A very valuable vulnerability - <AUTHOR> http://www.daemonology.net/blog/2016-10-28-A-very-valuable-vulnerability.html <comment><USER2> From the article ...

 _" Isaac Asimov's remark that in science 'Eureka!' is less exciting than 'That's funny...' applies equally to security vulnerabilities."_

That should be on a poster in every security engineer's view. I cannot count the number of times a really big problem was uncovered by a very small, yet unexpected, anomaly. It was also the core of Cliff Stoll's quest to find the hacker who hit UC Berkeley. Bottom line, never let that sort of observation go until you fully understand why it happened.

<comment><USER3> Many years ago, that's how I found a vendor-managed (but not vendor-patched) system had been compromised; I went from "why the hell is that multi-pipe command segfaulting?"to "why the hell aren't the system binaries stripped?" to " _how_ long has this thing been compromised?"

<comment><USER4> What is binary stripping?

<comment><USER5> Compiled programs sometimes contain the names of the functions.

To reduce binary size and/or discourage reverse engineering, the names can be stripped out.

<comment><AUTHOR> Not just names of functions; also names of variables and potentially a great many other things.

Stripping binaries generally refers to removing debugging information of all sorts.

<comment><USER3> Exactly. In this case -- working from antique memory here -- Solaris binaries were normally stripped, while the compromised versions placed by the hacker weren't, which was an immediate red flag. The system was compromised as part of a very large-scale, probably North Korean, attack that exploited an OpenWindows buffer overflow bug that was fixed many patch-revs ago by the time I saw the system (and shouldn't have been exploitable over the Internet anyway, but the firewall was also not properly set up at the time of compromise). Drive-by hacking, in other words. Luckily their compromised binaries -- specifically a 'ps' that filtered out the hackers' background attack processes -- weren't particularly robust to arbitrary input.

</comment></comment></comment></comment></comment></comment><comment><USER6> Great job of laying this out. It highlights how important the edge cases are. People wonder, why do we spend so much time on our financial code even though the base case is simple. It's that the amount of edge cases is insane.

<comment><AUTHOR> It's not just that there are a lot of edge cases; it's also that a single edge case could allow someone to extract _an effectively unlimited amount of money_ from you.

<comment><USER7> That's exactly what hit etherium in its early days. A bad actor programmed a contract that vaccuumed all VC money attached to the system. There was/is(?) a great debate on wether to invalidate the transaction (defeating the stated goal of "no central authority" in the system) or letting it ride, and allowing the bad actor his spoils.

It happens; gotta look out for those edge cases.

<comment><USER8> I still don't think that it was a bad actor. The Etherium guys explicitely said that the code _is_ the contract. If the code allows you to get all the money, then it's not malicious to do so.

It's like the tax code. Leaving your profits in a foreign country to avoid paying higher taxes at home is not malicious, it's just the best way for you to comply with the law.

</comment></comment></comment></comment><comment><USER9> I wonder if there's still a small arbitrage window here. The ten minute lockin is essentially a short lived option. If you lockin a rate at $101 and the price drops to $100 over the next nine minutes, buy bitcoin and complete the transfer, then request refund. If the price goes up, let the option expire.

<comment><USER10> The peak daily volatility of bitcoin is in the ~10% a day range [1], varying a lot month to month. The implied 10-minute volatility is 10% / sqrt(24 * 6) ~= 0.83%, assuming independence of successive 10-minute windows. This is likely an underestimate, because most financial time series display mean reversion.

The Black-Scholes price of an at-the-money option is very approximately 1/sqrt(2pi) * vol to maturity, so the option is worth somewhere around 0.3% of the notional price on a high-volatility Bitcoin day, somewhat less than the 0.8% transaction charge.

However, the charge is only paid if you go through with the transaction, so really this is an option that's 0.8% out of the money. With that assumption, the value of the option is just 0.08%.

[1] [https://btcvol.info/](https://btcvol.info/)

<comment><USER9> It's not much, but if somebody puts a button on the internet that gives me 8 cents every time I push it, I might try pushing it a few million times. :)

<comment><USER10> Yeah, the real barrier stopping you is being able to trade Bitcoins against USD on demand, which I suspect costs a _lot_ more than 0.08%.

<comment><USER11> Plus you have to get refunded over and over and over.

</comment></comment></comment></comment></comment><comment><USER12> > they merely need to find a merchant which uses Stripe for bitcoin payments > [...] > or even better, set up to automatically refund bitcoin overpayments

Any idea what proportion of merchants using Stripe's bitcoin handling actually do this automatic refunding?

It's a very interesting vulnerability and I enjoyed reading the write-up and thought process, but I'm not sure how practical it is if it requires interaction from the merchant to perform the refund. I think an overpayment and refund request weeks after the initial payment (when coincidentally the BTC value has reduced) would definitely ring some alarm bells - hopefully with both the merchant and the team at Stripe.

I guess you could spread out your overpayments amongst different merchants and try and limit the time between the initial purchase and the refund requests but the entire thing seems a bit convoluted to pull off.

In any case, kudos to the author for the responsible disclosure and for Stripe for handling this professionally.

<comment><USER13> I don't know the proportion, but coincidentally enough, I work at a startup that uses Stripe and we used to support bitcoin transactions (and thus refunds). I just asked a friend who's been here longer why we're not supporting bitcoins anymore and his response was "exchange rates were a huge pain" haha so yeah it is indeed convoluted to do refunds with bitcoins, but if we are to attempt to use them as regular currency for goods and services, we can't not support refunds. so we dropped bitcoin support altogether.

<comment><AUTHOR> Was that bitcoin support manual, or through stripe? I would never want to deal with bitcoin payments manually due to the exchange rate issue; but taking them through stripe works wonderfully.

<comment><USER13> Hmm digging through our old code looks like we never tried to use Stripe, for reasons unknown to me (maybe their support/requirements were different back then, maybe it didn't work for our product, idk). But yeah, especially after reading this article, handling bitcoin payments and dealing with the exchange rate sounds unfavorable lol :) glad we're not doing that.

<comment><AUTHOR> That's my point - with stripe, you don't have to deal with the exchange rate. You say "I want $X" and magic happens. Stripe takes care of the messy details of fluctuating exchange rates.

<comment><USER13> So that's not entirely true depending on how you use the product. We were attempting to use Stripe for a contract-like setup, e.g. person A pays person B, but person B doesn't get paid until some event occurs, and we hold on to the funds until that happens since that expiration of that event isn't guaranteed to be under 10 min.</comment></comment></comment></comment></comment></comment>


San Francisco Mayor orders cap on fees restaurants pay to food delivery apps - <AUTHOR> https://www.bizjournals.com/sanfrancisco/news/2020/04/10/san-francisco-mayor-orders-cap-on-fees-restaurants.html <comment><USER2> Previously on HN (3 days ago, 19 comments):

[https://news.ycombinator.com/item?id=22838727](https://news.ycombinator.com/item?id=22838727)

</comment><comment><USER3> IMO this is a good move. The counter arguments are:

\- Delivery apps are struggling and they have to charge 30% to survive in a cut-throat market (many delivery services competing).

\- Why not charge the consumer? Restaurants are struggling and take the fees off of them and charge consumers.

I feel like delivery companies are "double dipping", they charge delivery fee and they charge 30% to the restaurants as commission. That's unsustainable. Charge the consumer not the restaurant. It has all kinds of nasty disincentives - "We won't list your restaurant on our super popular delivery app because you didn't agree to pay 30% commission to us." Fuck that.

Delivery services should just charge by the mile/time of the delivery it takes. That's kind of like Uber but instead of driving around a human, they're driving around food.

\+ 10.99 sandwich \+ 1.99 chips \+ 5.50 delivery charge

5.50 delivery charge is based on the time/distance of the restaurant to the house. If they pool multiple orders, they it should be amortized and split. Personally, I tip because _I have to_ but not because _I want to_. Tipping is a shitty culture and needs to be abolished like Japan. Just pay the employees enough. There should be laws that protect service workers and guarantee their wage. I am happy to know that $8.00 is the delivery fee upfront because of increased salary for service workers than having to "voluntarily" tip $2.50. That's the job of the delivery company to pay, not for the consumers to pony up atop $5.50 delivery fee.

<comment><USER4> Companies like DoorDash are _triple_ dipping as they also steal the tips from the delivery folks.

<comment><USER5> Do they still do this? Last time I ordered I believe I saw text that 100% of the tip goes to the driver.

Wouldn't put it past them to lie, but I'd have thought one so blatant would get at least one state AG on them, or someone.

<comment><USER4> That is what they have always said, even before they came under fire for tip stealing. Which they did not stop doing: [https://www.businessinsider.com/doordash-still-be- pocketing-...](https://www.businessinsider.com/doordash-still-be-pocketing- tips-despite-pay-model-change-2019-8)

Anecdotally I have asked my delivery people. Most won't say anything (perhaps they are afraid I'm a "secret shopper"?) but the few who have have confirmed they don't get the same amount from DoorDash. There is one regular delivery person with whom I have a good rapport who has showed up from instacart, doordash and postmates; he says doordash and instacart continue to steal tips but postmates stopped.

