Ovid

That's certainly true :)

Edit: removed unnecessary political reference.

There are a couple of issues with that talk. It wasn't structured as well as it could be and it was only an hour long, so I had to gloss over or skip many topics. It also doesn't cover the topics I'm discussing here.

Also, I'm doing reading on Semco, but don't want to comment too much until I understand them better. They are, however, really fascinating. Some things would be hard for traditional companies to adopt if the company is bound into union contracts. I am, in theory, pro-union, but they're often counter-productive.

Update: for those who are into OO programming, here's a talk I give about traits (roles) versus inheritance. It's completely unrelated to this, but I love this talk so much that I want more people to know about it :) http://www.youtube.com/watch?v=cjoWu4eq1Tw

That being said, in my training I give several examples of Agile companies that either have no management or very flat hierarchies, such as 37signals, github, Booking.com and Valve. There are many reasons why they're successful and it would be silly to simply say it's because they're jettisoning management. However, we know that large companies tend to be significantly worse at innovation (Steve Jobs is an anomaly) and they also often focus on risk avoidance rather than reward.

The primary strengths of many large companies is name recognition, financial reserves, and mature products. That's very hard for smaller companies to compete against, particularly given the old saw of "nobody got fired for buying IBM/Microsoft/$insert_large_corporation_here".

Edit: as an aside, I did have a military analogy in my talk at one point and I used guerrilla warfare as the classic example of where a smaller force, with fewer resources, can take on a larger, well-organized force. In some ways guerrilla warfare can resemble Agile, but though I loved the analogy, I cut it from my training because it felt like too much of a stretch.

That being said, I've had a hard time verifying any of this stuff and it's rather a given that a company would be reluctant to air their dirty laundry.

If you look at the Feudal era (this is a gross oversimplification and varies wildly from from country to country), we had a king who gave land/authority to dukes, who gave land/authority to barons, who gave land/authority to knights, who had serfs work their fiefs. In return, the serfs had a place to live and gave food and goods to the knights, who pledged service to their liege, who pledged service to theirs, up to the king. The king also taxed every level of this and made orders of magnitude more money than the serfs.

There were a couple of interesting side-effects of this. First, while you were technically loyal to your king, he didn't have much day-to-day impact and your loyalty was to those immediately surrounding you. Communication throughout the realm was slow or non-existent, further isolating communities. Politics were local, not national, and these made made medieval intrigues all the more fascinating. Second, there were no price signals inside of a feudal society. As a result, you couldn't have a functioning economy in the modern sense.

And then about 300 years ago we had more and more international trade and many lords discovered that by displacing their peasants/serfs they could do things such as raise sheep and sell the wool for a far greater profit than having people harvesting food[1]. So you wound up with a bunch of free men traveling the land, selling their services where they could. In other words, you had one of the foundations to a modern economy: a mobile labor force.

Today, that feudal model still exists: inside of many large corporations. It's a mess of internal politics. People have loyalty to their teams and maybe their boss, but not so much to Steve Ballmer. There are few, if any, internal price signals. Internally. If you commit "treason" by suggesting Ballmer should be fired, you might get laid off, but not executed. You have hiring and firing instead of births and deaths to maintain the work force. In may respects, the modern corporation resembles the old feudal system, but sped up many times. And the king/CEO still earns orders of magnitude more money than the workers/serfs, completely out of proportion to actual value provided.

Agile itself had its roots back in the 50s, but as a modern movement in programming, agile is still just over a decade old. We don't know what's happening to the traditional role of management, but the feudal system couldn't compete with capitalism. I don't think that traditional corporations can, either.

1. http://en.wikipedia.org/wiki/History_of_capitalism#Enclosure...

Edit: A couple of tiny clarifications.

Locks on your front door knob are not there to keep out burglars. They're there to prevent opportunistic crime: someone who tries that doorknob out of curiosity and discovers a home full of stuff and no one around. There's a large middle ground between good guys, bad guys, and those who might, just might, be tempted to be bad when they find that suitcase full of money. That's what Google is missing here.

And in a condescending response[1], someone who is allegedly the Google head of Chrome security called the original author a "novice", claimed Google has "quite a bit of data" to back up their case (without describing the data, its source, or how it was evaluated), and suggested that a master password would make security worse by providing a false sense of security.

First, I would suggest that if Google really does have the data mentioned in the claim, release it. Second, a master password isn't going to make the computer safer from a determined black hat because physical access to the machine means game over, but THE MASTER PASSWORD IS NOT ABOUT PROTECTION FROM BLACK HATS.

