Compact Sparse Merkle Trees – Efficient Non-Membership Proofs - <AUTHOR> https://osf.io/8mcnh/ <comment><USER2> This paper is difficult to follow. The pseudocode in particular contains errors. For example, the insert function looks at left.key and right.key without regard to whether left and right, respectively, are leaves and thus _have_ keys. And insert calls itself recursively with the wrong number of arguments.

It seems to me that the interesting part of the paper is the claim of history independence. If I understand correctly, the basic idea is that, for a given set of keys and values, there exists only one possible tree. If that's the intent, there should be a proof and probably a description of _what_ the tree is for a given set of keys. If that's not the intent, then a proof that the membership algorithm actually works is needed.

<comment><AUTHOR> Author here, thanks for reading through the paper.

I think the confusion is because I wrote the pseudocode in a functional programming style so there are a few keywords being used which are causing confusion. ( Which i mentioned in the paper. )

The insert function uses the left.key and right.key to calculate the minimum distance for the key to be inserted. And there is a cond statement which will execute only of the conditions.

And the pseudocode I wrote was in a functional programming style so the arguments in both the functions are same, just the name of the last argument is different, i.e root and leaf as I wanted to imply pattern matching happens.

The interesting part of the paper is that it outlines a new way to create a Sparse merkle tree, which inherently becomes ordered due to the insertion algorithm used. This ordered property is exploited to find the non-membership proof in a new way which does not require empty hashes and is compact. History independence also follows from the insertion algorithm used.

I'll be releasing an implementation for this paper soon so the proofs can be checked empirically as well.

</comment></comment><comment><AUTHOR> I have released a framework which has a C-SMT module. [https://github.com/ZanjeerPlatform/bargad](https://github.com/ZanjeerPlatform/bargad)

</comment><comment><USER3> There is another method to support compact membership proofs and have history- independence. Ethereum uses a Patricia-Merkle tree structure to store its state snapshots. I'm not sure if it supports compact non-membership proofs though.

<comment><AUTHOR> Author here.

There are certain implementations out there which support non-membership proofs but most of them use empty hashes to find the non-membership proofs and the underlying SMT is unordered.

The approach taken in the above paper is novel in the sense that the way in which values in SMT are inserted make it ordered and this property is exploited to find the non-membership proofs through a window based method. To prove a certain value Y doesn't exist in the tree, the closest two values X and Z which bound Y form the non-membership proof.

This method avoids using empty hashes and the repetitive computation which comes with it.

And Merkle Patricia Trie currently does not support Non-membership proofs.

<comment><USER3> Interesting ideas. I understand the high-level idea of using X and Z to bound Y.

Questions: Can you clarify what it means to use empty hashes for non- membership proofs? / For the Merkle-Patricia Tree structure, if the branches are ordered, wouldn't it be possible to use bounding for non-membership proofs?

</comment></comment></comment><comment><AUTHOR> Hey guys, author here. Seems like the OSF link is failing for some people. I have hosted the paper on github as well now. [https://github.com/farazhaider/CSMT/raw/master/CSMT.pdf](https://github.com/farazhaider/CSMT/raw/master/CSMT.pdf)

</comment><comment><USER4> On Safari/iOS I only get a blank page

<comment><USER5> Oof, it takes several seconds to load on Android. I think it's particularly heavy JS rendering the page and the PDF. I do recall iOS JS being particularly bad under certain loads.

</comment></comment><comment><USER6> Serious question, can someone explain to me why these things are latex documents with a little bit of code?

<comment><USER7> CS papers mostly try to explain an idea or an experimental result, describe why it is important, how it relates to existing approaches, what situations it may be useful for, what the drawbacks are, how those might be addressed in future work, etc. Pretty much none of those things are code.

When some algorithm, metric, etc. _does_ need to be presented, it's important to make it as understandable as possible to the reader. This has a few consequences:

\- Only the core parts are shown, i.e. the new bits. All of the surrounding infrastructure that would inevitably be required (I/O, error handling, etc.) is omitted, because it's routine stuff for basically any programmer, would distract from understanding the main idea, and probably wouldn't be any good if included (since that's not necessarily what the researchers are good at).

\- Programming snippets require a programming language, and these go through fads and fashions over time. I've read papers from many decades ago, with code snippets in MACLISP, Smalltalk72, Algol60, etc. and the ones which remain understandable are those which either limit themselves to a tiny, commonly understood subset of the language (e.g. variables + if/else + loops); or those which have an accompanying description of the language features in English. If we're giving English descriptions anyway, we might as well leave out lots of actual code (especially due to page limits in journals/conference proceedings).

\- Since the point of code snippets is to get across the idea, and the notation might also require an accompanying description, it may be better to use a notation specialised to getting across our idea. Usually this is some form of mathematical notation (e.g. superscripts, subscripts, various forms of brackets, bold face, etc.), with an accompanying description of what these things represent.

<comment><AUTHOR> Thanks for explaining it better than I could have. The implementation is also in the works, it'll be released soon.

</comment></comment></comment><comment><USER8> This is interesting work, but the claims in section 5 need to be proved.

<comment><AUTHOR> Perhaps you missed it, in Section 5 I've mentioned that the hash function SHA256 behaves as an ideal hash function, an assumption in cryptography called Random Oracle Model.

By virtue of this model, the proofs for Structure, Space and Max-Proof of SMT are implied.

I'm also working on an implementation for the concepts mentioned in the paper so the proofs can also be verified emperically.

<comment><USER8> It's not the reader's job to fill in implied proofs. It's your job as the author to give them enough information to check your argument. In some cases "this follows from results A, B, C" is sufficient, but it's often not.

</comment></comment></comment><comment><USER9> Two-dimensional Bloom Filter?

</comment><comment><USER10> the 'Download preprint' keeps failing (Firefox, Fedora Linux)

<comment><AUTHOR> Use this link: [https://github.com/farazhaider/CSMT/raw/master/CSMT.pdf](https://github.com/farazhaider/CSMT/raw/master/CSMT.pdf)</comment></comment>


Ask HN: Would you hire a felon? - <AUTHOR> I have posted a few times before regarding this topic but in short I have a few felonies for playing with bitcoins and drugs while in college. I have a job as a full-stack JavaScript dev (just launched a new Gatsby site last week, I <3 netlify) and am a founder in a startup that counts CocaCola as a client (in negotiations with a few more Fortune 500 companies as well). I love to code more than just about anything else in life (aside from perhaps naps and nachos). It legit saved my life from a terrible addiction. I have been out of trouble for six years now, I got my life in order, and am in a great mental space. Yet, I want to get remote work while I continue my own projects. I am a competent developer who can make it past interviews and code challenges alike. Yet no one will hire. I usually get to the end and am told I am a top candidate. But at whatever point I reveal my past, I immediately get 'waitlisted'. Honestly, I am just curious. Would you ever consider hiring someone such as myself? Any advice how I can find those who would? What are some creative ways that I could put myself out there and prove myself? Thanks a bunch for any advice, it means a lot. <comment><USER2> I would, particularly since drugs/bitcoin seem like pretty low level offences. But I work at a large company and have no control over that now.

One thing I have heard is that big companies often care whether you have a record from the last 5-7 years, so as the conviction is further in your past you may find that it gets at least somewhat easier. Even the "Fair Chance Ordinance" mentioned in this thread only applies to convictions older than 7 years.

I don't think there is any creative way to hack this problem, since it is a trust problem, and remote work may make that trust piece even harder.

<comment><USER3> Thanks a bunch for the feedback, I really appreciate it.

</comment></comment><comment><USER4> I think name-dropping clients is inappropriate in this kind of context. (That's unrelated to anyone's criminal record.)

<comment><USER3> Fair enough, but I am open about it to those I work with and those that hire us. I won't say what we do at this point and the app is not even public. It is something that in the end I am very proud of and just because I messed up in the past does not mean that I haven't earned everything I have worked for.

</comment></comment><comment><USER5> melonbar: see my post about this very thing... [https://news.ycombinator.com/item?id=18704252](https://news.ycombinator.com/item?id=18704252)

I'm in much the same boat. I feel like for this to seriously change, the laws have to change. That's no small feat.

As long as there are for-profit prisons, there's little/no incentive for criminal laws to change.

San Francisco has the "Fair Chance Ordinance", but you actually have to _LIVE_ there for it to apply to you.

[https://sfgov.org/olse/fair-chance-ordinance- fco](https://sfgov.org/olse/fair-chance-ordinance-fco)

I have reached out to you via email, btw. It was back in November. I haven't spoken about that stuff publicly, hence the throwaway account. :/

<comment><USER3> Hey, thanks again! I will be reaching out again to keep you posted. I am heavily leaning toward pursuing my dreams.

</comment></comment><comment><USER6> Something important that might be in play is the company insurance policies. If the insurance company comes back and says, "No, we won't cover any activities that this felon does, you're taking on that risk yourself", the employer isn't going to hire you.

Typically this comes up where you're hiring someone for a similar (or the same) sort of work that they got in trouble for.

The same thing will happen if you lie on your employment application; the instant that the employer finds out you lied, they _have_ to fire you or their insurance will stop covering anything you do.

It's possible that insurance is at play, or that their HR department is being overzealous about avoiding risk to the company via that method.

</comment><comment><USER7> > I have a few felonies for playing with bitcoins

What is the charge. It wasn't 'playing with bitcoins'. Was it fraud? If so, I would be hesitant to hire someone, especially if they are coding in areas where money or other high security was required. I believe while everyone makes mistakes, morals tend to stay the same. So for me I would consider if a charge was a mistake anyone could make, or someone of dubious morals.

