Amash's Amendment To Defund NSA Program Fails 205-217 - <AUTHOR> http://techcrunch.com/2013/07/24/rep-amashs-amendment-to-defund-the-nsas-domestic-phone-metadata-program-fails-205-217/ <comment><USER2> Copied from the other thread, because it bears repeating:

I think it's important to keep in mind that the 12 vote margin is comfortable for Amash and supporters of new NSA restrictions and uncomfortable for its defenders.

Here's why: opponents of Amash wielded an argument that "split the vote". Representatives who voted against Amash could have done so for one of two reasons:

(1) They actively support providing the NSA with unchecked access to cell phone metadata under the "business records" provision of PATRIOT, _or_

(2) They don't support that access, but can't support a broad amendment that potentially de-funds whole NSA programs, and instead need something finer grained to correct NSA with.

Meanwhile, _everyone_ who supported Amash believes strongly --- so strongly that they're willing to do something disruptive to NSA --- that new checks on NSA are needed.

(I think Amash was a good amendment, if only because it would force the House to do its actual job and carefully regulate intelligence collection; if it caused a temporary shitstorm, so much the better --- it'd be a well-deserved comeuppance for a legislature that has been derelict in its duty to oversee these programs. But you should be aware that opponents of Amash had a persuasive-sounding argument for voting it down _even if you believed new regulations were needed_.)

I think this was a pretty hopeful vote.

<comment><USER3> Agreed: as a British citizen, I find this vote _incredibly_ close.

As an analogy, there is absolutely no political will here to change the status quo regarding unchecked data collection. The two largest political parties would likely be automatically against an equivalent amendment on national security grounds, whipping their members to vote against (and few members would care to break ranks).

As such, no vote would even take place. If it was forced in a full chamber, it would perhaps fall 100-550.

Edited to add: Exemplified by a spending review announced a month ago [http://www.bbc.co.uk/news/uk-politics-23060592](http://www.bbc.co.uk/news/uk- politics-23060592) "3.4% increase in combined budget for intelligence agencies": meanwhile many other budgets are squeezed by 5-10%

<comment><USER4> As a Swiss I'm always amazed how in indirect democracies, 'political will' equates to whatever the top ruling people are up to, depending largely on what lobbyist de jour is paying best as well as the proximity of elections. It's absurd to me to be honest. Why _wouldn 't_ you want a system where (a) the final say can always be cast by people's votes and (b) the government is put together proportionally? This basically mitigates both of these problems: (1) Elections become way less important, so the parties don't throw too much money into them - winning 2% every 4 years, in rare cases an additional cabinet member of 7, just doesn't justify putting hundreds of millions into a campaign. (2) Lobbying is worth much less as well since you can't lobby people very easily.

And yes, I'm aware that every system has flaws and people's votes aren't always sane - but given the alternatives...

<comment><USER5> I am extremely interested in direct democracy, and the possibility of using it for larger populations thanks to technology improvements. To my knowledge the main argument against direct democracy has been "it only works for small groups". Could modern computing and telecommunications change that?

<comment><USER6> The main argument against direct democracy is the danger of majoritarian oppression: e.g. imagine calling a vote to reinstate slavery and succeeding because 51% of the population supports slavery. Having a set of laws like the Bill of Rights that is agreed upon by consensus and enforced by courts is a safeguard against that.

<comment><USER7> There's nothing in direct democracy inconsistent with a constitution securing basic rights and a supreme court enforcing it. Indeed, Switzerland has exactly that: [http://en.wikipedia.org/wiki/Swiss_Federal_Constitution](http://en.wikipedia.org/wiki/Swiss_Federal_Constitution)

The main argument against, as I see it, is the lack of accountability, the prime example being California demanding more spending and lower taxes at the same time. Of course, indirect democracy has done very little to prevent that either.

When Switzerland doesn't pass laws similar to California's, I think it's because they have a much more homogenous society where there is simply a large degree of agreement on how things should be done - and so, the remaining bits lend themselves well to be decided by direct democracy.

That's also my response to the GP: no, no amount of interwebs and technology can turn a large and diverse population that disagrees fundamentally on many important issues into a small and homogenous one that agrees on most things.

<comment><USER8> The Swiss aren't homogeneous, though. They have four official languages and 20% of the country are resident foreigners. The various cantons don't often agree with each other and only 30-40% of the country votes.

<comment><USER4> Thank you. Here it is again, the 'US isn't homogeneous' excuse.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Your representative is probably on Twitter. If you've got an account tweet how they voted and what you think about it. Be polite. You can of course email and call them too to share you viewpoint.

Find your Representative - [http://www.house.gov/representatives/find/](http://www.house.gov/representatives/find/)

Amash vote - [http://clerk.house.gov/evs/2013/roll412.xml](http://clerk.house.gov/evs/2013/roll412.xml)

<comment><USER10> Thanks for the links! I learned who my representative was and sent him a respectful e-mail inquiring about his nay vote.

</comment></comment><comment><USER11> I'm knowingly paying an organization to openly wage cyber warfare and espionage operations on me?

Splendid. At least we may get a few good HPC and IR publications out of it.

Actually, it will probably be outsourced to contractors who will squander it away without producing anything.

Unless, that is, the next 9/11 gets planned using twitter hashtags. Actually, since the Sandy Hook shooter openly talked about his plans on 4chan, I'm guessing that even a twitter campaign would still "pass under the radar".

I bet the only real consequence is that someone will lose a laptop with like, everybody's social security number and financial history on it. It's going to be so awesome.

<comment><USER12> > Actually, given that the Sandy Hook shooter openly talked about his plans on > 4chan, I'm guessing that even that would still "pass under the radar".

Hoax?

[http://www.ibtimes.co.uk/articles/415935/20121217/sandy- hook...](http://www.ibtimes.co.uk/articles/415935/20121217/sandy-hook-newtown- connecticut-adam-lanza.htm)

<comment><USER11> ok fine. Gabriel Giffords shooter posted pictures and details on his MySpace profile prior to the assassination attempt.

And for people like Colleen LaRose or the Underwear bomber, just a web browser and plain-old internet led to the apprehension. With Michael Reynolds, traditional "law enforcement officers posing as honeypots" style did the trick.

These classical methods seem to be working quite alright.

What is the use-case here? Some dastardly secret terrorist conspiracy where they collaboratively make detailed plans, over the internet, in clear text, like this:

\-----

From: firstname.lastname@example.com

Subject: Re: RE: re: re: Re: Secret plans

To: email@example.com

CC: email@example.com, firstname.lastname@example.com, firstname.lastname@example.com

Attachments: annotated-map.pdf

\----

Hey all,

After reviewing the bombing plans of the terrorist attack next Tuesday, set for Washington DC, when the Secretary of State, Jon Carey, is set to arrive by motorcade at 4:15 PM, I've decided that our assassination attempt (where we plan to Kill Jon Carey) would be best suited for a different intersection.

As you can see here, there is a better place to bomb the motorcade.

Also, I've gotten all the parts for the IED. This includes the incendiary, a timer, and all the wiring necessary. I carefully asked a bunch of questions on various open forums and posted pictures to confirm I made everything right. I also disclosed my intended use of the bombs along with my radical political leanings.

Anyway, Down with the USA, and I hope to meet all of you to make this death of a US diplomat a reality, next Tuesday, at 4:15 PM.

Patiently Awaiting Martyrdom,

evilbomber.

P.S.: What's encryption?

<comment><USER13> Speaking from personal experience, I'd recommend not using real names in a fake plot like this.

<comment><USER11> Alright, swapped out.

</comment></comment></comment></comment></comment><comment><USER14> I think this is the end of the cloud. For me (as european) it is now unacceptable to use american webservices and remote apps. We had a good run.

<comment><USER15> _For me (as european) it is now unacceptable to use american webservices and remote apps._

As someone running businesses in Europe, I am genuinely concerned about whether the Safe Harbor scheme still protects us legally if we allow US-based services to use personal data about our customers.

As I understand it, the point of Safe Harbor is to recognise that some US- based companies have data protection measures sufficient to meet the stronger European standards, and therefore to permit the export of such personal data outside the EEA to those trusted partners where this would otherwise be against the law.

Given that the protection that any US-based partner can offer is now known to be limited, and that no-one running a business here could credibly claim not to be aware of that, I don't know where we'd stand legally if a politically active customer decided to make a point. Even if we openly disclose which US- based partners are involved as part of the relevant privacy policy, it still leaves a bad taste in the mouth.

<comment><USER14> It already started. Irish Google has been sued recently for sharing data with american mothership.

</comment></comment></comment><comment><USER16> Twelve votes? That's it? Wow, that's incredible. The first real tide change we've seen since the passage of the patriot act. Those who voted Nay seemed to do so because "metadata isn't covered under the 4th amendment."

Wait until they find out the NSA is raking in the call contents too [1]

[1] [http://www.huffingtonpost.com/2013/06/29/glenn-greenwald- nsa...](http://www.huffingtonpost.com/2013/06/29/glenn-greenwald-nsa-cell- phone-calls_n_3520424.html)

</comment><comment><USER17> Republican: 94 yea 134 Nay Democratic: 111 yea 83 Nay

Pretty close and party lines didn't seem all that important.

<comment><USER18> This surprised me too - especially given the rhetoric I was hearing from the lamestream media about this vote being cast along party lines.

Given that the majority of Dems in the house voted for it - in fact more than Republicans - I think that is a MAJOR, MAJOR rebuke to Obama.

I am sure he will notice that.

</comment></comment><comment><USER19> Would be interested in a consolidated list names of those who voted in favor and against this bill.

<comment><USER12> I would be interested in knowing where I can find this sort of information in general.

<comment><USER20> Senate: [http://www.senate.gov/legislative/LIS/roll_call_lists/vote_m...](http://www.senate.gov/legislative/LIS/roll_call_lists/vote_menu_113_1.htm)

House: [http://clerk.house.gov/evs/2013/index.asp](http://clerk.house.gov/evs/2013/index.asp)

</comment></comment></comment><comment><USER21> Repost from another thread on the same issue:

I really do commend everyone involved in this effort. This is how the system is supposed to work, citizens making their voices know, and the legislature acting upon the will of the people.

