Google's harvest of medical data includes names and full details of millions - <AUTHOR> https://www.theguardian.com/technology/2019/nov/12/google-medical-data-project-nightingale-secret-transfer-us-health-information <comment><USER2> If entering into a BAA under HIPAA for work involving PHI is "harvest", and you're worried that this reaches "millions" for Google, you probably don't want to think about the deals public and private firms in the healthcare and health insurance/payments space have with Amazon and Microsoft.

From the news article (I don't have time to review the source leak indepently) there doesn't seem to be anything really concerning here. The closest to an indication of anything wrong seems to be that someone raised an issue about the risk of improper employee use of data and a need for training around that in an internal meeting on the project and has not received a formal specific response on that issue from corporate leadership. Having spent a long time in HIPAA-related work, that neither that issue being raised in regard to a new project or the fact that it was raised being merely one of many inputs into a policy generating process that makes general adjustments considering a wide range of concerns, legal parameters, and other issues but not receiving a specific direct response seems...pretty typical. And HIPAA does not require notification or opt-in (or even opt-out opportunity) for data sharing between a covered entityand Business Associate, as BA's are (while under HITECH independently subject to HIPAA privacy and security rules) basically considered institutional agents of the covered entity to which the covered entity's authority to have and use data is delegated under the Business Associate agreement.

I don't know if there is really nothing of concern in the dump or the journalists covering it don't have enough understanding of the domain to even distinguish things that would indicate a problem, but what it looks like from the news article is a "whistleblower" making accusations and dumping docs, but nothing substantial and concrete in the docs supporting the thrust of the "whistleblower's" accusations of wrongdoing.

<comment><USER3> Not defending the article (I've not read it), but I suppose I probably would be horrified with the status quo. I really wish we had a more consent based data culture. I suppose I don't know how that would be designed. But lots of real things are horrifying and it's not necessarily fine just that something is normal.

<comment><USER4> My view is that consent is oversold. If I "consent" to a boilerplate agreement handed me moments before an action is taken, have I really?

Boundaries and distributions should be clearly, specifically specified, with any non-essential distributions requiring specific assent, defaulting to none. If there are consequences to sharing, those can be made known. We've been drawn into a circumstance which has long been untenable.

<comment><USER2> > If I "consent" to a boilerplate agreement handed me moments before an action > is taken, have I really?

A not uncommon practice with HIPAA "disclosures" is to sign an electronic device that records the signature (and provides no evidence that the document your signature is associated with is anything like the one you were given) _prior_ to being provided with documents. So, yeah, the practices around consent with PHI suck pretty hard.

<comment><USER4> I would flat out refuse.

</comment></comment></comment></comment></comment><comment><USER5> Googler here, my opinions are my own, standard disclaimer.

I'm not going to comment on this specific case but I do have almost a decade of previous non-Google experience working in clinical documentation technology.

As others have said, entering into a BAA with a covered entity, as HIPAA defines it, shouldn't be seen as a controversial action.

There are numerous problems in healthcare that are too complex for individual health systems to tackle. For example:

* Population Health: are there emergent changes in the regional population? What do you do about it? * Continuity of Care: The number of individual providers involved in a particular person's care continues to grow. How can you effectively inform the entire team--across health systems--what's most important for an individual now? How do you make sure nobody drops the ball?

To give you an idea of the scale, I have two examples. The first is MD Anderson Cancer Center in Houston. They used to have 200+ engineers working on their sophisticated home-grown EMR. It was a huge undertaking. But even with MDACC revenue, that development was unsustainable, and they moved to a 3rd party EMR vendor.

Second is the Mayo Health System. Another huge provider with facilities not just in flagship Rochester MN, but in several other sites. Again, there were realities that even at this scale internal development isn't sustainable across the board and they wound up with a $100M+ adoption of a 3rd party vendor.

And this is mostly straight-forward CRUD-level workflows. The technology is straightforward but the workflow expertise is not.

Now, try and solve some bigger problems. You're going to need help to do this at scale, and trying to solve it necessarily means giving access--not control of!--to medical records to drive R&D. It's happening right now, and Google is not the only player doing this at scale. They're not even the largest one.

Lastly HIPAA controls have real teeth, in comparison to the general consumer space (at least in the US).

<comment><USER6> > As others have said, entering into a BAA with a covered entity, as HIPAA > defines it, shouldn't be seen as a controversial action.

You place more faith in HIPAA than I do. HIPAA does not protect privacy to the degree that most people assume.

> There are numerous problems in healthcare that are too complex for > individual health systems to tackle.

True, but that doesn't mean that Google is the right entity to do this. In my opinion, they're the wrong entity, because Google is not exactly trustworthy.

> Google is not the only player doing this at scale. They're not even the > largest one.

But they're Google. What this sort of thing means for me is that I need to start asking medical providers if they're participating in this sort of thing with Google (or other companies that I consider bad actors), so I know which ones to avoid using.

<comment><USER5> > You place more faith in HIPAA than I do. HIPAA does not protect privacy to > the degree that most people assume.

That's correct. People would be surprised at the number of HIPAA violations that happen everyday. It is, however, among the strongest and most well- enforced data privacy laws (in the US).

> True, but that doesn't mean that Google is the right entity to do this. In > my opinion, they're the wrong entity, because Google is not exactly > trustworthy.

You're certainly right to be concerned. I don't share your opinion about Google per se, but this is important data for our society. I'd argue that OpSec at a large provider--let's say Microsoft--is more sophisticated than a start-up. So how does an organization decide who is the "right" entity to deal with?

> But they're Google. What this sort of thing means for me is that I need to > start asking medical providers if they're participating in this sort of > thing with Google (or other companies that I consider bad actors), so I know > which ones to avoid using.

If this is important to you, I would strongly encourage it. Our health industry is better when consumers are better informed, and can make informed decisions. Personally, it's more important to me to be able to actually know how much a procedure is going to cost rather than who owns the AI stack behind their clinical decision support system.

<comment><USER6> > So how does an organization decide who is the "right" entity to deal with?

Practically speaking, that's up to the company -- but the company needs to make sure that their clients are informed and are able to withdraw their data if they're concerned.

The larger part of what's wrong with this particular deal is that it was done in secret. Patients and doctors were not informed of this until after data has begun to be transferred. They should have been, and patients should have been given the option to remove their data from the dataset and find another health care provider if they wish.

> Personally, it's more important to me to be able to actually know how much a > procedure is going to cost rather than who owns the AI stack behind their > clinical decision support system.

I agree that knowing costs is very important, but we're miles away from that being a thing that is possible. In the meantime, I think it's important not to backslide in other areas such as this one.

I'd also say that my concern isn't really about who owns the stack, or the cloud. That sort of battle was lost years ago. My concern is the ability of Google to access that information.

</comment></comment></comment></comment><comment><USER7> What is actually happening here? A lot of rhetoric about the "Transfer of data" etc, but other times this just reads like a Google Cloud Infrastructure play, with some consulting on top.

Also - The deal was only just signed, e.g. the transfer hasn't happened yet?

There's a lot of hearsay in all of this reporting...

<comment><USER8> Seems like a lot of fake news over a cloud storage deal

[https://cloud.google.com/blog/topics/inside-google- cloud/our...](https://cloud.google.com/blog/topics/inside-google-cloud/our- partnership-with-ascension?mod=article_inline)

<comment><USER9> This is not "fake news" at all. This is the same factual event covered with a different spin. Use of the term "fake news" to describe reporting that is merely slanted in a direction you don't like--rather than presenting demonstrably false information as fact--is completely unwarranted, and is doing terrible damage to our social institutions.

<comment><USER10> This is a TEXTBOOK case of fake news - a newspaper owned by Google competitor spinning purchase of space on encrypted Cloud Storage and Google Apps productivity suite as a big medical data mining attempt by Google to drive a political agenda.

There are obvious concerns around data security here, but the article is very heavily distorting facts to drive outrage.

<comment><USER11> Also the Guardian isn't owned by a Google competitor - it's owned by the Scott Trust, an organisation set up specifically to maintain the paper's editorial independence.

They have viewpoints which include a distrust of very powerful global corporations, and one you may or may not agree with - but it's nowhere near 'fake news'.

[https://en.m.wikipedia.org/wiki/Scott_Trust_Limited](https://en.m.wikipedia.org/wiki/Scott_Trust_Limited)

</comment></comment></comment></comment></comment><comment><USER12> How is this not a criminal breach of HIPAA laws?

[https://www.hhs.gov/hipaa/for-individuals/guidance- materials...](https://www.hhs.gov/hipaa/for-individuals/guidance-materials- for-consumers/index.html)

<comment><USER10> Google's press release actually adresses HIPAA: [https://cloud.google.com/blog/topics/inside-google- cloud/our...](https://cloud.google.com/blog/topics/inside-google-cloud/our- partnership-with-ascension?mod=article_inline)

<comment><USER13> Important part:

>What about patient data? All of Google's work with Ascension adheres to industry-wide regulations (including HIPAA) regarding patient data, and come with strict guidance on data privacy, security and usage. ... To be clear: under this arrangement, Ascension's data cannot be used for any other purpose than for providing these services we're offering under the agreement, and patient data cannot and will not be combined with any Google consumer data.

<comment><USER14> > and patient data cannot and will not be combined with any Google consumer > data.

Does anybody enforce this or do we just take Google at their word?

<comment><USER15> Does anyone enforce any law?

<comment><USER14> When there's an obvious breach, hopefully. How would we even know if Google were abusing this data though? Does anyone have access to it besides Google? Are we literally asking Google to regulate itself with this data?

