NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender - <AUTHOR> https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ <comment><USER2> Amazing work by Lookout and Citizen Lab.

Until this point I was not aware that Lookout provided any value-add for mobile devices. I was under the impression it was the McAfee of mobile.

It sounds mean but this is the first reference to actual vulnerability discovery done by themselves on their blog, which usually reports on security updates that Google's Android security team discovered. Previous entries include such gems as "Now available: The Practical Guide to Enterprise Mobile Security" and "Insights from Gartner: When and How to Go Beyond EMM to Ensure Secure Enterprise Mobility."

I can't wait to see more great work. Lookout is now on my radar.

<comment><AUTHOR> Direct links to other resources:

Technical analysis: [https://info.lookout.com/rs/051-ESQ-475/images/lookout- pegas...](https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus- technical-analysis.pdf)

CitizenLab analysis of the nation-state side of things: [https://citizenlab.org/2016/08/million-dollar-dissident- ipho...](https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero- day-nso-group-uae/)

Apple update: [https://support.apple.com/en- us/HT207107](https://support.apple.com/en-us/HT207107)

<comment><USER3> Love that Technical Analysis.

If Apple, Google, MS, Linux distribution does the following:

* Create sha1, sha256, sha256 chksums of every system, app files and store them in a secure database somewhere.

* Check and audit the system files from time to time and notify the user when change happen.

Would it prevent these type attack or at lease notify the user that system security has be compromised?

<comment><USER4> Tripwire is a linux util for doing just that. However you need some read-only media to store the hashes and I think rootkits can still just intercept the read calls.

[http://linux.die.net/man/8/tripwire](http://linux.die.net/man/8/tripwire)

<comment><USER5> Some years ago, I had Tripwire installed for a few days but quickly removed it again because whenever I upgraded installed packages, I'd get a storm of messages about files which had changed and that was just annoying since I was the one who had initiated the action that caused the files to change, but at the same time there were so many files that changed of course, that I had no way of distinguishing legitimate changes (as they all were) from any potential illegitimate changes.

<comment><USER6> That's precisely what it's supposed to do. If you update the Tripwire db every time you "initiate an action that causes monitored files to change" \- then it does a _magnificent_ job of telling you when someone _else_ changes those files.

You need to run 'tripwire --update' every time you run 'apt-get update' or 'pip install foo' or 'npm install bah' or whatever - then you wont get that storm of false positives.

<comment><USER7> Honest question from an interested party: have you actually had it alert you about someone else changing the files?

I've been in the previous boat: of having it running on a system I've inherited, and given up because it seemed too much hassle.

<comment><USER6> Yes - a few times a year when normal and authorised things or people have unexpectedly changed files in tripwire-protected places, and in ~20 years I think three times when I'd had an intrusion.

Those three timely notifications of real breaches have made 20+ years worth of occasional false positives 100% worth it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> There is a frustration, as a user, that as the value of the iOS exploits increase, they become more and more 'underground'. The time between OS release and public jailbreak is continually growing - and it doesn't seem to only be due to the hardening of the OS. People are selling their exploits rather than releasing them publicly. And the further underground they go, the more likely they will be utilized for nefarious purposes rather than allowing me to edit my own HOSTS file. The most recent iOS jailbreak (to be able to gain root access to _my_ iPhone) lasted less than a month before Apple stopped signing the old OS. Yet its clear this (new) quick action on Apple's part does not (yet?) stop persistent state-sponsored adversaries.

It is more and more clear that to accept Apple's security (which seems to be getting better, but obviously still insufficient) I must also accept Apple's commercial limitations to the use of a device I own. And I suppose that the dividing line between the ability to exploit a vulnerability and to 'have control' is a sliding scale for every user: one man's 'obvious' kernel exploit is another man's 'obvious' phishing scam.

It is not a new tension, but it does seem the stakes on both sides seem to be getting higher and higher - total submission to an onerous EULA vs total exploitable knowledge about me and my device. Both sides seem to have forced each other to introduce the concept of 'total' to those stakes, and that is frustrating. More-so when it's not yet clear which threat is greater.

<comment><USER9> I look at it the other way: as exploits become more and more underground, I feel safer: I know those exploits are more likely to be used by state actors against activists and other people who are doing illegal stuff, and less likely to be used against me and millions of other users to install malware on our phones (to make them send spam, to make them send expensive texts...)

So yes I feel safer now.

<comment><USER10> Perhaps you feel that way because you have the luxury of living in a place where human rights are respected. That these exploits are being used by regimes to shut down opposition is terrible in its own right.

Edit: As for net effect on global society, I think having my phone be part of a botnet that sends spam is less impactful than disrupting democratic progress.

<comment><USER11> The point still stands: these bad regimes will find it harder to do their dirty work as security increases.

</comment></comment></comment></comment><comment><USER12> NSO sells tools that when used violate the CFAA act. It is an Israeli company but a majority share was bought by a San Francisco based VC [0]. It doesn't seem like it should be legally allowed to exist as an American owned company. Maybe Ahmed Mansoor could sue the VC in American courts.

[0] [http://jewishbusinessnews.com/2014/03/19/francisco- partners-...](http://jewishbusinessnews.com/2014/03/19/francisco-partners- acuires-israeli-intelligence-cyber-tracking-developer-start-up-nso- for-120-million/)

<comment><USER13> a) Selling tools itself doesn't violate the CFAA act. A separate entity uses the tools and assumes that liability, which as we see is mitigated by sovereign immunity.

b) And even if selling tools began to violate CFAA, then NSO itself would be sued. As it is a separate entity than the investors, which is the whole point of limited liability....

<comment><USER14> If you can tie the tool to any circumvention of copyright protections -- pretty broad argument (DMCA), you can be sued or arrested.

<comment><USER13> and then you lean on USC Title 17 Chapter 12 § 1201 (f) : the interoperability with other software defense, broad argument.

<comment><USER12> That makes more sense then my idea. But it would have to be Apple that brought the suit.

</comment></comment></comment></comment></comment><comment><USER15> An untethered stealth jailbreak that installs without user interaction from a webview, that's almost as bad as it gets. And for iOS 7.0.0 - 9.3.4 inclusive. And with exfiltration of audio, video, whatsapp, viber, etc etc. So thorough and so bad :-/

<comment><USER16> > An untethered stealth jailbreak that installs without user interaction from > a webview, that's almost as bad as it gets. And for iOS 7.0.0 - 9.3.4 > inclusive. And with exfiltration of audio, video, whatsapp, viber, etc etc. > So thorough and so bad :-/

Short of being triggered completely in the background by an UDP packet, what's worse than this?

<comment><USER17> Chaining this with some form of SMS/MMS bug (a la Stagefright) would make this unbelievably powerful. That's essentially the worst case scenario I can imagine for mobile security.

<comment><USER18> Or this, from the detailed writeup linked elsewhere on this page:

> To use NSO Group's zero-click vector, an operator instead sends the same > link via a special type of SMS message, like a WAP Push Service Loading (SL) > message. A WAP Push SL message causes a phone to automatically open a link > in a web browser instance, eliminating the need for a user to click on the > link to become infected.

It goes on to say that messages of this type are increasingly restricted by service providers and newer phone OSes, but that's still pretty horrifying to read.

<comment><USER19> Wow this WAP Push SL thing seems egregious. It's understandable that somebody thought it would be useful, for like five minutes. But how could a standards body or any of the several different OS companies who have implemented it _not_ have realized how monumentally unwise it is to just automatically run shit that randomly gets sent to a phone?

<comment><USER20> Not everything that supports WAP has to be a phone. It could also be a standalone device, or sensor, or whatever. And with WAP push you can control it.

For me the strange thing is that it is on by default on user phones.

</comment></comment></comment></comment></comment></comment><comment><USER21> The UAE really hates on activists, and appears to be hiring a bunch of people specifically to suppress activists/dissidents within the country. [1] Unfortunately, due to the amount of wealth the country has, it won't stop almost anybody from dealing with them unless Western sanctions are placed on the country, which are unlikely given the current geopolitical situation.

[https://www.evilsocket.net/2016/07/27/How-The-United-Arab- Em...](https://www.evilsocket.net/2016/07/27/How-The-United-Arab-Emirates- Intelligence-Tried-to-Hire-me-to-Spy-on-its-People/)

<comment><USER15> Don't forget the time they pushed an "update" for blackberries: [http://news.bbc.co.uk/2/hi/8161190.stm](http://news.bbc.co.uk/2/hi/8161190.stm)

<comment><USER22> Don't forget that Etisalat is now the majority shareholder and pretty much runs PTCL, the incumbent/largest telephone and telecom company in Pakistan, either... PTCL is to Pakistan as Verizon, Frontier or Centurylink are to various regions of the US. It's the ILEC.

Etisalat is not your friend. Etisalat has great marketing and is building GSM- based (LTE, etc) networks in many developing nations but it is no friend of an open internet or democratic institutions.

Etisalat is the reason why in some places in the world if you try to run a VoIP to Phone system gateway, armed men with carbines will show up and ransack your offices and home. They will use their influence with whatever local government exists to "deal with" threats to their revenue and/or tax base. This has happened in Pakistan and the UAE.

<comment><USER21> > armed men with carbines will show up and ransack your offices and home

This is a solid reminder that in the end, your ability to use defensive technology does not actually decide who calls the shots. Power is still ultimately controlled by violence.

</comment></comment></comment></comment><comment><USER23> Should exploits like this be treated as munitions, with sale to foreign governments restricted? Or any sale at all restricted? Some thoughts:

* The only uses for the exploits are either illegal or by government security organizations

* I don't think you can just make an explosive and sell it to a foreign government; I think there are strict export controls (though I know very few details, I only read about companies applying, getting approval, etc.).

* In the 1990s, strong encryption was called a 'munition' and export was restricted. That turned out to be impractical (it was available in many countries and the Internet has no borders), morally questionable (restricting private citizen's privacy), and it fell apart.

While I believe in liberty and freedom-to-tinker, as I said, this stuff has no legitimate use.

