The UDID leak is a privacy catastrophe - <AUTHOR> http://corte.si/posts/security/udid-leak.html <comment><USER2> After reading this, I'm still a bit confused as to why this is a catastrophe?

Should we change our paypal passwords? Or worry about getting more spam? etc Why should an end user (eg my mom) care?

I'm not saying there aren't serious repercussions, just having a hard time seeing exactly what they are.

<comment><USER3> Have a quick read through the posts linked in the article this story points to. I show that using just a UDID, you could access the user's geolocation, games they played, private messages and friends lists on many of the affected social networks, and in some cases (which affected millions of users) completely take over Twitter and Facebook accounts. This is with _just_ a UDID. Some of the companies I notified a year ago are still vulnerable today. And remember, I only looked at social gaming networks - small slice of the app ecosystem. I know that there are similar systemic issues in many other places. So yes, this is definitely a catastrophe.

Unfortunately, there's just not much an ordinary user can do. There's no way for a user to tell if an app accesses and broadcasts their UDID (if you're an expert you can use mitmproxy or a similar tool), and certainly no way to tell if the UDID is being used safely. I would recommend de-linking your social media accounts from all apps unless you know they're safe, but that's the kind of drastic advice that people tend not to take.

<comment><USER2> Thanks for that. Not super worried about people knowing my location or games I played :p

However, this is of interest:

 _> and in some cases (which affected millions of users) completely take over Twitter and Facebook accounts_

How is that possible? Are we going to see mass defacements/malware links or other bad stuff on Twitter and Facebook as a result?

Also what is meant by 'take over'? Surely it doesn't mean from a UDID alone, a hacker could log into that associated account with full permissions?

I'm assuming any scripted attack would only have the permissions that any other FB/Twitter app has, and could be blocked in App settings if it started doing 'bad stuff'?

<comment><USER3> I found vulnerabilities in two social gaming networks that let you take control of people's Facebook and Twitter accounts using _just_ the UDID. I never published the details of these vulnerabilities, but you can find an official acknowledgement from at least one of these companies (Chillingo of Angry Birds fame) in this WSJ piece:

[http://blogs.wsj.com/digits/2011/09/19/privacy-risk-found- on...](http://blogs.wsj.com/digits/2011/09/19/privacy-risk-found-on-cellphone- games/)

<comment><USER4> Angry Birds was made by Rovio, not Chillingo.

Chillingo is a publisher of 3rd rate knockoffs.

<comment><USER3> Chillingo is the publisher of the original Angry Birds, and it's their social network (which is integrated with Angry Birds and therefore on millions of devices) that had the vulnerability.

</comment></comment></comment></comment></comment></comment><comment><USER5> No, the UDID is a privacy catastrophe.

<comment><USER6> UDID is a few years old is it not? It's surprising it took people this long to figure this out.

<comment><USER7> Apple has been telling devs to move away from it for a least a year.

<comment><USER8> Yeah and there was an outcry over that, and nobody saying "Good decision." As Microsoft learned in the '90s, when you're on top nobody's going to do anything but rip on you.

</comment></comment></comment></comment><comment><USER9> Given that the UDID has been deprecated in iOS5 and Apple are now rejecting apps that use it, I'd be interested to see what level of actual vulnerability there is these days.

<comment><USER10> If they've deprecated the feature, are they doing anything instead to accomplish the same effect as the UDID?

<comment><USER11> They aren't actually rejectIng apps. But yes, they're replacing it with something akin to androidid. Check the uidevice doc for ios6 if you have it.

The real problem is the lack Of referral tags on installs. Android got this right I think. As it is ever advertiser uses a different hash of some Id whih means I have to store every possible identifier in plain text to hash later. Considering we have 3 million udids, Mac address, etc... This particular leak is unimportant.

<comment><USER9> Are you sure that they aren't rejecting? I've read a fair few stories like this - [http://thenextweb.com/apple/2012/03/29/confirmed-apple- now-r...](http://thenextweb.com/apple/2012/03/29/confirmed-apple-now- rejecting-apps-for-use-of-udid-start-finding-alternatives/) \- that seem to suggest that they are.

</comment></comment></comment></comment><comment><USER12> > If your UDID is contained in the list, take a minute to help us identify the > traitor that did give your information to the FBI without any your agreement > and without warrant !

