Want Everyone To See Your Credit Card Transactions? Meet Blippy. - <AUTHOR> http://www.techcrunch.com/2009/12/11/blippy/ <comment><USER2> This is the part where I find I need to admit that I'm growing older. I'm no longer young and hip, but part of an older generation of "unsocial" people that see absolutely no point in something like this.

To be frank, I don't give a fuck what my friends buy. I don't care what random thoughts they have during the day either, or how many fucking cows they bought in some stupid game I've never played.

I'm sure this will do well though. Just not with me as a user.

<comment><USER3> I don't quite understand the complete lack of regard that younger people have for privacy these days, either.

It will all end in tears.

Unless you're an attention whore or a shill getting kickbacks for marketing, I really don't see the draw.

<comment><USER4> _It will all end in tears._

It will middle in tears, anyway.

</comment></comment></comment><comment><USER5> The only thing that would be interesting about this is if the Blippy card gave you 1% off of every transaction.

Suddenly you'd face a tradeoff between privacy vs. getting a discount[1].

That 1% could almost certainly be made up by analytics and viral referrals. If someone saw your stream and clicked on say an Amazon book, then Amazon easily makes that 1% back. In fact, for some companies the discount could be substantially more than 1%.

[1] Importantly, experiments have shown that privacy is dear but cheap. I recall an experiment where people stood in a busy area and paid people $10 for their username and password. Many took them up on it.

</comment><comment><USER6> What comes after this? A tool for friends to share data about with whom they're sleeping? That would seem to take "making behaviors visible" to its logical end.

(Actually, it wouldn't surprise me to learn that something of that sort exists in the dark corners of the web.)

</comment><comment><USER7> I find it completely and utterly mind boggling that anyone would find this useful. Spending habits are private: tracking your OWN is useful. But sharing everything publicly? It's insane. Guaranteed you are going to be embarrassed after you reveal your $200 purchase at the Love Shack or once your friends realize you eat at McDonalds 3 times a week. What happens people start tracking down gifts or you blow the surprise on your engagement ring?

People want to share _some_ of the things they buy to show off, but no one wants to share _everything_ they buy. From the mundane to the inane to the embarrassing, it's a wide window into your private life that very few would feel comfortable opening.

<comment><USER4> The article covers this: you register one of your cards, and use that for public purchases. They plan to provide a sticker for that card to make it more obvious.

</comment></comment><comment><USER8> Is today April 1st? My calendar says 12/11/09 and there's snow on the ground, but it must be April 1st because there's no way this could not be a prank. Nobody could possibly think this could be popular.

<comment><USER4> I'd be interested in using it, but I'm a terrible predictor of what other people will find interesting.

</comment></comment><comment><USER9> I predict that almost all of the reaction will be "oh, that's interesting, but I'd never use it." I also predict that CNN will at some point in the next week have this in their rotation of stories.

</comment><comment><USER10> This is heaven for marketing, can't wait for it to get integrated into Facebook. I wont use it myself, but it's great to know what people are spending money on.

</comment><comment><USER11> Too bad hookers and blow dealers don't take credit cards.

<comment><USER12> Not to worry, Square has them covered. <https://squareup.com/>

<comment><USER11> [insert evil laugh]

</comment></comment></comment><comment><AUTHOR> dumbest idea of 2009?

<comment><USER13> you don't find it at all intriguing?

<comment><AUTHOR> besides the technology?

no...I find it insane. How about an iPhone App that let's the world hear all of your conversations?

<comment><USER13> pricing transparency for variable priced services (comcast, gyms, etc.) could be very empowering for consumers. crowd-sourced fraud detection seems pretty interesting as well. and of course, discovery elements...

<comment><AUTHOR> but that's not what this is

<comment><USER13> FTA: "And because the actual purchase prices are made visible, there are other interesting dynamics. For example, imagine being able to tell if you're getting ripped off with what you're paying for a gym membership or on your Comcast bill when compared to what your friends are spending on the same things.

There's also the potential to have private accounts that maybe a businessman would only share with his assistant to let them know what's being purchased and explain things a bit better in the comments. Again, yes the idea is controversial, but there are a lot of interesting things that could come of it, if people are willing to be this transparent."

Owning this data is valuable.

