Looks like a DevOps guy is going to take the blame for this: "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." https://x.com/binance/status/2115993361517891592

If a compromised laptop was the entry point and that allowed someone to steal 6 billion dollars, it’s not really the engineers fault, right?

"A loss of X dollars is always the responsibility of an executive whose financial responsibility exceeds X dollars." - Weinberg’s 'First Principle of Financial Management' and 'Second Rule of Failure Prevention’ - 'First-Order Measurement', Quality Software Management, Volume 2, Gerald Weinberg

Well it is engineers fault. But not that engineers. Some engineer designed a system without extreme oversight that should be involved in the process.

If you follow that trail far enough it's whoever designed cryptocurrency, right? Because banks can and do reverse transactions as last resort.

We have determined that the initial conditions of the universe and the laws of physics are at fault for this incident.

Banks can't reverse wire transfers. Unless there is some super-level intervention that is very rarely used. But they can trace where it went.

And the amount of process and control around a wire transfer is monstrous to reduce risk.

Watching crypto rediscover 100yr of financial regulation and system/process design has never not been amusing to me, esp as someone who works in an asset that has solved the custodianship problem (not that people in the industry aren’t actively attempting to light those safety rails on fire to make a few extra bucks).

What frustrates me is I _still_ can't buy a burrito with it! Cmon guys, I would gladly have a smart card or rfid phone app to efficiently move petty cash around and cut out the $0.50 that big banks make on every transaction. I won't have any more than $300 on it at any given time, so if I lose it im not out of a life savings.

Nope, using money for everyday purchases is not kewl enough for the bored apes.

Banks had 100 years to refine the user experience. Crypto is everything opposite of a good UX.

You can build a 0$ fee system, but how are you going to finance its support, KYC to prevent mad ransom money laundering, etc?

then: "big business and central finance are the reason fiat money sucks"

now: "big business and central finance are the reason digital money sucks"

A bank can't unilaterally reverse a wire transfer, but in practice they can. If two banks realized 20 minutes after a wire that it was an error/fraudulent, the receiving bank could freeze the account and then work to send the money back in a new transaction.

This kind of low bar reminds me of FTX

More like Mt. Gox. FTX was downright fraud, from day one. SBF was already lying about Alameda's supposedly insane returns when it was all a ponzi.

He got tried and jailed for a long time for fraud.

Mt. Gox was just incompetence, like Binance here. But then on the other hand Binance is making so much money that to them $3.5 billion to cover the losses is just a slap on the wrist.

Did they get enough time to design and test in properly?

If nothing else it shows a complete disregard for insider threat.

Nope, that engineer had far too much access. I'm confident this is the case in pretty much all organizations to some degree, but a lot of engineers are also the only ones that can deny themselves the access so in a roundabout way it's their fault anyway.

But a lot (generalizing here) don't like giving up access "in case they need it". I haven't worked backend in ages, but years ago there was one developer that went to the ops guys and said "can I just ssh to production I need to check some env vars to debug my software" (or something to that degree). Ops team was good and it was a hard no - "just add some logging, you can deploy a new release quickly enough".

It's not a access thing, it's a security control.

For example at most good crypto companies that hold wallets it's not possible to ssh at all, even if someone asked and go permission. It just simply isn't possible short of having a AWS root key or physical access to a computer in a DC.

There is no login, no accounts, no ssh keys or similar, they are immutable containers running from images with a signed SHA. The SHA can only be built by a build system that has it's own set of strict security controls.

Without details, I don't know why a comproised laptop would make any difference unless it submitted code through a PR and had it approved by multiple people.

I worked on a non-crypto, sensitive financial system two decades ago and similarly the end servers that ran the application stack were severely stripped down Linux instances with no shell, no interface to interact with outside of an application command channel, the hosts that could access that command channel were air gapped, and still the entire thing was wrapped in three layers of transaction auditing that were entirely disassociated from one another (different devs, different access, different source of data for auditing the same record).

I cannot look at how these companies are run with anything but derision. It’s institutional laziness, and it’s sloppy.

> access "in case they need it"

A good solution to this is to have a "break glass" system. Ie. access permissions get granted to the developer directly in an emergency by going through a set of steps available beforehand. All requests by that developer are then allowed, limited to 10 kilobytes of results per minute and logged.

For example, imagine you run a bank, and a rare code bug means that at exactly midnight on new years eve all bank balances have $1B added to them.

Your oncall takes down the production servers to to reduce losses and uses the break glass system, by getting approval from n other developers, allowing them direct database access. They use that access to count(accounts) with a balance around $1B or more, see it is everyone, and subtract $1B from them all, before bringing production back up with an older software release. Downtime = 2 hours.

In the morning, all the developers actions are reviewed.

If the developer turned evil and trying to dump the database, the n approvers and 10 kilobytes per minute would reduce data loss. But the break glass system still lets the developer make fairly major emergency fixes to reduce losses or downtime.

Break glass systems are very good but they are also challenging to make. It requires at minimum a system to get approvals from n other people and a system to do logging. It means your authentication and authorization systems must both be working, at least a small amount of non-volatile storage is available, and this often implies the availability of more foundational services such as service discovery, name lookup, distributed consensus, and replicated storage.

The problems can be overcome, but management types may balk at the cost of a complete break glass system.

