Leaked Google briefing, admitting a "shift towards censorship" - <AUTHOR> https://www.scribd.com/document/390521673/The-Good-Censor-GOOGLE-LEAK <comment><USER2> This presentation briefly mentions but then seems to mostly forget about "Elsagate" which they call the "Peppa Pig scandal".

James Bridle argues convincingly that the genre of bizarre YouTube videos which appeals to the toddler reptilian brain ( [https://medium.com/@jamesbridle/something-is-wrong-on-the- in...](https://medium.com/@jamesbridle/something-is-wrong-on-the- internet-c39c471271d2) ) is not created by hostile or evil actors but instead has evolved orgnically based on what stuff toddlers want to click on. Kids' click patterns reward more video themes like "Elsa tied up on train tracks kissing Spiderman", so the content industry crams more of that stuff into its new content.

The result, after a few iterations, would not have passed editorial controls at 1990s Nickelodeon (!), which would normally have halted the feedback loop, but with no one at the helm -- to "censor" or otherwise exert editorial control -- YouTube's kid-targeted videos are just a whole forest of weird.

Does YouTube want to allow their platform to become a laboratory for rapidly discovering local maxima in very young children's fantasy worlds? Do they have any choice? Should they step in and publish rules for what children's content is allowed? Should they hire some kind of human curator or editor to enforce those rules for child-focused videos? Should Web platforms act in loco parentis?

In this cases, in "the Peppa Pig scandal" style situation, the producers are machine-generating content that gets clicks and the consumers are children.

When the issue is the viral proliferation of "fake news" and hate speech, the content producers are people or state propaganda apparatuses, and the consumers & re-sharers are grown adults.

It seems like it's a different topic with maybe different guiding principles to decide how & whether to censor these different groups of consumers & producers.

<comment><USER3> > Kids' click patterns reward more video themes like "Elsa tied up on train > tracks kissing Spiderman", so the content industry crams more of that stuff > into its new content.

To be fair many of the Tex Avery and Tom and Jerry cartoons with which almost everyone grew up with were a lot more wild than that, thankfully they weren't censored back when we were kids.

<comment><USER4> Tex Avery and Tom & Jerry were wild and a product of their respective era, sure, but they're definitely not as bad as some of the Elsagate videos.

Did you watch them? Some of them are literally snuff, with tons of gore. The stuff of nightmares.

<comment><USER3> > Did you watch them? Some of them are literally snuff, with tons of gore. The > stuff of nightmares

I don't have kids so I only watched what I could quickly find on a simple YT search, and I remember watching that spider man scene the OP mentions (hence why I commented) which I didn't find that scary (even though it was quite tasteless). The gore stuff (probably meaning blood showing and similar stuff) should probably be restricted, of that I agree.

<comment><USER4> Look at /r/elsagate on Reddit for plenty of examples.

</comment></comment></comment></comment></comment><comment><USER5> I'm actually glad to see the conclusion. Everybody wants to censor what they don't like. There are people who believe free speech is not the ultimate value, but rather to protect people from 'harm'. In this case 'harm' being ideas they don't agree with.

The best stance is not to take a side, but to make sure both sides are civil in the expression of their beliefs.

<comment> mellow-lake-day I'm speaking for myself here but I think the Russian bots as well as astroturfing bots need to be censored. And not censored by government regulation but by the terms of service. There are many "active measure" Russian bots active on twitter. Twitter doesn't seem concerned at all mostly because those Russian bots are padding their numbers same goes for FB and reddit.

<comment><USER6> That sounds all fine and well but half the time I utter a conservative opinion I'm accused of being a "russian bot".

<comment><USER7> This happens to me too. I think people do this so they can dismiss ideas without having to refute them.

<comment><USER8> We actually have a good word for this: McCarthyism. If I don't like your opinion, you are a Soviet agent!

</comment></comment></comment></comment></comment><comment><USER9> Slide 66 is particularly interesting, and articulates an observation that I've made:

> Tech firms are performing a balancing act between two incompatible positions

> 100% commit to the American tradition that prioritises free speech for > democracy, not civility

> 100% commit to the European tradition that favors dignity over liberty, and > civility over freedom

It is a very American view that unrestricted freedom of speech is a requirement for a well-functioning democracy, and that any restriction of this beyond censoring direct calls to violence is evil.

<comment><USER10> As a European I have to admit that the American model is vastly superior. Europe had laws to protect "civilty" even before the great wars. American democracy is also more successful in general.

Europe just had the "luck" that censorship didn't become very necessary. In some places it was used extensively and those places are no more today.

And lastly, stripping someones voice implicates directly stripping someones dignity.

<comment><USER11> As a fellow European I have to disagree. Hiostorically speaking, pernal freedoms have been alot higher in Europe than the US (since the time something like personal freedom became athing), slavery was abolished by Great Britain and France way before the War of Independance for example. Also, where exactly is the US democracy more successfull overall? We do have free election in Europe, don't we? And we don't have such things like aelectoral college, not even in Germany where we don't elect the Chancellor directly (that the separation of legislative, executive and judicative powers works better in the US than in Germany with regards to the first two the excepotion proofing the rule).

Cesnrship was used extensivle by every European nation during WW1 and WW2, France convicted journalists of treason during wWW1 and Britain was very restrictive as well during WW2. Both places still exist.

Again, no one is stripping me of my voice in Europe. With the notable exception of redicals within their respective bubbles, there freedom of speech is treated as a direct threat. The existence of these bubbles and the hate speech coming from them has to be freedom speech on the other hand. But hey, extremist always want it both ways. Logic thinking isn't theirs strength, self dilusion is much more comfortable, isn't it?

<comment><USER12> I disagree with most of that.

You can pick and choose freedoms that you value or don't, and say Europe has more freedom. I can go the other way. Here is one: In much of Europe, you have nothing resembling the protection that Americans have under the 2nd amendment.

You have "free election" of approved parties. The other ones are subject to arrest for their political expression. Right now in the UK, Britain First is facing trial for what would be protected political speech in the USA. LePen got charged in France, also for what would be protected political speech in the USA. Geert Wilders, a member of the House of Representatives of the Netherlands, was likewise put on trial.

If you have a parliament that chooses a prime minister, then you have an electoral college. The members happen to be the same as those of congress; that is what a parliament is. It's actually worse, because you don't have a solid understanding of who they might choose.

In your last paragraph you admit that you don't really have free speech, but you don't care because your own views happen to be in favor with the current government. It's all fine to censor people you dislike, and to label them as radicals speaking hate speech. You're in a rather privileged position there, quite lucky to not be under a government that labels YOU in that way.

<comment><USER11> Just one thing, is the electoral college part of Congress and / or the Senate? If not, the systems are not comparable. And I have the impression that you seriously missunderstood my last paragraph which referred to radical elements thoroughly within their communities. Which, obviously, has nothing to do with constitutional free speech.

In the end, we agree that we don't agree. And for the sake of the discussion it is better than we stop now and don't go towards the 2nd.

<comment><USER13> The electoral college (EC) is a state system connected neither to Congress nor the Senate. Rather the EC is apportioned representatives based on the total number of Congressmen and Senators a state has. These representatives are chosen by (and vote at the behest of) the individual states according to how those states choose. All but two states require their EC representatives to vote for the Presidential candidate who won their state vote.

<comment><USER11> Thanks for the answer. I knew that, and yes the German syatem has a tendency to blur the lines between legslative and executive branches.

My comment was in reply to a comment that equated a parliament electing a chancellor / prime minister with an electoral college. Despite all the downsides of not electing the head of government directly they still are different things.

<comment><USER12> It's just a unification of some government functions. The functionality is the same.

parliament == electoral_college + congress

Specifically for Germany and the USA:

Bundestag == electoral_college + house_of_representatives

Bundesrat == senate

So you effectively do have a congress and an electoral college. In your system, they are merged and thus have the same members.

There are six typical roles:

1\. lower legislative body

2\. upper legislative body

3\. electoral college

4\. supreme court

5\. head of state

6\. executive

You have the 1==3 and 5==6 mergers. The USA has only the 5==6 merger. The UK has the 1==3 merger and prior to 2009 had the 2==4 merger.

<comment><USER11> You have to seprete the function frok the body, this is a very relevant separation. e.g. the head of state in Germany has close to zero actual power while France has a very powerfull presidential system. The only thing comming close to electoral college in Germany is electing the Head of State. Both, candidate and electors are caeefully selected by both chambers of parliament. Personnaly I'm not happy with that, parties tend to have way to much power in the German system.

All the Bundesrat has in common with thr Senate is being a second chamber. It is not elected directly as a body. Instead the prime ministers of ech state are making it up. So it is voted for indirectly during state elections. Votes in the Bundesrat are than based population, more or less (if someone knows the details that'll be cool). coalition governments different to the one on the federal level usually abstain (e.g. parties A and B govern federal, C and D being the opposition while parties B and D govern a certain state that state will note vote on certain issues).

In a democracy, these details do actually matter a lot. Otherwise you won't be able to ditinguish democracies on paper from real ones.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> It's interesting that this document calls Arab Spring "the high point in positivity" of the internet. From what I understand, most countries are even worse off now. Libya in particular is still stuck in civil war to this day.

