XRay Unreal Engine 4.5 source code - <AUTHOR> http://www.codergears.com/Blog/?p=965

<comment><USER2> Although this article points out that UE4 doesn't use synamic_cast, Unreal implements a full reflection system and uses it instead. Similarly, if you searched for uses of stl, you'd be is appointed because everything is reimplemented as TArray, TPair, TMap, etc.

<comment><USER3> _if you searched for uses of stl, you 'd be is appointed because everything is reimplemented as TArray, TPair, TMap, etc._

In case anyone else is wondering "why didn't they just use STL?", here's an answer from an Unreal employee: [https://answers.unrealengine.com/questions/2695/rocket- and-t...](https://answers.unrealengine.com/questions/2695/rocket-and-the- stl.html)

</comment></comment><comment><USER4> > ⁎((uint32⁎)3) = ExceptionCode

Is this just a way to force a segfault, or clever sorcery? What is significant about the pointer 3?

<comment><USER5> They're calling the Int 3 debugger instruction, I believe:

[http://en.wikipedia.org/wiki/INT_%28x86_instruction%29](http://en.wikipedia.org/wiki/INT_%28x86_instruction%29)

I'd prefer to see this either with inline assembly, or using __debugbreak() (and variants for other compilers). I'd say it's a deref because many compilers don't generate inline-asm for 64-bit skus. This makes the instruction always emitted, and then 64-bit platforms ignore it. But not always (recent claims say it works: [http://stackoverflow.com/questions/3634124/where-did- int-3-g...](http://stackoverflow.com/questions/3634124/where-did-int-3-go)).

<comment><USER6> Int3 is a one byte instruction, how do you imagine this code could possibly compile into one byte? This will compile into several moves/stores. Not to mention the code is not x86 specific at all.

It's a forced memory access violation and the 3 is used to distinguish it from a natural one: when you hit this you will see an immediate 3 load nearby and that's a constant that is rarely seen in code normally.

<comment><USER7> "Not to mention the code is not x86 specific at all."

Technically no, however it's only used in x86. It's only ever called if PLATFORM_EXCEPTIONS_DISABLED is 0. If you look up where PLATFORM_EXCEPTIONS_DISABLED is defined in Platform.h, you'll see it's only defined when not using PLATFORM_DESKTOP. PLATFORM_DESKTOP is disabled for Android, HTML5, iOS, WinRT, and WinRTArm. PLATFORM_DESKTOP is enabled for Linux, Mac, and Windows. So that instruction is only intended to be used in x86 desktop environments.

Considering this, I don't think RaiseException is well defined. If it's only meant to be used for x86, it should be coded that way instead of relying on other code to enforce the behavior.

<comment><USER6> >It's only ever called if PLATFORM_EXCEPTIONS_DISABLED is 0

Quite the opposite. The ! operator means a logical negation.

<comment><USER7> if PLATFORM_EXCEPTIONS_DISABLED means if it is not 0. if !PLATFORM_EXCEPTIONS_DISABLED means if it is 0, if it is not disabled. I said nothing incorrect, I'm well aware of what it means.

<comment><USER6> You said the code is being called only if PLATFORM_EXCEPTIONS_DISABLED is 0. This is incorrect. Just compile that function and set the breakpoints if you cannot figure out the #if/#else logic.

<comment><USER7> It's getting hit because you're running on Windows/Mac and Windows/Mac specific methods are calling it. In platform generic code like OutputDevices.cpp you see this:

        #if PLATFORM_EXCEPTIONS_DISABLED
        		FPlatformMisc::DebugBreak();
        #else
    		FPlatformMisc::RaiseException( 1 );
        #endif

<comment><USER6> I see. You are saying that because a library/framework is not calling one of its own functions in a certain configuration nobody ever going to call this function in that configuration, right? I am not sure I can join you in this belief, after all there are not that many fully recursive libraries so some functions will never be called in almost every library.

<comment><USER7> "You are saying that because a library/framework is not calling one of its own functions in a certain configuration nobody ever going to call this function in that configuration, right?"

I'm not saying that at all, I said early on that this is a problem. Refer to this in my first comment replying to you: "I don't think RaiseException is well defined. If it's only meant to be used for x86, it should be coded that way instead of relying on other code to enforce the behavior."

Internally it seems they only intended it to be used in specific cases, but there's nothing preventing anyone else from calling it when they shouldn't as you noted. This is bad design.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Testing the validity of mindfulness vs. the Big Five for mental health - <AUTHOR> https://www.sciencedirect.com/science/article/abs/pii/S0191886919307081 <comment><AUTHOR> Original title:

Testing the incremental validity of dispositional mindfulness over and above the Big Five in accounting for mental health: A facet-level structural- equation modeling and predictor communality and dominance approach</comment>


What happened to Verbly (YC12)? - <AUTHOR>

<comment><USER2> What did they do? Hopefully nothing similar to Verbling (YC S11)!</comment>


Google warns about two iOS zero-days 'exploited in the wild' - <AUTHOR> https://www.zdnet.com/article/google-warns-about-two-ios-zero-days-exploited-in-the-wild/ <comment><USER2> So far the two parent comments are quite negative, which surprises me. I understand the anti-Google sentiment, but Project Zero has been a much needed booster to the security of the public and it has born fruit. The fact that an iOS vulnerability is actively being exploited is notable. I think their method of responsible disclosure is reasonable.

<comment><USER3> There are cases that I'm all for bashing Google when they don't give the company they're targeting enough time to patch something (recently, seems mostly directed at Microsoft). This isn't one of those cases.

They seem to have waited until Apple had a patch ready, they disclosed it to Apple and gave them an adequate amount of time to patch the vulnerability, and users are better for it.

So in this case and others similar to it, kudos to Google.

<comment><USER4> >There are cases that I'm all for bashing Google when they don't give the company they're targeting enough time to patch something

While I understand the common ethos of our current culture supports this, has there been analysis if giving what could constitute a second chance to fix security issues leads to less prioritization of security initially? I could definitely see a business deciding to lower their security expenditure since if an issue is found, they will be given a grace window to fix it before the world hears about it. It would still be damaging, but it would be far less since the PR machine could spit out that it was patched before it was announced to the world.

There has to have been some agreement to limit the grace period since people will go live once a reasonable time frame to fix it has passed and they won't be judged negatively if others agree reasonable time was given. So if we won't judge someone for giving only 6 months instead of 3 years, what about the one who gives only 2 weeks instead of 6 months? How do we calculate which of two time frames is better?

<comment><USER5> If only Google would hold themselves accountable to the same standard. Android is a gigantic security mess, all caused and enabled by Google.

<comment><USER6> No it isn't? Android has a bug bounty program: [https://www.google.com/about/appsecurity/android- rewards/](https://www.google.com/about/appsecurity/android-rewards/)

and regularly has strong showings at pwn2own. Android's security for the past couple of years has been superb.

<comment><USER7> Android as an abstract project, yes. Android, as what's actually used by users, it's not that superb.

Google is slowly trying to fix it, but average Android device is way behind average iOS device in the wild, and that will be the case for many years to come.

<comment><USER6> > Android, as what's actually used by users, it's not that superb.

It is, though. The Android that's most commonly used by users is the one from Samsung, who also issues monthly security patches for a large range of devices: [https://security.samsungmobile.com/workScope.smsb](https://security.samsungmobile.com/workScope.smsb)

LG ( [https://lgsecurity.lge.com/security_updates.html](https://lgsecurity.lge.com/security_updates.html) ) does as well, and so do at least Motorola & Nokia.

> average Android device is way behind average iOS device in the wild, and > that will be the case for many years to come.

[citation needed]

Average iOS device just got hit by 2 zero-days in the wild. And jailbreaking is a long and well established practice on iOS, which is literally privilege escalation exploits. There's a constant, continuous stream of those on iOS. There doesn't seem to be many (any?) on Android for a while now.

<comment><USER8> >There doesn't seem to be many (any?) on Android for a while now.

To be fair, there are a variety of reasons why this isn't the case that have nothing to do with security. An Android jailbreak is less valuable for a few reasons, among them that you can often purchase android devices with root privs, the same isn't possible for iphone.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I wonder if one of these was used by the FBI's unlocking tool from the San Bernardino shooter case. That sort of just... fizzled out, with the FBI saying they could unlock iPhones themselves. Everybody kind of just said "yikes" to that statement and moved on...

[https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d...](https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_dispute)

<comment><USER10> I mean, the whole point of that issue was that the FBI wanted Apple to develop tools that would make it a lot easier for the FBI to do it later if they wanted to. It probably cost them a lot of money/time to do it the way they did. Plus, wasn't that the suspect's work phone anyway? So there really couldn't even be much that would have incriminated him on that phone. The point was setting a technological precedent.

<comment><USER11> > the FBI wanted Apple to develop tools that would make it a lot easier for > the FBI to do it later if they wanted to. It probably cost them a lot of > money/time to do it the way they did

No, they wanted to set a legal precedent.

<comment><USER12> Precedent was already on the FBI's side, just as in the Lavabit case.

</comment></comment></comment></comment><comment><USER13> Side question: whatever happened to Chrome blocking autoplay videos like this horrible and incredibly loud one?

It's supposed to have been in place for a year or so... but it's clearly not working. If this particular one isn't blocked, then what ones _are_?

I'm on up-to-date Chrome 72...

[1] [https://developers.google.com/web/updates/2017/09/autoplay-p...](https://developers.google.com/web/updates/2017/09/autoplay- policy-changes)

<comment><USER14> The autoplay blocking involves a complicated set of heuristics involving the domain name and your past behavior with that domain...

<comment><USER13> So I just checked my heuristics at chrome://media-engagement/ and zdnet.com has a personal MEI of 0.0 with 7 visits (for comparison, YouTube is 0.76), and the stated threshold at the top of that page for allowing video with sound is min 0.2 max 0.3.

So just ugh. Disappointed in Chrome that zdnet.com is somehow considered high enough quality to play videos with audio automatically. :(

<comment><USER15> zdnet.com has a score of 0 for me, and it still autoplayed.

</comment></comment></comment></comment><comment><USER16> To avoid the auto-playing video with loud volume, here's the entire content of the article:

[https://twitter.com/benhawkes/status/1093581737924259840](https://twitter.com/benhawkes/status/1093581737924259840)

"CVE-2019-7286 and CVE-2019-7287 in the iOS advisory today ([https://support.apple.com/en-us/HT209520](https://support.apple.com/en- us/HT209520) ) were exploited in the wild as 0day."

