MoviePass database exposes 161M records - <AUTHOR> https://www.scmagazine.com/home/security-news/moviepass-database-exposes-161-million-records/ <comment><USER2> With the billions of records breached this year alone, I'm feeling quite apathetic to these stories now.

Thousands or millions of records are breached due to X (usually egregious negligence, sometimes not), the company makes an apology full of mental gymnastics, blame game, and bold lies ("Your privacy is our number one concern, we're sorry we are only pretending to care now."), a few days later the heat is off because another company let loose a few million other records. Repeat.

I feel like I need to be re-sensitized. This is a major problem - and I just can't seem to muster up any care for it anymore.

<comment><USER3> Everyone has an opinion on why Amazon is a monopoly and should be broken up, but this is what they don't think about. I _trust_ Amazon not to get breached. No one is infallible, but tech is their _thing_.

I have no interest however, in further increasing the amount of online shopping accounts I maintain, because that means I have to keep tabs on the shenanigans of even more, highly technically incompetent, companies to know if I've been compromised.

<comment><USER4> Just use a password manager so you can have a different password for each site. It's not that hard.

<comment><USER5> The article points out that MoviePass had user and credit card data in plain text. A password manager wouldn't have helped with that.

<comment><USER6> The credit agencies are supposed to protect cardholders via PCI DSS audits (see [https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...](https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf)). This is definitely non-compliant. Obviously this system is broken.

Additionally, I don't understand why companies continue to roll their own payment processing rather than paying a service that knows how to do it. I guess it seems easy...

<comment><USER7> PCI DSS is a program of the card associations to protect the _issuing banks_ from fraud losses. Merchants have difficulty complying so it ends up as a balancing act between keeping the wheels of commerce moving and preventing fraud.

Fully outsourced payment solutions are a good fit for some business models but not for others.

<comment><USER8> Great post.

One thing I would add is that PCI DSS is also applicable for ISO's as well VAR's which operate payment processing gateways.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Blogspam of [https://techcrunch.com/2019/08/20/moviepass-thousands- data-e...](https://techcrunch.com/2019/08/20/moviepass-thousands-data-exposed- leak/) (which I did submit [[https://news.ycombinator.com/item?id=20752190](https://news.ycombinator.com/item?id=20752190)] but didn't get many upvotes, hmrph)

</comment><comment><USER10> I thought MoviePass was already deep in the red. What incentive do they or any company have to protect their data if they are imminently going bankrupt? I'm guessing cybersecurity is not their most pressing concern, although maybe it is now.

<comment><USER11> Their customer database was probably the only asset of value they had.

<comment><USER12> Is a list of people who like to pay less than face value for movie tickets valuable?

<comment><USER13> Yes. It's a list of price-sensitive consumers who historically respond well to perceived discounting.

General rule of thumb for spam email is 0.1% conv rate, so if you blasted this leak list then you'd have 150K sign ups.

<comment><USER14> What's the marginal value of this kind of list though? Call me cynical but I would assume data of a similar type and quality is already readily available

<comment><USER13> None really. Keep in mind any list dumps you can easily find online have already been pillaged thoroughly.

There is an entire data broker industry that relies on selling lead/contact information, so if anything there is a value savings on the hack. I've seen high quality contact (and assoc. company) data sell anywhere from $3 to $120.

</comment></comment></comment></comment></comment></comment><comment><USER15> If I want a trip down memory lane, I can just check the data breach section of CreditKarma and see a chronological history of all of my passwords from the last 25 years.

At this point, I'd join a social network that matched me with all of the people around the world that also used the same "clever, obscure" passwords.

</comment><comment><USER16> Why are they storing credit card numbers in a database in the first place? This should fall under PCI-DSS if so.

</comment><comment><USER17> So ... twenty years of free credit monitoring, then?

</comment><comment><USER18> unfortunately this is just becoming the norm and companies aren't held accountable for losing data. every account i make now is with a catchall domain and a randomly generated password

<comment><USER19> > unfortunately this is just becoming the norm and companies aren't held > accountable for losing data

How would a company be held accountable for losing data? Fining them? Paying out to users?

<comment><USER20> Pass a law that says every lost user account is an X dollar fine based on data "richness" that can't be discharged in bankruptcy. For simplicity, let's say $10 in this case. 160 million lost accounts is now a 1.6 billion dollar fine. That is enough to cripple a lot of companies. It would make people think long and hard about what data they wanted to keep and how they wanted to secure it.

Alternatively, create a situation where companies are responsible in perpetuity for damages related to identity theft if a victim's credentials are lost. If company X loses my SSN and then someone opens up a fake account in my name, they are automatically responsible for any costs I incur and I don't have to prove attribution.

The purpose should be to heavily, heavily disincentivize any storage of basic data or PII unless absolutely necessary.

<comment><USER19> Yes, that would also make it really easy for individuals/corporations/state actors/etc. to destroy companies: secretly employ security researchers that compromise your target's database and bam, you've just crippled/ruined them.

China tired of US putting pressure on Huawei? Bam, start targeting American companies and totally financially ruin them using their own privacy laws/fines against them!

Disgruntled suicidal employee has a grudge? Take down the whole company on your way out with that backdoor time bomb you planted and let the $1.6B fine do the rest!

<comment><USER21> You know that there are other industries that have heavy regulatory fines like this, right? The existence of a software culture where a single rogue employee can easily destroy the privacy of hundreds of millions of people is _itself_ a huge part of the security problem. If there were actual consequences for this kind of thing there would be a lot of changes to software development practices. I'm not saying that culture alone will make code perfectly secure, but I do think _caring_ about the code being secure (in the sense that the company will face deep financial and legal trouble if it isn't) is a necessary prerequisite. Arguably, it's the _only_ thing that works.

You may argue that you can't just buy absence of security bugs with money and a different culture, but there are plenty of formal verification tools out there, and they are not all toys. True, verified code is expensive compared to writing "normal" software, which is developed using the same best practices" that lead to a data breach being announced seemingly every other day. But it is quite cost-competitive with "high assurance" software (i.e. software developed when people face real consequences for the existence of bugs) and the techniques have been used to secure a number of nontrivial real systems by now. I have absolutely no doubt (as someone who's in the field) that we would see a huge boost to the state of the art in that field if there were actual money in it, especially considering how much of the current difficulty with using formal verification comes down to the lack of user-friendly tooling.

But, to reiterate, my larger argument isn't really about formal verification; I'm mostly bringing it up to refute the argument that the existence of bugs is something totally outside of any company's control. Ultimately companies are currently choosing not to pay to make their code secure, and it's not hard to see why given the current legal climate of "there are no consequences whatsoever." Ideally, the first step towards fixing this would be for the software development community at large to acknowledge that it is, actually, a choice, but frankly I don't see things happening that way. If a move towards not just safer, but genuinely bug-free (or at least, bug-free outside of hitherto undiscovered exotic side channels) software is going to happen at all, it'll be because a large government drags its country's unwilling programmers and CEOs in that direction.

</comment></comment></comment></comment></comment><comment><USER22> As usual, I want to ask: what are your favourite resources for security? These breaches seem like a good opportunity to share knowledge.

I like the OWASP content. Google Gruyere is also really nice for xss imho

</comment><comment><USER23> In what scenario, a system without a db password could possibly be designed for new startups?

</comment><comment><USER24> It wasn't 161m customers that were exposed, it was 0.058m

Pretty big difference to what the headline implies

<comment><USER2> Headline is accurate. 161M records were in the database. They have evidence that _at least_ 60,000 of the records accessed had credit card data attached.

> _161 million records was left unsecured and _exposed credit card and > customer card information on at least 60,000 of the ticket service's > customers_._

</comment></comment><comment><USER25> We need a GDPR equivalent in the US. That's the only way this will change.

<comment><USER26> No thanks. Thats a solution worse than the problem.

</comment></comment><comment><USER27> Sounds like an insurance scam</comment>


Simple tool to help create SSL certificate requests - <AUTHOR> https://csrhelp.peculiarventures.com <comment><AUTHOR> There are a bunch of good tools like [https://www.ssllabs.com/](https://www.ssllabs.com/) and [https://mozilla.github.io/server-side-tls/ssl-config- generat...](https://mozilla.github.io/server-side-tls/ssl-config-generator/) for getting your SSL configuration right. That said generating the certificate request with various tools can be a pain. We try to address that pain with this tool.</comment>


The Post Office Can (and Will) Sell Your Stuff, Even Before the Delivery Date - <AUTHOR> http://www.inc.com/chuck-blakeman/the-post-office-can-and-will-sell-your-stuff-even-before-the-delivery-date.html

<comment><USER2> "Fascinating" indeed... I've no problem with the general practice of selling lost or mis-directed packages that are reasonably never going to be claimed, but if the facts are as the columnist writes - with one box of 88 books x $28.95 being sold under the $25 threshold, the USPS should be worrying less about the PR damage and more about keeping its (dwindling) customers happy.

<comment><USER3> Dwindling customers - numerically speaking, sure. But volumes they seem to be ok on. Especially when you consider all of the last mile work they are doing for UPS & Fedex.</comment></comment>


Canada Border Services seizes lawyer's phone, laptop for not sharing passwords - <AUTHOR> https://www.cbc.ca/news/business/cbsa-boarder-security-search-phone-travellers-openmedia-1.5119017 <comment><USER2> >Wright refused, telling the officer both devices contained confidential information protected by solicitor-client privilege.

>He said the officer then confiscated his phone and laptop, and told him the items would be sent to a government lab which would try to crack his passwords and search his files.

Can this be used to get whatever case(es) he was defending thrown out because solicitor-client privilege was violated or parallel construction was used?

<comment><USER3> >> Can this be used to get whatever case(es) he was defending thrown out because solicitor-client privilege was violated or parallel construction was used?

That isn't what this is about. Nobody is talking about what this is really about and it isn't anything to do with him being a lawyer. This guy (1) was traveling alone (2) to a distant (3) and poor (4) country without preexisting business ties (5). Those are all red flags for sex tourism.

