iPhone app has  been "in review" for over 60 days - <AUTHOR>

I have an iPad app which has been reviewed for 60 days and still no message came from Apple.
I have called Apple twice, I have also tried to requesting expediting review.  Still, didn't get any explanation(not the case of "require additional review time"),  my app just sit there for 60 days.
this app is an iPad version of my iPhone app, which has been completely designed to fit iPad.   the iPhone version has already updated twice. while the iPad version just sit there and waiting for Apple to review.
Does anyone has the similar experience? Should I reject this build and submit a new one?
screenshots can be seen here: https://twitter.com/springrider/status/232344807526248449 <comment><USER2> This could be related to the new iPad mini and modified new iPad launch alongside the iPhone. I suspect that Apple is expediting review of updated applications to take advantage of new unannounced features in the next iteration of the iDevices.

</comment><comment><USER3> "Serving at the pleasure of the King" is an expression all iOS developers should be extremely familiar with.

<comment><AUTHOR> yeah that's true, has been iDev for 3 years but didn't expect to serve this far....</comment></comment>


Natalie Haynes Stands Up for the Classics – QED 2015 - <AUTHOR> https://www.youtube.com/watch?v=PxSzirZ9rR8 <comment><AUTHOR> youtube description:

"Natalie Haynes is a comedian, author and humanist whose appearance at QED 2013 was noted by many as their highlight of the event. She's a regular contributor to the Guardian and has written for The Times and The Independent. Before retiring from stand-up comedy in 2009, Natalie became the first female nominee for the Perrier Best Newcomer Award at the Edinburgh Fringe Festival. Her 2014 novel 'The Amber Fury' served as a fiction-based follow-up to her previous non-fiction book 'The Ancient Guide to Modern Life' – exploring the lessons the modern world can learn from classical societies."</comment>


Ask HN: Would you buy a Pomodoro/personal timer that connects to your PC/device? - <AUTHOR> Hello HN,<p>I am a fan and practitioner of interval work / the Pomodoro technique. I have used various programs and physical timers that help with this, but I have never seen the two work together. I'm thinking about building a timer that can connect to your computer and/or phone but wanted to see if others think this would be useful. Would you consider buying such a thing? If so what features would you want? <comment><USER2> No. I've a small computer in my hand which is highly programable and very likely there are several apps in the store for such functionality. Having to carry a special hardware doesn't sound enticing.</comment>


Ask HN: Does anyone else do what I do? - <AUTHOR>

I don't particularly like the work I do at my job.  Don't get me wrong, great people, smart people, and much to learn, but the work is not interesting at all.
So when I get home at night, I stay up and work on my own little projects here and there, just so I can remember that programming is a bunch of fun.
Anyone else doing/have done that?
-mohsen <comment><USER2> I used to do that.

The difficulty with this state of affairs is that the work you do at your job begins to become a [time+motivation+energy] sink, and you often find yourself wishing that you could devote more of yourself to your pet projects.

This in turn affects your performance at work, giving you a perpetually negative loop that's broken when you shift jobs.

There are very few excuses, I think, to not find good work these days. Pay with personal circumstances is the only I can think of - if you have a family with enough children to make accepting lower pay for better an impossible decision, for example.

I beleive that you have just this life to live. Make the most of it.

<comment><USER3> I'm stuck in this loop. At work all I can think about is getting home and having fun or doing "real" work.

Not all areas are flooded with good jobs, and mine isn't one of them. I've interviewed with a few companies that didn't hire me, and the process of interviewing takes such a toll - mostly emotionally, but also several hour+ long phone calls, and a whole day off to interview, a few nights spent on code samples... I'm reluctant to do it again. Especially when my job is "not that bad" and it's hard to get a clear signal on just how great any other potential job might be.

Also, pursuing my side projects is something I want to continue.

</comment></comment><comment><USER4> I think you'll find a pretty large majority of HNers do that, either just for fun, or in the hope of eventually building a business out of their little projects.

I work for a large game developer by day, and by night I go home and write my own open-source game engine, as it lets me learn what I need to learn. It's very hard to experiment with new techniques at work, but it's important to my skill development. Also the codebase at work is so horrible, that working with a nice, concise C codebase in the evenings is positively pleasant by comparison.

</comment><comment><USER5> Sometimes I get so frustrated with whatever I'm working on, that I start thinking about how nice it would be to quit programming and become a farmer or a builder.

Soon after that, I solve a little personal problem by coding the solution, or I discover a cool new tool, or I fix a little bug in an application I use, even if it's written in a language I'm not familiar with.

At which point, I remember that I'm never going to quit programming because it's so damn useful. And it can be fun too, if you work on the right things. Even if I go on to be a farmer, I'll still solve the odd problem by programming the solution. And I'll always have an appreciation of simplicity, bestowed upon me through endless nights of working against stupid, complicated technology.

<comment><USER6> I second the farmer path.

If I had some land and the skills to make it viable to live off of it, then I would. That solves most of my life debt since I'm fairly ascetic.

<comment><USER5> I am looking for a cofounder for an open source farm startup.

Mostly kidding, though if anyone is intrigued by such ideas, feel free to contact me.

<comment><AUTHOR> what do you have in mind?

</comment></comment></comment></comment><comment><USER7> I do. However, not because I'm unhappy with what I do at work (I'm completely statisfied). It's just that I love to tinker, so I continue to do that even when I get home.

</comment><comment><USER8> Same boat buddy. But I find the day job to be such an energy sink, that by the time I'm home I don't have enough mental energy to really code much.

<comment><AUTHOR> Same here, but you can't let them take your soul, just drink a cup of coffee and get to work. Any idea would be good, because it's your idea.</comment></comment>


'Colossus' a 1,100-pound robot helped extinguish Notre Dame fire spots - <AUTHOR> https://www.washingtonpost.com/technology/2019/04/17/firefighters-had-secret-weapon-when-notre-dame-caught-fire-robot-named-colossus/ <comment><USER2> Robots and drones should likely become effective tools in firefighting. Just having the ability to get reconnaissance with different kind of sensors should be really valuable.

<comment><USER3> One sensor I can imagine is of utmost value in an emergency response robot (besides for temperature and visibility) would be for detecting electrical currents on the wet surfaces through its caterpillar tracks before human firefighters enter the area.

I don't know how many firefighters get a jolt before the electrical mains is shut down, but I bet it is something that crosses their mind once or twice when the water begins to flow.</comment></comment>


Hey advertisers, track this - <AUTHOR> https://blog.mozilla.org/firefox/hey-advertisers-track-this/ <comment><USER4> Not paying for content (small games, blogs, vlogs, journalism, code, etc..) in the last 20 years, is now one of my biggest regrets. I remember back then I even had a small addon that was constantly showing me ads and I was getting money for doing nothing, I thought it was nothing.

Now we have to suffer fake content, incredibly well researched click-baits, short term conversion optimized (good trailer, bad content) media and of course tracking to incredible extend. Every single machine learning algorithm trying to push us to more extreme world views so we stay on the platform to consume more contend and see more ads.

Every time my young daughter is watching youtube, I can see how what it is recommending and how easy it is to manipulate her. Few weeks ago it hit me, that I sold her mind, because I did not pay, and now everything is beyond repair.

PS: I just finished listening a great reading of 1984 ([https://www.youtube.com/watch?v=wM3GFyuJwQ8](https://www.youtube.com/watch?v=wM3GFyuJwQ8)) and am in very dark place. /

<comment><USER5> We suffer that garbage not because people like you and me did not think of _money_ as reward for other people's projects but because of advertising, tracking and click counts.

There is absolutely nothing wrong with publishing things for free, doing things for free and consuming things for free. The best content on the web is done by people from their own interest in sharing. Personal contacts, exchange of information, feedback and community are so much more worth than money when it comes to motivating the production of _good_ things.

<comment><USER6> Also paying for things has a low success rate in reducing advertising - <USER2> customer who will pay for something is a good target to advertise more too.

<comment><USER7> Paywalls are a great alternative to intrusive ads for a larger publisher. NYT has been doing very well the last couple of years on their digital subscription model.

[https://www.nytimes.com/2018/11/01/business/media/new- york-t...](https://www.nytimes.com/2018/11/01/business/media/new-york-times- earnings-subscribers.html)

<comment><USER8> Your point _may_ be valid, but the NYT is a poor example of paywalls as an alternative to intrusive ads.

I'm a paying subscriber to the NYT. When I open their homepage now, the page is split horizontally with an ad taking up about 40%-50% of the entire screen. The "The New York Times" header is about halfway down the page, and the first actual content probably starts at 85% or even below that.

Anecdotally, the NYT runs even more intrusive ads than this to paid subscribers. Off the top of my head, I would say their modal popup video ad is the worst.

<comment><USER9> For the past few days I've also been unable to read articles on the NYT app without the page jumping around to load ads as I scroll. And I'm a subscriber to boot. I've a Pihole on the network and it still isn't a tolerable experience.

</comment></comment></comment></comment></comment></comment><comment><USER10> `[https://trackthis.link/`](https://trackthis.link/`) requests `[https://www.google-analytics.com/analytics.js`](https://www.google- analytics.com/analytics.js`) on page load.

Which, besides being a bad idea for privacy on any site, makes much of this particular site's ostensible purpose even easier to defeat.

<comment><USER11> See [https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14](https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14)

Mozilla has a contract which prohibits Google from using data from Mozilla websites for the things people usually object to.

<comment><USER12> What incentive did Google have to agree to such a contract?

<comment><USER13> Maybe they knew it would undermine any anti-Google privacy stance Mozilla would later take when people noticed GA's inclusion in various Mozilla pages

</comment></comment></comment></comment><comment><USER14> On a sad note, I couldn't stop myself thinking "this «doomsday» profile may be a bit dangerous to run, it could get you on some nasty lists" and wouldn't dare to run it. Shows how bad the chilling effect has become…

<comment><USER15> So what if you're on a list?