<comment><USER5> Ugh, that's scummy. I wonder if I can give cash tips instead. Sucks to not be able to do non-contact though.

</comment></comment></comment></comment></comment><comment><USER6> There are multiple competing delivery services and at least some of them have a history of charging below cost. It would initially appear that this is a good problem to leave to the free market: in the absence of regulation, the price charged will get pretty close to the delivery company's cost of doing business.

Why did the market fail here?

<comment><USER7> I guess because it's a double sided market with exclusivity deals. Consumers aren't going to have multiple service accounts just to get access to delivery. So if you want to reach the most people, you need to make deals with the devil. In this case, DoorDash, Caviar, or GrubHub.

It made sense from a brand/marketing cost back when things were normal, but now that it's the primary way to fund your operation, the cost-benefit doesn't make sense anymore, but you're still locked in.

<comment><USER8> > Consumers aren't going to have multiple service accounts just to get access > to delivery

I think that's a pretty questionable assumption</comment></comment></comment>


Steve Forbes: Don't Soft-Soap SOPA - <AUTHOR> http://www.forbes.com/sites/steveforbes/2012/01/25/dont-soft-soap-sopa/

<comment><AUTHOR> I submitted this because he does a good job summing up some of the major issues with this type of legislation. That said, the article is lacking in good suggestions for alternatives.

The following quote also displays a bit of naivety and misunderstanding of how the internet works:

 _And who knows? Perhaps inventors will come up with a seamless way for you to be charged a fraction of a cent in royalties if you inadvertently upstream copyrighted material._</comment>


Nothingtoinstall.com now live - <AUTHOR> http://www.joelonsoftware.com/items/2010/09/30.html

<comment><USER2> Maybe I don't get it, but this seems like a truly horrible name. I didn't have an idea of what the site was for from the name and even reading Joel's post left it a little vague. Once I was there, I got a feel for what was going on, but I still don't think I will remember the place.

For a site aimed at users, why use a name referring to webapp distribution?

<comment><USER3> It was the highest voted domain name by the community [http://meta.nothingtoinstall.com/questions/108/what- should-o...](http://meta.nothingtoinstall.com/questions/108/what-should-our- com-domain-name-be/398#398)

<comment><USER4> All the politicians in office right now were the highest voted, but that doesn't mean they are good. I didn't click on on the referenced link as I don't even want to know what was second worse.

</comment></comment></comment><comment><USER5> I sense a disturbance in the web - millions of sockpuppets being created to ask and then answer the same question of what is the best web app for X.

<comment><USER6> So this is like Digg ?

</comment></comment><comment><USER7> It's interesting.

The look and feel of this site is almost too sleek and clean (I say this as a designer)

I like it and all, but it also feels a little hmm soulless?

<comment><USER8> Grey-washed.

Looks like a Windows 95 application.</comment></comment>


MasterCard to start verifying transactions through selfies - <AUTHOR> http://americans.org/2015/07/03/mastercard-to-start-verifying-payments-via-selfies/ <comment><USER2> Relevant link: "Fingerprints are usernames, not password" (applies to all biometrics): [http://blog.dustinkirkland.com/2013/10/fingerprints-are- user...](http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names- not.html)

Long story short, it's a bad idea, and it's really not secure.

<comment><USER3> It's much worse for pictures than fingerprints because most people have tons of pictures of themselves online now, and many are also public. It's probably just a matter of time before malicious hackers start spoofing their identities.

<comment><USER4> don't forget all the ongoing advances in the "here's a bunch of pictures, come up with a 3d model of the person" problem, making the spoofing even easier

</comment></comment></comment><comment><USER5> I'm starting to feel like a grey neckbeard. In my day, when I wanted to hang out with my friends, I called them, from a landline, known simply as "the phone". These days, I'm at or near a desktop/laptop computer almost 24/7 so don't see much need for a smartphone. I dread the day when a smartphone is required to be a part of society. It's shifting in that direction rapidly. If being on Facebook/LinkedIn also becomes a necessity, hopefully I'm already retired and have a beautiful lawn.

<comment><USER6> I always wonder if there were these old fogeys who complained when the first postal services were brought in in the 19th century. Like "Back in my day, I visited my friends and family because I cared, but now any idiot with a stamp can send me an annoying letter."

<comment><USER7> > I always wonder if there were these old fogeys who complained when the first > postal services were brought in in the 19th century.

The first postal services were formed long before that; there were definitely some in the late _17th_ Century, may have been earlier.

<comment><USER6> FWIW, I date it from the issuance of the first really convenient paper postage stamp, much like how OP probably is complaining about smartphones post 2007, as opposed to the first mobile phones in the 70's.

</comment></comment></comment></comment><comment><USER8> People are missing the point, like "chip and pin" this is not about protecting the consumer but about protecting Mastercard and their duopoly

"What you mean you did not pay for a hooker and rum in Amsterdam, then who is this in a selfie you took" > shows a selfie some hacker stole from the poor eejits Lifeinvader page.

<comment><USER9> If only.

> shows a selfie [taken from somewhere]

The software only sends a hash of the "map" of the face to Mastercard for comparison (or so an earlier Dutch article on security.nl put it). They can never show you the original image again.

</comment></comment><comment><USER10> There's lots of easy avenues to attack this.

1\. Look for user's Youtube, Facebook, and other social media for photos/video

2\. Videochat and record them.

3\. Find them IRL and record them.

4\. Print a mask of that person, and leave eye holes. Now you blink instead.

Ridiculous.

</comment><comment><USER11> This reminds me of the hat from fifth element:

[http://images2.fanpop.com/images/photos/5000000/The-Fifth- El...](http://images2.fanpop.com/images/photos/5000000/The-Fifth-Element-the- fifth-element-5050874-1918-796.jpg)

</comment><comment><USER12> The don't want to make money safe. making money safe makes money slow. Pay wave / pay pass and mastercard/visa chargebacks are all about getting money moving around more.

</comment><comment><USER13> I hate selfies. Please leave pin codes for people who don't trust image recognition algorithms enough.

</comment><comment><USER14> How is this supposed to work in low-light and dark environments, like a classy restaurant? What about people that don't have camera phones? This will end up being opt-in only, I'm sure. Can you imagine the checkout at the supermarket as vain people hold the line up while they make up their hair? I really don't see this as becoming commonplace.

</comment><comment><USER15> I would just be happy if I could actually use my "chip and pin" credit card when performing a transaction. I have yet to find a retailer where I can actually use it.

<comment><USER16> Interesting, where are you located? Here in Canada I use mine practically everywhere on a daily basis.

<comment><USER17> They're in the U.S., the last large bastion of the magnetic strip.

<comment><USER18> And the paper cheque.

<comment><USER15> Yep, I still write several checks a month too (almost exclusively for rent, utilities, and the occasional donation).

<comment><USER19> I think the last cheque I wrote was at least 15 years ago. They don't exist here, Norway, any more.

</comment></comment></comment></comment></comment></comment><comment><USER20> There's a better link here [1], which explains with more details.

Main thing seems that it's not just facial recognition, you can use a fingerprint scanner (assuming your phone has one) instead, and that it requires you to blink when you're being scanned by the app. So it doesn't seem to be just static image recognition, it's looking at the video stream to ensure that your face is there and that it can blink (getting around the 'just hold a photo in front of the camera' problem).

[1] [http://money.cnn.com/2015/07/01/technology/mastercard- facial...](http://money.cnn.com/2015/07/01/technology/mastercard-facial-scan/)

<comment><USER21> Since a video is just a string of images, all the attacker would need is a sufficient number of photoshopped images to show a series that (when stitched into a video) shows the user blinking. I'm pretty sure you could make a Photoshop plugin that would do this.

I'll do you one better: you could probably make a print-out paper 'mask' of a person's face and just blink yourself, or something similar. This kind of tech isn't always as smart as we think.

</comment></comment><comment><USER22> Seems to me that this is a cheap, relatively smart piece of marketing, rather than a serious proposition - note the heartbeat and voice recognition ideas that they're also "experimenting" with.

</comment><comment><USER23> Ok, so everyone has pointed out how insecure this would obviously be, and all the simple ways in which you could fool it.

But, I'm left wondering, did the guys at mastercard never even think this through at all? This is people's money after all. It needs to be safe. Did they not even consider that, as soon as this is rolled out, people were going to see money disappear?

I can't believe they didn't think of that. Which makes me wonder, why am I even reading about this at all?

<comment><USER24> Credit card companies already have the perfect "security" measure: retroactive limited liability for stolen cards. Nobody loses money because someone steals their credit card.

As such, everything the card companies do in the _name_ of "security" is not to prevent people from losing money—they don't need to solve that problem. They just need to solve the _perception_ people have that credit cards are insecure. In other words, all credit card security (yes, even chip-and-pin) is security theatre. Whether it works or not, it's not there to work; it's there to feel good.

