Think Debtors Prisons Are a Thing of the Past? Not in Mississippi - <AUTHOR> https://www.themarshallproject.org/2020/01/09/think-debtors-prisons-are-a-thing-of-the-past-not-in-mississippi <comment><USER2> > The Mississippi Department of Corrections, or MDOC, repeatedly declined our > requests to visit the restitution centers and to discuss them with state > officials. But in a statement issued in late December in response to our > findings, the department noted that it follows state law when operating the > restitution program.

If this program were one of integrity and justice, it should not have a problem exposing its complete workings to its citizens. Notwithstanding the possibility of unreported history here, this stinks.

>Darrell Bridges says he earned almost $2,000 working at Checkers during his stint in the Pascagoula Restitution Center in 2013. But the money was never applied to the $3,403 debt he owed from an attempted robbery when he was 17, records show.

>As a worker makes money, the corrections department takes the first cut in room and board, then usually holds the remaining earnings until there's enough to pay the entire debt. When someone leaves the program, the corrections department sends their earnings to the court to cover its costs. It distributes the rest to victims, then to pay criminal fines.

Indefinite debt bondage is unjust in any form, but the state and its agents reserving for itself the lion share of this feast of blood and life is especially reprehensible.

<comment><USER3> Sadly, this happens in a lot of states. If you owe a fine and don't pay it because you can't, they'll keep tacking on interest until it reaches a certain limit, then throw you in jail.

Our current state of government scares the hell out of me.

<comment><USER4> What's the alternative? Fines and jail are basically the legal system's two main options for punishment.

If a poor person commits a crime, that's not serious enough to throw them in jail, what should the legal system do?

It seems like "If you're poor, you can commit non-felony crimes without consequences" seems like a REAL bad policy idea.

<comment><USER3> Depends. If it's car related, revoke the license until the payment is made. Maybe do what the debt collectors do and harass them on the phone or garnish wages. Another thought, maybe we shouldn't make so many things crimes. We only do it to pay for the obscenely large justice and policing system. To me it just seems like a jobs program with a very steep societal cost.

I would think throwing someone in jail who owes money for a fine is very counter productive, considering how much it costs to incarcerate and jail someone. It's like spending $5000 to not collect a $500 debt. We aren't very good at government.

</comment></comment></comment></comment><comment><USER5> > A judge sentenced Husband to the restitution center in 2015 to pay off > almost $13,000 she owed from an embezzlement conviction in 2009.

> The State of Mississippi had locked Husband into a modern-day debtors > prison.

Let's agree that this sort of punishment is potentially not conducive to restorative justice.

But what justification is there for the article to deceive the reader with a comparison to debtors prisons?

The EU Convention on Human Rights bans debtors prisons. It states: "No one shall be deprived of his liberty merely on the ground of inability to fulfil a contractual obligation." Restitution as punishment for a crime does not arise out of a "contractual obligation." It arises out of a criminal conviction.

<comment><USER6> Potato potato, that person would not have been in _prison_ had they paid off the _debt_.

Where the debt comes from matters why exactly?

The prison should be for one purpose only: to make society safer. If someone is dangerous enough to be in prison, they should not be out regardless of whether they owe money or not.

In other words, if you can't buy your way _out_ of prison, a debt should not bring you _into_ one.

<comment><USER5> > Potato potato, that person would not have been in prison had they paid off > the debt.

No. The meaning of words matters. Words, used precisely, are how people with different values and beliefs can communicate and reach agreements in a functioning society. When journalists, who are supposed to inform and educate the public, twist the meaning of words in order to make a point, that's wrong.

> Where the debt comes from matters why exactly?

Because a debt arising from a criminal conviction requires the convicted person to have engaged in a wrongful act in the first place. Mere failure to pay a civil debt does not.

> The prison should be for one purpose only: to make society safer

Views about the proper role of prisons vary widely. Most people believe that prisons are for punishing people for doing bad things. Note that by your reasoning, many people who do very bad things should not be imprisoned because there is no risk of recidivism. Women who murder their abusive husbands, for example, are almost never going to go and murder someone else. By your reasoning, they shouldn't go to prison to punish them for their murder.

<comment><USER7> > Women who murder their abusive husbands, for example, are almost never going > to go and murder someone else. By your reasoning, they shouldn't go to > prison to punish them for their murder.

That's a reasonable position to take, actually. Depends on the level of abuse, I'd say. [https://www.cnn.com/2019/06/07/europe/uk-sally-challen- intl-...](https://www.cnn.com/2019/06/07/europe/uk-sally-challen-intl-scli- gbr/index.html)

<comment><USER8> The thing is, jail also acts as a deterrent to the first murder. If it's common knowledge that everyone gets one "murder your abusive spouse" consequence free, a lot more people might commit murders in cases where a divorce might have worked out better and less deadly.

<comment><USER9> Then that's about jail as a deterrent (making society safer by discouraging _future_ crimes), not as a form of punishment for someone who did a bad thing.

It may be true that the deterrent is justifiable because it's also a legitimate form of punishment (for instance, saying "If anyone kills their spouse this year, I'll skin this puppy alive" might be a deterrent, but it's probably unjust), but it's not acting as punishment alone.

<comment><USER10> Aren't all punishments deterrents tho?

<comment><USER11> No.

A punishment fails as a deterrent if:

\+ it is not expected \+ it is not understood \+ it is not net negative

The first, not expected, fits when; one believes their actions are legal and then they are found not to be (correctly or incorrectly); one expects a different punishment to the one given, and the expected punishment was not a deterrent (often seen in fraud cases).

The second, not understood, fits when one expects the punishment but failed to understand its impact on them. For example, those incarcerated may misunderstand the lasting trauma of loss of privacy, agency, and family.

The third, not a net negative applies in cases where the punishment is deemed an acceptable risk or cost, or even desirable. Desirable has repeatedly been the case for the extremely impoverished or ill. Acceptable cost is seen in many corporate dealings, but mainly speeding and parking tickets for the individual. Acceptable risk is even more the corporate case (legal departments evaluate legal risk constantly) but is also the case for career criminals and moonshot criminals.

<comment><USER12> I'd argue that you often only need one of those criteria.

Witness Vinod Khosla and his battles: he has expected fines, understands them (though disagrees), and the net negative is (in his case) so trivial as to be negligible.

"Oh, you want to fine me $10,000/day? Well, go for it. By the end of my life that might amount to 3% of my net worth".

<comment><USER11> That was in fact what I was attempting to convey. It was unfortunate that each point was formatted onto one line - I forgot that HN does not use markdown!

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> The "except as a punishment for crime" in the 13th amendment was not in the first drafts. But less progressive minded forces got in the final version with the obvious intent of using it[1]. And it has certainly gotten a lot of use in spite of occasional whack-a-mole attempts to moderate it.

[1][https://en.wikipedia.org/wiki/Thirteenth_Amendment_to_the_Un...](https://en.wikipedia.org/wiki/Thirteenth_Amendment_to_the_United_States_Constitution#Peonage_law)

</comment><comment><USER14> "Looking back, Husband said she was punished for being poor..."

Nonsense: she was punished for embezzling $11,000 from her place of employment.

<comment><USER15> At first I nodded in agreement. Then I wondered if someone had the $11,000 would they still be in jail?

<comment><USER5> Convictions for theft and embezzlement usually have two separate punishments: imprisonment and restitution (give back what you stole). As to the restitution part only, being able to pay back the money can avoid imprisonment related to the restitution judgment. But there is nothing unfair about that.

<comment><USER15> Paying restitution is one thing, being forced to stay in jail while paying it back is quite another. Normally these cases are handled with garnished wages.

<comment><USER16> The idea that if you give back what you stole your punishment will be lessened is as old as theft.

<comment><USER12> To be clear, there wasn't _only_ restitution (center) punishment. She was placed on probation for 5 years of a 7 year sentence. Except she was also being "held" at the restitution center while that part of her sentence was being carried out.

</comment></comment></comment></comment></comment></comment><comment><USER17> Yeah, this is fucking insane, from top-to-bottom... left-to-right... inside- and-out... fucking insane.

This is quite literally forced indentured servitude, or what I normally call "slavery." This is fucking slavery.

At no point should one be forced to work before or after they've already paid their "debt" to society; extreme circumstances not withstanding (i.e. you still have a billion dollars after serving your time and can easily afford to pay back your debt). At no point, should ANYONE, be required to be imprisoned, worked, and have daily wages withheld for the "cost" of that imprisonment, furthering their imprisonment-- this is straight up a fucking violation of human rights and theft, the interest rate on the withholding is very likely not paid back, but I'm 100% sure they (prison owners or faction in that industry) profit on it.

Where can I donate what little money I have to stopping this fucked up practice and making it illegal? Maybe I missed it in the article due to the increasing amounts of (naive) disbelief and (pure) rage I encountered as I read it.

<comment><USER18> > At no point should be forced to work before or aftere they've already paid > their "debt" to society

Weird wording. The fact that the debt has not been paid is why they're working, no?

My dad's accountant embezzled from his business.

The person spent all the money over the years and by the the time they were caught, there was little left. And unfortunately, that's a pretty typical story. (FYI, business insurance may or may not cover internal theft; that's often a separate policy or a rider.)

In the end, the crime netted a hefty sum at the expense of the victim.

If you take something, you should have to give it back.

IDK what this vague "debt to society" is; I just know my dad is out $100k+.

<comment><USER19> That really sucks for your dad and this may be hard for you to answer objectively given your proximity to the situation but imagine if the guy who robbed your dad got tossed into this place with $100k + court fees and maybe child support if he had kids.

At minimum wage pay, with ~20% of his earnings going to pay down the debt that's effectively a life sentence. My question to you is, does that seem fair for what is essentially a white collar, non-violent crime?

