What was it like to be a software engineer at NeXT? - <AUTHOR> https://www.quora.com/What-was-it-like-to-be-a-software-engineer-at-NeXT-Did-workers-interact-with-Steve-Jobs/answer/Paul-King-2 <comment><USER2> Welcome to the creative industry, it's not unusual for businesses with a design culture to operate like this. It would be pretty similar working for any big name architect anywhere. Likewise in graphic design, product design etc... If you come from a design background you will be used to having your work taken apart at a presentation because it will have been happening since the first day of architecture/art/design school. It's a key skill to learn to be able to let go of the work you have done, stand back and analyse it dispassionately then go back and re-do things. After all, the criticism is meant to make the work better and better work gives you more of a sense of achievement. Yes, it was done in a way which was a little bit cheeky, but it doesn't sound mean to me.

It can be drastically worse than this. When I was at architecture school in the 90's some tutors would actually compete to see if they could make students cry in presentations. Things like physically tearing up hand drawn plans in front of all the other students. I remember tutors going round the final year presentation at midnight and deciding the general standard wasn't good enough, phoning the people they thought needed to do more work, telling them they would fail and that they needed to get out of bed and work for another 24 hours. These were people that had been already been working super long hours for weeks to get their stuff done. Madness. It wasn't just my school that was like this either, it was much worse back then but there are still pockets of this culture in my industry. It is no wonder that back then architecture students in the UK had the highest rate of suicide.

<comment><USER3> I worked in design for a little over 10 years. Having an art director "tear apart" your work is generally the best scenario. They can usually back up the critique with helpful insights. Regardless of tone.

The most dreaded situations, for me, were clients who would tear something apart, but offered no helpful reason why. "Jazz it up" was something repeated an alarming number of times in meetings. I can also remember someone saying that they wanted us to use more colors since they were paying for a full color ad. Because, you know, that's what cost all the money. The colors.

<comment><USER4> I've been a client for a variety of artistic professionals.

I'm not artistic, don't have that kind of creativity, and can't use words that would be helpful to you.

I can only tell you whether or not I like it and give a fumbling attempt to explain why.

This is why I (or my company) hired you: to do something that we can't.

It is incredibly hard to do the translation between designer language and client language. I've worked with some graphic designers who are absolutely amazing at taking my malformed mumblings and using them as effective critiques and requests. But not many people can do that and it leads to frustration on both sides.

This is why those who can do the translation can make incredible money and run their own firms. Just like how people in other industries (accounting, law, coding...) who can translate across domains make more money and run firms.

<comment><USER5> If you're not artistic, and you don't have that type of creativity, what makes you believe you're the best judge of what is good or not? Yes, you may have the money to pay them, but if you're hiring them why don't you just trust their judgement instead of your admittedly poor sense of creativity?

I'm asking this out of curiosity, not attacking you, since you said yourself you're not creative and rely on these people for their creative talents.

<comment><USER6> You can know whether the aesthetics of something does or does not work without being able to determine why.

For instance, I can't cook much more than eggs and bacon, but I can sure tell whether a dish at a restaurant is any good. And I can even narrow down a dish's quality into various broad classes: disgusting, bland, okay, good, really good, and great. Most other aesthetic creations are similar.

<comment><USER5> You may know if you like a particular dish, but would you think your sense of taste is good enough to pick enough dishes to make a successful restaurant? Probably not, especially if you don't know how to cool.

Just because you like or dislike a particular creative piece doesn't mean that you have what it takes to dictate a piece of creative work that will be exposed to millions of people.

<comment><USER6> No, but you could probably pick a restaurant to cater your wedding, which is more like what OP was describing.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> People in the comments here focus on the bad bits (working at night), but then there's this:

\- an enthusiastic CEO working with the team on Sunday morning

\- standing ovations from the customer on Monday

Sure, if you have a family you probably can't do that often, but I'd love a job with an occasional experience like this.

<comment><USER8> Also:

\- An opportunity to contribute to computing history.

\- To work on something new and novel.

\- Not having to worry about politics because there's only one diva allowed.

Not for everyone I'd agree, but there is certainly enough unhealthy appeal, kind of like hard liquor or bungee jumping ..

<comment><USER9> What history? What's new and novel?

Xerox parc, SGI & Sun already did everything the hardware could.

Software-wise it gave us terrible things I rather not know about. Objective-C & Appstore.

<comment><USER8> _> what's new and novel_

Literally the genesis of OSX.

<comment><USER9> What's new and novel about OS X? It's another Unix OS and not even a great one at that.

<comment><USER8> As an OS for the masses it was groundbreaking.

</comment></comment></comment></comment></comment></comment><comment><USER10> The last part sounds like a classic Henry Kissinger move[1] where he would tell people without even looking at their work "Is that the best you can do?" After which the person spent an entire night reworking the whole thing.. to which Kissinger said "ok I'll take a look now"

[1] [https://www.linkedin.com/pulse/best-you-can-do-henry- kissing...](https://www.linkedin.com/pulse/best-you-can-do-henry-kissinger- work-ethic-brad-sullivan-)

<comment><USER11> Nowadays this has bred a generation that resubmit the same work again even if you tell them specifically what's wrong.

<comment><USER12> It doesn't take much effort on your part to check that something hasn't been fixed. But it does take a lot of effort to re-do the work you spent much time on because some jerk pulls idiotic tricks.

Evolution succeeds once again.

</comment></comment></comment><comment><USER13> The author of this answer, I note is a neuroscientist. Wouldn't be surprised if he knew Bud Tribble prior to joining NeXT, who also was a neuroscientist (or studied it a great deal).

</comment><comment><USER14> >> One thing that was unusual is that all the technical people there understood all aspects of the machine

Is this something 'Apple' specific culture wise, I remember SJ saying Apple was the biggest collection of startups on the planet.

I personally prefer small sized teams with lots of in depth knowledge per engineer on the team. IMHO, unless you have a deep understanding of the machine you are working on, you can't make a difference. Not to say that, without it, one will suck, I guess it is that X factor in the outcome I am alluding to.

OTOH, there are other places which won't stick to small team sizes, more stakeholders, yet succeed. So there is that.

<comment><USER15> _I personally prefer small sized teams with lots of in depth knowledge per engineer on the team._

Does anyone prefer huge teams in which each person has only a shallow understanding?

<comment><USER16> Those aren't the only two options. The better one IMO is large teams with small sub-groups, each with at least one person who knows the whole stack top to bottom, with frequent communication between the subgroups. That's pretty typical in the corporate world where each manager has multiple teams under them, one architect, and a liaison to an advisory board to communicate to other teams.

The reason I prefer this approach is something Apple seems to be struggling with: lots of small teams breed lots of small solutions that don't add up to one big solution.

Case in point: I have a latest-gen iPhone and iPad. The iPhone has a touch- sensitive home button, while the iPad has a real actual click-button. The iPhone has no headphone jack, the iPad does. The iPhone is waterproof, the iPad is not. The iPhone has stereo speakers in landscape, the iPad does not. The iPhone has force touch, the iPad does not. The cheapest iPad has support for the Pencil, the most expensive iPhone does not. Moving on to the Macbook, the iPhones and iPads use Lightning to charge, while the Macbooks use USB-C and have never in their history ever even included a Lightning port. The Pencil exclusively uses Lightning to charge and has no other way of connecting, and even helpfully includes a Lighting-to-Lightning adapter in the box, still rendering it completely incapable of charging from a Macbook without yet another adapter to convert Lightning (male) to Lightning (female) to USB-C (male).

There's no real reason for these differences except to say the teams don't work together to synchronize their engineering efforts. Individually each one is a great engineering achievement. Combined, it's a mess of small solutions that don't add up to one big solution.

<comment><USER17> Alternative explanation to incompetence: iPhone, iPad, and MacBooks are different form factors for different use cases.

iPhone is used in more active situations. Not running in rain with iPad strapped to arm. On iPhone stereo speakers in landscape, not sure what that one means; for me it's the iPad with speakers on both sides while in landscape. Force touch requires force, easy with a phone in your hand, less easy if iPad propped on origami Smart Keyboard. (Could be reason for button diffs too, light touch with haptics vs. real touch, or just a very common use of home button on iPad is while landscape so you squeeze a "real" button between your thumb and forefinger.) The phone is not slate sized, why should it try to be a slate? Don't know why you'd be charging a pencil from a MacBook some way you couldn't charge an iPad with.

To me, seem to be plausible reasons for every one of these differences beyond just "teams don't work together". Certainly both are possible, just saying the device modalities are different. ATV, HomePod and Watch UIs are different too.

<comment><USER16> People read on iPads by the pool or lake or on a boat all the time. There's a good reason to make it waterproof.

Re: the stereo speakers. The iPhone uses the earpiece as one speaker and the bottom speakers as another, so when it's on its side and you're watching Netflix, sound comes out of the top and bottom. The iPad (except for the iPad Pro) only has speakers on the bottom, so when you're using the Smart Cover and watching Netflix, all the sound comes out the bottom. On a device far larger than the iPhone, this really makes a difference.

I don't think a device needs to be a slate in order to be worth writing on. Scribbling notes is easier on an iPhone since you can hold it in your hand, and since you have unlimited pages the increased size of the iPad doesn't matter.

</comment></comment></comment></comment></comment><comment><USER18> In a similar vein there's Carmack interactions with Jobs online now. Worth a read.

<comment><USER19> [https://www.facebook.com/permalink.php?story_fbid=2146412825...](https://www.facebook.com/permalink.php?story_fbid=2146412825593223&id=100006735798590)

</comment></comment><comment><USER20> What was the demo application's purpose? I'm having trouble grokking that from the post.

<comment><USER21> Sounds like it might have been a demo of DBKit or EOF (NeXT's ORMs).

<comment><USER22> I remember watching Steve demo EOF at a tradeshow in Chicago, probably around 1995. His demo system crashed hard in the middle of the presentation, and we got to watch it reboot NEXTSTEP on the big screen. He handled it well, with an "oops" and a laugh, but I bet some people got their asses handed to them afterwards.

<comment><USER23> Last year I watched a demo in San Jose where the company started re-writing the code, _in front of the audience_ , during the demo.

I felt terrible for them; it would've looked a lot better if they just fell back on something else. It was boring watching them write code, people were getting up and leaving, it made it look like they were wildly unprepared. I wouldn't be surprised if the entire company went kaput after that.