<comment><USER15> I think that's the point. Arab spring, the chance of positive change around the world because of it, pre Snowden(!).

It's not that things weren't awful then just people didn't know what was going on or how things would turn out, so we were all upbeat about the internet.

<comment><USER14> I disagree. People know how awful their lives are by their well being. The internet offered people the ability to organize and topple their corrupt government, but that doesn't mean that the new people in charge are going to be better.

<comment><USER15> Definitely. The awfulness that I implied was meant to be mass surveillance. That people could organize and resist was great, needs to be way more of that, not less.

Still, that moment has passed so people aren't positive about our connectedness in the same way cause it doesn't seem to be causing any progressive/democratic changes.

</comment></comment></comment></comment><comment><USER16> Underpinning the whole question of censorship;

"Under section 230 of the Communications Decency Act, tech firms have legal immunity from the majority of the content posted on their platforms (unlike 'traditional' media publications). This protection has empowered YouTube, Facebook, Twitter and Reddit to create spaces for free speech without the fear of legal action or its financial consequence."

Censoring content is suspiciously like editorializing content, and steps social media a lot closer than they want to being _publishers_ and not _platforms_.

Proceeding with censorship seems to carry the risk of losing immunity under Section 230.

<comment><USER17> _Proceeding with censorship seems to carry the risk of losing immunity under Section 230._

Nope. The whole point of Section 230 is platforms can make and enforce rules, and still have a safe harbor. Otherwise, they all would have lost their safe harbor _decades_ ago.

<comment><USER18> The issue is that Google is now associating itself with the role of a "publisher" rather than a "platform" (in particular on slide 68). Publishers are not protected under Section 230.

</comment></comment></comment><comment><USER19> Why did this have to be leaked? Seemed like a good summary on why things are the way it is with social media v moderation.

A whole lot of platforms could do with the conclusion.

Be consistent, be responsive and be transparent.

Who wouldn't love Google to be more transparent?

</comment><comment><USER20> > The Arab Spring was the the high point of this positivity - a visceral > example of the power of digitalised free speech.

Yes, millions of refugees is obviously not the consequence at all.

<comment><USER21> Everything else was rather unsurprising, pretty much what I expected. But that was the part that I had to read again. Hoping they just copied that from a 2013 pamphlet. If they consider Libya's slave markets ( [https://www.cnn.com/2017/11/14/africa/libya-migrant- auctions...](https://www.cnn.com/2017/11/14/africa/libya-migrant- auctions/index.html) ) and Sirya the high point of positivity, I'd wonder what they consider the low point.

</comment></comment><comment><USER22> I just finished skimming the whole thing—did Google just trick Breitbart into publishing propaganda for them? (I'm reminded of the Valve "employee handbook.")

<comment><USER23> Not really. It'll have the same result as literally every other revelation in the media.

The side completely, 100% opposed to any restrictions on speech (including "policing tone" as outlined in this presentation) will see this as corporate meddling in people's expression.

The side that supports speech regulation will see this as a structured plan to curb the kind of speech that's considered "harmful" or whatnot.

This presentation doesn't contain anything outside the current ideological dichotomy, no original or unorthodox thoughts or ideas.

</comment></comment><comment><USER24> The underlying premise of this, if real, is that these companies and their centralized platforms ought to exist. "Never expect a man to understand something his salary depends upon him not understanding" and all that.

<comment><USER25> Well, given that it's done by Google employees of course they'll want to continue to wield their power. For example, they mention "regulation" as a punch-line, IOW, the assumption is that regulation of any form is bad.

</comment></comment><comment><USER26> The presentation seems quite balanced.

Probably not the spin that Breitbart was hoping for.

<comment><USER27> I agree, assuming that it's real. (Which, considering Breitbart's history, could not be the case.)

<comment><USER25> Breitbart wouldn't benefit from faking it. If they did fake it, they would have made it look much more unbalanced whilst justifying more censorship.

</comment></comment></comment><comment><USER4> This is a really good document, mostly describing current events and trends in censorship.

Most of the policy it advocates is basically being consistent and open about how Google is handling issues, and how censorship is being applied.

The title is click-baity, but that's not so bad.

</comment><comment><USER28> dignity/civility should be a self determined value rather than one instated by authority. it is impossible to create a universal standard of conduct that will be adequate for everyone and we don't need to. you can call me a faggot or tell me to kill myself as much as you like and i really wont care at all, i want to see everything short of direct and malicious efforts to cause me real life harm (and arguably i want to know about those too). on the flip side you have older users who may be completely averse to course language or any interaction that falls beyond tv standards of etiquette, things that are relatively tame by internet standards may be completely offensive to them. how do you create a set of standards across your product that are adequate for both use cases without artificially limiting appeal to a single audience? empower users with the tools to define their own experiences and, if they so choose, filter out what they don't want without assuming what that is. perhaps you could even let users display their version of a content rating so that others could see what content they will and will not filter rather than the communication breakdown that emerges when some messages are opaquely censored. you could even use an honorific system to better determine what is an adequate level of filtering between two users. you might not want to hear 'i'm gonna fucking kill you' from a total rando, but if it comes from your spouse you probably should. don't tell the customers what they want when you don't know the answer.

</comment><comment><USER29> HN seems super strongly opposed to Google providing censorship in China. Do they feel the same way about Google applying it to the rest of the world?

<comment><USER30> There's a strong difference between state mandated censorship and a company voluntarily censoring content on their platform.

A company has the absolute right to prohibit any content on their platform that they so choose. There's freedom not to use Google services.

Calls to regulate independent companies are purely ludicrous. If Facebook said tomorrow that any positive mention of, say, Paul Graham, would result in immediate account deletion, that'd be their choice. Very valid criticism from the perspective of a user would be warranted, but that's where it should end.

<comment><USER31> > There's freedom not to use Google services.

Using Google services is now required by many public schools in the US. That's where all the homework is posted, for example. Now in the US there's freedom to not attend public school, of course, so technically you have the right to not use Google services. But in practice the vast majority of people would not be able to exercise that right in this case.

Similarly, a number of schools are starting to do communications with parents purely through Facebook. And I expect this trend will keep getting worse before it gets better.

> Calls to regulate independent companies are purely ludicrous.

If they're really independent companies, yes. If they're government-sponsored monopolies, on the other hand, the calculus is quite different. And we're quite close to that line, if not over it.

You could argue that the right solution is for governments to not enshrine these companies in these monopoly positions. That would be lovely, obviously. Too bad the companies are spending all this money to get into those positions (see Google Classroom).

<comment><USER30> I'd find a private school / homeschool argument disingenuous, so I'm with you that far.

Google Classroom is a fair point (schools also use Google Docs and the like as well), but I don't believe it holds water.

Governments would be well within their rights not to award contracts to, or use the services of, companies they felt were not respecting the values of free speech. The difference between this and active regulation are that one is voluntary for the company (must obey this term for eligibility for extra reward) and one is mandatory (must obey this term or be punished by the law).

I don't have much to say about communicating to parents through Facebook, other than that they should still offer optional email communication.

<comment><USER31> For what it's worth, I don't understand why you're being downvoted... :( I just upvoted you.

I agree that the optimal solution would be for local governments to not rely on Google like this. What's not clear to me is what the best course of action is in the world in which they _are_.

I think having "no propaganda aimed at elementary school students" regulation may be the only way to solve the coordination problem here, but of course that has the obvious flaw of it being hard to agree on a definition of "propaganda"...

</comment></comment></comment></comment></comment><comment><USER32> The most annoying part of this document is the watermark. It seems like a cogent summary of different ideas in the space - and doesn't advocate for "good censorship" (I think the title of the deck is provocative and unhelpful).

</comment><comment><USER33> Here in 2018, I'm not that worried about Google's position as world's information arbiter and how it chooses to censor content. But I do worry a bit, as the path to hell is paved with good intentions. How will this evolve over the decades to come?

Where does the line between "hate speech" and legitimate criticism get drawn? Criticism is often crude. Humor is often crude. Sometimes humor, even crude humor, cuts to the core of an issue better than any intellectual discussion or essay could possibly yield. The U.S. itself has a long tradition of pointed, sarcastic political cartoons, as an example.

We need not reach back too far in memory to find an example of grey area between "hate speech" and "free speech": The Dutch cartoonist Kurt Westergaard and his infamous Muhammad bomb cartoon.

I think Google and other social media giants will find themselves in an impossible situation, if they haven't already. To be a good censor is to declare the "rightness" and "wrongness" of content in a consistent manner. However, in order to do so, you have to stake a position.

However, these companies sprawl too far and too wide to stake a position without alienating huge swaths of the population. And without making it all too easy for factions to believe that their side is being discriminated against.

<comment><USER34> > _Here in 2018, I 'm not that worried about Google's position as world's > information arbiter and how it chooses to censor content._

Why, if I might ask?

"Google" has entered the common lexicon as a generic term for "search the internet for something". The amount of power they wield, ignoring all other power aside from the ability to rank the search results of most internet users, is _massive_ and I think this cannot be overstated or minimized.

This is a non-fallacious version of the slippery slope. Just because you're okay with the "do the right thing" nee "don't be evil" Google of today does not mean you'll be okay with the Google of tomorrow having that power. Consider _very_ carefully whether you want any one particular company to have that power, and what the remedies are if Google ever does go full evil.

