I am under surveillance by Canadian agents, my computer has been backdoored - <AUTHOR> http://log.nadim.cc/?p=110 <comment><USER4> Contact a lawyer immediately.

There are many actions you could take to mess with the investigation that might seem like fair game, but you should discuss each one with an attorney so you don't provide some arcane justification for them to arrest you (by hacking back, or even maybe "interfering with an investigation").

Once you get past that stage, the attorney can help you petition to stop the behavior or demand more information about it.

Legal advice is what you need now, not tech advice.

(Because the server is crushed, I'm only getting the basic gist - forgive me if you've already done this.)

<comment><USER5> If anyone knows a good lawyer in Montreal, please let me know!

email@example.com

<comment><USER6> Get in touch with the EFF:

<https://www.eff.org/pages/legal-assistance>

<comment><USER7> Don't. They take forever as they have only so few lawyers and they're all backlogged for months. They're also not equipped for this kind of thing. Their lawyers focus more on civil suits, not criminal..

<comment><USER8> _> EFF maintains a list of attorneys, called the Cooperating Attorneys list, who have told us that they are passionate about the same things we're passionate about, and who have indicated that they have some of the same areas of expertise. If we can't help you, but feel that your case is something our cooperating attorneys may be able to assist with, we'll offer to refer you to one of them._

<comment><USER9> Take that with a grain of salt. They want to sound more helpful than they actually are on their website so people will donate.

<comment><USER10> Your claim is based on the knowledge of what actual facts?

(That said, I can see another problem in cases such as this: what if some of the "volunteering lawyers" are set by the government?).

<comment><USER11> > (That said, I can see another problem in cases such as this: what if some of > the "volunteering lawyers" are set by the government?).

My IANAL guess is that they would still be bound by client/attorney privilege, and they'd be committing a crime if they violated that.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I don't know you and I don't know the world you live in, but just from your worried tone, and the rate at which you're responding to comments in this thread, I just want to say: take a breath. Engaging in a wild HN thread, full of well meaning but varied techy suggestions/speculation might not be the best approach right now. Have some friends sift through it for good information and disengage. Seek legal advice, and take it slow.

<comment><USER5> Sorry. I am very stressed and am knocked into full self-defense/damage control mode. Not sure I am in a state to meet people IRL at the moment.

<comment><USER13> I think that you actually should meet someone IRL, have them stay over with you or stay over with them.

<comment><USER14> Yes.. and in the meantime, I suggest all of us watch this 29c3 talk by Jacob Applebaum, "Not My Department" ( <http://www.youtube.com/watch?v=7mnuofn_DXw> ), and think about all our roles in all this. It's not going to stop unless we make it.

<comment><USER15> There seems to be a new pattern where anyone involved in promoting free speech and privacy through encryption gets harassed by the state, regardless if they actually did anything illegal.

[http://en.wikipedia.org/wiki/Jacob_Appelbaum#Investigation_a...](http://en.wikipedia.org/wiki/Jacob_Appelbaum#Investigation_and_detainment)

It really shows how those in power are scared of the liberating powers of technology.

<comment><USER16> Although the details of the gov's investigation and harassment of Jake are largely shrouded in secrecy, his harassment at the border began right after giving a keynote at HOPE 2010 in place of Julian Assange, as the only US citizen identified in the media as a member of the Wikileaks team.

Although I think what the US government has done to Jake is quite clearly a disgusting abuse of power, let us not kid ourselves by somehow believing that the state has gone after him because he has publicly advocated for the use of strong crypto.

<comment><USER17> I don't really know anything about this story, but do you have any guesses as to why they did go after him?

<comment><USER18>
      | his harassment at the border began right after
      | giving a keynote at HOPE 2010 in place of Julian
      | Assange

      | the only US citizen identified in the media as
      | a member of the Wikileaks team.

I'm thinking that these two pieces of information are part of it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Slow down a bit there. Whatever is happening, you need to slow down. Don't make any quick decisions. I know you may feel under a lot of pressure. Best way is to talk to someone you know and trust. A family member or a very old friend. These people love you and want the best for you. Contact them, and explain what is happening. Then with their company, analyze the situation.

I want you to do this. Your current position may make it not so simple. But you must slow down and regain your composure.

Such situations are better dealt with people who love you.

Postpone any harsh decision until you have met with a loved one and have explained the items.

Remember that there is always a way to work things out. Dont lose hope. I want you to remember that things get better. They improve. You just need to slow down and reason a bit.

I'm not doubting your points. But I want you to go to a safe place where you can get some rest. Tomorrow you may be able to think about this with a better understanding. You are a smart person. You always figure out hard problems. You need to rest a bit before you can tackle it. Go and stay with a loved one. They will welcome you and listen to the items you are talking about.

I am orangethirty. Have been programming for a long time. I live in the Caribbean, and you can read more about me on my github (github.com/orangethirty). I'm only interested in your well being. We all want for you to regain your inner peace.

If you need anything, then let me know by posting here. If you feel comfortable emailing me, then do so.I am not pressuring you to do so. Do it if you feel like it.

I want you to remember that tomorrow is another day. Things improve. There is a way to solve every problem.

\- orangethirty

</comment><comment><USER20> Disconnect computer from network.

Try to dump RAM image.

Image the drive, sign and optionally encrypt the contents, preferably file-by- file checksum and copy to multiple secure locations. Copy of checksums in additional secure location.

Get out of your house with your computer as soon as possible (as soon as you upload one or two images). Do not leave the computer, they will try to destroy or confiscate the evidence. Plan to store computer in secure location, preferably with 24/7 video monitoring and a heavy duty safe. Preserving the evidence is probably that important.

Try to be in the company of someone you trust so they can act as a witness and can protect you from physical intimidation or attack.

Assume phones are compromised including GPS on your mobile phone. Assume you are under physical surveillance. Assume your car is compromised.

Relatives and close friends will be known to operatives. May be a good idea to spend 1-2 nights in a motel with a friend without anyone's cell phone paying cash until you secure copies of your data and get advice on what to do next.

</comment><comment><USER21> "I'll be wearing a black suit."

That should have been enough to make anyone suspicious.

<comment><USER22> Nothing wrong with black suits, in London theyre very common among business people. Not everyone has the luxury of wearing t-shirts and jeans to the office.

<comment><USER23> Black suits aren't supposed to be worn for business. They are for evening wear. They should only be worn in the day if you are a waiter, doorman, undertaker, American etc.

</comment></comment></comment><comment><USER13> <http://en.wikipedia.org/wiki/Nadim_Kobeissi>

<comment><USER24> Curious how he knew Sabu in the first place

<comment><USER25> Wiki: _"In 2012, the FBI attempted to entrap Kobeissi using Sabu"_

<http://log.nadim.cc/?p=65>

[http://bits.blogs.nytimes.com/2012/03/12/a-hacker-charms- and...](http://bits.blogs.nytimes.com/2012/03/12/a-hacker-charms-and- disappoints/)

Fuckers. (sorry, I couldn't resist)

</comment></comment></comment><comment><USER26> It seems ridiculous that an "intelligence" organization would upload files to a server that identified themselves so blatantly like that. Could it be that it is some ruse of some sort? I don't doubt that someone broke in, but would it really be CSIS?

<comment><USER27> CSIS aren't the most competent intelligence organization in the world.

<comment><USER28> For the limited scope of the work that they do (which is essentially limited to what the NSA does in the US. They don't really do what the CIA does), and with a relatively small $600 million dollar public budget, they're known to be quite competent.

This story sounds...weird. I doubt it is quite as he suspects it is.

<comment><USER29> I think you've got it mixed up: CSIS [0] is the Canadian CIA, having been created in the wake of shutting down Department D of the RCMP after one too many scandals in the 1970s. The Canadian NSA is the CSE [1].

[0] [http://en.wikipedia.org/wiki/Canadian_Security_Intelligence_...](http://en.wikipedia.org/wiki/Canadian_Security_Intelligence_Service)

[1] [http://en.wikipedia.org/wiki/Communications_Security_Establi...](http://en.wikipedia.org/wiki/Communications_Security_Establishment_Canada)

<comment><USER30> CSEC, now. I'm thinking of interning there in the summer.

<comment><USER31> You aren't now.

I happen to know that upon applying you are directly told not to tell anyone you applied, or even that you were thinking of applying.

<comment><USER30> No, only thinking of it.

<comment><USER32> Then you aren't anymore.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER33> This guy should widely distribute the SFTP creds being used by the backdoor agent on his computer. Then we could all be helpful by uploading useful data to the Canadian government's spy server.

<comment><USER34> While an amusing suggestion, I sincerely hope everyone realises that such a move would be ... incompatible with a long and healthy lifestyle. Both for Nadim and anyone foolish enough to do so.

<comment><USER33> On the other hand, anyone who has reason to believe there might be information critical to their investigation embedded in the full version of Two Girls One Cup, it is their civic duty to submit that video to the authorities.

<comment><USER34> But sneaking it in through a backdoor and smearing it on their server is probably not going to be well received. (any unintentional puns are entirely unintentional).

</comment></comment></comment></comment><comment><USER35> It is possible that someone is playing a bad prank on Nadim, or that Nadim made the story up to gain attention.

Please read on. If this is real, then I'm sorry and recommend you to consider all suggestions before deciding illogical.

DON'T COMMIT SUICIDE!

