Windypundit

Classical liberalism, criminal laws, the war on drugs, economics, free speech, technology, photography, and whatever else comes to mind.

Main Menu

No, a Conservative Think-Tank Did Not Say Single-Payer Saves Money

by Leave a Comment

I’ve seen a few stories and tweets saying that a conservative think-tank accidentally proved that single-payer healthcare will save Americans a lot of money. They’re talking about a working paper released by Charles Blahous at the conservative Mercatus Center. The dumbest story I’ve found so far is from Matt Bruenig at Jacobin magazine:

The US could insure 30 million more Americans and virtually eliminate out-of-pocket health care expenses while saving $300 billion in the process, according to a new report about Medicare for All released by the libertarian Mercatus Center.

Bruenig tries to explain the study this way:

Since the federal government takes on nearly all health spending under Medicare for All, federal health expenditures will necessarily go up a lot, $32.6 trillion over the ten-year period according to Blahous. But this is more of an accounting thing than anything else: rather than paying premiums, deductibles, and co-pays for health care, people will instead pay a tax that is, on average, a bit less than they currently pay into the health care system and, for those on lower incomes, a lot less.

This misses the point. That the Medicare for All (M4A) plan will increase government spending by $32.6 trillion over 10 years is not “more of an accounting thing than anything else.” It’s a sizeof-government thing. Under M4A, the government would take control of $32.6 trillion in healthcare spending that would otherwise have been controlled by the people who actually earned that $32.6 trillion. It’s a huge increase in the size of government.

That’s not what makes Bruenig’s piece dumb, however. The is:

Blahous starts with current projections about how much the country will spend on health care between 2022 and 2031. From there, he adds the costs associated with higher utilization of medical services and then subtracts the savings from lower administrative costs, lower reimbursements for medical services, and lower drug prices. After this bit of arithmetic, Blahous finds that health expenditures would be lower for every year during the first decade of implementation. The net change across the whole ten-year period is a savings of $303 billion.

Bruenig explains what he thinks the conservative think tank was really up to:

But the real game here for Mercatus is to bury the money-saving finding in the report’s tables while headlining the incomprehensibly large $32.6 trillion number in order to trick dim reporters into splashing that number everywhere and freaking out.

Bruenig doesn’t say where he gets his figure of $303 billion in savings. The figure doesn’t appear anywhere in the paper. But I think he gets it from the next-to-last column of Table 2, labeled 2031, which lists Currently projected national health expenditures (NHE) of $7,651 billion and NHE under M4A of $7,348 billion. That is indeed a difference of $303 billion.

But here’s the thing: That’s not a cumulative figure. That’s the figure for a single year. The cumulative total, obtained by adding up all the savings over all 10 years in the table, is actually $2,054 billion. Bruenig has undermined his own point by using a figure that is 1/6 the actual projected savings in the Mercatus study. He’s probably not the best person to be calling out “dim reporters.”

Over at Slate, Jordan Weissmann comes closer to an accurate summary of the study:

Today in political own goals: A prominent conservative think-tanker appears to have published a white paper showing that Bernie Sanders’ plan for a national single-payer health care system could, in theory, reduce American health care spending by as much as $1.4 trillion. Take that, Medicare for all.

This time I have no clue where the $1.4 trillion figure comes from, but elsewhere in the piece Weissmann uses the correct $2.05 trillion figure, so I think we can put this down to a simple editing mistake.

Weissmann still has a bit of a conceptual problem. If you actually read Blahous’s Mercatus working paper, the figure of $2 trillion in healthcare savings is not a result of his study, it’s one of the inputs. For purposes of his paper, Blahous makes the generous assumption that the price caps in the M4A plan will work as intended. He’s trying to estimate how much M4A will increase the federal budget, and he apparently wants to avoid being accused of overestimating the expense because he didn’t account for the price caps.

(It’s as if you and I were arguing about something, and you said to me, “Even assuming what you say is true, there’s still this other problem…” and I immediately started telling everyone you had proven I was right.)

It’s important to remember that the M4A plan isn’t just a single-payer system. For purposes of the Mercatus paper, it consists of at least two other parts:

  • Expanded healthcare coverage.
  • Capping payments to healthcare providers at Medicare price levels.

Only that second item can save any money. To put it another way, all the savings from the M4A plan come from the assumption that we can reduce the cost of healthcare by forcing healthcare providers to accept low Medicare rates for all patients.

It’s not clear that this will actually work. For a long time, it wasn’t even possible to get doctors to accept Medicare rates for Medicare patients. The Medicare SGR rule was enacted in 1997 to control medical costs, but Congress kept passing so-called “doc fix” bills every year to keep it from fully taking effect. SGR was replaced in 2015 by MACRA rules, which seem to have held up so far, but they only apply to Medicare patients. It’s not clear that this will scale up to everybody.

The reason why is that healthcare providers have built their businesses around a mix of low-paying Medicare patients and higher-paying privately insured patients, and they may not survive the transition to all low-paying patients. It would be like telling a movie theater to offer their senior discount rate to all their customers, or ordering a bar to offer happy hour prices all day long. Even if they didn’t go out of business, they’d have to change the way they ran their operation, perhaps reducing staffing or buying lower quality supplies. For a theater or a bar, that just makes the experience less enjoyable, but when doctors and hospitals start cutting expenses, the results can be more dire.

On the other hand, hospitals and doctors have a lot of money and a lot of political influence, so they may be able to postpone cost cutting indefinitely, or riddle it full of exceptions that turn out to apply to nearly all patients. This would remove the financial pressure to reduce expenses in ways that might hurt patients, but it would also kill off the cost savings of the M4A plan.

Here’s some final food for thought: If the price caps in the M4A plan really will save us a ton of money, do we need to wait until we pass the rest of M4A before taking advantage of them? If we really believe this will work, shouldn’t we pass the price caps right now and worry about the other parts of M4A later? Yet that’s not what anyone is proposing.