On a side note, it absolutely reeks of double standards on many of the commenters here to castigate Google for their Chinese censorship while giving them a pass for what is described herein. Censorship is only bad when done at the behest of a state? I don't understand this sentiment.

I want _no_ third party deciding for me what is "hate speech" and deciding I shouldn't be able to see it as a result. With a special emphasis on the second part of that phrase.

</comment></comment><comment><USER8> The presentation mentions "global inconsistency" as a problem, but I disagree. Communities have different community standards, so they should have different moderation.

As an example, it is rather unfortunate that American obscenity standard is enforced against the world at large.

</comment><comment><USER35> Censorship alone is not evil. The problem is, once you have infrastructure in place to make it easy, it will be abused. And if that infrastructure is centralized, the stakes for abuse are much higher. It's the same old problem of "who regulates the regulators". Rather than the issue being about "censorship bad / free speech good", I think the heart of it is: There's simply a lack of confidence that tech giants like Google are part of a larger system with checks and balances, and they appear to be making unilateral decisions behind closed doors.

<comment><USER10> > Censorship alone is not evil.

Restricting access to information generally is until a good reason is given. That could be the protection of personal information for example. But without justification I would heavily disagree with that statement.

<comment><USER36> There seems to be justification though. If a "news" website is constantly publishing stories that are objectively false, or based on some factual event but distorted beyond any verifiable aspect, then Google has the right (and I'd argue the duty) to remove that content from its platform, especially if that content is targeted at individuals.

</comment></comment></comment><comment><USER21> It would be good for them to be more honest and transparent, and this leak is a nice step in that direction :-)

But to be serious, something like "We take these positions and stand behind these values and we're proud of it" would seem better than claim they are a neutral platform and they welcome all points of view and let users create and share whatever content.

This didn't even have to be a leaked document. They should have posted it in their "about" section right on the front page. If anyone doesn't like it they can go and make their own Google and share content there instead.

There was the leaked company meeting video after the 2016 elections with people crying and saying "we lost" and then users are supposed to believe those executives will turn around, wipe their tears, walk back to their desks and be unbiased when it comes to moderating news, search results, Youtube videos, charities they sponsor, etc? That's probably unrealistic... So why not drop the pretense and come out and be proud of what they support. Nobody will be surprised and many will welcome it including most of their employees.

</comment><comment><USER37> I think there is a massive market opportunity here, and all the competitor has to do is build Google from 5-10 years ago - when you could actually still get decent results for your search, warts and all - as opposed to the wildly unrepresentative kindergarten/pollyanna picture of the internet they currently return.

</comment><comment><USER38> Has anyone else ever wondered how some of the numbers about internet compares to a real world? Like,

* "2.6 million tweets contained anti-Semitic speech during the US presidential election" \- how many conversations there where, in real word, about the same topic and contained anti-Semitic speech?

* "26% of American users are victims of internet trolling" \- how many are victims of trolling in real word? Or in schools?

* "40% of internet users have been harassed online" \- how many persons have been harassed at work places? Bars?

* Governments under cyber attack? How many of them are targets of espionage? Or have many companies are targets of espionage?

I'm not saying that these are not bad things, nor that those shouldn't be addressed - I'm just wondering if these things are as bad as they might seem to be, when compared to "the real world".

<comment><USER39> I took that to be the point -- we tend to be at our worst online, thanks to the unique combination of anonymity (I can say whatever I want with as many accounts as I want, without meaningful consequences) and absence of social cues (there's nobody around me, so I have no incentive to soften my language or weaken my opinions).

In other words, the way we talk online is _not normal._ Even outside of the free speech debate, it's worth noting that.

<comment><USER40> You could also see it as the inverse. Online we talk as we really are, saying what we really think, and thus the quality and depth of the discussion will inevitably be higher and deeper than in the 'real world' where we are faced with relentless groupthink, desire to conform, self-censoring to avoid unrelated career blowbacks and so on.

Moreover online people can take the time to write something good (not saying they usually do of course), whereas in-person debates usually suffer from being shallow, filled with interruptions, half baked ideas, people getting artificially upset to try and 'win' and so on.

I'd actually like to see far more experimentation and research in online commenting and discussion forums. There's really been very little movement in this space since CmdrTaco retired.

<comment><USER41> I'm still here! I wish people would try more crazy stuff. I'd even help brainstorm the crazy!

<comment><USER40> No way! That's the response I least expected! :)

I'm a huge fan of the work you did on Slashdot and Slashcode back in the day. It's still by far the best thought out moderation system I've seen.

I'd love to see a modern respin of Slashcode that reused and enhanced the moderation ideas. Unfortunately my spare time project slots are all consumed already :(

</comment></comment></comment></comment></comment><comment><USER42> Quite a neutral and concise briefing I think covering all sides. The unfortunate part of the debate is viewing freedom/liberty vs diginity/civility as exactly opposing forces. That these are seen as opposing forces justifies the view of resting in the middle as though it exists.

Instead of thinking so linearly along these two dimensions, I would suggest using a wider lens. Instead of striving for some of both in a common platform, we should strive for some of both concurrently. I was encouraged by the example of Twitter unverifying accounts, but not banning them, but even that suffers from the single platform effect since unverification is objectively harmful.

Those with qualms concerning unfavorable content should ask themselves whether the concern is that it's promoted/visible by default or that it exists at all. The latter is too hard line of a stand to be seen as anything but censorship and should only be applied in the most extreme cases. But the former is something we can tackle. Simply default to safe and let the user opt in to increasing levels of unsafe. You'll always have the problem of being the arbiter of what resides at which levels (granted you can ask content creators to self-categorize with threats of violation for clear miscategorization) but at least it's better than outright banning/deleting. Just make sure that whatever level the user has set, content that is visible is all treated equally under the algorithms (i.e. no demotion). I personally would turn favorability filters off and encourage others to do the same, but at least defaults exist and levels of moderation can be chosen.

Finally, to shift the rant a bit, I just want to say I welcome self-imposed solutions over legal requirements. I am encouraged to know that, while it's hard to compete with a behemoth (why would you try), you can still legally publish your own content sans filter on your own site or a site with similar views towards your own. We might prefer all the popular sites respect our views on what is allowed, but since that's obviously impossible in a global medium due to cultural subjectivity, don't attempt codify it legally.

</comment><comment><USER43> I read the whole thing, all 85 pages of it. Based on the content, and based on how I read it, I'm now almost 100% sure, not completely, but almost sure, that it is, indeed a Breirbrat News Exclusive. I think it actually says so somewhere on the pages.

</comment><comment><USER44> So we're all supposed hope and pray Silicon Valley elects to honor free expression?

We need a new internet

</comment><comment><USER45> The monopolists becoming ever more aggressive censors, is the strongest argument there can be for ending their monopolies. Once a company acquires a monopoly over a critical means of public information distribution (search, social, etc), their policies of restriction formally become censorship. They've become an impediment to functioning democracy.

Freedom of speech is too important to leave to the monopolies of Google and Facebook to decide what qualifies and what doesn't.

</comment><comment><USER22> The watermark makes it really annoying to read, but unless it gets refuted by Google, it has to be real, right? (That's how these things work these days...?)

<comment><USER46> The Breitbart watermark makes me _very_ suspicious, I would treat it as probably worthless until we see more reliable sources.

<comment><USER47> They're definitely not the most reputable news source and many of their opinion pieces definitely step into fake territory, but I think outright falsifying an entire document like this would be a very extreme move, even for them.

<comment><USER48> More likely that someone else falsified it and they didn't fact check correctly. But Google's statement appears to confirm that it's real.

</comment></comment></comment></comment><comment><USER11> In a nutshell: Google, Twitter and Facebook followed a very liberal definiton of what they are, created a platform to promote free speech to get free content from users. Being a platform, they did nopt have to edit content like print media has to. This created traffic and drove ad revenue. And everything was fine.

Then some bad stuff happened, advertisers, not users, complained by withdrawing money. And who would have guessed, that was an issue. The situation these companies re now in sucks, either they start editing (which is not censorship) and risk being treated like traditional media eliminating their competitive advantage. Or they don't and risk loosing ad revenue.

IMHO the underlying reason is that free speech and free press offline is lot easier because there are a ton of different outlet, all with a somwhet limited reach. People like Rupper Murdoch already put these limitations to a serious test. Online it's much worse with a couple of global de-facto oligopols. I wouldn't be surprised if societies and governments are moving to regulate that one day.

That being said, the fact that all these companies, leaning apparently heavy on " 100% commit to the American tradition that prioritises free speech for democracy, not civility", are at the same time more than happy to ignore that stance in certain countries to maintain a global foot print (p.47 of the Google doc comes to mind). It seems, after all, that money is king and everything else secondary.

Admittedly, FB is much worse that Google in that regard.

EDIT: All of the above points are more or less cited from Googles own document. Except the part with e oligopol which is my own conclusion.

</comment><comment><USER49> I can understand why Google, as an engine, should err towards neutrality of information, without arbitrating even hideous content.

But I've never really understand why social networks can't, or shouldn't, say "This is the type of community we are, and what content we find acceptable."

<comment><USER50> Because Facebook, unlike say a subreddit, is not a a community formed around a certain topic. There is no 'we' in particular.

