Secure Computing for Journalists - <AUTHOR> https://blog.cryptographyengineering.com/2017/03/05/secure-computing-for-journalists/ <comment><USER2> A few weeks ago a bunch of us on Slack tried to put together a brief for journalists on why they should prefer iPhones. It's still a work in progress, as you'll see, but here's a draft:

[https://gist.github.com/anonymous/9f789aabd7e8681dec0cf5781a...](https://gist.github.com/anonymous/9f789aabd7e8681dec0cf5781aecf664)

<comment><USER3> Why would someone who's threat model includes the US government possibly want to trust a totally closed OS made by a US company?? Do you still not see the US government as a threat to journalists? If not how do you justify this position?

<comment><USER4> 1) Apple has shown substantial backbone in fighting against the US government when pressed to exploit a phone.

2) The other choice is a device made by a Chinese or Korean company with a semi-open operating system made by a US company.

3) Either device will have a totally closed baseband chip.

4) Deploying and maintaining secure Linux environment on a Laptop is a full time job that requires expertise journalists don't have.

5) Open versus closed source is a red herring. Everyone is using pre-compiled binaries.

<comment><USER5> >2) The other choice is a device made by a Chinese or Korean company with a semi-open operating system made by a US company.

All iPhones are made in China by a Chinese company.

<comment><USER6> They are made by Foxconn, which is a Taiwanese company.

<comment><USER7> Does that make it meaningfully better?

</comment></comment></comment></comment></comment></comment><comment><USER8> I have a security review for a news room coming up, and I plan on sharing this blog post with them. Thanks for writing it Matt! I'm definitely behind all of the points you made.

If anything, I worry that non-technical users will _still_ not understand that desktop programs can do anything you can do with your computer even after reading your post. I'm not sure the description is "in your face" enough to translate for the intended audience. In their minds, "reading files" may be better expressed as "copy of every email I've ever sent" or "operate my webcam and grab nudes of me."

<comment><USER9> > I have a security review for a news room coming up, and I plan on sharing > this blog post with them

Isn't there something more professional and accurate available? I fear there is not.

<comment><USER8> There are plenty of alternative sources I could list, but Matt's blog post is 1) accessible 2) correct 3) short. That's a winner in my book!

</comment></comment></comment><comment><USER10> I've been trying to secure investigative journalists for about a year and a half, and this article kind of covers two of the points that I make on all of the security trainings. They usually go like this:

* Do not have work-related emails on your Android (unless it's Google-made). iOS (9+) is okay. * Do not open random attachments on a Windows machine. (We always do our best to convince them to switch to a Ubuntu station with an AppArmor profile for LibreOffice set.)

This is a good start. I think this article would be even better if it included some phishing tips (like HTTPS doesn't automatically mean "secure", and if you're suddenly logged out of Google for no apparent reason, don't just log into the webpage displayed to you, but instead, open Google by typing the address bar manually and log in there).

Interesting side-note: Asshats spend days crafting phishing emails specifically targeted to our journalists, and they _never_ get Google's postal address right in the footer.

<comment><USER2> I'm not sure I understand how switching someone from Windows+Office to Ubuntu+LibreOffice is a security win. LibreOffice is not an especially safe piece of software.

<comment><USER11> I hope I'm not saying anything wrong here, but from what I'm aware there are two major problems with MS Office that LibreOffice doesn't have:

* It doesn't have all that macro bundling stuff in normal documents that's the source of the whole macrovirus issue.

* It doesn't have any OLE-object-can-run-embedded-EXE-files-on-click-feature.

I'd say that's a huge win.

<comment><USER2> It takes seconds to turn macros off in Office, far less time than it takes to convert someone to LibreOffice. Meanwhile, straightforward fuzzing is still producing RCEs in LibreOffice.

</comment></comment></comment></comment><comment><USER12> This advice makes sense given the threat model. However, it might not make sense for someone in Edward Snowden's role. If I were a military agency with a big budget, I would backdoor the shit out of every phone, enforce cultures of secrecy inside companies like google, apple, facebook, intel, qualcomm, at&t, and off any executive that interfered with the mission. Then I would pay experts to spend their lives on internet forums asserting that devices with two cameras, two microphones, wifi that can function as radar, an unremovable battery, a closed-source operating system and root access only available to a major US corporation via ssh, are the most secure computing platforms in the universe. That's just me though, if I had a lot of money and lust for world domination, neither of which I possess :)

Edit: removed sentence "Most mobile devices have baseband chips with DMA"

<comment><USER2> No, iPhone basebands do not have direct memory access. This is a myth that will not die. The baseband on an iPhone (and on modern Android phones) is connected via a serial bus, as a peripheral. Both Google's and Apple's security teams consider the baseband an adversarial device. This has been true for many years, just as for many years people have been popping onto message boards to confidently inform us that basebands have direct access to memory.

<comment><USER9> > The baseband on ... on modern Android phones ... is connected via a serial > bus, as a peripheral

Doesn't that depend on the manufacturer, or does Google somehow make that a requirement?

</comment></comment></comment><comment><USER13> But if a journalist is going to use a secure desktop Operating System, he/she/they should investigate the current trio of recommendations which are as follows, and have different threat models baked into each:

Subgraph. Currently in Alpha version, so be careful using this. Still has to be vetted by the wider infosec community, but worth downloading and playing around with.

TailsOS. Very useful for journalists, but since it heavily relies on Tor it can be tricky dealing with mixed-anonymity workflows where sometimes you just need a Windows environment (preferably an airgapped Windows sandbox you can use to code / play around with files using Windows freeware).

Qubes. Heavily reliant on compartmentalization, and this can sometimes prove too cumbersome if you typically do one type of activity on the web like chat / email / hang out on slack. Typically for when you need to insulate different activities from each other and to avoid contaminating different contextual environments / tasks.

<comment><USER2> I like Subgraph. I know a lot of people like Qubes (I have no opinions about it, but the people I know who like it are quite smart). I don't think I know anyone who recommends Tails.

But none of these are reasonable suggestions for journalists and activists. We're not talking about people who are running conspiracies and can organize their working lives around opsec. You can barely get these people to the point where they aren't blindly clicking on attachments (and the attachments they open need to open in office software that is compatible with their existing workflows). They're simply not going to use Linux on their desktops.

This is why security people like phones so much: they run secure operating systems that laypeople have accepted and can work with.

<comment><USER13> > that laypeople have accepted and can work with

There is the caveat that it's hard to get things done in a timely manner on phones, or even tablets/phablets. If I need to crank out a lengthy blogpost, then I need a full desktop environment where I can do cross referencing, wikipedia lookups, file selection, photo editing, and all the other things that a desktop affords. I have tried writing a blogpost on an iPad and it took up my whole day when it should have taken 2-3 hours.

I know people who have developed super-fast methods for working on iOS but they are such a rare creature, and I'm not so sure their workflow is even teachable enough to be widely adopted by journalists or professional bloggers. From my experience they're relying on all sorts of hacks to get a blogpost out the door like using some perfectly curated mix of apps, and being able to pass files to and fro different apps with ease. Hardly the stuff of laypeople.

</comment></comment></comment><comment><USER14> This is a great article but only really covers half the issue. The other half is why journalists should use secure messaging applications, and not email.

Sometimes the most succesful attacks are phishing attacks that no device will protect against. As an example, it is rumored that John Podesta used an iPad.

<comment><USER8> Great point, but this sounds like a topic for another blog post. I'm so glad that FIDO U2F is starting to catch on. I keep a drawer full of keys at work and hand them out to all our office visitors. The next generation of Bluetooth, NFC, and software tokens are exciting and a bright spot for the security industry.

</comment></comment><comment><USER15> Use iOS with a privacy proxy they said...

[http://www.falseconnect.com/](http://www.falseconnect.com/)

The first point being, software flaws and particularly those in low level networking libraries can expose secrets and the key I suppose as covered in the article is to ensure your OS is always up to date. The second point, and Dan covers it elsewhere in this thread, be very cautious about insecure hosted VPNs & you should really never trust proxies which some VPN providers are offering.

<comment><USER8> Yes, definitely always keep your OS up to date! Even in 2017, this is still a major advantage that iPhones have over Android phones. There will be bugs in any device, and iPhones have a better plan for dealing with them than Android phones. There is a vast amount of empirical data that shows patch adoption rates are far faster on iOS.

iOS patches are:

1) _available_ , directly from the vendor

2) come with new features

3) required for certain apps

4) nag you

etc

<comment><USER15> A number of years ago I found a crypto flaw in a Samsung component they shipped on their Android phones. Due to carrier update delays it took nearly two years for all the patches to roll out. Apple on the other hand can go from notice to patch available in weeks.

<comment><USER2> Apple's not perfect about this stuff. Google and Apple both have strengths when it comes to systems security, including on mobile platforms.

The key advantage Apple has is vertical integration. Google has to coordinate with third party vendors to ensure that an OS patch reaches Android users. Apple can just flip a switch.

</comment></comment></comment></comment><comment><USER16> I wonder how helpful these sort of posts are for actual journalists or whistle blowers. It's one thing to tell a casual user to get an iphone as a reasonably secure choice compared to Android's fragmented mess, but for someone whose job and/or life is on the line, you need a more thorough coverage. You may even need like a mini course of sorts that covers basics of CS and infosec. Short of that, such cavalier advice can be misleading.

<comment><USER17> This was written as a response to a question from an actual journalist. It's quoted right at the top. What do you find 'cavalier' about it?

<comment><USER16> Because it fails to mention any downsides of running an ios based phone, and I'm sure that a balanced discussion would find many. Security is complex, and paraphrasing it this way may be fine as casual advice, but when you add "journalists" in the title of your post, it falls short.

<comment><USER17> It outlines many of the limits of the advice, describes a specific case in which an activist was targeted by multiple iOS zero days, etc. What are the downsides you think it omits and in what ways does Matthew Green misunderstand the complexities of security?