</comment></comment></comment></comment><comment><USER24> [https://en.wikipedia.org/wiki/Stockholm_syndrome](https://en.wikipedia.org/wiki/Stockholm_syndrome)

<comment><USER25> I don't know what to think. Here we have a report of an engineer that was told a so harsh thing (you ruined XYZ just because a demo was not what the spectator was looking for), with the boss evaluating probably a very technical thing like an ORM, without having AFAIK the competences, and the report is that it was a great experience.

<comment><USER26> Hmm, well, if you read Jobs responses he was exaggerating, dramatic, and manipulative:

"he looked at the demo for 5 minutes and told me I had "ruined NeXTSTEP" (the software platform)" -> overly dramatic, exaggerating.

""Unless...", he paused with a twinkle in his eye, "there is a way of making it work like the old way,"" -> of course that way exists, but it requires working on saturday. He's not asking that _directly_ though. Manipulative.

""This is 10 times, no 100 times, no 1000 times better!!!"" -> Overly dramatic, exaggerating.

<comment><USER27> It is telling that they had been preparing for this demo for 3 months and Jobs decided to come by two days before the demo, on a Saturday, only to trash the project and personally attack the developers.

It is quite the skill to be able to do that in a way that is motivational.

<comment><USER26> Imagine he decided to come by on Friday instead. Oh well, then we wouldn't have this story either.

EDIT: My bad I meant Thursday instead of Friday, so that it could've been _fixed_ on a regular Friday.

<comment><USER27> Not sure I follow.

EDIT: So you think it speaks well of management to check up on a very important demo the last few days of a three months preparation? And make huge changes? That should have been known long in advance. Instead of a smoke-and- mirrors demo they could have produced the real thing had Jobs communicated what he wanted from the beginning or half-way through.

<comment><USER26> > So you think it speaks well of management to check up on a very important > demo the last few days of a three months preparation?

Nope, I think that's terrible, but that's an easy judgement to make. Who knows what a stressful mess management was in.

My point is that its part of a facade (broadly called "reality distortion field"). I quoted 3 examples of clearly manipulative behaviour.

Jobs could've made it easier for the engineer by checking out on Thursday. Why _didn 't_ he? Perhaps he just had high expectations and was very much disappointed? Has he ever published memoires where he went into examples like these?

<comment><USER28> The demo for Steve was originally scheduled on a weekday the week previous, but kept getting rescheduled by Steve. Maybe it was a low priority for him and he thought he already knew what it was going to be. The preview only happened at all because we kept pushing for it, because we knew it had changed a lot and it would be very bad if he was seeing it for the first time live.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> Saturday morning meeting, then worked all night, on the whim of one person, to present on Monday. Just wow.

If this is what it takes to succeed in our industry, then I accept that I will not. I just simply do not have the stamina for it.

I am not trying to be flippant. I am genuinely amaze how driven some people are.

<comment><USER30> When I was working at Google (now retired living in Germany), I spent my first year there working insane hours and pushing myself beyond self-imposed limits. However, after dealing with burnout and having some close friends implode on the job, I soon realized that I was nothing more than a cog in a machine that would, if I let it, chew me up and spit me out.

I started gradually reducing the number of hours I worked for 'real' until, a few years later, I found myself working for two hours a day, choosing to spend the rest on things that contributed to my sanity and self-development (on company time). To fill the gap, I would work on my own software projects, socialize with co-workers, do research on things I found interesting and read books.

Needless to say, nobody noticed. I kept this up for a number of years and then I quit. Looking back on it now, those were some of the best, most carefree years of my life. There is nothing like getting paid a competitive six figure salary to mostly do the things you enjoy and not care one iota about corporate management structures.

<comment><USER31> From one extreme to another isn't quite a good solution IMO. I'd much rather quit and work on something I really care about than pretend I care about my job and put in the bare minimum of work possible. But Ive never been comfortable just punching a clock and taking a pay cheque, being a mindless cog at a big company. So to each his own...

<comment><USER32> I don't see his comment as doing the bare minimum. More like being in no man's land. If the extra effort and time cannot lead to greater rewards or will go largely unnoticed why do it? Otherwise you're risking resentment and burnout. Some people can increase their output linearly (or better) by putting in more time and some of those people are positioned to benefit from that increased output. The rest (and the company) would probably benefit from a different approach. I often wonder when management theory will start exploring this issue. As something of a workaholic I had to teach myself moderation.

</comment></comment></comment></comment><comment><USER33> Memory: you forget the bad parts

</comment><comment><USER34> From this story I take away:

\- A Sr. Marketing staff member saw technical deficiencies in the project and pulled a _complete 180°_ literally days before showtime in front of a huge client, successfully.

\- Jobs pushed his workers hard.. though the ends justify the means

\- The NeXT computer pioneered nearly everything we take for granted today (mouse, networking, Objective C) in a package targeted at the high end consumer. Sound familiar?

Brilliant.

[edit: clarify meaning]

<comment><USER35> I don't think anyone takes for granted Objective C today. It's not used but for legacy code. Awful thing anyway.

<comment><USER22> Hardly awful. It was message dispatch object oriented programming. It allowed development of what was essentially the Mac OS X operating system and applications, in the early 1990s. Software that ran on a 25Mhz Motorola 68040. Years before Windows 95, and far more advanced and cohesive and productive than any other desktop computing platform. HTTP and web browsing was invented on a NeXT computer.</comment></comment></comment>


Galois Field in Cryptography (2012) [pdf] - <AUTHOR> https://sites.math.washington.edu/~morrow/336_12/papers/juan.pdf <comment><USER2> I'm taking a class in coding theory right now, and I've been surprised by how naturally it can be described using abstract algebra. There are also many deep relationships to important results in group theory. For example, the automorphism group of the binary Golay code (which was used during the Voyager missions to transmit pictures back to earth) is the Mathieu group M24, one of the sporadic groups from the classification of finite simple groups!

[https://en.wikipedia.org/wiki/Binary_Golay_code](https://en.wikipedia.org/wiki/Binary_Golay_code)

</comment><comment><USER3> Best part is Evariste Galois did all his field theory before he died at 20.. puts all other teenage mathematicians to shame.

<comment><USER4> I'm in my second semester of abstract algebra, and my professor has mentioned a few times that there should really be a movie made about Galois. "It's like if Good Will Hunting was real, except better in every way, and instead of a love story it's full blown Vive la France."

</comment></comment><comment><USER5> Good that this is more on the practical side, i.e. talking about bits and bytes instead of just abstract numerical theory. It really helps when learning this stuff --- a while ago I was reading about Reed-Solomon (which also uses GF) and I could find plenty of theoretical material, but there was a noticeable shortage of practical implementation-oriented detail.

<comment><USER6> Oh just be careful one of the early seminal "how to implement" papers has an incorrect description of the vandermonde matrix which results in not being able to guarantee matrix inversions. Be sure to check the errata for older papers.

If you want a good "halfway between theory and practice" experience, I suggest implementing gf256 in Julia. That is, create the datatype and define +, -, *, /. (Along the way g^n and log_g might be helpful too). For Julia > 0.6.2 the builtin lu factorization operator is general enough that once you've definitely the basic 4 operations (and zero(gf256) and one(gf256)) you can call the matrix solve operation \ on your datatype and immediately recover your erasures without having to go through tedious coding of an elimination routine.

</comment></comment><comment><USER7> it's a shame Galois Fields are basically completely/thoroughly patented for communications network use.

<comment><USER8> I was under the impression that mathematics cannot be patented.

A case of proprietary protocols? (Like MPEG?)

<comment><USER7> mathematics itself can't be patented, sure. but it seems their specific application can be -- see: [https://datatracker.ietf.org/meeting/92/materials/slides-92-...](https://datatracker.ietf.org/meeting/92/materials/slides-92-nwcrg-3/)

galois fields are very interesting for random linear network coding, so of course there is a very thorough patent group (recently sold off, I believe) around it.

given the seriously transformative effects it can have on communications networks -- especially wireless -- I'm both saddened and unsurprised it's in basically nothing as of yet. because it's patented to Hell & Back.

</comment></comment></comment><comment><USER9> I'm taking a class in abstract algebra as part of my graduate degree in math and I'm constantly finding parallels in the way we code and represent programs and data structures. Seeing the abstract theory in practical use like this is always fascinating.</comment>


Heartbleed - <AUTHOR> https://www.schneier.com/blog/archives/2014/04/heartbleed.html <comment><USER3> One of the things I'm taking from this episode is just how worthless a lot of prognostication about security by a load of "experts" on the internet is, especially of the "trust us to get it right" variety.

Frankly, their whining about how hard crypto is is partly responsible for the monoculture we have. Yes, it's difficult (more so in protocol than implementation), but they are so offputting to new people coming into the field it is insane.

Clearly OpenSSL dev is broken, at least partly because everyone assumes everyone else is auditing all 300k lines of it, but also I can't help wondering if this calls for stronger component isolation within cryptosystems. For example, protocol implementation, encoding and decoding seem like they should all be totally isolated, so a disaster like this doesn't mean you could be leaking information from the rest of the system. I imagine many a HSM vendor has been quite pleased by this news.

<comment><USER4> This is (I hope) a once-in-a-lifetime incident, so we have to be careful not to extrapolate it too hard. On the other hand, it's _seriously big deal_. Overall, it seems to strongly challenge a couple of important assumptions.

As you say, it's a strong challenge to the mantra of "never implement your own crypto". I think ( _think_ ) it still holds for the crypto primitives. If you're reimplementing AES you're probably doing it wrong. But the protocols? I'm not so sure now. Common wisdom seemed to be that if you implement the protocols yourself you'd screw them up, and you should stick with tried-and- true existing implementations. Now it's apparent that "tried" doesn't have to imply "true". Something being used by millions of people for years doesn't prevent it from having a huge vulnerability for years. Are your odds better or worse rolling your own? I'm not so sure now.

Consider Apple's "goto fail" bug, for example. Among a lot of other stuff, they caught some criticism for reimplementing TLS instead of just using OpenSSL. Well, if they had used OpenSSL instead, it turns out that they would have been shipping an even more serious bug for even more time.