Wouldn't it also be useful to gather information about who WASN'T on the list and what Apps they have? Maybe device type as well.

<comment><USER13> The device type is given in the leak

<comment><USER12> Sorry I meant in relation to the UDID's not in the list.

</comment></comment></comment><comment><USER14> If I don't play games, much less belong to any social gaming networks, does this affect me at all?

<comment><USER15> Indirectly it affects all of us.

<comment><USER16> *that have iDevices.

<comment><USER15> It affects anyone who lives in a society that is being tracked by their government.

It may be a good thing that the FBI can better track criminals, but if it is used to track political dissidents or to monitor foreign or unpopular companies it should be a concern for us all.

I'm not saying this is happening now, but we should be wary of going down that path.

</comment></comment></comment></comment><comment><USER13> If you've been exposed take some time to help us identify who gave this UDID's to the FBI. (Already working with 3 exposed device owners) <http://news.ycombinator.com/item?id=4473833>

<comment><USER3> Sorry, I don't think this strategy is workable. Consider - 74% of apps I tested sent the UDID to one or more upstream servers. Furthermore, Flurry alone received UDIDs from 15% of apps I tested. That's just one aggregator, and they surely have nearly 100% of UDIDs on file. The APNS tokens narrow it down somewhat, but not too much. It's also not at at all clear that there is a single source involved - this could be an amalgamation of a number of sources.

See this post for the source of these figures:

<http://corte.si/posts/security/apple-udid-survey/index.html>

</comment></comment><comment><USER17> A quick reminder for iOS developers:

Apple has provided a number of replacements for UDID, that address some of the UDID uses without it being as much of a privacy problem. It's all still under NDA, so I posted my summary on the Apple's developer forums (iOS developer login required): <https://devforums.apple.com/message/723147>

</comment><comment><USER18> Has anyone verified that this UDID leak isn't just the old "Goatse Security" leak re-branded? I'm not saying I have any evidence to that, but it seems strange that the "ownage" document didn't mention anything about how the hack was done.

Along those lines, has there been any talk of the attack vector? To get a list like this, it would seem that AT&T (as was the case with "Goatse Security") or Apple would need to be compromised to get this list.

<comment><USER19> They did mention the vulnerability they used

 _During the second week of March 2012, a Dell Vostro notebook, used by Supervisor Special Agent Christopher K. Stangl from FBI Regional Cyber Action Team and New York FBI Office Evidence Response Team was breached using the AtomicReferenceArray vulnerability on Java, during the shell session some files were downloaded from his Desktop folder one of them with the name of "NCFTA_iOS_devices_intel.csv" turned to be a list of 12,367,232 Apple iOS devices including Unique Device Identifiers (UDID), user names, name of device, type of device, Apple Push Notification Service tokens, zipcodes, cellphone numbers, addresses, etc. the personal details fields referring to people appears many times empty leaving the whole list incompleted on many parts. no other file on the same folder makes mention about this list or its purpose._

</comment></comment><comment><USER20> If you disallow an app from sending you push notifications, will it still have your UDID/Device ID? Or if you never enable it, does the app & app server never get it?

<comment><USER21> Push notifications don't use the UDID. They use a different token. UDIDs can be requested without user consent by applications, although that functionality is supposedly deprecated from iOS 5 onwards.

<comment><USER20> thanks for clarifying

</comment></comment></comment><comment><USER22> That ended ubruptly and without much in the way of resolution?

<comment><USER3> Yes, sorry - I'm on the road at the moment, and wrote that in a rush. Part of the problem is that there's not much users can do at this stage. The ecosystem of companies that use and abuse UDIDs is fragmented, and each service that relies on UDIDs for identification or authentication can have its own unique problems. I guess it would be possible to start aggressively releasing a list of services that users should close their accounts on, but that would also be a shopping list for bad guys out to take advantage of this situation.

</comment></comment><comment><USER23> The post adds approximately nothing to the headline.

It's also worth noting that Apple has deprecated the UDID, and new and updated apps are no longer able to access it.

</comment><comment><USER24> Forgive me if I am mistaken, but don't all you need is a UDID to send a push message to a device? I.E. via Urban Airship.