<comment><USER16> Not so much about misunderstanding as it is about omitting other details. For one, IOS is a completely closed box whereas AOSP is completely open. You can argue for or against security by obscurity v/s security in open software, but at the very least it needs a mention in any fair comparison. Secondly, most of the blog focuses on average case behaviour. In Apple's case the average, best and worst case are all the same since they make only one device and one OS. In contrast, android is a vast spectrum. Now if you were to give out advice to people with sensitive data, you should compare the best case for both of them, which he briefly does, but not quite as detailed as it warrants. For instance, is iphone necessarily better than a Pixel running AOSP or something like CopperheadOS ? I'm not so sure. IOS's centralized behaviour also makes it an easier target in some ways. Want to attack all browsers on an iphone ? Attack webkit. There are other security fails such as relying on either itunes or icloud for getting data in and out of the phone. Much fuss was made over Cloudfare's lack of a bug bounty program. Apple didn't have one either until quite recently either.

<comment><USER17> I'll just take the bit with the highest inaccuracy density:

 _IOS is a completely closed box whereas AOSP is completely open. You can argue for or against security by obscurity v /s security in open software, but at the very least it needs a mention in any fair comparison._

This gets addressed by people working in security on every single HN thread, including this one. Assessments of the security of iOS are not dependent on its 'openness'. There is also nobody seriously arguing 'security by obscurity' vs 'open software'. That's not what 'security by obscurity' means nor does the security of iOS depend on 'obscurity'. None of this needs a mention in a 'fair comparison' because it's simply wrong.

</comment></comment></comment></comment></comment></comment><comment><USER18> IOS more secure than android? Joke ready. IOS is closed source. You can not tell whether Apple, the CIA, or the NSA are spying on you.

<comment><USER8> Do you own a disassembler? I do. Also, a decompiler, debugger, and other analysis tools. Closed source does not mean "black box."

And besides, open source doesn't mean anyone has reviewed the code. Reviewing a program for security takes work, regardless of whether it is open or closed.

<comment><USER18> I really do not understand any of this. I am in the 1st period of the Information Systems course. But I know one thing, it's much easier to find a backdoor with the open code than the other way around. Besides that nothing guarantees that with these techniques you do not miss something.

<comment><USER19> One of my perennial favorite HN comments: you, the professional reverse engineer, could not possibly do what you do. I've never tried to do it, but I know you can't.

<comment><USER3> More like I the lowly software developer can read code but I can't reverse engineer - and why should I learn?

<comment><USER2> It's fine not to learn. What's less fine is stridently asserting, as you have all over this thread, that security advice from experts is flawed while at the same time huffing about how little time you have to learn about the details.

<comment><USER3> I have repeatedly asked you to actually provide some citations for your claims. Please do so.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> To be safe see this site. It has everything you need. Https://www.privacytools.io/

<comment><USER8> Hi, my name is Dan, and I don't recommend anything on the privacytools website.

Above all the many problems it has, it recommends using insecure hosted VPNs and advocates an app-centric approach to restoring your privacy (e.g., Install this app and you'll be safe!). This is no better than believing you can eat unhealthy food and fix it with weight loss pills.

If you're looking for a better solution to a communications security problem, you're welcome to check out Algo, a self-hosted VPN that I support:

[https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn- th...](https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/)

<comment><USER20> Thanks for the link to Algo. First time coming across it.

I was under the impression that PrivateInternetAccess was well regarded, but this link [1] which is in the blog post linked above was an eye opener.

[1] [https://gist.github.com/kennwhite/1f3bc4d889b02b35d8aa](https://gist.github.com/kennwhite/1f3bc4d889b02b35d8aa)</comment></comment></comment>


Medical Marijuana Research Hits Wall of U.S. Law - <AUTHOR> http://www.nytimes.com/2014/08/10/us/politics/medical-marijuana-research-hits-the-wall-of-federal-law.html

<comment><USER2> Is there anything stopping researchers from opening labs on Indian reservations?

There might be some technical requirements (like Native Americans have to be the owners) and it might be expensive, but I'm sure someone in the Native American community sees the extreme importance of this research.

<comment><USER3> It's not like US law doesn't apply at all on Indian reservations; the exact contours of the application are wildly unprincipled, but they do stick when the feds want them to.

Besides which, "money laundering", "conspiracy", or any of the other catch-all felonies are broad enough to encompass any of the practical steps to engage in such a project.</comment></comment>


Boltzmann Brain - <AUTHOR> https://en.wikipedia.org/wiki/Boltzmann_brain <comment><USER3> I find this question really fun: "Am I a Boltzmann brain, or a real human?". If there exists both a human and a Boltzmann brain with your current mental state, then it doesn't make sense to try to answer this question with a single answer. Your line of reasoning will be identically executed in both, so your line of reasoning can't result in a single answer and be correct.

Instead, one way to address the confusion about whether you're a Boltzmann brain or not, is to realize that in the case you're a Boltzmann brain, none of your thoughts or decisions matter at all. Even if you admit there's some probability that you're a Boltzmann brain, there's no use factoring it into your decision processes besides as a curiosity. Your decisions only matter in the case that you're an actual human, so that's the only possibility worth considering while coming up with decisions. (Similarly, if a coin was going to be flipped in a moment, and a bunch of things depended on which way the coin landed, including that you were going to be immediately executed with no possibility of escape if the coin landed on heads, then all your plans for the future should be exactly the same as if you expected the coin to land on tails with 100% certainty. It's the only path that any of your decisions matter.)

<comment><USER4> What if you are a recurring sequence of Boltzmann brains pooping into existence, lasting mere seconds but correctly temporally sequenced as to form a continuous consciousness?

<comment><USER5> If you like these thought experiments, consider that I'm not actually responding to your comment, but I am actually mashing the keys randomly and it only appears to form a response by coincidence. We are not actually communicating with each other.

<comment><USER6> You are not mashing the keys, because nothing happens except that God wills it so. It just happens that God keeps making miracles that you have interpreted as the effects of your actions on the world.

<comment><USER6> This is the first time I've been downvoted for paraphrasing David Hume :)

[https://en.wikipedia.org/wiki/David_Hume](https://en.wikipedia.org/wiki/David_Hume)

</comment></comment></comment></comment></comment><comment><USER7> I've always enjoyed this thought experiment and the loosely related one - <USER2> Thursdayism[0].

[0] [https://rationalwiki.org/wiki/Last_Thursdayism](https://rationalwiki.org/wiki/Last_Thursdayism)

<comment><USER8> > is the idea that the universe was created last Thursday, but with the > physical appearance of being billions of years old.

or it may have been just restored from a backup (with some bit rotting and missing pieces as evidenced by dark matter/energy and other inconsistencies)

<comment><USER9> The dreams you recall are just artefacts of the restore process initialising your mind.

<comment><USER10> I actually considered that as a realistic possibility -- that memories of dreams form as you wake up -- but I think that is didproved by people talking and moving in their sleep in ways consistent with what they report about their dreams when they wake up. PET and NMR scanning might be able to resolve the issue, if it has not done so already.

<comment><USER11> Lucid dream research done in the 1970s had subjects signalling from within a dream using eye movement.

[https://www.researchgate.net/publication/258201870_Lucid_dre...](https://www.researchgate.net/publication/258201870_Lucid_dream_verified_by_volitional_communication_during_REM_sleep)

</comment></comment></comment></comment></comment><comment><USER12> Why is it not a Boltzmann rock, or a Boltzmann commemorative coin, or something else inanimate like that?

I thought the whole point was to give a simple metaphor for a measuring the probability that a mundane object came into being based on the widely accepted history of the universe that modern physics predicts. As opposed to just coming into its current state instantaneously based on extremely unlikely random events among its constituent atoms.

Or put differently (based on the Wikipedia article), if the math behind a modern physics theory means that it's more likely the given object's existence was due to random fluctuations then that's a strike against adoption of that theory.

But if you make the object of interest a brain you get all this bikeshedding about consciousness and how do the regular brains know they're not Boltzmann brains, etc.

It'd be like introducing me to your new programming language's syntax by showing me the code for a quine instead of "hello world." What is the value in doing such a thing?

<comment><USER3> There are similar thought experiments around complex objects suddenly coming into existence. They're not very controversial. The Boltzmann brain thought experiment is interesting because it raises the possibility that there's some chance that you might be a Boltzmann brain without realizing it. It's very hard to try to figure out what the correct way to reason about this possibility is. Properly reasoning about whether you're a Boltzmann brain, and whether you should care about that, probably involves an interesting argument around decision theory and the anthropic principle.

<comment><USER13> I think the chance of being a Boltzmann brain is zero if you can write down "I'm human" on a bit of paper, paper in the room, go to another room and then return to the original room and read the paper saying exactly what you initially wrote. Whilst the memory of writing it may well be false, the paper will not be.

Now, a Boltzmann universe would cater for that - spooky thoughts at a distance :).

<comment><USER14> How about a Boltzmann simulation?

No physical anything at all, just organization of energy according to various rules that abstract a physical reality. A pure information based existence that depends on no ontological physicality.

<comment><USER15> This is interesting, but wouldn't 'organization of energy' be physical too?

<comment><USER13> I'm leaning towards looking at this akin to the Matrix, whilst your in the Matrix, if you have never been outside then reality and what is real is totally different from perspective. As nobody has proven they have been outside this Boltzmann Brain aka Matrix, nobody can disprove it. Very much like most religious icons you could say.

</comment></comment></comment></comment></comment></comment><comment><USER16> Most of the arguments in favor of the Boltzmann Brain are written before the discovery of the Hubble's law (1929) when most people thought that the universe was essentially eternal and static. Even Einstein was trying to use the cosmological constant to save the model of a eternal static universe.

After the discovery of the Hubble constant, the Big Bang and Inflation, it's more razonable a low entropy starting point.

<comment><USER17> > arguments in favor of the Boltzmann Brain are written before the discovery > of the Hubble's law (1929)

I'm pretty sure the Boltzmann brain paradox is 20th century, likely originating with John D. Barrow and Frank Tipler -- they discuss it in e.g. chapters 6 and 10 of their 1986 book on the anthropic cosmological principle, although afaict the actual words "Boltzmann['s] brain[s]" first popped up in the early 2000s.

