A Game of Consequences - <AUTHOR> http://www.antipope.org/charlie/blog-static/2016/06/a-game-of-consequences.html <comment><USER2> Lets think about this on an even smaller scale: Individual abusive relationships. Given the degree of individual suffering they inflict and the degree of societal harm and crime caused when children grow up in an abusive environment, I strongly suspect that it is worth investing significant resources. Also, it may be that the same principles of justice and conflict resolution that apply to this problem can then be scaled up to larger problems.

On Earth, when we see someone in an abusive relationship, our solution is to provide them with resources that allow them to exit the situation. As this essay explains, that is not an option in space. How then can we prevent long- running abusive relationships (romantic or otherwise) in space?

Some lines of thought:

0) More clear-cut definitions. One problem in conversations around verbal/emotional abuse is that it is not very well-defined. You can easily find lists of "signs that a relationship _might_ be abusive", but it is hard to have a discussion around the trade-offs to make in preventing a phenomenon when not everybody can agree on when something is actually an instance of that phenomenon.

1) Filtering: It may be that the most effective thing we can do is just to screen for people who have habits of abusive behavior. Given that both false- positives and false-negatives are costly, what are some good classifiers with a low error rate?

2) A conception of abuse-adjacent (or reckless) phenomena: Drunk driving does not directly kill or injure anyone. However, it has such a high risk of causing traumatic injury that the law punishes people for it nonetheless. Are there habits that have such a high probability of developing into abuse that we should prohibit them under some category of interpersonal recklessness?

3) Better tools for detecting and changing situation-triggered habits: A person's habits can be dramatically different in different physical settings and in different dyads of people. This makes doing #1 before a mission more difficult. It also means that if a crew notices #2 (and using #0, convinces the person it is a problem), the person can work on training different habits in one simulated situation and then copying those over to real life.

</comment><comment><USER3> The way it reads, the consequences of failure are so high that we're going to make it a pressure-cooker kind of situation which will inevitably cause the very outcomes that their whole governance model is based on avoiding.

The baseline will likely be "everything is great, be happy!" and expressing dissatisfaction will be deviation from baseline. Deviation from baseline can't be tolerated because Bad Things Can Happen (tm) so a few people who express dissatisfaction outwardly will be locked up, shipped home, etc. People will quickly learn to shut it if they don't like their situation and viola we've got a resentment escalating apparatus assembled. What happens next? Eventually someone can't stand it anymore and goes fully off the reservation with dire consequences.

Pretending that you can effectively manage your way out of the unpredictable nature of human beings when they don't have any outlet is tremendously naive or arrogant, or perhaps both.

The idea that we can just design something that'll last for more than ~50 years without falling apart spectacularly only works on Earth where the people who really are sick of $X have the choice to opt out by moving jurisdictions.

Seasteading -- as crazy libertarian as it is -- is probably the only thing that provides hope of finding a truly stable governance mechanism. It's like those crazy libertarians say, we need tons and tons of tries to get governance right without needing a revolution every time we make a mistake.

<comment><USER4> >Seasteading

Or Patchwork.

</comment></comment><comment><USER5> There is critical delay of communications beyond which an empire becomes ungovernable. If the Atlantic was narrower Her Majesty would rightfully rule the whole of North America. If it was wider - we may not have been able to settle there.

And history gives us pretty good idea what kind of ping political governance tolerates.

<comment><USER6> One of the best analysis of the US geopolitical situation I have ever read is this.

[https://www.stratfor.com/analysis/geopolitics-united- states-...](https://www.stratfor.com/analysis/geopolitics-united-states- part-1-inevitable-empire)

Thought me a lot.

<comment><USER7> While they do some interesting analyses, the mindset they express is just horrifying.

<comment><USER6> Sometimes the right people say the wrong thing and the wrong people the right thing.

I understand the controversy but that doesn't take away from the value of their analysis IMO.

</comment></comment></comment></comment><comment><USER8> I think it's a bit naive to assume there will be self sufficient space colonies with humans that are just like us, 300 years from now. Imagine a person 300 years ago speculating about the present.

Assuming we somehow survive 300 years, technology will be so advanced. We are just a few years away from genetically engineered humans as it is. And people argue about whether AI is 20 years away or 100, but we Will certainly have it by 300.

