JangoSteve

> Your list is predominantly racial and I thought that was the point.

Ah, no, that wasn't the point. They were just examples of systemic bias. The fact that so many are racial is just a reflection of the unfortunate state we find ourselves in.

> A few absolutely undeniable things, and they exist, would make the list more meaningful and perhaps give more weight to the rest which are a bit ambiguous.

I honestly don't know how any of the examples posted are deniable, they're all well founded with research and evidence. But you're right that adding more to the list can only help.

> Systematic bias doesn't mean that the majority gets more attention, it means that the entire system is biased against something, and you aren't showing that.

That's not what systemic bias means.

"Systemic bias, also called institutional bias, and related to structural bias, is the inherent tendency of a process to support particular outcomes."

https://en.wikipedia.org/wiki/Systemic_bias

Also, examples are evidence which support a theory (of systemic bias in this case). Any one data point is rarely intended to be absolute proof of that theory, much less a description of its scope in its entirety. All of these examples do indeed provide evidence toward the existence of systemic bias within systems without fully describing or proving the extent of the entire scope of systemic bias within those systems.

> But not serving a sentence for crime is just as bad, if not worse.

The article I linked explains that this is not what the algorithm was used for. It was not used to decide whether or not to sentence them, it was used to help decide the severity of their sentence.

> If they were predicted to be killers, a hard but fair sentence at the first crimes could turn them around. If they're predicted to steal a few cars then even a year in prison is probably going to make them worse.

You seem to be agreeing that this was in fact a badly biased algorithm, since it was recommending a stiffer punishment for a kid who attempted to steal a bike than for a repeat felon, previously convicted of armed robbery, who shoplifted.

> It would be, if it were system wide. It was a specific population though, and there's still no indicator that it said black kids specifically other than because in those neighborhoods they were the ones at risk. fwiw, stealing scooters from children doesn't seem like the path to good behavior.

If something affects a population, that is system-wide by definition, since the definition of "system" is pretty broad; see the description above. Regardless of whether or not you think stealing scooters is a good prediction, the fact here is that it rated the likelihood of future crime as higher than for someone who was already a career criminal.

> Systematic risk is AIs for this purpose in regard to anyone, not that they targeted black people more in some cases. That's essentially random.

If only. Unfortunately, this is seen over and over again, more so than would happen by randomness. That's the point of the list.

Your analysis above is a prime example of how dangerous statistics can be when not properly considered. Even if we took your numbers above as truth, it actually does not indicate that the system isn't biased. In order to determine that you'd need to know what percentage of each group _not_ labeled as high risk never re-offended. You're only analyzing the true positive rate without taking into account the false negative rate. You'd need to know how many people in each group that weren't labeled went on to re-offend.

Thankfully, the article I linked to looked at both:

                                               White  African American
    Labeled Higher Risk, But Didn’t Re-Offend  23.5%  44.9%
    Labeled Lower Risk, Yet Did Re-Offend      47.7%  28.0%

I'm not sure how you think my list would bifurcate into multiple lists.

> It's obviously caused by studying the people who present, and then demographics changing. Nobody made a decision here with any ill intent. Both the hospital and the insurance company share the patient's interest in them getting better and are already looking for better data.

Not a single example I gave was the result of ill intent. That's literally the point of my list. There's a difference between systemic bias and intentional bias. These are examples of systemic bias.

> A higher chance of any offense, or of being a burden to society?

I provided the link which answers your question. In this case, it predicted a higher likelihood of future crime for a kid who attempted to steal someone's bike and scooter, than for an adult who had shoplifted, been previously convicted of armed robbery, and served 5 years in prison already.

> Kids are more likely to commit smaller crimes, and those are a gateway to larger crimes that then put you away until you're a hardened repeat felon.

Your logic seems to acknowledge that one of the large drivers of crime is being "put away" in prison. In this case, the algorithm predicted a higher likelihood of committing future crimes for a kid than for someone who had already served 5 years in prison for armed robbery. Even worse is that the algorithm was being used to determine the severity of their respective punishments. So, the act of predicting a higher likelihood of future crime for the kid becomes a self-fulfilling prophecy, giving her a harsher sentence, which in turn is more likely to drive her toward future crime. This is systemic bias in action.