EDIT: I guess I don't understand. Once we give Google the sensitive information, how do we have any way of knowing what they do with it? I'm guessing an audit on all of Google's data is out of the question.

<comment><USER16> The point of this article is that a whistleblower is saying "they're not controlling access properly".

While the Grauniad is trying to spin it to sound worse, the whole point is Google are providing data processing services to a valid HIPAA processor via Google Cloud, not that they nefariously bought the data to integrate it with the search results.

Much like health data stored on AWS with a dedicated internal project team could be accessed by "Amazon" staff. It's kinda the point, the google staff have been brought in to help manage the data.

<comment><USER6> > not that they nefariously bought the data to integrate it with the search > results.

I don't think that anyone is claiming they are intending to do this.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> > Google could go on to use its AI analytics to predict outcomes for > individual patients, they posited.

This is the most scary part[0]. I'm sure plenty here would disagree, but I simply don't (yet) share your optimism for A.I.

[0] Not that the rest isn't scary.

<comment><USER18> Ubers ai won't even slow down when it sees a person in the road. A computer can prescribe a drug for me, but _I_ can't prescribe a drug for me?

Can I please have my life back please?

<comment><USER19> Drug self-prescription is forbidden for several good reasons that have stood the historical test of time, unfortunately.

It'd be convenient if we could assume perfect personal responsibility, but human behavior doesn't align with that assumption.

<comment><USER18> Prescriptions aren't required in many countries of the world. Protecting people from themselves is not a good reason. If it were lots of dangerous activities would be illegal.

You can risk your life to make it more fun, but not more healthy?

Prescriptions in the USA have only really been a thing for the century since the Harrison act, which brought drug smuggling with it.

</comment></comment></comment></comment><comment><USER20> Any google employees/friends of google employees here with insight as how staff is receiving this news? My guess is like all other egregious abuses of power, the employees will stage a "protest" to feel good about themselves then keep working there.

<comment><USER19> I don't think they see this as an egregious abuse of power. Googlers trust Google to do a pretty decent job of securing private information almost all of the time; this isn't an area of moral concern for them.

(i.e. the question in their minds is "Is the data safer in the source repositories?" And it's probably not).

<comment><USER6> The problem is that Googlers (like far too many tech companies) view data as being secure if outsiders can't get access to it. They don't count access by themselves as a security issue, even though it objectively is.

<comment><USER21> Googler here. I don't speak for Google and obviously shouldn't and won't divulge internals, but this just makes me cringe so hard: unauthorized or illegitimate access by staff is OBVIOUSLY treated as a security issue. I'm kind of shocked that folks would think otherwise.

<comment><USER6> Just to clarify, I was not referring to unauthorized or illegitimate access. I was referring to company-sanctioned access.

</comment></comment></comment></comment></comment><comment><USER22> So what do we do to stop this? What recourse do people directly affected by this have?

<comment><USER23> GDPR should kick in long before medical data is on the table.

<comment><USER2> GDPR will only occasionally and coincidentally (if at all) be relevant to health data held by US health care providers and their business associates, whereas HIPAA will always be relevant.

</comment></comment></comment><comment><USER24> >The disclosed documents include highly confidential outlines of Project Nightingale, laying out the four stages or "pillars" of the _secret project_.

> Among the documents are the notes of a private meeting held by Ascension > _operatives_ involved in Project Nightingale.

The whole article is written like they are trying to tell a spy story which brings into question the credibility that there's any wrong doing.

</comment><comment><USER25> I fear all of this will be used as part of a prediction program to find the best employees based on performance metrics. Imagine if before you even gave an applicant a callback you could see if they've ever had a bout of depression, insomnia, anything that may affect their job performance or the performance of their team. That would be standard part of any background check if that information was available.

<comment><USER26> The nice thing about the modern world is that nobody has to make the decision to do that or be aware. That sort of discrimination can filter through ML- derived correlations at two, three or more levels removed, and every human being can be as innocent as can be.

</comment></comment><comment><USER27> Where is the Guardian's report on this - [https://www.dailymail.co.uk/health/article-7588337/Google- ge...](https://www.dailymail.co.uk/health/article-7588337/Google-gets-green- light-access-FIVE-YEARS-worth-sensitive-patient-data-NHS-trust.html)

As a UK based paper Guardian could at least focus on British issues

</comment><comment><USER28> I wonder if this is not a coincidence given acquisition of fitbit.

<comment><USER29> Google's been investing in medical data analysis long before buying Fitbit. They got in trouble for DeepMind's involvement with NHS data over in the UK, which started years ago. And then Google absorbed that whole project from DeepMind into Google Cloud proper, after assuring the British government Google would never have access to the data from the project.

tl;dr: Unrelated avenue in a field they've been interested in for a long time.

</comment></comment><comment><USER30> Personally i think the frustrating thing here is that it sours the pool for others who are interested in medical innovation that requires data.

</comment><comment><USER31> I know I'm very much in the minority here, but just like we should have more open borders and more open software, we should encourage more openness around medical data.

Google and other large companies have made some significant AI advances in the last decade & I think it's in all of our interests to see if these advances can lead to improvements in health care.

Yes, it's scary how much data these companies have collected about us, but there are other things in the world which are even more scary, like heart attacks and cancer. I think we need to stop having an automatic knee-jerk reaction every time a company gets access to our data, especially if proper legal protocols with privacy protections are being followed, as it appears to be in this case.

Of course, I would love to live in a world with 100% perfect personal privacy AND perfect treatments for all diseases, but we don't live in that world: In our world, as we move forward, there are going to be difficult tradeoffs between health innovation and patient data access: We should try to navigate these tradeoffs in a level-headed way, without just insisting on greater walls around all data in every instance.

<comment><USER32> I know how hard it is to get enough medical data to do research. But why do you need names? Correlate diseases with first names?

<comment><USER33> Totally agree.

Last thing we should do is have radically open medical data. Some busybody parent could go out and search all the kids in in her kids' school who might have HIV or something. Or imagine all the crazies out there searching for a list of women in their town who have had abortions.

The only thing you do with open medical data is ratchet up the "crazy" in society. In an ideal world where everyone is rational, it's fine. But that world doesn't exist.

</comment></comment></comment><comment><USER6> Every time that I think that Google couldn't be any worse, they prove me wrong.

</comment><comment><USER34> Stopped reading after 2 popups and one add blocked the article.

</comment><comment><USER35> dupe. [https://news.ycombinator.com/item?id=21507370](https://news.ycombinator.com/item?id=21507370)

<comment><USER35> Instead of down voting me, you could reply saying that this article has new details (like the leaked presentation). I just assumed it was a repost of yesterday's discussion.

<comment><USER4> My practice is to usually limit "dupe" to the identical link or story submitted multiple times. Major mainstream breaking news possibly excepted.

For different takes on the same story, "Previously" with a link to earlier discussion, may be better.

For evergreen topics (e.g., Bertrand Russell's "In Defence of Idleness", submitted many times through the years, and again a day or so back), "earlier submissions" noting the years, of 2-3 top instances, can point to earlier interesting discussion.

</comment></comment></comment><comment><USER36> Time to use private cloud</comment>


Printing and Assembling the MK735, a 3D-Printed DIY NAS Case - <AUTHOR> https://blog.briancmoses.com/2019/06/printing-and-assembling-the-mk735-a-3d-printed-diy-nas-case.html <comment><USER2> 227 hours of machine time, $70 of plastic filament, multiple failed parts and hours of hand finishing. Truly, this is the future of manufacturing.

<comment><USER3> To make just 1 unit of a decently complex unique design for only $70 in materials, 227 hours of machine time, and a reasonable amount of human assembly time, is seriously impressive!

3D printing isn't the future of mass manufacturing, but it is getting much much closer to being the future of prototyping and one-offs for pretty much every plastic thing (and some metal ones, too), especially as the hobby level printers keep getting better.

If you're not impressed with this, you likely haven't ever gotten quotes from a quick turn plastics manufacturing shop.

<comment><USER2> _> If you're not impressed with this, you likely haven't ever gotten quotes from a quick turn plastics manufacturing shop._

Who on earth would want to make a computer case from plastic? Cutting, folding, drilling and riveting sheet metal is fast and economical, even with basic hand tools. You can buy a dizzying array of fixtures and fittings from McMaster-Carr or your local equivalent.

I'm not fundamentally opposed to 3D printing, but I do have a bone to pick with the "maker community", which seems to have a pathological aversion to basic shop class skills. If you want to make a custom PC case, then by all means do so, just don't stink out your house with ABS fumes in the process - buy a copy of _Basic Benchwork_ by Les Oldridge and _Sheet Metal Work_ by R.E. Wakeford, scrounge up some tools and have at it.

<comment><USER4> I'm definitely in agreement with you here; it bothers me a bit to see an instructable or similar where one of the essential requirements always seems to be a 3D printer. It's always a breath of fresh air when that isn't true.

In many, many cases, most things done by "makers" can be done without 3D printing anything, and be more accessible to others. I can understand needing or using one when you need something custom to fit or retrofit into an existing commercial product. Even there, with a bit of thinking, one can generally come up with a solution where a 3D printer isn't needed.

I'm starting to see this same kind of attitude creep into laser cutters - projects that seem to think everyone has access to one, when that isn't necessarily true. For instance, I know where I could go to get access to one (and 3D printers, etc) - but it would be about a 50 mile drive for me. Far enough where I would seriously consider other alternatives.

