Drew Wilson: I’m not against crypto, I’m just against the idea that crypto is the savior of the world, which I think is now falling out of mainstream think, which is cool… Because – I mean, the technology existed before, it’s called SMTP. It’s called email, distributed servers serving up the same set of data. And now it’s just on a different protocol. And it was never used for any – SMTP was never used for anything beyond email, and crypto will never be used for anything beyond collectibles and scams. That’s where it fits. And this idea – I always thought it was weird, this idea of like a distributed database being such a big deal. I’m like “Why is it such a big deal?” Like, every company you look at that has done anything great owns the technology, and it’s all centralized. No one wants to go to a distributed bank. I’m sorry, but they don’t. No one wants to go to a distributed almost anything. They want the centralized version. They want the company that’s there, who’s incentivized to make money, and who will build up a scale of employees to service you, the customer. That’s what they want. They don’t want a distributed do-it-yourself sort of thing. I mean, there are people that do, but it’s less than a fraction of a percent.

Mitchell Hashimoto: And so the moderators are very sensitive; there’s been a lot of scams, a lot of phishing, a lot of stuff…

Jerod Santo: It’s now time for Sponsored News!

3.7 million fake GitHub stars

How much weight do you put in a project’s GitHub star count? Probably too much…

Socket researchers have uncovered 3.7 million fake GitHub stars, highlighting a growing threat linked to scams, fraud, and malware, with these campaigns rapidly increasing over the last six months.

Based on this research, Socket is launching a new “Suspicious Stars on GitHub” alert that utilizes the low activity and clustering heuristics to detect packages associated with repositories that have fake stars.

if you want to get proactive alerts and check your entire organization for suspicious star packages (and 70+ indicators of supply chain risk), install the free Socket for GitHub app in just 2 clicks (link in the newsletter). Whenever a new dependency is added or updated in a pull request, Socket analyzes the package’s behavior and security risk, alerting you before any malicious code has the chance to land in your project.

Kevin Ball: Yeah. Sorry. But it’s not crypto, it’s not all scams. There is real value there, and if you’re ignoring it because you’re in that sort of “Oh, it’s been overhyped, so clearly, there’s nothing actually here”, you are gonna get left behind. And so I think that is in that domain of “It’s not boring, but it’s worth looking into, but don’t buy into all the total crazy AGI next year” hype.

Autumn Nash: That’s a scary thing, because they didn’t even need real accounts. They could have found one person, and if you have somebody high enough level, they would have had a way to do a wire transfer… Because they’re thinking that their boss, or a CTO, or these high-level officials are giving them these direct orders. And it’s more than one person. So it’s even if they didn’t have those accounts – and it’s like, how many other ways could this start to affect…? They fooled grandmas with IRS scams on the telephone… And then they’re gonna have video? How do we now educate people about this? How do we educate people around misinformation? Think about just what happened with memes on Facebook during our last election. This is going to be like – I don’t know if we’re ready at a level of how to educate our community on a global scale to fight the amount of misinformation that this is going to be able to churn out, and it’s going to be able to churn it out so quickly that – how do we bring people’s awareness to this? If you don’t work in tech, do you even know that videos like this exist? How do we then differentiate between the two?

Jared Henderson: Yeah, yeah, that makes sense. And you’re right. It works great for parents kind of watching over their kids, kind of being careful with their kids… But that’s not the only relationship that – if you have any sort of relationship where somebody’s kind of looking out for somebody else… You mentioned elderly people, and scams, and stuff like that… But I had a Gertrude user reach out to me and say they were – you know, I kind of market more to like parents and children, because that’s what I made it for… But I had someone reach out and say “Oh, I’m using this with my fiancé”, and they kind of were saying “Oh, this is the first thing that’s really worked for us, because it’s so –” You can remotely – basically, whoever is like the parent in the relationship can kind of like remotely manage stuff. And that was one of the things that – I was so frustrated about the fact that my kids… It’s like, if I wanted to allow a website, the only thing they could do is literally bring it to me and I had to type it in. And this person reached out to me and said “Hey, I live across the city from my fiancé, and I was trying to like manage their allowed websites through this other thing, and we would literally have to drive to each other for me to unblock something for them.” And that’s just – so they were kind of saying, just the ability to kind of remotely say “Hey, I get it a notification, I get a Slack, or a text when they need something, and then I can just do it from my computer.”