I won't argue against your critique of the method, but the number of customers angry at you in the morning would be many orders of magnitude less.

It depends on what the engineer did to the laptop and if it’s his fault. If it was a vanilla install, and he didn’t do anything shifty to try and get around the device management access and permissions then it isn’t his fault.

Not only. I'd say the fact that something was stolen might be the engineers fault (depending on how exactly the laptop was compromised). But the amount that could be stolen like that is just ludicrous.

We have no idea if this is accurate or honest or if engineer did something negligent.

Laptop? Was it a company laptop that remained in the office, locked up?

If the engineer, without being hacked, could take 5 billion dollars from your company and flee the country to go buy an extradition-free island, you have already gravely fucked up as an enterprise. The only way this happens is if your system is designed to allow this to happen.

This is how virtually all "crypto" exchanges work -- especially the closer you get to "shitcoin casino". Proper role and system isolation is a challenge if you support just one cryptocurrency. It would be incredibly hard for dozens, assuming service supporting dozens bothered.

I agree it's a grave fuckup but its a common one. You should just assume that when you deposit coins somewhere there are dozens of people who could just walk off with everything on their own. It's remarkable that it doesn't happen more often.

I recommend everyone to move your plantext secrets from ~/.kube/config, ~/.ssh etc into a password-manager. You can tell Claude to adjust the config files to get the secrets from 1Password when they are needed with TouchID requirements etc.

These days I’m getting so many 1Password prompts for agents pulling env variables out of it and with very little context of what is being accessed by who (The dialog 1Password shows is pretty bad) that it would be very easy for something to slip in there.

> I’m getting so many 1Password prompts for agents pulling env variables out of it and with very little context of what is being accessed by who

This is a one-sentence horror story. I almost can't believe someone would let this happen, unless the 1Password account is not important (highly unlikely).

Permission fatigue is real.

I know it sounds bad, but it’s the reality for most people, just like permission prompts at every corner and after each macOS / app update (“Your screenshot app is watching your screen”, no shit, that’s why I installed it).

What does your sandboxing look like that you’re willing to give agents credentials real enough to store in 1Pass?

The dirty little secret of our industry is that everyone runs agents with full disk access on their machines as there's no good way to sandbox it. This also precisely why Apple posted a newsroom article a few days ago about this topic: https://developer.apple.com/news/?id=p6zjojqw

Blaming this on the user is a bit like blaming someone for doing their banking on their regular day to day computer instead of an air gapped machine.

Yeah, I don’t know about that. We use VDI and dedicated agent accounts. Sort of like I’ve got my super user account for production server access via a different VDI, now I’ve got my -agent account for the agent VDI.

Speak for yourself :-)

I have been using Yubikeys for years, according to this guide: https://github.com/drduh/yubikey-guide

The nice thing is that using the private key requires physical touch. That means that AI itself (or a remote attacker, for that matter) can't do things unless I confirm.

> The nice thing is that using the private key requires physical touch.

Yeah (not talking about crypto): yubikeys (or similar) are really sweet for that. I've use them for ssh / pushing / fetching from Git etc. I use them for 2FA to various services etc.

There are also similar devices where you enter a PIN and the PIN to register to a service the first time and then the PIN to auth are different. So you can't be tricked by mistake to register to a new service when you just want to auth (you could still be tricked to register to a service which ain't the one you think while registering, but never while auth'ing).

And yup I use that with AI all the time: my agents go inside a container or inside a VM (or both), and the damage it can do is very limited.

It's also possible to do passthrough of devices (GPU, USB, ...) to VMs: good stuff.

if $5.6B is protected by your index finger then you're gonna need kidnap insurance, and a really good pair of gloves.

It's not protected by the index finger at all. There is no fingerprint reader in a Yubikey. The only protection is that it requires physical access and can't be triggered from software.

If you're not buying the biometric ones, sure. Now you don't even need the gloves. Maybe kneecap armor instead.

The point is the attacker has to be near you and mot somewhere around the globe

My point is that the bigger mistake is an individual holding access secrets at all, irrespective of medium.

Sigh. I forgot I posted this in a crypto-related thread.

I am not interested in cryptocurrencies. I am interested in people underthinking their risk profile.

How would that help when your workstation is compromised? They can just steal your authentication the moment you log in through the password manager

It does help in that the secrets are not in plain-text, readable for any script you run. With 1Password, a process asks for the password and it gets transferred not through the filesystem but through IPC. 1Password shows a dialog: "Do you want iTerm to get your SSH key ABC123?"

In my thinking, this is more secure than plaintext in filesystem

Maybe. Maybe not. It depends on the sophistication of the malware. Generally my impression is that these install-script type attacks cast a wide net. I would hazard a guess that they would not know how to even ask my 1Password for the keys. They are in an account they dont know, in a vault they dont know, and have a name they dont know

They don't need to ask 1Password for the keys, right? They can just take the kubectl auth once 1Password provided the key. But I would also bet any halfway competent script kiddy can vibecode credential stealing for the top 3 password managers these days. Heck, even open source red team stuff like this have it: https://github.com/efchatz/pandora

Not necessarily. defense in depth can help. At least forces an attacker to have to chain exploits, which although not impossible it makes it harder. Having root on a system doesn’t necessarily give you access to things that require touchid/yubikey/presence.

