HN user

jabbany

1,732 karma

Lurker. Do not contact.

Posts0
Comments463
View on HN
No posts found.

I think it's just because supply-chain attacks are not common enough / their attack surfaces not large enough to be worth the dev time... yet...

Sneak in a malicious browser extension that breaks the permissions sandbox, and you have hundreds of thousands to millions of users as an attack surface.

Make a malicious VSCode/IDE extension and maybe you hit some hundreds or thousands of devs, a couple of smaller companies, and probably can get on some infosec blogs...

Operating systems are different though, since their whole purpose is to host _other_ applications.

FWIW, MacOS isn't any better or worse for security than any other desktop OS tbh....

I mean, MacOS just had it's "UAC" rollout not that long ago... and not sure about you, but I've encountered many times where someone had to hang up a Zoom or browser call because they updated the app or OS, and had to re-grant screenshare permissions or something. So, not that different. (Pre-"UAC" versions of MacOS didn't do any sandboxing when it came to user files / device access)

Browser extensions also have a relatively robust permissions-based system.

If they wanted to, one would guess that browser-ish local apps based on stuff like Electron/node-webkit could probably figure out some way to limit extension permissions more granularly.

There's a chance that they might stall you and never actually pay (or chargeback the invoice).

That way they'll get a free link for at least some amount of time, and if done at massive scales correctly, it could bump some site up the search results for long enough.

The article mentions having the OP send a PayPal invoice...

Pretty sure the other side is not gonna pay it unless you follow through (i.e. they could always charge it back and claim you never delivered the invoiced service, heck they might do that even if you put up the link!)

I'd say China doesn't have particularly tight_er_ information control than other places, they're using the same tools everyone else is using (keyword/hashtag bans, algorithmic content demotion, "shadowbans" of responses, and outright content removal etc.)...

It's mainly just that there's more politically motivated manipulation... versus in the west where those tools would be used on things like copyright infringement, pornography, and misinformation etc.

Right to repair just means for those that do want to repair it, they can without any undue burden.

If you don't want to repair it, nobody is forcing you to! Just throw it away like you would have done anyways.

The point of right to repair is that there is a non-zero amount of people who want to repair stuff and it shouldn't cost the people who don't anything extra... It's a "right" not an "obligation"...

But if you go to a shitty concert, you don't get your money back. If you buy a shitty album, you can't get your money back. And you can't get the band to "make it better" for you.

The difference is whether "shitty" is subjective or actually defective.

Like, if you don't like the music, that's on you, someone else might like it.

And, I've certainly been to concerts / movies / events where there have been "experience-breaking" technical difficulties and they've (partially or fully) refunded the tickets.

It doesn't have to be though?

The provider could reject further access to them (reads / writes) once the limit is reached. The cost of actually keeping objects as "cold" storage has a natural cap per billing cycle since those are billed based on time.

So, as someone who has lived in regions with pretty severe internet censorship in the past and built circumvention software back in the day, I've always pondered the idea of whether one could build a fax-based thing like this for browsing the web. Kind of as like a "last resort" system.^

Could have a form that you fax in with, like a URL and session info (cookies and stuff), and then it faxes back the page, and you can circle stuff and fax the page back to interact and "click on" things.

Plus, since computers can ingest faxes, you wouldn't need to waste paper printing everything out, and could just do everything digitally. But you still had the option to use paper and a fax machine if you really need to.

^: Yes, I know faxes are unencrypted and phone lines can be tapped. But I've always found the idea intriguing. Plus having some emergency point-to-point communication to bootstrap things like key exchange could still be neat.

I wonder if OCR could be improved by adding a "language model" of sorts...

Like, sure, maybe it's hard to tell apart a "1", "i", or "l" purely visually, but if you knew it was supposed to be code, I'd suspect one could significantly improve the recognition accuracy if the system just worked in the probability of each confusable option given the preceding (and following) text.

PVP and leaderboards attract a different audience than normal gacha players which is why it tends to be rare-ish in gacha games. (Almost none of the popular ones focus on it).

Most of the time, the social aspect of gacha is to show off your "collection" rather than to show off your "skills", so adding PvP and leaderboards doesn't do much for most players. Instead, gacha games tend to have "social" features that do let you show off your "collection" in some way, like profile cards with character showcases, "supports" mechanisms that let friends and strangers borrow your characters, or sometimes just blatantly a score for your gallery completion %.

Also FWIW, Genshin actually has PvP, it's just that it's only present in the card battle mini-game. And my impression (could be inaccurate though) of that is most players are not particularly "into" that mode.

Very perplexed about this too. The only reason I can come up with is to prevent people from copying the content?

But that doesn't make much sense either TBH. The page's content is not obfuscated, so this does nothing to stop a content scraper script. Plus, even a not particularly technical user can just turn on reading mode and get at the text anyways...

Not really, it skips over utility based shopping entirely.

Everything in the article (after the bit about utility vs signalling) assumes the thing you're buying is primarily meant to increase social capital (as a gift or a display piece [which may still have utility]) and then explains how to get the most for your money in that case specifically.

Where do they imply that?

The article literally shows two examples of ads for trucks, one advertising utility and one signalling...

The fact that most ads _today_ focus on the signalling type speaks more about how consumer goals have changed, such that more people are buying for signalling. It doesn't imply that is the only reason, just that it's an increasingly _common_ one.

Based on what's being described ("career criminals") it doesn't seem like that would be a good deterrence.

A security guard is going to be looking out for their own safety and well-being before any property they're guarding. What do you think is gonna happen if armed criminals show up against a lone guard being paid $35 a night...?

