Meet Jack. Or, What The Government Could Do With All That Location Data - <AUTHOR> https://www.aclu.org/meet-jack-or-what-government-could-do-all-location-data <comment><USER2> It's easy to imagine the kind of data government has, imagine its ability to process that data, and easy to interpret that they will do it. But it's also important to recognize that this is conjecture.

From my experience in government: they _nailed_ the user experience (check out [http://dsbs.sba.gov](http://dsbs.sba.gov) for some awesome gov UI), but really overestimated government's capacity to build intelligent technology like this.

I know this will make me unpopular amongst this crowd, but The truth is, I'm far more afraid of data like this getting into the wrong hands because it's being stored improperly or insecurely, than I am of government being malicious with it. Heck, I'm more afraid of my insurance adjuster than I am a malicious cop.

<comment><USER3> Part of the issue with government is that you ultimately have much less recourse against the government than against anyone else. This exacerbates the potential damage the government could do with any given technology.

<comment><USER4> I think I'd be happier with the technology if the first deployment was used specifically to track police officers in an effort to weed out corrupt police. Let the program run for say 10 years, enough time to make police aware of how this sort of data can be _misused_ by making them the victims first. As a bonus, weeding out corrupt cops will make the system safer (but not safe) for ordinary citizens.

Still, it's completely crazy. These types of system are a direct threat to democracy and need to be shut down. In fact it's worse than that. At some point a telecom is going to realize that they could make a tidy profit by selling location traffic data to third parties, and that sort of thing needs to be prevented in law.

<comment><USER5> >At some point a telecom is going to realize that they could make a tidy profit by selling location traffic data to third parties, and that sort of thing needs to be prevented in law.

The year 1990 called and wants it's comment back!

<comment><USER4> You're saying that telecoms are already selling the data? Or that there are already laws preventing the sale of such data?

<comment><USER6> They sell it. See eg Vodafone and tomtom for a publicized example.

</comment></comment></comment></comment></comment></comment><comment><USER7> This article attempts to show what a local government could do, but does anyone have access to the sort of location dataset that could give one an intuition about how likely it would be that individuals would be singled out using the data shown?

The article uses maps of Peoria, IL, so let's assume we're dealing with Peoria. There appear to be roughly 115K people between 18-64 in its metro area ([http://www.wolframalpha.com/input/?i=population+of+peoria+il...](http://www.wolframalpha.com/input/?i=population+of+peoria+il+metro+area+demographics)), and 11 traffic cops. ([http://www.peoriagov.org/peoria-police- department/police-div...](http://www.peoriagov.org/peoria-police- department/police-divisions-units/))

These cops appear to arrest 23 people per month for driving under the influence, and hand out about 1750 other traffic citations (not linking directly to the PDF to save their server but you can find it under crime stats).

The article implies that there would be more traffic stops due to increased DUI suspicion, and it certainly seems that it could happen, but given these population, police, and police activity numbers, and given that the article itself gives a false-positive example, how likely would that be? Is it reasonable to think that these cops currently have a lighter load and have time to be dispatched to investigate a potential DUI?

I am not suggesting that it is of no concern for the government to have unfettered access to data, and I can imagine a vast number of possible scenarios in which the data could be misused, but possibly we can better quantify that concern.

<comment><USER8> You're assuming that individuals would have to be singled out for analysis in the first place. They wouldn't. With enough computing power, it'd be trivial to run this sort of analysis in near real-time for everyone. A few years down the line, this is even less of a concern: increased power, improved analysis tools, and greater efficiencies will all come together to empower just such a system at costs manageable by many local governments (particularly if they start working together to manage costs).

This means you've got a practical means of confidently predicting potential crime. Even better, the same mechanisms that help you predict potential criminal acts also help you close active cases more efficiently. That inevitably results in significant boosts to police productivity.

So armed, you now get to deploy your existing resources more effectively. Instead of parking a patrol car at a "pretty good spot" to nail violators for a few hours, you'll reposition yourself continuously to the location offering the greatest probability of an arrest/citation at that specific moment in time. Instead of passively waiting for violators to happen across your location, you're actively positioning yourself to nail them directly. The specific individual doesn't matter.

But you won't be dispatching patrollers in the current manner. Since you'll also be tracking your own patrol cars, you can correlate the two and dispatch each car to the highest probability incident nearest to them where they're likely to catch a potential perpetrator. By having everyone under effective surveillance, for every minute of every day, each of your resources will always be deployed in the most efficient manner possible.

Where it really gets wild is when you start to consider traffic enforcement automation along with the push for local government drone coverage. Along with the existing red light and speed cameras, you'll have mobile platforms capable of filling in for any holes in your patrol car coverage while also benefitting from the same efficiency gains described earlier. And they'll be gathering additional data (movements, facial recognition, automatic number plate recognition, etc.) to send back to base while they're doing it.

It won't be like The Machine from Person of Interest, but all things considered, it'll be closer to it than anything else to date.

<comment><USER9> Well hopefully the google car comes available. No DUI anymore because you're not driving the car.

If it's all automated there are no traffic violations anymore. So the system won't be used for this.

I'm all for safe traffic!

Things liken an Arabic Revolution are not possible anymore.

</comment></comment></comment><comment><USER10> Meet Jack. Or what the government could do with all these planes

>Article showing how half of San Francisco gets bombed

This argument can only hold on water by having a complete lack of faith in the rule of law.

The biggest issue I have with this is that this describes a massive , coordinated system to use all this location data in ways that are way outside the legal framework in place by the initial court order from the FISA court.

Stuff that has come out of these leaks have ranged from banal (oh, we listen to the German Chancelor's cell phone? What else is new) to absolutely damning (forcing companies to hand over SSL keys). But even in the most damning cases, all of these happened within the legal frameworks given to them (such as the National Security Letters) and maybe some overzealous law enforcement agents. The illegal incidents can be explained more by incidents outside of how things are "supposed" to work (LOVEINT is probably not sanctioned by the NSA), and a lack of strong implementation of the framework given by the courts.

The narrative has always seemed to be "check out how the NSA is going crazy over here!". But the reality is "check out how all these politicians are voting in these new laws allowing this to take place!"

From the leaks you can even see how the courts are constantly reeling things in, the system is actually working. We hear about old NSA programs that got shut down because of the FISA court's rulings. This is how rule of law works! We vote laws, and people follow them.

To actually come to this, given all we've seen from how courts rule on this issue in general, and the FISA court's rulings, this sort of data sharing would absolutely definitely not be allowed to exist. No judge would agree to this being allowed to be set in place, as it so obviously goes against 4th ammendement _in such a program 's intent_.

Just because the data is at the NSA doesn't mean they can use it however they want, just like how Google would run into some problems if it tried to sell the contents of your e-mails to somebody.

This anger at the NSA should also be directed at the congressmen voting for these laws of large scope in the first place. Hopefully we can get rid of NSLs too. But the NSA is just doing the most it can with the tools we give it (which is what we expect). And rule of law is actually working, we just have some shitty laws.

<comment><USER11> Lots of people have picked up on your thesis statement : _This argument can only hold on water by having a complete lack of faith in the rule of law._

We aren't talking about 'law' here, we're talking about 'people.' That gets lost some times.

Someone with access to these tools might decide the shake down Jack with a bit of blackmail. They might decide to sell union organizing 'alerts' to business. These are not legal but there are many people who work in an organization with these tools available who could justify abusing them.

Consider another hotbed subject which gets argued the other way all the time, gun ownership.

Now we can all agree that someone owning a gun who follows all of the safety precautions, and doesn't wave it about irresponsibly Etc is no threat to society. And yet the argument is put forward that _the capability_ is the threat and people other than the owner may exploit that capability (a thief steals the gun, a spouse grabs it in a fit of rage, Etc.) and that it is "better" to not allow the person to own a gun because the risk of that gun falling into the wrong hands and doing something bad are non-zero enough.

This is the same argument we should make on surveillance technology, which is that the potential for its abuse and damaging the lives of innocent civilians, out weighs the 'benefit' the law enforcement agency gets from having it. There are other ways for the agency to do its job, just as there are other ways for our homeowner to protect their property, that don't require this capability.