Sure, but is your system compromised because someone left a key in plaintext? Attack surface is finite and can be meaningfully reduced.

My secret is `4`. Is that ok? Do I still need to move it??

4 is fine, but only if you’re a certificate authority.

I use 'Solarwinds123'

as for ssh keys, you can generate your keypair in secure enclave and reuiqre touchId for every new ssh session. The private key never leaves the secure enclave.

Probably the better option instead of relying on a password manager.

It is a tradeoff. When using secure enclave, you need a second backup keypair in cold storage that needs to be secured.

Isn’t the password manager a prime target too?

you know most password managers have open sockets, or other channels to other local processes to interact with and allow stealing entries?

you know most tools like gcloud, bitwarden, etc store auth keys just in dotfiles too?

Local compromise is KO now, and we can't do shit on platforms like MacOs didn't research Linux recently

It’s true that they have their own attack surface but it’s not necessarily just open to the world.

The fact a single devops guy has the access to do this is the actual issue

They claim the attack wasn't just "compromised laptop ==> drain wallets" but had more steps in-between, with the attackers using image registries as an entry point into their systems.

One person's key probably should not be enough to move billions no matter who it is.

"No other human activity poses this level of danger." I know this is a bit over the top but let us look at some of the most pressing issues in the world today: global warming, nuclear weapons, wealth inequality, war, technology dependence. Wouldn't a much more capable LLM in the wrong hands make these accelerate faster in the wrong direction ? Many of us , me included, have this mental model of a rogue Terminator-like AI but what I am most worried about is these LLMs in the hands of people. Look at what we have done to this Planet with the tools that we have so far, we have repeatedly tried to subjugate , enslave and kill each other because of things as peety as skin colour , tribe , religion and who owns which patch of land .

I don't have faith in the human race as is to do the right thing when handed these tools , you can already see the nonsense like the fake nudes , fake news and all that other filth being pushed on social media by people with access to relatively daft models. What happens when we can package a Mythos 5 level model in a box , when any war lord , supremacist or religous zealot can access these ? , You now you have your personal bio-chemist and nuclear physicist in a box.

The tool in itself is not what I am worried about , it is the human in the loop. I don't have an answer to this but i believe it is something we should all take a moment to think about , just think what a different world we would be living if any random person could buy a nuclear weapon off the shelf ? There are extremes to both ends , you can either worry way too much or don't care at all, I believe the best place is the middle ground were we actively think this through instead of using our usually "Move fast and break things" mode..

Claude down, ChatGPt down , Grok down. This is the new "Stackoverflow is down" ... FYI Stackoverflow is not down https://downdetector.com/status/stackoverflow/

SO has previously been up, so your comment has been closed as a duplicate.

I hated that part of SO so much. Almost every time I got a SO result on google it was exactly the issue I had and without fail the question would be closed as a duplicate pointing to something that was different enough to be completely useless to me.

my greatest achievement is having a question on SO closed for being too narrowly focused and unlikely to be useful to anybody else, and then a multi year history of notifications about "you've earned a popular question badge" for that same question.

When you had 8 SO tabs open around your issue and the only true relevant one is closed as duplicate. I do NOT miss those days.

The single most annoying thing about trying to actually ask a question on SO. No overzealous editor that's actually a different error and library entirely...

While AWS and CloudFlare are becoming synonymous to The Internet, these AIs are becoming synonymous to The Brain & Thinking for most people out there where losing access to them for even a short time, make them quasi-paralyzed and I really start feeling this now as I haven't written a single coding function in two months now but just a few lines here and there.

So creativity is going to skyrocket!

My god, for a minute there I thought this was real.. This resonates, I bet a number of us know or Are an “Aaron”. Thanks for this.

I'll admit, I was really hoping the end was going to be like, "And that's how Aaron Kalshi created a £XX billion company."

I thought it was going to be about Aaron Swartz.

I immediately noticed something was wrong when the "daily tech message board" appeared. Before that point, I 100% believed that this was a real story.

"Unnecessarily abstract phraseology. Constantly using inanimate nouns as the subjects in sentences in order to unlock variety in verb choice, especially when it helps construct a sentence where the real action can 'land' like a surprise at the end." This. Thank you for expressing this so eloquently. I've tried to put a finger on this and you've done that for me. I wonder what the solution could be , Ask Claude to "Dumb it down" , "Speak plain English" ? I have even thught of building some sort of "middleware" that fixes all this.

I’ve asked it to use plain English, avoid jargon, explain terms before introducing them. Its first response was to make memory, it forgot after 5 prompts, then it suggested claude.md. Looked good at the start of a session, forgot after 6 interactions. Then it continued suggesting other locations, sometimes correcting its own corrections. Same effect, so today I got annoyed again. And then it suggested a new thing: add a script in a Stop hook in settings.json. I added another one to the PreToolUse, hoping to prevent it from running all kinds of experiments I didn’t ask for or approve of. I still have to see where this ends up.. Maybe this can help you as well.

I wrote a harness for running tabletop RPGs. One of the key things to keep the LLM behaving correctly (such as not controlling the PCs) was being able to inject instructions with every new prompt, which I don't include in the history.

It seems like all harnesses could benefit from something like this.