I ran a Tor exit node on my home static IP for years. No dramas.

<comment><USER16> Anecdotal

<comment><USER17> Yup; the grandparent is likely on a List already for being involved in child pornograpy and such (inadvertently, but you know that's a big part of what TOR is used for).

<comment><USER18> > but you know that's a big part of what TOR is used for

Citation needed please.

That's the juicier stuff that makes its way into the news. "A person living under an oppressive government evading censorship" will never be as juicy to write about as "murderers for hire on the dark web". That says absolutely nothing about the actual usage of Tor, so I'd like to see you back up that "big part" part.

<comment><USER19> This is the media doing their job. You don't listen on news about how a great chef used her knife to slice a piece of meat, but you do when someone uses one to slice another person. We need to be aware of misuses of tools in other to weed out bad actors, leaving the legitimate uses in place.

<comment><USER18> I agree, I just disagree with the generalization based off of those news. Tor is a tool and as such can be used for both good and bad.

It bothers me when people draw badly considered conclusions from them, such as claiming that "most" or a "big part" of Tor is dedicated to illegal activities. The percentage is probably greater than on the "normal" web, but I object to the stronger claims than that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> I suspect the comments here are largely missing the point.

IMHO, Mozilla isn't offering "Track THIS" as a solution to being tracked, instead it's a demo of how tailored one's ads are, so one will be offended enough to turn off 3rd party cookies.

<comment><USER21> I think it may backfire. In my opinion, the dangers of "tracking" and "customization" are dramatically overblown and I suspect the average user has a much more sinister idea of what it all means than the reality.

Some people are going to try this demo and realize "Huh, so 'surveillance capitalism' really just means that I see better ads?"

Most non-technical people have this dystopian illusion when they hear about all of Facebook/Google/Amazon's fabled super-advanced-magic-tracking that there's either a human or a near-sentient robot listening in to every facet of their lives and forming a judgmental, human opinion of them as a person. Once they realize this shit is so basic that opening up a few browser tabs of stuff you don't actually like is enough to trick it, I think their apathy will increase, not decrease.

<comment><USER22> Anecdotally, I had to explain to a family member recently how they got Twitter ads for an event they dropped a friend off at, even though they didn't personally search for or attend the event. They were confused by how this happened, and they knew I was the weird privacy person in the family to ask.

They proposed the simple, obvious solution: "Twitter is listening to my microphone."

I countered with, "No, Twitter knows you're friends with this person, and because they have access to both of your location data, they know you were visiting this person at the same time that they searched for and went to this event."

My family member said that my explanation didn't make them feel any better, at all, and then deleted Twitter off of their phone.

I don't know if that person is typical or not, but I will say that when you see something yourself it can sometimes make you feel more vulnerable and disturbed than when you hear about it second hand. Tracking is so ubiquitous that there's kind of an abstract, "but really it's not so bad" quality to it. People joke about the super-advanced-magic-tracking, but they don't really believe it on an emotional level. Or they believe it's super competent and dehumanized and subtle.

I think projects like this have the _potential_ to maybe make it feel more tangible. Hyper-advanced systems feel more theoretical and less dangerous than, "hey, I'm literally just watching you browse the web." In my (again anecdotal) experience, magical systems are dismissable, but people get worked up over, "somebody's looking in my window."

<comment><USER23> There's a whole Reply All podcast episode where one of the hosts tried convincing listeners that Facebook wasn't listening to their microphones.

It goes to show that people aren't too aware of just how much data Facebook/tech has about them, and occasionally that data can make extremely accurate predictions.

[https://gimletmedia.com/shows/reply- all/z3hlwr/](https://gimletmedia.com/shows/reply-all/z3hlwr/)

</comment></comment></comment></comment><comment><USER24> Seems a bit like the AdNauseam project, except more refined because it allows the user to select a profile.

[https://adnauseam.io/](https://adnauseam.io/)

</comment><comment><USER25> There are companies such as Forensiq [0] and a few others I can't quite recall now that work to fight ad fraud.

[0]: [https://impact.com/ad-fraud-detection/](https://impact.com/ad-fraud- detection/)

Believe me, there are many players in this space that work tirelessly to compromise mobiles and try to emulate real users to earn profits on PPC campaigns.

So honestly, this is just a waste of time. Whatever patterns these guys come up with. It'll be defeated by those to fight the real bad guys.

<comment><USER26> Well that's rather defeatist. Its also not correct.

I've done a lot of work in data linking, which I consider basically the same thing, albeit not with advertising or ad fraud as the necessary subject matter.

Now while its true that a lot of the things people do to lessen their fingerprint/signal is often not effective, its simply not true that such things are always a priori defeatable.

Theoretically, you have to do some combination of plugging the leaks, increasing the noise, or dropping the signal. And if you do that then signal becomes harder and harder to extract.

And its not even black and white like total win/lose. You could stop advertisers from finding out certain things, or change the relative value/cost of what's possible/profitable, or the degree of accuracy with which they can state certain things.

Indeed, for instance, if you can get regular people's actions and behaviours to look more and more like these bots or fraudsters, that likely lessens the effectiveness of their machine learning techniques...

</comment></comment><comment><USER14> THIS is the Mozilla I like ! Impertinent, guerilla, middle finger giving !

<comment><USER27> Linus Torvalds: "Nvidia, Fuck You!"

Just like this!

</comment></comment><comment><USER28> I never understood why advertisers insist on giving me "relevant" ads. I find it better if the ads are diverse and all over the place, as I discover new things. The "relevant" ads are usually about stuff I just bought, so useless to me.

I find this site insightful in terms of discovering new things. It could be made into some sort of tumbler for ads. :)

<comment><USER29> Because there are people who buy more than one of something.

Buy a widget - you might be purchasing for a company and will buy a the same widget next month for the next employee. If you advertise your widget to everybody 99.999% won't buy it, so that 99.9% that won't buy another widget is a much larger margin of those who will buy another. (the ad is about either keeping you a loyal customer or getting to to switch to a different brand). Most of us are more valuable as a possibly purchaser of more than one than as a potential customer of something new we didn't even know we needed.

<comment><USER30> I read a related claim about this. People that just bought an, e.g. refrigerator, are much more likely than others to buy a second one soon as they're more likely to _need_ a new refrigerator and even the small chance that the one they just bought doesn't work or isn't satisfactory means there's a much greater chance they'll need or want to buy a second one than that other people will want to buy one.

I could imagine buying a mattress would be an even better example.

</comment></comment></comment><comment><USER31> It would be nice to see what sites it is going to open. And maybe worth mentioning you can use Container Tab (or maybe even anonymous window) to test/verify this without compromising your real fondly crafted advertising profile.

</comment><comment><USER10> Since before Netscape originally jumpstarted the Web user tracking and profiling surveillance industry, we already knew that one of the big categories of risk of such databases is being penalized for inaccurate information (and being unable to correct it, or even know it's there).

Think twice before you take a poo in your own profiles.

If you want to poison your profile _without it backfiring on you_ , you might want to wait until pretty much all profiles are poisoned simultaneously.

<comment><USER32> What can they do, display the wrong products? Oh, the horror...

I would certainly like to poison my profile. Preferably with all the kinky stuff.

<comment><USER10> The pervasive intimate surveillance is a grave matter. These profiles do and will affect you in many more ways. "Tt's about showing you ads that are relevant" has been an industry PR lie for a long time.

<comment><USER32> I agree that it is a grave matter which many people take far too lightly. But I also refuse to be scared by some junkie advertisers. And currently we at least are still talking about mainly pseudo-anonymous profiles. Filling this data with wrong info takes away most of the value.

</comment></comment></comment></comment><comment><USER33> _" WARNING! THIS WILL OPEN 100+ TABS IN YOUR BROWSER. BE PREPARED!"_

I'm on a full fat iMac Pro and that's still going to be a big fat "nope" from me :-D

<comment><USER34> See, if you had the new monitor stand, it would be engineered to handle the weight of a hundred tabs on screen. People don't think about these power user use cases when they pooh-pooh Apple's hardware.

/ducks

<comment><USER33> Ha! It's not even the hardware I'm worried about. It's Chrome ;-)

<comment><USER35> That's why they use anodized aluminum!

</comment></comment></comment></comment><comment><USER36> While this looks and feels fun, I also felt so bad - it's such a huge waste of energy, computing resources and bandwith.

<comment><USER37> One could say the same for the ads industry.

<comment><USER38> The ad industry has a higher stake. What they do pays their mortgages/medical/college bills.

When you fight someone who has more to loose, it usually is a waste of energy. If you want them to change you have to reduce the stakes for them.

<comment><USER39> > If you want them to change you have to reduce the stakes for them.

Why? It just has to become unprofitable for them to look for something else. They will adjust their stakes accordingly (are you proposing getting them a different source of income? wouldn't someone greedy just accept both?).

</comment></comment></comment></comment><comment><USER40> "Track THIS will open A LOT of tabs. 100 tabs is a lot."

Hah, funny. Maybe on Chromium, where it would already go into swapping hell on my 8GB RAM. However, on Firefox this is rather low - I'm on ~150 right now and that's just because I have cleaned all open tabs a few days ago (it was above 1000 before).

<comment><USER41> How do you use 1,000 tabs?

<comment><USER40> With tabs on the side. Some of them are clearly forgotten, waiting for the next whole-window-cleanup, but there are groups of tabs I revisit.

Some people organize their tabs into trees; there was also "panorama" feature in the past; however, for me it seems like a scrollbar (with a filtering search bar) is enough.

Also, the awesomebar itself has excellent support for switching between open tabs.

<comment><USER41> I use Tree Style Tab in firefox, I still just can't imagine how 1,000 tabs is usable. How do you organize it? How do you find anything? Why not just google search for it again?