Adding this to my running list of algorithms encoding and amplifying systemic bias, like:

* A hospital AI algorithm discriminating against Black people when providing additional healthcare outreach by amplifying racism already in the system. https://www.nature.com/articles/d41586-019-03228-6

* Misdiagnosing people of African decent with genomic variants misclassified as pathogenic due to most of our reference data coming from European/white males. https://www.nejm.org/doi/full/10.1056/NEJMsa1507092

* When the dangers of ML in diagnosing Melanoma exacerbating healthcare disparities for darker skinned people. https://jamanetwork.com/journals/jamadermatology/article-abs...

* When Google's hate speech detecting AI inadvertantly censored anyone who used vernacular referred to in this article as being "African American English". https://fortune.com/2019/08/16/google-jigsaw-perspective-rac...

* When Amazon's AI recruiting tool inadvertantly filtered out resumes from women. https://www.reuters.com/article/us-amazon-com-jobs-automatio...

* When AI criminal risk prediction software used by judges in deciding the severity of punishment for those convicted predicts a higher chance of future offence for a young, Black first time offender than for an older white repeat felon. https://www.propublica.org/article/machine-bias-risk-assessm... And here's some good news though:

* When police wrongfully arrested a person based on faulty facial recognition match using grainy security camera footage, without any due diligence, asking for an alibi, or any other investigation. https://www.npr.org/2020/06/24/882683463/the-computer-got-it...

* When the above is compounded for people of color according to studies which show that facial recognition systems misidentify dark-skinned women 40x more often than for light-skinned men. http://news.mit.edu/2018/study-finds-gender-skin-type-bias-a.... Another study showed false positives can be 10x to 100x more frequent for Asian and African American faces compared to Caucasian. https://www.nist.gov/news-events/news/2019/12/nist-study-eva...

* When an algorithm blocked kidney transplants for Black patients. https://www.wired.com/story/how-algorithm-blocked-kidney-tra...

* When clinical algorithms include “corrections” for race which directly raise the bar for the need for interventions in people of color, such that they then receive less clinical screening, less surveillance, less diagnoses, and less treatment for everything, including cancer, organ transplants, birth interventions, urinary and blood, bone, and heart disease. https://www.nejm.org/doi/10.1056/NEJMms2004740

It seems weird to view it as an either/or. "Billionaires exploit people." -- "No, they build things people want."

I think that you may be able to become a billionaire without exploiting people, but it's like playing on the high-difficulty mode. In other words, it's easier to be "successful" (from a monetary point of view) when you don't care about others. It's also easier to be successful coming from a privileged background. What's more, there can be a correlation between only knowing privilege and not caring about others, which perhaps leads to the number of billionaires who exploit people (double-advantage).

But it's all very complicated. Sometimes a modest background is an advantage in that you have less to lose, and can provide unique insight in connecting with people. Or a modest background can lead to a survival-of-the-fittest or harsh-world mentality, which leads to the exact opposite, which can also be an advantage.

At any rate, I've chosen to play on high-difficulty mode, for better or worse.

> In that case, applying the remedy of the first example (a set of dates, and inferring that every 2nd (even zero length, to account for adjacent fixed) interval will be default,) introduces another bug where if you lop off any random date in that set or list, you invert everything.

This is a good point, and something I usually describe recoverable problems versus non-recoverable problems. If I make start/end dates in the first example instead of just a set of start dates, then I can always create application-level or database-level constraints that don't allow either overlapping or incomplete segments. When business rules change, I can delete the constraints and update the business logic as necessary with no change to underlying data structures.

However, if I miss implementing a constraint and it erroneously allows overlapping or incomplete segments, I can easily run a query to identify all such invalid entries. Then I can then investigate and decide how to fix them.