<comment><USER49> Isn't the "we" whoever developed and hosts the service?

The idea that you can only limit a community if it's dedicated to a specific topic is non-sensical.

<comment><USER50> I am not sure if I understand your argument.

If whoever develops and hosts the service gets to limit what is allowed, then why Google shouldn't censor its search results?

</comment></comment></comment></comment><comment><USER51> I caution against latching onto the title and making assumptions. The bulk of the content is analyzing where the current censorship position came from and the conclusion is for Google to be more open with their stance and also be more equal with applying it.

As for the why:

      Why the shift toward censorship?
      - User Demands
        - before, In the absence of rules, bad behaviour thrived
        - now, Appease users, maintain platform loyalty
      - Government Demands
        - before, Governments were unhappy to cede power to corporations
        - now, Respond to regulatory demands, maintain global expansion
      - Commercial Demands
        - before, It's impossible to neutrally promote content and info
        - now, Monetize content through its organisation, increase revenues
        - before, Advertisers were wary of unintended placement and endorsement
        - now, Protect advertisers from controversial content, increase revenues

As for the conclusions:

      Don't take sides
      Police tone instead of content
      Enforce standards and policies clearly
      Justify global positions
      Explain the technology
      Improve communications
      Take problems seriously
      Positive guidelines
      Better signposts

Most of the document is non-controversial. There are places where it can be seen as obviously left leaning, but there are also places where it acknowledges that sometimes the right has been treated worse:

      "[Richard] Spencer doesn't get to be a verified speaker; Milo gets kicked off, but I know
      plenty of pretty abusive feminist users or left wing users,
      expressing themselves in exactly the same way
      that the right is being penalised for,
      who are permitted
      to perform certain kinds of speech. That's going to get Twitter into

<comment><USER25> I don't know where you got "left leaning" from unless you're bending over backwards to be fair, they are if anything centrists which makes sense since they're Google. For heaven's sake, the slide about conversations of free speech, I see establishment centrist media pieces on the same plot as Breitbart and WorldNetDaily. An equivalent would be listing the Young Turks or alternet.

<comment><USER51> I think it is fair, but I can imagine a scenario where a person reads a line and thinks "this is obviously leftist".

Personally, I think company's have been bending over backwards to prove they aren't biasing against the right.

</comment></comment></comment><comment><USER52> All these "let's be more inclusive by focussing on what/how we can exclude" activities these days are really scary. You can't be inclusive by being exclusive.

</comment><comment><USER53> Interesting Quote of Current President (Pg 48)

"""When it comes to users, all of this bad behaviour and mismanagement... Breads Conspiracy Theories

"Google's search engine was suppressing the bad news about Hillary Clinton" \- Donald Trump, 2016"""

<comment><USER54> I wonder how many conspiracy theories about Trump have been censored by google?

<comment><USER54> Got downvotes but I can't explain why the conspiracy that trump is a russian agent is not a conspiracy theory that should be censored and it would be nice for someone to explain how that works.

</comment></comment></comment><comment><USER55> Today I learnt OogleBot is ignoring the robots.txt file on my private Gitea server:

git[dot]habd.as/robots.txt

A quick search for "after dark habdas" reveals the second of two rules in the robots file, which explicitly blocks Oogle at the site root, is clearly being ignored.

Of course I created this rule before putting this server online and Andex is the only webmaster console I registered this site with. But that's besides the point. There's obviously a lack of respect for the robots file or a gross error in OogleBot as far as I can tell.

So now you know.

<comment><USER56> You're doing it wrong, not Google: You're blocking the wrong bot user agent. You want "Googlebot", not "Google". Google documents this...

</comment></comment><comment><USER57> I think the thing that is missing from the presentation is that Google is positioning itself to take a tone policing position, but that completely ignores damage to actual people. People injured by the powerful and the state will be angry, will go viral, and will likely violate tone policed policies. People that drop white nationalist (genocidal) rhetoric with a smile get to push their case. Furthermore, the economics of the situation mean that Google et al are structurally incapable of reforms that dilute their power or reduce engagement. The alternative that preserves their power is to exert overt censorship as they will do in China. Thankfully, we are not there yet in the US.

Tone policing generally favors knocking down the left anyway, which is favorable to elites whom are the targets of their ire.

</comment><comment><USER58> All this shows is that Google has become a zombie company. It is more interested in building moats and pleasing politicos to solidify their position than in actually doing useful things.</comment>


Quantum Computing explained with a hands-on tutorial in 10 mins - <AUTHOR> https://medium.com/@viveckh/build-a-quantum-circuit-in-10-mins-ft-qiskit-ibms-sdk-for-quantum-programming-75435b99ee9e <comment><USER2> The article has many errors. Gold is not a superconductor and the explanation of entanglement is wrong.</comment>


Stop tolerating mediocracy - <AUTHOR> https://medium.com/from-a-self-taught-programmer-to-another/stop-tolerating-mediocracy-6b735513e1f9#.71l3wmgpl <comment><USER2> Meh. The best thing that happened to me in my life was realizing I was mediocre. It made the work/life balance a lot easier to manage, and gave me a lot more humility since I felt I had less to prove.

I am in no way a bad coder, but looking at the commit history of some projects just makes me stare in awe at what some people can do. I remember spending a conference in a sofa next to Zed Shaw as he was smashing out the basis of mongrel (i think it was). I was awestruck. Not only did he work at about three times my speed, the code was pretty as well.

<comment><USER3> This is wise. To be truly happy you need to accept your own mediocrity. Only then can you start to accept yourself.

</comment></comment><comment><USER3> The irony is that the word is "mediocrity" when referring to an individually mediocre person, as this article seems to advocate. Unless of course your goal is to call out the culture of the company which is entirely mediocre.

Anyhoo the point is that you're better off being empathetic and understanding of people who you judge as in some way not be "adequate". And even then first have a look at yourself in the mirror - are you really so awesome? And even THEN, people don't like being criticised - it's the best way to destroy a relationship.

So perhaps if your colleague isn't performing at the level you expect you can either be quiet or help them get to the next level.

</comment><comment><USER4> Not everyone responds well to criticism. Telling people they suck is a very mediocre approach.

</comment><comment><USER5> As far as I can tell, the word intended here is "mediocrity".</comment>


Startup Chile's Successful Companies - <AUTHOR> http://blog.entrywire.com/chiles-public-portfolio/ <comment><USER2> From the article: _" Most of these acquisitions appear to be "acquihire"-type deals, and the terms are undisclosed."_

 _" Only about 1% of Startup Chile companies have completed a Series A (or greater). For these companies, the average time from founding to A round is 2.25 years. Three companies have reached B (SaferTaxi, Cabify, Opendoor), and Cabify reached C. It's worth noting both of these companies are taxi-on- demand."_

 _" < 1% of it's companies have achieved a liquidity event."_

The success that isn't a cab company, Opendoor, is basically an AirBnB copy. Uber is moving into Chile and seems to be beating SaferTaxi.

That's disappointing.

<comment><USER3> Why is it disappointing?

</comment></comment><comment> guard-of-terra Chile is so awesome that I'm seriously consider moving there. The contrast with neighboring countries is also astounding.

</comment><comment><USER4> DataCamp also did TechStars NYC.

There are also successful companies that were bootstrapped, e.g. TheInternGroup.

<comment><USER5> the intern group is a joke at best. getting rich kids to pay for internships to make their CVs look more international. There isnt any innovation or disruption or even value creation involved. I'm not sure its something SUP Chile needs to be proud of.</comment></comment>


All Shopify Stores Now Use SSL Encryption Everywhere - <AUTHOR> https://www.shopify.com/blog/73511365-all-shopify-stores-now-use-ssl-encryption-everywhere <comment><USER2> Appears they're using Let's Encrypt [https://news.ycombinator.com/item?id=11020195](https://news.ycombinator.com/item?id=11020195)</comment>


Study finds 25 percent of Android apps to be a security risk - <AUTHOR> http://www.pcworld.com/article/2013524/study-finds-25-percent-of-android-apps-to-be-a-security-risk.html

<comment><USER2> ...and offers a product to solve this; incidentally, the product is from the same vendor as the study. In other words, "Never ask a barber whether you need a haircut."</comment>


Ask HN: Will Twitter Resumes Work? - <AUTHOR>

A social media event today is promoting the idea of twitter resumes with the hashtag #smw140resume. So far, it looks like dozens of applicants have shared their skills (and in some cases personality). But do you think hiring managers will bite? <comment><USER2> It certainly doesn't hurt. Any new venues to be noticed is one step forward. Only thing is not many people might know that this is happening so its hard to know how many people are going to be noticed. I believe that people should be building relationships on twitter anyways and then leveraging them for jobs.

<comment><USER3> Good point - it can be a great way to start a relationship, and then you can leverage that into a job or something else later on. I also agree with the commenter below who adds that it's industry dependent. Tech startups might be more willing to consider a twitter resume than a financial services firm, for example

</comment></comment><comment><USER4> No, I don't think 128 characters is enough to demonstrate any amount of competence or skill.

This idea is novel, but not practical.