It's also interesting to me how it challenges the idea of encrypting stuff by default. For years, people have been saying that as much traffic as possible should be encrypted, even unimportant stuff that nobody cares about. By doing that, the idea goes, using encryption isn't suspicious and you force attackers to spread out their resources. If only a small amount of traffic is encrypted, attackers can focus just on that traffic. Accordingly, a lot of sites that didn't really need it enabled SSL or even required it, including my own. By doing this, a lot of them inadvertently made things much much _worse_. A site that's only accessible over HTTP is much better off than a site that's accessible over HTTPS but vulnerable to heartbleed. I don't think the general idea is _wrong_ , but it certainly gives me pause, and I think more consideration has to be given to the increase in attack surface you take on when you enable encryption.

In any case, I really hope we see some new crypto projects come out of this, or more resources put into existing OpenSSL alternatives.

<comment><USER5> > This is (I hope) a once-in-a-lifetime incident, so we have to be careful not > to extrapolate it too hard.

Don't bet on it.

<comment><USER4> Yeah, my inner pessimist says that's a stupid thing to say. On the other hand, when was the last time something _this_ bad and widespread showed up?

<comment><USER6> Let's surmise that the reason two distinct researchers (Mehta and Codenomicon) found this same bug in a short timeframe is that the recent Apple & GnuTLS bugs have caused many teams to begin a fresh review of long-ignored shared codebases.

If so, is this the _first_ major bug discovered, with many more to come as they are flushed out by the new level of vigilance? Or, is it the only/last one, being revealed now because the deep dive has now wrapped up?

Those seem to me to be the interesting questions.

</comment></comment></comment></comment></comment><comment><USER7> _" Catastrophic" is the right word. On the scale of 1 to 10, this is an 11._

No, it's not. If you asked me — I was a CISO not many years ago — I'd call this an 8. Schneier means well, but he has a tendency to exaggerate. (Here is an example of him suggesting that SOAP and other web services never be used because they "sneak" through HTTP and are therefore inherently insecure: [https://www.schneier.com/crypto- gram-0006.html#SOAP](https://www.schneier.com/crypto-gram-0006.html#SOAP))

A 10 would be a case where a bug was not easily patched, and gave complete control of servers to any interested script kiddie. Thousands or millions of web users would have had enough information for credit card and identity theft to be acted on before the hole could be plugged.

This is not that case. And it's certainly not an "11". Most vital websites have either already been patched or are about to be.

We can now keep calm and carry on.

<comment><USER8> I'm going to have to go ahead and sort of disagree with you. A security library, specifically doing crypto, that is installed/embedded/used _everywhere_ that trivially leaks plaintext data remotely to _anyone who comes knocking_ (including passwords, keys, CC numbers, etc) is a compete failure.

Sure, it could hand out shells into a remote system, or hell it could launch a bunch of nuclear rockets as well...that would be very bad. But you seem to miss the point that perhaps someone's password to their shell (or maybe a nuclear launch code) _is_ going over the wire and is intercepted...by a hostile government agency, or a 13 year old playing with a python script. There are endless, devastating scenarios one can think up caused by such a critical bug in the very fabric of the secure communication of the internet.

This is a pretty big deal.

<comment><USER9> You're right - but I think a rating of 11 should indeed be reserved for a bug that does launch nuclear rockets while handing out root shells.

</comment></comment></comment><comment><USER10> Eh, I remember how about a month ago when that recent GnuTLS bug was found the almost dominant sentiment on HN was along the lines of "how come anyone is using GnuTLS instead of OpenSSL", "GnuTLS codebase is horrible, use OpenSSL", "the guy maintaining GnuTLS is an idiot, use OpenSSL", "OpenSSL has more expert eyes on it", etc. Although I prefer OpenSSL (for no particular reason), this all seemed so obviously stupid and shortsighted, not to mention some of it factually wrong. And what do you know, a month later we get an order of magnitude worse bug in OpenSSL which was also probably an order of magnitude easier to detect. I made a comment[0] then along that line, thinking to myself that I'd really hate if I got to say "told you so" but that unfortunately I probably will get the chance. I didn't think it would be this bad though.

[0] [https://news.ycombinator.com/item?id=7346879](https://news.ycombinator.com/item?id=7346879)

</comment><comment><USER11> Even if we generate a new key pair and replace our certificate, aren't we still vulnerable to MIM attacks if someone had downloaded the old private key and use the old certificate?

<comment><USER12> That's why it's so vital for everyone to implement Perfect Forward Secrecy. Yes, it's a little late for that now in regards to this bug, but who knows what others bugs like this will be discovered in the future. Let's at least not make the same mistake twice, by not taking advantage of PFS, which could've prevented most of the damage from Heartbleed.

<comment><USER13> As much as I'm a fan of Perfect Forward Secrecy, it does not protect you against MITM with old certificates.

</comment></comment></comment><comment><USER14> Also see this explanation from Troy Hunt, which hasn't made the front page. [https://news.ycombinator.com/item?id=7558597](https://news.ycombinator.com/item?id=7558597)

<comment><USER15> TL, DR:

Troy Hunt: "The Heartbleed bug itself was introduced in December 2011, in fact it appears to have been committed about an hour before New Year's Eve (read into that what you will). The bug affects OpenSSL version 1.0.1 which was released in March 2012 through to 1.0.1f which hit on Jan 6 of this year. The unfortunate thing about this timing is that _you're only vulnerable if you've been doing "the right thing" and keeping your versions up to date!_ Then again, for those that believe you need to give new releases a little while to get the bugs out before adopting them, would they really have expected it to take more than two years? Probably not."

<comment><USER16> Debian squeeze (oldstable) is not vulnerable, because it's still running 0.9.8o-4squeeze14.

0.9.8o was released 2010-06-01, almost 4 years ago!

<comment><USER17> [http://patch- tracker.debian.org/package/openssl/0.9.8o-4sque...](http://patch- tracker.debian.org/package/openssl/0.9.8o-4squeeze14)

It's had a _lot_ of security fixes backported to it in the four years since the upstream release.

</comment></comment></comment></comment><comment><USER18> There is virtually no useful software vulnerability for which you can't conjure up a compelling-sounding narrative of deliberate introduction (or "bugdoor"). It's like numerology. So you should be wary of people insinuating about bugs.

What makes Dual_EC so compelling to experts is the "Nobody but us" nature of the flaw: the bug is cryptographically limited to a small number of actors. FedGov buys hundreds of millions of dollars of COTS gear with OpenSSL embedded, and this bug is so simple that middle-schoolers are exploiting it. You shouldn't even need to ask if it was deliberate.

</comment><comment><USER19>
                                 Schneier.com Has Moved

       As of March 3rd, Schneier.com has moved to a new server. If you've used a
       hosts file to map www.schneier.com to a fixed IP address, you'll need to
       either update the IP to 18.104.22.168, or remove the line. Otherwise,
       either your software or your name server is hanging on to old DNS
       information much longer than it should.

Ok, how should I "authenticate" that the site at the new address is the "real" one?

I know, I'll use OpenSSL and HTTPS!

</comment><comment><USER20> More on the vulnerability from cryptographer Matthew Green:

[http://blog.cryptographyengineering.com/2014/04/attack-of- we...](http://blog.cryptographyengineering.com/2014/04/attack-of-week-openssl- heartbleed.html)

<comment><USER21> I am curious about which static code analysis tools pick up this problem. Could it have been found automatically by Coverity, for example?

<comment><USER22> We tested most of the major ones at work on the faulty code, and only PC-Lint caught the issue.

<comment><USER21> Wow -- that's scary.

</comment></comment></comment></comment><comment><USER23> Forgive my naivety here, but is there any way to tell which sites over the last 2 years I/we have used that may require new passwords, and whether they've been fixed?

I'm kinda looking at a site that lists the major sites (Banks, Socials, Shops, etc) that shows a status on whether you're fine / should change password / await fix before change password)

<comment><USER24> Yes. All of them.

Seriously, it's easier to just change all of your passwords than to hunt down a list (that will be incomplete and give you a false sense of security), cross-match against servers you might have an account on, then change their passwords.

Just change them all and be done with it.

The "whether they've been fixed" part is a little tougher, because that lets you know when you should change your password. General sentiment I've been seeing is give it a week for everybody to fix their stuff (even this might be a little long) and then change your passwords. If a given site says either "we weren't affected, here's why" or "we've patched our stuff, we're all good" then you should change your password on that site ASAP.

<comment><USER25> When would be the optimal time to perform these password changes? I am assuming that not every affected site has been patched yet, and it would be pointless to change the password, and log in, before they have fixed the problem.

<comment><USER26> Use one of the testers to check if the website is currently vulnerable.

<comment><USER27> And then use your browser's certificate inspector to check the issue date of the certificate. If it's earlier than April 7, 2014, it's still insecure.

<comment><USER26> Only if they were impacted by the bug.

It's rather unreasonable to expect sites that know they were not impacted will update their certificate. So unless you want to write off your bank's website for the next year or three until the date expires & they renew it then, (banks seem to have avoided this- suddenly dawdling behind the bleeding edge doesn't look so bad!) scorched-earth policies are a bit much.

Actually I might even say the opposite; if the site is secure and the certificate is older than 4/7/2014, that suggests the site was not impacted. If the certificate is newer than 4/7/2014, that pretty much guarantees the site was impacted. It is possible the site patched openssl and did not renew the cert, but in general people are not going to do one without the other.

</comment></comment></comment></comment></comment></comment><comment><USER28> On the XKCD [0] you can find a spoof of the Tears in rain soliloquy. I never imagined it was rewritten on the night before shooting by Rutger Hauer.

[0] [https://xkcd.com/1353/](https://xkcd.com/1353/)

[1] [https://en.wikipedia.org/wiki/Tears_in_rain_soliloquy](https://en.wikipedia.org/wiki/Tears_in_rain_soliloquy)

</comment><comment><USER29> "At this point, the odds are close to one that every target has had its private keys extracted by multiple intelligence agencies" Any proof of this?

<comment><USER30> It's bullshit.

I'm 100% positive that many targets have had their keys extracted, but it's hard-to-impossible for the attacker to choose what fragment of memory the server returns, and it depends heavily on the server in question. What works against nginx won't work against lighttpd or apache.

I hit a site I control repeatedly yesterday and couldn't even get any common byte-arrays in common across hundreds of connections.

Of course, as good practice, all organizations should treat their keys as compromised and issue new ones.