</comment><comment><USER9> We've known for quite a while that "Mars ain't the kind of place to raise a kid ..."</comment>


Ask HN: Who should I interview for my Master's Thesis on freemium? - <AUTHOR>

I have earlier used HN and Quora to get some ideas for my Master's Thesis on freemium (http://news.ycombinator.com/item?id=1652597). Now I have chosen what to focus on: optimizing customer acquisition when using freemium. Last semester I wrote a paper on freemium (http://www.scribd.com/doc/46680854/Succeeding-With-Freemium) where I found that word-of-mouth was a core element of freemium, and this will be the focus of my thesis. To be more specific, my focus will be on companies such as Dropbox that incentivizes people to share Dropbox with others to get more space for free, and how that effects Dropbox's freemium model.<p>But who other than Dropbox should I contact to try to get an interview?<p>(Also asked on Quora: http://www.quora.com/Freemium/Who-should-I-interview-for-my-Masters-Thesis-on-freemium) <comment><USER2> I read somewhere (not sure if this is actually true), that Fred Wilson coined the phrase, so he probably has great perspective if you can get him to do an interview.

Evernote has had several stories written about them explaining how crucial the freemium business model has been in helping their rapid growth. I think the CEO did a piece for Fast Company if my mind serves me correctly.

Hopefully these help.</comment>


California bans for-profit prisons and immigrant detention facilities - <AUTHOR> https://www.latimes.com/california/story/2019-10-11/california-bans-for-profit-prisons-and-immigrant-detention-facilities <comment><USER2> I find it incredible that it took this long, but as others have noted, not enough attention has been given to the abuse at the hands of guards, and prison officials. There needs to be a desperate, urgent overhaul of the entire penal system in America. We no longer see a system where it's better for ten criminals to go free, rather than one innocent person go to prison. Innocent and guilty alike are going to prison, and suffering inhuman conditions. Then we expect them to magically pop out on the side of a sentence and somehow be "reformed".

</comment><comment><USER3> [https://news.ycombinator.com/item?id=20955103](https://news.ycombinator.com/item?id=20955103)</comment>


European Court Rules Netflix Must Contribute to German Film Subsidies - cirrus-clouds https://www.hollywoodreporter.com/news/european-court-rules-netflix-contribute-german-film-subsidies-1112391 <comment><AUTHOR> Sad to hear its OK to pass retroactive laws in Germany, but maybe Netflix should just tack on 5% to cover this for any German customers.</comment>


Future of Retail: Why It Won't Be Empty Windows - <AUTHOR> http://iamvictorio.us/post/13356312465/future-of-retail-why-it-wont-be-empty-windows

<comment><USER2> If a retailer has to provide the lowest cost and the highest experience, doesn't that sound like predicting empty windows? And if those rents go down the malls collapse and all the windows will be empty. Plus, with electric self driving cars we are going to see delivery costs plummet. It doesn't look good.</comment>


Why are women being pushed away from the tech industry? - <AUTHOR> http://www.smashcompany.com/business/why-are-women-being-pushed-away-from-the-tech-industry <comment><AUTHOR> An excerpt:

Let's do a thought experiment. Suppose there was overwhelming evidence that 95% of women were terrible at technology and 5% of women were awesome at technology. There are roughly 7 billion people on the planet, roughly 3.5 billion women, roughly 1.5 billion women who work outside the house for a wage. In this scenario, where only 5% of women love technology, there are 75 million working women who are awesome at technology. According to the Bureau Of Labor Statics, the USA had 1,256,200 software developers in 2016. The BLS also tracks some other minor categories, such as Web Developer, which have about 150,000 jobs. Lump all the sub-categories together, and let's say there are 2 million such jobs in the USA. Let's be wildly generous and double the number for the EU, and triple it for Asia. That gives 12 million software developer jobs in all of the advanced and developing economies. So even with exaggerated assumptions about women's inherent weakness in technology, we still end up with a scenario where every single programming job in the world can be filled by a woman who will be awesome at the job. There is no need for men, at all, in the tech industry.

<comment><USER2> And thus you hit on exactly why the problem exists in the first place. The tech industry has been acting as a cushy jobs program for mediocre men for decades now and there's real panic about the push for an expanded talent pool driving them permanently out of work.

</comment></comment><comment><USER3> We're ignoring the elephant in the room here:

Tech jobs by and large are abusive.

My theory is that men are more tolerant of abuse, or more ignorant they're experiencing it.

<comment><USER4> What exactly do you mean by abusive?

<comment><USER3> I would have to write nothing less than a book to explain exactly what I mean.

Put succintly, a lot of tech culture is a lie meant just to keep you working long hard hours.</comment></comment></comment>


Journalist's phone hacked: all he had to do was visit any website - <AUTHOR> https://www.thestar.com/news/canada/2020/06/21/journalists-phone-hacked-by-new-invisible-technique-all-he-had-to-do-was-visit-one-website-any-website.html <comment><USER2> I think the developer community need to start ostracising people working for these companies. Don't hire former employees, don't hang hang out with people who work for these companies and conferences.

Don't supply services to these companies (build their website, network...).