Carbon Dividend/Carbon Tax

by 2 Comments

I’ve fallen behind on my blog reading, so I missed Greg Laden’s post a few days ago in which he tries to argue that carbon taxes aren’t really taxes. Actually, he seems to prefer to call them a “carbon dividend,” which is apparently the trendy new name for this idea. I googled and found this page at the Citizens Climate Lobby which explains it. It’s basically a carbon tax — shorthand for taxing the production of atmospheric carbon dioxide, usually by taxing the fuel that will be burned to produce it — with the added bonus of bribing people to like it:

100% of the net fees from the carbon fee are held in a Carbon Fees Trust fund and returned directly to households as a monthly dividend.

About two-thirds of households will break even or receive more than they would pay in higher prices. This feature will inject billions into the economy, protect family budgets, free households to make independent choices about their energy usage, spur innovation and build aggregate demand for low-carbon products at the consumer level.

Sigh. The billions of dollars it injects into the economy is, by basic accounting, exactly offset by the billions of dollars it takes from the economy, which will presumably hurt family budgets and reduce household choices in all matters. And the only way this increases demand for low-carbon products is by pricing high-carbon products out of the market. I suspect this chicanery is an attempt to head off criticism that carbon taxes are just another case of loving high taxes and big government. It’s understandable, but it ultimately feels dishonest. 

And no matter how many times Laden says otherwise, “carbon fees” or “carbon charges” really are taxes. In fact, they’re a very specific type of tax known as a Pigovian tax, after economist Arthur Cecil Pigou, who formalized the concept in the 1920s as a way to address a problem known as the “tragedy of the commons.” That’s the economics term for what happens when people have access to a resource they don’t have to pay for.

The idea is to get business incentives to align with society’s incentives. Under normal market conditions, when a bakery uses 1000 pounds of wheat flour to make 1000 loaves of bread, the benefit to society is that it gains 1000 loaves of bread, and the cost to society is that it loses 1000 pounds of wheat flour.

Those are also the costs and benefits facing the bakery: They have to buy 1000 pounds of wheat flour, and they get to sell 1000 loaves of bread. Because the bakery has to take market prices when buying and selling, they will only choose to bake bread if 1000 loaves of bread are worth more than 1000 pounds of flour. And since the price of flour and bread in their respective markets are determined by society, the bakery will therefore only choose to bake bread from flour if bread is more valuable to society than flour. In converting flour to the more valuable bread, they will be increasing the value of the goods available to society, and because the bakery faces the same benefit/cost trade-off as society, they have the right incentives to make a decision that is good for society as a whole.

Now consider a rancher who grazes his cattle in pastures not owned by anyone. The benefit to society is the resulting cattle, and the cost to society is the grass they consume. For the rancher, however, things are different. The benefit to the rancher is that he gets to sell the cattle, but the cost to the rancher is zero, because he doesn’t have to pay for the grass his cattle use.

The result is that the rancher derives a much greater net benefit from raising cattle than society does, which means the rancher has an incentive to raise far more cattle, using up far more grass, than would be best for society. Society would almost certainly be better off with fewer cattle and more grass, which could presumably be put to better use in some other way. In the worst case, so many ranchers raise so many cattle that they consume all available grazing land, at which point they have to stop raising cattle. Because Brits call public land “common land,” British economist William Forster Lloyd called this “the tragedy of the commons.”

It’s not hard to find examples. Catching a fish means one less fish in the sea, which is a cost for society as a whole, but not for the boat that catches the fish, and thus we get depleted fisheries like the Grand Banks, which pretty much ran out of cod after a few decades of commercial fishing. Chopping down a tree means one less tree for anyone else to use, but in old-growth forests nobody had to pay the cost of planting and growing the tree in the first place, so logging on public land (such a North American frontier land) led to deforestation and limited growth due to lack of lumber.

Not all examples of the tragedy of the commons involve direct consumption. Consider traditional industrial pollution, with giant factories belching smoke as they grind out manufactured goods. The goods they produce are a benefit to the factory owner, who gets to sell them, and to society, which gets to consume them. But the pollution is a cost only to society, which has to endure foul air.

To understand how this is similar to the cattle grazing example, it can be helpful to think not in terms of the cost of pollution, but of the cost some resource being consumed. So don’t think of the factories as creating dirty air. Instead, think of them as consuming clean air. Just as cattle are the benefit from the cost of consuming grass, factory goods are the benefit from the cost of consuming clean air. And since the factory doesn’t have to pay for clean air, the net benefit to factory owners is much higher than the net benefit to society. This gives factory owners an incentive to build a lot more factories and produce a lot more pollution than would be best for society.

(Note that while factory owners do suffer from general pollution like everyone else, they don’t suffer significantly from their own decision to pollute. The costs are distributed over so many people that their personal share is tiny. The costs they impose on any single other person is also tiny, but that cost can be considerable when summed across the whole of society. Alternatively, the cost per person can get quite high when the tiny personal cost of each polluting factory is summed across many thousands of factories.)

Pigou proposed a solution to this mismatch of incentives: Charge the factories for the clean air they consume. No one owns the air, of course, but through its power of taxation, the government can nevertheless charge factories for clean air, just as if it was a production input like flour. Then if the tax on using clean air truly represents the cost to society when it loses that clean air, then factory owners will be facing the proper incentive structure so that decisions they make to benefit themselves will also benefit society.

Economists prefer solutions like Pigovian taxes over government regulations because they are more flexible. Regulations tend to specify rigid rules and lock in narrow solutions. For example, a prohibition on a certain type of high-pollution industrial process would force all users of that process to switch to something else. That might be fine for 90% of the industry, but for the remaining 10% it might be economically infeasible. The would either go out of business or lobby Congress do carve out an exception or perhaps make use of some kind of exemption system built into the law already. This can quickly become a confusing and unpredictable mess where businesses live or die based on whether they can get government permission to do things a certain way.