Side question: are you allowed to ask for a potential employees charge sheet? If you just see 'yes' to criminal record you may hesitate to hire someone. If you see what they did you can see if it was recent, many, types of offences and you may be more reasonable based on the facts.

<comment><USER3> Ummm, honestly I think it is very easy for them to find but I am not certain. It was not fraud, I bought drugs on the deepnet and ended up getting in a fight with someone involved. When all was said and done, I was caught with drugs. I had a problem and have worked hard to correct it over the years. Thanks for the response.

</comment></comment><comment><USER8> Why are you looking for a job if a company you founded has Coca Cola as a client?

<comment><USER3> That is a great question. I have thought about this a bunch and am seriously considering leaving my job to pursue it full-time. But I have yet to get funding and I would have to spend some time planning. We booked them as a client last month so it is all new to us.

<comment><USER8> I'd be happy to discuss all of this with you on the phone and help as best I can. All of my teams are remote.

(I believe strongly that society should forgive and that former addicts suffer from unfair stigma.)

You can reach me at the address in my profile.

</comment></comment></comment><comment><USER9> Where are the companies that reject you? In San Francisco many companies would never even ask. I certainly wouldn't mind. No one should be eternally damned for a mistake made in college.

<comment><AUTHOR> Right now I am in Philly but I have begun looking for jobs all over. Typically no one ever asks me, but I feel like most places (even after extending offers) do default background checks. If I am not upfront I feel like I am not being honest so it's a catch-22. Thanks though, I will start applying to more out that way. My sis lives at Stanford so I may see if she knows some startups that need someone who is willing to do do whatever it takes!

</comment></comment><comment><USER10> I'd hire you. But I don't have a company. You need to find a place where the person interviewing you is the person who has the final say in hiring you. Which isn't most places.

<comment><AUTHOR> Haha, thanks! Yeah, that is how I got my current job. My boss helped me so much by giving me a chance but I feel that I am hindered from advancing at this point. I appreciate the response, bon soir!

</comment></comment><comment><USER11> Realistically, it depends on the kind and quantity of drugs.

</comment><comment><AUTHOR> Also, if anyone has any good suggestions for sites similar to weworkremotely I would love to hear about them :D</comment>


A fraudster got $12M out of a Canadian university - <AUTHOR> https://www.thestar.com/edmonton/2018/10/09/how-a-fraudster-got-12-million-out-of-a-canadian-university-they-just-asked-for-it.html <comment><USER2> This is why all staff, whether at a corporation, nonprofit or government that handle money should be put through a two hour anti-phishing training course. There's lots of good free training material out there.

There are also services which you can hire. You give them a list of staff emails, and they send test phishes to everyone. Those who respond or click on links (there's a GUID in each phish) can be sent for further remedial training.

As a person that's been seeing and analyzing spurious SMTP traffic since 1993, this stuff seems obvious, but there's a lot of blithely ignorant people out there in administrative roles.

<comment><USER3> While I think everyone should be aware of phishing, I don't think any amount of education can reliably prevent this sort of fraud. I see this fundamentally as a process problem, as I assume email was a common way of changing payment information. Email needs to be taken out of the loop.

<comment><USER4> I disagree. Taking email out of the loop is a technical solution to a problem that is inherently social, not technical.

<comment><USER3> I don't see it as a technical solution, but fixing a broken _process_.

<comment><USER4> But the process is broken by people not realizing that invoices are fraudulent. The method of delivery, be that email or some other system, is completely orthogonal.

Running their invoices through SAP or having gpg signed pdf invoices or using more node.js would not help because all of those solutions fail to address the fact that people are dumb and need to be trained to avoid scams.

<comment><USER5> If a (insert centralized service here) friend tells me about a change of plans, and I know that messages with that contact were successful in the past, then plans indeed changed because it's spoof-proof so long as you didn't make friends with two accounts that end up sharing a name and so long as the sender didn't fall victim to phishing of creds.

If an email from a contact comes in, the from/sender headers can be spoofed without anyone having fallen victim yet, so maybe plans didn't really change.

Yes there are social aspects but there is also this plainly technical aspect.

<comment><USER4> All you've done is moved the problem from your organization to theirs.

Phishing can still pwn you.

<comment><USER5> True, but making credential theft a prerequisite is helpful.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I get incomprehensible bills from the hospital whenever I get a test or see a physical therapist, etc. Sometimes I get bills about a service that happened 2 years ago, don't remember what the service was, and it seems they can't tell me because that would violate my privacy or something.

I've always wondered if I sent an invoice to the hospital for unspecified services if they'd pay it.

<comment><USER7> > _they can 't tell me because that would violate my privacy or something_

If someone can't tell you why you owe a bill, don't pay it. If they can't tell you, they can't tell a court.

<comment><USER8> The thing is, they probably could tell the court, if it came to that _(nevermind that most people couldn 't afford the time or money to take it that far)_. Just because someone isn't being candid about _why_ you owe them money, doesn't mean you don't still technically owe them money in a way that can be proven. I don't know if a judge would have the discretion to waive a debt that wasn't fairly "divulged".

<comment><USER9> Perhaps a good tactic would be to ask them in writing what the bill is for.

</comment></comment></comment></comment><comment><USER10> Apologies if it was mentioned in the article, but I am curious as to _how_ the original attacker acquired the information needed for spear phishing.

I suppose business dealings between the university and contractors is public to some extent, but it seems plausible that this attack came from within the university or the contractor.

<comment><USER11> This was the real breach. Bank account numbers, company letterhead, the CFO's signature, these were all gathered before any attack took place!

<comment><USER12> Bank account numbers weren't leaked - the scammers simply requested the payments be rerouted to a different account. The letterhead could likely be easily reverse engineered, and I doubt the University rep knew what to look for, and the CFO's signature also doesn't carry any weight - any decent signature font could duplicate that signature (especially a digital one).

I agree with the original comment - how did these scammers gain the knowledge that these transactions were ongoing, and know exactly who to target?

<comment><USER3> If you know that a university is doing construction, then you know they're paying _someone_. It's not hard to know a university is doing construction because it will be reported on, they will have had to gain permission to do so, and you can just drive by and see the construction. Once you know that, then you just need to figure out the name of the companies involved. That should be simple: often construction companies will put up a sign, or you can just ask some people on site.

That's assuming no prior knowledge, in which case it would be even easier.

</comment></comment></comment></comment><comment><USER13> As a side note, this is really great journalism.

</comment><comment><USER14> > Yangjiang City Jixie Zhulu Engineering made four payments to the Mas > totalling ¥6.7 million, which would have been worth approximately $1.2 > million. In August, Hoi Fu Enterprises received three wire transfers > totalling $1 million.

Interesting to see that a dollar in Canada is worth 16.7% more than the same dollar in China.

And that was for a deal that was too good to be true. I wonder what the real going rate is for getting large amounts of funds out of China.

<comment><USER2> China has really strict controls on the amount of money that a Chinese citizen can legally wire transfer out of the country, to a foreign domestic bank account, per year. People have come up with all sorts of "creative" grey and black market things involving Vancouver real estate and BC casinos. Google "china money laundering BC" for news about it.

<comment><USER15> Ya....a coworker of mine recently had to return to China to bring his retirement money back to canada. I'm not sure of the details of how he went about doing that. Does the limit apply to physically bringing currency back also? I'd ask my coworker but he doesn't speak English and I don't speak Cantonese.

<comment><USER14> I understand that there's a yearly limit on how much you can bring over per person.

Lots of evasion tactics:

hiring mules to use their limits.

finding someone that needs to send money to China, then you can make 2 domestic payments and everything is settled.

Buying goods in a China for export, then accepting payment into your western accounts.

</comment></comment></comment></comment><comment><USER16> _They quickly discovered that while the email appeared to have been sent by "firstname.lastname@example.com" the email address had been "spoofed." The display name of the email was different than the actual originating account._

Isn't this glaring security issue trivially fixable from the perspective of an email client developer?

<comment><USER17> No, because SMTP "accounts" are trivially spoofable as well. (Edit: Although you wouldn't want to spoof that if you need to get replies, so maybe there is something the client can do here.) Maybe you could try to do some kind of trust-on-first-use on the chain of Received headers but that's going to generate false positives.

<comment><AUTHOR> We do have several solutions in place for that, though. SPF, DKIM, among others. If this University were running on gmail I suspect this email would have been flagged for phishing (the builder did publish an SPF record), or outright rejected. However they run their own email servers[1].

[1] - They could of course do the same checks and even more, but among self- hosted installs it is common to disregard those additional securities.

<comment><USER16> What about PGP? No signature, immediate red flag.

</comment></comment></comment></comment><comment><USER18> _MacEwan was in the midst of constructing the $180-million Allard Hall: a state-of-the-art building boasting music studios and dance halls with room for 1,800 students_

Why does a college need a building that costs a large fraction of a billion dollars? Early this week we had an article about college education costs being one corner of the "Bermuda triangle" of personal finance. Out of control spending on new, shiny things is part of the problem, I think.

<comment><USER19> It's not clear to me that $180 million is an unreasonable amount of money to spend on a state-of-the-art building with multiple music studios and dance halls, necessary for music or dance programs that the school (presumably) offers. Between the tuition the students pay, grants from government, and potential commercial use of the space (for concerts, shows, etc.) it'll likely pay for itself soon enough.

Also bear in mind - while still pricy, higher education in Canada is leagues cheaper than in the US. My degree from UofT - usually internationally ranked among or at least near the Ivy Leagues - was about $5000 a year.

So I'm not sure this belongs in the same category of educational institution excess or Bermuda Triangle of finance stuff you're talking about.