I cannot say this strongly enough: I would never say this guy is a sex tourist, nor would boarder services. But they do run a program that targets people who meet certain criteria, criteria that this guy seems to have fallen into. Most famously, a bishop returning from Thailand had his laptop "randomly" searched by this program. ([https://en.wikipedia.org/wiki/Raymond_Lahey](https://en.wikipedia.org/wiki/Raymond_Lahey)) There have been other less-pubic successes too. The program is controversial but within the bounds of Canadian law.

So before everyone goes nuts about terrorism and attorney-client privilege, realize that this innocent person was caught up in a program that has nothing to do with those things. Canadians are polite, especially when dealing with sensitive matters. Canadian cops don't shout things from rooftops. Because of the nature of what they are looking for, boarder services isn't going to give any public explanations. They will hold the electronics for some time, as is their right, but they likely regret "randomly" selecting this particular person. In the future they will probably add "not a lawyer" to the criteria.

<comment><USER4> What is wrong with sex tourism?

<comment><USER5> In most parts of the world, sex workers don't exactly have strong human rights protections. In a poor country, it's generally worse.

A relatively wealthy, privileged person going someplace poor for sex is probably doing it because it facilitates doing rather nasty things in a way that is comfortable for them. They don't need to be ugly about it. Someone else will be ugly about it on their behalf while making them feel great about spreading their money around.

This often means they are raping children or otherwise indulging sexual predilections too unseemly for sex workers in more well-heeled parts of the world.

So _sex tourism_ is generally understood to be a polite term for exceedingly depraved behavior with a veneer of civility.

<comment><USER3> This. Anyone who thinks they are targeting people visiting Amsterdam's red light district, or Nevada's bunny ranch, needs to read more. This is about people seeking underage sex in countries where it is more accessible than in Canada. Thailand, Vietnam, all of south america ... a single male with no family ties, returning alone from such countries should expect some attention at the Canadian boarder. They are looking for the pictures, the possession of which is a serious crime in Canada.

</comment></comment></comment></comment></comment><comment><USER6> I have asked this question before, but never really got a satisfiable answer: why do governments (not just USA/canada) spend these resources to check data physically at a border?

It's not like you need to 'smuggle' any form of data physically.

I mean, any data considered to be dangerous (like terrorist attack plans, atomic bomb designs or political inside information) can be accessed across borders via the internet. You don't need to have those on any of your devices.

And even if you had the data on a laptop, how does border patrol even know what they are looking at?

<comment><USER7> This might partially answer your question...

I had my laptop searched at the border once. It was my work laptop. They told me the same thing, if I didn't share the password they would confiscate my computer.

It felt wrong that they should be able to search my computer, but I also felt bullied because I was going to need my computer the next day if I wanted to work and I think most people, including my boss at the time, would not see a problem with the search, so I let them search.

All they did was open up Windows Explorer and do a search for *.jpg. Then she looked up at me and said, "What kind of images am I going to find on your computer today?"

I don't remember what I said, but basically it took about 30 minutes for Windows to display all the results. She looked through them all and then I was free to go. I got the impression that they were looking for child pornography, but I don't know that for sure.

Either way, it was a pretty innocuous search, but this was also about 10 years ago. From what I understand, they now pull all the files off your computer and index the contents. They likely have a list of keywords that it searches against immediately and then it's indexed for when they add more keywords later.

<comment><USER8> Why do you think they did this kind of invasive search? It's very weird to me that border patrol would randomly search all the images on someone's computer. This doesn't even seem like an efficient way to catch criminals. Power trip?

<comment><USER9> Maybe just "a randomized search". Sounds very inefficient.

I think they are just looking for crimes like drug mules, people coming to work with tourist visa etc. Everyone here talks about nuclear plans but I doubt.. probably bully too but against simple minded criminals it can work. Texts of arranging work or when is the package going to arrive etc.

<comment><USER8> Right, but parent comment said they just searched all images (or jpgs). Hard to think of any motivation beyond finding child pornography, no? But that doesn't seem like something you'd reasonably become suspicious of during a short interaction.

</comment></comment></comment></comment></comment><comment><USER10> > Officers uncovered a customs-related offence during 38 per cent of those > searches, said the agency.

I really want to understand what kind of digital data is considered a customs- related offence.

<comment><USER11> There are cases at the Canadian border in which the investigators search for "boy" or "girl" using the Windows search tools to see if there is child pornography on your device. In other circumstances, they uncover hentai[0] showing characters that appear to be underage - and bringing that into Canada is illegal (in fact, much like Australia and New Zealand, any sexual depiction of fictional minors is illegal, and that can include stories or other text). There are anecdotal and well-documented cases for the latter[1]. One Reddit user claimed that the investigators at the border found browser-cached _thumbnails_ of such material (since it used to be permitted on Redddit) and he was jailed for a day or something like that.

Not to suggest that all of the 38% count for that, but with the popularity of drawn pornography I'd wager it makes up a sizable chunk.

[0] Hentai refers to anime-style drawings of fictional characters.

[1] [https://www.google.com/search?client=firefox- b-d&q=canadian+...](https://www.google.com/search?client=firefox- b-d&q=canadian+border+hentai)

<comment><USER12> Is there an exception for religious texts? There are Is more than one common religions whose holy texts depict sexual activity with minors.

Also, if I have a copy of Nabokov "Lolita" on my kindle, will I get in trouble? Stephen King's It? An apt pupil?

<comment><USER13> "Also, if I have a copy of Nabokov "Lolita" "

Enforcement is selective.

</comment></comment></comment></comment><comment><USER14> It's stuff like this that makes me want to build after-market privacy-oriented Samsung firmware, that at a low level (secondary bootloader) supports dual booting. By default you'd boot into the "non-private" environment. That way if customs asks to see your device, you simply boot it up and hand it over. Could make life a lot easier for lawyers, doctors, C-level executives etc.

I should note, dual-booting Android phones isn't a new concept, it's just generally performed at a higher (less secure) level. In particular, the secondary bootloader implements Loke (flashing protocol)[1], so a custom secondary bootloader could also prohibit flashing of unsigned images.

[1] source, I'm the developer of Heimdall - [https://github.com/Benjamin- Dobell/Heimdall](https://github.com/Benjamin-Dobell/Heimdall) \- [https://gitlab.com/BenjaminDobell/Heimdall](https://gitlab.com/BenjaminDobell/Heimdall)

<comment><USER15> Would this system come with plausible deniability?

Also, does anything like this exist for desktop operating systems?

<comment><USER16> Yeah. You can install GRUB snd default load it to windows 10 fresh install. Put some dummy files in the desktop, make it cluttered with oictures of cats and articles about meditation. This might sound like a great idea maybe i should try it!!

<comment><USER17> People say they scrape the filesystem (rather than copying everything), maybe they'd detect *nix systems too.

</comment></comment></comment></comment><comment><USER18> I've always preferred having a dedicated desktop that acts as a personal server and then a small cheap laptop that I use to remotely access it.

While this preference is mostly driven by capitalizing on the performance/price/size difference between desktops and laptops, it has lots of advantages when it comes to these situations.

My Dell XPS 13 only has 128GB of storage so none of the data exists solely on that device; it acts mostly as a dumb terminal that I use to SSH to my desktop. I suppose upon booting the machine they could request SSH key passwords and then search my desktop but this seems unlikely.

While most of the issues with these border searches are privacy/ideology based. These types of security theatre can easily be circumvented.

Of course, just using Linux may get you detained for a bit which makes it all moot. Maybe having a business card saying I'm a systems administrator (which is true) would make Linux an easy explanation.

If these searches increase and become normal, I think it's only a matter of time before Apple implements a cloud based 'data refuge' that would allow users to temporarily offload encrypted sensitive data to the cloud while crossing borders and traveling to countries with weak or no privacy laws.

<comment><USER19> Do you have a citation on how using Linux can get you detained?

<comment><USER20> I haven't heard of Linux getting people detained at border crossings, but it definitely gets you more scrutiny from other government organizations like the NSA[1].

[1] [https://www.eweek.com/security/linux-lands-on-nsa-watch- list](https://www.eweek.com/security/linux-lands-on-nsa-watch-list)

</comment></comment></comment><comment><USER21> Digital privacy while crossing borders seems to increasingly be an issue. And I'm worried that it's not going to improve any time soon. Politicians and very rich people don't deal with border security the same way normal people do.

<comment><USER22> That's my main issue with the recent trend to make international travel harder.

There's a huge push to assume that travelers are criminals and all kind of inconveniences, expenses or outright humiliations are O.K.

<comment><USER23> I've certainly reduced my tourism levels on account of CBP. Can you not rip my car to shreds every time I cross the border?

<comment><USER24> Thus reducing CO2 and working towards saving the planet

<comment><USER25> if you took cars away from the entire population that would only account for up to 25% of the CO2 being released. So, on this small a scale it's doing almost nothing.

<comment><USER26> A 25% reduction in CO₂ is a massive undertaking the likes of which have never been attempted before.

<comment><USER25> And yet it still is not enough. Not to mention that banning car usage will disproportionately affect poor, disabled, rural, and mentally ill people.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> Many of the services which could be accessible from those devices are American services with data residing on American servers. I wonder if it is possible to use hacking laws as a means of dissuading border agents from looking at devices. A Canadian agent might have jurisdiction in Canada but what if the get charged under the CFAA in the USA for accessing a server they aren't legally allowed to access. Perhaps it would be possible to design a specific legal/digital service for people to install with servers all over the world as a type of legal landmine meant to punish agents searching data by using hacking laws in many jurisdictions. Think of it like copyleft for stopping agents from snooping.

<comment><USER28> _CBSA officers are directed to disable any internet connection and only examine content that is already stored on a device_

<comment><USER27> Perhaps one could add a specific sort of legal DRM crypto layer and then get them for anti-circumvention. No internet connection required.

<comment><USER29> As you might expect, law enforcement is specifically exempt from the DMCA's antcircumvention provisions. I would imagine that's true for other countries' equivalents as well.

Same with the CFAA.

