E-piphanies Ziff Davis Enterprise
Advertisement
Advertisement
Friday, June 20, 2008 10:44 AM/EST

The Trojan Social Open-Source Drop-Down

UPDATED June 23, 2008
My wife is in charge of online donations for a large international relief agency, and she recently received a strongly worded e-mail from the leader of a pro-Israeli group accusing her organization of anti-Semitism and anti-Zionism, and threatening to spread the word among potential Jewish contributors--not a good thing.

I'll spare you the rant, but the upshot was that we learned that the "country" drop-down menu on one of her organization's donations pages omits Israel as a country and includes "Palestine." Among other things, this means that Israelis can't donate to the organization from these pages.

This isn't the case on the agency's own site, but it was the case on the pages for Causes, which puts widgets on social networks like Facebook and MySpace that let members donate to their favorite charities (including my wife's).

When I got a hold of Sean Parker and Joe Green (the co-founders of Project Agape, which created Causes), they tried to fob me off with a "Thanks, we'll look into this" response. Not what I was looking for.

I pointed out that this isn't just any omission and addition. When you omit Israel and add Palestine (which is not even recognized as a country by the United Nations) to a country drop-down menu, you seem to be making a very loaded political statement.

However, it turned out that this was not intentional, but the result of a set of unrelated circumstances that are the direct result of using open source and Web 2.0 frameworks carelessly.

According to Agape's developer, Chris Chan, Causes uses code from a Ruby on Rails API to build its country name drop-down. The form in RoR's API indeed includes "Palestinian Territory, Occupied," which was then shortened to "Palestine."

Folks at Agape have now overridden the defaults, and Palestine doesn't show up in their drop-downs anymore. But that still doesn't entirely solve my wife's problem, because Israel still isn't on the list.

That's an entirely different issue.

Causes uses Network for Good as its payment processor, and Network for Good has identified Israel, along with about a dozen other countries, as a significant locus of online fraud.

In fact, Causes has the following disclaimer in its Facebook FAQ:

Due to high rates of fraud, donations to U.S. non-profits are not accepted for cardholders from the following countries: Ukraine, Indonesia, Yugoslavia, Lithuania, Egypt, Romania, Bulgaria, Turkey, Russia, Pakistan, Malaysia, Israel, Nigeria and Ghana. We apologize for any inconvenience, and are working hard to support donations from more of these countries.

Nigeria, Russia and some of the others make sense. But Israel and Turkey? If you were of a suspicious mind, you could say that Turkey is being punished for being unacceptably secular in the minds of certain fanatics.

Green and Parker say they are strong supporters of Israel, and that it pains them that they can't accept donations from those countries.

Green e-mailed me:

As someone who cares deeply for Israel, please understand that this was an honest mistake, and we appreciate your pointing it out. Trust me that we have been working hard with Network for Good to enable donations from Israel and all of the other countries that we currently cannot accept donations from.

Chan also pointed out that "cutting the ability for donors from Turkey and Israel was an important issue for us, as they accounted for a substantial percentage of non-U.S. donors."

I believe them, but I'm not exonerating them. They were extremely sloppy, and should have known better. Parker is himself no stranger to social networking--his fingerprints are all over Plaxo, Napster and Facebook.

They should have checked the code they were using, especially because they know quite well the ramifications of letting widgets loose that will spread, well, virally, and uncontrollably. They may want to help, but these kind of issues create more problems than they solve for the very people they're trying to help.

I'm not bringing this up in order to cast aspersions on Causes or Network for Good--I have no reason to believe they are part of an anti-Zionist/pro-Palestinian conspiracy--but to point out how easy it is to lose control of your own self on the Web.

The guy who complained to my wife has no way of knowing that her agency didn't build the widget that was being used on Facebook. It was natural for him to make inferences about her organization based on what he saw.

Basically, my wife's organization was put at risk by the combination of open-source code and social media--two incredibly powerful and pervasive trends influencing enterprise technology today. And like the broomsticks in "The Sorcerer's Apprentice," useful tools can go on a rampage if they're not used by people who know what they're doing.

This means that if you're using open-source code, you have got to be very scrupulous and diligent to make sure that another developer hasn't surreptitiously slipped in a political message or a feature that could make your organization look bad or even lose it money.

And always be mindful that once you let third parties touch your enterprise in any way, decisions they make will be broadcast around the Internet whether you like them or not. Basic Web 2.0 technologies are proving to be both incredibly powerful and productive, but they can also lead to disastrous results for an organization that isn't paying close enough attention.

SECOND UPDATE: Katya Andresen of Network for Good (NFG) sent me a long email protesting the high-minded intentions of her organization and justifying the inclusion of Israel as a high-fraud country. Among others, she sent me to this link on Wikipedia, which oddly does not include Israel.

I did find a PDF file from e-commerce fraud protection service Digital River that shows Israel as having one of the higher rates of fraud dollar amounts per country. That said, the country listed just above it is Japan, and it's not on NFG's list of proscribed countries.

