderation and meta-moderation system ([https://slashdot.org/moderation.shtml](https://slashdot.org/moderation.shtml)) always comes to mind. Could something like that work for Facebook self- moderation?

<comment><USER31> yes, i always think of this. Why is this system not in use at Reddit or HN? Is it patented? I would pay 1000 euro's if they could implement it for my facebook group, with 2000 members it takes an hour a day which would halved with such as system, 14 hours a month.

<comment><USER32> Even without the meta-moderation aspect, just having multiple dimensions for evaluating any given post is so useful and seemingly unique.

"Upvote/Downvote" is not nearly as useful for ranking as the range of, say "+1 Funny, +1 Insightful, +1 Agree, -1 Disagree, -1 Spam, -1 Flamebait/Troll" (I've forgotten exactly what set /. uses)

</comment></comment></comment><comment><USER33> In parts of Eastern Europe, Asia, South America, and Africa, Facebook could hire 3,000 college educated employees for less than $3M monthly, including taxes. So while this from a human point of view is a very decent thing to do, it's not necessarily as costly as one might think, especially not when considering the possible liability or regulatory backlash they may run into if they do nothing and Facebook becomes the place for suicides and violence.

Now, if they add all those jobs in SF, it's another thing entirely.

</comment><comment><USER34> This is sort of ridiculous, they can't seriously be expected to be held responsible for every video served on their platform. Nor should there be anything inherently worse about live-streaming of violence than that violence occurring in the first place.

I can only see this as a good thing if they manage to catch people before the act and intervene. Is this a primary goal of the program?

<comment><USER26> Yeah, random acts of violence getting exposure as they're live-streamed on Facebook has been interesting, to say the least. Without the criminal's willful publication of their act, the crimes may have gone unsolved and ignored for a very long time.

I'm not sure that we really need to stop people from publishing videos of themselves executing old men at random. It certainly seems to lead to a speedy resolution and really heightens the impact over the impersonal "Another shooting today..." on the evening news. It's virtually the same as walking yourself into the police station, with the added bonus that the whole country now hates you and is looking for you.

<comment><USER35> Without an audience the crimes might never have happened in the first place.

<comment><USER14> that seems highly unlikely to me, given the abundant history of covert violence. Obviously it's hard to assess for individual cases but across a distribution people seem to avoid notoriety.

Perhaps we can make inferences by parallel; trolls engage in obnoxious behavior when granted anonymity or insulation from direct consequences. Is it likely that absent an audience for their trolling, they would be nice all the time?

Seems unlikely, and the historical record suggests that cruelty, criminality, and impunity are a common combination.

</comment></comment></comment></comment><comment><USER36> Can't help but think of Deming's famous advice on how to deal with quality issues: "Eliminate the need for inspection on a mass basis by building quality into the product in the first place."

If Mark Zuckerberg and his product teams could travel back in time a decade or so, would they still have built everything the way they did?

<comment><USER37> Market share was likely always more important than quality.

Besides, do app developers even understand statistical quality control? I tend to think this kind of software grew up on a very black/white, functional/broken, bug trackers, etc., a very narrow view on quality as a concept.

</comment></comment><comment><USER38> I don't expect much from this...

I've reported countless spammy comments like "free ladies!" and "free $50 per click!" But FB replies are 100%: "...but our community deemed that comment to be ok with FB guidelines"

FB should definitely see what Korean FB is like recently...

</comment><comment><USER39> I predict that Facebook's current PR problem related to this is going to be replaced by a swatting problem before long. I.e. someone reports someone on Live as suicidal, SWAT/police show up, shoot their dog etc, public outrage against Facebook ensues.

</comment><comment><USER40> Western social media seems to be one step behind the Chinese counterparts in terms of moderation strategies.

Living streaming scene in China has already went through this entire discussion and various forms of implementations on moderations of offensive and inappropriate contents sometime last year when it was rapidly growing.

Again with government intervention, it is so much faster and easier to enforce standards of moderations for private companies to follow.