<comment><USER25> No, you need a push token, which is a combination of device id and app id, and is only generated when the user authorizes the app for remote notifications. Additionally, you need a certificate on the server that is authorized to send messages to that app id.

<comment><USER26> The push token is static for the device installation: it is not in combination with the "app id".

[http://stackoverflow.com/questions/2338267/is-the-apn- device...](http://stackoverflow.com/questions/2338267/is-the-apn-device-token- unique-to-each-individual-app)

<comment><USER27> Yeah, but the certificate used to push _is_.

Effectively, it's the same result: you can only push to one app with one set of credentials, and credentials are not shared between apps.

</comment></comment></comment></comment><comment><USER28> The server is really slow, is this being run an an FBI laptop? (asking for people to upload their UDID)</comment>


India's $35 tablet computer - <AUTHOR> http://blogs.suntimes.com/ebert/2010/07/indias_35_tablet_computer.html <comment><USER2> First I thought, wow, in less than a day its price has already gone up from $30 to $35 (<http://news.ycombinator.com/item?id=1540120>).

But then I realized the difference in number as reported by the two news outlets is probably just because of forex translation rates.

</comment><comment><USER3> The R&D approach from the IIT's is a good one, but India, being India, I really wonder how much of that price tag is paying for the political "incentives."

<comment><USER4> I am a bit skeptical about the advertised price tag of $30. Last time when they released a $30 computing device(in 2009, see <http://www.wired.com/gadgetlab/2009/02/indias-10-lapto/> ) it was just a glorified box with 2GB memory. I wonder how they managed to put a touch screen and a functional OS without increasing the cost by even a single dollar.

Anyways this is a big step towards lowering the cost of computing devices.

<comment><USER5> They're putting the reputation of India's best engineering schools on the line, so it can't be far from $30.

</comment></comment></comment><comment><USER6> It's funny how they think manufactures will reduce the price over time instead of adding features to maintain the price/profit point.

At least how they do it here in the states, I mean my netbook was $170 last year and it's still the same price (or higher), just more things thrown in.

Still, it would be neat to have a computing device with decent abilities that could be found for $10 on pegboards @ dollar stores and Walmart, etc. just like calculators.

ps. the Tata Nano is $2000 in India <http://en.wikipedia.org/wiki/Tata_Nano>

but would be far more expensive here, so maybe the same goes for computers

<comment><USER7> $170 netbook? I haven't been able to find anything reputable-esque on Newegg or Amazon for under $250, so I've been holding out for ARM smartbooks and a price drop.

<comment><USER6> Hence my point I guess, prices only are going up, not down for some weird reason.

This is an acer aspire one. I only use it like an hour a month tops but it's nice to have an emergency backup.

I'd like to try it with Chrome OS someday.

<comment><USER7> I conjecture that the problem is that cutting a $250 netbook to $200 drops the price by 20%, but drops margins by a much greater fraction. For now, it looks like the market will bear $300+ netbooks, so we'll have to wait until more competitors enter.</comment></comment></comment></comment>


1966: Tomorrow's World predicted a leisurely 1976 thanks to Mabel the robot - <AUTHOR> https://twitter.com/BBCArchive/status/1007971055279853573 <comment><USER2> My father remembers taking 'leisure classes' which people thought they'd need once everyone had a four-hour work week. He thinks our technology would be quite a ways ahead of where it is if we'd developed a leisure tradition in response to the reduced need for work. I find it strange that our current wave of automation isn't causing similar aspirations outside the UBI crowd.</comment>


Programmer who worked for Bernard Madoff is arrested by FBI - <AUTHOR> http://www.nj.com/news/index.ssf/2009/11/fbi_arrests_two_former_compute.html

<comment><USER2> _Bernard Madoff's Coconspirators arrested by FBI_ would have been a better title.

First, it captures that more than one person was arrested. Second, it wasn't _programming_ that was the crime. It was creating the system for concealing the Ponzi scheme and then being paid to lie to the authorities to keep it concealed that earned them the attention of the FBI.

</comment><comment><USER3> Wow -- 60k is enough to keep these guys quiet? They must have known the river of money coming in. That seems really low.

<comment><USER4> Programmers (or software engineers, if you like) almost never ask / negotiate what they're really worth. I don't see how it would be any different in finance.

