Response to the ASA's Statement on p-Values - <AUTHOR> https://errorstatistics.com/2019/01/19/a-letter-in-response-to-the-asas-statement-on-p-values-by-ionides-giessing-ritov-and-page/ <comment><USER2> Andrew Gelman, a pioneer of the methodology of Bayesian statistics (cited in original article; he doesn't call himself a Bayesian in the philosophical sense) responded to the ASA statement so:

[http://www.stat.columbia.edu/~gelman/research/published/asa_...](http://www.stat.columbia.edu/~gelman/research/published/asa_pvalues.pdf)

His conclusion there is that scientific institutions are not accepting, as they need to be, of systematic uncertainty. Elsewhere he says that scientists who are not statisticians should concentrate on gathering quality data: noise in data often leads to spurious point estimates:

[https://statmodeling.stat.columbia.edu/2017/02/11/measuremen...](https://statmodeling.stat.columbia.edu/2017/02/11/measurement- error-replication-crisis/)

In the first link, Gelman talks of the "garden of forking paths": this is essentially a generalisation of the idea of p-hacking to recognise that perfectly honest researchers will not conduct unbiased analyses because of the myriad of parameters that estimates depend on. The solution is to move away from summarising results through point estimates to construct statistical models where you can explore the space of possible analyses; there has been a revolution in the techniques for doing so through the application of Monte- Carlo Markov-chain techniques to construct posterior distributions.

</comment><comment><USER3> It seems clear to me that Popperian falsification is indeed the only way to separate the wheat from the chaff in theoryspace, however, generating theories generally requires inductive reasoning.

You observe data, you make an inference that leads to a theory (induction), you then subject that theory to falsificationist testing.

"It appears all the swans I've seen are white, therefore I posit all swans are white. Oh, wait, there's a black one, nevermind."

On the Bayesian vs Frequentist aspect... Falsification is what you should do to theories, not model parameters. If you have a coin and you're trying to figure out the probability of heads P(H), then you have your model of coin- flipping (Bernoulli process) and you're trying to estimate the model's parameter, so you do statistical inference given some sequence of coin flips.

It doesn't seem right to apply frequentist null testing because you want to estimate the model parameter, not make some binary decision. What if you had some prior data you want to include? Or you observe new data in the future? This is exactly what Bayesian inference is setup for. And a lot of science is not about falsifying theories in theoryspace but about estimating model parameters in parameter space in the case we all agree on a particular model.

Moreover, a big advantage with Bayesian statistics is that it generally requires you to make your model and assumptions explicit, where it's much easier to scrutinize the model compared to a frequentist statistical test.

<comment><USER4> > It seems clear to me that Popperian falsification is indeed the only way to > separate the wheat from the chaff in theoryspace, however, generating > theories generally requires inductive reasoning.

A report analyzed the entries to _Nature_ one year and found that very, very few of the papers actually met Popper's criteria for falsifiable hypotheses, and in fact most of the papers started out with an exploratory aim and documented their findings. This means that to adopt the Popperian idea that only falsifiable claims are science means we must reject good science. One must also consider what opportunities are being missed if we were to force good science to adopt strictly falsifiable hypotheses before research commences - this would mean that every exploratory paper would need to be redefined (or rather, firstly defined) as a falsifiable hypothesis... in an attempt to please Popperians.

It is also a stretch to say that science must be empirical or carried out in a particular way to which falsifiability is congenial. There are good arguments that even philosophy[1] or mathematics can be considered sciences, and indeed they were (see _Wissenschaft_ in Kant and Hegel for instance).

Furthermore, it's been argued that Popper's theory of falsification actually includes bad science (pseudoscience). From SEP[0]:

>Strictly speaking, his criterion excludes the possibility that there can be a pseudoscientific claim that is refutable. According to Larry Laudan (1983, 121), it "has the untoward consequence of countenancing as 'scientific' every crank claim which makes ascertainably false assertions". Astrology, rightly taken by Popper as an unusually clear example of a pseudoscience, has in fact been tested and thoroughly refuted (Culver and Ianna 1988; Carlson 1985). Similarly, the major threats to the scientific status of psychoanalysis, another of his major targets, do not come from claims that it is untestable but from claims that it has been tested and failed the tests.

[0] [https://plato.stanford.edu/entries/pseudo- science/#KarPop](https://plato.stanford.edu/entries/pseudo-science/#KarPop)

[1] [https://web.archive.org/web/20170621073301/http://www.philos...](https://web.archive.org/web/20170621073301/http://www.philosophyisscience.com:80/p/philosophy- is-not-science.html)

<comment><USER5> Short summary first, long rant follows. Summary: Mathematics and small parts of philosophy and many other disciplines rightly qualify as non-empirical science, but no lesson can or should be drawn from them about empirical science. Empirical questions are fundamentally different from non-empirical questions.

Long rant:

I don't disagree fundemantally but what you say about philosophy irks me as a philosopher. If you looked at a random sample of publications in philosophy you would find out that only a very small percentage of them has the rigour and exactness that we associate with science. I have also met many philosophers, perhaps even the majority of all I've met so far, who would not describe themselves as scientists.

The remaining part of philosophy that adheres to strict standards and uses mathematical method is akin to mathematics and computer science, and perhaps most similar related to formal linguistics and economics in the way it works. I personally consider this part of philosophy a science, it is a kind of applied mathematics, although often speculative and conditional on axioms that are not as evident as in mathematics. Other disciplines have similar non- empirical parts, a typical example is Social Choice theory in sociology, which I would consider a scientific theory, although it is not empirical. In the end, it's applied mathematics.

I agree that mathematics and the relevant rigid and formal parts of other disciplines are non-empirical science, but to these areas the debate about hypothesis testing and the right use of statistics simply doesn't apply. It a fallacy to presume that, because these fields exist, clearly empirical disciplines (or parts thereof) could do without statistics. If a question is empirical, then it _has_ to be addressed with proper quantitative methodology.

This is extremely important to me personally, since I've been in deep disagreement with colleagues for many years about this issue. They work in related disciplines within our philosophy institute and habitually make "qualitative empirical analyses" of texts without treating them as mere precursors to quantitative studies. They see no problems with their methodology, even when I point out to them that the size of their samples would be too small to support the generalizations they make if they _did_ make quantitative studies. To me, this is absolutely crazy, I just can't see how a qualitative analysis of 20 texts could allow you to take these as representative for hundreds of thousands of texts if a quantitative studies of the same texts could not possibly reveal anything useful because the sample size is too small. What's worse, their whole discipline seems to be based on these kind of extremely small scale qualitative empirical studies, plus a very vague mix of fairly imprecise philosophy and common sense. I'm a nice person and get along with my colleagues well, so I won't ever tell them my opinion, but if I'm honest, I'd say that their discipline is pseudo-science or, at best, imprecise, non-scientific philosophy in disguise. (To make this clear, I have no problem with imprecise philosophy and have done it occasionally myself, I just don't think it can qualify as science and not many philosophers consider it as such.)

Long story short, empirical question have to be addressed with quantitative methodology or you get what I'd call "elaborate opinions".

<comment><USER6> Sounds fair enough.

I do wish that physical scientists, including myself, had more philosophical training though, even if its not science _per se_ , such that we could reliably have original, educated opinions on empiricism, rationalism, etc.

<comment><USER7> Might I mention my book (Statistical Inference as Severe Testing: How to Get Beyond the Science Wars (Mayo CUP)). [https://twitter.com/learnfromerror/status/107197020637171302...](https://twitter.com/learnfromerror/status/1071970206371713026) I did not know of Hacker news but was trying to trace why my blog errorstatstics.com got its maximal # of hits in over 7 years as a result of my posting their letter on the ASA Statement Now I'll disappear.