When the colleague who hates you is standing by your unlocked computer when you're off to get coffee and suddenly realizes that he not only can read your email now, but at any time he wants to in the future, that's a problem — when your partner gets suspicious about your working long and you've forgotten to log out — when your little brother realizes he can post "funny" pictures to your Facebook page ... when, when, when ... there are so many areas where this could cause a lot of pain. For example, this is from a blog entry I wrote a decade ago about a young lady who was compromised because LiveJournal stored her username in the cookie and the conservative, religious parents found her blog[2]:

    I know of a young lady who kept an online journal.  Her
    parents found it and started reading it and were
    horrified to find out that she was suffering from --
    brace yourself -- teen angst!  Her parents don't
    understand her, not enough boys like her, she's not very
    popular, etc., etc. In reading through the journal,
    there are no references to doing drugs, sex, or anything
    else that one might expect a parent to worry about, but
    this young lady's parents hit the roof. They forbid her
    to keep an online journal and they grounded her
    (naturally, I'm sure this cured the angst problem).

Google is optimizing against black hats but pretending that opportunistic crime doesn't exist. In physical security, opportunistic criminals tend not to be the brightest or think too deeply about what they're doing, but when the opportunity is there, they go for. Google is happy to give them that opportunity.

1. https://news.ycombinator.com/item?id=6166953

2. http://use.perl.org/use.perl.org/_Ovid/journal/13471.html

Does 37signals still use SVN and uses it to host their content directly?

And the US knows that this is illegal, too: http://www.guardian.co.uk/commentisfree/2013/jun/05/forcefee...

You'd have to avoid any SSN which exists in an illegal range and you'd want the first three numbers to be consistent with where you claim to have applied for the SSN (usually the state where you were born - fewer questions). See also: http://ssa-custhelp.ssa.gov/app/answers/detail/a_id/425/~/de... and http://www.usgennet.org/usa/ne/topic/resources/basic/ssn.htm...

- State-issued driver's license

- State/city/county ID card

- Student ID

- Government employment badge or card

- Prison ID

- Military ID

So if you're creative about how to obtain other ID, surely you can be creative about how to obtain the above?

Thus, while it might be hard to verify whether or not someone is in the index, there are many people who are not in said index. Consider: why does someone's death get reported to Social Security? So someone else can claims the death benefits. There wouldn't be much incentive to do that for a child.

That being said, the older you are, the harder it would be to explain why you never had an SSN, making this much harder to pull off today.

Update: That being said, it appears that the US switched to a national data collection system in the 1990s. It's the NVSS (National Vital Statistics System, http://www.cdc.gov/nchs/births.htm) which will track the births and deaths for you.

Traditionally, the best way to do this has always been to establish a solid "breeder document". This is a document used to procure other documents and assure someone that the person is who they claim to be. Typically this was a birth certificate.

There were two general ways of doing this. One way was to apply for the birth certificate of someone already alive, but living in another state and unlikely to travel internationally (assuming you wanted a passport). However, this is less likely to be successful today given the widespread information available on everyone.

The other way was to acquire the birth certificate of someone who was deceased. In theory, you want someone who was born in one state and died in another to ensure that the birth certificate won't be stamped as "deceased".

One thing to be avoided is to scan news stories of people who died in well-publicized accidents: if others have applied for the birth certificate (having the same idea in mind) too many times, a certificate may get flagged as suspect and extra scrutiny be applied to requests for it.

Note that instructions for applying for birth certificates are rather lax: http://www.dshs.state.tx.us/vs/reqproc/certified_copy.shtm. Given today's software, it's trivial to fake a "photocopy" of an ID . You'd want the birth certificate sent to a mail drop (http://www.maildropsearch.com/) and have it forwarded on to another address for added security.

Once you have the birth certificate, you then start obtaining "supporting" documentation, such as library cards, or maybe register for a local community college and get a student ID (those are often easy to get and are readily accepted as valid ID).

Eventually you'll want to apply for a state-issued ID card. Some states have stricter requirements than others. There was a time when you could apply for one with a library card and your birth certificate, but those times seem to be long-gone. States will generally require a social security number, too.

Applying for the social security number was always the tricky bit. One source recommended altering your "photocopied" documents to show that you were under-age and then apply by mail (the Social Security card doesn't list your age, after all). If you are ready to retire, file to correct the "bookkeeping error" that incorrectly lists your age. I am suspicious of whether or not this would work.