<comment><USER5> Probably so. However on Wall Street in general (especially in areas investment banking portfolio management, high frequency trading, etc) programmer salaries in the 100-150k range is the norm. Part of that is simply NYC cost of living, of course, but 60k is really seriously low, even for an entry level gig.

<comment><USER4> > programmer salaries in the 100-150k range is the norm

This is the norm outside of Wall St as well, for anyone who has actual talent and/or experience and isn't a spineless pushover. For example, a truly talented sales engineer can easily make $250k/year + benefits and equity compensation.

> 60k is really seriously low

It was a 60k bonus.

<comment><USER6> actually $250k is kinda low. a ludicriously talented sales engineer (level 60 of course) can easily make a bajillion dollars a year if not more...

</comment></comment></comment></comment></comment><comment><USER7> I find myself wondering: How exactly would you go about doing the ethical thing in a situation where you realize your work is such that you're being offered hush money to stay quiet about it?

I don't mean "how" in terms of "how do I know the right thing to do", more a question of what, exactly, is the best way to do the ethical thing without getting burned.

Is it better to take the hush money and pretend to be satisfied, then whistle- blow to the FBI once your corrupt boss thinks you're happy? What kind of evidence would you need in order to convince an FBI agent, in a phone conversation, that you are calling in a real crime and not just a prank? If your law-enforcement contact asks you to wear a wire to work and have a leading conversation with your boss, should you do it? What kind of corporate espionage do you perform to make sure a corrupt business does not shred or cover up evidence?

Maybe I've been seeing too many spy movies recently, but I find myself fascinated by questions like that.

There's lots of hacker literature about what to do when you're an employee in the middle of an unsuccessful company, and some about what to do when you are attempting to catch a cracker or other computer saboteur on your network, but I don't think I've ever seen a story or essay on the subject of what to do when your company is not merely clueless but literally criminal.

<comment><USER8> Honest people do not write software to defraud investors. Despite the story, they had no stroke of conscience convincing them to leave. You would _never_ tell a criminal organization that you're going to expose them unless you're blackmailing them; there would be no benefit. These guys are con artists.

I think an honest, rational person would contact the FBI in private and seek their counsel on how to proceed.

<comment><USER7> Yeah, my questions don't really apply to the pair in the story; they knew from the beginning that the software was for fraudulent purposes, and simply lost their nerve after a while, then got arrested anyway on charges of conspiracy. Getting cold feet after the crime has been committed does not earn you leniency.

I suppose I'm thinking of it more along the lines of, say, the person in the next cubicle/department over who knows about such software and wonders what to do about it.

Contacting the FBI and asking the professionals what to do is the most obviously correct path. It's just a matter of curiosity that I wonder what they would say, and whether the advice would work.

</comment></comment></comment><comment><USER9> I get the feeling these guys were looking up the definition of money laundering in the dictionary.

</comment><comment><USER10> They (allegedly) programmed a computer to generate false records. It's not like they created a trading model that happened to break an esoteric SEC law, it was probably pretty darn clear to these programmers that they were doing something illegal.

<comment><USER11> If I were running a Ponzi scheme, and I needed to generate fake results, I might ask developers to create a program that generated a month's worth of random trades (perhaps explaining that this was a way to test the expected commission + slippage of a strategy that covered a given volume and mix of securities). Then I'd run it twenty times and pick the top result. Being in the 95% percentile every month was close to what Madoff did; he never showed extraordinary profits (except to people who were apparently in on it), but did show incredibly consistent returns of ~1% per month.</comment></comment>


Demo self driving cars working through the blockchain (Open Source) - <AUTHOR> http://moovlab.online <comment><AUTHOR> Hello all, I've been working on an open source project to demonstrate how self driving cars may work with the blockchain to deliver a decentralized ride hailing experience. No middle man means no extra commission fees. This is part of a larger concerted effort to decentralize ride hailing services like Uber and simultaneously make self driving car technology free and open to all people. If you are curious you can find more at moovnow.org</comment>


Show HN: MadeForHackers.com - Kick ass landing pages, for kick ass hackers. - <AUTHOR>

Hi everyone! Im pleased to introduce MadeForHackers.com which is a tiny agency focused on designing beautiful handmade landing pages, user interfaces and logos for hardcore developers, like you guys.
This project is focused exclusively on helping hackers like you, stay focused on what you do best: Hacking.
I know there are a couple apps that helps you build landing pages but MadeForHackers offers handmade, unique and beautiful landing pages but also user interface design for web, mac, iphone, ipad, android, pc and logo designs at very competitive and accesible prices.
Each design is thought uniquely for each client.
Feel free to contact me anytime at firstname.lastname@example.com
Cheers, Nico. <comment><USER2> Some typos:

Original: '...interfaces design at very accesible prices. Are you a hacker? Make your self home.'

