AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types - <AUTHOR> http://pastebin.com/nfVT7b0Z <comment><USER4> Money quote for the people that don't want to wade through ten pages of rant:

      During the second week of March 2012, a Dell Vostro notebook, used by
      Supervisor Special Agent Christopher K. Stangl from FBI Regional Cyber Action
      Team and New York FBI Office Evidence Response Team was breached using the
      AtomicReferenceArray vulnerability on Java, during the shell session some files
      were downloaded from his Desktop folder one of them with the name of
      "NCFTA_iOS_devices_intel.csv" turned to be a list of 12,367,232 Apple iOS
      devices including Unique Device Identifiers (UDID), user names, name of device,
      type of device, Apple Push Notification Service tokens, zipcodes, cellphone
      numbers, addresses, etc.

<comment><USER5> This is very disturbing. How did the FBI gain access to all this information? It should be locked up in Apple.

From what I see, the NCFTA in "NCFTA_iOS_devices_intel.csv" looks like it stands for the National Cyber-Forensics & Training Alliance, which "functions as a conduit between private industry and law enforcement." (<http://www.ncfta.net/>)

Is Apple willingly sharing personal information with the FBI through the NCFTA?

<comment><USER6> Doesn't a popular iOS developer have the same information?

UDIDs, APNS tokens (for push notifications), basic demographic information is something a popular social app or game might have. 12 million is a pretty good number, though.

edit: our iOS app has over 2 million of these type of device records (though we don't collect any demographic info, so just device ids, apns tokens, device names, device types -- standard for push notifications).

[http://developer.apple.com/library/mac/#documentation/Networ...](http://developer.apple.com/library/mac/#documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/ApplePushService/ApplePushService.html)

<comment><USER7> iOS developers don't have the Apple IDs nor ZIP codes nor addresses (unless they separately ask for them but at least the apple ID is very uncommon)

<comment><USER6> There are no "Apple IDs" in here. Just Apple device UDIDs.

<comment><USER7> You are right. I misread the announcement. That still leaves the issue of the personal data, but as I said: app developers could acquire that directly from the user.

Possibly, the fact that personal data is missing so often actually might point to a non-apple leak, because they would have the link to personal data. Of course it could be fake, but it would be prsesent.

<comment><USER8> When he said "a popular iOS developer" I assumed he meant Facebook.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> This is huge. I've been fearing this kind of leak for a long time. If you're unsure why this is huge, here are some posts of mine on this issue showing de- anonymization, complete takeover of social media accounts, and more:

De-anonymizing UDIDs with OpenFeint: [http://corte.si/posts/security/openfeint-udid- deanonymizatio...](http://corte.si/posts/security/openfeint-udid- deanonymization/index.html)

A survey of how UDIDs are used: <http://corte.si/posts/security/apple-udid- survey/index.html>

Why the Apple UDID had to die: <http://corte.si/posts/security/udid-must- die/index.html>

I've often been asked what I thought the worst-case scenario is regarding the mis-management of UDIDs. My answer has always been that a large UDID database leaking would be a privacy catastrophe...

</comment><comment><USER10> One interesting thing I've found is that apparently 190 of those 1000001 people have named their devices "The Titanic", for that iTunes "The Titanic is syncing" pun. I'm curious if there's anything else interesting that might be found in this data.

<comment><USER11> I seem to see a disproportionate number of pro photographer accounts (grep for dot coms as device names) which might point to some commonality--some photo app? A quick search showed more female email addresses, but not sure if this is related to the source or if it is related to the likelihood of women using their email addresses as device names.

</comment></comment><comment><USER12> This is troubling on so many levels. Why did an FBI agent have a document of user and device info on his desktop and the real question is why are the FBI tracking this information in the first place? Surely this is illegal.

By the way, I think AntiSec needs to hire someone to write their releases for them. I struggled at times to make sense of the almost gibberish in their rant-filled sentences and at times some of the things they were saying read like the paranoid ramblings of a crystal meth addict. It wasn't until the end where everything they were saying was put into perspective and I understood what they were talking about.

<comment><USER13> I was confused by the writing style as well. It seems to be almost intentional. I wonder if it's a way of avoiding any style or nuances that could be attributed to a single person. Almost like a cut and paste ransom note.

<comment><USER14> It's elite (or 1337 if you will). It's supposed to sound cool. All the underground computer groups have talked like that since the early warez/cracking/phreaking scene.

<comment><USER15> Are you sure they're not just really bad at writing?

<comment><USER16> A lot of the "scene" traditions and symbols has a lineage back to adolescent boys in the early 80's as that's when many of the influential groups exploded onto the scene, so even if they're emulating a traditional style, they're emulating one that arose out of kids who wrote badly who tried to sound cool.

(I've some really horrible examples to my credit too, but thankfully I don't think any of it has survived)

</comment></comment></comment></comment></comment><comment><USER17> I can't believe with nearly 100 comments I appear to be the only one to call the whole story of how these were acquired into doubt.

I'm not saying that the FBI story isn't true, but so many comments here just assume it to be 100% factual - there's no evidence that it was taken from the FBI vs found on a USB Stick in the garbage.

It's a big story, yes, but I think maybe a deep breath is in order before we all accuse the FBI of leaking/losing/stealthily acquiring something!

(I'm not a US Citizen, btw)

<comment><USER18> I guess we better start tracking everything the FBI does. You know, so we can prove their innocence.

Besides, what's the big deal... if they have nothing to hide then they have nothing to worry about!

<comment><USER19> Nitpick: While I agree with the idea (of accountability), the fact of the matter is that the FBI--being what they are and doing what they do--actually _does_ have things to hide, often with good reason, even.

</comment></comment></comment><comment><USER20> I have found my own UDID - I can confirm these are real UDID's - and now I want to know why an FBI agent had my (a brit) UDID on their laptop.

<comment><USER21> What apps do you have installed? This is interesting to know since the data might be from a popular app instead of Apple.

<comment><USER20> Whatsapp, ebuddy pro, ebuddy XMS, Angry Birds, Angry Birds Space, FML, XKCD, Facebook, Spotify, BBC News, Dropbox, Steam and PokerStars are the more popular ones official I have installed. I also have Cydia, a few tweaks and finally Installous (didn't want to admit that - I don't use it often - <USER2> thought it may spread some light here)

<comment><USER22> I run Cydia, and have determined only 16.7% of the UDIDs in that file are from jailbroken devices: I thereby do not believe that whatever managed to get this data is anywhere in our ecosystem.

<comment><USER23> Do you have similar information stored about the Cydia users? How many users do you have?

<comment><USER22> The question "how many users do you have" is impossible to answer, as all I can ever demonstrate is "X users used Cydia in the last Y period". As for your second question, the information I have for your average Cydia user (one that is not actively paying me money, in which case I obviously have tons of information) is purposely highly limited: I certainly do not have, for example, the "names" of devices that was included in these dumps from AntiSec (which often discloses the name of the user), or any of the other personal details that are claimed to be in the original file.

<comment><USER23> Thanks!

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> Refresh my memory - aren't the device tokens for the Apple Push Notification Service application-specific? That suggests this data comes from a single application, not Apple. The patchy personal information columns also suggests that this is a single (somewhat grabby) application's data store - <USER3> Apple would have more comprehensive records.

My wild speculation, assuming what we're told is true - the application developer shared this information with the NCFTA, who in turn shared it with the FBI. (After all, that's what the NCFTA does.) The application developer may have shared this information because they wanted the FBI to investigate a 'cybercrime' of some sort against them - who knows what, in-app purchase fraud? That could explain why the data ended up on this FBI agent's desktop.

EDIT: I refreshed my own memory - APNS tokens are device-specific, not device+app specific. I still think this is a single application's data dump, if the statement about sparse personal info is true.

<comment><USER25> I doubt that they are a single app's data. Look at the repeat of certain Device names (try "Abo Mossa") and check their UDIDs - those UDIDs show an incremental pattern in their first 3 digits. This tells me: (a) those devices were bought in bulk and (b) those devices were never sold to one person - since the Device names were unchanged [assumption is that a regular customer cannot own so many devices]. I just don't see how one app (not pre-installed) could be on all the devices bought in bulk by one person and dump all its data to FBI.

<comment><USER22> The UDID is a SHA1 of a few fields (including a couple MAC addresses): we actually know the exact algorithm; if you are seeing patterns in them it is either a trick your brain is playing on you or a trick the user is playing on you (some people modify their UDID occasionally to keep themselves from being tracked by apps).

<comment><USER26> How do you modify the UDID? Does it depend on the model?

<comment><USER22> At some point, the UDID is being processed by code, so you don't really need to permanently modify anything: you just edit the code that generates it and make that return something different. These kinds of changes are very simple using Substrate, the library we all use (that I developed) for changing code at runtime. For the UDID, the obvious candidates are "edit every app so [UIDrvice uniqueIdentifier] returns fake" and "edit lockdownd so it calculates the wrong value every time it is generated".