<comment><USER20> Where does it say they have to make minimum wage? If someone was stupid enough to hire the guy again as an accountant, he could make whatever he made before. Hell, like most of the geniuses in this story, he could embezzle from the next guy to pay the last one!

Edit: I do think the system they have going on is absolutely ridiculous, especially considering the infrastructure costs when it's only being used for "more than 200 people" (which I'm assuming means less than 300). But some of the responses here from bleeding hearts are insane.

</comment></comment></comment></comment><comment><USER21> The more I read about "justice" in the US the more I realise how fucked up and perverted the concept of justice is in that country.

We're always quick to criticise other countries for the failings or bad design of their justice system and lack of respect for human rights, but are we much better? We might be better on paper, but is that actually reflected in reality? I'm not so sure.

<comment><USER22> If you get convicted for _embezzlement_ , as in the first example in the article, and don't pay your fines and restitution, what do you think the courts should do?

<comment><USER23> Wage garnishing is easy? If you have an employer then now they are on the hook for following through as well.

Hell, shut down the restitution centers and use that budget to help cover court fees instead!

Think about it: if someone gets fined $10,000 and is working minimum wage, is there really anything good accomplished by trying to recover that much? Just cap out some wage garnishment scheme if you want to fine them.

<comment><USER22> The criminal has an actual victim who needs his money back. It's pretty important to him (or her) that he gets his money back. Maybe she could pay the restitution with the money she embezzled.

She also skipped her meeting with her probation officer, more than once, and she didn't report to the probation officer (or the court, whatever) that she got an increase in income, when she got her job at Harrah's. Funny, that.

They don't mention that in the article, do they.

Here's the hearing transcript: [https://www.documentcloud.org/documents/6598211-Annita- Husba...](https://www.documentcloud.org/documents/6598211-Annita-Husband- Revocation-Hearing-Transcript.html)

<comment><USER12> Absolutely they mentioned it in the article.

<comment><USER22> Where do they mention that she didn't report an increase in income?

</comment></comment></comment></comment></comment></comment><comment><USER24> They aren't a thing of the past. Debt related criminal offenses are just charged differently as contempt of court or fraud: [https://www.nbcnews.com/news/us-news/debtors-prison-aclu- rep...](https://www.nbcnews.com/news/us-news/debtors-prison-aclu-report- details-criminalization-private-debt-n849996)

</comment><comment><USER25> The US has the highest real incarceration per capita on the planet except Seychelles, mostly for nonviolent crimes that were instituted (War on Drugs) by Nixon to attack the poor, minorities and other "opponents." Also consider the number of for-profit prisons and the prison industrial complex that runs transportation, staffing and internal services for the public prisons.

It's also worth carefully re-reading the text of the 13th amendment. The giant slavery loophole is as-intended. The Union lost the Civil War while it got to declare "Mission Accomplished" because Abraham Lincoln sold-out civil society. Slavery continues as corporations profit by exploiting cheap labor paid on average under $1/hour. Systematic disenfranchisement is profitable.

<comment><USER26> Your comment is incredibly hyperbolic. The Union won the civil war. Slavery in its most overwhelmingly common form was ended. Millions of black Americans were freed. Whatever his other faults and shortcomings, Lincoln presided over the sacrifice of many men's lives to bring about that momentous change.

</comment></comment><comment><USER27> How is this constitutional?

<comment><USER28> 13th Amendment

Neither slavery nor involuntary servitude, _except as a punishment for crime whereof the party shall have been duly convicted_ , shall exist within the United States, or any place subject to their jurisdiction.

<comment><USER29> I don't think failing to pay a debt is a "crime" under American law.

Edit: reading the article, these people have failed to pay the fines associated with criminal convictions.

<comment><USER30> People are regularly jailed for civil infractions such as traffic tickets, and failing to pay fines from such infractions.

They are also held on bail when they cannot afford to pay, this is before found guilty of any crime.

<comment><USER5> Traffic tickets in many states are criminal violations. Here in Maryland, for example, there are no civil infractions except for automated red light cameras. Even a normal speeding ticket is a misdemeanor criminal conviction.

<comment><USER31> A speeding ticket is a misdemeanor criminal conviction.

This beggars belief. Can you provide sources or citations. Quick googling finds no references to this absolutely implausible scenario.

<comment><USER5> [https://www.atlantaduilawyer.com/blog/is-a-speeding- ticket-a...](https://www.atlantaduilawyer.com/blog/is-a-speeding-ticket-a- misdemeanor-in-georgia/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER32> Embezzlement

</comment><comment><USER33> From what I understand there are a metric fuckton of people imprisoned for inability to pay child support, so I'd say debtor prisons aren't limited to Mississippi.

<comment><USER34> People in other states who are imprisoned for inability to pay child support, etc. are released at the end of a finite sentence; they are not held indefinitely until they pay off an ever-increasing debt to the state at a low wage job. That's what defines debtors prisons.

<comment><USER33> One is certainly more severe than the other, but in either case if people are getting imprisoned over debts, it seems like a pretty shitty situation. Do you disagree?

<comment><USER35> That's not what this article is about. It's about "How the state's "restitution program" forces poor people to work off small debts."

</comment></comment></comment></comment><comment><USER36> The scandal is the mainstream press hasn't raised this and related problems in the justice system. They really only have one job, and no amount of "concern" for political issues is sufficient to compensate for the shameful oversight of issues like this.

I'd argue any writer with a Pulitzer should hand it back until they have personally effected change in justice and prison reform. I'm angry that the system works this way, but I'm even angrier that people who do nothing but write for a living get to do so without making this a national priority.

<comment><USER37> This is silly. The "mainstream press" is nothing more than a mirror. If there were widespread outrage about justice and prison reform, there would be much more coverage of it. There really just isn't much interest, and it's honestly as fervent on the pro-punishment side as the reform side (e.g. Jeff Sessions' disastrous but celebrated term as Attorney General in rolling back progress made at the Federal level: [https://fivethirtyeight.com/features/jeff- sessions-is-trying...](https://fivethirtyeight.com/features/jeff-sessions-is- trying-to-take-criminal-justice-back-to-the-1990s/))</comment></comment>


Ask HN: What's your routine/ways to keep being productive day by day? - <AUTHOR> Interested in initiating a discussion about what worked for you to keep your productivity up. What'd you learn about yourself working for so far and what'd you think most of us are doing wrong? <comment><USER2> Here's what I try to do... work as little as possible while still getting stuff done, deeply think about things before doing any work, manage energy (exercise helps), use persuasion where its possible to avoid work (others call it sales), and select the activities that you do ruthlessly (selection being the most powerful tool).

Pomodoro, not-to-do lists, tracking software, etc all fail because they put emphasis on the wrong things. In those worlds input and output have direct relationships. But IMO you can get more done, by convincing someone not to do their bad idea, that's going to suck up a ton of time and force you to not work on things that could create higher impact. "There is nothing so useless as doing efficiently that which should not be done at all"

Another thing I've fallen in love with lately, is finding ways to use as little code as possible (this has actually lead to a passion for Machine Learning). Code, loved by all around here, causes myself and others to reframe our problem solving around it. Sometimes this is a good thing, other times its a bad thing. In theory code just automates things so you can set it and forget it... in practice, every line of code is under your

Also, consider viewing your productivity in the context of energy levels. Pretend that you are training for a marathon or something physical. Do those people train all the time as hard as they can? hell no. They work their way towards goals, using patterns that shape their bodies (and minds) towards the goals. Start with a 5K, then do a 10K... all the way up to an ultra marathon. If you get injured or burnt out, do the things that you need to do to heal properly... don't just start running again.

If you work for a company, prioritize whats good for the company over what your boss wants. If your boss is doing their job well the two should be in sync.

there's more... but I have to go get some stuff done :)

<comment><USER3> > If you work for a company, prioritize whats good for the company over what > your boss wants.

This sounds like some seriously bad advice. Your boss is the one deciding your fate within the company. Ignoring his goals is career suicide. The one exception I see are maybe some megacorps, where (at least in theory) your career progression is not up to your immediate manager.

<comment><USER2> And my follow up is... why is your boss not doing whats best for the company?

AND ...your career progress is NOT up to your immediate boss. That person is a blip on the radar over the course of 30-50 years working, particularly if they aren't worried about things bigger than themselves.

Companies are made up of many people and provided the company is working on something worth working on, your alignment towards that end will be noticed by all of the other people.

<comment><USER3> My boss is, most of the time, doing what's best for his career. That might be alligned with company's best interest, but that's not what he focuses on.

</comment></comment></comment></comment><comment><USER4> I've found that the main factor that determines my productivity (for everything: day job, studying for classes outside of work, doing chores, etc) is sleep the past few nights before. Caffeine can sometimes bridge a small sleep deficit gap, but I've found that it's a bad long-term solution to not getting enough sleep.

After sleep, the order is roughly exercise, moderating my caffeine intake, and taking breaks. I've found that it can be hard for me to remember to take breaks, and I find that with them, I don't get as exhausted as when I try to power through nonstop. Pomodoro timing (I use a free Chrome extension called Marinara) is especially helpful for that.

<comment><USER5> On the topic of sleep, I found Matthew Walker's "Why We Sleep" to be a really good read. I've spent about a month actively working on my sleep hygiene and I've seen a noticeable improvement in my productivity.

<comment><USER6> How applicable is Why We Sleep to someone who lives with a partner who keeps slightly different hours? Not opposed, but they're generally still up when I've fallen asleep...

<comment><USER7> Why We Sleep isn't really a "10 tricks to sleep" book, it's a book explaining the state of sleep research in 2018.

I found the research survey (less sleep => more cancer, more Alzheimer's, worse emotional states; more sleep => dreams for self-therapy, better health outcomes, better memory; your night/day inclination is immutable like your eye color) more effective at motivating me to improve my sleep habits.