</comment></comment></comment></comment><comment><USER30> He's suing to get them back and for compensation for having to "temporarily" replace them, but even if he wins he probably shouldn't trust either device in the future (possibly more so for the laptop).

<comment><USER2> >he probably shouldn't trust either device in the future (possibly more so for the laptop).

Seems risky for the government to put any firmware/hardware implants on those devices. The user is naturally going to be suspicious of it because the government had unrestricted access for days/weeks. So there's a high chance that the user might not even use it or will send it to an expert for analysis. If discovered, it's going to look extra bad for the government because there's no doubt that they did it.

<comment><USER31> Suspicious, sure, but most users aren't equipped to do that kind of diagnosis, and many won't be able to afford new devices, and maybe it will look even worse for the government but I am certain absolutely nothing bad will happen to the people who added the malware.

<comment><USER32> But in this case the EFF would love to do a forensic examination.

</comment></comment></comment></comment><comment><USER33> Why doesn't everyone simply refuse to share passwords, as is mentioned numerous times on various Canadian government websites? Basic search finds tons of pages from all sorts of departments [https://www.canada.ca/en/sr/srb.html?q=share+password](https://www.canada.ca/en/sr/srb.html?q=share+password)

A few samples

> 95% [of polled Candians] know not to share their passwords

[https://www.getcybersafe.gc.ca/cnt/rsrcs/vds/nln-sft- stck-p/...](https://www.getcybersafe.gc.ca/cnt/rsrcs/vds/nln-sft-stck-p/index- en.aspx)

> don't share your PIN, password or personal security questions and answers > with anyone, not even family members

[https://www.canada.ca/en/financial-consumer- agency/services/...](https://www.canada.ca/en/financial-consumer- agency/services/banking/online-banking.html)

> If you've shared passwords with friends, now would be a good time to change > them

[https://www.getcybersafe.gc.ca/cnt/blg/pst-20180913-en.aspx](https://www.getcybersafe.gc.ca/cnt/blg/pst-20180913-en.aspx)

> Protect your password, don't write it down or share it with anyone and > change it often

[https://www.canada.ca/en/employment-social- development/progr...](https://www.canada.ca/en/employment-social- development/programs/homelessness/hifis/training/administrative/module-1/thinking- security.html)

A few days of every single traveler saying "no" would force them to either begin seizing all electronic devices or to drop the entire endeavor as untenable. This problem doesn't need a technical solution beyond making sure locked devices are actually secure.

<comment><USER34> Because border police have authority

<comment><USER33> Could you elaborate on that thought?

Individuals also have the authority to assert their rights, one of which in Canada is the freedom from unreasonable search and seizure[0]. R v Fearon[1] places limitations on this exact type of search one could easily argue aren't met given the descriptions of these searches I've read.

[0] [https://en.wikipedia.org/wiki/Section_8_of_the_Canadian_Char...](https://en.wikipedia.org/wiki/Section_8_of_the_Canadian_Charter_of_Rights_and_Freedoms)

[1] [https://en.wikipedia.org/wiki/R_v_Fearon](https://en.wikipedia.org/wiki/R_v_Fearon)

<comment><USER35> You don't have any rights at the border. The moment they decide to search you they will ask for your passwords. If you don't give it, they'll detain you until you do.

<comment><USER33> > You don't have any rights at the border.

This is, to the best of my knowledge, factually untrue.

> Canadian courts have generally recognized that people have reduced > expectations of

> privacy at border points. In this context, privacy and other Charter rights > continue to apply

> but are limited by state imperatives of national sovereignty, immigration > control, taxation

> and public safety and security. The Canadian courts have not yet ruled on > whether a

> border officer can compel a person to turn over their password and on what > grounds, so

> that their electronic device may be searched at a border crossing.

[https://www.priv.gc.ca/en/privacy-topics/public-safety- and-l...](https://www.priv.gc.ca/en/privacy-topics/public-safety-and-law- enforcement/your-privacy-at-airports-and-borders/)

It goes on to specify that while the law is unclear, an _unpublished_ Canada Border Services Agency policy states searches "should not be conducted as a matter of routine; such searches may be conducted only if there are grounds or indications that "evidence of contraventions may be found on the digital device or media."" [nested quotes sic from page, presumably from this unpublished policy]

IANAL (nor Canadian) but the Canadian Charter of Rights and Freedoms and the Customs Act, and probably many more documents and judicial rulings, define the rights available to anyone crossing the Canadian border. CBSA policy may not be legal, and only by exercising their rights and refusing to cooperate with illegal orders will citizens be able to affect change.

Many brave people in the past have risked detainment, property seizure, and worse in order to protect the civil rights of millions of others. Apparently, in regard to safeguarding personal data privacy, this is again necessary.

<comment><USER13> The Charter is an embarrassment/joke -> see not withstanding clause.

</comment></comment></comment></comment></comment></comment><comment><USER36> This is the definition of a police state, with law enforcement officers empowering themselves and demanding to go through your personal papers, how dehumanizing is this?

What is the difference between this and the stasi or the police of any totalitarian state demanding to go through your personal papers? There is a huge difference between physically checking your laptop or phone and demanding to go through its contents and your personal data and thoughts. This is hugely invasive and dehumanizing and is the definition of totalitarianism. The word democracy by definition cannot include this.

Even more disturbing is the cognitive dissonance of those who have complete moral clarity when condemning police state tactics in some third country and then stretching credulity to normalize the exact same thing when done by their own governments or 'democracies'. The is the dangerous road to totalitarianism where values are not defined by actions but actors.

</comment><comment><USER37> Fighting this is all well and good, but we should look into the near future to when brain scanning or lie detecting has improved.

The fundamental problem is that governments believe they deserve to know citizens and travelers' thoughts. (Cell phone contents are a close proxy.) I disagree, and believe they can still provide adequate border and intranation security without it.

</comment><comment><USER38> So what's the Canadian governments real position on this?

Are individuals and companies allowed to store private and confidential data, or is all information seizable by the government without a warrant at the border?

They can pick one...

<comment><USER7> It's not that black and white. Private and confidential data is allowed; however, customs and border patrol also have legal authority to inspect such private and confidential data when you cross the border. They do not have the right to inspect it, without warrant, elsewhere.

This is the same in the US, maybe even worse in the US. Customs can inspect your home if you live within 100 miles of any border...

[https://www.citylab.com/equity/2018/05/who-lives-in- border-p...](https://www.citylab.com/equity/2018/05/who-lives-in-border- patrols-100-mile-zone-probably-you-mapped/558275/)

</comment></comment><comment><USER39> Why do border services think they can seize a device and send it to a lab?

If a border officer suspected I had a hidden compartment in my suitcase could they ship it off to a special lab?

I don't agree with (but can see the logic in) them copying data off your HD and trying to crack it later.

But I don't understand what legal argument is to be made for arbitrarily seizing property at the border.

<comment><USER40> >But I don't understand what legal argument is to be made for arbitrarily seizing property at the border.

It looks an awful lot like garden variety theft, to me, which makes me question whether or not we should use their vocabulary here ("seize", versus "steal"). That said, I hesitate to wager on whether or not a court will side with the victim.

</comment></comment><comment><USER41> > He said the officer then confiscated his phone and laptop, and told him the > items would be sent to a government lab which would try to crack his > passwords and search his files.

Hopefully they were powered down and used proper full-disk encryption.

<comment><USER42> Do you think its better to have an iPhone powered down or on?

I am wondering if it would be possible to leverage remote wipe features, but maybe the border agents power off the device or put it in a bag / container that blocks cellular signals.

<comment><USER43> Shouldn't matter. The key thing is to have a strong password, and disable any biometric authentication beforehand. (You can do this by squeezing the side buttons for a few seconds until the "power off" screen appears. The phone will then require a password before reenabling biometric authentication.)

<comment><USER44> Will that also terminate the in-memory ephemeral key that's set up at first login to permit background app refreshes?

<comment><USER43> Good question, I forgot about that. I'd have to read through the security guide again. I wouldn't personally worry about that, as I think the system is sufficiently robust against external attacks, but obviously other people's priorities and levels of paranoia may differ.

</comment></comment></comment></comment></comment><comment><USER45> Personal computers (and cell phones) contain more information than people could have ever imagined when polices around searches at borders became a thing. It's really unfortunate that there's no desire to respect that. You could find more from someones smartphone than you could via a search of their home with a warrant.

I'm pretty glad I travel a lot and can afford a second phone as a total burner that I keep nothing on, and a new m.2 SSD and a clean install for my laptop. It's saved so much hassle, as the one time I was asked to look at them, it was an easy "Sure officer, go right ahead. I hope you're quick though, there's nothing on either."

</comment><comment> Max-q > Officers uncovered a customs-related offence during 38 per cent of those > searches, said the agency.

This is hard for me to comprehend. Does anyone have an idea of what 38% of the phones can have stored on them, that is illegal to have when crossing the border?

<comment><USER46> > Does anyone have an idea of what 38% of the phones can have stored on them, > that is illegal to have when crossing the border?

Generally it's things like text messages from friends/family/potential employers that lead agents to think the person isn't going to abide by their non-work/short term visa.

<comment><USER47> that isn't a customs-related offence, though - that's an immigration related offence. Customs is concerned with the movement of goods, not movement of people.

<comment><USER46> They handle both at the border.

</comment></comment></comment></comment><comment><USER48> It's even worse in Australia:

[https://www.theguardian.com/world/2018/aug/25/sydney- airport...](https://www.theguardian.com/world/2018/aug/25/sydney-airport- seizure-of-phone-and-laptop-alarming-say-privacy-groups)

</comment><comment><USER49> Why aren't plausible deniability passwords a feature in operating systems? Especially since many now offer full disk encryption.

What would happen to these searches if plausible deniability passwords became more widely used?

<comment><USER50> I took a workshop on custom Kali builds where they specifically spoke about LUKS headers and shipping them via email/gdrive to yourself and removing them from the physical device. It renders the partition useless. This was viewed as a better alternative than something like TrueCrypt with decoy passwords since if the government can ever prove you did it then that's obstruction. With the headers gone and no local copy you can't provide what you don't possess.