<comment><USER25> > Credit card companies already have the perfect "security" measure: > retroactive limited liability for stolen cards. Nobody loses money because > someone steals their credit card.

100% on that. Money is lost all the time, but thanks to that retroactive liability, the bank and/or merchant loses it instead of the consumer. Security for the consumer is already as good as it could possibly get, so they're really saving themselves and their merchants. This is a good thing, because they have a much more direct incentive to save themselves money than to save you money.

</comment></comment></comment><comment><USER26> Didn't they get the memo from Japan? [http://pinktentacle.com/2008/06/magazine-photos-fool-age- ver...](http://pinktentacle.com/2008/06/magazine-photos-fool-age-verification- cameras/)

<comment><USER27> They require the user to blink to protect against this sort of attack but there are workarounds.

</comment></comment><comment><USER28> Well, it just shows that banks and credit card issuers will go to any length to avoid implementing a proper PKI and secure transactions.

My only question is why?

</comment><comment><USER29> Hahahahahaha. Remember that OS X login mode by your own selfie where you could simulate blinking with a matchstick and login with a photograph?

</comment><comment><USER30> First I thought I mixed up my tabs and I am on 4chan instead of being on HN.

Other verification approach is to use voice like WeChat does.

[http://www.biometricupdate.com/201503/instant-messaging- app-...](http://www.biometricupdate.com/201503/instant-messaging-app-wechat- on-ios-adds-voice-biometrics)

</comment><comment><USER31> OK, so who thinks it would be a good idea to post their credit card number and CVV2 code on their Facebook wall?

Because that's essentially what Mastercard has caused everyone to do here.

</comment><comment><USER32> I don't even have a cell phone. And there is zero chance I would ever get one just so that SlaveCard will process payments for me. That whole industry is like the grandfather that clearly can't drive anymore but everyone's afraid to confront about taking the keys away... why is nobody willing to 'disrupt' these people already?

</comment><comment><USER33> My question is:

"Selfie as a Password", - Is it really secure?

<comment><USER34> Its a terrible idea. Its a password you can't change, can't even choose, leave lying about all over the place. Its everything a password shouldn't be.</comment></comment>


Bypass the internet for large transfers: AWS Import/Export - <AUTHOR> http://aws.amazon.com/importexport/

<comment><USER2> About 3 months ago, I needed >50Gb of data uploaded to AWS and I asked a friend of mine who works at Amazon for help. He asked around and told me to mail the external storage to Amazon with keys/bucket info and a special code. I UPSed the stuff and within 2 days of arrival, I received an email with a notification that the transfer was done. Later on, I got the storage back. Everything worked as advertised!

I guess there's so much demand for this sneakernet that they made an official service. I wonder how many other people asked for transfer help before today's announcement...

<comment><USER3> If it was only three months ago, more likely this service was already in development and you were customer #1 without knowing it.

<comment><USER4> Unlikely. I have 2 contacts that did the same thing months ago. I actually thought that this was an already advertised service.

</comment></comment></comment><comment><USER5> When I read the announcement this morning, it occurred to me that the reason I like AWS so much, and what separates them from other cloud offerings, is that they're doing stuff dev teams actually _want_ and can _use_ (not impenetrably complex tech we could use with some vendor consultancy). Import features like this are trivial for AWS to implement - but will be a step change for some customers.

Last generation vendors saying 'anyone can do what AWS are doing' is just crap. You can't buy the enthusiasm these guys have - and its not just one individual - if you talk to anyone from AWS (and they're often around nights/weekends to talk about stuff) they are in a different lane to the competition or vendors that should be the competition.

<comment><USER6> Agreed, except I have found it pretty tough to figure out EC2. EC2 is fairly impenetrable at first.

</comment></comment><comment><USER7> Obligatory Tanenbaum quote:

"Never underestimate the bandwidth of a station wagon full of tapes hurtling down the highway."

<comment><USER8> Indeed, so obligatory that I included it in my blog post:

<http://aws.typepad.com/aws/2009/05/send-us-that-data.html>

<comment><USER9> Kudos (to all of you at Amazon) for being the first to turn that quote into a product feature. Certainly seems obvious in retrospect.

<comment><USER10> On the contrary, video delivery networks (VDNs) have been recommending loading data this way for years, such as one that's routinely internationally FedEx- ing those cheap 2TB "network" drives back and forth in small white mil-spec shipping cases.

</comment></comment></comment></comment><comment><USER11> Living in a country that's stuck on the end of an expensive and slow(ish) undersea cable for the past few years, sometimes my thoughts wander towards something like this. Even just a service (US-based) that would download a set of files (HTTP, FTP, bittorrent), burn them to DVD, and post them via airmail would be pretty handy. Bonus points if there was a way to use airline passengers as your couriers, such that the total latency might only be ~24 hours. :)

<comment><USER12> The airlines have services for that (see Delta Dash) without needing to use airline passengers. :)

</comment></comment><comment><USER13> Google had a neat feature related to this in implementation but not goal since 2007ish. It was called Google Datasets and let you mail in a hard drive. Google would then host the data on the web. It's audience was purely academic, though... no money exchange involved.

Anyway, it got cut back last Fall. Cool to see it's still living on in some form.

<comment><USER14> Oh that's a shame, I didn't know it had been cut.

Amazon has a similar scheme "Public Datasets", that store data as an EBS rather than an S3 bucket <http://aws.amazon.com/publicdatasets/>

</comment></comment><comment><USER15> New cloud feature: Pony Express

Only kidding this is great for immense datasets.

<comment><USER16> <lamejoke> Presumably a feature for Django devs</lamejoke>

</comment></comment><comment><USER17> How do they do virus and security checking? I don't know how they import the data, but it could be that they use a system that can be exploited using a security vulnerability?

It's a (very) long shot for this kind of thing to work, but still it's a risk worth asking about. They are at the end of they day hooking up hardware to their computer - i.e. physical access to the machine.

<comment><USER18> would you risk your account by intentionally adding malware to your data sets?

HDDs are passive, there is no danger in merely hooking one up. and as long as the file system drivers are solid, shoveling these bits into "buckets" (whatever these are) is safe too. you're just shoveling the bits, not looking at them.

this is about data, not executable code.

<comment><USER19> They only support SATA and USB-2, which unlike Firewire, do not work by DMA, IIRC. I'd assume they do not support Firewire for exactly this reason: to prevent a device from reading the systems memory directly (known as pwn-by- iPod)

<comment><USER20> SATA certainly does support DMA. DMA isn't a feature unique to firewire; rather, USB is (nearly) unique in that it's the one high-speed standard that doesn't support DMA.

</comment></comment></comment></comment><comment><USER21> Also check out Terascale Sneakernet from Jim Gray et al. from 2002: [http://research.microsoft.com/apps/pubs/default.aspx?id=6457...](http://research.microsoft.com/apps/pubs/default.aspx?id=64570)

</comment><comment><USER22> This is going to be great for professional photographers (the industry I work in). I'm been advocating they use S3 for archiving for some time ... now it's easier to get your files there.

</comment><comment><USER23> hmm... maybe i'll sneakernet all my music/photos now. been waiting for a sneakernet uploading service. it was only a matter of time before they added one. wonder how long before smugmug adds a wraper around this and lets you send your dvd/smartcard/etc media and get it directly uploaded into your account.

</comment><comment><USER24> Not really "AWS" then!

</comment><comment><USER25> Dupe: <http://news.ycombinator.com/item?id=620089>

<comment><USER26> Although this one is getting the comments.

<comment><USER27> Probably because of a better title giving people an idea about the service even before they read the article.</comment></comment></comment>


As China Hacked, U.S. Businesses Turned a Blind Eye - <AUTHOR> https://www.npr.org/2019/04/12/711779130/as-china-hacked-u-s-businesses-turned-a-blind-eye <comment><USER2> Forget about the hacking.

U.S. business walked into China and handed over all of their technology and Intellectual Property, just to have it used against them by the Chinese government. China has only resorted to hacking lately in order to get more technology and IP.

<comment><USER3> And I think that's a good thing. Intellectual Property is harmful to most and only benefits a few. If we abandoned the notion we'd be better off.

<comment><USER4> Samsung spend 130 million on research on bendable phones.

It got stolen by China. How can that be justified?

[https://edition.cnn.com/2018/11/30/tech/samsung-china- tech-t...](https://edition.cnn.com/2018/11/30/tech/samsung-china-tech- theft/index.html)

<comment><USER5> As a result of this 'theft', consumers now have more bendable phone options.

<comment><USER6> But in the future they will see less innovation as R&D is further slashed.

<comment><USER7> I see this thrown around all the time when we talk about monopolizing IP and having huge corporations put their lawyer boots on smaller company throats... but is it really true? Will making IP protection weaker actually stifle innovation? Was innovation in industrial era hugely stuffled by not protecting every single patent a huge multi-national conglomerates throw out?

<comment><USER6> Well, yes, hence the development of patents.