<comment><USER24> > * In the 1990s, strong encryption was called a 'munition' and export was > restricted. That turned out to be impractical (it was available in many > countries and the Internet has no borders), morally questionable > (restricting private citizen's privacy), and it fell apart.

IIRC, thats still on the books. Its just one of those sleeping paragraphs since the PGP release.

<comment><USER25> Debian documents mention that "BXA revised the provisions of the EAR governing cryptographic software" in October 2000. Debian no longer has separate non-us repositories for crypto because of that.

[https://www.debian.org/legal/cryptoinmain](https://www.debian.org/legal/cryptoinmain)

<comment><USER26> Open source software is now basically exempt from the crypto export restrictions, which is why Debian doesn't need separate non-US repositories for it anymore. As far as I know closed-source software is still restricted.

</comment></comment></comment></comment><comment><USER27> Vice has a nice writeup on the exploits as well: [https://motherboard.vice.com/read/government-hackers- iphone-...](https://motherboard.vice.com/read/government-hackers-iphone- hacking-jailbreak-nso-group)

<comment><USER28> FTA: It appears that the company that provided the spyware and the zero-day exploits to the hackers targeting Mansoor is a little-known Israeli surveillance vendor called NSO, which Lookout's vice president of research Mike Murray labeled as "basically a cyber arms dealer."

Phineas Fisher, we need you now.

<comment><USER29> So we have cyber arms dealers now. I continue to be amazed at the prophecies of William Gibson. Makes me wonder if there's anything to "remote viewing." Did he just look forward into the 21st century and write down what he saw? :)

BRB, gonna go slot me an icebreaker...

<comment><USER24> I think Gibson's explanation is that the future is here, it's just not evenly distributed yet.

Others like Doctorow and Stross has voiced similar views. In Stross' case, he apparently shelved the third part of a trilogy because the NSA was outpacing him.

<comment><USER30> Yep, apparently he did:

[http://www.antipope.org/charlie/blog-static/2013/12/psa- why-...](http://www.antipope.org/charlie/blog-static/2013/12/psa-why-there- wont-be-a-third-.html)

</comment></comment></comment></comment></comment><comment><USER31> This vulnerability sounds like this:

[https://www.zerodium.com/ios9.html](https://www.zerodium.com/ios9.html)

It was claimed November of last year. I wouldn't be surprised if this "Trident" was sold by Zerodium. Glad it's patched.

Edit:

I just saw the Citizen Lab article on this:

[https://citizenlab.org/2016/08/million-dollar-dissident- ipho...](https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero- day-nso-group-uae/)

They mention the Zerodium bounty as well.

<comment><USER32> Article mentions that there are indications this was in the wild as far back as iOS 7, suggesting this isn't directly linked to that Zerodium bounty.

<comment><USER33> The Article mentions that the exploit has kernel mappings going as far as iOS7. This doesn't mean this predates the bounty at all, the bug that received the bounty payout for all we know might have been simply functional on iOS 7-9 or even earlier (and who ever made the final commercial product just didn't bother). iOS7/8 is most likely still used since older iPhones stop receiving updates at some point and older iPhones are the ones you might actually find in emerging markets and developing countries. While rare you can still see people even in "developed" countries running Iphone 4's, if you go to the middle east, africa, or asia you probably see considerably more of them through being sold on the secondary markets.

<comment><USER34> Older iPhones become the "kids" phone when daddy buys the new one. There are more of them out there then you think.

<comment><USER33> I guess so, but it's rare to see iPhone 4's at this point when the iPhone 7 is almost out of the door.

Also depending on how old the kids are it might actually work in reverse =)

</comment></comment></comment></comment></comment><comment><USER35> Not having heard about NSO Group before, they've been claiming to have this ability since 2014:

[http://blogs.wsj.com/digits/2014/08/01/can-this-israeli- star...](http://blogs.wsj.com/digits/2014/08/01/can-this-israeli-startup-hack- your-phone/)

What other 0-days do they have in their pockets?

</comment><comment><USER36> The article mentions how this may have been use all the way back in iOS 7 which is crazy.

If you are being targeted for surveillance smartphones are a very bad idea depending on your adversary. A cheap phone that is refreshed regularly will probably be your best bet.

<comment><USER37> On the other hand, smartphones are invaluable to most activists because they allow _you_ to provide documentation of abuses through its various sensors (audio, video, photos, etc).

</comment></comment><comment><USER38> Here are the full technical details: [https://info.lookout.com/rs/051-ESQ-475/images/lookout- pegas...](https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus- technical-analysis.pdf)

</comment><comment><AUTHOR> Make sure to update to 9.3.5 on all of your iOS devices ASAP!

<comment><USER39> Sad face. Right now, on my iPhone:

"iOS 9.3.5 provides an important security update for your iPhone"

40.5 MB. Great! Tapped "Download and install". It's greyed out. Huh?

Oh, "this important security update requires a Wi-Fi network connection to download". Really? It's only 40.5 MB. Let me decide, please, how I use my data.

Am I missing a setting that allows me to install an important _security_ update on a network of my choosing?

<comment><USER40> Go to [https://bugreport.apple.com](https://bugreport.apple.com) and request that. The more duplicates they get, the more likely something is to get fixed.

<comment><USER39> Good call. Done. Also cathartic.

</comment></comment></comment></comment><comment><USER41> You can be sure that this vulnerability was probably discovered by some researcher, then sold to grey markets like [https://www.zerodium.com](https://www.zerodium.com) or [https://www.exodusintel.com/](https://www.exodusintel.com/) (they pay up to $1 million for a highprofile iOS exploit), who then resold it to some government who is now trying to exploit this dude's phone...

</comment><comment><USER42> To people who work for companies that sell / invest in products that are used in unethical ways (Francisco Partners, NSO, Cisco, etc), how do you justify it to yourself?

<comment><USER43> How do the people working for Citizen Lab / lookout justify to themselves blowing active operations by countless police forces around the world?

Ops like Mexico vs Cartels?

Also, since when is selling weapons to governments unethical?

<comment><USER44> When the governments are oppressing their people, that's a good clue.

</comment></comment></comment><comment><USER45> Does anyone know if the iOS 10 developer beta 7 (public beta 6) got this patch, or are we vulnerable?

<comment><USER46> According to Ars the bugs have already been fixed in iOS10: [http://arstechnica.com/apple/2016/08/apple-releases- ios-9-3-...](http://arstechnica.com/apple/2016/08/apple-releases- ios-9-3-5-with-an-important-security-update/)

</comment></comment><comment><USER47> Apple made its bug bounty program public a few weeks ago and the past few iOS updates have all been patching security vulns. It could be a coincidence, but from an outsider's point of view, it looks like the program is working.

</comment><comment><USER48> Will 9.3.5 disable/remove the spyware on infected phones? Or does it just prevent one from becoming infected?

<comment><USER49> From the article:

      "The kit appears to persist even when the device
       software is updated and can update itself to easily
       replace exploits if they become obsolete."

<comment><USER34> And, even if your phone is updating it may be doing a fake update and then show you that you did update to whatever version Apple says is "safe" for this exploit but in fact Pegasus was in control the entire time. Get a new phone ASAP.

<comment><USER50> ... or you could just hook it up to iTunes and let iTunes flash the whole phone with the latest iOS from scratch (9.3.5 fixes these exploits) instead of letting the on-device updater do it.

No need for a whole new phone.

<comment><USER51> I guess I've never dug deep into how a iPhone restore to default from iTunes works, but does it actually zero out the whole disk or is it possible for this exploit to survive that.

<comment><USER50> There are 2 ways. It can do a quick reinstall or it can do a full flash that wipes out everything (you can force it to do that by holding shift or the Apple key or something when clicking the restore button).

</comment></comment></comment></comment></comment></comment><comment><USER22> This is a REALLY, REALLY good reason why "activists" of any variety should be trained in how to acquire an old Thinkpad and install Debian on it (plus a reasonably xorg/XFCE4 desktop environment). If you're dealing with authoritarian regimes you can do a lot to reduce your attack surface. However at the end it all comes down to rubber hose cryptography. If your government, for example Bahrain decides to detain and torture you, you're pretty much fucked.

<comment><USER52> Debian? If it's anyone that's even 1/10 as targeted as Mansoor was, then they shouldn't use anything less than Qubes, Subgraph, or TAILS.

<comment><USER22> you realize TAILS is just debian with TOR, and non persistent storage?

I'm sure you can find a way to spear phish somebody and send them a Linux ELF binary that they will then execute, but accomplishing that is considerably harder than on Windows/OSX/Android/iOS.

<comment><USER53> > I'm sure you can find a way to spear phish somebody and send them a Linux > ELF binary that they will then execute, but accomplishing that is > considerably harder than on Windows/OSX/Android/iOS.

I'm afraid people are just as foolable and code just as executable on Debian as on any other platform. Additionally, vulnerabilities on Android are likely exploitable on Debian.

You will not survive an attack from a state adversary because you used Qubes, or OpenBSD, and certainly not TAILS (which is not particularly secure, just well integrated with Tor). You will survive because you are familiar with your tools of choice and you know how to secure them.

As a final note, if you're being targeted by a nation state, getting an pre- owned ThinkPad will probably result in getting a pre-0wn3d ThinkPad.

<comment><USER22> If you're being targeted by a nation state you will face all sorts of things to deal with that can't be handled by buying a Thinkpad with cash from a randomly chosen used computer store. Like bugging your residence and office, bugging your car, putting advanced GPS tracking devices on your car, rubber hose cryptography, hardware keystroke loggers inserted in your equipment while you're known to be away from your home or office, full disk copies of your laptop/desktop being taken (clonezille-type) by breaking into your office while you're away, all sorts of shit.

<comment><USER53> If you don't keep your airgapped laptop on your person or in a tamper evident container at all times, it isn't an airgapped laptop. And if it isn't an airgapped laptop, it shouldn't know any secrets.