<comment><USER51> > This was viewed as a better alternative than something like TrueCrypt with > decoy passwords since if the government can ever prove you did it then > that's obstruction.

If that qualifies as a type of legally actionable obstruction, it would seem that intentionally wiping your device before you cross a border and then reloading data onto it once you arrive at your destination would also qualify.

<comment><USER50> In one, you intentionally give false information and lead the government believe you in good faith complied. In the other, the data is inaccessible and the government is aware it is inaccessible. They can then evaluate risk and seize the device or take some other action from that knowledge. IANAL and I don't play one on TV.

ETA: To complete the threat analysis, and if they seize two devices, one with a password protected key and a LUKS volume without headers? I'll take LUKS.

<comment><USER51> > In the other, the data is inaccessible and the government is aware it is > inaccessible.

Because the person made it inaccessible with the intention of concealing it from law enforcement and others. There is still a means to decrypt the data.

All of the actions described in this thread - whether it's decoy passwords, encrypted volumes with headers, burner devices, or wiping data and then restoring at the destination, all seem like they could be construed by law enforcement as a person obstructing their ability to sift through the individual's data.

(But IANAL either.)

</comment></comment></comment></comment></comment><comment><USER52> I really can't be the only person who travels internationally with a burner phone and burner laptop. I'll generally wipe them both sitting at the airport waiting for my flight home, just so that I can have the e-passport application up by the time that I land and go through customs. (Admittedly, I should just upgrade my TSA Precheck to Global Entry, but, I'm not even sure that I want to go through with that process).

<comment><USER35> When I was working at Google I had to go through some training videos that explained that you should never bring corporate devices across the border for this very reason -- that they could be searched, thus breaking the NDA. They'll ship you a clean laptop instead.

</comment></comment><comment><USER53> Do you actually have to tell the officer's your password or do you need to just unlock the device. Also, are you allowed to be there while they are searching it to see what they're looking at/searching for?

</comment><comment><USER54> I never really understood the reason for seizing an electronic device anyway. Surely if something was important / secret enough it wouldn't be _on_ the phone. What are they looking for, exactly?

<comment><USER55> Most criminals don't actually have great OpSec.

I'm sure there are tons of phones that have incriminating photographs in the default camera app, or incriminating text messages or saved voicemails or who knows what.

<comment><USER56> Most people don't have great opsec, and most people are technically criminals.

</comment></comment></comment><comment><USER57> Cases like these makes me want to take extreme precautions when traveling.

I recently returned from a trip to the US, and prior to boarding (in any direction) i wiped my browser history, and logged out of iCloud, wiping all message history etc. When i arrived at my destination i simply restored from the last iCloud backup, and things "magically" reappeared.

Reading the comments here made me realize that it's much more than just personal emails/notes, but also things like Uber history, frequent locations, frequent calls, etc. Basically anything you do that has a pattern to it, or matches a list of keywords.

As i don't see the need nor justification for any government to profile me in detail, I'm seriously considering doing a complete wipe of the phone for my next trip, setting it up as a basic _phone_ and restore a backup once i arrive. For a laptop i would probably set it up as new, and bring an installation media with me, reinstalling when i arrive.

</comment><comment><USER58> If you demonstrate that government employees changed files all over your hard drive during a "search" then I wonder if recourse or compensation or legal action is possible.

I understand the law permits CBSA agents to perform warrantless searches. e.g. _reading_ the contents of your hard drive. This is, rightly, controversial. But then does the law also permit them to _modify_ the contents of your hard drive?

The act of logging in and browsing your computer will make many changes to system log files, to metadata of documents (e.g. last accessed date), etc. (Just thinking out loud about technicalities and other angles on this.)

</comment><comment><USER59> Same thing happened to me last year, flagged by Canada customs as some kind of potential sex criminal being a solo male traveller and I just gave them my unlocked phone to search through so I could get out of there after a 12hr flight.

I had keepassx android 3rd party app installed to keep financial info and passport pics in case my bank cards and other things were stolen, totally forgot it was there and they didn't even ask me for the pw, returning my phone and letting me go. If I was a degenerate criminal I could have had anything in there was surprised they didn't notice it.

</comment><comment><USER60> Exactly how many meaningful crimes have been prevented or busted because of this behavior?

I think sacrificing liberty for security is generally a bad idea. But it seems we're increasingly sacrificing liberty for nothing, which is a rather worse idea. We're creating a dystopia for what? To get people to click on ads on one front, and on fronts like this - the pretext is mostly to stop terrorism, but that's something that should be cleanly quantifiable. So let's quantify it. How many terrorist attacks has this stopped? I think the safe ballpark is exactly 0.

I also don't understand why more people don't seem to ask this question. Can governments do this is going to be an extremely difficult to answer question that few of us lack the expertise to even begin to delve into. Even for those of us with it, there are contradictory views. It seems much easier to answer _should_ governments do this. And if they're driving a meaningful deterioration of society, as I would call the stripping of basic rights of individual privacy, and have nothing of substance to show for it - then this is something for which there is no ambiguity whatsoever.

</comment><comment><USER61> > He said the officer then confiscated his phone and laptop, and told him the > items would be sent to a government lab which would try to crack his > passwords and search his files.

I'm breathlessly waiting for the "We will not go to Canada! Move the conferences out of Canada!" posts.

</comment><comment><USER62> Just enable guest mode. Pretty sure they're not employing top notch cyber investigators for security searches. They aren't smart enough to know the difference and it'll meet their "requirements". Fucking assholes

</comment><comment><USER63> Considering he is a lawyer and a politician and civil liberties activist, he knew CBPA's rights very well, and this is a public stunt to encourage the government to change the law.

A simple search about this nick wright, reveals that this is not his first encounter with the authority. He is definitely more active about civil liberties than the average person. He has been arrested during a G20 event, and his story then sounds a bit like this one.

So, we either have case of lightning striking the same person twice, or he likes to play games with the law.

<comment><USER64> > So, we either have case of lightning striking the same person twice, or he > likes to play games with the law.

Or he's being targeted now because of his past activism.

</comment></comment><comment><USER65> Something I wish iOS had is the dummy password to unlock the phone into a sandboxes type area without any of my personal data. "Yeah sure i'll unlock it, nope that's all I have on there"

<comment><USER66> I think this might backfire, though.

It's the same problem with Veracrypt/LUKS hidden volumes. If they know about the sandbox capability, they could easily say "okay, now unlock the real one" if they find nothing incriminating. What happens if you _did_ unlock the real volume/sandbox in the first place and have nothing incriminating on it?

Only remedy for this is having arbitrarily many sandboxes.

<comment><USER67> You could get away with it if you could download sandboxes from iCloud and be allowed to have multiple sandboxes.

</comment></comment></comment><comment><USER68> I'd love to have a second password that when I enter it automatically encrypts the phone and simultaneously loads a dummy user account.

This way I can give them my password, let them look around at some basic programs, benign emails, photos, etc. and then hand me back the phone.

Perhaps even a couple dummy passwors so I can keep a password like "1111" to generate a false positive if they try to brute force my phone.

I'm surprised this doesn't exist a jailbreak feature.

If it does, please let me know as I've looked.

<comment><USER69> The problem is if these features become common enough you will start getting asked about them. Even worse, if you aren't using them you may be asked to provide something that is impossible to provide.

<comment><USER68> So the answer I suppose is as stated. Cloud backups and when traveling, clearing our devices.

</comment></comment></comment><comment><USER70> I don't know the past of that lawyer, I don't know if that story is true or not, but it worries me even if I am 6000km away.

</comment><comment><USER71> On Linux, one could use dm-crypt in plain mode with keys on number of flash drives. Good thing about keys, they look like unformatted disks, so you can send flash drives via mail in advanced. Whenever you open a laptop like this without a key inserted, it look like it has no bootloader, no OS. There is no metadata, no nothing.

Get ready to have your devices seized though =).

</comment><comment><USER72> Is it legal to take steps to intentionally frustrate any future searches that may be done against the device by border agents, in cases where the is no other crime being covered up?

For example, having a trusted remote party encrypt your data, and that party will only decrypt it once you've cleared customs?

<comment><USER73> The problem here is that they confiscate regardless. Even when it's very clear they do not have the means to break the encryption at all. Any excuse, reasonable or not, will dissatisfy them and they'll confiscating either permanently or temporarily (both seem to have happened).

<comment><USER74> It seems to me that the best option is to keep sensitive data on encrypted removable storage devices while having light security on the internal storage of a laptop or phone.

Access could then be granted to the laptop/phone, but refused for the external storage device. You want to indefinitely detain my $20 SD card if I won't give you the password? That's not a sufficient threat to convince me.

<comment><USER75> They could also refuse entry or detain you if your not a citizen for obstruction of justice.

These laws that give border security unfettered search and seizure authority along with issuing punishment for non-compliance is the problem.

<comment><USER74> I agree, the laws are the problem. I can't do a whole lot to change the laws, and I am a citizen of the country I think is most likely to try something like that, so the technical solution is really all I have. So far, I have not had to employ it.

</comment></comment></comment></comment></comment><comment><USER76> While for a laptop one can use xen ( or grub, or similar ) to default boot into a pretty boring image of, let's say, windows 10, with some fake-but-good- looking documents, photos, etc, I wonder what are the possibilities on a smartphone? Would this be possible on an Android?

<comment><USER77> That really wont fool them though. EFF recommends against it too.

<comment><USER78> What exactly is wrong with this approach? It should get you through the border with no further suspicions, since I'm guessing they don't have the time to be checking for hidden partitions for every traveler they pull over.

<comment><USER28> 1) Because this can give officers probable cause to detain you. Just like if they find a hidden compartment in your luggage, even if there's no contraband in it, you'll be held many hours in a freezing cold room while they examine every detail of you and your property.

2) Because it could be a crime. Failure to disclose an encryption key if requested by UK Police and Customs authorities is a breach of The Terrorism Act, for which you can be arrested.