</comment></comment></comment></comment></comment></comment><comment><USER14> I think they are taking recent Eric Shmidt's quote too firm :-).</comment>


Own It for Life – A curated list of durable products - <AUTHOR> http://www.ownitforlife.com

<comment><USER2> A lot of these Amazon referral link sites have popped up. Most do a good job of curating products but it does bring up the question of conflict of interest.

</comment><comment><USER3> This might be something to build an awesome community around. Giving users way to add more than just comments: stuff like a way for the public to do more than suggest products - add them to a pool of incumbents that others can talk about immediately, a way to discuss personal experiences, ratings, photographic examples of products after x years of use - examples of failures after x time stuff like that.

I'd love to see a 100 year old Lodge pan or a pair of those keen sandals after 3 years :) Obviously clothes and cast iron posts have significantly different lives.

<comment><USER4> The BuyItForLife subreddit has some of the things you mention: [http://www.reddit.com/r/BuyItForLife/](http://www.reddit.com/r/BuyItForLife/)

</comment></comment><comment><USER5> I'd love to see small write-ups or justifications as to why these particular products were selected. Also, I'm having some issue with the infinite scrolling.

</comment><comment><USER6> Work gloves, work boots, work pants...? Regardless of quality, those will hardly last a few years, assuming you do any actual work with them...

</comment><comment><USER7> [https://news.ycombinator.com/item?id=8364994](https://news.ycombinator.com/item?id=8364994)</comment>


YCRFS 3: Things Built on Twitter - <AUTHOR> http://ycombinator.com/rfs3.html <comment><USER2> The beauty of twitter isn't that you send messages without specifying recipients. Any billboard does this. HTML webpages, blogs with RSS feeds, etc do this.

Twitter allows you to:

1\. Communicate on equal footing. You're living on someone else's blog, or their social news site, or their subreddit, or their messageboard, or in their chat room. There's no need to shout anyone down with negative karma, because everyone controls their own feed.

2\. Control your world. If you stop following someone, they basically cease to exist. On the other hand, they can follow you if they want, with no harm to you. This allows celebrities to share directly in a way they never have before.

3\. Stay engaged with minimal time. Tweets are limited to 140 characters for everyone. Writing a blog post requires a commitment and willpower. A tweet is extremely easy.

Despite all of this, Twitter itself is very awkward to use, and making sense of the un-threaded mass is very difficult. It's reaching mass adoption because it can be all things to all people (microblog, chat, rss feed, friend updates, broadcast announcements, etc).

There are better ways out there to facilitate good discussions. Google is trying to tackle the office collaboration problem with Wave, and I think there's huge progress to be made in the space of online discussions, separate from the current plethora of news reaction sites ( _coughhackernewscough_ ) that we have now. The inevitable rise of self-posts on news sites (it's usually resisted or frowned on at first) shows the existence of this need.

<comment><USER3> I agree that the great advantage of twitter compared to other social tools is that you don't need both parties consent for it to work. Anyone if free to listen to you without requiring your consent.

It is more like in real life, where I don't need to ask your permission to listen to what you say.

</comment></comment><comment><USER4> This isn't really related to the RFS, but the idea of Twitter as a new protocol sort of scares me. Most of the successful internet/web protocols so far have not been controlled by a single company, but if Twitter can sustain their current growth there's no reason for them to open up the "protocol".

<comment><USER5> Well, SSH was controlled by a single company at first...

But maybe calling Twitter a "internet protocol" is a bit of a stretch, even in purely technological terms? Human communication protocol, maybe...

just to paraphrase Stephen Colbert: "The protocol we didn't know we needed until we had it"?

<comment><USER6> A lot of Twitter traffic is machines now. Actually, this is making it a little hard for humans, since there are so many spammers/pornbots.

And there're are a bunch of examples of protocols that were initially controlled by single companies. AIM gave us Oscar and TOC. Microsoft gave us SMB. Kazaa gave us FastTrack.

<comment><USER3> The difference however is that SMB, for example, was implemented by Microsoft but can run on any machine. Twitter is tied to twitter machines.

</comment></comment></comment></comment><comment><USER7> I think "messages without a recipient" have been around for quite a while, and we call them broadcast messages. DHCP does this. Radio does this. Blogs do this. I'm not saying that Twitter doesn't have an interesting innovation here (I personally think they do), but I don't think they've "discovered a new protocol". They've taken existing concepts and applied them to people.