If you watched the movie "Enemy of the State", I'd become paranoid, but not afraid. Stay calm and act logical.

I've looked at cryptocat two days ago, what's special about it? I don't see any reason for the Government to observe you, except that you would be a good fit into their Cyberwar Team. And that you have the wrong connections in the internet. I mean your friends are all hackers. It makes you appear dangerous too. Anyway, the government observes everyone, but with different priority and detail. I think only you might know why they observe you. No need to share the info.

Just as in the Movie: I'd replace all clothes, shoes and hardware with new ones and move to a different place. Acquire encryption software from a trusted source or compile it myself on a newly obtained Netbook and encrypt the hardrive+swap with a password and keyfile. Hide the keyfile. Put your hardware and new phone into a cool faradaybag.com. Stay in public, but personally invincible. Leak everything that isn't harmful for you using delayed transmissions with ifttt.com. Always have multiple copies of important documents, just for the case it's necessary.

Oh and I'd get a weapon and buy a bulletproof jacket (not vest). Avoid any contact to officials should be priority. Use Tor and VPNs like spotflux, hide.io, ovpn.to etc. and inform close friends to guard you.

+Trust no one.

<comment><USER36> I don't think that buying a weapon and a bulletproof jacket is logical in his situation. Seems quite counterproductive to me when dealing with officials.

<comment><USER35> I think a bulletproof jacket is logical if his life is in danger.

Yes, I agree on the weapon, every signal that can pull the trigger of an official's gun should be avoided. But I think not having a weapon maybe careless too, only he knows what's right in his situation. A stupid move when confronted with officials could cause him more harm than wearing a gun.

<comment><USER37> A weapon is just an excuse to get shot. Don't be armed. You can't fight an intelligence agency with guns.

</comment></comment></comment></comment><comment><USER38> The interesting part of this to me is that I'm curious how, exactly, a computer owned by an undisputed computer security expert was successfully backdoored. Presumably he isn't clicking on spear-phishing emails and the like. If they physically accessed the machine, e.g. they sent Jason Bourne in to bug his machine, he's probably headed for some trouble at some point. In general that kind of thing isn't done just for the purposes of poking around.

<comment><USER39> I agree: I'd be formatting the machine and putting it on sale or eBay and then I'd buy a new machine. Nothing illegal here.

Now if he's in trouble simply because he works in the security field, this is a bit concerning. The lawyer advice is the sound one: fight legally the system and bring this to court if the attacker did anything illegal.

Of course you have to laugh hard at the mediocrity of the second part of the "attack": directly contacting servers which can be reverse-looked up. Doh!

But it still begs the question as to how his computer got owned in the first place.

<comment><USER10> > _Of course you have to laugh hard at the mediocrity of the second part of > the "attack": directly contacting servers which can be reverse-looked up. > Doh!_

Is it mediocrity, or is it intended in order to send a message?

"We are on to you", etc?

<comment><USER40> I'd say imaginary myself. I'm curious what the systems were that were obviously csis systems. He failed to include any logs or information beyond his claims.

<comment><USER10> Failed implies he tried. He didn't try. He just told the story.

People seem to know the guy. I'm not sure this is "imaginary" at all.

<comment><USER40> The problem is you have a person who constantly has more and more amazing stories like this that he pushes everywhere with no proof. Logs or the hostnames or anything is pretty simple proof but require work to make up beyond a story. He put so much effort into detailing it why leave them out? That is why I want to see some sort of proof before I just believe his claims.

</comment></comment></comment></comment></comment></comment><comment><USER41> yet another cry for attention from this talented but misguided young man. First it was TSA and Homeland, now the Canadian CSIS -please! You yell and scream about silent circle, about Skype -you demean and disrespect other noted cryptographers when they get press....I work for the govt -your little Hello- Kitty plug in is akin to sugar koolaid. There are many senior experienced folks here that would make great mentors. Get a good mentor -but please stop with the high-school drama. its not reality. I am too old to placate this and someone needs to bring this young man under his wing. He has a future if he stops pining for attention.

<comment><USER42> ?The last thing society needs it his talent being co-opted. His software is a clever little tool and helps to strike a balance between overarching security organizations and the citizens they're supposed to protect. Sure it is not enterprise class but good enough is pretty damn good. I think you while he could learn from you tecnically, you could learn a lot from him as a citizen.

<comment><USER43> Good enough isn't good in crypto when people are trusting it for secure communications. Also why what's the difference (functionally) between cryptocat and pidgin/adium with OTR turned on? In the latter case I believe you can even use gtalk securely.

</comment></comment></comment><comment><USER44> Would be interesting to hear more details about which software he's using (OS, "Secure File Transfer desktop client", firewall).

Also, it would be interesting to see what one could find on a raw disk image clone (hidden files? rootkits?).

<comment><USER5> Hello, I'm the person who wrote the blog post.

I am using Transmit for Mac OS X, by Panic Software, version 4.2.

<comment><USER45> Unless you had logs in Transmit indicating it was used, I would recommend not saying they used Transmit to do it - considering OS X has a builtin command- line sftp client:

[http://developer.apple.com/library/mac/documentation/Darwin/...](http://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/sftp.1.html)

If you're still concerned your machine is affected, I'd recommend getting Little Snitch - which automatically blocks connections (both in-bound and out- bound) that are not pre-approved. In addition, when it auto-blocks it records the application that was making the connection attempt in the auto-block rule.

(Well, actually I'd suggest you dd a backup of the drive to analyze - <USER2> wipe and start anew.)

If they hired anyone of any worth, the person installed a timed launchd (or cron) controlled script to run rarely and at odd hours to upload content from your machine to those remote locations. This kind of setup a.) would use a command-line tool for the upload and b.) unless they knew you had Transmit it would be designed around executables already included in OS X or that they installed.

Unfortunately, if it has stopped, they've probably deleted the scripts and cleaned up the evidence. If you've got Time Machine running, however, you may have backed up some of their handiwork.

<comment><USER46> OK, the _proper_ way to do this is to not touch the machine at all. Shut it down and leave it alone. Maybe borrow its hard drive and back it up using 'dd'.

Set up a separate Linux (etc) machine with two ethernet ports as a firewall/router, running wireshark in addition to everything else. It can now log all packets in and out of your network, and save them for later analysis.

If nothing interesting happens in the time it takes you to get bored, copy just the files you really need across from your old HDD to a shiny new one.

<comment><USER45> Given that the author of the blog post seems to understand cryptography - <USER3> doesn't seem to have much in the way of the forensics skill set - I did intentionally try to keep my post at the general consumer level (though I did mention dd, like you suggested).

The real -legal- solution is to turn the computer off, stop touching it, and get a lawyer specializing in computer crimes. Get the machine to them so they can make an image of the drive, complete with hashes of the filesystem, so that they can prove it hasn't been tampered with past that point.

Then let -them- do the investigation, with someone that has the documented skills a court would recognize.

Thank you for your response, though. I was just trying to be a little more practical.

<comment><USER46> Good point(s).

I was more addressing the techical "How can I tell if my computer is haunted?" question than the original poster's legal issues, on which I am not at all qualified to speculate.

</comment></comment></comment></comment></comment></comment><comment> w-ll How did they get access to your hardware? No disk encryption?

Might be crazy, but when I travel I setup a webcam in my office to upload to a vps and then ustream 24/7. Highest quality (don't care about bw since nobodies home.)

<comment><USER5> Hello, I left for NYC for five days. Since I develop sensitive cryptography software, I do not store anything sensitive on my desktop, only on my laptop, which is kept with me at all times (even when going on dates and such.) It was my desktop that exhibited this behaviour after my 5 day trip to NYC. Stupidly, I left it on the whole time. I do use full disk encryption.

<comment><USER47> This is an interesting mindset...I'm inclined to do the inverse, because of how easy it is for someone to steal a laptop.

While yes, a desktop can be breached (as it apparently was in this case), there's more surveillance options you have with which to secure its surroundings. And agents would have to get a warrant anyway.

If you're worried about the prospect of them warantlessly breaking in...I guess that the more likely danger is that if they are willing to resort to that, they are also willing to stage a robbery in which someone punches you in the face and makes off with the laptop. Or hire someone to spike your drink during a date.

<comment><USER48> It's trivial to put a keylogger+rootkit on an unattended desktop than on a laptop in your bag. Stealing hardware can't be prevented, but the risk is mitigated by good full disk encryption.

</comment></comment></comment></comment><comment><USER49> I'd like to know more information.

As it's written this seems to be a very confused article to me. What exactly is the author's point in writing this? And what is his next step moving forward?

What operating system does he use, what software under that operating system (specifically the FTP client), does he have a secure firewall, etc. etc.

<comment><USER5> Mac OS X, Transmit by Panic Software (v. 4.2) — I blogged this in order to protect myself.

<comment><USER50> Why do you use Transmit? Panic's software is known (amongst people who do reverse engineering) for having many holes.

If you're doing really security sensitive work don't run questionable software which you don't have the source code for.

<comment><USER51> As someone who uses Transmit... what would you recommend instead? Command-line sftp?

</comment></comment></comment></comment><comment><USER52> I find the idea that Nadim is under surveillance to not be unrealistic. I don't believe he would be under surveillance for his programming. Whether for his associates is another thing.

I don't believe the people he alleges he spoke with are intelligence operatives. Whoever they are, they were almost surely messing with him (but could still be conventional employees of an intelligence agency.) Whether or not they're for real doesn't change my first paragraph though.