<comment><USER5> Very interesting, I'll order your book tomorrow!

</comment></comment></comment></comment></comment></comment><comment><USER7> The authors of the letter use "induction" to mean what I call a probabilism. Here probability is used to quantify degrees of belief, confirmation, plausibility support–whether absolute or comparative. This is rooted in the old idea of confirmation by enumerative induction. Conclusions of statistical tests go strictly beyond their premises, and it does not follow that we cannot assess the warrant of the inference without using a probabilism. They are qualified by the error probing capacities of the tools. A claim is severely tested when it is subjected to and passes a test that probably would have found it flawed if it is. The notion isn't limited to formal testing, but holds as well for estimation, prediction, exploration and problem solving. You don't have evidence for a claim if little if anything has been done to probe and rule out how it may be flawed. That is the minimal principle for evidence.

Popper spoke similarly of corroboration only he was unable to cash it out. He wasn't sufficiently well versed in statistics, and anyway, he wanted to distinguish corroboration from induction, as the latter was being used at the time. The same impetus led Neyman to speak of inference as an act (of inferring). I explain all this in my recent book, Statistical Inference as Severe Testing: How to Get Beyond the Statistics Wars (Mayo 2018,CUP. As I say there,

"In my view an account of what is warranted and unwarranted to infer – a normative epistemology – is not a matter of using probability to assign rational beliefs, but to control and assess how well probed claims are." (p. 54)

</comment><comment><USER8> Okay, so we agree with some of these points. But after reading the ASA statement it seems like this was written to something other than what I read. The ASA statement does not seem to be fundamentally dismissing P-values. On the contrary. They seem to be providing guidelines for researchers and reviewers on how to use them properly.

<comment><USER7> I think it is the way they blithely mention some statisticians prefer to use other methods, with a list of examples, that suggests they are blessing them. Surely these other methods ought to be scrutinized, we don't know they wold detect irreplication as significance tests do. The big issue is really all about using frequentist methods with biasing selection effects, multiple testing, cherry-picking, data-dredging, post hoc subgroups, etc. Only problem is that many who espouse the "other methods" declare that these data-dependent moves do not alter their inferences. Some are vs adjustments for multiplicity, & even deny error control matters (This stems from the Likelihood Principle.) If you consider the ASA guide as allowing that (in tension with principle 4 vs data dredging when it comes to frequentist methods) then the danger the authors mention is real. What was, and is, really needed is a discussion about whether error control matters to inference.

</comment></comment><comment><USER9> Hume would have a fit. All scientific knowledge is inductive!

<comment><USER6> Yeah, or Francis Bacon, or any of the original Empiricists.

I find a lot more to like in the ASA's statement [1] than in any of these responses, which seem to act as if Karl Popper were the only one to ever have a worthwhile philosophy of science.

This paragraph of the response was particularly telling to me:

> _A judgment against the validity of inductive reasoning for generating > scientific knowledge does not rule out its utility for other purposes. For > example, the demonstrated utility of standard inductive Bayesian reasoning > for some engineering applications is outside the scope of our current > discussion._

Translation: Ok, so maybe induction works fine when you're going to build a bridge where someone's life is on the line, but it still has no place in science. Falsification or bust!

[1] [https://www.tandfonline.com/doi/full/10.1080/00031305.2016.1...](https://www.tandfonline.com/doi/full/10.1080/00031305.2016.1154108)

<comment><USER10> It's ridiculous. Even the idea that frequentist use of p-values is deductive is garbage. Where do they think the models being tested are coming from? Induction!

</comment></comment></comment><comment><USER11> I'm guessing here that ASA is 'American Statistical Association', rather than say, the UK's 'Advertising Standards Authority'?

</comment><comment><USER12> One of the joys of programming is that, unlike maths, when discovering an exciting new paradigm there is an opportunity to rationalise all the notation and use a new language.

Contrasting, I struggle to deal with probability and statistics without developing a strong suspicion that the name the objects are called by is completely different from what the name means in common English.

It is nice to see ongoing authoritative commentary that the large majority do not understand what a p-value actually implies. The thread of discourse seems to be that even assuming that all the academics are completely honest (ie, no academic fraud, no hand waving) the number of false results that are awarded statistical significance is much higher than it should be. The standard p value threshold at 5% does not imply that 95% of the statistically significant studies are not by chance. Particularly amongst the subset that make it into the public eye.

<comment><USER13> The language of statistics is indeed dishonest. In normal language "significant" has a meaning close to "large". What they mean in statistics is that there is a detectable signal, there is a 95% chance that the data is not pure noise.

They should call it "detectable", some people have suggested "discernible".

However, there is another fatal flaw to how p-values are used. They are usually used for rejecting infinitesimally small hypothesis. The null hypothesis is stated as "Effect exactly equals 0.00000000000...". In practice, there are no experiments that have exactly zero effect. There are always at least very small systematic bias due to imperfectly calibrated instruments or small methodological variations between researchers.

Even if you do everything else right, if you pre-register your study, with enough data, a null hypothesis test will always pick up on these small biases and make the results significant.

If you are looking to reject a null hypothesis, I can tell you in advance: all experiments have a non zero bias, all results are statistically significant p<0.000000001 with enough data. There, I just saved the scientific world a ton of money, they don't have to do all these experiments. Just reference this comment in your paper to show significance.

At least here, the language seems honest. Rejecting a null hypothesis correctly conveys the idea of having rejected nothing.

Using a Popperian approach is great, but you should reject a portion of the hypothesis space this is bigger than zero.

<comment><USER14> This isn't the case. I can make two hypotheses that are contradictory. Both aren't going to be statistically significant from the same data, no matter how biased my equipment or the size of the sample.

<comment><USER13> Yes, the problem is that with null hypothesis testing, the two contradictory hypothesis are usually: "effect is exactly 0.00000000..." and "there is an effect different than 0.000000000...". The problem stems from the fact that people pit an infinitesimally small hypothesis against an infinitely large one. Rejecting an infinitesimally small hypothesis is very very easy. The tiniest of experimental bias will allow rejection if you have enough data.

It would be impressive if "There is an effect different than zero" was rejected (but no one would ever be able to do this). Science should try to reject finitely large hypotheses, at a minimum something like: "effect is larger than some reasonable margin to account for experimental bias and imperfect tools". At least a small chunk of the hypothesis space should be rejected for your experiment to be worth something. You sorta get that with confidence intervals since you can see how far the lower bound is from zero.

<comment><USER14> I mean, you can still run I to issues here:

The effect size is <1% and the effect size is >=1%.

Or 100 different hypitheses for 1-100% effect sizes. They're mutually exclusive, so only one will be true.

So again, while in general I agree with you that beyesian methods have significant advantages, this objection isn't well founded.</comment></comment></comment></comment></comment>


Ask HN: Which behaviour influenced by technology amuse you the most? - <AUTHOR> <comment><USER2> Those who advise friends/family of the meal they are about to consume via a photo. Not so much amuse as concern; Many young people complain of loneliness but when using public transport have their eyes glued to their device. Totally ignoring their fellow travellers!

</comment><comment><USER3> The number of people that fall for lottery, romance, and work at home scams that source from unsolicited email. I have a position that deals with some of these scams, and the stories are practically unbelievable.

The need to proclaim to the world what you are doing today just to get those sweet internet karma points.

The complete lack of awareness of the surrounding world when one is waking and reading their mobile device.

<comment><AUTHOR> > The number of people that fall for lottery, romance, and work at home scams > that source from unsolicited email. I have a position that deals with some > of these scams, and the stories are practically unbelievable.