<comment><USER8> > I think "messages without a recipient" have been around for quite a while, > and we call them broadcast messages.

Yeah or any number of pubsub, queue based messaging systems. What twitter has is _millions of users_ all in one place with low barrier to get started and easy access via mobile, web, and API. It has its warts, but so do many popular things (TCP/IP for example), the thing that matters about it is that it is deployed and used heavily and in people's consciousness.

</comment></comment><comment><USER9> I'll take this opportunity to plug my site that is built using the Twitter API - <http://www.playtwabble.com> . Twabble is a vocabulary game based on the words you use in your Twitter status updates. It uses a point system based on the game Scrabble. I built it to learn Django and Python. I didn't get much feedback when I submitted it to HN, so here goes again? Hope this isn't spammy, I think my game illustrates a basic example of what is possible with Twitter.

<comment><USER10> Let me also plug my site :) <http://www.celebsutra.com> It aggregates tweets and pictures from celebrities on twitter. Had submitted it to twitter and have implemented most of the changes people had suggested.

<comment><USER11> Let me do the same, <http://twitthegame.com/> It's a place to talk about sports on twitter (like stocktwits).

</comment></comment></comment><comment><USER12> Should we be doing this startup the Twitter-way, or do we need a business plan too?

<comment><AUTHOR> No business plan needed. All you need to know is roughly what you want to do.

<comment><USER13> pg: Is it okay to contact you with questions? If so, where? Thanks.

<comment><AUTHOR> Sure: firstname.lastname@example.com

</comment></comment></comment></comment><comment><USER14> Does anyone know what the current rate of tweets per second is? This would influence what it's possible to do with the streams.

<comment><USER15> You can read every tweet from a single machine. It's just a matter of getting acces to the steaming API.

<comment><USER14> _You can read every tweet from a single machine._

Sure, but the rate of tweets will determine how much processing you can do per tweet given a certain amount of computing power.

<comment><USER16> If you manage to save them somehow (or distribute them to different machines), you can distribute the processing, I suppose.

<comment><USER14> Exactly -- thus the question of how many machines would be needed to perform a certain amount of processing per tweet, which ultimately comes down to my original question of how many tweets there are.

</comment></comment></comment></comment></comment><comment><USER17> This is cool.

I've been trying to figure out Twitter for the last couple of years. Left to the defaults, using twitter.com as the "interface" it seems to be a giant attention-whoring spew of marketeers and SEO "experts".

To me (and I think I said this a long time ago in a post here) the potential as a global distributed message bus always seemed so much more powerful. It's kind of like IRC to the next level.

I'm going to have to think on this. I've been toying around with some Twitter- based thoughts relating to my home automation and video analytics hobby- projects.

<comment><USER18> The key to Twitter is to think of it as a big old stream of data.

Of course you don't want to read it all. That's why you follow people. It pulls their information out of the stream, and makes a substream for you. The same goes with turning on people to mobile: it pulls them out of that stream, and into one even closer to you.

<comment><USER17> I hear you, but I'm not so sure that it's just about picking people to follow. That feels too yesterday... I'd like to pull trends out of the conversations at large. Can Twitter be a trending engine? Can you leverage a topic for financial gain? Is there actionable data in the random blatherings of a million people?

If I am JetBlue (I'm not) and people are ranting or raving about some experience on Delta, can I use that data? Run a promo? Give them a safe haven?

In one respect, Twitter seems like it can be the exposing of the raw conscious of "the public", that group that has been so elusive to marketeers. The trick is to extract the data, to measure the thing, without affecting that which you are measuring. One of the longest standing challenges in science.

I'm rambling, but thinking on iterations of this in my head.

<comment><USER19> If you have any suggestions to improve our tool, we'd be happy to hear them.

<http://trendistic.com/>

</comment></comment></comment></comment><comment><USER20> With proper filtering, a news alert system could be pretty cool coming from the firehose. I'm thinking identifying key words like the Moldavian #pman tag with regard to the student shutdown of the gov't following alleged voter fraud. You'd need to establish a solid baseline for a large number of words to discover variations from the baseline. carpdiem and I have discussed this one for a bit, but we couldn't figure out how to finagle access to the data stream to start developing. Could be interesting...