I believe by letting people of the hook for participating in this (similar things can be said for e.g. the NSA) we are essentially endorsing the behaviour. If you work on at e.g. NSO group, you are personally responsible for governments surpressing and even killing (just look at SA) critics

<comment><USER3> Ostracising someone from society solely on where they work without looking at their actual actions is implying guilt by association. A tactic often used by authoritarians. Everyone in a civilised society has the right to a fair trial without the presumption of guilt.

<comment><USER4> Finally, somebody's brave enough to say the truth!

I've been helping with some work for a small local gang- we do the usual (murder-for-hire, "debt collection", extortion, etc). Although I only do administrative work - keeping records and such. Pays great. But you know what? My wife- my wife of five years- left me when she found out.

Can you believe that? What a fucking fascist. I didn't do anything wrong. I never killed anybody. And, sure, I did also help machine firearms for folks, and I did help with some supply chain issues to make sure we have a reliable supply of bullets, but I never shot anyone. Not one person.

How _dare_ anybody discriminate against me?

<comment><USER5> Unclear whether this is legit, or if you're being facetious to demonstrate a point. I'm gonna bet on the latter, seeing as this is HN!

You _intended_ to supply a local gang with guns and ammo to earn profit from it, along with the other actions you took. You purposefully set out to profit from their criminal behaviour in full knowledge of what that entailed.

I'm not surprised your wife left you. Good on her.

Here is a circumstance where your point is not valid, where there is no malicious intent:

\- Developer A in dept X finds out developer B in dept Y is working on Z. Is uncomfortable with anything to do with Z.

\- Dev A raises this with line manager C and gets pushed back.

\- Dev A tries to raise this up higher. Gets push back.

\- Dev A decides to leave the company because the workplace has now become increasingly hostile.

Dev A tried to do the right thing and raise up the fact that project Z was unethical. By presuming guilt by association, Dev A is treated exactly the same as Dev B.

Consider engineers at Google. Did every Google engineer work on project dragonfly? Did every engineer know about it until it was leaked to the press? Do the project zero team work on ad tracking?

Bringing it back to your example now. If you were an accountant for a printing shop that just happened to be a front, but you never knew about it or suspected it, that's another story. There's no intent to profit from or knowledge of the criminality. Now you're an innocent bystander who was taking advantage of.

If your wife left you in this situation, I'd feel for you.

This is why we presume innocence until guilt is proven. I, for one, would rather some guilty people slip through the net of justice if it helps us to not habitually punish innocent people for crimes they did not commit.

The world is not perfect, nothing is ever black and white.

<comment><USER6> Facetious? Whatever gave you that idea?

Anyway, we can evaluate the permissibly of moral actions using the principle of double effect. As you suggest, we do not always have the luxury of choosing courses of action without some kind of negative side effect. At the same time, it is not morally permissible to engage in intrinsically immoral acts (sorry, utilitarians/consequentialists) nor is it permissible to intend the evil effect. We may also not use the evil effect as a means of attaining the desired good. Finally, there must be a proportionality between the good and bad effects that justifies the toleration of the bad effect.

<comment><USER7> I am genuinely confused by your comment. Are you, again, being facetious or are your arguments just bad?

> it is not morally permissible to engage in intrinsically immoral acts > (sorry, utilitarians/consequentialists)

How would anyone define an intrinsically immortal act? It seems dishonest to discard well-established schools of thought while ignoring the very premise that makes them relevant.

> We may also not use the evil effect as a means of attaining the desired > good.

> Finally, there must be a proportionality between the good and bad effects > that justifies the toleration of the bad effect.

These two statements directly contradict each other.

</comment></comment></comment></comment></comment></comment><comment><USER8> The Citizen Lab reports (one linked from this article) about the Israeli NSO Group's Pegasus spyware have been _really_ scary for a few years now already.

This is a frightening 8-part series about the abuse of "Pegasus" in Mexico 2017-2019: [https://citizenlab.ca/2017/02/bittersweet-nso-mexico- spyware...](https://citizenlab.ca/2017/02/bittersweet-nso-mexico-spyware/)

Here's a category of articles on the citizenlab.ca web site described as "Investigations into the prevalence and impact of digital espionage operations against civil society groups": [https://citizenlab.ca/category/research/targeted- threats/](https://citizenlab.ca/category/research/targeted-threats/)

<comment><USER9> NSO Group is owned by Novalpina Capital, a British company.

<comment><USER10> >NSO Group is owned by Novalpina Capital, a British company. Wy do you call it "Israeli?"

I assume because it was founded by three Israeli citizens, in Israel, and the HQ and staff almost all work near Tel Aviv.

And while Novalpina Capital provided funding, that was only in a partnership with two of the original founders, as a buy-out.

<comment><USER11> Buying something is the same as making it yourself right?

<comment><USER10> >Buying something is the same as making it yourself right?

No.

And I didn't claim anything of the sort.