3) If they ask if you have hidden or encrypted data, and you lie about it, in the US you're now guilty of a federal crime -- even the hidden volume itself is empty or innocuous.

<comment><USER76> Yes, true.

But if you are at the border and give to the officers all what they want ( access to your laptop and phone ), why would they have further suspicions to interrogate and/or detain and deep search your devices, if you are really a clean person, dunno, white, 30-40 years, suit up, good clothing, no strange stuff in traveling history..etc.?

</comment></comment></comment></comment></comment><comment><USER79> I remember signing documents that said I (basically) would not allow anyone access to my work phone or laptop. This would put me in quite a pickle if work council wasn't immediately available I would think.

Glad I don't travel for work outside the US.

</comment><comment><USER80> Next project: figure out how to add a fake user to my MacBook and only have the real HD / user boot if a key combo is placed. Apple should add users and this as an option if they care about security, to iOS.

<comment><USER35> They should show just one account, but give it two passwords: a real one, and one that secretly takes you to a different account that's also customizable.

</comment></comment><comment><USER81> [https://borderprivacy.ca/](https://borderprivacy.ca/) Its a site trying to campaign about this issue.

</comment><comment><USER82> Even for Canada, standard disclaimers apply to any hardware taken by the government: Don't connect them to anything else, bleach them and burn them.

</comment><comment><USER83> I'm planning a trip overseas sometime in the future, and I'm sorely tempted to write up some malware that will activate if someone attempts to download my hard drive in the wrong way. I'll provide the password, along with a statement that I'm not authorizing a search of the drive, and if they want to break the law they are doing so at their own expense. Any lawyers know if I would still be liable for the outcome?

</comment><comment><USER84> I think the best solution to that is to have a "honeypot" account, at least on your laptop. Have a random account with some photos / random documents that you login to by username. Hide the main account's home folder and hope the authorities aren't savvy enough to look properly. They probably aren't.

Perhaps add something to its login files that'll automatically wipe the main account data.

</comment><comment><USER85> I think there could be a market for backup/wipe/restore services. Very feasible for phones leave minimally needed contact info during travel.

For laptops keep the is on device and user data on external pulled and put in checked luggage. Security's annoying but lazy.

Edit: removable storage on mobile could get popular as a privacy feature.

<comment><USER75> I imagine an service which makes an image of your system and launches it as a remote VM that you can access or store to an encrypted external disk.

If your encrypted disk gets through then you can restore your data or boot from it.

If not then you can remote into your machine in the cloud or download the image if you have access to a fast connection at your destination.

</comment></comment><comment><USER86> Get a Chromebook, factory reset before going through security, go through the security, then login. Same for the phone for android. Nowadays both Chromebook and Android recover almost all states back fairly quickly and smoothly that you can do this with minimal hassle.

i.e. There's no password to share if the devices are fresh.

</comment><comment><USER87> These cases keep on cropping up and you see people suggesting to do some sort of technical trick like taking the hard-disk out of the laptop and carrying a TailsOS live USB flash device for your computing. Other tricks might include mailing a USB flash disk to a hotel reception with the intent of picking it up when you arrive. These are all fraught with risk and you could appear extra suspicious by doing these. Another 'trick' I see people advocating for is trying to act like a so called 'normie' and having normal average joe files on your computer and maintaining an innocent-looking browsing history where you can be seen visiting cnn.com or even cbc.ca for your news and not some left- wing conspiracy websites. The only caveat with the 'normie' method is that you _will_ need to access your more controversial/sensitive files at some later stage, so this could mean logging into Dropbox and then downloading an encrypted Veracrypt container onto your machine and proceeding to work with those files in the privacy of your hotel/where-ever.

<comment><USER88> Well, I'm not sure if one wants to just call security approaches "tricks". A "trick" approach is often one that can be undone if your adversary knows about it (keeping your files hidden somewhere in your luggage would be a "trick"). A cohesive approach should be unbreachable if minimal conditions are met.

If you can assure a "trustworthy" base computing environment (one that isn't keylogged etc), then having your valuable files encrypted in a remote location should work (which is the idea of tailsOS boot + a remote drive). How determined the adversary would determine how hard they might fight again you getting such a trustworthy environment.

Just sayin'

<comment><USER78> The "tricked-out-bootloader" approach also seems to be brought up often: have your hard drive portioned into two sections (or even have two hard drives), then configure your bootloader to start up the non-encrypted, not suspicious partition unless you press a specific key combo at boot and enter your disk encryption password.

</comment></comment></comment><comment><USER89> Just set a duress password [https://github.com/rafket/pam_duress](https://github.com/rafket/pam_duress) [https://github.com/jcs/login_duress](https://github.com/jcs/login_duress)

<comment><USER90> Pretty sure this can count as lying to / misleading a boarder agent.

<comment><USER91> Is "now, listen, you knew what we meant" a valid response, though?

</comment></comment></comment><comment><USER92> Something similar happened to me. One of the most uncomfortable moments of my life.

</comment><comment><USER93> I guess America no longer has a monopoly on that unique brand of freedom.

</comment><comment><USER94> He did the right thing... Even if it was illegal.

</comment><comment><USER95> Since he's a lawyer, there is a 99% chance his password is 'password123', and that it is written on a legal pad in his laptop bag.

</comment><comment><USER96> New Zealand just got a lot closer...

</comment><comment><USER97> carry two phones, one used only when traveling across the border. Swap sim cards when needed.

</comment><comment><USER98> This is one problem asking for a sass solution. What services exist to help this situation?

<comment><USER75> if a solution were to be created, could the company be held liable for obstruction of justice via aiding and abetting?

I guess this could be taken care of with an extended terms of service which lay out how the product shouldn't be used to prevent search and seizure by government officials...

<comment><USER98> Not if it is marketed as an online desktop or backup.

</comment></comment></comment><comment><USER99> "During 38 per cent of those searches, officers uncovered evidence of a customs-related offence — which can include possessing prohibited material or undeclared goods, and money laundering, said the agency."

If this is true ... wow.

</comment><comment><USER100> Well, at least it's not just the US that abuses this.

</comment><comment><USER101> (2012)

<comment><USER102> > Posted: May 05, 2019 4:00 AM ET | Last Updated: 10 hours ago

<comment><USER101> weird. thanks for the correction, some phone glitch there</comment></comment></comment>


Wireframing tools for web design - <AUTHOR>

Hey everyone,
I am a junior designer at an established web software company. I am surprised to hear they use Excel for the majority of their wireframing during the design process. I am primarily an algorithm designer, but I am frequently involved in the layout and user experience process because I communicate the technical requirements to the design team and occasionally make my own designs.
Can anyone recommend a good alternative to Excel for wireframing? I am a programmer by nature, and can write javascript and html, but I want to be agile to anticipate the rapidly changing design process.
Thanks. <comment><USER2> I ditched all wireframing solutions. What I do is open an illustrator file, with multiple pages and scheme the whole project there. Then I save it to PDF and I don't have to work on other things since everyone can read the PDF file and edit it, ofc.

With Illustrator and some years working with it I achieved a nice level of detail in my wireframes, they look pretty much a real thing than just, wires everywhere. Most people and developers understand things when they see the UI very detailed with nice explanations.

</comment><comment><AUTHOR> Thanks everyone. This is a lot of good advice. After iterating through the design process with a few products, I think I fall on the mockup side in the mocking up vs. prototyping debate. Since I have a tool that works well and permits prototyping if needed, I think this may be best for me for the time being.

</comment><comment><USER3> Currently I use Omnigraffle to produce wireframes. I've also used InDesign in the past as well as Hotgloo, which is web-based and allows for collaboration, if that's something of value to you.

</comment><comment><USER4> I saw a similar discussion a while back here in HN: <https://news.ycombinator.com/item?id=5558802>

</comment><comment><USER5> Balsamique Mockups

<comment><USER6> +1 for Balsamiq.</comment></comment>


Graphics design question... - <AUTHOR>

So, I am a full time business student and I recently sought (and technically am still seeking) a part time job.  So I talk to some people and I say ideally I would like a web design position, part time for 10-15 hours per week(I have lots of experience, a decent web portfolio, and solid knowledge of html, css, php, mysql, and a few other tidbits of languages and know how to fit them together to develop things like a CMS and database based apps).  So, someone says yeah I know a guy that needs graphic designer, do you know photoshop.  I do webdesign, so I know my way around photoshop, and for that matter Flash, and Fireworks too.
So anyway, I talk to a possible employer and he asks for samples of my work.  He knows full well i originally asked about a web design position and it was upon a mutual friends introduction and recommendation that I am now talking to him about a graphic design position.  I could go on and on all day about how web designers and graphic designers are really two different entities (well often the same person) that are after two different things.  Web designers optimize images for size (small), type (we love jpegs), and 9 times out of 10 would much rather use css to say change a background color, never mind resolution limitations.  Conversely graphic designers (artists) want everything perfect, highest resolutions possible, have great depth of color, ect. (well maybe not that extreme, but you get my point)
So here's the question (well questions...), A)  What work or parts of my work should I include in my portfolio to submit (or should I just show the entire website?)? B) Should I be working on a few pieces that better show my graphic design talents and if so, any suggestions?
Thank you for your time. <comment><USER2> Graphic design (no "s") isn't knowing a specific set of tools or techniques, but is a profession that really deals with solving the problem of how you communicate an idea in any visual medium.

The way you describe your skill set you aren't a graphic designer; instead you're a web production person or a front end developer. A designer knows subjects like art history, color theory, typography, etc.

Yes you can teach yourself these things, but that isn't a part time gig. Production on the other hand can be a part time gig — but you have to really understand that's more craftsmanship (and maybe some decoration) rather than high level creativity.

If you're serious about being a creative professional you should give up business school and go for a BFA or an MFA at a design school. Or if you really like the programming side if thing you might want to go in that direction. And of course there are other paths like becoming an Information Architect. Although all of those paths require going to school or really being ready to invest the time to teach yourself.