I do have to say, though, that the 3D printer (and other CNC tools commonly used by the maker community) has allowed for a lot of people who may not have the dexterity or other related abilities the chance to design and build some fantastic creations. Furthermore, there are more than a few things that just couldn't be done any other way (or at least as cheaply or quickly). There is also the nice idea that (at least in theory) one can take those same files and use them with other CNC processes. In the case of laser cutters, if you can print the files full-sized, you can even cut them out manually with a coping saw or other more "manual" tooling.

</comment></comment></comment></comment><comment><USER4> I'm trying to figure out how one manages 24 and 48 hour prints without potentially setting the house on fire.

As far as I am aware, no FDM 3D printer is safe to run unattended, overnight without supervision. I know there are ways to make things safer, with various interlocks, fire suppression items (like those kitchen vent-hood pucks), cameras for monitoring, etc. But I still wouldn't trust just letting something like that run.

I've yet to do anything with 3D printing, so maybe I am just out of the loop on this. I do know that software and hardware has come far enough to allow for print stop/re-starting (such as when reloading filament in the middle of a large job). Maybe that's how these long prints are done without the danger?

<comment><USER5> I have a few 3D Printers, a scratch CoreXY build, Tevo Tarantula, and PowerSpec Ultra (rebranded FlashForge Dreamer) I run prints unattended often. Overnight or leaving my house for errands. The only thing I do is regularly check termination points and board components to see if they are fine.

I wish I knew what was wrong with other people's configurations or the quality/settings of their hardware that causes these fires.

I blame kit providers racing to the bottom to throwing together low quality hardware and passing them off as solid workhorses. For my Tevo Trantula I replaced the screw down terminal block for one with higher amperage rating after noticing some slight melting on the housing, and spent a whole day doing PID tuning for the hot end and the heated bed.

There should also be a bigger disclaimer for kits to deter people who don't have decent knowledge in electronics to just go for complete printers or higher quality/proven kits.</comment></comment>


Ask HN: How to sell my startup - <AUTHOR>

I have a small start up software platform with high value to higher ed marketing companies. We did get some angel funding, but have sine paid it back so we (myself and co founder along with 2 employees) are the only shareholders.
After much deliberation, we decided to shut down shop in pursuit of another idea.
Beyond sites such as sitepoint, how does one go about selling their early stage start up? How should we value it and price accordingly?
We're not talking about anything huge, but we do have demonstrable traction, were growing. With a higher budget and a better engineering focus, a larger company could benefit. Or, it could be a good early stage "turn key" start up for entrepreneurs who want to start selling a pre-built product. I don't expect to make hundreds of thousands of dollars or millions, but something in the tens of thousands would be nice.
Any first-hand or second-hand advice that HN can share? You guys have always been so helpful in the past :) <comment><USER2> You may find this helpful: <http://jacquesmattheij.com/How+To+Sell+Your+Company>

Enjoy!</comment>


How Many People Are In Space Right Now? - <AUTHOR> http://www.howmanypeopleareinspacerightnow.com/

<comment><USER2> Eventually, every grammatical English sentence will have its domain taken, and be tended to by a nanostartup dedicated to answering that one question.

<comment><USER3> OK, who's gonna register iseverygrammaticalenglishsentencetendedbyananostartupdedicated toansweringthatonequestionyet.com?

<comment><USER4> That's not possible, because you have a space in there.

</comment></comment></comment><comment><USER5> Cool. Also, gets my vote for most blatantly unnecessary use of JavaScript (from 6 places???) ever.

<comment><USER6> I was about to say the same thing. Not nearly as bad as unnecessary Flash but in this case, for a website so simple, it's just as wasteful.

That being said, cool site! And cool domain name!

</comment></comment><comment><USER7> All of them.

</comment><comment><USER8> Does this include Bowie?

</comment><comment><USER9> It should have 6 astronauts and I should be able to mouseover any of them to get a bio, current time in space and total time spent in space.

C- for effort.

</comment><comment><USER10> Where does he really get the data from ?

<comment><USER11> Space.

</comment></comment><comment><USER12> No RSS feed. :(</comment>


Bash Fix Incomplete Still Exploitable (CVE-2014-6271) - <AUTHOR> https://bugzilla.redhat.com/show_bug.cgi?id=1141597#c24

<comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=8365158](https://news.ycombinator.com/item?id=8365158).</comment>


Pragmatic Debian packaging - <AUTHOR> http://vincent.bernat.im/en/blog/2016-pragmatic-debian-packaging.html <comment><USER2> > [...] building Debian packages with the official tools can become > straightforward if you bend some rules:

> 1\. No source package will be generated. Packages will be built directly > from a checkout of a VCS repository.

> 2\. Additional dependencies can be downloaded during build. [...]

> 3\. The produced packages may bundle dependencies. This is likely to raise > some concerns about security and long-term maintenance, but this is a common > trade-off in many ecosystems, notably Java, Javascript and Go.

Point 3. is fine for site-built packages that don't go to mainstream.

Point 1. in the long run can result in some trouble, and one really shouldn't do that for third-party code (unless it's mirrored in own repository).

Point 2.: please don't do that. It's a stupid, really stupid idea. This way you defeat much of the robustness provided by packaging. You can't reproduce the build and you can't reliably rebuild the package under network outage or leftpad 2.0 farce. It's much better to have a script (makefile?) that downloads all the sources off-line, and package that to a single source package (debian/source/format "3.0 (native)").

But apart from these, it's a really good overview of modern Debian package building, especially that it doesn't show how to _generate_ a package, but build it from scratch.</comment>


Ask:HN  Buying a parked domain from GoDaddy. How'd you do it? - <AUTHOR>

Hi, I am interested in a domain that is parked on GoDaddy site. I am trying to contact the owner but GoDaddy is hiding its name behind a paywall and asking for $70.00 upfront +10% commission of the transaction price.<p>So how'd you it? Any inputs/suggestions and feedback will be great. Thanks. <comment><USER2> DON'T DO IT!

I lost $70 trying to re-acquire jseliger.com after a screwup that was 80% my fault and 20% Wordpress's fault. At some point I'll write a blog post about the experience, but the big, important takeaway is that GoDaddy itself or a subsidiary of it may be warehousing the domain, or unwilling to sell it. (They've actually been caught doing this: [http://techcrunch.com/2008/12/03/godaddy-uses-standard- tacti...](http://techcrunch.com/2008/12/03/godaddy-uses-standard-tactics-to- warehouse-domains)).

In any event, when I was panicked I actually paid the $70, only to realize that "Domainsbyproxy" was listed as the owner—which GoDaddy owns!

When I did more research and realized the mistake I'd made, I disputed the charge. I got the $70 back but will never get back a) my dignity or b) the domain name.

<comment><AUTHOR> If they do not want to sell the domain then why they have parked it on their site. Just to collect adword revenues from keywords? That is a very un- business way of doing business.

<comment><USER3> Read the URL the commenter you replied to posted. It answers your question.

<comment><AUTHOR> Thank You.</comment></comment></comment></comment>


Attorney General Barr and Encryption - <AUTHOR> https://www.schneier.com/blog/archives/2019/08/attorney_genera.html <comment><USER2> > Nor are we necessarily talking about the customized encryption used by large > business enterprises to protect their operations. We are talking about > consumer products and services such as messaging, smart phones, e-mail, and > voice and data applications.

This is very naive. Just assume the scenario where a CEO or politician has a certain fetish that he/she rather would not like to be splattered over the front page of a national news paper. This person is likely going to use his personal email, phone, voice and data applications to indulge in this fetish. If there is a backdoor, it is almost guaranteed China, Russia or any other country will eventually break it and potentially use it for blackmail to get their hands on corporate or national secrets.

<comment><USER3> Not just China, could be any country really.

<comment><USER4> Including their own. How soon before the government is utilizing its security apparatus to blackmail its own wealthy and powerful?

<comment><USER5> I think that ship likely sailed long ago.

<comment><USER6> The fact that something has gone wrong before (even if repeatedly!) does not imply that we should not attempt to prevent it from happening again, or that it's no longer possible to take steps that would move us in that direction.

</comment></comment></comment></comment></comment><comment><USER7> As Schneier says, it's better than the "nerd harder" attitude exhibited previously.

However, I take issue with this part:

> After all, we are not talking about protecting the Nation's nuclear launch > codes. Nor are we necessarily talking about the customized encryption used > by large business enterprises to protect their operations. We are talking > about consumer products and services such as messaging, smart phones, > e-mail, and voice and data applications.

I think he is intending to argue that the quality of the encryption should be tiered, that "consumer" comm crypto should be weaker than business operations crypto should be weaker than gov't crypto. If so, I think this is a bad policy.

I just got through a security audit by one of our customers at work. One of the points that their security team made was that they want us to do more to protect the mobile devices used at our company. Even though said mobile devices do not, and will never have, access to the customer's sensitive data, the customer argued that a mobile device being breached gives an attacker a foothold, and allows said attacker to move closer to getting access to their data.

I think the same principle applies to this notion of lower-tier crypto for the peasants. Lower-security systems interact with higher security ones, and if those lower security systems are breached because their security was artificially lowered, they become threats to the higher security systems with which they interact.

I don't doubt that if crypto for Not-Government were kept artificially weak, that China or Russia would leverage that to their advantage, moreso than they already are. I think it would also make things easier for not just state actors, but lower-tier criminals, as well. If Barr wants to have an easier time catching bad guys, he should probably not make it easier for bad guys to do bad things.

<comment><USER8> > I think he is intending to argue that the quality of the encryption should > be tiered, that "consumer" comm crypto should be weaker than business > operations crypto should be weaker than gov't crypto. If so, I think this is > a bad policy.