</comment></comment></comment></comment></comment><comment><USER27> Looks like they've got Obama's iPad:

thea:Downloads admin$ cat ./iphonelist.txt | grep -i obama '473d6e1ebf0b100ed172ce5f69c97ba6c8f12ad5','766a23201c6089be11845bfef624dbaada68be52155079850951836e9373e5cd','hobamain','iPad' 'c63e008e6271c3ac128eb6a242a9817528b6baef','b996a080e11265a0c93436ba0b13b7c07ee4e8eef6faeb8516917b015d7355fb','Obama','iPad'

<comment><USER28> Openfeint shows that 'Obama' last played 'Fishing Fun 2'

        curl 'https://api.openfeint.com/users/for_device.xml?udid=c63e008e6271c3ac128eb6a242a9817528b6baef

        <?xml version="1.0" encoding="UTF-8"?>
        <resources>
        <user>
        <chat_enabled>true</chat_enabled>
        <gamer_score>160</gamer_score>
        <id>1479631313</id>
        <last_played_game_id>165632</last_played_game_id>
        <last_played_game_name>Fishing Fun 2</last_played_game_name>
        <online>false</online>
        <profile_picture_source nil="true"></profile_picture_source>
        <profile_picture_updated_at nil="true"></profile_picture_updated_at>
        <profile_picture_url nil="true"></profile_picture_url>
        <status nil="true"></status>
        <uploaded_profile_picture_content_type nil="true"></uploaded_profile_picture_content_type>
        <uploaded_profile_picture_file_name nil="true"></uploaded_profile_picture_file_name>
        <uploaded_profile_picture_file_size nil="true"></uploaded_profile_picture_file_size>
        <uploaded_profile_picture_updated_at nil="true"></uploaded_profile_picture_updated_at>
        <name>Player 1479631313</name>
        </user>
        </resources>

<comment><USER29> Seriously? Personal info about the President was leaked? Not that this particular instance looks like a big deal. Doesn't the NSA secure the President's communication? That must be carrer-impacting-embarrassing for _someone_.

<comment><USER30> Personal information about someone who had their device name set to "Obama". Let's not get all crazy now.

<comment><USER31> $ cat iphonelist.txt | grep c63e008e6271c3ac128eb6a242a9817528b6baef 'c63e008e6271c3ac128eb6a242a9817528b6baef','b996a080e11265a0c93436ba0b13b7c07ee4e8eef6faeb8516917b015d7355fb','"Administrator"的 iPad','iPad' 'c63e008e6271c3ac128eb6a242a9817528b6baef','b996a080e11265a0c93436ba0b13b7c07ee4e8eef6faeb8516917b015d7355fb','Obama','iPad'

Looks legit...

<comment><USER32> You do know that there are other people in world with the name Obama, right?

I know for a fact, the NSA protects all communications from the president (and most of the top level folk in his administration). If this turns out to really be the president (which I doubt) it would be a MAJOR breech.

<comment><USER33> For a fact? How so?

<comment><USER34> It was an issue widely covered in the press, or at least widely covered enough that I remember people joking about it in monologues. Obama wanted to keep his blackberry and other gadgets in opposition to what the Secret Service wanted. They finally compromised with security-enhanced versions of the devices such as his so-called "Blackberry One" a pun off of Air Force One.

Though I didn't hear anything about securing it when he got an iPad, I did see photos in the news of him carrying one. I would assume it would be equally vetted and locked down.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER35> DL links for the lazy:

<http://freakshare.com/files/6gw0653b/Rxdzz.txt.html> <http://u32.extabit.com/go/28du69vxbo4ix/?upld=1> <http://d01.megashares.com/dl/22GofmH/Rxdzz.txt> <http://minus.com/l3Q9eDctVSXW3> <https://minus.com/mFEx56uOa> <http://uploadany.com/?d=50452CCA1> <http://www.ziddu.com/download/20266246/Rxdzz.txt.html> <http://www.sendmyway.com/2bmtivv6vhub/Rxdzz.txt.html>

<comment><USER36> why does an FBI agent have 12 million+ identification numbers for iOS devices?

<comment><USER37> This is the stated reason for the release - to have people ask why an agent has 12m UDID numbers on his laptop. They released 1m out of the 12m UDIDs so that they can guarantee a statistical sample that can be verified, while preserving a bit of privacy.

Along with the UDIDs were other columns with an assortment of personal data, although there were a lot of holes.

<comment><USER38> How large would a 12m line long .csv file be?

Not sure how many bytes per entry, but it would be of the order of gigabytes.

<comment><USER39> It would probably compress well

</comment></comment></comment></comment></comment><comment><USER40> Question: is it possible for a malicious hacker to use this information for anything? E.g. sending rogue push notifications to a user, or tracking down a user's additional personal information by knowing his/her device UDID or APNs token?

I sincerely hope both the U.S. government and Apple address this. I'd also be interested in hearing why Apple chose to have hardware coded unique ids for each device.

<comment><USER41> If a webservice tries to send a push notification to a device that has not registered for push notifications for the entitlement requesting the notification to be sent, the notification gets discarded. Remember, all notifications are to be pushed to Apple using a certificate generated on a per-app basis, who in turn pushes the message to devices.

</comment></comment><comment><USER42> I like the card AntiSec is playing:

      well we have learnt it seems quite clear nobody pays attention if you just come
      and say 'hey, FBI is using your device details and info and who the fuck knows what
      the hell are they experimenting with that', well sorry, but nobody will care.

Arms race for attention, while the government races towards quieter actions and laws...

</comment><comment><USER43> Marco Arment thinks that the All Clear ID app is responsible for this leak: <http://www.marco.org/2012/09/04/fbi-udid-leak>

Can anyone who can confirm they're on the list confirm that was one of their apps?

<comment><USER44> This guy says he's in the dump and didn't use AllClear ID. <https://twitter.com/BFormations/status/243044444595687424>

</comment></comment><comment><USER45> If you've been exposed take some time to help us identify who gave this UDID's to the FBI. (Already working with 3 exposed device owners) <http://news.ycombinator.com/item?id=4473833>

</comment><comment><USER46> Putting a file of user data on a laptop is a fireable offense at at any reputable organization. Sad that the FBI is less careful about user data protection than consumer Internet companies.

<comment><USER47> The laptop was compromised while running. We do not know whether the disc was encrypted or not.

<comment><USER48> If it was exploited through the JRE, then it doesn't really matter...

<comment><USER49> On the other hand the disk or better said the partition with sensitive data should decrypted (mounted) only when needed. I doubt he needed that data during the conference.

</comment></comment></comment></comment><comment><USER50> Apple could probably figure out if this data came from an app developer because I'd bet there's only exactly one app which every single one of those 1,000,001 devices downloaded.

Even if they threw in a few fake rows to mess up the data, they could find the app that has the highest percentage of downloads from that entire data set.

<comment><USER51> And if the data came from Apple?

I can't think of any apps that take a full address. Perhaps there are some, I just don't know them.

Apple could have been compelled to release this data to the FBI. Unfortunately, we're unlikely to ever know this and Apple are equally unlikely to want to shed light on it.

If the claim is true, that the source data included full postal address, then I find it hard to identify a better source for all of that than Apple themselves. And that the data was brought together from various systems, and that we're glimpsing data that was shared between Apple and the FBI.

Not to say that there's anything illegal about that, more that the laws that allow that are a bit screwed but that's another issue altogether.

<comment><USER52> A reasonable assumption, besides Apple, is Facebook. With all the information these services have the easiest part may be to acquire your home address.

</comment></comment></comment><comment><USER53> interestingly enough, top ten ios devices names:

      42797 'iPhone'
      5191 'iPod touch'
      3136 '"Administrator"的 iPad'
      2202 '"Administrator"的 iPhone'
      1534 'Owner's iPad'
      1453 ' iPhone'
      1309 'Administrator's iPad'
      1196 'Administrator's iPhone'
      1141 'PdaTX.Net'
      1058 'John's iPad'

<comment><USER25> If you look at the UDID's for the '"Administrator"的 iPad's or '"Administrator"的 iPhone's, there seems to be an incremental pattern in their first 2-3 digits. Does that mean these devices were purchased/ordered in bulk and hence belong to some reseller? In which case, these must not have been sold to people and thus we don't see change in the Device names maybe? And thus the claim that this came from one or two apps seems a bit infeasible, no?

<comment><USER6> maybe an enterprise location or school that bought in bulk?

<comment><USER25> Wouldn't the devices' names still be changed when individual members of the enterprise/school activated them?

<comment><USER54> Devices being used in a kiosk-like or other setting in which they are mostly not being used by people who would be responsible for activating them?

</comment></comment></comment></comment></comment><comment><USER55> Just made a page where you can check if your UDID is leaked: <http://pastehtml.com/udid>

</comment><comment><USER56> We've recently discovered that even though the Apple docs suggest the APNS tokens may be unique to each app and may change over time they are NOT unique to an app and they also do not change (at least not over the last 18 months).

So if you have two apps on the same device they both share the same UDID _and_ the same APNS token.

Whilst on the surface this may seem like a huge security issue it is not as bad as it seems, because in order to send push notifications to a device you must have the correct APNS .p12 certificate generated by Apple for the app AND the app must be installed on that device.

I would see the UDID's as more of a security breach given the fact that many developers are still using the now depreciated udid to interface with web services.

On a similar note, If you are developing an app and need to have a unique identifier you should be using Secure UDID or something similar <https://github.com/crashlytics/secureudid> and if you're sending data to you're own webservice, don't just use SSL, use encryption such SHA to prevent mitm sniffing of your data - Both iOS and Android both allow installation of root CA certs which is amazing for developing and sniffing API's but dangerous if your writing webservices and ONLY relying on SSL and no other encryption.

<comment><USER57> > you should be using Secure UDID or something similar

As an app developer, does this give me some benefit over just generating and saving a random UUID on first launch?

<comment><USER58> If you save the random number, what happens when they wipe the device and reinstall your app? No way to get that original number back. Secure UDID is deterministic, so you'd get the same ID, and can resume the original session.