Honestly you guys got far closer to your goal than I would have anticipated. The bipartison support was almost unprecedented in recent years.

From a practical matter, even if the House bill passed it was dead on arrival in the Senate. But nevertheless it is a significant symbolic blow to blank surveillance against American citizens.

All I've tried to communicate, perhaps with less than appropriate tact, is that this is going to be a long slog.

If you're going to reign in the surveillance state, you'll need to start thinking like Washington insiders. Pick one incumbent that vocally supported these programs, and take him or her down. That will instantly catapult this issue to the top of the concerns in DC.

It only costs a few million to get that done. Considering the wealth of the tech industry, and the threat this poses to overseas expansion of the US internet services, donations shouldn't be overly difficult to drum up. We could really make a large dent in getting the legislature to help roll back these programs to sane levels. Add to that an anit-SOPA style social media campaign, and you could accomplish real and lasting change.

</comment><comment><USER22> If this is to be fought the time is close at hand. First off if this is played as a left vs right issue it will lose. Second this needs to be won at the primary level. If both the democrat and the republican in a district/state are against it, then it doesn't really matter who wins as far as this issue is concerned. Bonus points if when the debates start, instead of opposite sides of the issue, they try to one up each other on how they will dismantle the surveillance state. I think asking your Representative their stand on this issue as well as any one else who enters the race is a good start but also try to get some sort of pledge that they will work across the isle with the other party to get this done.

This will need at least two election cycles to be successful. Everyone in the house is up for re-election every two years but the senate requires six for everyone to go through the re-election process. I think with some luck, the third senate election cycle might not be needed if enough momentum can be attained. But I think to really succeed it will have to survive a filibuster and possibly a presidential veto.

We can do this if we are willing to put aside our political differences, work together and think long term.

</comment><comment><AUTHOR> I am wondering why we didn't see a /single/ large tech company release something in support of this. Even something as simple as a press release...

</comment><comment><USER23> If congress were to pass some law (over Obama's veto) limiting the intelligence agencies, what is to stop the administration from coming up with a secret interpretation of the new law that effectively ignored it? They are already in violation of current law, as the author of the Patriot Act has stated.

Democracy has been completely subverted at this point. We need impeachments and new anti-secrecy laws.

<comment><USER24> If you don't trust the government to follow the law in the former case, why would you trust them to follow anti-secrecy laws in the latter?

Either the system can possibly work or it can't, you can't say the process is a sham then suggest a legislative solution.

</comment></comment><comment><USER18> Even though I don't have the time to do it, I have a feeling that if you drilled down into the votes some more, you would likely see a pattern/relationship re: authority.

i.e. those in higher authority would have voted it down (Boehner, Pelosi, etc.) and those with less authority supported it. So the powerful preserving their power, with the less powerful challenging it.

That alone can speak volumes about the potential for their power crumbling. Boehner has been on the ropes recently with his caucus warning him to tread carefully.

If that turns out to be the case, then the leadership has big problems. Both in the House and the Whitehouse.

That could be good for the issue over the long-term....which is encouraging to me as a "foreigner".

<comment><USER25> If you're going come up with an interesting theory like that you almost have an obligation to track it down definitely.

Otherwise you're just making an assumption, and drawing conclusions from it without knowing if your assumption is right.

<comment><USER18> I know the feeling, but I figured I would just put it out there and let people more versed at this stuff than I find the relationships, if any exist and let us know.

<comment><USER25> > and let people ...let us know.

That virtually never happens. You have to do the work yourself.

</comment></comment></comment></comment><comment><USER26> The bit about _"...not the product of an informed, open, or deliberative process"_ illustrates the hypocrisy inherent to the ruling class.

They rarely hold themselves to the same standards which they set forth for the proletariat.

</comment><comment><USER27> The votes from members of the Permanent House Select Committee on Intelligence were 2 yes, 21 no.

By party, that was among Democrats 2 yes, 8 no, and among Republicans 0 yes, 13 no.

</comment><comment><USER28> The tool who represents my district actually voted AYE. Maybe there is hope for this body of morons.

</comment><comment><USER29> Is this the will of the people?

<comment><USER30> Not yet, but it's getting closer.

<comment><USER31> Don't assume you're privy to the will of the people.

<comment><USER30> With >50% regularly in polls, I'd say it's a fairly safe bet.

<comment><USER31> Have a look at this poll by WashPost/ABC:

[http://www.langerresearch.com/uploads/1150a3SnowdenandSecuri...](http://www.langerresearch.com/uploads/1150a3SnowdenandSecurity.pdf)

A majority of those surveyed now think Snowden should be criminally charged for his leaking and don't view the surveillance as an unjustified intrusion into people's privacy; interestingly, more people thought it wasn't an unjustified intrusion into their own privacy vs. the privacy of others.

It's just one poll, yeah, but don't assume you know the will of the people.

<comment><USER32> Please correct me if I'm wrong, but in the poll you linked to, the question that's most relevant to Amash's amendment was the following:

        17. Do you think that the National Security Agency's surveillance of telephone
        call records and internet traffic does or does not intrude on some Americans'
        privacy rights?

        Does Intrude: 74%
        Does Not Intrude: 22%
        No Opinion: 4%

<comment><USER33> It clearly does "intrude" whatever that means, the question is: does it intrude illegally or unreasonably? The relevant chart is on page 2: 58% think it's either not an intrusion or a justified intrusion, and 34% think it's an unjustified intrusion.

</comment></comment></comment></comment></comment></comment></comment><comment><USER34> Really interesting thing here is that 12 people didn't vote, exactly the margin of defeat. I wonder how many of them were leaning towards voting for it, and how many of them were strong advised (coerced) to abstain.

</comment><comment><USER35> It's really interesting looking at the people who voted against this -- Nancy Pelosi _and_ Michelle Bachmann?

</comment><comment><USER36> Maybe its a Spectacle for hegelDialectic/divideConquer #pov

</comment><comment><USER37> I read the title as "Amish's Amendment". Wondering what the Amish did to illicit such attention from the NSA.

<comment><USER24> Well, they are practically untrackable under the current surveillance architecture, and they do have those strange beards...

</comment></comment><comment><USER38> Which way did Obama himself vote?

<comment><USER39> He didn't have to, because it didn't pass the House.

However, he's been vocally supporting spying, so it's assumed he would have voted No on this bill.

</comment></comment><comment><USER40> Now you know who runs America.

<comment><USER41> Right, the ones we cannot criticize...

<comment><USER40> The downvotes just proves my point.</comment></comment></comment>


Scylla 10-20X faster than Cassandra in new cluster benchmark - <AUTHOR> http://www.scylladb.com/technology/cassandra-vs-scylla-benchmark-cluster-1 <comment><USER2> Whoha, that's impressive, even more that this is without DPDK.

With DPDK latency should be much better.[1]

[1] [http://www.net.in.tum.de/fileadmin/bibtex/publications/paper...](http://www.net.in.tum.de/fileadmin/bibtex/publications/papers/Network- Latency-Netgames-2014.pdf)</comment>


How Bitfinex strong armed me - <AUTHOR> https://docs.google.com/document/d/1yZD9g5b8prjIlVlAowSB-FLfif26QcRMuNhH5RRe5Ko <comment><USER2> Seems like the same thing gox did, basically find reasons to confiscate users coins to keep the company afloat.</comment>


Money - <AUTHOR> http://xkcd.com/980/huge

<comment><USER2> Average net worth of US Senator: $13,400,000

Average net worth of US representative: $4,900,000

Before looking at this chart, I had a vague notion that senators and representatives are better off than the average american. Turns out they are WAY better off.</comment>


Ask HN: How do you spend those long build times? - <AUTHOR> Since I changed my last job, at my new work place an incremental build (1 liner change) taken on an average of 8 to 10 minutes.
I used to bug my neighbor during these times (often hoping the last change solves the problem in hand).
Recently I have been crusading for some changes to the build system, without any effect on management I am kind of starting to lose hope on that charity project of mine (I would rather work on my personal projects). For a while I even tried working on my own stuffs in this while, however my brain's capacity to context switch is somewhat limited, is what I have realized. Also there is only so much coffee that you can drink in a day!
I was hoping to get some advise or some experiences on this topic. <comment><USER2> Have you tried optimizing your builds so they take less time?</comment>


Show HN: Spamaltman – a Twitter bot based on Sam Altman's blog posts - <AUTHOR> https://twitter.com/spamaltman <comment><USER2> This is pretty cool! I'm sure Sam would get a kick out of this xD</comment>


How to Price your SaaS Application – The Definitive Guide - <AUTHOR> http://www.pluggd.in/how-to-price-your-saas-application-the-definitive-guide-297/

<comment><USER2> From the title, I thought this was going to be more like "how to arrive at the price for your SaaS Application" but it's more like "how to choose the price model for your SaaS Application" which I think is actually easier and less interesting. Still a good summary for anyone interested in this topic who's been living under the ocean for a few years.

<comment><USER3> If that's what you're looking for here's a blogpost I wrote that explains how to use some basic statistics to arrive at exactly the price that maximizes your profits.

[http://www.maximise.dk/blog/2009/01/getting-product- pricing-...](http://www.maximise.dk/blog/2009/01/getting-product-pricing- right.html)

</comment></comment><comment><USER4> "The real number could be arrived by studying competition, market size, target audience, perceived value of your service and many other factors."

It would be helpful if someone did a study on pricing plans of popular web apps and could show how the pricing models affected the overall success of the apps in their own markets.

<comment><USER5> We've started to collect "pricing urls" on Cloudomatic.com I've been thinking of doing a few things with all of these pages. One is: how many plans are there on average? How many have a free trial and average length? Average price for a saas app.

Another is talking to a good chunk of startups and doing a: this is how you determine pricing white paper.

What would be useful to you guys?

<comment><USER6> I'd say yes, but not because I know it will be useful, but because I think it would be interesting to compare people's marketing and customer segmenting strategies.