</comment></comment></comment></comment></comment><comment><USER12> I saw this discussed on reddit, and I was surprised that there was so much confusion about how this happened. It wasn't just "network injection" \- quite clearly (unfortunately very poorly described in the article) there was a vulnerability in iOS/Safari that allowed remote code execution; network injection alone wouldn't have been enough. Does anyone know what the CVE was that allowed this?

<comment><USER13> A code execution vulnerability isn't enough. To work on truly any website, they need:

\- A remote code execution vulnerability. There are almost certainly multiple vulnerabilities at play here, since long gone are the days where a single vuln gave arbitrary code execution.

\- a way to bypass the encryption/https, unless the remote code execution was on a layer before encryption (which seems unlikely). EDIT: Apparently the hack only works on non-encrypted websites.

\- Once remote code is achieved, they most certainly need a way to elevate privileges in order to make the hack more persistent and tap into other apps.

There are most likely several CVEs at play here. The amount of effort that went into this hack is, frankly, terrifying.

<comment><USER14> > "There are almost certainly multiple vulnerabilities at play here, since > long gone are the days where a single vuln gave arbitrary code execution"

Could you go into this in a little more detail?

I'm inferring that chains of vulnerabilities are needed to go from some starting point to arbitrary code execution. Is that correct?

Have efforts to secure computer systems over the past ~2 decades succeeded, at least in that much more effort needs to be invested in order to get to the point of arbitrary code execution?

<comment><USER13> For the most part, yes, it's much harder to get ACE today than it was 20 years ago, and even then ACE doesn't actually grant you any fancy capabilities on a modern phone.

To get ACE, you will generally need a couple of primitives, such as an ArbR/ArbW coupled with an infoleak to get ROP. This will allow you to execute arbitrary code, but you're still stuck within the confines of the current process' privileges. Phone apps are generally heavily sandboxed, and the web browsers tend to be sandboxed even harder. Having ACE in some arbitrary process won't give you the ability to do anything: filesystem will still be out of reach, most of the time you won't even be able to see other processes or even make network requests. So you'll need to break the sandbox.

Breaking the sandbox tend to involve looking for an RCE in a process outside the sandbox that you can communicating with over an IPC channel. And you'll likely need to do this twice: once to break free of the browser sandbox, and once to break the "App" sandbox. If we take a look at chrome for instance (which is very well documented[0][1]), they have sandboxing mechanisms built- in to disallow access to most resources (like the filesystem) to most of its processes, and to prevent access to most of the kernel API surface. And then Android further sandboxes all apps to disallow them from accessing each- other's data. So again you'd have to find another bug somewhere to bypass this.

There are tons of mitigations techniques being developed to make bugs harder to exploit, from Pointer Authentication (making it much harder to exploit ArbR/ArbW bugs) to Control Flow Integrity (making it much harder to create a ROP chain). Of course, not all apps actually have those mitigations in place, but the web browsers tend to enable most, for instance chrome has CFI enabled[2].

[0]: [https://chromium.googlesource.com/chromium/src/+/master/docs...](https://chromium.googlesource.com/chromium/src/+/master/docs/design/sandbox.md)

[1]: [https://chromium.googlesource.com/chromium/src.git/+/master/...](https://chromium.googlesource.com/chromium/src.git/+/master/docs/linux/sandboxing.md)

[2]: [https://www.chromium.org/developers/testing/control-flow- int...](https://www.chromium.org/developers/testing/control-flow-integrity)

<comment><USER15> Would you mind expanding the acronyms? This is super interesting, but hard to follow (and also somewhat hard to google, apparently Arbr is a bike brand)

<comment><USER16> Guessing partly, but maybe ArbR = arbitrary read, ArbW = arbitrary write, RCE = remote code execution, IPC = inter process communication.

<comment><USER17> ACE arbitrary code execution

RCE remote code execution

ROP return-oriented programming, which I understand to be using code already on the target and manipulating code flow in order to piece together the boots of programme to execute a routine of the attackers choosing (like cutting letters out of a newspaper to make a ransom note!), [https://en.m.wikipedia.org/wiki/Return- oriented_programming](https://en.m.wikipedia.org/wiki/Return- oriented_programming)

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> On HN I've seen a lot of unencrypted sites lately. I don't personally feel comfortable browsing on them, so I avoid them. Near the end of the article here, it mentions that this is only possible on an unencrypted website. Is there a reason why so many people are not encrypting their websites? Even browsers seem to have picked up on the insecure nature of http. Please correct me if I'm wrong here, I just find it very strange how many links I've inspected only to see a lack of TLS/SSL.

<comment><USER19> I've seen this improve a lot in recent years with Let's Encrypt, so that's been a great trend.