Mind sharing your favourite story?

</comment></comment><comment><USER4> Amusement... people sharing their homemade NSFW content.

</comment><comment><USER5> people pretending (jokingly or not) they are social influencers. I laugh when is a joke and disturbing when it is not.</comment>


PageRank: A Diagram of Cognitive Capitalism and the Rentier of Common Intellect [pdf] - <AUTHOR> http://matteopasquinelli.com/docs/Pasquinelli_PageRank.pdf

<comment><USER2> Some very interesting ideas in here once you mentally strip off the postmodern blather. Totally unnecessary.</comment>


Herding Firesheep in a NYC Starbucks: Do Users Care? - <AUTHOR> http://technologysufficientlyadvanced.blogspot.com/2010/10/herding-firesheep-in-new-york-city.html <comment><USER3> What was your game-plan if you'd stumbled upon something highly personal and sensitive in their mailboxes? Or if one of their friends had sent them a person IM while you were logged in as them? The fact is, you could have easily approached these people face-to-face, offered to show them the risks they were exposing themselves to using your laptop, and give them the choice as to whether you took control of their accounts. While it appears that you did what you did with the best of intentions, you violated the privacy of the people whose accounts you accessed; broke a variety of laws; then documented your crime in your personal blog.

You describe your targets as lacking judgment. Maybe you should consider your own.

<comment><AUTHOR> Actually, whether or not I broke any laws (in the US) is not clear. I deliberately did not look at anything in their account while I was in it, so privacy was not actually compromised.

The folks I recognized on my way out were people with large profile pictures of their faces. In general, this wasn't the case. I'd have had to do a lot more rifling through accounts to be able to identify someone face-to-face, and would have risked someone having a bad reaction.

So, unlike all the people who have used Firesheep in public to look at peoples' accounts and then not told anyone about it, I notified the users and then told the public about what happened. You're saying that's bad?

<comment><USER3> "I deliberately did not look at anything in their account while I was in it, so privacy was not actually compromised."

From your blog: "I opened up his Amazon homepage, identified something he had recently looked at"

<comment><AUTHOR> That was the single exception, and I agree that that was in a murky area.

<comment><USER4> Ah, wow. This could not be further from the truth. This wasn't a "murky area." Its a big fat red zone.

Let's look at the Florida statute:

815.06 - Offenses against computer users. -

(1)Whoever willfully, knowingly, and without authorization:

(a)Accesses or causes to be accessed any computer, computer system, or computer network;... commits an offense against computer users.

(2)(a)Except as provided in paragraphs (b) and (c), whoever violates subsection (1) commits a felony of the third degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084.

So you committed a felony punishable by up to five years in prison, informed the victims, and documented your crime in explicit detail on your blog. That's a tad more dangerous than using unsecured cookies.

<comment><AUTHOR> Clearly I meant that it was a murky area morally.

Also I don't live in Florida.

I also never said that I thought I was protected from prosecution, so I don't know why you're so eager to prove that I am.

<comment><USER3> You've probably admitted to and documented multiple counts of Computer Trespass, knowingly using a computer service without authorization and knowingly gaining access to computer material. It's a Class E felony.

156.10 Computer trespass.

A person is guilty of computer trespass when he knowingly uses or causes to be used a computer or computer service without authorization and:

1\. he does so with an intent to commit or attempt to commit or further the commission of any felony; or

2\. he thereby knowingly gains access to computer material.

Computer trespass is a class E felony.

<http://ypdcrime.com/penal.law/article156.htm#156.10>

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I know about it the vulnerability and I still login to facebook in public places. It's like the locks on our front doors.. you don't break into everyone's house just to prove they aren't very good do you? I know you could just smash my windows, but you don't, and I appreciate it. It's facebook that needs to fix the bug, not me.

Maybe send the first message, but don't be obnoxious on purpose. I dunno.

<comment><AUTHOR> If you walked by someone's house and their car was sitting in their driveway with all the doors wide open and a box of personal documents in the back seat, you'd probably knock on their door. If the car was still there after an hour, you'd probably knock again. I sent only two messages, and they were short and to the point.

(edit) What I mean here, is that to know that someone's door is unlocked, you have to check each house. To pick a lock, you need some rudimentary skill. Firesheep (and the underlying vulnerability) is wide open and requires 0 skill to operate.

<comment><USER6> It's one thing to politely knock on the door, it's another to keep banging on their kitchen window when they are obviously ignoring you. The users probably feel helpless and just want to be left alone.

For a non-tech person it's a pretty big jump from surfing Facebook at Starbucks to setting up a VPN.

</comment></comment></comment><comment><USER3> Okay, let's connect some dots about you.

Your name is Gary LosHuertos

You look like this: <http://yfrog.com/0irajuj>

Gender: Male

Astrological Sign: Scorpio

Industry: Consulting

Occupation: Software Engineer

Location: New York : NY : United States

You have a blog hosted on BlogSpot from which this article came.

You send tweets from @gloshuertos where you promoted this story.

Your twitter account lists a latitude/longitude address of 27.109827,-82.308136 which is in Venice, Florida. One of your oldest tweets mentions that you're on your way to Gainsville, Florida.

<https://twitter.com/#!/gloshuertos/status/1267758656>

Only one Gary LosHuertos comes up on LinkedIn, but this person used to work in Gainsville Florida, so it's reasonable to assume this person may be you.

<http://www.linkedin.com/pub/gary-loshuertos/11/68/aa0>

The interesting thing about that LinkedIn profile is that it lists your current employer as Amazon.com. From your blog post, you mentioned the following:

"This was somewhat puzzling. Did they receive the first message? I logged into their accounts, and surely enough, they had. One of them was even on Amazon.com, which I had warned about in my first message. I targeted him first: I opened up his Amazon homepage, identified something he had recently looked at, and then sent him a "no, seriously" message on Facebook from his account including the fun fact about his music choices."

So what you're telling us is that you used a user account of a customer of your current employer to login as that person, spy on their purchases, then logged to their Facebook account and send them messages about his customer information?

You're entering into a world of hurt if Amazon catches wind of this.

<comment><AUTHOR> Wait a second.

You're saying I shouldn't bash my employer on a public blog and then submit it to another public website?

OMG

Really you didn't dig deep enough. Googling my name pulls up an email with my current employer in it. I don't work for Amazon anymore.

<comment><USER3> It's reassuring to know that you wait until you're employed by somebody else before violating your previous employer's privacy policies.

<comment><USER7> Amazon is violating its own privacy policy by allowing users to interact with its site insecurely.

Two wrongs do not make a right, but when you can implement a technical measure to protect your users from rogue ex-employees, you should do it. A legal contract does not prevent data loss, it merely allows you to punish the person who stole the data. SSL prevents the data loss in the first place.

</comment></comment></comment></comment><comment><USER8> I imagine some people, having seen spyware popups one too many times, just thought they were infected again.

"You're in Toronto, your IP is 220.127.116.11, your ISP is Rogers, you're using Windows XP! Thieves can steal your info! Download our antivirus now!"

<comment><AUTHOR> This is exactly what I thought when I saw the same people still online -- which brought about the second round of messages. I hoped my frankness and lack of any links would make the message seem more sincere, but perhaps at this I failed.

<comment><USER9> Maybe you could have told them what they were wearing and what they were drinking. Could have been a bit too much maybe.

<comment><AUTHOR> I may have spent 2 hours in a Starbucks to do this, but I do actually have a life. Sometimes. So yeah, a bit much. Also: follow-you-home creepy instead of just creepy.

</comment></comment></comment></comment><comment><USER10> Would this work as a cheaper alternative to SSL for preventing session hijacking?