\--

A Google top security engineer has revealed today that hackers have been launching attacks against iPhone users using two iOS vulnerabilities. The attacks have happened before Apple had a chance to release iOS 12.1.4 today --meaning the two vulnerabilities are what security experts call "zero-days."

The revelation came in a tweet from Ben Hawkes, team leader at Project Zero --Google's elite security team. Hawkes did not reveal under what circumstances the two zero-days have been used.

At the time of writing, it is unclear if the zero-days have been used for mundane cyber-crime operations or in more targeted cyber-espionage campaigns.

The two zero-days have the CVE identifiers of CVE-2019-7286 and CVE-2019-7287.

According to the Apple iOS 12.1.4 security changelog, CVE-2019-7286 impacts the iOS Foundation framework --one of the core components of the iOS operating system.

An attacker can exploit a memory corruption in the iOS Foundation component via a malicious app to gain elevated privileges.

The second zero-day, CVE-2019-72867, impacts I/O Kit, another iOS core framework that handles I/O data streams between the hardware and the software.

An attacker can exploit another memory corruption in this framework via a malicious app to execute arbitrary code with kernel privileges.

Apple credited "an anonymous researcher, Clement Lecigne of Google Threat Analysis Group, Ian Beer of Google Project Zero, and Samuel Groß of Google Project Zero" for discovering both vulnerabilities.

Neither an Apple or Google spokesperson responded to requests for comment from ZDNet before this article's publication. It is highly unlikely that the two companies will comment on the issue at this time, as both would like to keep the zero-day specifics to a minimum and prevent other threat actors from gaining insight into how the zero-days work.

iPhone users are advised to update their devices to iOS 12.1.4 as soon as possible. This release also fixes the infamous FaceTime bug that allowed users to eavesdrop on others using group FaceTime calls.

</comment><comment><USER17> Any word on what apps included these exploits? I'm guessing there was at least one since they say "in the wild"

</comment><comment><USER18> I hold the unpopular opinion that Google Project Zero is pretentious and unprofessional.

I mean here we have the most valuable company on Earth, specifically scoping out competing software and hardware constantly looking for zero day vulnerabilities. They don't submit to the bug bounty, so if they have a disclosure that you disagree with you better agree quick because they'll just go public.

How fast do you think I would get sued if I found a zero day in a Google product, told Google to fix it, shove the bounty, and then went public 30 days later?

<comment><USER19> They're using iPhones themselves inside of the company, trusting the devices as part of their Beyond Corp security mechanism, so they have an interest in the software trusted to their company network being as secure as possible.

<comment><USER20> And we don't?

I want my phone to be as secure as possible because I use it for work, but of course, since it's not brand new I can't get updates.

<comment><USER21> This update is available to iPhones from the 5S and newer. The 5S was released in 2013. If your phone is older than that, it's a bit older than "not brand new".

<comment><USER22> I think the point is that he has an Android, but _he_ can't update, while Apple users can.</comment></comment></comment></comment></comment>


Faiss: A library for efficient similarity search - <AUTHOR> https://code.facebook.com/posts/1373769912645926/faiss-a-library-for-efficient-similarity-search/ <comment><USER2> This looks great. I'm actually giving a talk on this type of search for my Master's project this coming Friday. I was looking at providing semantic similarity search across a collection of research papers to build a "semantic research network".

Currently I'm using a lot of pre-processing on the backend before putting all the results in Mongo for end-users.. but this looks like I can get closer to real time with a modest GPU cluster. My only complaint is that I wish GPU support wasn't CUDA only...

<comment><USER3> Hi, I'm the author of the Faiss GPU code.

The GPU implementation depends upon a lot of particularities in CUDA (warp shuffles and warp ballots, tricks with using register memory), and gets much of its speed in this way.

Much of the code would be much slower if unable to use register file memory and instead forced to use shared memory instead (the k-selection most notably). Some needed functionality is supported in OpenCL 2.0; e.g.,

[https://www.khronos.org/registry/OpenCL/sdk/2.0/docs/man/xht...](https://www.khronos.org/registry/OpenCL/sdk/2.0/docs/man/xhtml/cl_khr_subgroups.html)

but are still extensions or implementation specific, and I wouldn't hold my breath for them to work well.

OpenCL tends to be lowest common denominator and for bleeding-edge GPU programming it won't map well. I don't think shuffles are supported at all in OpenCL (?). They are available directly in AMD's GPU ISA, but have slightly different semantics, and at that point you're just using something that is as proprietary as CUDA. Not to mention trying to support wavefront size 64 vs. warp size 32 etc:

[http://gpuopen.com/amd-gcn-assembly-cross-lane- operations/](http://gpuopen.com/amd-gcn-assembly-cross-lane-operations/)

<comment><USER4> Great work! As a demo, could you make a Reddit comment or thread search engine based on document embeddings? It would be interesting to search through the treasure trove with word vectors. The comment dataset is already available in the wild.

</comment></comment></comment><comment><USER5> This looks really interesting. Full search engines rank documents based on the similarity of a query to documents in the index, but it seems like there are a lot of opportunities to do more with similarities between content.

One thing I'm interested in is the ability to find the most dis-similar document to a query / other documents (perhaps within some constraints). I think this would potentially be really helpful for discovery. For context, on [https://www.findlectures.com](https://www.findlectures.com), I'd like to show talks on subjects I know the least about i.e., most dis-similar from all talks I've previously watched.

<comment><USER3> Faiss query, at least for IVFPQ which is the main emphasis of the library, is based on real vectors as input but against quantized database vectors; the so called "ADC" (asymmetric distance computation), so you don't have to query based on a database vector.

If the data is normalized to lie on a hypersphere, you could find nearest neighbors to a query vector on the opposite point of the hypersphere, for instance.

But, as we sometimes find with, say, negative mining, sometimes what you are interested in is not the "hardest" negative or most dissimilar object as those don't provide much utility in comparison to your current object; you might something that is reasonably close in some ways but quite different otherwise, which is a more useful negative example. This is more difficult.

<comment><USER5> Thanks for the comment, that is a good way to articulate the problem I'm interested in. For instance, seeing novel topics, but retaining some form of high quality results - "low quality" would also be an opposite result, but clearly isn't the right answer.

</comment></comment></comment><comment><USER6> How do you handle incremental reindexing?

Content creation has a high velocity and new multimedia is being generated every second. The methods in the paper assume that the dataset is static.

<comment><USER3> Remove is supported for some indices.

The indexing scheme (IVFPQ, IMI, etc.) is based on the statistics (distribution) of the underlying data. If the statistics of the new data are not changing much, then it is reasonable to just remove the old vectors and add new ones.

If the distribution changes significantly over time, then rebuilding the index by reclustering would be required. For large enough datasets, one would probably have multiple shards of data that are assumed to be reasonably independent. Individual shards can be periodically reindexed to replace the old shard, but this demands that the original vector data (e.g., 128-dim vectors * sizeof(float) = 512 bytes per vector) is kept around rather than the compressed form (4 - 64 bytes per vector).

As with anything, there is a tradeoff between improving query time versus query accuracy versus preprocessing/index build time versus data storage:

no build time, high query time, high storage, exact accuracy: Faiss IndexFlat

low build time, med query time, high storage, high accuracy: Faiss IndexIVFFlat

med build time, low query time, low-med storage, med-high accuracy: Faiss IndexIVFPQ

very high build time, low query time, low-high storage (whether stored as a k-NN graph or raw data), high accuracy: NN-Descent by Dong et al. (e.g., nmslib)

IndexIVFPQ with perhaps IMI is typically what we concentrate on, seems to be a reasonable sweet spot for billion-scale datasets.

<comment><USER6> Thanks for the response. Great work here.

</comment></comment></comment><comment><USER7> Could this be used for record deduplication? Say you have products from various data sources. A product has various features/facts that almost always don't line up 100%. Could this library be used to match over such records? One of the more specific constraints is that no 2 records from dataset A can match on 1 record from dataset B and viceversa

</comment><comment><USER8> Badly in need of a rename</comment>


Microsoft Bob - <AUTHOR> http://toastytech.com/guis/bob.html <comment><USER2> One of the first things I looked up in XP was how to turn the dog off in search.

</comment><comment><USER3> It was cool. Not sure why it was ridiculed so much. Microsoft hatred by default, I guess.

<comment><USER4> It was ridiculed because it _wasn 't_ cool. Microsoft made lots of things that people wanted to use. Nobody wants to spend $100 on some software without some clear benefit from it, and almost nobody who knows what their software needs are needs a product like this.

That confines this product to the aisle of "things you would never buy for yourself."

It's a classic UI dilemma: how do you simplify an interface without removing the functionality that makes the product powerful? However you'd answer that, what you don't do is bury that functionality behind a bunch of obscure analogies that have nothing to do with how that functionality works. The presence of a couch on that screen does nothing to help the user do anything that they need a computer to do, for example.

<comment><USER5> It reminds me Silicon Valley (S03E09) when they introduced "Pipy (or Piedpy?)" to help the user through their UI which user is too dumb to use..</comment></comment></comment>


100,000 code compilations on a mobile phone  - <AUTHOR> http://blog.hackerearth.com/2013/12/api-ecosystem-movement.html

<comment><USER2> "When services like CodeAcademy launched, its implications to the world of computer education was quite immense."

From what I can tell, the correct branding is "Codecademy." Yes its kind of awkward, but its good to be respectful of competitors.

<comment><AUTHOR> Thanks for pointing out. Have corrected it now.

</comment></comment><comment><USER3> Think it might be also worth thinking about Tasker. The java is pretty old and broken, but usable enough for me to make a game and publish it to the play store. Caedere, [https://play.google.com/store/apps/details?id=com.davesapien...](https://play.google.com/store/apps/details?id=com.davesapien.caedere&hl=en) Possibilities?</comment>


To succeed in Silicon Valley, you still have to act like a man - <AUTHOR> https://www.washingtonpost.com/news/posteverything/wp/2018/07/24/to-succeed-in-silicon-valley-you-still-have-to-act-like-a-man/ <comment><USER2> The quote that hit me is, paraphrased, "women have to play the part until they're well known enough to be themselves"

Yes, you have to act strong and confident or else no one from whom you need something will take you seriously. This applies to both men and women, in almost every walk of life. I fail to see a problem here. (Not in general, but that complaint is not well reasoned.)