I don't think this is strange, since this is how it works in physical. A home has a simple lock, a business a few better ones and a security system, and a military base has 24/7 armed soldiers on guard.

Impossible to do right now for encryption of course.

<comment><USER9> > I don't think this is strange, since this is how it works in physical. A > home has a simple lock, a business a few better ones and a security system, > and a military base has 24/7 armed soldiers on guard.

Yes, but this is not how it works in cryptography and there's no reason it has to. Should we deliberately weaken crypto systems so that they work similarly to some other arbitrary system? The question seems to answer itself.

<comment><USER10> That does seem to be the policy for copyright..

</comment></comment></comment></comment><comment><USER11> I have found that the best way to educate people on the importance of no government backdoors in encryption is to use the example of TSA approved locks.

Everyone knows when they put a TSA lock on their luggage it does almost nothing to improve the security of their luggage. Any serious criminal has a key to TSA locks.

Adding backdoors is like putting a TSA lock on your bank password. It keeps honest people from seeing it but doesn't do much else.

<comment><USER12> Actually you can 3-D print a set of TSA keys now.

[https://github.com/Xyl2k/TSA-Travel-Sentry-master- keys](https://github.com/Xyl2k/TSA-Travel-Sentry-master-keys)

<comment><USER13> > Actually you can 3-D print a set of TSA keys now.

Unless that repo is backdoored and the code has been altered.

<comment><USER14> The point though is why would anyone even bother, since no one uses TSA locks as anything resembling legitimate security anyway.

<comment><USER15> I've never bothered locking my luggage. I figured it would cause more problems than it solves.

<comment><USER16> I use TSA-approved locks that have a little red indicator that pops up if the lock is opened with a key. You can reset the indicator only if you know the combination.

So, when I collect my bags, I can tell whether they've been opened since I last saw them.

<comment><USER17> Decoding the combinations (and thus resetting the indicators) on those is surprisingly easy. They're actually great for locksport beginners, the key lock is really easy to pick and the combination is easy to decode, AND they're cheap!

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> " As computers continue to permeate every aspect of our lives, society, and critical infrastructure, it is much more important to ensure that they are secure from everybody -- even at the cost of law enforcement access -- than it is to allow access at the cost of security."

This.

I love that Schneier weighed in on this.

<comment><USER19> Nice quote.

</comment></comment><comment><USER20> I don't like to be the tin-foil hat guy, but I'm getting tired of the gov't rhetoric around how this is "to catch criminals". No, it's not. It's to protect and further enable passive mass surveillance. And nothing good comes from that. I don't trust anyone with that power not to break the rules and do bad things sometimes.

<comment><USER21> Exactly. So the police and government were never able to catch criminals before 1990? Terrorism or kiddie porn are just red herrings to scale people into giving up control. When someone asks for this kind of backdoor, I want to ask them to hand me their unlocked phone. "But you have nothing to hide, right? You aren't breaking any laws, right? I _promise_ not to share this information with anyone!"

</comment></comment><comment><USER22> Barr seems intelligent despite all the news and politics we have going on right now. I agree with Schneier's assessment about have a policy discussion.

Let's pretend the Big Tech companies build something robust and unbreakable (impossible) for the US govt. Now the EU and former English colonies want the same.

Now Syria wants the same access and full history of anyone in Syria. China would like the same for Hong Kong.

It's slippery slope that goes down hill very fast. The line between criminal investigations and persecution are blurred.

<comment><USER23> It's more complicated than that. Let's say the US adds back doors. What is to stop China, Russia, or some other nation state from using it in the US to intercept the communications of lawmakers, CEOs, and others? These are policy implications worth raising and discussing. Do many realize implications like this?

<comment><USER24> I think most of us around here on HN and "tech people" in general understand that particular set of issues around encryption backdoors.

It seems to me that certain lawmakers and people like Barr either don't put the time in to understand or are willfully ignorant to further their own goals.

<comment><USER7> Supposedly Upton Sinclair said, "It is difficult to get a man to understand something, when his salary depends on his not understanding it."

I think that applies here.

</comment></comment></comment></comment><comment><USER25> > " Here, some argue that, to achieve at best a slight incremental improvement > in security, it is worth imposing a massive cost on society in the form of > degraded safety. This is untenable."

I'd suggest if they really want to push this line of reasoning, then we should also abolish the 2nd amendment. It is there in order to revolt against the government. But it's place also degrades the security of the country, as evidenced by the constant shooting and mass shootings that occur in American life.

Encryption is much the same way. It protects individuals against government spying, whatever their situation may be. And these products exist not just for the US, but are made by Americans for export with the American ideal of individual liberty in mind. If we remove that, it'll get moved for China, Burma, Russia, etc.

It's quite a price to pay for society.

<comment><USER26> The 2A and crypto have been linked for a long time. The original crypto fight in the 90s was over exportable encryption (because it was listed along with munitions and other ITAR-restricted items).

One idea I saw floated around the time of the San Bernadino iPhone was arguing that encryption is protected by the second amendment as a means to not having to fight against backdoored encryption every few years. I don't have the case law familiarity with the 2A & encryption to say if it would go well but I did find it a fun idea.

Edit: I should add that this would be in addition to the clear 1A protection code and therefore encryption has.

</comment></comment><comment><USER27> Bad guys will certainly know that given phones includes backdoor access and they'll figure out devices that does not.

Law enforcement will end up spying on regular citizens and catching small fish while big fish and bad hackers will laugh watching.

<comment><USER28> > they'll figure out devices that does not

Just owning one of them could then become probable cause for a search of everything else you have, and then you'll be held in contempt and jailed until you hand over the password.

Or it could just be made illegal to own one at all. Anyone with a secure smartphone could probably be tracked just by traces it leaves when it connects to a cellular network.

<comment><USER29> > > they'll figure out devices that does not

> Just owning one of them could then become probable cause for a search of > everything else you have, and then you'll be held in contempt and jailed > until you hand over the password.

Could you explain your reasoning? Just owning a safe in my trunk doesn't give people probable cause to search my trunk, so it's not clear how you came to that conclusion.

<comment><USER30> Check this out: [https://www.nytimes.com/2019/03/30/us/politics/dea-money- cou...](https://www.nytimes.com/2019/03/30/us/politics/dea-money-counter- records.html)

DEA was looking though records of who bought money counters.

</comment></comment></comment></comment><comment><USER31> I liked this comment from below the article.

> I prefer to live in a free but insecure world than in a perfectly safe but > not free world.

Which I interpret to mean, we're free to use whatever protections we see fit. But institutionally we can't promise security, since bad actors will always exist.

<comment><USER32> I don't like it because it suggests that freedom and security are somehow at odds with each other, which is already an authoritarian framing of the situation, and really just nonsense. I want to live in a perfectly secure world. I don't think that that is actually achievable, but there is absolutely nothing wrong with that goal.

But: There is no such thing as "security" in and off itself, security is always relative to something that you value that you try to protect. So, if you value freedom, you can not achieve security through limiting freedom, because that would mean destroying what you value, supposedly in order to protect it ... but that would obviously be a total failure at achieving that goal.

The point is: Part of living in a world that is as close as possible to perfectly secure is that you have to mitigate the risk of concentration of power in the hands of authoritarians and corrupt people. Limiting the power of the state is a security mechanism, and authoritarians who want to obtain more and more power by calling their power "security" are simply lying.

If you accept that authoritarians dismantling security mechanisms is somehow an increase in security, you have already fallen for their propaganda.

<comment><USER33> > I don't like it because it suggests that freedom and security are somehow at > odds with each other, which is already an authoritarian framing of the > situation, and really just nonsense.

Agreed. I think part of the issue stems from how people define freedom, seemingly thinking that freedom means "no rules".

For example: If having rules is intrinsically against freedom, then why would anyone who desires freedom play sports, where rules define the game. If you eliminate the rules, you eliminate the game _and your freedom_ to actually be able to play it.

<comment><USER34> Freedom means you get to pick the rules; they can't be imposed on you by others. The thing is, you can't pick one set of rules for yourself and a different set for everyone else. Whatever rules you choose to live by must apply equally to everyone. Don't like private property? Fine, but you can't object when others retaliate by seizing the fruits of _your_ labor. Think kidnapping for ransom is harmless fun? Locking you up in prison is essentially the same thing.

The problem is when certain people want others to live by _their_ rules and are willing to apply disproportionate force to get their way. Capital punishment for theft, fines and imprisonment for copyright infringement, penalties for refusing to aid an official investigation, etc.

</comment></comment></comment></comment><comment><USER35> Mandatory government access to all communications ( _including saved encrypted communications_ ) is not compatible with systems where the government or control of the government changes.

The thing that I don't really see discussed in this is the question of who do you trust to have the keys?

Personally I can't imagine entrusting decryption keys to anyone appointed by or simply hired by the Trump Administration given its history of choosing people for sensitive positions. I guarantee that there are a ton of people who think that Hillary should be locked up that would feel _exactly_ the same way about security keys under the control of any Democratic Administration. What's more, unless the policy becomes that all communication must go to the United States government to then be retransmitted onto a final destination then security keys would be vulnerable to disclosure by anyone from a former Administration who had access to them, and it only takes a limited number of compromised or dishonest individuals to compromise the entire system.

Don't discuss whether people are comfortable with the FBI or Department of Justice or William Barr having the authority to get to all of their Communications. Discuss whether they'd be fine with Barack Obama or Hillary Clinton or Eric Holder or whoever ends up being the Democratic nominee having that access.