Dyson, Kleban and Susskind (DKS 2002, [https://arxiv.org/abs/hep- th/0208013](https://arxiv.org/abs/hep-th/0208013)) is firmly after the widespread acceptance of the lines of evidence pretty much compelling an accelerated expansion of the universe, for example. Albrecht & Sorbo actually talk about brains and bodies and so forth in 2004 [https://arxiv.org/abs/hep- th/0405270v2](https://arxiv.org/abs/hep-th/0405270v2) : in section "C." they discuss some of the history of the paradox, briefly.

Without a finite age to the universe -- this comes from Lemaître in 1927, rather than Hubble in 1929 -- there is no particular reason to assume that there is a low entropy state in the past. A positive cosmological constant creates more empty space (all of which is very high entropy, because of the indistinguishability of subregions of any region of truly empty space) and thus demands a much lower entropy before the dark energy dominated era. It's the low entropy of the past that's the source of concerns about Boltzmann brains. And a hot big bang is even worse. How did the universe end up in such relatively low entropy? And it must be low entropy rather than a hot dense system in equilibrium, because otherwise one runs into the problem of _suppressing_ Boltzmann brains.

cf. Carroll's deck at [https://www.slideshare.net/seanmcarroll/the-origin-of- the-un...](https://www.slideshare.net/seanmcarroll/the-origin-of-the-universe- and-the-arrow-of-time) starting at or before slide 21. A second deck at [https://www.slideshare.net/seanmcarroll/what-we-dont-know- ab...](https://www.slideshare.net/seanmcarroll/what-we-dont-know-about-the- beginning-of-the-universe) starting at slide 5 is slightly more technical, with references at the bottoms of slides later in the deck. Suppressing an "entropy catastrophe" is very modern hard work for physical cosmologists!

> save the model of a eternal static universe

He didn't know the Raychaudhuri equations (1955, shortly after his death) or the focusing theorems they support, only the Jeans equations (1902), and was trying to suppress a collapse via Jeans mechanisms. Had he known about Raychaudhuri's expansion scalar, who knows where he would have went -- perhaps he might not have discarded his small _negative_ cosmological constant in the aftermath of evidence for the expanding universe, but rather might simply have accepted a small positive value as consistent with the evidence and theory, and we wouldn't have had to wait half a century to get it back in the minds of cosmologists. On the other hand, perhaps we would still have had to wait for the discovery of the _accelerated_ expansion to get to a small positive cosmological constant as a parsimonious explanation.

Finally, this is a really nice way to connect Raychaudhuri and the CC: [Ellis 2007] [https://www.ias.ac.in/article/fulltext/pram/069/01/0015-0022](https://www.ias.ac.in/article/fulltext/pram/069/01/0015-0022)

</comment></comment><comment><USER18> PBS Spacetime did a fun video on this: [https://www.youtube.com/watch?v=nhy4Z_32kQo](https://www.youtube.com/watch?v=nhy4Z_32kQo)

<comment><USER19> Excellent video. Thank you.

</comment></comment><comment><USER20> It's always seemed dubious to me that people try to make probabilistic statements about an event that we only have one sample of, and whose causes we can only speculate about

<comment><USER21> Exactly - probability (and by extension, statements such as "more likely") only make sense when we have a reference class of similar events for which we have iterated trials (frequentism), or iterated trials we can reasonably hypothesize about (hypothetical frequentism).

Statistics and probability was not designed for one-off events with specious reference classes. The more speculative the reference class, the more we should doubt any claim of "more likely".

In the case of the Boltzmann brain, given we have no evidence of this ever occurring thus far, we can at very least claim it does not have a clear reference class that we can identify empirically.

</comment></comment><comment><USER22> I found the argument that this was self-refuting fairly convincing.

If you're a boltzmann brain, then anything you think you know about anything is illusory and based on nothing at all, including the idea that you could be a bolzmann brain.

I think this also applies, although less convincingly, to most theories that the world is illusory or a simulation.

In any case, it doesn't matter because you'll stop existing momentarily.

<comment><USER23> I'd be careful assigning meaning depending on a relative time frame.

After all the Sun will swallow the earth in about 7 billion years. I like to think the things we do matter independent of that fact.

<comment><USER24> Sure, but you have causal effects in your general vicinity that will persist a little while, not least effects that come back to change the originating brain.

Boltzmann brains have no past and approximately no future _at all_.

<comment><USER23> Yes, but I experience meaning independently of those effects. I think that most people think those effects are what create the experience of meaning.

Boltzmann brains experience meaning too. Not that is does them any good in the way that it does for biological system.

It's not like we have a planet rich in meaning and then the sun swallows the earth and all that meaning retroactively disappears. It just exists in the past, not the future, and I think that is sufficient.

I always thought it was funny when people thought that the heat-death of the universe had moral implications. Like that killing someone means they never existed, or something.

<comment><USER15> I have maddeningly had this exact conversation with a friend, and I can't help but think there's something they're just not understanding about meaning.

I don't think this view is uncommon, and I think people get there because they're just not thinking straight, but I don't know what they feel is at stake that they have to hold onto, that gets 'lost' if you accept that meaning doesn't persist through time forever.

</comment></comment></comment></comment></comment><comment><USER25> A thread from 2016: [https://news.ycombinator.com/item?id=12152658](https://news.ycombinator.com/item?id=12152658)

2014: [https://news.ycombinator.com/item?id=6999074](https://news.ycombinator.com/item?id=6999074)

<comment><USER26> Someone should make a "List of repeating ideas that come up on Hacker News with every new HN Generation" post.

It would also be interesting to know how often a "New HN Generation" came in to being.

<comment><USER27> IMO, there's not a lot of repetition. It's just that certain individual posts get repeated over and over.

</comment></comment></comment><comment><USER28> There is a sci-fi book about scanning a human brain/conciusness to computer and testing wether it recognizes that the computer gets turned off between the tests. Hint; it doesn't as it does not change state. Based on this experiment one can create a machine, upload his mind then destroy the machine because there will eventually be somewhere sometime a state of the universe where the state of the machine will proceed a step. So you can make a simulated world in that computer and be anything in that world, even god.

Great mindfuck scifi, wish I could tell it's title but now it's clear the author read about this Boltzmann Brain theory...

<comment><USER29> Permutation City, perhaps?

[https://en.wikipedia.org/wiki/Permutation_City](https://en.wikipedia.org/wiki/Permutation_City)

<comment><USER28> That's the one! Thanks I'll re-read it :)

</comment></comment></comment><comment><USER30> [http://boltzmannburrito.com/](http://boltzmannburrito.com/)

</comment><comment><USER31> > Some cosmologists believe that a better understanding of the degrees of > freedom in the quantum vacuum of holographic string theory can solve the > Boltzmann brain problem.

All the evidence right now points that I am a Boltzmann Brain. It would be amazing for cosmologists to challenge this.

</comment><comment><USER32> This is one of my absolute favorite ideas/theories.

</comment><comment><USER33> Mandatory pointer to Isaac Arthur's collaboration on this, Part 1 [1] and 2 [2].

I too find this a fascinating thought experiment.

[1]: [https://www.youtube.com/watch?v=9UfQb_- XAuY](https://www.youtube.com/watch?v=9UfQb_-XAuY)

[2]: [https://www.youtube.com/watch?v=GrK9EaQRp2I](https://www.youtube.com/watch?v=GrK9EaQRp2I)

</comment><comment><USER34> This is an interesting topic. Although I don't have much knowledge in this area, randomly arranged atoms forming Boltzmann Brains and keep observing random bits handed out by universe doesn't seem all that likely to me.

My main reasoning is due to how we tend to classify the knowledge coming from the observed universe, and how logically stable it is.

Imagine this, you are Boltzmann Brain and track a randomly arranged consciousnesses. You sleep, go to work, eat, and sleep again as a human being.

Main problem is that this kind of existence is very stable for a Boltzman Brain, as in when you wake up you see yourself in the same universe (or at least a very similar one).

Now you have to ask why you are classifying these randomly arranged bits handed out by universe as a human life, but not as an alien one. Or why not you are imagining you are something supernatural like a god? Just shift the bits handed out by universe to you and next time you wake up, you will be a completely different being. It seems to me that this should be possible if you were a Boltzmann Brain and existence would be extremely chaotic.

It seems to me that there is more to existence and consciousness than just reading and classifying random bits handed out to you by universe. It seems to me that logical stability is extremely important for our kind of existence and I don't see how Boltzmann Brain theory would possibly keep the universe logically stable.

<comment><USER35> I think you're not fully understading the theory of the Boltzmann brain. A Boltzmann brain would not exist for any extended period of time. They only exist for an instant, they don't "track" any sort of existence or conciousness, they merely pop in to existence for an instant and then disappear the next.

Imagine your current mental state as a snapshot. By pure luck some atoms could arrange into the exact same state as your brain is right now. And for that moment, it would be you, it would have your full set of memories. It would be indistinguishable from your current existence.

And then the next moment it would cease to exist.

But there could be infinite many such brains popping in to existence and then disappearing at every instant, with every conceivable configuration of state/memories.

</comment></comment><comment><USER36> When it gets to seriously deep questions like this (possibly not such with this one because it's fairly abstract) I can't help but feel that we don't know enough about the universe to start pontificating.

We are still doing a lot of science (especially in the last 30 years) in our own solar system let alone understanding the whole universe.

</comment><comment><USER37> This is way too much thinking for a Friday ... call me a Boltzmann brain all you want, but I'm having beer!

<comment><USER38> Not if you're a Boltzmann brain.

</comment></comment><comment><USER39> This is about equally as ignorant, incorrect, and useless, as thinking infinite universes means all infinite possibilities will happen.

> Given enough time, every possible structure is formed via random fluctuation

NO. That is not what infinity means. I hate that this garbage made its way into anyone's lexicon.

<comment><USER40> Can you expand on that?

If a state is possible, isn't an infinite amount of permutations will form that state? Isn't that the definition of a non zero probability?

<comment><USER41> If you pick a real number at random, what's the probability it will be rational?