However, if I go with the start-date-only set-based approach, and miss implementing a constraint, and it leads to a deleted date creating incomplete segments... I'm screwed. There will be no query you can do to identify incomplete segments to investigate or fix, because all segments are assumed to extend to the next start date. You can irreversibly lengthen one segment by deleting another, due to a forgotten constraint preventing you from making the change.

These could both be errors on the developer's part, depending on the requirements at the time, but one data design may lead to more non-recoverable issues than the other. Add in the flexibility of the former approach, and I'd probably be more likely to implement the former approach than the one proposed.

The latest Android Firefox update also disabled several of the addons I was using, as apparently they are now incompatible until the addon developers do some extra work to fix whatever backward incompatibility Mozilla introduced with the latest version.

This was pretty much an exact question I had about OAuth 10 months ago:

Something I still don't understand about the OAuth flow is how it's _not_ training users to be more easily phished for actual usernames and passwords. The very first step is "If you are not logged into the third-party, display a login-form from the third-party."

The thing is, you never really know off-hand if you're logged into the third-party (provider) or not without opening a second tab and going directly to the third-party's site, since you're always getting logged out after various timeouts, cookie-clearing, browser-closing, and computer-restarting events.

What prevents an OAuth client application from displaying an OAuth process that shows a fake login form, which looks identical to the provider's login form, to get the user to enter their provider username and password before they realize the URL is off? It seems like it trains users that it's normal for websites to launch a Gmail login form and this is perfectly safe.

https://news.ycombinator.com/item?id=21357370

I'm not sure it's just feelings to be resolved. The problem is that even DNA matching, especially the SNP genotyping which tends to be used by consumer ancestry and heritage services, is not perfect. So your daughter can end up false-positively matching to a crime 20 years from now due to your uncle submitting his own DNA last year without you ever knowing. I'm not sure how anyone sufficiently familiar with the implications can just get over it and accept the reality of the situation. It is by no means an easy problem to solve.

Someone else mentioned it already in these comments, but I'll mention again to make sure it's not missed. If you're a startup using AWS, apply for the AWS Activate program. All you need to do is apply, and they'll give you up to $100k AWS credits, which will last for up to 2 years and automatically be applied to your bill until they're used up.

https://aws.amazon.com/activate/

It's not a solution to the larger problem of business model and percentage of revenue going toward compute costs to provide your service, but there are a lot of other great recommendations and suggestions here for that. This could provide you some time to actually implement the other recommendations.

One type of bias does not preclude the other. In this case, one may even strengthen the other. The argument that VCs discriminate on wealth strengthens the argument of systemic racial and gender-based bias, given the disparities in income and wealth between races and genders. This is the indirect nature of systemic bias I was describing.

That is exactly part of the problem, though. The thing about systemic racism and sexism, versus just regular racism and sexism, is that they're entangled (or worse, encoded) into the existing systems. You can't really solve the issues without unraveling the systems.

Regular racism and sexism is when the reason you're not given a chance is because of direct racial or gender-based bias. Systemic racism and sexism can additionally include scenarios where the systems in place (such as the private Ivy League club) might not necessarily be intentionally racist or sexist, but rather just incidentally racist or sexist.

From the article, when a venture fund hides their email or contact information, that's not directly racist or sexist. However, if it prevents people outside of your existing network from contacting you, and your existing network happens to be underrepresented on the basis of color or gender, then it's certainly going to help perpetuate the already-existing under-representation in your network, regardless of whatever the root cause of it may be.

Genomenon | Senior (Full-stack) Software Developer | Remote | Full-time

Ruby (and Rails), Python, Go, PostgreSQL, ElasticSearch, JavaScript (and React and Angular)

Genomenon connects patients’ DNA with the billions of dollars of genomic research to help doctors diagnose & cure cancer patients and babies with rare diseases, and researchers understand diseases at a molecular level.

Our flagship SaaS product, the Mastermind Genomic Search Engine, is the world’s first and only comprehensive genomic search engine. Mastermind is used by thousands of geneticists and genetic testing labs worldwide to accelerate diagnosis, increase diagnostic yield and assure repeatability in reporting genetic testing results so that no data is missed that can save a patient’s life.