LE is still tedious as heck to set up on your own, though, so I guess people who haven't migrated to modern hosting yet are still being left behind. Most hosting-for-devs platforms these days give you HTTPS by default and don't think would even let you host a website without.

<comment><USER20> Tedious to set up, tedious to maintain.

January 31 of this year I got an email telling me that my LE client used the older ACMEv1 protocol, not the newer ACMEv2 protocol. They gave me 4 months notice to update my LE client to something compliant. I burnt the time and did the work.

On March 3 myself and many others[0] got an email demanding that we manually re-issue our certificates because of a vulnerability discovered in the LE service. They gave us one day to comply, after that they would revoke the certificates and our users would receive security errors. I begrudgingly went through all my servers and issued the command to forcibly renew certificates. Not a huge burden for me, but likely a bigger burden for larger operations.

As the feature set grows (new challenge types, wildcard support, etc.) and the service gets even more popular, it's going to be an even bigger target and the effects of a monoculture will really be felt. I'm starting to see the value in paying for certificates, and more specifically, using providers that don't provide a public certificate issuance API (or at least stick it behind a paywall.)

How many times would LE have to accidentally issue gstatic.com or fbcdn.net before they get the Symantec treatment[1]? Too big to fail: It's not just for investment banks. And that should give anyone seeking a decentralized internet pause.

[0]: [https://www.zdnet.com/article/lets-encrypt-to- revoke-3-milli...](https://www.zdnet.com/article/lets-encrypt-to- revoke-3-million-certificates-on-march-4-due-to-bug/)

[1]: [https://www.zdnet.com/article/mozilla-warns-it-plans-to- dist...](https://www.zdnet.com/article/mozilla-warns-it-plans-to-distrust-all- symantec-chained-certs-in-october/)

<comment><USER21> > _How many times would LE have to accidentally issue gstatic.com or fbcdn.net > before they get the Symantec treatment[1]? Too big to fail: It 's not just > for investment banks. And that should give anyone seeking a decentralized > internet pause._

I agree that some problems are unfortunate. But let's contrast for a moment. LetsEncrypt has demonstrated track record of quickly fixing issues. Symantec has a demonstrated track record of hiding issues instead of fixing them.

It's wise to consider options carefully. LetsEncrypt _isn 't_ the be-all end- all service for TLS and your needs might not be compatible. But I don't think it's fair to shove LetsEncrypt aside just because it's had its share of problems.

For a _free service_ it's pretty damn reputable.

<comment><USER22> It's a good service, but I think the GP's point is that it's not trivial to do. Lots of websites probably went down because they missed that e-mail and we've seen lots of major websites go down due to some issue related to their certificate.

Let's Encrypt has lowered the bar, but it's still a bar that needs to be overcome.

<comment><USER23> As we'd expect ISRG not only fixed the immediate problem they also accelerated plans to ensure that any similar problem would have less serious ill effects.

In particular a current Certbot (or similar software from other developers) will conclude that it should try to replace a certificate which has been revoked and not only certificates that will shortly expire. So if a similar event happened, and you missed the email, your Certbot will treat the certificates much as if they'd expired and replace them automatically.

Also if you didn't replace a revoked certificate the thing is: Online revocation is broken. Most of your users will not have noticed your certificate was revoked. Popular browsers do have an out-of-band way to enforce revocation but they didn't use it on that Let's Encrypt incident because they felt it was low risk. So maybe some people are running Internet Explorer (really?) or have explicitly turned on revocation, everybody else doesn't even see a warning page.

</comment></comment></comment></comment></comment></comment><comment><USER24> Ok, so I want to make something clear to the (smart but mostly not "in-the- know" about NSO) HN crowd.

Let's say you're a Mexican drug lord or Saudi prince. You know this tech exists and the US/Israeli/European governments use it.

Then, you see this article, and see all the comments in the comment section about how competent, scary and balance-changing the technology is.

Basically: I think these pieces are bought for and paid by NSO through a PR firm, but you are not the target. When we leave comments like "NSO's tech is so good it has to be regulated!" or "NSO's tech is dangerous!" we are playing directly into the PR firm's clever hands.

It's like an article about how good the AR-15 or the F-35 are. Obviously to me (and most of the readers) it's mostly "why are we focusing on technology of death" but we are not the target.

<comment><USER25> What you are saying makes a lot of sense. Then does it mean that the NSO capabilities are not quite as "advertised"?

<comment><USER24> Of course, NSO and other players in that field can do much, much, much more than advertised to the media.

Remember, the vast majority of people working for NSO worked for Israeli and US intelligence bodies. They serve in the 8200 unit doing malware analysis trailed by the NSA and then go work for NSO on the same sort of technology.