<comment><USER40> Not zero. I think the proper way to define it is "almost never" when infinite are involved: [https://en.wikipedia.org/wiki/Almost_surely](https://en.wikipedia.org/wiki/Almost_surely)

I'm not sure if that means it will for sure happen or not, if the draw happens an infinite amount of times.

<comment><USER42> In the standard measure theory formalization of probability, that outcome set does have measure exactly 0.

Perhaps we could use a variation on in which somehow supports some infinitesimal values, but if one wishes to keep both countable additivity and have the distribution be uniform in the sense of translation invariant, then we run into difficulties.

</comment></comment></comment></comment></comment><comment><USER43> [https://en.wikipedia.org/wiki/Ego_the_Living_Planet](https://en.wikipedia.org/wiki/Ego_the_Living_Planet)

</comment><comment><USER44> This inspires me even more to learn about boltzmann machines. The `why` lighting up the limbic brain

</comment><comment><USER45> If a Boltzmann Brain that begets more Boltzmann Brains is possible, it would be more likely, since as soon as you had one, you'd have a whole lot more.

Similar for other forms with this property. A form that when it does appear is then more likely to return again.

<comment><USER46> self replicators do, such as all living things

<comment><USER45> Sure do. They tend to get beaten up by random things and lose their form, but reforming soon enough helps keeps them around.

</comment></comment></comment><comment><USER47> Bad counting in the probabilities.

</comment><comment><USER48> There is no such thing as a Boltzmann Brain, the mere idea of it is ludicrous. Get over it already.</comment>


Parsing Mach-O files - <AUTHOR> http://lowlevelbits.org/parse-mach-o-files/ <comment><USER2> The author, and anyone else interested in exploring Mach-O files, might want to check out the otool command on Mac OS X. The otool source code is open source: [http://www.opensource.apple.com/source/cctools/cctools-870/o...](http://www.opensource.apple.com/source/cctools/cctools-870/otool/)

</comment><comment><USER3> someone made a mach-o lib for ruby: [https://github.com/woodruffw/ruby- macho](https://github.com/woodruffw/ruby-macho)

</comment><comment><USER4> You might dig this Alex:

[https://github.com/cebix/macemu/blob/master/BasiliskII/src/U...](https://github.com/cebix/macemu/blob/master/BasiliskII/src/Unix/Darwin/lowmem.c#L109)

</comment><comment><USER5> Many years ago, I wrote something about Universal Binaries - [http://hohle.net/scrap_post.php?post=197](http://hohle.net/scrap_post.php?post=197) . IIRC, they've remained relatively unchanged since NeXTSTEP and have always been available in OS X (and even used during the G3/G4/G5 era in Mac OS).

</comment><comment><USER6> Related: [https://github.com/shinh/maloader](https://github.com/shinh/maloader) is a loader for running mach-o files on Linux.</comment>


Liberland: Europe's Newly Formed Country to Use Bitcoin - <AUTHOR> http://bitcoinist.net/liberland-europes-newly-formed-country-use-bitcoin/

<comment><USER2> So, between Serbia and Croatia was proclaimed a new country speaking Czech!</comment>


The Green Nuclear Deal: Eliminate Fossil Fuels with Nuclear Power - <AUTHOR> https://twitter.com/subschneider/status/1096110191718879233 <comment><USER2> If this dude really worked in the nuclear industry then he would know a few things that are missing from this tweet thread:

1) There isn't enough uranium in the world to provide the baseload power in nuclear plants that's currently provided by coal.

2) There's nothing green about uranium mining or fuel processing.

3) There's no solution for high-level radioactive waste. Most of it sits in swimming pools at nuke plants because it has to be kept cool and we don't have a better solution.

4) Nuclear is fundamentally uneconomic and requires huge subsidies everywhere it's been used. Even with those subsidies, plant operators are backing away. The only nuke plant under construction in the US is facing cancellation and no one is signing up to build another. Several countries have announced a total phaseout of nuclear. So much for the "nuclear renaissance!"

5) Scaling up Navy ship reactors is exactly how we got to the BWR and PWR nuclear plants we have today. Nuclear plants have to be huge to supply the load that a city requires. Is he suggesting we just string together thousands of small reactors like they have on Navy ships?

6) Thorium, molten salt, and fusion reactors are "just around the corner," just like they've been for 50 years. If these technologies actually worked, we'd have them already. It's time to stop subsidizing the nuclear industry (which only came into existence because we needed nuke plants to make plutonium for bombs).</comment>


Cover Flow in JavaScript - <AUTHOR> http://finnrudolph.de/ImageFlow/Examples

<comment><USER2> One of the best javascript coverflow implementations I've seen. Very smooth, yet feature rich.

Then I saw the php dependency (just for the reflection if I understand it correctly). A bit of a bummer as reflections really make it sing. I don't know much CSS3 yet, but I wonder if that can help remove the php dependency.

Great work though.

<comment><USER3> PHP and CSS3 are as orthogonal as a pillow and a toaster.

<comment><USER2> Funny. But I meant, I wonder if CSS3 can do the _reflections_ instead of PHP, which looks possible...

<http://stuntsnippets.com/css3-reflection/>

<comment><USER3> If you demand both reflections and the browser support, you might as well port the PHP code to Ruby or whatever else you're using.

Or use CSS3 and not worry about IE: <http://www.webkit.org/blog/182/css- reflections/>

<comment><USER2> >Or use CSS3 and not worry about IE

Exactly, like I care about IE. Plus, a lot of my HTML work is in AIR or PhoneGap anyway...mostly webkit clients.

</comment></comment></comment></comment></comment><comment><USER4> The hardest part of Cover Flow is getting the side elements to mimic perspective, and that's still really hard to do in JS without resorting to Canvas.

<https://secure.wikimedia.org/wikipedia/en/wiki/Cover_Flow></comment>


Supercomputer passes turing test - <AUTHOR> http://www.engadget.com/2014/06/08/supercomputer-passes-turing-test/

<comment><USER2> It's very, very poor. Extensive discussions already here on HN:

[https://news.ycombinator.com/item?id=7864644](https://news.ycombinator.com/item?id=7864644)

[https://news.ycombinator.com/item?id=7864521](https://news.ycombinator.com/item?id=7864521)

There are more submissions, more sources for the story, search for them to find more.</comment>


BuzzFeed employees demand it pay out earned PTO to all laid-off U.S. staffers - <AUTHOR> https://techcrunch.com/2019/01/27/buzzfeed-employees-demand-it-pay-out-earned-pto-to-all-laid-off-u-s-staffers/ <comment><USER2> When I left AVG Technologies (now owned by Avast) I figured they would try to screw me on this. I copied a line out of the employee handbook, that I had to sign a receipt for and acknowledge I had read, that said "All accrued unused vacation will be paid out in full on an employees termination" sent that line to HR and asked them if they would pay my vacation if I left. They replied, you work in FL which does not legally require us to pay it so no. Anyways, I showed my direct supervisor the email from HR, worked two weeks then took three weeks off. When "I got back from vacation" I turned in my notice and walked out even though the handbook said a two week notice was required... because FL is a right to work state and you do not legally have to turn in a two week notice. We each enjoyed our own groups at AVG but "Corporate" was just evil.

<comment><USER3> Good for you. Too many people don't stand up for themselves in situations like these. My grandmother had more than 125 sick days built up when she retired after 40 years of teaching elementary school.

They told her that a recent change in policy would mean she would only be paid for a maximum of 30 of those days.

I told her that alone would be enough to make me sick to my stomach for about 125 days (pretty much an entire school year), after which I would be ready to retire.

Luckily she is at least aging gracefully and goes to the gym daily. She's been collecting that sweet defined benefit pension for 25 years and will probably get another 10 out of it at least.

<comment><USER4> Why should people be paid for sick days that they didn't use because they weren't sick? Otherwise what is the distinction between sick days and vacation days?

<comment><USER5> If the employer is applying a limit to how many you're allowed to take then they're acknowledging that they're really vacation days (that you can take at short notice). Otherwise there would be no limit, because it's not like you control how often you get sick.

<comment><USER6> No, but you can go on short-term (or long-term) disability at many companies. There's an unfortunate pooling of sick time/personal time/vacation time at many companies today. But, in the US, it used to be absolutely the norm to have separate PTO and sick days and you were only expected to use the sick days if you were sick. (And they typically didn't roll over.)

And, if you left for whatever reason, you were paid out your accrued PTO (which often had an accrual cap) but not sick time.

</comment></comment></comment></comment></comment><comment><USER7> I agree with the idea that all accrued PTO should be paid out, if the release of the employee was the decision of the company.

I also would like to add, that Buzzfeed did not simply throw these people out the door and into poverty, they did provide severance and benefits through April, which should be plenty of time to find another source of income (hopefully).

"BuzzFeed's laid-off employees received a severance of a minimum 10 weeks pay, and benefits through April. Taylor's response to the petition's organizers said the company wants to meet with staff to discuss the issue"

<comment><USER8> Pto is part of your compensation.

It goes on the books as a liability, which is why a lot of companies are doing 'unlimited vacation' now. (And why others don't want to roll vacation from one year to the next). If they don't owe you a certain amount of vacation, they don't have to pay it out when you quit.

But if they do owe it, they do have to pay you.

<comment><USER9> This is not the case in Utah. I started my career in California and left a previous job in Utah with weeks of PTO unused and was shocked to discover there was no legal requirement to pay me for that time.

<comment><USER10> This is why you check your employment contract or ask your HR department if they paid out PTO for previous people who left.

</comment></comment></comment></comment><comment> who-knows95 I'm a young male working in cyber security, but before this i was a trained cocktail barman/supervisor. this means i worked weekends, 12 hour shifts, holidays, whatever was needed to keep the bar running. (i felt super burned out, and i was only doing this 4 days a week)

now i work in a office, doing this cyber security work. i would never stay past 5:30, i'd never forgo PTO, or force myself to over work myself beyond respectable limits.

"This is paid time that employees accrued by choosing not to take vacation days, and instead do their work at BuzzFeed,"

when i read things like this it just strengthens my feelings towards it.

is this the right attitude?