</comment><comment><USER5> depends on the position.</comment>


Blogging is the New Resume - <AUTHOR> http://ryanhoover.me/post/70793631386/blogging-is-the-new-resume

<comment><USER2> Uh, no, Github is the new resume. Just saying.</comment>


HTML to PDF - <AUTHOR> http://www.htmlpdf.com/

<comment><USER2> Chrome has "Save as PDF" in its print dialog, does the page offer something better than that?

</comment><comment><USER3> The opposite would have been much more interesting :)</comment>


Ask HN: What sort of split do you offer a co-founder? - <AUTHOR>

Specifically, I'm wondering how much you'd offer a technical or non-technical co-founder for an idea that you're already working on?  I'm technical and have been working on a startup for a couple months and still have a couple to go before a beta launch but have been thinking about trying to find a designer/ux co-founder to help out on the front-end.<p>I was originally thinking 60/40 but then started wondering what other people have done in this situation.  So what have others done in this scenario? <comment><USER2> If you give 40% to a designer, how much are you going to give to your biz dev person (when you need one in three months when your beta is done)?

If you both use equity to give to the biz dev and the biz dev requires more than 20% to retain, you just lost majority of your business. :(

40% is way too high for a designer.

Also, make damn sure you vest any equity you give out.

Remember, you can only give it away once, so do so sparingly.

<comment><USER3> This raises the question of whether you need a co-founder or a hire. It depends on the business.

IMO "40% is way too high for a designer" is too general. It depends on how significant a part of the leadership team they're going to be. Since you say you want them to "help out on the front end" - I'd lean towards guessing that you might need a hire, not a co-founder.

<comment><AUTHOR> Also a good point. I wasn't too specific but I was thinking more someone with previous startup experience and also at least a little bit business savvy.

</comment></comment></comment><comment><USER4> 60/40 sounds fair if you already have a good deal of effort into it.</comment>


Facebook lawyers explain to a judge that privacy on Facebook is nonexistent - <AUTHOR> https://theintercept.com/2019/06/14/facebook-privacy-policy-court/ <comment><USER2> Users grasp the idea that posting on social media is a public thing. It's like getting on stage and shouting to everyone in the room... It's not private.

But, Facebook is invading privacy in subtle ways that users aren't so good at grasping. Like the fact that Facebook remembers every website they visit. And how long you linger on a post in your timeline. And collects your location data even when you're not trying to broadcast it. And analyzes all of your private messages. And trains neural networks to recognize you so they can correlate you with other pictures throughout the internet (and who knows, maybe they're sharing those models with random governments or other companies).

That stuff is the real privacy violation, not the public posts. And that stuff is intentionally obscured from the users and vaguely articulated in their privacy policy.

<comment><USER3> I block every tracker and don't have Facebook installed and yet they show me ads that are uncanny. Rode my bike and hurt my back. Pretty sure I searched for remedies - likely on DDG. And bought a massage ball on Amazon. Instagram is filled with ads to address my back pain.

<comment><USER4> Did you buy any back pain stuff at the pharmacy? Maybe it's tied to a store loyalty card or credit card.

<comment><USER5> This. The shadow demographic profiles that Experian, Facebook, and others have on people are a lot more robust than just online cookies.

</comment></comment></comment></comment><comment><USER6> Reading through that article, the FB lawyer's argument is pretty reasonable:

> I go into a classroom and invite a hundred friends. This courtroom. I invite > a hundred friends, I rent out the courtroom, and I have a party. And I > disclose — And I disclose something private about myself to a hundred > people, friends and colleagues. Those friends then rent out a 100,000-person > arena, and they rebroadcast those to 100,000 people. I have no cause of > action because by going to a hundred people and saying my private truths, I > have negated any reasonable expectation of privacy, because the case law is > clear.

Was there more context the article left out about the specific level of privacy the party expected?

<comment><USER7> I don't see how it's reasonable for Facebook to enable an app that advertises itself to users as a simple "academic survey" to harvest the private data of not only those users but all of their friends as well. Is it so unreasonable for users to expect that their data would not be harvested by a survey app installed by an online "buddy" who they may have never even met in person?

Also I think the analogy the lawyers brought up is misleading. Instead of renting out an arena, it's more like just one of those friends accepted a 1000-page terms of service a couple decades ago for a random forum, and instead of "rebroadcasting" what's "disclosed" at one party, it's more like the forum is now publishing their per-minute GPS location for the past year.

<comment><USER6> I agree. Doesn't FB also agree, and hasn't it already disabled that kind of API access? At least when I tried to get access to friends-of-friends info for an app I was working on a couple of years ago, there was no way to request it.

</comment></comment></comment><comment><USER8> Facebook is awful in numerous ways but this article is misleading. FBs argument is entirely correct. The problem is of course that this is not the issue with Facebook.

Facebook is like a stalker. Even if he only uses public information, like following you in the street and sitting down next to you in a cafe to listen in on your conversations, it's still creepy, and it is not expected, even if you have the audacity to walk about and talk to people in cafes.

<comment><USER9> And the best thing you can do is ignore him and never talk to him.

<comment><USER10> I think the "beat thing you can do" when someone's stalking you is often "go to the police"

</comment></comment></comment><comment><USER11> Cambridge Analytica was never a "breach" \- Facebook worked exactly as designed.

This is just demonstrating the government/LEO's own definition of Third Party Doctrine which says once you give information to someone else, you have no reasonable expectation of privacy. This is why law enforcement _claims_ not to need a warrant to get your bank records, call history, or internet traffic.

Like it or not, disagree or not, it's clearly established until States or Congress roll it back. SCOTUS stepped in last year to block cell-location history but that's one piece of the problem.

Ref: [https://en.wikipedia.org/wiki/Third- party_doctrine](https://en.wikipedia.org/wiki/Third-party_doctrine)

</comment><comment><USER12> People migrated from blogs to Facebook so they could _selectively_ disclose their private information, only to the people they wanted. For a time, it wasn't even clear how FB could make money operating this noble public service. Remember that?

The legal argument in the article is just a good old fashioned gaslighting of FB's users, at least the original group. Next they'll claim email isn't private....

</comment><comment><USER13> Just a corporate entity passing the blame on their massive user base. They need to impose some restrictions or get regulated.

<comment><USER14> Only regulation needed is to prevent FB from buying off their competitors.

FB would have to innovate internally or turn into MySpace without without Instagram, WhatsApp and others [https://en.wikipedia.org/wiki/List_of_mergers_and_acquisitio...](https://en.wikipedia.org/wiki/List_of_mergers_and_acquisitions_by_Facebook)

</comment></comment><comment><USER15> Why does the lawyer keep bringing up "a hundred people"? Is there some kind of official policy where FB respects your privacy if you share with 99 or fewer people? Or is it some calculated legal argument to emphasize that anything shared publicly on FB is going to be seen by plenty of people?

</comment><comment><USER16> The worst thing you can do to Facebook is to stop using it. Sure they keep a profile on you even if you don't have an account but their power is derived from people using their platform.

<comment><USER17> You have more power than that. If you want to hurt Facebook, spread the ideas that Facebook is unhealthy, uncool, and/or a detriment to society. In addition to stopping your personal use, influence your friends to deter them from using it too.

<comment><USER18> Don't be "that guy". It doesn't work any it only makes you less fun to be around. Nobody wants to get lectured about how they're doing something bad or stupid. People are well aware of the problems with Facebook. Maybe they'll change, maybe they won't. If they do, please don't assume it was because of _you_.

<comment><USER19> Alternately, do be that guy. I love hearing about stuff I would be concerned about if only I were aware and I love personal testimonials from people I know and respect about things I had only read about previously. I often change because of specific things that people said, and like to tell them, because it takes bravery to hold an opinion, put it out there, and to be convincing in defending it.

I guess my ego is strong enough not to feel contempt towards people who know things that I don't, because I've never met anyone who didn't. If I already know, I'll tell you.

<comment><USER18> Okay, here's something you clearly don't know: You're _not_ actually that person, this is the self-image that you have constructed for yourself. It's an idealization of a rational human being that you admire, but that doesn't actually exist.

On another note, let's say you _were_ this exceptional kind of human: Your advice would still be bad. Most people are _not_ like you. Most people will react negatively, perhaps without you noticing. It wouldn't be very smart to go out into the world and assume that everyone works works the way you do, or that at least _they should_.

</comment></comment></comment></comment></comment><comment><USER20> How is "leave the platform if you don't like it" not the solution here?

Facebook's creepy stalking of its users is well known, and it's practically their only method of funding themselves. The calls to regulate Facebook just sound like entitled users attempting to use the hammer of government to reshape the site into what they want.

Can anyone here make a case as to why regulation is preferable compared to letting the free market force Facebook to change or die? I'm legitimately struggling to find any legitimate reason to do so.

<comment><USER21> Moxie Marlinespike (Openwhisper Systems, Signal) makes a good argument for why that doesn't work [https://m.youtube.com/watch?v=DoeNbZlxfUM](https://m.youtube.com/watch?v=DoeNbZlxfUM). Recommend watching the whole talk.

<comment><USER22> Making an argument doesn't change the fact that I am informed, made a decision, stopped using it and have suffered NO HARM. I made a tradeoff that I thought was valuable. Anyone demonstrably can, but are usually less interested in making a philosophical judgement than enjoying the dopamine reward from communal outrage.

</comment></comment></comment><comment><USER23> FB notion of privacy is wrong. Privacy is not about what i publicly share.