What about your differing sleep schedules causes problems? My wife is an early bird and I am a (relative) night owl.

<comment><USER6> No problems really. Just aware that like many inputs in health, it can almost always be better!

</comment></comment></comment></comment></comment><comment><USER8> I've read a few books on the topic recently, here's what works for me (some followed by resources):

\- going sleep early-ish (before 11 PM)

\- at least 7 hours of sleep

\- swimming before work

\- cutting down on meat

\- less worry (stoicism) - "Happy", Derren Brown

\- writing down a master to-do list of literally everything (it litters your head, really) - "Getting Things Done", David Allen

\- saying "no" to things you're not certain about

\- staying out of internet (internet-less Pomodoros) - "Deep Work", Cal Newport

\- listening to noise instead of music while working - [https://www.youtube.com/watch?v=ZXtimhT- ff4](https://www.youtube.com/watch?v=ZXtimhT-ff4)

But honestly, first 3 bullets are the most important ones; if done, I'm super concentrated the whole day (strangely enough, these 3 are basic stuff, you probably already know that from your mama).

<comment><USER9> well thats basically people routines...

<comment><USER8> Sure. For me, it's crazy that "how to be a good developer" mostly comes down to "how to be a healthy man"

</comment></comment></comment><comment><USER10> Gym, everyday, at 7:00 a.m. The benefits of working out help me stay calm and focused throughout the day, and the everyday routine gives me something to do every morning while still on autopilot.

<comment><USER11> Gym 7:00 a.m. doesn't work for me. That would be the best time from schedule perspective, but I simply can't. I'm talking about gym training with heavy free weights, not fitness club with stationary bicycles.

</comment></comment><comment><USER12> Writing down what you need to work on the next day in a list has been very helpful for me.

I usually pair this with Pomodoro technique if the items are programming related.

If they are management related, I usually use some form of GTD to ensure that I am on top of things.

<comment><USER13> My first exposure to Pomodoro was this thread so I looked it up.

>There are six steps in the original technique:

>Decide on the task to be done.

>Set the pomodoro timer (traditionally to 25 minutes).

>Work on the task.

>End work when the timer rings and put a checkmark on a piece of paper.

>If you have fewer than four checkmarks, take a short break (3–5 minutes), then go to step 2.

>After four pomodoros, take a longer break (15–30 minutes), reset your checkmark count to zero, then go to step 1.

I can't believe anyone would religiously do this, it seems like something designed by de Sade.

<comment><USER14> I've done this in the past and it does work. There are a few additional details that this description is missing - like what to do when an "interrupt/interruption" arrives (you just note it down and deal with it later).

It really helps but I thought it was very intense and eventually I questioned why I was working with that intensity for someone else. It's not that I was slacking off prior to that. I was performing well but wasn't heading towards burning out and this would have led to a burnout.

</comment></comment></comment><comment><USER15> Quick trick: every hour that you spend in front of a computer make sure to send out one email. If you're a writer, send a blog post to someone to edit or publish it. If you're a entrepreneur, send out a sales inquiry. If you're a engineer, send out a message to someone you want to collab with.

Have the outside world be your forcing function for productivity. If you send out one cold email 20% might lead to a good exchange, 5% to something that goes forward. But that's still an opportunity every three days.

<comment><USER16> For writers and engineers increased productivity will come from the exact opposite advice - allocate some time for email and isolate yourself as much as you can for the rest of the day.

<comment><USER15> I agree that you shouldn't be constantly reacting to incoming email, but what about your own outreach? Same caution?

</comment></comment></comment><comment><USER17> Movement.

I'm lucky in that I have a university campus to range around on, so this probably isn't an option for everyone, but I find that changing locations every two hours or so helps keep me on track, be it for homework or client work.

</comment><comment><USER18> Sleep, hard exercise, goals following (a variant of) the rule of threes. Keep perspective.

I try to sleep from 9pm to 5am with minor alterations.

I lift heavy things. Some lighter things faster. Follow a program. I like bergeron.

Rule of threes. Have three goals for the day. More often than not, break those into three milestones throughout given time periods. It tends to line up similarly as an pomodoro for me.

Keeping perspective. Understanding how what I'm working on helps my personal development goals, my manager's development and business goals, and how it helps the business. Understanding that I have to balance all that with family time and experiencing life (which, aside from the boss part, everything above helps with).

</comment><comment><USER19> I found that routines have limited effect on my productivity. Some hacks can be useful (pomodoro for example) but only get me so far.

What really matters is to have a clear understanding of the benefits of what I'm doing. If I know exactly why I have to do something and I am confident about the benefits of finishing it, I have zero productivity problems and don't need any kind of process or routine, it all becomes apparent.

This is usually the case when I have a clear goal and concrete plan how to get there.

If you are like me, my advice is to become as clear as possible about your goals and be as confident as possible about the path that gets you there.

In other words, the "why" is much more important to productivity than the "how"

</comment><comment><USER20> Fair warning: I often struggle with productivity and I definitely can't say that I've got it nailed. That said, for this same reason I think about it quite a bit, and I'll use this occassion to articulate some of those thoughts and relevant experiences.

Things that I emphasize concerning productivity fall under prioritization and modeling.

I mean priority in the most general sense. There's a hundred things that ideally would all be done or experienced, but you only have so much capacity. To deal with that, you have to know what's most important to you. By saying "to you", I'm highlighting that motivations are individual-specific. Sometimes you have to work quite hard to find out what animates you.

That's the consciousness aspect of it: seeing the situation and options clearly. The focus part of it is being sufficiently resilient to distractions, without falling into tunnel vision, i.e. balancing between focus and awereness.

[Notice: this paragraph is hearsay; should be treated as unverified] I don't usually advertise medication, but under certain circumstances self-medicating with microdoses of lsd has dramatic effects. My impression is that it's very effective treating anxiety induced productivity problems, but it also has other noteworthy effects on creativity and focus in general that are more difficult to articulate (for me, at least).

What I mean by modeling may be clarified with the metaphor of zooming. It's about switching between being focused on small scale details and large scale features. Related methods range from formal to informal. Mathematical modeling is a formal instance of this. Computer-assisted proofs or executable specifications are even more formal examples. Noting down what you care about, what affects that, and what in turn affects that and so on is on the informal side of the spectrum. It's about moving from one level of abstraction/detail to another, when appropriate and in the direction (zoom in or zoom out) that's appropriate. Bret Victor wrote about that [0]. He called it the Ladder of Abstraction.

Modeling (or zoom as I called it) has a large effect on my productivity. The prospect of dedicating time to thinking about a problem is not satisfying if you're anxious about getting results fast, but it's very effective in the long run.

[0] [http://worrydream.com/LadderOfAbstraction/](http://worrydream.com/LadderOfAbstraction/)

</comment><comment><USER21> A good sleep schedule and a loose approach of time blocking. [https://medium.com/@naveenraja/a-guide-to-time-blocking- how-...](https://medium.com/@naveenraja/a-guide-to-time-blocking-how-to-do- more-while-staying-sane-def13f606789)

</comment><comment><USER22> The Best Self Journal is a great tool for setting and achieving goals. Check it here: [https://bestself.co/](https://bestself.co/)

</comment><comment><USER23> I doubt mine will be much different than others, but: 7-8 hours of sleep every night, and exercise three times a week (specifically: an hour of strength training during each session).

</comment><comment><USER24> For work I do mostly project / product management

(1) Summarize everything important yesterday. Personal and work.

(2) Check my email 3-4xs a day, once in morning, once later on, fire off emails if it can be done in <5 minutes following GTD from david allen.

(3) Have junk mail, automatically go to junk. Important emails, go to important folders. Less important things / things that don't fit anywhere, general inbox.

(4) Respond to important things that have higher priority

(5) Throughout day, checkup on other projects in pipeline to see who needs to be reminded of what to do (less urgent)

(6) Document, document, document. For things I need to automate processes. Keep paper trails everywhere, so people are held accountable, including myself. For things that are more complicated / may hurt me if I leave a paper trail b/c of complex lose-lose situations, use a phone call instead.

(7) Delegate, delegate, delegate. Keep low expectations of everyone else until they prove otherwise. Objective is to not touch anything technical, everything needs to be agnostic and scalable and being able to passed down to another person. Try out new freelancers every so often for small mini-jobs so I build network of programmers / designers I can rely on for different tasks.

(8) Scale, scale, scale. Don't bother with unscalable things. Go all in or not at all. The end goal is you don't have to do anything

(9) Explore, explore, explore. Constantly try out new methods and tools, via alternativeto.net or producthunt. Chrome extensions. Git repos

(10) Aggregate, aggregate, aggregate. I have standard operating procedures for how I aggregate ideas, notes, git repos. Make the internet your own, google is just a search engine with all my littered notes everywhere

(11) analyze, analyze, analyze. Check through how often I am repeating myself. Check my progress from daily notes made every week. See if I am going under a prolonged sprint with no results. Fire people when necessary if they are underperforming. Deliver bad news fast and get it over with. Set clear goal- lines and deliverables. Automate consistently, mini changes at a time

(12) Learn, learn, learn. When dealing other people smarter than you, be humble and keep an open mind. Do not say more than necessary else you skew opinions towards your own. For instance, if you outsource a task, simply explain the problem not the idealistic solution in mind.

(13) Invest, invest, invest. Not just time and skills. Constantly look into new tools to automate processes. New printers. New monitors. New mechanical keyboards. Better PC's. Standing desks. Better machinery for manufacturing. New software for pipeline processes.

(14) Put a website blocker on my computer for hackernews / social sites so I don't go on them longer than I have too

(15) Write down things I have to do tomorrow

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>---

For personal hobby projects / personal life

(1) Waking up at 6 AM every morning to workout

(2) Occasionally blogging and/or doing technical presentations at meetups (sets a clear objective)

(3) Learning to delete. Deleting bad code routinely, deleting terrible writing, deleting bad habits, putting your best foot forward wherever you are. Strictly avoiding repetitive code when possible, this forces me to employ design patterns.