Clearly, fraud detection isn't an exact science at this point. But as the comments on this blog illustrate, you can probably go crazy trying to reduce fraud by trying to guess where e-commerce fraud is likely to come from. As one commenter said, he's an honest, hard-working guy from Nigeria--why should he suffer for the reputation of his country (warranted or not)? The answer probably lies in fraud detection software built on better algorithms, rather than probabilistic responses that proscribe entire countries from participating in e-commerce.

UPDATE: I just got a call from Katya Andresen of NFG (Network for Good), who said the list of countries for which they have concerns regarding fraud was developed by "e-commerce experts." She added that NFG is "committed to processing donations from all countries" but first needs to put in place "additional layers of security." She said those should be in place by the end of 2008.

On the face of it, I have trouble accepting her claim that the 14 countries have been identified by leading e-commerce players and consultants. I've looked at a lot of "country" drop-down menus over the past week, including on the likes of Amazon.com, and they somehow manage to include Israel. She said she'd e-mail me the sources for how the list was created, and I'll update this post again when I receive it.

TrackBack

TrackBack

http://blogs.eweek.com/cgi-bin/mte/mt-tb.cgi/14023

Comments (84)

In other news, I wanted to go do some research on Turkey and Israel being in a rather two-of-these-things-are-not-like-the-others situation, but when I type in "ecommerce israel turkey fraud" Google gives me a message I have *never* seen before:

" We're sorry...

... but your query looks similar to automated requests from a computer virus or spyware application. To protect our users, we can't process your request right now.

We'll restore your access as quickly as possible, so try again soon. In the meantime, if you suspect that your computer or network has been infected, you might want to run a virus checker or spyware remover to make sure that your systems are free of viruses and other spurious software.

We apologize for the inconvenience, and hope we'll see you again on Google. "

Ron :

And when I Google for "ecommerce israel turkey fraud", the only result is this eweek page...

Ron :

And when I Google for "ecommerce israel turkey fraud", the only result is this eweek page...

Biscuits :

Tell them they can come back and play with the adults when they've learnt to treat other human beings with respect.

That group could have just asked politely, being rude, insolent and attacking the inclusion of Palestine. This says a lot about how most pro-Zionist organisations view the rest of the world.

tkb :

Yes it would be disturbing to receive that letter, however my questions would be very focused on who did the verifying and approval of the website workings. You blame the upstream authors. Should not any responsibility be put upon those putting the face of your wife's organization on the internet? How silly for something that's so important to be overlooked.

Vexorian :

eweek: What on HELL does this have to do with open source? The RoR API is clear: http://api.rubyonrails.com/classes/ActionView/Helpers/FormOptionsHelper.html . They are including Israel, and "Palestinian territory occupied". If you have actualy reporter ethics you should change your title to "Beware of using Agape" but nope, you had to say it is a Social Open Source trojan so you put the blame on the entire OS world. Thanks eweek for this non-sense, thanks.

This is somewhat laughable argument, that FOSS software needs to be checked before use :)))!!!

The matter of fact is _any_ software must be checked before use.
There is no difference in this regard between foss and proprietary software.

Let me make you aware of similar incident happening with a Delhi based indian company (i am an indian)

They suddenly found out a show cause notice from indian customs and a separate notice that their consignment of product brochures is being burnt at the airport. With a product launch two weeks away they were in serious trouble. But the fault was with the foreign ad agency who used some big corporation's (which i think makes toilet paper too) map software to generate a world map. And the map included quite a political statement.... kashmir was entirely shown as part of pakistan and not india. The same mapping software is banned for quite some time in India. What was worse is that the ad agency couldn't fix it in time cause changing to a new software was just too lengthy process and existing software was proprietary. And the product launch had to be delayed lots of money lost and company got blacklisted in indian customs.
(Had it been open source it would have been really easy to fix it by just hiring a part time coder.)

Jim Thomason :

I own an E-store, and had to stop taking orders from Israel because of fraud. As I recall, most (if not all) of the fraud was from the "occupied territories".

Dan :

I am the CEO of a very successful and international e-commerce business. In the past 10 years of business neither Israel nor Turkey have produced a single fraudulent order. Surprisingly Turkey produces many good quality customers and high value orders for us. We would concur with the rest of the country list. Indonesia is by far the largest producer of fraudulent orders. It surpasses all other countries combined.

Rick :

Let me get this straight ...
1. your wife's organization strays out of its technical depth
2. it installs a bunch of software it doesn't understand, without configuring properly and testing that the software meets its needs

==>

Somehow it's then the fault of the open source developer that his software didn't anticipate the carelessness of your wife's organization ?

If you read the GPL (and similar licenses) there are very explicit sections where it talks about being void of warranties and being provided as-is.

If not the letter of the law, it's clearly the spirit of the contract that while the developers have made best effort if you choose to use the software, you are taking on responsibility for any unforeseen flaws. Read the Cathedral and the Bazaar - the value proposition for open source developers has always been feedback == testing. By not doing it and then venting at them for your lack of preparation, you are in fact leaving the restaurant without paying the bill.

I think the real lesson here is "you can't run any enterprise well by shirking your responsibility to manage your PR, and with websites that means actually testing exhaustively before releasing". Welcome to the world of grown-up software.