<comment><USER20> >it'll likely pay for itself soon enough.

Thats the problem though right? "Paying for itself" means students paying higher costs which is the problem.

<comment><USER21> Only the students who feel the need to attend a university with state of the art facilities.

<comment><USER22> Unfortunately it's not such an easy decision when businesses value degrees more from universities with state of the art facilities.

</comment></comment></comment></comment></comment><comment><USER7> > _while the email appeared to have been sent by > "firstname.lastname@example.com" the email address had been > "spoofed."_

That's not how you spell "receivable."

</comment><comment><USER23> The technical solution is easy and it is the same solution as when we make bank transactions online: one time pin codes.

If another company wants you to send payments to another bank account, then you mail back the received pin code to that other company via another known email account.

If the known email account responds that the pin is legit, then go ahead and change the payment details.

Also, before changing the payment details, do send a small amount first, have it confirmed with the other company and then proceed with the test of the payment.

</comment><comment><USER24> This seems like a place where physical security keys could've be useful.

Any invoice would be expected to be signed using a physical security key. The University or a trusted third party would have a list of vendor keys, signed by the university's master key.

Any request to change account details or for payments would require a new signed invoice. Then any user receiving such an email could easily see if the invoice had been signed by a person who can cryptographically prove they have a key that is trusted to be in the vendor's possession.

<comment><USER16> What about PGP?

</comment></comment><comment><USER25> "Fake it til you make it" is real.

</comment><comment><USER26> This is more common than you expect, a friend's company recently suffered a Business Email Compromise where their clientele were emailed and sent invoices to the hackers' bank accounts instead of the actual company's bank account.

Email is definitely a unsafe way to send messages.

</comment><comment><USER27> > They quickly discovered that while the email appeared to have been sent by > "email@example.com" the email address had been > "spoofed." The display name of the email was different than the actual > originating account.

Um, and it was mis-spelled apparently.

<comment><USER28> According to this link posted in another thread:

[https://www.thestar.com/content/dam/thestar/edmonton/2018/10...](https://www.thestar.com/content/dam/thestar/edmonton/2018/10/09/how- a-fraudster-got-12-million-out-of-a-canadian-university-they-just-asked-for- it/_20181001141124982_1_.jpg)

The email was sent containing the email address "email@example.com" and the name field "email@example.com"

</comment></comment><comment><USER29> I'd love to fund a startup fixing this problem.

It's a clear space where technology has the edge over humans and there's huge network advantages (e.g. you see a new account # for a known entity, especially at a different bank it's a big red flag).

<comment><USER30> In particular, this kind of low-tech spoofing could have been mitigated if the email client had highlighted the fact that the sender's "name" was nearly identical to the sending address, and therefore likely a phishing email.

<comment><USER31> This seems quite simple to accomplish - compare the name and email address in the email header and flag based on even regex matches/mismatches. Perhaps a Chrome plugin for gmail to test out ?

</comment></comment></comment><comment><USER32> This seems like a technology problem, not a personnel problem. There should be more checks in a system when you are changing bank accounts where so much money is going to be deposited.

<comment><USER33> This scam has been going on in the UK for a few years. It's called "authorised push payment (APP) fraud". Typically you're having some building work done (or any other large project or purchase), and an email will arrive from the builder saying they've changed their account details, could the purchaser please send future bank transfers to the new account. Of course the email is fraudulent and usually happens because the builder has a virus on their computer (or even the customer).

The problems are:

* since cheques are no longer in widespread use, the only good way to send money is by a bank transfer to another account; in the UK these are free and nearly instantaneous

* but every account is identified only by a 6 digit sort code and 8 digit account number[edit 1]; the numbers don't even have parity checking, forget about any sort of way to verify the destination account

* complete insecurity of email and computers in general

Finally, after years of foot dragging, the banks are promising they will introduce an "amazing" new feature, where before you do a bank transfer the name (I think surname only) of the account holder will be displayed. This should, when it finally arrives next year, prevent most of these frauds, although I guess the scammers will quickly adapt.

The fraud: [https://www.theguardian.com/money/2018/sep/25/uk-bank- custom...](https://www.theguardian.com/money/2018/sep/25/uk-bank-customers- lost-500m-to-scams-in-first-half-of-2018)

How the banks propose to solve it: [https://www.psr.org.uk/psr- publications/consultations/APP-sc...](https://www.psr.org.uk/psr- publications/consultations/APP-scams-report-and-consultation-Nov-2017)

[edit 1] True story to illustrate what a shitshow this is: When I started working for my current company they asked for my 6 digit sort code and 8 digit account number to pay my salary in. However the first payment was bounced by the bank. When my employer checked with me, it turned out they had only entered the first 7 digits of my account number into the payments system. Surprisingly this was _not_ an error. For example say my a/c number is 12345678, they entered 1234567, and the system assumed that meant 01234567 (this is a feature of all UK banks, not something to do with the payroll, because bank accounts are really just natural numbers, the first customer is given bank account number 1, etc.) Luckily the 01234567 account was dormant or closed so the payment was returned, otherwise several people would have had a bad day (and one person a good day).

<comment><USER34> As much as people make fun of the widespread use of checks in the US, it actually seems much better for this use case, for at least two reasons:

1) the check will be handed over in person to someone you've met before, or at least mailed to a known postal address which is harder to spoof than email.

2) If you present a check for $12m to a bank, it will get the scrutiny it deserves, and won't clear immediately.

<comment><USER35> To your second point, my anecdotal experience has shown that once a check makes it past the receiving bank clerk into the electronic clearing system, all manner of errors are allowed. E.g. dates in future, wrong payee, garbage signatures. The simplest way to pass a check with an error is to deposit it with 9 other "good" checks.

Has anyone had a check bounce due to a bad signature?

</comment></comment></comment></comment><comment><USER36> Did they ever find out who the masterminds were and were they charged criminally? I couldn't tell from the article.

<comment><USER37> I believe one unnamed person in China was caught with $5 million or so; but $960,000 CAD was still missing; so maybe not? Even if they only walked away with 8% of the total originally 'stolen', that's still pretty damn good.

Plus, it would probably bring the heat off of you. The investigators and the university get to say 'we successfully recovered 92% of it!' because that makes a great headline where 'justice was served' and have the case take a lower priority.

</comment></comment><comment><USER38> Is there a reason the submission titles are altered away from the articles?

</comment><comment><USER39> steal money from Canadian university and buy real estate in Vancouver...only in BC folks</comment>


The Perk Bubble Is Growing as Tech Booms Again (Airbnb) - <AUTHOR> http://online.wsj.com/article/SB10001424052702303763404576419803997423690.html?mod=WSJ_hp_MIDDLENexttoWhatsNewsSecond <comment><USER2> I do not identify as an anti capitalist by any means, but I can't help feeling a wee bit Marxy when thinking of someone in Manhattan reading the WSJ opining that an engineer getting fed by the company constitutes a perk bubble. (I also get a little Marxy about the perks themselves, as they are _explicitly designed_ to trick twenty something into not saying what they need to say, which is "Screw the soda, it's a seller's market right now, and that offer is under market by twenty thousand dollars.")

<comment><USER3> The truth is that most young people do get more out of an office with that kind of perks than a few thousand extra.

Heck free food, a place to sleep, shower and dry-cleaning? You could basically live there and would save much more than the 20k in expenses...

Not to mention that it would be a lot more fun than going home and doings things I don't particulary like, rather than staying and doing things I love.

But that may just be me.

<comment><USER2> So I'm working on a post about the psychology of owning a business versus the psychology of being an employee today, and this has been weighing on my mind. Here's my thinking:

There is a particular, exact dollar value which gets you the perk Do Not Worry About Laundry Ever Again. Google (presumably) doesn't have Google-branded dry cleaners on the premises, so this can be bought. What $TECH_EMPLOYER is taking advantage of is that young twenty-somethings think the entire solution space is "Do it yourself at the laundromat" and that "We'll do it for you" is thus a magical, irreplaceable unicorn of a perk from a company who really understands their inability to handle domestic chores.

You can buy that perk. In a high cost area like, I don't know, San Francisco, I think that it is highly likely that it costs less than $800. Let me check my guesstimate with the Googles: yep, you can literally have someone come to your door every two weeks for the year, grab your bag o' stuff, and bring it right back to you when it is done, for less than that.

You might think "But I have to actually arrange that." No, admin help is _also_ a perk which can be purchased, and admin help is _incredibly cheap_ because there is virtually _nothing_ that a secretary can do in San Francisco that cannot also be done by a virtual assistant in the Philippines for ~$10 an hour. (If for some reason that makes you uncomfortable, bump it up to $20 and now Nancy is a homemaker in Kansas.)

You could, after having a VA, send her an email saying "Hey Nancy, price out options for laundry service and catering where I live. I want to never worry about these things ever again after you handle them, except to pay. By the way, I like salmon and iced cocoa." and Nancy would come back in a day later with the number it would take to drown you in salmon and iced cocoa. And it would cost far, far less than $20k.

<comment><USER4> One thing that springs to mind in your example is the difference in social status. So I'm generalising (isn't all of psychology generalising..) but a person who has their laundry done for them by their company seems important and valuable; a person who pays for it just seems lazy / inept.

For example, I was once told a business suit gave status because it prevented the wearer from performing physical labour. A person in a suit was displaying that they did not have to perform physical labour in order to survive, unlike others who did - thus elevating their status _. Perhaps there is an element of this psychology in the domestic perks of modern day tech companies: the perks are displaying that they are important / smart enough to not have to perform some domestic duties or obtain their own sodas.