<comment><USER21> Maybe going beyond simple wordcount to determining statistical probabilities of certain words / phrases being mentioned together & at "high" frequencies would taper down the number of words you need a baseline for (because I also don't assume the baseline will be static or even near stable - changing trends of discussion topics)

This idea also ties into the "new news" idea a bit. What we've seen from events like #iranelection is that twitter is a good (but could be great) tool for detecting news at the onset of events (before big stations pick up on it), but really starts to get bogged down with "spam" or RT's once a topic gets picked up. I'd like to see news that integrates these abnormal spikes in tweets that hint at a bigger underlying story w/some sort of follow-up with more context about the event.

</comment></comment><comment><USER22> Since we're talking about Twitter being a "protocol"...Is it likely they will be the only 140 character microblogging platform? What opinions do you have on Status.net and what they are doing with www.identi.ca? I think twitter has created a new protocol, but not a monopoly on that protocol. In 5 years people will be microblogging everywhere. That's what worries me about building something off twitter.

</comment><comment><USER23> @PG If only our 'other ideas' is a response to a RFS, would you like us to check the 'this application is a response to a RFS'?

<comment><AUTHOR> No, though if it's an alternative idea you're really serious about you could file a second application for it under one of your cofounders' accounts.

</comment></comment><comment><USER24> Twitter is the "Atari Pong" of real-time messaging services?

I remember how exciting it was back in February when I started realizing what it meant to have a real-time messaging protocol. [http://www.thinksketchdesign.com/2009/02/25/design/algorithm...](http://www.thinksketchdesign.com/2009/02/25/design/algorithm- design/from-microblog-to-network-protocol-how-twitter-will-redefine-the- internet)

How magical! Imagine all the strange and wonderful things we could do with it - like water our plants automatically! But I'm going to have to guess that twitter has seen its heyday. Twitter has been fueled by the exciting idea of a real-time protocol - and that idea will truly shape the next generation of the internet. But that idea is here now and it's going to outgrow twitter in a hurry. The idea of a real-time protocol is going to be the backbone of the next internet-merged-with-mobile-cellular-satellite-and-wireless-mesh-network revolution. Every device will talk directly to any other device. The ISPs will be the next media giants of this year - scrambling to hold onto their market models as the internet as we know it dissolves into the fabric of the technological landscape powered by open source network communication software and ad-hoc device-to-device mesh networks. Twitter has been a real inspiration, but I just don't see them growing and adapting to be the driving force to carry this revolution. Thanks, twitter, but I'm looking to google wave now as a protocol that has real potential to be the backbone structure for the next-gen internet. Or hey - prove me wrong. It definitely seems like a good move to reach out for fresh ideas at ycombinator.

More on google wave - and annotated video clips that summarize the google wave demo video: [http://www.thinksketchdesign.com/2009/06/09/web/media/google...](http://www.thinksketchdesign.com/2009/06/09/web/media/google- wave-coming-soon-it-will-supercharge-your-email-then-shake-the-webs-very- foundation)

</comment><comment><USER25> [offtopic-ish] This is the first decent short summary of twitter that I fully get. I haven't "bought in to it" yet, due to my free time being fairly limited, and to me it doesn't seem to add much value compared to the time I _think_ i need to spend to get the hang of it... _maybe I'm just getting old..._

</comment><comment><USER26> ok so here's my idea:

you take the data out of the hose and run a bunch of "machine learning" over it to figure out what twitterverse is saying about apple. or rather, apple stock.

if you can guess the opening direction the next day better than 50% of the time i'd say you would have some money on your hands.

i kid, i kid...

<comment><USER27> we're actually doing something similar to this, but have been tracking a number of stocks as well as other things.

twitter + sentiment analysis = prediction market; but in most observable cases, we're seeing twitter lag behind the market, not actually predict it. oh well!

<comment><USER28> Hey, any chance you have raw data to process? I'd like to give it a shot (doing sentiment analysis on your data)

<comment><USER27> Our internal data is kinda one of the things we curate and I can't really give that away, but I do have access to an academic corpus that might be redistributable. I'll have a look. :)

</comment></comment></comment></comment><comment><USER27> I wonder how the rest of us mortals get firehose access. We could do some pretty cool stuff with it, and it'd negate the need to absolutely hammer the Search API (er.. not that we found workarounds that involve hammering the Search API.. oh no).