Edit: moved last paragraph to first.

</comment><comment><USER36> I for one look forward to our federal overlords thinking they have any clue what kinds of transmissions deserve security /s.

Seriously though, the legal tradition just hasn't caught up to the idea that somebody can possess information outside their person that can't be forced into the eye of the law.

I've thought about this a lot and my best conclusion so far is "give up the encryption keys in exchange for immunity against legal cases that aren't yet open that the secured data might reveal, or you're guilty by default". Seems like the kind of thing prosecutors might think twice about, and it gives them a trump card in extraordinary circumstances. I don't love it, but all the other ideas i can come up with leave one party so heavily favored that either freedom dies or the government won't stop whining.

</comment><comment><USER37> Subpoena individuals and do investigative work. Identified individuals can choose to comply and reveal their digital artifacts that are specifically identified as being part of a crime or be held in contempt of the court order. If they don't use locks or use easily bypassable biometrics then the court order already allows latitude for that.

Just give up on being able to image and examine people's encrypted artifacts, and just give up on trying to tap a firehose of data from the providers now that they have an interest in encrypting what they store.

The state had a good 30 years of unprotected digital artifacts being available, and now it is just going back to the heuristic analysis of the days before, a level of accepted intrusion that government is built around.

<comment><USER34> > Identified individuals can choose to comply and reveal their digital > artifacts that are specifically identified as being part of a crime or be > held in contempt of the court order.

Abuse of "contempt of court" to compel third parties not accused of any other crime to assist in an investigation is _also_ a problem. The court can ask for the data, of course, but one ought to have the legal right to refuse; refusal to provide the requested data, on its own, should not be considered evidence of guilt or probable cause to conduct a search.

<comment><USER37> Agreed. The point is that is a separate issue and the tools for investigation are already here.

</comment></comment></comment><comment><USER38> To empathize with Barr, I can see how he doesn't draw much distinction between his experience at Verizon and the question of encryption.

He experienced the pain and consternation of regulation, and now feels erudite calling BS on "his old industry" as the defender of All Things Right.

But of course, when Hacker News is called upon to "nerd harder" we always rise to the challenge. Except when the difference is, in fact, fundamental.

Back doors have a way of becoming front doors for the wrong people. And absolute power corrupts absolutely.

All of that was true before. It's just that now getting the wrong set of keys could now open a billion locks at once.

</comment><comment><USER39> 99% is good enough?

If 1% of all secure public data transmissions were compromised there would practically be no point in trying to secure anything.

And who is Barr to decide what's worth encrypting on a societal level? I'll put my photo album through 5 different algorithms if I want to. Such is my right.

Go ahead Barr, make laws for corporations to follow and watch as all that data you're trying to capture disintegrate from the networks where you gave yourself access and reappears on even more secure smaller scale distributed systems.

What will happen is instead of Google hosting your data for you they'll just create devices that let you store your data at home, offline while only beaming back the telemetry and meta.

</comment><comment><USER40> There is also a false dichotomy based on the idea that law enforcement are the "good guys". In the Bay Area, traffic officers routinely get caught blackmailing women. Federal prosecutors routinely use "alternative reconstruction" where they keep the real evidence secret, and just lie to courts about the facts. US government computers are routinely breached by government employees, contractors, and foreign governments, and the results are then used to blackmail our politicians, influence elections, etc.

Barr should know about that last one, since he's in the middle of the current impeachment proceedings, and Trump has also been routinely calling for the prosecution of his political opponents for doing some of the things I just listed.

It is clear that even Barr is uncomfortable with giving these surveillance powers to the executive branch while a Democrat is serving as president.

</comment><comment><USER12> >If one already has an effective level of security say, by way of illustration, one that protects against 99 percent of foreseeable threats -- is it reasonable to incur massive further costs to move slightly closer to optimality and attain a 99.5 percent level of protection?

Except that's not the case. Encryption is mathematically proven to be 100% secure. Assuming the application was coded / implemented correctly, the only thing capable of unlocking encrypted secrets is the secret key.

AG Barr wants to move it from 100% secure to "99.5% secure". Not the other way around.

<comment><USER28> > Encryption is mathematically proven to be 100% secure

Well... no. We're pretty sure that factoring large primes is intractable, but nobody has actually proven it. And we know it's not that hard for a quantum computer. Modern cryptography is certainly not 100% secure for all time.

</comment></comment><comment><USER41> >>Yes, adding a backdoor increases our collective security because it allows law enforcement to eavesdrop on the bad guys. But adding that backdoor also decreases our collective security because the bad guys can eavesdrop on everyone.

And the bad guys can be the state. People need to acknowledge the phenomenon of systemic failure. People at large can know that the system is deeply flawed, yet not be able to fix it, because the problem is too complex to fix.

One could argue that situations where members of Congress see their compensation increase by an average of 1,800 percent when they leave office and become lobbyists, where fewer than 3 teachers in an entire state are fired in a year due to sweetheart collective bargaining agreements, where police unions protect officers from facing disciplinary action for miscondict, where the wage gap between federal employees and private sector workers has increased significantly since 1950, where more than half of the 20 wealthiest counties in the US are suburbs of Washington DC, where intelligence agents are known to use the state's surveillance apparatus to spy on lovers and exes through a practiced coined LOVEINT, where there are approximately 1 million federal regulations which hold potential criminal convictions for breaching, and where the prison population is 1 percent of the total population, are all examples of systemic failure, and the frequency of such failures requires us to check government power by enshrining legal principles like the right to privacy.

Information is power and centralizing information in the hands of a small government elite through mass surveillance leads to power asymmetry that is dangerous to society.

</comment><comment><USER42> Keep in mind, while you cheer on ending the tech industry's free reign and bringing in adult supervision and regulation, that this is what it means.

<comment><USER43> Can someone help me understand why technologists and entrepreneurs on HN cheer on "ending the tech industry's free reign", when they are part of the very same tech industry?

<comment><USER44> Because those closest to a thing can see the bad things it does. If you then conclude that doing the bad thing is game-theoretically rational, then regulation is needed. Hence, you cheer on adding regulation.

<comment><USER42> One of the problems with the regulation debate framed in terms of "more vs. less" is that it's easy to assume increased regulation will fix what you consider bad and preserve what you consider good, or that deregulation will only cut pointless bureaucracy.

It's distressing that the support is for more regulation in general (which can be easily coopted to support stuff like this), rather than specific policies or outcomes.

<comment><USER44> It's a response to the conservative voice saying 'deregulate everything'. You first need to argue for regulation per se before you can argue for specific regulations. The nuanced position of 'regulation isn't inherently good, but this specific policy is' is blown away in the public debate by 'REGULATION BAD'.

</comment></comment></comment></comment></comment><comment><USER45> Just as the government has been pretending that backdoors are possible without a loss of privacy, the tech community has been pretending that backdoors are indistinguishable from a complete loss of the benefits of encryption.

Don't get me wrong: I'm totally against backdoors, and I do consider them a significant weakening of any encryption.

But it's just disingenuous to insist that, for example, a system with the same sort of requirements as exist for search warrants is entirely equivalent to a system without those. Or that one-out-of-two encryption schemes do not exist. Or that it is totally impossible for an agency to keep a keyfile secure.

As but one example for the last: SSL certificate authorities are already entrusted with keys whose loss has just about the same sort of security implications as breaking messaging encryption might have. And that system is working somewhat decently, including in cases where those keys were breached and certificates had to be revoked.

<comment><USER46> > SSL certificate authorities are already entrusted with keys whose loss has > just about the same sort of security implications as breaking messaging > encryption might have.

A leak of the private key for a SSL certificate authority (or even for the server itself with modern TLS) doesn't allow decrypting past messages, while these backdoor proposals aim to allow precisely that.

</comment></comment><comment><USER47> Relevant.

* Honest Government Ad | Anti Encryption Law - YouTube || [https://www.youtube.com/watch?v=eW-OMR-iWOE](https://www.youtube.com/watch?v=eW-OMR-iWOE)

Also worth noting that Australia already went ahead with their anti-encryption laws. Feels inevitable that we'll lose encryption to the nanny state. Really sucks, but I haven't got a clue how to convince the grandmothers out there why the cops shouldn't be trusted here. It's so frustrating.

* Government Surveillance: Last Week Tonight with John Oliver (HBO) - YouTube || [https://www.youtube.com/watch?v=XEVlyP4_11M](https://www.youtube.com/watch?v=XEVlyP4_11M)

I think it'll be one of those things that society won't wake up to needing until it's long gone. Depressing as fuck.

</comment><comment><USER48> I feel like it is inevitable that any back door you legislate ... will get more use out of enemies of that given state than the state itself.

Any state with strong individual rights and courts will be limited in their usage to some extent. Outside actors, unlimited.

</comment><comment><USER49> I guess it should be illegal for Ransomware providers to generate encryption without government backdoors too, eh?

On a side note, with the new Australian laws, is it now illegal to use tools like LUKS and Veracrypt there?

</comment><comment><USER50> "Yes, adding a backdoor increases our collective security because it allows law enforcement to eavesdrop on the bad guys." No it does not. By definition if the backdoor exists the bad guys won't use it. This is clearly an excuse for monitoring all people not just the bad guys, and has little to do with security and everything to do with control. Please stop accepting the argument that collective security is improved with eavesdropping, it really really isn't.

</comment><comment><USER51> Why would anyone listen to Attorney General Barr regarding information security issues instead of actual experts?

 _> This is exactly the policy debate we should be having_

Why is this debate needed? It's beating the same dead horse since this debate already happened in the past. It was made clear, that backdoors are not an option.