<comment><USER59> One way around this is to store that number in iCloud. Then you can always get it back no matter the device.

</comment></comment></comment></comment><comment><USER60> Wow, this is bad, and an excellent example of how the security machine (in this case FBI) can always be turned on itself. The methods required for FBI to "protect" citizens can be misused (or hacked) to do the opposite. A gun can always be turned around, etc.

</comment><comment><USER61> video of the special agent.

<https://www.facebook.com/video/video.php?v=512364171294>

<comment><USER62> His delivery is painful to listen to.

<comment><USER63> Not everyone is a polished orator.

<comment><USER59> Practice in front of a mirror or video camera a few times. Write some notes. It's not too hard to get competent, even if you can't become phenomenal.

</comment></comment></comment></comment><comment><USER64> The fact that there is a column for APNS (Apple Push Notifications) suggests that this is a database dump from an iPhone app that supports push notifications. APNS tokens are generally tied to a specific app so it may be possible to figure out what app leaked their database.

The "NCFTA" seems to deal with identity theft. (Ironic)

<comment><USER65> _APNS tokens are generally tied to a specific app so it may be possible to figure out what app leaked their database_

This isn't true, APNS device tokens are shared among apps on a device. The only time a device will have more than one device token is if it's being used for development.

This isn't to say that Apple couldn't correlate the device tokens by looking for shared apps with active APNS entitlements.

<comment><USER66> I don't think so. The device token is even generated over the version of the app. Meaning: you get a new device token if the app version changes.

<comment><USER22> No: the APNS token is only changed if you get a new device (as it is tied to your device's certificate) or restore your phone (and not restore a backup: if you restore a backup it restores the token).

[http://stackoverflow.com/questions/2338267/is-the-apn- device...](http://stackoverflow.com/questions/2338267/is-the-apn-device-token- unique-to-each-individual-app)

</comment></comment></comment></comment><comment><USER67> If the full file (including addresses) gets into the wild, and I fear that this may happen, it will be a really useful tool for burglars. Many iOS devices probably correlate with many valuables in a home. That's a lot of lawsuits against everybody involved...

<comment><USER68> Pretty sure that a smart burglar could figure out approximate addresses of people who own iPhones by looking at publicly available Instagram or Twitter or Facebook or Flickr locations. Not to mention people telling the world "I'm camping this weekend" which a burglar hears as "I'll be gone all weekend, steal my things!"

<comment><USER69> I think a smart burglar would just look at any commonly available database of home sales. Anybody who has moved in the last few years into a more-expensive- than-average house should correlate much better with valuables than iPhones.

However, I'd hope any criminal with brains like that would find something to do that has higher yield and lower risk than housebreaking. I'd suggest working for a private equity company.

<comment><USER68> Yeah i'm not really worried that burglars are going to use this data-set for harm. If they know about this data-set they likely know about databases of home sales or car sales or just plain old census data listing the average income by county.

</comment></comment></comment></comment><comment><USER70> There's a pretty nice power law in the names, which would support a real random sample. <http://tinypic.com/r/11gmwjl/6> That PDATX.net business is really weird, though.

</comment><comment><USER71> Has anyone here found their own UDID in the list?

<comment><USER72> I checked and didn't find my own iPhone, iPad or my wife's iPhone in the list.

</comment></comment><comment><USER73> Is there some good reason for all those steps to actually get the file after downloading? I don't see the point of encrypting it, or of having a tarball with just one file. They also suggest checking the file integrity of the download, and then also checking the integrity of the final extracted file-- this seems completely pointless as the final extracted file is derived deterministically from the download so you've already checked it when you checked the download checksum.

Am I missing something?

<comment><USER74> Encrypting it, at least, makes sense: They can take their time distributing the file without anyone peeking at it before they're suppose to. Then, when they release the decryption key, the file is already copied all over the place and really hard to shut down.

Guess all the verifying means they are afraid someone will distribute "altered" versions. Checking it twice is maybe a little drastic? Don't know how hard it is to generate a file that compresses to the same as their file (collision). But it's at least theoretically possible.

<comment><USER75> MD5 is not the best cryptographic hash... it's weird that they would be so paranoid as to include two hashes but not use something harder to collide with.

<comment><USER76> While I agree there's better options, MD5 has no known preimage attacks. So it's stretching it a bit to imply that someone could easily cause a collision on an existing archive.

</comment></comment></comment></comment><comment><USER77> Can someone tell me what the AntiSec can do with these UDIDs? I mean they are just phone identifiers, what harm can their exposure cause?

</comment><comment><USER78> Haxxors, what can we lay people with no computationalizing skills do?

<comment><USER79> Get informed, and inform.

Then, one can hope, the government might actually be forced to engage in meaningful discussion about whether their ridiculously expensive and obviously damaging espionage programs make sense.

<comment><USER24> It's far more likely that this data was willingly shared by an application developer who was the victim of a crime the FBI is investigating.

Not everything is a government conspiracy.

</comment></comment></comment><comment><USER80> The question of evidence is a very significant one.

Namely, why has AntiSec not provided any to substantiate their claim that the data was sourced from the agent's laptop? Surely if they had access to it they could have provided some additional files as supporting evidence?

</comment><comment><USER81> UDID checklist: <http://dazzlepod.com/apple/> Partial UDID search accepted, i.e. search "d565" instead of your full UDID "d56504ca3b268177f76fef0c2c446ba183afd12b"

</comment><comment><USER82> so, any of you iOS guys find your device? it'd be interesting to know what apps you have in common (if any)

</comment><comment><USER83> They wrote in the release that they wouldn't give any more interviews until they saw "Adrian Chen get featured on the front page of Gawker, a whole day, with a huge picture of him dressing a ballet tutu and shoe on the head, no photoshop."

Chen, a journalist at Gawker, actually did it: <http://gawker.com/>

Not even bothering to submit this as a story to HN because I'm pretty sure Gawker links get auto-killed (with good reason, the Gawker article is crap).

</comment><comment><USER13> As an Australian I am intrigued by the following:

 _just a comment: we are still waiting for published news about the $ 2 billions worth loans Assad has taken from Russia, mentioned on the syrian mails and also about the transfer of money to austrian banks etc.... and also cocks... So, don't be lazy journos and look for them._

Any one have any additional info on that?

EDIT: Derp...thanks for the correction. I read too fast. Still intrigued if anyone knows anything more.

<comment><USER84> _Austrian_ banks.

<comment><USER85> "Austrian, eh? <puts on australian accent> Let's put some shrimp on the barbie!"

<comment><USER86> Paul Hogan hammed up his Australian accent.

One of the best examples of a real Australian accent I've heard on American television is Dr. Chase [Jesse Spencer] from House, who is a real Australian and did not ham it up for an American audience. (Oddly though, the man who played his father in one episode had possibly the most embarrassingly bad fake Australian accent ever. Surprised Spencer didn't kick his arse during filming.)

<comment><USER47> You do not get real foreign accents on prime time American television, the viewers would be bemused and look for subtitles.

You get what Americans think are foreign accents, i.e. lightly accented. The one exception is that Brits playing bad guys are allowed to use camp, pantomime villain accents. Alan Rickman has made his fame and fortune from this, a shame as he is rather a good actor.

Hugh Grant sounds nothing like he does/did before that series started.

</comment></comment></comment></comment></comment><comment><USER87> I'm still somewhat unclear on the dangers involved with this leak (other than the likelihood of being tracked), but this link seems relevant: [http://www.cultofmac.com/160248/what-the-hell-is-a-udid- and-...](http://www.cultofmac.com/160248/what-the-hell-is-a-udid-and-why-is- apple-worried-about-them-feature/)

<comment><USER87> Hmmm, it seems that despite removal of the personal info, there may be ways to link it back to partial profiles via OpenFeint... [http://corte.si/posts/security/openfeint-udid- deanonymizatio...](http://corte.si/posts/security/openfeint-udid- deanonymization/index.html)

also: <http://corte.si/posts/security/udid-must-die/index.html>

<comment><USER6> Yep... well, based on this, I was able to fill in a UDID from the file and pull back an openfeint result. It didn't pull any sensitive information, but it worked. so seems to be real udids.

</comment></comment></comment><comment><USER88> Find out if your udid has been compromised <http://udid.afitnerd.com/>

</comment><comment><USER89> Didn't see this posted. Check to see if your UDID was on the list. Obviously it only checks the one million that were released. - [http://thenextweb.com/apple/2012/09/04/heres-check-apple- dev...](http://thenextweb.com/apple/2012/09/04/heres-check-apple-device-udid- compromised-antisec-leak/)

</comment><comment><USER90> 508 email addresses (.com, .net, .org, .edu) used as iOS device names in this file, and several hundred phone numbers.

</comment><comment><USER91> This demonstrate once again the antagonism of beeing able to ensure security as was complained to be lacking for the 9/11 and that no honnest citizen gets trampled by it.

I can't see a way out of spying it's own cytizen and keep them in the beleif they aren't to achive the goal.

One of the question to be asked is who is controlling the controllers ?

</comment><comment><USER92> I think this leak plays for FBI in PR sense, not against it. All support slogans in the _anonymous message are exact description of the US foreign policy, so this message support distribution of wreck and havoc of people's lives in the third and second world. All this is rather strange.

</comment><comment><USER93> Hi, first time here. I'm from Malaysia with a Jailbroken Ipad 2 as well. To my surprise, my device shows up on the <http://pastehtml.com/udid> link.

So now what does this all means? (and) I've never been to US.

<comment><USER33> They're coming for you. Run!!