"The English patent system evolved from its early medieval origins into the first modern patent system that recognised intellectual property in order to stimulate invention; this was the crucial legal foundation upon which the Industrial Revolution could emerge and flourish." ([1]Wikipedia)

Without patents what you do is create trade secrets, patents publish the concepts that are protected, they are fully disclosed (or the patent is junk) and after 25 years _anyone_ can use them. The 25 years is the time that you have to get payback on your invention - forcing investment in development _now_ before your monopoly expires.

[1] [https://en.wikipedia.org/wiki/Patent](https://en.wikipedia.org/wiki/Patent)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> > Hickton opened an investigation and quickly set his sights on a special unit > of the Chinese military — a secretive group known as Unit 61398. > Investigators were able to watch as the unit's officers, sitting in an > office building in Shanghai, broke into the computer systems of American > companies at night, stopped for an hour break at China's lunchtime and then > continued in the Chinese afternoon.

> ...

> But when Hickton went to the companies, eager for them to become plaintiffs, > he ran into a problem. None of the companies wanted any part of it. Hickton > says they had too much money on the line in China.

There really ought to be a law that mandates that 1) companies disclose any and all hacking incidents/data breaches they become aware of and 2) co-operate with the government in the investigation of those breaches.

Though I'm a little confused why they would need the "the companies to become plaintiffs." Wouldn't hacking be a criminal matter that's would be directly prosecuted by the government? Did they want to go against the hackers both criminally and civilly?

<comment><USER9> Why is it that intelligence agencies are still conducting their activities during their countries working hours?

You'd figure it would be easier to find nocturnal neckbeards anyways.

<comment><USER10> In this case, the timezones probably line up to make Chinese working hours the best time to do this work.

</comment></comment></comment><comment><USER11> > unfair business practices originating from China are costing the American > economy more than $57 billion a year, White House officials believe

And yet the companies who supposedly lose that money don't care.

It reminds me a little of the $200-250B "lost" to piracy by the movie and music industry ([http://freakonomics.com/2012/01/12/how-much-do-music-and- mov...](http://freakonomics.com/2012/01/12/how-much-do-music-and-movie-piracy- really-hurt-the-u-s-economy/)). To be more precise it reminds me of how everyone likes to create large impressive numbers that prove their point or support their agenda.

<comment><USER12> I suspect the amount is a mix of things:

* Investment in IP that then gets stolen. * Loss of potential earnings as American companies are locked out of Chinese markets * Loss of actual earnings as American/global consumers switch to Chinese companies (eg huawei) that are accused of unfair business practices or receiving unfair government subsidies.

Some companies "don't care" because they aren't actually losing money, they're just not making as much as they could be.

But other companies are 'coerced' into not caring because what happens if they complain? They lose Chinese government contracts. They effectively admit to shareholders that their IP has been stolen and lost. They waste time and resources fighting unwinnable legal battles against Chinese national champions (ie. the Chinese state).

I've met plenty of small/medium sized business owners who are so sickened by their experiences with China and the Chinese market that they're happy to just ignore it all and save themselves the heartache.

<comment><USER11> If you count being locked out of the Chinese markets, I think the number is actually much, much larger than $50B. But that seems to be rather unrelated to hacking? In fact most countries openly or secretly try to lock out foreign owned businesses. If the point is that China does it more than others, perhaps it's true, but it's a lot more complex issue than outright hacking.

<comment><USER12> I think the hacking and being cut out of domestic markets is fairly closely linked.

If you've already stolen the IP, you don't need to let the foreign business in to provide that service.

Possibly even more widespread though has been the standard practice over the last 20 years of lettin foreign businesses setup shop in China, hacking/stealing all their tech, then the state uses its legal/political resources to make life horrendously difficult for the original foreign business.

</comment></comment></comment></comment><comment><USER13> The government sponsored professional hacking team that was mentioned in the article was the focus of the infamous APT1 report by Mandiant (now FireEye), with investigations from 2006 and later: [https://www.fireeye.com/content/dam/fireeye- www/services/pdf...](https://www.fireeye.com/content/dam/fireeye- www/services/pdfs/mandiant-apt1-report.pdf)

There have been many APT groups named and tracked since then, not just in China.

<comment><USER14> Oh, memento. Those events fit the climate described in the article.

> Intrusion Truth's controversial approach of anonymously unmasking > government-backed hackers and exposing a foreign intelligence agency is > something new and seen as a method to put pressure on Chinese companies > cooperating with state-sponsored hacking efforts.

[https://www.zerohedge.com/news/2018-10-04/intrusion-truth- my...](https://www.zerohedge.com/news/2018-10-04/intrusion-truth-mysterious- group-doxing-chinas-hacking-army) \- [https://motherboard.vice.com/en_us/article/wjka84/intrusion-...](https://motherboard.vice.com/en_us/article/wjka84/intrusion- truth-group-doxing-hackers-chinese-intelligence) \- [https://twitter.com/intrusion_truth](https://twitter.com/intrusion_truth) \- [https://intrusiontruth.wordpress.com](https://intrusiontruth.wordpress.com)

<comment><USER15> Also even naming the group APT which was a corporate buzzword at the time (for advanced persistent threat aka anything above script kiddies and aimless bots).

<comment><USER16> APT is anything that happens to you.

</comment></comment></comment></comment><comment><USER17> USGOV and all but the largest businesses don't mesh. The solution to the spying threat is extending tort liability and statutory damages to negligence when there are compromises. Not different than product safety, liability will make quick work of the problem.

<comment><USER18> Who's the plaintiff in your suggestion? The article is not about companies leaking Americans' private data to China (though I'm sure that happens too), it's about them turning a blind eye when _their own_ company confidential technology and product designs are stolen by China. For tort liability to be a factor here, the company would have to initiate a lawsuit against itself, which would never happen.

The type of industrial espionage described in the article is actually a form of temporal arbitrage - it's present shareholders stealing from future shareholders and then hoping to unload the shares before the consequences of their decisions are reaped. In order to get access to the lucrative Chinese market _now_ (and goose this quarter's earnings), they put up with Chinese industrial espionage that results in reduced competitiveness 10 years down the road. In 10 years, they probably won't be working at the company, nor will they hold many shares, and so the consequences don't affect them personally.

This is a big problem in general (not just with industrial espionage - short- termism also affects labor practices, financial health, social fabric, environmental pollution, and global warming), but it's hard to see how any legal solution would fix it. Future shareholders are generally not entitled to sue until they actually become shareholders, at which point everybody says "Well, you should've known how fucked up the company was when you bought the shares". Similarly, unborn children don't get a vote on societal policies that may destroy the earth or society they live in before they're born. Usually the best alternative is just to deal with the problem with band-aids in the future, once it becomes widely recognized as a problem.

<comment><USER19> > In order to get access to the lucrative Chinese market now (and goose this > quarter's earnings), they put up with Chinese industrial espionage that > results in reduced competitiveness 10 years down the road.

Alternate reality: they stay alive instead of being hammered in earnings by their competitors, invest increased earnings to get better at security and prevent future data exfiltrations, use their existing corpus of innovation to get even more competitive and continue to exist long into the future.

Innovations are important and must be protected. But the short-sightedness of today is partially driven by a change in reality: the rate of technological advances is brutally fast.

</comment></comment></comment><comment><USER20> "When I pressed them on why they were not taking stronger action against China, their response was, 'We have a multifaceted relationship with China.' "

And this is it: don't want to upset the promise future sales. And this is how 'dividing and conquering' works. One side speaks with 'one voice', the other with 'thousands of little voices' \- and it's game.

<comment><USER21> And the one company highlighted in the article as speaking out is on the verge of being broken up by Western governments. The western world is being played like a fiddle.

Negotiating power is everything, and western democracies and their private and corporate citizens have absolutely none compared to autocratic regimes.

<comment><USER22> That one company has also completely reversed its stance over the last year and now openly defends censoring human rights and complying with the CCP's surveillance demands.

Google has no reason to hold its head high.

<comment><USER23> Why is Google singled out for reprobation when, as the article points out, they've spoken out more than other companies?

Sure, no one is spotless, but as it stands it's Microsoft that runs a censored search engine (Bing in China) and Apple that handed over its Chinese users iCloud encryption keys.

To be fair, you could say Apple and Microsoft had their reasons for doing so (as people including the Chinese themselves have argued). But why all the focus on Google then? Is the idea of a Chinese search engine (which has since been cancelled) worse than actually running a censored search engine such as Bing China?

It's gotten to the point where people commonly think Google is cozier with Chinese authorities than other companies, when if anything it's the opposite. That seems perverse.

<comment><USER22> I completely agree with the argument that Google is no worse -- and have publicly campaigned to this effect -- but I was responding to the claim that Google should be proud of its history of standing up against authoritarian pressure. It no longer deserves that honor.

But, yes, Microsoft and Apple are equally, if not more, deserving of shame.

</comment></comment></comment></comment></comment><comment><USER24> "Honey or condensed milk with your bread?" he was so excited that he said, "Both," and then, so as not to seem greedy, he added, "but don't bother about the bread, please."