Pigovian taxes, on the other hand, apply a relatively simple tax rule and let businesses and the market figure out a solution. So instead of banning a high-pollution process outright, they just increase the cost of that process by taxing the pollution. Now each business can figure out how to respond to that increase in costs. Most businesses would likely switch to an alternative, but for the 10% that find it too expensive, they could remain in business if they were willing to pay the taxes. That’s not a problem if the incentives are right, because what the business is producing is presumably more valuable than the clean air being consumed.

Of course, if the taxes were too expensive, they would still have to go out of business. But then they were never really a successful business anyway — they were just getting away with it because they were getting to pollute for free. Once they had to pay the full cost of what they were doing, they were faced with reality: They had been a net loss for society, and now they were experiencing that loss for themselves.

Anthropogenic global warming is also a tragedy of the commons. People and industries are dumping carbon dioxide into the atmosphere, and the Earth is warming up because of it. That imposes costs on everyone in the world, but the people releasing the carbon dioxide experience none of that cost. My knowledge of climate science isn’t good enough to figure out what resource they are consuming for free (The Earth’s carbon recycling buffer? Its energy handling capacity?), but they are definitely not paying the full social cost of using fossil fuels. At least in theory, a Pigovian tax — the carbon tax — would fix that.

Naturally, there are objections:

A resolution declaring carbon taxes to be “detrimental” to the U.S. economy sailed through the Republican-controlled House this morning with the support of most — but not all — of its GOP members.

Somehow, this is treated as controversial. But of course carbon taxes will hurt the U.S. economy. We’ve been using fossil fuels for many years without paying the full cost. Once that cost is imposed, we will begin to change our energy production technology to use less fossil fuels, either through increased efficiency or by switching to an alternative energy source such as nuclear or solar. Since those were not our first choices, switching to them represents a loss. It would have to, since using the more expensive energy necessarily means spending less on something else.

The world economy, on the other hand, experiences a net gain due to the reduction in greenhouse gases and, consequently, harm from global warming. The U.S. experiences some of that gain too, of course, but only a fraction of it.

Another objection is that it will be hard to determine the amount of the tax, since we’re talking about changes that will happen all over the world and far into the future. Given how much the world economy has changed in the last 300 years, I don’t think we can make reliable economic projections that far into the future, which makes it hard to calculate the level of carbon taxation needed to balance the harm. Any estimate we make will be not much more than a wild guess. But maybe that shouldn’t stop us from trying.

Note that the benefits of Pigovian taxes are obtained when the taxes are enacted and the people burdened by the tax change their behavior to be more in line with society’s welfare. Except for the relatively tiny cost of administering the tax, there’s no change to government spending. So if we impose a carbon tax, what should the government do with the extra revenue?

Well, if the government doesn’t need the money, the default position of most economists is that we should make the carbon tax revenue-neutral by lowering some other taxes. Let the American people keep their money and spend it however they want.

There’s an argument, however, that carbon taxes will hit poor people especially hard because energy costs are a larger proportion of the cost of living for the poor. Even if that’s not the case, the increase in energy costs will still increase the cost of living, which poor people will be less able to tolerate. For these reasons, many people think the carbon tax revenue should be used to increase aid to the poor, either by focusing the tax breaks on the poor or by giving them money with direct payments. The Citizens Climate Lobby’s “carbon dividend” proposal is to distribute the money evenly to everyone:

Equal monthly per-person dividend payments shall be made to all American households (½ payment per child under 18 years old, with a limit of 2 children per family) each month. The total value of all monthly dividend payments shall represent 100% of the net carbon fees collected per month.

In other words, they want to use the carbon tax to fund a Universal Basic Income (UBI) scheme.

I hate this kind of proposal. Whether or not a carbon tax is a good idea has nothing to do with whether or not universal basic income is a good idea. They are separate and unrelated decisions. The federal budget has to balance over the long term, but there’s no policy reason for specific line items like carbon tax revenue and UBI expenditures to match. If we want the government to help poor people with the increased cost of living due to rising fossil fuel costs, our expenditures should be based on the amount of help they need, not on how much money we’re getting from a single revenue stream.

Linking revenue and expenses this way is usually a cheap trick to justify a tax increase by tying it to something wholesome, e.g. “for the children.” Furthermore, if the carbon tax works as intended, fossil fuel use will decline by design, and therefore funding for the UBI “dividend” will decline. That’s a perverse relationship which could have perverse consequences. Either we will allow the “dividend” to decline and become less effective, or else UBI supporters will lobby to increase the carbon tax to raise more revenue, neither of which seems very smart.

(Or we will do something really stupid, like subsidize oil drilling to encourage more revenue-generating fossil fuel use. If that sounds too dumb even for our government, remember that the government used to run an anti-smoking public health campaign at the same time it gave subsidies to tobacco growers.)

The good news is that all of this may not matter. Solar energy has gotten a lot less expensive to produce than it was when I was a kid buying hobby solar panels to run a radio. Some estimates of costs indicate that utility scale photovoltaic solar power generation is actually cheaper than conventional production, without even factoring in global warming. If that’s an accurate estimate, it won’t be long before utilities switch to solar power just because it saves them money. Then we won’t need a carbon tax or a carbon dividend.

Building My New PC

by Leave a Comment

When I first started buying computers, they got so much better every year that a seven year old computer like mine would have been completely unable to run software designed for the newest computers. The pace of advancement is slower these days, however, so even though it’s several generations out of date, my computer was still pretty usable from a performance perspective with most applications.

A couple of months ago, however, it started crashing. It would be okay for a few days but then it would start crashing over and over 5 or 6 times within a few hours, reporting a variety of reasons. Just in case it was a software problem, I tried repaving it — wiping out the hard drive and reinstalling Windows and everything else from scratch — but the crashing continued. If I knew more about computer hardware (and had supplies handy) I might have tried replacing parts until the crashing stopped, but that seemed like a lot of work for a computer that was kind of clunky and old fashioned. I decided I wanted a nice shiny new one.