I'm not able to give any advice except this: As long as you're on this road, there is no one you can fully trust. No one at all. You haven't fully internalized this yet.

</comment><comment><USER53> I'm pretty sure that no legitimate covert service operative would identify themselves as such, nor would they brag about going to conferences.

<comment><USER54> Working for CSIS doesn't mean that you're a _covert_ operative. I know plenty of present and past employees of CSIS, CSEC, CIA, NSA, GCHQ, etc -- my understanding is that the general rule is "don't call attention to your affiliation, but it's ok to say if evading questions would draw even more attention to you".

<comment><USER55> this whole account sounds patently ridiculous considering the nature of cryptocat.

i would like to think that "CSIS" had better things to do.

<comment><USER27> Spying on and harassing activists has, for a long time, been a big part of what CSIS does. I personally know tech activists that have been spied on and harassed. The RCMP is also known for this.

Mainstream new story from a couple weeks ago in which activist orgs complained of CSIS harassment:

[http://www.ctvnews.ca/activists-warn-against-csis- intimidati...](http://www.ctvnews.ca/activists-warn-against-csis-intimidation- tactics-1.760797)

<comment><USER28> _Spying on and harassing activists has, for a long time, been a big part of what CSIS does._

Give me a break.

Canada has a very open door immigration policy. Unfortunately that open door draws in people who actually don't like what Canada is about (which makes it weird that they would come here) and who conspire against, effectively, Canadian society. I __welcome __that law enforcement cares about this and does normal investigations.

Further from a corporate perspective it is well known that China, in particular, is going absolutely rampant with corporate espionage in the West. This is a major concern.

Or just call it some sort of "anti-activism" creed.

<comment><USER27> >Unfortunately that open door draws in people who actually don't like what Canada is about ... Or just call it some sort of "anti-activism" creed.

Sounds like what you're saying is that because CSIS does some legitimate things it means they don't also do less legitimate things, like harass/spy on activists.

<comment><USER56> Perhaps the confusion is because CSIS spying on people is a legit thing.

<comment><USER27> Writing cryptography tools, and activism in general, aren't illegal and people who don't break laws should not be spied on or harassed.

<comment><USER56> If they knew who the lawbreakers were, they wouldn't need to spy on anyone.

<comment><USER27> Good logic to justify blanket domestic surveillance.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> If you need donations for any legal pursuits, set up a page accepting bitcoins or similar.

I'd totally support this.

Illegally monitoring a citizen has to about as bad as it gets in my books. Especially someone who has never done anything illegal and only received attention by building tools to help free speech/privacy.

<comment><USER57> Illegally monitoring anyone, citizen or not, is excessive and supremely uncool.

<comment><USER58> Actually it is not excessive. It is legal for CSIS to monitor non-citizens and it is even legal for them to investigate citizens if they may be assisting foreigners that Canada disapproves of. I was interviewed by CSIS because I did some technical work on a server for a foreign-born Canadian who was suspected of being involved in white-power/neo-nazi orgs. The goal of CSIS was to find out if a certain prominent foreign white-power speaker might sneak into Canada. There was a well-known leaky spot in the US border not far from the town where this guy lived.

This Nadim fellow is a suspicious guy doing suspicious things who travels to terrorist hot-spots and to the USA, which is also suspicious. And I bet that CSIS is reading every word on HN right now. After all, where do you think that CSIS finds the hackers to set up the kind of hacks that Nadim has described? Same goes for CIA, NSA, FBI, DHS.

<comment><USER59> > Actually it is not excessive. It is legal for CSIS to monitor non-citizens > and it is even legal for them to investigate citizens if they may be > assisting foreigners that Canada disapproves of.

Just because something is legal doesn't mean its not excessive. Just because the government does something, doesn't make it right.

</comment></comment></comment></comment><comment><USER60> Magikarp, out of curiosity, why do you think the CSIS want to spy on you?

1) Because you are an anti-surveillance activist.

2) Because they want to eventually backdoor Crytocat in order to spy on the users.

3) Because the FBI asked CSIS to spy on you, and the FBI has their own motives.

<comment><USER61> all 3?

</comment></comment><comment><USER62> I am inclined to believe this is some sort of publicity stunt. This is based on the same amount of evidence that has been presented to the contrary :)

<comment><USER63> Absolutely. Do a little more than surface level digging and this guy is really just a child playing with toys and announcing it loudly to the world.

<comment><USER64> Smart teenage coder turned activist... Reminds me of Aaron Swartz, surprised no one mentioned his name yet...

<comment><USER63> Sorry but respectively, no. I can't allow you to trash Aaron's name like that. Aaron was actually a child prodigy and a borderline genius who had done more than this at 14 years old. This kid plays with JavaScript and wrote a chrome extension that adheres to the XMPP spec. They're not in the same league.

<comment><USER65> It's ironic that you keep calling him "kid", yet he's obviously accomplished more than you. Is this veiled jealousy, or what?

In any case: Please take the time to actually understand the difference between XMPP and OTR. You have repeatedly and very confidently shown a fundamental misunderstanding of their function and implementation in this thread.

</comment></comment></comment></comment></comment><comment><USER66> Is the OP sure those were CSIS peeps? Just wondering based on how they bumbled through their attempts at making contact. Thought intelligence agents would be slicker than that.

<comment><USER67> Maybe this is the new guy, and it's his first assignment. Maybe it's not CSIS, but some other interested party. Seriously though, they're gov't employees, the hiring process does not guarantee the highest quality in every case.

</comment></comment><comment><USER68> I may or may not have any comments about your situation. Nevertheless, anyone responding to these comments needs to know that there is no guarantee that magikarp is actually Nadim himself, whether the account is compromised and so on. Catch 22 is in full mode in this thread and I would hope that this is not simply paranoia kicking in.

Hypothetically, what is the benefit of airing out of all this information ?

<comment><USER63> _Hypothetically, what is the benefit of airing out of all this information ?_

Media attention. That seems to be all this kid has done is wave things at the media that the media themselves don't understand. Cryptocat is a javascript implementation of XMPP with OTR enabled. _Snore_... Hop on Google chat and click "Off the record" and you've done the same thing cryptocat does. Unlike google chat you have to load up yet another Chrome browser extension that will no doubt eat more memory.

The "anapnea" thing he was involved in looks like a joke as well. "Encrypted tunneling network"? You mean a VPS you give people SSH access to? Mind blowing.

Nothing to see here folks. Move along.

<comment><USER65> You're quite cocky for being so hilariously wrong. "Off the record" in GTalk makes it not log your conversation in your "Chats" folder. It has absolutely nothing to do whatsoever with encryption or deniability.

<comment><USER63> I'm sorry, I thought this was "hacker" news. I Expected people would know that Google's OTR and OTR XMPP spec are different. My point was that you shouldn't be using 3rd party services to talk to people if the information is legitimately sensitive.

<comment><USER65> The specs are not "different." They are completely different things.

You realize it is impossible to talk to somebody over the Internet, or in real life except in person, without relying on a third party, right? You choose who to trust, and OTR, the protocol, makes it so you only have to worry about the software used, not about the communications channel and anyone listening in on it.

<comment><USER63> _> Google's OTR and OTR XMPP spec are different_

 _> The specs are not different. They are completely different things._

Do you not have any reading comprehension? That's literally what I said. I haven't said anything against OTR at all. I fully support the use of XMPP and OTR for communications. You can attack me all you'd like, it doesn't change anything I said.

<comment><USER65> > Hop on Google chat and click "Off the record" and you've done the same thing > cryptocat does.

This is _literally_ what you said.

> You can attack me all you'd like

I don't think I'm attacking you, but after being this insulting to Nadim Kobeissi, in this thread and on Twitter, you don't get to play hurt.

</comment></comment></comment></comment></comment></comment></comment><comment><USER69> If this is true - we live in a scary world. If not, the guy has talent in marketing.

<comment><USER70> We live in a scary world either way.

<comment><USER69> Haha! You are so right (unfortunately).

</comment></comment></comment><comment><USER71> Since you have already published so much of this story. How about full disclosure and post the actual hostnames, firewall entries and that email you received?

</comment><comment><USER72> What's the story with everyone calling each other 'friend' in this post? Is this some crypto community thing I'm not aware of or just coincidence?

<comment><USER73> Canadians.

<comment><USER74> A _cryo_ \- community then.

</comment></comment></comment><comment><USER75> For a hacker site, why are so few people interested in seeing his logs?

I hope Nadim does a full write-up, including these, soon.

In the meantime, all the best and keep your (thankfully already) level head.

<comment><USER63> They're caught up in the moment, I'm guessing. My first reaction was _"where are the logs? show me some kind of actual proof"_. Otherwise this is just some kid who's paranoid and has a rootkit on his machine or something.

</comment></comment><comment><USER76> I'm somewhat surprised that the cryptocat project has been ruffling so many feathers (assuming that the story is in fact what it appears to be).

<comment><USER55> i know the author (nadim) is in here and this is all a bit fantastic. cryptocat is one of many crypto snake-oil products that i would never consider using for any kind of secure communication.

using defective crypto products is much riskier than not using any crypto at all and exercising caution. cryptocat has always seemed a poorly disguised honeypot to me.

<comment><USER5> It would be nice if you could meet me for coffee and say this to my face, friend.