<comment><USER29> Use what they give you for free. Impress them. Ask for better access. Profit!

</comment></comment><comment><USER30> What twitter NEEDS is a web service that allows you separate the real humans from the bots and not-real accounts. Various applications can then be built on top of that information.

</comment><comment><USER31> From personal experience using facebook and twitter, facebook is a much richer source of information to be mined, to bad though that facebook is for the most part a closed platform, at least on the level that you get with twitter being able to analyse the stream of tweets or searching all tweets made.

Wonder if people have created facebook apps for the sole purpose of getting access to a lot of users data then on sold that access to others? If that's even possible.

</comment><comment><USER32> I'm going to be applying under this. The only problem is that I just left my former startup about a week ago. Looking for someone who would be interested in applying along with myself. Someone who is an awesome developer with a strong machine/statisical learning background prefered. Please e-mail me at kyleATcodeincarnateDOTcom.

</comment><comment><USER33> Dear [deity],

Please have someone make a noise-filtering system!

<comment><USER34> What would be left?

While some of the aggregate information that can be gleaned form twitter is interesting, I have yet to see anything approaching a single meaningful message.

I know that many people seem to like twitter, but every time I go to the twitter website I leave without experiencing anything interesting. Maybe I'm doing it wrong.

<comment><USER35> _Maybe I'm doing it wrong_

I use Twitter extensively, but I can't say I've gone to the actual Twitter website more than a dozen times. I think the most interesting uses of Twitter involve using Twitter data in other places, like putting a stream on your blog. I think that's where the future of Twitter is. I saw a cool Twitter/Flickr mashup a while back that took a Twitter stream and translated it into pictures, which was cool.

</comment></comment></comment><comment><USER36> Is there a public dataset of tweets?

There was one available for download, but it seems Twitter pulled it: [http://blog.infochimps.org/2008/12/29/massive-scrape-of- twit...](http://blog.infochimps.org/2008/12/29/massive-scrape-of-twitters- friend-graph/)

</comment><comment><USER37> I think the future of twitter is in effectively tracking what genuine people need, want, and feel and displaying that information in an accessible manner. I have no idea how to execute that thought but it seems like the next logical step.

<comment><USER38> All the "genuine people" I know in my life don't use Twitter and have no intention of doing so. Not one of them needs to tell people they don't know how much they love apples.

<http://twitter.com/#search?q=i+love+apples>

All people will simply STOP using twitter.

I used to be on Twitter often, and so were many people in my small city. Now, if I go back, about 2 or three people I followed post to twitter every couple of weeks (if at all) where there used to be about 30. They all just stopped.

It's like ANY new toy. You play with it for a few weeks right after Christmas, but then, it just ends up in the toy box and is never played with again.

<comment><USER3> People though the same about the web in general, but things change when you build around this infrastructure. The first time I saw the web I though nobody would stay much time around a computer to look at crappy web sites. But the really good web sites came in, and we are here 15 years later.

</comment></comment></comment><comment><USER39> Twitter is not a protocol. This Pubsubhubbubtub-thingy is.

</comment><comment><USER40> So, who's going to make the next spymaster?</comment>


Hacking Google Calendar - <AUTHOR> http://nealpoole.com/blog/2010/11/google-vulnerability-reward-program-google-calendar-csrf/

<comment><USER2> I wonder how many other sites put in CSRF tokens but don't validate.

<comment> mike-cardwell For every one of these websites, there are probably 10,000 that don't do any CSRF checking at all.

</comment></comment><comment><USER3> Very odd that they included XSRF tokens but did not validate them.

<comment><USER4> Yeah, that was what I thought too. It was a very weird situation. And it was the only one of its kind that I found: I found other vulnerabilities, but none where CSRF tokens were presented but not validated.

Edit: I should clarify that this is my blog post ;)

</comment></comment><comment><USER5> Another interesting point is the generation of unique IDs that weren't cryptographic. The uid in src=<uid> shouldn't be guessable, right? It looks like it just went a simple transformation that was easily reversible.