</comment></comment></comment><comment><USER7> Hi, We are thinking about the same issue. Hence <http://www.techcelerate.org/apr10workshop>. Let us know if anyone fancy joining via video link?</comment>


A Valid JPG/JAR, PNG or FLV After AES and PDF  After 3DES Decryption - <AUTHOR> https://code.google.com/p/corkami/source/browse/trunk/src/angecryption/PoCs/ccc.txt

<comment><AUTHOR> Actual file download here: [https://corkami.googlecode.com/svn/trunk/src/angecryption/Po...](https://corkami.googlecode.com/svn/trunk/src/angecryption/PoCs/ccc.jpg)

AES/3DES setups in here: [https://code.google.com/p/corkami/source/browse/trunk/src/an...](https://code.google.com/p/corkami/source/browse/trunk/src/angecryption/PoCs/ccc.py)</comment>


Smalltalk-72 Instruction Manual (1976) [pdf] - <AUTHOR> https://pdfs.semanticscholar.org/442f/0f5205c7d4674612204ecc8357367dabbf45.pdf <comment><USER2> While I was working on optimizing the Python runtime (internally, at a FAANG company), an unexpected resource that I learnt a ton from was the SmallTalk Blue Book[1]. A lot of the lessons learnt from implementing Smalltalk and Self runtimes in resource constrained computing environments available back in the 70s and 80s are still very relevant today.

One of my former colleagues from that team used to often joke about how the Self[2] team was effectively cheating with hidden classes and inline caching in the late 80s, because they had workstations with 64 megs of RAM whilst almost everyone else had to contend with a megabyte or less of RAM.

[1]: [http://stephane.ducasse.free.fr/FreeBooks/BlueBook/Bluebook....](http://stephane.ducasse.free.fr/FreeBooks/BlueBook/Bluebook.pdf)

[2]: [http://bibliography.selflanguage.org/_static/self- power.pdf](http://bibliography.selflanguage.org/_static/self-power.pdf)

</comment><comment><USER3> I have the orange (the envirnoment) and purple (the langauge) Smalltalk-80 books. They're really lovely and immensely thoughtful. I know everything is all functional right now, but I still feel Smalltalk never got it's day in court. I don't think most devs realize what's actually there. It's amazing tech that's never been widely enough appreciated. I think old Smalltalkers who know are just sad about it.

</comment><comment><USER4> I tried writing a ST for the Z-80 and then the first PC, but I bit off a bit more than I could chew considering I wasn't taking the minimal language approach (like "A little Smalltalk") but was trying for the self-bootstrapped whole VM and I had no image available so I had to try and wire everything up in a magical state -- still a great exercise though. I've tried ST on Tektronix and the Apple Lisa.

A GUI dev. environment ahead of its time, though "image save"-based development with classes strewn around everywhere isn't the best model for development, nevermind delivery where you never know what your code is going to be running next to. ST is also largely to "blame" for single receiver dispatch, and to a less extent the overuse of implementation inheritance, as most languages for performance don't have messages as first-class objects meaning that delegation becomes harder so inheritance was used over composition in most OO languages following. (Though you can use monkey- patching in langs that support it.)

<comment><USER5> > …though "image save"-based development with classes strewn around everywhere > isn't the best model for development…

What do you mean "classes strewn around everywhere" ?

"Smalltalk-80 The Interactive Programming Environment" chapter 23 explains the different ways class definitions, comments and methods could be saved to text files; and filed into a vanilla image in a standard build process.

[http://sdmeta.gforge.inria.fr/FreeBooks/TheInteractiveProgra...](http://sdmeta.gforge.inria.fr/FreeBooks/TheInteractiveProgrammingEnv/TheInteractiveProgrammingEnv.pdf)

> …nevermind delivery where you never know what your code is going to be > running next to.

Do you mean you never know what non-smalltalk code would be running on the same machine as the smalltalk code ?

Why would that be a problem ?

Why would that be more of a problem with a Smalltalk image than with .pyo ?

<comment><USER6> The issue on Smalltalk 80 was that diffing and combining images was a huge pain. There wasn't a clear seperation between the system itself and whatever you were working on. On top of that, Smalltalk VMs generally assumed that they were the only Smalltalk VM running on a given system so it's not like you could run the different apps like different containers or processes, or whatever. Additionally Smalltalk pretty heavily encouraged making modifications to the system classes as part of the porting process.

So, not the OP, but my answers to your questions:

>What do you mean "classes strewn around everywhere" ?

It was rarely clear where your classes ended, and the system ones began, which got in the way of distribution, particularly if you wanted to run on different hardware. It was surmountable, but a pain in the ass compared to Unix (which is not really the world's highest bar, particularly at the time).

> Do you mean you never know what non-smalltalk code would be running on the > same machine as the smalltalk code ?

> Why would that be a problem ?

It's what's versus running in the same VM image, including modifications to the system classes themselves. There's no good boundary between apps other than they don't have references to eachother.

>Why would that be more of a problem with a Smalltalk image than with .pyo ?

Because a .pyo only has the classes that pertain to what it's trying to do, and doesn't stop you from running other python instances at the same time. Imagine if there was only one python vm allowed to run at once, the source was an afterthought (and considered not idiomatic), and pyos were basically just memory dumps each with their own unique monkey patching of system classes.

There's a good chance that squeak/pharo have done work to address this, but that was the state of the world for Smalltalk 80. It was designed right at the cusp of collaboration on design of personal computer apps, and it shows in the overall design.

<comment><USER7> > There wasn't a clear seperation between the system itself and whatever you > were working on.

Another serious issues is that people routinely modified the system classes. Once you had imported a few large libraries there would be any number of changes to classes like Object that would cause the libraries to mis-behave if they went missing or were changed. As nice as it was to be able to mod anything, I think it hurt reliability.

<comment><USER5> _> …people routinely modified the system classes._

People!

What can be done?

— reject libraries that change system classes?

— accept that library version G is said to work with system version F, and may not work with system version Q?

— accept that along with library source code comes the burden of resolving library conflicts?

</comment></comment></comment></comment></comment><comment><USER8> Here is a long list of free online Smalltalk books

[http://stephane.ducasse.free.fr/FreeBooks.html](http://stephane.ducasse.free.fr/FreeBooks.html)

</comment><comment><USER9> Dan Ingalls himself presenting his continued work in the browser at JSConf US 2012 (whole conf was packed in, standing-room only): [https://youtu.be/QTJRwKOFddc](https://youtu.be/QTJRwKOFddc)

Surprised that video has so few views!

<comment><USER10> Here is his Smalltalk-72 implementation on the Alto/Nova emulator on the LivelyWeb!

[https://lively-web.org/users/Dan/ALTO-Smalltalk-72.html](https://lively- web.org/users/Dan/ALTO-Smalltalk-72.html)

</comment></comment><comment><USER11> Oh cool, I will compare with my smalltalk-80 book that just arrived today!!</comment>


Ask HN: Best privacy focused cell phone? - <AUTHOR> <comment><USER2> Cellphones unfortunately are not compatible with privacy. A laptop connected to the internet via WiFi is the only secure mobile option. Even with an open source GSM FPGA, you would be limited to 2G, and you probably want 4G.

The option just doesn't exist.

Librem 5 is the closest option, but still the cell companies will sell your location.

<comment><USER3> Would rotating prepaid SIM cards on a monthly/quarterly basis help with this?

<comment><USER2> No, because KYC is required for all SIMs.

<comment><USER4> Maybe in your country, but that is not the case in every country.

</comment></comment></comment></comment><comment><USER5> I'm happy with LineageOS running on a Pixel, no Play Services and only open source applications installed over adb.

</comment><comment><USER6> Ubuntu Touch is 100% garbage. I tried it for a few months.

<comment><USER7> Agree</comment></comment>


Introduction to sed - <AUTHOR> http://www.catonmat.net/blog/worlds-best-introduction-to-sed/

<comment><USER2> Flagged for excessive self-promotion. Take out "World's best" or make the article provide strong evidence that it's the world's best beyond the fact that _its author_ thinks it is, and I'll unflag it.

If this didn't have "World's best" in the blog title and someone had added that to the HN title, a moderator would be deleting those words. The fact that you've inserted the same peacock words in your own blog title as well as your HN submission does not make this any better.

(I don't like being so blunt with a highly regarded veteran HN user, but abuse is abuse whoever does it. Sorry, Peteris.)

[EDITED to add: The HN guidelines say not to comment saying "I flagged this". I think this is an unusual case. I appreciate that others may disagree.]

<comment><AUTHOR> Thanks for letting me know. I just removed the "World's best." I just thought I'd name it "World's best" cause I was feeling fantastic today. :)

<comment><USER2> Unflagged. Thanks.

<comment><USER3> But the word "World's Best" is still there in the URL, even in the Page Title and the article title. boo !!

</comment></comment></comment></comment><comment><USER4> The introduction was alright, but I'm not sure that the hold buffer needs to be introduced straight away. Using the hold buffer can get complicated pretty quickly, and it isn't something that you'll frequently have to do. The example the author gives of getting lines matching a regex with the previous line is more easily done using grep -B1, which doesn't require the mental overhead of sed scripting.

Perhaps more useful for an introduction would be retaining portions of the input back-references (\1 to \9) and `&'. Also useful is is the `g' flag for the `s' command, for global replacement, and the `i' flag (a GNU extension) for case insensitivity. Another note is that you can actually use any character to delimit `s' commands you want, which is useful if you have /'s in your pattern or replacement strings. The last main part of sed which I use regularly is the -r option, for extended regular expressions (basically the same as grep), which lets you use regular expression tokens like + and | without escaping. On that note, the author misses this point in his introduction, and the example of "sed -n '/a+b+/p'" should actually be either "sed -rn '/a+b+/p'" or "sed -n '/a\\+b\\+/p'".

For a serious introduction to all the extra functionality in sed, there's a great reference at the top google result for sed[1]. In addition, GNU sed adds functionality that you might be useful at some point (e.g. s///e), all of which are described in the GNU sed user's manual[2].