<comment><USER22> At which point if you're a UAE dissident and trying to deal with all this _while living in the territory of the UAE_ , you might say "fuck it" and find a way to move to Toronto.

replace "UAE" with "Ethiopia" or any other authoritarian regime.

<comment><USER54> They took his passport.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER55> I'm a beginner when it comes to software development (mostly web development), but it seems to me that the majority of complex exploits like this involve some type of memory overflow and subsequent code execution.

Shouldn't there be methods for detecting these kinds of things in source code or more priority given to preventing it in the C/low-level community?

<comment><USER56> There are. "(Kernel) address space layout randomization" is one of them. It was circumvented here; that's part of why this is impressive.

<comment><USER55> How is it possible to put the malicious code in the correct memory spaces? Unless the attacker had a full image of the memory, I don't see how this can be accomplished.

<comment><USER56> The second bit of the exploit chain, CVE-2016-4655, leads to disclosure of kernel memory addresses. Once a single memory address is known, you can calculate the random offset of the kernel, and then exploit the third part to overwrite the return address and return into specific chunks of kernel code ("Return Oriented Programming"), whose addresses you computed from the offset + a fixed code location. These can let you e.g. install your payload.

</comment></comment></comment></comment><comment><USER57> Aside, but does anybody else find the switch from right-to-left to left-to- right really jarring in this screenshot?

[https://citizenlab.org/wp- content/uploads/2016/08/image13-76...](https://citizenlab.org/wp- content/uploads/2016/08/image13-768x706.jpg)

It has the effect of introducing a line-break into the middle of a line, rather than at either end. I've never encountered this before and it took my brain a few seconds to catch on.

I'd be really curious how native bilingual readers of both a right-to-left and left-to-right language would read that. Does it look natural? Where do your eyes go first?

<comment><USER58> BiDi sucks, and as an RTL language speaker you learn to live with it.

My native language is Hebrew, and we don't bother translating most technical terms to Hebrew. You end up with technical documents looking something like this:

".yadot patch a desaeler Apple .iOS 9.3 ni ytilibarenluv privilege-escalation a dnuof srehcraeser ehT"

In newspapers, where lines are typically short, you get the effect in the screenshot in question. E.g.:

       "Everyone gets a day .ni tnew eH
                .dias eh ",off tomorrow

You can't _really_ get used to that. You actually have to read the second line sideways from the middle!

By the way, typing mixed text is even worse than reading it. You have to press alt+shift every 2-3 words to switch layout. If that's not bad enough, Office 2007 (if I'm not mistaken) introduced a 0.5-1sec lag after each keyboard layout switch. Imagine typing out an entire document like that. I lost my nerve a couple of times.

In many cases we avoid this issue by simply writing technical documents in English, but sometimes that's not an option.

<comment><USER57> Thanks for this – I really appreciate the insight. That changing-input lag sounds like an absolute nightmare.

Since I left my previous comment, I came across some Apple presentations on new work they've been doing in iOS 9 and iOS 10 on internationalisation including RTL and mixed-content support. It sounds like there's a lot of work still to do, but I was pleased to see they've at least started multilingual input sources now (in iOS 10, autocorrect can work with multiple languages without having to switch keyboards, though I'm guessing this only works with Latin alphabet languages for now?).

</comment></comment></comment><comment><USER59> I thought it was interesting that they're using Cydia Substrate to hook into specific third-party apps for monitoring.

I wonder if we'll ever see privacy conscious apps using some sort of obfuscation. So that every time you update your app, the attacker will have to reverse-engineer the symbol names again.

It seems like a compile or link time tool could find method call & selector references. As long as your app isn't calling methods using strings, or doing something else tricky, I think it could work.

Or you could just write the app in swift. It's the Objective-C runtime that makes it so easy to intercept method calls.

<comment><USER60> The trouble is that nearly every app does "something tricky" because it's so baked into Apple's frameworks. Every UI control calls methods using strings when you interact with it. Key-value coding and observing works extract method names from strings. Core Data uses method names to look stuff up in the underlying storage. And these things are so easy to do that it's pretty common for third-party code to do similar stuff. Reliably figuring out which methods were safe to change would be really tough.

</comment></comment><comment><USER61> Unless you are a high-value target, Apple's security seems fairly sufficient for normal use (I have Android ;)). Companies like NSO Group that state that they play both sides without any moral compass seem like a great target for Anonymous or others. Imagine the client list, and banking information as a trail to blaze!

<comment><USER62> This guy seems to be quite the high-value target to warrant 3 zero-days, on ios no less.

edit: What platform would be recommended, if you happen to be a high value target though. Using iOS at least seems to raise the cost of infiltration significantly judging by this [http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...](http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping- for-zero-days-an-price-list-for-hackers-secret-software-exploits/).

<comment><USER63> The other dimension to keep in mind is time. Governments can just cash out whatever {Vupen|Zerodium|rogue researcher} ask for, and get a 0-day for any major platform waiting there to be sold. Any obscure, probably less-secure platform has surely gone through less research and time becomes key: probably there will be no time to develop an exploit within your operational window.

</comment></comment></comment><comment><USER64> How does one monitor the infection of an iOS device and how do you capture and store all the stages of an infection?

I've never done any reverse engineering so I'm not sure how you'd go about recording what an infection like this does to your device...

</comment><comment><USER65> He wasn't hacked, he was being "lawfully intercepted"!

Just kidding. The difference here is that a government doesn't want to do such as provide reasonable suspicion or go publicly in front of a judge.

</comment><comment><USER66> So, basically three things to notice:

1\. never click on links in e-mails. 2\. if you're targeted by a nation state, you're screwed. 3\. everybody is vulnerable to rubber-hose cryptography.

</comment><comment><USER67> It's curious that Signal was missing in their list of apps that can be intercepted. Are the targets not using it? Or was it just not mentioned?

</comment><comment><USER68> Is there any way to check if an iOS device has Pegasus installed, without installing and registering for the Lookout app?

<comment><USER59> Sounds like an exploited device should be jailbroken, you could try running an unsigned binary (if it's easy to find & install one - I'm not sure).

I believe the article also says it disables the auto-update mechanism. So if you've seen an auto-update prompt recently, your odds are better.

The background audio recording must be terrible for battery life.

<comment><USER56> (From the lookout paper): "In order to maintain its ability to run, communicate, and monitor its own status, the software disable's the phone's 'Deep Sleep' functionality."

</comment></comment></comment><comment><USER69> I have an iPad 1 which long ago was left behind by upgrades. It'd be nice to know when the vulnerabilities were _introduced_ too. Should I stop doing anything networked with it?

<comment><USER60> I would definitely not trust it, at the very least. Even if this particular vulnerability didn't exist for it, there are bound to be many others that did.

</comment></comment><comment><USER70> "we did not have an iPhone 6 available for testing"

Big budget operation!

<comment><USER71> It's a human rights lab at an academic institution. Small budget is hardly a shock.

Somewhat hilariously, they appear to be funded in part by donations from Palantir.

</comment></comment><comment><USER72> I think NSA is trying to acquire them.

</comment><comment><USER73> [https://citizenlab.org/2016/08/million-dollar-dissident- ipho...](https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero- day-nso-group-uae/)

      > Alarmingly, some of the names suggested a willingness on
      > the part of the operators to impersonate governments and
      > international organizations. For example, we found two
      > domain names that appear intended to masquerade as an
      > official site of the International Committee of the Red
      > Cross (ICRC):  icrcworld.com and redcrossworld.com.

<comment><USER74> This is a much more informative source. Moderators may want to merge everything into this story: [https://news.ycombinator.com/item?id=12360714](https://news.ycombinator.com/item?id=12360714)

 _Edit:_ that story is now flagged as dupe, can we at least get the URL changed to this much more in-depth article? [https://citizenlab.org/2016/08/million-dollar-dissident- ipho...](https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero- day-nso-group-uae/)

<comment><USER75> Yes. Done.

<comment><USER74> Thanks!

</comment></comment></comment></comment><comment><USER76> This is off-topic but at first I thought I was on a Spotify blog page. Lookout has _very_ similar branding.

<comment><USER76> lol downvotes, ok hn. My initial reaction was "this is crazy Spotify found something like this", which was why I commented.

<comment><USER77> It's ok. I thought the same thing. You're not the only one.

</comment></comment></comment><comment><USER78> << Instead of clicking, Mansoor sent the messages to Citizen Lab researchers.

The story is great but I really doubt this. I'm wondering what made him suspect the link? Does he send all the links he receives to Citizen Lab?

<comment><USER79> Yes, who doesn't click on random links received from unknown numbers over (get this) SMS?

Some people.

<comment><USER19> Yeah that's almost dumb enough to indicate that this whole thing has been a cat's paw. Burn an old vuln, get everybody riled up about it, but distract them from looking for the sophisticated things you're doing when you actually want to spy on a troublesome subject.</comment></comment></comment>


Oxytocin enhances spirituality - <AUTHOR> http://sciencebulletin.org/archives/5449.html <comment><USER2> WHat's the difference between Oxytocin and Oxycontin?

<comment><USER3> One, Oxytocin, is a hormone; Oxycontin is a frequently prescribed narcotic painkiller.

The effects of oxycodone include pain relief, euphoria, anxiolysis, feelings of relaxation, and respiratory depression plus numerous side-effects.

Oxytocin (Oxt) is a human peptide hormone plays a role in social bonding, sexual reproduction in both sexes, and during and after childbirth.</comment></comment>


10 Year Old Bug Crushed by Hacker on a Mission - <AUTHOR> https://hackaday.com/2017/10/31/10-year-old-bug-crushed-by-hacker-on-a-mission/ <comment><USER2> Was hoping this would be about a very old insect

</comment><comment><USER3> Good job gnif!

I'll admit my thoughts from reading just the headline were that a hacker spent 10 years working on trying to fix the same bug over and over again.

</comment><comment><USER4> Zero details, nice.