(If you want to get an idea of how much, I recommend "Permanent Record" but if you don't like Snowden then check out how far ahead intelligence bodies were _historically_ compared to public knowledge - WW2 crypto being a good analogy)

This lets the US government (and the Israeli government in turn) to make money off the technology without going through the same international regulatory systems.

The US government (or Israeli government) can stop companies like NSO in a single decision but they are not since it is making them money.

It's up to us (the citizens) to pressure them to do so and to promote security best practices and work on better tools to make it harder to breach peoples' privacy.

<comment><USER25> Thanks for your through reply. My question was more in line with enterprise PR/sales. More precisely, to what extent does such a PR activity drive sales for NSO. In my early engineering career I did enterprise pre-sales for two different companies and we always relied on more direct touch points with potential customers (e.g. doing seminars, workshops).

</comment></comment></comment></comment><comment><USER26> Why aren't cell phone tower communications secured? Why aren't cell towers secured with certificates verified by the network? Why aren't stingray devices considered an attack on the cell network?

If stingray devices work by tricking your phone to connect with older protocols like 3G, why aren't those protocols deprecated just like we deprecate older encryption methods that are no longer secure?

<comment><USER27> I think it has to be 2G GSM specifically, 3G UMTS do _cipher_ that kind of holds, also a lot of phones aren't dynamically updatable or updated smartphones

GSM downgrade attacks as well as USB SDR gears came out late 3G era, I kind of trust 3GPP guys for protection for LTE onwards but if GSM downgrade attacks are your primary concern in your life you can move to Japan and get contract on au by KDDI as KDDI flat out ignored CSFB to CDMA2000 and went all VoLTE

<comment><USER28> >if GSM downgrade attacks are your primary concern in your life you can move to Japan and get contract on au by KDDI as KDDI flat out ignored CSFB to CDMA2000 and went all VoLTE

Wouldn't it be easier (at least on android) to go to mobile network settings and change it to "lte only" or "3g only"? As for using au by KDDI, I'm not even sure whether using their SIM cards will prevent a downgrade attack. It's possible that they still support 2g for roaming use, for instance.

<comment><USER27> okay, I've mistaken, KDDI do have eCSFB to CDMA since the get go...my brain was stuck in pre-LTE launch era. Sorry.

I'm not sure how "LTE Only" options work on every phones, moving across countries to just make a phone behave certain way is beyond absurd but verifying how it's working might be a bit of challenge?

regarding roaming, you mean a fake GSM tower with backend going over a VPN to a GSM tower somewhere the phone could roam to? That I didn't realize. That could happen indeed.

<comment><USER29> LTE Only is an option (albeit hidden) on every Android phone I've ever used, at least. Just enter _#_ #4636# _#_ in the dialer.

I usually have it set, and in areas that only have 3G coverage, I get no signal unless I change the setting.

<comment><USER29> Hrm, just noticed that hn ate my asterisks. Backslashes don't work, either. Unicode to the rescue: ⁕#⁕#4636#⁕#⁕

</comment></comment></comment></comment></comment></comment><comment><USER30> > All he had to do was visit one website. Any website.

The author directly contradicts the headline used here:

> The website must use "clear text" which means the URL starts with "http" not > "https."

<comment><USER31> Consider the following:

[http://google.com](http://google.com)

[https://google.com](https://google.com)

Both wind up eventually to the same place, but the first redirects to the second.

That can be a link, it can be an old bookmark, etc.

Worse if it was a targeted ad, the [https://](https://) link could be just a redirect back to an [http://](http://) link, something the browser probably has no trouble doing.

<comment><USER32> > the [https://](https://) link could be just a redirect back to an > [http://](http://) link, something the browser probably has no trouble > doing.

Doesn't HSTS prevent exactly this? Sure, not every website implements it, but the most visited ones overwhelmingly do - it's certainly misleading to say "any website" in that context.

<comment><USER33> doesn't the hsts header have to be delivered in cleartext the first time you visit the site with http? so your browser knows from then on it can only ever visit via https? the header can be removed in that initial cleartext request so it never gets set in your browser in the first place. I don't think HSTS works against highly targeted MITM attacks like this.

<comment><USER34> hsts lists ship with browsers. otherwise it'd be useless for the reason you described

<comment><USER33> but that's not an exhaustive list of websites though. any website not in the list is vulnerable to this

</comment></comment></comment></comment></comment></comment><comment><USER35> As recently as Nov 2019 comcast was doing this, albeit more benign

[https://rietta.com/blog/comcast-insecure- injection/](https://rietta.com/blog/comcast-insecure-injection/)

[https://news.ycombinator.com/item?id=21389657](https://news.ycombinator.com/item?id=21389657)

</comment><comment><USER36> Worth noting that the Safari and iOS vulnerabilities that allow this to happen are worth up to $1 million if reported to Apple.

<comment><USER37> Maybe $1 million is not enough.