Also, his "it leaves no trace" is a problem. It's trivial to recognize the traffic pattern.

</comment></comment><comment><USER31> And that's why every single login system should have two-factor auth - <USER2> started using google's authenticator app for my google and github account and it works just great. I wish I could use it for every account I have.

<comment><USER32> SSL is not login.

<comment><USER31> Sorry, I didn't mean to say that TFA was the solution, but I think login info leak is one of the consequences of heartbleed, right? So my point was just, at least with TFA, the risk of having your accounts stolen is reduced.

</comment></comment></comment><comment><USER33> Just a question (and I don't know too much about this). Is there any chance that certificate authorities who give out warranties could actually have to pay out on them now? Do any of them use OpenSSL?

<comment><USER30> Without looking at the specifics, the CA can't be held responsible for you leaking the key yourself.

Or do you mean if the CA companies _themselves_ were compromised? That's a big separate issue. Even if the web process is the one that generates the keys (I'm skeptical, but it's possible), any keys made that way would quickly be moved out memory, unless they were made that day.

</comment></comment><comment><USER34> Is there really a point in changing keys and passwords? It seems to me that if an attacker got the passwords, I should assume they already installed a root kit on my server?

I'm honestly not sure how to react. I'm not really a sysadmin, but I have a server online.

I suppose I could start a new server, but how can I be sure that the provider has already patched all their holes? If they've been hacked, maybe the images they use for preparing new servers have been compromised, too? Might be better to wait a little before restarting everything from scratch?

</comment><comment><USER35> Request for clarification from those who understand the bug's workings:

The memory it can expose is limited to that visible to the process using openssl, right? Or does the bug reside low enough in the kernal stack to disregard memory protections?

<comment><USER36> > The memory it can expose is limited to that visible to the process using > openssl, right

Yes. Only that process.

</comment></comment><comment><USER37> One question - this keeps talking about attackers being able to "read all of memory." Does anyone know whether that's limited to the process that is running OpenSSL code?

</comment><comment><USER38> So if I have a site that doesn't use SSL, am I still affected? I'm still trying to make sense of all of this.

<comment><USER39> No, if you're not using OpenSSL your site will not be vulnerable to an OpenSSL bug.

But if your site transmits or receives anything that a third party shouldn't see (hint: it probably does), you should start using SSL.

<comment><USER40> I would rather say...

If you're not using SSL right now, there's no rush to upgrade, but do it anyway while this is in the forefront because when you do use SSL one day on your server, you might forget that you had this old version of OpenSSL.

<comment><USER4> And there may be other things besides web servers using OpenSSL that you didn't think of or aren't aware of.

For example, I believe that using curl to fetch an https URL leaves you open to this vulnerability if you connect to a malicious server. The odds of the server being bad and the odds of curl containing anything of value are low, but it still counts for something.

</comment></comment></comment></comment><comment><USER41> At this point it's safer to say that an intelligence agency is responsible than that they aren't responsible. This is precisely what Schneier, Greenwald, et al. mean when they say that the NSA tactics degrade the security of the overall internet architecture. It's incredibly dangerous.

<comment><USER42> How can you make such a claim? Do you have any proof that they were involved with this specific bug?

I get that the NSA is after us but when you consider that the bug is of the exact same class as _a bug every C programmer has ever made in their career_ , it seems probable that it could have happened on accident. Where do you see the malicious intent?

<comment><USER43> If the NSA is all knowing as everybody seems to think, why aren't all criminals in jail by now?

<comment><USER44> Because they're not the police. And the jails are already full.

<comment><USER4> Also the criminal justice system doesn't accommodate evidence obtained through the NSA's methods.

<comment><USER37> Until they lie about how they got it.

[http://en.wikipedia.org/wiki/Parallel_construction](http://en.wikipedia.org/wiki/Parallel_construction)

<comment><USER4> Even then, that's way too much effort to go through to convict a car thief or other similarly small stuff.

<comment><USER37> Unless there's some other reason they want to nail that car thief, probably, yeah.

<comment><USER4> That's an interesting thought. Some terrorist is in the US and planning something, but they don't want to give away their intel. So do a bit of parallel construction and tip off the local cops to some relatively small crime he's committed in the course of everything....

Or substitute "whistleblower" or "inconvenient politician" for "terrorist" if you prefer.

<comment><USER37> Or even "ex-" or "rival".

<comment><USER43> Oh wow thanks HN, being down voted to oblivion for asking a question, nice one thanks!

<comment><USER37> I didn't downvote you, but I expect those who did aren't reading it as "a question" as in "a request for information" \- which I would think should rarely be downvoted - but as "a rhetorical question" whose purpose was to serve as a point of argument. Interpreted that way it seems to be attacking a strawman, poorly - such a comment would be deservedly downvoted.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER45> Why is his server still vulnerable?

<comment><USER46> He's running on a Windows box?[IIS]

<comment><USER47> IIS doesn't use OpenSSL though; it uses CredSSP [http://technet.microsoft.com/en- us/library/cc755284(WS.10).a...](http://technet.microsoft.com/en- us/library/cc755284\(WS.10\).aspx).

<comment><USER46> I had no idea about IIS using a different implementation.

The More You Know...

</comment></comment></comment></comment><comment><USER48> Interesting point for me is that those who serve over HTTP only are not vulnerable, which I think is a good case study in the risk of complexity. A lot of security experts have been calling for HTTPS everywhere, on the basis that it is low cost. Clearly there is a cost to the extra complexity, and in this case a bug in the security layer that results in a worse situation than if there had been no security layer at all.

<comment><USER49> > Interesting point for me is that those who serve over HTTP only are not > vulnerable

...yes they are. You don't even _need_ remote private key disclosure to MITM an http-only server. The way HTTP digest is written means you either store all passwords in a retrievable form or drop down to basic auth where anyone capable of base64 decoding can read all passwords.

This situation is _by no means_ worse than if everyone had just used plain HTTP.

<comment><USER50> It is worse than plain HTTP, actually. Heartblead allows an attacker anywhere on the internet to read out memory from your server. This is worse than plain HTTP in two ways:

\- With plain HTTP, the attacker would have to be in a MITM position to intercept traffic. With Heartblead, he can read traffic he wouldn't normally have access to from the server's memory.

\- There may be secrets in memory that would never even be sent over the network that are now accessible. For example, if running a web app in the same process doing SSL termination, private keys such as Django's SECRET_KEY may be available. Under certain situations, knowledge of the SECRET_KEY can effect remote code execution.

In short, Heartbleed gives the entire world the ability to read memory from your server. This is much worse than an HTTP MITM.</comment></comment></comment>


After Journalist's Alleged Murder, Tech Execs Distance Themselves from Saudis - <AUTHOR> https://www.buzzfeednews.com/amphtml/ryanmac/silicon-valley-leaders-disassociate-saudi-arabia-board-neom <comment><USER2> It was sad to watch so many "intellectual elites" fawn over MBS' "reforms". Wow women can drive and go to football games. Wow folks can watch Black Panther at the movies. All the while the Saudi government is bombing the hell of out kids in Yemen with bombs that have the US flag painted on em. Hopefully this will be the beginning of a thorough re-evaluation of our relationship with KSA but I highly doubt it.

<comment><USER3> I was also suspicious of MBS' 'anti-corruption' drive last year. There is no doubt that there's corruption among the rich and powerful but a sudden purge seemed more like a power consolidation move [https://en.wikipedia.org/wiki/2017_Saudi_Arabian_purge](https://en.wikipedia.org/wiki/2017_Saudi_Arabian_purge)

<comment><USER4> That's smart for him to do. If you want absolute power you need to scare the crap out of the competitors(1). Remember, the way he got power is new, and could be there for 50 years. Lots of super rich, but unhappy cousins and uncles. No doubt the Marriot family meeting will happen again and again.

(1)...of course after you've made sure no coup d'etat happens in response.

He's consolidating power but if recordings come out on how the journo was murdered, this guy will no longer meet Bill Gates or Bezos in his next US trip. He'll be treated like mad African dictators were.

</comment></comment></comment><comment><USER5> Saudi Arabia also indefinitely detains womens' rights activists:

[https://www.cbc.ca/news/canada/british-columbia/saudi- arabia...](https://www.cbc.ca/news/canada/british-columbia/saudi-arabia-death- penalty-ubc-graduate-1.4797113)

[https://www.google.com/search?client=ubuntu&channel=fs&q=lou...](https://www.google.com/search?client=ubuntu&channel=fs&q=loujain+al- hathloul&ie=utf-8&oe=utf-8)

They pay lip service to modernization and liberalization (like the legal change allowing women to drive), but in actuality it's one step forward, two steps back.

There is extensive documentation on the fact the Saudi Arabia and other states in the region fund fundamentalist, Hanafi / Wahabbist madrassas in Pakistan. Where do all the Pakistani jihadis fighting in Afghanistan come from? It's been known by intelligence agencies for _years_.

[https://www.google.com/search?client=ubuntu&channel=fs&q=sau...](https://www.google.com/search?client=ubuntu&channel=fs&q=saudi+arabia+funding+madrassas+pakistan&ie=utf-8&oe=utf-8)

<comment><USER6> There is a certain, big attack on US soil that is also known to be the work of certain people

<comment><USER7> _MbS: First of all, this Wahhabism—please define it for us. We're not familiar with it. We don't know about it.

Goldberg: What do you mean you don't know about it?

MbS: What is Wahhabism?

Goldberg: You're the crown prince of Saudi Arabia. You know what Wahhabism is.

MbS: No one can define this Wahhabism.

Goldberg: It's a movement founded by Ibn abd al-Wahhab in the 1700s, very fundamentalist in nature, an austere Salafist-style interpretation—

MbS: No one can define Wahhabism. There is no Wahhabism._

[https://www.theatlantic.com/international/archive/2018/04/mo...](https://www.theatlantic.com/international/archive/2018/04/mohammed- bin-salman-iran-israel/557036/)

<comment><USER5> I bet his intentional ignorance would have been just as forceful if the interviewer had asked him if he knew who Sayyid Qutb was, and the history of his association with certain wealthy saudis.

[https://en.wikipedia.org/wiki/Sayyid_Qutb](https://en.wikipedia.org/wiki/Sayyid_Qutb)

</comment></comment></comment></comment><comment><USER8> So the Saudis can be responsible for the worst cholera epidemic in history and the direct killing of thousands of civilians in Yemen, but killing one journalist is suddenly a bridge too far?