Genomenon provides a competitive base salary, excellent health insurance, generous paid time off, and equity participation opportunities in a positive, stimulating work environment. If you are interested in this position, please submit your resume with salary requirements to careers@genomenon.com.

See the full job description here:

https://www.genomenon.com/blog/job/software-developer-2/

> What happens in the case that a particular culture is more hateful? Do we just disregard any data that indicates socially unacceptable bias?

That's not what was happening. If you read the link, you'll see the problem is that the AI/ML system was mis-classifying non-hateful speech as hateful, just because of the dialect being used.

If it were the case that the culture was more hateful, then it wouldn't have been considered "mis-classification."

> You're completely missing my point.

I'm not missing your point; it's just not a well-reasoned or substantiated point. Here were your points:

> There's simply no indication that these aren't statistically valid priors.

We do have every indication that this wasn't what was happening in literally every single example I posted. You just have to read them.

> And we have mountains of scientific evidence to the contrary, but if dared post anything (cited, published literature) I'd be banned.

You say that, and yet you keep posting your point without any evidence whatsoever. Meanwhile, every single example I posted did cite peer-reviewed, published scientific evidence.

> This is all based on the unfounded conflation between equality of outcome and equality of opportunity, and the erasure of evidence of genes and culture playing a role in behavior and life outcomes.

Again, peer-reviewed published literature disagrees. Reading it explains why the point that it's all unfounded conflation is incorrect.

This is exactly why I suggested actually reading the sources I posted before responding. The Google example has nothing to do with routing travelers. It was an algorithm designed to detect sentiment in online comments and to auto-delete any comments that were classified as hate-speech. The problem was that it mis-classified entire dialects of English (meaning it completely failed at determining sentiment for certain people), deleting all comments from the people of certain cultures (unfairly, disproportionately censoring a group of people). That's the dictionary definition of bias.

> There's simply no indication that these aren't statistically valid priors. And we have mountains of scientific evidence to the contrary, but if dared post anything (cited, published literature) I'd be banned.

I'd consider reading the sources I posted in my comment before responding with ill-conceived notions. Literally every single example I posted linked to the peer-reviewed scientific evidence (cited, published literature) indicating the points I summarized.

The only link I posted without peer-reviewed literature was the last one with the positive outcome, and that's the one I commented had suspect analysis.

This is so incredibly common, it's embarrassing. I was on an expert panel about "AI and Machine Learning in Healthcare and Life Sciences" back in January, and I made it a point throughout my discussions to keep emphasizing the amount of bias inherent in our current systems, which ends up getting amplified and codified in machine learning systems. Worse yet, it ends up justifying the bias based on the false pretense that the systems built are objective and the data doesn't lie.

Afterward, a couple people asked me to put together a list of the examples I cited in my talk. I'll be adding this to my list of examples:

* A hospital AI algorithm discriminating against black people when providing additional healthcare outreach by amplifying racism already in the system. https://www.nature.com/articles/d41586-019-03228-6

* Misdiagnosing people of African decent with genomic variants misclassified as pathogenic due to most of our reference data coming from European/white males. https://www.nejm.org/doi/full/10.1056/NEJMsa1507092

* The dangers of ML in diagnosing Melanoma exacerbating healthcare disparities for darker skinned people. https://jamanetwork.com/journals/jamadermatology/article-abs...

And some other relevant, but not healthcare examples as well:

* When Google's hate speech detecting AI inadvertantly censored anyone who used vernacular referred to in this article as being "African American English". https://fortune.com/2019/08/16/google-jigsaw-perspective-rac...

* When Amazon's AI recruiting tool inadvertantly filtered out resumes from women. https://www.reuters.com/article/us-amazon-com-jobs-automatio...

* When AI criminal risk prediction software used by judges in deciding the severity of punishment for those convicted predicts a higher chance of future offence for a young, black first time offender than for an older white repeat felon. https://www.propublica.org/article/machine-bias-risk-assessm...