As you can see, the process is essentially one of building momentum of starting with small, easy-to-acquire documents and working your way up the chain. It was a long, slow, laborious process and it used to be that acquiring an alternate identity wasn't necessarily illegal so long as you did not due so for purposes of fraud. Today, I believe it's illegal in all fifty state.

That being said, I wouldn't try this today (hell, I never would have tried it when it was still feasible). It's worth several penal slaps on the wrist.

I'm sure that a cunning person can take the plan above and work out how to acquire a new identity today, but I'd not recommend it.

Update: or if it's a passport you want, there are alternatives: http://www.overseas-exile.com/2013/07/buying-second-passport.... For example, http://www.diplomaticpassport.com/ is known to be a couple of shady guys who have contacts with various third-world government people in African nations who, for the right price (a couple of hundred thousand, last I heard), will get you a diplomatic passport from a dodgy country, but due to the movie "The Ambassador" outing them, they've laid low. The site used to have a somewhat larger presence on the net: http://web.archive.org/web/20070403230615/http://www.diploma...

- Obama has a secret "kill list" and has bragged about killing Americans without due process of law.

- We have widespread surveillance of our phones and email.

- The FBI admits that drones are now being used for domestic surveillance.

- The activist Supreme Court is continuing to gut our laws and give Big Business everything they want.

- The TSA is groping and nude scanning everyone, they've never caught a single terrorist, but are expanding beyond airports.

- Half of the inmates at Guantanamo have been cleared for release but are still detained a decade after incarceration.

- Half of America is in poverty.

- The Obama administration is trying to gut the Freedom of Information Act by denying certain doesn't even exist.

- The Supreme Court and various politicians are finding more ways of restricting the right to vote.

But people won't shut the fuck up about Kim and Kanye's baby.

It's 1984 meets Brave New World.

The article mentions one case where a judge refused to issue a search warrant for a narcotics investigation and instead the police brought representatives from the Virginia Department of Alcoholic Beverage Control and raided the place with a swat team to conduct an alcohol inspection. What did they find?

Two sample bottles of beer that weren't labeled as samples and a bottle of vodka in the office. The fourth circuit court of appeals upheld the search. According to the article: So for now, in the Fourth Circuit, sending a SWAT team to make sure a bar’s beer is labeled correctly is not a violation of the Fourth Amendment.

Also, it makes me very happy to know that you're aware of this problem and are trying to tackle it. It makes me more likely to recommend it to clients.

Are there side-effects? Is there a small percentage of the population who will react badly? Are there long-term effects? I don't believe we yet know the answer to any of these things.

I'm all for the advance of technology, but this seems wrong.

If you've described that accurately, you're hurting some of your customers. It's not well-known (though it should be obvious, in retrospect), but a test can produce a false positive when, in fact, it's a negative.

The problem is that there is always noise in customer data and sometimes you'll randomly have enough conversions such that one of your tests will show a winner when it's not.

Matts Einersen has some simulation code to show this: http://www.einarsen.no/is-your-ab-testing-effort-just-chasin...

Evan Miller has a more in-depth (but harder to follow) discussion here: http://www.evanmiller.org/how-not-to-run-an-ab-test.html

If, in fact, you show the winner as soon as significance is achieved, it's then trivial to demonstrate that some of your customers will lose money as a result. However, if you take this knowledge and then find a good way to incorporate this into your tool, you may have another great selling point that competitors do not (that being said, the idea is complicated enough that some customers won't understand it).

> If we see consistently that people, for instance, don't like playing with you, that you're consistently blocked, that you're the subject of enforcement actions because you're sending naked pictures of yourself to people that don't want naked pictures of you... Blatant things like that have the ability to quickly reduce your Reputation score.

If you think about it, what he just said is "Microsoft is quite happy with you using Xbox one to send naked pictures of yourself so long as everyone consents."

On one hand, that seems a very fair attitude. On the other hand, that's a very provocative statement (but probably not so much for the target audience).

Update: I also suspect that the question is not whether or not this system can be gamed, but how it will be gamed. It seems a simple enough idea, but trolls are going to have fun figuring out how to exploit this. They know there will be a "troll hell" that no one wants to be in and they'll do everything in their power to figure out how to push people there.

That being said, I love this idea (I'd probably love it more if I were a gamer).