(4) Not wasting time on pomodoro / productivity hacks, - discipline, patience, and work ethic

(5) Putting pleasant music on right when I get home. I use this at the moment, [https://www.youtube.com/freecodecamp/live](https://www.youtube.com/freecodecamp/live). Makes me productive right away, so I don't play video games much anymore _(this is assuming I don 't have other commitments to make that night with meetups / friends)_

(6) When I get stuck on a problem, post it 3xs in 3 different locations (my city's dev channel, stackoverflow, reddit). I don't have hand-holding when it comes to development unfortunately, learned everything the hard way.

(7) Segregating different times of days for different things. Morning time is dedicated for coursework / tutorials. Evening is for hobby projects / music.

(8) Setting a bedtime alarm warning at 9 PM. I go to sleep at 10 PM, so I need to wind down for an hour</comment>


Service-Oriented Architecture: Scaling Our Codebase As We Grow - <AUTHOR> https://eng.uber.com/soa/ <comment><USER2> Any sufficiently complicated distributed architecture contains an ad hoc, informally-specified, bug-ridden, slow implementation of half of SOAP.

<comment><USER3> I must admit that having been through multiple generations of tools and approaches to support distributed programming - ONC RPC, CORBA, SOAP and now REST the one I liked least was SOAP - largely as it seems to favor initial ease of use (particularly in tools like Visual Studio) than long term operational support and ease of debugging.

Interesting to see that they had started using JSON Schema for specifying documents in a RESTful world - I've just started that myself and it seems to work fairly well.

<comment><USER2> Indeed, drag and drop SOAP/WSDL based on objects in your app never really gave you a great API, just like randomly creating opaque REST endpoints never gives you a great API. Most SOAP stacks are extremely well orchestrated, I'd be interested to hear the specific operational and debugging issues you had.

Look, I'm not madly in love with SOAP and I don't intend to throw myself on a bonfire of downvotes in its defence, but all the problems described in the article have been solved for a long time, including the ones lamented at the end - headers and authentication.

People are of course welcome to go to whatever lengths they like to have complete control of their stack, I'd just hate to think it was because either nobody in the room mentioned it, or that they wrote it off because it was enterprisey.

<comment><USER4> Totally agree with you there. It's been kinda funny watching the popularity of JSON grow while the world around it constantly spends time reinventing everything around XML like schemas.

The biggest difference between REST and WSDL services just boiled down to whether you were using a scripting language or a strongly typed language. Strongly typed languages greatly benefited the extra schema details that WSDL provided. Scripting languages didn't have to care so WSDL seemed bloated and unnecessary.

It's only when you start running into all of the problems associated with SOA that WSDL/SOAP already had solved that you truly start to appreciate the original spec.

<comment><USER5> > Scripting languages didn't have to care so WSDL seemed bloated and > unnecessary

This is an excellent point. And even a stronger point when one think about the popularity JSON. There is very little advantage with using JSON with Java for instance (architecture wise). XML,SOAP and co gets a lot of hate today.

And it's funny how people are now reinventing the wheel with GraphQL and co ... when all that is needed has already been invented but for some religious reasons devs refuse to take advantage of it.

</comment></comment></comment></comment></comment><comment><USER6> 500 services? Any choice of language? I can only imagine how much logic repeated amongst these services because "fuckit, I need this module over here and there's no great way to share it amongst all of these languages/services, so let's just copy/paste".

This sounds more like the wild wild west of coding and less of an architecture.

<comment><USER7> The fact that they CAN technically use any language, doesn't mean the new hire is going to start implementing a new service in brainfuck on day one.

In addition, if they are services, and you need some logic that's implemented in another service, why don't you, like, call it, instead of copy/paste? It's what services are for.

<comment><USER8> +1. Services, not libraries. Standard libraries turn micro-services into components.

</comment></comment></comment><comment><USER9> They discovered that SOA is the remedy, and will begin to use Thrift, well in later half of 2015.</comment>


Yet Another Reason Containers Don't Contain: Kernel Keyrings - <AUTHOR> http://www.projectatomic.io/blog/2014/09/yet-another-reason-containers-don-t-contain-kernel-keyrings/ <comment><USER2> As Theo de Raadt so eloquently said:

      "x86 virtualization is about basically placing another nearly
       full kernel, full of new bugs, on top of a nasty x86
       architecture which barely has correct page protection. Then
       running your operating system on the other side of this brand
       new pile of shit.

       You are absolutely deluded, if not stupid, if you think that a
       worldwide collection of software engineers who can't write
       operating systems or applications without security holes, can
       then turn around and suddenly write virtualization layers
       without security holes."

See [http://web.archive.org/web/20120513060008/http://kerneltrap....](http://web.archive.org/web/20120513060008/http://kerneltrap.org/OpenBSD/Virtualization_Security) for discussion/context.

</comment><comment><USER3> "Let's walk before we run"

Totally totally totally. I loved building VMs with BSD jails, and was excited to try out LXC a couple of years back - and it felt similar to very early years of the big jails push - all was working but kinks still existed and the user land was immature.

This is not stuff that great UX with Ansible will fix - the underlying mechanisms will still take a couple of years to shake out. We will run on them but ... Keep your secrets close.

</comment><comment><USER4> also known as user namespaces to the rescue again (available via lxc or other users of relevant parameterized syscalls), they've been available for a while... though libcontainer doesnt support. in conjunction with a good lsm, seccomp filtering, and capabilities thats pretty good protection. for those willing to endure the pain might also go with grsec.

</comment><comment><USER5> Sandstorm.io's containerization (which uses Linux namespaces just like Docker and others) is not affected by this, because add_key, request_key, and keyctl are among the syscalls which Sandstorm disables with seccomp. The other issues the author alludes to from his previous post on opensource.com also do not affect Sandstorm, because it does not mount /proc or /sys and only exposes the devices null, zero, and urandom.

[https://blog.sandstorm.io/news/2014-08-13-sandbox- security.h...](https://blog.sandstorm.io/news/2014-08-13-sandbox- security.html)

</comment><comment><USER6> Yawn. All containers will have potential security problems until people start using different user namespaces. I'm looking forward to Docker implementing an easy way to create unprivileged containers.

</comment><comment><USER7> Please enlighten me if I have misunderstood but isn't this something where unprivileged containers (under lxc 1.0+) can be a bonus?

</comment><comment><USER8> Note that these are docker containers and not "containers" as a general purpose concept. Jails still contain fine....

<comment><USER9> No, these are Linux namespaces. These break up the things jail does into smaller pieces of functionality, and that is more difficult. But this bug is to do with the fact that Linux just has a lot more complex kernel functionality than the BSDs do.

You can break out of a jail if there is a local exploit that gives kernel code execution as non root.

<comment><USER8> > You can break out of a jail if there is a local exploit that gives kernel > code execution as non root.

Well, this has always been true of any sandbox or virtual machine.

> But this bug is to do with the fact that Linux just has a lot more complex > kernel functionality than the BSDs do.

Also probably true. The linux kernel was not built to be namespaced, unfortunately, so bolting no namespacing will have edge cases that are not covered. I would not recommend anyone use linux containerization for production environments for some years.

<comment><USER10> _> You can break out of a jail if there is a local exploit that gives kernel code execution as non root.

Well, this has always been true of any sandbox or virtual machine._

That's not true for Virtual Machines.

 _I would not recommend anyone use linux containerization for production environments for some years._

Too bad people have been doing it for years - successfully - already. For example, most PAAS products use linux containers for isolation and as a security layer.

OpenVZ (ie, early version of Linux containers) has been used in production hosting environments to give people root shell access for just as long.

<comment><USER11> > > You can break out of a jail if there is a local exploit that gives kernel > code execution as non root. > That's not true for Virtual Machines.

That's certainly an opinion: [http://www.ubuntu.com/usn/usn-2342-1/](http://www.ubuntu.com/usn/usn-2342-1/)

> It was discovered that QEMU incorrectly handled certain PCIe bus hotplug > operations. A malicious guest could use this issue to crash the QEMU host, > resulting in a denial of service

Most virtualization servers are great big chunks of C and C++ running as root with a bunch of crazy optimizations for benchmarks. They get some help from the ISA, but... stuff happens.</comment></comment></comment></comment></comment>


Google Security Team Member on NSA: "Fuck These Guys" - <AUTHOR> https://plus.google.com/+MikeHearn/posts/LW1DXJ2BK8k <comment><USER4> I think it's pretty clear that we need both technical and legislative fixes to NSA surveillance. Just one of the two isn't enough: to get be even vaguely confident that surveillance ends, we need both. The technical fixes I can't speak to, but the legislative ones I've been thinking about for a while. In the last week, there have been two prominent bills announced to deal with surveillance:

\- Bill 1: The FISA Improvements Act, from Feinstein and the Senate Intelligence Committee. In short it legalizes most of what the NSA has been done.

\- Bill 2: The USA FREEDOM ACT, from Sensenbrenner and Leahy, currently being considered by the House/Senate Judiciary committees. It amends §215 of FISA to end bulk phone metadata collection and fixes some of the problems with §702 of the FISA Amendments Act (under which PRISM is run). But it doesn't fix §702 fully, does nothing to end BULLRUN (undermining encryption) nor the surveillance that happens outside FISA (MUSCULAR, for example, and god knows what else).

Obviously the Feinstein bill can't be allowed to pass. But some really big names (ACLU, CDT) have thrown strong support behind the Freedom Act. I'm wondering what we as the Taskforce(.is) should do. It's clear to me that it doesn't go nearly far enough. And there's some chance that if it passes, Congress will view this whole thing as "dealt with" and not revisit the issue for years to come. But unfortunately the Freedom Act barely has the votes to get out of the judiciary committee, and getting it to pass through both houses requires a lot of momentum.