</comment></comment><comment> brown9-2 I think there is another part of this alleged story that is equally as disturbing as the FBI having this data in the first place:

that an FBI agent's laptop, let alone an agent in the "Cyber Action Team", was susceptible to a common Java vulnerability.

</comment><comment><USER94> O proprio Governo dos EUA nos Da essa BRexa eu sou Brasileiro e ja comsegui diverssas vezes invadir o site da aplle e Microsoft ee agora ireii tentar o do FBI em um COmputador Externo :D me Desejem Sorte

</comment><comment><USER95> FACEBOOK? If I had to bet on any company I would bet on Facebook as the main/top source of this data. Where else can you easily be profiled so easily by liking or sharing content the Big Bro would deem as subversive. Followed by phone carriers since they have already been working with Big Bro, then apple and google. Combine these and you should be able to know everything you want. Govs probably won't deal with smaller companies lest increasing chances of leakage, etc.

</comment><comment><USER96> If you want the list you can download it here, <http://fileurl.me/41ld1>

<comment><USER97> I HATE YOU!!!!

"Please complete this survey to continue"

</comment></comment><comment><USER97> What do I do wrong?

$ tar -xvzf decryptedfile.tar.gz tar: Unrecognized archive format tar: Error exit delayed from previous errors.

</comment><comment><USER98> What's an easy way to figure out the UDID of a device (without hooking it up to a Mac to sync)?

<comment><USER6> there's a bunch of UDID apps (free) that you can download from the App Store.

<comment><USER23> Don't iOS apps have the permission to use the internet without any hassle? In that case, I would assume by using such app, chances are, you are contributing to another entity's UDID collection.

<comment><USER99> If in doubt, download and turn flight mode on before running, then uninstall?

</comment></comment></comment></comment><comment><USER100> What does ofc stand for?

<comment><USER101> Ofc = of course

</comment></comment><comment><USER102> the only thing to quench the appetite for additional wealth is the dirt of the grave

</comment><comment><USER103> ok, FBI have all information about us, and now? what we gonna do?? come on guys...

</comment><comment><USER104> Terrifying!

</comment><comment><USER25> If you look at line #'s 3741 through 3845, you will see they all (105) belong to one Abo Mossa. Is Abo Mossa some kind of an iPhone/iPad reseller or is there something else going on?

<comment><USER22> He probably is using a tool that spoofs his UDID... a lot. ;P

</comment></comment><comment><USER105> > 'Yip\'s iphone(in the memory of steve jobs)'

</comment><comment><USER106> Why all the buzz? I thought that the people who buy Apple products or use centralized social networks knowingly sacrifice their privacy and already expect things like this to happen.

<comment><USER52> Do we really need to go into tired cliches of what kind of people own which device? We don't even know how this information was acquired.

</comment></comment><comment><USER107> I doubt very much that Apple had anything to do with this. That's not the kind of company they are.

<comment><USER108> Wait, are syou serious? I didnt know anyone could be _that_ delusional about Apple. You _really_ think Apple cares about privacy? They aren't "that kind of company"? Where the hell do you get the idea that Apple cares about the morality of their decisions? Could it be that you are a fanboy? Wait, I know the answer to that already.

..."shit HN says", right here.

<comment><USER107> The accusation is that Apple INTENTIONALLY gave the FBI a database with twelve million records. That is what my comment refers to. It is preposterous to propose that Apple --or any company for that matter-- would willingly do that. The liability hole this would open up would be massive. They are a business and you can bet your ass that every decision with potential liability consequences is well considered by managers and their legal teams.

No, I am not an Apple fanboy, quite the contrary. As a developer I am very critical of their attitude and decision making. I think they really suck at some things and have been very vocal about it on HN and elsewhere. That does not mean that I would automatically vilify them for everything.

HN is very interesting at times. Most of the time you get positive feedback when you are for Apple and for politically Liberal points of view. However, sometimes the poles reverse and North becomes South. This is rare when Apple is the subject. I guess in this case it was as simple as not understanding what the comment was referring to, which can happen if someone doesn't actually read the original article in the first place.

<comment><USER69> Precisely what liability do you think Apple should be afraid of? I'm having trouble imagining what they could be sued for here.

Note that the FBI is the supposed source of the leak here. So let's say Apple claims they gave up the data at the request of the FBI to supposedly help with a classified terrorist threat that the government won't have to reveal at trial. Who's going to sue Apple, and for what?</comment></comment></comment></comment>


The 16-bit v/s 8-bit Blind Listening Test, Part 2 - <AUTHOR> http://www.audiocheck.net/blindtests_16vs8bit_NeilYoung.php <comment><USER2> Oh boy, this test is going to ruffle some feathers. However, the choice of audio clip ensures that you can't tell the difference easily.

It's known that the only difference between well-prepared files of different bit depths is the noise floor. Basically, in any PCM audio file, you can expect noise of about 1 ULP. So in a 16-bit file you get a noise floor of -90 dB, and in an 8-bit file it's at -42 dB. This is the ONLY DIFFERENCE.

People who are here listening for distortion artifacts aren't going to find any, and they're going to be surprised. That's because you can always choose to introduce noise instead of distortion artifacts when you do the conversion. The noise is actually added on purpose, it's "dithering noise", and it's not there to mask the distortion, but to entirely replace it.

The math works like this. Take a high-resolution input, say, 16-bit. You're converting it to 8-bit. If you just convert, you'll introduce a distortion signal of about 1ULP. However, if you introduce 1ULP of uncorrelated rectangular noise, the distortion signal is now also uncorrelated noise, which is less objectionable than correlated noise. It's also harder to hear.

Then, how do you tell the difference between 16-bit and 8-bit audio files? You can only do it if there's a quiet part somewhere in there. As soon as there's a quiet part, you can hear a "hissing" sound in the 8-bit file at -42 dB. If you're listening to the middle of a rock song like this, the hissing sound is going to be buried in the mix. Heck, a typical guitar amp will already be putting out uncorrelated noise.

<comment><USER3> 10/10, but I had to listen closely. Sennheiser 650s & external DAC/amp, quiet room, hearing is still good to ~16khz.

The primary place I picked out to hear this not the quiet parts, but rather a hiss above 10khz, which was audible even at the beginning - and particularly at the beginning. It's almost mistakable for brighter cymbals, if you're not listening closely. It also changes in perceptibility over the duration of the sample.

<comment><USER4> I tested myself using that same trace: I got 10/10 with the sound of the cymbals, then confirming with the fadeout at the end.

This is with HD-598's with 16 feet of cheapo headphone extension cords, loud old refrigerator running in tiled studio apartment, and motherboard built-in sound output.

</comment></comment></comment><comment><USER5> I scored 10/10 in the test, but only because I experimented with this myself after I read Christopher Montgomery's article in 2012: As explained there, with active dithering, bit-depth and signal-to-noise level are interchangeable -- a signal with a small bit depth has a small signal-to-noise ratio. So one can clearly hear a subtle noise in the 8-bit samples, especially in the fade- out at the end.

In my experiments I found that for almost anything, that is not orchestral music, and that is newer than 1990, 8-bit sample depth are enough. That was really depressing.

By the way, a nice jest is to tell some random bystander that you're going to present them "8-bit" music and then play the 8-bit version of a song that was a victim of the loudness war. Supposedly, the 8-bit times were better than most people think. ;-)

</comment><comment><USER6> I tested myself using my MacBook Pro's speakers. 7/10 correct.

I'm a musician and have a large CD, vinyl record, and digital audio collection. Honestly the knots some people twist themselves into over formats amuse me. I tend to focus on the music and the rhythm rather than the recording quality, at least above a minimum quality level. I prefer vinyl just because I do. :-)

[edit] the test page suggested my results were close to random, and I agree. I couldn't really tell a difference through the laptop speakers. It felt like I was guessing for each sample.

<comment><USER7> Wait a couple of hours, to forget your responses, and try again.

<comment><USER6> I honestly couldn't tell. I'm guessing if I tried again I'd get anything between 4/10 and 7/10.

<comment><USER8> Read the "comprehensive article" linked to from the main story. It is worth the read.

</comment></comment></comment></comment><comment><USER9> Regardless of whether or not this test is bunk or not, this person's website has a lot of cool audio samples:

Subwoofer Harmonic Distortion test: [http://www.audiocheck.net/testtones_subwooferharmonicdistort...](http://www.audiocheck.net/testtones_subwooferharmonicdistortion.php)

Polarity test: [http://www.audiocheck.net/audiotests_polaritycheck.php](http://www.audiocheck.net/audiotests_polaritycheck.php)

Practical effects of bit depth: [http://www.audiocheck.net/audiotests_dithering.php](http://www.audiocheck.net/audiotests_dithering.php)

Headphone Ultimate Test (the binaural audio one is pretty awesome): [http://www.audiocheck.net/soundtests_headphones.php](http://www.audiocheck.net/soundtests_headphones.php)

</comment><comment><USER10> 10/10 using the fade-out at the end. Choice of clip is a poor example of the benefits of higher sample depth, because the dynamics are relatively constant and there are a lot of noisy overtones.

Having $700 headphones helps, too.

<comment><USER11> Using the fade out makes it trivial to detect. Listening closely with headphones it's fairly easy (i.e. get 9+ right) to hear it in the first couple of seconds and throughout the song as well. I guess there's a reason we use 16 bits. Now I want to try it with 24 bits, maybe with a song that has more quiet parts in it.