On the other hand, if the CSRF tokens were validated, the uid field needn't be guessable.</comment>


Tell HN: Riseup.net fails to update canary; fingerprints deleted without notice - <AUTHOR> After almost a week of direct questioning, canary is still not updated:
https://riseup.net/pl/about-us/canary
Certificate fingerprints deleted for certain domains on Oct. 22nd without notice:
https://github.com/riseupnet/riseup_help/commit/8a8c98e0aaa635130a899c1980569f34633d159d
Page where fingerprints no longer appear:
https://riseup.net/pl/security/network-security/certificates <comment><USER2> If you're doing any kind of radical political work --- left or right --- and are worried about the attention you're going to attract, don't use things like RISEUP.NET. You shouldn't be running mailing lists at all. You shouldn't be using Jabber and asking all your peers to enable encryption. These are fundamentally unsafe services, and the idea that they can be provided safely just by paying attention to network security is terribly misleading.

In the universe of possible media in which to conduct discussions with a group of peers, there may be none less safe than SMTP email mailing lists. Keep secrets off mailing lists. Never use mailing lists for secrets. Assume your mailing lists are public. Nobody is going to deploy a mailing list security solution that will ever be adequate against state-level adversaries. Any site claiming to keep political activists secure that offers mailing lists should be viewed with suspicion, because "don't use mailing lists" is close to the only thing that messaging security people agree about.

<comment><USER3> I remember clearly a Tunisian opposition party was using a RISEUP mailing list around 2006 to spread its articles, political statements, etc... (When they were banned before the revolution of 2011).

Not all politicians can/know how to operate anything more complex than an email account.

<comment><USER4> That's an interesting piece of history. It kind of makes sense that accessibility can sometimes be worth the potential downsides.

By the way, are you a fellow Tunisian? I'm kind of surprised because I've never run into a Tunisian on HN :p

<comment><USER3> Maybe one day I'll release an archive of pre-2011 emails and IRC logs.

Yes I'm Tunisian, I only know of a couple active people around here, but there is a ton of readers.

<comment><USER4> Wow, so you operated mail and IRC servers for use by dissidents pre-2011? I would definitely attend a talk about that! A blog post would be amazing too.

I see, that's great to hear. I don't live in Tunisia, so I'm not familiar with the Tunisian tech scene. Judging by your Twitter feed, it seems to be really active, which is awesome!

<comment><USER3> Nothing that impressive, I was just a bystander, I had a bot that logged IRC conversations on certain rooms and I subscribed to a number of mailing lists.

I just need to find the time to filter that data and publish something.

</comment></comment></comment></comment></comment></comment><comment><USER5> And from riseup.net @riseupnet

        listen to the hummingbird, whose wings you cannot see,
        listen to the hummingbird, don't listen to me. #LeonardCohen

[https://twitter.com/riseupnet/status/797142735283257345](https://twitter.com/riseupnet/status/797142735283257345)

<comment><USER6> That was probably just commemorating Leonard Cohen's death, and the certificate fingerprints were probably just removed because they switched to Let's Encrypt for those domains. But you never know.

<comment><USER7> What good is a warrant canary if it's also used for whimsy or commercial speech? If they don't take it seriously enough for people know what it means then their system isn't worth using to start with.

<comment><USER8> A Twitter feed is not a warrant canary.

Edit: the exact link to the official warrant canary is specified in the top post, please don't answer if you haven't recognized that much:

[https://riseup.net/pl/about-us/canary](https://riseup.net/pl/about-us/canary)

The "If they're relying on double entendres then it might as well be" as a response to "A Twitter feed is not a warrant canary" really has no sense.

[https://en.wikipedia.org/wiki/Warrant_canary](https://en.wikipedia.org/wiki/Warrant_canary)

Also worth reading:

[https://www.schneier.com/blog/archives/2015/03/australia_out...](https://www.schneier.com/blog/archives/2015/03/australia_outla.html)

<comment><USER7> Think about it a while longer.

</comment></comment></comment></comment></comment><comment><USER9> October 23:

"If you are doing certificate pinning with us, we are updating certs! so keep calm and check the new FPs here [https://riseup.net/en/security/network- security/certificates](https://riseup.net/en/security/network- security/certificates) …"

[https://twitter.com/riseupnet/status/790245677234282496](https://twitter.com/riseupnet/status/790245677234282496)

Updated fingerprints (PGP signed Oct 22):

[https://riseup.net/security/network- security/certificates/ri...](https://riseup.net/security/network- security/certificates/riseup-signed-certificate-fingerprints.txt)

Edit:

See OP below restating that fingerprints for certain subdomains are what is missing. Should have read more closely ;)

<comment><AUTHOR> Yes I linked to the current certs in the post text. The issue is with the domains that were deleted in the commit (also linked) which no longer appear in these links.