By he way it's important to note that there is nothing wrong with being a web production person or a front end developer. In fact if you can do that well you won't find yourself lacking for work (and both creatives and hardcore programmers will appreciate you through and through).

<comment><AUTHOR> Thanks for the feedback.</comment></comment>


Show HN: Tap water you can trust - <AUTHOR> https://findtap.com/ <comment><USER2> > Tap Refill Stations are bringing refilling to the 21st century by connecting > water to a digital display and the Internet.

This whole thing is satire, right?

<comment><USER3> I'm not sure about the concept either, but that's more than a little reductive. They're selling water refilling stations.

<comment><USER4> But they are also promoting getting rid of the existing water fountains, which typically are already using water that has been cleaned and filtered by their local system. If they succeed, you have to use their service instead of just leaning over and drinking. As adults, many of us do have water bottles, but very few children that I know do - they just drink from the fountains. Making it harder for kids to drink, while inflicting ads on adults who just want some water doesn't sound like a great business model to me.

</comment></comment></comment><comment><USER5> Juicero for water ?</comment>


"Singles and Doubles, Not BlockBusters" -- Memo to Disney Executives - <AUTHOR> http://www.lettersofnote.com/2011/11/some-thoughts-on-our-business.html

<comment><USER2> I am amused how well Jeffrey Katzenberg describes the way that Pixar rose to pre-eminence over Disney in the 90s - "Getting Writers Who Can Tell the Stories", "Kids Movies Aren't Just for Kids", "only the product matters".</comment>


Ask HN: What valuable insight did you arrive at in 2017? - <AUTHOR> <comment><USER2> Any plan that starts with "let's summon a demon" is probably a bad idea.

On a more serious note... from a startup perspective, if you have a prospect that you're working with, and they ask for changes in your product as a condition to moving forward, get something from them in return before spending a lot of time on said changes (unless they were truly in the "we would have done that anyway" category). Either ask them to pay for the changes (even if it's a nominal fee) or sign a non-binding letter of intent to purchase your product, etc. If nothing else, this helps avoid the situation where you waste a lot of time making changes to suit a particular prospect, and then wind up with no deal to show for it.

Plus, if you're in a situation where you're trying to raise money, having a paying customer or at least the LOI, can be useful to help show investors that you are "for real".

Even better, depending on how nominal you make the "nominal fee" the money could actually be useful.

If, OTOH, the prospect isn't onboard with doing something like this, it's a sign they might not be serious and you might want to reconsider the whole thing.

And finally... most Internet arguments are a complete waste of time and there's no real reason to not simply walk away. If you're arguing, say, politics or something, and it's obvious that the discussion really isn't benefiting anybody, feel free to just quit replying. Don't worry about getting "the last word" or any of that shit. Just quit. If it helps, ask yourself "is this conversation helping me make any money?" If the answer is no, then walk away. Or whatever conditions work for you.

</comment><comment><USER3> The apocalypse has arrived. We're living in it now.

</comment><comment><USER4> pay less attention, do your own thing, have fun.. oh and never never ever argue the immovable object vs the unstoppable force, accept the yin and yang

</comment><comment><USER5> Never underestimate the power of FOMO.

</comment><comment><USER6> Execution is everything.

</comment><comment><USER7> c#</comment>


Ask News.YC: What sort of things do you do when you're so bummed you can't be productive? - <AUTHOR>

What's your guilty pleasure? <comment><AUTHOR> I try to minimize the rebound time. One thing that helps me with that is to reread Paul's essays. (Is it bad to admit that? It must look like kissing up. Whatever, I don't care.) They're short enough that I can sit down with one and tell myself "Okay, when you're done, get back to what you need to do." I feel sort of.. revitalized afterwards.

</comment><comment><USER2> Head down to the Ferry Building; that's where the summer sun shines in SF. Indulge in a glass of red wine and watch people.

</comment><comment><USER3> Change of context: book, film, game, chat... Preferably something that keep the brain ticking over, but allows the 'work' parts to take a rest. Oh, and virtually any kind of exercise.

</comment><comment><USER4> [http://thingsilearned.wordpress.com/2007/07/18/unconventiona...](http://thingsilearned.wordpress.com/2007/07/18/unconventional- motivation-techniques/)

</comment><comment><USER5> Read News.YC

</comment><comment><USER6> Star Fox 64. (Do a barrel roll!)

</comment><comment><USER7> Start talking to my co-founder and start getting new ideas (away from the computer)

</comment><comment><USER8> Taking a quick nap, shower, or exercising helps me rejuvenate.

</comment><comment><USER9> Go running.</comment>


PhoneFactor acquired by Microsoft - <AUTHOR> https://www.phonefactor.com/news/microsoft-acquires-phonefactor

<comment><AUTHOR> We'll be part of the Server and Tools Division, which includes things like Azure.

Consider me your inside contact. (though I can't go making any promises yet :-)</comment>


Ask HN: Please review my site favilous.com - <AUTHOR>

Hi,
We recently posted our new site on HN - http://news.ycombinator.com/item?id=1060022 - and got some fantastic feedback. We have acted on this and so have improved the site. We would love to hear what you think and where we can improve it further.
thanks <comment><USER2> First impression. Note that the tour is a slideshow, not a video. I sat there for 2 minutes wondering why your video was broken.

Second impression. It was a pain to get rid of "my links", which are not my links at all, but links you want me to have.

Third impression. The "Create new categories" button is very confusing. It acts like a drop-down menu even though it's really a button. I thought I had to try to maneuver my mouse to the legend and click there.

Fourth impression. If things I favorite are added to Favilous Buzz, and _then_ I can make them private, then how is it really private? I should have a way to add links as private from the "My Sites" page that are never displayed anywhere.

Fifth impression. I will not use any bookmark service full-time that doesn't have an export option. I am not going to put myself in a position of having to manually copy all my bookmarks into a new system when I decide to change.

<comment><AUTHOR> Thanks Daniel,

We have dealt with the 2nd and 4th issue - that should now be fine. The 5th we are looking into as you are quite correct; we just wanted it to get some people to review it even though we did not have 100% of the functions in yet.

With regard to the first point we will add some wording in to make this clearer and with regard to the third point we are trying to explain to our audience (a largely non-technical base we imagine) what all the buttons do.

Overall did you like the site? Any major features that you would like to see added? Thanks for your feedback - we have taken it all onboard.

</comment></comment><comment><USER3> Good job guys. I really like the style of the site and I definitely think there is a Market for a site like this. I would like to something for my media but otherwise good job

</comment><comment><USER4> The first thing I noticed is that the site is painfully slow on my computer (in both Chrome and Firefox). I think the changing image is hogging CPU.

</comment><comment><USER5> Clickable: <http://favilous.com/></comment>


Chrome Feature Request: Include commonly used JS libraries directly in browser - <AUTHOR> http://code.google.com/p/chromium/issues/detail?id=43371

<comment><USER2> Wonderful. And then when a tweak is needed to said libraries, you have to upgrade the browser to correctly render the web page?

Let's not.

<comment><USER3> Chrome already does transparent updates to the browser, it's doubtful you would even notice that.

But they are talking about a very limited application, only replacing the libraries where they know the exact version ahead of time (only the one's on Google's CDN). I would assume if the browser doesn't recognize a library, it just falls back to downloading it from the website.

</comment></comment><comment><USER4> The first time the page is hit, the browser should keep it cached for a year.

How much time will avoiding that first hit actually save?

Keeping a file compiled could be more generic too: just check which URLs get hit a lot, and keep those pre-compiled as a separate feature.</comment>


China Is Testing Roads Paved with Solar Panels - <AUTHOR> https://www.nytimes.com/2018/06/11/business/energy-environment/china-solar-roads-renewables.html <comment><USER2> It's just VC fishing. Can't wait to see square meters of solar road surface from the failed project being sold on Ebay!:)

For those interested, Dave jones at eevblog.com has grokked some numbers on why this is not and will never be economically sustainable. [https://hooktube.com/watch?v=HOZBrHqTJk4](https://hooktube.com/watch?v=HOZBrHqTJk4)

</comment><comment><USER3> Why pave the road with solar panels. I like the idea of covered roads. Put a solar panel roof over a road and it will last a LOT longer. Especially in bad weather areas. But it still makes too much sense to put the panels somewhere else. Easier to maintain and way cheaper to install.

</comment><comment><USER4> It has already been tested in France. The state subsidized the construction of a 1km road for 5 million euros. Given the constraints of a road, I wonder how anybody can argue this is a good idea. (source : [https://www.theguardian.com/environment/2016/dec/22/solar- pa...](https://www.theguardian.com/environment/2016/dec/22/solar-panel-road- tourouvre-au-perche-normandy))

</comment><comment><USER5> Wasn't there an indiegogo called Solar Roadways exactly for these types of roads? Didn't they fail after a couple of weeks of traffic?

<comment><USER6> IIRC, they were never deployed to roads. Instead, they were deployed in a pedestrian zone (30 panels or so). It didn't go well, issues included loose panels, failing panels, and a fire in the electronics cabinet.

</comment></comment><comment><USER7> Why roads? Panels are more efficient at an angle. Also what on earth would you have to make them out to sustain the wear and tear of car tires. Just imagine a small rock stuck in a tire's tread... It also has to remain clear to have any chance of remaining some what efficient.

</comment><comment><USER8> This is such a insane idea. I have never understood why so many people are so obsessed with it.

There is mostly enough land including around places that are roads.

Sure you could probably exceptions where it fits perfectly but this will never be the solution to any of our real problems.

Look at what china is doing with nuclear. That's easily a real solution that solve the carbon problem. France did it in 1970 but somehow in 2018 liberals still seem to search for a miracle solution.