Edit: The other test using Gangnam Style is _much_ harder to detect (for me), I scored 6/10 on my first attempt (and I won't try again, hearing that riff 10 times in a row is plenty): [http://www.audiocheck.net/blindtests_16vs8bit.php](http://www.audiocheck.net/blindtests_16vs8bit.php)

<comment><USER10> Yeah. The whole thing about these tests is that it's like testing whether you can tell a solid black box in an 8bit or 16bit png. Yeah there cases where you'll see the difference and ones that you won't. Why pick such limited examples, when it effectively undercuts _any_ value the test might have in terms of people's perception of bit depth?

</comment></comment></comment><comment><USER12> This is a terrible source material for this kind of test. The biggest audible difference between 8 bit and 16 bit, assuming the same sample rate, is the noise floor. But, this source material is LOUD throughout, which masks the noise floor. It is in dynamic material that bit depth makes an audible difference. The prior listening test used Gangnam Style, which is also loud and lacking in dynamics that would reveal audible distortion due to low bit depth.

The thing is that I agree with Monty on the (lack of) need for 24/196 audio for consumers. My degree is in audio, and I (mostly) understand the physics of the thing (and have done tons of blind listening experiments in controlled environments using professional equipment, as well as using high quality measurement tools for spectrum analysis, etc.). But, this particular test isn't really a useful proof that we don't need 24 bit and 196k. It only proves that loud material can mask noise, even at 8 bits.

Using a more dynamic Neil Young song would have been a better choice. Maybe _Old Man_ , or similar. Acoustic guitar is good for allowing one to discern audio equipment flaws. It is commonly the source material people use when trying to rate good pieces of equipment that have very small differences across a very broad price spectrum (microphones, preamps, etc.).

Nonetheless, I got 8/10 right using crappy ear buds in a noisy place, which isn't much better than random chance. I'm pretty confident I'd be able to recognize 8 bit vs 16 bit on any reasonably dynamic source played on good equipment in a good listening environment. But, I also _know_ I can't recognize 16 bit vs 24 bit (I've tested), and I know Neil Young can't either. Neil Young was around for the era when ADC/DAC quality was very poor; it actually was true that many early digital recordings were inferior to the very high end analog recordings of the time. And, it's even true that when recording, mixing, and mastering, it is useful to work at higher bit depths (because there's a lot of summing, raising the noise floor each time; though that may just mean you need to process at 24 or 32 bits, rather than actually record at higher depths).

It seems obvious, to me, that the reason most music sounds like shit is because of the loudness wars (dynamics reduction), lossy compression (cramming a lot of music down tiny network pipes), and the low quality of most people's listening equipment and environment. Those factors utterly dwarf the noise floor of 16 bit audio, and completely nullify any frequency advantages of higher bit rates (even if we could hear them).

In short: Pono is elitist bullshit, as most audiophile stuff is.

<comment> semi-extrinsic > Acoustic guitar is good for allowing one to discern audio equipment flaws. > It is commonly the source material people use when trying to rate good > pieces of equipment.

My go-to track for testing, recommended if rock is your preference, is Muse's "Undisclosed Desires". The beginning of the second verse has a "hidden" bit you will only hear on good headphones. First time I heard that song on some Grado SR80s I literally jumped from being spooked.

<comment><USER13> Are you talking about whispered part underneath sung lyrics? I can hear them on my cheapo headphones, but I never payed attention to them before.

<comment> semi-extrinsic Huh, maybe you can hear it on cheap headphones if you know there is something there to listen for.

</comment></comment></comment></comment><comment><USER14> I did 10/10, but that's because I knew exactly what to look for, and how to listen to it. I didn't use my expensive open headphones, but some cheaper closed headphones that passively block external noise, and I used a far louder volume than usual.

Of course the source is specially selected to make the test hard. With music with real dynamics, that hasn't been compressed to death, the test becomes trivial. 8 bit gives you 48dB of SNR, that is lower than vinyl and tape.

<comment><USER15> However lots of music is meant to play on the radio, and not to be too dynamic since that would just get lost. The clip is likely less compressed than a considerable portion of radio play, which in turn is likely how most recorded music is listened too, even today.

</comment></comment><comment><USER16> Could we have had 8-bit audio of that quality back in the Soundblaster days assuming the computer behind it was capable of processing it?

<comment><USER17> The original Soundblaster was a pretty noisy thing and was limited to 22.5 kHz, AFAIK. You could use noise dithering to improve the perceived quality, but it wouldn't be as effective at that sample rate.

<comment><USER18> Yeah, but later models (Sound Blaster Pro) added 44.1kHz (but only mono, stereo would be 22.5kHz, then it went 16-bit and that was it.

Then of course it became obsolete for 99.9% of use cases

</comment></comment></comment><comment><USER8> Why would you need a 4k video when your only display is 1080P? Same thing goes for audio. Your ears are only capable of hearing a subset of what is reproducible with 16 bit audio, no need for 24 bit.

It is all well explained in this article: [https://xiph.org/~xiphmont/demo/neil- young.html](https://xiph.org/~xiphmont/demo/neil-young.html)

The only time you'd ever need more than 16 bits is if you're going to do more than just listen to the music. If you're mixing/mastering that is another story.

</comment><comment><USER18> Interesting concept (scored 4/10 on the first test, there's also a similar test with a different song)

But to be honest I don't think the snippets are good candidates for the comparison

<comment><USER19> _> Don't get me wrong, differences between 16-bit and 8-bit are clearly audible, and are demonstrated on my Dynamic Range, Dithering and Noise Shaping page. However, because contemporary popular music has such a limited dynamic range, these differences become subtle, if not inaudible, when tested on it._

From the summary thing above the blind test. They're aware of this, this test was mostly done for irony (as also explained in the blurb.)

<comment><USER20> Unfortunately for them (as others noted) they do fade-out at the end, which makes the noise audible on even a decent set of headphones.

</comment></comment></comment><comment><USER21> 10/10 but perhaps my sensing method would be considered cheating : the underlying noise throughout the whole track was noticeably more dithery/glitchy in one set of clips than the others, so I presumed that identified the 8-bit clips. Speakers are tinny laptop speakers which I think probably overemphasised the effect.

</comment><comment><USER22> I linked to this from my comment on the "24-bit is overkill" article, some other peoples' results are mentioned there.

> > [https://news.ycombinator.com/item?id=10522850](https://news.ycombinator.com/item?id=10522850)

</comment><comment><USER23> I guessed randomly and got "8/10 definitely not a random guess".

Someone needs to check their p values.

<comment><USER24> I think it's sarcastic. Elsewhere he says unless you get 9 or more correct, you probably can't tell.

</comment></comment><comment><USER25> I had 6/10 on Neil Young and 5/10 on Gangnam Style.

That said, he claims "less than 9 is not meaningful". But by my calculations an 8/10 is significantly different from chance alone; to some extent, 7/10 is as well.

Suppose random guesses are drawn from a Binomial distribution -- each sample is an urn containing balls black and white (both equally likely) and we count how many white balls we can get.

This is the CDF: people who get 1 answer right score better than only 1% of people. \--- 1 0.0107422 2 0.0546875 3 0.171875 4 0.376953 5 0.623047 6 0.828125 7 0.945313 8 0.989258 9 0.999023 \--

A "7" is almost at 95% significance.

</comment><comment><USER8> I love this link (also linked in the main article). [https://xiph.org/~xiphmont/demo/neil- young.html](https://xiph.org/~xiphmont/demo/neil-young.html)

Whether a person prefers 8, 16, or 24 bit is besides the point and has to do with their tastes. That article clearly debunks any arguments saying that 24 bit is superior in re-creating reality. In fact he makes some points against it.

I love the analogy about a television that can display UV rays.

</comment><comment><USER26> MP3 files, seriously? A lossy audio encoder will remove much of a static noise floor (and sacrifice some of the signal in the process). That's the point.

</comment><comment><USER27> Speaking of listening test, I would recommended the following website for the interested:

[http://www.klippel.de/listeningtest/lt/](http://www.klippel.de/listeningtest/lt/)

A couple of years ago, we asked our colleagues to do the tests and the results were quite interesting.

(The tests require Microsoft Silverlight, which might be a little hard to setup these days.)

</comment><comment><USER28> I didn't bother with the test, because the 16 bit version of the audio clip sounds bad. It has some of the qualities of a demo that had been recorded with a casette-based four-tracker.

16/44.1 can reproduce a shimmeringly deep, richly textured audio experience. A valid 16/8 test will take a sample _of that sort_ : a great sounding 16 clip, converted down to 8.

This article is a veiled _ad hominem_ , which says that Neil Young is wrong about audio because he once recorded some music that sounds like shit. The underlying fallacy is the idea that whenever some artist promotes higher sample rates or wider sample sizes, we should arbitrarily criticize that claim based on some poor example of their own music, rather than using science.

<comment> semi-extrinsic > a shimmeringly deep, richly textured audio experience

... not sure if trolling, or "audiophile".

<comment><USER28> My guitar rig includes a 31 band EQ. Does that answer your question?

</comment></comment></comment><comment><USER29> In contrast to all the 10/10 posts I couldn't hear the slightest difference.

Even after reading all the hints about what I should listen to in this thread.

</comment><comment><USER30> The hover text for the links gives it away unfortunately.

<comment><USER31> You are supposed to do the test "blind". :-)

<comment><USER32> My screenreader read them to me?

</comment></comment></comment><comment><USER33> This article is bordering on pseudoscience.

When you do experiments you _must_ understand your experimental design enough to understand exactly what you're testing and what conclusions can be drawn from that. If you do A/B testing of 8-bit/16-bit (which is a good idea) you have to understand you're doing the test _through your current audio hardware_.