<comment><USER11> > now i work in a office, doing this cyber security work. i would never stay > past 5:30, i'd never forgo PTO, or force myself to over work myself beyond > respectable limits.

> is this the right attitude?

being professional and setting boundaries is absolutely the right attitude. it's just a job.

<comment> who-knows95 thank you

</comment></comment></comment><comment><USER12> Fun story. I worked at a "trendy" SV startup. I was hired in a wave of employees around the start of the year. I took no PTO. Around the end of the year they announce they are moving to an unlimited PTO plan. No one got paid for unused PTO that year.

<comment><USER13> I don't care for unlimited PTO. Here's why:

When I accrue time off, you as the employer and I as the employee have a written contract on what that time is for, when it can be used, and why it can be used. It places parameters on my time, yes, but it also is an actual agreement between the two of us, in objective terms.

Whereas unlimited PTO sounds nice, it also opens up more problems between myself and workplace 'culture'. It's so subjective and down to personal opinion as to whether or not I'm abusing the system.

It just tastes bad. I've worked in both environments, and I much rather prefer the structured environment. There seems to be far less drama and nonsense related to taking time off.

<comment><USER14> Part of why I left my last job was due to its "unlimited PTO" policy feeling more like a "you don't -actually- have any days we really owe you so you'll catch shade every time you take time off" policy. I now work for a place where I have a set amount of PTO that accrues so I feel more entitled to using it without feeling bad about it because if I don't then it's gone.

Unlimited PTO is one of those things that sounds great to potential employees who have never experienced it. Until you get in and realize you end up taking way less time off than if you just had 15 set days or whatever.

<comment><USER15> > "you don't -actually- have any days we really owe you so you'll catch shade > every time you take time off"

That's the idea behind it. It's a huge red flag for me.

But it looks fantastic on paper. The problem is you don't know how you'll be judged if you do take the time off. They'll never come and say "hey it looks like you took 5 weeks off this year". They'll just say "it looks like you're not realizing your full potential". So it allows for a lot more sinister manipulation and control.

It could even be coming from peers, managers, HR it doesn't matter. "Gee, so and so in on vacation... while we are slaving here at 8pm at night. - Haha. Of course he is, eye roll..." kind of stuff. And maybe the employee was having a family crisis and needed to spend time with their loved ones but it's not something they'll broadcast but people will imply various things and assume not the very best of intentions.

If the company is so darn generous, just give everyone 6 weeks off and make everyone take it.

<comment><USER6> Yeah. I'm not opposed to the idea in principle. "Managing" my time off around business travel, projects on a deadline, etc. can be a real PITA. (And, to be clear, I've taken essentially my full earned vacation--or have been paid for unused time when I've left--through my entire career.)

But, IMO, any company with this policy needs to establish some guidelines and management from the top down needs to walk the walk to show that they really expect employees to take 4-6 weeks off (or whatever) and stay home if they're sick.

Otherwise, it's just about keeping liabilities off the books.

<comment><USER16> Manager at BigCo here, that's exactly what I do in my "welcome to the team/company" email. We call it "untracked", not "unlimited" vacation, and I make that distinction clear also.

<comment><USER6> Untracked is a MUCH better term (especially paired with some general guidelines). Thank you for that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> As a European every time I read articles like this and the comments that go with it it makes me happy that I never moved to the states. In my last job I had a basic of 25 days PTO + public holidays + whatever days I carried over from the previous year. If I had to work a public holiday I'd get two days PTO in lieu. Reached the point that my allowance for my last two years before I left was 35 days per annum. I'm contracting for the last three years and just take the days(unpaid) I want , I just can't imaging living under the American system.

<comment><USER18> That's worse than what I receive as an American. Sorry to shatter your world view!

<comment><AUTHOR> You are an extreme outlier. American workers have on average nearly half as many vacation days as are legally mandated in the EU,[1] while EU member states have more public holidays than the United States.

[1] [https://en.m.wikipedia.org/wiki/List_of_minimum_annual_leave...](https://en.m.wikipedia.org/wiki/List_of_minimum_annual_leave_by_country)

</comment></comment></comment><comment><USER15> Surprised this isn't illegal in most states. Good on California for having the law.

And of course, if you do take PTO that you haven't accrued yet for the year, and then leave, companies will claw it back, that's legal and "fair" but paying it out if you don't take it and have some left somehow never managed to becomes a law.

It's also disappointing that this comes from BuzzFeed. One would expect this from some fast food restaurant chain and BuzzFeed would be at the forefront, doing a lot more for its employees.

</comment><comment><USER19> This hits close to home as I'm currently in the process of revamping our handbook and one thing I've fought for for some time is the ability to be paid out or "take" PTO if you leave the company on good terms (ie. 2 weeks notices, you aren't on a PIP, etc). My main arguments is our PTO is accrued (not front loaded) and I feel it is part of my compensation package and I am owed it. The run-around I've gotten in the past is PTO is a benefit not compensation (I honestly don't see a difference) and it would cost the company too much to pay out PTO.

My thoughts are this should be treated like 401K contributions where the company HAS to set aside the full amount of money even if the employee isn't fully vested (they get it back if they leave before fully vesting). Also, in my mind, this is easily solvable with just continuing to pay the employee for the duration of their PTO when they leave. That way it's not an increase, it's just the status quo. It would be the same as taking all your vacation then coming back and putting in your 2 weeks (or just leaving).

Would love to know any arguments you all have or have made regarding this situation.

<comment><USER20> From the employee's side, there's too much risk and uncertainty around PTO when leaving a job. It's easier to just take a vacation before putting in your notice than to haggle with your employer after the fact, when you have no leverage. This is especially true with companies that offer "unlimited vacation" in which PTO does not accrue.

</comment></comment><comment><USER21> Every time I see a company go belly up and the employees get screwed I wonder why there's not protection for this.

IMHO regular employees should be treated as creditors of first priority for unpaid wages/salary, PTO and any IRA/401k benefits. This should probably include COBRA health insurance for some period of time (this may already be covered?).

This means paying regular employees should come ahead of repaying investors, banks, bondholders, etc. And this should be mandated by law.

Likewise unused PTO should be paid out for all employees who leave a job.

<comment><USER22> In almost any case, employees who have unpaid wage claims are treated as secured creditors. I'm not sure what you mean by IRA/401k benefits as these are usually employer administered but held by the employee and should be shielded from any sort of bankruptcy. As mentioned earlier here, PTO is treated differently state by state. Most of what you have a gripe with is already covered by existing bankruptcy law.

Sure, if there's no recovery value in a bankruptcy, employees aren't going to get paid back wages but no one else is getting paid either.

</comment></comment><comment><USER23> Am I missing something? I thought it was _illegal_ to not pay out accrued PTO. (If it isn't, it certainly should be.)

<comment><USER24> Can't wait to get my unlimited PTO paid out!

<comment><USER25> One of the reasons why "unlimited PTO" is a bit of a scam.

<comment><USER26> Never been in this situation but couldn't you just take off a few months with unlimited vacation or even a few years.

<comment><USER27> You are pretty much guaranteed to get let go if you tried to do this without having a very good reason and a very understanding boss. Even though it is called "unlimited" that doesn't mean you actually get to take unlimited vacation.

<comment><USER28> So, it's like "unlimited" Internet data plans.

</comment></comment></comment></comment></comment></comment><comment><USER29> As an aside, why does a meme site have so many employees? I know a few entrepreneurs who run Buzzfeed clones and they run on a skeletal staff of freelancers.

I know that the news division needs dedicated journalists, but the main site is basically rehashing existing content. Surely you don't need 2,000 employees for that.

<comment><USER30> BuzzFeed does two things: they're a meme site with actual, serious investigative journalism sharing the same brand.

<comment><USER31> So are they just a serious journalistic website now they have fired their opinions section?

</comment></comment></comment><comment><USER32> previously (16 hours ago): [https://news.ycombinator.com/item?id=19014373](https://news.ycombinator.com/item?id=19014373)

<comment><USER33> It's interesting to see the difference in attitudes/voting patterns on this thread than the previous thread.

</comment></comment><comment><USER33> This article contains the BuzzFeed CEO, Jonah Peretti's response which wasn't available yesterday. He's also discussing it a bit on Twitter: [https://twitter.com/peretti/status/1089914253857894401](https://twitter.com/peretti/status/1089914253857894401)

Additionally, the layoffs are not done yet. :(

<comment><USER34> CEO:

> I can't really have this discussion in public, can't share all relevant > information on twitter, but I look forward to being very open-minded and > transparent with the staff council in our upcoming meeting

Seems... dishonest. What precisely prevents him from having it in public besides his desire not to?

<comment><USER35> There are always potential legal issue with layoffs. It seems reckless to have that kind of discussion in public.

I don't see that as dishonest (really, how is it?), I see that as being cautious.

<comment><USER34> Can't vs won't. He's making a choice, which is probably the wiser decision, but by saying "can't" he's offloading the responsibility of the choice.

</comment></comment></comment></comment><comment><USER36> They buried the lede: Buzzfeed is paying 10 weeks benefits and salary instead.

They'd probably save a lot more if they had paid for PTO and only PTO.

</comment><comment><USER37> Isn't the amount of severance a company like Buzzfeed decides to give out completely arbitrary? I don't know if there's stats by industry but 10 weeks seems above average. E.g. they could've paid out PTO but given only a month of severance (4 weeks) instead of 10 and most employees would be better off with current situation than the former?

<comment><USER22> In a lot of WARN notice cases, severance mysteriously lines up with the 60 day notice requirement. Draw your own conclusions from that. This is above but not such a crazy amount to be considered generous.

</comment></comment><comment><USER38> My plan, the next time someone offers me a role with unlimited PTO, is to tell HR and management before I join that I plan on taking four weeks vacation due to needing to see family overseas. If someone whines later, they were warned.

</comment><comment><USER39> Perhaps the worst hypocrisy is that the publication promotes on a daily basis their own version of 'social equality and justice' etc. which they themselves don't bother to live up to? Funny that.