And here's some good news though:

* A hospital used AI to enable care and cut costs (though the reporting seems to over simplify and gloss over enough to make the actual analysis of the results a little suspect). https://www.healthcareitnews.com/news/flagler-hospital-uses-...

This is so true. I've started a few startups and had a good acquisition. I've since made it one of my missions to espouse the underappreciated role that luck plays in a successful startup, and in life, in general.

You don't often hear it from people who have had the kind of success that leads them to being keynote speakers, I think, because everyone wants to feel like they deserve the success they've gotten. So, survivorship bias tends to kill this message. I think it's important, though, for people to understand when evaluating decisions (past, present, and future) and for learning from and empathizing with others.

Everyone likes to think of life as a meritocracy; that when you succeed it's because of the decisions you made and actions you executed. But people can make the right decisions for the wrong reasons, or vice versa. People can be prevented from making the decisions they'd like through no control of their own. And perhaps most significantly to the point, two different people can make the same decisions with different outcomes.

These are really good illustrations of the quote from this article:

> “Qualified immunity means that government officials can get away with violating your rights as long as they violate them in a way nobody thought of before,” said IJ Attorney Joshua Windham.

https://ij.org/press-release/institute-for-justice-asks-u-s-...

Built savemifaves.org to encourage people to by gift cards to their favorite restaurants and local businesses to help them stay afloat.

Well don't leave us hanging. What's the answer?

> Delegation flows downward from an authority.

Yes, exactly. You originally described delegation as flowing upward toward authority (so the opposite) when you said, "That is called delegation of responsibility. If you are not qualified to make a certain professional decision or if such a decision exceeds your delegated responsibility then you need to bring somebody else in, possibly a supervisor."

> In my experience that is a commonly believed blanket assumption that rarely occurs in practice. Risks tend to increase over time in the absence of controls enforcement.

Agree to disagree then. I've found that this occurs frequently in practice. I've already given examples.

> I am not discounting the value of education, but you would never hire a medical doctor who has never touched a scalpel or a trial lawyer who has never performed at trial.

In typical hospital settings, patients are assigned to doctors, and they can have little experience; it's called residency. Secondly, are you saying you'd rather work with a doctor with no education than one with no experience? There is a reason that doctors and attorneys with little experience are allowed to practice, but doctors and attorneys with little education are not.

This does not even include the fact that doctors and attorneys are _constantly_ reading and researching from studies (for diseases and treatments) and case law (for precedents), respectively, for which they have little to no experience.

> This is a logical fallacy called reaffirming the consequent.

No, it's not. What I said has nothing to do with reaffirming the consequent. I don't even know how to respond to this non-sequitur.

> You cannot know if a decision will be more well informed by waiting unless you have waited and reflected upon that delayed decision.

Yes I can, because I'm constantly learning. At any given point in time, I have more information than I did at any prior point in time. So, everything is always more informed the longer I wait. How much more well informed, or how relevant the additional information varies.

> This is a reckless line of thinking since a given risk profile with change during that period of waiting regardless of whether the assertion holds true.

Reckless means with a lack of caution or consideration for consequences. My original response concluded with, "The hard part about making decisions often isn't just the decision itself, but also in understanding the risks and trade-offs of making a potentially wrong decision now, versus making a better informed decision at a later time, and deciding which is the better approach for any given decision that needs to be made."

I would argue your advice is more reckless, since it's advocating less critical thought on a per-decision basis by prescribing a one-size-fits-all methodology for decision making in your original statement that, "It is better to make a wrong decision early than to put that decision off to a future time."

> Assuming risks are an unchanging constant and that the only thing that changes is the information you receive and also assuming there is never cost associated with a delay then yes it would make sense to procrastinate on many decisions, as much as possible, in the hope you will become supremely well informed, but this is extremely unrealistic.

Whether risks are constant or variable doesn't change whether or not a decision should be made quickly or delayed, so I'm not sure what you're saying here. Constant high risks could mean a quick decision is better, while constant low risks could mean a delayed decision is better. Likewise increasing risk could mean a quick decision is better, while decreasing risk could mean a delayed decision is better. Either scenario could go either way, which is exactly why my original point was that you should evaluate on a per-decision basis which is actually better, instead of following a dogma that one is always better than the other.