<comment><USER9> That's the way the world is. People only seem to sit up and take notice of terrible things on occasion. The answer isn't to be critical of them taking notice now, but to use it to make them aware of the other terrible things the same group is also doing.

<comment><USER10> they were aware. these are smart people. they don't live under a rock.

</comment></comment></comment><comment><USER11> $45 billion (soon to be 90) in Saudi money sloshing around in SV via SoftBank. Everyone is complicit.

<comment><USER12> Seize it and distribute to the 9/11 survivors, first responders, and troops who served subsequently in Afghanistan.

<comment><USER13> Do that and foreign investment in the US would collapse.

Very tangible difference between an asset _FREEZE_ , and an asset _SEIZURE_. And it's a difference wealth prez guys take deadly seriously.

<comment><USER14> Perhaps it's good that blood money isn't used to invest in the US.

</comment></comment></comment></comment><comment><USER15> > Just got word that Y Combinator's Sam Altman is suspending his involvement > with the board of Neom. His statement: "This is well out of my expertise, so > I don't plan to comment on the case until the investigation is finished."

[https://twitter.com/RMac18/status/1050541832126455809](https://twitter.com/RMac18/status/1050541832126455809)

<comment><USER16> On the one hand I really try to be mindful of the concerns someone like Altman faces that I don't, but then on the other hand I don't understand how anyone with any conscience, integrity and basic knowledge of history/politics would be able to have anything to do with the Saudi government.

Furthermore, if something is 'out of your expertise', why get into this situation in the first place? "ich habe es nicht gewusst" should at least not be valid approach/defense anymore.

</comment></comment><comment><USER17> It is deeply uncomfortable working in the tech industry knowing how much Saudi money has been sunk into VC funds and VC-back tech cos (some of which I've worked for).

<comment><USER5> If that makes you uncomfortable, research how much Saudi money was already invested into US real estate and major financial companies when 9/11 happened. The deal since the post WW2 era has basically been:

a) US and UK provide military equipment and military power to guarantee the security of the house of Saud. (Example: US reaction to the Iraqi invasion of Kuwait, operation desert shield/desert storm).

b) Saudi government and ARAMCO extract a shitload of oil and sell it, while using technical services of US and UK oil companies

c) Saudi government re-invests a certain huge amount of the proceeds from their post-1940s oil wealth into the US and UK economies.

<comment><USER17> Sure, it's just much more tangible when you actively _choose_ to work for a VC-backed tech co that has accepted Saudi money, especially coming off the news that Saudis are funding a large percentage of Softbank's newest fund.

</comment></comment></comment><comment><USER18> > some of Neom's advisory board members, including ... [Sam] Altman, who sat > down with the prince in April, declined to comment on their involvement

I hope he comments relatively soon (I'm not criticizing him for not commenting in time for this article). His leadership has a large influence on many, including in this forum. Tacit opposition and tacit support are the same thing.

<comment><USER19> [https://www.nbcnews.com/news/amp/ncna919331](https://www.nbcnews.com/news/amp/ncna919331)

Sam Altman, the president of Y Combinator, a startup incubator that has nurtured Airbnb and other well-known companies, suspended his involvement advising Saudi Arabia on a mega-city project there known as NEOM.

</comment></comment><comment><USER20> I cannot help but think that before this century ends (possibly even as early as 2050?), the KSA will have been reduced to that from which they came (before oil) i.e. not much. They will wield virtually no geopolitical influence. Within another hundred years, they will be a historical footnote.

<comment><USER21> They have significant geopolitical power. The entire Sunni realm is essentially under their rule. They blockaded Qatar and every Sunni nation followed suit. They don't have nukes but technically can call on Pakistan for their nukes anytime they want. The avg Saudi lives like an upper class westerner and by upper class I don't mean upper middle class like the majority of us tech guys. The poor in KSA are all foreign workers, the Saudis barely work at all and are rich with servants and cushy govt jobs.

They have the most influence in OPEC and they are now diversifying. KSA is invested all over SV. Uber, Tesla, Snapchat, biotech firms, SoftBank. Probably only 2nd to Russian oligarchs in terms of SV money. A bunch of princes are multibillionaires exclusively from American and British assets.

<comment><USER20> True, but the excess of their riches is matched only by the profligacy of their spending and protected by the USA. Once the oil is gone or irrelevant they lose the protection of America, and become merely a bunch of rich oligarchs. Some will manage it well, most wont.

EDIT: Forgot to add that their geopolitical power doesn't come from their money but from their control of a global resource. If the unfortunate deaths of various Russian expat oligarchs has proven anything, it's that no amount of money can buy you protection from a tier-1 state that wants you dead.

</comment></comment></comment><comment><USER22> We've needed to for awhile, for a lot of reasons; from 911 passports to weapons proliferation.

</comment><comment><USER23> Saudi PIF has a large stake in SoftBank. SoftBank has large stakes in a wide range of unicorns in the US and globally.

[https://www.google.com/amp/s/www.wsj.com/amp/articles/softba...](https://www.google.com/amp/s/www.wsj.com/amp/articles/softbank- group-launches-investment-fund-1476398189)

[http://www.arabnews.com/node/1324941/business- economy](http://www.arabnews.com/node/1324941/business-economy)

</comment><comment><USER24> Well, we can rest safe and assured that our human rights are assiduously guarded by Saudi Arabia as the chair of the UN human rights commission. You have the _right_ to be beheaded - chop! chop!

</comment><comment><USER25> Saudi Arabia introduce some progressive reforms like women being able to vote, companies feel like the coast is clear for business, Saudi Arabia does something terrible, companies shy away.

Reforming a country takes a long time, especially an absolute monarchy where the government owns the means of producing by far the most wealth in the country. So, my question is; if Western businesses keep doing this, is Saudi Arabia going to take two steps forward and one step back, inching their way towards progress, or just one step forward one step back staying in place?

</comment><comment><USER26> the problem is most of of US citizens judge Saudi Arabia without knowing what is really going on, adopting an opinion based on what they see on the news - which is in English -

I laugh when I see some of the comments, especially from seemingly intellectual people.

<comment><USER27> As someone with relatives who live and work in the KSA as expats, the perception that Americans and the world has about KSA is pretty much on point. It's a country ruled by a brutal kleptocractic family, which uses a particularly ultra conservative strain of Islam (Wahabisim) to keep themselves and their elite cronies in power.</comment></comment>


How Facebook handles account deletions - <AUTHOR> https://pageflows.com/blog/delete-facebook/ <comment><USER3> That is exactly the process I went through a few years ago and the manipulative messaging assured me that I was making the correct decision to get as far away from FB as possible.

Dr. Robert B. Cialdini, closed off Influence, The Psychology of Persuasion with the following paragraph about organizations that manipulate us and I completely believe Facebook is one of these organizations:

"I don't consider myself pugnacious by nature, but I actively advocate such belligerent actions because in a way I am at war with the exploiters—we all are. It is important to recognize, however, that their motive for profit is not the cause for hostilities; that motive, after all, is something we each share to an extent. The real treachery, and the thing we cannot tolerate, is any attempt to make their profit in a way that threatens the reliability of our shortcuts. The blitz of modern daily life demands that we have faithful shortcuts, sound rules of thumb to handle it all. These are not luxuries any longer; they are out-and-out necessities that figure to become increasingly vital as the pulse of daily life quickens. That is why we should want to retaliate whenever we see someone betraying one of our rules of thumb for profit. We want that rule to be as effective as possible. But to the degree that its fitness for duty is regularly undercut by the tricks of a profiteer, we naturally will use it less and will be less able to cope efficiently with the decisional burdens of our day. We cannot allow that without a fight. The stakes have gotten too high."

<comment><USER4> Thank you for that quote. The book has been high on my to-read list for a while now and this is a good motivation get started on it.

<comment><USER5> I think I gifted that book to at least a dozen people by now, it's an absolute must read. I still paraphrase stories from it regularly.

</comment></comment></comment><comment><USER6> > "Your friends will miss you!"

The company seems to have a strong culture of gaslighting and manipulating users. When I saw that screen, there were people there that definitely wouldn't miss me and who would probably be appalled that their identities were being used in that way.

When other people quit Facebook, it's likely that your photo is being presented to other users (who you may not really know) telling them that you will miss them. It's terrible.

<comment><USER7> I deleted Instagram 6 months ago. I recently came into contact with somebody in person, and they told me that they were aware I was deleting social media because Instagram told them to re-invite me back to the platform. It was this moment that I realized you're never truly out of the system. What is the point of me deleting my Instagram if I am still showing up on people's application?

<comment><USER6> It's a form of gaslighting. They are manipulating each of your realities in unethical ways.

<comment><USER8> It is the fear of missing out, not gaslighting.

"Gaslighting is a form of manipulation that seeks to sow seeds of doubt in a targeted individual or in members of a targeted group, hoping to make them question their own memory, perception, and sanity."

"Fear of missing out is a pervasive apprehension that others might be having rewarding experiences from which one is absent"

-wiki

<comment><USER6> I'm not referring to the fear of missing out. I posted another comment about it in this thread.

<comment><USER8> Do you mean coercive persuasion?

<comment><USER6> I'm not sure if that's exactly it. It isn't quite coercion. Facebook's tone and methods of communication often seem more like a manipulative but charming narcissist who is insidiously trying to rearrange your reality. You think you quit the site and suddenly they are back at your front door edging even deeper into your life than before, using every manipulative trick possible. Maybe there needs to be a new term for it.

I wrote other thoughts here:

[https://news.ycombinator.com/item?id=16664199](https://news.ycombinator.com/item?id=16664199)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> My experience of deleting my Facebook account back in 2009 (and reading this the process hasn't changed) is once I finally deleted it, it was stolen by someone else within a few weeks (I'm guessing automated / bots trying to steal identities). I have a very unique name which, as far as I'm aware, is the only one in the world. What caused me to notice was friends still on Facebook who were getting this fake profile recommended as a possible connection.

Facebook ignored requests I made (submitted without having an account) that the profile was fake. I also had friends report the account for me but it still exists today - this is the fake account [https://m.facebook.com/harry.fuecks](https://m.facebook.com/harry.fuecks) \- thats not my picture.