</comment><comment><USER40> Hrm, you would think companies should be legally required to have a separate pool of cash for unused PTO, and transfer $$$ to their cash book as employees use them... I'm sure some already do this.

</comment><comment><USER41> Maybe instead of lobbying the company we should lobby to change the law...

</comment><comment><USER42> It's still a mystery why they didn't unionize when they had the opportunity. They believed Jonah would look out for their interests more than they themselves could?

</comment><comment><USER43> so, everyone who is left at BuzzFeed will use all of their accrued PTO as quickly as possible?

<comment><USER44> My recommendation is to use it all up and quit the day you come back with no notice.

<comment><USER45> If you quit you don't get unemployment; better to get layed off in that case.

</comment></comment></comment><comment><USER46> Add PTO protection to the long list of California wins.

<comment><USER47> High taxes and widespread homelessness caused by a housing crisis. Nowhere is perfect.

</comment></comment><comment><USER48> this practice is legal? Isn't that part of the earned benefits?

</comment><comment><USER49> I am consistently told that unions used to be a good thing, but are completely unnecessary, now that they have fought for, and won all the important employee rights.

And now I read that in 45 US states, companies don't have to pay what they owe you in vacation time, when you get laid off.

</comment><comment><USER50> This is misleading. All employees got 2.5 months of salary. Do you want your 2-3 weeks of PTO or would rather take 10 weeks of paid leave? Legit fake news.

<comment><USER51> Except employees in California got both

<comment><USER52> Because California employment law requires paying out PTO.

Employees outside of California who want the benefits of California law should lobby their State government to adopt similar rules.

</comment></comment></comment><comment><USER53> You would not normally be paid for accumulated vacation time so I'm not sure why they're asking for this other than they have enough combined social media presence to make management capitulate.

<comment><USER54> Every job I've had has paid accrued PTO/Vacation when being let go or even leaving on your own will.

<comment><USER55> Every job I've had does not pay accrued PTO no matter how you left the company. Most states do not require companies to pay out accrued PTO.

<comment><USER26> In Canada you pay 4% towards your vacation each year so it is paid at the end regardless.

<comment><USER56> Can you explain how this works? What do you mean you pay 4% towards your vacation? Like the employee contributes 4% of each paycheck to some sort of escrow account?

<comment><USER57> The employer pays it for both part and full-time workers. The rates differ by province, but generally this works out two weeks of wages for the first few years with an employer - they can increase this if they want but that's the legal minimum.

In practice this just means that you can take two weeks and still get paid. You can forgo your vacation in some instances, but you still get paid out the vacation money. I used to do that when I worked part-time in college and was short of cash for whatever reason.

Ontario's rules - [https://www.ontario.ca/document/your-guide-employment- standa...](https://www.ontario.ca/document/your-guide-employment-standards- act/vacation)</comment></comment></comment></comment></comment></comment>


A thing that never was: ringback tones - <AUTHOR> http://www.rioleo.org/the-thing-that-never-was-ringback-tones.php

<comment><USER2> I remember ringbacks something like this;

One day several years ago I noticed the number of calls I was getting was going down. Then one day a friend texted me asking what was wrong with my phone, I asked what he meant and he said it had stopped ringing when ever he called me and all it did was play music now. He was rather confused, and I was just as confused but skeptical too, I requested no change in service. I asked him to come over to demonstrate and sure enough there was a song that would play whenever someone called me. I figure most people thought that meant some kind of error and hung up, most of the time before it hit my phone.

I called my carrier and angrily complained and the poor woman tried to pass this off as a service, but I was having none of it. I demanded that they disable it immediately and I apologized to friends and family who were confused by it. Nearly switched carriers over it as well, this is preposterous IMO and was executed with very little forethought.

Shortly afterwards, ringbacks disappeared entirely and I was all the happier for it. I get the sense there are multiple lessons to take from that anecdote.

</comment><comment><USER3> Technically speaking, it's only on SS7 networks where this is a problem to implement. It's basically just playing an arbitrary media file, which is trivial in VoIP.

The interesting thing is that the original SS7 code did not have an arbitrary case programmed for the ring back tone; that is to say the original network infrastructure did not support on-demand changes to ring backs or to pull an arbitrary media file at the time of call. The solution was a box intermediating the call to stream musical media before connecting to the actual intended voice call media.

Telecom, why do stuff in softwhere when you can just add another box?

<comment><USER4> If I were designing that system that's what I would have done.

I can't think of an actual _need_ for that ability, only the fact it could be used for novelty, abused to annoy people, or just flat out cause problems (i.e. what if my ringback tone is a busy signal?)

<comment><USER5> It's used as a cheap way to implement a school closing hotline where people all call to receive the same message.

<comment><USER4> You came up with something, I'm impressed. I don't think that would be the best way to implement that but it's a sane idea and one more than I had.

Edit: after reading more in the thread, I see you actually ENCOUNTERED this. Why do it this way? Would it somehow be cheaper because you don't have to 'answer' the calls and hold the lines open?

<comment><USER6> It really boils down to money. When the call connects, _somebody_ gets charged. Perhaps both of you do -- you lose a minute on your cellphone bill, and the school gets charged a minute for the phone call.

Putting the school notice in the RBT space eliminates this charge and essentially makes the entire transaction "free."

Lots of big companies use this for the first step in their automated attendants. Since DTMF (phone number signals) are transmitted during the ringback tone (but voice is not), they can put the first step of their attendant in the RBT space. This saves them the money if you never get any further, or decide to hang up soon after.

<comment><USER3> The settlement agreements for calls are pretty straightforward (Sending party pays). Consumers are also billed for service, but behind the scenes there's a wholesale market where traffic imbalances are valuable (this is also a core issue with Net Neutrality; consider that at peak Netflix is 35% of global bandwidth which is mostly delivered by one provider: cogent).

There's a whole different discussion around signaling and abusing both headers and early media transfers to avoid billing. It's still very largely the wild west, IMHO.

<comment><USER6> Truthfully, regarding call connect charges, ringback, per-minute fees, etc... I don't think many folks think much about the fact that a lot of the business and billing decisions driving modern telecom policy are still rooted in the same thought patterns they were in the 1950s. It drives the net neutrality debates, it drives shareholder profit expectations, everything.

And I agree - it's absolutely the wild west. After 70 years of doing it one way, we're starting to see a tipping point of new realtime infrastructures and technologies. Unfortunately, I think it's likely to become even more wild as the "silo-ification of communication" trend continues. Boo.

Don't get me started on credit card processing fees. ;)

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I found out about ring-back tones by accident when I was trying to use Twilio to write an app to call an automated snow closing hotline record the message and then tweet if there was a closing. When ever I called with twilio the call _always_ failed and after contacting twilio support and they couldn't figure out what was going on either I just sort of put it on the back burner for a while. Then the next winter season rolled around again and a bunch of co- workers were complaining about how they couldn't call the snow closing hotline from their Google Voice enabled phones. Someone who worked with the people who had implemented the system went to ask how it worked and discovered it used a ring-back tone to play the message. At this point I realized why Twilio always thought the call failed since you can't start scripting a call in Twilio until it is actually answered.

</comment><comment><USER7> I live in Indonesia and I can vouch that ring-back-tones are not just alive but also remain very profitable.

When you call a person with a RBT there is first a message saying "If you want this tone for 10cents please press 7", then the music starts, usually the latest chart-song.

Needless to say it has a solid customer base made up mostly of teens, but also of corporates with a company jingo as the RBT (I kid you not).

Im not sure if the big chat apps (will dominate VoiP) have this function built in yet but Id imagine they will at some stage, a nice VAS if you can charge for it..

<comment><USER8> I'm pretty sure this was incredibly popular in China around 2005. Pick your favourite artists song and pay for it with existing phone credit. Then force your family and friends to listen each time they call...

</comment></comment><comment><USER6> The U.S. market for straight ringback tones was really hampered by lack of competent marketing, poor (and as josh2600 said: annoyingly over-complicated, Telecom-mentality driven) implementation, and a complete lack of inter-carrier cooperation in the VAS space. Too bad - like Indonesia, it's quite huge in Latin America and many other parts of the world.

Ring Plus is still working with that technology - but now does a lot with _reverse_ ringback tones; rbts based on what you want/prefer to hear, not what the person you're calling wants you to hear. It's now a mobile phone MVNO in the U.S using reverse RBTs to deliver a Spotify/Rdio/Pandora-style radio feed that goes towards subsidizing or eliminating your phone bill.

</comment><comment><USER9> This was huge in New Zealand for a while in the mid 2000s - I have no idea how you'd sign up for it nowadays, but sometimes I'll call somebody and still hear a tinny rendition of I Believe In A Thing Called Love before they pick up.

</comment><comment><USER10> Yeah, if I called someone and heard an ad, I would _never ever_ call that person again. I don't need anymore ads in my life, thanks.

</comment><comment><USER11> these are huge in China</comment>


Ask HN: Why you look for a job? - <AUTHOR> Hi HN,
After graduating, we start looking for a job. Why do you not create a job, innovate, or invent something new?
What is missing? <comment><USER2> The Industrial Age happened. Dept of Education taught us to goto school, get a job and work for 40 hours for 40/50/60 years. They dont teach entrepreneurship for a reason. They want us working, not creating assets etc.

</comment><comment> temp-dude-87844 Savings.</comment>


A PowerShell script for helping to find vulnerable settings in AD Group Policy - <AUTHOR> https://github.com/l0ss/Grouper <comment><AUTHOR> [https://www.reddit.com/r/netsec/comments/8dr0rl/grouper_a_po...](https://www.reddit.com/r/netsec/comments/8dr0rl/grouper_a_powershell_script_to_find_vulnerable/)</comment>


DNS Marketshare - Alexa 10,000 + Fortune 500 - <AUTHOR> http://blog.cloudharmony.com/2013/04/dns-marketshare-alexa-10000-fortune-500.html

<comment><AUTHOR> At the bottom of the post - ycombinator.com switched from easyDNS to CloudFlare during the past 30 days</comment>


Tor 0day: Stopping Tor Connections - <AUTHOR> https://www.hackerfactor.com/blog/index.php?/archives/888-Tor-0day-Stopping-Tor-Connections.html <comment><USER2> Both of these vulnerabilities are bogus.