That’s kind of one of those things that I think takes – I don’t know, it’s never going to be as easy to maintain allow lists as it would be to just block stuff out… But there’s all these little things we can do to sort of chip away at the usability and the difficulty of actually succeeding with this approach. And the screenshots are kind of like one thing that really actually goes a long way towards that, because if you can see what your kids are doing, or the person you’re helping protect, there’s this real natural accountability. And I’ve found using it with my kids a whole bunch that I had a bunch of sites that they needed to get to for school every day, that I had unlocked, and they just used them and they just worked… But they had all these kind of weird little edge cases where, “Oh, hey, dad, I’ve gotta get on this Zoom call with my teacher, and they’re gonna want me to go here and there, and they’re gonna send me links to click”, and I can’t allow those in advance. I don’t know what they are, and they might never need to go back there. And so I didn’t kind of realize this when I first started it, but by having those extra layers of like monitoring, including screenshots, it allowed me to kind of build this feature where I could temporarily just turn off the filter… And that sort of came from just – all this is just me scratching my own itch. I had this six-month period where my daughter, every single Friday at 1pm I would have to turn off her filter for an hour. And I would say to her “Hey, remember, I’m still getting screenshots.” I’d kind of wink at her and send her back with her computer unfiltered.” And then I thought “Why does she have to bring me my computer for this? Why can’t I just remotely control this? I’d rather sit here in my office and just get a Slack message like I do with the other stuff.” And so I kind of built that feature, and it’s become super really handy for parents or for people protecting other people. They know, “Hey, I’m watching”, and they know that they’re being watched by somebody who’s trying to help them. And that means you get these sort of like rare times where it’s like “Oh, the filter’s frustrating. I don’t know where I need to go, but for a few minutes I need to go somewhere.” You can just turn it off, but there’s this sort of extra layer of safety of just like the oversight that something like screenshots or the other monitoring feature provides. And some neat things fall out of that, and that’s where I’m so constrained on iOS; I’ve been wondering “Will it be worth it?” But I think it might be.

Kris Brandow: But it’s like, I was thinking about this the other day, where I’m like, blockchain as a technology is actually absolutely incredible. From a distributed systems perspective, to nerd out for a second, the thing about Byzantine fault-tolerant distributed system consensus algorithms, which is what blockchain is, is usually you have a lower threshold of the number of nodes that can fail to make it secure… And blockchain as technology has figured out how to effectively get you up to 50%, which is the same tolerance you have for every other type of consensus. You can’t have consensus with more than 50% of your nodes failing. And I’m like, it’s incredible. We actually made some major ground and have proven that this type of system can work and can function, even with adversaries. That is incredible. And it is tragic that it is attached to something that is so horrible. Even if you like cryptocurrency in general, the current state of it, with the scams and the Ponzi schemes and the people losing their life savings - it’s a disaster. And I feel like the same thing about AI. I feel like AI, the underlying technology is really interesting. Really cool. That thing it’s attached to, the name AI, the brand AI - no. I could do without it. Please, just…

Cory Doctorow: Yeah, sure. Well, so Chokepoint Capitalism - I co-wrote this book with my colleague, Rebecca Giblin. She’s a great copyright scholar at the University of Melbourne. We wrote it during lockdown on Zoom calls with shared G docs. And we had spoken together at an event in Melbourne while I was out on a book tour in like 2017, and both of us had been involved in kind of copyright liberalisation for a couple of decades each. You know, the Napster wars and their sequels, right? And those debates are terrible. Every one of those debates comes down to “Why are you doing the business of big tech?” or “Why are you doing the business of evil record executives and publishing companies?” And there’s no room in that debate to be an advocate for artists directly or audiences directly. You can only advocate for these companies, which are said to be the proxies for audiences and artists, right? So tech companies proxies for audiences, entertainment companies proxies for artists. Neither of them are very good proxies for either, right? Both of them are really bad at being proxies for either. And what we wanted to do was write a book that tried to explain how you could be suspicious of ever-expanding copyright, and still be on the side of both artists and audiences. And it starts from this observation that we have made copyright bigger and bigger for 40 years. It lasts longer, it covers more kinds of works, the penalties are harsher than they’ve ever been, and it’s easier to prove infringement and secure those penalties than it ever has been.

The industries - music, movies, TV games, publishing - they’re bigger and more profitable than they’ve ever been, proportionally and in real terms. And the share of income going to creators whose work they sell is smaller proportionally, and in real terms, than it’s been in 40 years, and it keeps declining. So the question is, how could you give creators this bargainable right, this copyright that they take to market, and try to get a better deal with from these intermediaries, publishers, labels, studios, tech platforms? How is it that we keep giving them more of those rights, and they keep getting less money for them? And the answer is that we live in a world where there are five giant publishers, four giant studios, three giant labels, two giant ad tech companies, also two giant app companies. One of those is the same company. And one company that does all the eBooks and audiobooks.

[34:30] And in that world, giving the creator extra copyright is like giving a bullied kid extra lunch money. There’s just not an amount of lunch money you give that kid that will buy them lunch. All it’s going to do is a kind of roundabout transfer to these firms that control the chokepoints, that have the audiences corralled with DRM, lock-in, network effects, all the things that they use to control the market, and whatever we give artists, they just take as a condition of reaching that market.