<comment><USER40> Do I have to? Most of the time they're invisible behind the scrollbar. When I need something not visible, it shows up in search.

Sometimes I only have a vague recollection of what I want to revisit - <USER3> just figuring out something that was near it is enough, as after searching and activating some related tab its whole surroundings are now in view again.

</comment></comment></comment></comment></comment><comment><USER42> I wonder how many of those tabs are affiliate links?

<comment><USER43> I looked at the source code and indeed they put referrer IDs to the amazon links. It's even a dedicated ID for each link, to see the number of purchases for each link. So mozilla is taking part in the tracking.

<comment><USER44> Do you know it's their IDs and not some of the Amazon Smile charities?

<comment><USER43> the smile links look different, burt I am not entirely sure about the referrer IDs.

They look like:

\- fsclp_pl_dp_12

\- fsclp_pl_dp_11

with each link having a distinct number, counting down to 1.

It doesn't look like a typical referrer ID, so it is probably something that Amazon generates, although I don't know under what condition.

</comment></comment></comment></comment><comment><USER45> I don't think this does what you think it does.

This confuses the algorithms temporarily into thinking that your tastes have changed.

They still know who you are. Your devices and browsers are fingerprinted. Your home network is in a database. Your mobile carrier is selling your location data. Your IP address doesn't change that often. Etc.

Plus, you know there are already multiple teams tasked with filtering out "fake clicks". They probably are already doing it, assuming that multiple users are sharing a machine or something like that.

</comment><comment><USER43> I think it would be more constructive it Firefox would include a better visualization of the extend of web tracking.

Mozilla had already tried something like this with an extension, it's called "Firefox Lightbeam".

With the next Firefox version, statistics about the number of trackers blocked will be included in Firefox, and I think a better version of Lightbeam (more lightweight, visually showing the difference between tracking protection on/off and excluding subdomains) should be included as well.

</comment><comment><USER12> Couldn't a burst of unusual activity like this be easily detected? Then again, advertisers probably don't go the extra mile to cover the 1% that's using this tool...

<comment><USER46> More like 0.00001%.

</comment></comment><comment><USER47> Of course this works but won't solve the root cause and won't be applicable to the real world in which tracking also becomes more present. For the time being an ad blocker seems more useful, also I'd be happy to still use certain features of my browser like the history function. ;)

Also I think there is anyway a trend towards less ads. Those who push out most ads - probably online magazines - are changing more to paid subscriptions.

</comment><comment><USER48> > _This will show you ads for products you might not be interested in at all_

You can just say, "your regular browsing experience won't be impacted."

</comment><comment><USER49> Please let us know what links you're going to open.

</comment><comment><USER50> I feel by doing this, ad makers will create more aggressive tactics to fingerprint users

<comment><USER51> Yes yes, best not to fight back, they say the struggle will only make things worse.

</comment></comment><comment><USER52> LOL, ran it in private window. We have a single outward facing office IP address, and a few tabs were for things like bras and lingerie, so I'm now waiting to see if it affected others on the office network!

<comment><USER43> IP tracking is fairly uncommon, no?

<comment><USER53> Nope, widespread. Try looking at the YouTube frontpage when in a foreign WiFi...

<comment><USER54> While tracking is uncommon, using it for language / geolocation is not.

</comment></comment></comment></comment><comment><USER55> The problem with this is that I picked the "Prepper" profile, and then it just opened a bunch of pages with cool outdoor gear that I kind of wanted. Upside hopefully now I get ads for REI I guess?

</comment><comment><USER56> I like the hypebeast guy wearing a "Superior" t-shirt.

<comment><USER57> Actually I'd buy a t-shirt with this URL (or a QR code for the URL) in a heartbeat. Subversive t-shirts are a way to take your part in trying to change the world for the better.

<comment><USER58> Nothing says 'fuck capitalism' like buying a shirt from a company who uses sweatshop child labor in a third world country to spew out product so bad that it will end up in a landfill in six months.

</comment></comment></comment><comment><USER59> I would like to block Canvas Extraction, but it seems to allow it on every website I visit, and I have to click on the icon in the address bar and turn it off.. late.

</comment><comment><USER60> Is it broken? I tried it out and it only opened up 2 tabs to random news articles..

EDIT: nevermind, you have to go back and visit the Track This tab to have it open up more tabs.

</comment><comment><USER61> Is there a simple solution to automatically clear cookies when a tab is closed, similar to closing a private mode browser?

<comment><USER62> The closest thing I know is Firefox Focus, but I think it's mobile only.

</comment></comment><comment><USER63> I'm really afraid to click one of those links on mobile. Does it just spawn 100 new tabs?

<comment><USER64> it says: "It looks like you're visiting Track This on your phone. Please use Desktop to activate your persona. Trust us, you don't really want to open 100 tabs on from your phone in any case."

<comment><USER65> Where's the fun in having the number of open tabs visible instead of just ':D'? I honestly can't remember the last time that was the case on my phone.

<comment><USER66> I smiled the first time I saw it.

</comment></comment></comment></comment><comment><USER67> Mozilla is on fire lately, this is Trump level trolling & I love it</comment>


Ask HN: What is the right title for a Lead Engineer? - <AUTHOR> I'm updating my Resume and I can't figure out the standard title for a Tech lead. Should I say<p>- Software Engineering Lead<p>- Lead Engineer<p>- Engineering Lead<p>- Tech Lead <comment><USER2> Of those listed I'd choose "Software Engineering Lead" because there are many types of engineering and also using "Engineering" rather than "Engineer" is a hedge for those without degree for engineers. We had a similar discussion for how to title open positions.

</comment><comment><USER3> There's no standard afaik, similar to software development vs software engineering. As a reader it would be important to mention if engineering included IT (were you responsible for the office wifi router for example) and team size.

In Germany the equivalent "Leiter" is defined and requires the person to have autonomy over budget and team hiring decisions for example. More like a director. So it's less likely in a startup environment to have that job title. What do startups do? They simply use the english title ;)</comment>


OPM now says more than five million fingerprints compromised in breaches - <AUTHOR> https://www.washingtonpost.com/news/the-switch/wp/2015/09/23/opm-now-says-more-than-five-million-fingerprints-compromised-in-breaches/ <comment><USER2> Oh boy, this is going to kneecap CIA HUMINT ops overseas for many years to come.

Consider: you can't repudiate your fingerprints. So all the Chinese or Russian authorities need to do is to look for these fingerprints on folks entering the country and they can identify anyone with a US security clearance -- and in particular look for the other characteristics indicative of a CIA or other human intelligence operative. Such as, oh, a set of prints matching someone with a US security clearance attached to an authentic but definitely-not-in- the-same-name passport.

Spies are going to be _so_ much a thing of the past ...

<comment><USER3> This is bad but not so bad for CIA HUMINT. Most* human source handlers, at least from what I've read, work under Official Cover. That is, they work at the embassy under their real name. This way if they get caught they have diplomatic immunity and can't be charged as spies.

Foreign governments know that people that work at the embassy are often spies and generally the know which ones are spies (used to be the case that the passport officer was almost always a spy).

Not that this won't hurt, but it won't be a death blow. The real danger comes from the fact that handlers, and more importantly their superiors, are vulnerable to blackmail because OPM stored VERY personal information (affairs, drug addictions, etc...).

* CIA does have Non-Official Cover personel (NOC), this will hurt them more. Then again fingerprint readers are not impossible to fool and even before the OPM hack NOCs were facing increasing exposure risk due to biometrics.

<comment><USER4>
        > Foreign governments know that people that work at the
        > embassy are often spies

That's not true. Perhaps you meant: "there are often people working at the embassy who are spies".

<comment><USER5> OPs usage is conversationally common and understandable. No need to break out the ruler, professor.

</comment></comment></comment></comment><comment><USER6> If you're going to use something that is permanent and unchangeable for authentication (which is itself dumb), wouldn't it make sense to store one way hashes rather than the fingerprints themselves? There are multiple layers of idiocy at work here.

<comment><USER7> Does that really help? Unless the hashing algorithm is also a secret, an attacker with the full database of fingerprint hashes would still be able to take a random fingerprint, hash it, and then see if they have any OPM records -- isn't that the main threat scenario here?

I guess it would make it harder for an attacker to manufacture and plant false fingerprints?

<comment><USER8> That's where salt idea comes in. Even if you know the hashing algorithm and the key, you still need to rehash it for every single entry in your database to check if you have a match.

That assumes you can get a consistent description of a fingerprint though, or have some scheme for fuzzy match with hashing. Now I want to find a paper on this...

</comment></comment></comment><comment><USER9> So, does FIPS-201 now need to ban fingerprints for government facilities?

[http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf](http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf)

</comment><comment><USER10> Somewhat related: I've heard that devices with fingerprint access control are designed such that software can't get the fingerprints out; the fingerprint reader is a self-contained black box. If I wanted to verify this, how would I?

<comment><USER11> You don't.

I worked at a place with biometric hand geometry scanners, same deal pretty much. Technically it was two black boxes, the dumb reader couldn't open doors directly and supposedly stored no data locally in case someone smashed and stole it, or smashed and shorted the control wires (I believe it was RS-485 line level protocol WRT wiring) and a black box inside the secured area that contained our biometric hash data, logs, and a normally closed relay that could toggle and unlock the door when it felt like it.

Anyway if the protocol and connection between the two black boxes could be monitored without breaking the DMCA, then you could verify the box outside does hashing and only 24 bits of data or whatever transport to the other black box that unlocks, rather than entire hand pix. Assuming there's no ATM-skimmer grade camera taped on the scanner recording the geometry of every hand for later abuse.

The nature of security theater or snake oil is apparently unfixable failure modes don't indicate lack of effort or knowledge, they indicate the product sucks.

</comment></comment><comment><USER12> In related news, the FBI has just merged the civil and criminal fingerprint databases, just so they can have a "one-stop shop" to search for everyone's fingerprints - just like the hackers will when they will inevitably steal this one as well. Aren't fingerprint databases great?!