The whole point of the Pono player is to have higher quality hardwhere _everywhere_ , including pre-amps and DACs so you have a chance to hear subtle differences.

If you do this test through your laptop speakers you really might not be able to tell the difference. If you'd like to "debunk" the Pono player then do this test through a Pono player pushing music through quality studio headphones.

Making things worse they're using Neil Young's _Rockin In The Free World_ which contains, get this, large amounts of harmonic distortion to begin with. The pre-existing harmonic distortion will only serve to mask any distortion and fidelity loss from truncating to 8-bits.

If you don't own high-fidelity music equipment then this test is like proving high definition television is impossible because you can't tell the difference between a standard and high definition signals on your standard definition TV.

<comment><USER2> > The pre-existing harmonic distortion will only serve to mask any distortion > and fidelity loss from truncating to 8-bits.

This is blatantly incorrect. The 8-bit conversion is not truncation, it is dithering. Dithering to 8-bit does not introduce _any_ distortion at all, whatsoever, of any kind. If you don't understand the mechanisms and the science of how bit depths work, then you're going to come to false conclusions, like the conclusion that there's any point to the Pono player at all. We're not talking about just "subtle differences" here. In order for it to be even _theoretically possible_ to hear the difference between 16-bit and 24-bit audio, you have to bring your audio system into a quiet room and then crank the volume levels well above into the threshold at which you can damage your ears, and even then, you still won't be able to tell the difference with the most dynamic music.

So, suppose you have a quiet room in your house, with an ambient noise level of about 30 dB. If you raise the 16-bit audio level so the noise floor is above 20 dB, then the peaks are going to be well into the 120 dB range. That's like having a symphony orchestra in the room with you, at the very peak of their performance, with all the instruments playing at once. If you've ever listened to a symphony orchestra, you know that the background noise is NOT 30 dB, but somewhat higher. So even at the peak of a symphony, your CD recording should still be able to reproduce the various unwelcome bits of noise that the musicians produce (stomachs gurgling, breathing, shuffling in their chairs, etc.)

<comment><USER34> Here is my take on dithering, with online demos : [http://www.audiocheck.net/audiotests_dithering.php](http://www.audiocheck.net/audiotests_dithering.php) (still 8-bit though, because at 16-bit, it is barely noticeable, and it won't serve educational purposes very well)

<comment><USER35> Interesting demo! Thank you for sharing.</comment></comment></comment></comment>


The World Wide Web project (1993) - <AUTHOR> http://info.cern.ch/hypertext/WWW/TheProject.html <comment><USER2> I think the most interesting page is, of course, [http://info.cern.ch/hypertext/WWW/Bugs.html](http://info.cern.ch/hypertext/WWW/Bugs.html)

There's technology to enable for most webapps (form processing), and search engines right there. And of course, "Gateways: JANET and DECnet for example" are a "Real need."

Really makes you wonder whether the priority decisions you made today will seem similarly ludicrous in 30 years.

<comment><USER3> "Really makes you wonder whether the priority decisions you made today will seem similarly ludicrous in 30 years."

My bet is on yes.

</comment></comment><comment><USER4> This project will never take off.

</comment><comment><USER5> [http://info.cern.ch/hypertext/WWW/FAQ/KeepingTrack.html](http://info.cern.ch/hypertext/WWW/FAQ/KeepingTrack.html)

How does www keep track of the available servers? - The resource discovery problem

<comment><USER6> "In the long term, when there is a really large mass of data out there, with deep interconnections, then there is some really exciting work to be done on automatic algorithms to make multi-level searches." \- TimBL

</comment></comment><comment><USER7> Simple, clean design. This is how I like to see it done.

</comment><comment><AUTHOR> In the long term, when there is a really large mass of data out there, with deep interconnections, then there is some really exciting work to be done on automatic algorithms to make multi-level searches.

Tim BL

<comment><USER8> And there still is. Some of my bets would be on semantic (ontology identification and interaction), multilingual/multicultural (IMHO huge), local-machine personalized, further processing integration (local or cloud: visualization / result manipulation / statistics / monitoring), reputation and other metric system integration for result entities.

</comment></comment><comment><AUTHOR> Check out the source code, old HTML tags

<comment><USER9> I love how every anchor has a line break. I wonder what browser bug forced them to do that...

<comment><USER10> There are no
 tags in the source, and
 is not a line break.

<comment><USER11> I think he means breaks in the actual source itself? I.e., not occurrences of "
" but occurrences of "\n" ?

<comment><USER10> Ah.

I would equate that to being the developer's style preference.

</comment></comment></comment></comment></comment><comment><AUTHOR> Header instead of head

</comment><comment><USER12> dat html ಠ_ಠ</comment>


Lifetimes of cryptographic hash functions - <AUTHOR> http://valerieaurora.org/hash.html <comment><USER2> The SHA-256 "weakness" is a bit disingenuous. As far as I'm aware in the 10 years since that paper was published the "weakness" hasn't been extended _at all_. The main reason for the SHA3 competition was because we were all concerned at the time that SHA2 would be broken and there'd be nothing to replace it with. However as it happens, SHA2 has remained rock solid, so the outcome of SHA3 was to pick something (Keccak) maximally different from SHA2, since in the intervening years cryptographic diversity became more desired than actual replacement. Both SHA2 and SHA3 are fit for use in production systems -- I would personally pick SHA2 unless I had some specific reason to benefit from SHA3 (e.g. incremental hashing modes that the sponge construction makes possible).

<comment><USER3> It looks like it's important to switch to a variant of SHA-2 that is truncated (like SHA-384 or SHA-512/256 for example), since they are more robust. No trivial length extension attack since they don't put the whole internal state in the output.

This would be if one cares about how violently you fall if SHA-2 is broken more, but I think you should care.

<comment><USER2> Or design your protocols to be safe from length extension attacks in the first place.

<comment><USER4> Can you please explain?

<comment><USER5> EDIT: I realized you were asking about "design your protocols against length extension", not "what is length extension". Sorry. Ignore this, but I'll leave the response for anyone else who is curious

\---

SHA-{1,2} are vulnerable to length extension attacks, because of the way their Merkle-Damgard construction works. Basically, if you have the result HASH(X), you can calculate HASH(X+P), knowing only 'HASH(X)', without knowing 'X' itself. This is problematic because it means you can effectively "extend" some cryptographically hashed data with an arbitrary suffix.

You can immunize SHA-2 in one of two ways to a length extension attack:

\- Truncate the hash value. For example, use SHA-512, but truncate the result to 256 bits (this is called "SHA-512/256"). This works because the output of your HASH function which is 256-bits, cannot be reused as the initial starting state for a new round of HASH (e.g. SHA-512 needs a 512-bit starting value, but the output is only 256, so this makes it impossible)

\- Although it is not standard SHA-2 anymore, you can use a trick from Neils Ferguson and John Kelsey (from 2001!) to immunize it -- simply XOR a constant into the final block round before running the final compression function. Unfortunately this suggestion was not adopted for SHA-2: [http://www.cs.utsa.edu/~wagner/CS4363/SHS/dfips-180-2-commen...](http://www.cs.utsa.edu/~wagner/CS4363/SHS/dfips-180-2-comments1.pdf)

Alternatively just use a modern hash design like BLAKE2, SHA-3, or a number of others -- these avoid the entire problem. I'd suggest just sticking to one of those two.

<comment><USER6> I object to the notion that SHA-3 and Blake2 are "modern" hash functions and that SHA-2 isn't. SHA-2 remains a first-line hashing recommendation among crypto designers. The Noise protocol framework, for instance, includes it, as does Nacl; the authors of both of these systems had hashes available that didn't have length extension.

If I had to rank those three hash functions, SHA-2 wouldn't be in last place.

</comment></comment></comment></comment></comment></comment><comment><USER7> If you're not willing to move to SHA256 "because of performance," you should at least move to Blake2.

[https://blake2.net/](https://blake2.net/)

There's no excuse for staying with SHA1 at this point.

<comment><USER8> From the article -

[3] Google spent 6500 CPU years and 110 GPU years to convince everyone we need to stop using SHA-1 for security critical applications

<comment><USER9> And the next fifteen years of Moore's Law will take that down to, what, 1 GPU month even without further algorithmic improvements? Which are anticipated?

I _still_ see things that use 2-digit years, twenty years after the last millennium bug should have been fixed.

<comment><USER10> "Next fifteen years of Moore's Law?" The recent failure of Intel's "tick-tock" alternation of process shrinkage and new architecture suggests that however performance improves in the next 15 years, projecting the last 15 years' Moore's Law forward is a bad idea. For crypto stuff, I'd think about how quantum computing may advance by the 2030s.

</comment></comment></comment></comment><comment><USER11> What is the status of the Whirlpool hash function? Can it be added to the color table?

</comment><comment><USER12> For anyone needing to decide what hash function to use, I recommend to have a look at multihash: [https://github.com/multiformats/multihash](https://github.com/multiformats/multihash)

</comment><comment><USER13> > Non-expert ("slashdotter") reaction:

> Explain why a simple collision attack is still useless, it's really the > second pre-image attack that counts

Why is this the "non-expert reaction?" It's correct, right?

And why go to the trouble of making a timeline with "Broken" and "Collision found" without a "Second pre-image found"?