<comment><USER5> > The reason turned out to be that SVM is discarding the guest PAT setting and > uses the default (PA0=PA4=WB, PA1=PA5=WT, PA2=PA6=UC-, PA3=UC). The guest > might be using a different setting, and especially might want write > combining but isn't getting it (instead getting slow UC or UC- accesses). > [0]

That's all it is. Not a big complicated bug, the patch is seven simple lines.

[0] [https://patchwork.kernel.org/patch/10027523/](https://patchwork.kernel.org/patch/10027523/)

<comment><USER6> That patch might be small but I imagine the path to the patch had more details than mentioned in the article. It would be nice to hear that side of it to.

For someone benefiting from the patch it's a great story, from a developer viewpoint there aren't enough details for it to be satisfying.

<comment><USER5> Not much of a story [0] either. A quick benchmark or three, an assumption that something was missing... And it was, it was just stubbed.

This isn't a heisenbug, it was just never high enough priority for someone to notice.

[0] [https://lists.linuxfoundation.org/pipermail/iommu/2017-Octob...](https://lists.linuxfoundation.org/pipermail/iommu/2017-October/024823.html)</comment></comment></comment></comment>


Show HN: Convert a number to an approximated text expression - <AUTHOR> https://github.com/tokenmill/numberwords <comment><USER3> If you don't want it approximate, but exact, this is still a tricky non- trivial ambiguous problem. And this problem often comes up in text normalization for NLP task (e.g. speech recognition, or text-to-speech).

For Python, for English, there is the inflect library: [https://pypi.org/project/inflect/](https://pypi.org/project/inflect/)

<comment><USER4> I also wrote a function in Pascal to convert integers to natural language exactly. E.g. here is the output for 100000! [https://gist.github.com/benibela/f0163b02562f647e4d2f](https://gist.github.com/benibela/f0163b02562f647e4d2f)

<comment> jagged-chisel It's 8.8MB of plaintext English output describing the ridiculously long number, for those on mobile (who can't see the full file), or who don't want to click through the 'file is truncated...' link

<comment><USER4> As an approximation, one could just say three duoquinquagintacentillinonagintacentillion

</comment></comment></comment></comment><comment><USER5> One other aspect of approximated numbers is whether the author wants to emphasize that the number is large or small. "Less than" and "almost" carry different connotations.

<comment><AUTHOR> You are right, hence Number Words returns different versions of the approximation: 'more', 'less' and 'around'. More nuanced versions could be added to the list. Importantly the choice of the approximation version to use would be with the user of the library. Wonder if the algorithm to choose appropriate approximation can be devised.

<comment><USER6> > Water temperature is below 10C (input data would be 9.53C)

I can't tell the water temperature at all without context -- could be any temperature below 10C; and in the wrong context it could be confusing. "Just below"/"just under" would be a lot more accurate.

</comment></comment></comment><comment><USER7> Does this exist for time numbers?

I wish Telegram used such a thing. Someone not seen for 1h59m is 'last seen an hour ago'. Even just showing the actual time would be more helpful IMO - <USER2> displays it at the top right underneath (iOS) or very near (Android) the system time anyway, I don't know why it's thought to be a good idea to remove so much information.

<comment><USER8> I always assumed their system is simply to tell you roughly whether to expect the person to be online soonish. And I would find it too invading to have exact numbers - e.g. in WhatsApp almost everyone I know disables that.

<comment><USER7> It tells you the exact time anyway, just have to click on it (or otherwise get to the contact's profile). The options for disabling it are to make it visible to everybody/contacts/nobody.

</comment></comment></comment><comment><USER9> This is the type of thing WASM modules would be perfect for. Theres no reason for this to have so many implementations in so many languages.

<comment><USER4> That is a frustrating aspect of open-source

In the old days you would have a binary shell tool or a dll, and then you could call it from any language. It did not matter in which language the tool was written in.

<comment><USER10> It has nothing to do with open-source. This project is written in Java (basically), which is proprietary.

It has everything to do with programming languages that don't compile down to linker symbols that can be called with the C calling convention, and the utter failure of Unix philosophy when it comes to shell tools.

</comment></comment></comment><comment><USER11> What would be the intended use case for something like this?

<comment> jagged-chisel Use automation to get human-friendly text for numbers. An example from the readme:

\- Q2 sales were around 1M$

When the input was $1,002,184.

<comment><USER12> I'd be amazed if a company put "around $1M" for anything that was "over $1M" !

<comment><USER13> They could use the -pr switch when running it.

</comment></comment></comment></comment><comment><USER14> Is there a Java version of this? I understand it's open-source, but since Clojure is JVM, and the lowest common denominator is Java, I think it will be hard to include Clojure just to use the library.

<comment><AUTHOR> Clojure is JVM language and it is straightforward to interact with Clojure libs from Java apps. To make it even easier it is a first thing on my TODO list to provide a simple Java interface to work with Number Words plus update README with Java use examples.</comment></comment>


Paul Buchheit: Optimizing everything: some details matter a lot, most don't - <AUTHOR> http://paulbuchheit.blogspot.com/2007/06/optimizing-everything-some-details.html <comment><USER2> Great article! I love that you post here, give genuine advice on your blog, and didn't present at startup school with the crazy and rude idea that you were going to find employees for your company, like some of the speakers did.

But, I think you should mention the most important rule of optimization--don't optimize something that doesn't even exist yet. When you create anything new, just do it. When something bothers you once, twice, three times, then you know what to address.

Another example of when optimizing early isn't just a waste of time, but can hurt one in other ways as well, is when optimizing early is going to hide some information from the developer(s) when they need it most.

For example, say one has a live stats page. One can always optimize and cache the stats pages later on when one gets a lot of users and doing so will actually make a difference in performance. But in the beginning, anything "live" should be live so the developers can test things out and get instant feedback, and not see a cached or confusingly optimized result.

How I try to think about it, is "anything that takes time away from creating new things because something that used to work previously is now slow or broken." THEN one should optimize. Anything else is a waste of time.

The WORST kind of optimization? PEOPLE RE-WRITING THEIR ENTIRE SOFTWARE OR WEB APP IN ANOTHER LANGUAGE.

</comment><comment><USER3> Right now the Reddit post at <http://programming.reddit.com/info/1wv6m/details> and this post have the same score. Think there's anything interesting there, from a social news perspective?

<comment><AUTHOR> But on reddit it also has 25 down votes. They are cranky over there...

<comment><USER3> Yeah but we're renaming the alien after you and PG, so that's not bad.</comment></comment></comment>


What I learnt from being sexually harassed at Google - <AUTHOR> http://www.gadgette.com/2016/01/19/what-i-learnt-from-being-sexually-harassed-at-google/ <comment><USER2> original - [https://medium.com/@juliachou/it-s-not-your- fault-3e5ad1ccb9...](https://medium.com/@juliachou/it-s-not-your- fault-3e5ad1ccb95c#.chzsfx407)

<comment><USER3> Previously discussed here: [https://news.ycombinator.com/item?id=10909612](https://news.ycombinator.com/item?id=10909612).

</comment></comment><comment><USER4> > In the span of a week, I went from feeling excited and motivated about my > job to feeling lethargic, anxious, and unenthused. (...) I was kissed on the > cheek, asked to sit on my manager's lap, told about my manager's sex life > and virility (...)

There exists a breed of narcissists who are so incapable of tolerating rejection that they will consistently ignore every sign of it. In fact, the less you are satisfied with their actions, the more they will repeat them, desperately _needing_ to see that your displeasure was just a temporary fluke and in the end they really are those cool dudes who are never wrong and everybody just admires them.

As a man I've never been asked to sit on one's lap (knock on wood), but some did give me a fair amount of trouble.

It doesn't help that their delusional serf-confidence can be confused with competence by some less experienced folks and get them promoted to management roles. In fact, I'd expect their density to increase as you go up the corporate food chain.

<comment><USER5> I am member of a minority, and have had more than one chance to go to the HR to report "being racially abused" and present the narrative in such a way that anyone would be convinced it was horrible.

Firstly, what happened to her is definitely misconduct, but not sexual harassment. I get the impression that the "victim" here is trying to take advantage of the situation. She never asks the inappropriate person to stop here, instead goes to HR. I mean just in plain words "Please don't, this is inappropriate." would stop most such behavior from happening again in huge majority of cases.

> During the HR investigation that ensued, I remember being shamed by a female > colleague who thought I was blowing the situation out of proportion. She > thought I was being overly sensitive, and that it was wrong of me to report > my manager. That hurt. I thought she would've naturally supported me.

"Being shamed"? What if that female colleague honestly thought that she was blowing the situation out of proportion? A mere disagreement is shaming? Just because someone thinks they are 'sexually harassed' doesn't make them right automatically. I mean is there any scenario where someone claiming they are harassed could be on the wrong side of the things (or blowing things out of proportion)? It seems the SF/valley area atleast is too politically correct to even entertain the possibility that the female could possibly be wrong or making a mistake. Anyone that doesn't agree with a narrow notion of SJW equality is literally the devil. And this sort of trend has made 'being victim' a somewhat coveted status that can be used for gaining publicity/career advances.

<comment><USER6> > Firstly, what happened to her is definitely misconduct, but not sexual > harassment. I get the impression that the "victim" here is trying to take > advantage of the situation. She never asks the inappropriate person to stop > here, instead goes to HR. I mean just in plain words "Please don't, this is > inappropriate." would stop most such behavior from happening again in huge > majority of cases.

1\. Your implicit dismissal of her as a victim by using quotes is, frankly, a pretty large part of the reason why women feel so frustrated in tech. Here you are, a third party to this situation, automatically assuming that she's somehow someone who is purposely trying to take advantage of a situation.

2\. Why is it the woman's responsibility to tell her male manager that it's inappropriate to ask her to sit on his lap? I mean, c'mon. I'll ask a coworker to stop if he's playing his music too loudly, but this is hardly in the same league. Plus, he's in a position of power over her, as her manager.

3\. This situation is _precisely_ why there's an HR department.

<comment><USER7> 1\. Parent comment's dismissal is based upon details revealed in the article, or rather details that weren't revealed. He suspects that, since the victim escalated immediately, the victim may not have wanted a peaceful resolution. We don't have the full picture, but what we have suggests that there were other ways to handle it.