<comment><USER41> > Western social media seems to be one step behind the Chinese counterparts in > terms of moderation strategies.

I totally agree. We have the NSA so the total information awareness network is there, but we've really fallen behind China on using it to address suicide intervention.

<comment><USER40> I understand your sarcasm but I believe you have misunderstood my point.

I'm not talking about secret operations, but rather some transparent guidelines or laws issued by the government (legislative branch in the case of US? I'm not sure.) that are enforceable by private entities like Facebook.

</comment></comment></comment><comment><USER42> Machine Learning and AI are dropping the ball here?

</comment><comment><USER43> I get the feeling the job itself might have some side-effects, if this article from quite a while ago has any relevance to the subject at hand:

[https://www.buzzfeed.com/reyhan/tech-confessional-the- google...](https://www.buzzfeed.com/reyhan/tech-confessional-the-googler-who- looks-at-the-wo)

</comment><comment><USER44> What is "CO"?

<comment><USER45> Community Operations, it's mentioned in the article.

</comment></comment><comment><USER46> China has 30,000 people who work full time moderating the Internet: [http://certmag.com/the-great-firewall-how-china-polices- inte...](http://certmag.com/the-great-firewall-how-china-polices-internet- traffic/)

</comment><comment><USER47> They already had 4500 people. And use of the moderated features is likely still growing rapidly.

It's great that Facebook is increasing it's moderation numbers, but it's unclear if this was already planned and simply used (successfully) as a PR response to recent events.

</comment><comment><USER48> I wonder if Facebook made much money on the ads displayed alongside this type of content (or perhaps pre- or mid- roll ads). Do they have a responsibility to treat this income differently?

</comment><comment><USER49> Recomended minidoc "Field of Vision - The Moderators" [https://vimeo.com/213152344](https://vimeo.com/213152344)

</comment><comment><USER50> Does anyone else think it is dangerously Orwellian to describe speech as people 'hurting themselves and others'?

We seem to have a serious problem resulting from people living in bubbles of information sources that only confirm their own viewpoint.

How can the solution to that problem be to have a single corporation design the bubble for everyone?

(Note: I know he's taking about actual videos of violence taking place. However my point is that violence is already happening, and hiding that from public view is 'out of sight, out of mind')

<comment><USER51> Nobody's forcing you to have a Facebook account, or participate in it. It's not "for everyone".

<comment><USER52> Unfortunately, it kind of is becoming that way. Facebook is becoming a de- facto public utility.

The phone and telegraph companies started out as "optional" services. If you didn't like the telegraph company arbitrarily blocking journalists that criticized them, you were free to not use telegraphs.

Facebook is being tied to credit worthiness, and job applications, whether we like it or not.

And in some parts of the developing world, it is more important than a phone number. It is recognized as being so vital, that providing Facebook access is subsidized.

We can no longer pretend that Facebook is some sort of toy, and dismiss criticism by saying that if you don't like it you shouldn't use it.

<comment><USER51> > Facebook is being tied to credit worthiness, and job applications, whether > we like it or not.

Where, how? I've never heard of someone needing a Facebook account for credit and any employer asking for your Facebook profile is a huge red flag.

<comment><USER52> > Where, how? I've never heard of someone needing a Facebook account for > credit and any employer asking for your Facebook profile is a huge red flag.

Here[1]. Saying "wasted" as a status update can affect a credit score. And even if it isn't disclosed, employers, and other entities, may use your Facebook activity. This is a totally valid issue. So, yes, Facebook does matter, whether you like it to or not. It isn't just a toy, and you can't just stop using it, without it potentially harming you. I think it's totally unfair, but people now have to consider their online presence when hunting for a job.

And they don't have to ask for your Facebook account specifically. Companies like ru4.com can tie your financial identity to your social media identity[2]. Just like how even though you didn't submit anything to the 3 credit bureau, they will find data for you, it is also becoming true with social media. I can't log into chase.com without allowing scripts from ru4.com. Luckily, I use a sandboxed Firefox profile, that has never touched Facebook.