So beware - it may be more pragmatic just to deactivate your account than delete. That means Facebook gets to keep your data but at least you don't risk identify theft.

Ultimately think it's going to take regulation to solve this problem in general - it's not in Facebooks interest to make account deletion painless.

<comment><USER10> I think there is a browser plugin to recursively delete all your info - <USER2> leave account as inactive

<comment><USER11> What's the plugin's name?

<comment><USER12> Social Book Post Manager

</comment></comment></comment></comment><comment><USER13> Fun fact I experienced: if you get banned for anything, there is absolutely no way to delete your account.

(It was a test account at a time I didn't even have a personal account yet. I uploaded very mild nudity¹ as a profile pic and had a friend flag me on purpose)

¹ [http://www.liverpoolmuseums.org.uk/walker/collections/painti...](http://www.liverpoolmuseums.org.uk/walker/collections/paintings/20c/item-242744.aspx) (slightly NSFW)

<comment><USER14> Interesting, my account got disabled a few months ago and radio silence from them on why or what (appeals process seems a black hole).

In light of recent activities I'd like them to delete all data they have on me but since I'm not an EU citizen unfortunately I don't have the GDPR to force them to do so.

<comment><USER15> How are they to know you're not a EU citizen. Even if you weren't, you could be now.

</comment></comment></comment><comment><USER16> Biggest problem to me is if you are a login with facebook user (or were ages ago), which is highly likely since many websites pushed it hard at the time, some like spotify requiring it. If you log back into spotify while its still deleting, even to move your account to a regular spotify account, it permanently reactivates your facebook account. You have to do all the cleanup, app deletion, etc beforehand.

<comment><USER17> If you delete your facebook account and had your spotify account associated with facebook, now you cannot login into spotify anymore with your email account. It happened to me, it's a very stupid thing, and as it seems, they (spotify) can't or wont do anyting about it..

<comment><USER18> I deleted my fb account, and was able to recover my spotify account with the 'forgot password' mechanism.

<comment><USER19> > and was able to recover my spotify account with the 'forgot password' > mechanism

If you signed up for Spotify using Facebook, this doesn't work.

</comment></comment></comment></comment><comment><USER20> Facebook's offline archives never get deleted.

[http://www.geekculture.com/joyoftech/joyimages/1390.jpg](http://www.geekculture.com/joyoftech/joyimages/1390.jpg)

</comment><comment><USER21> Wow, I had no idea there a buried option like that to really delete it.

Several years ago I read an article about how savvy teenagers and college students were calling account deactivation "Super Logout", since it was well known that deactivation was non-binding and immediately reversible at any time. If you were going to be away from your phone or computer for anything more than a few hours you would Super Logout and not have to worry about potentially embarrassing wall posts, tagged photos, tagged comments, unwelcome messages, etc.. It was all about having full control of who interacts with your account and when. I thought it was quite brilliant and I totally get why you would want to do that in the fast-paced social world of a teenager. Ever since I read that I've always laughed at people saying "I'm going to delete my account", thinking they were really deleting it. (I bet no more than a fraction, if any, ever dug up the full deletion option.) People think they are "deleting" their account while kids are literally using "deletion" as an advanced feature of the platform.

</comment><comment><USER22> There's also no mention in the article about what Facebook does with all of the data you've surrendered to them while using the platform. Do they actually remove your history of likes and your node in the social graph?

I'm very doubtful they voluntarily delete your data.

<comment><USER23> They likely never delete _anything_. They simply transform you back into a "shadow profile" and keep monetizing everything they know, but conceal the data from you and the rest of the public.

I believe they always retain all data forever, as a trade secret. They don't need no stinking laws to do that.

This is a component of not requiring users to pay for premium service. When you "create an account" you're simply "activating/linking/merging" one of your shadow profiles to your IRL identity (or not-so-IRL personas), which (possibly) has always existed (long before you showed up), claiming it as yours, and publicly exposing whatever Facebook is willing to show you that they know about you/that persona/whoever.

<comment><USER24> > They likely never delete anything. They simply transform you back into a > "shadow profile" and keep monetizing everything they know, but conceal the > data from you and the rest of the public.

If they stick to those habits with European users post May 25, GDPR will mess them up pretty bad. It would require just one whistle blower to expose their wrongdoings.

<comment><USER25> European citizens/residents, we're all counting on you to do your part.

</comment></comment></comment></comment><comment><USER26> Always wondered if its worth trying to delete all your data before deleting your facebook- or if deleting both does the same thing. They're supposed to delete data in 30 days but in the 2012-2013 days people proved the links to content were still up and photos/etc were all up.

</comment><comment><USER27> Does anyone think these services actually _delete_ all of your data, or just use a "deleted" flag on the database, keeping all of your info making it look like you're "deleted" but not allowing you to use it any longer? My vote is the 2nd one.

</comment><comment><USER28> The mobile site makes this way, way, way easier. You literally just have to enter your password and the deed is done: [https://m.facebook.com/account/delete](https://m.facebook.com/account/delete)

I just reactivated my deactivated account to delete it.

<comment><USER29> Just tried it and it worked great.

</comment></comment><comment><USER30> How do I know if my account is deleted? I did it years ago but every few months I get a suspect email about, "looks like you're having trouble logging in. Let us help you get back on Facebook." Which makes me think it's not actually deleted.

</comment><comment><USER31> Even though this user says he couldn't find the link to delete your account, it is on two of his screen shots with the label "Request account deletion"

Edit: I guess the text above makes this link confusing. Go FB.

<comment><USER32> I think that link applies to what happens when you die, as all the text above it describes.

<comment><USER31> Yeah I think you might be correct - I don't have a FB account so I couldn't test it, but it was strange the author didn't mention this. at least. I guess I retract my note.

</comment></comment></comment><comment><USER33> Deletion can also be a little misleading.

I deleted (not deactivated) a Facebook account that I had from high school to sophomore year of college.

A year or two later I made a new one and didn't fill out anything except my name and didn't add any friends (yet). Almost immediately facebook started suggesting friends, groups, etc that existed on my deleted account.

tl;dr nothing is every really "deleted," just hidden

</comment><comment><USER34> This is pretty clever marketing by Page Flows. I made it all the way to the end before I realized I was being sold something.

<comment><USER35> Yeah. The authors don't want you to delete your facebook. They want you to share their article on your facebook (it's right there at the top of the page!).

The people/person who wrote the article seem desperate for you to _not_ follow the directions. They want you to go to Facebook and starting sharing and liking content right away. They just want your money.

</comment></comment><comment><USER36> I went so far as to edit all comments give blank, remove all likes and untag all images before deleting. This was years ago, but I'm glad others are seeing the same issues and reacting appropriately.

</comment><comment><USER37> Thanks for this post. I thought I deleted my Facebook four years ago only to read this and find out it still existed. IIRC back then it said something about deletion after a set period of inactivity.

</comment><comment><USER38> I would imagine if what happened to facebook happened to google, it would be 100 times worse. So when do we tackle google?

</comment><comment><USER39> I don't think Facebook is being ethical by making people wait to delete their account. Thought experiment:

Suppose John owns a room. John's room is occupied at full capacity, 24/7\. People mingle in the room, sometimes they trade with each other. Assume John is never present in the room at any time. John decides to install a camera and microphone in the room. John analyzes the data in order help increase the quantity of trades in the room, through which John makes a considerable commission. Later, someone asks him to delete the data he has on them. John says he will only delete the data after 90 days, and if the person takes a step in the room within 14 days, they will not have their data deleted.

Is John's behavior ethical?

<comment><USER40> So why are John's friends using the living room so frequently yet without having any contact with him? Maybe you find that question to be pedantic given the bigger picture you're ostensibly addressing. But trying to imagine the answers would make it obvious why your hypothetical situation doesn't really apply to reality.

For starters, your scenario involves a surveillance camera, but in the next sentence, you ask us to imagine that the friends haven't given any permission. Permission for what exactly?

<comment><USER39> > So why are John's friends using the living room so frequently yet without > having any contact with him?

Good question. I rent out a house with 100% capacity, and I haven't set foot in the house in the past year at all. It's managed remotely by me. There are living areas where people can hang out. This is also what John does.

> you ask us to imagine that the friends haven't given any permission. > Permission for what exactly?

I have edited that part out and made things more concise, thanks for catching that. John records his living room and uses the data in order to sell products to the people who happen to be there. Later, people found out and have politely asked him to delete any video and audio involving them.

Side note: I feel John's implementation isn't important here, so I've intentionally left it out. Perhaps he earns a profit by having buyers and sellers meet, serendipitously, in his living room. For example, he may learn that Alice is a laptop seller and Bob is a laptop buyer. Assume John can influence the traffic in his living room for the sake of the gedanken.

</comment></comment></comment><comment><USER41> I deleted Facebook before it was cool. They wouldn't stop sending me "Won't you please come back" emails until I made a formal complaint about the spam to the Australian Communications and Media Authority. No more emails.

I was on there just a few days ago to find out what my elderly aunts were up to. Crickets. They hadn't posted anything for three years.

</comment><comment><USER30> When I quit WoW years ago it was the same thing. "You're making the peon cry!"

</comment><comment><USER42> Thanks for the post!

I just deleted my FB account, and I am a little less of a product (today).

</comment><comment><USER43> This is just the beginning, next #deletegoogle</comment>


FBI agrees to unlock iPhone for Arkansas prosecutor - <AUTHOR> http://abcnews.go.com/US/wireStory/fbi-agrees-unlock-iphone-arkansas-teens-murder-case-38041135 <comment><USER2> How does the prosecution prove the plaintext came from defendants' devices? When DNA is used as evidence not only is there chain of custody rules for biological material, but the details of DNA extraction and comparison are openly documented. You don't just have someone claim something is a match, there's proof.

<comment><USER3> They might just be planning to use the information learned from this to assist in the prosecution without providing it as evidence? For example they could subpoena those involved in the imessage conversations or find other criminal leads?

<comment><USER4> Yes, that would be my take on it. The government can still make use of inadmissible or illegally obtained evidence. The evidence here was obtained legally, so it will likely be used to bolster the case against the defendants and anyone that may have assisted them.

Even in the case of illegally obtained evidence, there are techniques like parallel construction [1] that they can use to make their cases. They also have the so-called "clean hands" exception, which allows allows the government to introduce evidence into trial that was illegally obtained by a third party when the government did not play any role in obtaining that information [2].