2\. Yes, I expect you to say that you're upset by the situation. I cannot read your mind; most people can't read your mind either, and many of them don't know the line between a 'joke' and harassment. Telling someone you don't like what they're doing is a crucial step, because otherwise they may assume nothing is wrong. We want the boss to learn that his joke is not funny, and to do that sometimes you have to say it to his face.

3\. Neither side is communicating well, which is indeed why HR exists. It's also possible that the boss would've continued after being told explicitly to stop. This does not mean you reach for HR's hotline the moment something goes wrong. You don't respond to a slap by pulling a knife, and you don't respond to a knife with a nuke--at least, not without examining other options.

<comment><USER8> > We don't have the full picture, but what we have suggests that there were > other ways to handle it.

So it's safest to assume that the victim of sexual harassment is at fault, of course.

> because otherwise they may assume nothing is wrong.

So in this scenario, you're taking the stance that the Manager at Google has no concept that asking an inferior employee to sit on his lap could be unacceptable workplace behavior?

That doesn't seem like a generous read to you? You honestly think that this man, who has been working in a professional environment for at least a decade, was completely unaware that asking an employee to sit on his lap could possibly be construed as sexual misconduct?

So to review:

victim of sexual misconduct: obvious potential liar

perpetrator of sexual misconduct: blameless victim of ignorance

Got it.

<comment><USER7> I am taking this stance because you, in your infinite wisdom, have assumed there are no possibilities other than the manager being the literal Devil. To compensate, I am taking the opposing position, so at least both ends of the spectrum of possible arguments are heard.

That having been said, talking about your problems is a basic communication skill that everyone who's graduated high school really should have, since it helps ensure that everyone learns from their mistakes and nobody has to be fired. Something I've noticed often in thses sorts of conversations is that people assume their point got across even if the other person acts like they aren't reading the subtle social cues.

TL;DR: I'm arguing with you because you're not thinking about both ends, and someone's gotta think of the other possibilities if we're to be sure that we're right; further, you shouldn't rely on subtlety to work with someone who can't handle subtlety. That's like expecting Java to be weakly typed. You gotta rule out the possibility that they're just stupid before you assume they're a dick.

</comment></comment></comment></comment></comment></comment><comment><USER9> I'm not so sure about this one.

I think sexual harassment and direct flirtation can become confused depending on the perspective of the recipient.

Men have been making advances toward women throughout history and, perhaps to a lesser extent, women do the same toward men.

Far more workplace flings happen than any company (and even many employees) will admit and it often starts with one party or the other making their desires known to the other party. I've also been part of and present for many very graphic conversations in the workplace involving both sexes and none of these, to my knowledge, were never seen as harassment or reported as such.

In reading the linked article the one thing I don't see is where she told the manager "No. I'm not interested. Leave me alone." Perhaps if she had simply been as direct with him as he was being with her, the entire HR fiasco could have been avoided.

It's telling that the female colleague felt that she was overreacting. At no point in the article does she mention the manager touching her inappropriately, or saying anything to imply that her job or compensation depended on her accepting his advances.

This honestly sounds like he was a guy who got attracted to a colleague, made steadily increasing verbal advances (which were not rebuffed), and then got blindsided by HR.

I'm sure this won't be a popular view here but I think it's valid.

Edit: Replaced "HR Worker" with "Colleague". As some responders pointed out it was not the HR person who told her she was overreacting (thanks for the corrections).

<comment><USER6> > It's telling that the female HR person felt that she was overreacting. At no > point in the article does she mention the manager touching her > inappropriately, or saying anything to imply that her job or compensation > depended on her accepting his advances.

It was a female colleague, not HR. According to the article, HR was fully behind her, as they should be.

> This honestly sounds like he was a guy who got attracted to a colleague, > made steadily increasing verbal advances (which were not rebuffed), and then > got blindsided by HR.

Not just a colleague, a report. This is what's important. HR would have frowned on a manager making advances on his reports, if nothing else. Especially advances on a new report during her first week.

<comment><USER10> My friend was in the same position about a year ago, and she told her boss (directly, and in private conversation) that she's not interested, after he didn't interpret a few other subtle hints. She still works there.

Furthermore, she the boss and some other colleagues were cracking jokes about it during a team building event that I was invited to.

Edit: I realise this is anecdotal, but it feels to me like the author of the blog post immediately assumed she's a victim and panicked. Maybe the manager should've been more observant, but pointing fingers is useless without knowing what really happened. We only have her account of the story, which is probably distorted by the discomfort she experienced. This is not to say her discomfort shouldn't be taken into account, and yes I agree that HR should've sided with her, but I don't believe he should've been seriously sanctioned either.

<comment><USER6> It doesn't sound like he was -- he apologized, and they moved her to a different group

</comment></comment></comment></comment><comment><USER11> I'm not going to speak directly regarding the way this individual handled this situation, but in general, if you experience any form of sexual harassment I highly recommend you speak with HR immediately following the incident. Don't allow it to escalate, things can only get worse. Even if it's your first day on the job, you should never feel speaking to HR regarding an incident is a bad idea.

<comment><USER12> Can you really trust HR to do the right thing?

<comment><USER13> If you can't trust HR to do the right thing or they don't, it's time to leave.

<comment><USER14> If you've privileged to have adequate savings and good prospects, sure. For a lower-middle-class graduate on their first job it isn't always that simple.

<comment><USER15> It's a good point. From a purely procedural standpoint, "Discuss with colleague, contact HR immediately if it persists (or immediately if serious enough), then hire lawyer" is impeccable advice.

On the other hand, from an outcomes standpoint, this gets a lot more murky. "I see you recently graduated and worked for Google for a month?" "Yes, I had to leave under difficult circumstances" isn't a great conversation to be having career-wise, right out of college, interviewing for a replacement job. So I empathize with the blogger's confusion as to the right course.

Same problem as whistle-blowing.

</comment></comment></comment></comment></comment><comment><USER16> Why does nobody seem to be bothered with the apologize and continue as usual outcome? Shouldn't there have been serious implications for the sexual offender?

<comment><USER17> I have to write this comment pretty carefully to avoid vindicating the offender or blaming the victim. It seems to me like the victim wasn't making it clear that she was uncomfortable (this is not her fault), and perhaps the offender was picking up on signals that weren't there. The situation needed to be fixed, but the behaviour mentioned in the article could have been more flirtatious than forced. A zero tolerance policy is just a way of removing the humanity from the situation. Maybe the events weren't so severe to demand that he lose his job, has charges pressed, etc. I don't think we should be calling for his head. I am surprised that she continued to work under his management, though.

<comment><USER18> > It seems to me like the victim wasn't making it clear that she was > uncomfortable

The default position should be to assume that _everybody_ is uncomfortable with _everything_ unless otherwise stated.

It's like a good firewall policy - default block all and then explicitly allow.

<comment><USER19> That's a good way to wind up unhappy and alone at work. Chances are that anyone using that strategy and isn't miserable has a fair number of unspoken assumptions about acceptable behavior, and don't actually use that strategy but are slightly more guarded that normal so they think they do.

<comment><USER18> That not wanting to be sexually harassed would make someone unhappy and miserable in a workplace is exactly the problem.

<comment><USER15> You missed forgottenpass's more nuanced point.

"Not wanting to be sexually harassed would make someone unhappy and miserable in a workplace" was not the assertion. The assertion was "going to such extremes as to _guarantee_ that no claims of sexual harassment could at any time be made against you would make you unhappy and miserable in a workplace".

</comment></comment></comment></comment></comment></comment><comment><USER20> Is this really a problem with Silicon Valley? I think it's an universal problem you'll find in all industries.

<comment><USER21> My mother worked in an all-male field starting in the 1970s; they didn't even have a women's bathroom at the plant when she started. When something like this happened to her, she was perfectly capable of opening her mouth and telling the person that their behavior was unappreciated.

I don't see where she says she ever even hinted to the manager that his actions were inappropriate. I suspect a single "cut that shit out, stop acting like a damn teenager" might well have stopped this problem in its tracks. But we'll never know.

I read these tales of woe and wonder why people today lack the intestinal fortitude to stand up for themselves, rather than resigning themselves to the status of "victim".

<comment><USER22> See - this is interesting. There is definitely a sense that in "ye olden days" people were stauncher. There's a bit of application of so called common sense where a lot of behaviours can be shut down by addressing them.

Yet you instantly have to recognise that you just blamed the victim for not being more assertive, and not being able to protect themself from something that they should _never_ have to deal with - it's not even _close_ to acceptable behaviour.

I am not unsympathetic to your point, I just kinda wish some consequences would start arising for the seemingly endless tide of entitled pricks who either don't care or don't know any better.

<comment><USER21> > Yet you instantly have to recognise that you just blamed the victim for not > being more assertive

You and every other commenter seems to think I don't understand that. Not sure why.

<comment><USER23> It's because people give the benefit of the doubt and don't want to think you're the kind of guy who blames the weak and powerless when bullies abuse them.

<comment><USER21> My mother was _anything_ but "weak and powerless". Sure, standing up for yourself isn't "ladylike", and not everyone is willing or able to do it, but the current assumptions are "she is weak and powerless" and "he is a big strong bully". That dynamic is easily changed, but you have to be willing to stand up for yourself.

<comment><USER23> This isn't about your mother. Your mother managed to push the problem onto someone else, which is nice for her. There will always be people who, for whatever reason, don't.

Is your attitude that it's acceptable for these people, who do not push the problem onto someone else, to be sexually assaulted? If it's not acceptable, why is it incorrect for the victim to seek help? If I were burgled, I would seek help. If I were mugged, I would seek help. Why is it incorrect for me to seek help if I am sexually assaulted by a manager?

Furthermore, given that my employer has a duty to ensure a safe workplace, why should I not upbraid my employer for failing in that duty, or advise them of the problem so that they can correct it? If I saw a dangerously loose carpet, I would tell them. If I noticed some buzzing wiring, I would tell them. Why should I not tell them that one of their employees is sexually harassing people?