_ Interesting side note, that now the hoodie is becoming like the reversal of this display: it says the wearer is important / smart enough that they _dont_ have to wear a suit

Anyway, just a random though stream. Good luck with your post!

<comment><USER2> _a person who has their laundry done for them by their company seems important and valuable_

I grant that California may be a funny place, but in what social pecking order do engineers at Google beat lawyers, doctors, investment bankers, hedge fund traders, CEOs, assorted executives, or any other profession that routinely hires household help, when seen from the eyes of someone who cannot do pointer arithmetic?

</comment></comment></comment></comment></comment><comment><USER5> Perks that are pleasing in and of themselves are nice. Stuff that is designed to promote this sort of 'vibe':

> Working at Airbnb "is like a really fun school where you get paid," says Joe > Gebbia, the 29-year-old co-founder of the company, whose offices have a two- > story indoor tree house and a section of a retired Pan Am plane. "Or maybe > it's more like camp."

Feels a bit fake to me. It's a job. They pay you to be there, and they are not your friends. Friends are people who you hang out with after you've both changed jobs several times.

Also: work parties in SV suck, if you're a straight guy, because there are _not very many girls_.

Food isn't a bad perk, although fizzy drinks are not very healthy. The best perk I ever had at a job was a massage. It made me feel great, didn't take too long, and since most everyone got one, it wasn't like you stuck out for taking advantage of it.

<comment><USER6> > work parties in SV suck, if you're a straight guy, because there are not > very many girls.

These same parties can be fun if you accept that you're not going to meet a romantic partner at a work party. There are a thousand other great social circumstances which are more balanced and "productive" in this area.

<comment><USER7> I'm not in SV (Seattle instead), but I'm _already_ tired of "work parties". For once I'd like to talk about something _other_ than vim vs. emacs, Android vs. iOS, Python vs. Ruby, etc etc ad infinitum.

The homogeneity of this environment is aggravating. It takes a _lot_ of work to break out of it. I'm not sure what it is about geeks, but much of our community seems to take pride in being about tech - and _only_ being about tech.

<comment><USER5> One of the fantastic things about moving to Italy for me was meeting lots of people who do various things in life. Sure, I have friends that I can 'geek out' with from time to time, but even most of them have plenty of non- programmer friends. Also, being a programmer, as far as I can tell, seems to be regarded as a job like most others, not something too terribly nerdy or uncool.

<comment><USER7> I have a coder friend who recently moved to NYC and he reports (for the most part) the same thing. In Seattle telling people he's a software engineer does one of two things: it starts a big geek-out discussion about something, or people roll their eyes "oh boy, _another_ one of you guys". In NYC on the other hand people regard it as just another job.

</comment></comment></comment></comment></comment><comment><USER8> What I find interesting is the nature of the perks being offered. So while a big established business might offer 401K or medical and so on (and to be fair, it's probable that startups offer some of that too) the focus seems to be on perks that "keep you at work".

Free meals? Great, I don't have to go home just because I'm hungry. Fun at work? Great I don't need to go home, or go out, to meet my friends. Place to nap at work? Shower? Great - I can spend more time in the office.

The work-hard, play-hard mentality, appeals enormously to people who have no real reason to ever leave work. If all your daily chores are taken care off (free dry-cleaning, free food), and if your social needs are met at work, then you'll naturally spend more time there.

This life-style appeals less to me, 'cause I have a wife and kids to go home to, and a social life outside the office, and hobbies, and fixing-the-roof- when-it-leaks and stuff like that. But when I was 22 I had none of those things, and I would have thrown myself at an environment like this. Does it honestly matter if I'm making 10K or 20K a year less than I _could_ when I get all my (paltry) living expenses paid for? And the bragging rights over my peers are worth a LOT.

Is it a bubble? Well, it's a sign of supply and demand reaching the place where demand outstrips supply. Demand for employees, and also demand for investment-opportunities (by those with cash). That will inflate salaries, and lead to creative (read "fun") work environments.

Enjoy the good times, because as sure as nuts are nuts, the wheel will turn and the down-times will come again. Party hard now, but save some nuts too for when the supply overtakes demand again.

<comment><USER9> Agreed. But, then again, even when I did work at start-ups in the 90s, without kids and responsibilities, I much preferred "out of the office" activities. I thoroughly enjoy programming, and make time to hack when I'm not in the office, but I also like to do things that have nothing to do with computers, or the people I work with. So...these perks have always been lost on me, and like you, I see them as a "perk" at least partially designed to keep you in the office more.

That said, if this works for other people, by all means, have fun with it.

</comment></comment><comment><USER10> Are we now in the age of the "Articles using the word bubble to gain traction" bubble?

<comment><USER4> Perhaps it's a bubble ponzi scheme ;)

</comment></comment><comment><USER11> As an investor, employee perks are fine; trading $x in salary for a convenience that --when bought on scale or bulk-- might even save the company money. Employee happiness has tangible value.

On the other hand, as an investor I think I'd see decorating the executive offices with airplanes and tree houses as excessive and wasteful.

</comment><comment><USER12> How long until they start supplying dormitories?

We geeks really are 21st century medieval monks, and I, a UX designer and developer am nothing more than a manuscript illuminator.

I am tempted to put "Limner" on my next business card.

<comment><USER13> _We geeks really are 21st century medieval monks_

I don't know if monasteries are the right metaphor. Maybe more like highly paid company towns.

<comment><USER12> I don't think they had those in medieval times.

</comment></comment></comment><comment><USER14> Market price in a talent acquisition for a productive software engineer is $1M to $1.5M locked in over four years. That means that the annualized cost for talented engineering is $250k to $350k per year.

Paying for laundry, dinners, etc... to keep those employees productive and happy is a rounding error.

I've worked for years in an industry where a certain class of employees get paid at least $150k, up to $800k per year. These people get their laundry done for free. They walk around in clothing that is remarkably similar to pajamas, and these people often sleep on in special rooms dedicated to letting them sleep. Indeed, these people often put on their pajama uniforms when they walk into the building, sleep in them, and then change and go home.

These people get special parking permits, they get free food in the cafeteria. They have entire staff's devoted to making them as productive as possible. In fact, there are entire occupational disciplines devoted to making this class of employees as productive as possible, and make sure they have to do as little menial work as possible.

These people are doctors. And, there are entire disciplines devoted to making different specialties as productive as possible. Cardiac Cath Lab tech's and Cath lab nurses are on call 24/7, and their job is to make sure that _everything_ aside from patient care is taken care of for the doctor. Often, the Interventional Cardiologist walks in, talks to the patient on a gurney, looks at an EKG, and then goes and dictates a chart while a team of 3 nurses and tech's set up the patient, get the Flouroscopy machine ready, and call the physician back into the room to perform the procedure for 45 minutes.

No one blinks twice that the cardiologist gets to wear hospital provided scrubs, has a call room where they can sleep in, gets fed for free in the cafeteria, has special parking spots, has a physician lounge with free newspapers, deluxe coffee and snacks stocked 24/7/365. Why?

Because a busy Cardiologist in a single day, might place 10 pacemakers $30k a piece in 10 different patients. The hospital can bill $80k to 100k a piece for the procedure, and make enough money to care for the uninsured hoards in the Emergency Department.

Why then, do we balk at an engineer getting laundry done, wearing comfy clothes to work, or being able to wear a fake mustache once a week? The engineer :: user ratio at Yelp is about 1 :: 2 Million last I heard. It's about the same at Facebook and Reddit.

The only other industries where the employee to revenue ratio is comparable or better are the oil industries and the finance industries. Pay for software engineers is only now starting to catch up to the revenue that they are able to generate for a company.

Also, the software industry, and in particular the startup industry is built from "creatives".

What perks do other "creative" industries enjoy? No one thinks twice about playful, creatively colored rooms, toys laying around at a design or advertising agency in Amsterdam or New York City. If I were lead writer for a television show in Los Angeles and I had a bull pen of 12 writers that got together and wrote scripts for TV shows every week, I'd make sure that those writers had anything and everything they needed to spur creativity and focus on writing great copy.

Why should software startups be any different? Perks are cheap. Engineers are _really expensive. Keep those engineers happy. If you're doing anything less than that, you're not spending your money well.

<comment><USER15> Saving people's lives is a sustainable, indispensable industry. Yet another photo sharing app flush with irrationally exuberant VC funding isn't.

<comment><USER14> _Saving people's lives is a sustainable, indispensable industry._

Pacemaker representatives make a 3 to 5% commission on every pacemaker or implanted defibrillator they install. A busy Cardiologist can put in 10 in a day. Each pacemaker costs a minimum of $30k. I've seen pacemaker's go in people that probably didnt' need it. That doesn't mean the entire industry sucks.

For every misfunding of Color, there are 80 barely funded 2 to 3 person startups building solid, revenue producing companies in the Valley. When these startups get funded they struggle to recruit and need to retain engineers because they are head down building product.

That doesn't mean that perks industry wide are corrupt. An exception does not a rule make.

</comment></comment></comment><comment><USER16> Until the newly hired programmers start demanding demanding shares of your company in the interview and ask about the availability of your onsite sushi chef and masseuse we still won't be able to match the high point of the first dot.bomb era. And did I mention about companies competing to see who can through the best party?

</comment><comment><USER17> I'm probably too old anyway but _Mustache Monday_ could get old on me real quick.

</comment><comment> brown9-2 _Cashmere hoodies are all the rage on Sand Hill Road in Menlo Park, Calif., home to many big-name venture-capital firms, according to venture capitalist Marc Andreessen, who recently brought on former U.S. Treasury Secretary Larry Summers as a special adviser. Mr. Andreessen says "the challenge for now is to get Larry to wear a hoodie."_

Something about this feels very odd.