<comment><USER10> >Someone with access to these tools might decide the shake down Jack with a bit of blackmail. They might decide to sell union organizing 'alerts' to business. These are not legal but there are many people who work in an organization with these tools available who could justify abusing them.

The situation described in the article would require coordinating a lot of data together. I have a hard time seeing how individuals could do that properly without the institution noticing (especially considering how "Big Data" it is). It's not just cell data that you need, but also license plate scans, court records, etc. These are all fairly independent things, unlikely to be stored in the same place.

Individuals will try to exploit systems, and we should work hard to avoid things like LOVEINT happening (which shouldn't be hard in itself, but given that Snowden walked off with all those documents, the NSA doesn't seem very skilled in secure storage of documents).

If institutions work hard enough to make sure they're following the rules on document access, then it'll be harder for people to abuse, since each individual block of data is useless in itself. It would be the information equivalent of N keys to launch the nukes. Abuse would be much,much harder if somebody sat down and chmod'd some folders properly (nobody should have access to everything in any system). A plus side (for gov'ts at least), would be that Snowden-class events would be a lot harder to pull off.

Institutions can be built to be a lot harder to corrupt.

<comment><USER12> >The situation described in the article would require coordinating a lot of data together.

Do you think the federal government cares more about protecting your personal data, or their own top secret data?

Edward Snowden was able to single-handedly pull together reams and reams of data on a cornucopia of the most highly classified top secret projects of our government. He wasn't noticed at all, except for the fact that he outed himself.

Had Edward Snowden actually been a spy working for a foreign government, he probably wouldn't have been caught at all, and would still be working for the government.

>It's not just cell data that you need, but also license plate scans, court records, etc. These are all fairly independent things, unlikely to be stored in the same place.

[http://en.wikipedia.org/wiki/Data_fusion](http://en.wikipedia.org/wiki/Data_fusion) is the process of unifying disparate data sources in order to glean information not readily apparent by looking at the sources individually. Guess who is leading the charge in this budding field?

>Institutions can be built to be a lot harder to corrupt.

Once all this information is stored, its value is essentially incalculable. Almost no expense at all will be too high for a foreign government or a multinational corporation to pay for access to it - it is too profound a leg up on Bob the competitor, Joe the union organizer, and Sally the investigative reporter. The act of collecting and storing the information is, itself, opening Pandora's box.

</comment></comment></comment></comment><comment><USER13> I understand the importance of focusing on the government, but I think use of this sort of data should be restricted for everyone, not just the government. What happens when employers realize that you can filter out less desirable employees by correlating the movements of their social groups and cross- referencing it against credit history databases? We fear what the government can do with the data, but as a practical matter its corporate America that's more likely to actually screw over large numbers of people with this sort of data.

<comment><USER14> This is what bothers me about most of America's large tech companies' recent opposition to various NSA programs. They pioneered many of the techniques (albeit independently...usually) yet now point their fingers at the government.

</comment></comment><comment><USER15> Hey, that's not what the Palantir UI looks like!

</comment><comment><USER16> Am I the only one for whom the article had the opposite than intended effect? I was expecting some real life horror story of a false positive or deliberate framing, but instead I was given examples of how this data could be used constructively to try and evaluate where there might be a high likelihood of crime occurring, and trying to prevent it. In my eyes, using tax dollars to prevent crime rather than punishing it a HUGE win!

<comment><USER17> There was a false positive in there. There was a "probable criminal activity" that turned out to be a real estate agent.

<comment><USER18> Are we not willing to accept a certain number of false positives if the net effect is good?

</comment></comment></comment><comment><USER19> This is fear mongering. You could have some person out in the field tailing you and get the same info (maybe even more). You can also put up a camera and tag people as potential DUIs based on how close to the middle of the lane they are driving. So what?

What's important to ask is what can the government do with the data. And NSA or not, what they are can do is limited by the law. No database changes that.

<comment><USER20> It's not the same goddamn thing. The article describes programmatic policing.

THEY CAN APPLY THESE TECHNOLOGIES TO THE ENTIRE POPULATION AT ONCE AS THEY ARE NO LONGER LIMITED BY NUMBER OF OFFICERS AVAILABLE.

This carries new, complex risks for society at large. How hard is that to understand? Relying solely on unclear "policy" and "access controls" to protect us from these risks is extremely foolish. Now, I'm not saying this is happening now, or will happen tomorrow. But these thought exercises are very useful and informative.

<comment><USER19> You're not really explaining what's "foolish" or a "complex risk to society"...

Why is it okay to do it to several thousand people (selected in some non- systematic/statistical process more akin to voodoo than science), but not okay to do to the whole population?

Shouldn't everyone be treated equal? Seems like the way we have it now, if you get on some officials bad side you will get harassed by the TSA and maybe audited (there aren't _that_ many tools at the disposal of the gov't to make your life difficult) And most likely no one will notice or care.

Doesn't that illustrate a more fundamental problem with our laws? And shouldn't we be addressing that?

</comment></comment></comment><comment><USER21> For those thinking this is so far down the slippery slope as to be ridiculous: [http://www.washingtonpost.com/blogs/the- switch/wp/2013/12/10...](http://www.washingtonpost.com/blogs/the- switch/wp/2013/12/10/new-documents-show-how-the-nsa-infers-relationships- based-on-mobile-location-data/)

</comment><comment> vezzy-fnord A related experiment: [http://www.zeit.de/datenschutz/malte-spitz-data- retention/](http://www.zeit.de/datenschutz/malte-spitz-data-retention/)

<comment><USER7> Nice. I was looking for that yesterday for the Google Location history discussion.

Digging through this site's javascript I found this comment: "Für diesen Quellcode komme ich nicht in den Himmel."

<comment><USER22> In case you don't know German: "Orpnhfr bs guvf fbhepr pbqr, V'z abg tbvat gb urnira." (ROT13 for fellow non-native German speakers who want to think about the meaning for a moment.)

<comment><USER23> In case you don't have time to waste: "Because of this source code, I'm not going to heaven." (English for fellow grownups.)

</comment></comment></comment></comment><comment><USER24> Setting aside all of the other existing information, the crux of many of the arguments in the article depend on the government knowing the use of particular addresses. That's data most city/county/state governments already have laws that they should know (for tax assessments, occupancy limits, health inspections, census, etc.) and yet they frequently have incorrect or incomplete information on this.

While pervasive tracking is indeed a problematic state, I still find it humorous at how competent we truly believe the government to be in retaining accuracy in all this data given how often our interactions with government and private businesses revolve around them FIXING their data about us.

</comment><comment><USER25> This indirectly makes a great point. While everyone's been talking about the danger of a turn-key totalitarian state -- the danger of _intentional_ totalitarianism -- much less has been made of the danger of an unintentional totalitarian state arising from overzealous use of these systems by law enforcement. I think that's a much greater immediate risk.

Replace "DUI pattern detected" with "likely child predator." Just the _insinuation_ that a person is a pedophile can destroy a person's life.

</comment><comment><USER26> Maybe I'm just a huge data nerd, but this article made me really excited.

</comment><comment><USER27> That is not how this task is done by programmers, here's a newsflash: We use Bayes! A lot of it.

(ref: [http://en.wikipedia.org/wiki/Bayesian_network#Inference_and_...](http://en.wikipedia.org/wiki/Bayesian_network#Inference_and_learning) )

Translated for 'non programmers: computers don't think the way we do, they look at (big) data, there is _no causality_.

(ref: for example, if human brain can't diagnose disease, since we are limited in thinking to causality, we use computers: [http://pubsonline.informs.org/doi/abs/10.1287/opre.46.4.491?...](http://pubsonline.informs.org/doi/abs/10.1287/opre.46.4.491?journalCode=opre) )

Please don't talk about how computers detect something in big data, if you don't know some math, ex(' causal calculus')

Item to discuss: Getting pulled over and being told, we don't know why we pulled you over, but there's a 85% chance you are non-compliant.

</comment><comment><USER28> The police go to Jack's house and educate him on not drinking and driving and give him a free taxi token.