<comment><USER15> _> Is your attitude that it's acceptable for these people, who do not push the problem onto someone else, to be sexually assaulted?_

In a normally common-sense forum here, I'm kind of amazed by the number of comments here that go straight to the nuclear extension of the other's point. Can we assume that we're all against sexual assault here and have a bit more charitable discourse?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> _In that week, I was kissed on the cheek, asked to sit on my manager's lap, told about my manager's sex life and virility, and told that "all men go through an Asian fetish at some time"_

holy frack - that's insane - and no way the first time they've said these things in front of other people before with no-one challenging the behavior as unacceptable

easy guide for men: if you wouldn't say it to a friend's daughter, or someone saying it to your daughter, don't say it to any woman you aren't in a personal relationship

</comment><comment><USER25> I'd like to preface this comment by saying I'm not confident in my opinion, and I'm very open to discussion and to changing my stance.

My understanding is that the manager's actions would likely be considered low level harassment, tipping towards misconduct considering the short duration (1 week) and minimal resolution attempts outside of HR. Definitions are hard for this subject, but my understanding is the phrase escalates with severity from misconduct->harassment->assault.

I agree that the manager was in the wrong, but I worry about a culture that cannot readily distinguish the severity of conduct, and in-turn come up with an appropriate response.

In this scenario, I feel going to HR was appropriate, but I also feel this writing takes an overly hostile tone, instead of one focused on improvement. I'd find this tone appropriate if there were more pushback from HR, or if harassment continued and HR wouldn't help resolve. But as far as I can tell, OP is happy with HRs response.

Perhaps instead we can explore what HR can and should do to prevent self- confidence issues at the conclusion of these investigations? To me, that would be more beneficial than asking others to pursue a path which - all things being similar - results in self-doubt.

<comment><USER26> I understand your point of view, but I feel like we often underestimate the level of harm that some types of misconduct can cause. A workplace should never tolerate any type of harassment (and few workplaces do).

It's not just the act itself, it's also the act in the current historical context (institutional inequality) and work context (workplace power inequality).

Unfortunately the effects on OP are probably much bigger than we expect because of the way we are socialized, our culture, etc. Some might say that it's not the guy's fault that our society is so imbalanced, but I think we should be more conscious about this in general. To prevent the self-confidence issue, we could probably fix our education and general culture, but in the short term we could just not harass women at work. That's a pretty easy short term solution :)

</comment></comment><comment><USER27> What happened to the woman in the article was unacceptable _if_ she clearly signaled she wasn't interested. On the other hand some women now think "Why won't that cute guy come hit on me?, is he shy or gay?" No he is worried you will report him for harassment. Forget ever trying to date someone from work it's a minefield (as is dating in general!).

<comment><USER28> It's unacceptable because of the manager-subordinate relation.

And you can't put the burden on women to actively _signal_ that they are not sexually interested in a professional setting. That's at best a large distraction for them, and at worst very draining and emotionally damaging.

<comment><USER27> I meant if someone show interest not all the time, men can be dumb and are unable to detect subtle hints.

<comment><USER6> Are you actually using "I'm stupid and oblivious" as an excuse?

</comment></comment></comment></comment><comment><USER29> Is the term "sexual harassement" appropriate here?

It'd be interesting to hear the manager point of view on this issue. We have only one side of the story here. Maybe the manager genuinely thought this was a case of mutual flirting there.

Or flirting in the workplace = sexual harassment?

EDIT: [http://legal- dictionary.thefreedictionary.com/sexual+harassm...](http://legal- dictionary.thefreedictionary.com/sexual+harassment)

"A key part of the definition is the use of the word unwelcome. Unwelcome or uninvited conduct or communication of a sexual nature is prohibited; welcome or invited actions or words are not unlawful."

"The courts have generally concluded that a victim need not say or do a particular thing to indicate unwelcomeness. Instead, a court will review all of the circumstances to determine whether it was reasonably clear to the harasser that the conduct was unwelcome. "

<comment><USER6> General rule of thumb is that a manager should never flirt or make advances to his direct reports, because the power imbalance and potential for confusion there is just too great.

Even if it was mutual, HR would probably have moved either her or him to a different team if their relationship had progressed.

</comment></comment><comment><USER30> As somebody that has endured the same the other way round - being hit on by many (even married) female colleagues, HR girls, having a female manager attempting to invite me to her room in the hotel, girls repeatedly stalking me at my apartment, e.g. after I performed on a piano at a party, even just meeting random girls that would dump their boyfriends on the spot, completely shaking with excitement (me and her BF just look at each other with disbelief: "Is this really happening?"), dozens of girls telling me I am their "Mr.Perfect" etc. I can relate to her plight. However, she at least has some recourse; if I wrote a blog about my experiences I'd become a laughing stock of the Internet. Sometimes I think redpillers/AFBB got something right, which is shaking me to the core... There are some very dark areas of both male and female sexuality...

<comment><USER4> > if I wrote a blog about my experiences I'd become a laughing stock of the > Internet

So write a blog post on what lead you to such abundance :)

<comment><USER30> Win everything you can as a kid whether it is sports or scientific competitions, then decide it's not worth it (winner is the lonely one), grow in an environment where girls are looking like supermodels so you aren't intimidated by their looks and can talk to them normally and just don't care that much about them, learn as many arts as you can, like playing an instrument, how to use chiaroscuro, how to make pro photography, direct movies, make computer games and cool graphics, run your own businesses, be amongst top students of your universities, be very tall, have a nice personality with very firm boundaries, go deep into conversations with girls then eject to avoid boredom on both sides, be surprising, don't be needy, nerdy, geeky, abrasive or inept, have a sister that tries to break your frame since you were child but was never successful, have a vision you follow and push for a better world, learn at least 6 foreign languages, travel around the world, be fit, be able to tell off declining people with perceived power over you when they behave like retards in front of everyone etc. Have fun! :-P

<comment><USER4>
      > if I wrote a blog about my experiences I'd become a laughing stock of the Internet

      So write a blog post on what lead you to such abundance :)

OK, so I officially admit to being a naive fool, as apparently somebody downvoted even that.

> go deep into conversations with girls then eject to avoid boredom on both > sides

That's a big mindfuck for attractive girls used to needy guys like this Google manager desperately hitting on them whether it's fun or not. You may want to cut them some slack if they go crazy after _that_ :) Generally, I think I found Strauss' _The Game_ quite enlightening in this regard. It shows kinds of bullshit and drama I'd never realized that women are going through.

</comment></comment></comment></comment><comment><USER31> Office environments today are like minefields. A man never knows when his next step, word, or simple action will be misconstrued as harassment.

Hold a door? Thats harassment.

Wink ;-) in an email or IM? Thats harassment.

Tell an off-color joke? Thats harassment.

Complement female coworkers outfit? Thats harassment.

Stand too close in an elevator or inline at the canteen? Thats harassment.

Getting caught looking looking at a female coworkers boobs? Thats harassment.

The problem is that at the end of the day it is all up to how that female employee "feels." If she is especially sensitive, then everyone around her has to walk on eggshells.

Why can't anyone have a sense of humor about any of this?

I think I'm going to watch 9 to 5 with Dolly Parton tonight, just to remember a time when people had a sense of humor about dealing with toxic office culture.

<comment><USER32> Come on, that is bullshit. Simply, don't go out of your way to be an asshole. Genuine compliments are fine. Leering is wrong. Sexually suggestive comments or winks in emails are wrong. Don't treat anyone as a lesser form of life. This is so fucking simple and it makes for a better work environment for all.

<comment><USER27> So what are you supposed to do if you are attracted to someone at work, never make a move? Women need to be more forgiving and take it as a compliment, unless someone continues after a clear rejection (which is the definition of harassment).

<comment><USER33> You do not need a "clear rejection" to make something harassment. If I've never spoken to someone but I spend ten minutes a day staring at her chest, that's harassment.

If I ask someone out, they say yes, and keep rescheduling 100 times, me continuing to ask them out and not take the (subtle, non-obvious) hint is still harassment.

<comment><USER27> Looking at someone is harassment now? I must have harassed hundreds of women then, What about thinking about them?

<comment><USER33> If you are leering at someone day in and day out that is harassment. Is that really a difficult point to understand?

I'm not talking about a glance because a woman is wearing a new shirt. That's not harassment, nobody ever said it was, and asserting otherwise is a straw man. But ogling the hot girl every day _is_.

<comment><USER27> Only if it's someone you aren't interested in, if a hot guy you liked made eye contact a few times and smiled it would make your day. Am I right?

<comment><USER33> Well I'm a married heterosexual man, so the universe of "hot guys I like" is pretty small.

And I don't know why you insist on continuing to argue against points I'm not making. I'm saying continued unwanted advances = harassment, regardless of the existence or lack of "clear rejection." If you flirt with someone at work (what exactly are you being paid to do?) and they reciprocate, it's not unwanted. If you do it once and they don't reciprocate, and you stop, it's not continued.

<comment><USER27> So it's not the act that's harassment, it's the relative level of attractiveness of the person committing the act. Interesting.

<comment><USER33> You are either being willfully ignorant or a troll (or both). Nowhere did I even intimate that attractiveness has anything to do with anything.

> _I 'm saying continued unwanted advances = harassment_

<comment><USER27> Reciprocation will be more likely if the person making the advance is more attractive relative to target of the advance. I'm sure there is a mathematical formula for this.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER34> How come the manager got away with just an apology?

</comment><comment><USER6> 1\. There's a lot of typical victim blaming, downplaying, and "why didn't she just ask him to stop" comments on this submission, and it saddens me. Many of the reactions here are a large part why so many women feel uncomfortable and unwelcome in tech.

2\. This is partially why HR exists. HR isn't just there to handle payroll. More people should do this, rather than let things fester or ignore things that should be reported.

<comment><USER35> Women should stand up and stop calling themselves victims.