</comment><comment> Black-Plaid you have to be kidding me...</comment>


Ask HN: Web applications or software that lets you remotely administer SQL data? - <AUTHOR> I have a spring boot service that uses some tables with business data that might change every month or so.
At the moment we are doing this change using scripts that remotely update this data from csv files etc.
The data itself, is mostly for the UI. Dropdown options, currency values and meta data.
Back in the day there was things like PhpMyAdmin etc. however those are for DBAs, not general users who have SQL experience.
The long term plan is for an operations team to administer this data.
We are planning to just hack together an admin page for management of this data.
However I was wondering if there are any tools or software that could host this admin page for us?
I am aware its risky to allow users access to the database directly.
However I was hoping to be able to restrict it to certain tables.
Any suggestions welcomed! <comment><USER2> You can use Excel with data connections to do that if you have limited number of people who are going to access it and update data.</comment>


Andreessen Horowitz Raises Another $200 Million To Invest In Huge Startups - <AUTHOR> http://www.businessinsider.com/andreessen-horowitz-new-fund-2011-4

<comment><AUTHOR> More Coverage on Reuters: [http://www.reuters.com/article/2011/04/06/andreessenhorowitz...](http://www.reuters.com/article/2011/04/06/andreessenhorowitz- idUSN0623979320110406)</comment>


Google Social Network Likely To Be A Disaster - <AUTHOR> http://chimprawk.blogspot.com/2008/04/social-networks-cant-be-bootstrapped.html

<comment><USER2> Everything is in the eye of the beholder. I, for one, love to see what my friends are sharing in Google Reader, and vice-versa.</comment>


Danny Sullivan: How Link Spammers Killed My Wife's Web Site - <AUTHOR> http://daggle.com/link-spammers-killed-wifes-web-site-1446#

<comment><USER2> Sorry to be blunt, but stop bitching and fix the problems. I don't think this type of give-up attitude goes over well on HN.

<comment><USER3> What's even worse is I've used Drupal just enough to know that stopping link spamming is as simple as installing the right plugin. I haven't done it in years, but I'd bet it's even better now since there's almost certainly an Akismet plugin.

*Edit: just typed "drupal ak" in Google which auto-completed and took me to just such a plugin. I'm sorry, but if you can't figure that out, you have no business on the web.

<comment><USER4> In fact, Drupal founder Dries Buytaert has a side-project called Mollom for eliminating comment spam. And of course it integrates very nicely with Drupal.

Sounds to me like whoever they hired to do the site didn't have much of a clue.

<comment><USER5> They quite clearly said they couldn't be bothered to spend money on it as it wasn't earning anything.

 _She could, if she wants, get this latest huge barrage of spam cleared out on Boudica and improve spam filters going forward, if she choses. She's currently debating this. It just may be, as I explained above, that this was the thing that tips her toward closing the site, something she was already considering because of low usage._

In a way it's probably not a bad thing if low traffic me-too style sites are discouraged a little - if there's something worth keeping then for the cost of a meal for two you can hire someone to install a captcha (or whatever) and strip out the spam. If the content isn't worth that then, does the web need it.

The story sounds more like the tale of someone who didn't have time or resources to do anything with there not-especially-unique website and then got annoyed because it attracted more bad attention than good.

The link-spam is an excuse, IMO, to close the site and not lose face. Sure it's annoying, sure it shouldn't happen (like people putting flyers on your windscreen), but don't lose sleep over it.

<comment><USER4> I just wanted to note that Mollom is free for small sites and takes no more than ten minutes to install (maybe two minutes if you know what you're doing) so yeah, I agree, it's more of an excuse for closing a small site.

</comment></comment></comment></comment></comment><comment><USER6> I see his gripe with it. There's nothing more irritating then seeing a whole bunch of spam comments on one of your sites. The worst is the compliment spam that is so hard to filter.

But what it's taught me is to be a better developer, and to learn new anti spam techniques. I feel bad because the site probably meant a lot to her. He should have helped her out more.

<comment><USER7> > He should have helped her out more.

I fully agree with that. I would do that for strangers, not doing it for your wife seems rather rude. It would take less time to put a 90% solution in place than it would take to write that blog post.

</comment></comment><comment><USER8> Who defines good content?

Obviously blatant link stuffing on non-related topics is spam.

Obviously on-topic paragraphs of text on-topic without links is not spam.

What about on-topic posts with a link back to my affiliate sales on on-topic products?

What about on-topic posts with 5 links back to my affiliate sales page? (check out my favorite 5 workout videos on a post about womens health).

How substantial does the content need to be? "I really enjoyed this post, and I think that you are right on about XYZ. I read this book <amazon affiliate url>".

Basically, the problem with web spam is that the obvious stuff slaps you in your face as obvious. The gray area is really wide in some cases.

Also, the whole post was predicated on the fact that people have an obligation to provide you value when you put up a web form. That seems pretty presumptuous. I decided to send an HTTP POST with my content. You decided to post it up to the world.

<comment><USER9> That's a good point, but the vast majority of spam on my sites are clearly junk. If there were some easy way to stop all the obvious spam but left all the grey-area stuff, I would be overjoyed.

How about this: any comment posted by an automated process and not a human is spam?

<comment><USER5> If it's a human cut-and-pasting? Or someone employed to workaround strong captchas? Spam for sure.

<comment><USER9> Sure, and that's a growing problem. But 500 identical or nearly identical ads for fake viagara? I'd bet good money there's nobody pasting that into boxes over and over again.

</comment></comment></comment></comment><comment><USER9> I just wish the spam bots were smart enough to identify sites that add nofollow to links. If that worked, it would be such an easy fix.

<comment><USER10> That would be true, except (in theory) the purpose of spamming isn't to put links out on websites, its to put links out on at least tangentially related sites, so that you can game the search algorithms better.

That means it doesn't matter if its no follow or not, you're still getting benefit. You may not be getting a direct benefit to your own site, but at the least you're hurting a "competitor".

<comment><USER9> I don't quite follow -- I thought a nofollow link doesn't enter into the search algorithm at all?

<comment><USER11> It doesn't (on search engines that "matter"), but if I sell say titanium hammers, there's still value to me putting link spam to my site on a construction blog.

</comment></comment></comment></comment><comment><USER12> Well, there are thousands of people out there whose sites aren't being killed by link spammers, so I think he should scratch his head and look home.

</comment><comment><USER13> "If Boudica had been more successful, doing the work would make sense. But it has remained small, and the link spam attack will probably tip her over to a decision she's already been debating, of whether it makes sense to continue working at it."

In other words, link spammers didn't kill the site. They just pushed a decision she was already contemplating.</comment>


AppFog lands $8M for PHP PaaS - <AUTHOR> http://gigaom.com/cloud/appfog-lands-8m-for-php-paas/ <comment><USER2> Let me be cynical for a moment: name change means a search for the company name won't bring up quite as many results covering their security failures earlier this year.

<comment><USER3> If you read the article, they are planning to support Rails, Node.js, Python, etc. soon, so the name change reflects their goal to make it into something bigger. Also, I checked out the domain appfog.com and there is a huge PHP Fog button right there as one of their products, so it doesn't appear to be an attempt to cover anything up.

</comment></comment><comment><USER3> Great to see more Portland startups getting funding. I've been experimenting with their platform the past week or so. Title should mention it was formerly PHPFog.

<comment><USER4> We tried PHPFog, but ended up with pagodabox. If you are checking out cloud php platforms, give pagodabox a shot.

The ease of deployment and scaling on the fly is crazy simple, I could teach a 6 year old to scale our site up or down to meet demand.

<comment><USER3> Hadn't heard of pagodabox. I like the site design and the ability to easily deploy from an existing GitHub repository is nice. I requested an invite. Any idea who the developers are? Can't seem to find much info about them.

</comment></comment></comment><comment><USER5> Interesting that they are aiming a lot wider than PHP now, which is probably required to open up a market big enough to get that level of funding. Their PHP stuff is a big opportunity but I think it will be a lot harder to crack something like the ruby market with heroku.

</comment><comment><USER6> I tried to work with PHPFog. Didn't come out as expected. I had trouble with their git workflow; you can't pull stuff from their servers. Interesting huh?

In any case the support was pretty good.

<comment><USER7> Push-only makes sense, git hosting as a service is a different business.

</comment></comment><comment><USER8> if AppFog plans to support Ruby and Python as well - its probably the road to nowhere .. , as there are plenty of competitors there,

they should rather focus on PHP clouds

<comment><USER9> A lot of the backend infrastructure can likely be reused, and by using javafog.com, rubyfog.com and so on, they can keep each brand/site independent without confusing end-users.</comment></comment>


Mechanical Keyboards - <AUTHOR> https://mattgemmell.com/mechanical-keyboards/ <comment><USER2> My big f off keyboard is also my favorite gadget.

Sincerely, A writer that likes MX browns slightly more than MX blues but has both.</comment>


British Airways Digital Billboards Know When A Plane Is Flying Overhead - <AUTHOR> http://www.fastcompany.com/3022142/fast-feed/british-airways-digital-billboards-know-when-a-plane-is-flying-overhead?utm_source <comment><USER2> "We hope it will create a real 'wow' and people will be reminded how amazing flying is and how accessible the world can be."

This reminds me of the Louis C.K. bit about how amazing flying is & how "everything is amazing & nobody is happy."[1]

[1][https://www.youtube.com/watch?v=mfmmNif5WCw](https://www.youtube.com/watch?v=mfmmNif5WCw)

<comment><USER3> flying has made no progress since the 60's. planes still crawl along and it takes me 6 hours to get to the East Coast. I'll be wow'd when they make some progress beyond allowing me to listen to my music during take off.

<comment><USER4> We have different outlooks on life. I'm thankful and amazed that I have hot water right in my home, grocery stores filled with selection, heaters to keep me warm. We are so lucky to have such things and it's amazing what it took to get us where we are now. Try to build a screw, a single screw that holds one of these planes together.

<comment> grey-area _try to build a screw, a single screw_

That's pretty easy if you have a tap and die set, it doesn't require advanced machine tools.

I agree fantastic progress has been made due to our cooperative societies and the division of labour though, even just in the last few decades, the advances are astounding. The Internet alone is an advance at the level of Gutenberg.

<comment><USER5> And a mine, and a smelter... If you had to start from scratch, could you even make a nail? I couldn't.