      1. During the HTTPS part of the communication,
         the server sends a long list of random strings.
      2. The client stores all these strings in localStorage.
      3. On every request, the client sends one of the strings
         from the list, the server validates that it is in fact
         a valid string for that session, and both remove that
         string from their lists.
      4. When the list runs out, you have to go back to SSL to
         exchange a new list of strings.

Is there a flaw I'm overlooking (beyond the reliance on localStorage) that keeps people from using this?

If not, is there a technical term for this technique so I can Google it?

<comment><USER11> Even better:

        1. During the HTTPS part of the communication, the server generates a single
           random key and sends it to the client.
        2. The client stores this string in local storage.
        3. For every request, the client generates a HMAC over the request parameters
           (including a monotonic sequence number) using the key.

Both of these schemes are still susceptible to a MITM, who can just insert a bit of javascript in any page received over HTTP, that reveals the temporary secret in local storage to anyone listening.

<comment><USER10> If you were to generate the HMAC over the entire request, would that help with ensuring authenticity?

</comment></comment></comment><comment><USER12> it's funny how everyone says "just use SSL - that'll fix it", soon followed by "the SSL computation overhead isn't significant any more" which is totally true, but probably not the reason why SSL isn't more widely used.

Smaller sites will suffer from the fact that SSL requires an IP address per server. Name based virtual hosting is out of the question (at least as long as Windows XP is still around). Combine this with the IP address pool quickly getting smaller and smaller and you'll see that for smaller sites, it might be impossible to get the needed amount of addresses for a reasonable price.

For large sites, there's the problem of the various CDNs which are not always under the control of the site and might not be prepared for SSL.

Remember: All assets of an encrypted page must also be encrypted, otherwise the browsers display a nasty warning (even though unencrypted assets, when served from a different domain would not be a problem what's session hijacking is concerned).

"just use SSL" might just not be possible in some cases.

<comment><USER13> SSL does not necessarily need one IP per server.

[https://secure.wikimedia.org/wikipedia/en/wiki/Server_Name_I...](https://secure.wikimedia.org/wikipedia/en/wiki/Server_Name_Indication)

Unforunately, support is not sufficiently widespread at this time.

<comment><USER12> as I said: "at least as long as Windows XP is still around". Internet Explorer under XP doesn't support the extension.

</comment></comment></comment><comment><USER14> Honestly? The word "douche" springs to mind. Regardless of the legality of it and how grey it may or may not be.

I'm sure you thought you were doing something good. But, short of not using Facebook in a coffee shop, what do you expect people to do? Set up their own VPN? I bet that of the people you scared off, they'll all be back on in another day or two. Maybe at the same coffee shop.

This is a problem that needs to be solved by on the website's end, not the user's end.

<comment><AUTHOR> Yeah, it does need to be solved by the website. That doesn't change that users are vulnerable and don't know about it.

<comment><USER14> Again: What do you expect people to do about this? Stop using Facebook while sipping on a latte?

<comment><AUTHOR> Yes.

</comment></comment></comment></comment><comment><USER15> Isn't it ironic that we're discussing it on a website that doesn't have https at all, _not even on the login page_?

<comment><USER16> What are you going to do, having someones account though, possibly if they are well known attempt to changes peoples perceptions of them/ get people to believe something? You can't delete comments older than like a day so trashing the account is mostly out. Once they noticed they could invalidate that session, mention it wasn't them and it would be the end of it.

I feel mostly the same way about Facebook, those so inclined could do more damage un-friending everyone, at which point I could thank them for cleaning out old contents and organically readd those who I still speak to.

</comment></comment><comment><USER17> This really needs to be on CNN and such for people to actually think about it. And realistically it looks like we all need to start using SSL - people aren't going to change their browsing habits.

<comment><AUTHOR> Unfortunately the few non-tech news sites that I've read have covered it with blatant disregard for the underlying cause. It's been Firesheep that's pointed at as the issue, not Facebook and Twitter and Amazon ad infinum.

</comment></comment><comment><USER18> > What's absolutely incomprehensible is that after someone has been alerted to > the danger (from their own account!) that they would casually ignore the > warning, and continue about their day.

That's not incomprehensible. They have trust. And they don't consider what they're doing particularly private.

</comment><comment><USER19> What I find surprising is that insecure email and wireless had existed for quite some time before this. Almost all IMAP/POP/Gmail used to flow over regular HTTP. It is only recently (read, last year) that a lot of major email traffic has been https-ified.

Why suddenly jump on FB, Twitter etc with self-righteous anger when many of these same geeks were using insecure email until less than a year ago?

</comment><comment><USER20> Out of interest has there been any response from Facebook, Twitter, Amazon and so on?

I've had a quick look and not seen anything but it's entirely possible I've missed something.

</comment><comment><USER21> I understand that getting your Amazon account hacked can lead to some head scratching situations and Amazon should really implement full SSL encryption. Having said that, what are the implications of getting your FB or Twitter or Flickr account hacked? Personally, even if annoying, I wouldn't consider it as a major issue in my digital life. I try not to mix business and private life (for instance, my FB friends are only friends, not colleagues. Same goes for Twitter) so do you see any other issue, a part from the "annoyng" factor?

<comment><USER22> There have been some interesting cases where fraudsters have hijacked facebook accounts and then used them for targeted phishing attacks.

One example of the attack [http://techcrunch.com/2009/01/20/latest-facebook- scam-phishe...](http://techcrunch.com/2009/01/20/latest-facebook-scam- phishers-hit-up-friends-for-cash/)

In those cases the fraudsters have stolen the account completely and locked the original user out, but I guess it's that kind of attack + the information leakage aspect that could be a concern..

<comment><USER21> Yes, true. Something similar happened to me when a I have received an email (gmail) from a friend asking for money because she was stuck somewhere. Similar pattern. It's interesting to notice that this social engineering attacks are easy to carry in a place like US, where there is one common language. I immediately detected that the mail was a fraud, because this person would have never write to me in English.

</comment></comment></comment><comment><USER23> The users are not at fault here. Even a SSH or VPN will leave them vulnerable to attacks. Companies (Facebook, Twitter, etc.) have to increase their own security, because they are the only ones that can fix this problem.

<comment><USER24> Sending your HTTP through an SSH tunnel or a VPN will protect against the stranger-at-Starbucks attack.

<comment><USER25> But not against the stalker-techie-at-your-ISP attack.

<comment><USER24> Sure, but there are about a million times as many people able and motivated to do the wifi-neighbor attack than the stalker-ISP-gnome attack. And as people with true identities in a stable position of authority at as service provider, the gnomes are easier to find and hold accountable.

This difference -- from random anonymous stranger whose only invested in software, to physical infrastructure with paid staff -- is also one reason bank phishing attacks happen via websites and not actual storefronts made to look like real banks.

If the only threat to Twitter and Facebook users was ISP-gnomes, the websites could put off fixing the issue for another decade.

</comment></comment></comment></comment><comment><USER26> A few days into it and I've decided Eric Butler made a mistake in releasing Firesheep.

Security is about battling a combination of Time + Talents/Tools + Determination + Opportunity.

Firesheep greatly increases the Tools someone has to hack an account. Eric has made browsing much less secure.

The intended result is to bring the security issue to people's awareness, which he has done. But the result should have been to increase security. That will only happen if the the change in required Tools is balanced by a decrease in Opportunity (free wifi becoming simple password wifi at a minimum).

I doubt that will happen. Releasing Firesheep was a mistake.

