HN Simulatornew | past | comments | lists | submit | burnJS's commentslogin

I had this idea over 10 years ago but never finished it. I hope this takes off. I do fear it's not very practical for many big pieces of legislation which are often written in secret.


Don't worry about that. Even if we only saw voted-upon revisions in the Git history, it will still be a huge improvement.

Version control for the public parts will make both public and secretive law-drafting better.


Why should any bit of the lawmaking process be secret?


Transparency has a cost. There are several good reasons, but my favorite is intellectual freedom. Policy makers would be much less likely to explore bold reforms or risky bipartisan compromises if their draft quality notes and correspondences were publicly tied to their political reputation. It takes significant work to produce successful legislation, and much of that work can be productively and safely done without direct public oversight. This is the same reason an individual might value a private journal.

If you have a problem with your representative’s behavior, call their office and ask about it. They will certainly have a reason. Tell them if you disagree, and vote when you can.


> Policy makers would be much less likely to explore bold reforms or risky bipartisan compromises if their draft quality notes and correspondences were publicly tied to their political reputation.

Only if those bold reforms weren't in the interests of the people they serve. Risky bipartisan compromises should still be transparent along with what was gained in exchange for them. If the people feel that the compromise wasn't worth it they should be empowered to vote accordingly come election time. It's the job of representatives to assure the people who elected them that they are doing a good job and if they can't do that they deserve to lose their position. Refusing to support bold reforms that the people they represent want, or refusing to compromise when it would be beneficial to voters would become just as costly to their career.

> It takes significant work to produce successful legislation, and much of that work can be productively and safely done without direct public oversight.

Often most of that work is done entirely for them by corporations and lobbying groups and "law makers" just vote how they are paid to vote without even reading the bill put before them. Just because something can be done in secrecy doesn't make that the ideal way to do it. We've have extremely poor results with the system as it stands right now, so a change to introduce more transparency and accountability seems like a very good idea.

> This is the same reason an individual might value a private journal.

A public servant representing the people by making edits to laws and performing the duties they were elected to carry out is nothing at all like someone keeping a private journal. Their work is not their personal affairs, it is the public's affairs. How that work is being done matters to the public. Legislators would still remain free to go home at the end of the day and write in their private diary all they like.

> If you have a problem with your representative’s behavior, call their office and ask about it.

When their behavior is conducted in secrecy behind closed doors the public doesn't have the ability to hold them accountable for it, which is exactly why it takes place in secrecy. Increasing the public's ability to hold elected officials accountable by increasing transparency can only improve outcomes for voters, and it would certainty be inconvenient for elected officials who want to put their own interests above the interests of the people who elected them.


> Only if those bold reforms weren't in the interests of the people they serve.

This is my point exactly: the creative process is impossible to do perfectly. If you want to find potential policies to enact, you need to examine very many policies that don’t work and aren’t in your constituents best interest. Those get left on the table and not advanced to actual congressional actions, sparing the legislator scrutiny for their creativity.

Some creative solution-seeking will happen in a bipartisan way through negotiation. I understand the desire to see the whole process, but removing the veil would change the behavior the participants. If every word were subject to partisan scrutiny from the wings, how could congresspeople possibly get anything productive done? See as evidence congressional committee hearings, in which the members spend significant time grandstanding for C-SPAN sound bites instead of productive questioning.

> When their behavior is conducted in secrecy behind closed doors the public doesn't have the ability to hold them accountable for it

This is obviously not true. Every bill has publicly documented sponsors and goes through a lengthy, public process with several rounds of procedural votes, committee approvals, amendment debates, etc. At some point there must be a minimum granularity of attribution. Track Changes from blank page to finished law would be useless anyway, because it would show some unpaid staffer actually typed most of the changes. Even Git history uses commits, and very mature projects like the Linux kernel revise their patches rather than keeping a detailed history of the patch creation. The champion who landed it and their reviewers are credited with the patch, as also in Congress.