</comment><comment> at-fates-hands This is why its important for people to get their respective states to start writing laws which protect people's privacy and usurp the Federal Preemption of states rights in regards to people's private information.

This is a great paper which addresses this in regards to environmental laws. This kind of argument can also be made in protection of people's private information. It's about restraining and balancing the federal laws with state laws and not allowing the feds to overstep state laws.

[http://www.law.northwestern.edu/lawreview/v102/n2/649/LR102n...](http://www.law.northwestern.edu/lawreview/v102/n2/649/LR102n2Learner.pdf)

</comment><comment><USER29> Could? The government may know you better than you know yourself; and perhaps the only reaction to be had upstairs is when you change a habit; i.e. quite unexpectedly break the prediction model for your life.

</comment><comment><USER30> I don't know why everyone is paranoid about unseen location data being collected. They often blame proprietary software like iOS/Android collect location data and send Apple/Google servers. That sort of transfer would be evident by tracing traffic and there are tons of reverse engineers out there intentionally keeping an eye on transferred packages that might contain sensitive private data. That would be a huge breakthrough if it would exist and be revealed.

<comment><USER31> >That sort of transfer would be evident

It is evident: [https://maps.google.com/locationhistory/](https://maps.google.com/locationhistory/)

Besides, the issue is also location data from cell tower triangulation. That data is available to your cell carrier whenever you connect to their network.

</comment></comment><comment><USER32> Setting aside morality for a moment, that's a pretty cool little system there.

What havoc would be wrought if such a system were public? Heh, the mind reels.

<comment><USER33> I would think a system like that being public would cause a great deal of interpersonal problems until ways to circumvent the data collection were found (even if it meant tearing GPS receivers out of mobile phones).

I remember reading a meta-analysis of lie detection and deception studies in humans, and there was one social psychology experiment where the participants were asked not to lie for the duration of the experiment. They couldn't even use the tactic of "white lying."

Overwhelmingly the participants said it was extremely difficult not to lie and when they couldn't lie, it ended up causing their stress levels to rise and their relationships suffered. Lying, or much more fundamentally - concealing, is a necessary process for maintaining social relationships. [You don't want to tell Mary what you really think about her new dress, and in the same way, you don't want to tell your boyfriend that you're throwing him a surprise party, even if he asks you directly.] As technology becomes increasingly woven into our social fabric, it's going to have to conform with our pre-established patterns.

<comment><USER34> Trying to remove location tracking from a cell phone is essentially impossible; they're capable of using a system called Assisted GPS which when GPS isn't available, can use things like WiFi signals to help determine where you are; [http://en.wikipedia.org/wiki/Assisted_GPS#Description](http://en.wikipedia.org/wiki/Assisted_GPS#Description)

Even if you were to build your own cell phone or dig out an old brickphone without this capability (thanks to the FCC's efforts, basically no cell phone made after 2005 is without it), you can still be triangulated by the network with fair accuracy.

At this point, The Only Winning Move Is Not To Play.

<comment><USER17> Right, this was a requirement so if you dialed 911 the emergency responders know where to find you even if you didn't know where you are. It is called e911 or enhanced 911.

</comment></comment></comment></comment><comment><USER35> Suddenly I'm not as sure I want a self-driving car.

Then again, if there are no tracking cookies, maybe they can't tell if I'm in it? (Wishful thinking, I'm sure...)

Of course a self-driving car would defeat the need to catch someone after a party perhaps, so bad example? :)

<comment><USER17> What exactly would a self driving car have to do with this? This is talking about tracking by cell phone data and license plate, not car data. A self driving car would be the same as a regular car, just with extra sensors, the ones they have now are at least. Who is to say that it would have extra tracking?

<comment><USER35> Your car has a computer and needs to know both where it is precisely and if the roads have changed since it was last there. This is always on and possibly worse than a cellphone for tracking given how hard it would be to "throwaway".

</comment></comment></comment><comment><USER36> Is Jack a celebrity? Why does anyone (other than a data mining algorithm) care about him.

<comment><USER37> Is Bill Montgomery the cop performing the queries?

</comment></comment><comment><USER38> Nice of the ACLU to spec how the NSA's software work and what it should look like.

</comment><comment><USER39> It feels like there's a game in here. The Sims meets Uplink.

<comment><USER10> six degrees of sabotage ([http://dukope.com/play.php?g=six](http://dukope.com/play.php?g=six)), made for a gaming hackathon, feels a bit like what this would be.

</comment></comment><comment><USER40> Reminds me of the Big Brother pizza shop [http://www.youtube.com/watch?v=-zh9fibMaEk](http://www.youtube.com/watch?v=-zh9fibMaEk)

</comment><comment><USER41> Now imagine similar data in the hands of a private company,

"I see you like to go to a bar regularly, would you like to see this beer advertisement?"

</comment><comment><USER42> Couldn't google or apple build this?

</comment><comment><USER43> So was Jack arrested or not?

<comment><USER44> You'll notice they prefer the term "interdicted" now. "Arrested" implies rights.

<comment><USER33> They stopped his vehicle and summoned him an Uber (charging him stewed prune surge pricing).

</comment></comment></comment><comment><USER45> Yet another example of how the government can use this information to "discredit radicalizers":

[http://www.huffingtonpost.com/2013/11/26/nsa-porn- muslims_n_...](http://www.huffingtonpost.com/2013/11/26/nsa-porn- muslims_n_4346128.html)

<comment><USER46> Stewart Baker, who was quoted extensively for that article, had some interesting words regarding it[1]:

 _When one of the authors, Ryan Grim, called me for comment, he said that while Glenn Greenwald was transitioning to his new Omidyar-funded venture he was temporarily publishing his Snowden leaks with HuffPo. So when he asked for my take on the NSA story, pretty much the first words out of my mouth were, "Why wouldn't we consider doing to Islamic extremists what Glenn Greenwald does routinely to Republicans?" The story quotes practically everything I said to Grim except that remark, even though I returned to the point a couple of times and emphasized that it summed up my view.

I don't think HuffPo cut the quote because they ran out of electrons. The article itself is so tediously long that I defy anyone to read every word in a single go.

Nor because my remark was inaccurate. It turns out that Glenn Greenwald has written an entire book devoted to exposing the contradiction between Republicans' ideology and their private lives. In Greenwald's words, "While the right wing endlessly exploits claims of moral superiority … virtually its entire top leadership have lives characterized by the most decadent, hedonistic, and morally unrestrained behavior imaginable …[including] a string of shattered marriages, active out-of-wedlock sex lives, and highly 'untraditional' and 'un-Christian' personal lives [endless detail omitted]." His book certainly makes the NSA memo sound restrained and cautious, but both are motivated by the same idea.

Grim and Greenwald very likely cut the quote because it would have undermined the narrative of the piece, which combines solicitude for the poor Islamists whose sexual and financial hypocrisy might be exposed with outrage at the NSA for even considering such a tactic. The quote would have made them look like, well, hypocrites.

The incident makes me wonder what else Greenwald leaves out of his stories. And why we should continue to trust snippets of documents selected by someone who thinks that the difference between Islamist extremists and Republicans is that one is an enemy that deserves no quarter and the other is sort of like Martin Luther King, except for the part about wanting to kill us._

[1] [http://www.volokh.com/2013/11/27/understanding- enemy/](http://www.volokh.com/2013/11/27/understanding-enemy/)

<comment><USER47> > "Why wouldn't we consider doing to Islamic extremists what Glenn Greenwald > does routinely to Republicans?"

I think this is disingenuous. Of course the US should do to extremists what Glenn Greenwald does routinely to Republicans. I don't think anyone is saying exposing hypocrites is a bad thing, and it's certainly good jounalistic practice.

What people are upset about is the US spying on the whole internet to do it.

In addition, there's the slippery-slope argument that once this mechanism of surveillance is in place, they'll use it to modify everyone's behaviour, not just "the bad guys."

But it's hardly controversial that journalists reveal hypocrisy, is it?

<comment><USER46> Sorry, I wish I had seen your comment two days ago when you posted...