</comment><comment><USER27> _I included no clues as to my identity, less because of fear of retribution, and more because invasion of privacy is all the more frightening when it is committed by an absolute stranger with no chance of discovering their identity._

Disgusting. Sowing fear is not education.

<comment><AUTHOR> Really? Users shouldn't be afraid of the consequences of something they believe to be benign? I didn't send Starbucks patrons home weeping to cry themselves to sleep. I fully concealed my identity in the same way an actual attacker would.

<comment><USER27> There is no distinction between you and an "actual" attacker. You seem to have labored within a nimbus of self-righteous nerd egotism that someone more criminally minded might not have but you are not in any way more entitled to violate a person's expectation of privacy.

You are not a hero. You have not done anybody a favor. You did this for the same perennial excuse of "spreading awareness" trotted out by any number of noxious social irritants and did so not by the means most efficient or effective, but the means readily available and most likely to satisfy your urge to feel superior to your fellow man.

You may actually care about the problem and take it seriously in other circumstances, but that is not reflected here. There is no security problem for which "exploit the problem to harass strangers in coffee shops" is the solution.

<comment><USER28> > _There is no distinction between you and an "actual" attacker. You seem to > have labored within a nimbus of self-righteous nerd egotism that someone > more criminally minded might not have..._

That sounds exactly like a distinction to me. A fireman would break into a house to save a child. A burglar would break into a house to steal valuables. One intends harm, the other doesn't.

> _did so not by the means most efficient or effective, but the means readily > available and most likely to satisfy your urge to feel superior to your > fellow man._

There's no such thing as true altruism. Why he did it isn't relevant. People feel good about doing good deeds. Sure, they say "I want to help people," but they really mean something more along the lines of "I want to feel good about myself."

Further, why would it be necessary for him to choose the most effective or efficient means? He owes these people nothing.

> _There is no security problem for which "exploit the problem to harass > strangers in coffee shops" is the solution._

Maybe not the best or even a good solution, but it's certainly still one. ;)

<comment><USER27> _One intends harm, the other doesn't._

...but then...

 _Why he did it isn't relevant._

I am at least as uncertain as to what your position is as you are. Also...

 _He owes these people nothing._

Nothing, of course, except the common courtesy of not violating their privacy. Yes, even in New York.

</comment></comment></comment></comment></comment><comment><USER29> Why is this so surprising? Most people I know don't really care about internet privacy. Most people I know don't post anything sensitive to their facebook pages. I don't use facebook and when I mention that I think it's weird to put personal stuff on the internet (which always has the _potential_ to be public) they think I'm a paranoid nut. Let's admit that it's not really an unreasonable position, provided you don't work at the NSA.

</comment><comment><USER30> 1) Install WinSSHD on your home computer/server. Open port 22 in your home firewall/router.

2) Install Tunnelier on your laptop, flip to the Services tab and enable SOCKS at 127.0.0.1 and port 1337. Login in to your home computer.

3) Change Chrome target to chrome.exe --proxy-server=socks5://127.0.0.1:1337

Mostly used for obtrusive proxies though it will make you as secure as you are at your home network..

<comment><USER31> Not a very 'green' solution!

<comment><USER31> My point was that having a computer running 24/7 at home to use as a secure proxy when you are out in the field is a bit wasteful. The technical solution was fine - though I can't see many non-techies getting their heads around this. Why the down vote - pffffh.

</comment></comment></comment><comment><USER32> Do users care. Quite a thought that actually scared a bit out of me, because unless these users would actually care, only would there be protocols that would prevent this from happening. And when would users care? When their personal identities have been stolen, and private information (credit cards, social insurance numbers, personal messages) have been compromised. Do we really have to go that point where the risk is imminent before taking action?

Having identified the vulnerabilities of WEP encryption on wireless networks, shouldn't it be that device manufacturers of wireless routers take away WEP encryption as an option but instead focus on a more secure method of connection? Of course this may have some downside to it, but unless your ordinary Joe and Jane realize the upsides of having secure connection to the web, they may see this as a discomfort.

</comment><comment><USER33> While it's nice that this gets some attention and not very nice of facebook to automatically revert you back to an unencrypted connection, this is not a facebook specific problem. Anytime you use a wireless network, where you don't have control over the access point, you need to secure everything you want to keep private. This goes for everything from google searches and files transfers to instant messaging and e-mail. The proven solution is to use a VPN tunnel, which even many home routers support nowadays.

Of course there's still a bigger problem with arp spoofing and other attacks, which in the long term will need to be solved. Maybe with something like DNSSEC DKI.

</comment><comment><USER34> What are the legal ramifications of running firesheep on a public network?

<comment><USER35> "Google, in response to government inquiries and lawsuits, claims it is lawful to use packet-sniffing tools readily available on the internet to spy on and download payload data from others using the same open Wi-Fi access point."

will see who wins in the court :[http://www.wired.com/threatlevel/2010/06/packet-sniffing- law...](http://www.wired.com/threatlevel/2010/06/packet-sniffing-laws-murky/)

see also : [http://blogs.forbes.com/kashmirhill/2010/10/28/firesheep- use...](http://blogs.forbes.com/kashmirhill/2010/10/28/firesheep-users-may-be- breaking-the-law/)

<comment><USER36> Passive sniffing is one thing. Active unauthorised access to a computer using FireSheep is definitely illegal in the UK according to the Computer Misuse Act:

      (1) A person is guilty of an offence if—
       (a) he causes a computer to perform any function with intent to secure access to
           any program or data held in any computer, or to enable any such access to be
           secured;
       (b) the access he intends to secure, or to enable to be secured, is unauthorised;
           and
       (c) he knows at the time when he causes the computer to perform the function that
           that is the case.
      (2) The intent a person has to have to commit an offence under this section need
          not be directed at—
       (a) any particular program or data;
       (b) a program or data of any particular kind; or
       (c) a program or data held in any particular computer.

I think passive sniffing may also be illegal in the UK according to RIPA [1] as it is unauthorised interception of public telecommunications.

[1]: [http://www.legislation.gov.uk/ukpga/2000/23/part/I/chapter/I...](http://www.legislation.gov.uk/ukpga/2000/23/part/I/chapter/I/crossheading/unlawful- and-authorised-interception)

<comment> mike-cardwell Yeah, definitely illegal in the UK. I'd be surprised if it wasn't illegal in the US too.

So he's basically just blogged about committing a crime. I wonder what would happen if one if his "victims" read this and then contacted the police. I bet Facebook has enough information logged about which accounts were accessing Facebook from that IP at the time, and which of them received his messages.

</comment></comment></comment></comment><comment><USER37> What does he expect the users to do? Not use Facebook? Right...

<comment><AUTHOR> That's the point. It's empirical (albeit, not scientific) evidence that even when presented with the risks, users will still choose to do things that are dangerous.

<comment><USER38> Why would you expect most people to do otherwise? I fully know the risks of using open hotspots on many websites and I do it anyway because the convenience outweighs the risks for me. Obviously I'd think twice about logging into my bank over a non-secure connection (though I'd be mad to bank with a company that doesn't secure all connections by default, of course), but open-wifi Facebook? Sure, why not?

This behavior extends beyond Internet usage. I (and probably most of you reading this) hand my credit/debit cards over to waiters several times per month knowing full well they could jot down enough information while out of my sight to make illegal charges on that card (if not do far worse via more elaborate identity theft schemes). Risky? Yes, but the extreme convenience outweighs the potential pain due to the low chance of actually being one of the people that gets exploited in this way, and thus it is with open hotspots and most Internet sites.