</comment><comment><USER18> Not so related to perks but Steve Blanks published an intriguing article on the second tech bubble that I thought was a very good read.

It's called "The Internet Might Kill Us All" - [http://steveblank.com/2011/06/22/the-internet-might-kill- us-...](http://steveblank.com/2011/06/22/the-internet-might-kill-us-all/)

</comment><comment><USER19> Still a long way until they match the perks of more traditional industries: [http://economicsnewspaper.com/policy/spain/the-insurer- munic...](http://economicsnewspaper.com/policy/spain/the-insurer-munich-re- paid-prostitutes-to-motivate-employees-26447.html)

</comment><comment><USER20> I'm wondering about the tax consequences of perks as opposed to equivalent salary bumps...

<comment><USER21> > I'm wondering about the tax consequences of perks as opposed to equivalent > salary bumps...

"free food" can't be taxable to the employee because there's no accounting. There may be limits on how the company can expense it but I suspect the "keeping them at work" is a good enough argument.

</comment></comment><comment><USER22> "The hoodie's centrality to tech culture..."

Heh, journalists.

</comment><comment><USER23> _The party room at reviews site Yelp Inc. has three beer kegs with built-in iPads to offer information about what's on tap._

Uh, do you need an iPad for that? It's a keg, you can just write 'Kilkenny' on the side in magic marker and be done with it.

<comment><USER24> info like who's the biggest drunk in the office (check-ins), momentary flow rate of the tap, etc... it's actually pretty fun!</comment></comment>


RedFenix can help people stay connected to the internet during Covid-19 - <AUTHOR> https://www.redfenix.network/redfenix-covid-19-challenge <comment><AUTHOR> As a result of the coronavirus, many people will not be able to leave their home to work and will not have how to pay for their cellular service or the internet at home. There are cases where students have been sent home, but due to their economic condition they do not have fixed internet, and cannot study. We have added a tool in our app to share the Wi-Fi network of your home or business, so that anyone near your network can connect automatically without the need to give the keys to anyone. By not interacting with who the internet needs, we have fewer infections and we help everyone stay connected.

We have started a challenge to make this viral and have a better social impact.

For participating we have 3 prizes:

1\. 100GB package.

2\. 50GB package.

3\. 25GB package.

To participate you must follow the following steps:

1\. Download our app and sign up.

2\. Share a Wi-Fi network in the app and make screenshot of Wi-Fi you shared.

3\. Invite 3 friends to share their Wi-Fi, tag the person who challenged you, tag RedFenix and use hashtags #SiHayWifi #RedFenixWifi #WifiGratisConRedFenix

Bonus: If you share a video inviting more friends, you have more opportunities to win.

We want you to help us democratize Internet access. A free internet is possible, but it must be collaborative.

Sincerely,

Charvel Chedraui CEO and Co-Founder RedFenix

This is our website: [https://redfenix.network](https://redfenix.network)

Direct link to apps or registration: [https://onelink.to/r95beb](https://onelink.to/r95beb)

reply</comment>


OkBuck: 10 lines config to use BUCK from Gradle - <AUTHOR> https://github.com/Piasy/OkBuck <comment><AUTHOR> OkBuck is a gradle plugin, aiming to help developers utilize the super fast build system: BUCK, based on the existing project with Android Studio + gradle, and keep both build systems work, with less to only 10 lines of configuration.</comment>


Central Illinois Xpress Emerge as Unlikely Force in Fifth-Grade League - <AUTHOR> http://www.nytimes.com/2015/01/19/sports/central-illinois-xpress-emerge-as-unlikely-force-in-fifth-grade-league.html?hp&action=click&pgtype=Homepage&module=photo-spot-region&region=top-news&WT.nav=top-news&_r=0

<comment><USER2> This article has some nice points about what the girls are learning (team work, discipline etc), but it's not nearly "breaking down barriers" as it seems. I coached swimming for 8 years:

Girls are 10x easier to coach than boys (on average). At that age they are also more coordinated, taller and sometimes stronger.

Also at that age: continual year round well coached practice is infinitely more important than gender. The boys teams in this article are seasonal recreational, while the girls team is a year round club team. I can tell you from swimming that a 5th grade year round swimmer would easily crush a recreational swimmer, regardless of gender, on average.

</comment><comment><USER3> > Too many youth coaches, Mr. Toran said, spend their time designing intricate > plays.

I could not agree more. So many coaches at this level of play want to try out the fancy stuff before establishing the basics.

> At the time, he said, he was an assistant coach with a semipro men's team > and was eager to escape what he described as the "whining and complaining" > of players who were resistant to coaching.

> In search of a more mature audience, he turned to a group of 9-year-old > girls.

> "You can actually teach them basketball," he said.

I already posted this comment on HN ([https://news.ycombinator.com/item?id=8910371](https://news.ycombinator.com/item?id=8910371)), but I think it relates to this article as well:

 _I play women 's football and coach high school guys football. Football is one of the most teamwork-dependent sports out there. Everyone has to be doing his job every single play. There's no way for one player to carry the team._

 _Before I started coaching guys ' football, I had heard consistently from other coaches in my women's league that women are way easier to coach than men in the game of football. Reasons given included less attitude, less individualism, less ego, more willing to work together, etc. When I started coaching high school ball, this was exactly the case. So much of my time was wasted beating the individualism out of these boys and getting them to play for each other, not themselves._

 _Maybe it 's that football attracts a certain type of male. But I think women might be more naturally disposed to working on a team than men on average._

<comment><USER4> > Maybe it's that football attracts a certain type of male.

Um, _DUH_. Most boys play sports to _stand out_. Mostly with girls. Sometimes against other boys. Sometimes in the hope of getting a scholarship.

Game it out. What's the point of being a team player on a mediocre team? Better to be the guy who makes the big play that people remember.

In addition, most high school coaches suck by simple Darwinian mechanics. The good ones get pulled up to much bigger schools _REALLY_ quickly. The poor ones get left behind.

<comment><USER3> > Most boys play sports to stand out. Mostly with girls. Sometimes against > other boys. Sometimes in the hope of getting a scholarship.

I completely disagree. This is a very pessimistic depiction of young male athletes. I believe the primary reason for high schoolers playing sports is still interest in the game itself, not ancillary benefits. When I started coaching high school the team was 1-7 and a joke to the school. There were still thirty boys that came out to practice everyday because they loved the game.

> In addition, most high school coaches suck by simple Darwinian mechanics. > The good ones get pulled up to much bigger schools REALLY quickly. The poor > ones get left behind.

I also disagree with this. Coaching promotion is highly dependent on whom you know and whom you're friends with. There many excellent high school coaches that never get pulled up simply because they do not have the connections. There are also many good college coaches that leave college ball because they would rather be head coach of a great high school program than the third defensive back specialist of a college team.

<comment><USER5> American culture is awash in thinly-disguised fertility rituals, from cheerleader routines at sports fixtures to selection of 'prom queens' who are stereotypically paired with the quarterback of the football team. From a non- American's perspective, football is _massively_ sexualized.

</comment></comment></comment></comment><comment><USER4> A professional coach can out-compete the local yokel coaches with a team a year or two behind.

And, at that age, girls on average are bigger than boys.

Um, okay. This is news, why?

</comment><comment><USER6> We have a team of girls who are doing mighty fine (shocking, I know) and a newspaper that turns their story into such an unbearable headline (for profit). Pretty good summary of where we're at right now.

<comment><USER3> I agree. The headline is inflammatory. Very unfortunate because the article itself was an interesting read.</comment></comment>


Update on Sony Investigation - <AUTHOR> http://www.fbi.gov/news/pressrel/press-releases/update-on-sony-investigation <comment><USER2> Some of the Sony leaks have demonstrated the company's ability to influence the news cycle, giving them pull with certain news organizations and editors to change or remove parts of a story.

I'm disappointed by the lack of evidence given by the FBI and other departments investigating the attack that directly tie the incident to a specific government or group of non-state actors. Many well-known security professionals have given opinions contrary of the FBI's findings, stating that it's not only difficult to determine the source of the attack but also incredibly dangerous to attribute the attack to a specific government given so little direct evidence.

There are so many aspects to this story that don't add up, but most strikingly, the press's push to point the finger squarely at North Korea for all this.

<comment><USER3> _Many well-known security professionals_

...who are pandering to a crowd, and based upon essentially no information at all, but just the same sort of "I think" gut feeling notions that we see on HN. While there should always be questions about government honesty, it's rather incredible how far people will reach to find to clutch onto something that backs whatever their initial knee-jerk opinion was, seen throughout the comments here.

Quite a few comments are among the "they're making this up to go to war", which is simply _incredible_ : Are people so far out of the loop on world players or current events? The US in no universe will launch a military action against a rogue, shells-pointed-at-Seoul, nuclear armed nation because they hacked Sony. That premise alone is simply absurd.

Is the US trying to isolate North Korea? They're _already_ completely isolated. I mean...do people understand the situation North Korea is in, and the complete lack of tools to deal with this? The US gains literally nothing pointing the finger at North Korea.

<comment><USER4> _The US gains literally nothing pointing the finger at North Korea._

It also loses nothing, which might be the case if Russia or China were behind the attacks.

<comment><USER5> Not true. Can you imagine the economic impact if this stands as a case study on how lax security standards _could be_ at large, trusted private institutions? That all it takes is one pissed-off employee with a cursory background in computer security to cause billions of dollars in damages and rampant fear?

It's much easier to address public fears with an easy scapegoat than to owe up to the overall frailty of network-driven industry. Could you imagine the cost of creating "the TSA of networks belonging to important private entities?"