Bill :

C'mon, Rick, there's 'testing exhaustively' but there's also the 'who would have thought to look' factor. Unless you're already paranoid to begin with (and considering much of the world's attitude toward Israel, that's not an unreasonable default), who would have thought to look there?

Yeah, it's silly to blame the software for this. People who deploy the software have to be sure they know what they're doing. If they're not able to accept responsibility, then they should pay for a qualified developer to do it for them.

lee doolan :

,----[ Abhijit Bhopatkar ]
| The matter of fact is _any_ software must be checked before use.
| There is no difference in this regard between foss and proprietary software.
`----

I agree with Abhijit that you should vet any software that you use in
your business.

I would add, though, that if you find open oource software to be
lacking in some regard, then you can change it. That's the whole
point, the raison d'etre, of FOSS.

On the other hand, if you find proprietary software to be similarly
lacking then there's not really very much that you can do about it.

happypinguin :

And why on earth does somebody put something into production without checking it properly?
This can happen in any kind of software, not only in opensource.

But even worse! According to you, the developers that choose to spent their time and efforts in the development of a free and opensource software whose purpose is mostly to serve community should be responsible by your wife incompetence?

You should thank the software devs for giving you a respectable answer. If was me, I would raise you the middle finger.

expert :

Turkey is one of the leading countries for internet fraud. I have had ... on several occasions ... been called in to resolve hacking and fraud issues which traced back to TURKEY !

Any how basically I agree with rick above, things were done by people who had no technical knowledge and then they got an angry e-mail ... go figure ... now they are sad and crying over this ... do it right the first time and hire some one who has a clue, im sick of people complaining about things because they did it on the cheap and got burned.

Matt :

It's your wife's fault for not ensuring the donation process was reviewed. Stop blaming software developers for a business decision by the management of this Network for Good organization.

Barius :

This is by far the most silly article I've ever read. Where does the author get off putting *any* blame on OS in any form? If I were the litigious type I'd sue him for defamation, but I fear even the most computer illiterate judge would laugh him out of court for his pure stupidity.

First, would a proprietary product include palestine in the list of countries? Maybe, maybe not, just the same as any OS product may or may not.

Second, the author blames OS for the omission of Isreal before actually checking his facts. Then, when he finds out it was in fact an error on the part of a proprietary vendor he adds a blurb at the end with no apology.

Change the title or delete the article, but for your own sake, get the f off the 'net until you grow up and stop posting before thinking.

rosignol :

Nigeria, Russia and some of the others make sense. But Israel and Turkey? If you were of a suspicious mind, you could say that Turkey is being punished for being unacceptably secular in the minds of certain fanatics.

Your suspicion is completely misguided.

Israel has accepted a huge number of immigrants from eastern europe. Where there are eastern europeans, there will also be eastern european crime rings. Eastern european crime rings are among the major perpetrators of online fraud. That's just how it is.

If you want to know more, feel free to email me.

alanj :

Coincidentally, I just ran across this:

http://iovation.com/pressroom/news/28/

"Of the countries that iovation performed at least 250,000 device reputation queries in Q1, Israel topped the list of the highest percentage of denied transactions at 15%."

...and yes, it's pretty silly to label this as an issue with open source in particular.

Matt Helsley :

It may be that large and/or commercial organizations with lots of money/insurance (Amazon.com) can absorb the costs of fraudulent credit card activity while small non-profit charies cannot. That could explain the inconsistency you observed.

I don't see how this kind of thing couldn't happen using commecial software. It's not unique to open source. Furthermore, based on anecdotal evidence, you haven't established that it's more likely to occur with open source.

Assuming you had established those points, how could open source development (in this case RoR) change to prevent problems like this? There are already an extraordinary number of technical problems handled in such projects. Are you seriously suggesting that in addition to being technical geniuses open source developers must be political analysts too?

Clearly for people who claim expertise in technology and politics Project Agape has some work to do. The value of your tale lies not in the "Trojan Open Source" but in Agape's failure to recognize the political charge that would be associated with this technical detail. However, I don't think this demonstrates gross incompeten
ce on their part. Nobody gets 100% of the details right (in commercial or open source software) and there are always some suprising details to be discovered in any new endeavor.

The bigger problem is the pro-Israeli leader came at you with a rather big stick. That's his ego/attitude problem and not a "Trojan Open Source Drop-Down". I think the title of the article should have been "Religious Leader Makes Wildly Unsound Accusations".

dave :

Now wait a second, you can blame the software or you blame the people using it for choosing it.. in either case it's a relatively honest mistake. Folks tend to use other people's free software so as not to have to re-invent it. Checking all the names in the country list so you don't have to create a country list sort of obviates the whole thing. We as a species only progress mentally by conceptually encapsulating ideas and building on them. The whole idea behind this encapsulation is so you don't have to re-interpret every single thing you've ever known in order to understand a single new idea. I don't blame them for not looking at every country, Israel, Palestine or whatever, especially if they're not Israeli or Palestinian. Geez.

I obviously don't blame the open source movement either, nor the specific authors of the code you're using for free, and expecting no particular 'fitness for a purpose' from. So what is wrong with saying 'whoops! sorry, we didn't mean any offense. Here's what happened and why it looks this way.' I guess just arriving at the truth without someone to blame just doesn't cut it in modern society. Sometimes, in real life, you can't find someone to sue when you're pissed off. Thank goodness.