[1] <http://www.grymoire.com/Unix/Sed.html> [2] <http://www.gnu.org/software/sed/manual/index.html>

<comment><AUTHOR> Thank you, this is a really great comment! I'll improve my introduction based on your feedback to make it better.

</comment></comment><comment><USER5> Are there any HN reviews of this guys eBooks? I think he has two on SED and I'm a little leery of self promotion although the preview was pretty good.

<comment><USER6> I've got both one-liners books (Sed and Awk). Peteris takes a very practical approach in the book. I almost think of it like a field guide. Think of the times you've google searched for something like 'number lines in file sed'. These books not only provide solutions, but give detailed explanations of what's happening. Pick any given example and there's a good chance you'll gain some insight about how sed/awk work. They're very well written, and very accessible.

Having said that, if you're a long beard who has long been acquainted with these tools, you could maybe skip them.

</comment></comment><comment><USER7> As the author also explains in the introduction, the compilation is based on the earlier compilation by Eric Pement, available as .txt files on his website.

<http://www.pement.org/sed/sed1line.txt>

<http://www.pement.org/awk/awk1line.txt>

</comment><comment><USER8> To quote "The Awful Truth about sed" section of the Grymoire, "It is not your fault you don't understand sed."

I do, however, understand Perl, so that's what I use. E.g.: `echo 'fubar' | perl -lpe 's/fu/foo/'`

It might be a few milliseconds slower-- for example, commenting every line of my 352-line .zshrc (via s/^/#/) takes 0.007s total with Perl (so does `s/^/#/ unless /^\s*#/`) and 0.005s with sed. Commenting out every line of /usr/share/dict/american-english (98569 lines) takes 1.124s with Perl and 0.813s with sed.

Since I already know how to do more complicated things with Perl (like conditionals, named backreferences, etc.) it doesn't seem worth it to take the time to learn how to use sed effectively. I can wait the extra second since I'm not on any kind of deadline or under any efficiency constraints.

I am not trying to say that Perl is better than sed or any other text processing tool. I also don't mean to imply that speed is sed's only advantage-- it's just one example. I think that for someone who already knows some Perl, learning another similar tool doesn't make sense. I'm sure there are exceptions. This is only my humble, personal opinion.

For people who do need/want to learn sed, the article did a pretty good job of showing you how to get a lot done without a whole lot of reading.

<comment><USER9> however, perl has -i, which not all seds do, so those 0.002 seconds you lost to perl will be more than gained by being able to type

          perl -pi -e 's/foo/bar/' somefile

instead of

          sed 's/foo/bar/' somefile > somefile.tmp && mv somefile.tmp somefile

<comment><AUTHOR> Sed has -i, too! Well, at least GNU sed.

<comment><USER9> yes, that's why i said "not all seds".

<comment><AUTHOR> missed it. sorry!

</comment></comment></comment></comment></comment><comment><USER10> I dont know if this off topic but is there an utlity that can parse C files and print all the function names or local variable names for example.

I know it can be done through sed,but a perfect regex for parsing functions and nothing else can be complex and I am wondering if someone has already done it.

<comment><USER11> Look at what the perl script at <http://www.gson.org/egypt/> does -- if you are using gcc, you can compile with certain options to generate info from the source code into an intermediate file and then parse this intermediate file with a script to get the info you need. A bit complex, but useful if you are trying to read through code you are maintaining. A compiler is better than a regex for this, I think, for C.

Also ctags/etags like another comment mentioned as also the cscope utility.

<comment><USER10> I checked out Egypt.It is pretty cool but unfortunately it doesnt seem to have support for Objective C.

</comment></comment></comment><comment><USER12> I'll just leave this here...

        s/&/&/g

Sorry! :D</comment>


Microsoft will be carbon negative by 2030 - <AUTHOR> https://blogs.microsoft.com/blog/2020/01/16/microsoft-will-be-carbon-negative-by-2030/ <comment><USER2> Alright, I'll drink the Kool-Aid. I think this is an excellent strategic investment for Microsoft that also aligns with timely ethical priorities. I didn't read the post and think "this is corporate glossy bullshit," I read it and thought "this is an actual strategic initiative that is driving broad organizational alignment, which has measurable success criteria, and which makes sense."

I am genuinely surprised by the sincerity, cogency, and aspirational nature of this initiative and its associated PR glossies.

I am measurably more likely to work at and invest in Microsoft after reading this.

I guess they've hacked my demographic?

<comment><USER3> Should I be satisfied if you're doing the right thing for the wrong reasons? I'm always unsure about this. If a politician is making all the right noises, but clearly doesn't care about the topic, should I be satisfied? I really don't know. That's how I feel about this, it's clearly a PR move, but I think I'm happy about that?

<comment><USER4> > Should I be satisfied if you're doing the right thing for the wrong reasons?

I tend to think YES, assuming you're _actually_ doing the right thing instead of just _saying_ you're doing the right thing. For example, when good ideas happen to coincide with profit motive, I think that's a wonderful thing, and really the best-case scenario in a market economy. Apple's seemingly genuine focus on privacy is a perfect example: many people criticize it as being driven only by profit (perhaps as a way to compete with Google), while I say it's great if that's true!

<comment><USER5> I just want to mention that apple has been 100% renewable for a while now, and publish a detailed environmental report; [https://www.apple.com/au/environment/pdf/Apple_Environmental...](https://www.apple.com/au/environment/pdf/Apple_Environmental_Responsibility_Report_2019.pdf)

<comment><USER6> Yeah but they rely heavily on Chinese companies that are not 100% renewable. That's like someone saying they have never murdered anyone while routinely paying for hit men to get their hands dirty. Technically correct, but misleading.

<comment><USER5> I'm not sure what you're arguing, that nobody's perfect? Microsoft is aiming here to be carbon neutral in 2030. In ten years.

From my linked report; A more energy efficient supply chain.

In 2015, we started engaging directly with suppliers to help them reduce their energy use. We aim to educate them about energy efficiency, identify energy efficiency project opportunities, and manage those projects to completion. We prioritize facilities with the highest energy use and potential for improvement. Then we conduct energy audits and train suppliers to uncover opportunities for energy efficiency—like replacing outdated or inefficient heating, cooling, and lighting systems; repairing compressed air leaks; and recovering waste heat. The assessments provide suppliers with a cost-benefit analysis for implementing energy efficiency improvements. Since the inception of this program in 2015, we have engaged 59 suppliers at 85 facilities. In 2018, our program implemented energy efficiency measures that prevented 466,000 metric tons of CO₂e from entering the atmosphere.

So they are working with suppliers and have been for the past 5 years. They also have been cleaning up the chemicals their suppliers use.

You can't compare what they are doing to murder; it's legal for starters. But if you're relying on all the companies you do business with to make up your definition of 100% renewable, it's likely you'll never get there. They don't say anything about the energy used by the banks they do business with either.

<comment><USER7> In the article, Microsoft says they are carbon neutral _today_. They make a distinction between being carbon neutral—offsetting all their emissions—and being "net zero". The latter is harder because it requires actually removing carbon from the atmosphere, not just paying someone else not to emit carbon.

They also make a distinction between Scope 1 (direct emissions), Scope 2 (emissions created by energy providers), and Scope 3 (emissions created by suppliers). Their Scope 3 emissions are two orders of magnitude higher than their Scope 1 emissions, if I'm remembering it right. Their commitment is to be net negative _including_ Scope 3 emissions.

I was impressed. They went well above and beyond a simple PR move.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> The bigger, of course also more distant and vague, announcement is that "by 2050 Microsoft will remove from the environment all the carbon the company has emitted either directly or by electrical consumption since it was founded in 1975."

<comment><USER9> Begs the question does this include the inefficiencies in its products over the years, which due to their breadth of their adoption, effected hundreds of millions of computers?

I'm thinking the carbon footprint of Windows update's endless (seemingly needless?) grinding and rebooting alone ends up being more than they ever emitted manufacturing and building software.

<comment><USER10> How would they decide that some computation was "needless"? If it was the best they could do at the time I'd argue it wasn't needless. If they were intentionally wasting CPU/energy for no reason it would be a different story.

</comment></comment></comment><comment><USER11> Something I notice regularly on large companies and universities, literally any organization which is bigger then a single building: The vast amount of energy waste.

This starts at heating rooms like crazy (because it is unmanaged), having unneccessary equipment, computers and lights running all night (because they are unmanaged) and goes up to transportation. It's so simple things like truck drivers who prefer to keep their diesel running during loading/unloading. I guess they do so because either they were told by incompetent managament, have the wrong belief that their batteries could not power the lights, or some other disbelief.

Saving energy starts in the small, also if started by something big. Having said that, I guess a company of the size of Microsoft will have a huge potential to save energy.

<comment><USER12> Indeed, also at every tech office I've worked at, late at night I'd see all the lights in the entire building on until 11pm on the chance the cleaning crew might still be emptying a wastebasket.

Not to mention the nightly vacuuming of entire floors. A waste of energy and time, that also made it really hard to get work done without noise cancelling equipment.

<comment><USER13> The worst is just empty buildings waiting for a tenant that blaze lights 24/7

<comment><USER14> salt on the wound is when you see a new mixed use apartment with the vacant retail on the ground floor being a pit of coarse gravel before a tenant (and their custom floor) are found, but lit up like a target all the same.

</comment></comment></comment></comment><comment><USER15> 30,000 employees drive their cars every morning to their suburban campus, conveniently located in unincorporated land between Redmond and Bellevue. Are they going to neutralize that CO2?

Do they have a plan to prevent employees from driving 20 miles each way every day? Their new campus renovation has tons of parking for cars. Any bike lanes? Bus stops?

<comment><USER16> That would Be categorized as type 3 emissions, which they intend to cover.

<comment><USER15> business travel is different from commute. they chose to save money by building away from where people live. most of their employees drive, redmond campus has more than 15,000 parking spots.

vendors and contractors are not allowed to use shuttles and connectors, that probably adds another 5,000 cars

i want to believe they want to right their wrongs, but their initial decision to be far away from any population area has contributed a lot of co2 over the last 30 years.