[1] [https://www.theguardian.com/media-network/media-network- blog...](https://www.theguardian.com/media-network/media-network- blog/2014/aug/28/social-media-facebook-credit-score-banks)

[2] [https://yro.slashdot.org/story/13/05/02/1521239/even-the- ad-...](https://yro.slashdot.org/story/13/05/02/1521239/even-the-ad-industry- doesnt-know-whos-tracking-you)

</comment></comment></comment></comment></comment><comment><USER53> Not optimistic but hopefully things will improve. As of now Facebook can't even remove an account for a hate blog local to my area.

</comment><comment><USER54> We laughed when China added x thousands to their great firewall content moderation team.

</comment><comment><USER55> Hopefully things will improve and we will see better things in our feed

</comment><comment><USER14> Why doesn't Facebook give people a way to have input to their 'community standards'? Basically it's a black box that's presumably stuffed with lawyers, marketers, and some analytics people. I see zero evidence that there is any actual input from the people who use FB. It's essentially a dictatorship dressed in a costume of democracy, and I would far prefer it if the 'community standards' were called what they are, 'Rules of Mark's Club.'

This is a sore point for me as an artist. It's tedious when posts are removed because they depict or seem to depict nudity and you have to go through and assure some anonymous and wholly unaccountable person that they're not. One of my friends teaches art history at UCLA and - surprise - he posts lots of fine art on his wall. He has to have 8 or 10 accounts because he is constantly getting temp banned for posting famous paintings of people with no clothes.

It also bothers me on a more general level, eg it's fine if I take a picture of myself with my shirt off but if one of my female friends does the same thing she risks being restricted from posting or having her account terminated because her breasts are apparently a worse thing than extreme gory graphic violence that comes with a warning but is nevertheless acceptable to post.

That's sexist bullshit that turns women into second class citizens. I utterly fail to understand how it's OK to share pictures of just about any violent subject matter, but any kind of nudity, sexual or not, is grounds for having your account terminated.

Here's a list of some of the things I've seen on FB over the last year, some with an automatic clickthrough content warning (which is a good idea and mostly well implemented) and some not. As far as I'm aware none of these have resulted in account terminations for people who posted them:

Beheadings (video, multiple examples); hanging; people being shot/have been shot; serial killers and their refrigerators stuffed with human meat; disembowelments; autopsy photos. In each of these cases I don't mean grimy thumbnails where you can sort of imagine what was going on, but photos and video of sufficient clarity to be used in a news broadcast if not for the disturbing nature of their subject matter.

I'm leaving out other stuff that I found sufficiently disturbing that I prefer not to even describe it. I'm not into gore, beyond watching a few horror movies in a given year. But I'm pretty open with my friends list and allow people to join me to groups, so I'm exposed to a certain amount from trolls and of course there are episodes of violence in the real world that are newsworthy, and I prefer my news without censorship of any kind.

You'll notice that I'm not calling for this stuff to be removed or banned from FB. I think the 'graphic content, are you sure?' warning strikes a sensible balance between protecting people's sensibilities and allowing free discussion and information. We live in a world that is often violent and I believe that concealing the ugliness of violence often allows it to proceed unchecked. It's also true that some people become obsessed with or celebrate violence, and that admitting it as cultural currency risks desensitization or normalization of violence. Those are tricky questions to which I do not believe any one person, firm, or society has a perfect answer, but given that the instinct of criminal persons and regimes is generally to conceal rather than reveal transgressions, exposure and condemnation is probably a more effective response than obscurity and censorship.

After that unpleasant detour into the pits of human awfulness, I _really_ want to hear from someone at Facebook:

a) why it's OK to engage with the reality of people inflicting horrible violence on others, but it's not OK to let people engage with the reality of sexual or aesthetic expression, and

b) why the 51% female majority of the population are subject to tighter restrictions than the male minority, and

c) why the 'community standards' don't offer any formal mechanism for community input and decision-making.