(c) Winnie the Pooh

</comment><comment><USER25> I remember iRobot was quite popular few years ago here in Europe, today everybody buys much cheaper Chinese devices. Same about smartphones: Apple/Samsung->Huawei. Same about Quadrocopters. It looks like it's just a matter of time until CPUs, GPUs, FPGAs, E-vehicles will be designed/produced by Chinese companies.

</comment><comment><USER25> Look, you can really protect your intellectual property in Europe and in USA, but you cannot do that in the rest of the world. It means your innovations will be copied and much cheaper products will be created. You can protect your own internal national market, but you cannot compete on all the remaining world markets. So what to do? End of intellectual property? Back to trade secrets? Even this will probably not help in long term.

</comment><comment><USER26> China hacked. Because it seems they are better at their job than their counterparts in the U.S. - saw first hand their capability. Small cubicles, 3 sq yd, 30 in a row, all with different language skills, ( any language ), Computer science graduates from the No 1 University in China. Pay is a fraction of what a compatible grad is being paid in the U.S. No competition. High pay won't make the leverage.

</comment><comment><USER27> I saw Mr. Hickton speak a few nights ago. It was really an interesting talk about some of the challenges for the future: [https://www.youtube.com/watch?v=8Zktw-m5hTI](https://www.youtube.com/watch?v=8Zktw-m5hTI)

</comment><comment><USER28> It's super weird how everybody considered Trump odd for his hate for China, yet these days so many people just repeat the, usually completely baseless, anti-China FUD.

Whether it's Huawei supposedly spying on everybody or the Chinese government putting implants on Super Micro boards, nothing is too absurd to be spread by, out of all parties, Five eyes themselves.

Does China hack? Of course, so does the US, it even steals IP from allies. But I seriously doubt the damages for that go into the $57 billion, that's just a piracy-damages like inflated number. In reality, a whole lot of interesting innovation, particularly on the hardware level, has already been happening in China for years already. They gonna out-make the US maker movement, on a massive scale [0].

[0] [https://youtu.be/SGJ5cZnoodY](https://youtu.be/SGJ5cZnoodY)

<comment><USER29> There is plenty of truth to much of the china situation, not just FUD. While the Potus has bounced between 'i love china' and 'we need to do something about these people', the rampant IP theft negatively affects nearly everyone on HN.

<comment><USER28> > There is plenty of truth to much of the china situation, not just FUD.

Yet FUD is all we get and people eat it up like the best thing ever.

Even here on HN barely anybody questioned the Super Micro narrative, even tho that Bloomberg story was super sketchy from the very beginning by not disclosing who did that audit, just like their inability to produce a sample of the chip.

Trump also never "bounced" on China, China is pretty much the only thing he doesn't bounce on, it's been his one constant since the election [0] and just because he throws an "I love China" in there, does not reflect or change any of his policy decisions. This is much more "I love my enemies because they are so stupid" posturing [1] than an declaration of actual sympathies.

[0] [https://www.youtube.com/watch?v=RDrfE9I8_hs](https://www.youtube.com/watch?v=RDrfE9I8_hs)

[1] [https://abcnews.go.com/Politics/10-times-trump-attacked- chin...](https://abcnews.go.com/Politics/10-times-trump-attacked-china-trade- relations-us/story?id=46572567)

</comment></comment></comment><comment><USER30> I think the root cause is because of China has no human-rights.

</comment><comment><USER31> How is this any different to the NSA and Chinese companies?

We already know the NSA did this to Huawei for multiple years.

<comment><USER32> One could make the case that Chinese businesses and governments have a tighter relationship where the fruits of such hacking could be used to benefit businesses. While the NSA/other US gov agencies may be hacking chinese companies, I have yet to see any indication that it is done for the purposes of IP theft and/or anything is being shared with US businesses.

<comment><USER33> [https://www.bbc.com/news/world- europe-32542140](https://www.bbc.com/news/world-europe-32542140)

<comment><USER34> "[Checking] whether European companies were breaking trade embargos" is not the same as government-assisted industrial espionage.

<comment><USER33> The EU claims information obtained by the US government was fed to amongst others Boeing and McDonnel Douglas.</comment></comment></comment></comment></comment>


Ask HN: Open Source Metrics Collection System - <AUTHOR>

Hi HN,
I'm looking for self hosted (open-source) alternative to Stathat[0]. Basically, we want to send custom events to be captured and plotted with the ability to set alerts on these metrics. I do understand that this is something a lot of companies have built in house but if there are good open-source alternatives we could avoid a custom solution.
[0] - http://stathat.com
Thanks! <comment><USER2> We use graphite and cabotapp for metrics collection, aggregation and alerting</comment>


Fig: Java elegant supplement - <AUTHOR> http://wapatesh.github.io/fig/

<comment><USER2> A convenient addition the library would be a Seq/Hash that delegates to a "regular" List or Map without copying. I haven't had the time yet to look into how default interface methods work in conjunction with dynamic proxies, but may be able to easily "figify" a list that way

</comment><comment><USER3> "Fig uses conventions on method names similar with Ruby. If there is a pair of methods name, name$, method ends with $ means calling this method will change the object itself, while calling the other won't."

This seems very un-Java - surely the Java way to achieve this would be method overloading.

<comment><USER4> I do agree that this is very un-Java. However, how would method overloading allow for the simple given example of shuffling a sequence?

        seq.shuffle(); // copy to a new seq and shuffle it
        seq.shuffle$(); // shuffle the original seq

These two methods should have the exact same signature. So using two different names is necessary. I'm not particularly fond of introducing $ as a substitute for !. That convention is not existent in Java, and is not at all obvious to anyone who hasn't studied a functional language.

I would probably solve this by simply making shuffle always in place, and add a copy constructor and/or copy method:

        // Copy and shuffle.
        (new Seq(seq)).shuffle();
        seq.copy().shuffle();

        // Shuffle in-place.
        seq.shuffle();

<comment><USER5> Great opinion.

I do agree $ is very un-Java, either.

But I don't want "shuffle" to be in-place method by default. I agree with @jdmichal that it should return new copy.

In this case how to design the in-place way is not obvious.

I'm the main author of fig. This project is started for just a week. All of your suggestion are very supportive and I'm checking the feedback to make fig better.

<comment><USER6> I would simply not have in place modifiers. Focus your programming efforts instead on adding other cool high level constructs on lambdas.

See underscore or scala for inspiration.</comment></comment></comment></comment>


Ask HN: Is anyone disabling email tracking because of GDPR? - <AUTHOR> I'm trying to make my personal blog GDPR-compliant. I use a free MailChimp account to send emails when I post a new article. Seems to me that MailChimp's tracking of email opens and clicks, which are clearly associated with personally-identifying email addresses, is not GDPR-compliant. Obviously, MailChimp is not alone in offering this functionality. And yet, I don't get the sense that anyone is turning off email tracking or, alternatively, requesting my permission to track my interaction with their emails. <comment><USER2> Why don't you put a privacy policy explaining this in your blog? As long as you ensure 'lawfulness, fairness and transparency', you can easily be "GDPR- compliant". Keep a record of your processing activities (e.g. MailChimp is data processor and your are the data controller) and a quick note about the risk associated.

<comment><USER3> It isn't enough anymore to put this into a PP. If the subscribers did not gave consent for this it cannot be tracked (at least I think).

<comment><USER4> Consent is only one reason for data handling. There are others. Consent doesn't always need to be given.

[https://twitter.com/bainesy1969/status/995370110587154433](https://twitter.com/bainesy1969/status/995370110587154433)

<comment><USER5> Only if it is strictly necessary in order to conduct business, and no longer than that. E.g. using cookies for managing a session's shopping cart. Obviously tracking emails for marketing purposes is not allowed.

<comment><USER2> Tracking emails for marketing purposes can be seen as a legitimate interest. As long, it's describe to the data-subject and they give their consent, it's allowed.

Recital 48 is giving some explanation:

"The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."

[https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...](https://eur- lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN)

<comment><USER5> I really think the answer to this question at the moment depends upon the person asking. All I read in recital 48 is that PII might be shared within a group of companies that fall under the same holding.

IANAL, but I spent the past 2 years as CTO of an EU-based analytics company becoming compliant with GDPR, and consider myself quite informed on the topic. I would tread more carefully than what you are suggesting.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> I asked the following question of MailerLite and received the following answer...

Q: "Does Mailerlite allow me to disable open tracking and click tracking for the purposes of GDPR compliance?"

A: "Email tracking is not forbidden by GDRP. We just recommend to update the privacy policy that clicks and opens are tracked in the newsletter they get."

</comment><comment><USER4> This website might be useful: [https://www.infosecurity- magazine.com/blogs/gdpr-questions-a...](https://www.infosecurity- magazine.com/blogs/gdpr-questions-answered-blog/)

<comment><AUTHOR> Thanks for the pointer, but this simply speaks to collecting the email addresses (which is rather easy to obtain explicit consent for), not email tracking.