I agree with all the points on top. The proper instrument to do this would be banks setting up a system that lets people borrow against an illiquid asset, in this case would be CNY, but it's not anything new... (and is one proposal for how to work with cryptocurrencies). That would price in the political and market risks.

---

The last one I don't agree with. This is different from the 2008 crisis in that the 2008 crisis was primarily "internal" and for the most part zero sum --- some people gained, some people lost (kind of loosely like a long-horizon pump-and-dump scheme), and at the end things revert to the original non-inflated value.

This situation is more of an encouragement of external injection _into_ the economy. Rising prices are due to external capital flowing in (and the anticipation of more to come). Even if it were to pop, things would be no worse than a hypothetical alternative timeline where there was no bubble. And that's assuming no external capital actually flowed in, that not a single person wired money into the country. Clearly this is not true, and the money coming in is still net positive. So _in aggregate_, the economy is still improved due to the injection. Again, these gains are not spread evenly, and it may be the case again that some individuals will be hurt while others reap large returns.

a generation’s quality-of-life gains going down the tube

If anything, that just means the previous quality-of-life gains were achieved by overdrawing against the future... nothing new here.

You don't know. The paperwork's fraudulent.

They don't offer these services to anyone. Because the paperwork is fraudulent, a lot of people involved are/will be personally implicated (could easily lose their job and/or face legal challenges on top) in the scheme. It's not like banks are not monitoring delinquency/default rates already, and if the stats are start indicating problems they will certainly investigate...

So while outside observers can't verify anything, those perpetrating the scheme do have to balance their own personal risk and many will in exchange request invasive details around the clients' assets in China to cover their own ass. Not admissible evidence to the bank, of course, but they're not handing these out like candy.

The Chinese property market is in freefall.

Realistically, people involved have already sold so this doesn't affect them. At least in the Vancouver area, the brokers (who are the usual point-of-contact to the clients) won't even proceed unless you've already sold and have the cash.

And capital controls can get tightened.

This is the main real risk that those in the scheme look out for, but it's a geopolitical risk rather than a market-based one. Which makes more sense when rates are high, like now. When rates were low, this didn't happen as much since there are plenty of clients to go around.

---

Also, in the grand scheme of things, even if the bubble bursts, the broader economy is still not worse off. Each cent paid into these mortgages is real "new money" being introduced into the economy. This is not the subprime mortgage days where at the end it became just a transfer of wealth to the banking industry. For the most part "the public" is not the one being defrauded, it's China...

This is somewhat counterintuitive but... the fraudulent mortgages are not more risky, they are often times more stable than other local borrowers.

I think what many people are imagining is the subprime mortgage situation of yore. But in this case, a lot of the "fraud" is the result of knock on effects from capital controls in the PRC. Many (new and aspiring immigrants) have capital from sales of their property in China, but due to capital controls, cannot get it out quickly. They have to do it in $50k/year chunks.

Usually a loan or mortgage is the solution for this, but those depend on _income_ rather than _wealth_, so normally these people can't take out as much as they need to, even though they could easily back actual value of the mortgage. So there's a little collusion between banks and mortgage brokers to get in on this market gap (probably more so now that interest rates are high, which these borrowers are much less sensitive to).

Of course, there are risks, but those risks are tied to more geopolitical circumstances and less market-driven, and apparently banks are more willing to take their chances on that.

Yup. Hence the capital control (less money leaking out means an easier recovery after the bust).

Of course, as is rational in capitalism, this just makes it even more urgent to skirt the capital control, lest you be caught with the burden of the bust. This was also why crypto was even an option for doing this, for a short while at least.

this behavior goes overboard and everything crashes

Maybe... but you need to keep in mind most of these people are not really building a bubble. Unlike the subprime mortgage crisis, where things were built on inflated valuations, many borrowers in this "scheme" do have more than enough funds to cover the entire mortgage. It's just that their capital is relatively illiquid. This is also why the high interest rates have not significantly affected this.

The effects on housing cost is because of natural market merging where chinese properties are "overvalued" domestically. This is actually not new, and happened with Japan at some point as well.

That being said, the main risk for this is actually geopolitical... Should capital controls tighten (or, like, if war were to occur etc.) then there is a much bigger risk, but many are banking on the fact that, at least given the signs today, that is still unlikely.

Foreigners are not fully exposed to the local market though, so there's no need to do capital controls. _Income_ is never an issue, as there are taxes to cover that. The main thing being cracked down on is people moving accumulated _wealth_ out.

Also, things have changed _considerably_ since 2016 (as these things tend to do). Indeed, nobody --- foreign or domestic --- needed to document use as long as you stayed within the $50k (you would be asked to if you went above that). Later it became a mandatory question, but wasn't enforced. These days it is enforced rather strictly. If you claim education, you need to provide statements of tuition and housing etc. For tourism there's similar requirements, and usually they limit discretionary spending budgets to ~$10k.

You can label it however you want, if both the lender and borrower are willing participants, it will be difficult to prevent this from happening.

Like mentioned in the article, often times the material is very obviously suspicious and banks probably know this and still turn a blind eye to it because these borrowers are low risk and much less sensitive to the high/rising interest rates of today...

But even Chinese citizens can also pool those $50k yearly allocations, it doesn’t take a lot of friends and family to do that.

So as an observer of this, you will see money coming out of one place, spread to many accounts, wired overseas to different recipients, then re-aggregated...

What do you think that looks like...? Surely not money laundering?