As usual, I wanted something with a lot of performance. I’m not talking about a bleeding-edge gaming system — getting that last little bit of extra performance is way too costly — but I definitely wanted to find something speedier than a typical office computer. I started by visiting all my favorite custom gaming computer vendors — Origin, Maingear, CyberPower, Falcon, Digital Storm — and using their configuration systems to put together a whole bunch of different fantasy computers, trying out combinations of parts to see how the cost worked out for various options.

My search ended where it always does: With me realizing I could get exactly what I wanted and save hundreds of dollars by purchasing the parts separately and building the computer myself.  I’m not an expert at building PCs, but it’s not that hard these days. Tom’s Hardware has excellent instructions, a buying guide, and tons of component reviews. If you can wire up an entertainment system in your living room, you can build your own PC.

I can’t say that putting together a PC is a fool-proof operation, but it’s definitely fool tolerant: You might not be able to get it working, but short of major physical mishandling, it’s pretty hard to damage the parts. So you can just keep trying again and again until you get it right. And if that doesn’t work, just take all the parts to a storefront PC repair store with good reviews (not one of the big box computer stores) and tell them “I fucked up my build. Can you put it together for me?” It will cost you something, but it will still be cheaper than buying a high-end system pre-assembled.

I did decide to do one thing different this time: I wanted an overclocked PC. I had avoided overclocking in the past because it sounded like too much trouble. A CPU chip running faster than the manufacturer’s specified speed can be unstable, and wasn’t I trying to replace a computer that kept crashing?

The thing is, overclocking has become pretty mainstream. Both Intel and AMD sell CPU chips that have the clock controls unlocked, and several motherboard manufacturers sell boards that have the extra power management and specialized software you’ll need. The overclocking process is a bit complicated, and feeding a CPU too much power can destroy it, but as long as you’re reasonably careful, the worst thing that happens is that the CPU heats up more than usual. You can fix that by adding more cooling.

Oh, you can still do crazy, bleeding edge speed tricks. The latest one I heard of is “delidding,” which means carefully slicing the top off the CPU module to expose the circuitry inside and replacing the internal packing with material that conducts heat better. But for more mainstream overclocking, all you need is an unlocked CPU, a motherboard with overclocking support, and good cooler.

I finally decided to buy

  • Intel’s top-of-the line 8th generation Core i7 processor. It only has 6 cores, but the processors with more cores are slower and I’ve generally found that peak core speed is more important for my applications than more cores. I rarely even peg all 4 cores in my current computer.
  • I nice overclocking motherboard from MSI.
  • 32 GB of DDR4 memory. Some of my applications are really memory hogs. I got 3200MHz RAM because people doing benchmarks were reporting that faster RAM didn’t make much of a difference for normal kinds of loads.
  • A Samsung EVO M.2 solid state drive, because those memory hogging programs need to fill that memory as fast as possible.
  • A 280mm liquid cooling system. It’s a completely sealed system, so there’s nothing to fill or replace. Basically, it works like a car radiator in miniature: There’s a pump attached to the CPU and it pumps coolant to a radiator mounted at the top of the case. Calling it 280mm just means that the radiator is attached to a pair of 140mm fans.
  • A GeForce 1080 graphics card. My monitors are IPS displays for accurate color rendering for photography at HD resolutions, so I don’t need the much-more-expensive 1080Ti, which is for driving high-frame rate 4K gaming monitors. I could probably get away with a 1070, but the 1080 is only slightly more expensive.
  • A 750 watt power supply. That’s more than it will ever use, but you don’t want to be straining your power supply.
  • A Master Cooler MasterCase MC500P. At $127, it’s the most I’ve ever paid for a computer case, and it was definitely worth it. It has good cable routing and airflow, it comes with all the screws and hardware you’re likely to need, and it’s very flexible about how you mount components. It’s also just well made. All the removable parts reattach without having to fiddle with them. Plus it has handles on top to make it easy and safe to carry. It truly made the build much easier.

Once all the parts arrived, I started assembly. There were a lot of parts to connect:

  • Clamp the CPU on the motherboard.
  • Install the hard drive.
  • Mount the motherboard in the case.
  • Mount the power supply in the case.
  • Install the memory.
  • Run the motherboard power cable.
  • Run the CPU power cable.
  • Attach the front panel hard drive indicator light.
  • Attach the power switch and power indicator light.
  • Attach the reset switch.
  • Attach the front panel USB.
  • Attach the lower front fan.
  • Attach the upper front fan (had to remove and rotate it to make it reach).
  • Attach the built-in speaker.
  • Install the radiator and fans.

At this point I decided to attach the pump to the CPU. This was the trickiest part because the base of the pump has a heat sink with fluid channels, and it is covered with a special heat-conducting paste that will be pressed between it and the CPU to create a good heat-conducting connection. If I got this wrong and I had to remove the pump from the CPU, it would mess up the paste and it couldn’t be used again. I only had one chance to get this right, or else I’d have to buy paste remover and more paste and clean everything off to try again.

Fortunately, everything went fine. I kept going.

  • Run the pump power cable (via SATA-style cable).
  • Attach the pump monitor cable.
  • Attach the top front radiator fan cable.
  • Attach the top rear radiator fan cable.
  • Run the fan USB control cable.
  • Remove the 3.5″ hard drive bay to improve airflow.
  • Install the video card.

That was it. Everything was installed. I attached a monitor, keyboard, and mouse, and then it was time to plug it in and turn it on. I it to show me the BIOS setup screen, but instead the screen remained blank. Uh-oh.