I don't think Mr. Barker's argument was based solely on whether or not the US should be doing it, but also touched upon the journalistic standards behind the reporting. As an analogy:

Headline: Hacker News commentors unfazed by NSA controversy

 _Discussion repeatedly turned in favor of the NSA 's targeting of Islamic extremists on Hacker News, a web forum frequented by many of the internet's technical elite. Summerdown2, a respected contributor, even went so far as to say that "of course the US should do to extremists what Glenn Greenwald does routinely to Republicans." Though also mentioning vague concerns regarding NSA surveillance, he stressed that "it's hardly controversial that journalists reveal hypocrisy" and even went so far as to say that it was "certainly good journalistic practice."_

You and I (and anyone else reading this thread) can easily look at the source comments and tell that my hypothetical news blurb is complete bullshit and the crux of your argument was left out entirely. So if the authors are willing to selectively quote from their expert source to avoid having their argument look bad, what else are they selectively quoting to make their arguments? This isn't like Reuters, AP, ITAR-TASS, Kyodo and half a dozen other major news agencies are on the ground writing about what they see as events unfold - Snowden chose which documents to gather, then chose Greenwald and Poitras specifically to give these documents to. These guys have the ultimate control over which documents get reported, what parts of the documents get shared with the public, and which documents get shared with which news agencies. The guy I quoted is stating that he feels Greenwald and the people he is working with had no qualms about selectively quoting from an expert source in order to keep their argument from looking weak. There's little risk to the authors in misquoting Stewart Baker - how many people read his blog? How many people here on HN know about the blog post before I linked to it? There's almost no risk whatsoever in selectively quoting a document from Snowden to make their point - no one has access to it except for the NSA and whoever Greenwald has allowed access.

From the NSA porno article, they pull out a few paragraphs to make their point - what's in the rest of the report? If the information regarding the inconsistency in the public/private lives of those 6 individuals was documented in a "previous SIGINT assessment report", why are they showing us this report instead of that one? Was that other report sent to the Departments of Justice, Commerce and the Drug Enforcement Agency, too? If the information in that other report wasn't sent to them, what information on those 6 individuals was in this report that would have been of interest? Better yet, why can't Greenwald just redact the identifying information and let us read the whole damn report for ourselves?

And it's not just that one. Here's a paragraph from a recent Washington Post article[1]:

 _One senior collection manager, speaking on the condition of anonymity but with permission from the NSA, said "we are getting vast volumes" of location data from around the world by tapping into the cables that connect mobile networks globally and that serve U.S. cellphones as well as foreign ones. Additionally, data are often collected from the tens of millions of Americans who travel abroad with their cellphones every year._

I have no idea who is saying what in that paragraph, beyond the fact that an anonymous collection manager said "we are getting vast volumes".

Why were the specific encryption systems that the NSA had compromised and the countries targeted redacted from the source documents that we were shown[2] in the BULLRUN leak? Everyone's up in arms about Dual EC PRNG, but that might not even be what that document was refering to. It would be trivial for the media to reveal it and end all doubt, but keeping it hidden and instead writing about how the NSA is betraying our trust and compromising the security of the same crypto systems that we all use makes a better headline.

Or one could ask why we only got a limited subset of the PRISM slides. What else is in there? Why can't we see it? Would that information invalidate their argument?

[1] [http://www.washingtonpost.com/world/national-security/nsa- tr...](http://www.washingtonpost.com/world/national-security/nsa-tracking- cellphone-locations-worldwide-snowden-documents- show/2013/12/04/5492873a-5cf2-11e3-bc56-c6ca94801fac_story.html)

[2] [http://www.nytimes.com/interactive/2013/09/05/us/documents-r...](http://www.nytimes.com/interactive/2013/09/05/us/documents- reveal-nsa-campaign-against-encryption.html?ref=us)

<comment><USER47> What a great answer! Thank you for responding :)

I see it a little differently, though I agree with your basic point about not being able to work out the whole truth from only partial information.

The reasons I'm happy to give Greenwald's NSA reporting a (qualified) pass on this are:

1) He (and a few others) are the only source of information we have on the level of surveillance we're all exposed to. Greenwald is a commentator speaking up to power, and the justification I see is that there is a basic asymmetry in that power. Without these stories, no-one would be challenging the surveillance.

Note that I'm not giving him a pass because the stories are unsupported. I'm giving him a (temporary) pass because so many have later been confirmed to be true. In essence, we need a debate on the level of surveillance a democracy will have, and without this as a catalyst, it would not be happening.

2) I suspect that a lot of these documents are highly sensitive. As much as I'd like a debate, I don't want to risk people's lives. Hence, if Greenwald produces the minimum documentation that still sparks reform, I think he's done us all a service.

<comment><USER46> Thanks for continuing the conversation - I don't think I've ever seen a thread continue on for a week here on HN. :)

I suspect that ultimately the truth lies somewhere in between the media's portrayal of the NSA and the administration's own description - there are likely privacy and/or oversight issues at play, but I don't buy the prevailing attitude that the NSA is a rogue agency that is sweeping up everything it can simply for the purpose of sweeping up everything it can.

As a journalist, any time Greenwald wants to release information he needs to evaluate what effect his reporting will have on his journalistic reputation alongside the profitability of his reporting. I think he's unlikely to ever write an article that states that the NSA is doing something beneficial to national interests - it won't bring in nearly as many readers as a story on overzealous infringing of privacy, and it could potentially call into question his previous reporting.

That's not to say that you can't have reporting that's both balanced and worth reading. I've found some of the NY Times' reporting on the NSA to be fairly interesting. In particular, "No Morsel Too Miniscule for Consuming NSA"[1], despite the sensational title, was fairly balanced; definitely not propaganda, but at the same time not falling into the trap of saying "the NSA is likely watching you, your friends and your family 24/7". They go on for 7 pages describing the NSA's problems and successes, inefficiencies, bureaucracy, etc. They manage to ask the reader to call into question privacy issues and ask whether we're getting our tax dollar's worth in terms of foreign intelligence delivered - and they managed to do it without whipping their readers into fear-driven frenzy. It astounds me that two different news agencies can look at the documents that Snowden leaked and get such different interpretations.

[1] [http://www.nytimes.com/2013/11/03/world/no-morsel-too- minusc...](http://www.nytimes.com/2013/11/03/world/no-morsel-too-minuscule- for-all-consuming-nsa.html?_r=0)</comment></comment></comment></comment></comment></comment>


Tim Ferriss on how to build an app empire: Can You Create The Next Instagram? - <AUTHOR> http://www.fourhourworkweek.com/blog/2012/04/22/how-to-build-an-app-empire-can-you-create-the-next-instagram/ <comment><USER2> I don't know how Ferriss successfully appointed himself some kind of tech guru, but he seems to have convinced people he deserves this pulpit where he doles out tech advice. People take him seriously, which is fascinating.

<comment><USER3> He actually outlines how to become an "expert" on any topic in "The 4-hour Workweek". :)

</comment></comment><comment><USER4> If Tim Ferriss wasn't obnoxious before, he sure is now.

His prescription is:

* Look for "market trends" (As opposed to building things you know about and understand, and focusing on great products)

* Treat "your programmer" like a house builder you'd contract with

* Pay rock-bottom prices

* Make everyone sign an NDA so they don't "steal" your brilliant idea

Ugh. I hope this gold rush ends soon.

<comment><USER5> My favs from the "your programmer" comments:

"oDesk— Its work diary feature tracks the hours your programmer is working for you and takes screenshots of the programmer's desktop at certain time intervals."

and

"Below is a screencast on how to upload an app to the App Store. As you'll see, it's a fairly confusing and tedious process. Best to leave this task to your programmers"

</comment></comment><comment><USER6> You know, if Tim Ferriss knew how to build an app empire, I think he'd probably have gone ahead and built that app empire by now.

Now, if I were interested in how to make a lot of money by conning gullible people into thinking they can work four hours a week and be millionaires, he'd be my go-to guy.

</comment><comment><USER7> As a freelance mobile designer/developer, _fuck that shit_.

I'd never answer a giant list of "interview questions" and certainly wouldn't complete a "Hello World" task for a short-term, low four-figure job. I can show you live apps I've already built; if that's not good enough, we don't have anything else to discuss. (Side note: "creating/delivering your app's icon" = spec work! NOOOOPE.)