My right to privacy is about all the info they secretly collect, keep and sell to make a profit. My right to privacy implies that they do not keep a shadow profile on me and my relatives who are not on Facebook. My right to privacy implies that they dont read through me phone messages at will. My right to privacy gives me the freedom to avoid being spoon fed by the highest bidders such as Trump, farage et al

FB knows this and they consciously divert the attention towards what we publicly share. Evil.

<comment><USER18> Facebook can't read through your phone messages unless you give them permission to read through your phone messages.

<comment><USER24> If everybody I send messages to have decided to install the facebook app on their phones, then the decision is taken out of my hands. Facebook will receive and store messages that I wrote, even though Facebook and I do not have a consensual relationship.

<comment><USER25> Any time you communicate with someone you surrender to them the right to control what happens to that communication. This is a property of human communication that predates Facebook by millenia. If you tell secrets to someone you can't stop them from spreading the secrets to other people. The onus is on you to vet the people you share confidential information with.

<comment><USER24> If neither facebook nor the other person is disclosing to me that facebook is listening, then in two-party consent states that certainly seems to be against the spirit of the law, if not the letter.

<comment><USER18> Even then, the responsibility wouldn't be on Facebook, but on the other person. Facebook can't contact you to inform you of anything _before_ you send the message.

</comment></comment></comment></comment></comment></comment><comment><USER26> You can whitter, you can pontificate, you can reason.

We are all dumb fucks.

</comment><comment><USER27> The argument is "if you share it with friends you've abandoned the right to privacy cuz they can share it with others".

OK if that's how were going to play it then fb isn't responsible if a friend, of their own volition, shares it. However if fb says "you shared it now WE can share it" is a whole other game.

Regulate Facebook. They lied and said they weren't intentionally playing with people's dopamine to grow themselves. They're lying now (in a roundabout way). They're always going to lie. Why will they always lie? Because there's no accountability.

Regulate them. Force their hand. That's the only way we can stop creeping further into dystopia. They won't do it on their own and at this point no one should be comfortable with their practices.

<comment><USER28> >The argument is "if you share it with friends you've abandoned the right to privacy cuz they can share it with others".

If those are the rules then it seems copyright is out the window. Looking forward to Clash of the Titans 3: Facebook vs. Disney

<comment><USER29> Never gonna happen, but it would be amazing.

</comment></comment></comment><comment><USER18> This quote:

"Again and again, Snyder blames the targets of surveillance capitalism for their own surveillance"

This is an awful way of looking at the world, because it denies that people have personal responsibility. Everybody knows what Facebook does. It is in plain sight. It's in their terms of services. It's all over the media.

A lot of people don't use Facebook because of what Facebook does. Using Facebook is a fool's bargain, just like smoking or gambling.

If people can't be blamed for their own conscious decisions, we might as well throw out the whole legal system. All contracts are void, because nobody has legal capacity.

This is all pretext for more legislation, for the nanny state to come in and save us all from our dumb and irresponsible selves, to create more positions for bureaucrats to extract even more rent out of the remaining members of society. _Don 't_ buy this.</comment>


Signal: Incoming call can be connected without user interaction - <AUTHOR> https://bugs.chromium.org/p/project-zero/issues/detail?id=1943 <comment><USER2> Two separate issues:

[https://bugs.chromium.org/p/project- zero/issues/detail?id=19...](https://bugs.chromium.org/p/project- zero/issues/detail?id=1936)

webrtc data being handled before call answered, problematic in theory, Moxie can't get webrtc upstream to fix it ([https://twitter.com/moxie/status/1180226374851710976](https://twitter.com/moxie/status/1180226374851710976)), not fixed yet.

[https://bugs.chromium.org/p/project- zero/issues/detail?id=19...](https://bugs.chromium.org/p/project- zero/issues/detail?id=1943)

State machine bug in Signal app, you can send the callee the message the caller gets when the callee answers and the callee will think the call has started and enable the mic. No user interaction, but with log and indication ([https://twitter.com/moxie/status/1180261210341511168](https://twitter.com/moxie/status/1180261210341511168)), fixed same day.

<comment><USER3> Deja Vu.

> you can send the callee the message the caller gets when the callee answers

This is the exact same type of bug that was in libssh: [https://www.nccgroup.trust/uk/our-research/technical- advisor...](https://www.nccgroup.trust/uk/our-research/technical-advisory- authentication-bypass-in-libssh/)

"possible to bypass authentication by presenting to the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication"

Also, Apple had a FaceTime bug of very similar nature:

[https://www.theverge.com/2019/1/28/18201383/apple- facetime-b...](https://www.theverge.com/2019/1/28/18201383/apple-facetime-bug- iphone-eavesdrop-listen-in-remote-call-security-issue)

"you begin calling somebody via FaceTime Video from within the Phone app. Before that person picks up, you can swipe up to add your own phone number to the call. Once you've added yourself, FaceTime immediately seems to assume it's an active conference call and begins sending the audio of the person you're calling"

<comment><USER4> And what's the common theme here? Naive switch statement logic instead of a real state machine with fully mapped transitions.

</comment></comment></comment><comment><USER5> The bug tracker requires javascript, transcript for anyone that doesn't want to enable it:

There is a logic error in Signal that can cause an incoming call to be answered even if the callee does not pick it up.

In the Android client, there is a method handleCallConnected that causes the call to finish connecting. During normal use, it is called in two situations: when callee device accepts the call when the user selects 'accept', and when the caller device receives an incoming "connect" message indicating that the callee has accepted the call. Using a modified client, it is possible to send the "connect" message to a callee device when an incoming call is in progress, but has not yet been accepted by the user. This causes the call to be answered, even though the user has not interacted with the device. The connected call will only be an audio call, as the user needs to manually enable video in all calls. The iOS client has a similar logical problem, but the call is not completed due to an error in the UI caused by the unexpected sequence of states. I would recommend improving the logic in both clients, as it is possible the UI problem doesn't occur in all situations.

To reproduce this problem on the Android client, replace the method handleSetMuteAudio in the file WebRtcCallService.java with the following method.

      private void handleSetMuteAudio(Intent intent) {

        Log.e(TAG, "SENDING MESSAGE");

        this.dataChannel.send(new DataChannel.Buffer(ByteBuffer.wrap(Data.newBuilder().setConnected(Connected.newBuilder().setId(this.callId)).build().toByteArray()), false));

         intent.putExtra(EXTRA_CALL_ID, this.callId);
         intent.putExtra(EXTRA_REMOTE_ADDRESS, recipient.getAddress());
         handleCallConnected(intent);
      }

Then build the client and install it and make a call. When the call is ringing, the audio mute button can be pressed to force the callee device to connect, and audio from the callee device will be audible.

This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available (whichever is earlier), the bug report will become visible to the public.

<comment><USER6> Thank you, why absolutely no text can be displayed without JS enabled is beyond me. The page source is filled to the brim with trackers.

<comment><USER7> > The page source is filled to the brim with trackers.

I would expect nothing less from a site owned by google.

<comment><USER8> On the contrary; on a site owned by Google (or any other tracking company), I expect there to be only their own tracker(s), unlike on most other commercial sites, where there are often dozens.

And the requests I see seem to indicate just that: it only tried to load Google Analytics.

</comment></comment></comment></comment><comment><USER9> It looks like this was shortly preceded by [https://bugs.chromium.org/p/project- zero/issues/detail?id=19...](https://bugs.chromium.org/p/project- zero/issues/detail?id=1936) which was an exploration of the fact that making a call induces RTP data processing on a recipient device during a call, prior to the recipient answering.

That 'seems' innocuous (and both Signal and WebRTC had reasonable arguments around expecting that behaviour) but this follow-up exploit looks more serious, and the researcher is correct to note how an expanded attack surface can lead to problems like this :/

</comment><comment><USER10> It's fixed and updated.

But this demonstrates how much advantages open-source software has, this transparency does pay off with users who are gradually paying attention to the technology and security landscapes.

</comment><comment><USER11> fixed for a week. Update and you should be good.

<comment><USER12> What I don't understand is:

I'm a big fan of maintaining a forced 90 day disclosure period to pressure companies that do not address relevant security bugs.

But why, when a security issue is fixed, whitehats tend to always disclose immediately? Since it is fixed it is not relevant any more, and disclosing now only increases the likelihood of a hacker abusing the bug. Instead wouldn't it be better if the targeted entity just disclosed that "a critical security vulnerability was found" and that "users should upgrade immediately"?

I don't see the point of disclosing the specifics of a fixed security vulnerability soon after the fix? I understand that recognition is an important factor, but isn't it more logical to delay the recognition step for e. g. 6 months?

<comment><USER13> Because blackhats look through updates to determine what has been fixed by reversing the change, and try to capitalize on the time between an update being available and it being widely deployed. The more you raise awareness of people that might be susceptible to attack in that time frame to get them to update sooner than automated systems would allow, the less victims there are to exploit.

I imagine there's probably a short time after update release, almost definitely in the single or double digit hours range, where you might be helping the blackhat that would reverse it do it quicker, but it's probably hard to do more harm than benefit by releasing the details earlier than later.

</comment></comment></comment><comment><USER14> It thrills me to no end that there aren't a bunch of snarky comments about "OH THIS PROVES SIGNAL IS A TOOL OF THE NSA!!".