<comment><USER6> Part of me does wonder whether we're headed in that direction. See: Rainbow's End, by Vernor Vinge.

What is the equilibrium in a world where state funded actors can anonymously attack major companies / infrastructure components? I am not convinced that is possible for a Sony to secure itself to such a level that it will not be vulnerable to attacks by state actors.

<comment><USER7> Not without actually - ya know - trying.

</comment></comment></comment></comment></comment></comment><comment><USER8> As far as I can tell, there are (EDIT: at least) three scenarios:

1\. The NSA is competent, and has verified that NK is responsible.

2\. The NSA is competent, and is lying about whether NK is responsible.

3\. The NSA is incompetent, and erroneously concluded that NK is responsible.

Since we know that the NSA is filled with highly competent people (based on the quality of the people who periodically join the commercial world after a stint at the NSA) we can probably consider 1 or 2 the most likely explanation.

Which do you believe, and why? Unless there is strong evidence, 1 seems the most likely. It's also the simplest explanation.

Also, the reason I'm talking about the NSA even though the article is talking about the FBI is because this surely falls under their umbrella, and the NSA has the most powerful tools for verifying what happened. Other agencies would seek answers from them, and the NSA's input would matter. For example, one sentence starts, "As a result of our investigation, and in close collaboration with other U.S. government departments and agencies, ..."

EDIT: Could we focus on the question? Which do you believe, and why? Please feel free to add additional scenarios, but at least mention whether you believe them and why they're likely.

<comment><USER9> 4\. The NSA is incompetent, and correctly concluded that NK is responsible using erroneous reasoning.

<comment><USER10> Haha! Good catch. I've seen people unwittingly leverage this basic pattern into entire executive careers :(

<comment><USER11> It's basically a specialization of the base rate fallacy. If, say, idiots can still be right by chance 10% of the time, and experts are right 90% of the time, but only 10% of the population are experts, then lucky idiots will make up fully half of the population of people who are right.

<comment><USER12> 10% is pretty generous for most of the work experts actually do, though.

Experts do many things, one of which is to occasionally make predictions, where 10% might be more reasonable.

But, for work like imagining how a given goal can be realized, I would guess an "idiot" could compose an achievable plan less than a fraction of a percent of the time.

<comment><USER11> I'm not sure. Computer experts? Yes, hard to get lucky there. Business experts? Luck seems much more significant.

<comment><USER13> It's all about having enough variables in the system so you can point to something else as the cause when there is failure, and yourself as the cause when there is success. With willful ignorance of reality, idiots can have a success rate _much_ higher than 10%. :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> It seems unfortunate to me that the Sony hack has now displaced the CIA torture report completely in the national narrative. Whether purposefully orchestrated or not, it sure seems like a useful coincidence.

<comment><USER15> To be fair, its been a busy newsweek. The ruble collapsing, Putin's ridiculous Q&A and befriending of North Korea, the Sony hack, Iran coming to the negotiation table, a few days of no deaths in Ukraine, Australian terrorist operation, UK VIP sex ring deaths, Hong Kong protestors being pushed out, etc.

The torture report is just more details on what happened 10 years ago. No one is shocked or surprised. The guy in charge of all this left when the current guy took office in 2008. If we're playing nation state PR trickery games, it seems to be Russian and Chinese media outlets were really pushing the report as a way to distract from their own domestic issues, their own domestic human rights issues against their own citizens, and to continue to vilify the US as it serves them domestically to deter people from their god given rights to freedom, justice, and self-rule.

Of course, to many internet commentators, Russia and China never do dirty tricks like these, only the US. Shame we can't have a more evolved view of press release timing, news cycles, etc. Its just more anti-US conspiracy theories while the rest of the world, especially dictatorial regimes, get a free pass.

<comment><USER16> I'd just like to point out that the "Australian terrorist operation" turned out to be one person with a previous history of violence and mental instability, who has been disowned by every group he claimed some connection with.

It wasn't so much a "Terrorist operation", as an act of horrible desperation by an incredibly disturbed individual.

This is a perfect example of why "Terrorism" is a dangerous term. It has huge definition creep.

<comment><USER17> Well, walking past it every day on the way to work certainly gives me a bit of terror

</comment></comment></comment></comment><comment><USER18> They sound a lot more certain than people here want to give them credit for.

"Intelligence officials "know very specifically who the attackers are," said one individual familiar with the investigation"

[http://www.washingtonpost.com/world/national-security/us- att...](http://www.washingtonpost.com/world/national-security/us-attributes- sony-attack-to-north- korea/2014/12/19/fc3aec60-8790-11e4-a702-fa31ff4ae98e_story.html)

</comment><comment><USER19> I can't believe so many people are rendering verdicts _sans evidence_ that the FBI is wrong about this.

Look, I don't trust the FBI completely. But as of this point they're the only people who have actually seen any of the pertinent evidence. Unless you have a prior that they are actually MORE likely to be malicious than not, there's no grounds to do anything but acknowledge their claim (with as much salt as your please, of course).

</comment><comment><USER20> If we assume everything written here is the full truth, I think they need to release some more technical details on the specifics of the hack.

If foreign governments are now a real threat, industry should have some awareness of the methods being used so we can try and protect our own infrastructure. Especially as this seems to indicate they are using software that's at least somewhat known already.

</comment><comment><USER21> The US government getting involved initially moved this from "Sony never bothered paying for actual security" to "somebody is trying to take advantage of the attack". When Obama promised a "proportional response, this drama suddenly sounds like war drums.

So I guess the question is either who needs a war asap (follow the money?), or who needs a war-sized distraction?

<comment><USER22> It is really quite safe to say that absolutely no one wants a war with N. Korea. It would be one of the most horrific wars in history, and everyone in the Defense department knows that. N. Korea has been looking to provoke conflict for a while, and the US, or anyone, doesn't want them to escalate. They have nukes.

</comment></comment><comment><USER23> Where is Japan in all this? If North Korea is in fact responsible, it seems like Japan should be the one weighing a "proportional response". They are certainly capable.

<comment><USER24> Because the attack occurred on networks and computers belong to Sony Picture Entertainment based in Culver City, CA.

</comment></comment><comment><USER25> The response is rather disturbing. It's like we're expanding the reach of N Korean censors. My initial reaction to accusations of N Korean involvement was to laugh it off. Seems like the sort of thing Russian teenagers would do quite frankly.

</comment><comment><USER26> It is significant that this information is coming from the FBI and not the Pentagon, CIA or NSA. It indicates that this will be treated as a domestic criminal issue and not an act of war. Don't expect an overt military response. Also, since US law doesn't apply to the North Korean government, don't expect much to happen at all besides Sony continuing to cede to the demands of the hackers.

<comment><USER21> FBI isn't about criminal issues anymore now that they got into the CIA/NSA club about a year ago. In case you missed their change in direction, their new mission statement says the primary function of the FBI is "national security", not "law enforcement".

[https://www.techdirt.com/articles/20140106/00442525768/fbi-a...](https://www.techdirt.com/articles/20140106/00442525768/fbi- admits-its-not-really-about-law-enforcement-any-more-ignores-lots-crimes-to- focus-creating-fake-terror-plots.shtml)

<comment><USER27> FWIW, one of Obama's quotes today referred to the "criminals" behind the attacks, which is a careful choice of words. It implies that it is not being treated as a terrorist attack, and certainly dampens the rhetoric that this is state sponsored. Criminal implies independent groups or possibly foreign organized crime elements, but not necessarily state-sponsored.

</comment></comment></comment><comment><USER28> Brian Krebs has just posted his analysis of the incident and the FBI's response: [http://krebsonsecurity.com/2014/12/fbi-north-korea-to- blame-...](http://krebsonsecurity.com/2014/12/fbi-north-korea-to-blame-for- sony-hack/)

</comment><comment><USER29> The more I read about this blunder, the more I shake my head. Sony is really dropping the ball

<comment><USER30> To be fair, now FBI deserves some of the blame. I'd like to see exactly why they believe this was a specifically Korean thing and not a "North Korea used this same malware family they acquired elsewhere for their South Korea attack earlier" situation.

[http://www.fbi.gov/news/pressrel/press-releases/update-on- so...](http://www.fbi.gov/news/pressrel/press-releases/update-on-sony- investigation)

Proposed Scenario:

        - Malware is developed independently
        - N Korean actors use a variant of it
        - GoP uses a variant of it

               A
            B     C

FBI hamfistedly assumes B -> C, not A->B and A->C.

<comment><USER31> To be fair, the FBI is a big organization which employs many intelligent individuals. It's very unlikely we know everything about this situation that they do.

<comment><USER32> However, it is well-known that big U.S. government organizations regularly come up with lies to serve their own interests.

I would take everything they say with a grain of salt.

<comment><USER33> You're right, but I don't think they would make this accusation purely due to a mistake. In my opinion, there are 2 possibilities:

1\. The FBI knows who did it and is telling the truth by saying it's North Korea. 2\. The FBI knows who did it and is lying by saying it's North Korea.

Personally I think they're telling the truth in this particular case.

</comment></comment></comment></comment></comment><comment><USER34> "FBI now has enough information to conclude that the North Korean government is responsible for these actions"

Their reasons were along the lines of "attacks that look very similar were from North Korea" but were those attacks conclusively linked? I'm also curious how they decided it was the government there, not a rogue group of people.

</comment><comment> at-fates-hands The one thing I can't get off my mind is something I saw in another forum related to InfoSec when the letter threatening the employees came out.

A Russian poster said, it was an odd use of the word "False" in the email, since in English it's "Lies". He said when you translate the Russian word for "Fake" or "Lies" it comes out as "False". Which, if you read the email and substitute the word "Lies" for "False" in the two sentences where the word is used, suddenly the meaning is totally clear.