Eric :

I have to agree that this is embarassment over a naive mistake masquerading as analysis. A series of coincidences and (as others have pointed out) total lack of testing by the end recipient leads to some email complaint? That's software methodology problems on the part of the organization, not any flaw in any software package whatsoever.

On a more detailed note, using Amazon as a reference point is a huge mistake. Amazon somehow manages (who knows exactly how) to have one of the most lenient credit card policies of any retailer anywhere. My brother routinely uses his Venezuelan-issued credit card on Amazon because noone else will take it. So, again, do a little more homework before concluding.

A better article would have said: "my wife's organization was naive about software. Here's a tale of why, even though websites seem like they're something an intern can build, they're actually software programs, so it's really important to do research and acceptance testing before going live with them." That's a great point in a spirit much closer to what really happened. But the projection of blame onto various software packages and service providers, plus the vaguely Zionist outrage makes the author look like he's trying to find political and analytical cover for his friend's mistakes.

cubanbob :

Matt why is it an ego problem when a real functioning state is not included and a non existing country is? Gee, wonder what the Chinese reaction would be if China was not on a drop down list but Tibet was? perhaps Biscuit would be happy if Israeli's treated Palestinians like the other Arabs treat Palestinians. Or Kurds. Or Copts. Or for that matter like they treat each other.

Moral of the article: if you are going ask for donations, don't piss off potential donors. Check your software first. No one is obligated to give to your charity so be mindful you don't offend the potential donors and donor base. Just like a restaurant, it could serves thousand of wonderful meals, but if yours is bad or your treated poorly you won't be back and probably spread the word around.

plh :

I had no idea that the "country" drop-down menus in closed proprietary software are automatically politically correct and not configurable either by third party developers or site building end users.

Thanks for the tip, Mr. Hickins. ;-)

port :

looks like several pages have "israel turkey fraud" all in the same sentence according to google.

Does the author know how to use google?

James :

The real villains here are the commercial banks which will close merchant accounts for only 3% chargebacks. If alanj's statistic above -- 15% chargebacks from Israel -- is correct, then any merchant account holder offering the use of it for web charge card services would have to have a suicide wish to allow any source of that many chargebacks.

Good luck asking the banks to allow larger chargeback rates from their merchant accounts.

asdf :

why is open source in the title? cause people are stupid.

yes you.

Michael :

I was directed to this article for a laugh and was not disappointed until I realized that it wasn't satire.

The opening summary should have explained that your wife was upset because some software that is designed for use internationally is not politically compatible with a specific charity that caters to a specific country in North America.

A simple failure of the charity to ensure they built their politics into their donation scheme - not sure if it is really related to technology in any way though.

Regardless, thanks for the laugh =)

Rick :

@Bill: no actually those are not too separate things. Testing == checking *everything*, especially on something that is representing you commercially. Anything less than that is *insufficient* testing, or in the case where you looked and didn't notice the code bug: a testing bug.

I've personally released open-source code before that I would not use in a commercial environment. The reason ? Because it's interesting code that someone else with less stringent requirements than mine might benefit from, yet I know that it is not well enough tested to represent a commercial site, so I don't use it myself.

fubar :

The whole point of open source software is if you don't like such an omission, then you can get off your butt and pay some developers to fix it your damnself. They reacted in a really obnoxious way, but this kind of dumb political stuff DOES happen.

At my company, some genius had us unhappily working on one highly irregular deal in which some Chinese company would:

1) take our commercial product and simply strip all imagery and names and replace it with their company logo and name; ONLY for the purpose of concealing its origin (this was beyond simple co/re-branding).

2) fix the timezones files to remove errors like the existence of some place named "Taiwan".

we really should have placed pro Taiwan easter eggs, hidden Falun Gong propaganda, and democracy rants that show up on rare race conditions. It's one thing to add in an entity that's not universally recognized, but quite another to deliberately remove a widely recognized entity for the purpose of trying to convince people that they don't actually exist.

This is a most unfortunate post, as it gives the illusion of research when it is indeed poorly researched.

No one in the Open Source world, not even the Pro-Palestinian (as if that's a bad thing.. how is pro-any ethnicity bad?) abide by the UN classifications when dealing with country lists. In fact, even translations into Arabic do it in that manner.

Short-handing Occupied Territories for Palestine may be a politically loaded statement. How about 'Illegaly Occupied by the Zionist Israelis'? After all, simply saying 'Palestine' seems to avoid the entire issue. Either way, most people familiar with the conflict and open source would simply go with the UN classification and put it word-for-word as to avoid going into this type of senseless discussion.

Go ahead and blame Israel's ministry of economy for not dealing with fraud instead of spewing this garbage.

This is a most unfortunate post, as it gives the illusion of research when it is indeed poorly researched.

No one in the Open Source world, not even the Pro-Palestinian (as if that's a bad thing.. how is pro-any ethnicity bad?) abide by the UN classifications when dealing with country lists. In fact, even translations into Arabic do it in that manner.