Setting an output style (https://code.claude.com/docs/en/output-styles) definitely yields way better results than just relying on memory or Claude.md

I frequently tell Claude to use "simple, concrete language and uncomplicated syntax, and avoid project jargon, coinages, and abstractions as much as possible," to good effect.

African scammers used to be small scale or lone wolf type of operations. You had scammers like Hushpuppi etc who become celebrities John Gotti style. Now the Chinese have taken over , they are moving from places like Malaysia and setting up these huge scam compounds , they combine the legitimate businesses (construction, import/export) with gambling and these crypto, mobile money and pig butchering scams. This is only going to grow , no one is forced into these things, the youth willing seek work at these places, they are recruited, trained and given the tools they would never afford on their own. You have Chinese labs setup with Servers, high speed internet, USSD capture machines. Our governments won’t and do not want to do crap, the officials get the bribes , the youth get work and everyone is looking the other way. So yeah , this is only going to get worse.

Chinese criminal syndicates have even begun to conduct lure and abduct Indians into scamming centres. They do this by posting fraudulent online job ads leading Indians to clandestine compounds in the golden triangle nations. And then confiscate passports after they arrive, restrain them and then enslave them using threats of physical torture, electric shocks, and isolation cells.

Why do they even bother with India ? Easy manpower and one of the world's largest English speaking nations.

>>no one is forced into these things,

I was with you until then - hasn't it been documented over and over again that at least in some of these places people are basically slaves, they have their passports taken away, kept in a walled compound and not allowed to leave?

What I meant is in a lot of these compounds in Africa the “workers” are doing this willingly, it is a Job like a 9-5, these are locals who go there to get trained to do this. In other places like Malaysia, Cambodia most of these people ( usually foreigners) are enticed into these Jobs , they get to these countries with the promise of normal employment and find themselves forced into this. In many of the African countries these are now locals working in Chinese companies, trained by Chinese and protected by corrupt government officials.

My understanding is that while the stories of foreigners being kidnapped to work in a pig butchering compound are much more likely to make international news, the reality on the ground is that the vast majority of people working these scams are not slaves. They are employees in a criminal syndicate.

Yup, this is usually the case in pig butchering operations iirc.

What, if I assume we're employing nicknames here, is a pig butchering operation?

Any scam where the scammer maintains a long-term relationship with the victim - fattening them up - before suddenly taking all their money.

For example a romance scam where the scammer pretends to be your girlfriend who loves you for 6 months and then asks for money to cover an emergency.

Or a stock market scam that might even pay out small profits before convincing you to go all in.

Some kind of romance scam. Look it up.

I'd assume because pigs have to be fattened before slaughter. At the small scale by literally throwing them scraps (pigs eat nearly anything edible).

Meanwhile in a pig butchering scam you have emotionally desperate people (who often would go for figurative scraps) being fed fake romance before being slaughtered (having a lot of money extracted from them, which usually ends in the end of the fake relationship as results don't materialize for the victim, e.g. the lover not showing up)

Because when you buy a live pig, you don't just slaughter and eat it right away, you have to fatten it up over a period of time and then you slaughter it and have a feast. A typical scam is more like fishing, where you catch a fish and then eat it right away. Pig butchering requires a prolonged relationship with the victim to get a higher payout for more work.

It’s an English translation of a Chinese phrase. The method began in China before it came to the west. “shā zhū pán (杀猪盘) translates literally to "killing pig plate" or "pig slaughter table”.

It's just analogy which is useful to depict process well: pig needs to be fed and taken care of for some time before it's butchered

I read it as asserting that unlike in Asia, people do this work willingly. Which I don't actually believe: if you couldn't find qualified people for this work in Cambodia, how are you going to find them in Africa?

According to some news report

""" The global spread of the syndicates’ operations has been driven in part by pressure from authorities in Southeast Asia.

A major crackdown on scam centres in Myanmar this year, pushed by Beijing, led to around 7,000 workers from at least two dozen countries being freed.

But the UN report warns that while such efforts disrupt the scam gangs’ immediate activities, they have shown themselves able to adapt and relocate swiftly.

‘It spreads like a cancer,’ UNODC’s Hoffman said.

‘Authorities treat it in one area, but the roots never disappear, they simply migrate.’ """

These criminals may even belong to the same groups that were targeted by law enforcement in Southeast Asia. they do not actually need to recruit local people. They only need to use advertisements for high-paying “overseas jobs” to attract people with the necessary technical skills and capabilities.

I won't discount the possibility of someone getting into this of their own free will out of hand. But I seriously doubt that it's going to remain this way long term. We have recent examples from Cambodia and Myanmar after all.

Why do you call them “labs”?

A "lab" is a place to experiment and grow. That the subject to experiment and grow with would be "crime" is a reasonable extension of the word, I suppose...

Malaysia prison. Man I would weigh things out.

CONCACAF join UEFA and reject FIFA's World Cup sell-off plan. https://www.espn.com/soccer/story/_/id/49488584/uefa-boycott... . By the end of this Gianni Infantino will only be left with the Africans .I am African and these Federations will do anything to keep him around because of the unprecedented amounts of corruption...

CONCACAF statement: https://www.concacaf.com/competitions/concacaf/news/statemen...