Here is the email:

[http://variety.com/2014/film/news/hackers-threaten-sony- empl...](http://variety.com/2014/film/news/hackers-threaten-sony-employees-in- new-email-your-family-will-be-in-danger-1201372230/)

 _Removing Sony Pictures on earth is a very tiny work for our group which is a worldwide organization. And what we have done so far is only a small part of our further plan. It's your false if you think this crisis will be over after some time. All hope will leave you and Sony Pictures will collapse. This situation is only due to Sony Pictures. Sony Pictures is responsible for whatever the result is. Sony Pictures clings to what is good to nobody from the beginning. It's silly to expect in Sony Pictures to take off us. Sony Pictures makes only useless efforts. One beside you can be our member.

Many things beyond imagination will happen at many places of the world. Our agents find themselves act in necessary places. Please sign your name to object the false of the company at the email address below if you don't want to suffer damage. If you don't, not only you but your family will be in danger.

Nobody can prevent us, but the only way is to follow our demand. If you want to prevent us, make your company behave wisely._

Just something I keep coming back to in all of this.

<comment><USER35> One of the articles that was debunking the NK connection mentioned that the language used in NK stems heavily from Russian in a variety of ways. So if they took the use of false to mean lies and falsehoods it would make some kind of sense.

</comment></comment><comment><USER36> Questions to challenge this assertion (because come on, my grandmother is more competent at digital forensics than the FBI):

      Technical analysis of the data deletion malware used in this attack revealed
      links to other malware that the FBI knows North Korean actors previously developed.
      For example, there were similarities in specific lines of code,

Did the original NK's malware use lines of code from somewhere else, and could this 'shared line of code' just be a very common line of code?

      encryption algorithms,

Encryption algorithms in common?! Oh, heavens! I use AES too! Maybe i'm a North Korean hacker and I never knew it!

      data deletion methods,

Because there are North Korean ways of deleting things that nobody else uses to delete things?

      and compromised networks.

If a network has been compromised by one person, it's probably been compromised by several.

      The FBI also observed significant overlap between the infrastructure used
      in this attack and other malicious cyber activity the U.S. government has
      previously linked directly to North Korea.

Using the same questionable ways of 'linking' like the above, I presume.

      For example, the FBI discovered that several Internet protocol (IP) addresses
      associated with known North Korean infrastructure communicated with IP
      addresses that were hardcoded into the data deletion malware used in
      this attack.

THE SMOKING GUN! An IP address! And we all know those can't be spoofed! But just to clarify: An IP of some NK hardware communicated with an IP that was hardcoded in the malware. That 'hardcoded IP' could be a Google web server for all we know.

      Separately, the tools used in the SPE attack have similarities to a
      cyber attack in March of last year against South Korean banks and media outlets,
      which was carried out by North Korea.

The _tools used_ are similar? They might have used Metasploit to hack a SK bank, but that doesn't mean everyone who uses Metasploit is a NK hacker. And off-handedly asserting NK did the SK bank hack is a bit of a hand-wavey move.

\--

It's clear that the FBI has no actual direct links or hard evidence. It has amassed a set of random unrelated suspicious notes and decided this is enough to be sure NK was the perpetrator.

And that's how law enforcement works in this country, folks. Some obscure hokey details get paraded around as hard evidence so they can look like they've done their job.

</comment><comment><USER37> Obama's response to this today was very diplomatic and on point: [http://www.bbc.com/news/world-us- canada-30555997](http://www.bbc.com/news/world-us-canada-30555997) .

He mentions that we as an international community needs to establish better internet and cyber operating rules, and I think we are slowly but steadily heading to a decentralized internet as the answer.

The problem I see with decentralization is that non-technical people have absolutely no idea what it even is or how it can help. However, the trend with these major cyber breaches seems to be that they are occurring more frequently and being more widespread. This may be a push towards educating the public on the benefits of decentralizing information on the internet.

<comment><USER38> No politician ever sees _de_ centralization as the desired answer.

</comment></comment><comment><USER39> The 'Of Course' side of me is disappointed in this whole thing and how our freedom is very weak when put on CEOs/corporations protecting self interest first.

However the 'But Maybe...'and cynical side of me says Sony and the studios will use this to attack file sharing, and a new cyber crime law somehow out of this ([http://www.theverge.com/2014/12/19/7420823/mpaa-decries- goog...](http://www.theverge.com/2014/12/19/7420823/mpaa-decries-googles- shameful-attack-on-its-anti-piracy-program)).

Our hysteria at times just turns into loss of rights and freedoms for us, we have to stop this manic, short-term thinking behavior.

</comment><comment><USER40> This confirms that the public mindset doesn't need evidence when it comes to geopolitics. Over a decade later, and people still never ask for evidence. #learn-nothing-ever

</comment><comment><USER41> I just can't buy this explanation without evidence.

</comment><comment><USER42> "Who this was" is a lot less important than the question: "How can corporations and individuals defend themselves in the future"

</comment><comment><USER43> This is a very serious allegation -- I certainly hope as much evidence as possible is provided to the public before any punitive or compensatory measures are taken.

But let's be honest, the perp is North Korea. Nobody in this whole process will be stressing the need for transparency and restraint.

Looks like Sony's horrifying and insulting info-sec policies are going to be swept under the rug.

</comment><comment><USER44> I have to admit - I'm dying to know just what it is that this group has on Sony. They are completely back on their heels with this.

</comment><comment><USER45> USS Maine, anyone?

The evidence and the release of statements about that evidence seems extremely light, and way over the line of being dangerous.

<comment><USER11> There are far better ways to drum up support for an invasion of North Korea than a false-flag hacking of an entertainment company. All you'd really have to do is wait a little while until they test another nuclear bomb or shell South Korea again or sink another South Korean ship or anything of the sort, and then take a hard line response instead of the standard "if we ignore them maybe they'll go away" response. The idea that this was drummed up to start a war makes no sense to me.

<comment><USER46> It's not about invading Korea, it's about justifying new laws that would provide tighter control over the Internet as a way to "keep us secure".

</comment></comment></comment><comment><USER47> Out of curiousity, does anyone know any serious or credible infosec figures who believe the attacks were perpetrated by North Korea?

All I've heard confirming this is from MPAA "cyberterrorism experts." And George Clooney, whose statement regarding the Nixon origins of the name "Guardians of Peace is also unverifiable.

</comment><comment><USER48> Am I the only one thinking that maybe the attack came from North Korea, but the hackers originated from China? Maybe China even loaned the hackers?

I can't see how NK could have a hacker force when they are so behind in technology. For hackers to be good, they need to be educated with technology. That seems unlikely coming from NK.

<comment><USER49> How do people keep getting this so wrong? North Korea recruits and trains hackers.

[http://www.vocativ.com/world/north-korea/unit-121-the- north-...](http://www.vocativ.com/world/north-korea/unit-121-the-north-korea- hack-sony/)

<comment><USER48> No need to be snarky. I'm not reading NK news everyday and I'm sure I was not alone not knowing about that Unit 121.

Even so, this article actually raises more question than it answers. Was Sony's security really weak or was the hack very clever? It may have been the former and if so, some other people might have the same information for quite some time now.

<comment><USER49> Didn't mean to be snarky, I just keep seeing all of the "North Korea is behind in technology" talk with not a whole lot of evidence to support it. Thinking that any nation doesn't have the technological capability to perform some complex hack is a little misguided, in my opinion. The average citizen may not be up to snuff technologically, but these are governments we're talking about.

</comment></comment></comment></comment><comment><USER50> Now that USG has announced attribution, what kind of response is called for by US doctrine?

<comment><USER51> I think the response is usually to make and release a comedy film about the affair.

<comment><USER52> At the very least, a documentary about filming the film _ala_ [http://en.wikipedia.org/wiki/Hearts_of_Darkness:_A_Filmmaker...](http://en.wikipedia.org/wiki/Hearts_of_Darkness:_A_Filmmaker%27s_Apocalypse)

</comment></comment></comment><comment><USER53> Now that anti-prohibition measures are passing in various states - posing a threat to the feds' cash cow (the "War on Drugs") - the feds are now trying to stir up nonsense over supposed "cybercrime".

The intrusion in this case was most likely done by an insider, the feds themselves, or a hacktivist group. The feds routinely break into private systems and are known to go to great lengths to construct elaborate string operations [1].

The timing of the press release is highly suspect. An investigation into an international security breach can take months or years. The feds rarely comment conclusively at the outset because such statements can compromise the investigation. They've provided no evidence whatsoever to support their claims.

Tipping off the purported culprit in this way by claiming to have identified their tell-tale attack signature would make it harder to track future breaches. (It's like publicly announcing that a suspect's phone is being tapped.)

This press release violates standard operating procedure. And why haven't the feds filed charges if the investigation is all "wrapped-up"?

If a foreign nation was involved, there's no evidence that's the case. NK has been the subject of scathing media criticism in the west for years, but other critics weren't targeted in this way.

As others have pointed out [2], the intruders initially demanded a cash ransom. The theory that the attack was linked to a movie release was originated and spread by the media.

[1] "The Terror Factory: Inside the FBI's Manufactured War on Terror" \- [http://trevoraaronson.com/book/](http://trevoraaronson.com/book/)

[2] [http://krebsonsecurity.com/2014/12/fbi-north-korea-to- blame-...](http://krebsonsecurity.com/2014/12/fbi-north-korea-to-blame-for- sony-hack/)

</comment><comment><USER54> For Argument sake, What if this is another WMD, of NK which did not exist in Iraq, and Did not Originate from NK. Not saying NK is not behind the attack, but what if they are not?