</comment></comment></comment><comment><USER17> >There's another aspect of carbon math that's also essential. This is the difference between being "carbon neutral" and being "net zero." While they sound similar, in fact they're different.

>Given common usage, companies have typically said they're "carbon neutral" if they offset their emissions with payments either to avoid a reduction in emissions or remove carbon from the atmosphere. But these are two very different things. For example, one way to avoid a reduction in emissions is to pay someone not to cut down the trees on the land they own. This is a good thing, but in effect it pays someone not to do something that would have a negative impact. It doesn't lead to planting more trees that would have a positive impact by removing carbon. In contrast, "net zero" means that a company actually removes as much carbon as it emits. The reason the phrase is "net zero" and not just "zero" is because there are still carbon emissions, but these are equal to carbon removal. And "carbon negative" means that a company is removing more carbon than it emits each year. While we at Microsoft have worked hard to be "carbon neutral" since 2012, our recent work has led us to conclude that this is an area where we're far better served by humility than pride. And we believe this is true not only for ourselves, but for every business and organization on the planet.

>Like most carbon-neutral companies, Microsoft has achieved carbon neutrality primarily by investing in offsets that primarily avoid emissions instead of removing carbon that has already been emitted. That's why we're shifting our focus. In short, neutral is not enough to address the world's needs.

>While it is imperative that we continue to avoid emissions, and these investments remain important, we see an acute need to begin removing carbon from the atmosphere, which we believe we can help catalyze through our investments.

> Solving our planet's carbon issues will require technology that does not > exist today. That's why a significant part of our endeavor involves putting > Microsoft's balance sheet to work to stimulate and accelerate the > development of carbon removal technology. Our new Climate Innovation Fund > will commit to invest $1 billion over the next four years into new > technologies and expand access to capital around the world to people working > to solve this problem. We understand that this is just a fraction of the > investment needed, but our hope is that it spurs more governments and > companies to invest in new ways as well.

This is one of the most exciting and potentially impactfull announcements. My biggest issue with companies that make a big deal about being "carbon neutral" and "carbon offsets" is that many times it is "voodoo accounting" in which they pay money to another company which claims to have prevented some carbon emission in an unaccountable developing country. Basically, these carbon fees just are another form of indulgences in which rich people pay money to be able continue their sins while feeling good about themselves.

However, "carbon removal" is a game changer. Based on human nature, I do not believe we will be able to change behavior enough to save ourselves. I think our only hope of preserving our civilization is with carbon removal technology.

That is why I am so glad that Microsoft is specifically focusing on this. If other large companies did this, I think there is a good chance that we could innovate our way out of the climate change crisis.

<comment><USER18> If they take every dollar Chevron is paying them to enhance oil recovery with deep learning and then put it in this climate innovation fund then maybe I'd believe them.

</comment></comment><comment><USER19> Carbon-negative like in reality, or by outsourcing dirty jobs like how Germany is the greenest country by dumping their garbage in Poland?

<comment><USER20> While I agree with the point you are making, it must be noted that garbage is not "dumped", like someone is throwing stuff across a wall. I am sure Poland is paid lots of money to take the garbage.

<comment><USER21> There should be a ban on exports, unless it is proven they are recycled.

You buy garbage from Germany to recycle in Poland. You store it in some field temporarily, before the recycling. You set them on fire, getting rid of the problem. To avoid liability you blame the badly recycled trash e.g. candles. Now it's hard to do in Poland, since the regulations have changed, but I bet you could pull it off in Ukraine.

</comment></comment></comment><comment><USER22> > At Microsoft, we expect to emit 16 million metric tons of carbon this year.

So, Microsoft emits as much carbon as the whole of Ireland? Or did I get it wrong?

[https://en.wikipedia.org/wiki/List_of_countries_by_greenhous...](https://en.wikipedia.org/wiki/List_of_countries_by_greenhouse_gas_emissions)

(1 ton of carbon = 3.67 tons of carbon dioxide)

<comment><USER7> That includes 12 million tons from their supply chain, IIRC.

</comment></comment><comment><USER23> It is important to have goals to work towards, good luck to you Microsoft and thanks for leading the way!

</comment><comment><USER24> I have not seen anything in this letter than #2 Cloud provider in the world is going to be carbon-neutral in 10 years.

Just because I have not seen does not mean its not there. But the meat and potatoes are missing -- especially a company that is building massive data- centers around the world.

<comment><USER7> They said they are already carbon neutral. Now they are aiming for net zero or lower and also including their supply chain. They included quite a few concrete details about how they will do it, including an internal carbon "tax."

</comment></comment><comment><USER22> Is their carbon accounting public? Is anybody auditing it? Not really familiar with how this works. Quick googling didn't turn up anything. Could anyone point me in the right direction?

</comment><comment><USER25> What about sales and operation of PCs running Windows?

</comment><comment><USER26> Does Microsoft take ownership of all the wasted electricity / carbon due to their mandatory updates?

</comment><comment><USER27> We still shouldn't let them off the hook for their invasive telemetry lately, but for such a large, energy hungry company to be carbon negative is legitimately a great thing.

</comment><comment><USER28> That's all great, but it's not really enough. We're past the point of no return for global warming unless we remove carbon dioxide from the atmosphere.

How come Microsoft or Bill Gates don't invest in better CO2 scrubber technology that might make that feasible? Or do they and I just haven't heard of it?

Then again, maybe such a thing could become a "weather weapon".

<comment><USER29> This article is talking about removing CO2 from the atmosphere, did you not read it before commenting?

> How come Microsoft or Bill Gates don't invest in better CO2 scrubber > technology that might make that feasible? Or do they and I just haven't > heard of it?

Bill Gates is doing just that: [https://www.theguardian.com/environment/2018/feb/04/carbon-e...](https://www.theguardian.com/environment/2018/feb/04/carbon- emissions-negative-emissions-technologies-capture-storage-bill-gates)

<comment><USER30> also probably noteworthy to add that Microsoft is a private firm who is not directly incentivized economically to do this (apart from maybe attracting some environmentally conscious workers), so this is already quite a lot.

It says much less about Microsoft and much more about the political state of affairs that a company appears more forward-looking than most other institutions. It's quite sad really.</comment></comment></comment>


Looking for a cofounder? Come to the new OpenCoffee Cambridge June 4th. - <AUTHOR> http://nabeel.typepad.com/brinking/2008/05/looking-for-a-c.html

<comment><USER2> OpenCoffee is a great place to hang out and meet folks.

Here's a sweetener: anyone who shows up gets a beta invite to my startup.</comment>


If true , largest scam in India so far . - <AUTHOR> http://jgopikrishnan.blogspot.com/2009/03/spectrum-scam-indias-mother-of-all.html

<comment><USER2> India uses strange currency units:

1 crore = 10M rupees

1 rupee = 1/45 USD

So the damage is estimated at around $1.33bn

Note that this is not a scam in the standard sense, but simple corruption. It's probably even going to benefit individual subscribers due to the lower infrastructure costs of the operators.</comment>


NASA might build its very first Warp Drive - <AUTHOR> http://io9.com/5963263/how-nasa-will-build-its-very-first-warp-drive/

<comment><USER2> I've been reading the Culture series by Ian M. Banks (RIP) recently and have been fascinated by the idea of an underlying energy grid between universes, and how that is used to power spacecraft moving at 1000x multiples of the speed of light.

What is even more interesting is how the ideas of scifi from decades ago - considered outrageous at the time - are now coming true. The possibilities of even near-light-speed are endless, much less actually being able to exceed it.</comment>


It's the 21st century – why are we all working so hard? - <AUTHOR> http://www.theguardian.com/commentisfree/2012/jul/01/why-are-we-working-so-hard <comment><USER2> Entrepreneur employ Labor 1 and Labor 2 > Technology increases productivity > Entrepreneur greedy > Entrepreneur fire Labor 1 > Labor 2 keeps working hard, Labor 1 becomes lesson for Labor 2.

Alternatively, Entrepreneur employ Labor 1 and Labor 2 > Clinton negotiates trade deal > Entrepreneur shift jobs to China > Labor 1 and 2 fired, now compete in a reduced job market > New Entrepreneur now uses Labor 1 and Labor 2 as uber fodder

Alternatively, Labor 1 lives in the United States > Labor 1 therefore judges self-worth by his work > Labor 1 therefore works hard because it gives his life meaning

And so on.

The summary answer to this question is that we're structurally fucked. The only determinant of how hard labor can be pushed is labor power, and labor power is pretty low. The capitalist will colonize every last corner of the earth before he gives the worker any dignity, and probably not even then.

</comment><comment><USER3> Wealth is not a fixed sum. When a machine comes along and automates 50% of our labor, we (not we literally, but 'we' as a system) have two choices to make: 1) Accept that our jobs are now 50% easier; or 2) find twice as much work to do. The latter is what seems to happen every time technology automates _processes_ and _procedures_ especially. Take email's replacement of the telephone, for instance. There are only so many calls you can place in a day, and therefore only so much value those calls can generate. But you can send hundreds of emails and accomplish much more work than you could with your phone -- and also generate lots more value. When capitalism is given the option to generate more value, capitalism tends to take that option.

As productivity grows, we choose to reinvest that productivity gain in more work, resulting in more systemic wealth creation. This becomes a sort of treadmill, and damned if I know how we get off of it. When we routinize and automate something, we always seem to find a higher-order task to take on in its place. The result is that our world is wealthier than ever (in the economic sense of the word). The unfortunate side effect is that we seem to be working harder than ever.

Tl;dr: Machines make our jobs easier, so we squeeze more work and more complex tasks into the vacuum created by the automation. This process repeats itself.

<comment><USER4> A huge part of the problem is that improved productivity leads to higher housing prices. Solve housing, or the flip side of that coin, transportation, and you can start extracting significant quality of life improvements from higher productivity.

</comment></comment><comment><USER5> Because automation is increasingly used to transfer wealth from the middle- class to the super rich (at least in America).

There have been many studies: eg [http://www.motherjones.com/politics/2011/02/income- inequalit...](http://www.motherjones.com/politics/2011/02/income-inequality- in-america-chart-graph)

</comment><comment><USER6> Because if we stopped working so hard, all the existing processes would fail immediately. (automation requires constant care by humans).