Short-handing Occupied Territories for Palestine may be a politically loaded statement. How about 'Illegaly Occupied by the Zionist Israelis'? After all, simply saying 'Palestine' seems to avoid the entire issue. Either way, most people familiar with the conflict and open source would simply go with the UN classification and put it word-for-word as to avoid going into this type of senseless discussion.

Go ahead and blame Israel's ministry of economy for not dealing with fraud instead of spewing this garbage.

James :

This article seems to simply be spreading FUD about Open Source. When in reality it is a failure of your wife's company or their web hosting provider to do adequate testing.

BA :

Sigh...

RoR's list of countries includes Palestine because it has an ISO 3166 code. That's an international standard for country code abbreviations, which assigns the codes PS and PSE to the "Occupied Palestinian Territory".

The ISO 3166 standard is a reasonable place to get a list of countries. Pretty much all computer systems that store countries use ISO 3166 codes. I see no problem here.

The remainder is simply Network for Good excluding Israel (and some other countries) for legitimate business reasons - namely, that the risk of fraud is too high. I see no problem here either.

The real question is - why did the both the original complainant and the original poster immediately jump to the conclusion that it was clearly some kind of anti-semetic plot, or someone making some kind of political point? There's almost always a rational explanation that doesn't involve conspiracy theories.

James :

ps: The omission of Israel isn't even an "Open Source" issue.

Richard :

It wasn't an error in Ruby on Rails by sounds of things, because RoR did what seems sensible and allowed both answers so people from either place could enter what they see as their country.

Was it an error in the fraud list used? Only if you're paranoid.

The problem only came when these two things were combined. It was therefore entirely an integration problem.

Proprietary software is not immune to this either, and no-one can argue that proprietary are without bias or come from countries that don't have their biases. I still note how many school children were using Microsoft's Encarta when I last looked. That encyclopaedia is not exactly neutral towards ideas like open source and reverse engineering, even though reverse engineering is common practice in many engineering industries. Now teaching the kids using a commercial agenda - that's politically incorrect.

sam :

what
the
HELL
does this have to do with Open source software? Do journalists frequently use words without knowing their meaning? Does using the term 'open-source' make you feel, like, cool or something?
Michael Hickins = Sorry Excuse for Journalists
Never reading anything by e-week again.

Niels :

Dear Michael,

It is indeed outrageous and I'm afraid the complot is much much more serious.

Further investigation has revealed that browsers will not check any country list on omission of Israel while when removing all countries they suddenly are aware and inform you of an empty list object!

Moreover, after contacting the main hardware vendors it also became clear they are not accepting liability for free software that result in upset endusers, even when it was run on their very own product.

Richard2 :

How exactly is this a 'trojan'? It is doing exactly what is advertised, and simple testing for a few minutes would have revealed exactly which countries are supported, and the ill-advised shortening of the Palestinian Occupied Territories name.

Stop abusing well-defined terms in order to get a sensational headline and more hits. Something like "Beware Problems with Social Open Source Tools" would have reasonably accurate.

Like others, I will try to never read another eWeek story.

Richard2 :

@Bill: re "who would have thought to look" - are you really saying that a responsible organisation would not check the list of countries that can donate money? Seems like a very basic check, both for fraud prevention and to ensure major donor countries are not missed.

There was a major lack of due diligence here by the columnist's wife, and it is completely unfair to blame the open source developers for this. It would be equally unfair if the third party tool was proprietary.

The whole story has many points where the software supplier is blamed, despite his wife's organisation simply failing to check this. Whether you buy software or get open-source software for free, the rule of 'caveat emptor' applies - it's their own fault they didn't test it properly.

nonissuemadebig :

open the source,
add/edit the items,
close the file,
recompile or reload,
end of story.

What's with all this politics?
(... unless, of course, you're deliberately targetted by a syndicate of powerful corporate/political overlords?)

Gal :

Of course he jumped to conclusion. All these things. continued world denunciations. discussions all over the world about ISrael's right top exist.. nothing but reckless conclusion-jumping. That Anti-Israeli card is drawn again!

nonissuemadebig :

open the source,
add/edit the items,
close the file,
recompile or reload,
end of story.

What's with all this politics?
(... unless, of course, you're deliberately targetted by a syndicate of powerful corporate/political overlords?)

bob :

So basically your wife screwed up, but you need some website hits to sell some advertising, so you deceptively title the 'article' to get people to read it, and then create some asinine logic that blames somebody else (that created and gave you something for free) for your wife's lack of experience/professionalism/competence/whatever. Nice.

The explanation you give seems relevant to me. And that also makes it not a story. It's just a sequence of events that were unrelated, but as a first impression, seemed to have some agenda. But they didn't. So you decided to write an article anyway and be a drama queen about it.

It's funny listening to people who are 'real' journalists and media professionals complain about bloggers and the other amateurs that can now publish themselves on the web and grow an audience. The professionals wouldn't have anything to worry about if the quality of the 'professional' media wasn't so abysmal.

howlingmadhowie :

trojan?

Ryan :

Interesting article, though I think by the time you're through the comments you'll wish that you never posted this rant in the first place.

Sure, it looks like some api had an "extra" country, that is probably fine by itself. The omission of another country, well that's a problem but that API link you provided clearly shows that said country is listed. Perhaps it has been updated, or perhaps your quick scan of the document only produced the result you wanted to see.

From a public relations standpoint you would have been far better off to issue an apology and make public efforts to change this API you rant about. Taking the high road and contacting the developers might be a good start. Maybe you've already succeeded in "making change" but you certainly did not make me want to sign up for your RSS feed.

Andrew :

Last year I was involved with the build of a charity website. Six people across three departments (agency, client and legal) were involved with the country list. We spent about 12 person-hours just on how to represent Taiwan, in the end we went with "Chinese Taipei".

To not have reviewed the country list was just amateur. The use of third party software, propriety or open source, does not imply that testing is not required.

Alex :

It is not a problem with open source; it is a problem with the way credit card transactions work.

Credit cards is a completely outdated, 50-years old system with no strong authentication. For any credit card transaction, a credit card merchant has to _guess_ whether the transaction is legitimate or fraud, based on number of fuzzy criteria. This leads to excesses like banning the whole countries, because it's often the easiest thing to do.

You think it's OK and fair to ban China or Eastern Europe and only feel banning of Israel wrong. I don't feel declining transactions from any country is fair. The problem is this:
imagine, orders from a country A show a fraud rate of 0.1%; orders from a country B show much higher fraud rate of 5%. Is it fair to ban the country B ? Technically, yes. But as a "collateral damage" you punish 95% absolute majority of legitimate orders in the country B!

By the way, Israel is indeed listed as a high fraud country by Digital River (the biggest shareware merchant):
http://www.digitalriver.com/corporate/pdfs/59951100.pdf

LCC :

To all the "your wife screwed up", "incompetent", etc. commenters, did you read the article?

The problem was not on the agency's site but on Causes site. See paragraph 3.

Ryan @ June 22, 2008 4:15 AM suggests taking the high road and contacting the developers. Oh wait, that's in paragraph 4.

Hickins is pointing out an issue with social network widgets that happened to be built with FOSS that through a confluence of events resulted in what appeared to be a political statement. And that means users of FOSS (or proprietary sw) need to be extremely diligent in checking what they use to avoid getting caught in similar circumstances.

It's OK to defend FOSS, but at least direct your arguments to the issues brought up. All the "I'm not reading e-week anymore cuz you dissed FOSS and your wife is incompetent too" commenters need to get a grip.

Jack :

All you are doing here is spreading FUD about open source. This is not in any way an open source problem. It could have happened with any proprietary application. The fact that Amazon has certain countries changes nothing. Allot of companies make stupid decisions or have better tools for detecting fraud. It sounds to me like the current source simply excluded certain countries for real reasons. Now, that decision to exclude based on country might have been a stupid security measure. I don't know. I do know that many companies tag fraud to those whose IP address don't match a credit cards country of origin. That is stupid as all fraudsters know how to 'proxy' around this fraud detection that likely does more harm than good even if it did work right due to the frequent travels of man in modern societies.

Hugo Rabson :

Great article. It sounds as if there is plenty of blame to go around. Let's all try to learn from this embarrassing episode.

Personally, in addition to contacting the software developers, I would patch the software to make sure Israel was included in the drop-down box. If Israel simply *can't* be included, I would offer an additional "Click here if you're from Israel" button, along with an explanatory note. It would be better than excluding an entire country, and a pretty recognizable one that that; it's not as if we're talking about Micronesia.

Jack :

This article has clearly offended more people than that of those who were offended by the missing Israel and inclusion of Palestine. Blaming Open Source! tisk tisk

Frans :

The evil Web 2.0 strikes again. I'm just convinced Web 2.0 (don't know what it means but it sound great doesn't it) is reponsible for fascism towards jews, supports terrorism, causes infections and is in general the Dark Side. Indeed, beware! By using open source (you're asking for troubles aren't you?), web 2.0 technologies, I've got to wonder: whose side are you on???

malapart :

Actually there is ZERO issue with FOSS software.
The list of countries is correct.
The faulty assumptions about added/deleted
countries have been courteously answered
(and corrected) by the OSS author(s).

The booking service removes from this list
certain countries it does not like.

It would have been good practice for the wive
to ask if there are limitations to this service.
IMHO This is a contract issue.

The elevated style of reporting is designed to
improve viewing numbers ( which seems to have
worked out quite well )
A question remains: did the author get a charitable
contribution from the fount that SCO drinks from ?

On another note:
I don't see how card fraud is an issue for charities.
There is no product complementing the money transfer.
Thus rejected transfers are less income but no loss.

malapart

James :

If the people who used the code should have checked it for sloppiness then your wife should have checked what countries were allowed to donate. She is as much at fault as the guys who software she was using on the social networking sites

David :

Re: Jaz-Michael King

I've seen that message when searching for recipes on foodnetwork.com, I don't think we can infer anything about Google from the message.

Mike :

I'd reiterate that it is your wife's organization's responsibility to ensure that the organization's web presence is presentable. Sorry that it's extra work! I don't think there's any harm in contacting the widget's developer to alert them of the problem. However, ultimately, one must take responsibility for one's own.