[https://www.eff.org/deeplinks/2015/09/little-fanfare-fbi- ram...](https://www.eff.org/deeplinks/2015/09/little-fanfare-fbi-ramps- biometrics-programs-yet-again-part-1)

</comment><comment><USER13> I think a clever observation of the article is the timing of the news: "it's like a PR problem not a real security threat and it doesn't deserve front page, it can go after Pope visiting Washington"

</comment><comment><USER14> The US Government's backwards policy of emphasizing offensive capability over defensive strikes again -- the NSA may have a treasure trove of vulnerabilities and the capacity to extend its reach into the nether regions of other nation-state's networks, but it leaves its belly wide open for other's to feast on.

<comment><USER15> Is this such a backward policy? It's how nuclear strategy worked, have an offense so scary you don't need a defense.

</comment></comment><comment><USER16> Yeah, we should totally make our fingerprints our password, because it is so safe and we don't leave our prints on anything we touch.

</comment><comment><USER17> I leave my fingerprints everywhere I go, so it's one of the least worrying things to have stolen.

<comment><USER18> as cstross already pointed out [0]: the reverse lookup can be a mighty tool.

[0] [https://news.ycombinator.com/reply?id=10267079](https://news.ycombinator.com/reply?id=10267079)

<comment><USER17> hmm, that's a very good point. but my point is still valid, since i'm not a spy... or am i? ;)

</comment></comment></comment><comment><USER19> Question, why would identity theft protection be issued to the victims of this colossal hack if it was indeed conducted by the Chinese?

</comment><comment><USER20> Eh, they just need to invent that fingerprint refresher from Men in Black.</comment>


This man's been dating a crowdsourced Internet girlfriend for the last 3 months - <AUTHOR> http://fusion.net/story/169012/meet-a-man-who-has-had-an-invisible-girlfriend-for-the-last-three-months/

<comment><USER2> I remember seeing this app a few months earlier. I'm surprised the company hasn't folded already, but I guess all the publicity it received & having a margin of ~70% (users pay $0.25 per txt, service pays $0.05) keeps it going.</comment>


Facebook is the first to jump into ARM servers - <AUTHOR> http://www.semiaccurate.com/2010/08/23/facebook-first-jump-arm-servers/

<comment><USER2> Already submitted (without www.) - <http://news.ycombinator.com/item?id=1628356></comment>


Overstock.com Has $10M in Gold and Silver Hidden Somewhere in Utah - <AUTHOR> http://www.buzzfeed.com/matthewzeitlin/overstockcom-has-10-million-in-gold-and-silver-hidden-somewh <comment><USER2> So, they believe there is a 1:20 chance that 'the end of the world as we know it' will take place, that having gold will somehow magically insulate them from such an event because they can ride out 3 months to pay their employees a wage? That's prepping. Makes you wonder if they also have a vault with weapons and ammo, generators and a bunker underneath their offices (hm, that might be a good spot for an attempted burglary, if anywhere that would be where the gold is).

In other news, Jonathan Johnson taken hostage by criminals that would like to know where he stores his sugar.

I really hope they have thought about the implications of putting this sort of knowledge out there for the world to see.

<comment><USER3> >I really hope they have thought about the implications of putting this sort of knowledge out there for the world to see.

I don't think they had a choice in the matter. Form 10-Q[0] are mandatory for public companies, and apparently precious metal holdings have to be listed. (The article links to Overstock's form 10-Q)

Sure, it's dumb for them to reveal that the precious metal is physically held in Utah, but then again they're a Utah-based company and gasoline is probably a scarce commodity in whatever apocalypse fantasy they're imagining, so it's not hard to put it together.

[0] [https://en.wikipedia.org/wiki/Form_10-Q](https://en.wikipedia.org/wiki/Form_10-Q)

</comment></comment><comment><USER4> Trying to meet payroll with gold and silver would lead to some serious problems. Hell, given how little gold there is in public hands outside of jewelry, it'd be a bitch to make change for.

As far as weird CEO tendencies go, hoarding precious metals isn't really that big of a deal. Long-term, they aren't really losing money from it. They aren't earning much, either so I guess you can chock it up to a wash. But it beats the hell out of some other habits he could have; at least he isn't freaking out about blueberry distribution across muffins or something like that.

[https://www.youtube.com/watch?v=Yz_-k9qoYns](https://www.youtube.com/watch?v=Yz_-k9qoYns)

Now, replenishing the food stockpiles as food goes bad would be a huge waste of money unless we're talking about MREs that will last until the heat death of the universe. But if he tries to serve that to his employees, he might have a mutiny on his hands.

</comment><comment><USER5> I find this announcement absolutely bizarre. Even if you believe there's a 5% chance of a banking crisis, there's a much higher chance many investors will think you're insane and unfit to manage a company. I imagine publicly announcing this precaution hasn't done wonders for their stock value.

<comment><USER6> I disagree, as an investor and as a CEO, I say— YOU MUST HEDGE!

<comment><USER2> I've become more sensitive to this due to some gaffes recently, is this yet another example of Poe's law at work?

<comment><USER7> I'd guess a CEO of a bitcoin related startup.

</comment></comment></comment></comment><comment><USER8> Who is going to shop at an online junk retailer (and make no bones, that is what Overstock is) after the financial system collapses?

<comment><USER2> Precisely. It's not as if people won't have bigger problems than this if and when the financial system collapses, after all, how will you pay for the goods.

"Oh, look: 45% off a set of pans & pots at overstock.com, just one moment honey, how do we pay for it, the financial system has collapsed."

<comment><USER5> Obviously you pay for it using your gold stash, carefully planned with denominations small enough to purchase cookware. Overstock will accept your payment via carrier pigeon, and the product will arrive via caravan within the next several months.

<comment><USER9> In the event of the apocalypse I think cheap cookware will be more valuable than gold. Consider all the things you can do with a pot post-apocalypse:

* Cook in it, clearly

* Use it as a shovel

* Sit on it

* Drink out of it, or eat out of it

* Use it as a toilet (might want two pots)

* Use it to collect fruits and berries you gather

* Use it to collect rainwater

* Conk people/animals/zombies over the head with it

* Sharpen the lip by rubbing it against some rocks and use it as a knife

* Use it as a helmet during the radioactive hailstorms

That's just what I've come up with in a few minutes of thinking. Other than conking you can't do any of the above with a gold brick.

</comment></comment></comment></comment><comment><USER10> If you've been around Mormons in your life, this wouldn't really seem _that_ odd.

</comment><comment><USER11> Everyone wants to save gold, but when money is literally worth absolutely nothing, you don't want gold, you probably want to barter food for useful items like ammo, guns, gasoline and car parts, as well as other things that actually are beneficial to your survival. Gold wont really offer much, you can't eat it, if you can make weapons with it then you're (excuse the pun) golden.

<comment><USER12> History would disagree with you. You need an easy-to-carry, hard-to-replicate and non-spoiling unit of exchange. You also cant sell 1/7th of a cow for a new shoe.

Read "the gift" if you are interested. Barter is much rarer than adam smith thought and serious commerce was never based on it.

<comment><USER13> > easy-to-carry, hard-to-replicate and non-spoiling unit of exchange

Wouldn't ammunition check those boxes and be intrinsically useful as well? Would also help defend the gold :)

<comment><USER12> Probably. Iirc ammunition was actually used in america at some point. Cigarettes could also fit the bill as prisons, depressions and concentration camps suggest.

There would probably a few currencies and exchange rates floating around. One of which would be gold.

</comment></comment></comment></comment><comment><USER14> "I don't know if it will be two days or two weeks or two months. But we have $10 million in gold and silver in denominations small enough … for payroll,"

How exactly will this work? Is USD still the unit of account for your salary, or does their employment contract state, "$X or X oz. gold at company's discretion."?

How do they expect to pay taxes? Is this even legal?

I don't see how this actually solves any perceived problems with the banking industry. Even if the banks go down for a period of time, you can still cut people/businesses a check. That's certainly easier for everyone involved than handing out gold doubloons on payday.

" in 2008 we came perilously close to banks not knowing who could accept counterparty risk,"

This goes to show how deft the Federal Reserve is. Lots of bad shit could have went down in 2008, but didn't.

<comment><USER15> _Is USD still the unit of account for your salary, or does their employment contract state, "$X or X oz. gold at company's discretion."?_

I think the idea here is that if the banking system has collapsed, employees might eagerly accept gold in place of cheques, no matter what their contract says.

<comment><USER2> The irrational bit of that whole argument to me is that they are effectively trying to keep 'the lights on' when their customers can no longer use overstock anyway. After all, if the banking system collapses your inability to use 'overstock.com' is going to be the least of your problems.

Recently Greece went through something like this on a much smaller scale (and with daily limits rather than a total collapse but it got quite close). Paying with gold was never even considered, people switched to cash in stead. It's not as if you're going to buy a bread or fill up your basket at the supermarket and expect to pay with gold, people will not be able to ascertain its value on the spot at the register.

Having $10M in cash in various currencies to hedge against the collapse of _one_ currency or banking system would already be quite an act of paranoia, having it in gold is taking that to a completely different level. That's end- of-times level stuff, it means there is no more trust in any currency at all. Merchants in Greece would have been happy to take your cash if you had it.

<comment><USER15> Right, I have no idea why it makes sense for an online retailer of non- essential goods to be making that particular hedge.

There _might_ be an argument for nuclear power stations and similar critical infrastructure companies to have such a stockpile, although even there (a) the military would probably step in, and (b) it's likely that Bouillon would be a more useful thing to stockpile than Bullion.

<comment><USER2> I think they have the Bouillon angle covered:

"Byrne said the company maintains a 30-day supply of food, and has a distribution system to pay and _feed_ employees in case the banking and payments systems collapse."