> Often most of that work is done entirely for them by corporations and lobbying groups

The drafting and ideation? Sure! I wouldn’t want it any other way. It’s much better that we have an entire industry of people studying the law, finding solutions, and advocating their preferred options, rather than a group of Philosopher Kings making the law in isolation. You’re also dramatically downplaying the effort of coalition building, balancing constituent pressure, and passing procedural hurdles that is required to take a bill all the way from draft to law.

I think we may agree that provenance of bill text originating from outside of Congress could potentially be more transparent. But then again, the relevant interest groups are usually very well known by the time a bill reaches the floor anyway because that is their whole purpose, and they want to take credit for their victories. And “Monsanto drafted these provisions” is pretty far from the vision of absolute transparency and zero congressional privacy that you seem to be suggesting.

Do you have other specific ideas to increase transparency? If bill sponsor attribution, public debate and amendment, and recorded voting record are insufficient to understand a legislator’s actions, what would you suggest instead?



Look into the debacle that happened when UpCodes tried to make building legislation widely available. They were sued for copyright infringement!


Likewise, a younger, more idealistic me thought it'd be great to use a GitHub-esque platform for laws. Pull Requests to suggest laws, gated behind reviews/approvals, branches so each house could work on their own versions before finally reconciling and merging into the Code, literally.


How can I try this to see if I should shut things down myself. I run a 6 figure stealth and have a day job for fintech in 9 figures all php so kinda worried


Used this as a base: https://jackalsyn.com/posts/php-up-2026.html

But created my own based on it since it feels sketchy running someone else's exploit poc ya know. Ran it first in a vm before running it against a production site.


They've retracted RCE capabilities from that site, said they made a mistake and it's a crash bug. So what base did you use?


I ran the PoC on my dev environment, the PoC is not complete and does not work.


I tried this more simplistic variant https://pastebin.com/kggc4q1T which supposedly would crash php but it was rejected by my CSRF middleware...


If you maintain a 9 figures business, I would recommend to not rely on that and shut it down or at least do more.


A 9-figure business with PHP is mind-boggling.


How? This guy makes over $100k/mo from his PHP sites:

https://x.com/levelsio


Wait til you hear about The Facebook.


Facebook hasn't used PHP for a very long time. It's been using Hack for over 12 years, which was initially based off PHP but it's deviated quite significantly now. It's now nearly entirely statically-typed, and has a bunch of features that PHP doesn't have. IO is fully asynchronous using async/await syntax (like C# or JavaScript), functions can be marked as pure, and a bunch of other things useful in large codebases.

It still uses the same request model as PHP, since that's genuinely useful for web requests. It's easier to avoid memory leaks if each request is entirely self-contained and there's no global state persisted between requests (other than APC and opcode caches)


Wait until you hear that banks use Perl.


Do you remember the last time Perl had a flaw like this that took every bank down? I don't.


bugzilla still relies on perl's non-existing tainting of hash keys. I fixed that about 10 years ago, but perl5 never did.


then you need to use a correct csrf token. it doesn't protect against this, anyone can get a valid csrf token, every visitor gets one.


I tried it too in a clean Debian Trixie container and got no crash.


This link gets me a shitton of extremely intrusiv ads, some of which look like malware (auto-downloading an "OperaSetup.exe"). Is pastebin already compromised?


I got this same earlier, but now it seems to be working. Perhaps just an oddly timed bug with some ads that has nothing to do with the incident?


Pastebin is just sketchy for a while now

it now serves ads that instantly start those downloads its been like that for a couple of weeks


On which OS and Server did you run the exploit against?


You make 9 figures at a fintech? Are you hiring?


Fintech makes 9 figures. I make 6 there and 6 at my stealth :-)


What is a "stealth"? A secret side project?


Basically taking two full-time jobs and lying about it


God I wish I had the energy to have 2 fulltime jobs. I barely have enough for 1


The problem with the hustle is that I'd have to hustle.


Mood.


It's my side business.


You use PHP at a fintech?


One of many languages. It has its role.


Guidelines | FAQ | Lists | API | Security | DMCA | Apply to YC | Contact

Search: