38.0000,-97.0000
April 10, 2016 12:08 PM Subscribe
How an internet mapping glitch turned a random Kansas farm into a digital hell: For the last decade, [Joyce] Taylor and her renters have been visited by all kinds of mysterious trouble. They’ve been accused of being identity thieves, spammers, scammers and fraudsters. They’ve gotten visited by FBI agents, federal marshals, IRS collectors, ambulances searching for suicidal veterans, and police officers searching for runaway children. They’ve found people scrounging around in their barn. The renters have been doxxed, their names and addresses posted on the internet by vigilantes. Once, someone left a broken toilet in the driveway as a strange, indefinite threat. All in all, the residents of the Taylor property have been treated like criminals for a decade. And until I called them this week, they had no idea why.
Wow, that is a great story and way to go this reporter for (hopefully) getting it fixed, but also holy crap, how did nobody at that company think of this before now?
posted by LobsterMitten at 12:20 PM on April 10, 2016 [8 favorites]
posted by LobsterMitten at 12:20 PM on April 10, 2016 [8 favorites]
Why on earth would you return a default location instead of an error code?
posted by Pope Guilty at 12:20 PM on April 10, 2016 [43 favorites]
posted by Pope Guilty at 12:20 PM on April 10, 2016 [43 favorites]
Do they have grounds for a lawsuit against MaxMind? Obviously they can prove damage from MaxMind's incompetence.
posted by Chocolate Pickle at 12:20 PM on April 10, 2016 [7 favorites]
posted by Chocolate Pickle at 12:20 PM on April 10, 2016 [7 favorites]
I get why they targeted the geographic center of the nation, but it seems like it would make better sense (at least to me) to point to a nation's capitol.
posted by Thorzdad at 12:24 PM on April 10, 2016 [9 favorites]
posted by Thorzdad at 12:24 PM on April 10, 2016 [9 favorites]
We traced the house. It's coming from inside the call.
posted by oulipian at 12:26 PM on April 10, 2016 [69 favorites]
posted by oulipian at 12:26 PM on April 10, 2016 [69 favorites]
Why on earth would you return a default location instead of an error code?
It's not an error, it's just a very unfocused result that gives an illusion of greater accuracy because it identifies a point instead of a zone. Apparently Mapmind is now relocating default results to the middle of bodies of water, but the question is why they don't include return values indicating the degree of precision?
posted by fatbird at 12:28 PM on April 10, 2016 [17 favorites]
It's not an error, it's just a very unfocused result that gives an illusion of greater accuracy because it identifies a point instead of a zone. Apparently Mapmind is now relocating default results to the middle of bodies of water, but the question is why they don't include return values indicating the degree of precision?
posted by fatbird at 12:28 PM on April 10, 2016 [17 favorites]
Doesn't jessamyn live in the middle of a lake, according to Google Maps? Now she's going to receive all the harassment. :(
posted by hippybear at 12:33 PM on April 10, 2016 [11 favorites]
posted by hippybear at 12:33 PM on April 10, 2016 [11 favorites]
But IP mapping isn’t an exact science.
I guess not. My IP location (according to the in-text link IP locator) is in the middle of a farmer's field hundreds of miles away from the city in which I live. I don't get it.
posted by kozad at 12:37 PM on April 10, 2016 [1 favorite]
I guess not. My IP location (according to the in-text link IP locator) is in the middle of a farmer's field hundreds of miles away from the city in which I live. I don't get it.
posted by kozad at 12:37 PM on April 10, 2016 [1 favorite]
I'm glad the reporter looked into it. It's a small thing, but they might have actually made a serious difference in these people's lives.
What struck me is just how oblivious the people at MaxMind were when told about the problem, which should have been very foreseeable. When you put data out there, people will use it, and if you're lucky 10% of them will pay attention to any disclaimers about the accuracy. And that's if there are disclaimers, even.
There should be some kind of responsibility for this. And they don't seem to get it, other than saying "oops our bad we'll fix." Like ... this actaully impacted people's lives, guys?
posted by Kutsuwamushi at 12:39 PM on April 10, 2016 [16 favorites]
What struck me is just how oblivious the people at MaxMind were when told about the problem, which should have been very foreseeable. When you put data out there, people will use it, and if you're lucky 10% of them will pay attention to any disclaimers about the accuracy. And that's if there are disclaimers, even.
There should be some kind of responsibility for this. And they don't seem to get it, other than saying "oops our bad we'll fix." Like ... this actaully impacted people's lives, guys?
posted by Kutsuwamushi at 12:39 PM on April 10, 2016 [16 favorites]
Why on earth would you return a default location instead of an error code?Remember, the software was almost certainly written for another purpose, for which the strict accuracy wasn't important. Or, more likely, it was a demonstration product's default value that failed to get removed prior to Production deployment.
But now, they have a different problem. By not returning a null value, a special code, or something else that designates the address isn't appropriate, the later software that *relies* on this software almost certainly isn't going to handle any changes they make gracefully. In other words, even if they wanted to, they likely can't return an intelligent answer that won't cause issues, because it would break compatibility with products for which this is a dependency.
posted by mystyk at 12:39 PM on April 10, 2016 [3 favorites]
This is not a "glitch" - it's an intentionally wrong result, presumably because the folks designing the API were lazy fucks who didn't want to code "unknown" as a result.
posted by rmd1023 at 12:41 PM on April 10, 2016 [23 favorites]
posted by rmd1023 at 12:41 PM on April 10, 2016 [23 favorites]
Obviously they can prove damage from MaxMind's incompetence.
I don't think that's obvious. It may or may not be worth their while to litigate, but I suspect there's a big difference between what people believe MaxMind does, and what MaxMind actually specifically claims they do.
Having said that, I'm pretty happy to hear that MaxMind's response was to directly take responsibility for fixing the situation, that's pretty great. There are a lot of lessons to learn here about the power and responsibility that comes with the default settings and assumptions in widely-used software.
posted by mhoye at 12:42 PM on April 10, 2016 [6 favorites]
I don't think that's obvious. It may or may not be worth their while to litigate, but I suspect there's a big difference between what people believe MaxMind does, and what MaxMind actually specifically claims they do.
Having said that, I'm pretty happy to hear that MaxMind's response was to directly take responsibility for fixing the situation, that's pretty great. There are a lot of lessons to learn here about the power and responsibility that comes with the default settings and assumptions in widely-used software.
posted by mhoye at 12:42 PM on April 10, 2016 [6 favorites]
What struck me is just how oblivious the people at MaxMind were when told about the problem, which should have been very foreseeable.
Given enough hindsight, everything seems like it should have been forseeable. The fact of the matter is that people will use your software for whatever they use your software for, in whatever way they find it useful, and that process is often very far removed from the creator's intentions. I mean, MaxMind's business seems to be a service to enable high-level fraud mitigation.
They almost certainly didn't and maybe couldn't have foreseen individuals, much less law enforcement or people bent on revenge, drilling into their data to four digits of accuracy without understanding it.
posted by mhoye at 12:45 PM on April 10, 2016 [4 favorites]
Given enough hindsight, everything seems like it should have been forseeable. The fact of the matter is that people will use your software for whatever they use your software for, in whatever way they find it useful, and that process is often very far removed from the creator's intentions. I mean, MaxMind's business seems to be a service to enable high-level fraud mitigation.
They almost certainly didn't and maybe couldn't have foreseen individuals, much less law enforcement or people bent on revenge, drilling into their data to four digits of accuracy without understanding it.
posted by mhoye at 12:45 PM on April 10, 2016 [4 favorites]
In digital maps, that number is an ugly one .... So back in 2002, when MaxMind was first choosing the default point on its digital map for the center of the U.S., it decided to clean up the measurements and go with a simpler, nearby latitude and longitude ....
That seems like very poor and sloppy reasoning.
posted by Greg_Ace at 12:45 PM on April 10, 2016 [19 favorites]
That seems like very poor and sloppy reasoning.
posted by Greg_Ace at 12:45 PM on April 10, 2016 [19 favorites]
Pope Guilty: “Why on earth would you return a default location instead of an error code?”
fatbird: “It's not an error, it's just a very unfocused result that gives an illusion of greater accuracy because it identifies a point instead of a zone. Apparently Mapmind is now relocating default results to the middle of bodies of water, but the question is why they don't include return values indicating the degree of precision?”
It's an ambiguity, and in data gathering an ambiguity is an error, generally. Specifically, this is an error except in cases where the only thing you want to use the data for is determine what country an IP address maps to. (I would guess that those cases are relatively rare, but I can imagine plenty of them I suppose, so maybe not.)
The real answer is probably something more like:
MaxMind set their data to return a point, rather than a zone, because points are what the client was paying for, and general imprecision is almost always judged better than stated ambiguity by the non-data people who pay for data, even though general imprecision is actually worse. They wanted to sell a set of geographical pinpoints for IP addresses (not a structured dataset including geographical pinpoints, state zones, and country zones) because clients wanted to buy a set of geographical pinpoints for IP addresses.
Markets breed deception and obfuscation, even when they're literally markets for data – especially when they're markets for data, because the larger the dataset, the easier it is to handwave away general imprecision.
posted by koeselitz at 12:46 PM on April 10, 2016 [33 favorites]
fatbird: “It's not an error, it's just a very unfocused result that gives an illusion of greater accuracy because it identifies a point instead of a zone. Apparently Mapmind is now relocating default results to the middle of bodies of water, but the question is why they don't include return values indicating the degree of precision?”
It's an ambiguity, and in data gathering an ambiguity is an error, generally. Specifically, this is an error except in cases where the only thing you want to use the data for is determine what country an IP address maps to. (I would guess that those cases are relatively rare, but I can imagine plenty of them I suppose, so maybe not.)
The real answer is probably something more like:
MaxMind set their data to return a point, rather than a zone, because points are what the client was paying for, and general imprecision is almost always judged better than stated ambiguity by the non-data people who pay for data, even though general imprecision is actually worse. They wanted to sell a set of geographical pinpoints for IP addresses (not a structured dataset including geographical pinpoints, state zones, and country zones) because clients wanted to buy a set of geographical pinpoints for IP addresses.
Markets breed deception and obfuscation, even when they're literally markets for data – especially when they're markets for data, because the larger the dataset, the easier it is to handwave away general imprecision.
posted by koeselitz at 12:46 PM on April 10, 2016 [33 favorites]
There was probably a reasonable-at-the-time rationale for these MaxMind clowns to pick the approximate middle of the country as the default. Maybe they wanted unlocated addresses to be auto-classified as inside the US for some analysis or another. But the fact that they were blithely using it in geolocating services they were selling to police forces is almost criminally dumb.
why they don't include return values indicating the degree of precision?
Most end users of this service probably never see a coordinate pair, just an address or a dot on Google Maps. I doubt anyone other than a confluence.org member would recognize that location. It sounds like their new default is probably something like (0,0), which will only confuse navies searching for pirates in the Gulf of Guinea.
posted by theodolite at 12:49 PM on April 10, 2016
why they don't include return values indicating the degree of precision?
Most end users of this service probably never see a coordinate pair, just an address or a dot on Google Maps. I doubt anyone other than a confluence.org member would recognize that location. It sounds like their new default is probably something like (0,0), which will only confuse navies searching for pirates in the Gulf of Guinea.
posted by theodolite at 12:49 PM on April 10, 2016
This problem must crop up for lots of similar applications. I wonder if it would be worth having the government (or ICANN or whoever the relevant authority is) designate points that will be interpreted by all systems as "USA, location not further specified" or "Virginia, location not further specified" or even "New York City, location not further specified" -- rather than every one of these systems using a kludge like pointing to bodies of water or parks and hoping that end-users will know how to interpret that.
posted by LobsterMitten at 1:07 PM on April 10, 2016 [8 favorites]
posted by LobsterMitten at 1:07 PM on April 10, 2016 [8 favorites]
They really should have returned state or national capitols instead. That's what many people think of as the "default" spot for a region.
posted by sbutler at 1:15 PM on April 10, 2016 [2 favorites]
posted by sbutler at 1:15 PM on April 10, 2016 [2 favorites]
Sitting in a bar in Brooklyn, yet I would appear to be in their front yard.
posted by aloiv2 at 1:22 PM on April 10, 2016
posted by aloiv2 at 1:22 PM on April 10, 2016
39.8333333,-98.585522. So back in 2002, when MaxMind was first choosing the default point on its digital map for the center of the U.S., it decided to clean up the measurements and go with a simpler, nearby latitude and longitude: 38°N 97°W or 38.0000,-97.0000.
This is very problematic; in this single sentence I can see several problematic conceptual, implementation, and ethical decisions that a college-trained engineer or computer scientist should have learned to anticipate.
I wish these people would sue MaxMind. Perhaps that's unlikely, but so I take comfort that this will be documented on one of those software engineering blogs as yet another illustration of shitty programming choices.
posted by polymodus at 1:24 PM on April 10, 2016 [11 favorites]
This is very problematic; in this single sentence I can see several problematic conceptual, implementation, and ethical decisions that a college-trained engineer or computer scientist should have learned to anticipate.
I wish these people would sue MaxMind. Perhaps that's unlikely, but so I take comfort that this will be documented on one of those software engineering blogs as yet another illustration of shitty programming choices.
posted by polymodus at 1:24 PM on April 10, 2016 [11 favorites]
The answer to "where is the United States" can reasonably resolve to some point in the middle of the country, but that's not what this API is for -- it's for pinpointing the location of a specific computer. When an accurate location is impossible to determine, MaxMind would rather provide wrong information than a null, or some error code, or even a list of coordinates bounding where they do know the IP is located, because that makes their API look better.
Hey, it always returns an exact longitude and latitude! It must be pretty good, and what could be easier?
MaxMind's whole business is based on geolocation, so I'd be surprised if their engineers didn't know exactly what tradeoffs they were making.
posted by swift at 1:34 PM on April 10, 2016 [5 favorites]
Hey, it always returns an exact longitude and latitude! It must be pretty good, and what could be easier?
MaxMind's whole business is based on geolocation, so I'd be surprised if their engineers didn't know exactly what tradeoffs they were making.
posted by swift at 1:34 PM on April 10, 2016 [5 favorites]
I'd imagine the programmers at the coalface were totally aware of this issue. Returning a coordinate under all circumstances is the kind of thing management picks as a solution (or worse, hardcodes into specs and contracts) when the engineers ask for guidance.
posted by grahamparks at 1:35 PM on April 10, 2016 [17 favorites]
posted by grahamparks at 1:35 PM on April 10, 2016 [17 favorites]
Given enough hindsight, everything seems like it should have been forseeable.
This is true, but I don't agree that this particular oversight is a case of "hindsight is 20/20." People misunderstanding the tool and believing that the default points are accurate is almost inevitable.
Seriously, these were people selling a tool to locate IP addresses. They therefore knew that people would use the tool to locate IP addresses. At best, it was extremely oblivious of them to think that all of their users would have a sophisticated understanding of the tool and would interpret the default points accurately.
It really is just terribly obvious that when you sell a tool for locating IP addresses, and millions of IP addresses return a default location, that many users will end up being given these default locations. You know they'll use that information (the purpose of the tool is to give it to them), and it's oblivious to think that none of them will misuse them because the way the tool works is technically obscure to them.
I'm not sure it was criminal, but it was certainly a fuck-up that shouldn't have happened.
posted by Kutsuwamushi at 1:40 PM on April 10, 2016 [1 favorite]
This is true, but I don't agree that this particular oversight is a case of "hindsight is 20/20." People misunderstanding the tool and believing that the default points are accurate is almost inevitable.
Seriously, these were people selling a tool to locate IP addresses. They therefore knew that people would use the tool to locate IP addresses. At best, it was extremely oblivious of them to think that all of their users would have a sophisticated understanding of the tool and would interpret the default points accurately.
It really is just terribly obvious that when you sell a tool for locating IP addresses, and millions of IP addresses return a default location, that many users will end up being given these default locations. You know they'll use that information (the purpose of the tool is to give it to them), and it's oblivious to think that none of them will misuse them because the way the tool works is technically obscure to them.
I'm not sure it was criminal, but it was certainly a fuck-up that shouldn't have happened.
posted by Kutsuwamushi at 1:40 PM on April 10, 2016 [1 favorite]
aloiv2: "Sitting in a bar in Brooklyn, yet I would appear to be in their front yard."
After sitting in a bar in Brooklyn long enough, I could very well be in anyone's front yard.
posted by Splunge at 1:46 PM on April 10, 2016 [6 favorites]
After sitting in a bar in Brooklyn long enough, I could very well be in anyone's front yard.
posted by Splunge at 1:46 PM on April 10, 2016 [6 favorites]
Great piece, thanks for posting it.
It's amazing how many folks here are absolutely positive that they would never have made such an obvious error when the future problem was so easily predictable! MeFites really are smarter than everybody else!
posted by languagehat at 1:47 PM on April 10, 2016 [42 favorites]
It's amazing how many folks here are absolutely positive that they would never have made such an obvious error when the future problem was so easily predictable! MeFites really are smarter than everybody else!
posted by languagehat at 1:47 PM on April 10, 2016 [42 favorites]
Apparently Mapmind is now relocating default results to the middle of bodies of water, but the question is why they don't include return values indicating the degree of precision?
Because that's useful information, and MaxMind is an information merchant. Looking at MaxMind's GeoIP documentation, they do offer an estimated accuracy radius in kilometers, but only with their high-end "Insights" web service. I'd guess that most of the thousands of GeoIP lookup pages on the web opted for the free city-level version of the database, which gives a bare lat/long point.
posted by skymt at 1:49 PM on April 10, 2016 [1 favorite]
Because that's useful information, and MaxMind is an information merchant. Looking at MaxMind's GeoIP documentation, they do offer an estimated accuracy radius in kilometers, but only with their high-end "Insights" web service. I'd guess that most of the thousands of GeoIP lookup pages on the web opted for the free city-level version of the database, which gives a bare lat/long point.
posted by skymt at 1:49 PM on April 10, 2016 [1 favorite]
It's amazing how many folks here are absolutely positive that they would never have made such an obvious error
A certain amount of working in computers and IT is really hating you-6-months-ago, because nobody is stupider than yourself when you have to recover from a past bad decision.
posted by rmd1023 at 1:55 PM on April 10, 2016 [43 favorites]
A certain amount of working in computers and IT is really hating you-6-months-ago, because nobody is stupider than yourself when you have to recover from a past bad decision.
posted by rmd1023 at 1:55 PM on April 10, 2016 [43 favorites]
39.8333333,-98.585522.
At the small risk of belaboring my concerns, and irrespective of the expectations and responsibilities of tool users, what I find perverse and offensive about this story is that, literally, programmers/management have allowed the problem of round-off errors dictate how some people may live their lives.
posted by polymodus at 1:55 PM on April 10, 2016 [2 favorites]
At the small risk of belaboring my concerns, and irrespective of the expectations and responsibilities of tool users, what I find perverse and offensive about this story is that, literally, programmers/management have allowed the problem of round-off errors dictate how some people may live their lives.
posted by polymodus at 1:55 PM on April 10, 2016 [2 favorites]
While due diligence should have been exercised, I doubt any of anyone who decided on the coordinates actually thought "maybe someone lives right there".
posted by hippybear at 1:57 PM on April 10, 2016 [1 favorite]
posted by hippybear at 1:57 PM on April 10, 2016 [1 favorite]
In fact, I doubt they even thought as far as "if we do make these coordinates someone's house, what possible bad things could happen to them".
This was obviously a poorly made decision, but there was no malice. There was only blind choosing with no thought.
posted by hippybear at 1:59 PM on April 10, 2016
This was obviously a poorly made decision, but there was no malice. There was only blind choosing with no thought.
posted by hippybear at 1:59 PM on April 10, 2016
Information Retrieval doesn't make mistakes. Must have been a problem down at Information Dispersal.
posted by RobotVoodooPower at 2:01 PM on April 10, 2016 [13 favorites]
posted by RobotVoodooPower at 2:01 PM on April 10, 2016 [13 favorites]
Yes, but do you have a 27b/6?
posted by hippybear at 2:06 PM on April 10, 2016 [7 favorites]
posted by hippybear at 2:06 PM on April 10, 2016 [7 favorites]
I mean yes, I am pretty sure that I would have foreseen that users would be returned default points, since it was built into the tool, and that they would interpret this as the location of that IP address, since that is the information that I was selling.
I don't think there was malice. I just think there was obliviousness. I don't think I'm smarter than them; I think they were in a bubble.
I think some of that can be attributed to it being 2002 when they first made the decision, but it is amazing to me that they were surprised their data was being used this way in 2016.
And I'll add to this--assuming obliviousness (and not conscious choice to ignore), then the problem is still really systemic and not individual. In the information age, I think that data merchants have an ethical responsibility to think about how their data will/can be used. It doesn't sound like this was part of MaxMind's process, but it should be part of every such company's process.
posted by Kutsuwamushi at 2:07 PM on April 10, 2016 [2 favorites]
I don't think there was malice. I just think there was obliviousness. I don't think I'm smarter than them; I think they were in a bubble.
I think some of that can be attributed to it being 2002 when they first made the decision, but it is amazing to me that they were surprised their data was being used this way in 2016.
And I'll add to this--assuming obliviousness (and not conscious choice to ignore), then the problem is still really systemic and not individual. In the information age, I think that data merchants have an ethical responsibility to think about how their data will/can be used. It doesn't sound like this was part of MaxMind's process, but it should be part of every such company's process.
posted by Kutsuwamushi at 2:07 PM on April 10, 2016 [2 favorites]
That reminds me of the degree confluence project, a deliciously quirky project that was featured on MeFi more than 15 years ago and still seems alive and well. That 38,-97 confluence that the IP locating company so carelessly used has only been visited twice by project enthusiasts, in 2001 and 2006, so before this whole madness started. It's actually located in a field SW of what I assume to be the farm from the article and both DCP visitors found nobody home so the owners, out of bad luck, could not be told the geographical peculiarity of their property, which could have helped them figure out what they later endured.
posted by susuman at 2:07 PM on April 10, 2016 [8 favorites]
posted by susuman at 2:07 PM on April 10, 2016 [8 favorites]
This was obviously a poorly made decision, but there was no malice. There was only blind choosing with no thought.
That's sort of the accepted, typical case when engineers fail. Engineering ethics is a mandatory or encouraged course at all the highly ranked departments, and pedagogical content does not resort to debates about hindsight or intent in order to let designers off the hook.
posted by polymodus at 2:08 PM on April 10, 2016 [10 favorites]
That's sort of the accepted, typical case when engineers fail. Engineering ethics is a mandatory or encouraged course at all the highly ranked departments, and pedagogical content does not resort to debates about hindsight or intent in order to let designers off the hook.
posted by polymodus at 2:08 PM on April 10, 2016 [10 favorites]
When we do our on site demo, I want you to make sure that 100% of their test data returns a god damn location, do I make myself clear?!?
posted by benzenedream at 2:11 PM on April 10, 2016 [13 favorites]
posted by benzenedream at 2:11 PM on April 10, 2016 [13 favorites]
My IP address, for some reason, resolves to Beaverton, OR, which is 350 miles from here.
Relying on IP addresses for anything seems to be a fool's way to do the process.
posted by hippybear at 2:13 PM on April 10, 2016 [3 favorites]
Relying on IP addresses for anything seems to be a fool's way to do the process.
posted by hippybear at 2:13 PM on April 10, 2016 [3 favorites]
Someone who makes a tool not fit for the advertised task need not be malicious to be culpable. If your job is to provide data, and the way you misrepresent data causes harm, that's your fault, period.
posted by idiopath at 2:13 PM on April 10, 2016 [2 favorites]
posted by idiopath at 2:13 PM on April 10, 2016 [2 favorites]
This is what happens when a programmer who doesn't plan to be working for the same firm in five years is given a project.
posted by Mooski at 2:14 PM on April 10, 2016
posted by Mooski at 2:14 PM on April 10, 2016
This is utter incompetence on the part of MaxMind's fault. "Oh, I don't want to deal with this edge case" has fucked up the lives of people and they should provide restitution.
Once again, Design for Real Life, people.
posted by fifteen schnitzengruben is my limit at 2:14 PM on April 10, 2016 [5 favorites]
Once again, Design for Real Life, people.
posted by fifteen schnitzengruben is my limit at 2:14 PM on April 10, 2016 [5 favorites]
I thought the article said that Maxmind's database was never intended for, nor advertised, street address-level accuracy? There's still the open question of whether people ignoring this caveat is ultimately Maxmind's responsibility or not (perhaps Maxmind should have made their API return polygons of lat/lng points instead of a single point, but maybe early clients didn't want that, but maybe Maxmind should have insisted or found some other way to pass that data), but "Maxmind shouldn't misrepresent its data as being accurate when it's not" is not the same thing as "Maxmind should handle cases of people misusing their datasets in ways the company never intended." One is more clear-cut than the other.
posted by chrominance at 2:17 PM on April 10, 2016 [9 favorites]
posted by chrominance at 2:17 PM on April 10, 2016 [9 favorites]
While due diligence should have been exercised, I doubt any of anyone who decided on the coordinates actually thought "maybe someone lives right there".
I am sympathetic to the "this could happen to anyone" line of thinking, but I am curious whether any of this could be seen as negligently careless, not necessarily from a programming perspective at MaxMind (although I do think restitution is a reasonable thing to request), but especially for those who relied on MaxMind's data as if it was infallible. This gives me the chills a bit:
posted by SpacemanStix at 2:21 PM on April 10, 2016 [3 favorites]
I am sympathetic to the "this could happen to anyone" line of thinking, but I am curious whether any of this could be seen as negligently careless, not necessarily from a programming perspective at MaxMind (although I do think restitution is a reasonable thing to request), but especially for those who relied on MaxMind's data as if it was infallible. This gives me the chills a bit:
But people do use it that way. Five thousand companies draw information from MaxMind’s database. And most casual internet users don’t know anything about IP mapping defaults—they just know that when a website tells them that their scammer lives in Potwin, Kansas, they get in the car and go.I'm pretty tired of hearing how people end up getting harassed for things they didn't do on the internet. Just like manslaughter can be unintentional [warning: imperfect analogy follows that is not equivalent to manslaughter], I wonder if some people should be held responsible for recklessly getting out the pitchforks and wrecking the lives of others based on incomplete information. To me, "not knowing the data was faulty" may be about as good an excuse as not knowing other sorts of things that lead to unintentionally damaging behavior.
posted by SpacemanStix at 2:21 PM on April 10, 2016 [3 favorites]
I'd love to see the e-mails around the time the PRDs and/or design documents were being finalized.
Long time ago I worked on a project where customized content would be displayed on screens that could be located in all kinds of places all over the world. From bars and nightclubs to shopping malls and private homes. User could set up content filters, geolocation was automatic, but could be overridden.
Some times these settings would be missing, or be corrupted. In this case we had to decide what content to serve.
Engineering has a good mix of nationalities and ages. Product management was mostly US born males with business degrees.
Engineering wanted to serve the safest possible content, a hand curated feed of innofensive and uplifting stuff. Management wanted to default to the American feed with 'no porn' flag, based on bug reports from a couple of bars in London who started getting cats and puppies and children being cute.
We on engineering were sure we would get in trouble the first time we displayed American celebrities in bikinis in some conservative countries (we were thinking about costumers in Malaysia) shopping mall, so we made sure to leave a big email trail and comments on the design docs.
The shit hit the fan from a completely unexpected direction: screenshots and gameplay from some American WW2 game with tons of nazi imagery were shown in public spaces in Germany.
We had the fix live in under one hour. It was a question of searching the code for a comment along the lines of 'when default feed shit inevitably hits the fan, flip this flag.'
I'd love to see if anyone in this company saw this coming and did say anything.
posted by Doroteo Arango II at 2:26 PM on April 10, 2016 [69 favorites]
Long time ago I worked on a project where customized content would be displayed on screens that could be located in all kinds of places all over the world. From bars and nightclubs to shopping malls and private homes. User could set up content filters, geolocation was automatic, but could be overridden.
Some times these settings would be missing, or be corrupted. In this case we had to decide what content to serve.
Engineering has a good mix of nationalities and ages. Product management was mostly US born males with business degrees.
Engineering wanted to serve the safest possible content, a hand curated feed of innofensive and uplifting stuff. Management wanted to default to the American feed with 'no porn' flag, based on bug reports from a couple of bars in London who started getting cats and puppies and children being cute.
We on engineering were sure we would get in trouble the first time we displayed American celebrities in bikinis in some conservative countries (we were thinking about costumers in Malaysia) shopping mall, so we made sure to leave a big email trail and comments on the design docs.
The shit hit the fan from a completely unexpected direction: screenshots and gameplay from some American WW2 game with tons of nazi imagery were shown in public spaces in Germany.
We had the fix live in under one hour. It was a question of searching the code for a comment along the lines of 'when default feed shit inevitably hits the fan, flip this flag.'
I'd love to see if anyone in this company saw this coming and did say anything.
posted by Doroteo Arango II at 2:26 PM on April 10, 2016 [69 favorites]
They really should have returned state or national capitols instead. That's what many people think of as the "default" spot for a region.
I thought it was the main Post Office, at least in the US.
posted by ChurchHatesTucker at 2:27 PM on April 10, 2016
I thought it was the main Post Office, at least in the US.
posted by ChurchHatesTucker at 2:27 PM on April 10, 2016
Dangerous glitch when some very odd people are gunning for you based on incomplete understanding of IP mapping.
posted by meehawl at 2:29 PM on April 10, 2016
posted by meehawl at 2:29 PM on April 10, 2016
They really should have returned state or national capitals instead.
Telling people the government was the source of that spam/fraud/identity theft; what could go wrong with that?
posted by Segundus at 2:41 PM on April 10, 2016 [2 favorites]
Telling people the government was the source of that spam/fraud/identity theft; what could go wrong with that?
posted by Segundus at 2:41 PM on April 10, 2016 [2 favorites]
I thought the article said that Maxmind's database was never intended for, nor advertised, street address-level accuracy?
They're not. Why they even give you latitude and longitude, I don't know. (They have a paid product that tries to tie an IP to a business. If you're using that, you're probably meant to be able to take the lat/long as semi-meaningful. But even five minutes of playing with MaxMind or any of their competitors tells you they're often completely and obviously wrong for anything more specific than the country.*)
You know how sometimes you go to the store locator page on some website and it suggests you're in some ZIP code a couple of miles away? That's the site hitting (likely) MaxMind with your IP asking for a ZIP code.
*There are a few companies out there who will give you information on what business an IP supposedly belongs to. Often the "business" is the ISP.
posted by hoyland at 2:54 PM on April 10, 2016 [4 favorites]
They're not. Why they even give you latitude and longitude, I don't know. (They have a paid product that tries to tie an IP to a business. If you're using that, you're probably meant to be able to take the lat/long as semi-meaningful. But even five minutes of playing with MaxMind or any of their competitors tells you they're often completely and obviously wrong for anything more specific than the country.*)
You know how sometimes you go to the store locator page on some website and it suggests you're in some ZIP code a couple of miles away? That's the site hitting (likely) MaxMind with your IP asking for a ZIP code.
*There are a few companies out there who will give you information on what business an IP supposedly belongs to. Often the "business" is the ISP.
posted by hoyland at 2:54 PM on April 10, 2016 [4 favorites]
It's amazing how many folks here are absolutely positive that they would never have made such an obvious error when the future problem was so easily predictable!
Well, it should have been obvious from the point of formulating Maxmind's business plan. They want to provide geolocating data for IP addresses. They would sell that information to other internet services. What kind of services? Advertisers, for one; apparently, Find-my-Phone and other fraud/theft/etc apps; also fucking law enforcement! Suicide crisis lines! Who wouldn't think that pointing those last two to a random ass point on a map would lead to problems? Let alone when you got to 600 million IP addresses set to "default."
If they didn't have the presence of mind to think of these issues, I'm stunned they managed to even get the business off the ground. This data isn't even faulty; it's straight up false.
This company had to negotiate deals with all of the apps/companies/services that use their data. Those deals must have liability language in them. I doubt they could disclaim all warranties and get the end user services to indemnify them for false or faulty data, who would trust them if they don't stand behind their product? So I would think that someone would have a claim against them for pointing ambulances and other critical services to Nowhere, Kansas.
posted by Existential Dread at 3:02 PM on April 10, 2016 [1 favorite]
Well, it should have been obvious from the point of formulating Maxmind's business plan. They want to provide geolocating data for IP addresses. They would sell that information to other internet services. What kind of services? Advertisers, for one; apparently, Find-my-Phone and other fraud/theft/etc apps; also fucking law enforcement! Suicide crisis lines! Who wouldn't think that pointing those last two to a random ass point on a map would lead to problems? Let alone when you got to 600 million IP addresses set to "default."
If they didn't have the presence of mind to think of these issues, I'm stunned they managed to even get the business off the ground. This data isn't even faulty; it's straight up false.
This company had to negotiate deals with all of the apps/companies/services that use their data. Those deals must have liability language in them. I doubt they could disclaim all warranties and get the end user services to indemnify them for false or faulty data, who would trust them if they don't stand behind their product? So I would think that someone would have a claim against them for pointing ambulances and other critical services to Nowhere, Kansas.
posted by Existential Dread at 3:02 PM on April 10, 2016 [1 favorite]
And wouldn't you know it, according to CheckIP.org, I posted that comment from the Taylor farm outside Potwin, Kansas.
posted by Existential Dread at 3:06 PM on April 10, 2016 [6 favorites]
posted by Existential Dread at 3:06 PM on April 10, 2016 [6 favorites]
I've worked with MaxMind data before. Basically, If you've ever looked at the data, it is clear that the DOD and DARPA realized mapping IP geography as an afterthought to the initial specification. As a result, there were clearly some regions that were designated for key purposes, and other IP masks that were separated out into a logical order - but there's this whole group of IP addresses in which the subnet could literally be anywhere. As a result, those actually report 0,0. Which nets you somewhere in the South Atlantic iirc.
Then someone had the bright idea of labeling the country, or at least realizing that a group of IP subnets were all in the same country... and therefore the data drops those close to the centroid of the country. In this case, that means Kansas. There's another set which is actually owned by Dish or DirectTV which all of their subscribers are netted through and it actually dumps them to their corporate headquarters - which is Delaware or Maryland - either way, I could see it at work by connecting to a web page I was monitoring from my in-laws, noting the IP address, and then looking it up. Honestly, that was pretty funny - since they live in VT. Either way it vastly breaks correct reporting from that town (just as the 38.0 -97.0 did). I chose to mask out those coordinates because - while it was a massive chunk of people when taken out of context - the vast majority of addresses in use do (amazingly) assign themselves to a proper geography. At the time I could basically correlate internet connectivity census stats with household income and region - and yeah... it made sense.
Anyways, the data was good. But, it had to be taken into account that some of the assumptions were done out of convenience, and to work with it - you had to mask the data.
Clearly, other people using the data didn't think about it, didn't bother to understand it, and just slammed it up there. Understandable to some extent - it probably took me a day of custom implementation to find all the little nuances I needed to mask out for it to be useful. Why take the time when you gotta be first to market! by geolocation?
posted by Nanukthedog at 3:12 PM on April 10, 2016 [6 favorites]
Then someone had the bright idea of labeling the country, or at least realizing that a group of IP subnets were all in the same country... and therefore the data drops those close to the centroid of the country. In this case, that means Kansas. There's another set which is actually owned by Dish or DirectTV which all of their subscribers are netted through and it actually dumps them to their corporate headquarters - which is Delaware or Maryland - either way, I could see it at work by connecting to a web page I was monitoring from my in-laws, noting the IP address, and then looking it up. Honestly, that was pretty funny - since they live in VT. Either way it vastly breaks correct reporting from that town (just as the 38.0 -97.0 did). I chose to mask out those coordinates because - while it was a massive chunk of people when taken out of context - the vast majority of addresses in use do (amazingly) assign themselves to a proper geography. At the time I could basically correlate internet connectivity census stats with household income and region - and yeah... it made sense.
Anyways, the data was good. But, it had to be taken into account that some of the assumptions were done out of convenience, and to work with it - you had to mask the data.
Clearly, other people using the data didn't think about it, didn't bother to understand it, and just slammed it up there. Understandable to some extent - it probably took me a day of custom implementation to find all the little nuances I needed to mask out for it to be useful. Why take the time when you gotta be first to market! by geolocation?
posted by Nanukthedog at 3:12 PM on April 10, 2016 [6 favorites]
> Well, it should have been obvious
After the shit has hit the fan, the problem always "should have been obvious." That's what they call Monday morning quarterbacking. I understand the reasons everyone thinks they would have seen this coming from the git-go, but based on my reading of world history and my memory of my own life, I beg leave to have serious doubts about it.
posted by languagehat at 3:12 PM on April 10, 2016 [7 favorites]
After the shit has hit the fan, the problem always "should have been obvious." That's what they call Monday morning quarterbacking. I understand the reasons everyone thinks they would have seen this coming from the git-go, but based on my reading of world history and my memory of my own life, I beg leave to have serious doubts about it.
posted by languagehat at 3:12 PM on April 10, 2016 [7 favorites]
Herzet said that his department’s job has become to protect the Taylor house from other law enforcement agencies.
This is how the surveillance state comes to its max. It begins to eat itself.
(My IP address is 15 miles away from where I sit but it's no biggie I am cooking beans not methamphetamines.)
posted by bukvich at 3:14 PM on April 10, 2016 [1 favorite]
This is how the surveillance state comes to its max. It begins to eat itself.
(My IP address is 15 miles away from where I sit but it's no biggie I am cooking beans not methamphetamines.)
posted by bukvich at 3:14 PM on April 10, 2016 [1 favorite]
Reply All did a similar story recently. (Episode 53.)
posted by anshuman at 3:16 PM on April 10, 2016
posted by anshuman at 3:16 PM on April 10, 2016
Well, it should have been obvious from the point of formulating Maxmind's business plan.
I think we can definitively say that, in fact, this precision issue has not had any serious effect on their business. If it was a proven liability then they would have already fixed it.
I'd wager most of their clients are folks using their data to get broad location data for their analytics. In that context some percentage of wrong data is fine; nobody is using individual IP addresses. Further, all MaxMind needs to do is provide a better service than their competitors. Some percentage of error is expected; they just need to have a smaller percentage than the next guys.
It's useful to look at what MaxMind actually claims. Check out this table of accuracy in their database. I'm seeing a range between 50% and 90% — none of their paying clients are making decisions about individuals based on that.
What you're seeing — as others have pointed out before — is a new application of an old service that, expectedly, doesn't do a very good job.
posted by wemayfreeze at 3:25 PM on April 10, 2016 [4 favorites]
I think we can definitively say that, in fact, this precision issue has not had any serious effect on their business. If it was a proven liability then they would have already fixed it.
I'd wager most of their clients are folks using their data to get broad location data for their analytics. In that context some percentage of wrong data is fine; nobody is using individual IP addresses. Further, all MaxMind needs to do is provide a better service than their competitors. Some percentage of error is expected; they just need to have a smaller percentage than the next guys.
It's useful to look at what MaxMind actually claims. Check out this table of accuracy in their database. I'm seeing a range between 50% and 90% — none of their paying clients are making decisions about individuals based on that.
What you're seeing — as others have pointed out before — is a new application of an old service that, expectedly, doesn't do a very good job.
posted by wemayfreeze at 3:25 PM on April 10, 2016 [4 favorites]
Someone has connected a cable to a physical location (the ISP), so with a legal search warrant a lot of IP's could be located quite accurately. I can understand a decade ago the FBI coming to this poor woman's door but one would think our high tech experts would have identified a glitch in the system long ago. I sure wish the reporter could have the impetus to go the next step and interview agents of the government that have recently conducted investigations on such flimsy understanding of the system. Were they ignorant, just doing their jobs (poorly), or too lazy to execute a warrant?
posted by sammyo at 3:29 PM on April 10, 2016 [1 favorite]
posted by sammyo at 3:29 PM on April 10, 2016 [1 favorite]
5 year prediction: MaxMind moves the default unknown locations to the middle of lakes etc. Somebody buys the lake and builds an island and a house and has unexpected guests.
Internet explodes in righteous indignation once again.
posted by zengargoyle at 3:45 PM on April 10, 2016
Internet explodes in righteous indignation once again.
posted by zengargoyle at 3:45 PM on April 10, 2016
languagehat - they rounded the co-ordinates and didn't even bother to check if anyone lived at those co-ordinates by, oh I dunno, looking at a map? This is negligence. Imagine if someone was building a bridge and rounded down the amounts of sand and cement needed and didn't bother to check whether the bridge would still maintain structural integrity.
There are people who have actually commented in this thread about things they have done in similar situations, and you are basically calling them liars ("I beg leave to have serious doubts about it."
posted by marienbad at 3:48 PM on April 10, 2016 [4 favorites]
There are people who have actually commented in this thread about things they have done in similar situations, and you are basically calling them liars ("I beg leave to have serious doubts about it."
posted by marienbad at 3:48 PM on April 10, 2016 [4 favorites]
The centroid of mis-geocoded locations is at 0°N 0°E. Fortunately Null Island is a happy place, a lovely tourist destination. Come visit!
posted by Nelson at 3:48 PM on April 10, 2016 [3 favorites]
posted by Nelson at 3:48 PM on April 10, 2016 [3 favorites]
Pope Guilty: "Why on earth would you return a default location instead of an error code?"
It's not so much a default location as a best guess (and all these locations services are a guess at sufficient precision) that happens to resolve poorly. IE: the default isn't an error. If the service can only determine the country/state of an IP it picks a point that is roughly equidistant to all points in that landmass. Not taking more care in choosing that point though was an error especially considering they didn't pick the actual centroid but something that made for a nice easy to type/remember coordinate.
Me, I would have picked some nice public landmark. But you do want it to be somewhat close to the centroid; picking say the Whitehouse would mess up a lot of GIS querying.
posted by Mitheral at 4:23 PM on April 10, 2016 [1 favorite]
It's not so much a default location as a best guess (and all these locations services are a guess at sufficient precision) that happens to resolve poorly. IE: the default isn't an error. If the service can only determine the country/state of an IP it picks a point that is roughly equidistant to all points in that landmass. Not taking more care in choosing that point though was an error especially considering they didn't pick the actual centroid but something that made for a nice easy to type/remember coordinate.
Me, I would have picked some nice public landmark. But you do want it to be somewhat close to the centroid; picking say the Whitehouse would mess up a lot of GIS querying.
posted by Mitheral at 4:23 PM on April 10, 2016 [1 favorite]
Product management was mostly US born males with business degrees.
This is a surprisingly common failure point.
posted by GenjiandProust at 4:35 PM on April 10, 2016 [13 favorites]
This is a surprisingly common failure point.
posted by GenjiandProust at 4:35 PM on April 10, 2016 [13 favorites]
I'm not smart enough to understand if this is the same thing, but a few years ago someone posted that thing you could download into Google Earth and it would show you where all the MeFites live. When I loaded it up and zoomed into my area, I noticed that many, many users lived pretty close to me. Then I zoomed in and saw that a whole bunch of people lived in this certain house that's in my neighbourhood. Like dozens of MeFites that could never fit in this one tiny house. I figured it must be that when people just enter "Toronto" to figure out their co-ordinates instead of being more specific, it gives them all this one location.
But then I googled the actual street address and it was disturbing how many results came up: from different forums and chat rooms, people posting "Aha!" type comments, claiming to have found someone and proceeding to dox them, posting the IP address and full home address (the same address that all the MeFites live at!) and sometimes full name of the person. Like "hey John Smith at 52 Main Street, how's the weather in Toronto?" kind of comments. Different people, different issues, but that same address many times.
posted by chococat at 4:35 PM on April 10, 2016 [4 favorites]
But then I googled the actual street address and it was disturbing how many results came up: from different forums and chat rooms, people posting "Aha!" type comments, claiming to have found someone and proceeding to dox them, posting the IP address and full home address (the same address that all the MeFites live at!) and sometimes full name of the person. Like "hey John Smith at 52 Main Street, how's the weather in Toronto?" kind of comments. Different people, different issues, but that same address many times.
posted by chococat at 4:35 PM on April 10, 2016 [4 favorites]
After the shit has hit the fan, the problem always "should have been obvious." That's what they call Monday morning quarterbacking. I understand the reasons everyone thinks they would have seen this coming from the git-go, but based on my reading of world history and my memory of my own life, I beg leave to have serious doubts about it.
Like probably a lot of people in this thread, I have been asked to provide geographic coordinates for IP addresses by an employer, and also used this sort of data for things like prefilling some form fields in e-commerce account creation or checkout. The problem domain has always been riddled with conversations along the lines of "I know you want this information, and I know that we can appear to give it to you, but it is really important that you remember the conveyed precision of this information is bullshit."
In other words, people who are saying that this was a pretty obvious fuckup probably have good reasons for feeling that way. Commercial providers of this kind of data have perverse incentives around its apparent accuracy, and consumers of it have to overcome the temptation to read it as more than a probability, especially given how it's usually displayed. I'm guessing long-time users of a single tool figure this out, because a lot of people are actually pretty smart about patterns in this kind of thing, but you have to know that in fact an IP doesn't map cleanly or easily to a place (except when sometimes it does), and that is a hard thing for a lot of people to know. Even if you tell them that in the clearest possible terms, they often refuse to believe you.
I have a lot of sympathy for programmers involved in this kind of thing, because I know firsthand how incidental small decisions cascade into Real Problems. Fuckups most certainly happen. I have made probably more than my share over the years. But my gut still says that someone for whom this is a primary business should really, very definitely, have thought harder about this problem and acted more responsibly around it.
posted by brennen at 4:38 PM on April 10, 2016 [5 favorites]
Like probably a lot of people in this thread, I have been asked to provide geographic coordinates for IP addresses by an employer, and also used this sort of data for things like prefilling some form fields in e-commerce account creation or checkout. The problem domain has always been riddled with conversations along the lines of "I know you want this information, and I know that we can appear to give it to you, but it is really important that you remember the conveyed precision of this information is bullshit."
In other words, people who are saying that this was a pretty obvious fuckup probably have good reasons for feeling that way. Commercial providers of this kind of data have perverse incentives around its apparent accuracy, and consumers of it have to overcome the temptation to read it as more than a probability, especially given how it's usually displayed. I'm guessing long-time users of a single tool figure this out, because a lot of people are actually pretty smart about patterns in this kind of thing, but you have to know that in fact an IP doesn't map cleanly or easily to a place (except when sometimes it does), and that is a hard thing for a lot of people to know. Even if you tell them that in the clearest possible terms, they often refuse to believe you.
I have a lot of sympathy for programmers involved in this kind of thing, because I know firsthand how incidental small decisions cascade into Real Problems. Fuckups most certainly happen. I have made probably more than my share over the years. But my gut still says that someone for whom this is a primary business should really, very definitely, have thought harder about this problem and acted more responsibly around it.
posted by brennen at 4:38 PM on April 10, 2016 [5 favorites]
(Then again, I probably also wouldn't have gotten into this business in the first place, because it strikes me as intrinsically kind of sketch. It has too many surfaces interacting with too much societal and network dysfunction.)
posted by brennen at 4:40 PM on April 10, 2016 [1 favorite]
posted by brennen at 4:40 PM on April 10, 2016 [1 favorite]
I didn't elaborate earlier, but the immediate software-engineering issue that I saw was that there's actually four categories of data values at play: If the the managers are asking for whole integer representations of important data values in your system e.g. 38, whereas the conceptual representation of angular degrees is not simple at all, e.g. 39º 50'00", your engineers chose floating point precision for convenience e.g. 39.8333333, and by deliberately mapping that to an approximation e.g. 38.0000 (as opposed to 39? 39.8? 40??) you've not only allowed your internal abstraction to dictate API consequences (which is bad, mkay?) but the choice isn't even the usual way of rounding numbers (engineer's red flag, right?)—at first I was thinking what they neglected was analysis to characterize certain precision guarantees provided by their system—now I'm thinking what some programmers are needing is are remedial education in arithmetic, data structures, and software engineering principles, in that order.
The other programming problem that's already been discussed is the issue of null/error values. Again, there are best practices—programming language choices, data structure choices—tools which a first-year college education would have already furnished the programmer's intellect with.
Given these discrepancies, let's interpret this for what it is: money interests over ethics, education taking a backseat, urban interests over the rural. And so on.
posted by polymodus at 4:54 PM on April 10, 2016
The other programming problem that's already been discussed is the issue of null/error values. Again, there are best practices—programming language choices, data structure choices—tools which a first-year college education would have already furnished the programmer's intellect with.
Given these discrepancies, let's interpret this for what it is: money interests over ethics, education taking a backseat, urban interests over the rural. And so on.
posted by polymodus at 4:54 PM on April 10, 2016
Similarly, in my day job I have think daily about potential product liability on behalf of my employer, including in the use by third parties of data we supply. If I were going to supply an emergency service, law enforcement, or the federal government with data, I would be damn sure I understood all the risks, had solid data, and didn't assume any liability for errors or misuse. These guys should have done the same thing; data is all they supply! Just blithely picking a point and rounding to another point is ridiculous.
posted by Existential Dread at 4:59 PM on April 10, 2016
posted by Existential Dread at 4:59 PM on April 10, 2016
Null is kind of the dumpster fire of computer science (a thing that represents nothing turns out to cause confusion, who knew?) but it is, I suppose, what they should have returned.
posted by thelonius at 5:09 PM on April 10, 2016 [2 favorites]
posted by thelonius at 5:09 PM on April 10, 2016 [2 favorites]
"To my knowledge, we have never claimed that our database could be used to locate a household.” said the guy whose company happily will give you four decimal places of precision on lat/long (~20ft in the ground). Seriously, how can you return values that give the precision to locate individual houses and then turn around and say you never claimed to be able to locate a household? You would think that a dude whose entire business is selling numbers would understand that those numbers might have some kind of meaning.
posted by ssg at 5:17 PM on April 10, 2016 [8 favorites]
posted by ssg at 5:17 PM on April 10, 2016 [8 favorites]
FYI: MaxMind gives out a freebie version of their IP mapping coordinates which is what everybody seems to use to get these spurious results. The paid version gives you a few options on what to do with the unknowns.
... just as an FYI...
Once again, people on the internet complain about something that is free on the internet. This is my surprised face at the outrage.
posted by Nanukthedog at 5:18 PM on April 10, 2016 [5 favorites]
... just as an FYI...
Once again, people on the internet complain about something that is free on the internet. This is my surprised face at the outrage.
posted by Nanukthedog at 5:18 PM on April 10, 2016 [5 favorites]
So I am comforted my IP puts this computer in Waukegan Michigan. Then I have to ask, is someone currently hijacking my computer in Waukegan Michigan? Then I guess it is not so good. I am deliberately, deliciously unimportant. So there is no cause for that, just take some time to browse anonymously, never synch, and some other things.
posted by Oyéah at 5:21 PM on April 10, 2016
posted by Oyéah at 5:21 PM on April 10, 2016
Yeah, yeah, yeah, I know my life is more transparent than some glass jellyfish, oh laughing Gods of Metafilter. Schprut.
posted by Oyéah at 5:22 PM on April 10, 2016
posted by Oyéah at 5:22 PM on April 10, 2016
After the shit has hit the fan, the problem always "should have been obvious." That's what they call Monday morning quarterbacking. I understand the reasons everyone thinks they would have seen this coming from the git-go, but based on my reading of world history and my memory of my own life, I beg leave to have serious doubts about it.
I know how fun it is to poke at all of metafilter when you're out of your field of expertise, but seriously dude. This is basic exception handling shit.
posted by aydeejones at 5:23 PM on April 10, 2016 [2 favorites]
I know how fun it is to poke at all of metafilter when you're out of your field of expertise, but seriously dude. This is basic exception handling shit.
posted by aydeejones at 5:23 PM on April 10, 2016 [2 favorites]
If you're going to use a "magic number" to represent an exception because you can't return NULL, you think about it and choose something that is essentially meaningless, and if you can simply plug numbers into a map search to determine if they might represent something "real" you just do that. It is a thoughtless decision that was actively made.
posted by aydeejones at 5:26 PM on April 10, 2016
posted by aydeejones at 5:26 PM on April 10, 2016
I'm a little intrigued here by all the people here who are saying how obvious and irresponsible Maxmind are for causing this problem because they'd have thought of the problem immediately, but yet give the impression this is the first time they, the poster, have ever thought about it. I wasn't surprised by the issue because it's been annoying me for years.
Am I the only person here to have come across spammy ads that tell you how this [city 200 miles away] mom lost 22lbs in 3 weeks, or other horrendousnesses of using the modern internet?
posted by ambrosen at 5:34 PM on April 10, 2016
Am I the only person here to have come across spammy ads that tell you how this [city 200 miles away] mom lost 22lbs in 3 weeks, or other horrendousnesses of using the modern internet?
posted by ambrosen at 5:34 PM on April 10, 2016
I tried my IP address. It showed a location 15 miles away.
Then I tried while on my company's VPN. It came up as San Mateo, 3000 miles away.
I guess if I was going to commit an IP crime, I should do it on VPN.
posted by MtDewd at 5:34 PM on April 10, 2016 [1 favorite]
Then I tried while on my company's VPN. It came up as San Mateo, 3000 miles away.
I guess if I was going to commit an IP crime, I should do it on VPN.
posted by MtDewd at 5:34 PM on April 10, 2016 [1 favorite]
It is real, rural America; in fact, it’s a two-hour drive from the exact geographical center of the United States.
So, people who appear to be government agents along with other weirdos are showing up near but not exactly at the exact center of the United States, and we're 100% sure this isn't a slight infestation of American Gods?
This seems like something the Technical Boy is involved with, that's all I'm saying.
posted by Sequence at 5:35 PM on April 10, 2016 [2 favorites]
So, people who appear to be government agents along with other weirdos are showing up near but not exactly at the exact center of the United States, and we're 100% sure this isn't a slight infestation of American Gods?
This seems like something the Technical Boy is involved with, that's all I'm saying.
posted by Sequence at 5:35 PM on April 10, 2016 [2 favorites]
This is basically a real-life version of the Spiders Georg "statistical outlier" meme.
posted by Halloween Jack at 5:38 PM on April 10, 2016 [2 favorites]
posted by Halloween Jack at 5:38 PM on April 10, 2016 [2 favorites]
Null is kind of the dumpster fire of computer science (a thing that represents nothing turns out to cause confusion, who knew?) but it is, I suppose, what they should have returned.
Reifying nothingness is not in itself a problem --
posted by invitapriore at 5:42 PM on April 10, 2016
Reifying nothingness is not in itself a problem --
Option/Maybe in Java/Rust/Haskell are all boons to safety because they force you to check whether there's an actual value in the variable before you use it. The problem is when "nothing" is a value of any type, as with null, since the language just turns its head like a bribed customs official when you smuggle one in via an apparently innocent List or Map or so forth. As in life, the institutional refusal to grapple with the reality of the thing is what causes problems.posted by invitapriore at 5:42 PM on April 10, 2016
I can accept the arguments that MaxMind didn't do a great job at returning a meaningful "this is a meaningless location" response. I'm just mystified that there's very little "Wow, that toilet guy was a complete jerk." comments. Have we truly arrived at a time where the Internet is just assumed to be truly a force of nature, completely amoral and all-powerful?
posted by circleofconfusion at 5:46 PM on April 10, 2016 [2 favorites]
posted by circleofconfusion at 5:46 PM on April 10, 2016 [2 favorites]
i wonder if any mefite crossing the Pacific by, like, 1930s sea plane has ever stopped by Howland Island and expected to find me there
posted by indubitable at 5:46 PM on April 10, 2016
posted by indubitable at 5:46 PM on April 10, 2016
Was it here that someone posted the article about the travails of Jennifer Null, whose last name broke the website every time she tried to buy a plane ticket?
posted by ArbitraryAndCapricious at 5:48 PM on April 10, 2016
posted by ArbitraryAndCapricious at 5:48 PM on April 10, 2016
circleofconfusion: "MaxMind didn't do a great job at returning a meaningful "this is a meaningless location" response. "
Well they never intended to provide a meaningless location. They have as a goal providing a location of variable accuracy.
posted by Mitheral at 5:49 PM on April 10, 2016 [3 favorites]
Well they never intended to provide a meaningless location. They have as a goal providing a location of variable accuracy.
posted by Mitheral at 5:49 PM on April 10, 2016 [3 favorites]
No, I guess it wasn't here! Poor Jennifer Null has to do everything by phone because her name breaks computers.
(Presumably whomever is on other end of the phone still has to deal with entering Null into some database somewhere, but I guess they figure out a workaround.)
posted by ArbitraryAndCapricious at 5:56 PM on April 10, 2016 [4 favorites]
(Presumably whomever is on other end of the phone still has to deal with entering Null into some database somewhere, but I guess they figure out a workaround.)
posted by ArbitraryAndCapricious at 5:56 PM on April 10, 2016 [4 favorites]
languagehat: "It's amazing how many folks here are absolutely positive that they would never have made such an obvious error when the future problem was so easily predictable! MeFites really are smarter than everybody else!"
For what it's worth, as I tried to say above, I really don't think this was an error, and I don't think it was down to anything any database engineer did.
But then maybe I've been working in database programming for direct-mail marketing for too long.
posted by koeselitz at 5:57 PM on April 10, 2016 [7 favorites]
For what it's worth, as I tried to say above, I really don't think this was an error, and I don't think it was down to anything any database engineer did.
SUIT: "Hey, what are all these IP addresses with no geographical coordinates, and what are all these extra columns here?"That's how I picture it. Whoever collected the data surely knew about this issue, and said something. The person who made the decision was not someone who cared about good data.
ENGINEER: "Oh, those are IP addresses that don't resolve neatly to a point in some way - they're only known to be somewhere in a certain locale or country."
S: "But that doesn't work! Clients want clean, simple data! They don't want a bunch of empty records and IP addresses they don't know what to do with!"
E: "But that's how the data is. Those IP addresses don't have a precise geospatial location."
S: "Well, I don't care. Fix it. I can only sell this if all IP addresses resolve to a point."
E: "But I'd have to -"
S: "Whatever. Just do it."
But then maybe I've been working in database programming for direct-mail marketing for too long.
posted by koeselitz at 5:57 PM on April 10, 2016 [7 favorites]
I'm just mystified that there's very little "Wow, that toilet guy was a complete jerk." comments.
But... Free shitter!
posted by ROU_Xenophobe at 6:07 PM on April 10, 2016
But... Free shitter!
posted by ROU_Xenophobe at 6:07 PM on April 10, 2016
This is very problematic; in this single sentence I can see several problematic conceptual, implementation, and ethical decisions that a college-trained engineer or computer scientist should have learned to anticipate.
I think you have a much more optimistic view of what's conferred in a college degree program than is warranted. There's only so much time to cover critical topics in a four year undergraduate degree. I have a BS in CS, obtained not all that long ago from a decent institution. This program didn't even teach us about unit tests, because there was no time. Ethical topics were simply not part of the curriculum.
And that's with a formal education. Many people in engineering are given programming tasks ad-hoc regardless of background, which then have a funny way of becoming production code because their solution kind-of works, never mind how sloppily it came about. Code review remains the exception, not the rule, in shops under market pressure, and doubly so for shops that are too small to have an independent QA department. And if the people doing the review, should the dev culture and infrastructure support such an ask, are just as sloppy... well. I find an outcome like this all too plausible.
posted by Mrs. Davros at 6:25 PM on April 10, 2016 [1 favorite]
I think you have a much more optimistic view of what's conferred in a college degree program than is warranted. There's only so much time to cover critical topics in a four year undergraduate degree. I have a BS in CS, obtained not all that long ago from a decent institution. This program didn't even teach us about unit tests, because there was no time. Ethical topics were simply not part of the curriculum.
And that's with a formal education. Many people in engineering are given programming tasks ad-hoc regardless of background, which then have a funny way of becoming production code because their solution kind-of works, never mind how sloppily it came about. Code review remains the exception, not the rule, in shops under market pressure, and doubly so for shops that are too small to have an independent QA department. And if the people doing the review, should the dev culture and infrastructure support such an ask, are just as sloppy... well. I find an outcome like this all too plausible.
posted by Mrs. Davros at 6:25 PM on April 10, 2016 [1 favorite]
I can accept the arguments that MaxMind didn't do a great job at returning a meaningful "this is a meaningless location" response. I'm just mystified that there's very little "Wow, that toilet guy was a complete jerk." comments. Have we truly arrived at a time where the Internet is just assumed to be truly a force of nature, completely amoral and all-powerful?
Keep in mind there is a good chance this is someone who had a significant amount of money stolen from them by a scammer. It's not necessarily gamergate style harassment. If delivering a toilet is all the justice a victim of a scammer can get, I don't blame them for taking it. Just make sure you have the right place next time.
posted by Drinky Die at 6:26 PM on April 10, 2016
Keep in mind there is a good chance this is someone who had a significant amount of money stolen from them by a scammer. It's not necessarily gamergate style harassment. If delivering a toilet is all the justice a victim of a scammer can get, I don't blame them for taking it. Just make sure you have the right place next time.
posted by Drinky Die at 6:26 PM on April 10, 2016
"languagehat - they rounded the co-ordinates and didn't even bother to check if anyone lived at those co-ordinates by, oh I dunno, looking at a map? This is negligence."
No, because this is a problem for every coordinate they return. It would still have been a problem if they had used the correct coordinates, which is also near someone's farm and could resolve to that particular nearby address. The rounding thing is a red herring, except insofar as it explains why this particular farmhouse has this problem and not some other particular farmhouse near the center of the contiguous US.
"I know how fun it is to poke at all of metafilter when you're out of your field of expertise, but seriously dude. This is basic exception handling shit."
It's not. It's not an exception and it shouldn't be handled as such. All of their coordinates represent what is effectively the center of some area thought to contain the network device -- an area that can range from less than a square mile to an entire continent. All the returned coordinates have this characteristic, this one is not exceptional.
I don't disagree with everyone pointing out that you can anticipate that the data you're providing can be misunderstood and misused. Given that, I have some trouble with any such IP geolocating service that returns a pair of coordinates instead of, say, a centered circle of a specified size.
But what I'm puzzled by in this thread is that people are missing the fact that if customers (or free users) are misusing this data in this manner, then this kind of problem is necessarily occurring all the time at smaller scales. This problem isn't specific to the center of the US case, or the center of the state case ... because everything is basically a "center of X case" and so who knows how frequently or rarely an actual address corresponds to where the device actually is. I'd guess approximately never. And yet people are clearly using it for this purpose.
So, putting aside our blaming this vendor, we should also be asking why in the hell is any law enforcement, ever, using this? If it really matters that you get a precise result, what you do is look up who owns the IP address, call them, and keep talking to people until you find someone who can tell you where the device that was assigned that address (within that range of time) is physically located. They almost certainly won't tell you without a warrant, though, which is the answer to the question of why LE would use this completely inappropriate tool for this purpose.
"Oh, those are IP addresses that don't resolve neatly to a point in some way - they're only known to be somewhere in a certain locale or country."
But within their own context, IP addresses don't have a physical location at all. And anyone's attempt to compile a database of probable physical locations is going to result in a database filled with results that are only meaningful as areas. So, again, this particular example isn't exceptional in any sense. It's a more extreme case of what's happening with all the results. All their results are "only known to be somewhere in a certain locale or country".
posted by Ivan Fyodorovich at 6:27 PM on April 10, 2016 [17 favorites]
No, because this is a problem for every coordinate they return. It would still have been a problem if they had used the correct coordinates, which is also near someone's farm and could resolve to that particular nearby address. The rounding thing is a red herring, except insofar as it explains why this particular farmhouse has this problem and not some other particular farmhouse near the center of the contiguous US.
"I know how fun it is to poke at all of metafilter when you're out of your field of expertise, but seriously dude. This is basic exception handling shit."
It's not. It's not an exception and it shouldn't be handled as such. All of their coordinates represent what is effectively the center of some area thought to contain the network device -- an area that can range from less than a square mile to an entire continent. All the returned coordinates have this characteristic, this one is not exceptional.
I don't disagree with everyone pointing out that you can anticipate that the data you're providing can be misunderstood and misused. Given that, I have some trouble with any such IP geolocating service that returns a pair of coordinates instead of, say, a centered circle of a specified size.
But what I'm puzzled by in this thread is that people are missing the fact that if customers (or free users) are misusing this data in this manner, then this kind of problem is necessarily occurring all the time at smaller scales. This problem isn't specific to the center of the US case, or the center of the state case ... because everything is basically a "center of X case" and so who knows how frequently or rarely an actual address corresponds to where the device actually is. I'd guess approximately never. And yet people are clearly using it for this purpose.
So, putting aside our blaming this vendor, we should also be asking why in the hell is any law enforcement, ever, using this? If it really matters that you get a precise result, what you do is look up who owns the IP address, call them, and keep talking to people until you find someone who can tell you where the device that was assigned that address (within that range of time) is physically located. They almost certainly won't tell you without a warrant, though, which is the answer to the question of why LE would use this completely inappropriate tool for this purpose.
"Oh, those are IP addresses that don't resolve neatly to a point in some way - they're only known to be somewhere in a certain locale or country."
But within their own context, IP addresses don't have a physical location at all. And anyone's attempt to compile a database of probable physical locations is going to result in a database filled with results that are only meaningful as areas. So, again, this particular example isn't exceptional in any sense. It's a more extreme case of what's happening with all the results. All their results are "only known to be somewhere in a certain locale or country".
posted by Ivan Fyodorovich at 6:27 PM on April 10, 2016 [17 favorites]
Oh, I guess I should also point out that if it's the case that MaxMind is ultimately returning an actual address, then, on the one hand, that's not conceptually any more or less problematic than returning a coordinate pair because, again, either case is a point on a map that represents (vaguely) the center of a probable area of some varying (and apparently unspecified) size. On the other hand, though, providing an actual street address is just begging users to wrongly assume that, hey, the device is at that actual address. I don't even understand how you wouldn't anticipate this tool being badly misused with some potentially tragic results.
Regardless, the problems are for every single (mis)use of it in this fashion, not just those that resolve to the middle of a state or a country.
posted by Ivan Fyodorovich at 6:38 PM on April 10, 2016 [2 favorites]
Regardless, the problems are for every single (mis)use of it in this fashion, not just those that resolve to the middle of a state or a country.
posted by Ivan Fyodorovich at 6:38 PM on April 10, 2016 [2 favorites]
I know how fun it is to poke at all of metafilter when you're out of your field of expertise, but seriously dude. This is basic exception handling shit.
Being able to locate to only a county, or state, or country is in no way an exception. This is well within my field of expertise, thank you very much. I have used MaxMind's API as well as several competitors. It IS NOT AN ERROR to have data at different levels of precision. This problem has nothing whatsoever to do with error handling. It has to do with using a data type (lat/long) that can't represent different levels of precision, and then having the API users not understand the meaning of the data they're getting back. I'm not saying it's not a screwup by MaxMind, but it's not about error handling or exceptions.
posted by primethyme at 7:11 PM on April 10, 2016 [7 favorites]
Being able to locate to only a county, or state, or country is in no way an exception. This is well within my field of expertise, thank you very much. I have used MaxMind's API as well as several competitors. It IS NOT AN ERROR to have data at different levels of precision. This problem has nothing whatsoever to do with error handling. It has to do with using a data type (lat/long) that can't represent different levels of precision, and then having the API users not understand the meaning of the data they're getting back. I'm not saying it's not a screwup by MaxMind, but it's not about error handling or exceptions.
posted by primethyme at 7:11 PM on April 10, 2016 [7 favorites]
I hope somebody also talks to whatever company is doing the latitude and longitude to street address conversion and tells them not to treat locations in centers of lakes to the nearest valid street address.
posted by ckape at 7:19 PM on April 10, 2016 [2 favorites]
posted by ckape at 7:19 PM on April 10, 2016 [2 favorites]
I've just returned from a teaching trip to one of our partner organisations, I work for an Australian University, and one of the things we talked about in this course was when you returned values and when you didn't. This is a course that deals a lot with user input and output.
One of the examples I used was the arithmetic mean, which we often call the average. If you have error checking on the values to provide to the function and, for one reason or another, all of them get rejected, then you're trying to calculate the mean of no values.
At this stage, many students want to return 0 from the mean function, if you have no values. But 0 is the mean of the values 0,0,0,0 or -3,3,-3,3. 0 is the mean of a single value that is 0. The arithmetic mean is ill-defined if you try to calculate it with zero values. (Which makes sense if you've never had to think about it before.)
It's such a simple example and it's one that, unlike an isolated instance of dividing by zero, most people have never thought about because every other time they've done the calculation it has been with at least one value.
My question to my students is "what will the user do with that 0 if you tell them that's the mean?" with the answer, of course, being that the user will assume that the mean is 0.
Years ago, I worked for some people who probed the soil in a rural area to see how moist it was and, combined with mean rainfall across the area, told growers how much irrigation to use. Water was expensive in this region and over-irrigation had proven catastrophic in the past. Sometimes we had problems with the rainfall data (availability or quality) but it was really important to report no values as "I can't calculate an average" rather than "zero", because a zero value would mean adding the full amount of irrigation to address the soil water profile. Which would lead to exactly the local environmental problems we were trying to fix.
The MaxMind example is going into my teaching portfolio. Thank you for the post!
posted by nfalkner at 7:24 PM on April 10, 2016 [16 favorites]
One of the examples I used was the arithmetic mean, which we often call the average. If you have error checking on the values to provide to the function and, for one reason or another, all of them get rejected, then you're trying to calculate the mean of no values.
At this stage, many students want to return 0 from the mean function, if you have no values. But 0 is the mean of the values 0,0,0,0 or -3,3,-3,3. 0 is the mean of a single value that is 0. The arithmetic mean is ill-defined if you try to calculate it with zero values. (Which makes sense if you've never had to think about it before.)
It's such a simple example and it's one that, unlike an isolated instance of dividing by zero, most people have never thought about because every other time they've done the calculation it has been with at least one value.
My question to my students is "what will the user do with that 0 if you tell them that's the mean?" with the answer, of course, being that the user will assume that the mean is 0.
Years ago, I worked for some people who probed the soil in a rural area to see how moist it was and, combined with mean rainfall across the area, told growers how much irrigation to use. Water was expensive in this region and over-irrigation had proven catastrophic in the past. Sometimes we had problems with the rainfall data (availability or quality) but it was really important to report no values as "I can't calculate an average" rather than "zero", because a zero value would mean adding the full amount of irrigation to address the soil water profile. Which would lead to exactly the local environmental problems we were trying to fix.
The MaxMind example is going into my teaching portfolio. Thank you for the post!
posted by nfalkner at 7:24 PM on April 10, 2016 [16 favorites]
I was gonna post about how the public demo maxmind interface is kinda crappy, and that paying customers know what they're getting by the time they whip out their credit card, but I see that is well covered (if a bit contentious).
I have a BS in CS, obtained not all that long ago from a decent institution. This program didn't even teach us about unit tests, because there was no time. Ethical topics were simply not part of the curriculum.
Ethics when I got a CS degree was a required, separate course. And at the university I work for now, is still a required separate course. I imagine it's an ABET accredited degree requirement. Not that it would have prevented this episode. There's no geospatial chapter in the ethics book. At best you might get a discussion about what can happen when your software yields an answer that is interpreted as more accurate than it really is, and then the class bogs down into a finger pointing circle blaming users, developers, managers, government, etc.
There's no step in Waterfall, Agile, or any other software engineering process where engineers sit in a conference room debating topics like "Is it ethical to make a shitty demo interface to our API?" From their perspective, the chief misuse of data isn't "What if internet vigilantes drop broken toilets on driveways?" but "What if our customers use this demo instead of paying us?" And even if they only published their "lite" db for free, someone else would have written the misleading website.
posted by pwnguin at 7:44 PM on April 10, 2016 [3 favorites]
I have a BS in CS, obtained not all that long ago from a decent institution. This program didn't even teach us about unit tests, because there was no time. Ethical topics were simply not part of the curriculum.
Ethics when I got a CS degree was a required, separate course. And at the university I work for now, is still a required separate course. I imagine it's an ABET accredited degree requirement. Not that it would have prevented this episode. There's no geospatial chapter in the ethics book. At best you might get a discussion about what can happen when your software yields an answer that is interpreted as more accurate than it really is, and then the class bogs down into a finger pointing circle blaming users, developers, managers, government, etc.
There's no step in Waterfall, Agile, or any other software engineering process where engineers sit in a conference room debating topics like "Is it ethical to make a shitty demo interface to our API?" From their perspective, the chief misuse of data isn't "What if internet vigilantes drop broken toilets on driveways?" but "What if our customers use this demo instead of paying us?" And even if they only published their "lite" db for free, someone else would have written the misleading website.
posted by pwnguin at 7:44 PM on April 10, 2016 [3 favorites]
I'm not saying it's not a screwup by MaxMind, but it's not about error handling or exceptions.
Absolutely. The problem was poor specification and implementation of an abstraction (the API), which caused undesirable consequences. The further problem being MaxMind not taking responsibility for the livelihoods that they have thus affected in a very negative way.
The debate about "if I were programming this system I would have caught it, or not" is a distraction from the fact that software engineering—whether you learned the basics in school, or more appropriately, through your continued education as a programmer/technologist—provides a knowledge framework for understanding these kinds of problems, through a body of best practices, case study literature, and so on so forth. It's cultural too—there are blogs out there devoted to this stuff, that practicing engineers can read.
And much can be discussed about the almost complete lack of good testing/verification methodology in practice, or the gap/differences between education and industry—needless to say, neither are free of criticism. There are multiple cans of worms here. Thankfully some people in industry as well as academia do worry about this stuff.
posted by polymodus at 7:46 PM on April 10, 2016 [4 favorites]
Absolutely. The problem was poor specification and implementation of an abstraction (the API), which caused undesirable consequences. The further problem being MaxMind not taking responsibility for the livelihoods that they have thus affected in a very negative way.
The debate about "if I were programming this system I would have caught it, or not" is a distraction from the fact that software engineering—whether you learned the basics in school, or more appropriately, through your continued education as a programmer/technologist—provides a knowledge framework for understanding these kinds of problems, through a body of best practices, case study literature, and so on so forth. It's cultural too—there are blogs out there devoted to this stuff, that practicing engineers can read.
And much can be discussed about the almost complete lack of good testing/verification methodology in practice, or the gap/differences between education and industry—needless to say, neither are free of criticism. There are multiple cans of worms here. Thankfully some people in industry as well as academia do worry about this stuff.
posted by polymodus at 7:46 PM on April 10, 2016 [4 favorites]
If MaxMind had also returned a value that indicated the precision of the position (are we sure they don't?), I guarantee most clients would have ignored it.
This is an interesting article by Factual on analyzing bogus location reports, with a description of the detailed analysis of the type of bogusness: Investigating Low Quality Location Data. Location is a huge deal in the mobile realtime ad auction business, which Factual is heavily involved in. (The prequel article talks more generally about origins of bad location data, and even mentions specifically the "coordinate truncation" problem.)
posted by jjwiseman at 7:47 PM on April 10, 2016 [4 favorites]
This is an interesting article by Factual on analyzing bogus location reports, with a description of the detailed analysis of the type of bogusness: Investigating Low Quality Location Data. Location is a huge deal in the mobile realtime ad auction business, which Factual is heavily involved in. (The prequel article talks more generally about origins of bad location data, and even mentions specifically the "coordinate truncation" problem.)
A significant percentage of locations reported in the mobile ad ecosystem - anywhere from 30% to 70% - is of insufficient quality for use in location based mobile ad targeting, measurement, or analytics. In our previous post, Validating Mobile Ad Location Data at Factual, we describe the different reasons for this, and the ways we pre-process and clean location data. This post, the second in a series, explores a particularly blatant case of inaccurate locations reported over Greenland and beyond.Their conclusion for this particular case was that a developer somewhere was probably generating coordinates literally at random, via string operations, something like randint(100) + "." + randint(1000000). They find that about 3.4% of publishers supply "wholly invalid" locations.
posted by jjwiseman at 7:47 PM on April 10, 2016 [4 favorites]
I think they should change the default location for the US IP addresses to the center of The Gold Depository at Fort Knox... this would eliminate a lot of issues in one fell swoop.
posted by MikeWarot at 7:54 PM on April 10, 2016 [5 favorites]
posted by MikeWarot at 7:54 PM on April 10, 2016 [5 favorites]
If MaxMind had also returned a value that indicated the precision of the position (are we sure they don't?), I guarantee most clients would have ignored it.
They do in the paid version, not in the free version.
But you know what? They already are indicating precision, but they are reporting it wrong! 39.0000 is not the same thing as 39.00 or 39. And sure, lots of clients may ignore the precision, but it would at least give people are chance to think about the issue if they got back 39 instead of 39.0000 (and if MaxMind had followed the convention on precision, they probably would have smartened up before they started reporting one point for the entire US instead of reporting 4E1).
Maybe I'm biased but that seems like very basic scientific literacy.
posted by ssg at 8:16 PM on April 10, 2016 [2 favorites]
They do in the paid version, not in the free version.
But you know what? They already are indicating precision, but they are reporting it wrong! 39.0000 is not the same thing as 39.00 or 39. And sure, lots of clients may ignore the precision, but it would at least give people are chance to think about the issue if they got back 39 instead of 39.0000 (and if MaxMind had followed the convention on precision, they probably would have smartened up before they started reporting one point for the entire US instead of reporting 4E1).
Maybe I'm biased but that seems like very basic scientific literacy.
posted by ssg at 8:16 PM on April 10, 2016 [2 favorites]
Can we focus on the real issue here, which is what point whoever left a toilet in their driveway was trying to make?
posted by chimpsonfilm at 8:34 PM on April 10, 2016 [2 favorites]
posted by chimpsonfilm at 8:34 PM on April 10, 2016 [2 favorites]
The other half of the problem being: it hardly matters if MaxMind is not making claims about the precision of the locations, if people using their API -are- making those claims. Okay, sure, MM isn't -personally- pointing all those people to a single farm in Kansas, but folks misusing (assuming that's the right word) their software definitely are.
posted by Archelaus at 8:50 PM on April 10, 2016 [2 favorites]
posted by Archelaus at 8:50 PM on April 10, 2016 [2 favorites]
The precision seems fine, I have no doubt they measure to that many sig figs. It's the accuracy that is the issue.
posted by Mitheral at 8:51 PM on April 10, 2016
posted by Mitheral at 8:51 PM on April 10, 2016
Me, I would have picked some nice public landmark. But you do want it to be somewhat close to the centroid
Rather than the middle of a lake, why not the actual landmark for the geographic center of the contiguous United States? Presumably, after reading the marker, people could work out what the problem with their data is, and take a few minutes in the chapel (!) to reconsider their plans for revenge. At least until they've found out who really done 'em wrong.
posted by asperity at 9:04 PM on April 10, 2016 [3 favorites]
Rather than the middle of a lake, why not the actual landmark for the geographic center of the contiguous United States? Presumably, after reading the marker, people could work out what the problem with their data is, and take a few minutes in the chapel (!) to reconsider their plans for revenge. At least until they've found out who really done 'em wrong.
posted by asperity at 9:04 PM on April 10, 2016 [3 favorites]
Someone must have had to type the location repeatedly.
posted by Mitheral at 9:09 PM on April 10, 2016 [1 favorite]
posted by Mitheral at 9:09 PM on April 10, 2016 [1 favorite]
The CIA World Factbook entry for the USA lists the location of the USA as 38 00 N, 97 00 W. That's a more likely explanation for using those particular coordinates than Maxmind themselves deciding "to clean up the measurements and go with a simpler, nearby latitude and longitude."
posted by zsazsa at 9:18 PM on April 10, 2016 [14 favorites]
posted by zsazsa at 9:18 PM on April 10, 2016 [14 favorites]
So, as I understand it, the paid version reports an accuracy range. The free version does not. So, can I ask if the problem is not Mindmax, but the fact that law enforcement and suicide hotlines are using the free version?
Also: Reporting the US as your location seems fine to me. If all I want to do is stick a flag on each users location profile, country works.
How is this for a crazy idea: Instead of not reporting any accuracy with the free version, you returned a large value? Also, print a map with a big circle on it, like when I"m using a GPS and it hasn't figured out where I am yet. Then people look at it and go "Ok, they are somewhere in Kansans" instead of "oh, they are right at this address". Is that a crazy idea?
posted by Canageek at 9:55 PM on April 10, 2016
Also: Reporting the US as your location seems fine to me. If all I want to do is stick a flag on each users location profile, country works.
How is this for a crazy idea: Instead of not reporting any accuracy with the free version, you returned a large value? Also, print a map with a big circle on it, like when I"m using a GPS and it hasn't figured out where I am yet. Then people look at it and go "Ok, they are somewhere in Kansans" instead of "oh, they are right at this address". Is that a crazy idea?
posted by Canageek at 9:55 PM on April 10, 2016
I don't think there is any standard way to in-band accuracy uncertainty in a plain lat/long number. Even if there was Maxmind is making money off of providing accuracy information out of band.
posted by Mitheral at 10:03 PM on April 10, 2016
posted by Mitheral at 10:03 PM on April 10, 2016
5 year prediction: MaxMind moves the default unknown locations to the middle of lakes etc. Somebody buys the lake and builds an island and a house and has unexpected guests.
Internet explodes in righteous indignation once again.
You just gave me a great idea for a Beowulf reboot.
posted by No-sword at 10:13 PM on April 10, 2016 [1 favorite]
Internet explodes in righteous indignation once again.
You just gave me a great idea for a Beowulf reboot.
posted by No-sword at 10:13 PM on April 10, 2016 [1 favorite]
If MaxMind returned a polygon rather than a point, then within about 10 minutes half of the consumers of the API would pick some point in the middle and use that to look up an address... which would have the same exact problem.
The problem is, MaxMind does know something about the IP address- they know it's within the US. Or at least, it thinks it probably is. So returning "null" is wrong. Returning a point-and-a-radius would be fine, except see above, same problem. Someone's going to throw away the radius and just display the point to the user. That's not MaxMind's fault- they could be providing the radius and somebody would decide to throw it away anyway.
There are two kindof solutions I can think of:
1. Don't return a point. Return the name of the smallest region you're confident contains the IP. Country, state, county would cover the US.
2. Pick a point at random within the radius of the accuracy you've determined. If it's within the US, return some random point in the US. If it's within a state, return a random point in that state. A few doors might get knocked down in error, but at least it won't be the same door every time...
posted by BungaDunga at 10:35 PM on April 10, 2016 [4 favorites]
The problem is, MaxMind does know something about the IP address- they know it's within the US. Or at least, it thinks it probably is. So returning "null" is wrong. Returning a point-and-a-radius would be fine, except see above, same problem. Someone's going to throw away the radius and just display the point to the user. That's not MaxMind's fault- they could be providing the radius and somebody would decide to throw it away anyway.
There are two kindof solutions I can think of:
1. Don't return a point. Return the name of the smallest region you're confident contains the IP. Country, state, county would cover the US.
2. Pick a point at random within the radius of the accuracy you've determined. If it's within the US, return some random point in the US. If it's within a state, return a random point in that state. A few doors might get knocked down in error, but at least it won't be the same door every time...
posted by BungaDunga at 10:35 PM on April 10, 2016 [4 favorites]
I put my IP address (reported by typing "my ip address" in Google search) into https://www.iplocation.net/ and MaxMind is one of the results given. It gives coordinates of the house at the exact center of the city I live in.
Moral of the story: don't buy a house that's in the exact center of the city.
(Not as bad as buying a house in the exact center of the country, though).
posted by eye of newt at 10:44 PM on April 10, 2016
Moral of the story: don't buy a house that's in the exact center of the city.
(Not as bad as buying a house in the exact center of the country, though).
posted by eye of newt at 10:44 PM on April 10, 2016
return a random point in that state
Oh, no, that's even worse. To an API user, that would give even more of an illusion of 'accuracy' that they would rely on.
Even returning polygons is troublesome, because geography is hard. If you wanted to return a state or city or whatever, you may just be as well to return the verbose name of that place and let the developer use whatever libraries to convert a named location to a specific point or polygon. Then again... naming places is hard too.
So, really, as many other have said, the only real safe result is to return "unknown" or "null" or whatever.
If I was pushed though, I think I'd try to work my way back up the network path and give the most certain location for one of the upstream ISP or ASN. The connecting ISP almost certainly has a physical address, or worst case, you end up pointing everything at Ashburn, Virginia or some other major exchange point. With this method, at least the FBI would end up talking to a network engineer who would be better placed to locate the end of a wire than a family in the middle of Kansas.
posted by rh at 11:11 PM on April 10, 2016 [4 favorites]
Oh, no, that's even worse. To an API user, that would give even more of an illusion of 'accuracy' that they would rely on.
Even returning polygons is troublesome, because geography is hard. If you wanted to return a state or city or whatever, you may just be as well to return the verbose name of that place and let the developer use whatever libraries to convert a named location to a specific point or polygon. Then again... naming places is hard too.
So, really, as many other have said, the only real safe result is to return "unknown" or "null" or whatever.
If I was pushed though, I think I'd try to work my way back up the network path and give the most certain location for one of the upstream ISP or ASN. The connecting ISP almost certainly has a physical address, or worst case, you end up pointing everything at Ashburn, Virginia or some other major exchange point. With this method, at least the FBI would end up talking to a network engineer who would be better placed to locate the end of a wire than a family in the middle of Kansas.
posted by rh at 11:11 PM on April 10, 2016 [4 favorites]
When I am on my phone, my address comes up in Las Vegas, NM, which is around 50 miles from my house (most of my internet access goes through my phone, for the time being). A significant number of apps, websites, etc., which use this location info to target advertising have concluded that I must live in Las Vegas, NV, which is, to be fair, a much more notorious city named Las Vegas, yet in a totally different state. I can sort of see how such an error is made, but it's simultaneously annoying and comforting knowing that the data collectors are so incompetent.
posted by krinklyfig at 1:44 AM on April 11, 2016 [2 favorites]
posted by krinklyfig at 1:44 AM on April 11, 2016 [2 favorites]
I just got a large dataset from a researcher who does not program, and I'm meant to be doing some programming with it to come up with cool data visualisations of various social groups. The first pass I made at it, I took a look at the result, and was like, dude, wtf, it looks like 90% of people in that village are siblings. Someone had an extremely large family.
So I went back and looked at the data, and the researcher had coded each person with an ID number, and there was a column in the spreadsheet for the ID of people's mother and one for the ID of their father. And my program logic said, if people have the same mother and father, they are siblings. But the researcher had started the ID numbering at 1, not 0, so they used ID = 0 for an unknown parent, instead of ID=-1 or NULL or "unknown" or something. So the program said, all these people who share the parents called 0 must be siblings. (Instead of all these people in this village have unknown parents.)
Anyway, that's the sort of glitch you get when the data was coded by someone unfamiliar with programming norms. It is not the sort of thing you should get with a large commercial project that presumably had some sort of planning stage. And if I had released that data visualisation without checking it, and some harm had come to people because everyone was all, "wow, you backwards village are full of inbred relatives" I would absolutely be taking personal responsibility and trying to make it up to people.
posted by lollusc at 4:29 AM on April 11, 2016 [2 favorites]
So I went back and looked at the data, and the researcher had coded each person with an ID number, and there was a column in the spreadsheet for the ID of people's mother and one for the ID of their father. And my program logic said, if people have the same mother and father, they are siblings. But the researcher had started the ID numbering at 1, not 0, so they used ID = 0 for an unknown parent, instead of ID=-1 or NULL or "unknown" or something. So the program said, all these people who share the parents called 0 must be siblings. (Instead of all these people in this village have unknown parents.)
Anyway, that's the sort of glitch you get when the data was coded by someone unfamiliar with programming norms. It is not the sort of thing you should get with a large commercial project that presumably had some sort of planning stage. And if I had released that data visualisation without checking it, and some harm had come to people because everyone was all, "wow, you backwards village are full of inbred relatives" I would absolutely be taking personal responsibility and trying to make it up to people.
posted by lollusc at 4:29 AM on April 11, 2016 [2 favorites]
So, as I understand it, the paid version reports an accuracy range. The free version does not. So, can I ask if the problem is not Mindmax, but the fact that law enforcement and suicide hotlines are using the free version?
Basically, yes, though I'm not familiar enough with the paid version to know whether using it for search warrants is reasonable. (I'd say wellness checks are a place where knocking on the wrong person's door would be annoying for them, but harmless, but then the police manage to kill people doing wellness checks, so...) The free version tells you the city, if it can, and is giving latitude/longitude for "the city". It claims to do ZIP code, but I'm pretty sure you get the ZIP code for the center of the city. That's part of the business model--the free version is useless if you want to know anything precise. (But they get name recognition and so on for providing a free database to map IPs to countries (and, sort of, cities, sometimes).)
This is very much a case of people taking MaxMind's database and selling it on to others making the claim that they can map an IP address to a physical location with a degree of accuracy that simply doesn't exist, both because of how IP addresses work (remember 15 years ago when everyone on AOL showed up as being in Virginia?) and because they're using a database that doesn't claim to resolve to anywhere near a street address.
posted by hoyland at 4:35 AM on April 11, 2016 [2 favorites]
Basically, yes, though I'm not familiar enough with the paid version to know whether using it for search warrants is reasonable. (I'd say wellness checks are a place where knocking on the wrong person's door would be annoying for them, but harmless, but then the police manage to kill people doing wellness checks, so...) The free version tells you the city, if it can, and is giving latitude/longitude for "the city". It claims to do ZIP code, but I'm pretty sure you get the ZIP code for the center of the city. That's part of the business model--the free version is useless if you want to know anything precise. (But they get name recognition and so on for providing a free database to map IPs to countries (and, sort of, cities, sometimes).)
This is very much a case of people taking MaxMind's database and selling it on to others making the claim that they can map an IP address to a physical location with a degree of accuracy that simply doesn't exist, both because of how IP addresses work (remember 15 years ago when everyone on AOL showed up as being in Virginia?) and because they're using a database that doesn't claim to resolve to anywhere near a street address.
posted by hoyland at 4:35 AM on April 11, 2016 [2 favorites]
The real story here is that there is apparently more than one judge who should be having to answer some really awkward questions.
Stuff like this is what makes me consider becoming a monk rather than deal with the 21st century.
posted by ob1quixote at 5:00 AM on April 11, 2016 [2 favorites]
Stuff like this is what makes me consider becoming a monk rather than deal with the 21st century.
posted by ob1quixote at 5:00 AM on April 11, 2016 [2 favorites]
I am baffled why people keep insisting that this case has anything to do with an exceptional result. "Unknown" would not have been the correct result, nor would have a null or anything similar. This was not an exception. This result is just like every other result.
If you think this isn't the case because the article includes a hypothesis that someone manually changed the contiguous US center to this value then you're misunderstanding something fundamental. Every value in their database was similarly determined by someone at some time. If, for example, you actually know that such-and-such business is assigned a particular address range and that this business only is located in this one particular building and that all address ranges it uses are for devices located in that building -- this is the best-case, the most precise possibility for this sort of data -- then even then you have to select some latlong coordinate (to some degree of precision) to represent that building, which is obviously larger than a point. Every likely location of every IP address is an area, for which they had to either idiosyncratically or systematically assign a specific coordinate, just as in this case. This example is not an exception; this is a difference of degree, not kind.
Furthermore, as someone pointed out above, it's probably not even the case that anyone involved rounded the latlong, as the article imagines, but rather that the source they were using to determine national geographic centers had done so (the CIA Factbook, which is ubiquitously used to supply such data, I guess because it is free).
And, again, if people are relying on this to provide specific addresses where they believe they will find an internet device, then a very large amount of the time they're getting results that are addresses that are actually just the center of something like a zip code or a city or a county and so there are going to be these misidentifications in all these cases, too. It seems to me that it would be by far the exception, not the rule, that the result would actually lead you to someone threatening suicide, for example. Almost no such address identifications are going to be correct. It doesn't matter that it's off by a eight blocks instead of a thousand miles -- you're still knocking on the wrong door.
posted by Ivan Fyodorovich at 5:23 AM on April 11, 2016 [8 favorites]
If you think this isn't the case because the article includes a hypothesis that someone manually changed the contiguous US center to this value then you're misunderstanding something fundamental. Every value in their database was similarly determined by someone at some time. If, for example, you actually know that such-and-such business is assigned a particular address range and that this business only is located in this one particular building and that all address ranges it uses are for devices located in that building -- this is the best-case, the most precise possibility for this sort of data -- then even then you have to select some latlong coordinate (to some degree of precision) to represent that building, which is obviously larger than a point. Every likely location of every IP address is an area, for which they had to either idiosyncratically or systematically assign a specific coordinate, just as in this case. This example is not an exception; this is a difference of degree, not kind.
Furthermore, as someone pointed out above, it's probably not even the case that anyone involved rounded the latlong, as the article imagines, but rather that the source they were using to determine national geographic centers had done so (the CIA Factbook, which is ubiquitously used to supply such data, I guess because it is free).
And, again, if people are relying on this to provide specific addresses where they believe they will find an internet device, then a very large amount of the time they're getting results that are addresses that are actually just the center of something like a zip code or a city or a county and so there are going to be these misidentifications in all these cases, too. It seems to me that it would be by far the exception, not the rule, that the result would actually lead you to someone threatening suicide, for example. Almost no such address identifications are going to be correct. It doesn't matter that it's off by a eight blocks instead of a thousand miles -- you're still knocking on the wrong door.
posted by Ivan Fyodorovich at 5:23 AM on April 11, 2016 [8 favorites]
I followed the link in the article to locate my IP address and discovered that I am the roommate of another MeFite.
posted by jaruwaan at 5:54 AM on April 11, 2016
posted by jaruwaan at 5:54 AM on April 11, 2016
I have to walk away from this topic. I poured over the documentation of MaxMind a few years back. For those that accuse them of poor exception handling - lets consider: their specification tells you exactly how their data is going to spit it out at you when you go to use it. Meaning - it is doing exactly what it is supposed to be doing. The exception handling everyone seems to want needs to occur user side, where user is the admin that connected their own system to the data table MaxMind provides "as is". In other words, don't shoot the aggregator that provide a useful tool; take the time to learn how to use and implement it.
posted by Nanukthedog at 6:23 AM on April 11, 2016 [2 favorites]
posted by Nanukthedog at 6:23 AM on April 11, 2016 [2 favorites]
Aside from all the problems with MaxMind and the choices made in their and others' algorithms:
The Taylor home was at the very top of the list; the 600 million IP addresses attached to the home were 10 orders of magnitude higher than at any other location.
So the next most frequent location on the list has 0.06 IP addresses, eh? So that's... 1.9 bits of addressing, or what? How does that work exactly? Do they truncate the packet 2 bits into the address 19 times in 20, and just drop the 20th packet? Or is it IPv6—do they get 7 bits and some change?
posted by atbash at 7:59 AM on April 11, 2016
The Taylor home was at the very top of the list; the 600 million IP addresses attached to the home were 10 orders of magnitude higher than at any other location.
So the next most frequent location on the list has 0.06 IP addresses, eh? So that's... 1.9 bits of addressing, or what? How does that work exactly? Do they truncate the packet 2 bits into the address 19 times in 20, and just drop the 20th packet? Or is it IPv6—do they get 7 bits and some change?
posted by atbash at 7:59 AM on April 11, 2016
If they can only track an IP address to "somewhere in the US", then they should return a random point somewhere in the US, and make sure it's a freshly-generated point for every time the same IP is queried. Spread the love!
posted by whuppy at 8:19 AM on April 11, 2016
posted by whuppy at 8:19 AM on April 11, 2016
If they can only track an IP address to "somewhere in the US", then they should return a random point somewhere in the US, and make sure it's a freshly-generated point for every time the same IP is queried. Spread the love!
Well, they *should* return data that's actually less specific, i.e. "it's in the US", rather than any precision data that's wrong, no matter how random or arbitrary. Possibly that's what somebody meant to get by zeroing out the low-order digits, but that's not how the coordinate system works - that just moves the location. (Though obviously lots of us have done exactly that on e.g. our MeFi user locations, where it basically doesn't matter...)
But unless their customers get wise, their incentive is not to do that, because they more or less get paid based on how many queries they respond to with specific results.
posted by atbash at 8:42 AM on April 11, 2016
Well, they *should* return data that's actually less specific, i.e. "it's in the US", rather than any precision data that's wrong, no matter how random or arbitrary. Possibly that's what somebody meant to get by zeroing out the low-order digits, but that's not how the coordinate system works - that just moves the location. (Though obviously lots of us have done exactly that on e.g. our MeFi user locations, where it basically doesn't matter...)
But unless their customers get wise, their incentive is not to do that, because they more or less get paid based on how many queries they respond to with specific results.
posted by atbash at 8:42 AM on April 11, 2016
I shouldn't be surprised at how harshly judgmental so many of you are; this is MetaFilter, after all. But consider this use case:
You run the website for a retail chain. You want to add a store locator widget, with a map showing the nearest stores to your visitor. You can ask them to enter their zip code, but before that, you can take a guess at where they are, and possibly save them the effort. You buy MaxMind's database.
If MaxMind can tell you the U.S. county, you can render a map centered on that county. If MaxMind can only tell you that the IP address is somewhere in the U.S., you render a map centered on the Continental U.S. WHICH VERY LIKELY WHAT THE VISITOR WANTS, not a map centered on Washington, D.C. with half the area of the map in the Atlantic, or no map at all with a LOCATION UNKNOWN message.
If you want to blame someone, blame the law enforcement folks and internet vigilantes who don't understand what they're dealing with. It sounds like as soon as MaxMind learned there was a problem with how people were misusing the data, they took prompt measures to reduce the chances somebody would misuse it in this way.
posted by Jasper Fnorde at 9:12 AM on April 11, 2016 [4 favorites]
You run the website for a retail chain. You want to add a store locator widget, with a map showing the nearest stores to your visitor. You can ask them to enter their zip code, but before that, you can take a guess at where they are, and possibly save them the effort. You buy MaxMind's database.
If MaxMind can tell you the U.S. county, you can render a map centered on that county. If MaxMind can only tell you that the IP address is somewhere in the U.S., you render a map centered on the Continental U.S. WHICH VERY LIKELY WHAT THE VISITOR WANTS, not a map centered on Washington, D.C. with half the area of the map in the Atlantic, or no map at all with a LOCATION UNKNOWN message.
If you want to blame someone, blame the law enforcement folks and internet vigilantes who don't understand what they're dealing with. It sounds like as soon as MaxMind learned there was a problem with how people were misusing the data, they took prompt measures to reduce the chances somebody would misuse it in this way.
posted by Jasper Fnorde at 9:12 AM on April 11, 2016 [4 favorites]
If MaxMind can tell you the U.S. county, you can render a map centered on that county. If MaxMind can only tell you that the IP address is somewhere in the U.S., you render a map centered on the Continental U.S.
But that is most definitely not what MaxMind does. If all they know is that the IP is in the US, they tell you that it is at this farm. That's not going to help you display a map of the entire US, that's just going to make you falsely display a map of a section of Kansas.
posted by ssg at 9:54 AM on April 11, 2016
But that is most definitely not what MaxMind does. If all they know is that the IP is in the US, they tell you that it is at this farm. That's not going to help you display a map of the entire US, that's just going to make you falsely display a map of a section of Kansas.
posted by ssg at 9:54 AM on April 11, 2016
If you're paying for their service you get the precision info, which would allow you to set a zoom level on the map. Low precision: zoom allll the way out.
posted by wemayfreeze at 10:11 AM on April 11, 2016
posted by wemayfreeze at 10:11 AM on April 11, 2016
Ok, pretty sure i can scrounge out the old .csv dataset from MaxMind as well as a SAS implementation (utilizing PROC FORMAT) to recode the IP address to the geographic coordinate. It is massively faster than using the PROC GRAPH functionality GINSIDE iirc. If you need it/want it, ping me in memail.
posted by Nanukthedog at 12:16 PM on April 11, 2016
posted by Nanukthedog at 12:16 PM on April 11, 2016
You run the website for a retail chain. You want to add a store locator widget, with a map showing the nearest stores to your visitor. You can ask them to enter their zip code, but before that, you can take a guess at where they are, and possibly save them the effort. You buy MaxMind's database.
IP mapping is a horribly bad way to do this though. The IP mapping site linked off the linked article puts my location at a data center a fair distance away, in an industrial park which would probably produce wrong directions. These days we have a location api for browsers on GPS-equipped devices that avoids the superstitious woo of traditional IP mapping.
Not to mention, every now and then people do searches remotely. About a month ago, I had to find an emergency towing service across two state lines. Also, you create problems for people using a VPN.
Bad information creates more customer service problems than prompting the user for what they need. MaxMind was selling bad information. If your precision is a "county," then the proper data is state and county. If the precision is state, then the proper data is, "State, Unknown County." It's high-school level data analysis to not mix your knowns and unknowns in a dataset by arbitrarily assigning a fake data point.
posted by CBrachyrhynchos at 12:40 PM on April 11, 2016
IP mapping is a horribly bad way to do this though. The IP mapping site linked off the linked article puts my location at a data center a fair distance away, in an industrial park which would probably produce wrong directions. These days we have a location api for browsers on GPS-equipped devices that avoids the superstitious woo of traditional IP mapping.
Not to mention, every now and then people do searches remotely. About a month ago, I had to find an emergency towing service across two state lines. Also, you create problems for people using a VPN.
Bad information creates more customer service problems than prompting the user for what they need. MaxMind was selling bad information. If your precision is a "county," then the proper data is state and county. If the precision is state, then the proper data is, "State, Unknown County." It's high-school level data analysis to not mix your knowns and unknowns in a dataset by arbitrarily assigning a fake data point.
posted by CBrachyrhynchos at 12:40 PM on April 11, 2016
MaxMind was selling bad information.
Which is fine if your envisioned use case is "guessing sales tax jurisdiction" and less fine if it's "internet vigilanti-ism"
posted by pwnguin at 3:54 PM on April 11, 2016
Which is fine if your envisioned use case is "guessing sales tax jurisdiction" and less fine if it's "internet vigilanti-ism"
posted by pwnguin at 3:54 PM on April 11, 2016
remember 15 years ago when everyone on AOL showed up as being in Virginia? YUP. That, and having to explain to bosses that no, our non-profit local to one county of Washington state is not getting lots of visits from people in Virginia. Sigh.
posted by epersonae at 5:13 PM on April 11, 2016
posted by epersonae at 5:13 PM on April 11, 2016
Back in 2006, when we moved to Australia, we started a blog on good old Blogger, and I added a dashboard widget that would show me the location of our blog readers based on their IP address.
When we posted a picture of our sister-in-law holding a baby wombat at Taronga zoo, the Internet exploded, and the map filled up with dots like a particularly virulent flu outbreak or something. And yes, many of those dots were at the exact centers of countries.
I might have thought that baby wombats were particularly popular in Kansas, but the apparent huge number of readers in the middle of the great Australian outback gave the game away.
On the other hand, it was exciting to know that we had readers in the USA, Australia, India, France, ... even if we didn't know the exact location.
posted by RedOrGreen at 6:02 PM on April 11, 2016 [2 favorites]
When we posted a picture of our sister-in-law holding a baby wombat at Taronga zoo, the Internet exploded, and the map filled up with dots like a particularly virulent flu outbreak or something. And yes, many of those dots were at the exact centers of countries.
I might have thought that baby wombats were particularly popular in Kansas, but the apparent huge number of readers in the middle of the great Australian outback gave the game away.
On the other hand, it was exciting to know that we had readers in the USA, Australia, India, France, ... even if we didn't know the exact location.
posted by RedOrGreen at 6:02 PM on April 11, 2016 [2 favorites]
If your precision is a "county," then the proper data is state and county. If the precision is state, then the proper data is, "State, Unknown County." It's high-school level data analysis to not mix your knowns and unknowns in a dataset by arbitrarily assigning a fake data point.
This is actually what MaxMind does. The latitude/longitude that come riding along with that information. This is definitely a case of people not knowing how to use the database, rather than MaxMind not knowing how to make their product. The question of whether they should have thought to build a product resilient to people being stupid is separate.
posted by hoyland at 4:55 AM on April 12, 2016 [3 favorites]
This is actually what MaxMind does. The latitude/longitude that come riding along with that information. This is definitely a case of people not knowing how to use the database, rather than MaxMind not knowing how to make their product. The question of whether they should have thought to build a product resilient to people being stupid is separate.
posted by hoyland at 4:55 AM on April 12, 2016 [3 favorites]
Arbitrary values should never have been mixed in that data at any step of the process. It's a basic principle of handling data in electronic systems to provide a graceful way to handle null and missing data without ruining your dataset. If you rely on additional processing to identify the arbitrary values (51 cases for the U.S. alone at the state level) it's going to create problems.
posted by CBrachyrhynchos at 7:47 AM on April 12, 2016
posted by CBrachyrhynchos at 7:47 AM on April 12, 2016
Even though there've been something like five or six comments pointing out that the actual software provides this information, and it's only the free demo that doesn't, this hasn't stopped many more commenters repeatedly arguing that MaxMind should have done what they actually do. This thread is like a long exercise in people Having Opinions, presenting them authoritatively, independent of being actually informed on the topic.
"It's a basic principle handling data in electronic systems to provide a graceful way to handle null and missing data without ruining your dataset."
It's not "null or missing data" or even arbitrary within the context of their database. FFS. Every fucking bit of data is equally arbitrary -- there is not some official, authoritatively precise majority of IP geolocation data and then some other bits are fudged. It's all fudged and it's all fudged to varying degrees.
posted by Ivan Fyodorovich at 7:51 AM on April 12, 2016 [2 favorites]
"It's a basic principle handling data in electronic systems to provide a graceful way to handle null and missing data without ruining your dataset."
It's not "null or missing data" or even arbitrary within the context of their database. FFS. Every fucking bit of data is equally arbitrary -- there is not some official, authoritatively precise majority of IP geolocation data and then some other bits are fudged. It's all fudged and it's all fudged to varying degrees.
posted by Ivan Fyodorovich at 7:51 AM on April 12, 2016 [2 favorites]
This thread is like a long exercise in people Having Opinions, presenting them authoritatively, independent of being actually informed on the topic.
Yes, I would say that a postgraduate education including data analysis, a few published papers dealing with large and messy datasets, and a career working with this kind of stuff does qualify me to have an informed opinion on the topic.
It's not "null or missing data" or even arbitrary within the context of their database.
That's exactly what's described in this article! If the state or the county of the IP number can't be determined, the system automatically assigns 38.000, -97.000. It mixes this arbitrary code with street-level mapping data. It's a dataset with apples and oranges (more appropriately apples and toaster ovens) which makes it garbage.
Of course, all data is fudged to different degrees and in different ways (we call this error). Which is why you don't mix fundamentally different flavors of error within your dataset. We can't even talk about the reliability or precision of the IP mapping because the dataset is garbage.
posted by CBrachyrhynchos at 8:29 AM on April 12, 2016
Yes, I would say that a postgraduate education including data analysis, a few published papers dealing with large and messy datasets, and a career working with this kind of stuff does qualify me to have an informed opinion on the topic.
It's not "null or missing data" or even arbitrary within the context of their database.
That's exactly what's described in this article! If the state or the county of the IP number can't be determined, the system automatically assigns 38.000, -97.000. It mixes this arbitrary code with street-level mapping data. It's a dataset with apples and oranges (more appropriately apples and toaster ovens) which makes it garbage.
Of course, all data is fudged to different degrees and in different ways (we call this error). Which is why you don't mix fundamentally different flavors of error within your dataset. We can't even talk about the reliability or precision of the IP mapping because the dataset is garbage.
posted by CBrachyrhynchos at 8:29 AM on April 12, 2016
I wonder if they are using IP mapping to do this. I imagine there will be some upset people if there are inaccuracies in whatever dataset they are using.
posted by TedW at 9:17 AM on April 12, 2016
posted by TedW at 9:17 AM on April 12, 2016
"That's exactly what's described in this article! If the state or the county of the IP number can't be determined, the system automatically assigns 38.000, -97.000. It mixes this arbitrary code with street-level mapping data. It's a dataset with apples and oranges (more appropriately apples and toaster ovens) which makes it garbage."
I don't even know what you think this "street-level mapping data" is, but it's not what you think. You can actually go to MaxMind's site to read about the data they provide. Here's a page that includes a lot of detail about their "GeoIP2 Precision Services", which is their most accurate (and includes their most precise) data, which in some cases resolves to postal codes. Of note is this part (my bolding):
So, let's review:
I understand that the article itself is variously misleading on some of this -- where it doesn't mislead, it omits a bunch of relevant information. I can understand why readers would think that this Kansas location is an extra-special arbitrary thing compared to IP --> genuine, accurate street addresses. The article makes it seem like this is how it is and, clearly, people use these IP geolocation mapping services as if that's what they provide. And, yes, data structure and programming best practices are all heavily implicated in this topic and given the way the article is written, the educated reader is heavily inclined toward thinking that critiques like yours are apt. Which would have been fine, maybe, at the top of the thread before specifically informed commenters filled-in many of the blanks and corrected some misunderstandings.
posted by Ivan Fyodorovich at 10:15 AM on April 12, 2016 [4 favorites]
I don't even know what you think this "street-level mapping data" is, but it's not what you think. You can actually go to MaxMind's site to read about the data they provide. Here's a page that includes a lot of detail about their "GeoIP2 Precision Services", which is their most accurate (and includes their most precise) data, which in some cases resolves to postal codes. Of note is this part (my bolding):
The lower service tiers maximally resolve only to city precision, not postal codes. In all cases they are selecting a specific latlong coordinate to represent the postal code, city, state/province, or country associated with an IP address, using the highest level precision available for a given IP address. These coordinates are generally near the center of a region, because they're just points on a map representing areas of varying size.longitude| decimal | An approximate longitude of the location associated with the IP address. Latitude and Longitude are often near the center of population. These values are not precise and should not be used to identify a particular address or household.
accuracy_radius| integer | The radius in kilometers around the specified location where the IP address is likely to be.
So, let's review:
The basics of this have already been established in this thread. And someone has posted several times in this thread who has direct working experience with MaxMind's product. And anyone, including you, could have gone to MaxMind's site to read about their product, as I just did. Instead, you and other people have presumed that your authority on the general topic of CS and data structures meant that you didn't need to pay attention to what other people had written, didn't need to actually research the data and services about which you were authoritatively writing.MaxMind's lower-tier products resolve IP addresses to associated city, state/province, or national locations. They do not resolve to street-level addresses. In addition to providing city, state/province, or country names in these resolutions, they also provide a latitude/longitude coordinate pair to represent these regions. This is for mapping convenience and is not intended to represent specific physical locations.
MaxMind's premium product resolve some IP addresses to the level of postal codes, providing more precision, but otherwise everything in the previous applies. Also in this product they provide accuracy_radius, a more explicit quantification of precision for the latitude/longitude coordinates.
All of this data is of the same type. It is not apples and oranges, it is all one kind of fruit. The coordinates they return are sometimes (approximately) at the center of postal codes, sometimes states/regions, sometimes countries. When they provide a result such as the case described in this article, it's exactly the same thing they do with all their results, just in this case it's the approximate center of a nation and not the approximate center of a town or a state or, sometimes, a postal code (if you've paid more).
I understand that the article itself is variously misleading on some of this -- where it doesn't mislead, it omits a bunch of relevant information. I can understand why readers would think that this Kansas location is an extra-special arbitrary thing compared to IP --> genuine, accurate street addresses. The article makes it seem like this is how it is and, clearly, people use these IP geolocation mapping services as if that's what they provide. And, yes, data structure and programming best practices are all heavily implicated in this topic and given the way the article is written, the educated reader is heavily inclined toward thinking that critiques like yours are apt. Which would have been fine, maybe, at the top of the thread before specifically informed commenters filled-in many of the blanks and corrected some misunderstandings.
posted by Ivan Fyodorovich at 10:15 AM on April 12, 2016 [4 favorites]
If the state or the county of the IP number can't be determined, the system automatically assigns 38.000, -97.000. It mixes this arbitrary code with street-level mapping data. It's a dataset with apples and oranges (more appropriately apples and toaster ovens) which makes it garbage.
I can see why Ivan Fyodorovich has expressed frustration. There is no authoritative source of precise IP address to location data and the non-demo version of the MaxMind database does not pretend that it is such a database. For every request the MaxMind API returns a latitude, longitude, and a radius. The API always returns a circle that the service believes likely to encompass the location of the IP address, not a specific point where the service believes the IP address is located. For many IP addresses the service may return a circle representing a fairly precise location with a small accuracy radius, however, this is not always the case. For example, if the MaxMind service determines the IP address is likely to be in the U.S. without further specificity, the API returns 38.000, -97.000 for the latitude and longitude, but a accuracy radius of something like 2000 km.
posted by RichardP at 10:20 AM on April 12, 2016 [2 favorites]
I can see why Ivan Fyodorovich has expressed frustration. There is no authoritative source of precise IP address to location data and the non-demo version of the MaxMind database does not pretend that it is such a database. For every request the MaxMind API returns a latitude, longitude, and a radius. The API always returns a circle that the service believes likely to encompass the location of the IP address, not a specific point where the service believes the IP address is located. For many IP addresses the service may return a circle representing a fairly precise location with a small accuracy radius, however, this is not always the case. For example, if the MaxMind service determines the IP address is likely to be in the U.S. without further specificity, the API returns 38.000, -97.000 for the latitude and longitude, but a accuracy radius of something like 2000 km.
posted by RichardP at 10:20 AM on April 12, 2016 [2 favorites]
Hah, after I posted I noticed Ivan Fyodorovich has already replied with these details...
posted by RichardP at 10:21 AM on April 12, 2016
posted by RichardP at 10:21 AM on April 12, 2016
I do want to highlight this for agreement:
"We can't even talk about the reliability or precision of the IP mapping because the dataset is garbage."
Fundamentally, all IP geolocation data is garbage. That may be a bit of an overstatement, but given that IP addresses don't have a geographical component except incidentally, that there is no authoritative registry of IP geography association, and that in any event address assignment changes and range ownership changes, all databases of IP geolocation are inherently ad hoc and reflect an extremely high incidence of idiosyncratic associations.
This is also what I meant by saying that they're all "fudged" -- I primarily intended to emphasize that all latlong coordinates are arbitrarily assigned to something approximately the center of the associated geographical area -- but I also intended to imply that all of these geographical associations are questionable in a deeper sense, as I wrote earlier.
So I agree with what you wrote in that sense. But not in the sense that there's anything special about the Kansas coordinate result.
posted by Ivan Fyodorovich at 10:24 AM on April 12, 2016 [4 favorites]
"We can't even talk about the reliability or precision of the IP mapping because the dataset is garbage."
Fundamentally, all IP geolocation data is garbage. That may be a bit of an overstatement, but given that IP addresses don't have a geographical component except incidentally, that there is no authoritative registry of IP geography association, and that in any event address assignment changes and range ownership changes, all databases of IP geolocation are inherently ad hoc and reflect an extremely high incidence of idiosyncratic associations.
This is also what I meant by saying that they're all "fudged" -- I primarily intended to emphasize that all latlong coordinates are arbitrarily assigned to something approximately the center of the associated geographical area -- but I also intended to imply that all of these geographical associations are questionable in a deeper sense, as I wrote earlier.
So I agree with what you wrote in that sense. But not in the sense that there's anything special about the Kansas coordinate result.
posted by Ivan Fyodorovich at 10:24 AM on April 12, 2016 [4 favorites]
Saying the system works as designed and advertised really doesn't say much of relevance when we're criticizing the underlying design.
This is for mapping convenience and is not intended to represent specific physical locations.
Which is about like saying, "a meter is used for visualization convenience and is not intended to represent a specific physical length."
All of this data is of the same type. It is not apples and oranges, it is all one kind of fruit. The coordinates they return are sometimes (approximately) at the center of postal codes, sometimes states/regions, sometimes countries.
Any given data point could come from:
* RIR-assigned blocks
* registered addresses via reverse name lookup
* location api data
* street-based wifi scanning
That's not intended to be an exhaustive list. All of the above will give you different results, with different forms of error. Reporting any of the above through a single API (the API doesn't disclose method from what I can tell) and falling back to regional or national precision for a result is, IMO, bad design.
All of the counter-arguments here have been that the data design was well documented in the fine print of the service. However, the location mapping section is very vague. The city and country APIs have confidence values but it's not clear what they actually mean. It's not clear whether the range value in the location API means "we don't know" or "Texas is really big compared to Rhode Island." In fact, there's no documented way to know.
So I don't find that my criticisms have been addressed. The API reports heterogeneous data with large differences in data collection and precision. Reporting of location precision isn't sufficient to identify the level of precision. Reporting of confidence doesn't offer enough information to determine at what levels one should reject a report. There's minimal transparency as to which of multiple methods were used to return a specific result. Worse, the location API returns additional demographic statistics on population density and income.
posted by CBrachyrhynchos at 12:53 PM on April 12, 2016
This is for mapping convenience and is not intended to represent specific physical locations.
Which is about like saying, "a meter is used for visualization convenience and is not intended to represent a specific physical length."
All of this data is of the same type. It is not apples and oranges, it is all one kind of fruit. The coordinates they return are sometimes (approximately) at the center of postal codes, sometimes states/regions, sometimes countries.
Any given data point could come from:
* RIR-assigned blocks
* registered addresses via reverse name lookup
* location api data
* street-based wifi scanning
That's not intended to be an exhaustive list. All of the above will give you different results, with different forms of error. Reporting any of the above through a single API (the API doesn't disclose method from what I can tell) and falling back to regional or national precision for a result is, IMO, bad design.
All of the counter-arguments here have been that the data design was well documented in the fine print of the service. However, the location mapping section is very vague. The city and country APIs have confidence values but it's not clear what they actually mean. It's not clear whether the range value in the location API means "we don't know" or "Texas is really big compared to Rhode Island." In fact, there's no documented way to know.
So I don't find that my criticisms have been addressed. The API reports heterogeneous data with large differences in data collection and precision. Reporting of location precision isn't sufficient to identify the level of precision. Reporting of confidence doesn't offer enough information to determine at what levels one should reject a report. There's minimal transparency as to which of multiple methods were used to return a specific result. Worse, the location API returns additional demographic statistics on population density and income.
posted by CBrachyrhynchos at 12:53 PM on April 12, 2016
Yes, I would say that a postgraduate education including data analysis, a few published papers dealing with large and messy datasets, and a career working with this kind of stuff does qualify me to have an informed opinion on the topic.
What, now our CVs get to fight?
posted by hoyland at 3:24 PM on April 12, 2016
What, now our CVs get to fight?
posted by hoyland at 3:24 PM on April 12, 2016
By all means if a post opens with an ad hominem about qualifications to have an opinion...
posted by CBrachyrhynchos at 3:47 PM on April 12, 2016
posted by CBrachyrhynchos at 3:47 PM on April 12, 2016
I find that just writing out a response is boring and I can't imagine how boring this specific back-and-forth is to those not involved in it. I'll just suggest that you further investigate your claim that the state/province and country associations are qualitatively different than the other data, that this is similarly true about their corresponding coordinate assignments and, also, just an FYI, you should note that the use of a latitude and longitude pair to represent a named geographical region (the coordinate pair chosen somewhat arbitrarily from within that region) is ubiquitous and used by many authorities, including the USGS GNIS.
posted by Ivan Fyodorovich at 4:52 PM on April 12, 2016 [3 favorites]
posted by Ivan Fyodorovich at 4:52 PM on April 12, 2016 [3 favorites]
Since the documented api does not provide sufficient metadata about how results are obtained or even what values represent, there is no clear way to investigate whether a postal code and nation code result are equivalent.
posted by CBrachyrhynchos at 5:09 PM on April 12, 2016
posted by CBrachyrhynchos at 5:09 PM on April 12, 2016
If you're working with categorical data you can't just say that two process that spit out the string "Kansas" are equivalent. Maybe they are, maybe they're not. You can't just assume that two people using the same process produce equivalent results either.
The fact that reported "range" within the same dataset can vary from 1 - 2,000 miles should be a big warning sign that there's something screwy with that coding system.
posted by CBrachyrhynchos at 6:11 PM on April 12, 2016
The fact that reported "range" within the same dataset can vary from 1 - 2,000 miles should be a big warning sign that there's something screwy with that coding system.
posted by CBrachyrhynchos at 6:11 PM on April 12, 2016
In other, actual, news: "The hell is (almost) over for the farm in Kansas. It is no longer the digital center of the U.S."
The over 620 million IP addresses that are imprecisely mapped in the MaxMind database no longer point at Joyce Taylor’s farm. They point to a new default location for the United States: a lake west of Wichita, next to Pretty Prairie.posted by jjwiseman at 7:43 PM on April 12, 2016 [2 favorites]
“I want to see the bill after cops dredge the lake looking for a missing person,” said Maynor.
« Older Dave Spector, Gaijin Tarento: Big in Japan... | We're Gonna Need A Bigger Remote Newer »
This thread has been archived and is closed to new comments
posted by oneironaut at 12:17 PM on April 10, 2016 [2 favorites]