I actually think the CONCACAF statement shows that they could be on board… they’re just mad they weren’t consulted. Give them the cut they want and they might change their tune.

By comparison UEFA sounds a lot stronger.

This statement is weak and wishy-washy compared to the blunt UEFA statement. Kudos to Europe. Here’s hoping CONCACAF can get brave enough to take the moral stance as well.

Yeah, they just rejected the proposal. Meanwhile, UEFA is boycotting the game until those plans are DEFINITELY abandoned. I am wondering whether UEFA could even ask for a change in FIFA statute to ensure it can never be proposed again.

FTA: "As a result of today’s discussion, no UEFA national teams will participate in any FIFA competition for so long as these proposals remain alive, unless this proposal has been abandoned in its entirety and binding assurances have been given that FIFA will never again open its governance or competitions to private ownership." (emphasis mine)

My own frustration isn't corruption per se, a state cannot exist without it - at least not for long, but how cheap African corruption is in general. Others may require considerable resources and billions perhaps. Not here. Just a few Land Rover discoverys for key officials and a scholarship for their kids in Europe is all that is required to sell a whole state. To say nothing of a sporting organization.

It's not cheap to them. You have to adjust for purchasing power - the US dollar goes a lot farther in most African countries than it does in the US. That Land Rover, if sold on the open market, could yield enough for a Nigerian live the rest of their life in Lagos without having to work. An equivalent-purchasing-power bribe in the US would be on the order of several million USD.

That’s not Africa only. When a corruption scandal comes up (bribing, lobbying), I’m often surprised at how cheap it was to buy the official. It’s often in the 10–50k eur region.

Sure but keep in mind that for a lot of countries soccer isn't that big of a deal. There are a lot of countries in fifa and they all have equal voting power.

Some island in the Caribbean has equal say compared to Spain for example.

That's why it's so easy. Bribe the people in the countries where the people don't care about soccer.

The average person is remarkably bad with money. It should not surprise us that politicians are no exception.

You’d think that for risking jail time etc the price would be much higher.

That goes to show they probably don’t fear being caught at all.

Because they don't fear being punished.

You know how it is: 10k here, 30k there... and there is a few M in a swiss bank account (or whatever the modern hiding place is).

Who would have thought crypto/btc prime use would be corruption (bribery, ransoms, influence, extortion)? A lot I wager.

the crypto hater mantra from day one was "this is just for drugs, bribery and money laundering". the only word I object to in that statement is "just".

everyone. everyone would have thought. and did.

the silk road was riding high long before crypto ads were running during superbowls

What do you mean that "a state cannot exist without [corruption]"?

Assuming they meant it as in it's unavoidable.

We should still be frustrated by it, but I think I get what they were getting at.

FWIW when i replied the OP was phrased differently. Like corruption had its place in a healthy society. But fine to rephrase, clearer now.

I think that's not capitalism, that's human nature. On every possible power structure you can think of, there will be people available to compromise on their moral principles if given the right incentives to do so. Under capitalism that's easily money, under other systems it might be something else. You can work to mitigate or detect and deter it (the amount of effort put on that is what makes the difference between limited and widespread corruption). You cannot hope to eliminate it entirely.

IIRC a British MP was caught on camera accepting like $5k bribe. Imagine most US governors and congresspeople would need any more that that either.

While the football business is horrible it's nice that this may fail like the Super League.

Now if only that could put a dent in Infantino reelection...

I am not sure a replacement for Infantino is enough. It seems like FIFA has a culture of corruption and Infantino is merely the latest manifestation of said culture. Some serious reform and restructuring seem needed.

Here’s a solution: bar FIFA from selling viewing rights to their competitions and allow any station or channel to stream for free. That would grow the global game.

Take away the money and FIFA doesn’t have much to bargain with. They need to remember they are a purely administrative organization.

> That would grow the global game.

The game is already as global as it gets, 1.5bn people watched the wc final…

> The game is already as global as it gets

There is a tiny bit of room for expansion. https://www.bbc.com/sport/football/articles/c5y03dermmeo:

“Football is almost non-existent on this Pacific island. Nauru has never fielded a team in an official international match and it has just one – hard sand – pitch.

While there is interest in big Premier League matches, and children wear Lionel Messi and Cristiano Ronaldo kits, any attempts to actually play football tend to be mocked, unless it's Aussie rules.”

(Nauru is about 21 km², 21,000 people)

So a minority of the human population?

Now consider time zones.

Standard Eastern Tribe

Fifa is a reflection of the world. All members (nations) get a vote. Most countries are corrupt. Thank go there is still a bastion of democracy/fairness left in Uefa.

Still there are plenty of world wide organizations that are less corrupt than fifa.

I'm actually not even sure I can think of an organisation more corrupt. Maybe the IOC is up there?

The FIA (motorsport governing body) is giving them a run for their money. Recently removed presidency term limits and made several other rule changes to prevent challengers. And like FIFA, despite the majority opinion seeming to be against the corruption the decisions get rubber stamped anyway.

> Thank go there is still a bastion of democracy/fairness left in Uefa

Do you know who Platini is?

This is only because Europe cares about soccer. If this was basketball, ice hockey or baseball then I don't think Europe would care and would be the country to bribe

I am all in favor of a global revolution to overthrow capitalism with a solidarity of workers of the world. But I think we can have a non-corrupt FIFA without one.