Think about it, Folks. A picture of a healthy naked body is grounds for account suspension or a ban, but it's totally OK to show that same body hacked to pieces? That's some grade A bullshit, and platitudes about how 'we try to reflect the prevailing standards of society' isn't going to cut it.

Automation _intensifies_ whatever process you choose to automate, and if you automate a standard whereby erotic desire and self-expression are constrained but extreme violence and interpersonal aggression are less constrained, guess which you'll end up with more of? Likewise if men are allowed freedoms that are systematically withheld from women, guess whose freedoms are going to be expanded and whose are going to be reduced?

I demand answers on this. Facebook is one of the most powerful political entities on the planet and those who own it need to explain why, within Facebook, there is greater tolerance for violence than nudity or sexuality, and why one half of the population is subject to greater restrictions than the other half.

</comment><comment><USER56> Dear mods, I enjoy TLAs as much as the next geek, but can we please change CO to Community Operations?

 _edit - that was quick, thanks!_

</comment><comment><USER57> Censure is coming

</comment><comment> gm-conspiracy Are they hiring pre-cogs from Mars?

</comment><comment><USER58> The issue with work like this is it is very distressing. Having to look at videos and pictures of horrific acts (suicides, child porn, etc) is not a pleasant job. Many of those who do this in law enforcement (mainly child porn) have high rates of PTSD and other issues.

</comment><comment><USER59> Mr zuckerberg's involvement signals it is a huge problem, one unable to spin away..

People always figure out a way around the latest attempt to control - <USER2> these measures will be overcome by bad intenders.

So if FB admits it has a community safety and fake news problem - by hiring 3000 additional enforcement agents, why would one stay with FB if there is an alternative. Which there isn't.

I would like a FB lite. Photo sharing and comments and discovery of old friends. No news. No menu of features.

I wish there could be an alternative. ("Its just like. fB but without the news and crap)

<comment><USER16> I think some alternatives do exist, but I do not believe an near exact clone of Facebook with less of the problems of Facebook exists.

Maybe it's just infeasible to properly monitor such a massive social network? I don't know for sure, but I left Facebook long ago and have not regretted it at all.</comment></comment>


At-will employment and your basic freedoms - <AUTHOR> http://crookedtimber.org/2012/07/01/let-it-bleed-libertarianism-and-the-workplace/

<comment><USER2> This is a good read, but it's far too long, and the rhetoric is hard to stomach at times. I wish it were 1/5th the length and a bit more even-handed - the situation is bad without it being painted in a bad light.</comment>


People, processes and tools - tomh- http://swombat.com/2011/10/24/people-processes-tools

<comment><AUTHOR> "People" problems can be minimized by careful interviewing. Talking to the person, letting him chat with the team, and possibly solve a small problem with them can give you some insights.

Having a rigid process is often an overkill for small companies. You hire people that can communicate, and they keep going together because of that. But if you enforce some process on them, it might be harmful and decrease their desire to cooperate. I've seen that.

<comment><USER2> _Having a rigid process is often an overkill for small companies._

Processes don't have to be "rigid". For example, "everyone online between 2-4pm GMT" is not all that rigid, and imposes very little overhead, but greatly helps with team communications.

<comment><AUTHOR> Agreed, but I wouldn't call that "process". A set of 1 or 2 rules is fine, of course.</comment></comment></comment>


The key to tackling climate change: electrify everything - <AUTHOR> https://www.vox.com/2016/9/19/12938086/electrify-everything <comment><USER2> Electrification will only reduce CO2 emissions if the power SOURCES are also carbon free. Since wind and solar are still a VERY small amount of the grid, and are very expensive without subsidies, the only real alternative is nuclear reactors. Lots of them.