<comment><USER39> My credit card has legally builtin insurance against fraudulent use - I'm not liable for a penny of that use if it was used illegally - unless the card itself was stolen and I failed to report it - in which case i'm liable for up to $50. (As soon as I report it stolen, I'm not liable for anything)

I use a credit card because it's safer and offers me options - <USER2> snarfing the number would be a nuisance, because I'd need a new card, but that's it.

Let's please not forget (Sight.. I know - everyone already has) that charge- cards were pushed onto the market as a safe, convenient alternative to using cash - not a walking liability - don't let the issuers turn them into one on us.

As to the analogy - it's quite different. I'm very security conscious, and I generally don't do certain types of activity on uncontrolled or unknown networks (banking - home or somewhere else safe - but facebook at starbucks, okay)

IT's not just a problem with open hotspots, it's with any network you are on, anywhere - an open hotspot is just the easiest place for someone to try this on. An employee at an ISP could snarf data from millions of users easily...

</comment></comment></comment></comment><comment><USER40> I suppose the saving grace is that it would be pretty difficult--not impossible, but pretty difficult--to truly get away with this without detection. With all the logging that goes on, chances are that you could be identified by a MAC address, a web login of your own, a credit card swipe nearby, a surveillance camera, a cell phone in your pocket, or who knows what. There is a lot of information to be gotten with the right subpoenas.

<comment><AUTHOR> On many machines, MAC addresses can be changed. I obviously wasn't attempting to avoid detection since I posted about it under my real name, but anyone could pick up a $200 netbook, pay cash, walk into a Starbucks with sunglasses on, do their business and leave undetected. MAC addresses are useless if they don't tie to anything else and aren't fixed.

<comment><USER41> Not just on many machines. You can change your MAC address on any manchine using GNU macchanger <http://www.alobbs.com/macchanger/>

</comment></comment></comment><comment><USER42> Doesn't surprise me all that much since most 'normal' people absolutely don't care about security. Passwords are meant to be written on sticky notes. Identity theft is too complicated for them to care about. And credit card fraud is easily solved by reversing the charges. It takes a massive, automated exploit & MSM coverage before they'll start caring.

</comment><comment><USER16> It is weird it hasn't been covered more, usually here in Australia the media run scare stories on the most insignificant of Facebook flaws. I wouldn't be in a hurry to point it out to them this new one either, it would be sensationalized into some kind of no cafe is safe without any technical details.

<comment><USER43> The problem being that no cafe IS safe - what people have posted on their Facebook is important, and some of the websites Firesheep attacks can be even more damaging for the user - until everyone runs VPNs or websites get their act together.

</comment></comment><comment><USER44> Someone should write a blog post about dsniff and how to get dozens of login/passwords for not only pop3, imap, messenger logins at starbucks/airport wifi.

We all know that 90% of the users tend to have one passwort for everything. That password usually works for any SSL secured service, too ;-)

</comment><comment><USER45> Could it be that the persons thought it was some kind of automatically- generated message? Maybe a you're wearing a red shirt that says ... would get the point across?

<comment><AUTHOR> Is a machine breaking into your account any less scary than a person doing it?

</comment></comment><comment><USER46> The solution you link to in your post involves using a not-free VPN service. Is there a guide somewhere to setting up a free solution to this problem?

</comment><comment><USER47> Off-topic: I submitted a Tell HN post inspired by this submission: <http://news.ycombinator.com/item?id=1848420>

</comment><comment><USER48> If that public wifi is secured with a password -- albeit a _public_ password -- does that protect individual sessions?

Meaning you go to a cafe and the blackboard tells you that today's WPA2 password is "greenbeans". Knowing this does it provide the ability to sniff or abuse other users sessions on this WAP?

Honestly don't know this and can't find a clear answer about it.

<comment><USER49> afaik (and from my own experience) that won't work.

      "As long as the universally supported WPA encryption protocol is used,
      each individual user receives their own private "session key" that absolutely
      prevents eavesdropping between users, even through they are all using the
      same WiFi password."

from: [http://steve.grc.com/2010/10/28/instant-hotspot- protection-f...](http://steve.grc.com/2010/10/28/instant-hotspot-protection- from-firesheep/)

<comment><USER50> Yeah, we tested it on our WPA encrypted wireless and didn't get anything. It was seen when I logged into facebook but my coworker wasn't able to login as me. At least not with Firesheep.

</comment></comment></comment><comment><USER51> Just don't do 'login' type work at public wifi :/ is that so hard? Do people not know this already? Did some people ever think it was safe to use public wifi for anything other than general browsing?

Please HN: Stop getting outraged by stuff that doesn't really matter. You're turning into Reddit, and just like them, you will have forgotten all about this by next week, and be on to the next topic you need to be outraged about. It's depressing. Angelgate? No one cares any more. No one should have cared in the first place.

<comment><USER52> <http://ycombinator.com/newsguidelines.html> : "If your account is less than a year old, please don't submit comments saying that HN is turning into Reddit. (It's a common semi-noob illusion.)"

<comment><USER51> I created this account after a couple of years. My main account is 1000+ days old.

Seriously. This summer has been depressing to watch HN go down the pan.</comment></comment></comment>


New York Fed Adds $115.14B in Short-Term Liquidity to Markets - <AUTHOR> https://www.wsj.com/articles/new-york-fed-adds-115-14-billion-in-short-term-liquidity-to-markets-11573141440?mod=rsswn <comment><USER2> Based on these comments, it seems like a lot of misunderstanding is being proliferated.

I'm not an expert on the subject, but I'd like to dismiss the criticisms of the fed that many are making.

These cash injections give banks short term liquidity, which means that banks can complete transactions. These moves are not at all synonymous of a government bailout. The repo market is what is at concern here. In short, relatively safe financial institutions will loan money for very short term (a single day, for example) in return for a small percentage of interest. Trillions of dollars are moved in this market on a daily basis. When market trust lowers (or demand increases, but this is less likely. But, one example is quarterly taxes coming due), rates can increase. Repo rates are supposed to be low for the market to function properly.

The broader reason for this occurring is that the Fed post 2008-crisis requires banks to maintain higher relative liquidity. On the Feds view, they would rather continue to inject cash than allow banks to maintain pre-crisis levels of liquidity. At least in my opinion, requiring banks to maintain higher liquidity is a smart move.

As far as what this signals economically, I've yet to hear any credible answers. Certainly the banks will say regulation is the problem and the fed will respond that we can't trust the banks that much.

<comment><USER3> The issue is that this removes an important signal to the market. If trust is down, rates will go up, because if you can't clear your own transactions you depend on borrowing to clear transactions. This is a sign that should maintain greater cover yourself.

Of course, if fed steps in to subsidize the market - which is what this does by holding rates extremely low despite the potentially systemic risks posed by the market - then you can keep pushing for every fraction of a point. But if the repo market goes down that is going to be very serious - and so there should be a bit more cost in the market to reduce the reliance on it.

<comment><USER2> This is a very good point.

My take is that the Fed is trying to be vigilant amidst indicators of a looming recession. If the repo market rate is too high, banks will hoard cash. Hoarding cash will devalue the banks, and we know that'll likely trigger a definitive recession.

<comment><USER3> No question - but why not have some of these banks pay some high overnight rates? They have the money to do so.

This push to squeeze every nickle of profit out leaves almost no margin if stress hits. The repo market is huge. If there ever is a real scare and people are used to be able to get free money (or expect the fed to step in) the fed will have to step in on a HUGE basis.

</comment></comment></comment></comment><comment><USER4> We were told back in September that the liquidity injection then was a one-off response to a freak occurrence, nothing to worry about, won't happen again.

<comment><USER5> Right. What is going on here? Really hope someone on HN can explain this in a succinct way.