So to solve it, you need structural interventions. So first you need to understand how that market has become so degraded, what are the historic forces, how does the market work… A lot of the first half of the book is just untangling these very baroque accounting scams. The finance sector, they use the acronym MEGO, which stands for “my eyes glaze over.” It’s when you make a prospectus so thick that the person you give it to assumes that it must have some substance to it, but doesn’t try to find it. The same way that you assume that a pile of shit big enough must have a pony under it, right? [laughter]

Adam Stacoviak: I don’t know if the worm, as you said, shouldn’t be a worm, or could have been a worm… Because I think if Twitter implemented ads – and I’ll be frank, I don’t mind ads in my tweet stream if they are tasteful, relevant, not scams, not things that are trying to objectify me, or belittle… There’s a lot of weird stuff out there, where you go and buy it from somebody and it’s a knockoff of somebody else’s thing. It’s just like weird stuff out there.

So I think if you do a good job of like maintaining a good ad ecosystem, of worthy and respectable advertisers, it can be a flourishing environment. Now, that being said, that’s a great way to fund what potentially could be a massively desired company to run something like Twitter… Because it is a global company; it is a global usage application. I don’t mind the ads. And I think it could have been done better if they would have just said, “Can we put the ads in TweetBot, for example?” One thing with Tweetbot is it didn’t have any ads, despite Twitter’s native client having ads.

Kris Brandow: Yeah… I’ve been watching some Coffeezilla on YouTube recently; he’s like this investigator that goes into all of these different types of scams. And I’m just like, “It is so easy to just create a new coin, and then just extract money from people.” And I’m this is a wild, wild space. It all started because of this blockchain thing. But then again, like most of finance also - we’ve had Ponzi schemes for a very, very, very long time, so…

Paul Orlando: [48:10] Yeah, engagement is through the roof, so we wanna boost these posts. And of course, it was doing like the opposite of what they wanted. So in this case, it was a much more modest financial reward for whoever the scammer was. I think it was only around $100,000 in Bitcoin that they ended up getting away with… But you have scams that can scale. So you can scale through a social network, like Twitter, or you have something like the Garmin ransomware situation, where I’m dependent upon this one piece of tech, and now I cannot do the thing that I need to do at this moment. Or now navigating for me is impossible, or it’s really dangerous. So yeah, I like just bringing attention to these things.

For me, when I wrote them, I think I was calling back to some of the writing I did about autonomous vehicles, in both of these examples… If you don’t mind, I’ll loop in the thought on autonomous vehicles there.

Nader Dabit: Yeah. I mean, we’ve had financial scams that have happened (I would say) forever, and really, the thing that you can think of - this analogy is kind of like, we’ve lowered the barrier to entry for financial programming and financial participation… We’ve also lowered the barrier to entry for scammers and people taking advantage of those people.

Guy Podjarny: Yeah, I think security continues to be super-important. Unfortunately, history teaches us that at a time when there is a lot of vulnerability, attackers kick in. So they use this vulnerability we’re seeing – all sorts of phishing scams right now that are related to Covid-19. We’ve seen in past crises, like in 2008, 2001 - we’ve seen an increase in online attacker growth… So we don’t know exactly what will happen here, but we can guess that attackers are only going to accelerate, versus go down… Unfortunately, also some people that are on the cusp also revert to more criminal activities when the market doesn’t give them a lot of great, legitimate work to perform.

So it’s very important that companies continue to invest in that security. you also as a company don’t want to go from a financial crisis to a crisis caused by a breach. You want to do it. So it’s hard… Balancing budgets is hard.

From Synk’s perspective, what we did is we actually tried to help out by giving Snyk usage for free. We’ve actually made an offer of six months free of Snyk usage to companies in the distressed industries, and to small/medium businesses as well, trying to help people… You know, at the moment it’s hard to get – if you’re in an airline, it’s hard to pay anything; you’re not really sure what’s gonna happen tomorrow… But the security people still want to keep the company secure, the developers still want to do that… So we are sort of opening up.

Thanks to the last rounds, we have enough in the bank to be able to withstand this period and allow these parts of the community and our customers as well to keep secure, stay secure as they brave through these really challenging times. We also issued these cheat sheets of ten best practices for secure development while working from home…

Daniel Whitenack: Yeah, the human element here is really important. I was just having a conversation with someone on a Slack channel about “Does AI have morality?” and my thought around that was – I mean, similar to other tech, I think the morality of the creators is what infuses any sort of morality in the technology, in the same way that a certain technology can be used for good, to automate emails and all of those things, but it also could be maybe used for bad, in like phishing scams and all of those things… That really comes back to the root in the creators of that technology.