<comment><USER15> My point was more that food or other _useful_ commodities might be a more useful form of currency than gold in the complete-societal-breakdown scenario.

<comment><USER16> Food is definitely more valuable than gold when society collapses to the point where people can't get food anymore.

Related example: [http://www.foxnews.com/us/2013/08/19/american-world-war- ii-p...](http://www.foxnews.com/us/2013/08/19/american-world-war-ii-pow- prized-gold-ring-comes-home-after-70-year-journey/)

Although the food is artificially scarce in that case, it shows that people value what's necessary for survival above trinkets when they're required to do so. Gold having value presupposes some amount of social cohesion.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> hoard food, cash, and precious metal and bitcoin.

If something were to happen I think food and survival gear would be more useful then cash, precious metal and bitcoin...

Also CEO is in fear of currency crash, is the cash in another currency? And it's weird to think that in a crazy melt down their employees would care about getting paid versus survival?

</comment><comment><USER18> That's very Mormon. Mormons are supposed to have a year of supplies in storage for emergencies.

</comment><comment><USER19> When I read the title I thought they were hosting a huge treasure hunt, and I thought hey, that's a really cool marketing idea..

</comment><comment><USER20> In the event of a banking crisis gold has no value because you can do pretty much nothing with it and it's difficult if not impossible to exchange in any meaningful denomination in most situations of a modern economy.

Gold has value because of tradition and scarcity, the available supply cannot be diluted. If shit hits the wall with banks it isn't going to be gold that is scarce, it is liquidity.

<comment><USER21> We just went through a global banking crisis, the largest in history. Gold did not lack value during that time as you're claiming. That by itself proves your position wrong. Then you contradict yourself by saying that gold is valuable because of scarcity (true), and then you say that gold won't be scarce if shit hits the wall - shit hit the wall in 2007-2009, gold remained valuable and scarce.

<comment><USER22> It's so weird because we just went through a global banking crisis, the largest in history -- and cash had no problem whatsoever. There just isn't a realistic scenario in which USD has 0 value and Gold is useful.

<comment><USER13> > There just isn't a realistic scenario in which USD has 0 value and Gold is > useful.

This happens all. the. time. The USD lost 33% of its real value between 1977 and 1981 while Gold increased in value in real terms by 65% during the same time period. USD itself has been reasonably stable since, but there's no guarantee that will continue.

I'm not a crazy goldbug, I don't think we should go around trading gold shavings with each other in our day-to-day lives, but it's an indisputable fact that Gold is an excellent hedge against financial and currency crises the likes of which happen somewhere in the world all the time. Hell, right now Russia is in a currency crisis where the Ruble has lost 50% of its value in less than two years.

<comment><USER23> > > There just isn't a realistic scenario in which USD has 0 value and Gold is > useful.

> This happens all. the. time.

No, it doesn't. About the only times its even approximately happened during or after the 20th Century to a national currency of a nation that had been a major world power within the preceding century have been a few cases to the losing side of major wars (and in those cases, prewar businesses are quite likely to lose their market and ability to operate as a result of the war and its loss, independently of the collapse of the currency.) It absolutely doesn't happen all the time.

</comment></comment></comment></comment></comment><comment><USER24> It's like this company is being run by Ron Swanson...

<comment><USER25> Yes, Byrne is a libertarian.

</comment></comment><comment><USER26> Well that's one way to tell the government that they can make 6 million dollars by confiscating your illegal gold stash.

<comment><USER27> Gold stashes are no longer illegal

<comment><USER15> Yes, but the government doesn't need to prove that you've done anything illegal to confiscate your money as "possible proceeds of crime".</comment></comment></comment>


Book Notes: Founders at Work - <AUTHOR> http://designsprints.com/founders-at-work-book-notes/

<comment> grey-area The Steve Wozniak interview is just incredible:

 _I couldn 't really afford to buy the pieces I needed. I couldn't buy a teletype, so I had to design my own terminal. The only thing that was free (because I had no money) was a home TV to see characters on. I got a keyboard for $60, which was amazingly low priced then. That was the most expensive thing to getting my terminal built. Then it was just a matter of designing logic to put dots on a TV screen that add up to the letters of the alphabet and spell out what's coming from another computer far away. The keyboard types the data to the computer far away, and I built a modem for that. So now I had a TV terminal. This is while I'm working at Hewlett-Packard. I'm just doing these things on the side for fun in my apartment in Cupertino._

[http://www.foundersatwork.com/steve- wozniak.html](http://www.foundersatwork.com/steve-wozniak.html)

</comment><comment><USER2> "I highlighted a ton of things".

I haven't read Founders at Work, but I really enjoyed Coders at Work by Peter Seibel in the same series. I had the same feeling with that book - I scribbled down a lot of notes on interesting things to follow up on. My conclusion (from my review on Amazon[1]):

If you are seriously interested in programming, this is definitely one of the books you should read. Highly recommended.

[1] [http://www.amazon.com/review/R2OV0TG7MJGXGL/](http://www.amazon.com/review/R2OV0TG7MJGXGL/)

<comment><USER3> Thanks Henrik! Great review, convinced me to buy a copy of the book.

<comment><USER2> :-)</comment></comment></comment>


Machines That Play (7 part series about AI and games - until Deep Blue) - <AUTHOR> https://hackernoon.com/machines-that-play-overview-7f670681ef6a <comment><AUTHOR> A 7 part series on AI and games (till Deep Blue). It reviews (briefly) how to build chess machines, Shannon's work, Turing's work and the following machines: The Turk, El Ajedrecista, MANIAC, Bernstein Chess program, Samuel's Checkers, Mac Hack VI, Cray Blitz, BKG, HiTech, Chinook, Deep Thought, TD- Gammon, Deep Blue.

If you only want a chess summary, read this: [https://medium.com/@reasonets/machines-that-play-chess- summa...](https://medium.com/@reasonets/machines-that-play-chess-summary- fb0d67fc5a19)</comment>


Ask HN: What would work well in a country built on the Unix Philosophy? - <AUTHOR> It seems to me counties end up with rules and institutions with increasingly less chance of improvement yet a accumulated complexity.<p>Would the Unix Philosophy when applied to country building help with this problem? <comment><USER2> If all legislation followed the model presented by git (versioning, increments, branches, merges, and total transparency) I think that it would reflect positively on a true democracy.

The next step, however, would be to educate the populous so that all voters were informed, and that voters would be presented (in an elegant fashion) with what is relevant to their districts on the three tiers of national, state, and local policy. I don't know if Unix has a good metaphor or reflection of this, but unix is meant to be a) modular and b) minimalist, so if we can sponsor the idea of true modularity in voting, I think we could see some full- participation schemes that are not overwhelming. I don't have to vote on every issue, but could vote on collections of issues that reflect my general ideology or current understanding of what best suits the republic.

Another issue though, is ownership. In the Feudalistic Republic of the United States (as of 2016) it's hard to describe a system that could be adopted reasonably that promotes the idea that all the nation belongs to everyone in it. We have some things like "the right to life, liberty, and property [often misquoted as 'happiness' at the end here]" and how does one reconcile this idea of property with a truly harmonious community? Good question.

So in short, the basis of the Unix philosophy would help (especially with law versioning, that is just what needs to happen and is so brilliant and clear I am surprised there is not greater traction for it). All Laws need time limits (and easy renew options if they are good)... And the entire populous needs higher quality information that [forces?] causes people to consider the community at large.

/rattle like a snake

<comment><USER3> I have been quietly advocating for version controlled legislation for a long time. Here in Massachusetts, bills describe what they would change in the text of a statute directly - a bit like an ed script. Here's an actual example:

>SECTION 2. Said section 35 of said chapter 123, as so appearing, is hereby further amended by striking out the words "is an alcoholic or substance abuser", in lines 17 and 18, and inserting in place thereof the following words:- has an alcohol or substance use disorder.

>SECTION 3. Said section 35 of said chapter 123, as so appearing, is hereby further amended by inserting after the word "a", in line 36, the third time it appears, the following word:- qualified.

>SECTION 4. Said section 35 of said chapter 123, as so appearing, is hereby further amended by striking out the fourth and fifth paragraphs and inserting in place thereof the following 3 paragraphs:-

As someone who attempts to keep informed about changes to the law, this style is a huge obstacle. It often necessitates a lot of manual piecing-together in order to form a complete view of the final change. A simple diff view would make it much easier to understand.

I have considered tracking changes to the law in git, including representing bills as branches, as a side project idea, but I determined it would require far more effort than I am willing to put in.

<comment><USER2> Wow sir. That is really a great list of examples! It actually seems [very very] feasible to make a simple system that could automate this based on the language used. It would be a worthwhile endeavor, but like you say, would take a lot of time/effort investment.

Perhaps an open-source effort that does this (tracks and updates current laws and shows diffs) could be a worthwhile beginning?

I think every senator and representative that has ever had to amend legislation would delight at the thought.

<comment><USER3> I was only considering doing it manually. I don't know how feasible it would be to automate the conversion process. The formatting and language used in these "edit script"-style bills varies considerably, as they are written for humans by humans with no standardisation.

<comment><USER2> Honestly, this seems like one of the more realistic problems NLP could actually solve. Yes there may be many variants, say 100 or even 1000 different structures and vocabularies for updating versions, but a differential neural network where you have inputs (like the pre-amended law) and outputs (like the laws after the "amendments" or version bumps) would actually be perfect for learning what means what and when to do it.

It would be the perfect grad project for someone interesting in bridging the gap between computation/machine learning and legislation.

Of course, it would be a little tedious setting up the learning (thousands of sets of input cases and output cases) but in the end the findings could be used across the board.

</comment></comment></comment></comment></comment><comment><USER4> How do you define The Unix Philosophy as applied to a country? Software doesn't come close to the complexity of an entire country so your analogy could possibly be fundamentally mismatched...