</comment></comment><comment><USER36> HR ONLY EXISTS TO PROTECT THE COMPANY. They are not there for you or to support you or to even support the truth. They will almost always without fail support the manager over the IC. I feel like we shouldn't let people graduate college until they know this. It sucks, but it's the truth.

</comment><comment><USER37> She admits in that piece that she shouldn't have laughed at jokes that made her uncomfortable. So I suggest people/women keep themselves out of situations like this by being honest and upfront with their colleagues in the first place. If that doesn't work, go to HR. Simple as that.

</comment><comment><USER38> > In hindsight and with more experience, I now can say, "Yes, I shouldn't have > tolerated even a little bit of misogyny or mistreatment. I should've > immediately given him feedback that it made me feel extremely > uncomfortable." But regardless of my own reactions, the fact remains that > sexual harassment should never have happened in the first place.

Women don't(in some cases: don't want) to realise that they can send out misleading signals, which itself would not be an issue if they would clarify their limits when a man does something inappropriate.

Men might do something physical without any bad intentions and women might interpret them otherwise.

Here is how I see it:

If someone violates your intimate space, send a subtle signal that it's not okay: move away, turn away or do a grumpy cat impression.

If the person does not understand the subtle signal, use words.

If words fail, contact the authorities.

I'd wish we could move away from the one dimensional "males in tech are sexist" angle onto something more scientific. However, judging by the tile of the post, we are galaxies away from that.

<comment><USER39> > _Women don 't(in some cases: don't want) to realise that they can send out > misleading signals, which itself would not be an issue if they would clarify > their limits when a man does something inappropriate._

Sigh. This is nonsense.

Men don't, or don't want to, realize they frequently misinterpret so-called "signals", or don't pay attention to them at all. There's a sad truth that women _actually send signals men completely miss_ , while men _actually pick up signals that were never sent_.

A woman should never have to expend extra effort to clarify their limits when a man does something inappropriate. An easy way to guarantee this is to constantly be mindful of your actions and _never do anything inappropriate_.

General rule of thumb as a man: treat physical interactions with women in the workplace the same way you do other men in the workplace--inherently non- sexual. Second rule of thumb: all that sexual conversation you might be used to having with other men--don't do it with women.

It's for this reason that expecting the victim of unwanted behaviors to send subtle signals first is pretty silly. If we're going to suggest anything, let's not go with something subtle and ambiguous that is likely to be misunderstood and misinterpreted by the person who is already behaving inappropriately. Instead, let's opt for expecting something like this:

 _That 's fucking offensive. Don't ever fucking do that again. This is your only warning._

Pretty clear. Straight to the point. Pony up an apology, or admit that you're being a lecherous fuck.

Don't feel comfortable being direct? Go directly to HR.

Don't have HR? Give that "fuck off" directive a go. Worst case outcome? You realize this isn't the place for you and move on.

\---

> _Men might do something physical without any bad intentions and women might > interpret them otherwise._

Bullshit. Here are examples of "something physical without any bad intentions" that are pretty impossible for women to misinterpret:

\- high fives

\- fist bumps

\- shaking hands

\- a pat/slap on the upper back or shoulders to say good job

\- a light punch/slap to the arm in an obviously playful way (probably only best with well-known company that already trusts you)

Oh, and if you actually are paying attention and notice a woman recoil in any way from these types of interactions: make a mental note to not do that again. There's probably something in her past experiences that makes her uncomfortable with this, and it really doesn't put you out at all to remain mindful of that as you interact with her in the workplace.

Here are examples of "something physical" that cannot hide behind "no bad intentions":

\- touching a woman anywhere, in any way, not covered above

\- kissing a woman anywhere, in any way

\- asking a woman to sit on your lap

\- positioning yourself in such a way next to a woman that you intentionally make physical contact of an intimate sort

Why? _Because women can fucking tell when you 're making an advance_. And men cannot hide behind a silly schoolboy's defense of "mixed signals".

After almost 35 years of life as a heterosexual man who doesn't have much trouble with women, here are a few general rules and suggestions on how to handle interactions with women to ensure you don't ever "misread" signals. I'll give them in a half-assed order of importance.

General rules:

1\. Treat every woman with absolute respect as a person, not as a sex object, every time.

2\. Don't interpret or estimate your _probability-of-fucking_.

3\. Trust that women don't really ever play "hard to get". _Ever_.

4\. Trust that women will make it very clear when they're inviting you to increase physical intimacy.

5\. Understand that just because a woman smiles or is nice/polite/kind/open, doesn't mean she is saying, "I want to fuck you."

6\. If in doubt, _ask_ don't _act_.

General suggestions:

1\. Allow a woman to set the tone of physical intimacy. Reply in like kind.

It's really, really, _really_ easy to tell if a woman is physically/sexually/romantically interested in you as an adult. She will typically do more than simply "send signals". If a woman trusts you enough to touch you on the arm, it's probably okay to touch her arm. That doesn't mean it's okay to rub her arm. If she touches you on the leg, it's probably okay to touch her on the leg. But feel free to ask, cos there's no harm in that. She might be doing it subconsciously, and you'll be able to alert her to this without groping her leg and making her feel assaulted. If she's rubbing your arms and legs, that's a pretty unmistakable indication that she's feeling safe, trusting, and probably okay with you returning the same level of physical touch. But that doesn't mean you should grab her breasts and jam your tongue into her mouth.

At the club on the dance floor? Don't walk up and start grinding some woman with your junk. If the lady wants to grind, she'll make the move. And then she might want to go do the same on some other guy. C'est la vie. Why? _Because she 's often just out to have a good time, not find someone to go home with_. If she _is_ looking for someone to go home with, follow the directives above and you'll be certain to never find yourself the perpetrator of a sexual assault or harassing behavior.

2\. Just because you like feeling like a piece of meat, doesn't mean she does.

I have experienced, on more than a few occasions, a relatively unknown female coworker telling me I have a nice ass, or some other such physical attribute. Cool. Flattering. My response: laugh it off. I don't turn around and say, "Well, your ass is damn fine, too." Accept the compliment. For whatever reason, some women think it's okay to do that. And they can be the same women who would be offended if you did it to them. Big deal. That's how it is. They know when they're attractive, _because every fucking dude in the world tells them so_. Don't ever be that guy--unless you're actually in a relationship with her; then, by all means, tell her all the time. Just steer clear of making comments to a woman in the workplace about her appearance. 100% guaranteed success rate there.

3\. Physical intimacy doesn't belong in the workplace.

This one's pretty damn easy. Even when I've been in a serious relationship with a coworker, we never brought that into the workplace. There's no need to kiss in the office. Or have my girlfriend sit on my lap. Or touch her in an intimate spot. It's the fucking workplace. Treat it as such. All the more fun when you get home later. It can wait.

\---

I seriously cannot believe we're still having this conversation in 2016.

<comment><USER38> > Men don't, or don't want to, realize they frequently misinterpret so-called > "signals", or don't pay attention to them at all. There's a sad truth that > women actually send signals men completely miss,

The sad truth, is that (some) men are bad at receiving signals and (some) women are bad at sending them.

> while men actually pick up signals that were never sent.

Some women(and men) subconsciously send out signals that can be interpreted as an invitation, especially if we are talking about people from different cultures.

> After almost 35 years of life as a heterosexual man who doesn't have much > trouble with women, here are a few general rules and suggestions on how to > handle interactions with women to ensure you don't ever "misread" signals. > I'll give them in a half-assed order of importance.

Some people actually do have a problem with reading other people. There are a lot of them in tech.

> I seriously cannot believe we're still having this conversation in 2016.

Society is moving constantly and there are problems that will just never go away, because it's just hardwired to our monkey brain.

I am in no way excusing sexism and harassment, however I see that reality is more complicated than "men evil, women good".

If we go down the path of stigmatizing men and come up with more severe laws to punish them, the divide that caused this mess will only get bigger.

</comment></comment></comment><comment><USER27> A lot of time sexual harassment == someone i'm not attracted to flirting with me. If it was a 6 foot handsome guy then it would be highlight of the week.

</comment><comment><USER40> This problem happens in every industry, tourism and hospitality is full of these cases as far as I heard even by people I personally know.

The Silicon Valley situation is more visible for the simple reason that diversity is still a problem, so having so few girls makes this a huge problem and a barrier hard to overcome for women. I feel truly sorry for all the female colleagues having troubles with bosses and colleagues harassing or also bullying them (have you ever heard somebody saying: "she's a girl, let's give her this task b/c is very trivial").

<comment><USER41> >girls

You should start by referring to female workers in SV as women.

</comment></comment><comment><USER42> What an uplifting story. Sexual harassment is a serious problem affecting women all over the world. I'm glad that more and more people speak up.

<comment><USER43> If you think that women are somehow immune to this behaviour you are very naive. Stereotype of older women superior hitting on young men has not appeared from thin air.

<comment><USER42> From my wife's experience, older women superiors are way too busy making the professional life of younger women a living hell and they don't have much time and energy left to harass young men.

</comment></comment></comment><comment><USER44> >In that week, I was kissed on the cheek, asked to sit on my manager's lap... >Protect yourself and others. Report it to HR.

The correct response is to punch him in the face, defend your personal space with extreme prejudice.

<comment><USER45> I assume you're kidding but if you're not: you run the risk of being fired for physical assault, whether or not you're in the right.

In any case, as reported in the article, people in that situation are more likely to be paralysed by shock and doubt. A blunt, self-assured response in the moment is unlikely.

</comment></comment><comment><USER46> ew em

</comment><comment><USER47> > a company well-known for its "Do no evil" culture

This was their motto a decade back and what they are doing does not reflect it even remotely. I'm pretty sure they are not known for "do no evil" culture, just that the slogan is tied to them somehow.

<comment><USER48> That's not the slogan. It's "don't be evil."