We need people thinking about this and pushing us, and we also need people with a head looking towards the ethics of what we’re doing as the creators of AI, which is especially a technology which has kind of a more subtle infusion of the creator’s morality and fairness and bias into it than maybe other technologies

Jerod Santo: Sure. I think crowdfunding was a great example of a capability that was unlocked, and then we see the positives and the drawbacks of that with the scams and what have you… But that’s kind of just the market sorting itself out. But I think we all can agree that, like Adam is saying, it’s a good place to jump in and be bleeding edge and have fun and learn something that has tons of opportunities… But I don’t know if any of us have even seen where the real killer use case is, where they’re coming, you know?

Jerod Santo: Yeah, I don’t know specifically about Web 3.0 and Ethereum, although like you said, it has a huge advantage and the developer focus is on it… But my current take - and I’ve been watching this space relatively closely - is that is it a mania and a price bubble and all that? Yes. Is it also actually revolutionary technologies that someday will change the way things work? Yes. I think both of those things are true. It’s tough to see the long-term when you’re staring at all of the frauds and the scams, the Bitconnects that are going to zero while everybody loses their savings… But that doesn’t mean there isn’t real value underneath. I think there is, that’s my take.

Chris Beams: [01:24:04.19] Yeah, for sure. And some percentage are actually out and out scams, right? I think a lot of people are too quick to say “Oh, it’s just all scams”, or something like that. Mostly, the things that you run into, I think it’s still safe to say, are actually well-intentioned people saying “Hey, I’ve got a bright idea. I’ve got some sort of notion of a kind of economics that I can add into this application, that I can sort of tokenize it, and that I can build a legitimate way to fund the development of this project. People will hold this token and pay for using the application with the token” or whatever different kind of model.

So there’s hours and hours that we could talk about on all of those models, right? But what Bisq is doing is something if not unique, very unusual, by comparison, to this kind of norm that we’ve been seeing in this space. Basically, one thing that makes it unusual is that Bisq is working, running software. We’ve actually built the system, it’s out there, it works, people use it, and people are happy to pay to use it.

When people initiate a trade, both on the maker side and the taker side (both counterparties), they pay a fee into Bisq, in Bitcoin; that fee goes to the arbitrators today. I’m one of those arbitrators, the founder of Bisq is one of the arbitrators. So people are willing to pay to use this application in this network, because it’s valuable to them to be able to trade. Same reason people pay a fee on a centralized exchange.

So that works to a degree, in terms of economically incentivizing the development of the application. That can help pay the bills and so on, if you will, but it doesn’t scale very well with regard to getting that JavaFX UI person to come and contribute that chart implementation, or fix that bug, or whatever it is. That’s where this idea of a DAO comes in.

What we’re up to here and what we’re rolling out is a token; we added a token into the sort of larger Bisq system, and that token is actually something based on Bitcoin. This is something that is not a new idea, but not a lot of people do - it’s called a colored coin. What that means is that each BSQ token (we actually call the token Bisq as well, but its ticker symbol would be BSQ) is actually backed by a small fraction of a Bitcoin, a thousand Satoshis, where a Satoshi is one one-hundred-millionth of a Bitcoin. So 1,000 of those, which is a very, very small amount of Bitcoin, actually backs this coin.
What this means is that – and before I get too much into the details of what BSQ is, what can you do with it? Well, we haven’t launched it yet, and I can get into the details of the roadmap later, but when it’s fully functional, what people will be able to do is buy BSQ, trade for BSQ on the Bisq exchange - so they might trade Bitcoin for it - and with that BSQ they’ll be able to pay their trading fees at a lower rate than they would pay for it in Bitcoin. So it’ll be a cost-savings to them, they’ll be able to do more trades more cheaply when they pay for them in BSQ.

[01:28:04.27] Okay, so what? What good does that do? Well, on the other side, and getting back to the original question you asked, we wanna bring people in, have more people contribute, we wanna fully decentralized the operation and maintenance and development of the whole network and the application and so on. So this is the second role of the BSQ token.

The first role is that you can pay to use the application with it, so it’s a kind of access token in that way. The second utility that it has is that you can be paid in it for the work that you do for Bisq or on Bisq. Somebody comes along and implements the chart that we were just talking about - they would at the end of that month period issue what we call a compensation request, and fundamentally that’s gonna be a document saying “Hey, I did this work.” It might be a link to a pull request, or one or more pull requests or commits, something like that that says “Hey, I contributed a chart and it’s merged. That took me this much time, and this is my market rates, what I usually get paid.” Again, just sort of thinking in the units of currency that we denominate our lives in, “Hey, this was $1,000 worth of work for me”, and then they would look at what the market price of BSQ is, and they would issue a compensation request for that amount of BSQ.

What happens is then DAO (Decentralized Autonomous Organization) votes on his compensation request and anybody else’s requests that were issued during that period, and they’re voting in the affirmative or negative - “Yes, we’re going to pay for that work”, “No, we’re not.” And people don’t have any guarantee.