</comment></comment><comment><USER6> GDPR implementation is a nightmare for small startups.... so to avoid case-by- case consent options you make your newsletter adapt to the reading behavior of the user. If this becomes a key feature of the service it would seem that this data becomes necessary for the service and you could force consent without make it one of many optional features that a user opts in to.

<comment><USER7> It seems pretty straightforward that tracking deliverability, opens, and click-through of your newsletter is essential in providing a newsletter service.

These metrics are fairly essential if you want to be sure your users are actually receiving your content, and what content they are relating to in order to improve your content.

Since providing relevant content which actually makes it into your users' Inboxes is the whole point of a newsletter, it seems like ensuring that is actually happening is a core part of the service.

But I am not a lawyer, and I am certainly no expert on GDPR.

<comment><AUTHOR> Well said. As a hypothetical non-technical recipient of an email newsletter, I'd probably disagree that such tracking is essential. Personally, I just use the service so I don't have to manually send emails when I post new articles. The tracking doesn't interest me much.

Simply because the industry has molded the competitive landscape in such a way that tracking can be deemed "essential" does not, in my mind, make their behavior and actions immune from consent. But, I don't doubt that they could make that argument and win.

</comment></comment></comment><comment><USER8> Realistically, no one is ever going to go into your mailchimp account to audit if you're tracking opens. Dont worry about it.

<comment><AUTHOR> I'm not necessarily worried about it. I mostly ask because the lack of activity/discussion surrounding email tracking mystifies me. Just trying to understand.

</comment></comment><comment><USER9> It looks like you can uncheck the tracking box if you get a paid account, which I suppose means that your GDPR compliance will be $10 a month: [https://kb.mailchimp.com/reports/enable-and-view-click- track...](https://kb.mailchimp.com/reports/enable-and-view-click-tracking)

<comment><AUTHOR> Yeah, I saw that. They state that they require it for free and new paid accounts - for the purposes of "compliance".</comment></comment>


Ask HN: What to do with a spare linux box? - <AUTHOR>

So I have a spare Gentoo box.
I want to turn it into some sort of practical utility machine, but I am having trouble with some ideas.
So far I have set it up to stream my MP3 collection, which is quite nice.
Any other ideas?
What have you guys done with spare linux boxes? <comment><USER2> There're many things you can do with a spare linux box. I do keep a few 'project ideas' links just in case I got some spare time on hand.

Home file server with ZFS - <http://breden.org.uk/2008/03/02/a-home- fileserver-using-zfs/>

Proxy Server - [http://devcentral.f5.com/weblogs/macvittie/archive/2008/10/0...](http://devcentral.f5.com/weblogs/macvittie/archive/2008/10/08/8-things- you-can-do-with-a-proxy.aspx)

Map-Reduce fun with Hadoop - [http://www.michael- noll.com/wiki/Running_Hadoop_On_Ubuntu_Li...](http://www.michael- noll.com/wiki/Running_Hadoop_On_Ubuntu_Linux_\(Single-Node_Cluster\))

Donate bandwidth with a Tor Server - [http://ubuntu- tutorials.com/2007/08/31/how-to-run-a-tor-serv...](http://ubuntu- tutorials.com/2007/08/31/how-to-run-a-tor-server-donate-bandwidth-to-the-tor- network/)

More good ideas - [http://www.dailycupoftech.com/2007/09/17/put-that-old- comput...](http://www.dailycupoftech.com/2007/09/17/put-that-old-computer-to- good-use/)

A Dial-In server - <http://www.howtoforge.com/linux_dialin_server>

</comment><comment><USER3> You could give it away to someone who really needs it.

A lot of low-income families and kids don't have computers, and there are organizations (Free Geek is one) that accept and distribute donated machines.

<comment><USER4> Donate.

</comment></comment><comment><USER5> Get a VoIP account, set up Asterisk, throw in Adhearsion, do fun stuff. I rickroll random incoming calls. People recently stopped calling me.

</comment><comment><AUTHOR> I was also thinking of maybe doing that Folding@Home stuff.</comment>


A silicon valley vision for San Francisco - <AUTHOR> http://www.nytimes.com/2013/04/19/us/ron-conway-tech-investor-turns-focus-to-hometown.html?smid=tw-share&_r=0

<comment><USER2> There are things I dislike about Ron Conway's politics (the gun thing), but in general I support his goals in SF.

What I do dislike in SF are two things: shifting the payroll tax to a gross receipts tax is unfair to non-tech businesses with lower margins. A simple surcharge to the state income tax would be much more suitable, for both businesses and residents.

Two, as far as I can tell, either Ron Conway nor Ed Lee have seriously addressed the lack of affordable housing in SF. Not "affordable housing" -- housing for people with political connections and long-term waitlists, for below market rate rents -- but genuinely making housing affordable based on demand, by de-politicizing zoning and permitting in the city.

<comment><USER3> BMR rents/sales here are ridiculous. I've read some of the requirements for the sales and I don't see how these units ever get sold legitimately. BMR rents are also a similarly byzantine process.

As it is now SF (like the state itself) is business unfriendly and I hope that changes. My favorite example is SF's property tax depreciation schedule and the 12 year cycle for servers. I can't think of a server that is even designed to function that long anymore, the standard is 3 years. This is how out of touch San Francisco is, and it needs to change.

</comment></comment><comment><USER3> I am glad someone is finally taking on the ridiculousness of San Francisco politics. I was born here, and I've watched things just get more and more ridiculous. There's a reason this city was voted one of the worst run in the US, just watch a board of supervisors meeting and you'll get a good sense of whats wrong.

I think Ron is in the wrong about a few things (1A vs 2A), but frankly Ron is and will be a boon to San Francisco politics and the economy.</comment>


Kevin mitnick dox hacked by Kryogeniks - <AUTHOR> http://pastebin.com/f1a0852c9

<comment><USER2> Old info

<http://twitter.com/#!/kevinmitnick/status/84322256750260224></comment>


Apple Is Hiring for Clojure ("Apple Media Products, Core Services") - <AUTHOR> https://jobs.apple.com/en-us/details/200184362/apple-media-products-software-engineer-clojure-java-core-services?team=SFTWR <comment><AUTHOR> > […] part of the server team […] App Store, Apple Arcade, Apple Music, Apple > TV+, Apple Books, Podcasts, MusicKit, iTunes etc.

<comment><AUTHOR> AMA on reddit from 4 days ago:

[https://www.reddit.com/r/Clojure/comments/i59h4w/apple_is_hi...](https://www.reddit.com/r/Clojure/comments/i59h4w/apple_is_hiring_clojure_engineers/)</comment></comment>


If programming languages were vehicles - <AUTHOR> http://crashworks.org/if_programming_languages_were_vehicles/

<comment><USER2> Nice one, where will you place 'Rust' in this list?

I haven't used it but I sense that it's good.</comment>


Huawei caught cheating performance test for new phones - <AUTHOR> https://techcrunch.com/2018/09/06/huawei-caught-cheating-performance-test-for-new-phones/ <comment><USER2> This comes as no surprise. This is a company who has also been caught claiming their phone took a photo - but left in DSLR exif data, claiming a phone had UFS but shipped EMMC instead, boasting to work with dev community - only to lock them out months later, among other shady practices. They make nice phones at a good price, but is not a company to be trusted.

<comment><USER3> I am not surprised as others have been cought doing the same. Anyone remember the DSLR in the reflection in a Nokia ad that was supposedly shot a Nokia? Have you seen the rig Apple uses? doesn't look much like a phone anymore but technically is still an iPhone.

Sadly the P20 pro has an incredible camera and would stand on its own without forgery.

All I really care about is that they unlock their bootloader. The marketing crap is always half truths anyway. Retina, you mean 4k?

<comment><USER4> > Have you seen the rig Apple uses?

I cant find this, do you have a link? I'm quite interested in what they do.

<comment><USER5> They mount DSLR lenses onto stripped-down iPhone chassis via custom adapters. So it demonstrates what the Sony sensor + Apple software can do, but isn't reproducible in the real World.

<comment><USER6> They'd have to be careful in some EU countries with that trick.

</comment></comment></comment></comment></comment><comment><USER7> > we have decided to delist the affected models and remove them from our > performance rankings

I would be inclined to be more aggressive than that. Leave them listed, but add support in the site or other publication system to display "deliberately broke the rules of the test" as a negative, perhaps displaying in a negative looking colour and in any graphs show as a if they scored, say, 20% worse then the worst other score.

If presenting some arithmetically derived overall rating of benchmarks and other properties, balloon this further. Then if the rest of the phone is demonstrably brilliant they still have a hope of not looking terrible, but the cheating hurts the result otherwise.

Unfortunately in these litigious times such an inclination would probably cause me some financial trouble, so it is probably for the best that I don't run a device comparison site! This may be why simply delisting was the chosen way of handling the situation here.

</comment><comment><USER8> I used to work at an OEM that did this. When the VW Emissions Scandal was publicized, we removed almost every piece of code that did things like these from all our phones.

Not sure if it was ever reverted eventually but performance test might not matter to HN users but it is something that typical consumers do look at when making purchasing decisions, based on our research.