We've been working on a campaign asking folks to call and oppose Feinstein, and potentially to support the Freedom Act. But I'm not sure if that's a right move. Unfortunately, the public doesn't understand why privacy is important, and Americans aren't nearly angry enough for Congress to do anything more substantial than the Freedom Act. We might be able to push for amendments, but it's a long shot.

tl;dr - We've got two bills in Congress. One is terrible, one is mediocre. But we don't have the political momentum to do anything better than the mediocre bill. What do we do? Tech advocate conundrum.

<comment><USER5> Legislative fixes aren't going to buy you a lot, though they'll buy you something. The fundamental problem is structural: there are a lot of things the NSA is totally allowed to do, especially when it acts as an agency of the executive outside of the U.S. Technologists tend to ignore national and jurisdictional borders because networks cross those borders, but the powers of the NSA are defined in terms of those borders. Not just statutorily, but as an agency of the executive, Constitutionally.

For example, Mike Hearn says: "Bypassing that system is illegal for a good reason." Illegal under whose law? Obvious things like the Wiretap Act simply don't apply outside the U.S. And this is by design: Congress and the courts are primarily domestic institutions. The executive, by design, has primacy when it comes to activities outside the U.S. Maybe this design made a lot more sense back in the day before the advent of trans-national corporations, but it's the design we have, and we're talking Constitutional-amendment level fixes to change that design.

Internally, you might see fixes without a Constitutional amendment. E.g. the Supreme Court might at some point weaken the third party doctrine, which is what makes a lot of the NSA's data collection not a violation of the 4th amendment. But they won't touch the activities of the NSA internationally.

<comment><USER6> U.S. law follows U.S. citizens around the world. For example if a U.S. citizen rob a bank in the U.S. and then flees to the UK, when the UK police catch him, he will be extradited and prosecuted in a U.S. court. He's not stuck into a UK jail without a trial.

That's the minimum issue here--Google ships the data of U.S. citizens around the world, and the NSA knows it. They are trying to play a cute game by pretending to assume that if the GCHQ collects the data in the UK, the NSA can safely treat it as foreign data. We need to call them on it.

<comment><USER5> U.S. law does follow U.S. citizens around the world, but only in certain circumstances does it apply to conduct abroad. For example, there is a law against U.S. citizens engaging in underage sex tourism abroad. But such laws are the exception. If you, e.g., murder someone in England, the U.S. can't hold you accountable under American law.

Your example is a bad one, because in your example the law is broken by conduct in the U.S. In this case, the splicing of the leased lines happened outside of the U.S.

<comment><USER6> The conduct in this case is not the fiber tapping, but the possession and use of U.S. citizen data by the NSA. It does not matter how they gather it, their restrictions are the same--they must limit and justify it.

<comment><USER5> The Google+ comment objects to the fiber tapping. It doesn't say anything about the use of U.S. citizen data, and the NSA asserts it has safeguards in place to filter out such data from foreign taps.

</comment></comment></comment></comment></comment></comment><comment><USER7> It's ironic that when the Chinese attack against Google occurred, we thought the Chinese government was the most hostile state actor threat to worry about, but it turned out to be the US and UK government.

<comment><USER8> Why do people assume the Chinese government is not able to use similar techniques?

<comment> grey-area China doesn't have agreements with BT, AT&T etc which allow it to tap fibre in our countries at will. I'm sure they try some tapping, but they can't do it on the scale that GCHQ and the NSA have been outside China.

<comment><USER9> But they could easily have agreements with every chip fab to build back doors into every piece of networking equipment.

<comment><USER10> That's very unlikely nobody would have noticed them by now, if it were the case.

<comment><USER11> Do you mean - as unlikely as not spotting the weakening of encryption standards - for example by another branch of the same government (NIST/NSA)?

<comment><USER12> Those were spotted.

<comment><USER13> eventually.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Lets start from the beginning: the NSA "hack" became possible because Google (and its security team) made bad assumptions about the security of the connection between Google's data centers and did not encrypt the traffic. Basically, this is security 101: protect data at rest and protect data in flight. So, sorry but I think the better subject for discussion would be how badly Google screwed up, not how evil is NSA. Moreover, it is not clear if other governments or criminals also had access to the users' data (e.g. in Google's data centers located outside of the US). So far Google did not produce any public post-mortem thus we have no clue how bad was the problem.

P.S. I am sure I will get smashed in the comments, so let me say right away that NSA actions should be controlled and audited by the public (e.g. through our representatives in Congress). I think that the biggest "evil" here are the members of Congress who either approved NSA actions or failed to do their job and monitor/audit NSA properly. In particular, I would point my finger at Sen. Dianne Feinstein [D-CA] who should have been ousted from the office long time ago.

<comment><USER15> > Lets start from the beginning: the NSA "hack" became possible because Google > (and its security team) made bad assumptions about the security of the > connection between Google's data centers and did not encrypt the traffic.

The assumption isn't bad - it's a private network line, not a public internet connection. Nobody else had access to that line, at least they weren't supposed to. Splicing a fiber line is a bit outside the scope of your random attacker. You can't blame Google for not anticipating a hostile break-in by the government. The discussion should absolutely, 100% be directed at the NSA here. To accept that a _private_ network connection is open season for the government to tap is batshit insane.

> Moreover, it is not clear if other governments or criminals also had access > to the users' data (e.g. in Google's data centers located outside of the > US). So far Google did not produce any public post-mortem thus we have no > clue how bad was the problem.

How is Google supposed to tell you if they themselves didn't know?

Although from the leaks it sounds like everyone is fucked thanks to the GCHQ and the NSA getting friendly with each other.

<comment><USER14> Well, I feel that encrypting traffic _inside_ the data center is not a bad idea (and we do it at WePay where I serve as CSO). The reasons is that you never know who is listening (big smile here). For example, I don't want our system administrators to have an _easy_ way to look at the traffic: yes, it is still possible to do but it is harder and requires some very unusual actions that will trigger alerts everywhere.

If indeed Google does not know then it's just another sign of security failures at the company. Nobody is perfect and security incidents do happen. A good security will have in-depth defense and built-in monitoring/audit measure that would at the very least allow you to determine what have happened post- factum.

<comment><USER15> > Well, I feel that encrypting traffic inside the data center is not a bad > idea (and we do it at WePay where I serve as CSO).

Do you have your own data center building? And if you don't have your own data center buildings, how are you guarding against physical attacks? Because just saying "encryption" doesn't actually mean anything. Encryption isn't free, and at Google scale that can add up. Useless encryption is just wasted power

> For example, I don't want our system administrators to have an easy way to > look at the traffic: yes, it is still possible to do but it is harder and > requires some very unusual actions that will trigger alerts everywhere.

That can be accomplished in many ways that don't involve encryption. And your servers are all capable of decrypting the data at some point, so you still have to trust your sys admins and/or have alternative systems in place as they still have access to the unencrypted data.

> A good security will have in-depth defense and built-in monitoring/audit > measure that would at the very least allow you to determine what have > happened post-factum.

How, exactly, do you detect cable splicing? Much less audit said splicing? You seem to be asking for a hell of a lot more than "good security"

<comment><USER14> At WePay - no, we don't have our own data centers just yet. In a couple large companies I worked before - yes (and we did encrypt the traffic as much as possible).

Some types of encryption are pretty cheap actually. I used to use special SSL cards in the servers 10-15 years ago but today my laptop would outperform these cards and wouldn't even get hot :) Plus you need to remember that relatively expensive public key encryption needs to be done only for key exchange. After that you run block or stream cyphers and those algorithms tend to be _really_ fast.

So far I haven't seen any evidences that there was cable splicing. Thus using occam's razor I would assume that the hack was much simpler than that. To detect the issue, I would start from reviewing the visitors log to the data center (assuming there is a visitor log).

I'll re-iterate that security should be built on defense-in-depth principle. Every single protection layer will fail or someone will go around it. The assumption that a data center is "safe" is a bad assumption period. You have to play "what-if" game and think for the attacker.

<comment><USER15> > So far I haven't seen any evidences that there was cable splicing. Thus > using occam's razor I would assume that the hack was much simpler than that.

What? The evidence totally points to cable splicing. What hack involves getting all the inter-DC packets but nothing else? Obviously the machines weren't compromised, or they wouldn't have cared about reverse-engineering the wire protocol. So what are you proposing was hacked?

> I'll re-iterate that security should be built on defense-in-depth principle. > Every single protection layer will fail or someone will go around it. The > assumption that a data center is "safe" is a bad assumption period. You have > to play "what-if" game and think for the attacker.

And I'll re-iterate that you're asking for a goddamn magical pony.

Side note, if your data center isn't safe go get a new one. Seriously. Most DCs have tons of security to _make them safe_. That's not an assumption.

<comment><USER14> > The evidence totally points to cable splicing.

I don't think there are any evidences at all. As far as I know, the only known thing is that NSA was able to obtain the un-encrypted google traffic. For example, it could have been backdoor in the router, one extra cable in the switch, or a few other similar low-tech options.

> Most DCs have tons of security to make them safe.

Don't disagree. But this doesn't make them invincible from other attack vectors (e.g. rogue employees). I actually heard the same argument from quite a few people during interviews and I usually don't hire them because you have to be paranoid to get security right :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> I wondered about that traffic, and getting confirmation from the source that the only way the NSA could have it would be by tapping into the internal network is as quite damning.

Google has the best OpSec team I've ever known, it is my hope that they close this 'loophole' as completely as possible.

<comment><USER17> Google, and their "geniuses" in opsec, should not be given a pass at all for this.