Open-source software is great because you can find bugs like this by inspecting the software. Anything that is related to personal communications should be open-source.

<comment><USER15> I think open-source software is great as well, but assuming these kind of bugs are found because you can inspect the code is very wishful thinking that doesn't always hold up.

This specific example required a Google department to find it. Who would have found it if Google got restrained by the NSA?. Other notable examples include openSSL.

On top of that, here is a great talk about how easy it would be to infiltrate open source projects: [https://www.youtube.com/watch?v=fwcl17Q0bpk](https://www.youtube.com/watch?v=fwcl17Q0bpk)

<comment><USER16> The fact it's open source enabled someone outside the project to find it in practice. While also possible with closed source software, if you think the bar is possibly too high with an open source project, it is an order of magnitude higher with closed source.

Also, please don't say "Google". A bunch of hackers (on Google's payroll) found it, not Google. We can't tell what would've happened in a counterfactual universe where Google was not financing Project Zero.

<comment><USER17> I'm shocked at how cynical your perspective is that you don't grant credit here.

Like if I said "the police didn't save me from the hostage situation. Some hero saved me who happened to be working for the police. In an alternate universe we don't where this guy isn't employed by the police, we don't know if he wouldn't have saved me anyway"

Can't you just say, thanks police, you saved me.

<comment><USER16> I just prefer congratulating the actual people that did this instead of the relatively arbitrary money supplier. You could say I'm equally shocked that credit is propagated as "Google" instead of the names of the researchers.

<comment><USER15> The reason I said Google because I think that if the NSA pulled some strings at Google, this exploit would not have been published. As such this was all in the hands of Google.</comment></comment></comment></comment></comment></comment>


Ignore the GPS – That Ocean Is Not a Road - <AUTHOR> http://www.nytimes.com/2016/02/14/opinion/sunday/ignore-the-gps-that-ocean-is-not-a-road.html?action=click&pgtype=Homepage&clickSource=story-heading&module=span-abc-region&region=span-abc-region&WT.nav=span-abc-region <comment><USER2> > If we're being honest, it's not that hard to imagine doing something similar > ourselves. Most of us use GPS as a crutch while driving through unfamiliar > terrain, tuning out and letting that soothing voice do the dirty work of > navigating.

It is very difficult for me to imagine driving 250 miles out of the way ( _especially_ when I'm tired and really want to get where I'm going); or driving into the ocean; or driving off a bridge because I've ignored all the road closed signs. I don't even shut my brain off to this degree when another human is helping navigate.

The article is saying our cognitive maps are deteriorating because navigation software provides the information instantly at hand. For some people that may be true. I've noticed this effect in other aspects of my life, though not with navigation. But even if true, that does not explain people ignoring all other indicators that something is not correct.

<comment><USER3> This sounds like a remix of one of the many "internet is making us dumb" stories. If anything the existence of GPS, satellite, constantly updated maps, and now detailed 3D city maps makes our "cognitive maps" (whatever that means) far better now than in the past where our navigation was done from printed Rand McNally folding map.

The reality is there are a lot of impaired drivers on the road. May be they have been drinking, have early onset dementia, or just a mixture of prescription medications with undocumented side effects. A lot have spent half the time sending text messages on their phones. Whatever the circumstance, some of the tools we have now let them survive longer or at least pretend they know what they are doing.

<comment><USER4> Do you really doubt that if you use a GPS to navigate over an unfamiliar route and were then asked to repeat the journey the following day, you'd do significantly worse than if you'd had to plan your original route by hand?

A cognitive map is an internal mental map of how some region of space is connected. Using landmarks and signs to follow a route from a map naturally builds mental connections between your observations of the world and the corresponding points on the map, in a way that following spoken directions does not.

<comment><USER5> I absolutely think that following the GPS provides a worse mental map of the area/route than looking at an old fashioned paper map.

Here in Melbourne we have (shortly: had) the Melways. A4 size traditional map- book, two pages covers a good couple of suburbs. Let's call it a 5km-wide area.

When you look at this map, you see the relationships of suburbs. Balaclava is just to the east of St Kilda, which flows to the south to Elwood, etc. You see the major arterial roads and where they lead. You build a proper, high-level mental model of where you are.

Contrast this to the GPS. "Turn left in 100m" tells you _nothing_ of your locale. It gives you no context. You see a sign that says "Elwood" and you're heading south because the beach is to your right and you know you want to be in St Kilda but this isn't useful to you: your brain doesn't instinctively think, hmm, _that just feels wrong_.

GPS is amazing until it doesn't work, and then you are truly lost.

</comment></comment></comment></comment><comment><USER6> This reminds me of a trip I was on a couple of years ago. I was traveling from Italy to France, and wanted to make a visit to a friend in Switzerland on the way. I never drove that route before, so I just typed the friend's address into the GPS and followed every turn. It made me go on a really curvy and steep road up the Alps, than equally curvy and steep down. The road was wet from the melting ice/snow (it was a summer trip) and at one point I went through a foggy area which looked like I was driving through the clouds.

It was a pretty interesting experience, but I kept thinking that it was strange that there were basically no other cars in either direction. When I got to the bottom I saw why: this road was merging with a tunnel which goes directly underneath the path I took, saving you a couple of hours of driving. Live and learn.

<comment><USER7> So the GPS took you into a lonesome journey of introspection, man and machine conquering a demanding road through the beautiful scenery of the summer Alps... instead of directing you to through a boring, overcrowded tunnel? Seems pretty good to me!

</comment></comment><comment><USER8> Everyone laughs at these mistakes, including me. Mine happened while holidaying in the Lake District, we were planning to hike to Scafell Pike (highest point in England), from Seathwaite. So we rolled out of our tent at 5am, got in the car, punched Seathwaite into the sat nav, and drove. We passed ominous warning signs. We thought that sounded reasonable for the highest point in England so we ploughed on.

We did get out the car at Seathwaite an hour or more later, feeling slightly puzzled as we had recollections it was about 30 minutes away from the campground. We put it down to google underestimating the time taken to go on the slightly scary steep, single track roads.

After stretching our legs, we consulted our actual map + walking instructions and couldn't get anything to match up. We flagged down a local and they pointed out that there's another Seathwaite about ten miles away as the crow flies and that was probably the one we wanted. The catch was that three mountains lay between us. I've rarely felt so embarrassed. The drive over the Wrynose and Hard Knott pass was very picturesque though.

</comment><comment><USER9> While driving in Bavaria my wife was programming the GPS. Since she new nothing of umlauts ([https://en.wikipedia.org/wiki/Umlaut](https://en.wikipedia.org/wiki/Umlaut)) we ended up going to a tiny farming community rather than a town near Schloß Neuschwanstein. Luckily, a suitable castle also constructed by King Ludwig can be found in nearly every part of Bavaria, a few minutes searching turned one up, and it turned into an unexpectedly wonderful day.

GPS errors can bring good experiences as well.

<comment><USER10> Related: [http://www.theguardian.com/world/2010/aug/04/lourdes-gps- mis...](http://www.theguardian.com/world/2010/aug/04/lourdes-gps-mistake- catholic-pilgrims)

</comment></comment><comment><USER11> Honestly, it wouldn't hurt for the software to have some warnings and confirmations for trips that exceed 3 hours.

I've been burned by this myself since I still used an old Garmin far past its expiry date - trying to avoid a border toll while I was visiting Buffalo, it tried to send me the complete wrong direction and I only stopped when I noticed the arrival time said 9am and not 9pm... I was unfamiliar with the area so it would be easy to not realize my mistake, I only checked the device when it became obvious when I'd been on the road too long for what was supposed to be a shortish drive.

Similarly, in New Brunswick it tried to have me shortcut through an increasingly-rugged wasteland of logging roads. It took me an hour of backtracking to extricate myself from that. Fool me once, shame on you, fool me twice, shame on me.

I use Google Maps now.

<comment><USER12> Every navigation device I've used will show the estimated drive time, distance, and a map. I always do a quick sanity check on these before I start following the directions. Do other people not do this?

<comment><USER13> On many GPS models, including my own crusty Garmin, this requires an additional tap and a longish wait while it renders the map as an illegible squiggle. So I rarely do this unless I want to confirm that I'm going via a specific route, and even then it's only useful if I know the route options beforehand and can tell them apart.

As an aside, the Garmin routing is terrible: it (for example) frequently "optimizes" for distance by doing endless zigzags on small roads instead of a single turn on big roads, even when the settings tell it to take the "best" or the "fastest" route. Of course this is to some degree unavoidable when all the brains it has is a tiny on-board CPU; but I've already long since resolved that my next car will have Android Auto, so the cloud can do the work.

<comment><USER14> >As an aside, the Garmin routing is terrible: it (for example) frequently "optimizes" for distance by doing endless zigzags on small roads instead of a single turn on big roads

Google sometimes does this as well. I joke that it seems as if Google Maps sometimes just wants to take a drive in the country. Not that I always mind but, especially if the weather isn't great, I'd probably prefer the simpler route even if it theoretically takes a minute more.

</comment></comment></comment></comment><comment><USER15> I have anecdata here. A single lane, paved but rough road, signed 'no entry for deliveries' regularly has delivery vehicles coming up it because their GPS navigator told them to.