</comment><comment><USER3> To back this up from a non-founder perspective, I know lots of women engineers who feel pressure not to dress in feminine ways in the workplace. They're taken less seriously when they wear dresses (even the casual kind that match the usual tech level of formality), have to pitch their voices lower to be paid attention to, etc.

There does seem to be a pushback, though - women dressing femme-er as an intentional attempt to change the workplace culture.

<comment><USER4> I bet the pressure is even greater for men not to wear dresses.

<comment><USER5> You joke, but I know a game developer who prefers to wear skirts in the summer.

He's an indie game dev.

<comment><USER4> I understand why you think that, but I actually wasn't joking. I believe people should be able to wear what they like.

Good on your game dev friend. That's not an easy thing to do.

Pacific Islander men often wear what we in the West would call a "skirt". This is all just an issue of culture. Our culture isn't necessarily the best, and certainly isn't "the right way".

In the past I have worn a lava lava in the hot Queensland summer. It's great.

[https://i.pinimg.com/736x/7a/6a/95/7a6a956128892187bba615ec6...](https://i.pinimg.com/736x/7a/6a/95/7a6a956128892187bba615ec6f363e50 --samoan-tattoo-polynesian-tattoos.jpg)

<comment><USER5> My apologies; I guess I'm too jaded from online discussions. I'm with you on that.

<comment><USER4> I don't think you have anything to apologise for.</comment></comment></comment></comment></comment></comment>


Life without source control – share your most painful moments. - <AUTHOR> http://www.troyhunt.com/2012/09/life-without-source-control-share-your.html

<comment><USER2> A bioinformatics lab I worked at developed a novel method of cancer drug prediction based on comparative genetic network expression from microarray data of normal and cancerous cell lines. First predictions were promising and small scale trials were done with the novel compounds. Very impressive results and a good paper resulted from this which supported further grants for larger trials. Then the lead researcher died unexpectedly.

Source code for the original prediction algorithm? Nowhere to be found. Intermediary data? Nada. We spent weeks combing through desktop, personal, and distributed computers trying to find that code to no avail. No more cancer drug experiments. The worst part to me was that this method looked for pre- existing naturally occurring compounds that were merely lacking in cancerous cells - hence reintroducing them would have much lower theoretical toxicity than other anti-cancer compounds. It's still theoretical because proper source control wasn't used.</comment>


Apple has shut down the first fully-functional Mac OS X ransomware - <AUTHOR> http://techcrunch.com/2016/03/07/apple-has-shut-down-the-first-fully-functional-mac-os-x-ransomware/ <comment><USER2> "...has shut down the first _fully-functional_ Mac OS X ransomeware"

Here I was hoping it was the second malware coded with functional programming. Scheme last time [1]. I was hoping to see some systems Haskell or ATS in there. Oh well. Always another opportunity when it comes to malware.

[1] [http://philosecurity.org/2009/01/12/interview-with-an- adware...](http://philosecurity.org/2009/01/12/interview-with-an-adware- author)

<comment><USER3> >Windows has this thing called Create Remote Thread. Basically, the semantics of Create Remote Thread are: You're a process, I'm a different process. I call you and say "Hey! I have this bit of code. I'd really like it if you'd run this." You'd say, "Sure," because you're a Windows process– you're all hippie- like and free love. Windows processes, by the way, are insanely promiscuous. So! We would call a bunch of processes, hand them all a gob of code, and they would all run it.

I...wait, what? Did Windows actually used to be that bad?

<comment><USER4> This still exists, and it's used by lots of extensions.

But you can only inject DLLs (this is how it's called) if your process already has some admin rights and if the other process is not of a higher integrity.

</comment></comment></comment><comment><USER5> Has the Transmission team offered any explanation of how the tainted binary ended up being served by them? My concern is that the attackers were also able to maliciously modify the Transmission source code.

<comment><USER6> Someone compromised their main web server where the binaries are hosted and put up a malicious binary.

<comment><USER5> Do you have a citation for this? The extent of what was illicitly accessed remains unclear. Without knowing how their infrastructure is set up, it's not possible to say that the intrusion was limited to just the web server.

<comment><USER7> Here's the Reuters article where they state that:

[http://www.reuters.com/article/apple-ransomware- idINL1N16F17...](http://www.reuters.com/article/apple-ransomware- idINL1N16F17Q)

<comment><USER5> Thanks for that, at least it's something. John Clay is listed here[1] as a contributor to "Website maintenance and troubleshooting, Mac OS X help documentation". I wish they would post a similar update on their website and explicitly confirm that the current source and binaries have been audited and are safe.

[1] [https://github.com/jparyani/Transmission/blob/master/AUTHORS](https://github.com/jparyani/Transmission/blob/master/AUTHORS)

</comment></comment></comment></comment></comment><comment><USER8> That is a poor error message. I would assume apple was trying to block me from using torrents rather than protect me from malware if I saw that error and hadn't kept up with the news.

</comment><comment><USER9> So this confirms that Apple revoking the app-signing certificate that pissed off a bunch of people was related to KeRanger?

<comment><USER10> No. They revoked that single developer's certificate. I think you're referring to an Apple certificate that simply expired and invalidated many App Store signatures.

<comment><USER11> They revoked the developer's certificate, or they blocked opening up of an image with a given checksum?

<comment><USER12> Both.

Apple has updated XProtect to detect the malicious Transmission disk image and prevent it from being opened, and has additionally revoked the developer certificate which was used to sign the application on that disk image to prevent any other applications they sign from being treated as trusted.

</comment></comment></comment></comment><comment><USER13> > The fact that OS X has now been targeted speaks to the popularity of Apple's > operating system

It's not a security breach it's a problem of rising popularity. That's one way to spin it.

<comment><USER14> It is a security breach but in the past most malware has been targeting windows because of the larger financial upside due to popularity. As OS X gets more popular expect more attempts like this.

<comment><USER13> You don't think it has anything to do with the fact that OSX is more secure than Windows due to the underlying OS being based on FreeBSD? The economics have been in favor of attacking OSX for along time now. Especially when you consider that OSX users likely have more money on average since OSX adoption has been much higher among the affluent.

<comment><USER15> The BSD angle is one component of the security. The other is strictly cultural. OS X users aren't in the habit of clicking "Yeah, whatever, just install" on every dialog that pops up in their face. They're used to just dropping the application into your Applications folder and running it, or downloading it from the App Store.

Windows is a wasteland of garbage, of unsigned applications from shady looking sites, where telling the real thing from a malicious fake is often very difficult, even for experienced users.

If you're not familiar with the application in question and just Google for it and download the first match you can get burned very badly. This is generally not the case for OS X since the applications tend to be more tightly curated.

Consider Panic Software, makers of Transmit, which comes signed by the developer, and Filezilla, which generally comes from Sourceforge. The official site for Transmit is well maintained and offers a no-nonsense download link.

For contrast, the _official_ download for Filezilla, an equally popular FTP client for Windows, came with malware bundled in due to SourceForge's bad business decisions. If that isn't a sign of a completely dysfunctional software ecosystem i don't know what is.

In the Windows world people are constantly battling this sort of garbage. In the OS X world malware like this is a shocking anomaly.

<comment><USER16> Nobody ever summed up my dislike of Windows as well as this. Though, to be fair, it appears as if Microsoft has seriously improved in the last few years.

It's still insane to see what consumers put up with, seemingly without even noticing. MS of ca. 1995-2010 has created an ecosystem of tastelessness, where a new computer can come preinstalled with competing "Printer managers" or whatever and, without even doing anything stupid yourself, you can't use it for more than 10minutes without being interrupted by some update, "virus warning", "expiry warning", "system optimization" etc. It's truly baffling.

<comment><USER15> > It appears as if Microsoft has seriously improved in the last few years.

I've seen almost zero evidence of this. The state of affairs is worse than ever. There's non-Microsoft efforts like Ninite ([https://ninite.com/](https://ninite.com/)) that work to fix this, but that's fighting an impossible battle.

Microsoft's core security has gotten better, the days of them casually trusting _anything_ that ends up on your computer is over, but this has lead to a culture of flagrant abuse of these features. You constantly have to run things in Administrator mode, click dialogs that present scary warnings, and you end up numb to it.

The real detriment to the experience on the Windows side is how loaded down with absolute junk your average OEM system is. They're pre-loaded with malware, with deliberately broken software, with trial versions that nag you constantly, and drivers for inconsequential things that always seem to need your attention regarding an update or a settings problem.

Microsoft is in a tough spot when it comes to cleaning that situation up. Most PC vendors depend on the money those "services" provide, their margins are sometimes negative without them. This is part of the PC industry's suicidal race to the bottom that keeping prices low at the expense of user experience.

On the OS X side, by comparison, alerts like that warrant a bit of attention since they're so infrequent. The Software Update thing can be a bit of a nuisance but telling it to shut up isn't hard. Linux and BSD are likewise pretty quiet, and alerts stand out as a total anomaly.</comment></comment></comment></comment></comment></comment>


Startup Stories: Healthcare Insurance for your startup - <AUTHOR> http://roasm.com/2012/01/04/healthcare-insurance-for-your-startup/

<comment><AUTHOR> I'm in the early stages of setting up a "proper" working environment for my startup (office space, health insurance etc), and would love to hear about people's experiences, costs etc.</comment>


Show HN: GIF Your Face - Easily create an animated GIF with your webcam - <AUTHOR> http://gifyourface.com GIF Your Face – Create an animated GIF using your webcam in under 10 seconds <comment><USER2> Where is the link to the gif? Clicking or right clicking does not show the link

</comment><comment><USER3> how about security .. any chances you are saving faces on your server ?

<comment><AUTHOR> We definitely are. All GIFs are stored on a CDN for sharing purposes. A disclaimer has recently been added to the site.

</comment></comment><comment><USER4> This thing is sweet!!!</comment>


Botrnot: an R package for detecting Twitter bots - <AUTHOR> https://mikewk.shinyapps.io/botornot/ <comment><USER2> I was surprised by the number of false positives reported here, went ahead and tested on several Twitter accounts of my friends, both professional and personal. 9 out of 25 tested were classified as 'bot' with probability > 0.6. Only 11 were classified as 'humans' with probability > 0.7. And that's on 25 accounts of people I know personally.