The US legal system was designed to seem exceedingly fair on its surface, while allowing for unconscionable abuses by those skilled in maneuvering through its loopholes.

[1] [https://en.wikipedia.org/wiki/Parallel_construction](https://en.wikipedia.org/wiki/Parallel_construction)

[2] [http://jipel.law.nyu.edu/ledger- vol-1-no-2-2-coffman/](http://jipel.law.nyu.edu/ledger-vol-1-no-2-2-coffman/)

<comment><USER5> _parallel construction_

You're probably thinking of "inevitable discovery", which says that illegally obtained information can be used anyway if the prosecution can show that they would have obtained it anyway. Parallel construction is something intelligence agencies do in order to hide how they obtained information in the first place (whether legal or otherwise).

<comment><USER6> FBI, local law enforcement, etc use parallel construction too; for examples, look into how the FBI works with local law enforcement using tech like Stringray.

</comment></comment></comment></comment></comment><comment><USER7> Remember that the FBI said that if Apple provided a solution, it would not be used in other cases and that they were [Edit: not] going to use it as a precedent (IIRC the details).

<comment><USER8> > and that they were going to use it as a precedent

Directory Comey very explicitly said that "The San Bernardino litigation isn't about trying to set a precedent or send any kind of message"

[https://www.lawfareblog.com/we-could-not-look-survivors- eye-...](https://www.lawfareblog.com/we-could-not-look-survivors-eye-if-we- did-not-follow-lead)

<comment><USER9> Yes, and? Should we believe him? He's the director of the FBI, he's almost _certainly_ lying. It will come out in some leak or declassified document, or someones memoirs, or some such, in 30 years that the guy was lying through he teeth.

We can't seriously be expected to believe that over the next six decades it will come out that all these politicians and law enforcement folk were just, upright, moral citizens, acting in everyones best interests.

<comment><USER7> > He's the director of the FBI, he's almost _certainly_ lying.

If you mean that because he's FBI Director therefore he's lying, I strongly disagree. Certainly, just like everyone else, FBI Directors don't always tell the truth; the world is much more complicated than that. He is a human being, not a saint or angel, who has dedicated his life to public service and has an extremely high pressure, difficult job. I don't always like what he says but he deserves a little respect.

<comment> shawn-butler So we should respect accomplished liars? This seems totalitarian to say the least.

Lying to the public to accomplish a goal is not admirable in my view; it is contemptible.

It seems clear to me that he lied to Congress but parsed his testimony in a way to provide deniability / accountability. You may choose to admire this but the rest of us don't have to share your view.

I'll side with Socrates and condemn the Sophists.

</comment></comment></comment></comment></comment><comment><USER10> LA Times is reporting that the phone is an iPhone 6

 _> The FBI has agreed to help prosecutors gain access to an iPhone 6 and an iPod that might hold evidence in an Arkansas murder trial, just days after the agency managed to hack an iPhone linked to the San Bernardino terror attacks, a local prosecutor said Wednesday._

[http://www.latimes.com/local/lanow/la-me-ln-arkansas-fbi- pho...](http://www.latimes.com/local/lanow/la-me-ln-arkansas-fbi-phone- access-20160330-story.html)

<comment><USER11> IIRC, didn't the unlock in the San Bernardino case use an exploit(s) specific to the 5C or something? Also IIRC the iPhone 6 has some sort of hardware-level protection against this.

<comment><USER12> Anything you may have heard is almost certainly speculation. It seems pretty likely that a particular Israeli company supplied the FBI with an exploit, but no one has said anything about that exploit being specific to the 5c.

Even Apple does not seem to know what the exploit was, as they are pursuing legal options (or dropping hints to that effect) to compel the FBI to reveal it to them.

<comment><USER13> > no one has said anything about that exploit being specific to the 5c.

Cellebrite describes [1] the solution as working for iOS 8.x on the following devices:

> Cellebrite's unlocking capability supports the following devices: iPhone 4S > / 5 / 5C, iPad 2 / 3G / 4G,iPad mini 1G, and iPod touch 5G running iOS 8 ...

[1] [http://www.cellebrite.com/Pages/cellebrite-solution-for- lock...](http://www.cellebrite.com/Pages/cellebrite-solution-for-locked-apple- devices-running-ios-8x)

<comment><USER14> This comment someone posted in reply to my query on another article might be of interest to you.

[https://news.ycombinator.com/item?id=11387909](https://news.ycombinator.com/item?id=11387909)

<comment><USER13> Sorry I didn't reply sooner, I did find that interesting. Thanks for sharing.

</comment></comment></comment></comment></comment></comment><comment><USER15> Serious question: how is this "unlocking iPhone case", any different from what fbi and other agencies used to do for a while when they seize computers for example, or a locked safe? They also "unlocked" those devices after they got a warrant, what makes this "iPhone case" any different? If they have a warrant - and a way to unlock the device - what is the reason of all this buzz around it?

<comment><USER16> I think because Apple decided, after the Snowden illegal wiretapping stories, to grandstand for PR purposes. And many tech writers took that bait.

<comment><USER17> That's really not a fair summary of the situation. Apple took a stand, rightly in my view, to dig their heels in under the request to make a permanent back door for FBI (and likely other groups) usage. There is a massive difference.

<comment><USER18> > That's really not a fair summary of the situation. Apple took a stand, > rightly in my view, to dig their heels in under the request to make a > permanent back door for FBI (and likely other groups) usage. There is a > massive difference

This is history rewriting, the request, in his least dangerous form, was to unlock a single phone from inside Apple labs by Apple people

<comment><USER19> Incorrect -- they requested an "instrument", which carries with it all sorts of legal requirements beyond creating an in-house tool.

Source: [http://www.zdziarski.com/blog/?p=5645](http://www.zdziarski.com/blog/?p=5645)

<comment><USER20> They made both requests. Apple refused both requests.

</comment></comment></comment></comment></comment></comment><comment><USER8> ... this also severely contradicts the narrative we were fed about "it's just this one phone, for, you know, TERRORISM".

<comment><USER16> No it does not. Govt never claimed this. What it does is show that, the FBI will do exactly what the Chinese are currently most likely doing if need be.

<comment><USER21> FBI Director James Comey claimed that unlocking this phone was really really about Terrorism: "So I hope folks will remember what terrorists did to innocent Americans at a San Bernardino office gathering and why the FBI simply must do all we can under the law to investigate that." ([https://www.lawfareblog.com/we-could-not-look-survivors- eye-...](https://www.lawfareblog.com/we-could-not-look-survivors-eye-if-we- did-not-follow-lead))

It's possible, by some weird John Yoo-style contorted reading of the facts to say "FBI Director Comey said that, the US Government didn't say 'because terrorism'". That contorted reasoning would amount to lying by splitting hairs. Don't lie by splitting hairs.

<comment><USER16> I think you are confusing the arguments for granting a search warrant in this specific case (terrorism), with the overall argument behind granting the powers that a search warrant provides in general ( _not_ terrorism specific)

<comment><USER21> I'm sorry, I don't see how the above statements relate to John Comey's public explanations of why hacking the iPhone in question was so important. Maybe you can expand on the above to clarify that relationship?

<comment><USER16> Law is not made on a case by case basis. There is a general set of powers that gets granted for something like a search warrant. Just because a govt official argues that a specific case is terrorism related, does _not_ mean that the general powers granted by a search warrant is "just cause terrorism". Instead, to have a coherent argument you have to argue against why the govt should have been given the search warrant in the first place.

If you're a programmer you'll understand - you can't argue generally about a class because of the properties of an instance of that class.

<comment><USER21> _Law is not made on a case by case basis._

I see where you've gone astray: law is made on a case-by-case basis in the USA. The USA has a "common law" system ([https://en.wikipedia.org/wiki/Common_law](https://en.wikipedia.org/wiki/Common_law)) where precedent ([https://en.wikipedia.org/wiki/Precedent](https://en.wikipedia.org/wiki/Precedent)) is overwhelmingly important.

If I understand correctly, the FBI was attempting to set a precedent, using an instance that has lots of emotional appeal ("Terrorism!") and they were really working that emotional aspect ("Couldn't look the survivors in the eye") hard. Once that precedent is set, the USA's legal system would require some new laws to make the precedent go away (in a legal sense). The FBI could at the least operate under the legality of the precedent until the new law(s) take effect, if such new laws get made. They often don't, and the USA just rides on the precedent.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> I don't really have a too much of a problem with them unlocking individual phones. I have a problem with them asking for the master key to all phones, which is what they were doing in the San Bernardino case.

<comment><USER23> But this request also shows that unlocking was never about just that one phone.

</comment></comment><comment><USER24> ...and now it begins.*

* Officially, because presumably it's been going on for a long time but not publicly discussed to the degree that it is being discussed now.

</comment><comment><USER25> I'm glad I have an iPhone 6. Anything without touchID is now insecure thanks to the FBI. It sounds like Apple knew this would happen which is why they recently hired a Signal developer:

[http://techcrunch.com/2016/02/25/apple-hires-developer- behin...](http://techcrunch.com/2016/02/25/apple-hires-developer-behind- signal-edward-snowdens-favorite-secure-chat-app/)

<comment><USER26> "The FBI has agreed to help prosecutors gain access to an iPhone 6 and an iPod..."

So yea, it's an iPhone 6.

[http://www.latimes.com/local/lanow/la-me-ln-arkansas-fbi- pho...](http://www.latimes.com/local/lanow/la-me-ln-arkansas-fbi-phone- access-20160330-story.html)

<comment><USER27> If you use your iPhone 6 WITH touch ID, that is, you actually use touch id to unlock it, it makes it all the more easy for them to unlock it. They can not compel you to provide a password, as of yet, but they can compel you to provide a finger print, and they would probably have a fingerprint of yours anyway, as that is a standard procedure during booking. If you (for some reason) are concerned about FBI having access to your phone, do not use touch ID.

<comment><USER28> Or you know, just lift one off the case which you spend all day touching with the fingers you use the phone with.

<comment><USER29> Unless they already have a routine procedure for doing this, that's just not going to happen within 48 hours (the TouchID timeout) of seizing the device in a normal criminal case.