As the developer who committed the current list of countries to rails I feel obliged to point out that we chose the ISO3166 list as our source data precisely to avoid any potential accusations of taking a political stand in our software.

I'm sorry that a bug in Causes and a mis-handled feature for ecommerce fraud detection caused your wife issues, but I don't believe there's anything else we could have done in this case.

Raoul Ortega :

All the defenders of FOSS are here because a posting appeared on slashdot. For those of you not familiar with it, it's where the pugnaciously stupid compete with the aggressively ignorant to see who can be more fanatical when it comes to their beloved Holy Open Source Software. (And both groups have reading comprehension difficulties, so their motto is "insult first, don't bother with reading the article".) Say anything less than nice, and be prepared for a reactive temper tantrum, as you see here.

brian :

sound like you need the following:


  • a new payment processor...
  • make a one line code change to your app to include the word "israel" in the dropdown...

samer :

Zionists are the most organized minority that can take the largest country with their orchestrated efforts, they even have software to track anti-Israeli comments on bloggs and websites it is called Megaphone. It is as good as any Google Bot.

Ian :

Wow! So you are telling me that you have to test Open Source software too? You can't just assume it's all good but you can when you pay money for it? Come on, this is nonsense, this should have been caught in testing.

Likudnik :

OMG, this is so offensive! Palestinian children being starved to death is NOTHING compared to how offended me and my whiny Zionist friends getting shafted by a dropdown menu! Committing genocide for over 60 years isn't anything, damnit, we want our goddamn entry on the drop-down menu YESTERDAY! Owning both Obama and McCain isn't enough! WAH! I WANT MY MOMMY!

Likudnik :

Also, if we're going to talk about Open Source, that's phooey that's communismz! Secrets in plain sight -- that's where it's at! Trust us Zionists, we've had nuclear weapons for decades that we officially deny to everyone on the world, then get the U.S. to bomb Iraq and Iran for nuclear weapons they don't even have! Hahaha! We'll strike Iran's nuclear facilities but we'll keep the Dimona reactor in the Negev desert! Nyah nyah nyah nyah nyah! Neener neener neener!

Committing genocide for over 60 years isn't anything, damnit, we want our goddamn entry on the drop-down menu YESTERDAY!

Let's see. There were about 3/4 of a million Arab residents of Palestine in 1947. Today there are 1.5 million Arabs in Gaza alone, and perhaps 5 million people who claim to be Palestinian worldwide. Whether they are actually descended from people with longstanding ties to the geography is a matter of some serious debate, but since they now self-identify as "Palestinians" we can use their numbers for the purpose of evaluating your charge of genocide.

The Jews/Israelis must be piss poor practitioners of genocide if after 60 years of it the Palestinian population has soared.

Meanwhile, the Arab and Muslim world has ethnically cleansed itself of its former Jewish inhabitants.

Middle-ager of Zion :

...and, here come the nutjobs :)

DensityDuck :

Wow. Lots of blame-the-victim here. I guess if your wife didn't want to be raped then she shouldn't have worn that dress!

Want extra linkage to your thin article on how your wife's system integrator screwed up? Put in some FUD about open source and blame it on the ruby guys. That'll bring the page views!

Come on folks, don't feed the troll.

sfcmac :

It's amazing when you come across people who think that there's a country called "Palestine".
Last I checked, there wasn't any such thing on a world map.

Steve :

.....and these countries are removed because of the risk of online fraud, but Palestine would not be a risk of online fraud???

One thing I’ll say—you FOSS zealots are even more reactive than religious fanatics and ultra-nationalists. And your zealotry is getting in the way of understanding the facts.

You’ve missed the single most important point I was making—the drop-down menus in question are not on my wife’s site, and she has no control over them. The menus are on social networking sites, and were created by a third party that is unconnected (and not able to be controlled) by my wife’s agency.

But the episode is instructive in that, if you’re using FOSS, you do need to check content as well as feature functionality.

This episode is all the more interesting because the people who are left with egg on their face is Causes and Agape, who implemented the drop-down across a series of social networking sites without realizing it included Palestine. (It happened to be Palestine. That’s not the issue. The issue is that it was unintended and causes a furor that undermines the purpose they were trying to achieve.)

And those people from Agape are not neophytes by any stretch. So maybe you think you’re so smart this could never happen to you. If that’s the case, why even bother reading technical publications? You already know everything there is to know.

For the others, please understand that I think FOSS is a critical component of the democratization of the Internet. It is hugely important, because it gives creative minds everywhere the tools necessary to improve their and our lives, and breaks the hegemony of proprietary software which gives rise to complacency.


Christopher Jackson :

There was never, in the entire history of the world, a sovereign nation called Palestine. And until the 1960's the term "Palestinian" was a purely geographical term that just meant anyone who lived in that region, including the Jews.

And there are many, many regions in the world today whose occupants feel that their territory is "occupied" by rulers they don't like, either of their own or some other ethnicity. (Including, for example, almost every country in Africa.) Yet we all know which "occupied territory" everyone loves to focus on, don't we? I wonder why?