The sign is large. The track is almost half a mile long and has nowhere to turn around at the end.

It is very difficult to get the navigation providers to remove this private access from the maps. Even if they do, there are many people who will never update their satnav software.

This lack of updating may become an increasing problem as roads change and hardware ages, but directions remain the same.

</comment><comment><USER16> The only GPS mishap I've ever had was when Google maps got me in an infinite loop.

I was driving into San Francisco from the East bay, and when I got over the bay bridge, Google had me get off the freeway, turn a few times, and I ended up right back on the freeway, going back over the bridge. I realized right away what was happening after I got back on the freeway, but there were no more exits, so I had to drive to treasure island, and turn around.

That wasn't so bad, but once I crossed the bridge again, I kept following the GPS and ended up right back on the bridge.

Google Maps would try to get me to do this every time I drove over the bridge for a couple of weeks, but I never fell for it again.

This was around the time that they were building the new east bridge, so I wondered if it had anything to do with that but I can't imagine how it would.

<comment><USER17> I'm sure at least a portion of those construction workers on the bridge had Android phones that Google collected maps data from.

<comment><USER18> Ha, then someone just needs a flock of location enabled smartphones pushing faked traffic patterns back to Google and hilarity ensues... :)

</comment></comment></comment><comment><USER19> Late last year a friend of mine was involved in a car accident.

The other driver was following the Google Maps directions on their phone which told them to go down a one way street, it just happened to be the wrong direction. Luckily no one was hurt.

People really need to pay attention when they drive and read the road signs. Just because the GPS says to go down a street, doesn't mean you are allowed to go down it the wrong way.

<comment><USER20> Yup, source data is one of the issues here: I had Waze send me up one-way streets more than once. (Okay...there's a community map editor, let's fire that up and fix this. "You can't edit a road, you need Magic Editor Points." Oookay, how do I get Magic Editor Points? "You get points by making edits..." and you need points to do that.

Well take that editor and shove it, I'm in no mood for a Catch-22.)

</comment></comment><comment><USER21> Reminds me of a time when I was using GPS to get around Vancouver Island.

Rather than taking me on the real highway I got directed to a "highway" that was a narrow mountain logging road. I did realize exactly what was going on and decided to keep going in my Subaru Outback for the sake of the adventure. Eventually did get through. Then there was this time in Utah where my GPS decided that following the powerlines on what was sometimes not even a road was better than going around. One of the locals hearing the story later joked you should never use a GPS in Utah. In both cases I knew the GPS was crazy but as long as I could safely continue I went on for the sake of the adventure... If things got too hairy I'd simply turn around...

</comment><comment><USER22> I have a good counter-example. I was traveling to Shenzhen and I had a faxed address and directions for the hotel. It was in Chinese, which I can't read. About an hour into what should have been a 20 minute trip, it occurred to me I was being taken somewhere entirely different. I turned on data roaming, figuring that could not be more expensive than ending up two hours away from my hotel at 3am. A search in English turned up local results with labels in Chinese. The driver had to drop me at the taxi garage to wait for a driver going in the right direction, so I got to see what a Chinese taxi company looks like at 2am, but was spared a lengthier adventure.

</comment><comment><USER23> Article freely conflates GPS with software navigation. Over of these things works perfectly while the other has technical and usability quirks still not solved.

<comment><USER24> The real mystery is, why he even bothered to take a rental car from keflavik to his hotel in reykjavik, instead of just taking the shuttle.

<comment> the-dude So smart. Maybe he planned a trip for the next day?

<comment><USER24> I wonder if it was trip to Siglufjörður, and he got there a day early.

</comment></comment></comment></comment><comment><USER25> How many people got lost and died or whatever before GPS navigation?

How many people have been lost in dangerous situation but were able to get to safety due to GPS navigation?

How many people are balls stupid and will win a Darwin Award regardless of what technology the use or don't.

<comment><USER26> Exactly. There were and always will be stupid people, it's not technologies to blame. If not blindly following GPS to death, they would choke on spoon or smth anyway. I'm actually glad to see that natural selection works even in the digital age.

</comment></comment><comment><USER27> Lots of People rely on GPS navigation without checking. This tells us how well it works and nothing else.

As an OSM-editor I know the map has many errors. (Not in my neighborhood mind you.) So when I strapped a Garmin loaded with OSM to my bicycle I knew what to expect. Sometimes I let it navigate my destination even when I know the route I want to take. Then I watch the device give me suggestions to know whether the map works. Found quite a few details that break navigation in OSM. Used that way you get immune to the urge to follow everything the device tells you. I have yet to attempt cycling down stairs that were recorded as path.

One common occurrence is the device insisting on you to turn around; its estimates getting longer and longer. A few later villages later in your journey you cross the nodes where the road was not correctly connected in OSM and the device is suddenly happy again.

When I'm somewhere I don't know, and OSM is reliable in that area, I find navigation very comfortable to use and it's saved me a lot of brain cycles.

</comment><comment><USER28> Back in the summer I found an oddity on the map what I wanted to explore for the sake of it. It was on the way back from a customer's house and I had the rest of the afternoon off, so it was great timing.

I navigated the waypoints and tracks as the map directed but one of the track's surfaces was degenerating beyond practical travel. I didn't mind a bit of mud, but didn't feel like drowning :-)

After another bend, it was clear the mud wasn't getting better. I turned round and headed back home, as the alternate routes weren't really practical. This story ends with not a lot happening.

I find stories such as the headline, and others in the comments, are very difficult to relate to. I suppose this is because I take in information I see in real-time and allow myself to make decisions on the fly. I'm sure there's a part of the brain involved which must be inhibited in some way that allows blind following of instruction, be it made by a device or other way.

</comment><comment><USER29> An even more troubling aspect is the increasing lack of ability for our pilots to fly by hand instead of relying on the autopilot. A large number of accidents today, like the Asiana 214 that went into the SFO airport sea wall, could easily be avoided if either the PIC or the FO pay attention to what's happening around them instead of having their eyes glued to the colorful shiny dials. Take Asiana 214 - the PIC had pulled engine power to idle, flew far too low on his approach to runway 28L, expected automation to pick up slack, didn't bother to visually check if things were all right, and crashed into the sea wall.

</comment><comment><USER30> I remember in Lebanon getting on the wrong bus with a slightly similar name and ended up somewhere I wasn't supposed to be.

Dam GPS, these days I would have realised sooner and not had that adventure.

</comment><comment><USER31> Self Driving cars rely on exactly this same data. (Read all the stories from other HN members in this thread on bad data, it's not always the user's fault.)

Despite all the hype I don't expect general purpose self driving cars ever. At best we'll have some interstate express lanes exclusively designed for self driving cars, and that's about it.

<comment><USER14> "Ever" is a long time. Though I agree insofar as it's probably further out than a lot of people are assuming.

But, yes, it will be a long time before maps are sufficiently good across wide areas of the rural US (much less the world as a whole) to enable self-driving. The situation when you start talking about unpaved roads becomes even more problematic.

<comment><USER32> Isn't it just a matter of the car paying attention to the road and if it doesn't match up to the map's version, picking an alternate route?

<comment><USER14> Autonomous vehicles today are highly dependent on having accurate high- resolution road maps. Without them, you don't have a self-driving car. And, when you talk about unpaved rural roads, there often aren't any alternative routes.

Presumably if/when we get such vehicles, they'll only be approved to drive some subset of roads and, if they encounter an unknown condition, they'll have to stop and have a human driver take over in some manner.

</comment></comment></comment></comment><comment><USER33> Why advertise yourself as dumbass with zero common sense?

</comment><comment><USER20> Well look what the cat brought in :D

[https://fbcdn-sphotos-a-a.akamaihd.net/hphotos-ak- xta1/t31.0...](https://fbcdn-sphotos-a-a.akamaihd.net/hphotos-ak- xta1/t31.0-8/fr/cp0/e15/q65/12694731_10207803332897022_8128739970234650151_o.jpg?efg=eyJpIjoidCJ9)</comment>


Discontinuing Support for Android Nearby Notifications - <AUTHOR> https://android-developers.googleblog.com/2018/10/discontinuing-support-for-android.html <comment><USER2> Wow. I know a number of small and medium sized businesses that were just closed by this. Millions of dollars of value and investment vanished because Google decided to shit down a service.</comment>


Chrome marks sidebar extension API issue WONTFIX - <AUTHOR> https://code.google.com/p/chromium/issues/detail?id=477424#c82 <comment><AUTHOR> Previously on HN:

[https://news.ycombinator.com/item?id=9845301](https://news.ycombinator.com/item?id=9845301)

I've been really looking forward to this, because tree style tabs are the main thing keeping me on firefox. But now it looks like in-window sidebar extensions aren't going to be possible.</comment>


In Microsoft's shadow, Seattle's tech scene surges - <AUTHOR> http://www.patexia.com/feed/in-microsoft-s-shadow-seattle-s-tech-scene-surges-1352

<comment><USER2> >> [...] Microsoft directly helps startups by giving them free software through its BizSpark program [...] Seattle isn't ready to challenge Silicon Valley [...]

I see the two as somehow related. Silicon Valley's strength comes from using free-as-in-freedom technologies as a foundation for their startups.</comment>