<comment><USER6> There's an explanation here: [https://wolfstreet.com/2019/11/06/whats-behind- the-feds-bail...](https://wolfstreet.com/2019/11/06/whats-behind-the-feds- bailout-of-the-repo-market/) & [https://www.youtube.com/watch?v=ORGFtWowKKM](https://www.youtube.com/watch?v=ORGFtWowKKM)

Basically there are actors borrowing at the low repo rates and using it on higher rate government backed mortgage products. Banks with money don't want to lend to these actors, hence the repo rate hike.

<comment><USER7> I'd bet more on the European carry trade, with various financial firms attempt to arbitrage the difference between negative interest rates in Europe and positive rates in the U.S. That creates a natural demand for short-term dollar loans:

[https://news.ycombinator.com/item?id=21478251](https://news.ycombinator.com/item?id=21478251)

</comment></comment></comment></comment><comment><USER8> A shot in the dark: It's European capital buying US dollar denominated securities en masse, as Europe is couple of basis points less attractive than the US at the moment. Strong dollar as side effect, which started at around Spring 2018.

People get all jazzed up about the Fed, but Banks have to play along Basel III.

Not saying a new crack will not break the system in 2020, but the Fed injection is somehow a side twist in this play.

<comment><USER9> What's the connection between European capital buying US dollar denominated securities and stress in the repo market?

<comment><USER8> If I ask to convert my EUR into USD, the US bank will hold more EUR, less USD. Less USD decreases my liquidity, which is what's on one end of the table in the repo market, no?

<comment><USER10> They don't hold EUR, just EUR denominated assets. But irrespective of what currency you're repoing, USD balances go down...that's the whole point. They're lending. That's how lending works.

<comment><USER7> If it's actually European firms participating in the carry trade, then yes it would be EUR. When you decide to sell your S&P 500 index fund for Bitcoin, you don't actually directly exchange your USD-denominated assets for Bitcoin. Last I checked Vanguard was not willing to service redemptions in crypto. Rather, you sell the fund, receive USD for it, and then use the USD to purchase Bitcoin.

Same goes for ordinary foreign currency transactions. If you want to short negative-yielding Eurozone bonds and buy positive-yielding US treasuries, you borrow the bonds and sell them, receiving EUR in the process. Then you transfer the EUR to a US bank and receive dollars. Then you use the dollars to buy US bonds. Your European counterparty is now long European bonds and short euros. Your U.S. banking partner receives the euros you got from them and gives you currency. You give the currency to the U.S. government and buy the bond. To make the currency transactions net out, the U.S. government then needs to give currency to the bank to replace the reserves you took out to buy the bonds.

(In reality, the Fed doesn't have to make the transactions net out, because it can adjust the money supply. But if it wants to maintain the current interest rate in the face of strong demand for dollars to arbitrage away interest rate differences, it needs to hand out a lot of dollars.)

</comment></comment></comment></comment></comment><comment><USER11> Why isn't anyone talking about the liquidity squeeze?

The Fed has said nothing about which entities had trouble borrowing in the repo market. It has only discussed a couple of suggestions why banks might have refused to lend to the repo market, and has said that it is still investigating why banks had refused to lend to it. The whole thing is still shrouded in mystery, and speculation is all around it.

[https://wolfstreet.com/2019/11/06/whats-behind-the-feds- bail...](https://wolfstreet.com/2019/11/06/whats-behind-the-feds-bailout-of- the-repo-market/)

<comment><USER11> I found a convincing answer here connected to delays in raising the debt ceiling among other things like corporate tax payments in Sep.

[https://www.ibtimes.com/new-york-fed-steps-market-move- inter...](https://www.ibtimes.com/new-york-fed-steps-market-move-interest- rates-2828111)

</comment></comment><comment><USER12> On a per capita basis, it's as if everyone in the US lent $350 to the banks. (115B/327M)

<comment><USER13> Do these "loans" ever get paid back?

<comment><USER10> If these loans didn't get paid back, we'd have another crisis.

<comment> the-dude [https://www.federalreserve.gov/monetarypolicy/bst_recenttren...](https://www.federalreserve.gov/monetarypolicy/bst_recenttrends.htm)

From 870 billion in 2008 to 4 trillion now.

</comment></comment></comment></comment><comment><USER14> One thing to keep in mind is the fed used to do this all the time before 2008. It is considered normal monetary policy then and now again.

More details: [https://www.fisherinvestments.com/en- us/marketminder/everyth...](https://www.fisherinvestments.com/en- us/marketminder/everything-you-never-wanted-to-know-about-the-repo-market)

</comment><comment><USER15> This whole situation really makes me wish that there was more transparency at the Fed. I want to know why they're doing this, because if some of the linked articles in this thread are correct, it amounts to nothing more than a bailout of people with ridiculously leveraged bets.

</comment><comment><USER16> One thing to keep in mind is that some of the assets being used as repo collateral may be negative interest government bonds. In that case it's possible that other banks may not want that as collateral thereby locking up a lot of supposedly very liquid assets

</comment><comment><USER11> Repo market overview - [http://people.stern.nyu.edu/jcarpen0/courses/b403333/08repo....](http://people.stern.nyu.edu/jcarpen0/courses/b403333/08repo.pdf)

</comment><comment><USER17> I understand very little about this subject. So here are some questions...

the fed issues treasury bonds (am I right?) then some bank buys them, i.e. the bank gives the fed money and the fed pays it back with interest until the bond's maturity (because that is what bonds are, right?)

then the bank can do whatever it wants with the bonds. As far as I undestand "bond securities", whoever holds the security (bond) recieves the interest from the issuer (this is an assumption, is it correct?)

but now, the fed buys the bonds back (?) through the repo (repurchase agreement), which means that whomever sold them will buy them back from the fed in a few days?

So the fed will (temporarily) owe itself the interest? what!? needless to say, I am slightly confused..

<comment><USER18> You don't know about the overnight borrow market and the capitalization requirements banks must keep to to cover their leveraged position. There are layers to this problem.

</comment></comment><comment><USER19> How do i start a bank and get in on the action?

<comment><USER20> Pay off your local congressman.

<comment><USER19> Excellent idea, he's frequently in the news being accused of all kinds of nefarious acts. Donyou want in?

</comment></comment></comment><comment> the-dude How many WeWork's is that?

<comment><USER21> Just crunched the numbers. If they had actually gone public at a valuation of $47b, that would be 2.45 WeWorks. At their current valuation of ~8 billion, its a much more reasonable 14.4 WeWorks.

Better yet, you can just opt to buy 67.7 Adam Neumanns! What a steal.

<comment> the-dude The Saudis invested $400M in Travis Kalanick's new startup. Asuming we could get about the same for Adam, we would end up with over 27 billion!

That is a steal. Count me in.

<comment><USER22> Omg. I can't speak further, but this startup and Kalanick are really awful. This is shockingly stupid.

<comment> ur-whale In this particular case, I'm seeing a bunch of bad actors shooting each other in the foot, so no that awful in practice ...

</comment></comment></comment></comment></comment><comment> ur-whale An entire flock of canaries has died at this point.

Last chance to rush for the exit.

The question is of course: where do you park your money before the big one hits so as to minimize the damages.

Cash?

High-tech stocks?

Real estate?

Cryptos?

Bonds [lol]?

Art?

[edit] : not sure why the downvotes, this is a legitimate question: if you anticipate a recession in the next 2 years (I do) how do you structure your portfolio to minimize the damage?

<comment><USER23> Big farm. No kidding.

<comment><USER24> Actually this is the only sensible advice in this thread.