Given the preposterous error rate, I deem there is no actual classification logic in R, and instead it uses the (very fallible) humans to do the actual classification via a Mechanical Turk-style API.

Wait, do I need to add "/s" to this post, or is it obvious enough?

<comment><USER3> Same here. I am a bot with 84.7% confidence

Dread to think how they came up with this

<comment><USER4> 83% chance that I'm a bot, apparently. Neat idea though.

</comment></comment></comment><comment><USER5> I've done some work in this area - it's disappointing how terribly the Twitter product has failed to evolve to take account of bot usage.

There are (of course) some useful bots, but lots of incredibly harmful bots, they they should be treated differently to actual humans.

But Twitter can't ship product, so it's not really worth suggesting what they should do.

In the mean time, my colleagues and I got a nice WWW18 conference paper about a new _unsupervised_ (!) way of detecting some type of bots on Twitter. Like most things it's completely obvious in retrospect...

<comment><AUTHOR> Can you share the paper on the new method?

<comment><USER6> Seconded, I would be very interested in this paper!

EDIT: Perhaps it's this one ? [https://arxiv.org/pdf/1711.09025.pdf](https://arxiv.org/pdf/1711.09025.pdf)

<comment><USER5> No it's not.

That's supervised for one thing. Also this is bot detection, not attempting to detect fake news.

I'm not the first author and I'm not sure what the convention is for pre- prints at WWW.

It's the kind of thing I'd love to talk about because it's so damn amazingly effective, but it isn't really my place to say anything.

</comment></comment></comment></comment><comment><USER7> I looked at the GitHub README for the project, which says

 _> Uses machine learning to classify Twitter accounts as bots or not bots. The default model is 93.53% accurate when classifying bots and 95.32% accurate when classifying non-bots. The fast model is 91.78% accurate when classifying bots and 92.61% accurate when classifying non-bots.

Overall, the default model is correct 93.8% of the time.

Overall, the fast model is correct 91.9% of the time._

How is this accuracy determined? There is no information available explaining how this determination is quantified, nor what the caveats are.

<comment><USER8> From the code ([https://github.com/mkearney/botrnot/blob/master/R/features.R](https://github.com/mkearney/botrnot/blob/master/R/features.R)), the percents are # correct / # total, which makes sense.

However, the percents are from the training set; there's no test/validation set, which is a problem when working with bespoke text data as a feature.

<comment><AUTHOR> Do we know that no cross validation was done? I couldn't figure out what the dataset is or where it came from just by looking at the repo.

<comment><USER8> k-fold cross-validation was done (the cv.folds parameter to gbm), but that doesn't help when the model overfits like hell.

<comment><USER9> I agree this is probably what happened. From the estimation object I see around a total of 3500 training samples with around 90 predictors. 3-fold cross-validation was done so at each iteration only around 2150 samples were used for training... And it seems none of the samples were used for out-of- sample checking.

</comment></comment></comment></comment></comment><comment><USER8> Per the README to the corresponding repo:

> The default [gradient boosted] model uses both users-level (bio, location, > number of followers and friends, etc.) and tweets-level (number of hashtags, > mentions, capital letters, etc. in a user's most recent 100 tweets) data to > estimate the probability that users are bots.

Not an exact science, but shows what you can do and deploy quickly with R/Shiny.

The author's rtweet package is very good for making quick Twitter data visualizations.

</comment><comment> andrew-lucker I tried putting in verified users and they were all "probably bots". By definition is that not the only type of user publicly acknowledged as "not a bot"?

<comment><USER5> Yeah it's not very good. It marks the author's account[1] as "not a bot" when it appears to be just reposting Instagram posts.. ie, it is a bot.

Plus it said I was a bot (85% chance anyway), and I'm pretty sure I'm not.

[1] [https://twitter.com/mkearney](https://twitter.com/mkearney) (I assume this is his account?)

<comment><USER10> It correctly classified me (I am a bot) w/ 96% accuracy.

</comment></comment></comment><comment><USER11> While the quality of the model can be debated (I noted lots of false positives too), I do note that it's kind of cool that we're all sitting around and poking at an app written in an R web framework.

If you haven't:

1\. Downloaded RStudio IDE

2\. Built a hello word Shiny App (better still for a flavor of the thing a hello world app using the shiny dashboard package)

3\. Deployed your app to shinyapps.io

I highly encourage you to do so if for no reason than to see how streamlined RStudio has managed to make web app deployment for people who often don't have much of a programming background.

I'm continually impressed with the work RStudio does, even if I'm a curmudgeon and still write all my code in Emacs instead of their IDE. If RStudio expanded to support Python similarly well, I imagine they could really be the place most data scientists work.

<comment><USER12> RStudio is by far my favorite IDE. I would write much more Python if there was something as good for it. Anticipating more Python support, which I believe is part of the plan

</comment></comment><comment><USER13> It is classifying me as a bot with 94.6% probability. Does it give too much emphasis on retweets ?

<comment><USER14> False positives are usually due to high number of retweets and. . . uh. . . check your followers. You may have a lot of bots following you or you may be following a lot of bots.

</comment></comment><comment><USER15> I recently watched a talk from 34c3 (chaos computer club conference) which were held at the end of last year about Twitter bots, their existence and their detection. The speaker couldn't find a lot of bots that were cited in studies and that their methodology were somewhat arbitrary.

Definitely worth a watch: [https://media.ccc.de/v/34c3-9268-social_bots_fake_news_und_f...](https://media.ccc.de/v/34c3-9268-social_bots_fake_news_und_filterblasen) (The video is German but there should be a translated version of it on the site)

<comment> shaki-dora I believe there is a bit of confusion in the public discussion, mostly of the 2016 election:

While "bots" featured large in initial discussions, the details that have emerged since, especially in the recent indictment, actually point at software-assisted humans as the main avenue for these activities.

I believe the "bot" monicker because (a) it's how most people would tackle the task, perhaps ignoring the cheap labor pool this shadowy PR operation had access to, and (b) the bot-like behavior exhibited by many of these accounts, which was actually a result of not being native speakers, following a script, and having no deeper knowledge of politics and culture to fall back on.

</comment></comment><comment><USER16> The classification is based on an R package for Generalized Boosted Regression Models[1]. Can anyone knowledgeable opine about this choice?

[]1 [https://cran.r-project.org/web/packages/gbm/](https://cran.r-project.org/web/packages/gbm/)

<comment><USER17> I'd opine the choice of model matters less than the general approach used. In this case, features are taken from the data that are more like metadata about an account, metadata about the frequency and such of tweets, and automatically generated text features about the tweet text which are used to train/predict the binary classifier. Whether it's gbm, lda, logistic regression, etc. used on this data is probably not that huge a deal (maybe small % differences in accuracy) assuming each are used correctly.

What I'd want to also see however, would be curation of a relevant corpus of tweet content that could be integrated in the classification process in terms of actual tweet content (bag of words, sentence structure, & other NLP features, images, other media) being used to determine a given account's similarity between bots and non-bots -- instead of relying essentially on metadata similarity in addition to crude auto-extracted text features like simple total number of words and character counts. I can't say for sure if it'd improve predictions but would seem key for this type of problem.

</comment></comment><comment><USER18> I got .6 probability, that's pretty high and last time I checked I could fool the Turing test.

</comment><comment><USER19> I tried a few things, it seemed to be working well but now I keep getting "An error has occurred. Check your logs or contact the app author for clarification."

</comment><comment><USER20> @jack, 0.693?

</comment><comment><AUTHOR> Developer: Michael W. Kearney

Link to github: [https://github.com/mkearney/botrnot](https://github.com/mkearney/botrnot)

</comment><comment><USER21> What use is this really if bot creators can incorporate this tool, and adjust their tweets until they pass the test?

</comment><comment><USER22> Welp, apparently I'm probably a bot. Time to go into the bathroom and cut my arm to verify...

</comment><comment><USER23> It seems even @potus has a probability of .929 of being a bot. Is this fake news?

<comment><USER19> @realdonaldtrump is only 0.008, interesting comparison! I wonder if it's picking up something weird from the style of @potus changing from Obama to Trump, and in particular something related to the fact Trump seems to favour his personal account even as POTUS.

</comment></comment><comment><USER24> Kinda wish you named it: 'Robot or not' [https://www.theincomparable.com/robot/](https://www.theincomparable.com/robot/)

</comment><comment><USER25> I think you need to fix your bot algorithm.

</comment><comment><USER26> This is the name of a browser plugin mysef and a few others have been working on. Glad you jacked the name.

<comment><USER27> Jacked? I just tried searching for "bortnot" and I can't even find your plugin in the search results. You can't blame somebody for stealing a name that nobody can even find.

<comment><USER28> Did you search "bortnot", or "botrnot"?

<comment><USER27> Sorry, botrnot is what I searched for.</comment></comment></comment></comment>


Cellebrite: We Keep iPhone Flaws Secret for the Public's Safety - <AUTHOR> https://www.forbes.com/sites/thomasbrewster/2018/03/01/apple-iphone-vulnerabilities-kept-secret-by-cellebrite <comment><USER2> No, you keep them secret so you can stay in business. If you actually cared about the public, you'd be reporting them to Apple.

<comment><USER3> Has Apple offered them an appropriate bug bounty?

<comment><USER4> Who is "them"? Cellebrite is mostly in the business of buying vulns, not developing them. That said: Apple pays $100k for SE leaks and $200k for boot firmware vulns. Based on described capability, the iOS11 vuln in question would be one of these two.

</comment></comment></comment><comment><USER5> Right, it's in the public interest to keep open vulnerabilities that China and Russia can exploit.

<comment><USER6> Or more realistically arbitrary people trying to get access to passwords and cc info.

</comment></comment><comment><USER7> Until they use it in a Felony trial and their means/methods get cross examined. No trade secrets in forensics bro.</comment>


Convert a Bird Scooter to a personal one with $32 kit - <AUTHOR> https://scootertalk.org/viewtopic.php?p=1643&fbclid=IwAR0-b9xJKny5r5adXwc6gocfXbqZ9scA1fpgX5t8L7f7afbT9RZU33Exqnk#p1643 <comment><USER2> Apparently,you don't need to steal it for this.

> There are cities that are selling Bird scooters at police auctions. Planning > on picking one up once the eBay parts show up.

<comment><USER2> Aaand we killed it.