<comment><AUTHOR> Well I believe that fundamentally the complexity of a country is to a large extent historical artifacts.

How do you think the relations between institutions would be different, how do you think they would perform their functions differently? What would their structures be?

Or focus on some specific example -How would voting be different? -How would registering for a licence be different? -How would taxation be different?

<comment><USER2> I think with taxation we could also do very cool things: Say your nation taxes at 30%, what if every voter had a subset of that value (say, 12.2%) that they could choose which district or set-of-needs to fund?

Like maybe I want my 12.2 to go to education for kids 6mnths-12years, or maybe I want to fund state medicines, and my neighbor and I both pay the base rate that covers necessities like roads and stuff, but he may fund shelters instead of medicine specifically with his 12point2. It could be really wonderful.

In effect, people may become more participatory in their own governing systems, and could actually direct funds instead of relying on bill-makers to figure out where to spend monies/resources.

</comment></comment></comment><comment><USER5> The plumbing, presumably.

<comment><USER6> The sewerage and garbage can be piped into /dev/null

</comment></comment><comment><USER3> National PKI. Every citizen would have a key pair. I believe I have read that Estonia has implemented this.

<comment><AUTHOR> What could it be used for?

<comment><USER2> Voting! And easily verifying a) your vote was/is counted and b) is accurate for what issues/candidates you voted for. In fact, we could eliminate most candidates because they are only there to "represent" the wills/intentions of their constituents. Gloabl PKI pairings for voting would eliminate the need for a lot of "representatives" and we could do more direct forms of democracy instead!</comment></comment></comment>


An arcane new accounting standard is helping reporters follow the money - <AUTHOR> https://www.cjr.org/watchdog/corporate-tax-breaks.php <comment><USER2> Presumably the tax breaks lead to further taxation through increased economic activity so it isn't a clear cut case of a library "loosing" $3 million a year as the article implies.

Mesa, Az gives Honeywell a property tax break and all the highly paid tech workers drive up the property values and sales tax revenue &etc.

Of course discounting political kickbacks which I'm sure are rampant because, well, politicians.

</comment><comment><USER3> This is an article about a news article.

Original article is here:

[https://www.myajc.com/news/local-govt--politics/new- disclosu...](https://www.myajc.com/news/local-govt--politics/new-disclosures- show-atlanta-companies-that-profit-from-tax-breaks/yucUJNyGk1ldpKt9wsGeZJ/)

<comment><AUTHOR> Sorry but I have to make an objection here. What I submitted is an article about _several_ articles; its premise is that a relatively unknown regulation has made it possible to efficiently scrutinize tax breaks in virtually every jurisdiction nationwide, and that is what some reporters have taken advantage of.

The AJC article is good, but its intended audience is Atlanta region taxpayers, and those who benefit or are harmed by regional decisions. It does not focus on the regulation, or how/why reporters were able to do this story in the present age. The CJR story is more generally interesting because it reveals more about the general circumstances regarding (non-)transparency and impact of tax breaks.

</comment></comment><comment><USER4> This can be very misleading. Say a city gives Amazon a big tax break to encourage it to move there. So instead of paying $5 million in taxes it pays $2 million.

The city didn't _lose_ $3 million, it _gained_ $2 million + ripple effects of economic growth - increased costs to administer the city resulting from that growth . So it's almost certainly better off.

<comment><AUTHOR> Describing it as a simple loss of $3 million is definitely a simplification, for the reason you mention. But saying this is "very misleading" is perhaps even more of an oversimplification. Unless you are so cynical that you think the normal tax rates are a complete sham -- i.e. that the official tax rates have no basis in reality, such that there is no impact whether a city charges $5M or $0.

But if we assume that that $5M is somewhat tied to the actual costs to the city to administer services and regulation, then offering a $3M tax break is done with understanding the potential opportunity cost, and believing that Amazon's business will more than make up for that $3M that the city might have reaped otherwise.

The point of these stories is that, in the past, there was basically no easy way for the public to evaluate these tax breaks. A situation like Amazon seems like a sure net win. But there are many, many more American jurisdictions than the city that happens to get Amazon's business.

<comment><USER4> Like I said in reply to another comment, the marginal increase to the cost of administration is probably a good deal lower than the resulting average cost.</comment></comment></comment>


Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys - <AUTHOR> https://www.wired.com/story/hackers-can-clone-millions-of-toyota-hyundai-kia-keys/ <comment><USER2> Quote: "By contrast, the cloning attack the Birmingham and KU Leuven researchers developed requires that a thief scan a target key fob with an RFID reader from just an inch or two away."

Story time: Back in 2005/2006 when I worked for Siemens Automotive on Immobilizer feature (was involved in Mazda and Ford projects) I got my hands on the highly secret crypto source...and much to my surprise I've seen they implemented a Vigenere style of cipher. I was astounded by this. Having some crypto background as pet projects on previous years I knew this class of ciphers are at least 1.5 centuries obsolete and they are thought only from historical perspective. Therefore I prepared and called a panel of higher-ups (managers, group leaders and even including the hardware department chief) showing to them that the source code implementation is very dangerous and that for a criminal group to mass steal cars would be very easy. Including telling them exactly what the article is talking about - put an RF recorder under the handle door (how many car owners will check there?), record sessions of radio communications between key fob and the car, analyze that, extract the crypto key and steal the car with a duplicate no more then maximum a week after. Their reply? : "standard in industry call that we also allow mechanical keys to open doors/start the car, so a criminal group can do them as well much easier", and that was the end of that meeting.

<comment><USER3> Are you sure you aren't misremembering?

DST40 [https://en.wikipedia.org/wiki/Digital_signature_transponder](https://en.wikipedia.org/wiki/Digital_signature_transponder) used in Fords of that period is a Feistel cipher not a Vigenere cipher. Now, I wouldn't choose a Feistel cipher for this problem today but it certainly is not 1.5 centuries obsolete, this type of encryption wasn't even invented until the mid 20th century and a very famous example would be DES.

<comment><USER2> I am sure yes. Mind you, this was Immobilizer feature, sold by Siemens Automotive to auto-makers. As to what in rest of their car Ford itself was using I have no idea, since I was not working for them at the time.

Here is an analogy - Microsoft is Siemens and Ford is IBM. Microsoft sold DOS to IBM to equip their PC's. As for what IBM implemented/used for BIOS, was not Microsoft's job, get it?

<comment> o-__-o An immobilizer simply keeps the ecu from running the fuel pump, thus preventing the car from starting. The challenge-response from the key is used to authenticate the ecu. It's not so much that it's bad encryption (it is) it's just that the access to override such encryption has physical controls (e.g. if one breaks the glass then one typically has complete access to the vehicle). Second the cpu of the time where maybe 4mhz in a good case so it required a system that was fast. This is very similar to the encryption used to immobilize Mercedes and BMW of early 90s.

Also I can tell you on all current and last gen Ford and Mazda's, the inter- car encryption and authentication has vastly improved.

<comment><USER2> <An immobilizer simply keeps the ecu from running the fuel pump>.

Wrong! Immobilizer is just a tiny part of the BCM (Body Control Module), to which the normal folks usually interact with and call it on-board computer. The truth is that you have CAN (Controlled Area Network), used by BCM and ECU to communicate through, at the very least. When you press the start button, ECU asks BCM "hey dude, can I start the car?", and BCM responds with "yes" or "no" based on various factors, one of them which is Immobilizer. Even with correct key fob and authenticated, if your door is opened it will not let you drive. Of course, all these varies from car maker to car maker. Some will let you start it but you can't drive for more then 3 meters, others won't even let you idle the engine. You have a crapload of sensors that are part of BCM (tire-guard, wipers, door ajar, belt, etc etc) all of which are taken in consideration to yield that "yes"/"no" response.

And that's just a small part of what BCM does. Also poor ECU, an entire computer on its own right, reducing him to running the fuel pump is like saying a house is to shelter you from bad weather.

Saying immobilizer simply keeps the ECU from running the fuel pump is like saying that all you need to create Witcher 3 game is Visual Studio.

<Also I can tell you on all current and last gen Ford and Mazda's, the inter- car encryption and authentication has vastly improved. >

As per article, you can see for yourself this is not really true. My code that I've worked in those years (2005/2006) were to be deployed in 2007 Mazda RX-2 and 2008 Ford, so in regards to last gen (cca. 2010) I bet you're simply wrong again. I do hope latest gen has better encryption but I doubt, wanna know why? Because economics. Lemme tell you first hand experience. Managers care about economics and that means cheaper parts. Cheaper parts means less memory, less speed. The goal was always to have the BCM's CPU load between 70% and 90%. Did a smart code and you reduced the load bellow 70%? The higher-ups were jumping happily in the air because it meant a big fat bonus for them due to allowing them to stick a crappier chip on that PCB. That's what they care about, not strong encryption and elimination of theft. Also read about Ford/GM practices in 60's when they preferred to allocate about 200 millions USD/year for paying victims of accidents than have belts. Until they got regulated by law, they could not care less about lives.

<comment> o-__-o The BCM is an ECU.

The encryption has been broken already but it's basically trailing bmw and Mercedes etc by about 13 years, so definitely money related but likely they don't want to or are unable to negotiate patent rights in their technology

<comment><USER2> BCM is Body Control Module. ECU is Engine Control Unit. 2 different parts (logically). Both are physically PCB's (Printed Circuit Board) that physically can sit either side by side or in very different sides of the car - that's car maker decision. I can't explain it simpler than this.

<comment><USER4> ECU is usually an Electronic Control Unit. Some OME's name one of there ECU's, Engine Control Unit to make stuff more complex. Not app manufacturers have Engine Control Unit or a Body Control Module. The electronic architecture of a Volkwagen, GM, Volvo or Tesla is very different. Hardly any of the ECU's have the same name.