I'm genuinely puzzled (and have asked it here on HN before [1]), but I unfortunately suspect that an honest answer lies somewhere along these lines: "Second pre-images are a _hell of lot_ more difficult to find than collisions, so if we waited around for a second pre-image to be found we'd never get to dance around like headless chickens and talk about really scary shit (which typically requires a second pre-image) as 'now practical'. That would make the whole field a lot less sexy, and cut into our 'expert' consulting fees..."

1\. [https://news.ycombinator.com/item?id=13729492](https://news.ycombinator.com/item?id=13729492)

EDIT: I'm of course not advocating staying with SHA-1. There's absolutely no good reason to. Even years ago when I was last involved in choosing a cryptographic hash function (even truncated) SHA-256 was obviously a much better choice.

<comment><USER14> I had a similar thought, but actually prefer this way.

People who understand things well enough will know what first collision means, so can moderate their response.

Others who are less familiar with the ridiculous levels of subtlety around this sort of thing are better off being given the simple message that sha1 is now legacy in all cases. Helps to avoid mistakes.

<comment><USER13> Simple "truths" are sometimes useful. I can see that.

I'm more surprised though at the resentful attitude towards the actual truth (in the non-alternative sense): collisions are useless in many cases and the necessary second pre-image is _much_ more difficult to find.

At least in a forum like HN I'd expect intellectual honesty to prevail.

EDIT: Removed the incorrect example out of pure shame! :P

<comment><USER15> /u/pvg linked below how the ability to generate collisions for MD5 was used to obtain a fake CA certificate. It's not obvious to me that this would not work with SHA-1 certificates, and that no other important things we use have similar weaknesses. (Neither do I know for sure that it would work, but "collisions are useless" seems like a dangerous simplification in the other direction. I suspect for many, simply replacing SHA-1 with something deemed better is easier than thoroughly evaluating the risks involved with not doing so)

<comment><USER13> Now we're getting somewhere in terms of intellectual discussion! :)

I of course agree we should replace SHA-1. But I still think a more intellectually honest discussion is meaningful. For example, after reading the link you referred to I'm rather convinced that X.509 is pretty seriously flawed, and could easily be redesigned to be collision resistant. Why not talk about that? Why not do it?

<comment><USER16> As I understand it, CAs have mitigated the collision attacks by forcing a random serial number they generate into the certificates. Since that's part of the hash, collision attacks are no longer practical.

Doing x509 still means having to parse ASN.1 though, and nobody seems to actually like it.</comment></comment></comment></comment></comment></comment>


An app to find scantily clad pics of your FB friends - <AUTHOR> http://techcrunch.com/2012/10/28/badabing-for-ios-helps-you-find-all-of-your-facebook-friends-bikini-pics/

<comment><AUTHOR> No, I didn't make it.</comment>


Ray Tracing Denoising - <AUTHOR> https://alain.xyz/blog/raytracing-denoising <comment><USER2> It's only briefly mentioned, but NVIDIA's recurrent denoising autoencoder is pretty amazing.

[https://research.nvidia.com/publication/interactive- reconstr...](https://research.nvidia.com/publication/interactive- reconstruction-monte-carlo-image-sequences-using-recurrent-denoising)

Two Minute Papers did a nice explanation of it:

[https://www.youtube.com/watch?v=YjjTPV2pXY0](https://www.youtube.com/watch?v=YjjTPV2pXY0)

<comment><USER3> Yes it's very nice. I think they went a bit too far with their deep learning anti aliasing solution DLSS though. Read somewhere here that AMD potentially had an algorithm that surpassed it in many metrics using no ML. Seems like that thing about holding a hammer for too long so everything starts looking like nails.

<comment><USER4> Also, DLSS was received rather poorly. The performance impact doesn't justify the increase in perceived quality, and the artifacts when it fails are pretty jarring.

<comment><USER5> I thought DLSS speeds up the rendering with RT ON.

<comment><USER4> In all games to date, it's better both in terms of perf and aesthetics to run with RTX disabled and TAA enabled. There's a bunch of blog posts and youtube videos like [1] about this.

There's a bit of a meme going around that DLSS stands for 'doesn't look so sharp'

[1] [https://www.youtube.com/watch?v=3DOGA2_GETQ](https://www.youtube.com/watch?v=3DOGA2_GETQ)

<comment><USER6> > and aesthetics to run with RTX disabled

Did you mean to say "run with DLSS disabled"? RTX contains all the new features including ray tracing, which is not the same as DLSS. There are several games where many people feel they are indeed much better aesthetics- wise with RTX on, not off. At the very least it's a matter of preference, and not "better" in general to have RTX off.

<comment><USER4> I meant to say with RTX disabled. Turning on RTX (and let's call DLSS free at this point) costs a performance penalty that's equivalent to meaningfully upping resolution or AA settings without RTX. And people prefer the latter. This might change as games start making better use of RTX functionality, but this is where things are today.

For n=1 I've played Metro with RTX on lower settings and without RTX on higher settings, and I prefer without. I think realtime raytracing came out a hw generation too soon.

[https://au.ign.com/articles/2019/04/17/what-is-ray- tracing-a...](https://au.ign.com/articles/2019/04/17/what-is-ray-tracing-and- should-you-care)

[https://www.techradar.com/au/news/we-tested-ray-tracing- in-c...](https://www.techradar.com/au/news/we-tested-ray-tracing-in-control- on-pc-on-every-nvidia-rtx-super-card)

<comment><USER6> > And people prefer the latter

You prefer the latter. Many people prefer ray tracing on. In fact the main complaint online is about the cost of cards, very few people seem to contest that scenes where ray tracing is properly artistically used, have superior aesthetic quality to them and superior realism. (assuming that's what you mean, since you keep using the term "RTX" and it's unclear what you talk about, whether it's ray tracing or DLSS etc.)

<comment><USER4> And yet I cite 3 unrelated sources that all corroborate what I said with detailed analysis and you cite.. Opinion?

> assuming that's what you mean, since you keep using the term "RTX" and it's > unclear what you talk about, whether it's ray tracing or DLSS etc.

I use the term the same way NVIDIA uses it. RTX is anything an RTX core accelerates. Still confused? I think that might have been the intention of their marketing team.

> very few people seem to contest that scenes where ray tracing is properly > artistically used, have superior aesthetic quality

This is quantifiable bs. Ray tracing as a technique is superior to rasterisation, but only with sufficient flops. And the current generation of hardware does not yield that critical number. So we get 'ray tracing', but so subdued and limited that existing approaches just flat out look better and also perform better.

[https://www.youtube.com/watch?v=CuoER1DwYLY](https://www.youtube.com/watch?v=CuoER1DwYLY)

Or if you want a more approachable comparison of RTX vs. not-RTX. consider Minecraft+RTX[1] vs. Minecraft+PTGI[2]

[1] [https://www.youtube.com/watch?v=91kxRGeg9wQ](https://www.youtube.com/watch?v=91kxRGeg9wQ)

[2] [https://www.youtube.com/watch?v=Y2WqX6Iu6cU](https://www.youtube.com/watch?v=Y2WqX6Iu6cU)

<comment><USER7> You linked a performance analysis of RTX cards in Control, a general overview of ray tracing and how it applies to gaming and some youtube video from almost a year ago about DLSS not being implemented very well in one game (which has since been much improved).

None of these corroborate the idea of RTX effects being aesthetically inferior, or that this is a widely held opinion.

Consider watching these for an up-to-date take on the subject.

[https://www.youtube.com/watch?v=blbu0g9DAGA](https://www.youtube.com/watch?v=blbu0g9DAGA)

[https://www.youtube.com/watch?v=yG5NLl85pPo](https://www.youtube.com/watch?v=yG5NLl85pPo)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Aw this didn't mention orthogonal array sampling, another sampling technique aimed specifically at ensuring good distribution in higher dimensions: [https://cs.dartmouth.edu/~wjarosz/publications/jarosz19ortho...](https://cs.dartmouth.edu/~wjarosz/publications/jarosz19orthogonal.html)

<comment><USER9> It actually does mention and link that paper.

<comment><USER8> oh woops! didn't catch it

</comment></comment></comment><comment><USER10> Can't wait until ray tracing is more mainstream. I know NVIDIA has their share of uncool things but I really appreciate them making the RTX series, hopefully we'll see more and more of this.

<comment><USER11> With AMD bringing ray tracing next year to consoles and desktop we won't have to wait long.

</comment></comment><comment><USER12> At one time, writing a ray tracer was a right of passage when getting into computer graphics. I never did it, but this week I was trying to figure out how to find the intersection point of a ray and an oblique cone and all of the resources I found were related to ray tracers.

I'm thinking that maybe I should actually write a ray tracer. Is that still a worthwhile thing to do, or has the world moved on?

FWIW, I never solved the ray-oblique cone problem...

<comment><USER13> Still worthwhile in my opinion! But full disclosure, I happen to be working on ray tracing problems.

Writing them is still really fun, it's no less useful today for learning things than it was 20 years ago. You can get amazing pictures with not very much code, and the algorithms are really satisfying to understand & implement.

There are also still tons of low hanging fruit. You'd think the easy problems would be mined out by now, but they're not. New developments are actively happening with intersection primitives, color handling, sampling, direct lighting, shadowing, the list goes on. If you want to do research, you don't have to dive that deep to find something unsolved that is solveable.

For an oblique cone intersection, I don't know the right answer, but the oblique cone is a skew transform of a regular cone, right? You might be able to use a regular cone intersector, but pre-transform the ray by the inverse skew transform?