I had heard the fans spin up, and I could see lights on the motherboard, so obviously something was happening. In fact, the fans slowed down after a few seconds, which meant they were under motherboard control. So why wasn’t I getting video?

It turned out I had forgotten to run power cables to the video card. High-end gaming cards draw far too much power to run off the motherboard power bus, but I had forgotten to hook these up. So:

  • Run video card power cables.

After that, it booted up just fine and showed my the BIOS config screen. I plugged in the thumb drive I had built and

  • Upgraded the onboard BIOS software to the latest version.
  • Installed Window 10 Pro.

Then I rebooted to Windows and installed all the rest of the software:

  • Intel chipset drivers.
  • RealTec audio drivers.
  • Intel bluetooth driver.
  • Intel network driver.
  • Intel WiFi driver.
  • MSI App manager.
  • MSI Super charger (enables charging stuff on USB cables).
  • Samsung Magician SSD management software.
  • Corsair cooler control software.
  • NVidia GeForce 1080 drivers and utilities.
  • Windows updates.
  • AIDA64 Extreme monitoring software.

With all the drivers installed and the operating system up to date, it was time to try some overclocking. First I wanted to see how the base CPU looked. So I fired up AIDA64 and ran the stress test. The CPU cores immediately heated up and the case fans all sped way up. And I noticed something odd: There was no air blowing out of the top of the case from the radiator. I held a piece of paper over it, and it got sucked down onto the fan grill.

Dammit. I had installed the fans upside down. The two front fans pull air in, and with the two top fans also pulling air in, the single rear exhaust port was probably not going to keep up. So I had to disconnect all the external cables, open up the case, remove the radiator, remove the fans and flip them, reattach the radiator, close things up, and try again. This time I got the air flowing the right way.

Now it was time to install the all software that makes my computer useful:

  • Chocolatey install scripting software.
  • Chrome browser.
  • Firefox browser.
  • Logitech unifying software.
  • Microsoft Office 365.
  • Epson workforce 845 printer drivers.
  • Notepad++ text editor.
  • 7zip file compression utility.
  • Adobe Reader.
  • Keyfinder.
  • FileZilla FTP client.
  • Greenshot screen capture software.
  • Plantronics headset hub software.
  • Slack messaging.
  • BeyondCompare file comparison tool.
  • Treesize.
  • Microsoft Visual Studion 2017.
  • Resharper.
  • DataGrip.
  • PuTTY.
  • Java runtime.
  • git source code control.
  • Sourcetree GUI for git.
  • R Studio.
  • Python.
  • PyCharm.
  • Kindle reader.
  • Logitech gaming tools.
  • Steam.
  • Google Earth.
  • Ispy
  • VLC
  • Paperscan
  • Brother P-Touch editor
  • Photoshop
  • Lightroom

That sounds like a lot to install, but I use a set of Choclatey config files to install about 2/3 of them automatically in one shot. It went pretty quickly.

So now I’m sitting here working on my brand new computer. It’s a little underwhelming. After all that work, it just doesn’t feel like a shiny new system. Probably because I’m doing all the same things with it as I did with my old computer. But with the clock running at 5 GHz, it does all the things faster.

Courtesanal Access Protocols

by 1 Comment

A while back, I stumbled across a series of posts by New Orleans sex worker Annie Calhoun on the subject of screening clients who contact her through the internet. I was especially struck by the degree of sophistication she shows in her thinking about security.

I realize that sounds condescending, but I don’t mean it that way. Corporate IT security managers would be thrilled if company employees understood security as well as Annie does.

I’m not a security expert, but as a software developer, I am somewhat familiar with the basic ideas behind information security, such as establishing a subject’s identity and controlling access to resources. What was especially fascinating to me about Annie’s posts is that — in part because she does business over the internet — many of her practices bear a striking resemblance to network security protocols.

Start with her section for newbies that explains why screening is necessary.

Just in case you don’t get where I’m going with this: This man was asking me to meet with him alone, in private, when he was completely unwilling to provide ANY information about himself whatsoever.

[…]

I know literally NOTHING about this man.

The man she’s talking about had sent her an email expressing his wish to meet her but did not want to provide screening information such as his name, employer, and phone number. This is a problem for Annie, because there are certain things she wants to establish about a potential client before she is willing to meet him alone in a private place:

For most of us, the client must:

  • be someone we’re willing to spend time alone with,
  • agree to provide the requested honorarium in the amount we’ve specified beforehand (on our websites, listings, etc.)
  • be someone we feel is not a danger to our personal safety.  We each have our own standards regarding what makes us feel safe.

(“Honorarium” is Annie’s way of saying she wants to be paid. Due to the legal climate, sex workers in America tend toward euphemism.)

In the world of information security, we might call the items in that list claims. They are assertions of fact about the client that Annie needs to establish before she will let him meet her. In a sense, Annie is specifying her access control requirements.

Speaking of which, I’m pretty sure that Annie’s access controls imply an additional implicit claim that she wants to establish about a client before she will meet him: Don’t be a cop. She doesn’t say this explicitly anywhere that I can see, but it seems like an obvious concern. (I’m guessing Annie doesn’t mention her no cops requirement because expressing a desire to hide from the police could be taken as evidence she’s doing something illegal.)

When discussing security, we often talk about establishing one’s identity, but in practice the details of an identity are linked to what the identity is used for.

For example, you can leave comments on this blog by signing in with your Twitter account. That doesn’t really tell me who you are, it just tells me you have the password to a Twitter account. So if @JohnSmith signs in, it doesn’t really prove that John Smith has left the comment. It literally only proves that the comment was left by someone with the password to the @JohnSmith Twitter account. That’s good enough for Twitter, and since I only want to offer people the ability to establish a secure history of comments, that’s good enough for me.