Even if this is a leased private line, non-Internet routed, whatever, it is trivially easy to encrypt the communications and is absolutely a best practice. I see this as great big egg on their face.

In fact, it's such a cock-up that one wonders if this is the plausibly deniable ingress that they agreed to provide for the NSA, et. al

This is akin to using telnet to access your home server because you're "on your own network". Nobody does that and I can't believe they would have either.

<comment><USER18> Tapping multi-mode dark fiber unnoticed is now considered trivially easy? I must have missed when the bar was shifted this high.

<comment><USER19> You don't need to tap dark fiber for this to be poor security. They were passing all internal data around in clear text. It would have been trivial for any data center employee to gain significant amounts of open data this way. Why wouldn't you have services, db connections, etc. encrypted internally? Its certainly possible and done within many companies, it is surprising how lax google was in their assumption that once inside the network everything is going to be a-ok.

<comment><USER18> This isn't something that is "easy" when you run one of the biggest infrastructures in the world.

</comment></comment></comment></comment></comment><comment><USER20> Appreciate Mike speaking up like this. We need more people within the industry to speak up. Not just hackers.

(People within these companies are also hackers, but they have more effect when they speak because they are part of a company)

<comment><USER21> I agree, but I do wonder what is going to happen when people start speaking up to say something quite the opposite. "I don't speak for my employer, but I think the NSA is quite awesome and I don't mind that they've been listening to us at all." Or something to that effect.

The clash might be interesting to watch.

<comment><USER22> With the increasingly alarming NSA plans being revealed, if someone thinks NSA is doing a good job, they deserve to be fired. His thoughts and opinion doesn't give him the rights to have public data available to governments. This, ofcourse, assumes that he is into Security Team at some well known company.

</comment></comment></comment><comment><USER23> Oh, the hypocrisy....

> "Bypassing that system is illegal for a good reason."

Yes, so is invasion of privacy. Yet Google has no problem breaking the law and violating civil rights for profit.

> "Unfortunately we live in a world where all too often, laws are for the > little people."

Yeah, like tax laws and privacy laws...

If you want to get on this high horse, you shouldn't be working for Google.

<comment><USER24> Erm, what? Which law did they break, and which civil rights did they violate?

<comment><USER25> Like indiscriminately and illegally sucking up WiFi data with their street view mobiles?

Including account information and passwords on unsecured WiFi connections.

Even if the accusation of "violating laws" may be a tad hyperbolic in the great scheme of things it's not a stretch to deem Google one of the most hypocritical companies around.

<comment><USER26> Except, they didn't explicitly mean to do that, stopped doing that, and paid for the autonomous collection of trash that they threw out.

<comment><USER27> You are very naive if you think that Google does something by mistake (that also happens to fit well into their Big Black Hole of Information).

<comment><USER28> I work for Google, and I can assure you, we do 100,000 things by mistake every day.

</comment></comment></comment></comment></comment></comment><comment><USER29> This has been asked before, but I'd love to hear from a dev (anonymously of course) who actually helped build this NSA madness. Is it like The Cube, where no one really knew what each piece was for? Is it that they are morally pro the NSA's attitude toward personal and corporate privacy, or do they just not care either way?

<comment><USER30> In _The Shadow Factory_ (written after the Klein leaks but before Snowden), Bamford notes that a lot of surveillance equipment comes from Israel. I don't know much about Israeli culture but it may be significantly different from the US.

<comment><USER31> I am at the openstack conference right now. My colleague was talking in hebrew to a lot of folks the past few days. I said to him jokingly "Where did all these Israeli's come from that are here"

His reply: "Dude, all this shit comes out of Israel! its the whole tech/NSA bullshit used against the palestinians!"

It was a casual comment - but very interesting in that its a foregone conclusion that the surveillance state is just a function of the culture of Israeli tech development.

<comment><USER32> Highly self-aggrandizing. I think the most that can be said is that it's a highly symbiotic relationship between .us/.il.

</comment></comment></comment></comment><comment><USER33> 'Privacy' currently is just a facade, most people have just not realised that. Here is an interesting fact, that joe public do not realise.

If you have a mobile phone, you can be tracked, even if there is no GPS on the device. Besides this if the NSA chooses, they can track practically ANYONE in the world, all they need is a mobile number. I would not be surprised if this is actually one of the tools they have.

How?

Due to the nature of how GSM and mobile operators integrate when roaming. When a mobile operator signs an international roaming agreement, they setup signalling links between their switches and VLR's (Visitor Location Register).

The mobile operator in the visited country needs to authenticate you against your home network, this happens via SS7.

Once this link is established, it is assumed to be trusted, and most operators _DO NOT_ apply any filtering on these commands. So with a carefully crafted SS7 command, you could request the location of a mobile subscriber, even if they have not even attempted to join your network.

Now here is where it gets interesting, get access to send ss7 commands from an operator with many international roaming agreements, and you can get details on practically any subscriber. Get access to 2-4 (i.e AT&T, T-Mobile, Vodaphone) of these massive tier1 operators, and you can get the location of practically everyone with a mobile handset.

<comment><USER34> I don't have a mobile phone.

You don't need one, really. Skype at work, landline at home. Why would I want to talk to anyone on the go?

I go out for beers and other social activities all the time. My social life is not suffering at all. The need of having a cellphone is a lie.

</comment></comment><comment><USER35> I am surprised this exerpt from Alan Rusbriger's article in the New York Review of Books [1] hasn't made the rounds:

> "But I did have an interesting (unattributable, of course) briefing from > someone very senior in one West Coast mega-corporation who conceded that > neither he nor the CEO of his company had security clearance to know what > arrangements his own organization had reached with the US government. "So, > it's like a company within a company?" I asked. He waved his hand > dismissively: "I know the guy, I trust him."

West Coast mega-corporation does not know what West Coast mega-corporation does.

[1] [http://www.nybooks.com/articles/archives/2013/nov/21/snowden...](http://www.nybooks.com/articles/archives/2013/nov/21/snowden- leaks-and-public/?page=2)

</comment><comment><USER36> Wow, a guy working for Google said "fuck you" to the NSA. All my doubts and worries are gone now.

<comment><USER37> Are you being sarcastic?

For months Google's only public response was to lobby the government for permission to release stats(?) to prove that they complied with the law - <USER2> a word of criticism for the law itself.

So now that Google's own autonomy has been breached by the NSA (all above- board and legal according to the NSA's legions of loop-hole seeking lawyers) instead of just Google's users, now they are mad?

I just made another post about how a lot of people are unable to imagine what its like for others to be in a situation until they themselves are in the same situation. But... I'm not so sure Google, as an organization, has fully recognized the scope of the problem here.

<comment><USER36> I was being sarcastic, yes.

<comment><USER37> OK.

I had laugh-snort reading the discussion on that page - at one point the original author, Mike Hearn, tries to argue that ad-based services are actually a good thing for privacy. Does Kool-Aid have a google flavor now?

<comment><USER38> You should respond to his argument instead of accusing him of brainwashing. The latter does nothing to advance the conversation.

<comment><USER37> Can't. I so disbelieve in his argument that I won't sign up for G+.

Besides, as Upton Sinclair was fond of saying, "It is difficult to get a man to understand something, when his salary depends upon his not understanding it."

<comment><USER38> I'm suggesting you could rebut his argument here instead of just insulting his integrity.

<comment><USER37> I doubt he's reading this - but for you, sure...

His claim is that there aren't any viable anonymous payment systems for the web but that advertising is semi anonymous, so that's better.

(1) There are ways to make anonymous payments on the net, I can use cash to buy cash-cards in denominations up to $500 that work just like debit cards online, they are even branded with Visa and/or MasterCard. Until a couple of years ago you could buy even larger denominations but war on terror hysteria made it illegal to do without providing ID. None of the entrenched powers seemed to mind the new regulations all that much, which leads too...

(2) The rise of advertising as the primary source of online funding has choked out development of alternative online payment systems in the same way that an invasive species chokes out native species that occupy the same ecological niche. If it weren't for companies like google we wouldn't be in the situation we are now because a lot more work would have gone into the development of alternative payment systems.

(3) The entire goal of modern online advertising is to identify and track users as narrowly as possible so as to better "target" them. The more sophisticated online advertising systems become, the less anonymous the users become. Companies like BlueKai and hundreds of others exist to connect your real-life identity (and associated database entries) with your online activity. Even google does it with their real names policy for g+.

So instead of each vendor only knowing about the specific transactions they have with you, there exist multiple databases that amalgamate all of your transactions (online and offline) across multiple vendors into one central record that is for sale. I'm well aware that Google thinks their user records are super proprietary and that they would never make that data openly available outside of Google, but (1) they are far from the only holder of such data and many of the others see selling/renting that database as their main source of profit, (2) sophisticated use of targeted ad-buys can indirectly mine Google's data, it's not as easy as just buying access like you would from a place like Experian but it is feasible under the right circumstances and (3) who can say if Google will have a change in corporate direction tomorrow and start selling access to all that data that they have been collecting for over a decade?

So, in short, his claim was so blindered that it really was quite ridiculously naive/ignorant.

<comment><USER38> Thank you for responding in a meaningful way. I appreciate it.

> There are ways to make anonymous payments on the net, I can use cash to buy > cash-cards in denominations up to $500 that work just like debit cards > online, they are even branded with Visa and/or MasterCard.

This still puts you at greater risk of exposure than creating a Gmail account through an anonymizing proxy. Prepaid cards can be traced to where they are purchased, which at least narrows your location geographically, if not the exact location. From there the NSA could probably catch you buying it in person by reviewing CCTV footage.

> The rise of advertising as the primary source of online funding has choked > out development of alternative online payment systems in the same way that > an invasive species chokes out native species that occupy the same > ecological niche. If it weren't for companies like google we wouldn't be in > the situation we are now because a lot more work would have gone into the > development of alternative payment systems.