This resource is fantastic for finding intersection building blocks and code examples: [http://www.realtimerendering.com/intersections.html](http://www.realtimerendering.com/intersections.html)

</comment></comment><comment><USER6> For a practical demonstration of what denoising can theoretically do I recommend Quake II RTX. There is a dev mode with a bunch of rendering settings, many more so than in an average game. They were added to it because this game is more of a tech demo of RTX at this point.

There is a switch where you can turn the denoising of the ray-traced output on/off: it shows tremendous difference, to a point where it's hard to even imagine looking at the noisy image that it is even possible to extract the denoised version.

</comment><comment><USER14> Something I've wondered is whether technology like this could eventually be self-defeating for hardware manufacturers. Rather than the evolution of graphics deriving from improved accuracy of the optical simulation fuelled by advances in computational power, it may instead derive from optimising subjective video quality, similarly to video codecs.

While accurately simulating optics is needfully computationally expensive and gives special-purpose graphics hardware an advantage, it's not clear that psychologically subjective high quality graphics (i.e. generating visuals which are inaccurate but convincing to humans) has such a need.

<comment><USER15> >While accurately simulating optics is needfully computationally expensive and gives special-purpose graphics hardware an advantage, it's not clear that psychologically subjective high quality graphics (i.e. generating visuals which are inaccurate but convincing to humans) has such a need.

What you're describing is rasterization, which is what the industry standard is (at least for games) for decades.

<comment><USER14> Techniques used to create realism with rasterization (e.g. normal mapping; shadow mapping; screen-space anti-aliasing) are still simulations of optics, just not entirely faithful ones.

Generating visuals with an autoencoder, albeit hinted by noisy physically- based raytracing, is not an optical technique; detail is generated from a visual statistical model, not an optical simulation.

<comment><USER16> > _noisy physically-based raytracing...detail generated from a visual > statistical model_

That is an optical simulation :)

<comment><USER14> The raytracing is, but you don't see the result of the raytracing, you see the output of a neural network inventing detail based on higher definition training data. It's like seeing some blurry dots through a microscope, then drawing a sketch of detailed cells, based on your memory of pictures you've seen. The microscope is an optical system, but the sketch is the result of memory and style transfer, not simulation of optics. Hypothetically, you could have no understanding of the behaviour of light in producing the detailed sketch.

<comment><USER17> I think the success of deep learning is quite unfortunate. There are a lot of areas where "throw an ANN at it" has become a go-to even though they're basically inscrutable blackboxes with minimal theoretical guarantees.

</comment></comment></comment></comment></comment></comment><comment><USER18> So far, what I've read about denoising is always the context of doing image post-processing, but it seems to me that some of these techniques could be used just as well to identify areas of the image that the denoiser is most uncertain about, so that you can trace more rays in those directions.

<comment><USER19> Sure if you want to reduce error at some cost, you can use a noise metric to identify where you should send more rays. The premise of denoising is that it's cheaper and you've already spent enough time on the analytical algorithms. Also there is a chance that the noise/variance is due to a high variance feature which (a) would have been fine to leave out and (b) causes a cascade of "noise-driven" ray tracing.

</comment></comment><comment><USER20> What's fascinating to me about this is that it sounds like future renderers may end up working very much like we think the brain does. There is a virtual world, but very little raw data about that world is used directly, just a small sample, and the rest of the image is filled in by a neural model that is able to infer how the whole scene should look based its a priori understanding of how things like light and depth work.

</comment><comment><USER21> Great post but disappointingly few images. It would have been really interesting to see these techniques applied on a standard scene with before/after comparisons.

</comment><comment><USER22> Shirley published a paper in 1991 showing that low discrepancy samplers worked well in a ray-tracing context. So I wouldn't say that's particularly new.

<comment><USER9> I'm not sure what exactly you are responding to, but low discrepancy samples is not at all what this page is about. There have been a lot of papers on many different techniques with various upsides and drawbacks when it comes to reducing noise.

Comparing this overview to one of the most basic techniques that is used everywhere and is a given is like reading an article on a modern car engine and dismissing it because you saw someone light some gas on fire 30 years ago.

<comment><USER22> I'm sorry you took such offence to my comment. I guess I should have quoted the statement that I was replying to within the overview section: "Recently, the use of low discrepancy sampling [Jarosz et al. 2019] and tillable blue noise [Benyoub 2019] has been used by Unity Technologies, Marmoset Toolbag and NVIDIA in real time ray tracers."

<comment><USER9> Those papers are about specific low discrepancy sampling patterns, their ease of use, their speed, their flexibility and the scalability of their properties into higher dimensions. Papers written by knowledgeable researchers in 2019 were not used in all the things you listed.

I understand you know what low discrepancy samples are, but equating the very first demonstration that random sampling wasn't ideal for day tracing, to the state of the art that has evolved over three decades of research is ludicrous.

I don't know why you are desperate to be dismissive but it has no basis whatsoever in reality.

<comment><USER23> whoa, calm down. The post makes it sound like low-discrepancy sampling is a recent development, and 'rbkillea is pointing out that it is 30 years old.

That's it, no need to attribute malice anywhere. I think you are reading _way_ too much into 'rbkillea's comments.

<comment><USER9> There is nothing about low discrepancy sampling being a recent development. This article is about recent research and suggesting anyone involved would imply that one of the most trivial aspects of rendering is somehow new is total nonsense.

There is a recent paper about generalizing n-rooks sampling to higher dimensions which seems to have been misunderstood by yourself and others. It was written by researchers who already have dozens of high profile papers on many different topics.</comment></comment></comment></comment></comment></comment>


Everything There Is To Know About Lift (Obvious Corp) - <AUTHOR> http://blog.lift.do/post/25435255834/everything-there-is-to-know-about-lift

<comment><USER2> There was a section I found fascinating:

"We want to eliminate willpower as a factor in achieving goals. Imagine smooth, fun, optimized, self-reinforcing paths for every aspiration. That would qualify as a giant impact on human potential. We think we can turn chores into positive draws."

Isn't willpower self-reinforcement?

Still, it appears that gamification of a general, broad based goals is something worth doing.</comment>


Blush, Illustrations for Everyone - <AUTHOR> https://blush.design <comment><USER2> I'm seeing lots of oversaturated people with giant pants on startup marketing sites these days. Don't really understand this trend.</comment>


How Do You Talk To An Angel? Use Yobongo, They're All Investing - <AUTHOR> http://techcrunch.com/2011/03/23/yobongo-funding/

<comment><USER2> I couldn't figure out from the website exactly what Yobongo is. Can someone help me out?

<comment><USER3> Yobongo makes it easier to make new connections with people around you. We connect you with a small group of interesting authentic people nearby and you can talk about what you are thinking, what you are doing and the news of the day. You really have to try it to 'get' it.

<comment><USER2> With absolutely no disrespect intended, "you have to try it to get it" isn't a very compelling pitch to get a potential user on board. There are just too many things out there that one could try. There must be a way that you could describe the service more explicitly.

</comment></comment></comment><comment><USER4> Brilliant, simple and well executed. No wonder they raised an angel round so quickly.

I'm jealous... and maybe a little inspired.

</comment><comment><USER5> didn't ycombinator also invest in something similar recently? message party or something?</comment>


The best way to write, collaborate on, and talk about a text. - <AUTHOR> https://editorially.com/

<comment><USER2> Screen shots? Is there an API?</comment>


Ask HN: Encrypted messaging still sucks on multi platforms - <AUTHOR> I've been using all sorts of IM clients.
Recently, started using utox and qtox. On utox, I've random crashes and the Android client Antox is not that robust either.
There seems to be no way to disable notification in qtox on linux (gnome). I've tried doing everything including setting my status to busy, disabling it via gnome control center but notifications are still there.
I am a programmer and I like snooze all notifications.
Then there are apps like wire, the signal which often either need phone around or huge electron apps.
Is there any IM app which works on iOS, OSX, Linux, Android. These are what my family uses.
We share some private stuff which I do not want cloud service to retain. <comment><USER2> Although I haven't used it as IM (I'm still toying with it), I'm on the understanding that Keybase had a functionality that allows encrypted chats, and groups ("teams") too. Also, it allows you to use your own PGP key.

Maybe you want to check it out to see if it fits your requirements/needs.

</comment><comment><AUTHOR> I've tried Riot Matrix, it has same Electron issue. My family says it's not as simple as WhatsApp. They are reluctant to use it.</comment>


Contacts of 1m Virgin Media customers left on unsecured database - <AUTHOR> https://www.theguardian.com/media/2020/mar/05/contacts-of-1m-virgin-media-customers-left-on-unsecured-database <comment><USER2> I just recently joined VM and I also got the email.

> This data breach has exposed the data of almost a million Virgin Media > customers and whilst no financial details or _passwords_ were included, > those customers are likely to be worried.

> For anyone concerned they could be affected – it's good practice to _update > your password_ after a data breach.

Which is it?</comment>


Xwax – Open Source Digital Vinyl Emulation - <AUTHOR> http://xwax.org/ <comment><AUTHOR> Thought I'd share seeing as I've not seen this posted before and I've been using this software pretty much constantly for the past 5 years or so.

xwax is one of the only open source pieces of DVS software that's comparible to the proprietary alternatives (serato, traktor) which all cost in the hundreds of dollars just to get digital vinyl working. it works with cheap soundcards, you can get a full DVS setup with about $30 worth of extra gear, and you'll actually get much better latency (<5ms) using ALSA on linux than you'll get with any of the proprietary alternatives.

massive shout out to the xwax developers that have made an incredible piece of fast, straightforward and useable software for DJs and turntablists everywhere <3</comment>