1\. "using JavaScript, you can identify the scrollbar width [...] so an attacker can identify the underlying operating system"

Using JavaScript, you can simply _ask_ Tor Browser what platform it's on using navigator.userAgent, and it will tell you the truth because lying breaks e.g. websites' custom key combinations. Tor Browser will however attempt to anonymize the platform in passive indicators, i.e. HTTP User-Agent: [https://blog.torproject.org/new-release-tor- browser-801](https://blog.torproject.org/new-release-tor-browser-801) (search for "User Agent")

(EDIT) This was too dismissive, because scrollbar width differences are more fine-grained than platform differences: [https://bugzilla.mozilla.org/show_bug.cgi?id=1397996#c5](https://bugzilla.mozilla.org/show_bug.cgi?id=1397996#c5)

2\. Blocking entry node connections:

"Checking every network connection against every possible Tor node takes time. This is fine if you have a slow network or low traffic volume, but it doesn't scale well for high-volume networks."

If you can muck around in TLS cert fields in real time, you can look up an IP address in a hash table...

"Second, the list of nodes changes often. This creates a race condition, where there may be a new Tor node that is seen by Tor users but isn't in your block list yet."

Oh no! (clutches pearls)

Not to say that it isn't worthwhile to tidy up the TLS fields some more, but hyping this as a zeroday is absurd.

<comment><USER3> I'd definetely consider Tor Node Fingerprinting (2nd issue) to be an important issue. Nonetheless, both issues have been _accepted_ as those by Tor Maintainers, yet they failed to act appropriately.

<comment><USER4> > I'd definetely consider Tor Node Fingerprinting (2nd issue) to be an > important issue.

Why? If someone knows I'm running TOR, I guess that's not great, but I don't really see the issue.

<comment><USER5> Is it going to get you in trouble if anybody finds out?

</comment></comment></comment></comment><comment><USER6> I can't see how this is a "0day".

This post talks about how you can identify a running Tor when you connect to the (operator-assigned, public) relay port. You can only "see" these TLS certificate details when you are connecting to the relay yourself. This means this does not allow network operators to detect traffic going to Tor nodes, or in-between nodes, let alone identify users or deanonymize anyone: To external observers, such traffic looks like typical browser TLS traffic.

So, what this does is allow you to identify Tor nodes, which is by definition not a problem for all Tor relays except bridges, which should not be as easily discoverable by a network scan. The problem has been known before, and work as been done so you can now run a Tor bridge without this problem. As this problem has been publicly discussed and outlined in the very first design documents, it cannot be called a "0day", even if it was more problematic than it actually is.

Tor came up with the concept of "pluggable transports" to address this very successfully, which allows clients and entry bridges to basically make Tor traffic look like anything you want.

<comment><USER7> Security is in the eye of the application. Unauthenticated editing isn't an exploit on Wikipedia but it would be on the CDC's website

In this case the fact that a user is using tor is considered protected information meaning any exposure of that is in fact a info leak vulnerability

<comment><USER6> The "fact that a user is using Tor" is not discussed in the post. There is zero connection between how Tor nodes generate their TLS certificates and whether or not you can detect that a user is using Tor. All you can do with this information (which is not a secret but a well-discussed tradeoff with no better option) is to identify Tor relays, which are already public.

</comment></comment></comment><comment><USER8> The author of this blog strongly comes across as a person who understands a good deal about finding vulnerabilities, but doesn't really understand the tradeoffs being made in maintaining _usable_ anonymity software such as the Tor browser.

The reported scroll bar width vulnerability is his strongest case. He rightly got a bounty for it. But it's relatively hard to fix, and until recently, the Tor browser also just leaked your window size via Javascript. But they're getting there, slowly.

However, the story about public bridge certificates is pretty unjustified. The response he got from the Tor Project is completely clear, and his proposed solution in trying to impersonate traditional PKI simply won't work against even mediocre attackers. Furthermore, bridge enumeration as a systemic attack might be a problem against censorship systems, but can't rightly be called a '0day'. Private bridges ([https://bridges.torproject.org](https://bridges.torproject.org)) also solve a lot of the problem.

In the linked ticket, you clearly see that they are trying pretty hard to find a sponsor willing to fund the solution.

<comment><USER9> > and until recently, the Tor browser also just leaked your window size via > Javascript.

Though this was why Tor would always open in the same window size. But ya, that all fell apart if you maximized.

When did they fix "the leak" itself? Wouldn't that require intercepting the JavaScript call in the same way that the scroll bar size issue could be fixed?

<comment><USER10> I believe they implemented panels inside the browser window that force the window size to be different reported values.

<comment><USER11> It's called "letterboxing", and rounds the window size to the nearest 200x100 px when maximized, I think. So while it does make you slightly less unique than just maximizing normally would, that anonymity set is still potentially smaller than the set that can fit everyone, namely the 1000x1000 default. There are methods of detecting screen resolution using CSS that don't require JavaScript, so blocking JavaScript doesn't necessarily protect you from this fingerprinting method.

<comment><USER9> Fascinating to realize that CSS can do that. I guess it does it by "calling" x.png 1024 times and y.png 768 times? Or running some loop to call 1024x.png and 768y.png...

<comment><USER12> No loop necessary, maybe just a set of @media rules with e.g. custom .png resources: [https://developer.mozilla.org/en- US/docs/Web/CSS/@media](https://developer.mozilla.org/en- US/docs/Web/CSS/@media)

</comment></comment></comment></comment></comment></comment><comment><USER13> > The bug is simple enough: using JavaScript, you can identify the scrollbar > width.

I thought it was accepted and strongly emphasized that running JavaScript in a Tor environment was insecure and could leak information in all sorts of ways, which is why Tor Browser came with NoScript enabled by default.

Is that no longer the case? Is there now an expectation that you should be able to safely run JS in Tor Browser without risk?

<comment><USER2> [https://2019.www.torproject.org/docs/faq.html.en#TBBJavaScri...](https://2019.www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled)

<comment><USER14> I don't understand this bit:

> But there's a third issue: websites can easily determine whether you have > allowed JavaScript for them, and if you disable JavaScript by default but > then allow a few websites to run scripts (the way most people use NoScript), > then your choice of whitelisted websites acts as a sort of cookie that makes > you recognizable (and distinguishable), thus harming your anonymity.

How would this work exactly? And if it did work, wouldn't it at the very worst only work on sites for which you had enabled JS? I.e. sites that you had already essentially conceded your anonymity on by choice?

I don't see this as a worthy argument for enabling JS by default and destroying users' anonymity without custom configuration.

<comment><USER15> You just let the javascript send a heartbeat ping. If you don't receive the ping but served the page you can determine that the user agent did not execute the javascript.

<comment><USER16> Sure, but the comment mentions that you would use the 'set of websites that are whitelisted' as an identifier... your method can only check the site you are currently on, it doesn't give you information on if other websites have been whitelisted or not.

<comment><USER2> AFAIK NoScript whitelists don't respect first-party isolation (so a JS-enabled website can be included in a JS-disabled website), which makes it a relatively simple coordination problem between website A and B (possibly automated by a third-party tracker included in both A and B).

In any case, first-party isolation can be subverted: [https://news.ycombinator.com/item?id=17947605](https://news.ycombinator.com/item?id=17947605)

<comment><USER16> Yes, with coordination it is possible. I was thinking of the non-coordination issue.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> >Checking every network connection against every possible Tor node takes time. This is fine if you have a slow network or low traffic volume, but it doesn't scale well for high-volume networks

What? I can't tell if this is sarcastic or not. There's only around 3000 tor entry nodes[1]. This is orders of magnitude smaller than the number of entries in the internet routing table, which is around 800k. This means at the worst case, if you're an ISP, you can block tor nodes at the router level with virtually zero impact.

[1] [https://onionoo.torproject.org/details?search=flag:Guard%20r...](https://onionoo.torproject.org/details?search=flag:Guard%20running:true)

<comment><USER18> It's no problem, he has some regexs you can put in your DPI system to catch the connections instead. Regex is cheap right? Especially when it is long and complex.

</comment></comment><comment><USER19> > "After a lot of back-and-forth technical discussions, the Tor Project's > representative wrote, "I'm a bit lost with all this info in this ticket. I > feel like lots of the discussion here is fruitful but they are more > brainstormy and researchy and less fitting to a bug bounty ticket." They > concluded with: "Is there a particular bug you want to submit for bug > bounty?" In my opinion, describing a vulnerability and mitigation options is > not "brainstormy and researchy". To me, it sounds like they were either not > competent enough to fix the bug, or they were not interested. In any case, > they were just wasting time."

This plus the other descriptions/responses from the project in his post makes me think the project has attracted a lot of people that aren't programmers or can't actually do the valuable work of fixing the thing (though I'd be interested in seeing the specific ticket).

I'd guess that projects like Tor that interest people outside of strict programmer types have this as a bigger issue.

The result is you end up with a lot of people filing tickets and writing emails, but very few actually doing work to fix things because they don't know how. The few that could figure it out, are probably over extended. Having non- programmers interested in helping isn't necessarily a bad thing since good support people help make it easier to fix issues, but it can become bad if support people bias to closing issues because they can't fix them and closing them becomes the goal.

Tor does have some obfuscation proxies (called pluggable transports) to try and disguise the traffic to make it harder to block (there were videos a few years ago when I looked into how Tor worked that talked about this, the traffic is disguised as VOIP among other things). I know China blocks Tor by blocking all the bridge nodes it can find (both public and private) and by using the tricks he describes to slow or stop identified traffic. I think the head of the project cares about these issues.

Not an easy problem to fix, they probably need more programmers. Maybe a direct focus on these issues would help, but it could be they're focused on problems of similar or worse severity (hard to know).

<comment><USER20> I think the author's problem is that he finds vulnerabilities thinking outside the box. Traditionaly vulnerabilities exist when you can inject payloads, get access to somewhere you don't have access to.