<comment><USER9> Your second paragraph is completely ethically bankrupt.

That a lie increases sales is at the top of the list of bad reasons to lie to customers (and they are all bad reasons).

<comment><USER10> > That a lie increases sales is at the top of the list of bad reasons to lie > to customers

I think that in the society we've built it's actually one of the best reasons to lie to customers. Advertising is pretty much built on that.

<comment><USER9> Replying to that piece of text out of context is really boring.

<comment><USER10> I'm not sure how it's out of context, your entire comment was "lying to customers to increase sales is bad!".

</comment></comment></comment></comment></comment><comment> EZ-E I'm gonna get down voted but that's why I buy Apple phones. Comparing processors, ram, test scores means nothing compared to the actual experience

<comment><USER11> And that's why I buy Google phones. The processor being slightly slower doesn't matter to me if I prefer the overall experience

<comment><USER12> If you don't mind being stuck storage-wise with no SD card slot... 4k videos fill up internal storage pretty quickly.

<comment><USER13> When you buy a Google phone you get unlimited backup storage in Google Photos. You never think again about things like that.

<comment><USER14> Unlimited backup storage _for low-quality, highly-compressed_ photos. If you want to store photos the way they were shot, you'll quickly run out of space and will have to pay up.

(That's what made me pay Google directly for the first time; extra storage for backing up photos.)

<comment><USER15> The photos are neither low-quality nor highly-compressed. I personally can't tell much of a difference 95% of the time and I'm a technical person. Here´s a comparison and a closeup, left image is the original, right one compressed with the Unlimited Storage setting:

full picture [https://images.huffingtonpost.com/2016-01-01-1451631423-7665...](https://images.huffingtonpost.com/2016-01-01-1451631423-7665610-Beach.jpg)

cropped detail [https://images.huffingtonpost.com/2016-01-01-1451631515-2060...](https://images.huffingtonpost.com/2016-01-01-1451631515-2060334-BeachCrop.jpg)

Also, I believe Photos storage is unlimited even in Original quality if you own a Pixel phone, which may or not may be the case, but still.

<comment><USER12> The first picture has a very noticeable color shift (left is warmer, right is colder) - I am looking at it on a professional 10-bit 4k display which might be a factor, but I would run away from any storage that would cause that :-O Detail looks horrible on both, difficult to say which one is worse and how well do they match. On better photos that would probably be noticeable (my color vision is 100%).

<comment><USER14> I'm looking at it on a Dell U2715H, which is not a professional display, just a consumer one with above-average color quality and good calibration out-of- the-box, and I could spot the temperature shift immediately as well. Also, as you say, the details are bad.

I'm wary of services that auto-compress images, because a) I want my bits to stay the way they were originally captured, and b) every now and then I have to print a photo I make, and then suddenly all those details matter for the print quality.

<comment><USER13> It's a non-issue with a Google phone (a Pixel) in any case, as you have unlimited storage of photos in their original quality.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> This is just what is expected: the vendors do this because they need to shine in these meaningless benchmarks because that's merely the name of the game. The tech magazines are in between: they publish results in reviews and phone comparisons but it seems that not many people really buy phones based on benchmark scores. They might give some overall idea of whether the phone is middle-end or high-end, but differences within one category tend to be small enough to not matter for the general buyer.

To fix this, there should be different runs for these benchmarks. A max-clocks run with the phone set in an actively cooled cabin to see what the hardware can theoretically do at its very best, and another run in non-actively cooled room temperature with the test running for about an hour to rule out any benefits from temporary boosts or ignoring thermal limits to get an idea of continuously supported performance.

Even those results wouldn't really tell much to the end-user. I always suggest my friends and relatives to buy a phone with excessively large memory and storage space because lack of memory and storage really is what turns phones slow after a few rounds of application and system updates.

The performance edge on mobile is thinning out pretty much what happened with PCs. Ditto for memory and storage. Early on, vendors competed on who has the highest MHz cpus but somewhere between 1-2GHz the performance got high enough in nearly any case. 95% of people could buy about just any PC or laptop and it would be "fast enough". There's gigabytes of memory in even the sloppiest laptop these days, and enough SSD to make things fly. The same will happen with phones which makes it impossible to buy a phone that is too slow. At that point components with lower performance and less capacity will become more expensive due to the lack of volumes, that no vendor will bother any longer.

</comment><comment><USER17> I don't see why an earnest benchmarking firm would let manufacturers know details like the name of the testing app.

<comment><USER18> Transparency. Everybody can run the benchmark on their own device [1] and check the results, that way they can't deny the results saying that it's malicious, a conflict of interest or a configuration error.

[1] [https://play.google.com/store/apps/details?id=com.glbenchmar...](https://play.google.com/store/apps/details?id=com.glbenchmark.glbenchmark27)

</comment></comment><comment><USER19> My first reaction was reaction isn't this a dupe. But then the earlier one was about Huwaei's camera cheat:

[https://news.ycombinator.com/item?id=17805027](https://news.ycombinator.com/item?id=17805027)

</comment><comment><USER20> Can these be grounds for refund?

<comment><USER21> In Australia, can return for a full refund that it's not working as advertised.

<comment><USER22> Only if the benchmark results were marketed by Huawei. Otherwise you would be limited to a claim under _misleading or deceptive conduct_ which is still technically possible but you'd have bear the huge expense of taking them to court with the real possibility that you might lose and be bankrupted.

</comment></comment></comment><comment><USER23> How ironic that Huawei uses the word "Honor" in some of its models.

<comment><USER24> Well, they sure missed the dis* prefix

</comment></comment><comment><USER25> >however, when an unlabeled version of the benchmark test was run, the phones were unable to recognize it and, as a result, displayed lower performances.

>In other words, the phones aren't so smart after all.

If I may, also the fact that benchmarks are normally/usually "recognizable" through some "label" doesn't seem "smart" to me.

</comment><comment><USER26> If something is cheap in terms of the price you pay for it, you're going to pay by something else. Be it poor quality components, information collection or unethical manufacturing processes. Yes, of course I am generalizing. There are good cheap(er) products and bad expensive ones.

<comment><USER27> AFAIK Chinese companies make money (in China) with the software they ship on their phones, and the associated Internet services. They all have a slew of what we'd call bloatware, but apparently Chinese people expect it and enjoy it for it being "free stuff".

I don't really know what's their roadmap for Western markets considering nobody wants to let off their Google world. Even though the cynics among us will placate it as the Party bankrolling it for spying.

</comment></comment><comment><USER28> That's a shame. I got a P20 Pro and I really like it (even the software).

But I don't think I'll get another Huawei next time, because the company itself is really weird.

<comment> yjftsjthsd-h Using "weird" as a euphemism for unethical, or some other problem?

<comment><USER28> Weird as in they keep doing shady things even though they don't need the shady practices.

</comment></comment></comment><comment><USER29> Huawei caught cheating at a meaningless 'test' nobody should care about.

I spoke a fair bit about performances with a Googler in charger of it. Apparently he is appalled that OEMs have been optimizing their phones in order to score high on these benchmarks.

They don't reflect real use at all and are not what should be optimized against.

In the end, he documented the work he did on the various terminals he worked on so OEMs could do what they should have been doing for years..

</comment><comment><USER30> It reminds me of the old GPU vendors when we were still using AGP bus(or pre- AGP era I forgot). Good evil days.

<comment><USER31> Are those days gone? Benchmark-specific hacks in graphics drivers, I mean, not AGP. :P

Also all the outrage when people discovered that a Radeon 9600 was just a Radeon 9800 running in crippled mode, and that you could bridge the tracks and re-enable it in 9800 mode. (Or something similar, anyway, that was a long time ago... :P )

<comment><USER32> It was the 9500 that could be modded into a 9700. Early versions could be softmodded, this was disabled in later revisions which could only be modded by soldering the additional rendering pipes back on. No idea why I remember this useless piece of information.

Also on a completely different note, the 9700 Pro which was the flagship card of that generation, cost about $300. Times have changed.

<comment><USER33> $399 was the price on launch in 2002, which is around $550 adjusted for inflation, current flagship consumer GPU from Radeon is the Vega 64 priced at $599 RRP. Times haven't changed as much as you might think

<comment><USER34> AMD's flagship is the $700 Vega 64 LC. NVIDIA's flagship 1080 Ti is $700 and their soon-to-launch 2080 Ti is $1000 or $1200 for the Founders Edition.

</comment></comment></comment></comment></comment><comment><USER35> > For the Huawei case, the rules are actually a little fuzzy. Phones are > permitted to adjust performance based on workload, which results in peaks or > dips in performance for different apps, but they are not permitted to hard- > code peaks in performance specifically for the benchmark app. Huawei > reportedly claimed that the peak in performance seen during the run of the > benchmark app was an intuitive jump determined by AI; however, when an > unlabeled version of the benchmark test was run, the phones were unable to > recognize it and, as a result, displayed lower performances.