I am trying to protect myself and my open source project, which, by the way, has been audited countless times and has progressed greatly towards security. If you have a problem with me, then call me up and discuss it instead of stressing me out even more when I just discovered that the government is building a case against me.

If you don't like my work, file a bug report. Check out our documentation. Review our OTR implementation. Submit a pull request. Hack some code. Just don't say hurtful and untrue things like that in public. You can do better.

<comment><USER77> Law enforcement officers come to you with a correctly formed legal document - a court order, or a warrant, or somesuch - and ask you to serve a malformed client to some cryptocat users. This malformed client will give the impression of encrypted communication, but will actually allow the law enforcement officers full access to the plain text (but only for the specified users). What do you do?

This is the Hushmail attack, and it seems like Cryptocat is vulnerable to it.

<comment><USER5> Cryptocat is a browser plugin. You need to download it like everything else. The source code is on Github.

I swear upon my father's grave I will never do something so dishonest and evil towards everyone who has supported Cryptocat, the most meaningful thing I have made with my life.

<comment><USER78> Unfortunately, I don't think you have a choice in these cases, I think you are obligated by law to do it.

<comment><USER30> You always have a choice. In this case, you can refuse and go through the legal system. If you've made that choice already, then you can further raise a big stink about it and hope public pressure forces the gov't to back down.

<comment><USER78> Oh, interesting, I didn't know that. Thanks for clarifying.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER79>
      I have to wonder what you'd see
      If you used style as ID.

      Styles change from time to time
      But style stays from line to line.

      Names can change and faces too
      But writing tells you who is who.[0]

      Many say they are a crowd
      But fewer do once lost their shroud.

      Traps and snares one will find
      Many more if kept their wits about their mind

      Still plenty that you see
      Hide their face behind IP.

Just a thought.

[0]: [http://33bits.org/2012/02/20/is-writing-style-sufficient- to-...](http://33bits.org/2012/02/20/is-writing-style-sufficient-to- deanonymize-material-posted-online/)

[1]: EDIT: It seems to me that it is very possible that not all accounts here, though not necessarily in this thread, correspond to a single individual.

<comment><USER80> Could you... elaborate more on this, perhaps?

<comment><USER79> Sure. While I don't want to start a witch hunt, I often wonder while reading discussions who it is behind the handle. To the point where I can't help but think that a little careful observation might uncover an army of sockpuppets.

With the help of the HN api, you could probably fingerprint a lot of users.

</comment></comment></comment><comment><USER59> Is it possible that they may have used a type of hardware backdoor? Something that would be connected to the router, or back of the computer using the lan or usb port?

None of that would show up in any logs or files, and it would get around any password protection and encryption on the actual computer, the only evidence would be from monitoring router traffic. A usb bug would be something that would transmit via wifi, but it would need to be connected directly to your computer to work.

Also check inside the computer for anything unusual.

</comment><comment><USER81> In case you're curious about who exactly we're talking about.. check out this CSIS Recruiting Video, complete with ominous, heart-thumping, background music.

<https://www.youtube.com/watch?v=dszXCHbvJYY>

more: <https://www.youtube.com/user/csisscrs/videos?view=0>

</comment><comment><USER82> Just looked at the update. "we have migrated Cryptocat's network into new servers inside a Swedish nuclear bunker" Holy Crap!

<comment><USER24> Also love the photo of said bunker.

[https://blog.crypto.cat/wp- content/uploads/2013/02/Port_sn_0...](https://blog.crypto.cat/wp- content/uploads/2013/02/Port_sn_05.jpg)

<comment><USER83> Upon visiting that blog.crypto.cat URL, Chrome tells me "Incorrect certificate for host / Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery."

The main crypto.cat page loads fine over HTTPS (certificate has sha1 thumbprint d1aa1c1037202e359f224e407d7f84a0e8a94dd7 which i see is advertised on the erroring blog.crypto.cat page).

Why has the certificate changed? Why did the CA signing the SSL certificate change? Is there any forwarding message signed by the original certificate?

<comment><USER5> It's a bug in the Chrome 25 Beta. Will be fixed on stable release.

</comment></comment></comment></comment><comment><USER84> The Wikipedia article notes that the press attention garnered by Nadim after his prior tussles increased the popularity of Cyptocat. Now imagine an intelligence agency wanting people to make greater use of a system they have back-doored or which is vulnerable to attack by them. Perhaps they couldn't resist the urge to make Cryptocat more popular! (Disclaimer: I have no knowledge of Cryptocat or CSIS, and my comment is hypothetical speculation. Alternative hypotheses are that they are invading Nadim's computer to try to find a way to break Cryptocat or to spook its developer, or because they have Nadim under some sort of surveillance, for who knows what reason.)

I do have a question about the story though. Why would an intelligence agency want to "acquire" Cryptocat? What would that mean anyway? Purchasing it for internal use is surely not necessary. They can just use it or any one of a number of in-house products they surely already have access to. Purchasing it to take it out of circulation is a possibility. But is this actually feasible? It's Open Source. Purchasing it to stop the developer working on it is a possibility. But wouldn't others step up? Buying a controlling stake in it is a possibility. But I don't see why an intelligence agency would make an offer of cash to someone not known to be susceptible to that kind of manipulation. I actually just don't see them doing this full stop. They surely know Nadim is motivated by idealism, not cash. So I can't think of a reason to "acquire" Cryptocat that actually stacks up. To work out what is going on here, you have to put yourself into the mindset of the individuals and organisations involved. And that is not easy if you simply have their media persona to go by.

Like the rest of the population, these organisations tend to be filled with people of many different persuasions, from geeks and activists and hackers through ultra-authoritarians and rogue elements. It's impossible to know which group is responsible for this, or what their motivations might be. It might have even been an unauthorised operation! And it may just as easily have been someone spoofing CSIS, e.g. some hacker group angry at CSIS for some past grievance. If so, I bet it is baking CSIS's noodle just as much as Nadim's!

At any rate, one should never infer a conspiracy where simple administrative or bureaucratic incompetence is a perfectly valid explanation.

</comment><comment><USER85> This sounds a bit like your friends are playing a prank on you, or CSIS is smart enough to make it look like that is the case.

The key here is your desktop and how did they access it.

</comment><comment><USER86> You should attempt to contact the Canadian Civil Liberties Association as soon as possible and protect the evidence on your laptop with your life.

</comment><comment><USER87> That'd have been an awesome trolling opportunity.

</comment><comment><USER88> This is the most trouble a browser plugin could ever cause anyone, and if all this is true then the Canadian government, the FBI and whomever else are after this kid are being very silly. That being said I can't help but think the author likes the media attention, and why wouldn't he, it must be bringing more exposure to his work.

<comment><USER89> I think it's more of the sense of the passion that he puts into his work, you should read the weblog.

</comment></comment><comment><USER90> Update found via Nadim Kobeissi's Twitter feed on Feb 11 @ 7:37 AM:

"Alleged CSIS Liaison Officer met me for coffee yesterday. Told me that Cryptocat is national security threat to Canada. That is all."

<https://twitter.com/kaepora/statuses/300992047345704960>

</comment><comment><USER91> I'm extremely confused by one detail. I'd like to know, what would be the point of describing oneself as a "Juror" or "former Juror"? Is there a particular court case involved with this story that I've missed a reference to? Is it some kind of slang in intelligence circles?

</comment><comment><USER92> And now his server is down?

<comment><USER93> Nothing to do with traffic, must be the agents trying to silence the truth.

<comment><USER94> Or that it is Wordpress.

<comment><USER95> "Never attribute to malice that which can be adequately explained by Wordpress"

</comment></comment></comment></comment><comment><USER96> Google cache: [http://webcache.googleusercontent.com/search?q=cache:http://...](http://webcache.googleusercontent.com/search?q=cache:http://log.nadim.cc/%3Fp=110)

</comment><comment><USER97> Just curious how you are so certain that the servers were CSIS servers?

Pretty sure you would never be able to trace back a CSIS or CSE ip.

</comment><comment><USER98> In other news, Canada's internal security agency is using "PG" to entrap people...(read the article for context)

I guess they read HN too.

<comment><USER99> This PG approached him with a "business opportunity" -- so the Canadian security folk probably _did_ mean to confuse him into thinking that this PG is our HN pg.

<comment><USER30> They really should have tried harder. For some reason, I really can't picture pg in a black suit.

</comment></comment></comment><comment><USER100> Straight into the Supreme Court? That is way better oversight over executive branch spying than in the US!

</comment><comment><USER101> I suggest you contact the CSIS and ask them directly why they've backdoored your computer.

</comment><comment><USER102> Go talk to your MP as well.

</comment><comment><USER103> magikarp, could you please do a writeup on how did you notice the surveilance? Any extra info except i found a backdoor and noticed funny traffic would be more than useful to know.

</comment><comment><USER104> whatever you do make sure to document every single little detail, take photos, videos, audio recording, keep the emails, etc...

</comment><comment><USER105> try a different computer for example android / linux or something exotic much harder to backdoor compared to windows

</comment><comment><USER106> Umm, backup and format you computer?

</comment><comment><USER107> you should revise your TCP connections if you want know if it's a joke or not

</comment><comment><USER108> Canada has secret agents?

<comment><USER109> > Canada has secret agents?

The fact that you don't know about them means ... the plan is working.