His points are valid, and these are vulnerabilities. However they seem like feature requests, rather than being focused on a technical vulnerability (for example use after free).

</comment></comment><comment><USER21> I'm sorry but to call these minor issues 'zero day vulnerabilities' is a bit rich.

I'll wait and see if there are any real vulnerabilities in the queue.

</comment><comment><USER22> As a person who has, over the years, been recommending Tor and defending it against people claiming it's backdoored and useless, I'm disappointed. Can anybody here on HN give information on how some Tor alternatives and projects with similar goals are holding up?

<comment><USER23> I'm not sure there is a good alternative. Most of the alternatives are built with Java, which (considering tor isn't considered safe with Java enabled) doesn't seem like an improvement.

Is there an alternative that's performant and built with a decent language? Or do the good ones just get snuffed out?

<comment><USER24> Java is not the same thing as JavaScript

<comment><USER25> People always say I'm being pedantic when I point that out, but I think it's a really important distinction to make to someone who's not aware, especially in the context of their security.

<comment> yjftsjthsd-h There's a line about pedantic meaning "you're right but I don't like it", but Java vs JS isn't even close! They're both OO programming languages in the C-like family with garbage collection, but they have _completely_ different execution models, runtimes, usecases, and implementations; their close naming is a bug.

</comment></comment></comment></comment></comment><comment><USER26> Browsing over Tor, I cannot read the article. Instead the entire page source is:

      Banned

...

<comment><USER27> I believe they are demonstrating one of their 0days. Easily identifying tor traffic based on the packet.

      0Day #1: Blocking Tor Connections the Smart Way

      There are two problems with the "block them all" approach. First, there are thousands of Tor nodes. Checking every network connection against every possible Tor node takes time. This is fine if you have a slow network or low traffic volume, but it doesn't scale well for high-volume networks. Second, the list of nodes changes often. This creates a race condition, where there may be a new Tor node that is seen by Tor users but isn't in your block list yet.

      However, what if there was a distinct packet signature provided by every Tor node that can be used to detect a Tor network connection? Then you could set the filter to look for the signature and stop all Tor connections. As it turns out, this packet signature is not theoretical.

<comment><USER28> The packet signature thing is maybe sort of interesting, but it's not hard to block Tor exit nodes; Tor themselves makes this easy:

        #!/bin/bash
        addresses=$(curl -s https://check.torproject.org/torbulkexitlist?ip=<your-server's-ip> | sed '/^#/d')

        if [ -n "$addresses" ]; then
            /sbin/ipset flush tor
            echo "$addresses" | while read address; do
                /sbin/ipset -q -A tor "$address"
            done
        fi

Add that to a cron job and your form abuse traffic falls off a cliff.

<comment><USER29> If you feel it necessary to block Tor nodes in some way, I think it's better to only block non-safe methods.

Personally, I don't do it, but I understand why it's appealing. I see it as a personal decision (its your website after all) and not morally wrong as some see it.

I once talked to someone working security for a Canadian government agency. They considered it against their charter and/or illegal to block tor nodes, because it could be blocking legitimate access for Canadian citizens potentially in distress, much to the chagrin of their downstream customers (other agencies). I thought that was pretty interesting.

<comment><USER30> I think there are also some Canadian court cases protecting the right to speak anonymously over the internet. It's an area where I think our government is going a pretty decent job (as governments interacting with new fangled technologies go)

<comment><USER29> Yeah, I don't remember the exact reason they didn't consider it a possibility, but I seem to remember the guy saying it would save him a headache but it wasn't in the cards and that they had to explicitly configure some solution they were using (perhaps cloudflare?) to not DoS the traffic.

</comment></comment></comment></comment></comment></comment><comment><USER4> > (Many users think that Tor makes them anonymous. But Tor users can be > tracked online; they are not anonymous.)

Being tracked and anonymous feel like two distinct issues. If you were to only see a hash of my username, you could track me, but you couldn't identify me with it. Definitely something you'd want TOR to stop, but I think that's pretty important.

The other vulnerability is that websites can identify that a user is using TOR. My understanding is that this has always been fairly trivial?

It feels like the real 'story' here is that the TOR project hasn't been grooming their bug bounty program, and so there may be more serious bugs lurking.

<comment><USER31> Suppose you visit facebook via tor and log in. If you can be traced across the web, then your real name can now be attached to all your activity.

<comment><USER17> >If you can be traced across the web, then your real name can now be attached to all your activity.

But that's not how tor works. It's not like a VPN where all your traffic comes out of one node. So if even if you logged into facebook using tor browser, it won't be able to correlate your other tor browsing activities. Even third party cookies won't work because tor browser has third party isolation enabled.

<comment><USER32> _> >If you can be traced across the web, then your real name can now be attached to all your activity._

 _> But that's not how tor works. It's not like a VPN where all your traffic comes out of one node. So if even if you logged into facebook using tor browser, it won't be able to correlate your other tor browsing activities. Even third party cookies won't work because tor browser has third party isolation enabled._

Except that the OP discussed a technique that exposed an attribute of the user's setup that (when combined with other such techniques) allows unique (albeit pseudonymous) identification of the user across requests and sessions (this is called fingerprinting). Add in correlation of the pseud identifier with a real-world identity via use of FB, and the user would be _totally_ hosed.

</comment></comment></comment></comment><comment><USER33> Sorry, this seems bogus. There are a lot of ways to block Tor connections, and Tor doesn't try to make it particularly hard to identify ordinary entry nodes. That's what bridge nodes are for, if you need it.

</comment><comment><USER34> Bugs and 0days aside, is not the writer's main issue here a communication problem with the Tor project?

</comment><comment><USER35> I don't know why the Tor browser allows JavaScript to be enabled by default to begin with.

I don't allow JavaScript to run on my mobile browser because of the disturbing crash logs in WebKit in the few times I have enabled JS.

</comment><comment><USER36> Could someone in the know inform me as to whether or not my knee jerk reaction of "couldn't this individual possibly contribute to the Tor project instead?" is warranted?

<comment><USER37> They are contributing to the Tor project by sending detailed vulnerability reports. As for demanding that they fix/upstream changes themselves, then yes, that's likely too big of an ask, as even these reports are a gift. Tor has paid employees. "PRs welcome, wontfix" is not acceptable for security vulnerabilities in a security product.

<comment><USER38> To add to this, when reporting bugs (security or otherwise) I regularly feel like it's not worth my time to fix them because it takes me 2 hours to try to get the code to compile in the first place, sometimes you need to sign legalese to be allowed to help them, then I still need to figure out what the project's structure is and decide on how to best fix it (perhaps discuss it with the maintainer(s)), and then I haven't even started writing code yet. Meanwhile, I know that when maintaining my own software, it takes me 30 seconds to open up the project and I'll be literally 5 times faster working on a fix with all the context that is in my head and usually don't need to consult with others.

It's like if you kept trying to fix other people's cars when you know only the principles of a combustion engine, own an electric motorcycle yourself, and those cars would be very different from each other: I'd much rather someone does it who actually knows what they're doing, it would save all parties a lot of trouble. Diagnosing problems very specifically should already help them a lot of the time they would otherwise have to put in.

<comment><USER14> > it takes me 2 hours to try to get the code to compile in the first place

And then the tests won't pass on master!

<comment><USER38> Tell me about it. Instructions working on the first attempt on a standard Debian system is quite rare. Bigger projects with more contributors put more work into making it work, but also have more complex processes, so the result is that it's almost always trouble. Or they're simply more complex than necessary: no I don't want to download 12GB of IDE, SDK/compiler, emulated operating systems, and custom versions of dependencies installed system-wide in order to compile and run this project, I just want the code and dependencies in the local folder and apt install a compiler so I can simply build the apk and adb install it on my phone without screwing up my system or having to setup a new container/VM for the purpose.

</comment></comment></comment></comment></comment><comment><USER39> > _Unfortunately, sometimes companies are non-responsive. At that point, I > have a few options. I can sell the vulnerability to someone else who will > certainly exploit it. I can just let it sit -- maybe the bug will be fixed > by coincidence or become obsolete, or maybe I 'll find another use for it > later. (I have a large collection of sitting vulnerabilities, some dating > back decades.)_

This sounds so interesting to me _to hear about_. Can anyone recommend a podcast where like-minded engineers discuss things like this? I'd love to vicariously live through their hacking adventures.

<comment><USER38> Sitting on bugs is just being an asshole, not a great adventure. In most cases there really isn't that much to tell anyway: you find a bug, either on your own or in a customer project, and for some reason it doesn't get fixed. Perhaps management accepts the risk and you're bound by an NDA. Perhaps you plan to make a patch so people can also update when you publish but you haven't found the time for the patch and so it continues (I know of a denial of service in nextcloud like this: it's trivial to find (go ahead) and out of scope for their security program so nextcloud tells us it's a wontfix; we're still meaning to release a patch but it has been two months now, though it's only denial of service anyway). If the bug just so happens to be useful in the future, it's like using a public bug except you're the only one knowing it and you can feel real proud of yourself for putting everyone at risk during that time.

</comment></comment><comment><USER40> I have gotten the impression over the last few years that the Tor Project has embraced social justice and diversity to the detriment of their software.

<comment><USER41> People said the same about Mozilla, but FF is doing just fine.

<comment><USER42> It's more important to support FF for a million reasons than not support them because of their internal culture.

Remove those reasons and I would prefer a more open culture and prefer less toxic and would switch browsers to support single thought vs group think.</comment></comment></comment>


Student used 'USB Killer' to destroy $58000 worth of computers - <AUTHOR> https://bgr.com/2019/04/18/usb-killer-college-of-st-rose-computers-destroyed/ <comment><USER2> Reminds me of the Etherkiller and Friends at [http://www.fiftythree.org/etherkiller/](http://www.fiftythree.org/etherkiller/). I'm surprised this doesn't happen more often honestly.

<comment><USER3> Probably because the "pranksters" are not filming themselves using the device to destroy computer equipment.</comment></comment>