<comment><USER3> 1.) In the US, all energy is subsidized by the federal government, including nuclear. Oil is the most highly subsidized, nuclear is one of the lowest, but solar, wind, and geothermal are even lower. The number quoted for 'renewable energy' subsidies is about equal with the nuclear subsidies, but per page 23 in [0] this includes:

 _Alcohol Fuel Credit Tax Policy of 1984

Renewable Transportation Fuels and Volumetric Ethanol Excise Tax Credit Tax Policy of 2006_

Ethanol subsidies which do not benefit solar and wind.

[0]: [http://www.misi-net.com/publications/NEI-1011.pdf](http://www.misi- net.com/publications/NEI-1011.pdf)

2.) Burning petroleum in your car is less efficient than burning petroleum in a commercial power plant and using the power plant's output to perform mechanical work. To find the efficiency of a power plant, you divide the operating heat rate in BTUs by the BTUs in 1 kWh (3412) - so, the average petroleum plant at 10687 is 31.9% efficient (the remainder is waste heat). One gallon of gasoline = 116,090 BTUs [2], so a perfectly efficient gasoline ICE would get 34 kWh per gallon, but the EPA uses a metric of 33.7 kWh per gallon, so I will too [3]. Per the same source, the Nissan Leaf gets 99 MPGe - or, it takes it .34 kWh to travel one mile.

[1]: [https://www.eia.gov/electricity/annual/html/epa_08_01.html](https://www.eia.gov/electricity/annual/html/epa_08_01.html)

[2]: [https://www.eia.gov/energyexplained/index.cfm/index.cfm?page...](https://www.eia.gov/energyexplained/index.cfm/index.cfm?page=about_btu)

[3]: [https://en.wikipedia.org/wiki/Miles_per_gallon_gasoline_equi...](https://en.wikipedia.org/wiki/Miles_per_gallon_gasoline_equivalent#Conversion_to_MPGe)

<comment><USER4> > Oil is the most highly subsidized, nuclear is one of the lowest, but solar, > wind, and geothermal are even lower.

Really? How much would nuclear cost if it had to pay for insurance for the full possible cost of a nuclear accident?

<comment><USER3> I don't know, cost of disaster recovery isn't in the analyses I've read. For nuclear power the failure modes for different fuels and generations is different, so any analysis would need to take that into account. If you find something would you please post it?

</comment></comment></comment></comment><comment><USER5> Yes, I agree, and we are getting there - albeit too slowly, but a few more flooded places in the USA/China will up the ante and drive to change.

</comment><comment><USER6> That's not really worthy of an article, that's common sense. Everyone knows that there are a hundred different ways to fix climate change, but none of them are feasible or cost effective. A few advocates love for nature doesn't make the business decisions, the love for money by the CEOs of company's behind the biggest sources of pollution do.

<comment><USER7> That's like saying "properly use indexes in SQL databases to fix performance problems" shouldn't be an article because it's obvious.

The devil (or god depending on who you ask) is in the details. We don't get into the details without a lot of discussion.

Your views on electification feasibility sound archaic and uselessly pessimistic. Try out an EV today. They accelerate & decelerate faster, usually handle better and are lower maintenance and charge/fuel cost. Today is the swan song of ICE cars.</comment></comment>


Ask HN: Where the World Is Going? - <AUTHOR> <comment><USER2> Most of us have not developed spiritual lives and know of no reason that might persuade us that goodness is a valuable state of being, nor that the state of love (kindness; care; honesty) is also the state of happiness (beauty, loveliness). So most people think that the world is theirs to consume and that nobody else matters whatever. In other words, this world is becoming a major suburb of Hell. Does that help?

</comment><comment> jerome-jh The world is going to shit. India and China still build coal power plants and that alone, undermines the weak efforts of the rest of the world in CO2 emission reduction. Many countries do not have proper waste management causing huge quantities of plastics going into the ocean. Someday fish and sea food may not be healthy anymore. Note that carnivorous fishes are not considered healthy anymore for e.g. pregnant women. The future 1st economy is not a democracy, and democracies themselves struggle not to become plutocracies. That should be +/\- OK for the next 50 years, but then?

</comment><comment><USER3> For sure, in warmer temperature ranges</comment>