Jobs like these are the ones that drag down the mobile marketplace. Shit apps made for shit pay by developers willing to work for table scraps. Good icon development is an art. Check out the work by The Iconfactory, for example. The fact that the employer treats it like an also-ran is another gigantic red flag.

"Disqualify anyone who is not willing to jump on a Skype call." For a short- term, low-paying job? You want me to break the flow of my day and blow an hour of my time on maybe satisfying your absurd needs? I'll disqualify you, brah.

(Sorry to rant, but, I just feel like we should all have more self-respect than to take jobs like that.)

</comment><comment><USER8> Tim Ferriss' blog post is absolutely ludicrous. He is clearly playing on the dreams of dupes who want fast money with little effort or skill involved in the process.

The only reason Tim Ferriss posted it is to play on the proverbial "market trend" of hawking self-help books to wannabe techies after the announcement of the Instagram deal.

What a joke.

<comment><USER9> I found it interesting that this guy makes zillons of dollars a month in app sales and is busy peddling a guide.

</comment></comment><comment><USER10> Emoji icons, Fingerprint Security Pro, and a Flashlight.

While I think there is plenty of room left in the App Store for innovative, well-polished apps (e.g. Paper's recent success), you're not going to be making any money selling this crap in a sea of 5,000 other clones.

<comment><USER11> Apparently it works for Chad.

</comment></comment><comment><USER12> Tim Ferris is really good at making money. It kind of reminds me of Multi- level Marketing where you need to convince your downlines that they will make millions by buying your product.

The main flaw with this piece, is that the person who wrote it was doing this 2 years ago. What worked then to produce a lot of money may not do so for new entrants now. The big thing should be to figure out what will create those returns 2 years from now and do that.

I can also guarantee that no-one is going to expose their "muse" if it is actually making a lot of money. Why kill the goose that laid the golden egg?

</comment><comment><USER13> I was already starting to become skeptical while reading. Then came to the following section:

"Here's my three-step process during the coding phase:

1\. Icon—Ask the programmer to create and deliver the icon of your app."

Right...

</comment><comment><USER14> This article is written by Chad Mureta, not Tim Ferriss.

</comment><comment><USER15> He's actually becoming a parody of himself it seems.

"How get 24 points on Hacker News"

1\. Hire someone who can write. (I usually use an outsourcing agency for $7.23 per article) 2\. Give them a topic to write about. (usually something that's in some way timely) 3\. Tell them to create an article that implies that there is a numerated set of steps that one can follow to become rich. Use images from popular apps to imply that the article is well referenced. 4\. Submit to Hacker News and other sites.

</comment><comment><USER16> Do these "Plagiarize Other Apps to Try To Make a Quick Buck" articles make anyone else throw up a little?

</comment><comment><USER17> I bet you can still make a lot of money using this method if you focus on some emerging trends though. Look how many One Direction apps are out there now. I counted 38 results after searching "One Direction". If you get in early, you can make off with a few 10s of thousands.

<comment><USER18> How many of those trend chasing applications really make money though to make it worth developer time?

It is easy to interview a successful app developer out of the sea of unsuccessful ones, just like Tim Ferriss did.

Disclaimer: I had to google what One Direction is (NKOTB was hot when I was growing up).

</comment></comment><comment><USER19> Isn't this "create the next Instagram" like "create the next Facebook"?

<comment><USER20> He describes poor quality, client-side apps that can be developed in a matter of hours. If he has made money, that's great, but he's not creating anything with long term value, like Instagram.

Apps like Instagram are businesses with passionate developers and back-end systems that you just can't do with random developers that will work on junk projects for no pay.

<comment><USER19> Maybe I was too subtle. This "create the next foo" is the tagline of way too many "news" that float around this place. I think that there's no "next foo", only bar that contains the ingredients indicated by you.</comment></comment></comment>


Perceptrons – the most basic form of a neural network - <AUTHOR> https://appliedgo.net/perceptron/ <comment><USER2> This is a question for anyone who knows more (or reads more) about neural networks than me. My problem with the perceptron since I was a kid is that it doesn't seem to model how neurons work very well at all. It creates a neuron that exists in a timeless place; kind of a homo economicus for cognition.

My understanding of neurons: The signals arrive at the dendrites at different times, as soon as a signal arrives its strength decays steadily, and when the sum of decaying signals and an additional signal reach a threshold, the axon fires, getting rid of all energy and beginning the process again (creating the largely irregular pops that everybody is used to listening to.) Aside from that, there are effects from other bodies and chemical concentrations between neurons that are mostly unknown (that I get leaving out as not central to the process.)

My question: is there any paper that explains how that process, which seems pretty easy to model, can be mathematically reduced to perceptrons (hopefully comprehensible to the educated layman) which are just addition and a condition?

<comment><USER3> First off preceptrons are very simplified models, a first pass really at modeling brains in silico decades ago.

There is a whole field of theoretical neuroscience dedicated to this problem, and have made quite a bit of progress, still a bunch of work left to be done.

The classical introductory text on the topic is the book by Peter Dayan and Larry Abbott called computational and mathematical modeling of neural systems.

<comment><USER2> [deleted]

Thanks for the reference.

edit: Thanks very much; if that doesn't contain what I'm looking for, it'll give me further places to look.

</comment></comment></comment><comment><USER4> One thing the article failed to mention - which I found most interesting, is that a perceptron can function like a NAND gate, which is the building block of all other gates (AND, OR, XOR, etc) and thus can replicate the functionality of any logical array.

<comment><USER5> Another interesting thing is that perceptron can approximate any non-linear function with just a single hidden layer.

[http://cstheory.stackexchange.com/questions/17545/universal-...](http://cstheory.stackexchange.com/questions/17545/universal- approximation-theorem-neural-networks)

</comment></comment><comment><USER6> I implemented the code produced in the tutorial in python for anyone who's interested

[https://github.com/petenilson/pyceptron](https://github.com/petenilson/pyceptron)

</comment><comment><USER7> I'm getting "refused to connect"

DownForEveryone says it's down too.

anyone have a mirror?</comment>


My roommate received this email from a Microsoft recruiter today - <AUTHOR> https://twitter.com/pburtchaell/status/750494339860615169 <comment><USER2> I'm not sure what is more cringeworthy, the email itself or the fact that this became controversial enough to warrant a response from Microsoft [1]. People on the Internet will express discontent over anything and everything.

[1] [http://gizmodo.com/microsoft-wants-bae-interns-to-get-lit- at...](http://gizmodo.com/microsoft-wants-bae-interns-to-get-lit-at-its-beer- pong-1783200089?utm_campaign=socialflow_gizmodo_twitter&utm_source=gizmodo_twitter&utm_medium=socialflow)

</comment><comment><USER3> That recruiter is doing good job, party announcement made it into HN frontpage.

</comment><comment><USER4> This response chain seems much more interesting [https://twitter.com/savantdotwtf/status/750781065518731264](https://twitter.com/savantdotwtf/status/750781065518731264)

<comment><USER5> The entire situation is ridiculous, but Mitchel's response probably won't go over well with his employer.

<time to get some popcorn and watch what happens>

<comment><USER6> I work at microsoft and honestly the Mitchel guy seems unhinged. I saw him posting every 15 minutes on our internal Yammer today about this. He ranted a lot about how people at HR plotted against him in the past. Honestly his autism might get him fired because he took it way too far.

</comment></comment></comment><comment><USER7> "But if they do show up, perhaps they can be put to work programming Skype Translator to produce a less cringy version of how kids today speak"

Cring(e)y is an example of how 'kids' today speak. For whatever reason this portmanteau is now being used more frequently than cringeworthy.

[https://www.google.com/trends/explore#q=cringy%2C%20cringey%...](https://www.google.com/trends/explore#q=cringy%2C%20cringey%2C%20cringeworthy)

</comment><comment><USER8> might go without saying, but: do NOT get sloshed at events like this, even if you see other people doing it. you're trying to get a job, so keep your wits about you.

</comment><comment><USER9> So does Microsoft have good parties or not?