</comment><comment><USER7> Because we are nudged to cover costs of artificial habits.</comment>


Scientists in Germany, Peru and Taiwan to Lose Access to Elsevier Journals - <AUTHOR> http://www.nature.com/news/scientists-in-germany-peru-and-taiwan-to-lose-access-to-elsevier-journals-1.21223 <comment><AUTHOR> I bet the nonchalance here has a lot to do with Sci-Hub. Although supplementary materials are still a problem there.</comment>


Former Uber executive charged with paying 'hush money' to conceal breach - <AUTHOR> https://www.npr.org/2020/08/20/904113981/former-uber-executive-charged-with-paying-hush-money-to-conceal-massive-breach <comment><USER3> Just read the federal complaint, my highlights and summary:

\- Hackers downloaded a bunch of PII from Uber

\- Uber CISO paid them a 100k bounty with bitcoin to sign an NDA with their hacking handles, but they wouldn't give real names

\- Uber staff traced them down, found their real names, then met them in person and got them to sign NDAs with real names

\- FTC is mad because CISO tried to make it seem like it wasn't a data breach vs bug report through the bounty program.

\- Their 2014 breach was from "an AWS access ID and secret key in software code posted to GitHub"

\- In 2016 to FTC "SULLIVAN elaborated that it was common at the time to write access IDs and other secrets directly into code when that code needed to call for information from another service." \- oof

\- SULLIVAN received an email from "email@example.com" claiming to have found a "major vulnerability in uber," and that "I was able to dump uber database and many other things."

\- _in 2016 breach, the hackers used to stolen credentials to... get the AWS keys that were still in their github code, but was now private_

-"Similarly, Uber argued that the industry at large had become more adept since 2014 at protecting private data in the cloud, and that Uber should not be judged for "what a company did then (back when the company was much smaller and the technology at issue was evolving) according to the standards that the agency thinks are appropriate now (given the current sophistication of the company and current industry best practices)." Uber made these arguments via letter in April 2017, approximately five months after the 2016 Breach."

[https://assets.documentcloud.org/documents/7041237/Joseph- Su...](https://assets.documentcloud.org/documents/7041237/Joseph-Sullivan- Complaint.pdf)

<comment><USER4> > "Similarly, Uber argued that the industry at large had become more adept > since 2014 at protecting private data in the cloud, and that Uber should not > be judged for "what a company did then (back when the company was much > smaller and the technology at issue was evolving) according to the standards > that the agency thinks are appropriate now (given the current sophistication > of the company and current industry best practices)." Uber made these > arguments via letter in April 2017, approximately five months after the 2016 > Breach."

I've been hearing this argument for decades, and every time it's been earnest but transparent blame-shifting. "The industry didn't understand security risks back then." "No one could have predicted this." The risks were well known back then by anyone who cared about risks.

<comment><USER5> Companies don't give a shit about security until it's too late. Security is a complex beast and I have yet to meet a developer who understands it top to bottom (nor should they but I would expect even juniors to know they should not store creds in the git repo). It's an increasing specialist role that startups rarely hire for because they're focusing on survival and growth so it's to be expected this story will repeat ad nausea.

</comment></comment></comment><comment><USER6> Just to be clear, the complaint charges Sullivan under these two federal criminal statutes:

18 U.S. Code § 1505. Obstruction of proceedings before departments, agencies, and committees -- [...] Whoever corruptly, or by threats or force, or by any threatening letter or communication influences, obstructs, or impedes or endeavors to influence, obstruct, or impede the due and proper administration of the law under which any pending proceeding is being had before any department or agency of the United States, or the due and proper exercise of the power of inquiry under which any inquiry or investigation is being had by either House, or any committee of either House or any joint committee of the Congress—

Shall be fined under this title, imprisoned not more than 5 years or, if the offense involves international or domestic terrorism (as defined in section 2331), imprisoned not more than 8 years, or both.

18 U.S. Code § 4. Misprision of felony -- Whoever, having knowledge of the actual commission of a felony cognizable by a court of the United States, conceals and does not as soon as possible make known the same to some judge or other person in civil or military authority under the United States, shall be fined under this title or imprisoned not more than three years, or both.

18 USC § 4 is independent of any federal investigation, unlike § 1505. The complaint itself lists quite damning facts. Have a read, it's quite readable. [0]

[0] [https://assets.documentcloud.org/documents/7041237/Joseph- Su...](https://assets.documentcloud.org/documents/7041237/Joseph-Sullivan- Complaint.pdf)

<comment><USER6> There's a recent case on Misprision of felony from the 9th Circuit, which has jurisdiction over California. [0]

"The panel affirmed the long-established federal rule that "[t]o establish misprision of a felony," under 18 U.S.C. § 4, "the government must prove beyond a reasonable doubt: '(1) that the principal . . . committed and completed the felony alleged; (2) that the defendant had full knowledge of that fact; (3) that he failed to notify the authorities; and (4) that he took affirmative steps to conceal the crime of the principal.""

[0] [https://www.whitecollarbriefly.com/2017/06/07/9th-circuit- cl...](https://www.whitecollarbriefly.com/2017/06/07/9th-circuit-clarifies- elements-of-misprision-of-felony/)

</comment></comment><comment><USER7> It seems to me that Kalanick was often "aware" of things but conveniently avoids scrutiny. How is this? Uber did so many questionable things under his leadership. And he managed to totally dodge the Levandowski saga.

<comment><USER8> He is a savvy politician. You are definitely onto something here. The guy has a very carefully curated public image. It is genuinely impressive how opinion of him is higher than the company he runs.

Edit: I was convinced by the arguments. I was holding onto old idea of him. Clearly things have changed.

<comment><USER9> Is he though? I thought he was pretty much considered a fratbro. The stories of the bro culture that permeated Uber HQ were pretty damning. There's also video of him drunkenly arguing with an Uber driver. The stories are plentiful. If that's the image he's curating, then it sounds like lots of politicians past and present, so maybe you're right.

<comment><USER10> Did we watch the same video, the one where he is in the Uber with two women? Because in the video I saw, he was politely disagreeing with the facts the driver was saying.

Neither person raised their voice or cursed, and I guess you can call it arguing but I did not see anything that was inappropriate behavior.

We are disagreeing right now, and maybe one of us has even been drinking -- does that mean that we are now ineligible to be CEOs?

</comment></comment></comment></comment><comment><USER11> This is especially interesting because Joe Sullivan is the current Chief Security Officer at Cloudflare. I'm curious to see what happens to his role at Cloudflare, will CF stand behind him or give him the boot considering the optics here...

<comment><USER12> Why talk about optics? This is not about what seems bad, it's about what US democracy deemed is a felony. If I was CF I wouldn't want a criminal mind working for me, how can you trust him when you know he lies and cover up.

I just don't understand this sort of detachment.

Optics are not of essence.

<comment><USER13> > how can you trust him when you know he lies and cover up

If he lies and covers up _in the interest of his employer_ , that's a pretty good recommendation.

<comment><USER12> I dunno to me it sounds horrific that Machiavellism is accepted without a pause knowing how inefficient and detrimental it is for human cooperative endavours. History showed us that unchecked Machiavellism causes dynamics to devolve to paranoidic-zero-sum social dynamics. Although is an aspect of our psychology we shouldn't just rationalize it as a force of nature. When we talk we cynically opt to talk about optics so casually that's exactly what we're doing.

</comment></comment></comment></comment><comment><USER14> I really don't understand how this is a crime. Bug bounty is basically hiring consultants to find bugs. They found a bug that allowed consultant to download all the data. Uber paid the consultant the designated bounty. It is a done deal.

Implications that this is an actual breach are large. Does that mean if I hire a red team of independent consultants and they managed to gain access to one of my backups, i have to report it as a breach? Thats the worst case scenario.

The best case scenario is all companies have to pull bug bounty programs because any bug found is now considered a breach. This actually very bad for the industry. Bug bounties are very effective part of a comprehensive strategy to safe guard customer data.

<comment><USER15> In a bug bounty program, you agree to the terms before participating and in particular those terms include not exfiltrating data.

These hackers were not participants in the bugbounty program, and extorted money from Uber. They were not in anyway "consultants", even retroactively.

But that's not the issue at hand here, the issue at hand is the cover-up while Uber was being investigated about a similar breach.

It is also curious that HackerOne was the middleman here. I do wonder how much they knew of what was going on.

<comment><USER16> >those terms include not exfiltrating data

Is there a way to determine that your credentials are sufficient to download an S3 object without actually downloading it?

How would you know whether you'd found an information disclosure vulnerability without peeking at the information?

<comment><USER17> Bounty programs explicitly tell you to only to target accounts that belong to you.

Outside of that, if you're "peeking" at information that doesn't belong to you, you immediately stop, document, and submit the report. You do not download 14,000 files as the Uber hackers did.

This is a non-trivial amount of nuance that clearly shows the hackers were not acting in good faith.

</comment></comment></comment></comment><comment><USER18> I know Joe, I've worked both with and for him. Frankly, this sounds completely out of character for him. He's someone who has a strong moral compass and has been catching black hats for over 20 years.

There has to be more to this story. I feel like he was probably railroaded by Uber's legal team/CEO and they did things he may not have been fully aware of. That's the only explanation I can come up with.

I look forward to him having his day in court to vindicate himself.

<comment><USER19> Your views conflict with facts

1) [https://web.archive.org/web/20200414123312/http://www.ubersc...](https://web.archive.org/web/20200414123312/http://www.uberscandals.org/category/managers/joe- sullivan/)

2) [https://arstechnica.com/tech-policy/2017/12/new-letter- top-u...](https://arstechnica.com/tech-policy/2017/12/new-letter-top-uber- officials-engaged-in-illegal-wiretapping-shady-spycraft/)

<comment><USER20> Who wrote the facts?

</comment></comment></comment><comment><USER21> From what I've read Sullivan claimed the decision to not inform the feds was one made by Uber's legal team. I have no idea if that's accurate, but it's a good reminder that a companies lawyers _look out for the best interests of the company_ , not individual employees.