> SQL ERROR [ mysqli ]

> User birdfo5_phpbb already has more than 'max_user_connections' active > connections [1203]

> An sql error occurred while fetching this page. Please contact an > administrator if this problem persists.

<comment><USER3> The influx of traffic has been a great surprise. I've contacted the host and updated the plan to handle the activity. They informed me the issue will be fixed soon. Sorry for any inconvenience.

Thank you for checking out Scooter Talk. Hope you enjoy!

<comment><USER4> If you don't want to pay more or deal with technical details like setting up cache servers, just put it behind CloudFlare or similar temporarily.

<comment><USER5> This is the best answer. Cloudflare free tier CDN is amazing, and is ridiculously easy to set up. They even provide and set up an SSL certificate for you.

</comment></comment></comment></comment></comment><comment><USER6> Google cache of the page, since we've given the site the hug of death: [http://webcache.googleusercontent.com/search?q=cache:https:/...](http://webcache.googleusercontent.com/search?q=cache:https://scootertalk.org/viewtopic.php?p%3D1643)

<comment><USER7> TLDR; =

I ordered this off eBay: [https://www.ebay.com/itm/for-Xiaomi-MIJIA-M365-BIRD- Scooter-...](https://www.ebay.com/itm/for-Xiaomi-MIJIA-M365-BIRD-Scooter- Circuit-Board-Dashboard-Cover-Replacement- JT/253942419471?epid=9022713001&hash=item3b2025d00f:g:KdIAAOSw1CBbxwHh:rk:1:pf:0)

<comment><USER8> "Taken apart from original M365 scooter."

What are the chances these are coming from someplace doing the conversions for Bird and now they're coming full circle?

<comment><USER9> The listing claims to be selling a brand new part still in its original packaging, so that wouldn't fit, although it certainly wouldn't be the first time that an eBay seller lied.

</comment></comment></comment></comment><comment><USER10> Isn't a big part of the advantage of ride-share is that the vehicle is just there for your journey, you don't need to take care of it outside of that?

These companies companies seems to have exploded in valuation, driven I guess by VC money. I wonder how much of the rider-growth fueling that is just people trying out an electric scooter for the first time.

<comment><USER11> > I wonder how much of the rider-growth fueling that is just people trying out > an electric scooter for the first time

I saw they have Lime in Madrid and a few other Spanish cities, and that was my impression for their usage here. For a 10 minute ride the cost is comparable to what you would pay for car-sharing scheme like Car2Go - but that's for a car where you can fit a passenger and shopping. It's also priced in USD here, which suggests it's not aimed at the local market.

If they had pricing similar to bicycle sharing schemes (X minutes free, then pay per minute + daily/yearly subscription fee) I could see them being a lot more popular with commuters, but as it is now, my impression is it's too expensive for the European market.

<comment><USER12> But that's also for a car that you need to park, and that stops at traffic lights. Depending on the travel, scooters are a great value proposition.

I'd say shared electric motorbikes (also present in Madrid) pose a more direct threat to scooters: they accompdatr 2 people, speedier, safer (comes with helmet), easily parkeable, not affected by traffic jams (but dependent on traffic lights - in strictness)

</comment></comment></comment><comment><USER13> Isnt vandalism a problem with dock-less scooters ?

I can imagine someone passing by, picking up one of these and dumping it into a garbage can.

Maybe the margins are so high they can just effort to replace them ?

<comment><USER9> I suspect the margins are high enough. These things are cheap, and it doesn't take a whole lot of rides to pay for themselves. If they last a few months on average before being trashed, that's probably good enough.

It's also possible that these companies are taking the loss to gain market penetration, hoping to find a solution to the vandalism problem before the VC money dries up.

<comment><USER14> They cost <$500 at retail prices. Assuming they have 15 miles of range at max speed (15mph), worst case one charge only gets them $10 ($1 to start + 0.15/min * 60min), $5 of which goes to the person who picks it up and recharges it. That's 100 cycles to breakeven on worse case (one person rides one scooter until it dies).

They've disclosed that an average scooter does 5.5 trips/day ($5.50), assuming everyone rides at max speed nonstop, that still ~$14.50/day. Pays for itself in under 2 months.

<comment><USER15> Full retail price in china is 1,999 RMB ($289-300). Wholesale on Alibaba for more than 300 is $153USD per scooter.

Bird probably manages to get a further $25-30 off that, so perhaps as low as $120 per scooter, plus perhaps $10 for the bird brain modification and shipping by container, another $10-15.

So theoretically, a scooter could pay for itself in 10-20 days if used that heavily. I'd say that they are very capable of absorbing the cost of the occasional one going missing

</comment></comment></comment></comment><comment><USER16> Background for anyone else who has not heard about this particular Bird:

[https://www.bird.co/](https://www.bird.co/)

<comment><USER17> Thanks for linking this, I have never heard of Bird before.

Also, the website does a horrible job of explaining what it is in the home page.

<comment><USER18> Jesus, you're right. It looks like a site I'd design if the client had given me no copy and only a vague description of what they do.

</comment></comment></comment><comment><USER19> So all that's needed to enter the scooter business is a van, a Faraday cage, and a conversion kit. Perfect!

<comment><USER20> Why bother with the Faraday cage? Where's your sense of adventure?

</comment></comment><comment><USER21> Bit off topic:

I had got to know about the scooter boom in USA via youtube video. It says anyone can put scooter anywhere in the city and can pick up any other scooter anytime they want from anywhere?

Is this really true?

<comment><USER22> Correct. It's been a headache to cities and some citizens.

The scooter companies hire somewhat of bounty hunters to charge them. They are paid roughly $3 to 8 per scooter.

<comment><USER21> What kind of troubles do they give you exactly?

</comment></comment></comment><comment><USER23> The conversion kit is on ebay, [https://www.ebay.com/itm/for-Xiaomi- MIJIA-M365-BIRD-Scooter-...](https://www.ebay.com/itm/for-Xiaomi- MIJIA-M365-BIRD-Scooter-Circuit-Board-Dashboard-Cover-Replacement- JT/253942419471?epid=9022713001&hash=item3b2025d00f:g:KdIAAOSw1CBbxwHh:rk:1:pf:0)

</comment><comment><USER15> Does anyone have a source for confiscated Bird scooters in europe? I would definitely buy a Xiaomi M365 from a government/police auction and do this mod if possible; for now, it seems like they are being welcomed with open arms though.

</comment><comment><USER24> Someone at u of Michigan stole my personal use m365 (bird) handlebars and brain so that they could steal a bird for personal use—and to think I felt so clever using a u-lock to lock the frame up....

<comment><USER25> Sounds depressingly fqmiliar. I thought I was clever with a lock thru each wheel at u of m, but came back to just 2 wheels, sans frame. Curse you quick release, and things worse than curses to whomever stole our bikes.

</comment></comment><comment><USER26> Looks like the site is down, here is a tweet with a screenshot: [https://twitter.com/nickabouzeid/status/1070036774871650304](https://twitter.com/nickabouzeid/status/1070036774871650304)

</comment><comment><USER27> I wonder how much a kit costs to convert one of those Lime ebikes I've been seeing around...

<comment><USER28> Those bikes are heavy and under-powered. They're not worth using exclusively.

<comment><USER27> Pulling the motor off and putting it on a lighter bike would make it worth it though.

</comment></comment></comment><comment><USER29> there ought to be a business where, instead of shelling out $32, you just rent the conversion kit by the hour

<comment><USER30> Then maybe someone could make a kit to turn a rented kit into a personal one.

<comment><USER31> When people get tired of riding their personal ones - you can buy them all up off craigslist, then rent them out and make a killing.

<comment><USER32> Obviously you could use a blockchain to tokenise the ownership as well. EDIT: Crap. Now got a brain bug.

</comment></comment></comment></comment><comment><USER33> Why don't hackers develop a $32 kit for hijacking leafs or other hybrid cars SV hackers drive and publish it publicly.

<comment><USER25> There are. Sdr code for opening many cars, replay attacks (featured today on HN), and can-bus interfaces are all available inexpensively. Dealer style keyfob copiers and obd2 port hacking products are about 200 and up online. The scooters haven't been around as long.</comment></comment>


Adobe Summit Cancelled - <AUTHOR> https://www.adobe.com/summit/faq.html <comment><USER2> 2020: Let's just all work from home

<comment><USER3> 2020: The future of remote work is here.

<comment><USER4> I put some money into the Slack stock a few weeks ago based on that thinking, on a lark. Worked out well so far. Any ideas about other companies that will benefit from this inevitable giant wave of remote working that will be growing rapidly for the next 6-12 months?

I think we'll see entire new categories of people working from home on a large scale. Lawyers, marketing people, accountants, etc etc. Basically anyone who is dealing with information rather than physical goods.

<comment><USER5> Microsoft has a much more solid remote work product suite, IMHO; though most companies adopting more WFH policies are probably already Microsoft customers.

<comment><USER4> They're such a massive company with already gigantic solid revenue streams; this wouldn't move the needle much in the short term.

</comment></comment></comment></comment></comment><comment><USER6> Still waiting on SXSW. Dorsey pulled out of the keynote list this morning.

</comment><comment><USER7> I'm going to events in London and Budapest end of March. Not yet cancelled but I've been wondering if it's inevitable.

<comment><USER8> The virus will still be spreading until at least April at this rate.

<comment><USER9> Does it show seasonality?

<comment><USER10> I've seen conflicting opinions about that - seems that we may have to wait and see. [1][2]

[1]: [https://ccdd.hsph.harvard.edu/will-covid-19-go-away-on- its-o...](https://ccdd.hsph.harvard.edu/will-covid-19-go-away-on-its-own-in- warmer-weather/)

[2]: [https://www.nationalgeographic.com/science/2020/02/what- happ...](https://www.nationalgeographic.com/science/2020/02/what-happens-to- coronavirus-covid-19-in-warmer-spring-temperatures/)

</comment></comment></comment></comment><comment><USER11> Interesting that the official page doesn't mention coronavirus when we all know that's why it's been cancelled.

<comment><USER12> It's on [https://www.adobe.com/summit.html](https://www.adobe.com/summit.html)

<comment><USER11> Ah, ok. Maybe that would have been the better page to submit.

</comment></comment></comment><comment><USER13> So will you now be a terrible company if you host a summit/expo/large- gathering? If that is the trend it could really bite into some of the economies tied into cities used to hosting events.