<comment><USER52> Because AG Barr is the expert on law enforcement capability, which is being weighed against security. Nobody including Barr himself denies that his proposal would weaken security.

<comment><USER51> I meant in the context of "it's worthwhile to weaken information security". This debate is over and he is just beating the dead horse.

</comment></comment></comment><comment><USER53> DES was built to be brute forced by govt computers.

Don't trust any cryptographic standard put forth by the NSA, ever. They have always been about backdoors.

<comment><USER54> Source? Wikipedia says exactly the opposite: [https://en.m.wikipedia.org/wiki/Data_Encryption_Standard](https://en.m.wikipedia.org/wiki/Data_Encryption_Standard)

NSA made DES more resistant.

<comment><USER53> No they didn't.

They reduced the key space down to 56 bits. Which was small enough for government computers to hack even decades ago. The original proposal by IBM was for 128 bits IIRC.

[https://en.m.wikipedia.org/wiki/56-bit_encryption](https://en.m.wikipedia.org/wiki/56-bit_encryption)

That is interesting that the Wikipedia page you linked claims the contrary and makes me suspect tampering.

Because this story has been told over and over again, even in textbooks. See Springer's Understanding Cryptography chapter on DES for instance.

EDIT: In fact, the Wikipedia page you linked states

 _DES, as stated above, is insecure. This is mainly due to the 56-bit key size being too small._

So where is this nonsense about the NSA making DES more secure?

<comment><USER55> From [https://www.schneier.com/blog/archives/2004/10/the_legacy_of...](https://www.schneier.com/blog/archives/2004/10/the_legacy_of_d.html)

"It took the academic community two decades to figure out that the NSA "tweaks" actually improved the security of DES. This means that back in the '70s, the National Security Agency was two decades ahead of the state of the art."

<comment><USER53> Talk about cherry picking info. From TFA, if you had bothered to read it:

 _By the mid-1990s, it became widely believed that the NSA was able to break DES by trying every possible key. This ability was demonstrated in 1998, when a $220,000 machine was built that could brute-force a DES key in a few days_

<comment><USER55> Two NSA issues are getting conflated:

(1) Keeping the key size within brute-forcing range. Agreed, they did that and surely wittingly. By the mid-90s nobody doubted they had the computational strength for it; the 1998 demonstration was that any modestly-funded organisation could too.

(2) Improving the resistance to differential analysis by changing the S-boxes. This is what the Schneier quote is about: the NSA making a change and refusing to disclose the basis, causing suspicion that this installed a backdoor for them, whereas in fact it was (as far as any public cryptographer has disclosed) strengthening it against a cryptanalytic technique that the NSA didn't want to reveal.

</comment></comment></comment></comment></comment></comment><comment><USER56> Let's not pretend that Law Enforcement (aka The Government) is asking for these powers in a vacuum. Every time a terrorist event happens, or pedophile ring is broken up the public asks why it was not prevented or stopped sooner.

The argument of data security vs physical security needs to take place with your neighbors and not just your Senators.

Don't get too mad when Law Enforcement does what your neighbors ask.

<comment><USER57> I see this trope a lot around these kinds of discussions, but don't really see this going on as much when such events actually happen. Sure, it happens to some extent but I really wonder whether this claim (saying that large numbers of people basically demand more and more surveillance whenever any major crime happens) is instead hugely exaggerated and pushed by those very people trying to push more and more surveillance...

</comment></comment><comment><USER58> The thing I have never heard anyone talk about is what the repercussions should be for those asking for a back door when the door is used by malicious actors. We have seen companies like Wells Fargo commit company wide bank fraud...no one goes to jail. We have seen companies like Equifax lose millions of people's worth of personal and financial information...no one goes to jail.

When Barr and Trump push through legislation that requires back doors put into all our security, who is going to do jail time when all our personal information is leaked again? I try to put the least amount of info out there but when I do I use crypto that I know works, that I know who and how it was designed, who and how it was audited. When the government comes in and some intern loses a USB stick with keys to the back doors I wanna know who's head is gonna roll for it.

</comment><comment><USER59> I see this as fundamentally un-American. To quote Benjamin Franklin

* Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety.*

Additionally I think there is a fundamental misunderstanding, or lack of understanding, of Pareto[0] and fundamental statistics. At this point we are scraping the bottom of the barrel for safety. We are in the safest time in world history. We are in one of the safest times in American history too^. Certainly in the last couple decades. Yet for some reason we are treating issues of safety as if they are worse than the 90's. And if we can make a statement that is only 99% secure then we're pretty much screwed. 1% of attacks/opponents/people being protected (whatever that measurement of "threats" means) is really low. If it's attacks, well give it a few minutes (that'd be consistent with previous back door implementations). If it's opponents, then really anyone we actually care about is going to happen access (there are far more than 100 countries with computers). If it's people being protected, well there are 350m Americans. That leaves 3m Americans vulnerable. Any of these cases are unacceptably low and I'd argue actually set us back.

The other thing is that even implementing mass surveillance wouldn't help us. In many ways it has more potential to harm us. Like many in the thread have said, it isn't just personal privacy at hand. Politicians, high profile business people, etc can easily be blackmailed. It doesn't even have to be some kink (as others have suggested). Just something like sending nudes to a partner or a charged joke that is taken out of context (how many of you have dark humor or use jokes to illustrate a point?). Nation States will definitely gain access to these backdoors. It's highly likely hackers will as well. Additionally everyone does have something to hide. Banking passwords, sensitive information, personal thoughts and feelings^^.

So we are going to give up a fair amount of liberty for a minute amount of security? (Possibly negative security!) This does not sound like a good deal for anyone involved. I don't think it even helps law enforcement. They already can't handle the information that they have. We've seen that with data they have, or could easily obtain, that things are obvious in post hoc (like someone on 4chan saying they are going to shoot up a school).

How does this help us as American people? That needs to be honestly answered. Otherwise all I see this as a ploy on fear and overreach. We used to fear Big Brother. I'm not sure why or how we have come to embrace him.

[0] [https://en.m.wikipedia.org/wiki/Pareto_principle](https://en.m.wikipedia.org/wiki/Pareto_principle)

^ the issues at hand I do not believe would be solved in any way by monitoring because monitoring does not fix the root causes, which are clearly solvable.

^^ lack of being able to share these will only increase our problems.

</comment><comment><USER60> I wanted to write a post about how the encryption would interact with free speech, especially given the leaked memo to censor the Internet.

Let me start by stating my views on free speech and rights in general, and then how they are shaped by these events. I think that human rights and freedoms are just that: personal freedoms. Freedom of religion is about personal religious observance without harming others. These freedoms philosophically should not mean entitlement to unlimited exercise thereof. The right to bear arms doesn't mean you should be able able to stockpile unlimited amounts of ammunition and incendiary devices etc.

Similarly, FREEDOM of speech to me is a PERSONAL human freedom. You can say what you want, and not be punished by the government for it. You can say it in a car, you can say it in a bar, you can say it very far, you can wish upon a star. But there are limits to how many people can hear you. Maybe 10 or 100 people at an event.

Once you get into situations where 5,000,000 people can hear a tweet, that's clearly not about FREEDOM of speech in its strict sense. It is about entitlement to use a PLATFORM, maintained by an ORGANIZATION that involves many people, to broadcast arbitrary, unfiltered one-to-many messages to everyone.

I think this latter thing is toxic, in both directions. Society listening to tweets of celebrities cheapens public discussion and civic thought. And being reachable by the whole world using email (rather than through networks of shared invited/capabilities) leads to constant spam and papparazzi for celebrities. What happened here is an ORGANIZATION put on a show or movie and catapulted this celebrity into the limelight and carefully maintains their stature, along with their own publicists, social media team on twitter, etc. This is the society we live in, where we have heroes. But entitlement to unlimited unfiltered megaphones is NOT the same as freedom of speech, any more than being a leader if a paramilitary group of unlimited size is the same as the right to bear arms. So, freedoms and rights have limits. Where those limits lie is the heap paradox - as you take away grains, when is a heap no longer a heap? etc. So what is the alternative to this type of misnamed "free speech" aka megaphones run by organizations, super PACs, mainstream media, and so on? It is COLLABORATION.

      Look at Wikipedia.
      Look at peer reviewed journals and science.
      Look at large open source projects

There, individual contributions are filtered and often butt up against changes, revisions, etc. The result is that when the general public sees something, it is the result of a collaborative process of filtering and refining the presentation of information, citing sources, etc. There are no heroes on wikipedia, and only a few in science and open source. Most contributions are filtered by a community of experts, not state governments or platforms employing boiler rooms of low paid workers to determine what's true. I would like to see more of that COLLABORATION and less of COMPETITION.

I would like to see a patentleft movement in drug research, instead of big pharma. I would like to see news reported like Wikipedia with footage submitted by everyday people on the ground instead of "intrepid reporters in a warzone". CNN used to have a motto that they have "no celebrities". News agencies tried to stay lukewarm and neutral. FOX News changed the game, lots of people copied the model. The Internet eliminated newspapers and classifieds. News had to adapt because capitalism and cutthroat competition for the same ad dollars means MORE clickbait and MORE lockin to one type of audience. For-profit Social networks further use this content to herd us into echo chambers of outrage, because that's what drives the most engagement, which the social networks need to monetize. They send notifications in an increasingly desperate attempt to grab your attention in a tragedy of the commons where the commons is our attention.