</comment></comment><comment><USER35> ANY UPDATES?

<comment><USER90> <https://twitter.com/kaepora/statuses/300992047345704960>

</comment></comment><comment><USER110> Assange? McAfee? Is that you?

</comment><comment><USER111> IP logs or STFU

</comment><comment><USER112> Hackernews captivated by a schizophenic...

<comment><USER113> Correction: Lightly schizoid/paranoid may suspect hidden cameras in implausible situations. Schizophrenic screams at cars.

In this case, it's plausible enough suspicion, let's give him the benefit of the doubt, eh?

<comment><USER110> There are a few types of schizophrenia - paranoid schizophrenia being one of them.

</comment></comment></comment><comment><USER114> We are watching. Everything.

<comment><USER115> I'm just surprised you guys even exist - I thought "Canadian Agents" were something they'd just made up for Quantum of Solace.

</comment></comment><comment><USER116> Well probably because you did something wrong. Turn yourself in and reflect on your wrongdoings. Put yourself together and stop causing harm to the society.

<comment><USER117> Haha, it's his fault for living in Canada! Canada sucks, move to Japan!

<comment><USER113> This is also a good joke.

</comment></comment></comment><comment><USER118> "Whats that abeut? Are they not your friends buddy?"

</comment><comment><USER119> Honestly, I wasn't reading this very closely and started to wonder what in the world pg had to do with Canadian government agents.

<comment><USER101> Exactly the same. I had to re-read it and then I got that "PG" wasn't PG (Paul).

</comment></comment><comment><USER120> Man, who could imagine such skullduggery in such a boring place as Conscordia's Reggies. Secret agents and illegal break ins oh my!

Although, I did have a palestinian friend swear that the Tim Horton's on Guy was a hotbead for the Jordanian security service.

</comment><comment><USER57> What, no "C.I.Eh" comments yet? I'm... a little disappointed to be honest.

<comment><USER121> This isn't reddit.</comment></comment>


This tiny, wearable patch makes you invisible to mosquitos - <AUTHOR> http://io9.com/this-tiny-wearable-patch-makes-you-invisible-to-mosqui-894656159 <comment><USER2> Just use an oscillating fan.

[http://www.nytimes.com/2013/07/16/science/a-low-tech- mosquit...](http://www.nytimes.com/2013/07/16/science/a-low-tech-mosquito- deterrent.html)

It's also worth noting that previous attempts at preventing malaria in Africa have failed not because of any technological limitation, but because they view it completely differently than we do in the West.

> As medical anthropologists have consistently found, because malaria is so > common in much of sub-Saharan Africa, and because the overwhelming majority > of cases go away on their own, most rural Africans consider malaria a minor > ailment, the way that Westerners might think of the cold or flu.

[http://articles.latimes.com/2010/may/02/opinion/la-oe- shah-2...](http://articles.latimes.com/2010/may/02/opinion/la-oe- shah-20100502)

<comment><USER3> > [http://articles.latimes.com/2010/may/02/opinion/la-oe- > shah-2...](http://articles.latimes.com/2010/may/02/opinion/la-oe- > shah-20100502)

This is a revealing article. I somehow didn't think about, now rather obvious, cultural difference in perception of malaria. I also didn't know that "the overwhelming majority of cases go away on their own". I thought of malaria as a certain death without treatment.

The treated nets did, however, have technological issues, as pointed in the article: "Among other design flaws, their tight mesh blocks ventilation, a serious problem in the hot, humid places where malaria roosts".

Kite patch is simple enough to actually make it work. I just hope it is indeed effective.

<comment><USER4> Wait a minute - maybe we are being too sensitive to cultural differences here. Do we just accept the culture of sub-Sarahran Africa as equally valid to our own in this case? Do we just accept that Africans don't like using bed nets and so we must discount that approach and look for alternative ways to combat malaria?

Let's not pussy-foot around the issue. The LA Times article mentions that some African people think that mangoes cause malaria - in this case the African view is wrong and the Western view is right. Perhaps it is also wrong to hold the view that (a) malaria is no more harmful than the flu; and (b) having ventilation is preferable to a bed net.

I realise that changing people's attitudes is difficult, particularly when the message is delivered by white people who have such a poor historical record in Africa. But malaria causes a quarter of childhood deaths in sub-Saharan Africa [1] and insecticide-treated bed nets are 90-95+% effective, even when they have small holes [2].

I'm not saying that Western culture is always right - or even right when it comes to malaria. Lets just be careful to avoid automatically excluding other cultural viewpoints from criticism.

[1] [http://www.thelancet.com/journals/lancet/article/PIIS0140-67...](http://www.thelancet.com/journals/lancet/article/PIIS0140-6736\(12\)60169-X/fulltext)

[2] [http://www.againstmalaria.com/faq_bednets.aspx](http://www.againstmalaria.com/faq_bednets.aspx)

<comment><USER5> The question here, I imagine, is not primarily one of the validity of the various viewpoints. Rather, it is commentary that someone solving the problem of malaria has to accept the reality of the sub-Saharan African viewpoint as a starting point for their approach.

Foundationally, the local populations aren't clamouring for a solution, so they are much less likely to accept inconvenience as a by-product of a solution.

We know rhinovirus and flu kill scores of elderly people in nursing homes, but continue to avoid the minor inconvenience of meticulous hygiene before visiting our geriatric loved ones.

In risk communication, we might say "the audience will be hostile toward our rhetoric". Put another way, the target population will require careful encouragement to changing their viewpoint, while being presented with a solution that does not operate from a confrontational approach.

Any solution that does not consider the local populations' viewpoints will likely fail.

</comment></comment></comment></comment><comment><USER6> So the Bill and Melinda Gates foundation supported them with a grant, but not enough of a grant to do product testing?

Something sounds fishy to me....They seem to be all about results-based investing, and I just don't see the foundation providing funds without providing enough to "see it through" the development and testing phase.

Am I wrong here?

<comment><USER7> According to their text, they seem to have received those grants 3 years ago. Still, given the rather low goal, I'd, too, assume that this is simply a marketing strategy to increase visibility. After all, this is a kickstarter and when you back it (even though not receiving any Kites for yourself on the low tiers) you do something good for those poor people in Uganda!

Also, I'd guess that the $75k goal barely covers production, shipping & travel costs... and their manufacturing pipeline seems to already be set up.

</comment></comment><comment><USER8> It sounds very good, but how can I invest in them, if they make such a great effort in their video to avoid explaining what it does exactly?

How do you hide a CO2 footprint, when that same footprint could be smelled by a from musquito 100 meters away? Why not just tell us?

<comment><USER9> > how can I invest in them, if they make such a great effort in their video to > avoid explaining what it does exactly?

Here you go, there's an article under the video:

>If we had to guess, we'd say the FAQ are referring to this study, published by Ray and his team in a June 2011 issue of Nature, in which the researchers identify three groups of chemicals that can which disrupt a mosquito's carbon dioxide receptors

And also a helpful comment by "ciller" below the article:

>DEET works by blocking the CO2 receptors on mosquitos, this causes the mosquito to be unable to figure out non food sources from usable ones. If this kite patch blocks the CO2 receptors as well as DEET does, then it should be effective.

>I work in a laboratory that deals with mosquito related problems quite a bit and we are more then willing to test these things out in a small scale field study. A viable alternative to DEET that you dont have to apply over your entire skin surface area would be rather ideal.

<comment><USER10> It's not a very comforting explanation if it comes from a Pop Science blogger and starts with "If we had to guess..."

</comment></comment></comment><comment><USER11> From the linked article it is unclear if the chemicals are absorbed into the body or not. From the horse's mouth:

"Kite Patch is designed for clothing, not skin. A few news articles did get it wrong – but our technology is designed to be placed on clothing, baby carriers, backpacks, Camelbacks and other outdoor gear (for outdoor enthusiasts), etc. Kite is NOT a skin patch."

Source: [http://www.kitepatch.com](http://www.kitepatch.com) about 5 pages down.

Manufacture's website: [http://olfactorlabs.com](http://olfactorlabs.com)

</comment><comment><USER12> Did anyone else pick up on all the chemophobia in this video? Is a clip of people spraying DDT supposed to scare us? Rachel Carson was wrong. DDT is safe. My favorite part is when they say "food grade FDA compounds". That's a lot of words to say chemicals.

<comment><USER13> >DDT is safe.

[citation needed]

<comment><USER12> Rachel Carson's book Silent Spring is credited with starting the anti-DDT movement. It's been discredited and is full of junk science and needless corporation-bashing. Read the paper Chemicals and Pests which tears apart Carson's book. [1]

Checkout the New York Times article from 1962 titled "Fateful Voice of a Generation Still Drowns Out Real Science" [2]

A choice quote:

"Ms. Carson used dubious statistics and anecdotes (like the improbable story of a woman who instantly developed cancer after spraying her basement with DDT) to warn of a cancer epidemic that never came to pass. She rightly noted threats to some birds, like eagles and other raptors, but she wildly imagined a mass "biocide." She warned that one of the most common American birds, the robin, was "on the verge of extinction" — an especially odd claim given the large numbers of robins recorded in Audubon bird counts before her book."