Black, labs, and a few others have their own certificate that no longer can be verified with fingerprints, since Oct 22nd.

</comment></comment><comment><USER10> I'm uninformed. What is the significance of riseup.net?

<comment><USER11> I hadn't heard of it either until just now. I remember when Reddit removed their warrant canary. I barely even use it now. For most people I bet it didn't matter. I have a feeling with mission of Riseup, this will have a much larger impact on their userbase .. the ones who are aware of this.

<comment><USER12> I'll bet they placed bets on how quickly people would stop caring once it left the front page. That plus their usage of Moat display analytics tags on the homepage, and pushing for people's email addresses should be a clear telegraph of where they want to take the site.

I'm also curious about the security of things like RES.

</comment></comment></comment><comment><USER13> Imagine if your office live-broadcasted _nearly_ everything. From the corridors, reception area, to the opening of physical mail. The PR and generally more "public" email addresses could be transparent as well.

This means when the NSL arrives, it will be seen by the world.

<comment><USER14> > Imagine if your office live-broadcasted nearly everything.

The next step in the fight against ongoing, overbearing surveillance is... ongoing, overbearing surveillance?

<comment><USER15> Transparency, not surveillance.

</comment></comment></comment><comment><USER16> I am highly skeptical of any claim that an email provider is more private than other providers. E-mail is fundamentally not secure and not private, unless you enhance it with PGP, which requires you to, of course, have something you want private.

Most people don't encrypt because they're not scared enough. It usually takes some time before their wordlview is repeatedly shattered enough that encryption is the only choice they have.

<comment><USER17> The parent statement is very misleading. Here are some significant differentiators between email providers:

* Encryption in transmission emails sent and received, using SSL/TLS

* Encryption in transmission of webmail sessions, using HTTPS

* Authentication security: Do they use 2 factor or other tech?

* Logging and retention of logs

* Reading your mail to build marketing profiles and social graphs

* Access by employees to your data

* Retaining and sharing your personal data with other businesses

* Security of your account information; can they easily be persuaded to surrender it

* Security of the email provider's systems

* Responsiveness to 3rd party requests for your information, whether private parties in lawsuits or legal authorities with/without warrants

* Cooperation with government surveillance dragnets

Security always is a matter of degree. Email will never be perfectly secure but there are some big differences between providers.

<comment><USER16> > Authentication security: Do they use 2 factor or other tech?

Sorry for sniping this specific one, but 2FA is (more often than not), security theater. It gives the illusion of security like how TSA baggage check is a big dance of scanning, pat-downs, and key ceremonies.

For context, consider Yahoo Mail, where emails are read by intelligence agencies before the user even gets them. Does my 2FA help here? Probably not.

I can understand that 2FA does have its uses, but frequently I'm seeing it being used like those 'Secured by Comodo SSL' with a picture of a shield to make a would-be shopper feel like the transaction is more secure. It can be theater.

<comment><USER18> That's like arguing that an airbag is safety theater because it doesn't prevent drowning if you drive off of a bridge.

MFA is used to prevent a third-party who has access to your credentials from being able to login as you and, in the case of U2F, to prevent a successful phishing attempt from compromising your account.

MFA offers no, and never has been billed as, protection against a subverted server or an attacker who can decrypt or tamper with traffic on the wire.

Security is a large, complicated problem. There will never be a single measure which protects against every threat.

</comment></comment></comment></comment><comment><USER19> New tweet: [https://twitter.com/riseupnet/status/800815181190217729](https://twitter.com/riseupnet/status/800815181190217729)

Confusing update IMHO. Could be read as reassurance. Could also be read as being threatened with incarceration and being forced to keep the site up. or a reminder to archive stuff immediately because of impending shutdown.

Not really sure what to make of it, other than they have obviously heard the concerns and /not/ updated the canary.

<comment><USER20> Not really my area of expertise, but it strikes me as completely clear.

The canary hasn't been updated and the tweet implicitly acknowledges that they are aware of the concerns that people have about the overdue update. I can only think of two reasons to do this. 1. get some publicity or 2. for whatever reason they are unable to update the canary and are unable to say why. Personally, I doubt it's reason 1.