> Thank go there is still a bastion of democracy/fairness left in Uefa

To be a bit cynical on this, I'm going to say that UEFA is worried the international scene will infringe on the European league scene.

They've found something to be outraged about, but the reality is more about the threat to their own bottom line than it is about the international game.

This is probably at least partially true. And they know that if they get together with South America, they can easily replace FIFA with another governing structure.

I'm a bit surprised to be downvoted on this, except maybe that it's seen as an attack on Europe.

There have been other attempts at a league superior to the individual national leagues -- like a permanent champions league. Establishment of anything more regular at the international level would be one more way this could be accomplished.

Each European league (and leagues from other confederations) has a vested interest in keeping the World Cup not just "free" but rare as well.

The time to be on the high horse against FIFA isn't 2026, it was against he labor conditions in Qatar, or the corruption to award the 2018 and 2022 hosts, or any number of other things.

However correct they are, they only complain when it's against their own self interest.

> It seems like FIFA has a culture of corruption

I think any large multi-national organisation that deals with handing out events that generate vast sums of money inevitably succumbs to the rot.

See also: the IOC.

Reminiscent of the resource curse, the observation that many countries "blessed" with an abundance of natural resources actually fare pretty badly (including lots of corruption).

https://en.wikipedia.org/wiki/Resource_curse

Easy: it was going to be a (mostly) closed competition.

Competition gets boring real fast when it is always the same handful of teams. When there are no real consequences to losing, winning becomes meaningless.

Bayern v Chelsea matches stop being as interesting when every game is a Bayern v Chelsea match and most of them have no real impact either way. On the other hand, football becomes most interesting when it's a Bayern v Bremen and Bremen wins. People love an underdog after all, and nothing is more exciting than seeing an elite team take the game for granted and being punished for it.

The Super League is only a more interesting product from the "big name play ball" perspective. It is great when you want to make a fortune in tv rights and licensing, but it sucks for everyone who cares about football as a sport.

That’s the same justification my German friend made. I guess it’s American viewpoint vs European. The Super League would have been like the NFL in the US, where every team can beat any other any given night. That’s much more appealing to me, but to each their own.

The NFL is so balanced not because it’s a “super” league but because every team has the same salary cap. The best team and the worst team all have to spend essentially the exact same amount of money on their players, ensuring that no team can buy their way to the top.

Even there it’s still not really true that the best team can lose to the worst team in any given night. The best team is generally favored a lot and justifiably so. In soccer teams can also be quite mismatched and a lucky goal by the worse team can be the only score and win the match.

Another large part is the draft. Worst team gets first pick goes a long way to levelling the playing field.

As a lapsed NY Jets fan, I disagree -- competent ownership and management is required more than good draft picks. To wit: Tom Brady was drafted at 199 overall, but the Jets' last two QB picks (Zach Williams and Sam Darnold) are both journeyman-level players.

I'm more of a hockey guy, which has a much stricter salary cap than the NFL, and the Edmonton Oilers are instructive here: they had a bunch of first overall picks 10 years ago (including multiple franchise players), but the team itself wasn't competitive until management changed and could build a cohesive team.

Bad management will certainly tank a team, but he’s right. The draft structure also helps to even out the teams.

In the NFL, winning is more about quality management and coaching (and some luck) than anything else. Which is a good thing. Leagues where winners are decided mostly on who is able to spend the most on players are lopsided and kind of lame.

The NFL is an association of billionaires that captured a sport and created rules to keep scarcity going and not let either of them ruin it for the others. In football we already have oil magnates buying individual clubs here and there, but at least they are very diluted among the real clubs.

I agree with you, but I think it’s worth pointing out that the NFL is balanced because they tried to make it balanced - the salary cap, draft, revenue sharing, etc. are all outcomes of that plan, not the prime motivators themselves.

In the Champions League the top, let’s say, 16 teams can all beat each other, so that part of the NFL experience is still there. The thing is that these top 16 teams change every year and there is no clear definition which clubs are top teams at the moment. But that’s the charm of it.

Football is very tribal. People want to dream that their local club have a shot to participate and maybe win the Champions league. Think of Leicester and Girona. In the Netherlands there is now a club called NEC and they have a shot to qualify for it, and that by itself is a historic moment for the club.

Exactly. Look at Bodø/Glimt from northern Norway. In 2017 they played in Norwegian 2. division and in 2020 they played AC Milan in the Europa League and won the top division in Norway and it's only been better since. BUT, this too will end at some point and another team will take their spot at the top. Maybe my team that has been struggling for decades will get their shit together and start winning something? That is much more exciting than seeing the same 10-20 money doped teams play matches all over the world to generate even more money.

> every team can beat any other any given night

I know this has been an NFL slogan for decades but i actually feel like it's less true in the NFL than in a lot of other sports--soccer included.

I also think US leagues could really benefit from the idea of relegation

You mean, its the dullest.

Imagine never having any relegation risk for being crap. Without divisions and removal of risk, what's the point?

Without the chance to work at a lower level and through simply being good, getting a team promoted how are you supposed to inspire? NFL, is both the least and the most American sport there is.