You may also want to check out the story of Professor Kenneth Mellanby who ate DDT for 40 years. [3]

Make sure to take a look at the scientific paper mentioned in this Times article. It concludes "DDT is practically harmless to humans who get it on their skins or breathe it into their lungs." [4]

[1] [http://www1.umn.edu/ships/pesticides/library/baldwin1962.pdf](http://www1.umn.edu/ships/pesticides/library/baldwin1962.pdf)

[2] [http://www.nytimes.com/2007/06/05/science/earth/05tier.html?...](http://www.nytimes.com/2007/06/05/science/earth/05tier.html?ei=5124&en=14a418afaa8af640&ex=1338782400&adxnnl=1&partner=permalink&exprod=permalink&adxnnlx=1181487827-TjMEg9pHGxi9E4cK+bB4rQ&_r=0)

[3] [http://www.telegraph.co.uk/comment/4264030/DDT-is-safe- just-...](http://www.telegraph.co.uk/comment/4264030/DDT-is-safe-just-ask-the- professor-who-ate-it-for-40-years.html)

[4] [http://www.time.com/time/magazine/article/0,9171,812248,00.h...](http://www.time.com/time/magazine/article/0,9171,812248,00.html)

<comment><USER13> But the environmental effects regarding birds, as well as the impact of indiscriminate spraying on mosquito resistance to DDT are a far cry from "safe". Regardless of whether Carson was completely right about everything she said, it's silly to claim that DDT is generally safe when it clearly is not.

<comment><USER12> "DDT is generally safe when it clearly is not."

I'd love for you to cite your source on that. When used properly DDT is generally safe and has saved millions of lives. There is no arguing that it doesn't do a great job killing mosquitos. Resistance is mostly due to agricultural use. The video claimed we are using chemicals toxic to humans and flashed some footage of DDT being sprayed. That's simply a false assertion on the part of the maker's of the video and the product. They're trying to use junk science to push their product onto naive consumers.

<comment><USER13> >I'd love for you to cite your source on that.

Do you actually need me to cite my source on the fact that it harms birds and can lead to resistance? I can, if you need me to, but I didn't think those facts were in dispute. The extent of the problem is arguable, but all I'm asserting is that these are measurable effects. There is also evidence that DDT is harmful to humans, but as far as I can tell, it doesn't seem to be significantly more so than a ton of other things that we happily accept. It seems unlikely, for example, that DDT usage at its peak killed more people per year than air pollution from coal power.

Anyway, I think your general point is fair and that it was irresponsible to try to scare people away from controlled DDT use on mosquitoes. But I also think it's irresponsible to assert that DDT is safe. It's _OK_ to use solutions that aren't safe if the benefits outweigh the risks.

</comment></comment></comment></comment></comment></comment><comment><USER14> They have an indiegogo funding page where you can select your perks [1]. I am wondering why they needed $75k in the first place, if they were funded through Bill & Melinda Gates Foundation, wouldn't they just chip in the final chunk to push this into production?

[1] [http://www.indiegogo.com/projects/kite- patch](http://www.indiegogo.com/projects/kite-patch)

</comment><comment><USER15> From their own FAQ:

 _Does Kite provide 100% protection against mosquito bites? Kite provides a steady stream of our patent-pending spatial (airborne) compounds that block mosquitoes' ability to track us for up to 48 hours, but it does not guarantee mosquitoes will not bite us. It is being designed to be a replacement for spray-on, fan-powered, or lotion applications, but does not take the place of bed nets at night and /or appropriate clothing in mosquito-impacted areas_

So, they have put some compounds, that have been proven to repel mosquitoes in laboratory conditions, on a patch. The "minor" problem is that this patch can't possibly exude enough of those compounds to protect a human in real life conditions. I'm only refraining from calling this a scam because it seems to be a real company with scientists and all. But I won't be spending any money on this patch, that's for sure. [http://xkcd.com/1217/](http://xkcd.com/1217/)

</comment><comment><USER16> I remember in 2011 reading with great interest some research into nootkatone[1] as a mosquito repellent[2] _(which has already been shown to be effective against ticks)_. It is a non-toxic oil found in grapefruit and is already approved by the FDA as a food additive.

Unfortunately, I haven't seen anything _(read: consumer-available products)_ come of it. Upon a bit of searching, I found a patent[3] for a nootkatone- based insect repellent... filed in 1998!

[1]: [http://en.wikipedia.org/wiki/Nootkatone](http://en.wikipedia.org/wiki/Nootkatone)

[2]: [http://www.npr.org/2011/04/18/135468567/repelling-bugs- with-...](http://www.npr.org/2011/04/18/135468567/repelling-bugs-with-the- essence-of-grapefruit)

[3]: [http://www.google.com/patents/EP1033076A1?cl=en](http://www.google.com/patents/EP1033076A1?cl=en)

</comment><comment><USER17> I hope this comes to fruition, since it would be a huge boon for lots of people, assuming its cost effective. On a slightly more cynical note, I am so sick of the self aggrandizing sappy tone of these videos. I think the music is the culprit in this particular case. Maybe its necessary, but it drives me nuts.

</comment><comment><USER18> I don't understand what covering the CO2 in our breath could do to prevent mosquitoes from biting you when they are around your arm like we can see in the video when the guy puts his arm in the experience box. Does our skin emit CO2?

<comment><USER19> I don't think the patch helps when you're already surrounded by mosquitoes - the bugs use CO2 to find you in the first place, then find the bare skin using some other means.

<comment><USER18> In that case, what the hell is going on with their pictures of the arm in a box full of mosquitoes not moving towards the skin? Looks really really shady to me.

</comment></comment></comment><comment><USER20> Who has told people to stick investor-repellent soundtracks IN EVERY DAMN start-up-beggar campaign? That same bland optimistically beige stuff. This one didn't have the plunky piano and/or guitar bits, but it's like someone ran out and said...

The words aren't enough. We need sound reinforcement to lend emotion. Hmmmm... Apple used quirky, plucky, minimal for their quirky, plucky, minimal industrial design product launches... I KNOW! I want people to think I'm a quirky, plucky, minimal start-up that puts stinky color stickers on people!!!

</comment><comment><USER21> As anyone who's ever summered in Minnesota will tell you, (and as one who's been chased out of the woods near a river one evening by a starving swarm of thousands) this is akin to finding the holy grail.

</comment><comment><USER22> Where I am living this is available for such a long time. What is suddenly so new about it?</comment>


Good collection of Algorithms - <AUTHOR> http://stackoverflow.com/questions/tagged/algorithm

<comment><USER2> I really don't understand what is the point of such entries. Everybody knows stack overflow. Putting a link to a tag on SO is not really something worth sharing.

<comment><AUTHOR> Well, it's a weekend. Sharing this might lead some HNers spend some time going through the list of algorithms (which I thought is good; a refresher may be)which might be spent elsewhere. That's the intent.

</comment></comment><comment><USER3> There is also the NIST's Dictionary of Algorithms & Data Structures, which is formatted a little nicer. These are mostly 'textbook' algorithms though, probably not as specific as most of whats on StackOverflow

<http://xlinux.nist.gov/dads/>

</comment><comment><USER4> The Stony Brook Algorithm Repository is a nice little collection of algorithms, plus they out link to various implementations:

<http://www.cs.sunysb.edu/~algorith/>

</comment><comment><USER5> Was this supposed to link to the tag algorithms or to a particular question?

<comment><AUTHOR> It was link to the 'algorithm' tag.</comment></comment>


StatHat iPhone App Released - <AUTHOR> http://www.stathat.com/ios

<comment><USER2> Had never heard of StatHat before but the simplicity of the system is appealing. The pricing is a bit steep for the hobby projects I have however..

Are there any opensource alternatives to StatHat? (I'm aware of Graphite and such but I found it overly complex for my needs).

<comment><USER3> There is dashing ([http://dashingdemo.herokuapp.com/sample](http://dashingdemo.herokuapp.com/sample)) but it is Ruby specific.

I'd love to see the visual appeal of Dashing that perhaps uses statsd as a backend ([https://github.com/etsy/statsd/](https://github.com/etsy/statsd/)).

</comment></comment><comment><USER4> Great to see this. I've been using StatHat for a while now, tracking various analytics for [http://www.soundslice.com/](http://www.soundslice.com/) such as number of signups per day, etc. It's great for ad hoc stats.

</comment><comment><USER5> 2 hours ago I used a StatHat graph to convince a Time Warner Technician they'd messed up my network, and I showed them exactly when it happened. Love it.

</comment><comment><USER6> Looks really nice, but I don't see why this isn't just a mobile web page? What's the advantage of having a native app in this case?

<comment><AUTHOR> Push alerts, for one. And we think the user experience is better native.</comment></comment>


New code execution security vulnerabilities discovered in Ruby 1.8/1.9 - <AUTHOR> http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/

<comment><AUTHOR> Drew Yao at Apple found these. They're bad. Array and String both have integer handling problems; here are some fun diffs:

[http://svn.ruby-lang.org/cgi- bin/viewvc.cgi/trunk/array.c?r1...](http://svn.ruby-lang.org/cgi- bin/viewvc.cgi/trunk/array.c?r1=17101&r2=17460)

[http://svn.ruby-lang.org/cgi- bin/viewvc.cgi/trunk/string.c?r...](http://svn.ruby-lang.org/cgi- bin/viewvc.cgi/trunk/string.c?r1=17472&r2=17447)

We'll write up more on them later, right now just trying to nail down some exploits.

You're going to want to update soon.