<comment><USER14> I think super fueling a COVID-19 outbreak would bite into the economies a bit more than canceling a few events

<comment><USER15> If you are a large event, the hope is they purchased a policy for show stoppage events and it covers public health events like this. It won't make you completely whole but should limit losses on contract commitments to venues, hotels, f&b, etc.</comment></comment></comment>


Agile does Not work - <AUTHOR> https://www.linkedin.com/pulse/agile-does-work-oleg-vishnepolsky?trk=eml-b2_content_ecosystem_digest-recommended_articles-97-null&midToken=AQHAReKO7Y9oIw&fromEmail=fromEmail&ut=01-rW2bI4plns1 <comment><USER2> In modern use, "agile" means little more than "not waterfall".

As such, it's hard to tell if agile works because sprinkling even a little bit of agile dust on a project means it's "agile."

Then again, I come from a RAD background, and I don't like how the rich description of different models and approaches, like what Steve McConnell described in "Rapid Development", had mostly devolved into a more ambiguous "agile."

On a bit of a tangent, I came across papers from industrial process management that made a similar complaint about Toyota's continuous improvement method. Quoting from the introduction to [http://freyssenet.com/?q=node/748](http://freyssenet.com/?q=node/748) :

> With this book I hope we are able to show that Toyotism or 'lean production' > as presented in the bestseller The Machine that Changed the World by Womack, > Jones and Rose (1991), is not, as they seem to claim, the only possible > industrial organization of the future.

[http://www.design4change.com/LinkedDocuments/Torslanda%20to%...](http://www.design4change.com/LinkedDocuments/Torslanda%20to%20Uddevalla%20via%20Kalmar.pdf) calls it a "humanistic alternative" and "Socio-technical", and "Reflective production".

Do these alternatives also apply to software development? Would they even better?

The agile software people I've talked to have never heard of these alternatives.

</comment><comment><USER3> Agile isn't a thing you do, and it isn't a thing that works or doesn't work. Its very little more than the recognition that what works is highly specific to the group and task, coupled with specific warnings against practices that were commonly and harmfully adopted as one-size-fits-all straightjackets at the time the manifesto was written.

Particular methodologies -- like Scrum, which is often conflated with Agile -- may or may not work (and, more particularly, may or may not be ideal for certain classes of project), but that's a very different issue.

OTOH, I think that Agile has a critical problem which is revealed by the fact that people confuse it with various methodologies (particularly Scrum) -- it is so nebulous that no one actually considers the manifesto to be a thing, and everyone just accepts whatever canned, one-size-fits-all methodology some book or consultant sold them (usually Scrum or a derivative, though I remember when people who said "Agile" were more likely to really mean "XP") is what Agile is, which is fundamentally the kind of mindset Agile was a reaction _against_.

Because Agile -- the manifesto itself -- contains no clear actionable recommendations, just value statements, everyone with a concrete methodology to sell once Agile became a popular buzzword just decided to sell their methodology _as_ Agile.

<comment><USER2> How do you tell if something is agile?

If we drop the word "agile", what would we lose? For that matter, couldn't we just call it "software engineering"? The goal of engineering is to choose from different possibilities to come up with a cost-effective solution.

I came of age as a professional software developer in the 1990s, before the Agile Manifesto. I was (and still am) in the RAD school of thought. Steve McConnell's "Rapid Application Development" was one of the big software engineering books of the era. It certainly doesn't promote a "one-size-fits- all straightjacket", so I don't recognize your statement as reflecting my understanding of the pre-Agile era.

I have also read a lot of accounts of software development pre-Agile Manifesto, from the Mac development to the game software described at [http://www.filfre.net/](http://www.filfre.net/) to the first web browsers. I don't recall any of them using a waterfall model or any of its variations.

This is also a bit of a hot button for me. All too often I see people arguing, ahistorically, that first there was waterfall and then there was agile. I am one of the skeptics that Wikipedia describes at [https://en.wikipedia.org/wiki/Waterfall_model](https://en.wikipedia.org/wiki/Waterfall_model) as saying "the waterfall model is a false argument used purely to market alternative development methodologies."

<comment><USER3> > How do you tell if something is agile?

If the thing is not _a person 's high-level framework for decisionmaking about the process of making software in a particular group_, its easy, its not "Agile" in the sense of the manifesto.

If it is such a framework, its Agile iff it applies the values in the manifesto as its guiding principles.

> If we drop the word "agile", what would we lose?

Very little. I think that one of the big problems of the manifesto is that, while it really was a reaction to a common (then and now) cargo cult approach to software development methodology and, secondarily, particular elements of particular methodologies that were commonly adopted with that approach in certain domains at the time the manifesto was written, it _wasn 't_ any kind of fundamental revelation or new approach. (And, arguably, articulated the issue it addressed less well than numerous other sources that _also_ argued that the _method_ of work itself should be subject to a continuous and critical review for fit to the particular team and goals, and not adopted based on generalized lore.)

> I came of age as a professional software developer in the 1990s, before the > Agile Manifesto. I was (and still am) in the RAD school of thought. Steve > McConnell's "Rapid Application Development" was one of the big software > engineering books of the era. It certainly doesn't promote a "one-size-fits- > all straightjacket", so I don't recognize your statement as reflecting my > understanding of the pre-Agile era.

The methods of any of the various methodologies in the RAD tradition can be applied as one-size-fits-all straightjackets just as much as any other methodologies (at the time the manifesto was written, they were trendy enough that it was probably happening then just as it is now common with supposedly "agile" methods like Scrum, and just it had previously been -- and still was, in some domains -- with various waterfall methods.)

> I have also read a lot of accounts of software development pre-Agile > Manifesto, from the Mac development to the game software described at > [http://www.filfre.net/](http://www.filfre.net/) to the first web browsers. > I don't recall any of them using a waterfall model or any of its variations.

I'm not sure why you think this is relevant to the post you are responding to, which doesn't mention the waterfall model or any of its variants or suggest any particular relevance of them. (And I also think it suggests a certain bias, because certainly government/enterprise software was still then -- and in many cases is still _now_ \-- often built on methods that are commonly referred to as waterfall models [in the case of government, often with institutional mandates that approximate the stages of the waterfall model.])

> This is also a bi of a hot button for me. All too often I see people > arguing, ahistorically, that first there was waterfall and then there was > agile.

Its not ahistorical to argue that the cluster of methodologies typically labeled "agile" (which they shouldn't be) are, in fact, newer than the cluster labeled waterfall models. It would, of course, be grossly inaccurate to assert that there was nothing in between; iterative models (RAD, spiral model, etc.) were in between, both chronologically and conceptually.

Its true that the iterated models _often_ get ignored, kind of like Generation X in Boomers vs. Millenials discussions.

> I am one of the skeptics that Wikipedia describes at > [https://en.wikipedia.org/wiki/Waterfall_model](https://en.wikipedia.org/wiki/Waterfall_model) > as saying "the waterfall model is a false argument used purely to market > alternative development methodologies."

Actual documented methodologies in the group labeled "waterfall models" do, in fact, exist and were widely accepted at one point, and had not been generally displaced (though there were newer models challenging them) at the time the agile manifesto is written. The idea of _the_ waterfall model as a concrete methodology is a bit mythical, but things like the Structured System Analysis and Design Method certain _did_ exist (and descendants of that approach are still being used in real institutions.) Asserting that waterfall models are a pure strawman that exist only to sell "agile" models is false as a matter of readily verifiable fact.

<comment><USER2> I am in agreement with most of your response. I want to follow up on a couple of points.

> "I'm not sure why you think this is relevant to the post"

Well, it's not. It's a response to the comment concerning "practices that were commonly and harmfully adopted". I want to soften that from "commonly" to "sometimes".

However, it's hard for me to really justify that. Agile comes out of government/enterprise. That's clear from the manifesto, which refers to "contract negotiation", and where the principles refer to "the customer's competitive advantage". Neither are really relevant to, say, the end-user games that I mentioned earlier, or to software one writes for oneself for fun.

Within government/enterprise organizations then and now, I agree that many use various modified versions of waterfall and, as you say, straight-jacketed methodologies.

What I don't know is, how many software projects in the 1990s were using heavy-weight processes, vs. ones which would be now called agile? (Or a third category of none-of-the-above?) For example, in the mid-1990s I worked for an academic research group of ~20 people, and we distributed the source and binaries for free so I also did some support for external users. There was no emphasis on processes and tools, nor comprehensive documentation, nor contract negotiation. Most users were within a few tens of meters from me, there was close collaboration, and I could do several build/releases per day if needed. According to the manifesto, I was agile, yes?

But that approach was also not uncommon for other research or in-house software, and it wasn't much different from the software development process at the startup I joined in Palo Alto a couple of years later (during the dot- com era), or the places I worked at or consulted at since then, all doing scientific research support software development.

By count, and perhaps even by budget, were there more of these small-scale agile-like projects than there were heavy-weight government/enterprise projects? If so, then waterfall would have been relatively uncommon in practice.

> "Asserting that waterfall models are a pure strawman that exist only to sell > "agile" models is false as a matter of readily verifiable fact."

I do not argue that waterfall is a pure strawman, rather that many agile proponents present the dichotomous choice of "waterfall" vs. "agile", and use that comparison to market an alternative, agile method as the alternative method. (I like your Boomers/Gen.X/ Millennials example - slackers represent!)

This isn't a strawman, but ... I don't have a word for it. Choosing the weakest opponent, propping it up by always talking about it, showing you're approach is better, than concluding you are best.

Laurent Bossavit has written much about this, but I couldn't find the one I remember reading before, so I'll quote [https://www.infoq.com/articles/bossavit-agile-ten-years- on/](https://www.infoq.com/articles/bossavit-agile-ten-years-on/)

> The most dangerous distortion of all is the notion, sadly prevalent today, > that Agile consists of a handful of competing "brands" of processes: Scrum > versus Extreme Programming versus Lean or Kanban. In the interest of pushing > this or that brand, the interesting details of our young history are papered > over.

</comment></comment></comment></comment><comment><USER4> The most entertaining part: scrolling through the list of commenters and seeing how many list their title as "Agile Coach", "Scrum Master", etc.

<comment><AUTHOR> If IT isn't working then you're not really doing IT. You must be doing something else. No true Scotsman!

<comment><USER5> Sounds like "if it doesn't work you're not praying hard enough".