Hint: the majority of anti-Semites throughout history have denied that they were anti-Semites; they usually claim (perhaps even to themselves) that their concern is just with some political or social issue. Right.

alanj :

Michael, your original post implied a connection to open source because some activist might have "slipped in a political message". Aside from the issue that this risk isn't unique to open source, your hypothesis has been thoroughly debunked by commenters.

The Palestinian territories were on the country list because they're part of an ISO-standard country list, the same one that a proprietary software vendor might use. Israel is blocked by a (non-open-source) payment processor because it is, despite your protestations of disbelief, a major source of ecommerce fraud.

So, yes, when you continue asserting this phantom connection between this episode and risks of open source software, people who support open source software are going to yell at you. And rightly so.

You do have a legitimate point about the dangers of relying on code you can't control, and how this is becoming more common in today's web with sites like Facebook. If you'd stopped at that, you'd have an interesting article. Of course, you'd also have 5% as many hits.

malapart :

Hello Michael,
imho you mix what agape does and how they do it.

They seem to have used OSS software.
But they are a commercial entity
> Project Agape is a venture backed start-up based in Berkeley, CA.
that provides a service your wife has decided to use.
part of this service ( direct or brokered ) is credit card transactions.
to be save from fraud they have decided not to
do transactions with certain countries.
Thus these countries are not provided in the menu.
( Leaving all other countrynames that have not got
prominence as fraud orignators )

A pressure group disguised as your wifes unhappy customer has tried to leverage this situation
to push a political issue.

I still do not see this as an OSS issue.


Jimbo :

Israel is a major source of chargebacks for my hotel clients too, but not because of actual fraudulent charges.

The typical scenario is as follows:
People visit, stay for the full duration, start complaining loudly on the last day, ask for a rebate upon departure, don't get it (if you don't complain during the stay we cannot fix the issue), still sign their credit card slips, go home, and complain start badgering the support department for a rebate, followed by filing a dispute with the credit card company. Not sure if this is post-vacation spending remorse or modern-day haggling (heckling?)

My clients prefer customers that aren't from Israel (or the occupied territories, pretty much the same thing, isn't it?)

Furthermore, you should read up on Turkey's problems with hackers... Many of the latest mass hacks of bulletin boards, Joomla, etc. originated from Turkey.

Likudnik :

Killing Palestinians is sane! Supporting apartheid South Africa is sane! Trading nukes with them is sane! Punishing people for taking pictures of them is sane! Denying that you ever had nukes is sane! Refusing IAEA inspection is sane! Insisting on bombing Iraq for refusing inspection of non-existent nukes is sane! Threatening to bomb Iran for non-existent nukes is sane!

Laughing at spoiled Israelis who want more donations in spite of being one of the top destinations of military aid, that's INSANE! And anti-Semitic!

Matt :

cubabob:

Maybe "ego" isn't exactly the right word.

My point is this leader seems to have persecution issues -- he assumed the only explanation for the omission is anti-semitism. He threatened this charity based on his insecurities and his sense of his power over them rather than bother to determine why "Israel" wasn't listed. I used the word "ego" because it looks like the leader feels he's someone of power who can and should make trouble for others based only on flimsy evidence.

Bumba Chumba :

Summary:

*whine* *whine* *israel* *whine* *whine*

Why am I not surprised.

There are political entities in contention all over the world. An "international" NGO should know that. You can't blame software for lack of editorial oversight.

It's not clear if:

1. The "Causes" was using your wife's organization's name unilaterally without the organization's permission.

vs

2. Your wife's organization requested inclusion in "Causes", and apparently did not do sufficient due diligence into what the donor user experience would be like.

Over it... :

Bottom line, the problem was inadequate testing of the system.

BTW, thank you zionists for seeing an opportunity for reminding us goim how anti-semitic we are. And
being critical of actions by the sovereign nation of Israel is in no way the same as being anti-jewish. To use the "anti-semitic" slur to deflect criticism is a cop out.

"Nigeria, Russia and some of the others make sense..."

Pray say, why does Nigeria, Russia and some of the others make sense? Have you personally been defrauded by a Nigerian? Or are you just echoing what you see/hear in your own media? I think it's the latter. I might be wrong though. Correct me. I'm a Nigerian. Making an honest living, waking up, going to work, coming back and being good to my family. There are many more people like me in my country. Just like there are many more people like me in your country. At the same time, there are people in my country who wake up everyday with plans to con other people with silly tales. I'm sure there are a lot of people like that in your country too. So how does it make sense that honest people from my country be denied access to meaningful commerce because of the few thieves who operate from out of here? Why does it make sense for the honest people in your country to have access to meaningful commerce in spite of the few thieves who operate from out of there? I think it's only fair that people like you should stop propagating news that you only hear from other people until you have hard facts researched by yourself or personal experiences.

njcommuter :

Is there any way to process Israeli credit card payments through an Israeli bank, which would presumably be better equipped to deal with Israeli problems? And likewise for Turkey?

Somehow, the vast majority of the comments on this seem to have hijacked the debate into a "we hate Israel," "we love Israel" debate.
I'm not a computing professional, but it seems to me the point is just "be careful who writes your software."
Now, can we all please grow up and support better software and world peace...?

Post a Comment

 
 


Advertisement
Advertisement