<comment><AUTHOR> ... for starters --- x = ("A" * (2 __16)); while 1; s << s; puts s.size; end

Boom.</comment></comment>


Hacker Arrested in Billboard Porn Stunt - <AUTHOR> http://www.themoscowtimes.com/news/article/hacker-arrested-in-billboard-porn-stunt/399895.html

<comment><USER2> FTA: "He had previously worked as a systems administrator but was laid off, Interfax said."

I find this hilariously ironic. The whole world has the consequences of recession and depression on its mind, so the article closes with this epiphany: Lay off your computer geeks and they'll find other, more novel ways to amuse themselves.

</comment><comment><USER3> If there were any justice he would be hired (or at least given a brief gig as a consultant) by the company that serves the video billboards to increase their security.

I'll bet they had a default login (like admin:admin) and just relied on obscurity to keep their billboards safe.

<comment><USER4> This was a cute idea in the seventies, and we've been through this debate on ethics in the nineties and the consensus is that no, we're not hiring burglars to fix the locks anymore. There are other people who can fix locks and we don't have to reward anti-social behavior.</comment></comment>


How Did Astronaut DNA Become 'Fake News'? - <AUTHOR> https://www.theatlantic.com/amp/article/555794/?single_page=true <comment><USER2> Ironically, the amp link isn't loading for me. Non-amp link:

[https://www.theatlantic.com/science/archive/2018/03/scott- ke...](https://www.theatlantic.com/science/archive/2018/03/scott-kelly-dna- fake-news/555794/)

In any case, this Atlantic article was beat to the punch by Ars Technica two days ago:

[https://arstechnica.com/science/2018/03/scott-kellys- medical...](https://arstechnica.com/science/2018/03/scott-kellys-medical- monitoring-has-spawned-some-horrific-press-coverage/)

HN discussion - [https://news.ycombinator.com/item?id=16599612](https://news.ycombinator.com/item?id=16599612)

</comment><comment><AUTHOR> I wish they hadn't called it, "fake news," which I'd reserve for misinformation that's initially spread by those who know that it's false. In this case, I think that journalists' lack of knowledge about genetics led to erroneous reporting.

</comment><comment><USER3> "For reasons that remain unclear, the news stories that erupted this week resurfaced a couple of nasa press releases from January, which came out after the study's scientists presented some of their preliminary results at a conference. The releases were summaries, and some of the language was ripe for misinterpretation."

If a Journalist can't explain a journalism event, I am disinclined to ever believe anything they will ever write.

Why is it hard to find the time stamp of the press release or article that started this firestorm if noise? Why is there no explanation of why that approach doesn't work? Are date sort searches really that useless in this situation?

</comment><comment><USER4> The same way anything else becomes fake news: a headline that is seemingly the product of a mental function that optimises for the most sensational emotion under the loosest possible construction of the facts (and sometimes even looser than that).</comment>


Show HN: My first serious Android game - <AUTHOR> https://play.google.com/store/apps/details?id=com.zerobudgetdev.AlienShootout

<comment><USER2> congrats on launching! hope it goes well for you.

small suggestion: try to add some screenshots to the play store that give a better idea of what the game is. at the moment i paged through all of them and i'm still unsure of what kind of game it is.

<comment><AUTHOR> Thank you for the suggestion.

</comment></comment><comment> atom-morgan Damn, I really wish I had an Android device just to play this. I was always a big fan of Super Mario Galaxy which makes me think I'd like this game too. Did it influence your design at all?

<comment><USER3> > Damn, I really wish I had an Android device just to play this.

I can't resist pointing out that there's an x86 Android distribution available -- you can create a small partition on a desktop or laptop hard drive -- say, 20 GB -- and install it, then set up dual boot. It beats having to buy an Android device just to have an occasional exposure or run a test.

Good news: free, runs on x86/64 machines.

Bad news: only runs Android programs that either don't have any native code, or that have multiple native executables for different platforms.

More here: [http://arachnoid.com/android/Android-x86](http://arachnoid.com/android/Android-x86)

<comment> atom-morgan Thanks for the suggestion. I may have to set this up.

<comment><USER3> I should have added that the source for Android x86 ([http://www.android-x86.org/](http://www.android-x86.org/)) have a way to burn their runtime to a USB stick, which is easier than what I suggest on my Web page, and might get you closer to what you were after -- a painless way to sample a few Android apps.

</comment></comment></comment></comment><comment><USER4> Pretty good. A small tutorial or help page in game would go a long way though... plenty of users will install without thoroughly reading the description.

</comment><comment><USER5> Unity?

<comment><AUTHOR> Yes.</comment></comment>


On Linux, 'less' can probably get you owned - <AUTHOR> http://seclists.org/fulldisclosure/2014/Nov/74 <comment><USER3> _I 'm also not sure if the automation actually scratches any real itch - <USER2> doubt that people try to run 'less' on CD images or 'ar' archives when knowingly working with files of that sort._

This is a trend not uncommon in GNU software -- features added by someone who at some point thought it was a good idea, but probably didn't even bother using them much beyond an initial test to see that they are somewhat working. Most users likely think of 'less' as nothing more than a bidirectional version of 'more', and not as the "file viewer that attempts to do everything" that it seems to actually be. It's also a little reminiscent of ShellShock.

<comment><USER4> lesspipe is not a GNU project...

<comment><USER5> Yes, the responsibility here lies squarely with the distros that set LESSOPEN and LESSCLOSE.

</comment></comment></comment><comment><USER6> This is probably a good reminder of something else: using selinux/apparmor/tomoyo/... can save you from many situations where you'd be exploited otherwise. For example as a response to this you can set a policy on lesspipe and all its children so that they cannot access the internet or write outside of temp directories.

Whatever library is used by lesspipe - you're safe as long as the output terminal and your kernel are safe.

<comment><USER7> This should honestly be part of every modern Linux system. It would go a long way toward creating the kind of reasonably secure system people are looking for.

I would envision this to be useful if there were a pre-installed local database of common use cases for each utility, and the user invoking the utility could interactively decide whether to allow specific exceptions, with a big fat warning.

Then, it doesn't matter whether someone exploits your tool, they're only ever allowed to utilize the tool for its intended use cases.

<comment><USER8> Yet when apple makes a sandbox for apps -- which is basically this design, yet usable by people who don't understand software construction or libs -- people shriek. A sandbox is a security boon for the vast majority of people. And I think this is the only way to get reasonable security; we've been banging on this "reduce bugs" plan for at least a decade with much less progress than one would hope to show for it.

<comment><USER9> People shriek because Apple isn't giving the device owner any option to get around the security if they want to.

Apple aren't using that model just for security, but also so they can tightly control the platform and restrict what the device owner can do on it.

<comment><USER10> > People shriek because Apple isn't giving the device owner any option to get > around the security if they want to.

You are misinformed. Right click -> Open instead of double click overrides my current signing requirements and executes the app anyway.

<comment><USER11> Where do I right click on my iPhone?

</comment></comment></comment></comment></comment></comment><comment><USER12> This research lcamtuf has been doing with AFL is really important.

One thing that it is proving (exactly as a lot of people expected) is, we don't have any idea where security bugs (think the next heartbleed or shellshock) are going to show up, we have no idea how good the software out there is (meaning it is bad), and most of the time we don't even know what's running on our own boxes.

If these basic things we use hundreds of times a day (less, strings) have huge flaws, we have a lot of work ahead of us.

<comment><USER13> They will never go away while people insist in using C and its derivatives to write userspace code.

<comment><USER14> Shellshock didn't have anything to do with C. gotofail looked like an SCM merging bug, which could have happened in any language. Security issues in the Rails world are often caused by libraries that do more than they should, just like less does (YAML comes to mind).

Yes, it would be nice to get rid of one class of errors. But proper sandboxing would get rid of them all.

<comment><USER15> Yeah those are the famous ones, but what's much more likely is that you're not going to necessarily be working on a project with as wide a footprint as any of those, and you're probably not going to create a bug that's quite as harmful as any of those either, but you're still going to cause memory- management problems for your project if you start out writing C.

No one's saying it's impossible to write memory-safe C code, it's just exponentially harder, and when you're not 100% sure of your use case and exact performance needs, you're going to spend a _lot_ more time than you want to making C do only what you want and nothing else.

</comment></comment></comment></comment><comment><USER16> Last month, it was "file", which turned out to have a parser for executables which can be exploited via a buffer overflow.

Probably the best exploit in this line is crafting JPEG files which cause buffer overflows in forensic tools and take over the machine being used for forensics.

We need an effort to convert Linux userspace tools likely to be invoked as root or during installs from C/C++ to something with subscript checking.

<comment><USER17> "strings" is also vulnerable: [http://lcamtuf.blogspot.com/2014/10/psa-dont- run-strings-on-...](http://lcamtuf.blogspot.com/2014/10/psa-dont-run-strings- on-untrusted-files.html)

Inspecting files is apparently hazardous.

<comment><USER18> No, writing general handling code in C is hazardous.. And after that, mixing domains, especially for human convenience, is dangerous as parsing gets complicated and leads to the unexpected.

Rust can solve the first problem. A sense of elegance or just good taste can solve the second.

<comment><USER19> This problem with LESSOPEN would exist even if less was written in Rust. The same goes for the strings command.

<comment><USER20> All the more reason to use memory safe languages as far up the stack as you can go.