It looks like Wikipedia agrees with me and in addition, the Engine Control Unit article state that they are usually called the Engine Control Module (ECM) to lower confusion. [https://en.wikipedia.org/wiki/Electronic_control_unit](https://en.wikipedia.org/wiki/Electronic_control_unit) [https://en.wikipedia.org/wiki/Engine_control_unit](https://en.wikipedia.org/wiki/Engine_control_unit)

Different OEMs vary in architecture and naming. Making it a bit of a hassle working in a teir-1 with multiple customers.

<comment> o-__-o Or PCM (powertrain control module, since the transmission and engine typically work as one unit) which has been used by Ford (and Mazda) since ODB-2 was standardized in the 90s.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> The LockPickingLawyer has done a few recent videos on RFID locks and how one can bypass them. They were pretty interesting to me:

"[1052] Defeating a RFID System With The ESPKey" => [https://youtu.be/0SEHUqkbIjU](https://youtu.be/0SEHUqkbIjU)

"[1056] This Black Box Reads RFID Cards in Your Pocket" => [https://youtu.be/dTObKtHzroM](https://youtu.be/dTObKtHzroM)

<comment><USER3> [ Edited to insert: 1056 sort-of covers this, that's what I get for not having seen his latest video ]

The lesson in 1052 sort of misses the point. LPL (his videos are a lot of fun by the way and I recommend them to anyone who is curious about lock picking) says:

> So, if you are installing an access control system like this it is really > important to use one that only transmits encrypted data

This would defeat the ESPKey demonstrated, but of course that product exists precisely because it's all you need for common systems today. If "encrypted data" was common the ESPKey's successor would probably be a product that sits next to the reader and gets its own copy of the raw RFID signal. Not as convenient, and less fun for doing cool demos, but still plenty effective enough for crooks.

What you actually need to do to defeat this is a bit more expensive. You need the token (keyfob, card, etcetera) to be smart enough to use the tiny surge of power to do local computation, and then produce one-time-only access codes. That would actually fix the problem, because to get the current code a bad guy needs to steal the token and that's an ordinary physical security consideration that humans are used to dealing with. This way an ESPKey gets the one-time code you just used, but neither replaying it nor copying it to a card to try later will do anything useful.

Unfortunately this smarter token would be significantly more expensive. We saw with EMV cards (payment cards) that the smart and secure option (DDA with changing cryptograms) is expensive enough that providers would often rather take a risk and give you an insecure cheaper alternative which looks identical, especially if they believe regulators, courts etc. won't realise they took the cheap option and so the risk actually lands on their customers not on them.

<comment><USER6> What you are describing is basically MIFARE, which is commonly used by transport cards. Rather than just being an ID, the card is responsible for storing and deducting the balance, and often stores other things like trip history. The allows them to be used without a internet connection on the ticketing machine (e.g. on a bus).

There have been vulnerabilities found in older versions, but as far as I know, later versions are still considered secure.

[https://en.m.wikipedia.org/wiki/MIFARE](https://en.m.wikipedia.org/wiki/MIFARE)

<comment><USER7> Apologies if this reply seems a little pedantic; your reply is mostly correct, but there are some large shortcuts.

MIFARE is not a card type, it's more a family of cards in the 13.56MHz space, produced by NXP.

There are multiple cards under the banner of Mifare, including:

\- Mifare Classic 1/4k - UID + Storage space, with individual keys and crypto. Suffers/ed from multiple vulnerabilities. Used mainly in cheaper hotel access systems, gym cards, etc etc. Can be secure, if your security layer relies on strong crypto on card contents, as opposed to the crypto of the card itself. There are no counters in Mifare Classic.

\- Ultralight / Ultralight-C / Ultralight EV1 These cards are low cost, reduced storage space, and are / were conceived specifically for the transport industry. They have 'one way' counters that can be used to deduct 'credits' \- but these can't be re-written - so they fulfill the task of discardable tickets.

\- Mifare DESFire 3DES / EV1 / EV2 The EV2 is the latest generation - ID + Storage + "Applications", with AES encryption. The 3DES was cracked with side- channel power analysis (like the items in this article) - but the EV2 has no practical attacks to this day.

Information aside, most transport systems do _not_ store value on the cards, but allow for offline use by forcing sync the next time the card passes by an online system - IE, limited trust.

<comment><USER8> Do you have any resources on how to secure Mifare Classic against cloning? I thought it's inherently insecure.

<comment><USER7> You can't secure Mifare Classic directly, it's totally broken.

The best solution is to assume that a card's encryption is or will be broken, and build a system around it.

That is to say, store encrypted or signed data on the MIFARE card.

VIGIK is a French system that uses RSA signed data in MIFARE cards which has not been cracked to date.

</comment></comment></comment></comment></comment></comment><comment><USER9> My reaction: Great! Reproducing these keys costs hundreds of dollars and a trip to the dealer. Maybe it can finally be affordable again.

I'm less concerned about someone stealing my car. The local police department takes it seriously, no less because stolen cars are used to commit other crimes.

<comment><USER10> Wait, what are you advocating? Return to keys without an immobiliser??? You do realise that that's the feature that has single-handedly destroyed car theft that was so rampant by the 90s? That is what made cars so difficult to steal, but also what makes keys cost what they do and require an approved dealer to code the keys. Return to the old keys where you only had the key and nothing else would be......crazy, really.

<comment><USER11> Yeah, if they're overcharging then it would probably be better to go after that directly. It doesn't need to cost more than $20.

</comment></comment></comment><comment><USER12> Garcia is a professor at the UNI of Birmingham, he already made a paper on similar topic that in 2012 was blocked by a Court:

[https://www.theguardian.com/technology/2013/jul/26/scientist...](https://www.theguardian.com/technology/2013/jul/26/scientist- banned-revealing-codes-cars)

</comment><comment><USER7> For the curious or eagle-eyed, David Oswald, one of the co-authors of this paper is also one of the co-creators of the ChameleonMini [1], an open source RFID emulation device which has become the defacto tool for emulation in the penetrating community.

Well done David, and thank you :)

[1] [https://github.com/emsec/ChameleonMini/wiki](https://github.com/emsec/ChameleonMini/wiki)

</comment><comment><USER13> dang, can we get a ruling? These headlines might not violate the letter of the "If the title begins with a number or number + gratuitous adjective" guideline, but they do violate the spirit.

"Hackers Can Clone Toyota, Hyundai, and Kia Keys" gets the same point across without the sensationalism.

I'm bringing it up because I've seen many of these "millions of [thing that exists in the millions]" headlines recently, and I think it's more than just Baader-Meinhoff at work.

<comment><USER14> I'm not seeing the problem. Your suggested title makes it sound like they could clone all the keys from those manufacturers which isn't true. And if you inserted a word like "some", my first question would be, "Well, how many?" To me "millions" is useful in conveying it isn't just a niche issue, but it isn't everything, either.

<comment><USER15> Why not include a percent? Are we talking about 10% of cars, or more like 80%? Is it mostly recent cars, or are cars from several years ago also affected?

It's not a terrible headline, but it could also be improved.

<comment><USER16> Does it matter at all that this is the original title of the article? How about quoting it if we don't like it?

</comment></comment></comment></comment><comment><USER17> Does Schuyler Towne read hacker news?

He made the point in one amazing talk (that included references to centaurs and American exceptionalism and possibly ancient sumerian) that we've long used locks not for security, but as a social symbol of security.

Anyone can just put a cinder block through your window and steal your car. The barrier isn't technological, it's social. Locks are a great defense against the kid or confused person who is wandering around and forgets that we have social mores against making off with thousands of dollars of other people's property on a whim. They are not designed to defend against dedicated thieves.

We defend against dedicated theives by hiring detectives and prosecutors and making it in general more hazardous as a profession than other professions that one might take up. We defend against theft by just generally making it more lucrative to apply the same amount of ingenuity and dedication to other endeavors, like giving amazing talks about perfect security and American centaurs.

I'm probably butchering or overextending his point though, would love for the man himself to weigh in.

<comment><USER18> Indeed, most locks are societal items instead of actually being difficult to defeat. It doesn't make a lot of sense to over engineer one part of a system that an OoB attack can easily defeat unless that other attack vector is much more often attacked. I doubt that's the case here. People should avoid locations where their cars are likely targets.

</comment></comment><comment><USER19> The essential problem is that static credentials are transmitted and can be copied. If they used a randomly generated code to unlock the cars (needs to be generated offline) then that would solve this issue.

There are plenty of offline hardware based solutions already on the market especially for unlocking computers with MFA. It needs to be offline generation for computers for NIST DFARS 800-171 compliance.

<comment><USER20> >The essential problem is that static credentials are transmitted and can be copied. If they used a randomly generated code to unlock the cars (needs to be generated offline) then that would solve this issue.

Not necessarily. Relay attacks are very hard to defeat, regardless of your crypto scheme:

[https://www.wired.com/2017/04/just-pair-11-radio-gadgets- can...](https://www.wired.com/2017/04/just-pair-11-radio-gadgets-can-steal- car/)

<comment><USER21> Shouldn't relay attacks be preventable by having the car inspect the timing of the response? A signal that needs to be received, reprocessed, transmitted, reprocessed again and then retransmitted should have a noticeable difference in timing, shouldn't it?

Is there any reason a challenge/response protocol with proper timing filtering isn't safe against relay attacks?

<comment> yc-kraln Currently working in the Car industry, previously in the access control industry (and have developed active RFID systems which include timing information to prevent relay attacks)

Yes, you can do this. I have done this (restricted the negotiation to about 12 meters)--you're essentially racing the speed of light, see DE102012104955A1. Most of the reasonable approaches are patented by NXP.

<comment><USER21> I see, very interesting! I could've figured someone would patent something like this. Thank you for explaining.

</comment></comment></comment></comment></comment><comment><USER22> I live in the city and it's extremely common for cars to be broken into and/or stolen because of key fobs. It's a common topic on our FB neighborhood group. We store our keys in a Faraday box by the front door now, instead of leaving them out. Not surprised the attack vectors keep growing here.