This has had a corrosive effect on society. The capitalist (competition based) news has made us more polarized and outraged, while the capitalist (competition based) social networks have made us more addicted to our notification slot machine, with smaller attention spans and self control, responding to that stranger on the internet over that latest outrage.

THIS is the culture that leads to more mass shootings. The fact that we have giant platforms instead of peer to peer is another problem. By banning extremist people from platforms, a platform can pop up which attracts the worst extremists, and feeds them. This platform should ABSOLUTELY be a honeypot for the FBI to watch these people. In our world of centralized platforms, Platforms like this should be RUN by the FBI. Instead, our government takes the wrong approach. They shut down the Craigslist and Backpage hookers sections instead of using them to entrap and catch traffickers. Then they threaten large platforms with SESTA (2018) when they should be the ones catching the people who are out there. The platforms should be honeypots!

Anyway. So although I feel my stance is correct, and beneficial to society, there are three practical problems with it:

1\. First Amendment is not interpreted as I do. In fact Citizens United even allowed our politics to be run by PACs with huge money and megaphones (although nonprofits could have always done that). So legally my literal understanding of limits of freedoms is not matching the traditional ones (slander, yelling fire etc.)

2\. This may be the more serious one. As we have more end to end encryption and better personal technology, all well-meaning ideas about limits of freedom of speech and arms melt away. Imagine Alex Jones on SAFE Network with 1,000,000 people subscribed to his encrypted feed. Or imagine 3d printed guns from illegally shared 3d models, stored in 10% of the homes in NYC. Can't stop people using a turing complete language to turn out banned material.

3\. Even with numerical limits on each person's audience, a hateful message can attract people who make plans to use technology to asymetrically perpetrate criminal acts. And end-to-end encryption means we won't know what they're saying. However, I believe that if we took the freedoms in the way I defined them, and moved to collaborative platforms instead of competitive ones, our society's health would measurably improve.

</comment><comment><USER9> > Nor are we necessarily talking about the customized encryption used by large > business enterprises to protect their operations. We are talking about > consumer products and services such as messaging, smart phones, e-mail, and > voice and data applications.

This very American attitude of separating "business enterprises" from "consumers", which to me sounds like separating the noble and important from peasants or cattle, is utterly sickening. I am not a "consumer", I am a person and I deserve and _demand_ more privacy and freedom than a corporation.

We are not consumers, we are people.

<comment><USER61> Please don't post unsubstantive comments to HN, and especially not indignant riler-uppers. Those lead to noticeably worse discussion, and we're trying to drive in the other direction.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER9> Noted, but in what way was this not substantive? I'm expressing my opinion on a particular subpoint which is quite relevant to this discussion. If Barr was was not pushing for an artificial separation between the corporations and consumers, there wouldn't be any discussion to have, since taking encryption away from corporations is a non-starter.

Just as a disclaimer, I've read the guidelines and know them well.

<comment><USER61> If I take out the nationalistic slight ("This very American attitude"), the sarcastic rhetoric ("separating the noble and important from peasants or cattle"), the denunciatory venting ("utterly sickening") and megaphone language (" _demand_ "), it's not clear to me what information is left. What is the comment really saying? Something about how businesses aren't people? To me it reads like an angry reaction to some shallowly triggering phrasing in the article. Angry reactivity is the opposite of thoughtful reflection, which is what we're hoping for here.

It's also off topic. Whimsical off-topic digressions can be interesting, but generic rhetorical ones are never interesting. Those discussions have been repeated countless times already, thus are predictable, thus are tedious, so we ask people to avoid them. The more generic a subject, the more shallow its discussion—and when it's angry as well, that's much worse. Angry plus shallow equals riler-upper, which is close to flamebait.

<comment><USER9> You're right, I was a bit angry when I read this. It's rather hard not to get angry given the topic. I agree I could have phrased it more tactically.

I understood your point and I'm not trying to prolong the discussion. However, I consider the implication that my comment was entirely devoid of a point a bit unfair, so I'll try to rephrase.

I think there is no good argument to be made for stripping away the privacy of citizens, with the implication that it's okay since they are somehow less important than businesses. The fact that this is now getting somewhat regularly proposed is scary and a danger to liberty. To me, Barr's statement reads as a long-winded way of saying "it's not too bad if we punch holes in your encryption because your systems weren't secure to begin with and you're also not that important since you are just consumers". My point was to call this out explicitly and try to invalidate it as an argument for breaking encryption.

<comment><USER61> If you had posted that last paragraph originally it would have been a fine way to make your point. That's the basic idea here.

</comment></comment></comment></comment></comment></comment><comment><USER62> I actually appreciate Barr's point. Honestly given the cost of not saving lives that could have been saved, abducted children, potential active shooters, terrorist threats all surrendered for the benefit of me getting end to end encryption to ask my wife what kind of drink she wants me to buy from Starbucks. I, speaking only for myself, find _lawful_ access to such personal messaging, given probable cause of a crime being committed and a warrant signed by a judge, tolerable and reasonable.

I also get the sentiment that people have more of a problem with the idea of government access to private communications than with weakening the encryption to allow it. I see a lot of the conversation being all about privacy, and not about encryption.

In discussion of the latter I don't have a lot to add, but in the former, the courts have decided many times over that law enforcement and the state can access information about you if they have probable cause that you're committing a crime. If you enjoy living in a society governed by laws and don't tend towards libertarian extremes of personal freedom it's something worth accepting and the discussion on the highest level of whether we should or shouldn't do this doesn't even consider this side of the argument, despite it filling up 90% of the user generated discussion about this topic whenever it comes up.

<comment> self-reference This perspective really bothers me— I'm sure I'm not the only one. It seems to presume that the current state of affairs, where the police lack some ability to access some of the evidence which is in principle available, is a novel situation demanding of a novel response.

But, like, it's not like the original ratifiers of the Bill of Rights didn't understand what they were doing. They _knew_ that by outlawing common law enforcement practices like arbitrary searches and coerced confessions, they would be giving up some of their ability to "punish" certain types of "criminals". They got that it meant they couldn't listen in on a man's conversation with God. That's the deal they struck to try to form a country governed by laws, not by men.

It really seems like it's not such a new situation, after all; we just have new values.

<comment><USER63> Founding fathers had no way of knowing of the current state of affairs, technologically speaking.

Imagine billions of unbreakable safes containing secret messages to and from anyone globally, instantly transported to anywhere in the world.

Like, dude, anyone with the appropriate security clearance that is aware of the implications of the encryption status quo isn't spending time posting here.

<comment><USER64> No wonder you're using a throwaway to post this

<comment><USER63> I can't downvote you but your response doesn't add any value to the conversation.

<comment><USER64> I was going to respond, but there is no point arguing with trolls posting pro- authoritarian opinions from a fake account because they're too scared to have their thoughts tied to their identity in any way

</comment></comment></comment></comment></comment></comment><comment><USER65> As a security researcher, I would like to present a counterpoint to the general discussion here, unpopular though it may be: Access to the internet is a privilege, not a right. There is nothing in the US Constitution regarding the internet. An individual is not required to use the internet to communicate with another person, this is a matter of convenience, ergo privilege, but not a right. Along with face to face meetings, letters and phone calls, individuals are also, through the power of software, allowed to implement their own encryption over existing communications channels.

The internet has been a force of good, but also a force of evil, in this world. Rapid dissemination of personal opinion masquerading as fact has lead to extremism and polarization across the globe, this is undeniable. Some degree of accountability needs to be introduced into the system for the internet to reach the next level of maturity. The government is allowed to access your telephone records. The corporation holds your records to a certain date as mandated by law, and hands them over when a lawful request (warrant) is made. Full-on disk encryption and end-to-end encryption make it impossible for the government to access those records even when a lawful request is made. Note that the Fourth amendment states _unreasonable_ searchs and seizures. That does not mean the individual is allowed to be _impervious_ to searches and seizures. The reasonableness clause protects the interests of the state and allows courts to decide yay or nay on a case by case basis. That is the very intent and spirit of the law.

Currently technology, not law, is the gatekeeper, and technology is controlled by corporations. In a lawful society, this is untenable in the long-term. If anything, it enables tyranny by corporations, since they are unelected and not responsible to the public, whereas elected governments, in fact, are. The history of US is replete with cases where corporations have grown too powerful and governments required new laws to counter the threat they presented to society.

<comment><USER66> > Access to the internet is a privilege, not a right. There is nothing in the > US Constitution regarding the internet. An individual is not required to use > the internet to communicate with another person, this is a matter of > convenience, ergo privilege, but not a right.

I think the recent 8-0 ruling by the Supreme Court completely invalidates this statement in the context of the government being able to block ones access to the internet in general.

> Justice Anthony Kennedy began by outlining what he described as a > "fundamental principle of the First Amendment": that everyone should "have > access to places where they can speak and listen, and then, after > reflection, speak and listen once more." And even if once it may have been > hard to determine which places are "the most important" "for the exchange of > views," Kennedy concluded, it isn't hard now. Instead, he reasoned, it is > "clear" that the Internet and, in particular, social media provide such > opportunities, with "three times the population of North America" now using > Facebook. Emphasizing that Packingham's case "is one of the first this Court > has taken to address the relationship between the First Amendment and the > modern Internet," Kennedy warned that the court should "exercise extreme > caution before suggesting that the First Amendment provides scant protection > for access" to ubiquitous social-networking sites like Facebook and Twitter.

Source: [https://www.scotusblog.com/2017/06/opinion-analysis-court- in...](https://www.scotusblog.com/2017/06/opinion-analysis-court-invalidates- ban-social-media-sex-offenders/)

<comment><USER65> That's an excellent ruling, thank you for sharing that. Brings the internet closer to a "right" for certain, but does not require the government to provide access to the internet.