I also already gave examples where delayed decisions made sense, and they did not involve any of the assumptions you claim to be requirements for a delayed decision to make sense. There doesn't need to be no cost, there can be little cost. You don't need to be supremely well informed, you can just be better informed.

Yes, your reductio ad absurdum argument (speaking of logical fallacies) would be extremely unrealistic as you pointed out. Thankfully, none of those things are necessary for a delayed decision to potentially be better than a quick decision.

> Its a matter of making better decisions and reducing risk over time. Its not about universal truths. That's what religion is for.

The one-size-fits-all prescription to decision making in this original statement is the universal truth I was objecting to:

> It is better to make a wrong decision early than to put that decision off to a future time.

I was pointing out that this isn't always true (i.e. not a universal truth).

> That is called delegation of responsibility. If you are not qualified to make a certain professional decision or if such a decision exceeds your delegated responsibility then you need to bring somebody else in, possibly a supervisor.

Delegation more often happens toward subordinates than supervisors, but I don't see how that's relevant. My response here was to your statement that, "If you are afraid to associate a decision with your reputation then somebody will make the decision for you." I was pointing out that someone else making the decision for you isn't necessarily a bad thing as you seemed to be implying.

> That consideration is itself a decision and it should not be delayed.

You seem to be arguing here just for the sake of arguing, even if it means arguing against your original point. By the same logic you're using here, the decision to procrastinate can itself also be a decision, which is actually the entire point of my post.

> Exactly. You have no idea until you can determine the result. If you fail early and have the awareness to recognize that failure you are in a far stronger position for all forthcoming decisions. If you wait to make that decision all the time between now then remains an unknown and you also aren't completing any resulting actions. So not only does risk increase but your productivity proportionally decreases.

Your reasoning seems to rely on the premise that you can only learn by making a decision, which isn't true at all. You can also learn by research, which you have more time to do by delaying a decision. Even without research, there are many things you can learn just by allowing more time to pass and more events to unfold without any deliberate action on your part.

An example of this could be something like submitting an application that's ready today for an RFQ from a large potential customer that isn't due for another month. Then, 2 weeks from now you find out from an acquaintance who used to work for that customer that they always valued some other piece of information being included in the RFQ submissions they review. I can't tell you how many times I've run into similar situations, and procrastinating improved the quality of the final result.

Similarly, most of the time, you'll only ever have more information available to make decisions the longer you wait, not less.

> It makes sense to wait on a decision only when that decision is both critical and costly and even then the only advantage on waiting is to perform further investigation. There is no advantage in hesitation only for the sake of hesitation, because then you are allowing external factors to influence the conditions away from what you currently know.

You're arbitrarily asserting here that external factors can only influence the conditions away from what you currently know. External factors can also influence conditions toward what you currently know. Furthermore, the longer you wait, the more you'll know, which means the more informed your decisions will be.

> This isn't something that software developers are well equipped for. Other industries have specific processes and criteria for evaluating risk in a uniform and standard way as well as the processes to apply the proper controls. These are basic trade practices that are often affirmed through education and licensing with bodies of enforcement. Software, on the other hand, does not have a commonly recognized ethics enforcement/evaluation body to define these trade practices. In practice most of this is outsourced to security professionals, for example people holding one of the various ISC2 certifications: https://www.isc2.org/ethics/

I have know idea what point you're trying to make here or how it's at all relevant.

At the end of the day, I've had enough good decisions come as a result of waiting to make them when I can to know that what you're prescribing isn't a universal truth, which was the point I was trying to make clear.

I've also had plenty decisions turn out to be the wrong decisions, which I would have known if I'd waited another day or two to make them, further reinforcing that quick decisions aren't always better than delayed decisions. Again, the hard part is figuring out when it's better to make a quick decision and when it isn't.

> If you are afraid to associate a decision with your reputation then somebody will make the decision for you. It is better to make a wrong decision early than to put that decision off to a future time. A wrong decision in the short term results in learning that can result in corrective decisions that would otherwise be absent.