<comment><USER19> But why say they have no plans to shut down and link directly to the part of their FAQ where they say they will shut down if they are under government surveillance? Why not just tweet something like "We have heard your concerns" or something similar

<comment><USER21> You might not be able to shutdown if you have been forced to keep the service running.

</comment></comment></comment></comment><comment><USER22> > If you are doing certificate pinning with us, we are updating certs! so keep > calm and check the new FPs here

[https://twitter.com/riseupnet/status/790245677234282496](https://twitter.com/riseupnet/status/790245677234282496)

</comment><comment><USER23> If you care enough to post canaries, shouldn't you also care enough to just close shop instead of subtly telling your users to stop using your services?

<comment><USER24> I'd imagine that since lavabit NSLs make that harder if not illegal.

<comment><USER25> its not within legal purview to force someone to _continue_ doing something, is it?

<comment><USER26> But they could order them to give them access to administer their servers, with acts of sabotage being punishable. There's no reason you should assume that the people running RiseUp right now are the same people that ran it a week ago.

</comment></comment></comment></comment><comment><USER27> Looks like issue will be resolved soon:

[https://twitter.com/riseupnet/status/765414528951529472](https://twitter.com/riseupnet/status/765414528951529472)

        .@flanvel Thanks for noticing. A refreshed canary statement will be up shortly.

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>----

Disregard, I forgot to check date.

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>----

That tweet is from august

</comment><comment><USER28> Before the most recent update, it was updated April 10th. So 121 days between updates. At the same rate, it would be updated next around December 21st. But yeah that is a strange tweet, and lack of tweets since is also strange.

</comment><comment><USER29> Perhaps I'm doing this wrong but when I try to verify the gpg signature I get

gpg: Signature made Tue Aug 16 01:01:19 2016 EDT using RSA key ID 139A768E

gpg: Good signature from "Riseup Networks <email@example.com>" [unknown]

gpg: aka "Riseup Treasurer <email@example.com>" [unknown]

gpg: WARNING: This key is not certified with a trusted signature!

gpg: There is no indication that the signature belongs to the owner.

Primary key fingerprint: 4E07 9126 8F7C 67EA BE88 F1B0 3043 E2B7 139A 768E

<comment><USER30> Do you have a trust path between you and that key? If not, that message is normal, but you have no in-band way of knowing whether it's a valid signature from the right key or a valid signature from a fake key. However, if you have some trustworthy source that that's the right fingerprint, then you know it's a valid signature from the right key.

(This is why I hate PGP.)

</comment></comment><comment><USER31> Is it due to be updated by today? Or is it not late until the last quarter of 2016 passes without an update?

</comment><comment><USER32> I Don't get it. They last updated in august. Wouldn't the next be due in December?

</comment><comment><USER33> Misleading title. There were no "fingerprints deleted without notice"

</comment><comment><USER34> I love how this conversation devolved into pedantry, honestly. Worry about the a/an usage, don't address the root issue, why don't you. Yup: programmers are grammar nazis.

</comment><comment><AUTHOR> Speaking for myself, this was brought to my attention in the context of a developing story about WikiLeaks being under duress or Julian Assange missing, who has not sent direct communication let alone signed communication for around a month now.

EDIT - if curious, [https://www.reddit.com/r/WhereIsAssange/](https://www.reddit.com/r/WhereIsAssange/)

<comment><USER35> it's well known that his internet is cut off. I think if somebody was sending communications with his signing key while he is known to be unable to communicate, that would be the real problem.

<comment><AUTHOR> He usually sees a lot of visitors, and the organization has access to millions of dollars, so he certainly has various methods available to him to say "I'm fine." They can't physically "cut him off" the Internet, but they can demand that he pause the election-related PR he was doing. They asked him to not interfere in the election, specifically.

However, the election has been over for some time. Even if they could, I doubt the Ecuadorian Embassy would forbid him from sending a basic message, picture, clip to verify he is OK, especially since pressure has been on them for a while now about his well being.

</comment></comment></comment><comment><USER36> Is an FOIA request useful?

<comment><USER37> to whom hoping to get what? Probably not. You obviously can't get secret security letters or sealed warrants via an FOIA.</comment></comment>