</comment><comment><USER23> Ceo's BMW X5 was stolen last year.He watched the CCTV later on.The guy came to the car with a laptop and drove away after a minute or so. Police found the car dumped somewhere on a road,as the car ran out of fuel and apparently it had some security feature that prevented the thieves from refiling it.

<comment><USER24> Sounds like you're describing a range extender attack on the keyless start. Almost(I don't know any that aren't) all cars with the feature are vulnerable to this.

<comment><USER25> Latest BMW, Audi, VW and Ford (or at least some models from these manufacturers) key fobs stop transmitting after X amount of time (based on motion).

<comment><USER26> Interesting. So do you have to put your fob in a bowl so it won't be moving to prevent it from being relay attacked, or some such?

<comment><USER25> Yes but I would assume that coming home and putting all your keys somewhere to lay down is a routine for most people.

<comment><USER26> Lots of people sure. Mine stay on me til I go to sleep typically.

<comment><USER27> This feature can still protect you if it works for enough people that it's no longer worthwhile to attempt to unlock a car this way.

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> "Though the list also includes the Tesla S, the researchers reported the DST80 vulnerability to Tesla last year, and the company pushed out a firmware update that blocked the attack."

</comment><comment><USER29> One related and another unrelated though...

First: Auto manufacturers ought to get together and agree on one common key + entry system standard. It can be a combination of physical key and remote key if necessary.

The problem: If you have multiple vehicles (and many families do) you end-up with a keychain full of horrendously large and unnecessarily inconvenient keys, key-fobs, whatever. Some manufacturers seem intent on making the larges and most inconvenient boxes they can possibly imagine. This is entirely unnecessary. In this day and age one ought to be able to have a universal programmable entry system that gets programmed for your vehicles and that's that. One device to rule them all.

Second: Auto manufacturers ought to get together and agree on placing the fuel tank port on the same side.

The problem: Today you have cars and trucks with fuel tank refill ports on the left and the right. It can be an absolute nightmare to go to a gas station where most of the cars have ports on the left and you show-up with one on the right. This is one of the reasons for which I hated driving our BMW. Going to the gas station was always a game of chicken with cars entering in the other direction.

<comment><USER30> >was always a game of chicken with cars entering in the other direction

Uh, other direction? Almost always there are hoses from both side of pillar. Is it some regional thing?

<comment><USER29> As Dylan said, cars come in from any direction, which makes not having the port on the same side in every vehicle a complete mess.

From my experience most vehicles have it on the left side, in the US that would be the driver side.

If you show-up at a busy gas station with a BMW --which has the port on the right-- well, good luck, it can get ugly. Rather than lining-up behind the car currently fueling-up, you have to line-up in front of them. Which means that someone entering the station with a left fuel vehicle often ends-up behind them --even with you waiting patiently in front way before the third car showed-up. That's where the problems begin. This has happened to me many times.

Because the car that finished fueling drives forward to exit, the car behind it has a natural advantage and the one in front a disadvantage (at the very least you have to allow plenty of room for them to drive out). The car behind them, if they want to deny your rightful turn, just crawls forward as the first car exits. Before you can do anything at all they are in front of you, took control of the pump and you have to choose between waiting, moving or getting into an argument with someone you know isn't likely to be a nice person.

If all fueling ports are on the same side there are no problems.

The alternative is to require that hoses be longer. The problem with this is that it doesn't work at all for trucks.

<comment><USER12> >Second: Auto manufacturers ought to get together and agree on placing the fuel tank port on the same side. The problem: Today you have cars and trucks with fuel tank refill ports on the left and the right. It can be an absolute nightmare to go to a gas station where most of the cars have ports on the left and you show-up with one on the right. This is one of the reasons for which I hated driving our BMW. Going to the gas station was always a game of chicken with cars entering in the other direction.

I would say that in EU (German, French, Italian) cars have it on the right (like the BMW), i.e. opposite the driver side, I have now an Opel and it is on the right, and my my previous car was also on the right.

I believe it being on the right is a traditional safety provision, though they are becoming very rare nowadays (and since several years) a number of fueling stations (at least in the cities) were not, like it is common nowadays, in a (large) court, the pumps were simply along the road, at the most in a 3-4 meters enlargement of the road itself.

So it made sense to have it on the right, the only moment where the driver is exposed to the trafic is when he/she gets out of the car, during the refueling he/she can stand on the right of the car, i.e. between the car and the sidewalk (and the same applies to - as it was once most common - to the gas station service personnel).

<comment><USER29> That makes sense.

</comment></comment></comment></comment></comment><comment><USER31> IMO this is what class action lawsuits are for.

</comment><comment><USER32> Call me old but what is so great about the smart key? Not having to pull it out of your pocket? I know this is an old rant already but car have reached the crappyfication curve, when something cannot improve its main purpose anymore it starts adding unneeded features to be able to push a "new" product.

<comment><USER33> I disagree, when you've got 4 kids and both arms full of groceries, when the doors open automatically or even unlock on their own it's a godsend. I'd even say it's probably saved some lives as the kids race to get in and out of the parking lot instead of waiting on me to shuffle around for the keys, dropping bags in the process, and then chasing each other around in blind traffic.

<comment><USER11> Isn't the solution to that situation a shopping cart?

<comment><USER34> you dont have children

<comment><USER11> I'm not saying dealing with the kids is at all easy. But the kids are there either way. So I think you have my argument exactly backwards. I'm not saying something is easy. I think kids plus carried bags sounds _completely overwhelming_. If you want to say I'm wrong, you're making the argument that kids plus carried bags is _easier_ than I think. So please, elaborate on how that's easier than a cart.

<comment><USER35> You're basically saying "I cannot, in any way, imagine a situation where the parent's story is the sensible choice, and therefore I'm entitled to make a pedantic comment about a situation I wasn't in". Instead, you should give them the benefit of the doubt.

<comment><USER11> I didn't say it was wrong. I said a cart should make it easier. I'm legitimately confused by their partial explanation, not being pedantic. It's fair to want clarification about why a cart doesn't solve this.

Maybe there are no carts at this store for some awful reason. Maybe the story was so focused on how this type of key solved their problem that they didn't give a fair shake to other possible solutions. More information is needed.

There are multiple ways I can/do give benefit of the doubt, but doing so doesn't make the situation any clearer.

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> Some class-action lawyers will sue and make millions for themselves while every car owner will get $1 for the unfixable problem.

If only this was deemed as a road safety problem forcing a recall.

Is it possible to remove the antenna or disable the radio receiver in the car to force physical key use?

</comment><comment><USER37> Great! The dealership charges inordinately for a new key so I would love to be able to do it myself.

<comment><USER38> I am married to someone who has lost her keys several times so far. Upgrading from a car with a $50 fob to one with a $200 fob was not fun.

<comment><USER39> [https://www.thetileapp.com/en- us/store/tiles/pro](https://www.thetileapp.com/en-us/store/tiles/pro)

If she loses her keys just once it pays for itself many times over.

<comment><USER40> I assume this person must be losing their keys in public or somewhere unknown. Otherwise their house must have quite the bonanza of keys waiting for them.

<comment><USER41> Those types of systems like tile work in public as well, they use a network of other users that will inevitably walk by the lost item.

<comment><USER40> I see, that's interesting and good to know. I thought it was something that only worked in local range.

</comment></comment></comment></comment></comment></comment><comment><USER42> Information wants to be free. Including encryption keys.

</comment><comment><USER43> Am I the only one still fuming about those two idiots who turned the engine off on the highway, and the hazard lights as well, with no shoulder to pull into? Then the idiots smugly claim they would never put anyone's life in danger. The author also gives them a wide pass. Why? This is such irresponsible behaviour. They couldn't demo it in some large unused lot?

</comment><comment><USER44> Stolen cars are almost a sale. So good news. Supporting the industry by lowriding security.

</comment><comment><USER45> Can they do Honda, please?

</comment><comment><USER46> And those who steal cars can clone pretty much any car keys. No sensation here.

<comment><USER47> ... except you don't need physical or visual access to clone an electronic key, just proximity.

Which is straightforward when you want to steal a particular vehicle because you know where it is and can easily follow its patterns.

<comment><USER48> And folks with access to Mentor (Advanced Orion) likely can clone keys from other side of the planet</comment></comment></comment>


The Marriage of Silicon Valley and the Pentagon Is Happening - <AUTHOR> https://gizmodo.com/the-marriage-of-silicon-valley-and-the-pentagon-is-happ-1833605329 <comment><USER2> My experience is largely that US engineers want to help the US military. But they don't feel comfortable confronting the vocal anti-military minority.

</comment><comment><USER3> Happening^^^Continuing

Silicon Valley was build on military spending, who do you think was Shockley's biggest clients? Fairchild Semi's first transistor went into bombers, Google was funded by NSA/CIA ([https://medium.com/insurge-intelligence/how-the-cia- made-goo...](https://medium.com/insurge-intelligence/how-the-cia-made- google-e836451a959e)), etc.

<comment><USER4> Well this throws away all pg's ideas about how to create silicon valley in his essays. (It is not the engineers and venture capitalists)

</comment></comment><comment><USER5> Isn't the Pentagon the father of the Valley? How is this marriage legal?

</comment><comment><USER6> I know this has been posted before but if you haven't seen it, definitely check out Steve Blank's "Secret History of Silicon Valley" presentation. Silicon Valley was founded by the Defense Dept.

[https://www.youtube.com/watch?v=ZTC_RxWN_xo](https://www.youtube.com/watch?v=ZTC_RxWN_xo)</comment>


Why over 90% of online businesses fail? - <AUTHOR> http://ibusinessgurus.com/internet-marketing/90-online-businesses-fail

<comment><USER2> Because most new business fail, and for many of the same reasons described.</comment>