While I agree with everything else you said, I can't disagree with this more.

If someone else is more qualified or better able to make a more informed decision than you are, then let them! Why worry about whether it was you or someone else who made the decision, when the real focus should be on maximizing the right decisions.

Furthermore, how do you know that a wrong decision early is better than putting a decision off until a future time? While I can think of some cases where this is true, I can also think of a LOT of cases where this is absolutely untrue. Some wrong decisions can be very damaging and irreversible. There are also many decisions that don't affect anyone adversely the later they're made up until some ultimate deadline (like turning in homework when you're younger, or filing applications for an RFQ, or many other similar things); the only reason to finalize decisions for these kinds of things earlier than necessary is to ease your own cognitive overhead rather than actually being better for anyone else.

The hard part about making decisions often isn't just the decision itself, but also in understanding the risks and trade-offs of making a potentially wrong decision now, versus making a better informed decision at a later time, and deciding which is the better approach for any given decision that needs to be made.

Additionally, almost none of the nearly 400 businesses that have been submitted or added to our site for Michigan have used squareup or quickgifts for selling gift cards, so I have the same suspicion about the preponderance of those links as well.

Also, I was looking at the helpmainstreet.com website that you mentioned in your comment and noticed they had a lot of businesses all around the country with links to gift cards. It's taken a fair amount of time for us to curate the gift card links for all the businesses on savemifaves.org, so I couldn't fathom how they could curate that many.

Looking through the links, it looks like almost all of them are links to squareup.com, toasttab.com, or quickgifts.com. I don't know about squareup.com or quickgifts.com, but when we were verifying the gift card links people were submitting (to ensure that people aren't setting up their own fraudulent gift card links for local businesses that don't already have their own way to purchase gift cards), we specifically looked at toasttab.com and realized that toasttab gift cards aren't all set up by the businesses themselves. Toasttab seems to set up their own gift card purchasing for local businesses, probably in order to reach out to the businesses and force them to sign up to claim their money from anyone who unwittingly purchases gift cards from there thinking the business must already be signed up.

So, we've had to spend a fair amount of time verifying submitted toasttab links to make sure the businesses actually signed up to sell gift cards through them, and that they weren't automatically set up without their knowledge. Otherwise, it's not going to help out that business much.

Looking at the helpmainstreet.com site, I'm a little disappointed, since I'm guessing the vast majority of businesses on there won't immediately and directly benefit from the purchase of gift cards as listed there. It's one thing to set up such a site as some sort of enterprise, but it seems disingenuous to use COVID-19 and claim that it's directly helping the businesses if it's not.

Very nice. We've built a similar tool, mainly geared toward purchasing gift cards, for Michigan. The code was built to make it as easy as possible to manage and add new businesses, so that others can easily deploy it for their own states.

https://www.savemifaves.org/

What you're saying makes a lot of sense to me, but I think the OP's comment still has valid insight. The point about the in-your-face bright colors all over the place could be addressed as easily as muting down the colors of the tags that you're not subscribed to. You could click the tags you want to subscribe to, which would instantly brighten them.

Interesting! That's definitely something I missed, thank you.

I still wouldn't expect an Electron app to subvert basic browser sandboxing by default, particularly where they wouldn't have expected to need to redirect users to other domains with cookies intact. It seems like they'd need to go out of their way to enable that.

I wonder if it has to do with the sign-in tokens they send or otherwise allowing the user to move between the browser and the app within their account. For example, when you're in the app and click "Manage Users" and it sends you to a management dashboard in the browser. or when you click a link with an auth token in the browser and it launches you into the app.

Yes, this was precisely my question. I agree with you that the post does a great job of explaining the how request smuggling works, and how they used it to trick Slack's server into responding to the user's client with a 301 redirect to the hacker's server. But then, when they got to the part where the cookies are sent, they just said, "and the cookies are sent" with no further explanation.

That's the part I'm stuck on. Is there some browser behavior I'm not remembering where it sends sensitive cookies across domains just because one redirected the browser to the other?