</comment></comment></comment></comment></comment><comment><USER27> Are there any good articles on the difference between iPhone 5, 5c, 6, and 6c in terms of security? Also, has anyone covered why NAND Flash clone attack vector would not work? I had many people tell me that is definitely, for sure, certainly would not work, and yet no one I spoke with could explain exactly why that was the case.

<comment><USER30> Good (excellent) article on IOS security: [https://www.apple.com/business/docs/iOS_Security_Guide.pdf](https://www.apple.com/business/docs/iOS_Security_Guide.pdf)

See Page 12 on advantage of A7 or higher processor, but, in particular:

"On devices with an A7 or later A-series processor, the delays are enforced by the Secure Enclave. If the device is restarted during a timed delay, the delay is still enforced, with the timer starting over for the current period. "

The question still outstanding, is whether the Secure Enclave can be modified, and also, whether it can be modified without a passcode.

<comment><USER31> And where does Secure Enclave store the counter? Does it have flash inside the processor? Otherwise - just unplug and replug the battery

Edit: Any device that is nand cloned will not be using apple power anyway. And we have all kinds of low temperature, low voltage bit flip attacks anyway.

<comment><USER27> The Secure Enclave does have it's own flash, it apparently even has it's own OS. What do you mean by bit flip attack? I am actually really interested in how it would be possible.

<comment><USER32> A bit flipping attack is where a change to the cyphertext results in a predictable change to the (decrypted) plaintext [1]. Re venomsnake's comment, I'm not sure how this applies to the secure enclave though, or the relevance of low temperatures.

[https://en.wikipedia.org/wiki/Bit- flipping_attack](https://en.wikipedia.org/wiki/Bit-flipping_attack)

<comment><USER31> No - I meant literal bit flipping in a processor when you play tricks with ambient temperature, voltage and so on ...

</comment></comment></comment></comment></comment></comment><comment><USER33> Put down the pitchforks people. This is standard operating procedure and you're not gonna win any arguments opposing it. If the government gets a search warrant for the contents of a safe in your home, they're perfectly entitled to crack it open with whatever techniques they discover. The now-moot case against Apple was about whether they can compel the safe-maker's assistance, which is a very different issue.

This is the protection against search and seizure that you're entitled to within the US:

> _The right of the people to be secure in their persons, houses, papers, and > effects,[a] against unreasonable searches and seizures, shall not be > violated, and no Warrants shall issue, but upon probable cause, supported by > Oath or affirmation, and particularly describing the place to be searched, > and the persons or things to be seized._

</comment><comment><USER34> I wonder what they are all thinking over Apple HQ about this... I suspect it is some variant of "Ok, now how to make these phones even more secure?"

<comment><USER35> >"Ok, now how to make these phones even more secure?"

Or more likely how to _market_ the next round of phones as being more secure and whether claiming the upgrade is essential for businesses ("our old phones are all broken now, you must upgrade") will lead to a gross increase in profits or not.

</comment></comment><comment><USER36> Fairly obvious that no actionable information is being discovered on these phones.

<comment><USER16> How so?

<comment><USER21> First, the San Bernadino shooters destroyed a lot of other computers/phones/disks - yet they left that iPhone unscathed ([http://abcnews.go.com/US/san-bernardino-shooters-destroy- pho...](http://abcnews.go.com/US/san-bernardino-shooters-destroy-phones-hard- drives-sources/story?id=35570286)). It was also a phone provided by Farook's employer. Unless Farook was a big dope, he used it for work stuff only. Since nobody got wind of the crimes before they happened, Farook was evidently Not a Dope. Third, the FBI has had access to iCloud backups from that device ([http://www.latimes.com/business/la-fi-tn-apple-fbi- call-2016...](http://www.latimes.com/business/la-fi-tn-apple-fbi- call-20160219-story.html)), apparently the iCloud password was changed as part of accessing the backup data. The changed iCloud password is what caused the FBI to not be able to access the phone directly.

So, I think we can be reasonably sure that no info of value will come off that phone. It's possible, but it seems unlikely.

<comment><USER16> So are you arguing that the police should _not_ explore all reasonable sources of information when investigating a crime?

You know, just sample a few and then if nothing comes up, just infer that everything is kosher?

<comment><USER21> Dude... you were the one that asked "How so?" in response to a statement that nothing of value would be recovered from the iPhone that the FBI was using as a means of creating a precedent. I gave you the "how so" reasons, I didn't say _anything_ about not exploring reasonable sources of information. If FBI investigative time is a scarce resource, I would expect them to prioritize the sources of information, putting "less likely to yeild results" lower in the prioritized list. I would also expect them to stop investigating the material way down on the priority list if the material high on the priority list had yielded results.

<comment><USER16> Dude. Clearly you have insights into this investigation that neither I, any media outlet or even in fact the FBI even has. So in that case, congrats, you win.

</comment></comment></comment></comment></comment></comment><comment><USER37> "just this one phone"

</comment><comment><USER38> "Drexler and Staton have both pleaded not guilty to capital murder, aggravated robbery and other charges in the deaths of the c, who were both 66."

Is it just acceptable at this point to publish AP content with typos?

<comment><USER37> Would you pay more money for a proofread article?

Would you pay anything at all for online journalism?

</comment></comment><comment><USER39> So if the FBI is just going to have the Israeli company Cellebrite unlock the phone, why couldn't Conway prosecutor's office do this directly? And given the number of public articles of opinion offered to the FBI on how trivial it was to unlock 5c and previous iPhones, and the number of companies offering unlocking them as a service, is the FBI just incredibly slow at setting a standard forensic process, or is there some other reason these phones aren't being unlocked?

</comment><comment><USER27> Apple SHOULD NOT demand to find out how the FBI did it because it would expose them to discovery requests in future court cases where they would have to tell other people (read China / Russia) how to do it. For now they have plausible deniability and they have plenty of talent to figure out how it was done, or if all else fails, they can pay that same security firm to tell them under cover of an NDA.

<comment><USER40> Nope. It could be one of many security flaws that are unknown. And you can't be sure which one they used.

<comment><USER27> But the problem still remains, if it's well publicized that they were told about the hack, next time they are compelled by the court they will have to tell everyone what FBI told them.

</comment></comment></comment><comment><USER41> Can apple sue to get the FBI or that Israeli firm that unlocked the San Bernardino phone to find out how they are unlocking these phones?

<comment><USER42> Anyone can sue for anything anytime, but there is no way they'll ever get to compel the FBI to do so, no.

</comment></comment><comment><USER42> I'm pretty sure there are quite a few FBI people chuckling these days about how all of this turned out for Apple :)

</comment><comment><USER43> At least it is in the Zeitgeist now, these kind of stories will be around for a while.

</comment><comment><USER44> Glad to learn that. I am sure it is gong to be a welcome step.

</comment><comment><USER45> Url changed from [http://techcrunch.com/2016/03/30/sure-why-not-fbi-agrees- to-...](http://techcrunch.com/2016/03/30/sure-why-not-fbi-agrees-to-unlock- iphone-for-arkansas-prosecutor/), which is a knockoff of an AP story that they mention but never link to.

</comment><comment><USER46> The technique used will be passed on down to anyone that the FBI deems fit, be it public or private.

There is no oversight or limitations.

Complete and total lack of justification.

There's a word for this -- corruption.

<comment><USER16> I don't think that word means what you think it means.

Would it have pleased you more if, oh let's just for the sake of argument say: the government had to get some kind of a court order to get the information?

<comment><USER47> Well, the grandparent did say "There is no oversight or limitations."

So, yeah. I believe it would please 'em more if there was a court order involved.

<comment><USER16> Sorry. Sarcasm doesn't come across well: there _is_ a court order, but because Apple decided to not help, they were removed from the oversight chain, hence arguably weakening the oversight.

<comment><USER33> If the government gets a search warrant and seizes a safe from your home, they don't need the safe-maker's permission to crack it open.

<comment><USER48> They would if the safe was purely digital, based on vendor-controlled platform DRM that granted the vendor and only the vendor additional access to the safe.

</comment></comment></comment></comment></comment></comment><comment><USER49> This is a blatant violation of [https://www.law.cornell.edu/uscode/text/18/2511](https://www.law.cornell.edu/uscode/text/18/2511) which prohibit direct interception of communications, 4th amendment/UN rights to privacy and encryption [http://www.ohchr.org/EN/Issues/FreedomOpinion/Pages/CallForS...](http://www.ohchr.org/EN/Issues/FreedomOpinion/Pages/CallForSubmission.aspx) extending to personal devices, and circumventing 5th amendment rights of compelled decryption.

<comment><USER50> Errr, it's pretty much none of those things :) (ie they have a valid search warrant, the fifth amendment does not protect you here under any current caselaw, etc)

<comment><USER51> > the fifth amendment does not protect you here under any current caselaw

I can't see even a _speculative_ 5th amendment argument. If they can crack your phone without your cooperation, how could they possibly be forcing you to incriminate yourself?</comment></comment></comment>


$3.6M Bounty to Recover Stolen Bitcoin - <AUTHOR> http://www.coindesk.com/bitfinex-6000-btc-bounty-stolen-bitcoin/ <comment><USER2> Looking forward to seeing how this will turn out. Never a boring day in Bitcoin.</comment>


WSO New update 2.5.1 ( Web Shell ) - <AUTHOR> https://github.com/downloads/orbweb/PHP-SHELL-WSO/wso2.5.1.php WSO New update 2.5.1 ( Web Shell )
http://i48.tinypic.com/33wxkw8.jpg
Changelog (v2.5.1): Remove comments from the first line . Added option to dump certain columns of tables. the size of large files are now well defined . in the file properties field "Create time" changed to "Change time" (http://php.net/filectime). Fixed a bug that caused not working mysql brute force if there was a port of the server . Fixed a bug due to which one can not see the contents of a table called download in the database.
https://github.com/downloads/orbweb/PHP-SHELL-WSO/wso2.5.1.zip
https://github.com/downloads/orbweb/PHP-SHELL-WSO/wso2.5.1.php <comment><AUTHOR> Changelog (v2.5.1): Remove comments from the first line . Added option to dump certain columns of tables. the size of large files are now well defined . in the file properties field "Create time" changed to "Change time" (<http://php.net/filectime>). Fixed a bug that caused not working mysql brute force if there was a port of the server . Fixed a bug due to which one can not see the contents of a table called download in the database.</comment>