And, it may not matter: When making its case, the Justice Department will disassociate the use of encryption technology from access, arguing that limiting encryption options on consumer devices does not limit participation in an online forum.</comment></comment></comment>


Would you consider replacing Ruby with Rust instead of Go? - <AUTHOR> I'd love to see comments that don't consider the amount of libraries but the languages themselves since eventually more open source will exist in Rust. This is mostly a question of someone doubting go because of this http://yager.io/programming/go.html <comment><USER2> Rust and Go are very different languages, with very different aims and objectives. They are often mentioned together, as a few years ago around about the time Go went public, they both talked of themselves as 'Systems Languages'. But they meant very different things by that.

Ruby is not a language that would ever be used for writing a web browser, Virtualmachine, OS kernel, or other high performance low-level software.

Nor is Go.

Rust is.

Ruby and Go are languages for writing servers, web apps, 'scripting', and high level stuff.

Rust has the interesting property that it may well be possible to write relatively sane higher-up-the-stack server software, in the land that Ruby and Go currently are popular, but it's not there yet.

If you want a replacement for Ruby, and don't want to use Go (for whatever reason), then I'd really advise asking "Why?", first.

If you want to learn and grow as a programmer, then learn a bunch of languages, and don't get too hung up on whether or nor they'll last. There's a good chance that in 20 years time we'll all be using something totally weird and different, so learning a bunch of different ways of working and learning to think in different terms from Ruby may be more use than any specific language. Learn Haskell, Rust, Racket, Erlang, Assembly, Forth, Ada, Fortran, C, D, Clojure and Scala, say.

If you want a very practical language for writing server stuff, quickly and without having to learn too much new stuff straight away, then maybe look at Elixir, Kotlin or Ceylon.

If you're happy with Ruby, then there's no real reason not to stick with it. It's a good language, and a lot of fun to use. (Elixir is superficially similar, if the aesthetic of Ruby code really appeals to you).

Rust should be pretty easy to write extensions for ruby in, so if you want to try branching out into Rust, for doing high performance / low-level stuff, then give that a go.

<comment><USER3> Go would be decent for applications asymptotically approaching web browsers if the user interface options were better. It's UI library support that makes Go such a bear for desktop applications, not any fundamental property of the language.

In general, I find Go works really well for anything I would normally code in C in userland.

A better way to put it: if you can reasonably write it in Java, you can almost definitely write it in Go. Nobody calls Java a "scripting language".

<comment><USER4> > Go would be decent for applications asymptotically approaching web browsers > if the user interface options were better.

No, it wouldn't. Browsers are too performance critical. You need an industrial-strength optimization pipeline in the compiler, and even having a GC is risky.

(There are numerous other smaller-but-still-critical reasons why Go's design prevents it from working as the implementation language for a competitive browser, but these two are the biggest show-stoppers.)

<comment><USER3> I agree, which is why I replaced "applications like web browsers" to "applications asymptotically approaching web browsers".

</comment></comment></comment></comment><comment><USER5> While the points in that article are valid, in practice they don't cause as much trouble as Go trolls think. :)

As for moving from Ruby to Rust or Go, Go is almost guaranteed to be faster for developers to learn. The reason for the complaints in the article is that Go is intentionally simple, and you're seeing many people migrating from dynamic languages to Go for those benefits. The fact that Go has its roots in C will make it immediately understandable to anyone with experience in a C-type language.

My final thought is going to address libraries and widespread acceptance. Regardless of your thoughts about Go as a language, there is no doubt it is here to stay. Underlying major technologies like Docker, it has already seen massive adoption. While initial signs are positive for Rust, you're still betting that it continues to build momentum and doesn't stagnate like Haskell.

<comment><AUTHOR> I agree many people use Go for it's simplicity for new developers which is understandable but not the only way to measure why a language should be adopted.

I'm yet to verify this, but it seems that Rust is closer to Haskell in that it intends to enhance the likeliness of program correctness as it's being written and not only through testing. In go you still get runtime errors and I don't think it's all that rare, Rust should reduce those greatly.

I do share that adoption through libraries and widespread acceptance is very important and when you compare Rust to Haskell you make a nice point, the language could be great but not generate adoption.

However besides adoption I don't see anyone who seem to dislike the process of writing Rust itself. Apparently people think it's viable if more libraries are out there. The natural presentation of the arguments made me feel that people are open to it should the right libraries be there.

</comment></comment><comment><USER6> > I'd love to see comments that don't consider the amount of libraries but the > languages themselves since eventually more open source will exist in Rust.

That doesn't seem like the kind of comment to start a meaningful conversation. I must ask, what data do you have behind that statement.

I think both languages offer their own set of pros and cons.

For me, Go has been my go-to because of the maturity of the language. And, it has been implemented in systems that run at a very large scale by people within Google/YouTube as well as CloudFlare.

Would I consider it? Honestly, maybe one day. But that depends on how the language, and related things, mature over the next few years. And I think it's after the libraries have filled-in, and there is experience running systems built with it at scale.

Go is allowing me to solve the problems I have right now with some well-built packages. Is it perfect for everything, no. But it does well in a lot of areas.

<comment><AUTHOR> It's not my intention to close the conversation but to try to make it richer by not focusing on the historical advantage that Go has over Rust. You are correct in that it's possible that not much more open source will exist in rust since it could simply fail to acquire any massive adoption.

I do think there will be space for both and I would prefer to consider them as raw tools, hence the language themselves, and take the risk of having a community in the future sharing libraries for common things. It's a risk but not a crazy one I'd say and probably helpful for the analysis.

Building on your reply, I'd say prove of adoption is one downside for choosing Rust. This however ignores the merit of Rust as a language which hints me into what I have begun to see more often: that it's the newness and relative absence of production use cases that don't seem to validate it viability, not some inherent complexity or downside to the language itself.

</comment></comment><comment><USER7> No, Go is more simple, in terms of syntax among other things. The threading model in Go is very attractive as well, please refer to this article: [https://swtch.com/~rsc/thread/](https://swtch.com/~rsc/thread/)

<comment><USER4> > The threading model in Go is very attractive as well, please refer to this > article: [https://swtch.com/~rsc/thread/](https://swtch.com/~rsc/thread/)

That's a nice overview of CSP. It's not a selling point for Go over Rust. Rust threads are in fact a purer implementation of CSP than Go goroutines are.

<comment><AUTHOR> Go offers thread as channels directly expressed in the language Syntax, not as a semantic construct on top of them. That is of course attractive for it's simplicity, but Rust offer a lower level alternative. I don't have much experience with Rust, but maybe a clever macro could be use to express in a higher level the type of things you'd use go channels for.

Going back to my proposed question, maybe people can prefer golang for this syntactic benefit but I don't think that addresses the larger set of differences that usually separate them.

</comment></comment></comment><comment><USER8> IMHO, Ruby is still one of tthe strongest language in term of ease of use, object orienteness and features. Go and Rust compared to Ruby will adress not performance but core scability and this can be addressed in numerous ways in every architecture.

<comment><AUTHOR> I agree that you can address the scalability problem in every architecture in different ways. In ruby you'll typically have a mix of vertical and horizontal scaling that often results in a significant consumption of memory. This even though feasible comes at a higher price on cloud resources. I have experience this first hand and I think it's similar (at much minor scale of of course) to what companies like Shopify have experienced as motivations to change to something like Go.</comment></comment>


How Pixar Lost Its Way - <AUTHOR> https://www.theatlantic.com/magazine/archive/2017/06/how-pixar-lost-its-way/524484/?single_page=true <comment><USER2> I miss the old Pixar. Yes, now Disney is making better animated films, but I'm not sure it's worth the loss of truly great Pixar films. Plus, it seems that Disney is slipping too. Though they released some good films after the acquisition of Pixar (Tangled was excellent), their recent releases have been... mediocre. I never liked Cars, Finding Dory could've been better... I suppose Moana was pretty good, but the exception to the new rule. Now to see good, emotionally resonant films, we look to other studios. Kubo was astounding good, for example. Props to Lassiter for his success, but it comes at the cost of great films for the whole family.

</comment><comment><USER3> Intentional talent drain. A tiny bit of anecdotal information from a talk given by a couple of Pixar artists was that if you were an artist, you could get paid 30% more in Southern California than at Pixar in Emeryville. Also talked to an engineer who left Pixar for Google. I think Bob Iger doesn't want an independent and powerful Pixar.

<comment><USER4> What's in Southern California?

<comment><USER5> Disney Animation is based out of Burbank. I think the writing was on the wall when John Lasseter took over as head of basically all of Disney's animation groups which includes Pixar.

</comment></comment></comment><comment><USER6> Frankly neither Pixar, nor Disney's animated films come anywhere close to Studio Ghibli's artistry in story-telling. The tech is definitely cool though.

</comment><comment><USER7> My suspicion is that Disney wanted Pixar's secret formula, but under its own brand. So they stole it, and fabricated a story about how the two studios work in parallel, and don't share ideas with each other.

<comment><USER8> _> So they stole it_

They bought it.

<comment><USER9> But they're on a different part of our floor.

[https://youtu.be/xnG1OiGGL0Q?t=41s](https://youtu.be/xnG1OiGGL0Q?t=41s)

</comment></comment></comment><comment><USER10> I know Jobs was pretty hands off with Pixar, but the fall of their creative height started when Steve moved on. I was surprised the article made no mention of this.</comment>