I don't really understand this point. You seem to be positing a world where online advertising didn't become the dominant mechanism for making money on the web, but you don't explain how this could come about. Perhaps if "companies like Google" did not exist? But there were advertising companies before Google and there will be long after Google is gone. Advertising is an inextricable part of the global economy. It would take a revolution to change that.

> So instead of each vendor only knowing about the specific transactions they > have with you, there exist multiple databases that amalgamate all of your > transactions (online and offline) across multiple vendors into one central > record that is for sale.

I think this is deeply wrong and I wouldn't be working for Google if I thought we were heading in this direction. It's not my place to comment further on your other assertions about Google.

> So, in short, his claim was so blindered that it really was quite > ridiculously naive/ignorant.

I don't see how your argument supports this claim. Nothing you have said would be news to Mike, who has been thinking about all this stuff longer and more deeply than most people. He just has a different perspective to you, that's all.

<comment><USER37> _This still puts you at greater risk of exposure than creating a Gmail account through an anonymizing proxy._

I note that you've specifically gone to the most extreme case of the state looking to track you rather than some other private entity. The NSA/FBI looking at camera footage at the point of purchase for a cash card is just as likely as the NSA de-anonymizing your proxy (well probably less likely given what the NSA has been up to). However, for private databases nobody is going to make those efforts. But what they will do (and do all the time) is cross- reference web activity to minimize anonymity and increasing "targeting."

 _Advertising is an inextricable part of the global economy. It would take a revolution to change that._

That's circular. My point is that the industry's overwhelming movement toward advertising as a payment system starved out the development of alternative payment systems, micropayments, e-cash, etc. Hell, paypal could be so much more privacy preserving simply by not disclosing your email to the seller but they don't make that trivial effort because they have no competition.

 _I think this is deeply wrong and I wouldn 't be working for Google if I thought we were heading in this direction._

If you think I am specifically talking about Google, you are mistaken. Go install Ghostery and watch how simply visiting a web page like The Verge gets you into the databases of at least 7 different trackers other than Google. If Mike Hearn was arguing that google should have a monopoly on advertising because google currently doesn't deliberately share its secret stash with anyone, then that opens up a whole different line of disagreement.

<comment><USER38> The industry moved to advertising because it works. When something more compelling comes along, people will move to that. So far it doesn't exist, but many people are trying.

PayPal are not a monopoly, by the way. I would not be surprised to see them unseated from their current position in the next few years.

I do have Ghostery installed. I'm glad it exists, and wish more people would use it so that they could see the extent of the tracking that's going on.

> If you think I am specifically talking about Google, you are mistaken.

I was responding specifically to your paragraph about Google.

<comment><USER37> _The industry moved to advertising because it works._

That's really overly simplistic. It's a complex system and to assume that its the best system (as Mike Hearn stated) is to ignore the fact that there are competing interests at work and the ones who value privacy have significantly less clout than the ones that don't.

 _PayPal are not a monopoly, by the way._

That's just wordplay. Paypal has not faced significant competitive pressure for over a decade, if ever.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER39> Here's one potential cultural snafu - my understanding is US intelligence based almost entirely on SIGINT. I'm not sure how great we are at plain old HUMINT, i.e. using people and relationships to get information and an overall picture of the world.

So all the defense community was raised on SIGINT, and anything seen as a curb on this - technical or legal, they will probably view it as some sort of existential threat. They would then fight tooth and nail to block any sort of reform. And the military industrial complex has quite a lot of legislative muscle....

<comment><USER40> One of the outcomes of various 9/11 reviews was the realisation that HUMINT had degraded as far as it had. The problem is that it is very expensive, both in time and money, and it has uncertain outcomes.

The rise of technology, both its widespread use by the public and the ability to capture it by agencies, had made SIGINT seem much more attractive in the couple of decades prior to 9/11.

So, yes, agencies had become over-reliant on SIGINT over HUMINT, but for understandable reasons with the benefit of hindsight. Currently, they certainly don't view it as an existential threat and all agencies are working to re-establish HUMINT capability, the opposite of trying to block it. The trouble is that it is hard, really hard work.

</comment></comment><comment><USER41> Non mobile post: [https://plus.google.com/114798402540078632611/posts/LW1DXJ2B...](https://plus.google.com/114798402540078632611/posts/LW1DXJ2BK8k)

<comment><USER42> and here's the original "fuck these guys" post [https://plus.google.com/108799184931623330498/posts/SfYy8xbD...](https://plus.google.com/108799184931623330498/posts/SfYy8xbDWGG)

The submitted link is Mike Hearn agreeing with and elaborating on Brandon Downey's original thoughts on the matter.

</comment></comment><comment><USER43> I'm personally far more angry with Congress utterly failing in their oversight role, and to some extent with the judiciary for becoming at best a rubber stamp, than with NSA. The President (pretty much from LBJ onward, but even farther back) is also fairly complicit in this, but that part is accelerating.

I would probably be a single-issue voter if a candidate for congress were likely to win and was aligned with me on this issue but opposed on virtually everything else.

One essentially-fantasy is to run for Congress directly. Unfortunately I haven't lived my entire life to my mid-30s in trying to become a viable political candidate, so this would be difficult. Central or Eastern WA is probably the best bet, along with starting a 50-500 person business which employs a lot of local people (manufacturing of some kind) and generally being an engaged local citizen for a decade or more. But that's a long term goal.

</comment><comment><USER44> The NSA must have somebody working on the inside at google. Otherwise it would be extremely difficult to reverse engineer the RPC protocol that was used by google's servers to communicate between each other. Even on an unencrypted network I can image it would be very difficult to reverse engineer the protocol without any help.

<comment><USER45> The RPC protocol is stated to be based on protocol buffers so the encoding is known. What you would need to do to reverse engineer it is coming up with matching message descriptions.

But, even without that piece of the puzzle, reverse engineering a protocol that doesn't use encryption wouldn't be "extremely difficult". This is not an indication of an inside man.

[https://developers.google.com/protocol- buffers/docs/overview](https://developers.google.com/protocol- buffers/docs/overview)

<comment><USER46> The only published information is how the values are encoded, not what is encoded (the specifications aren't transported together with the data) so to crack 1622 different protocols only involved in authorization according to the NSA slide is not such a small task, at least if they are interested in more than just recognizing e-mail addresses which can be found using regexps. And just counting the protocols proves that they were indeed interested in more.

<comment><USER7> The screenshots of the ascii dump of the RPC calls shown in the WaPo article show that there is tons of information to work with, besides just the email account.

You're talking about the NSA here, an outfit which has cracked the cryptosystems of foreign governments in a variety of foreign languages, and even cracked a Russian one-time-pad that they had accidental;y used more than once.

I don't think it's very hard at all for them to reverse engineer RPC serialization that is not even encrypted if they can crack cryptosystems.

<comment><USER46> Of course it's not impossible just reverse engineering the protocols but we now know that these guys also rightly measure their smartness by taking shortcuts wherever they can. It would be stupid to do unnecessary work to "rediscover" easily accessible information. The right approach is using the internal documents describing the protocols. Shouldn't be so hard, "it's all in the cloud."

</comment></comment></comment></comment></comment><comment><USER47> Keep in mind when considering reform by our legislature that any serious efforts on that front will likely be undermined with blackmail made possible by the very surveillance apparatus they are attempting to curtail [1]. I sincerely hope that Snowden's revelations prove or at least strongly hint towards such an assertion because until they do it's still "conspiracy theory." Free society is in deep shit, and for the life of me, even though I've thought about it obsessively for the past couple months now, I have no idea what can be done about it.

[1] [http://www.boilingfrogspost.com/tag/russ- tice/](http://www.boilingfrogspost.com/tag/russ-tice/)

</comment><comment><USER48> My feeling is that the NSA/GCHQ hack was arguably an unfortunate thing for them to do, although somewhat predictable, once one knows of the existence of the network topology vulnerability that was exploited. But presumably somewhere in Google someone knew about this possibility sometime back. I wonder whether there was an assumption that nobody would be clever enough to figure things out, or whether security engineers were working 24/7 to fill in the gap and just didn't get there in time.

Either way, this is a good stimulus for rolling out deeper encryption.

</comment><comment><USER49> Is information about disruptions to the US PSTN collected anywhere?

The discussion of cable tapping and the NSA's apparent taste for doing things the expedient way instead of the legal way makes me wonder if the "vandalism" domestic underground fiber cuts in the years after 9/11 form an interesting pattern.

</comment><comment><USER50> Cussing is all fine and understandable, but I missed the part where the Google opsec team was searching for and plugging the holes the NSA is exploiting, or switching to another carrier, or suing the NSA for illegal wiretapping.

<comment><USER51> The problem is that it's not the NSA doing it. It's GCHQ, in the UK.

<comment><USER52> What was the physical location of this fiber? The UK?

<comment><USER53> Yes, according to the Washington Post, the interception took place in the UK.

</comment></comment></comment></comment><comment><USER54> I can understand using unencrypted network _within_ a data center (unless you are doubly paranoid), but why wouldn't they encrypt data _between_ data centers?

<comment><USER55> Apparently these data centers were linked via dedicated lines -- there was no traffic or outside access to these fiber lines. They were used solely for communication between the two data centers (so technically still an isolated network).

<comment><USER56> A pretty good example to smack in the face of all those "Just Air-gap your distributed SCADA system!" devotees.

<comment><USER57> Such people exist?!

<comment><USER58> they do, sadly

</comment></comment></comment></comment></comment><comment><USER59> So, this is how it's gonna play out:

Over the next few years it will become more and more common for "in-flight" data to be encrypted. As the "low-hanging fruit" starts to disappear, state- level attackers will increasingly turn their attention from fibre to endpoint; with a corresponding increase in the number of attacks on mobile devices, apps, and embedded systems. This is, to put it mildly, incredibly challenging terrain for passive defence, where complexity all-but-guarantees unknown vulnerabilities and hidden attack vectors.