<comment><AUTHOR> At first glance I read "if it doesn't work you're not paying enough".</comment></comment></comment></comment>


PonzICO, let's just cut to the chase - <AUTHOR> https://ponzico.win <comment><USER2> I was thinking about this a few weeks ago: is it illegal to run a Ponzi scheme if you openly advertise that it's a Ponzi scheme?

</comment><comment><AUTHOR> The white paper is comic genius.</comment>


Bill Gates Flipped Out When He Heard Apple Was Bringing Steve Jobs Back - <AUTHOR> http://www.businessinsider.com/bill-gates-on-apple-buying-next-2011-10?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+typepad%2Falleyinsider%2Fsilicon_alley_insider+%28Silicon+Alley+Insider%29 <comment><USER2> Now imagine a timeline with all pundit & haters quotes, contrasted with Apple stock prices.</comment>


Show HN: find the coolest workplaces with Coworfing  - <AUTHOR> https://github.com/nukomeet/coworfing

<comment><USER2> More details on the app: As nomads - freelancers, entrepreneurs, students and teleworkers - we share the places where we like to work: Cafés, bars, coworking spaces, librairies, airports, parks, and even our own homes.

</comment><comment><USER3> Great app, for the coworking community, by the community.

</comment><comment><USER4> Simple, nice user experience and really powerful.

</comment><comment><USER5> useable, beautiful and useful!

</comment><comment><USER6> Great app !</comment>


Working Out Inside the Office - <AUTHOR> http://www.nytimes.com/2011/12/04/jobs/working-out-inside-the-office.html?_r=1&src=recg <comment><USER2> Thank god I'm self employed and decide myself when and what to exercise. I can't imagine having to dance to the pipes of these corporate clowns. 18 people being scrutinized by their bosses collectively lose 150 lbs (25 of which are accounted for by 1 person)? I can't say I'm impressed.

<comment><USER3> They were 18 people participating in a scientific study. There's nothing in the article that suggests that they were forced to participate. They were almost certainly volunteers.

<comment><USER2> If they were volunteers the study would have a very strong self selection bias and therefore not be scientific.

<comment><USER3> That might be true for some studies, but the generalization is not correct. It depends on what is being studied.

<comment><USER2> Care to give an example where a study with strong self selection bias is still scientific?

<comment><USER3> Nearly every drug test. E.g., the researchers ask for volunteers suffering from condition X. Those volunteers are then tested with a new drug.

Why would you think the fact that the subjects are volunteers would affect this?

</comment></comment></comment></comment></comment></comment><comment><USER4> I hope that's stock photography. Working out in a business suit is offensive. I can't even wear my hoodie at the gym without overheating. And I look like that dude on the left.

Just sayin'.

(explicitly I am just sayin' that we need to revisit the expectations of attire if we're going to conflate the notions of work and exercise).

<comment><USER5> I'm pretty sure they're moving at a slow-ish walk, not running. The point is regular low levels of physical activity, not hard core cardio during your meeting.

</comment></comment><comment><USER6> I interviewed once at a hedge fund that had a power rack in the corner. All four people I spoke with were ripped. So yeah, exercise at the office can work pretty well.

I have no idea what the water bottle curls described in the article are going accomplish, however.

</comment><comment><USER7> My entire dev team (all 4 of us) have started doing burpees at 11:00am and 3:00pm everyday. Great all-around excercise that gets your heart racing and even works out the whole body. Japan has a milder version, called Rajio Taiso.

Not sure if I'd be able to walk while in a meeting, even if its at a slow pace. When I'm working out, I usually try to get into "the zone" and I'd probably have difficulties staying focused.

</comment><comment><USER8> I don't get it. My wife is on her feet 12 hours a day, so her feet just hurt.

<comment><USER9> Proof that moderation is still key. Sitting all day is horrible for your health. Standing all day is horrible for your health. Laying down all day is horrible for your health.

The human body was made to move.

<comment><USER10> Why is standing all day horrible for your health? I'm assuming your are talking about the post above yours referring to a work day. I stand 10+ hours a day, with no foot pain, and don't stand on a pad or in shoes. Just because of this, I won't lay down a blanket statement that it IS good for you (based on one person's opinion), so why go as far as saying it is "horrible for your health" with no backing facts?

<comment><USER11> Being overly active without taking proper precautions (good diet for joint lubrication, proper posture, etc) can lead to joint damage, back problems, foot problems, recurring pain, etc. Specifically, standing still all day causes problems. Moving tends not to.

In general, humans were not designed to do one motion/one task repeatedly all day every day.

</comment></comment></comment></comment><comment><USER12> We used to have a ping pong table in an abandoned part of our office space. It was great for a quick break to get the heart-rate up and burn a few calories.

</comment><comment><USER13> Heh, I've been looking for more tips to add to my blog about this: [http://neverfriday.com/?q=exercising-software-developer- it-w...](http://neverfriday.com/?q=exercising-software-developer-it-worker- programmer)

It's amazing how awful your back feels after a day in a crappy chair :-/ I'm not sure treadmills are the answer, but at least they're something. Now to get those offices to add some dumbbells! :P

</comment><comment><USER14> Why not just go outside for a run around the block? You'd get an actual health benefit from your heart rate being elevated for at least 20 minutes.

<comment><USER15> From the article: "But regular exercise doesn't entirely make up for the shutdown of chemical processes that occurs during long periods of sitting, research has shown."

<comment><USER14> ....yeah, that's why you stop sitting, get up, go for a run at lunch time. it's also recommended you get up every so often and walk around a bit (coffee breaks are good for this)

</comment></comment></comment><comment><USER16> I couldn't imagine taking a meeting seriously when everyone's walking on a treadmill...But I guess it's better than scarfing down deli sandwiches.

</comment><comment><USER17> We built one of these at our company:

[http://www.clockwork.net/blog/2011/04/27/478/we_made_a_sweet...](http://www.clockwork.net/blog/2011/04/27/478/we_made_a_sweet_walkstation_for_10_and_some_wood_scraps)

[http://www.flickr.com/photos/clockworkactivemedia/sets/72157...](http://www.flickr.com/photos/clockworkactivemedia/sets/72157626468276603/)

We've been using it every day for months.

</comment><comment><USER18> A product I created recently launched to help people do exactly this... fitbolt.com

<comment><USER19> <http://fitbolt.com/> is down.

</comment></comment><comment><USER20> walking around helps you thinking too. Remember Aristotle and the peripateticians ("those who wander around").</comment>


MasterCard adds fingerprint sensors to payment cards - <AUTHOR> https://www.engadget.com/2017/04/20/mastercard-biometric-fingerprint-card/ <comment><USER2> Biometrics can be used for identification, not authentication. This card is not for me.</comment>


Apple's Jobs blunders on options swap - <AUTHOR> http://www.marketwatch.com/story/apples-steve-jobs-blunders-on-options-swap-2010-05-18?siteid=nbsh <comment><USER2> This is hardly a blunder. He decided to go with the less risky option of taking the smaller share of options instead of betting that Apple stock was going to skyrocket over the next 5 years which seems like a sane choice to me.</comment>


Better password protections in Chrome - <AUTHOR> https://security.googleblog.com/2019/12/better-password-protections-in-chrome.html <comment><USER2> The cryptography behind this is done very well so that Google does not ever see even your hashed password, or know if there was a breached password detected. What Google does see is a hash-prefix of your username, to narrow down the encrypted data set of compromised credentials being returned to your Chrome instance.

Here's what happens. Your instance of Chrome hashes your username and password and encrypts that value with an ephemeral key which doesn't leave Chrome, _Kc_

Google gets the encrypted cred-hash and applies a second round of encryption with a key only known to Google, _Kg_. They return the doubly-encrypted cred- hash, and also return 256 candidates encrypted with just _Kg_ for you to compare against, those 256 candidates are selected based on a clear-text 3 byte prefix that Chrome also sends them.

When Chrome gets the results back, it decrypts the cred-hash using _Kc_ which results in the cred-hash now being encrypted only with _Kg_ ; coincidentally this is the same exact key used to encrypt the candidates, allowing Chrome to do a simple byte-compare to see if there's a match between your cred-hash and the encrypted breach candidates.

The cool part is the encryption operation is basically communicative. You can add your layer of encryption first, send the value to Google, they add their encryption and you get the double-encrypted blob back, and then you remove your encryption to end up with a plaintext encrypted just with Google's key, even though Google never saw the plaintext, and you never saw their key.

This trick allows your browser, and only your browser, to compare your cred- hash against the breached cred-hashes while all the data you are comparing is actually encrypted with a secret key held by Google that never leaves Google's server.

The only information leak is the 3-byte hash prefix to identify the slice of the comparison set. This is definitely not nothing, but perhaps it is a reasonable trade-off.

<comment><USER3> Is this an okay simplification?

• I want to send my password (44) to Google but don't want them to know it's 44. So I multiply it by 37 (Kc) and send 1628.

• I also tell Google that the password is between 40 and 50. (Equivalent to sending three characters of cleartext.)

• Google multiplies 1628 by 78 (Kg) and sends me the result, 126984.

• Google also sends me every number between 40 and 50, multiplied by 78.

• I divide 126984 by Kc and get 3432. I see that 3432 is in the set of other numbers Google sent me (44x78). So I can infer that my password is in Google's set of breached passwords.

<comment><USER4> > I also tell Google that the password is between 40 and 50. (Equivalent to > sending three characters of cleartext.)

I believe the (first 3 bytes of the) hash of your username is used, as opposed to your plaintext password. I realize you were simplifying, but the difference between "plaintext password" and "hashed username" is rather essential in this case.

IIUC, their breach data consists of pairs of values - a username hash and the matching username-password hash (all encrypted ofc). This way they aren't storing a bunch of breached plain text credentials on their servers. This allows for a range search based on your username hash prefix, while the encrypted packages you send and receive are username-password hashes.

Edit: I believe I was incorrect - they only retain the _prefix_ of the username hash (as opposed to the entire thing). This has the benefit of effectively rendering the username unrecoverable - you'd be forced to attack the combined username-password hash. So it's not really a range based search, but instead a hash table. They just return the entire (24-bit addressed) bucket to you, which for 4 billion (!) sets of credentials amounts to ~240 on average.

</comment></comment></comment><comment><USER5> I don't like the direction of "popular websites are exempt, small websites are restricted".

Chrome has blocked autoplaying videos with sound for most sites except a small, hardcoded list that includes YouTube.