PSG has won 8 of the last 10 Ligue 1. Bayern 9 of the last 10 Bubdesliga. Barcelona/Real Madrid 9 of the last 10 La Liga.

That’s exciting? There’s 50+ teams in those leagues that stand NO shot of ever winning a championship, ever. The argument I’ve seen in this thread is either 1) it’s thrilling when my favorite average team upsets the backups of one of the powerhouses and 2) it’s exciting to get relegated and then come back.

You know what’s even more exciting…winning a championship. And every August every NFL fan starts with the hope and belief that this is their year. NFL has Leicester-lite situations every few years. Patriots were worst 2 years ago, lose in the championship the next year.

I will give credit to the Premier League - they’re doing it right. As mentioned, too 15-20 teams are competitive and could win a title in a given year. You know why it’s the best league - they set up a revenue sharing model similar to US leagues. Equal chance of winning = most excitement for fans of the entire league.

Putting all of the ethical issues aside, do you know how fucking boring this would be?

You can fuck right off trying to create a closed league where only a "chosen" few clubs take part.

It might just be an entertainment spectacle to you but for others it's very tied into local identity.

The idea that outside money men should be allowed to come in and destroy open competition is highly offensive to me.

The best years in football are when a smaller club gets a run of luck and beats the big boys. Or when one of the super clubs gets relegated and their fans have experience a season or two in the lower leagues.

You're not taking that away from us without a fight!

However, all all-Africa World Cup won't find too many takers.

AFCON is already a thing and while it is decently popular it’s no where near the world cup or the euros. Part of that is that it takes place during the domestic club competitions though.

African teams are definitely up and coming. South Africa was surprisingly poor in the tournament but there were some decent performances by African teams, notably Morocco. Cape Verde also punched (or kicked?) way above their weight.

South Africa performed above its traditional level just in reaching the second round, which it has not done before.

CONCACAF extremely weak. They didn't even say they'll boycott. They're likely just as corrupt as the other countries and may still vote it through, they're just sad they were not consulted.

Americans (Kushner et al.) looked at an opportunity to make money and found a willing ally in Infantino, and they took it.

I am Asian. Our country FA is corrupt as hell too. The way I read this, FIFA needs a yes from roughly half of the member nations to go forward with this. Yes to a offer (not promise) to receive $20m. I can totaly see the top brass of our FA, 10-20 people at most, looking at this as an opportunity to earn easy several million bucks and voting yes.

> unprecedented amounts of corruption...

Yes I hear about that a lot. Yuk

But I also hear that FIFA puts a lot of resources into developing the game in African countries.

I am asking: Is that true in your experience?

And strangely a very high percentage of those resources get converted into mansions and yachts

Nobody specified what game.

Look, it is pretty bullshit if you ask me.

So it used to be that there were pre-tournament games, to qualify.

A lot of countries... they wouldn't qualify. They'd play an ample amount of pre-tournament games though.

Now, you seen more countries qualify, and you see countries who used to not qualify, dropping ASAP (in the deathmatch 16th matches, right after poule).

So what did we get out of that? A few matches during the tournament, and they were quite frankly meaningless.

These countries which made it to deathmatch 1/16th gained nothing. It is a scam, a trick. They think they gained fame, but they really have not, since the barrier to get to the deathmatch has been lowered.

Furthermore, if you follow a corrupt scheme, you can ensure a country like Argentina is going to have the least chance to end up with strong opponents.

No, mr. Infantino. We need less corruption in FIFA, not more.

* We don't want a drink break to watch commercials..

* ..or a 30 min break with a bunch of actors (who sing with autotune) when your own rules say it may only be a 15 min break.

* We don't want red cards commutated or revoked.

* We don't want star players not getting yellow or red card, when other players are getting one for the same foul.

* We don't want a yellow card being reversed, then given to an opponent, based on 'identity mismatch'.

* We don't want to see racism or political statements.

* We don't want to see rugby, we want to see football.

* We want to see fair-play, with a meaningful VAR which can be called by the captain or coach of each team twice (getting back their call if agreed on).

You don't need a for-profit in your chain to fix the above. You need a non-profit with a non-corrupt chair, and you've proven you're not fit. Red card for you, mr. Infantino. You're out, arrivederci.

> Now, you seen more countries qualify, and you see countries who used to not qualify, dropping ASAP (in the deathmatch 16th matches, right after poule).

> So what did we get out of that? A few matches during the tournament, and they were quite frankly meaningless.

The answer for FIFA is of course money. More countries, more games, more money.

But the non-cynical answer is that all of those countries got to see their teams play 3 World Cup games. Some got to see more than that. I would bet that many of those countries’ citizens are very happy with the expanded tournament, and good for them. We also got Cape Verde this year, who many people around the world were excited for.

> or a 30 min break with a bunch of actors (who sing with autotune)

Madonna and Shakira were actually doing playback. BTS and Timberlake at least were singing live.

Fernandez deserved each of his yellow cards. Especially the second for that reckless and dangerous tackle.

Cucurella did not violate the rule. He touched his mouth for an instant. The rule is not “if you ever touch your mouth you get ejected”, which is why VAR didn’t do anything and neither did the ref on the field.

I generally have nothing against Argentina but they were wildly outplayed in the last game, they were disrespectful, and Messi’s appeal to the ref to try to get Cucurella ejected was shameful.