</comment></comment></comment></comment></comment><comment><USER6> Our company (based in LA) has party today at Vegas. A friend of mine decided to take the plane from LA -> Vegas, I took the bus, other people drove their cars.... And somehow I got 30-60 minutes earlier than him, if not more. Granted, due to the rain it was much harder for the planes to take off, but adding checkin time, checkout, taxi to the hotel, etc...

On top of that we had nice 30 minute break with the bus, at not so bad place (In-N-Out). And plenty of room to play monopoly on the iPad, read books, drink wine, stroll around, etc.

<comment><USER7> I have found that the plane time travel door-to-door is almost slower than land base transport, especially train. If I travel from Cologne to Paris, car about 6.5 hrs, train is 3.5 hrs, plane is about 4.5 hrs.

<comment><USER8> This definitely depends a lot on the airport and distance you are traveling. San Francisco to New York, Los Angeles to Chicago... America is too big for land to be faster. Stuff is a closer in Western Europe.

<comment><USER7> You are right. The example I gave is probably a bit skewed to faster travel times. If I had chosen say Barcelona to Moscow, times would have been a lot different. The other difference is that the trains in western Europe are much faster than their US counterparts as well.

</comment></comment></comment></comment><comment><USER9> Clever use of ADS-B signals, which most large commercial aircraft ( and nearly all British Airways a/c ) now implement. I think the only exceptions in their fleet are four previous-gen 737s that are near to phase-out.

Accuracy of the co-ordinates broadcast on ADS-B is dependent upon a/c equipment but for BAW should be around 5 metres.

So receive signals, screen for BAW.* call sign, cross-reference online for route. I wonder if they include affiliates such as CityFlyer, which fly in BA livery? Their callsigns are CFE.*.

<comment><USER10> I was going to say, it would make more sense if they got the data digitally by knowing pre-registered flight plans and plotting that in 3D. Alternatively, they could point a camera at the sky and look for "plane-like" objects. Either would be cheaper than ADS-B hardware. Then I learned you could actually scan radio signals with software... [http://www.rtl-sdr.com/about-rtl- sdr/](http://www.rtl-sdr.com/about-rtl-sdr/) Mind blown. :)

</comment></comment><comment><USER11> In reality, I suspect very few people actually notice what is going on in the ad. Ironically, they /will/ get a lot of 'wow' but mostly from the virality of the video and maybe award submissions. Which means they need not have produced the actual signage but just the video and probably would have achieved the same result. But that would have been too easy to earn them any publicity. How meta.

</comment><comment><USER12> Hmmm. Isn't this just parallax?</comment>


Could Self-Driving Cars Spell the End of Ownership? - <AUTHOR> http://www.wsj.com/articles/could-self-driving-cars-spell-the-end-of-ownership-1448986572 <comment><AUTHOR> "The absurdity of our century-old, ad hoc approach to mobility is captured in one statistic: The utilization rate of automobiles in the U.S. is about 5%. "

Except it's not all about mobility. People like cars for all sorts of reasons and mobility is only one reason. [1] Just like watching a football game doesn't serve much social purpose other than entertainment (and socialization...and that's ok) owning a car is a valid way for some people and infact many people to gain enjoyment. Those that don't want to own don't have to own but please don't assume that just because you might enjoy sharing a car or a ride that everybody should desire and do the same thing.

And for anyone that says "yeah but there is an environmental impact to having cars" there is an environmental and healthcare impact to hosting a sporting event or a rock concert or even kids playing soccer or football (healthcare, injuries, car pooling kids) and so on.

[1] If it were only about getting from point a to b they wouldn't care about the color, the features or the brand.</comment>


Apple Reports Second Quarter Results - <AUTHOR> https://www.apple.com/newsroom/2020/04/apple-reports-second-quarter-results/ <comment><USER2> When people ask why the stock market isn't in the dumps when it feels like the whole economy is stopped, this is why. Small business isn't on the S&P, and out of the businesses in it, a large percentage of the market value is concentrated on the tech giants who aren't getting nearly as affected by the current crisis as everyone else. If they don't actually benefit from it. Still super impressive results.

<comment><USER3> Apple is doing... OK. They are still down 13% from their highs.

Boeing is trashed and announced layoffs.

GM is as well and are suspending their dividend, Ford isn't exactly happy either, and plenty of other S&P giants.

Disney has taken a huge hit due to sports/ ESPN revenue, theme parks, and cruise lines.

Small businesses aren't on the S&P 500, but unemployed people and small businesses all buy from companies in the S&P 500.

Apple also happens to have a massive cash pillow to soften their fall. Nobody else has reserves like Apple and a lot of companies have substantial debt.

The stock market hasn't quite priced in damage yet.

<comment><USER4> > The stock market hasn't quite priced in damage yet.

Quite the claim. Anyone with confidence in this theory should take a short position now and pick up their million bucks after the market "prices in the damage."

<comment><USER5> That's assuming you can time it right. I've been holding puts for ~2 months, and I went from very right to very wrong very quickly. I also fully anticipate to be very right again as soon as the fed stops pumping trillions of dollars into companies that were ill prepared for risk.

<comment><USER6> > I also fully anticipate to be very right again as soon as the fed stops > pumping trillions of dollars into companies that were ill prepared for risk.

Be careful...

<comment><USER5> I was mostly being sarcastic, but I think it's relevant to direct you to this article (found in top 50 on HN). [https://thesoundingline.com/fed-slows-qe- unlimited-to-just-8...](https://thesoundingline.com/fed-slows-qe-unlimited-to- just-83-billion-a-week/).

I'm hesitant to say that they're going to stop buying, but there is at least evidence of slowing.

<comment><USER6> I just said be careful, they can pump and release at will. You can't predict when they will do it, it's better to wait for them to announce it and THEN take action.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Surprised why so many people are surprised. Digital services and platforms are booming in this current climate. We have no choice but to be consuming content.

App downloads (30% thank you very much), Apple TV+ ($10 a month thank you very much), Apple Music...the list goes on. That list, apart from TV+ specials, is just revenue on the backs of other work. Others taking advantage of lockdown to product more content. Which makes these companies more and more without lifting a finger. And the Apple TV specials are short change. Just drive growth.

Microsoft, Amazon, Netflix, remote tools like Mural and Zoom, all these digital platforms offering consumer and business services are king right now. Ad supported services are booming, the Facebooks, Googles, because we're consuming more ads.

It's the cash cow of the 2010s and 2020s. Corona is only accelerating that.

<comment><USER8> But ads are supposed to be paid back by customers buying real stuff. And if they won't buy real stuff because of crisis, it just means that ads budgets will be cut soon.

<comment><USER9> I wonder what fraction of consumption people who've been lost their income during the crisis is. If 20% of the workforce is laid off, does that mean consumption will go down 20%? Is the salary/spending power of the group who were laid off representative of the entire workforce? Or does it skew in a particular direction.

I ask because one explanation of the disconnect is that consumer spending in general hasn't actually dropped that much, it's just moved away from in-person small businesses.

<comment><USER10> I know it's anecdotal but April was our lowest spending month for 20 years, despite having plenty of cash on hand.

You can't spend much when most shops are closed and visiting the ones that are open comes with quite a risk.

</comment></comment></comment></comment><comment><USER11> Hold onto your hats though when companies release results next quarter (in early July).

Consumer spending is way down across the board (everything from appliances to travel). Early indications are the stimulus checks are being saved or used to pay off existing debt - not consuming/purchasing.

The ripple effect of this sudden drop will likely be unprecedented.

<comment><USER12> That's because it's not a stimulus cheque. It's an insurance payment. You can't stimulate the economy while you're (for good reasons) shutting it down. I don't know how it is in the US but here in France I can't even go buy an appliance, or to the restaurant, or even get a fucking haircut.

<comment><USER13> Basically the same here with variations across different State and local jurisdictions.

</comment></comment></comment><comment><USER14> Bear in mind that the quarter is before the lockdown.

>>> Apple today announced financial results for its fiscal 2020 second quarter ended March 28, 2020.

<comment><USER15> China is one of Apple's largest markets, though, and they were dealing with Coronavirus for the entire quarter.

<comment><USER16> Wuhan was basically shut down for the whole quarter, but the rest of China was impacted for only a few weeks though.

The shutdown started on Jan. 23 and things were already reopening by mid- February, and mostly back to normal in March.

[https://www.theverge.com/2020/2/13/21136648/apple-beijing- st...](https://www.theverge.com/2020/2/13/21136648/apple-beijing-stores- reopen-february-14th-limited-hours-coronavirus)

[https://www.theverge.com/2020/3/13/21177964/apple-stores- chi...](https://www.theverge.com/2020/3/13/21177964/apple-stores-china- reopened-coronavirus-covid-19)

<comment><USER15> Easing lockdowns != resumption of normal economic activity.

</comment></comment></comment></comment><comment><USER17> The top-line rose by 1%. International sales accounted for 62% of the quarter's revenue. Key highlights in four charts: [https://news.alphastreet.com/apple-q2-2020-earnings-aapl- sto...](https://news.alphastreet.com/apple-q2-2020-earnings-aapl-stock-charts- highlights/)

<comment><USER18> > The top-line rose by 1%

0.5%, with services (+17%) and wearables/home/accessories (+23%) offsetting the decline in iphones/ipads/macs.

</comment></comment><comment><USER19> does anyone have a good definition of services without bundling in fees paid by google etc to be default search engine. one thing to note though, is services is an excellent business $13bn qtr revenue, $4bn short of FB quarterly revenue.

</comment><comment><USER20> I wonder what amazon's report is going to look like. Only half an hour until they release

<comment><USER21> They already did, lower earning but higher revenue. Also, AWS topped $10B/qtr for the first time. [https://s2.q4cdn.com/299287126/files/doc_financials/2020/Q1/...](https://s2.q4cdn.com/299287126/files/doc_financials/2020/Q1/Amazon-Q1-2020-Earnings- Release.pdf)

</comment></comment><comment><USER22> Apple's second-quarter revenue was $58 billion, down 5% from a year earlier; net profit was $11.6 billion</comment>