Annie’s got more at stake than I do, so she has more stringent requirements. Before getting further into those, however, let’s look at a screening method that doesn’t satisfy her requirements. She offers this fictionalized example:

To: [email protected]
From: [email protected]
Subject: Appointment with you tonight

Hey Annie,

My name is Bob Ross. You may have heard of me. I’m a painter, and I used to have my own TV show. Remember “happy little trees?” Yeah, I started that whole thing. Anyway, I want to meet with you tonight. I know it’s short notice, but I’m sure you can accommodate a slick guy like me.

Talk to you soon,

Bob Ross the TV Painter

That’s not going to work. It’s the equivalent of letting people comment with their Twitter handle without having to login to Twitter. It doesn’t prove the claim that they are the owner of the Twitter account, it only proves they know the Twitter account exists. The only authority for the claim that they own the account is their own assertion that they do. In matters of security, such self-certifications are worth nothing as an authority for a claim. Similarly, Bob’s letter only proves he knows Bob Ross the TV Painter exists, and his self-certified assertion that he really is Bob Ross the TV Painter doesn’t actually prove that he is.

Going into a little more detail, when you sign in with Twitter, my server receives a message from the Twitter server telling me you correctly logged in to your Twitter account. I trust Twitter because their business model depends on them being a reliable authority for identity claims. I believe that the message came from Twitter because it is signed with a certificate that belongs to Twitter. I trust that the certificate belongs to Twitter because it is authenticated with a chain of certificates that ultimately ends with a top-level public certificate that came installed on my server. Once my blogging software has enough information to link all these things together, I know I can trust your comment to have come from your Twitter identity. I have established a chain of trust.

Annie’s problem with Bob’s insistence that she just Google him is that so far there’s no chain of trust. There’s actually only one trustworthy claim she has about him: That he controls the [email protected] email account. The chain of trust for that claim runs through her email provider, which allows her to exchange email with Bob at that address.

Google does tell her a lot of things about Bob Ross the TV Painter, with all the authority of whatever public news stories and websites it finds for her, but it does not close the chain of trust: It doesn’t prove that Bob Ross the TV Painter is the same person as the owner of the [email protected] mailbox.

This problem can be hard to understand when you;re on the other side of it. After all, you know who you are, right? It’s hard to figure out where the gaps are from the other person’s point of view. I’ve run into this a few times when I missed paying a bill and somebody called to ask for their money. I have to explain to them that while I apologize for my error, and I promise to pay as quickly as possible, there is absolutely no way I’m giving my credit card number to a stranger who called me. If I had called them at their public customer service number, that would establish a chain of trust I could believe in, but when they call me, I have no proof that they are who they say they are.

Annie understands these things, and she goes through some trouble to explain several possible chains of trust to Bob:

What I need is an email address that is associated with you publicly and professionally. For instance, if you work for PBS, and the PBS website lists Bob Ross’s email address as [email protected], that will work perfectly. You can either shoot me a quick email from that account, or I can contact you through that address and you can reply that you’ve received that message. Then, I’ll know that you are really Bob Ross, the TV Painter.

The chain of trust is pretty clear. Annie trusts her email provider, so she trusts the claim that email from [email protected] is from whoever controls the [email protected] email address. As for the claim that the owner of [email protected] is Bob Ross the TV Painter, Annie trusts that Bob’s employer wouldn’t put fake contact information its public website, so if they say that Bob Ross the TV Painter has the email address [email protected], that’s enough to authenticate the claim for her. She now trusts that she’s talking with Bob Ross the TV Painter.

But perhaps Bob Ross is afraid to use his work email address for his dalliances with harlots. That’s why Annie offers a second option: She’ll send him something through his public address, and then he can respond to it through the [email protected] address, thus extending the chain of trust  to that address. In other words, Annie has reinvented the computer science concept of a bearer token.

When you login to your bank’s website, you provide your credentials — your username and password — in order to access the first page of the site. In return, the server generates a cryptographically secure token — basically some random data that would be hard for someone else to guess — and sends it back to your browser. After that, as you navigate around the website, whenever you click to bring up a new page, the browser sends the token along with the page request. (In browser terminology, the token is a cookie.) Since the server knows it gave out that token to a user who provided valid credentials for your account, possession of the token proves you are the owner of the account without your having to send along the username and password with every request.

Annie’s plan works the same way. She can send a message like this to Bob’s public account, referring to a randomly made-up order amount and using a made-up name (this is my example, not hers):

To: [email protected]
From: [email protected]
Subject: Thank you for your order!

Robert,

Thank you for your order. Your credit card will be billed $21.57.

Margaret P. Granholm
Sales Associate

Bob can then respond from the private account that he used to contact Annie earlier:

To: [email protected]
From: [email protected]
Subject: Got your message.

Hey Annie,

Got your message. Here’s the information you asked for: The amount is $21.57 and the sales associate’s name was Margaret P. Granholm.

Talk to you soon,

Bob Ross the TV Painter

The public websites establish the chain of trust to assure her that [email protected] is controlled by Bob Ross the TV Painter. And since she sent that address a token composed of the made-up name and amount, she knows that anyone who has that information must be Bob Ross the TV Painter, so when she gets that token back via the [email protected] address, she can close the loop and verify that [email protected] really is Bob Ross the TV Painter.

She further explains a similar technique over the phone:

Alternatively, you can supply a phone number that is traceable to you. Let’s use the PBS example. PBS lists Bob Ross’s office contact number as (504) 555-5555. I can call that number and ask to speak to Bob Ross, and all you have to say is “Yes Annie, it’s me,” and I’ll know I’ve been emailing back and forth with the right guy.

She also explains how the chain of trust can be broken:

However, if you only supply me with a phone number for a prepaid phone, or a number that, when Googled, is not attached to your name or business, that doesn’t really help me.

Backing away from the details a bit, the purpose of all this is to establish that [email protected] is a client that Annie can do business with rather than somebody who will hurt or arrest her. It’s possible to do this more directly:

And if neither of those methods works for you, you can also provide references (names and contact info or websites) from two established professional companions/providers/escorts you’ve met with in the past. I’ll contact them to make sure you’re safe and a gentleman. When they respond positively, I’ll get back to you and we can set up an appointment.