<comment><USER38> Does Apple allow anonymous reports/crypto payouts? There could be anti-money laundering issues to sort out, but perhaps this could incentivize individual actors to break ranks and leak vulnerabilities upstream.

<comment><USER24> "Break ranks"? If you work for one of these actors (NSO with intentionally "sassy" PR or "quiet" ones like Verint or ones in the middle like Cellebrite) and leak info - you will get jailed.

Breaking ranks in this case is a 10 year jail sentence if you get caught.

Funnily enough, the ex-head of malware analysis for NSO recently released this [https://www.jsof-tech.com/ripple20/](https://www.jsof-tech.com/ripple20/) and "switched ranks" to the light side.

</comment></comment></comment></comment><comment><USER39> I'm probably naive here because I'm not versed in networks -- but couldn't he avoid surveillance by using a VPN? Wasn't one of the design features of VPNs that your connection can't be hijacked?

<comment><USER40> Of course, the VPN could be the one doing the hijacking.

<comment><USER39> Well let's assume that he f.ex. has friends in several countries to whose VPN servers he has a direct unimpeded access (by IP, not hostname).

Would a trusted VPN help? Or would hijacking the traffic at the point of departure (his phone / the air) still manage to corrupt the payloads?

</comment></comment></comment><comment><USER41> The article mentions NSO's Pegasus that the journalist victim downloaded, and presumably installed surveillance tools on his iPhone. What is Pegasus? Is it platform of browser zero days that then installs surveillance tools? Does it root kit the phone?

<comment><USER42> It's easy to look up, it has historically been used to spy on human rights activists and reporters.

It's sold by the NSO group, that has repeatedly tried to smear and spy on organisations that report on them knowingly selling to and supporting governments that are using these tools to attack HRAs, etc.

I assume that they have updated it since it first came to light, as the vulnerabilities at the time were all fixed.

Note that the vulnerabilities that they use are all the same ones used by jailbreaks, so fixing them necessarily means preventing jailbreaks.

<comment><USER43> > Note that the vulnerabilities that they use are all the same ones used by > jailbreaks, so fixing them necessarily means preventing jailbreaks.

Well, unless there was a method to jailbreak your device that did not require a chain of software vulnerabilities.

</comment></comment></comment><comment><USER44> > the Israeli company issued a policy that vowed the company would cut off > clients if they were found to misuse the surveillance technology to target > journalists and human rights activists

This goes right up there with "the backdoor for which only we'll have the key".

<comment><USER45> If a system's purpose is to protect citizens from bad actors, it is only a matter of time before the citizens become suspected bad actors, and the machinery is turned against the citizens.

This is a concept that is sadly missing in well-intentioned people.

</comment></comment><comment><USER46> Ironically, Firefox gave me a fingerprinting warning for the website this article appears on. (The fingerprinting was being done by eyereturn.com)

<comment><USER43> Safari says this page has 21 trackers ¯\\_(ツ)_/¯

<comment><USER47> Between uBlock Origin and uMatrix I hadn't even realized. Prior to seeing these comments I had actually been impressed by the site's (apparent) responsiveness combined with the (apparently) clean and mostly pain text layout. Whoops.

<comment><USER46> I'm running UBlock Origin and UMatrix too. And both of them are blocking eyereturn.com. But because I've got Firefox to alert me to fingerprinting (not a default option I think) I also got a little pop-up informing me that the site was using it. Which advice I appreciated even though I was already protected by those two earlier mentioned services.

</comment></comment></comment></comment><comment><USER48> Would using something like Opera Mini have prevented this attack from happening?

I'm imagining a proxy like tool that lets high exposure individuals to request webpages, have them downloaded/parsed, and possibly rendered before handing them off to the client device.

Perhaps it would let the client download https normally but switch modes for any http requests (if I understand what happened here correctly.)

</comment><comment><USER49> I feel like this article makes the technique sound a lot more novel/surprising than it is. It seems like a simple case of "phone had an RCE vulnerability that got exploited by an attacker in control of the network".

<comment><USER42> So either they had a fraudulent cert or he was using insecure sites :-/

<comment><USER50> It's probable that they were intercepting the connection and the act of hitting _any_ http site resulted in the redirection to an exploit payload. Many many sites have http requests, so you can't really blame someone for hitting a non-https site.

<comment><USER42> You're right it may not be his fault, but that is why all sites should be https, and sites should have the hsts header set.

Essentially if you are using [http://](http://) anywhere on your site (including transitively loaded resources) you are putting your users at risk - the same thing was exploited with the great cannon or whatever that DoS from the Chinese gov was called.

<comment><USER50> Oh yeah, I agree! https should be the standard, indeed.

</comment></comment></comment></comment></comment><comment><USER51> >Yet Radi was trained in encryption and cyber security. He hadn't clicked on any suspicious links and...