</comment></comment></comment></comment></comment><comment><USER21> The first time I accidentally ran "less" on a directory and it piped some version of "ls" into itself, I was mildly annoyed. The thing's supposed to page a text file on a terminal. Since then, I've had to think twice before invoking it to avoid this "helpful" behavior, and I'm not surprised that it came back to bite people.

<comment><USER22> > The first time I accidentally ran "less" on a directory and it piped some > version of "ls" into itself, I was mildly annoyed.

        % less .
        . is a directory
        % less imadir
        imadir is a directory

My point is, that behavior is a configuration issue on your end, not inherent to the less codebase.

<comment><USER21> > My point is, that behavior is a configuration issue on your end, ...

On my end, and on every "end" where I ever log in. "less" works as a simple pager on my own system, but now I need to remember to possibly fix it everywhere else. "You can fix it in the config file" is not an excuse for broken-by-design software.

> ... not inherent to the less codebase.

Well yes, it kind of is. "less" used to be a better replacement for "more." Now it's something else, which should have a different name. Should "cat" be changed to automatically uncompress files and concatenate archives?

<comment><USER23> > Well yes, it kind of is. "less" used to be a better replacement for "more." > Now it's something else, which should have a different name. Should "cat" be > changed to automatically uncompress files and concatenate archives?

"less" already means "pager with all the bells and whistles". If you just want a simple pager, "more" is still there. How many fine gradations do you need?

<comment><USER24> Back in the old, old days, we all started using 'less' because 'more' did not have the ability to scroll backwards through a file. Nor was it buffering pipe input to enable similar functionality. It seems there has been a bit of feature creep in the ensuing 25 years...

<comment><USER25> Yup, cause apparenlty staying the same for 25 years is the new normal. Would you discard more too if it added the ability to page back in a document?

<comment><USER24> No, but if the maintainers added the ability to play MP3s and file my taxes, that is a cause for concern.

</comment></comment></comment></comment></comment></comment></comment><comment> vezzy-fnord This was also mentioned in one of the pages of The Fuzzing Project, linked on HN just a short while ago as of this comment: [https://fuzzing- project.org/background.html](https://fuzzing-project.org/background.html)

<comment><USER26> I was idly wondering about "less" a month ago. [https://news.ycombinator.com/item?id=8506813](https://news.ycombinator.com/item?id=8506813) It looks like my answer is "yeah, people are looking at that."

</comment></comment><comment><USER27> That is bad default behaviour on Ubuntu's (and centos'?) behalf. I have confirmed this is not the case in Debian.

</comment><comment><USER28> I think this is one side effect of development. We are trying to implement any feature that would be _nice to have_ into every software.

LESSOPEN or LESSPIPE is a feature that is already achievable via manual means. But automation is the king so it's a nice feature to have it in the software implemented.

If we could just stop and move on whenever software is capable of doing what they are intended for as smooth as possible, many of these issues would diminish to exist.

</comment><comment><USER29> Am I missing something? Is lesspipe run as root? What could you execute via lesspipe that you couldn't from the command line?

<comment><USER30> > Ultimately, I think that there's an expectation that running less on a > downloaded file won't lead to RCE

When you use less, you do not expect any code to be executed, and this article shows how this might be the case (through unexpected invocations of other utilities which may have bugs in them).

There are many ways to go from normal shell to root shell after that.

<comment><USER26> There's not a firm list, but certain commands should always be safe to run against hostile input.

If I type "make" on a project I downloaded, arbitrary stuff gets run. I accept that as part of make.

If I sha256sum a hostile file, that should never lead to RCE.

<comment><USER31> If you open a PDF, that should never lead to RCE, but that's not the world we live in. Better for tools not to open PDFs when you don't expect that to happen.

<comment><USER26> It depends what's hiding in the word "open."

If I open a PDF in a full-featured reader, I'm slightly ill at ease. If I sha256sum it or wc it, I should be (read: ought to be, in any sane world) perfectly at ease. No matter how complicated the data structures in it, they shouldn't affect those programs.

<comment><USER31> As per the link, I'm talking about less "opening" a PDF by shelling out to pdftotext. "Hiding" is a good word for the behavior. :)

</comment></comment></comment></comment></comment></comment><comment><USER32> I checked what I have on my Ubuntu 12.04.

$ env|grep LESS

LESS= -R

LESSOPEN=| /usr/share/source-highlight/src-hilite-lesspipe.sh %s

Safe, as long as source-highlight isn't buggy.

I also checked my .bashrc and found this

# make less more friendly for non-text input files, see lesspipe(1)

# NO! I don't want this!

# [ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"

So yes, lesspipe was the default and for some reason I commented it out. I vaguely remember at being annoyed about less showing me something different from the actual binary content of the files.

</comment><comment><USER33> > Many Linux distributions ship with the 'less' command automagically > interfaced to 'lesspipe'-type scripts, usually invoked via LESSOPEN. This is > certainly the case for CentOS and Ubuntu.

I just ran less on a dir in Ubuntu Trusty (latest LTS) and got the expected "<dir> is a directory" message.

</comment><comment><USER34> Less really is more

<comment><USER35> Using Ubuntu 12.04

            md5sum /bin/less /bin/more
            4be69e915a4b4514d3d06ee07dd56a68  /bin/less
            11fc84952b1f31a91b5b6ec29740e497  /bin/more

Or it just my system?

<comment><USER36> /bin/more is in the util-linux package.

Less can pretend to be more if run that way, but debian also does ship the real more command.

</comment></comment></comment><comment><USER37> Should this show when I run env or not?

<comment><USER38>
      $ env | grep ^LESS
      LESSOPEN=||/usr/bin/lesspipe.sh %s

      $ cat /etc/redhat-release
      Red Hat Enterprise Linux Server release 6.6 (Santiago)

</comment></comment><comment> guard-of-terra That's why

      alias less=/usr/share/vim/macros/less.sh

<comment><USER39> I used to do that with vimpager (a better implementation of this shell script). Unfortunately this cannot work as it doesn't process data as it arrives, you need to wait for input to end. So it's only good for fast & short commands.

<comment> guard-of-terra Sure, but I have a separate alias for streams. alias -g even, zsh-style.

</comment></comment></comment><comment><USER40> but also vim. and irssi. and gpg. and a bunch of other day to day linux programs nobody bothered to review very thoroughly.

Just any case anybody still believe its just java, flash, openssl and bash that suffers bad vulns (oh oh oh).

</comment><comment><USER41> Using cat in terminal can get you owned.

</comment><comment><USER42> rm /bin/less

Problem solved.

Any binary utility that I haven't used in a 6 month period can get lost. The problem is that there are probably a hundred or so more issues like this hiding in /bin/* and /usr/bin/* and wherever else executables are hiding.

Is there a way to retrofit 'can shell out' as a capability flag not unlike the regular access permission bits?

<comment><USER43> You probably did use less in the past 6 months if you used Linux in the past 6 months. less is usually the default pager for things like 'man', 'git log', etc.

But as pointed out in another comment the problem is not with 'less', but with some distros configuring it to use 'lesspipe' as preprocessor.

</comment></comment><comment><USER44> I checked on Debian Jessie and the /usr/bin/lesspipe script runs entirely off the file extension. So there is no issue with less itself. If someone sends me, say, a malicious doc file I would have to type "less blort.doc" to get owned by catdoc. The only time i would ever type that is if I knew that less would invoke catdoc, that I actually had catdoc installed on the machine and for some reason I wanted to use catdoc to look at a doc file.

Less only installs a mailcap entry for "text/*". A mail reader that could not handle plain text itself would not be much of a mail reader.

That also means that it is kind of stupid to have less display non-text things. Still not a real security issue.

<comment><USER45> User continence works great until someone figures out how to get lesspipe called automatically...

' _I_ would never run bash manually on unsanitized input from HTTP requests!' [years pass] /shellshocked!

<comment><USER44> Pretty sure that shellshock doesn't involve any manual invocation of bash....

<comment><USER45> You're right, it doesn't. Think a little harder.</comment></comment></comment></comment>


Chmod by Letters Vs Numbers - <AUTHOR> http://unix.stackexchange.com/q/94212/10611

<comment><USER2> I never find numbers readable. I always rely on google conversion to do the right amount.</comment>


Solving the HN comment problem. - <AUTHOR> http://i.imgur.com/nY4X4.png

<comment><USER2> The problem with flags and downvotes isn't that they fail to kill the offending comment, or that they fail to cause a karma penalty. The first effect is localized to the thread and the second is very indirect.

The problem with downvotes is that they do not give meaningful feedback or encourage positive contributions. They are not even especially effective at discouraging negativity. When not lost in a sea of upvotes, downvotes only encourage defensiveness and complaining.

Flags should be visible by the commenter only, and the issue of whether to kill comments or penalize karma doesn't have to be decided immediately.

</comment><comment><USER3> Purely curious...is this that big of a problem? Karma isn't my end-all-be-all, I don't think I'd be upset if someone misfired a downvote on me.

I only see flags being useful for admins to help keep spammers out and to ban truly offending users.

</comment><comment><USER4> Any evidence or reasoning behind why that will solve it?

At the moment you can downvote but (enough) people don't. If we gain flags, why will people who don't downvote use them?

<comment><AUTHOR> Downvotes get lost in a sea of upvotes. Flags are stronger, enough of them will kill the comment regardless of karma. It also lets you be more specific than downvoting.</comment></comment>