</comment><comment><USER10> I actually love it! though, maybe they didn't write it ironically.

</comment><comment><USER11> More than likely a third party advertiser hired to attract young people as prospective interns.

Looks like they will probably be effective, only thing they didn't promise was strippers.

</comment><comment><USER12> Misaligned incentives combined with poor oversight/training?

I can't imagine this is actually a recruiting pitch that's enshrined in company policy.</comment>


Google's Brin Talks About China Gamble - <AUTHOR> http://online.wsj.com/article/SB10001424052748704266504575141064259998090.html?mod=googlenews_wsj

<comment><USER2> My wife is Bulgarian, and through her, I'm exposed to a lot of folks who escaped from behind the iron curtain before it fell. These people are a breath of fresh air to me. They understand what freedom is and how precious it is.

While most westerners are trading their freedoms for the promises of security, and smiling foolishly while they do it, I find myself more at home with my wife's group of friends, who take this stuff seriously. I think I'd get along with Mr. Brin just fine.

</comment><comment><USER3> I like how even though Google is a big company, every time they have something to say, it feels like it came from a regular guy wearing a t-shirt. Maybe they are just really good at their brand marketing.

<comment><USER4> Except when it's Eric Schmidt doing the talking, for some reason.

<comment><USER5> 'Cause Schmidt doesn't wear a t-shirt. Edit: better picture [http://www.internetmarketing-news.de/wp- images/content/googl...](http://www.internetmarketing-news.de/wp- images/content/google-time-cover.jpg)

<comment><USER4> Touché!

</comment></comment></comment></comment><comment><USER6> People often cite the cynical business reasons why Google pulled out of China, but this article makes me wonder why no one ever cites the reasons why China began to ramp up the pressure on Google these past two years. Baidu has come to its own (at least in the Chinese market), and maybe they don't feel they need Google anymore.

</comment><comment><USER7> Well, this makes me an even more enthusiastic Google user.

<comment><USER8> Not only do they show at least some humanity (which is hard for a company of their size), but they've also got big balls.

It's interesting that while this may be a PR spin, few companies would have done it because the risks are much higher than the potential gains for shareholders.

<comment><USER9> Why does it take big balls to pull out of a market you're losing in?

<comment><USER10> "Losing" and "winning" aren't terribly relevant in a market. "Profitable" and "not profitable" are much more important. That's not really an answer to your question, but I've never understood why people think it's such a big deal that Google's not the biggest search engine in China.

<comment><USER9> Well, you have to admit that google's investors have a notion of how well it will be able to transfer its business to developing markets... and so with all its advantages if google can't take first place in china, what does that say about its fundamental ability in non-us markets?

I'd say that the perception that google will dominate search in worldwide markets is worth about $200 per share right now.

<comment><USER11> Google doesn't dominate every market, but I think they're doing quite well:

[http://googlesystem.blogspot.com/2009/03/googles-market- shar...](http://googlesystem.blogspot.com/2009/03/googles-market-share-in- your-country.html)

and

[http://www.artofseobook.com/search-engine-market-share-by- co...](http://www.artofseobook.com/search-engine-market-share-by-country- region/)

</comment></comment></comment></comment></comment></comment><comment><USER12> Now, this is just me imagining.

My guess is that part of the tussle with Chinese authorities which Google does not talk about may be demands made on Google for information on individuals. More than censorship, it may be the surveillance aspect.

It is maybe in this context that Eric Schmidt told users: "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place."

Maybe the Chinese authorities told Google: "If you have something on users that you don't want us to know, maybe you shouldn't be doing it in the first place." And Google did not want to stop keeping user information for just China....

</comment><comment><USER13> I'm very impressed with Google's willingness to back up "Do No Evil" with hard action. For a while, I was wondering if the initial incident from last month was going to fade into obscurity, but the news from this week shows that Google is willing to walk the walk so to speak, and show it really isn't willing to sacrifice its ideals for the sake of a quarterly. Laudable.

That said, I think Brin and much of the commenting is missing a great deal of nuance. I rarely, if ever, see anyone who actually talks extensively with Chinese international students or who does business in China claim that the level of totalitarianism in the PRC actually causes anyone to live in constant fear of the government. Most likely this is a combination of regular Chinese citizens not caring and the government not being the evil empire some commentators appear to think it is.

I agree China needs to open up more both because of basic human rights principles and also because well-executed democracy is an excellent guard against government corruption, but I'm rather frustrated by the lack of attempts to understand the motivations and viewpoints of the PRC.

At its core, can you really blame the PRC for putting social stability first when it's at the head of a country that's seen constant civil war, invasion, and been on the wrong end of Imperialism since the end of the Qing Dynasty? Sure, the societal training wheels need to come off and people need to stop getting thrown in jail for bad reasons, but at least acknowledge that the PRC's actions are not pure black.

</comment><comment><USER14> "people familiar with .. say ..." This attribution was used 3 times. I hate that.

</comment><comment><USER15> Way to go Sergey. This reinforces in my mind, the "Do No Evil" motto that Google is famous for.

It also reinforces my opinion that Eric Schmidt is a douche. All he cares about is making a buck, and would sacrifice the motto and public good will towards the company just for quarterly results.

<comment><USER16> I don't think Schmidt is a douche. I think he's just providing a balanced perspective. I suspect that Larry and Serge would run Google as a charity, if they could. Unfortunately, data centers are expensive as hell. Schmidt is just keeping the balance necessary to sustain Google.

<comment><USER17> Ok, but Schmidt's decision about China was a miscalculation, let's admit it. It brought a lot of problems for Google, and didn't bring them that much money. They weren't that much profitable there, despite quite a large market share.

<comment><USER16> There are 1.3 billion people in China. I don't think that any amount of miscalculations could have overcome that fact. It's also not that hard of a sell to say that "As long as we indicate that results were censored, we're doing what we can to bring information freedom to China one step at a time."

</comment></comment></comment></comment><comment><USER9> I applaud Google's announcement that it will be hosting a Wikileaks server to help stop internet censorship.

(yeah right... if Google actually cared about censorship it would host one... the China stuff is just a graceful way for Google to exit a market that it has failed in).

<comment><USER18> Why do I keep hearing it repeated that "Google failed in China?" They are second place but with a sizable market share, 43% to Baidu's 56% according to this link.

If your company's goal was to have 100% market share and you 'only' had 43%, would you call yourself a failure?

<http://gs.statcounter.com/press>

<comment><USER9> For highly successful companies, it's expected that they will take dominant market share within a reasonable period of time, or else they are viewed as having failed.

More importantly, Google's market share in China is symbolic of its ability to repeat its success in the US elsewhere.... this is the foundation of much of Google's current stock price.

I asked a Google finance guy what percentage of revenue comes from non-US ads and he got all red and refused to say a word. This is a HOT topic at Google and the firm can't afford to show any weakness whatsoever.</comment></comment></comment>


The Bandwagon – Claude Shannon (1956) [pdf] - <AUTHOR> http://www.monoskop.org/images/2/2f/Shannon_Claude_E_1956_The_Bandwagon.pdf <comment><USER2> I believe still very relevant:

> A few first rate research papers are preferable to a large number that are > poorly conceived or half-finished. The latter are no credit to their writers > and a waste of time to their readers.

<comment><USER3> Absolutely. One of the most important things I learned from Grad School was that to publish something, you cannot have a single grammatical mistake and must make every effort to be clear in what you're trying to say. I thought my adviser was rather harsh, but then I realized that his harshness now was better than frustrating all the future readers of the paper.</comment></comment>


Show HN: Replicating Data from Hacker News (Firebase) to RethinkDB - <AUTHOR> https://hackernoon.com/replicating-data-from-hacker-news-firebase-to-rethinkdb-8e62a3848863#.mscrpbd89 <comment><USER2> When clicking the logo:

        Cannot GET /index.html

        https://tophn.info/index.html</comment>


Barefoot Running - <AUTHOR> http://www.nature.com/nature/journal/v463/n7280/full/nature08723.html

<comment><USER2> Nature is one of the top scientific journals out there -- awesome to see them covering barefoot.