I've read that if you start to get involved in a legal issue at work like this, you need to get your own lawyer and keep your mouth shut.

<comment><USER22> Except Sullivan was also Deputy General Counsel, making the legal team his team.

<comment><USER21> I didn't know that, and that certainly changes things!

That also makes this statement kind of absurd...

 _" The spokesperson said Uber's legal team, rather than Sullivan, was responsible for deciding whether and to whom the matter should be disclosed."_

</comment></comment></comment><comment><USER23> As someone who has been falsely accused of a crime in the past, I'd just like to remind people that being charged with something does not make you guilty, it's an allegation. I know you know this,but society today seems to be treating allegations like convictions

</comment><comment><USER24> I worked with people who worked with him before Uber. When the news came out they were surprised. They thought he was the scapegoat.

I never worked with him. That personal anecdote does not exonerate him at all but it does give me second thoughts. Truth is nuanced sometimes.

<comment><USER18> > When the news came out they were surprised. They thought he was the > scapegoat.

Same. My initial thought was that Uber threw him under the bus. I still think that.

<comment><USER25> I'm interested in your opinion here. After reading the indictment, which is fairly detailed, you still think that Sullivan is nearly blameless? Or do you just think other execs at Uber are also culpable?

<comment><USER18> It's hard to say. An indictment is necessarily one sided -- it's a document by a prosecutor with the goal of establishing guilt. There is nothing that prevents them from omitting information that is favorable to their target. That comes later during the defense's discovery process.

So the indictment sounds bad, but at this point I'm willing to give the benefit of the doubt and wait to find out the other side of the story.

<comment><USER25> That makes sense. Thanks!

</comment></comment></comment></comment></comment><comment><USER26> My first thought on hearing this news was the famous essay "The Al Capone Theory of Sexual Harassment."

[https://blog.valerieaurora.org/2017/07/18/the-al-capone- theo...](https://blog.valerieaurora.org/2017/07/18/the-al-capone-theory-of- sexual-harassment/)

Basically it states that for a long time, sexual harassers were given a blind eye with excuses like "he's good for our bottom line." But it turns out this isn't true. It turns out people who act unethically in _one_ way often act unethically in _other_ ways, that (among other things) hurt the bottom line.

</comment><comment><USER27> He is currently the CISO of CloudFlare. [https://blog.cloudflare.com/why-im- joining-cloudflare/](https://blog.cloudflare.com/why-im-joining-cloudflare/)

Hopefully eastdakota is preparing a statement about his departure.

<comment><USER28> Hopefully not, considering he hasn't had due process yet.

<comment><USER29> Cloudflare should apply due process in this case as in all other HR matters, but let's just be clear that the amount of process "due" for terminating an employee is vastly less than the process due for imprisoning an individual with state power.

<comment><USER28> But do you want to live in a world where someone can completely fabricate an allegation that you can easily disprove, yet you're still terminated on the spot for doing nothing wrong?

<comment><USER29> By "due process" I don't mean "no process." It's unlikely that someone can "easily disprove" a 19-page federal criminal complaint, but an employer should certainly give an employee the opportunity to do so before their dismissal.

</comment></comment></comment></comment></comment><comment><USER30> Another Uber security guy was hired by Tesla and somehow came up related to the Gigafactory drug running stuff:

> Tesla then hired a new senior manager of Global Security named Nick Gicinto. > He was told that Gicinto and team were "spying on Tesla employees using > devices to monitor emails, cell phones, and data communications from Tesla > employees. Hansen expressed concern to his supervisors regarding what he > believed was illegal conduct."

> In fact, Gicinto and his team allegedly used these same tactics at Uber > under Jeff Jones, former head of security who was also hired at Tesla with > another security employee Jacob Nocon.

> In a lawsuit filed in the United States District Court, District of Northern > California, Waymo LLC v. Uber Technologies, Inc., (Case > No.:17-cv-00939-WHA). Jones, Gicinto, and Nocon all "allegedly engaged in > numerous illegal methods of investigations such as wiretapping and hacking." > These behaviors are all outlined in the "Jacob's Letter" filed in this case.

[https://patriotssoapbox.com/business/tesla-whistle-blower- al...](https://patriotssoapbox.com/business/tesla-whistle-blower-alleges-ties- between-sr-management-organized-crime/)

<comment><USER31> I guess the problem is if you are using company property and the company is wiretapping that property and you have signed some disclaimer then it might be difficult to prove the company did something wrong.

<comment><USER32> I think some judges would consider the power imbalance between employer and employee before legalizing invasions of privacy because the employee signed a disclaimer. Contracts that a weaker party is pressured or coerced into don't automatically clear the company/institution of wrongdoing.

</comment></comment></comment><comment><USER33> > _"Companies like Uber are the caretakers, not the owners, of customers' > personal information," said U.S. Attorney Anderson (for the Northern > District of California)_ [1]

I would like that to be true, but everything I've read indicates otherwise. Uber, Google, Facebook, banks, and credit bureaus have my personal information, but I am _not_ the owner of that information. I've been told that they own it, at least under U.S. laws. If I do own it, why can't I demand that credit bureaus delete all my personal information?

The quote comes from the prosecutor of the Uber executive. If anyone should know the law regarding who owns your personal information, he should. Is he right or wrong?

[1] [https://www.justice.gov/usao-ndca/pr/florida-man-and- canadia...](https://www.justice.gov/usao-ndca/pr/florida-man-and-canadian- national-plead-guilty-hackingextortion-conspiracy) [this was a link in the featured article]

<comment><USER34> Exact the reason why we ought to NOT offer anything in digital form of our person information WHENEVER possible. Data is money. Why should I offer anyone anything in digital form unless I get paid!!!

<comment><USER34> I know someone is going to say because it offer your connivence. Then we each would have to weight is the connivence worth trading our privacy?

</comment></comment></comment><comment><USER35> The CSO informed the CEO so ... this is individual concealment?

The better question is: If the CSO was not previously an AUSA, would the prosecutors have charged this conduct?

<comment><USER36> Is there also a CISO or is CSO same as CISO? Man all those security titles. Hopefully everyone has a CISSP.

<comment><USER25> The titles are generally used interchangeably, though a CISO has an IT connotation and implies an engineering leader, while a CSO can be a risk/policy leader instead of an engineering leader.

Hopefully none of them have CISSPs; the CISSP is a joke.

</comment></comment></comment><comment><USER37> Interesting he's a former federal prosecutor himself (currently the CSO at CloudFlare).

</comment><comment><AUTHOR> U.S. Attorney Anderson announces charges against Joseph Sullivan for alleged cover-up of Uber hack (Video)

[https://www.youtube.com/watch?v=QEPRm2E_PUw](https://www.youtube.com/watch?v=QEPRm2E_PUw)

</comment><comment><USER38> > "Need to get certainty of what he has, sensitivity/exposure of it and > confidence that he can truly treat this as a [bug] bounty situation... > resources can be flexible in order to put this to bed but we need to > document this very tightly" - <USER2>

Looks to me like this is why Kalanic was not indicted. If he deferred, said "handle it, keep it legal, and document it for any investigation," that's really all you can ask from a CEO.

Whether or not this is REALLY what he meant (or just a way to cover his butt) is up for debate. But it would be a good defense imo.

</comment><comment><USER39> I'm a bit surprised this is a criminal offense.

What control does the FTC have over storage of personal data anyway?

<comment><USER40> The criminal offense is not the hack, it's the concealment.

<comment><USER25> In fact, the two people responsible for the hack, Brandon Glover and Vasiley Mereacre, are awaiting sentencing after pleading guilty in federal court; they'll be sentenced next February.

<comment><USER41> 'Vasile', which I think is the Romanian variant.

</comment></comment></comment></comment><comment><USER25> For what it's worth, and I'm no lawyer, it doesn't look like he's facing anything near 5 years.

For the misprision offense (18 USC 4), the guidelines are based on the underlying felony, less 9 levels, capped at 19. Assuming CFAA/wire fraud, a 2B.1 offense, that's:

        6
        +8 for the >$95,000 loss
        +2 if involved harvesting email addresses (not charged?)
        +2 for evasion across jurisdictions
        +2 for exfiltrating trade secrets overseas
        +2 for intent to exfiltrate customer PII

That reads to me a worst-case underlying level of 24, or a 15 for the misprision, which is 18-24 months; remove any of those constraints and it's a "Zone C" offense that doesn't require imprisonment at all.

The more painful charge appears to be the Obstruction (18 USC 1505), for which the guidelines appear to go:

        14
        +3 for substantial interference to an investigation
        +2 for extensive planning

That worst-cases to 19, 30-37 months. Still not close to 5 years, though, and I'd assume (please correct me!) that these sentences group, since the underlying conduct is the same.

(I assume this case settles?)

<comment><USER27> If you look at most federal cases they start off with 1-2 charges like Obstruction of Justice that are easy to prove to a judge. They always add charges later.

<comment><USER25> Seems unlikely here. (I was going to say the whole case is pretty silly, but then I read the indictment, re: the FTC investigation.)

</comment></comment></comment><comment><USER19> While working at Uber, Joe Sullivan's head of Global Threat Intelligence hired Ergo to carry out surveillance against Uber's legal foes. [https://www.theverge.com/2016/7/10/12127638/uber-ergo- invest...](https://www.theverge.com/2016/7/10/12127638/uber-ergo- investigation-lawsuit-fraud-travis-kalanick)

<comment><USER42> Im sensing a pattern here. See Jedberg, you're like that neighbor when the news shows up saying how the "bad person" nextdoor seemed totally normal.

Happens to the best of us bud.

</comment></comment><comment><USER43> From the criminal complaint:

> The hackers' ransom was paid in December 2016 via bitcoin, even though the > hackers by that time had refused to sign the NDAs in their true names and > had not yet been identified by Uber. Uber's staff continued to work on > identifying the hackers and were able to eventually identify them in January > 2017, at which point SULLIVAN dispatched security staff to interview both > hackers and obtain signed NDAs from them in their true names.