Source code for their AI engine:

if (app == benchmark) { increasePerformance(); }

<comment><USER36> What exactly does "adjust performance" even mean? If it's something like frequency throttling, there should be a user setting to force maximums, even at the expense of battery life, and likewise another option to force minimums.

<comment><USER37> No mobile device on the market runs at the same clock speed for any length of time. They're always scaling down the clock speed for a variety of reasons (usually battery life and thermal management). If you ran at max speed all the time, you'd have trash battery life and probably cause overheating.

<comment><USER38> Each device has a pretty unique thermal profile(tablets dissipate heat better than small phones, more metal = better profile, etc) so these things tend to get tuned on a per-device basis.

We had one device I was helping bring up where you could run the GPU full-tilt for ~60s. After that the device would reboot and fail to come up until it had cooled enough. Was a fun process characterizing that device and our workloads in 60s bursts. Couple weeks later they had it tuned in where you could run it 24/7 as the thermal limits kicked in pretty aggressively.

</comment></comment></comment></comment><comment><USER39> This is a change from their normal business practices, usually they would steal performance results and publish them as their own.

</comment><comment><USER40> Yeah, Huawei also sells shitty phones with locked bootloaders. Not interested in any case, cheating or no.

<comment><USER28> I disagree that they are shitty... hardware and software is great. Their ethical standards maybe not.

Besides, if you want to install custom roms just get a phone that is supported officially (e.g. Pixel). I don't care about custom rom scene so it doesn't bother me that the bootlocker is locked. Though it was definitely a nice to have while it still existed.

<comment><USER40> _You_ don't care about custom ROM scene, but by purchasing Huawei's products when you have plenty of other highly-competitive choices, you _are_ supporting their ethical standards. And thus by proxy you are declaring your support for locked-down hardware and black-box software. As long as you are totally aware and recognize that you do not support the principles of free computing, and that you support companies asserting ownership rights over something after you have purchased it, then I have no problem with your reply. There is no hostile intent with this comment, but I do wonder if you understand what you are saying, when you say that you realize their ethical standards are not great, but you continue to buy their products because it currently does not affect you, despite having plenty of excellent alternatives in this market. Incidentally, I think you have a cool username.</comment></comment></comment>


Warning: This Algorithm Will Self-Destruct After It's Used - <AUTHOR> https://www.technologyreview.com/s/609054/warning-this-algorithm-will-self-destruct-after-its-used/ <comment><USER2> It seems to be this preprint: [https://arxiv.org/abs/1709.09724](https://arxiv.org/abs/1709.09724)</comment>


Show HN: A low(ish) code development tool I've been working on - <AUTHOR> https://github.com/PhilipSkinner/elemental-lowcode <comment><USER2> Perhaps graphics, blog walkthrough or video would help people figure out if its worth the effort of installing and providing feedback

<comment><AUTHOR> Thanks! I'll see if I can spend some time on making the readme.md more informative.

I have done a simple tutorial for creating a todo list app here:

[https://elementalsystem.org/documentation/tutorials/todo](https://elementalsystem.org/documentation/tutorials/todo)

I plan on creating tutorials for creating a blog with it and creating a ticketing system. I should call these out on the readme and include some graphics/videos like you way.

</comment></comment><comment><AUTHOR> Hello all!

I've been spending my time working on a low code development tool. While it's not so as low in terms of code as I would like it right now, I think it should allow for easy interfaces to be put on the top, while still retaining the ability to jump into your apps source.

It's all very much a work in progress to flesh out concepts etc.

I'd love to hear what people think, good or bad!</comment>


Ask HN: Any free/open source tools to create animated videos? - <AUTHOR>

I'm looking for free/open source video editing solutions that I can use to produce promotional videos for my web applications. I am good at illustration so I guess animation videos are the way to go.<p>Do you know about any such tools? <comment><USER2> Check out <http://www.blender.org/> if you are looking for making 3D animations.

</comment><comment><USER3> You might try this: <http://muvizu.com/></comment>


How to Breathe Water...and Not Die? - <AUTHOR> http://sbms.blogspot.com/2010/12/how-to-breathe-waterand-not-die.html

<comment><USER2> I kept thinking this reminded me of something...the scene water-breathing scene from the Abyss. The scene with the rat is real: <http://www.youtube.com/watch?v=2NmU7VKd3VA>

<comment><AUTHOR> It's awesome how science developments follow their creation in science fiction. Remember Star Trek and their communicators? We have cellphones that surpass those by leaps and bounds...talk about progress.

<comment><USER3> Although a cell phone probably won't do you much good on say...Nimbus III.

<comment><AUTHOR> I feel the conversation should end hear, otherwise we'd soon start discussing Star Wars too...and then it would simply never end.

</comment></comment></comment></comment><comment><USER4> There are a lot of issues that would have to be resolved before diving with a liquid breathing solution would be practical. (Okay, it will never be practical, but maybe it could at least not kill you.)

* Liquid breathing solutions have to be really, really sterile. You're introducing a liquid past all your defensive mechanisms, and typical immune responses (coughing or sneezing) won't do anything. As a result, immune response/inflammation can be quite severe. This would be hard to maintain in a marine environment.

* Even with a liquid breathing solution, high pressure can still have health impacts. I don't think this has ever been tested (at least not in an unclassified setting), but HPNS (High Pressure Nervous Syndrome) would probably still be a major issue at depths beyond 800-1000 feet.

* It's my understanding that total liquid breathing (as opposed to partial liquid breathing, where only one lung is filled or both lungs are partially filled) will cause a lot of damage to the lung surfactant layer. I'm not sure if this is still the case--human tests with total liquid breathing are very rare.

There's lot more information about medical applications in this paper, written by Thomas Shaffer (mentioned in the article): [http://pedsinreview.aappublications.org/cgi/content/full/20/...](http://pedsinreview.aappublications.org/cgi/content/full/20/12/e134)

<comment><USER5> HPNS is a problem beyond 500 feet when using conventional gas mixtures (Nitrox, Heliox, ...); however, there have been simulated dives to 3500 feet on Hydrox (Hydrogen/Oxygen), which seems to prevent HPNS (I can't seem to find anything more specific about the cognitive abilities at 3500 feet). Hydrox isn't used often.

<comment><USER4> Diving with nitrox (nitrogen/oxygen) beyond 500 feet is very rarely done, and HPNS isn't really an issue because the overwhelming narcotic effect of the nitrogen would be devastating (think 20 tequila shots in a row). HPNS seems to be caused by rapid changes in the partial pressure of helium, so it can be alleviated somewhat by using less helium and replacing it with nitrogen.

COMEX (a French commercial diving company) has done successful working dives to beyond 1,700 feet on hydroheliox, a mixture of 49% hydrogen, 50% helium, and 1% oxygen. However, there are major practical issues with breathing a hydrogen mixture--namely, if you have hydrogen and oxygen together at high pressure with more than a tiny fraction of oxygen, it will explode. This makes it only practical to use a hydrogen mixture at a depth great enough where 1% oxygen is a high enough partial pressure to sustain consciousness.

Also, hydrogen at high partial pressures is said to have a narcotic effect similar to LSD, but permanent.

</comment></comment></comment><comment><USER6> The title's a bit misleading, it's not actually water that you'd be breathing.

 _Water normally doesn't have enough dissolved oxygen_

 _The new suit allows its wearer to breathe a specialized liquid chock-full of oxygen molecules; called a PFC or perfluorocarbon, the liquid can store large amounts of dissolved oxygen._

<comment><USER5> _How to breathe water which isn't actually water ... and not die_

I imagine this will be an extremely unpleasant experience. Humans don't like having any kind of fluid in their lungs. Safer deep diving is exciting.

</comment></comment><comment><USER7> Original source: [http://www.independent.co.uk/news/science/into-the-abyss- the...](http://www.independent.co.uk/news/science/into-the-abyss-the-diving- suit-that-turns-men-into-fish-2139167.html)

<comment><AUTHOR> Thanks, I've updated the link.

</comment></comment><comment><USER8> If you have read The Lost Symbol it will sound terribly familiar :)</comment>


Unisoftdev Forum - do follow links - <AUTHOR> http://forum.unisoftdev.com/ <comment><AUTHOR> Is there anyone wlling to discuss and make do follow links from the forum?</comment>


Manage your business address in social networks - <AUTHOR> http://managemylocation.com <comment><AUTHOR> We're a group of freelancers, and build online tools and small prototypes.

Recent research shows that location data of hotels and restaurants is not generally available in mobile apps. With this tool business owners can verify and follow up their location data in Google, Facebook, Yelp and Foursquare.

Please review and let us know if you have any suggestions for improvement!</comment>


Formlabs Form 1 Teardown - <AUTHOR> http://www.bunniestudios.com/blog/?p=3110

<comment><USER2> Nice to see they got the job done. I ended up not participating in the original kickstarter (money being tight at the time), so I'm waiting for them to start retailing the devices.

<comment><USER3> They have started shipping printers as Kickstarter rewards and promise to ship regular preorders in July 2013. July is not that far, so I have just ordered one.</comment></comment>