This means that if you create a YouTube competitor today, you are playing at a technical disadvantage. Or if you're just hosting videos on your own personal website!

What if Google's algorithms classify your new startup as "potential phishing", because users are re-using their own passwords on your site? How can you appeal? What recourse do you have against Big G's algorithm?

<comment><USER6> Disclosure: I'm the TL of this project on Chrome and I work very closely with the Safe Browsing engineers regularly.

> What if Google's algorithms classify your new startup as "potential > phishing", because users are re-using their own passwords on your site?

That's not how our phishing detection works. In fact, our internal studies show that a lot of users reuse their passwords often and while that's not the best password hygiene, it's the user's choice to make and we have to respect that and build protections with this in mind.

> How can you appeal?

Right from your search console.

> What recourse do you have against Big G's algorithm?

Ultimately, Google/Safe Browsing has a lot more to lose if their users stop trusting their product(s). I can tell you that we take false positives very seriously and try hard to provide a fair and speedy resolution.

<comment><USER7> > I can tell you that we take false positives very seriously and try hard to > provide a fair and speedy resolution.

How/Where does one start this process?

<comment><USER8> he told you, in the search console. Yo have to register your site and verificate it before you could appeal something.

<comment><USER9> This assumes that someone from every site has a Google account and consents to their Privacy Policy and Terms. This is not a safe assumption, nor is it fair to make this a requirement.

</comment></comment></comment></comment></comment><comment><USER10> Seems to me Troy Hunt (the independent developer of [https://HaveIbeenPwned.com/](https://HaveIbeenPwned.com/)) and Cloudflare's Junade Ali deserve at least a mention in the Google announcement. They're pioneers of this database of pwned passwords and the ability to look up candidate passwords securely.

[https://HaveIbeenPwned.com/](https://HaveIbeenPwned.com/)

[https://haveibeenpwned.com/Passwords](https://haveibeenpwned.com/Passwords)

[https://www.troyhunt.com/ive-just-launched-pwned- passwords-v...](https://www.troyhunt.com/ive-just-launched-pwned-passwords- version-2/#cloudflareprivacyandkanonymity)

Mr. Hunt personally paid to operate these services for quite a few years. Then he got sponsorship from 1Password to defray the server costs.

<comment><USER11> I'm happy to see this comment. I guess I don't really care if Google wants to succumb to NIH syndrome and build this themselves, but they should at least acknowledge the person whose idea they are repackaging.

<comment><USER12> Why? Did Apple acknowledge all the PDAs that came before iPhone? Did Spotify acknowledge subscription music services like Rhapsody from 2003? Did Flickr mention Smugmug?

</comment></comment></comment><comment><USER5> Some of these changes, such as realtime sending of all non-popular URLs, concern me a little.

I am happy for Google to use this information for aggregated security purposes (e.g. bots analyse suspicious new pages).

I am not happy with this being associated to the Google account. However, AFAIK, I have no way of knowing this, and in the absence of an explicit statement, I have to assume the worst: that Google will use this to target me ads.

If any Chrome team members are reading this comment, could we get some sort of confirmation that these security features will not be used to collect more data to target me ads?

<comment><USER6> Disclosure: I'm the TL of this project on Chrome.

Your concern is fair.

TL answer: I can tell you that this data is used only for improving user security. Legal answer: Please read the Chrome Privacy Notice :)

<comment><USER13> So basically "you have our word, so trust us!"

<comment><USER14> Do you see any other alternative than trust for such a system?

\- Building a fully local system will not provide the same coverage and doesn't allow sharing findings across users (which means that when a new phishing page appears, it will appear as "new" for every single user, instead of being new for N users and then known bad for the rest of users). It also heavily reduces what kind of analysis can be done since you can't just store large datasets on every single device and/or run expensive algorithms on every single web page load on a mobile phone.

\- Making it open source would not help. You can't know whether the code you can see is what is deployed remotely, so in the end you just end up trusting a different assertion instead (if you can't trust a privacy policy, why could you trust that the deployment is not backdoored?). It also has some significant cons: malware / phishing / abuse detection is in essence a cat- and-mouse game, and secrecy is unfortunately a key requirement in how everyone is building anti-abuse systems across the industry (not necessarily because they want to, but because nobody knows how it could work otherwise).

\- You could even go all the way and have e.g. remote attestations, reproducible builds, etc. that allow proving that indeed the code running remotely is the open source code you want and can audit. This is barely doable with available technology these days, and even if someone was to do it there would maybe be 1K people on this planet able to understand why this is trustworthy. A prime example of this is looking at people in this very thread not understanding the differential privacy scheme for detecting compromised passwords.

Not trusting Google is a personal opinion, and I completely respect that. But implying that there is an alternative to trust for this kind of system is IMO misleading. Using DDG or Protonmail or any other service doesn't change the fact that you have to trust someone, it's just a different someone. You might personally believe their word more than Google's word, but if e.g. DDG started logging your identity and log requests and sell that to ad companies you would have very little way of learning about it either.

Disclaimer: I work for Google, not on Chrome, but I have worked on anti-abuse systems in the past.

</comment></comment></comment></comment><comment><USER15> Reading through the article and the other sources linked, this seems to be a different dataset and implementation than the "Have I been pwned" dataset that Firefox and other password managers reference. However, I don't see any information about where their data comes from, only information about how the feature/extension works to not leak your password during verification.

<comment><USER16> To be fair, if you have money (which Google does) you can buy a LOT of this data, every single day, forever.

There are at least two distinct outfits which pay grey hats to steal data from black hats who in turn obtained it typically through cheesy script kiddie attacks on web sites or phishing.

If you give them not very much money they'll "monitor" their stream of supposedly fresh stolen data (a lot of it isn't fresh because crooks are also often liars) for specific data items you tell them about. This is a bad deal, but apparently some pretty big US companies pay for that service. It's fine though because everybody reading this has unique strong passwords for every account right? Right?

If you give them a LOT of money (or if you were say one of my former employers and you owned the company that does this outright) you just get the raw data. As like UTF-16 XML or CSV files with different types of quoting on each line, or whatever other crazy and inadequately documented nonsense came to mind for each such type of file delivered.

</comment></comment><comment><USER17> I like the secured hash check method. I think this is good.

Most of my current life is in unique-per-site and 2FA but the burden of remembering which one(s) are using shared was more than my motivation to fix. This mechanism may take me to fixing faster.

</comment><comment><USER18>
      chrome://flags/#username-first-flow

is needed to see the

      Warn you if passwords are exposed in a data breach

option in

      Sync and Google services

</comment><comment><USER19> The Verge article about it: [https://www.theverge.com/2019/10/2/20892854/google- password-...](https://www.theverge.com/2019/10/2/20892854/google-password- checkup-hack-detection-now-available)

</comment><comment><USER20> This is similar to what Firefox has been doing lately, right?

</comment><comment><USER21> I guess someone somewhere maintains a database of all leaked username passwords and this feature compares a credential with this database? Is that how this works?

<comment><USER22> Possibly, internally at google, we had something similar that would look for passwords found in the wild that you're using for internal google logins

</comment></comment><comment><USER23> Does this use Troy's have I been pwned dataset?

<comment><USER11> No they went and rolled their own in true Google fashion

<comment><USER5> When you're google size and investing engineering and cryptography resources into building security features, applied at scale to a billion* users, you probably want assurance that this list will he maintained for as long as you want it to be maintained, AND for no third parties like HIBP to enumerate over all google emails.

* random number.

<comment><USER24> Google does not have a very good record of maintaining their non-core projects.

<comment><USER5> Publicly, yeah. But you really think google would depreciate some core internal service actively used for account security, as well as internal employee security?

</comment></comment></comment></comment></comment><comment><USER25> Say no to chrome. Here is why:

[https://notochrome.org/why/](https://notochrome.org/why/)

</comment><comment><USER26> this is a solution looking for a problem, enabled by default. i think most people dont care that homomorphic encryption is being used, they dont want their user/passwords being sent across the wire in any way shape or form, especially enabled by default.

</comment><comment><USER27> I thought this would be about finally introducing a master password, but nope!

</comment><comment><USER28> So let me get this straight. We currently consider it poor practice if passwords are stored for authentication purposes in anything but heavily salted PBKDF2, bcrypt, or sometimes scrypt. Yet it's okay to just send SHA256 unsalted hashes to web services for the purposes of verifying that those same SHA256 hashes aren't already stored?

It's good that Google is encrypting these hashes, but come on, really? Surely there has to be a better way than just shipping off unsalted password hashes to a centralized location.

Edit: Okay, unsalted scrypt for the password. Thanks for the clarification :)

<comment><USER29> I'm assuming it's similar to the haveibeenpwned pwned passwords API?

[https://haveibeenpwned.com/API/v3#PwnedPasswords](https://haveibeenpwned.com/API/v3#PwnedPasswords)

<comment><USER28> It...appears to be so? The infographic states that they "send a strongly hashed and encrypted copy of your username and password to Google." They explicitly mention that the username, not the password, is sent with a 3-byte hash prefix. They make no mention of prefixing the password in the infographic.

In the linked paper where they discuss the tradeoffs and take blinding into consideration. They note that the protocol is that a client calls CreateRequest(u, p) which creates a Req that is then sent explicitly to Google. It appears to me that they consider the merits of sending a hash- prefixed password, but do not make it explicitly clear that the final solution sends a hash-prefixed password. I think that they would want to explicitly say that only a partial hash is sent to Google, if that were the case?

<comment><USER30> > ... do not make it explicitly clear that the final solution sends a hash- > prefixed password

I'm not sure if you're actually talking about something else, but the paper says: "Post-canonicalization, the server calculates a computationally expensive hash of both the canonical username and credential password... This 2-byte prefix—while leaking some bits of password material—provides the client with k-anonymity over the universe of all username and password pairs."

IOW, the 3-byte hash prefix sent is of the username and password concatenated. (Note that Google seems to have added another byte to the prefix versus the paper).

<comment><USER4> To add to this, hashed username-password material is leaked only by the first variant described in the paper. The second variant described only leaks hashed username material. They reportedly used the first variant during testing but have now switched to the second variant.

They indeed appear to have increased the prefix from 2 to 3 bytes. This makes logistical sense though - with 4 billion items, a 2 byte address yields ~61k items per bucket (and thus sent to the client per request) while a 3 byte address yields only ~240 on average.</comment></comment></comment></comment></comment>