Corrected: '...interface design at very accessible prices. Are you a hacker? Make your self at home.'

Otherwise, nice idea! There's certainly a need for this, for many hackers...

</comment><comment><USER3> "Handmade" and you're using stock icons on your own landing page?

Apart from that, I think it's a great idea.

1\. Focus even more. ONLY do landing pages.

2\. Make sure there are at least 4 examples we can see.

3\. Set a fixed price.

</comment><comment><USER4> Needs full site / images for examples, IMO. The dribbble is nice, and I think shows good taste, but a 400x300 corner-image is not a website. Demo what you're selling, not just your style, and either way, more!

edit: and FYI, yiipu.com is coming up with broken images, and roll-overs for your buttons aren't loaded either. Though it seems your site is now being HN'd, so that could be the cause. For the buttons specifically, eager-load those things, a load-on-mouseover generally strikes me as an oversight.

</comment><comment><USER5> Sweet project, but just a heads up: you forgot to set some fallback fonts for the Pricing area. I, and probably most people you're targeting, don't have Helvetica 55.

</comment><comment><USER6> great idea, but it seems like you're making everything look very "stock". i suppose if you want your startup to look like another "web 2.0" company, then great, but I'd like to see some examples of how you took a personalized brand and turned it into something exceptional.

you're also charging way too much, and i hope your ad copy is just placeholder. i spend a lot of time on the internet laughing at LOL Cats (i admit it), but you can really do better than to name your pricing tier "I can haz design". evne for a proof of concept, maybe aim for a bit of professionalism.

i feel like the 3-option pricing tier image is really overdone (guilty of this myself) and you can easily find a more creative way to display, well...your creativity.

in all, i love the IDEA but the implementation is lackluster. you provide an easy way to get a cookie cutter image, which works for some people, but serious startup can afford to pay for a unique design. cheapskates like me can just spend an afternoon in photoshop mocking up the same things that you're offering for well under $400.

keep at it, and keep honing your design chops, because the core idea is sound.

</comment><comment><USER7> Dont feel me, bro!

<http://madeforhackers.com/x/2.5.png>

Good tagline for a tshirt, not for a business

</comment><comment><USER8> Your header is broken (meta tag is missing its closing part) and your google analytics code is visible on page. Not really inspiring confidence ...

<comment><AUTHOR> Thanks for the heads up. Fixed! :)

</comment></comment><comment><USER9> wayyyy too pricey!

Everybody here can probably code a "nice" landing page and use launchrock widget.

You should maybe make something more standard, closer to launchrock but with more customisation like A/B testing, integration with Mailchimp/sendgrid/whatever

I would pay less then $100 for that anyway.

<comment><USER10> I haven't had time to review his portfolio and decide if he's worth it, but that is not too pricey. The fact that you wouldn't pay $100 for it does not mean it's without value.

Everybody here can code a nice landing page? I see thread after thread of Hackers saying "Hey! I don't don't know much about design, where do I start?" or "Where can I find an affordable skilled designer?". If your user interface / design skills (as well as HTML & CSS code) are truly up to par, congratulations, but there are many here who are not.

If you prefer to work through things on your own and wouldn't consider paying $100 for a professional designer's time, that's fine, it's your choice. Posting that this is too pricey is an extreme fallacy and in my opinion, required correction.

</comment></comment><comment><AUTHOR> Linkeable: <http://www.madeforhackers.com>

</comment><comment><USER11> Could do with more of a portfolio of previous work - there's not much to go on at the moment.

<comment><AUTHOR> You can see some snapshots from previews works here: <http://dribbble.com/nicogarcia>

</comment></comment><comment><AUTHOR> Thanks for the feedback everyone

UPDATE: Prices and typos fixed!

</comment><comment><USER12> I love this, and I need this - but I don't $99 need this -- I $20 to $40 need this....</comment>