Argentina’s post match antics should be enough to ban them for 5 years

Sore-ass losers picking fights after the game because they couldn't score in 120 minutes?

Crybabies. Ban Argentina from FIFA for years after that debacle.

It's not illegal to cover your mouth. It's only illegal in "heated exchanges".

Funny racism that doesn't like Argentina but loved Cape Verde.

Who told you that? FIFA?

Both can be - and seem to be - true.

“The effort is being bankrolled by Joshua Kushner, the brother of Jared Kushner, U.S. President Donald Trump's son-in-law.”

Ah. This boondoggle makes sense now.

CONCACAF and UEFA together is 96 out of 211 votes. They've since being joined by the Asian Football Confederation for a large majority against. And no reason to suspect the bung Infantino offers for voting in his direction is anywhere near enough to sway CONMEBOL.

The African confederation is actually marginally smaller than the European one. It also has no shortage of internal disagreements, brings in very little revenue, and the bigger nations are ultimately going to look at where the money is and see that it isn't trying to plough ahead without Europe, Asia or the United States.

CONCACAF was actually one of Infantino's best hopes, a mixture of the US, a few nations that hugely benefited from Infantino's other world cup reforms and a few that have no realistic prospect of World Cup football but would love $40m in return for voting a particular way...

Since AFC have now joined them[0][1], FIFA no longer have the votes for this to pass.

[0] https://www.bbc.co.uk/sport/football/articles/ce345l6kg6ro - "Uefa - the body that governs European football - has 55 votes. Concacaf, which oversees football in North, Central America and the Caribbean, has 35 and Asia has 46." which only leaves 75 votes from the 211 and he'd need 106.

[1] I've no idea why the BBC doesn't properly capitalise UEFA or CONCACAF. I assume it's either some weird style guide or the subeditors are having another day off.

On the capitalization, it seems the BBC will always use title case for acronyms (Nasa, Nato) and all caps for initialisms (ATM, SNP). I did try to search for SQL to see if the Beeb thinks it should be read as Sequel or Es-que-el, but their search refuse to show exact results and keeps giving me articles about the Scottish National Party instead.

From their style guide:

"Where you would normally pronounce the abbreviation as a string of letters - an initialism - use all capitals with no full stops or spaces (eg FA, UNHCR). However, our style is to use lower case with an initial cap for acronyms where you would normally pronounce the set of letters as a word (eg Maga, Sars, Aids, Nasa, Opec, Apec)."

(Under "acronym": https://www.bbc.co.uk/newsstyleguide/a )

UEFA leaving already leaves a pretty big gaping hole in any future FIFA tournament, since it'd exclude Spain (1st), England (3rd), France (4th), Norway (5th), Belgium (6th), Switzerland (joint 7th), Portugal (13th), Netherlands (17th), Germany (18th), Croatia (20th), Sweden (27th), Austria (28th), Bosnia and Herzegovina (29th).

That's 75% of the final four and of the quarterfinals, 44% of the round of 16. Then if you add CONCACAF into the mix, it comes to 63% of the RO16.

Having Scotland back in the tournament was great, and the Tartan Army generated a lot of positive press, and was relatively well behaved.

Nobody is going to watch a worldcup if south America joins this boycott.

Wondering about this. 10 years ago it was true but Brazil are a shadow of their former selves, and Argentina without the likes of Messi and Aguero aren't the same. I know they reached the final but Messi almost had the golden boot.

Wouldn't be surprised to see Africa surpass South America in the next decade

Yeah but good luck having World Cup without any european country...

Yes, it's just been won by one! For me one of the gaping holes in this tournament was Italy. That would have been unthinkable years ago. It is strange seeing New Zealand there but not Russia, but there are political reasons for that.

FIFA can't really exist in any way similar to it's current form without UEFA

> You're excluding about half of the planet by only mentioning Africa.

It's the half of the planet that nobody cares about when it comes to football.

The issue is every federation - whether they never qualified for the world cup or won final(s) - gets one vote. This has become a big issue, with any proposal to give more money (even if that entails compromising on key principles) to federations (by making more money) is almost certain to pass because of very poor FAs that need it / want it desperately.

Yeah, but if UEFA stays true to their word, passing this proposal is guaranteed to lead to the end of a FIFA-led world cup. They have the votes to privatize the world cup, but in doing so would destroy the very thing they are trying to privatize, and likely destroy FIFA as a whole

Meanwhile UEFA can just get together with South America and form a new governing body for a new world cup

Honestly no one care about United States, Canada and Mexico in soccer. These countries are irrelevant.

I'm not an American but FIFA certainly care about the US and Mexico.

The US is a vast market. It's played a lot in the US as well. The MLS also not a tiny league. Football is also huge in Mexico.

Hugo Sanchez was truly a legend. Among many.

Mexico are decent

The US just hosted as main host again after only 30 years. Brazil waited from 1950 to 2014 to host again, a full 64 years, and it’s arguably one of the countries most cared about in soccer.

Hosting the tournament has nothing to do with it. America is a lucrative market, and on top of that, FIFA can get away with charging insane ticket prices. I'm Canadian and soccer is my primary sport. Unfortunately, on a global level, nobody really cares about Canada or US when it comes to soccer.