How did they identify them, and is the DOJ going after the hackers too?

edit: finished reading the PDF:

>H. The Hackers Pleaded Guilty to Federal Crimes. >>50\. On August 2, 2018, a Grand Jury in the Northern District of California returned an indictment charging Brandon Charles GLOVER and Vasile MEREACRE with crimes related to extortion involving computers under 18 U.S.C. § 1030(a)(7)(B) and 1030(c)(3)(A). The indictment alleged that GLOVER and MEREACRE, between December 2016 and January 2017, conspired to extort a online employment- oriented service ("COMPANY ONE") by obtaining over 90,000 confidential user accounts and using those accounts as a means to obtain money.

</comment><comment><USER44> this reminds me that Joe has ties to Tesla's security team (ex Uber) which is embroiled in a whistleblower lawsuit that allege they spied and hacked employee devices _and_ the insane eBay security team lawsuit in which the security team allegedly sent a severed pig head to a small town blogger they thought was working for Amazon

[https://www.bloomberg.com/news/features/2019-03-13/when- elon...](https://www.bloomberg.com/news/features/2019-03-13/when-elon-musk- tried-to-destroy-tesla-whistleblower-martin-tripp)

[https://www.wsj.com/articles/ebay-harassment-campaign-pig- co...](https://www.wsj.com/articles/ebay-harassment-campaign-pig-cockroach- blog-11593009038)

great legacy

<comment><USER45> > _... the insane eBay security team lawsuit in which the security team ..._

They (allegedly) did a whole lot more than that! Everything about that story is absolutely crazy!

I'm not sure what's leading these security folks to believe they can do anything they want and get by with it but I, personally, am glad to see this criminal prosecution taking place -- hopefully it will help to "remind" others that they must "play by the rules" and that "'winning' by any means necessary" is not acceptable.

The complete lack of ethics at Uber, in particular, was appalling. Fortunately, it sounds like Dara was working hard to fix that once they got rid of Kalanik.

</comment></comment><comment><USER46> One question for any attorneys here - if the FTC were not investigating the 2014 hack, would there not be any charges for these alleged actions? The indictment doesn't seem to mention any statutes violated except for in connection to impeding the existing investigation.

<comment><USER6> 18 U.S. Code § 4. Misprision of felony -- Whoever, having knowledge of the actual commission of a felony cognizable by a court of the United States, conceals and does not as soon as possible make known the same to some judge or other person in civil or military authority under the United States, shall be fined under this title or imprisoned not more than three years, or both.

This statute doesn't require an active investigation.

<comment><USER47> Not a lawyer but what does "conceal" mean when it comes to websites like forums? You often see probably illegal stuff show up on popular forums and they eventually get banned/removed by moderators. Does that mean the moderators "concealed" it and are therefore liable?

<comment><USER48> I am also not a lawyer, but I think this sentence is what does it:

> actual commission of a felony cognizable by a court of the United States

Illegal isn't always a cognizable (ie: perceptible; clearly identifiable.) felony by a court. In this case, not only did the two hackers clearly commit a felony, the lack of reporting it lead to the exact same type of breach conducted by the same two individuals against another site Lynda.com.

That suggests they had clear evidence of a felony and knew of intent to commit future felonies. And the two hackers were caught and going through the court stuff now, they even plead guilty. So thats basically a slam dunk on a cognizable felony.

</comment></comment></comment></comment><comment><USER49> How is this any different than paying ransomware? Is that also illegal? If anything, it seems like he/Uber are the victims of blackmail. And I have no love for Uber.

<comment><USER50> He's not accused of paying off the hackers. Rather he's accused of hiding the incident from an ongoing FTC investigation. They list various ways in which he supposedly concealed the hack from the FTC, e.g. they claim he set up up a false paper trail to make it look as if the hack was a harmless bug bounty submission.

<comment><USER49> Would you have to disclose a ransomware attack?

<comment><USER27> Yes, if there is a federal investigation you cannot conceal or refuse to disclose details.

There isn't a clear answer on proactive reporting. Depending on the type of business you have, what data you hold, the scale of the attack, etc. Some specific professions have mandatory reporting laws that may cover individuals that work for you. (see [https://www.lw.com/thoughtLeadership/LW-ransomware- attacks-w...](https://www.lw.com/thoughtLeadership/LW-ransomware-attacks-when- is-notification-required) for a detailed answer)

The generally accepted best practice is that every ransom attack be reported to the Cybersecurity and Infrastructure Security Agency.

In the specific case of Uber, the incident involved scanned passports. The law is pretty clear that you have to report any compromise of passport data to the State Department.

</comment></comment></comment></comment><comment><USER51> Sounds like the TV series devs

<comment><USER52> I thought the same, but Amaya was more like a combination of Apple and Google.

</comment></comment><comment><USER53> What law obligates a company to report a breach? Is this only applicable for publicly traded companies?

<comment> kube-system This is the law cited in the article:

[https://www.law.cornell.edu/uscode/text/18/4](https://www.law.cornell.edu/uscode/text/18/4)

<comment><USER53> So this expectation is that Americans know all the possible felonies the people around them are committing? What a law.

" It has been reported that the Congressional Research Service cannot even count the current number of federal crimes. These laws are scattered in over 50 titles of the United States Code, encompassing roughly 27,000 pages. Worse yet, the statutory code sections often incorporate, by reference, the provisions and sanctions of administrative regulations promulgated by various regulatory agencies under congressional authorization. Estimates of how many such regulations exist are even less well settled, but the ABA thinks there are "nearly 10,000."

[https://www.wired.com/2013/06/why-i-have-nothing-to-hide- is-...](https://www.wired.com/2013/06/why-i-have-nothing-to-hide-is-the-wrong- way-to-think-about-surveillance/)

<comment> kube-system > So this expectation is that Americans know all the possible felonies the > people around them are committing?

When relevant case-law is taken into account, it appears that is not the case. Courts require active concealment of a known felony for conviction under that statute.

[https://en.wikipedia.org/wiki/Misprision_of_felony#cite_note...](https://en.wikipedia.org/wiki/Misprision_of_felony#cite_note-6)

In this case, a CISO certainly is aware of the CFAA.

<comment><USER53> >> In this case, a CISO certainly is aware of the CFAA.

That is a fair counterpoint

</comment></comment></comment></comment></comment><comment><USER54> If you see an individual paying hush money to conceal a breach, check the commit history asap.

</comment><comment><USER55> IANAL but this seems far from a slam dunk to successfully prosecute. The charge is that he tried to cover up something that they aren't charging as a crime while they were investigating an unrelated thing they also aren't charging as a crime. And the legal department recommended and approved the bug bounty and the CEO was fully informed.

</comment><comment><USER56> I'm surprised by the misprision charge. Is that not a bit dated?

</comment><comment><USER57> this sounds like every parent of every killer ever "he was a good kid. he would never do this"

<comment><USER58> > " this sounds like every parent of every killer ever "he was a good kid. he > would never do this" "

I understand that the HN mentality has become very cynical, but if your only contribution to this conversation is a sardonic simile, comparing someone you don't know to a murderer, you should consider biting your tongue.

<comment><USER59> If your only contribution is defending shitty character testimony you should consider biting your tongue. If there's no actual evidence I don't want to hear about what a nice guy he is.

<comment><USER60> Sorry, this isn't cool. Internet forums are far too quick to form flash mobs of judge, jury, and executioner. In nearly every case this turns out to be missing critical information. Moreover the instinct to do it is reflexive; it has nothing to do with the particulars of any situation—it's just an opportunity to have an experience that somehow we seem driven to recreate over and over again.

Because the tendency is overwhelmingly in this vicious and vengeful direction, having HN be the kind of community we want requires that we all make a conscious effort not to go there by default.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment></comment><comment><USER61> Its extremely out of character that he can't pay more hush money to get out of the charge of paying hush money

Why isnt Uber Inc helping him get a "Deferred Prosecution Agreement" so that he can _kickback_ and relax

<comment><USER15> He's the CSO of cloudflare now, so I doubt he does much relaxing.

Other thread: [https://news.ycombinator.com/item?id=24227059](https://news.ycombinator.com/item?id=24227059)

</comment></comment><comment><USER62> The documents dumped by Martin Tripp in the Tesla case were pretty juicy. Looks like they had a full access to his personal phone, round the clock surveillance on him and constant hacking of his accounts. So much so that one of the security guys working for Tesla turned a whistleblower (Sean Gouthro).

Documents are taken down since a court ordered Martin to take them off the public display.

</comment><comment><USER63> This is about lying to the FTC, not about paying off hackers to keep data private. Ransomware has shown that the latter is accepted even if not exactly legal.

> The database included the drivers' license numbers for approximately 600,000 > people who drove for Uber.

Drivers licenses are deterministic and can be generated by knowing full name and DOB and state. They aren't PII.

<comment><USER64> From reading the article it doesn't sound like this was ransomware:

> "During this time, two hackers contacted Sullivan by email and demanded a > six-figure payment in exchange for silence. The hackers ultimately revealed > that they had accessed and downloaded an Uber database containing personally > identifying information, or PII, associated with approximately 57 million > Uber users and drivers."

The hackers were demanding a ransom from Uber to keep silent about a data breach. Which is a whole lot different than paying a ransom to decrypt valuable, internal data. If a company has been breached, while it will almost certainly cause damage fiscally & to their reputation- they have a responsibility to notify users/customers. I'm unfamiliar with the law on this, but it should be illegal for a company to pay a ransom for malicious actors to keep silent about data they stole.</comment></comment>


Similar airdroid app to ipad - <AUTHOR>

Free app to ipad like airdroid. Airdroid give total access to android phone on computer.We can send sms, view gallery. Not interested on softwares like TimeViewer. I want something simple to use,not a virtual access.<p>Thanks <comment><USER2> what?

<comment><AUTHOR> there is a software called AirDroid lets you connect via the web with the android mobile phone (via app). It has a user friendly interface (not as timeviwer which is direct remote control). Allows you to send sms, view photos, see contacts ... Is there some kind of software to access ipad to android phone like AirDroid?</comment></comment>