Elsewhere she clarifies the information she needs about the other escorts:

Generally, when we ask for references, we’re looking for a name, email address, and a link to a website. For example:

This way, the provider can look at my website and see that I’m legit (or even search for my name on various ad, screening, and networking sites) before contacting me).

Notice again, the careful chain of trust: From the public website to the email address to the escort’s emailed verification that the client is safe.

One thing we might wonder is why does Annie put so much trust in public websites. How much does a website really prove? Couldn’t a cop or a serial killer set up fake escort sites? The short answer is that although public websites aren’t hard to set up, they do require an order of magnitude more work than getting a gmail address. That additional work will tend to screen out some bad actors.

Again, this is a common technique in information security. For example, it’s used in encrypted password systems to prevent password guessing. Passwords are stored in a hashed format that is computationally expensive to test, so even if a hacker obtains an encrypted password, it will be time-consuming to test password guesses.

Annie’s basic goal here is to pick verification techniques that are difficult for someone to spoof. A malicious person would have to plan ahead by setting up two fake escort websites with email addresses. And while setting up a website isn’t very hard, it’s considerably harder to setup a convincing website, especially for someone like Annie, who’s actually in the business. She could easily research the other escorts to determine their legitimacy.

To show how this works, let’s use Annie’s own website as an example, and look for signs that she’s legitimate. We can see that her WHOIS entry shows that her domain was registered in March of 2012 and the Wayback Machine starts picking up content from it in May of that year. Furthermore, Annie has purchase an advertising page on the Eros guide for New Orleans and at Preferred 411, and before they shut down U.S. access, she had reviews on The Erotic Review from 2012. Annie is also active on Twitter, and her website and Twitter bio link to each other to close the trust loop.

All of this is evidence of an internet presence going back for years, which is a strong indicator of legitimacy. If the Annie Calhoun identity was only created so that someone could give out fake escort references, the perpetrator must have gone through a lot of trouble to set all this up, and they’ve somehow maintained the fiction for six years without anyone blowing the whistle on them. It seems far more likely that Annie Calhoun is a legitimate escort who began working six years ago, which means that a reference from her is most likely legitimate.

It’s worth noting that Annie doesn’t have to do all the work herself. The online escort industry is large enough that it has spawned a services industry to support it, and escorts like Annie have been able to use screening services to do some of the work. The feds have been shutting things down lately (in their effort to stop sex work by making it more dangerous), but in the past, Date-Check performed screening, The Erotic Review had some kind of whitelist for clients that allowed escorts to vouch for them, and Preferred 411 did both screenings and escort endorsements. 

In computer security terms, these sites act as trusted third parties that verify claims. Some of the sites issue ID codes that escorts can check and others use email addresses, but all of them eventually provide a chain of trust between the potential client and some information that can be used to judge whether he’ll make a good client.

It turns out that a lot of potential clients don’t want to cooperate with the screening process because they don’t like revealing their identity to a stranger. That makes things difficult, but note that Annie’s screening goals — “someone we’re willing to spend time alone with…agree to provide the [correct payment]…be someone we feel is not a danger to our personal safety” — do not include knowing the client’s true name.

Getting the person’s true name is usually a practical requirement for screening, but we could imagine other ways of establishing trust. For example, if several other legitimate sex workers say that the person at the [email protected] email address, and he was a great client, that might be good enough. His control over the email address proves he’s the person the other sex workers met, and their references establish his safety. Annie might consider that sufficiently strong evidence that he meets her standards even if she does not know his name. (Or not. I can’t speak for Annie) The referring sex workers might not establish that the owner of the [email protected] address is Bob Ross the TV Painter, but they do help establish the other claims Annie is interested in, such as agreeable personality, ability to pay, and safety.

Again, Annie doesn’t have to do all of this for herself. If she works for an agency or a brothel, they may provide the screening services. The computer security equivalent would be a trusted third party that enforces compliance to certain standards, such as workflow orchestration services like IFTTT and Zapier, or business coordination services like athenahealth medical billing or Quickbooks payment processing.

I find it fascinating that American sex workers face some of the same security problems as software engineers, and that they solve them in analogous ways. Annie’s thoughts on issues of identity are particularly clear, and they parallel a lot of modern thinking about identity on the internet. If more people learned to think about these issues the way Annie does, a lot fewer people would fall for phishing schemes and other con games.

Trump and the Art of the Vandal

by Leave a Comment

On Monday of last week, Harley-Davidson announced that it will be moving production of motorcycles destined for the European Union to somewhere outside the United States. The reason isn’t hard to understand:

In response to U.S. duties on European steel and aluminum, the EU enacted tariffs Friday on more than $3 billion worth of U.S. goods including bourbon, yachts and motorcycles.

U.S. tariffs on steel and aluminum imports have increased the cost of Harley-Davidson’s raw materials at the same time the European tariffs on motorcycles made it less profitable to sell U.S.-made motorcycles in Europe, so the company is moving their manufacturing operation outside the U.S. to avoid both sets of border-crossing taxes. It’s a logical business decision, and the possibility that some U.S. manufacturers would do things like this in response to tariffs was entirely predictable to anyone with even a modicum of economic education or business experience.

Naturally, Harley-Davidson’s decision made Trump angry, because he’s a babyman who cries when he can’t get his way: 

God, what a bully Trump is. He’s the abusive boss who makes life hell for employees and then calls them “ungrateful losers” when they quit. He’s the father who beats his son and then calls him weak for crying. Trump is driving companies out of business and then blaming them for quitting.