If you were properly trained for, you should have already realized that cellphone is not trustworthy way of communication.

</comment><comment><USER52> Time for everyone to install HTTPS Everywhere and turn on Encrypt All Sites Eligible (EASE) on desktop.

On mobile, highly recommend using a browser that supports extensions or pressuring companies to enable third party browsers. It's not overstating it to say that our legislators should compel that competition, it's a national security issue that journalists, intelligence officials, and the President using devices by a certain manufacturer cannot change the browser or use helpful extensions like HTTPS Everywhere.

[https://www.eff.org/deeplinks/2018/12/how-https- everywhere-k...](https://www.eff.org/deeplinks/2018/12/how-https-everywhere- keeps-protecting-users-increasingly-encrypted-web)

</comment><comment><USER53> How's this possible? Anyway this can be prevented?

<comment><USER54> > How's this possible?

Software is insecure.

> Anyway this can be prevented?

Stop using insecure software.

<comment><USER53> This is obvious; just wondering what exactly they used.

</comment></comment></comment><comment><USER55> What methods and tools are available to the average "power user" to detect and mitigate mobile device malware?

Just reboot my phone every morning?

<comment><USER56> Root some android, install obscure build, install firewall, use exotic browser.

<comment><USER57> Be fingerprinted by unique stack signature anyway.

</comment></comment></comment><comment><USER58> Would using a trusted VPN prevent this attack, since even HTTP requests would be tunneled through a secure connection?

</comment><comment><USER59> So just by being redirected, you can have root access to your iPhone taken without warning? That sounds like an insane vulnerability. Anyone with a security concern should immediately drop iPhone shouldn't they? I admit the intercept process is clever, but if that's all that is needed for total security failure, the real issue is the browser/OS.

</comment><comment><USER60> I'd love to see a more technical explanation of the method that is used!

</comment><comment><USER61> Would factory resetting your phone on a regular basis remove the hack?

<comment><USER28> Considering that we haven't had untethered jailbreaks in forever now, I think even a restart would do.

<comment><USER62> Possibly, but advanced malware like this can add many re-infection paths, opening a safari tab might be sufficient to trigger a re-infect upon browser launch. Many apps also make periodic background http requests, might be enough to just hijack one of those to trigger the RCE after reboot.

<comment><USER47> I don't think it's safe to assume that Pegasus can't manage persistence. This isn't run-of-the-mill malware we're talking about.

</comment></comment></comment></comment><comment><USER63> Would certificate pinning help here?

</comment><comment><USER64> Journalists need to take a page out of Assange's playbook and use ancient Thinkpads and Powerbooks and use VPNs which would make this technique obsolete.

</comment><comment><USER65> This is one reason why I don't use cellphones.

I suspect that Mr. Radi would have been safe if he had 1) used a PinePhone, with cellular and WiFi radios turned off, and a USB-connected cellular modem; and 2) hit the Internet through a VPN, Orchid, Tor or LokiNet.

If you think not, please share, because I hate spreading BS.

Edit: Well, someone seems to think that I'm wrong, but they aren't saying why. Just sayin'.

<comment><USER66> It seems this attack exploited the browser on the device via non-HTTPS sites. So the elaborate networking scheme really wouldn't do much. They just had to inject their browser exploits on every non-HTTPS site the user visited. Just because the PinePhone runs non-Android/iOS doesn't mean there aren't 0-days for the browser it runs.

<comment><USER65> In TFA, it says that they injected the exploit via stingray or cellular network compromise. I'm pretty sure that better isolation of the browser and other apps from the cellular network would have prevented that.

But yes, he would have been vulnerable to malicious sites exploiting browser bugs, as one always is. I mitigate that by compartmentalizing activities in multiple machines and VMs. For example, the host that this VM is running on contains absolutely no information about my meatspace identity.</comment></comment></comment>


Ask HN: What do you use to plan a sprint? - <AUTHOR> Something which takes care of:<p>- Teams availability, holidays etc.<p>- Shows free time available per team member (after applying the cost for each task assigned) <comment> chupa-chups Prior to the planning the scrum master informs us about the 3-month-average of story points per sprint. We don't do any normalization on the raw story point value like reducing for vacations etc, we rely on the average.

We plan sprints by at first discussing team availability, which includes time required for trainings, off-time for vacations etc.

Next we discuss the backlog items considering who will probably work on which items.

After that we estimate how many story points we will probably manage, both by gut feeling as well as based on the probable task distribution.

This works quite well for us, we usually complete the sprint goals and only seldomly have to add new tasks into a ongoing sprint. If we don't manage to complete the sprint goals it is mostly caused by unexpected events or technical difficulties.

We are in the SaaS business.</comment>