"Don't do evil" is impossible for a corporation with 50k employees. "Don't be evil" is a worthy ideal to strive for.</comment></comment>


There is Nothing Wrong with Being Alone - <AUTHOR> http://whatblag.com/post/4197874796/there-is-nothing-wrong-with-being-alone <comment><USER2> _Every coaster someone moves, every chair that is dragged from the dining room into the living room, every minor adjustment is mentally noted. The second we say goodnight and close the door, I press the reset button—every little item goes back to what I consider its proper position._

That's going a lot further than merely being introverted. It sounds like OCPD. Is there anything wrong with that? Not really, unless it impedes on what you _want_ to do and get out of life. There's no need to justify it.

<comment><AUTHOR> I think perhaps I should rephrase that section to sound less extreme. It sounds like I'm sitting there with my eye-twitching, watching every little movement. While I do NOTICE minor changes, I shouldn't say that I notice them ALL, and I certainly do not fixate on them. I'm just the type of person that needs to clean up after someone leaves.

</comment></comment><comment><USER3> I suppose that's fine for you. However, I used to be the same way..and after years of this, I realized how many things in life that I missed.

You can't ever get that time or those experiences back. Once you are old, there is no rewind.

<comment><AUTHOR> I understand, but there are plenty of experiences I know I will enjoy with my girlfriend and a few close friends. I plan on traveling the world and seeing great works of art.</comment></comment>


IAmA Patent Examiner on reddit - <AUTHOR> http://www.reddit.com/r/Android/comments/ww982/iama_patent_examiner_i_want_to_answer_questions/ <comment><USER2> One of my biggest complaints about the current state of patents is that it reverses the process of innovation. I have not heard of anyone reading existing patents to get new ideas for software. Instead, we invariably _invent first_ , usually oblivious to the existence, or not, of relevant patents. Then we search (or are informed) that our new product falls within the scope of an existing patent and decide whether to license it or _iteratively re-invent_ to find a solution that does not infringe.

Consider the various compositions of linked lists that are patented (<http://www.google.com/patents/US7028023>), any of which would be casually "re-invented" by any competent developer. The USPTO should give the world more credit for "obviousness". I propose that the closure of established concepts under the algebra of established compositional operations shall be considered "obvious", in which case we can all go about applying those compositional operations without worrying about stumbling over patented combinations.

</comment><comment><USER3> Just had a browse through and although these particular patent examiners are obviously smart, software is not their area.

If you are looking for answers as to how some of the ridiculous patents manage to get through the patent office (including patents for software concepts that engineers are likely to consider "obvious" or for which there is likely "prior art"), you are unlikely to find the answers here.

<comment><USER4> I agree. While he is doing his best to answer the hard questions (instead of avoiding them outright), his answers are not very satisfactory. See this thread: [http://www.reddit.com/r/Android/comments/ww982/iama_patent_e...](http://www.reddit.com/r/Android/comments/ww982/iama_patent_examiner_i_want_to_answer_questions/c5h0r4x)

Whenever someone defends software patents, I bring up Amazon's one-click patent. It's so obvious! I use the one-click-checkout feature on Amazon all the time and dearly miss it on every other website out there. Imagine if Pizza Delivery sites or Flower Delivery sites had that feature. People would order things a lot more if they didn't have to go through extra screens to confirm things every single time. The funnel gets smaller as the number of steps rise. And now one company has a patent on short funnels.

<comment><USER5> I think he did a decent job answering. However, /r/Android is being needlessly confrontational and cynical.

For instance, this question from your linked thread: [http://www.reddit.com/r/Android/comments/ww982/iama_patent_e...](http://www.reddit.com/r/Android/comments/ww982/iama_patent_examiner_i_want_to_answer_questions/c5h21br?context=3) was answered satisfactory. There is a difference between

 _"a plurality of heuristic modules, wherein: each heuristic module corresponds to a respective area of search and employs a different, predetermined heuristic algorithm"_

and

 _"searching different sources of data wherein you search each with a method that makes sense for its contents"_

But the replies from random commenters and vote totals would have you believe the opposite.

<comment><USER6> I wonder how important the actual wording is vs what appears to be the intent on what the patent covers.

To me (and I know I'm simplifying just like the random commenters you speak of), the patent is _intended_ to cover 1. performing heuristic searches on multiple areas (modules) 2\. using a different search on each area

However, it uses the word "predetermined" when defining the heuristic algorithm to use for each area. If my code randomly picks between two slightly different heuristics (even with a very low probability), would it still be covered under the patent?

Also it says "heuristic algorithm" meaning singular algorithm. If I ran 2 algorithms in parallel (even one that always returns no results) and then chose the "better" of the two, would that get around the patent too?

Are patents vulnerable to this sort of work-around due to subtle interpretations of wording, or is it really the intent of the patent that matters?

<comment><USER7> How important is the wording: _You can't normally just claim an obvious extension without evidence. We have to provide prior art for every limitation in a claim, and every word must be considered within a claim._

It seem every last adjective counts.

 _"In order to jump to an obvious argument, you'd have to prove this device reads on all the limitations minus the unlock image that is slid. Then you'd have to show something else that uses an image to unlock something. Then you'd have to provide rationale why the combination between the two things would have been obvious at the time of the invention, in this case 2005."_

In other words, obviousness might seem, uh obvious as a defense for most this stuff. But actuality it's categorically dismissed with the "you can't prove it" argument. Plus the "but was it obvious in 2005, _with phone_!" (lovely to see those so-and-so's trying to wiggle out of that one but essentially coming back to it).

</comment></comment></comment></comment></comment><comment><USER8> If I read them correctly the whole business of deciding if something is obvious is seriously broken in that it seems to be limited to combining claims from existing patents. This, of course, isn't even close to what "obvious" means to those "skilled in the art".

I, like many others, have run across so many patents that should not have been issued at all. This isn't limited to software. There are examples across disciplines, like the guy who got a patent for running wires inside clothing to connect devices or the company that got several patents on using pulse- width-modulation to control the intensity of LEDs to mix colors or most software patents.

In hardware I have seen lots of patents that cover the exact same thing. I have seen patents for things that don't work. And, patents for things that I knew had been available or done prior to the filing date.

I call these "implementation" patents rather than true inventions. The term refers to the fact that a modern skilled engineer or team of engineers would be more than capable of coming up with that or a myriad of other implementations when given a problem to be solved. That's what engineering is all about. Many engineers across time and distance are able to solve similar problems and end-up with similar solutions. This is what we are trained to do. This is also the part of the human and other animals: the use of our brains to solve problems.

It seems that the patent system ought to be reformed in such a way that the rules recognize who we are, what we are taught, what we do, what we are capable of and, in general, the fact of knowledge acceleration.

Today it should be exceedingly hard to receive a patent on just about anything. Patents should be reserved for true invention and not implementation. Today's environment is such that there's so much distributed knowledge across so many disciplines that most "inventions" that are patented are really cases of someone choosing a solution to a problem (not inventing one) and then hiring an attorney to try and monopolize it. Case in point: The Apple "slide to unlock" patent. Someone chose that solution from available knowledge. No sane person would suggest that this qualifies as an invention by any possible imaginative stretch. This was a UI decision that the lawyers at Apple got a patent for. They got a patent for, effectively, the analog of a mechanical slide switch made to look nice, nothing less. Not an invention, but they have a patent to say otherwise.

I am not against patents. I am against the granting of patents for non- inventions. Today the granting of a patent should almost be so rare as to make national news. Just a few per year. In fact, they should be rarer and rarer with time, to the point that those granted the few patents that should make it through the system per year would be invited to the White House to receive a Presidential Innovation award or some such thing.

It only stands to reason that, as technology advances, there will be less and less true inventions per year. Part of the problem was alluded to on the reddit thread: the USPTO makes money and Washington takes it away. Fix that and you might just fix the system.

Maybe the patent review process should be open to anyone. Yes, your competitors, anywhere in the world, get to examine and weigh-in. If an invention passes such a test it is probably deserving of a monopoly for twenty years. This also means that someone will really think hard before spilling all the beans in front of the entire world. Only a true invention, where other engineers go "This guy deserves a patent for this!" should be granted patents. And rightly so.

<comment><USER9> "If I read them correctly the whole business of deciding if something is obvious is seriously broken in that it seems to be limited to combining claims from existing patents."

Obviousness is not based on existing patents only. It is based on anything that is published before the relevant date. Thus, examiners should and sometimes do use all kinds of different publications to determine obviousness. But the problem is that the patent office is accustomed to do prior art searches based on existing patents. Thus, internally the PTO is set up to favor prior art searches based on patents rather than other publications. This generally makes sense for other slower moving fields of technology (e.g. mechanical devices, farming equipment, etc.) or for fields where everything gets immediately patented (biotech) but it makes no sense in software.

Another problem is that software was considered generally unpatentable until a landmark supreme court case in 1995. At that time people started filing for software patents and the patent office was generally set up to mostly use patents as prior art searches. Well, there were no software patents then, because software was not patentable until then. The unsurprising result was that a lot of very obvious software patents got through.

Thus, my pet theory on software patents is that there is nothing inherently wrong with them, they were just not correctly administered by the PTO. If the USPTO hires proper competent computer scientists as examiners and encourages the searching of all available prior art, then we would get much fewer and much higher quality software patents.

And I do agree with your idea of opening the review process. The pto is trying to make tepid steps in that direction but they are obviously scared of a flood of comments that may happen if they open up the gates and them having to pay examiners to evaluate every single comment from every crazy person on the net.

<comment><USER2> Journal editors don't have time to personally review every submitted manuscript, yet that peer review process is relatively successful. Journals generally do not compensate reviewers (though I have been compensated for reviewing book proposals---in the form of my choice of free book from the publisher). In any case, what if the patent examiner selected a small number of experts in the _specific_ field and sent the proposal out for review, along with some compensation for quality reviews (positive or negative). A senior USPTO examiner makes on the order of $100k/year (<http://usptocareers.gov/Pages/Misc/SalaryRates.aspx>) and spends 1-3 days reviewing each application. After overhead, that's more than $500-$1500 in personnel expenses per patent. What if, after an initial filter, the application was sent to three experts at $200 each. It seems like this could keep the costs similar to what they are now, but dramatically reduced the number of false negatives for prior art.</comment></comment></comment>