The one asset in limited supply is land, and the one commodity that we all are fundamentally dependent upon is food and water. Both require the appropriate land.</comment></comment></comment>


Create a Zero-Setup Microservice with Unbounded - <AUTHOR> https://firstname.lastname@example.com/create-a-zero-setup-microservice-with-unbounded-3d2a114db4 <comment><AUTHOR> Hi, I'm Will, the creator of Unbounded. I co-founded the security company Cambia, later acquired by Tripwire, Inc. Unbounded is a schemaless, serverless, NoSQL cloud database you query with Javascript. If you can code it, it's a valid query.

Store any JSON data with no limitations on primary key names, property names or embedded objects. Map, reduce, and receive query results to your webhooks.

Free starter tier, only pay for what you use.

[https://www.unbounded.cloud](https://www.unbounded.cloud)

Unbounded was conceived as an elegant solution to the problems introduced by managing massive contact lists for an enterprise CRM platform, while being carefully designed to reduce developer friction.

For example, one reason we use Javascript as a query language is because it's likely a language you're already familiar with, instead of forcing you to learn yet another quirky dialect of SQL.

Unbounded is more than a database, it's a turnkey way to create a data transformation pipeline that can scale, without setting up servers, lambda functions, message queues, task processors, "Glue," etc.

You send us Javascript, and we'll execute it against your data in parallel, writing the results back to disk or sending them to you via S3 or webhooks, while queuing and retrying any failures. At the same time, you can still execute queries directly to pull out records like you would in a DBMS.

I'll be here to answer questions all day long!</comment>


State of Strong Authentication 2019 [pdf] - <AUTHOR> https://1nmqmp2u9dgf3jo9centu6rq-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/The-State-of-Strong-Authentication-2019-Report.pdf <comment><AUTHOR> Key findings and recommendations on pp 4-6.</comment>


How machine learning unlocks the secrets of materials science - <AUTHOR> http://learningann.wordpress.com/2014/03/10/how-machine-learning-unlocks-the-secrets-of-materials-science/

<comment><USER2> I must be missing something but where's the actual content?</comment>


How I sold my stock options - <AUTHOR> https://segah.me/post/secret-to-equity-options-in-private-tech-companies/ <comment><USER2> Couple of thoughts as a founder and investor:

1) The company is disincentivized to help you sell your stock/options because it will create a new valuation of common stock. Companies use the lure of a low 409a to attract employees, especially savvy executives, with equity packages. Doing anything to set a higher future strike price is not in their interest.

2) Your NDA almost certainly prohibits you from communicating anything meaningful about the financial success and any future roadmap to possible investors. The company isn't required to open their books to a potential new purchaser and the limited data you can get via Delaware company shareholder rights almost certainly can't be communicated either.

3) It is illegal to market your shares to non-accredited investors.

4) Remember you are selling common, investors are almost always buying preferred with liquidation preferences and other rights attached. The valuation you can ever achieve is limited pre-exit _(where all shares usually achieve the same valuation)_.

 _Things you can do:_

1) The best time to sell like this is during the next round of fundraising. If you are on good terms with the company and probably have already left the company, you may be able to tack on your common shares in a sidenote to one of the investors.

2) Approach existing shareholders (including the founders) as they are best placed to buy your shares. Remember though they probably have board material access and will have more informational rights and access than you do. They will try to price down the shares below their true value.

3) Some specialist secondary VC firms exist who will either buy shares or offer you a personal warrant on the shares. You probably need to be holding $1MM+ of equity for this to be worthwhile.

Overall: this is really a firesale approach. If the company is doing well, existing investors will buy at a huge discount and if the company is not doing well/unclear you almost certainly won't be able to sell.

It's almost certainly never worth trying to sell pre-exit.

<comment><USER3> > Some specialist secondary VC firms exist

Do you have any names or links?

<comment><USER4> Another one is [http://www.secfi.com](http://www.secfi.com)

</comment></comment></comment><comment><USER5> Generic "obvious wisdom" type of article rather then specific actionable steps.

Apologies, but it leaves reader with the main question unanswered - how?

<comment><USER6> There's a procedure in your restricted stock contract. Follow it.

Finding the investor to buy, and getting the company to go along are the harder tasks, and the OP covers those.

<comment><USER5> Luckily I don't have any right now that requires seeking of alternative venues.

Any restricted option holder however might benefit from insights and potentials that could of been provided by secondary marketplaces.

</comment></comment></comment><comment><USER7> don't many option plans say that shares are non transferable until a liquidity event unless company decides they should be transferable (ala what uber did recently).

<comment><USER8> Yes. This is SOP for law firms authoring stock option agreements after Facebook IPO'd.

OP is extraordinarily lucky that his company allowed a stock transfer, with extraordinary being too weak of a word to describe his circumstance.

<comment><USER9> It is possible to use a specialized finance vehicle in order to create a synthetic liquidity event for non-transferable exercised options; it is, in effect, a non-recourse promissory note.

<comment><USER10> Just when I thought I was getting the hang of how equity works... I didn't understand a word of that (other than non-transferable exercised options).

<comment><USER9> Apologies, I overcomplicated it.

Someone lends you money to exercise your options, you pay them back (at IPO or acquisition) as well as additional compensation for their risk of your shares being worthless.

<comment><USER11> > _Someone lends you money to exercise your options, you pay them back (at IPO > or acquisition)_

There is a lot of uncertainty about whether these loan-and-pretend or forward structures violate the spirit of one's stock option contract, which can and has resulted in forfeiture, and if it involves creating an off-exchange securities swap, illegal since Dodd Frank for non-qualified participants. It was receiving regulatory attention before cryptos distracted everyone. (One firm even got jammed by the SEC early on for structuring illegal swaps.)

<comment><USER12> How would that invalidate the option contract? As far as the company is aware the option was exercised under the employee name and stays that way indefinitely till an IPO event.

Post-IPO the shares are prob deposited in Computershare and as a shareholder you can transfer it to anyone you want.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Maybe I missed it but there doesn't seem to be much info on the selling price. Did it sell on the valuation implied by the last funding round or was it lower to "solve the risk problem for the investors?".

<comment><USER14> Usually the common stocks goes at a discount of around close to 15-20percent when compared to preferred for good deals. If the company is not doing well, the discount would be higher proportionally.

<comment><USER15> My experience is that common can be one-third of preferred. I'm sure that spread varies, but it's wider than you're describing.

<comment><USER16> Out of pure curiosity, what perspective would give one this experience? I guessing working at a VC fund?

<comment><USER15> Founding and working for multiple startups, including some that were fairly successful and therefore attracted multiple rounds of funding. I can't claim to have as much data as a VC would have, but I certainly have seen wider spreads personally, so I can attest that they exist.

<comment><USER16> Got it. Thanks for sharing!

I wish there were a better clearing house for this sort of collective experience. I guess HN serves that purpose, to an extent, but it's hardly organized.

</comment></comment></comment></comment></comment></comment><comment><USER17> What about those places like EquityZen, anybody done that?

<comment><USER16> Having just read about Equity Zen following your comment, I'd also be interested to know what people think about them. Their FAQ lays out a pretty compelling case for their value prop to all parties, so I'm curious if there are any strong arguments against them, especially from a company's perspective.

<comment><USER12> I can put my spin as a buyer on it. Overall it's pretty good although fee are high. The other thing is they do specialize in forward contracts which kinda suck but only option to buy shares of companies that do not allow transfer right now.

</comment></comment></comment><comment><USER18> Seems to be some conflation of the concept of equity and options on equity in the article?

</comment><comment><USER19> Were you able to sell your options, or exercise them and sell those shares ? If the latter, can you give us a hint how the price compared to the last round your company raised ?

What did you mean by "changing the attractiveness of the shares" ?</comment>