I've been wearing Vibram Five Fingers and running on the fore- and mid-foot for about two years.

Running barefoot and landing on your heel jars your entire body (knees in particular) and isn't sustainable for long distances. Cavemen certainly didn't run this way, and we haven't evolved fast enough for our optimal mechanism to be any different.

There's plenty of evidence that humans have evolved to be better long-distance runners than any other animal. The amount of impact energy returned by our tendons is highest, and human ultrarunners can go over 50 miles in one sitting.

For a couple weeks, my calves screamed and my feet were sore as they strengthened. Then after a month I started to get used to running on the balls of my feet. After two months, I felt totally comfortable with the new style.

Also, my trouble with Illiotibial Band Syndrome disappeared within two weeks of starting to run barefoot.

<comment><USER3> I really want to start running in this barefoot style but I am having trouble knowing if I am using a proper technique. I know it is mostly about landing on your ball or just below it but that is about the extent of my understanding. Could you provide any resources?

<comment><USER4> to grannyg00se (author of dead sibling of this comment): you appear to have been put on some sort of HN shit-list where your posts are being autokilled. You should email pg and ask him to remove the ban.

</comment></comment></comment><comment><USER5> A couple of recent HN threads about barefoot running:

<http://news.ycombinator.com/item?id=1082153>

<http://news.ycombinator.com/item?id=1056665>

</comment><comment><USER6> Since high school cross country in the 1970's, we were told the proper distance running form is rolling heal-to-toe, while for the short distance sprinters the form is to land on toes or the balls of the feet. This could be one of those shockers where something I've learned turns out to be false.

Still, I'm still finding it hard to imagine running, say, ten miles by landing on the front part of the foot and not the heal first. Maybe we humans aren't naturally evolved to run ten mile distances. I give it a try, but I suspect I'll be a heal-to-toe distance runner.

<comment><AUTHOR> There is a great deal of evidence that humans not only can run long distances, but have evolved to do so. The idea is that before primitive weapons (bow and arrow or whatnot), this is how we caught food -- by simply running it down.

From other sources:

"Biomechanical research reveals a surprising key to the survival of our species: Humans are built to outrun nearly every other animal on the planet over long distances."

<http://discovermagazine.com/2006/may/tramps-like-us>

<comment><USER7> Here's David Attenborough narrating a modern-day persistence hunt. It's fascinating stuff.

<http://www.youtube.com/watch?v=fUpo_mA5RP8>

<comment><USER8> Wow. That was amazing, thanks for the link.

Note that you can see (supposedly) how his feet land as he runs at 3:11

<comment><USER9> Yes, but it's also interesting that he's chosen to wear modern shoes.

<comment><USER8> Agreed. My guess is the shoes broaden his foot and make it easier to run on sandy and unstable surfaces.

</comment></comment></comment></comment></comment></comment><comment><USER10> How I Became a Barefoot Runner [http://suburbiarebooted.blogspot.com/2010/01/how-i-became- ba...](http://suburbiarebooted.blogspot.com/2010/01/how-i-became-barefoot- runner.html)

</comment><comment><USER11> I feel that there seems to be a, albeit perhaps weak, correlation between hackers/geeks and some kinds of physical activity. Mostly I'm thinking of running and mountain climbing.

While of course I'm biased and base my observations upon the plural of anecdote, I still find this observation to hold true.

I could of course hazard some kind of guess to why, but more interestingly, I think, would be if there was any kind of non-anecdotal data covering this.

Has anyone heard/read about any evidence for or against this?

<comment><USER12> No less anecdotal, but the classic "Real Programmers Don't Eat Quiche" includes:

 _"Real Programmers don't play tennis, or any other sport which requires a change of clothes. Mountain Climbing is acceptable. Real Programmers wear climbing boots to work in case a mountain should suddenly spring up in the middle of the machine room."_

<http://www.lib.ru/ANEKDOTY/quiche.txt>

<comment><USER13> Not funny if intended as a joke, and ridiculous otherwise. More dumb stereotyping.

<comment><USER14> It's a riff on Real Men Don't Eat Quiche, and if it's in the same spirit, it's self-satirizing.

<http://en.wikipedia.org/wiki/Real_Men_Dont_Eat_Quiche>

</comment></comment></comment></comment><comment><USER15> I can best describe running barefoot as feeling very very fleet on your feet. running on the balls of your feet feels fast, very very fast.

edit: grammar.

</comment><comment><USER16> It's not just the forefoot striking (also, Vibram != barefoot, call them minimal, if anything). When you run barefoot, you don't do anything stupid with your feet, like subjecting them to lots of impact, because it hurts!</comment>


Interesting story about young angels in NY: "The Littlest Angels" - <AUTHOR> http://www.observer.com/2011/tech/littlest-angels

<comment><USER2> Sounds like a lot of old people with money and no clue as to what might be viable using young people without to source their investment opportunities.

It's the investing equivalent of letting whoever is the youngest in the room fix the computer.

</comment><comment><USER3> There are a lot of emerging roles in the angel ecosystem, as traditional VC suffers, including the youngest guy in the room and the ever present, entrepreneur in residence.</comment>


Apple is missing the point of the "cloud" - <AUTHOR> http://www.techdirt.com/articles/20110606/13200014569/were-missing-point-cloud-its-not-supposed-to-be-locked-to-single-service.shtml

<comment><AUTHOR> The cloud is supposed to offer us liberation from devices and certain operating systems, and access our data from ANY device and any type of machine that has the Internet. In that regard, although iCloud has the cloud word in it, it's not a true cloud at all. Apple is turning the cloud idea on its head, and saying the cloud should only work with certain devices and operating systems, like theirs.

All their "cloud" services are native applications and their cloud iTunes doesn't even stream the music. You're still supposed to download it on your Apple device. But wasn't the point of music streaming to save storage space, so you wouldn't have to keep your thousands of songs on the device? Are you going to download every song one by one to your device to listen to them when you move to another Apple device? All their cloud services seem to be made so they lock you in the Apple ecosystem even more.

<comment><USER2> The cloud is still a relatively new concept, loose at that, and certainly too early in it's conception for definitions such as this. Remember, Steve Jobs isn't selling the cloud, he's selling The Apple Cloud. And as regards music Jobs knows very well today's cellular networks are not capable of streaming music reliably (as Spotify is all too well aware with Offline Mode).

"I'm grateful there are open platforms like Android out there that will compete with Apple. And I'm grateful there are developers who will make use of these platforms to give us extreme uses of tech that would never make it into Apple's cozy padded-wall-land. But as a matter of policy, we're all better off letting Apple behave like a perfectionist chef that doesn't allow salt at his tables. You don't have to eat at the restaurant–there are lots of others–but you'll probably be glad if you do." - Jerry Brito

</comment></comment><comment><USER3> The "i" prefix gives the word a different meaning ;)</comment>


Ruby 2.x Universal RCE Deserialization Gadget Chain - <AUTHOR> https://www.elttam.com.au/blog/ruby-deserialization/ <comment><USER2> For anyone interested in gadget chains for other languages, these Github repos are quite interesting:

\- Java: [https://github.com/frohoff/ysoserial](https://github.com/frohoff/ysoserial)

\- .NET: [https://github.com/pwntester/ysoserial.net](https://github.com/pwntester/ysoserial.net)

\- PHP: [https://github.com/ambionics/phpggc](https://github.com/ambionics/phpggc)

</comment><comment><USER3> This is interesting, although not that novel. Marshal deserialization has always been unsafe, and in > 10 years as a Ruby engineer I've never seen it used in a production system. I would guess that finding a system vulnerable to this exploit would be a more interesting story than the exploit itself.

<comment><USER4> As a pen tester, I wholeheartedly disagree. It's probably more common to see unsafe YAML deserialization, rather than directly deserializing marshaled Ruby objects, but both are impactful and these types of vulnerabilities do exist. Just recently I assessed an application that used unsafe serialization to pass around an object encoded in the value of a cookie. It contained transient data related to the user's session (e.g. what page they last visited). Last year I assessed an application that allowed users to upload YAML files, which would get parsed and deseralized as Ruby objects. Unfortunately I didn't have a universal gadget chain then, so I had to note it as theoretically exploitable in my report. That's troublesome because some clients may take it less seriously.