That’s not true. Harley-Davidson was responding directly to new tariffs. They announced in May of 2017 that they were moving some production to Thailand to avoid that country’s just-announced 60% tax on imported motorcycles, In addition, by manufacturing in that region, they would also be able to avoid some taxes when selling into nearby countries. Of course, they wouldn’t need to do that if they were protected by some sort of free trade pact that limited tariffs against U.S. manufacturers, such as the Trans-Pacific Partnership agreement that Trump had pulled the U.S. out of just four months earlier.

Thanks to Trump foolishly tearing apart our hard-won international free trade policies, Harley-Davidson had a strong incentive to reduce production in the United States and open factories in not just one but two separate economic regions. This is not exactly shocking: When you create isolated islands of trade, the market will create isolated islands of production. That’s wasteful, and it will cost American jobs and ultimately reduce the income of Americans.

For example, Jack’s Ornamental Iron, a small ornamental metal working company, has been forced to cancel a planned expansion because of Trump’s taxes:

The two were caught off-guard when President Donald Trump announced tariffs on foreign steel. Jack’s watched the price of steel shoot up nearly 25 percent in just two weeks.

“We buy roughly a million dollars worth of steel a year,” Schow said, “so that’s going to be $150,000 to $200,000 in additional cost to our business.”

The tariffs have put a halt to the growth of the company — plans to buy a nearby building for possible expansion are no longer a reality, Schow said. Also, plans for employee raises and expanding their workforce of 25 have been put on hold for now.

This illustrates one of the worst aspects of Trump’s trade war: It’s unnatural and therefore unpredictable. Jack’s Ornamental Iron was following all the rules for success in in the market — hard work, high-quality production, good customer relations — and yet their plans for expansion were scuttled by changes in tariffs. Every business now faces additional uncertainty in its planning and investments because of Trump’s stupid trade war.

It gets worse. As Reason‘s Eric Boehm argues, Trump’s trade policy will put a lot of power over businesses into the hands of government bureaucrats:

At three manufacturing plants in Arkansas, some 1,500 workers are waiting to hear whether the Commerce Department will let them keep their jobs.

Those workers make a product that you’ve probably never thought much about: tire cords. They are the lattice-like structures, often made of steel fibers, that line the inside of rubber tires to help them maintain their shape. The owners of those three Arkansas-based tire cord manufacturing plants say they will have to close their doors and lay off their workers, Arkansas Today reports, because the type of steel wire needed to make tire cords is not available from domestic manufacturers and foreign suppliers are now subject to a 25 percent import tax. They have applied for a special exemption from President Donald Trump’s steel tariffs, and the Commerce Department is considering the request.

Because of Trump’s trade policies, it’s no longer enough to run an efficient business and produce a good product. You have to kowtow to bureaucrats.

Perhaps nothing else about the ongoing debate over tariffs so clearly demonstrates the quiet horror of the Trump administration’s attempt at central planning. Workers and factory owners who produce a necessary but unremarkable product, filling a hole in a supply chain that few Americans ever notice, now fear that they will be forced out of business if their application for relief does not find favor with federal bureaucrats.

They are hardly alone. More than 1,200 businesses have filed over 20,000 requests for exemptions from the Trump administration’s steel tariffs.

I started writing this last week, and since then the trade war has created a few more casualties:

On Friday, the Trump administration levied tariffs on some $50 billion of Chinese goods, including everything from x-ray tubes and aircraft tires to ultrasound machines and agricultural equipment. China retaliated with its own tariffs on imported Americans cars, meats, and produce.

[…]

“Every time there is a trade friction, the first thing that gets hit with retaliatory tariffs are the fresh products,” says Steve Reinholt, export sales director for the Washington-based agricultural export company Oneonta. “We pack and ship things within 48 hours. If you have a bit of a slowdown, it can effect things quickly.”

Hardest hit, says Reinholt, are the cherry growers his company buys from, who over the past decade had been doing steadily increasing business with China.

[…]

“We’re very much expecting to have less volume to China this year,” says Thurlby. “Historically we would ship two million boxes in July alone. There’s just no way we see that happening this year, not with the amount of tariffs we’re talking about.”

Exporting to China had always been a challenge for the 2,500 or so Pacific Northwest growers that Thurlby’s organization represents. In the past, these growers have had to contend with a flat 10 percent import tax as well as a 13 percent value added tax.

Trump’s trade policies have only made things worse.

In response to the U.S.’s protectionist drift, China has upped tariffs on U.S. produce twice in the last three months, once in April and again last week, getting us to the 50 percent tariffs growers now have to pay.

This sort of micro-management of the economy isn’t just some unfortunate side effect. Trump is bragging about it:

I suspect that Trump gets this attitude from his years as a New York real estate developer. For a lot of people in local government, the job is not about the civics textbook version of government — passing good laws, running departments efficiently, serving constituents. Rather, it’s about making deals: Factory deals, strip mall deals, housing deals, stadium deals, land deals, development deals.

If you’re a businessman who wants to buy some land and develop it into a shopping mall with a residential complex, you will have to involve city politicians and planning officials every step of the way. You definitely need them to get zoning variances and permits, maybe some rent-control exceptions, permission for curb cuts, connections to city water and sewer, and so on. In addition, if you have enough influence (as Trump certainly did), you can probably get them to throw in some tax breaks, or maybe even use eminent domain to grab some of the real estate you need. You’ll get your lucrative development deal, and the politicians will get campaign contributions and bragging rights for bringing in new development and jobs.

That was the world Trump lived in for decades in New York, and that that seems to be his vision of what he should be doing now: Putting together deals for businesses that will help help him look good. In international trade, this means adding and removing tariffs to choose winners and losers, instead of letting the free market decide. This is pretty much the definition of crony capitalism.

The system of free international trade benefits everyone who participates, and Trump is tearing it down, hurting people on all sides. When you forcibly take value from other people to keep for yourself, that’s stealing. But when you simply destroy things that are valuable to other people, to the benefit of no one, that’s vandalism.

css.php