Haven't we lost the hope and trust on Media and Agencies already?

</comment><comment><USER55> Relax, it's North Korea, the nation-state equivalent of the short bus. -Archer

<comment><USER56> Potentially irrelevant, but: I find this quote to be distasteful and offensive (for hopefully obvious reasons). This and "you never go full retard" are two quotes I think modernity could do without.

<comment><USER55> Really? I didn't realize it had anything to do with that. I thought it was simply about how the "short bus" looks like a normal bus from one angle, but disproportionately small from another. As in, DPRK threats look scary but really don't have much backing.

<comment><USER57> It refers to a smaller bus used to ferry students to special education programs, with the implication that they're all dumb and so is the person being insulted.

[http://en.wiktionary.org/wiki/ride_the_short_bus](http://en.wiktionary.org/wiki/ride_the_short_bus)

So, yeah, please don't use it :) (if you really want to see the context of the common usage, you can do a google image search for "short bus".)

<comment><USER55> That's really not how it's used around here (west coast canada). They aren't associated with special needs kids. When I rode motorcycles at university the term was used for any silly-looking vehicle. A Jeep TJ with a lift and big rims, or a large truck with a tiny trailer would be called "short bus" if it looked taller than long.

I think that was the context Archer meant. (s04e09 "The Honeymooners" when Lana an Archer pose as newlyweds)

</comment></comment></comment></comment></comment><comment><USER58> PHB: This situation is so embarrassing... We are so fired!!!

BOFH: We can blame North Korea. Aren't we about to launch a comedy about their supreme leader?

PHB: Genius!!! (and left the room)

BOFH: Let me change the locale to Korean and recompile my virus!

</comment><comment><USER59> This is a political power grab by the FBI from the NSA.

</comment><comment><USER60> Several articles mention that the hackers have released stolen data, but I can't seem to find any download links. Does anybody have a source?

<comment><USER61> Fire up a Tor browser, it's probably all over the dark web. Part of me wants to dig through it because I'm just nosey, but I don't need a new way to waste time.

</comment></comment><comment><USER62> Or the FBI has their own agenda and knows other agencies won't contradict them publicly once they announce North Korea is responsible.

</comment><comment><USER63> Honestly, I think Sony did take a big risk with that movie. First, the movie is total crap, and, now, because of all the noise, more people will watch than it deserves when it gets released on DVDs, cable, and so on!

We know CIA and NSA do sabotages as well and have hacked the whole world already - why do we think this right is reserved only for America and North Korea and other countries are not allowed to do this when it serves their interest?

<comment><USER64> how do you know the movie is crap? it's probably at least as good as any seth rogen movie. and seth rogen movies were good enough to get this one made.

for my money, it had a great trailer. the movie could be okay. it's easy to pile on to the notion that the movie is crap, as it makes the proceedings even more absurd. if the movie was good, then sony is somewhat vindicated, but we can't imagine that to be the case, because sony has bungled every moment of their response.

<comment><USER63> There are no good comedies these days. If you put a price tag on your life's worth and then calculate the dollar value of an hour of it, will you invest all that money into watching a crappy comedy, really? Although the time spent watching may have some health benefits from the laughter, I think meeting friends and having a social conversation, which is often accompanied with even healthier laughter is time much better spent. I personally want to "invest" in a movie only if it enriches me in some way. Unfortunately, these movies are so rare nowadays.

</comment></comment></comment><comment><USER65> Wake me up when these idiot hackers finally destroy the last bits of freedom still available on the Internet.

</comment><comment><USER66> Sony Pictures is a subsidiary of a Japanese company. Why should the U.S. and not Japan take the lead?

</comment><comment><USER67> North Korea's actions were intended to [...] suppress the right of American citizens to express themselves.

This looks like a new war from an European point of view.

</comment><comment><USER68> why did they issued a update on that so fast? and none on the results of their war on drugs?

;)

</comment><comment><USER69> I was going to comment, but North Korea suppressed my expression. Curses you NK!

</comment><comment><USER70> Why anyone would trust any statement made by the American government without providing any supporting evidence is beyond me.

<comment><USER71> It's probably not wise that they release malicious binaries or details about foreign hacking infrastructure to the general public. That doesn't leave the with much direct evidence they can release at this point. Remember, it is an ongoing investigation and will be for quite some time considering the scope and severity of the breach.

</comment></comment><comment><USER72> On one hand, it seems incredibly stupid to make a movie (comedy or no) about assassinating a sitting national leader. They didn't even use a thinly-veiled reference. They used his actual name.

Still, of course this response is unwarranted.

> _North Korea's attack on SPE reaffirms that cyber threats pose one of the > gravest national security dangers to the United States_

Ah, the real meat of the issue? Has anyone else noticed the drumbeat ramping up in earnest for the next "War on fill-in-the-blank"? Sure, we all know that the threats are real, but it strikes me that we're about to spin up the full military/cyber-security complex, complete with its incessant fear-mongering, revolving private/public beneficiaries, and trillion dollar budgets.

Something about repeating the same patterns ad infinitum in response to every threat or perceived threat is just a bit exhausting.

<comment><USER73> "On one hand, it seems incredibly stupid to make a movie (comedy or no) about assassinating a sitting national leader."

Quartz covered that angle:

[http://qz.com/315432/this-is-far-from-the-first-time- hollywo...](http://qz.com/315432/this-is-far-from-the-first-time-hollywood- has-killed-a-world-leader-on-screen/)

<comment><USER74> _The Naked Gun: from the Files of Police Squad!_ , anyone?

The plot of that movie revolved around a professional baseball player psychologically reconditioned to assassinate the Queen of Canada during a game. Oddly enough, neither the Expos nor the Blue Jays were the visiting team.

Interesting that the article only gave an honorable mention for the fistfight where Lt. Drebin rubbed the birthmark off of Gorbachev's head.

</comment></comment></comment><comment><USER75> Queue an invasion of North Korea.

[Edit] Actually I shouldn't have posted that. Some reporter is going to see this post, assume that I'm repeating something I heard from a reputable source, put it on the front page, and the whole world will suddenly believe that we were always going to invade Korea, because terrorism!!

<comment><USER76> * Cue</comment></comment>


Linux Inside - <AUTHOR> https://www.gitbook.com/book/0xax/linux-insides/details <comment><AUTHOR> I have finished reading the first chapter of this book. It's very easy to understand.</comment>


Algorithm for Optimizing Caffeinated Alertness - <AUTHOR> https://lifehacker.com/how-to-time-your-caffeine-consumption-and-maximize-aler-1826619383 <comment><USER2> I recall reading that if you get clean from caffeine that your level of alertness is basically the same as someone who uses caffeine regularly with caffeine in their system.

In other words, at best regular caffeine use can only ever boost you back up to a level that would be your baseline had you not consumed caffeine regularly.

When I saw the brain scans that suggested as such I quit drinking coffee.</comment>


Twitter Sidestepped Russian Account Warnings, Former Worker Says - <AUTHOR> https://www.bloomberg.com/news/articles/2017-11-03/former-twitter-employee-says-fake-russian-accounts-were-not-taken-seriously <comment><USER2> This article is one-sided and full of factual inaccuracies.

Leslie did not start the product safety safety and security team in 2014 -- it had been started long before he arrived. He didn't even start the engineering arm of it, which also existed long before he arrived. While I can't say so conclusively, I also do not believe he was the head of engineering at Slack. I believe that was/is Michael Lopp (@rands).

Twitter has regularly been deleting spam, bot, and fake follower clusters for years, at a massive level. A cluster of Turkish fake followers was discovered in my time there and deleting it threw off user growth numbers for the quarter and also forward-looking guidance. That predictably had a negative effect on the stock. I'm sure there was discussion about what the right thing to do was, but they took the action that hurt them financially (both at the company and individual level) over the easy path.

Twitter is not perfect, but the people I worked with there were honestly trying very hard to strike a balance between protecting free speech and removing bad actors from the system.

<comment><USER2> Btw, just to put more fact-checkable names against my claims:

Bob Lord starting the security team at Twitter. Moxie started the platform engineering wing of security. Del Harvey either started or was a very early employee that went on to lead product safety and still does so today.

Leslie started after all of these people and had a relatively short tenure. He probably did have something to do with user login (that was after my time), but that was and likely still is a very small team.

</comment></comment><comment><USER3> Related article which came out a few days ago, concerning high profile alt- right Twitter personalities, which turned out to be Russian run accounts.

[http://www.philly.com/philly/news/politics/presidential/russ...](http://www.philly.com/philly/news/politics/presidential/russia- fake-twitter-facebook-posts-accounts-trump-election-jenna- abrams-20171103.html?amphtml=y&mobi=true)

</comment><comment><USER4> if twitter ever gave an honest accounting of their real users, the stock would tank and they'd probably be facing shareholder lawsuits.

<comment><USER5> They have no idea what's going on.

I travel a lot and the number of countries where society has gone nuts is unbelievable.

There was a time when people who had experience working a crisis stepped in and worked it. As in things moved forward towards better solutions. Now they spend their entire day being distracted and reacting to noise generated on social media by people who have no experience doing anything other than making noise.

If Youtube/Twitter/FB et al don't handle and own all these unintended consequences in the same manner they do software bugs we are headed to Chinese style network control very soon.

<comment><USER6> The article is saying that they have a good idea what is going on but have no incentive to "clean up" the platform and detect "fake" content.

</comment></comment></comment><comment><USER7> Sounds like Twitter has a flawed internal culture. I expect many rats will start paddling away from the ship.</comment>