I'm personally very impressed with this research and I think it does a net good, demonstrating that deserialization of Ruby objects in any form is unsafe when you can't trust the input.

</comment></comment><comment><USER5> I'm trying to interpret what this means. I think it's saying that a previous result showed that `Marshal.load` on user-supplied input gave an RCE if you were running Rails (basically, see the 3 conditions under "Previous Payloads"), but the new result is that `Marshal.load` is _always_ unsafe, with just the stdlib. Does that sound right to other folks?

<comment><USER6> `Marshal.load` was already always unsafe -- what this changes is the difficulty of writing a malicious payload.

Previously (for Marshal anyways, not sure about pickle), you would need to know a least a _little_ bit about how the input is being used, so that you could monkeypatch one of the methods eventually used by it. This makes it possible to get RCE without any knowledge of the codebase.

</comment></comment><comment><USER7> If you wonder how to execute code via git clone:

      $ git clone --config=core.gitProxy=awk 'git://BEGIN{system("cowsay pwned > \x2fdev\x2ftty")}/'
      Cloning into 'BEGIN{system("cowsay pwned > \x2fdev\x2ftty")}'...
       _______
      < pwned >
       </comment><comment>-
              \   ^__^
               \  (oo)\_______
                  (__)\       )\/\
                      ||----w |
                      ||     ||
      fatal: Could not read from remote repository.

      Please make sure you have the correct access rights
      and the repository exists.

<comment><USER8> Why \x2f (in \x2fdev\x2ftty)?

<comment><USER7> Only hostname (i.e. the thing between git:// and the next slash) is passed as an argument to the proxy command, so slashes in the payload had to be escaped.

</comment></comment></comment><comment><USER9> The title is kinda misleading. This should mention Payload for vulnerabilities within the Ruby libs.

<comment><USER4> That is fully captured in the notion of a _universal_ deserialization gadget chain. However, for those not familiar with the concept of gadgets, yes, I can see how it might be a bit confusing at first.

</comment></comment><comment><USER10> The only known way for this to work on a Rails application was setting "Content-Type:application/xml" and then injecting the gadget chain payload to the request data like -

<bang type="yaml"> #{gadget payload} </bang>

But this has been fixed in Rails since CVE-2013-0156- [https://groups.google.com/forum/#!topic/rubyonrails- security...](https://groups.google.com/forum/#!topic/rubyonrails- security/61bkgvnSGTQ)

Is this RCE possible on Rails application having fix for CVE-2013-0156 and using Ruby versions 2 to 2.5 ?

</comment><comment><USER8> The "RCE" acronym is only used in the title, what is it?

<comment><USER11> Remote command execution

<comment><USER8> Aha, thanks!</comment></comment></comment>


Natalie Portman a la justin.tv? - <AUTHOR> http://valleywag.com/tech/exclusive/natalie-portmans-lifecast-258610.php <comment><USER2> If this is true, it would be insane if JustinTV didn't chase this lead. She's the kind of person that could take lifecasting from the nerd audience to the everyone audience really quickly.

<comment><USER3> I would normally be afraid that she would just hire some average geeks on the cheap and broadcast her camera stuff, but people seem to have implied that the justin.tv's have some amazing technology that gives them a big advantage over everybody. I'd be interested in what that technology advantage is, though.

<comment><USER4> Im guessing they only have software advantages...seems unlikely they have actual technology without having an electrical engineer on their team.

<comment><USER2> <http://www.justin.tv/cast#kyle>

Guessed wrong.

<comment><USER4> But from what I have read, they just hacked together off-the-shelves technologies. Making new technology in the semi-conductor industry is often very expensive. Besides the skill set required to hack-together off the shelve technology is not nearly as specialized and difficult as making new circuits/chips.

</comment></comment></comment></comment></comment><comment><USER5> Not to be insensitive to Justin, but his life isn't exciting in a way that attracts the masses to his video feed. Most of the time he's walking around his apartment, or sitting on his couch playing with his laptop. he just doesn't have the charisma that somebody like Natalie Portman likely has.

<comment><USER6> ch...what? I think you mispelled "breasts"

<comment><USER7> If she's walking around with a camera on her head like Justin then you won't be seeing much of her boobs unless she has some kind of weird obsession with them. But we can always dream!

</comment></comment></comment><comment><USER8> I would not call JustinTV a technology startup. They are Web 2.0 company, i.e. they are following myriads of other "SQL to HTML converters" they are experiencing lack of data to stick to DB tables.

They are unique, however, in their attempt at building the actual data for their SELECT statements, as opposed of asking their users to provide their own data for conversion to HTML.

<comment><USER3> Ehm... all hints by people in the know have pointed to significant technology that's invisible to the user. They aren't just content providers.

<comment><USER4> Umm..do any of the people "in the know" as you say, have a technical background other than computer science? Ive heard plenty of people in CS refer to a cool programming language as a new "technology". That may be a technically correct use of the word. But when I hear the word technology I think of faster CPU, smaller ram, more powerful jet engines, a new way to design drugs, etc....

In this particular case of streaming video...i would think smaller more convinent cameras with better bandwidth and easier access to the internet.

<comment><USER3> I'm talking about PG etc saying that they have extra technology, and lookalikes are just fakers. In the know means in this context that people know the justin.tv'ers and know what's going on.

<comment><USER4> ok so CS people only.

<comment><USER9> You don't consider software to be technology?</comment></comment></comment></comment></comment></comment>


MIT and the future of open courseware - <AUTHOR> http://sharing-nicely.net/2011/01/mit-and-the-future-of-open-courseware/ <comment><USER2> I wish people would stop calling this stuff "courseware"; it's not courseware. It's lectures on video, that's all. Courseware is a term invented in the late 60s to describe computer-based educational or training lessons, simulations, programs, tutorials, quizzes, tests, and games that when taken and mastered by a student, qualify for course credit. It's not about sitting and watching a prof give a lecture.

<comment><USER3> What are talking about? Video lectures accompany only few of the published courses. Much more often, it is lecture notes, homeworks, reference cites, old exams, and solutions. Everything to "run" a course. There is no better generic term for it than courseware.

</comment></comment><comment><USER4> I submitted answers to user surveys on Yale and MIT Open CourseWare, glad to see that they're resulting in great improvements.

I have to say I'm more inclined to detailed textbook-style information than the social aspect. OpenStudy didn't quite manage to deliver any greater value to me, just kept me occupied. Maybe I'll revisit now that it's out of beta and the community had probably grown substantially.

<comment><USER5> Most text books are riddled with errors. So I guess as far as content goes the value of groups will be in correcting such errors.

(And perhaps also in _better explaining_ the material by adding notes and linking to external content.)

<comment><USER6> Yeah, that's been happening on Curious Reef a lot (Curious Reef is my website which is similar to OpenStudy).

Here's an example of people working through an issue in a C programming class: [http://curiousreef.com/class/programming- in-c/lesson/1/assgn...](http://curiousreef.com/class/programming- in-c/lesson/1/assgn/4/). There wasn't any issue with the actual book itself, but the discussion is adding value to others who might come across the same problems.</comment></comment></comment>


Show HN: Beta version of a new backlink analysis tool - <AUTHOR> https://beta.linkminer.com/ <comment><USER2> OK, I made two quick queries to check what it did and roughly how it worked, then went to do a "proper" query and got the "You've used your quota for today" message. Which is fair enough, but it would have been nice to be told that before I burned my quota with explorations.

I find the display crowded, but there's a lot there. I wonder if you could provide a "novice" mode that has a lot less detail, but gives significant "bang for buck". Then people can learn how to read the basics, and see that there is more information if they choose to self-identify as "experienced". It might help prevent the "Wall of Stuff" response.

The information appears to be useful, and the fields and abbreviations have pop-ups to name them, even if they don't have complete explanations about their meanings and implications.

In short, I like it, and if I want a tool like this I'd use it. I'm not sure I'd remember where it is if at same random point in the future I wanted the facilities it offers.

That's a problem I've never seen a solution to.</comment>