Now, I am not too sure about the ethics of active defence / networked HIPS, (Too similar by a long shot to the sort of malevolent behaviour it is supposed to defend against) but it might be something that we are going have to have a look at.

</comment><comment><USER60> "Unfortunately we live in a world where all too often, laws are for the little people."

This is sort of the crux of it. We are degenerating into a true oligarchy and/or gangster state in which there are two different systems of law: one for the politically connected and one for the plebs.

</comment><comment><USER61> My bet, especially with the rumors of a secret google data ship, is that google is getting ready to make a data power play.

Something along these lines:

"Look at the horrible way NSA treated our customers... We're gonna make sure the NSA can't get our data in the future, and protect everyone's data. Come use our services where we treat you right!"

It was always just a matter of time before a corporation had the ability to compete in the total information awareness arena with the three letters. Google is probably the primary candidate that has the capability, besides MS/Apple.

Of course the three letters win on the data side, but the company wins on the customer side. Win win. For them. Lose for us.

</comment><comment><USER62> I think that we also forget in this age of reduced crime, that it doesn't matter whether or not something is illegal if you have no means of preventing someone from doing it or holding them responsible when they do. We discovered this situation not by uncovering the intrusion, but from leaked documents. The government has a lot of employees and likes to document its operations, which can lead to whistleblowing... organized crime has few employees, tight lips, and doesn't offer the same protection of whistleblowers. The problem here is not the NSA.

</comment><comment><USER63> Any data running over a leased or owned fiber between data centers should still be encrypted. Why didn't they have a VPN between the data centers? I don't get it and I personally think it's inexcusable. I believe I would lose my job if I my companies data was stolen and their was something I could have done to prevent it, and rightly so. I personally think that everyone has been far to forgiving of companies like Google, Yahoo, Microsoft, Facebook etc... for having done such a poor job of protecting the data we entrust to them.

</comment><comment><USER64> They are likely both complicit in - as well as victims of - fiber tapping given GOOG now owns the building housing one of the largest peering exchanges on the Internet [1].

[1] 111 Eight Ave in NYC (housing Hiberia's trans-Atlantic cable, Equinox, Deutsch Telecom, etc)

[http://www.datacenterknowledge.com/archives/2010/12/03/wsj-g...](http://www.datacenterknowledge.com/archives/2010/12/03/wsj- google-has-bought-111-8th-avenue/)

</comment><comment><USER65> I think the trends has been like this and history tends to repeat it self but in different forms. 1) Main frame - central computing 2) PC revolution - decentralized computing 3) The cloud - central computing 4) ? Hackers invent p2p - decentralized network corporations,government not in control of any communication, information heavily encrypted possibly distributed using erasure codes. Network run by friends who you can trust. Code written by hackers

</comment><comment><USER66> "Fuck these people" was Wikipedia's reaction to seeing the puzzle globe on the NSA slide too. First time I've ever seen Jimmy Wales use profanity in a tweet: [https://twitter.com/jimmy_wales/status/362626509648834560](https://twitter.com/jimmy_wales/status/362626509648834560)

</comment><comment><USER67> Global security sure is easy if you're an engineer working for a large tech company. I say that with as much sarcasm as possible.

Day after day I see post after post around the tech web about how horrible the actions are of the NSA but few if any propose a workable solution to balancing both securing _and_ obscuring actions taken to protect a nation, with the public's need for privacy and protection from abuse.

Oversight, oversight, oversight is all we hear yet nothing concrete to describe how the US (or any nation) is supposed to provide security and keep the enemy from monitoring the techniques and actions taken by intelligence services.

Maybe I'm naive but I don't see a way to keep spying (something all nations do and have done for centuries) with the public's need for complete disclosure.

</comment><comment><USER68> I think it's time to also highlight the fact that people enabled the NSA to do these things. A lot of them engineers. In some cases I'm sure the ones building the stuff didn't or couldn't see the end goal. But I guess there have been many who HAVE suspected or known about the use-cases of the products/software that they have been a part of making. This scares me, it is time that engineers take some moral responsibility. Maybe some course in ethical decision making wouldn't hurt to include in engineering colleges?

(Note: All fields should take moral responsibility, but engineers seem to be worse than a lot of others.)

</comment><comment><USER69> Well that's ok. But what really needs to happen is this to come from the top management - and most of all, they need to ACT accordingly. Until then, all this "fuck them" exclamations aren't worth a dime.

<comment><USER7> You mean like working on projects to encrypt all of their data center links, which started, incidentally, before the Snowden revelations. Or the fact that David Drummond and Eric Schmidt have publicly said the diplomatic equivalent of 'fuck these guys'?

</comment></comment><comment><USER70> Well, if you read the Terms of Service that Google (and to be fair - <USER3> else) makes people agree to - Google is free to sell your data to anyone they want. So I don't know which 'Google user' is expecting their data to be private anyway. Not to beat the 'you are the product' dead horse, but I wonder if they were to actually start selling user data would people be in uproar?

</comment><comment><USER71> The judiciary should always have an adversarial relationship with the Intelligence community in order to have checks and balances. I think FISA could work with more and varied members on it's committee.

Feinstein is a joke and obviously isn't well informed on the subject matter she's supposedly overlooking.

</comment><comment><USER56> Given the snippet of traffic involved, can they make an educated guess which links were compromised to get it? (It is DB replication traffic so if you know the source DB and the dest DB then you can work out the route... in theory anyway, with Google Complexity, who knows...)

</comment><comment><USER72> Just simple big government(s) v.s. big company - happened over and over again in history - remember how powerful Microsoft was in the end of the 90.

Governments don't like challenge to its power. They will find ways to control the Jedi Council.

<comment><USER73> I really don't think this is that clear cut. On this thread alone, two people have have vouched for their companies that encrypt internal traffic as standard MO (wepay, and another larger than google [by their words]) and considering that some mailing list chatter[0] has pointed out some interesting dynamics (read duplicitous) on the behalf of some companies (among the remarks on here), I wouldn't fool myself with its that simple.

As someone working on a start up now dealing with crowd-sourcing/mining data on people/identities and leaving it public, it's very interesting to see the dynamics play out with online services especially with ones that create the perception of walled gardens vs those that position themselves as inherently public and the flak (or lack thereof) they take from privacy advocates and what not.

[0] [http://cryptome.org/2013/10/nsa-hysteria- coverup.htm](http://cryptome.org/2013/10/nsa-hysteria-coverup.htm)

</comment></comment><comment><USER74> Where are the startups that disrupt the 1984 surveillance state? I think YC recently ventured into nonprofits, maybe they should consider adding one company that "furthers the cause of freedom" to each batch or something.

</comment><comment><USER75> How do we know the Chinese or someone else hasn't hacked into the NSA and is using that data to gain access to secure systems that would otherwise be almost impossible to break into.

Wasn't there a Google break in not so long ago?

<comment><USER76> Considering the track record of Governments and technology, I pretty much assume that whatever systems the NSA (and friends) had made are so ridden with holes that any/all people who really want access to it, already do, and that all our (worldwide citizens) access is basically out in the open now.

If anything, I'm actually pretty impressed it has gone on this long without seeing posts on underground forums offering access via cracked/leaked accounts and 0days, in exchange for money. Or maybe it has?

</comment></comment><comment><USER77> It's good to see there are still people at Google with integrity and not afraid to speak up. Sadly, they do not run things. In this environment, you either quit or turn to the dark side.

</comment><comment><USER78> Being that google probably has an unreal security, did they know the NSA got in.. or was it a surprise after learning it from the info leak?

</comment><comment><USER79> This is the first time I've seen a HN article pass the 1000-point mark. Who doesn't love someone telling the govt to eff off?

</comment><comment><USER80> fuck these guys, they stole our business model!

</comment><comment><USER81> This may put a small kink in their plans, but the NSA and GCHQ have unlimited resources and will find another way in.

</comment><comment><USER82> How does one "capture" data flowing over a private fiber channel? Does it require a physical tap?

<comment><USER83> Most likely, yes.

You can tap a fiber optic line without breaking it by bending it such a way that light leaks out: [http://www.techrepublic.com/blog/it-security/protect- your-ne...](http://www.techrepublic.com/blog/it-security/protect-your-network- against-fiber-hacks/222/)

</comment></comment><comment><USER59> So how long before HN gets shut down for supporting criminality and terrorism?

</comment><comment><USER84> There comes a time when principles are more important than life itself.

</comment><comment><USER85> afterwards they will be fu* * * * using FISA court orders ...

</comment><comment><USER86> This is just crap!!! The google guys are no better.

</comment><comment><USER87> One of the few who dares thanking Snowden...

</comment><comment><USER88> Lol a Brit trying to lay into an American corporation for imperialism. I wonder why a system he "worked" on for 1 (or 2) years was so easy to subvert. What a laugh.

</comment><comment><USER89> Oops. What a Hypocrisy? The moral righteous Google. Little People vs Big People? Please stop. Don't do Evil still works for you guys.. I guess.

You have the resources to defend it, if you want to defend. You choose not to in many ways.

So please dont explode in profanity several times a day.

</comment><comment><USER90> Has it ever occurred to anyone that, just maybe, the whole NSA thing is a cover-up to distract the attention from the fact that it's actually the megacorporations that want to spy on you? This is a good way for Google, Microsoft, etc. to look innocent. Let's not forget that it was us who decided to trust these corporations with all our personal data.

<comment><USER88> This is absolutely true. DPI was used by corporations first. NSA et. al. have to use it to stay in the game. Of course, you'll never hear this because the multinational media decides who you root for.</comment></comment>