Japan's National Police Agency to urge Internet providers to block users of Tor - <AUTHOR> http://mainichi.jp/english/english/newsselect/news/20130418p2a00m0na013000c.html

<comment><USER3> _> The move comes on the heels of a series of online threats via remotely hijacked computers using the Tor system, which allows users to mask their online identities and locations by routing connections through several servers._

There's been an investigation/questioning going on regarding one particular incident for many months now, where a guy had used Tor (among other things) to hijack others' computers and send crime threats from these machines. The Japanese police, being pretty inexperienced at this sort of thing, arrested the wrong person back in late 2012 (which btw ruined that poor guy's life, because the Japanese press has this retarded tendency to report suspects' real names, addresses, occupation, even when the status is preliminary), and it's been a series of embarrassments for them ever since.

They even have the prime suspect in custody, yet they can't find concrete evidence to lock him up. (in fact, they're doing some pretty shady stuff by keeping him in custody for an inordinately long time through various loop- holey means). The whole debacle has shown both the technology ineptitude of Japan's police department as well as its heavyhandedness.

Old article, but you'll get the gist of the situation.

[http://www.wired.co.uk/news/archive/2013-01/07/japan-cat- col...](http://www.wired.co.uk/news/archive/2013-01/07/japan-cat-collar- hacker-clue)

Then there is an article in February saying he was "caught", but two months later, he is still stuck in custody as police try in vain to find conclusive evidence that can lock him up.

[http://www.wired.co.uk/news/archive/2013-02/12/japanese- cat-...](http://www.wired.co.uk/news/archive/2013-02/12/japanese-cat-hacker- caught)

<comment><USER4> OK, this needs context.

Japan has an insanely hight conviction rate in pretty much all crimes. What happens is this: police find someone who is plausibly guilty (very low threshold and lots of bias) and keep them in custody for a long time (sometimes months) until they finally confess. Case solved.

So what you have just described is just business as usual for Japan.

<comment><USER3> Yes and that behavior resulted in the wrongfully convicted guy (back in 2012) "confessing" that he's the one who sent the crime threats, even though he was innocent.

(I forgot about this part in my original post, for thanks for being the impetus for making me remember :P)

<comment><USER4> It seems very plausible.

Most crimes in Japan have conviction rates of well over 90% for the reasons I wrote so I would be very surprised if this case was any different.

</comment></comment></comment></comment><comment><USER5> So this would work by the host wanting to be nice to the police; a dating site doesn't want child rapists, so they ban Tor exit nodes. That makes sense. What I found amusing, though, is that they want sites that accept leaks from government agencies to do the same thing. If you're a site that collects leaked information, the last thing you're going to do is block Tor. So I found that example amusing.

<comment><USER6> How do you know if traffic is from a Tor exit node? Is there a giant list of exit nodes kept somewhere that can be referred to?

For that matter, if I'm using TOR does the ISP have anyway to know that? I know they can't get to the contents of what I'm sending, but does the data look like different to "normal" internet use in a way that could be detected and filtered?

<comment><USER5> Yes, there's a list of exit nodes. Which machines are exit nodes is not supposed to be secret and could be easily derived by an interested party. (Send a bunch of requests to your web server over Tor. Observe the list of IPs making requests.)

[http://torstatus.blutmagie.de/ip_list_exit.php/Tor_ip_list_E...](http://torstatus.blutmagie.de/ip_list_exit.php/Tor_ip_list_EXIT.csv)

And yes, ISPs could detect Tor traffic if they wanted to.

<comment><USER6> Could Tor traffic be encapsulated in HTTPS to stop ISPs from identifying it, or would they still be able to either identify the traffic as Tor or identify the relay nodes and block access to them?

I'm curious if the Japanese proposal is even possible, or if it's another political policy that isn't supported by technology like Australia's proposed internet censorship system (which was eventually abandoned)

<comment><USER7> That's a complicated question. This talk from CCC in 2011 addresses some of the points (and is very interesting in it's own right):

<http://www.youtube.com/watch?v=GwMr8Xl7JMQ>

Tor already uses SSL, so I'm not sure how valuable encapsulating it in HTTPS would be. In fact (and this is from memory, so I may be wrong), some governments were able to block Tor by looking at certificate expiry date - <USER2> uses short lived certificates, but no real https site is going to use an ssl cert that expires in a couple hours. There were some other ways to fingerprint Tor traffic, but I'd have to watch the video again to remember.

The Tor developers also apparently have a list of potential ways to identify Tor traffic, but haven't fixed all of them because they're waiting for evidence that they're being used to block Tor traffic first.

As for relays - the bridge system addresses that. It's difficult or impossible to compile a complete list of bridge nodes, so that method should be pretty effective. It's also possible to run a "private" bridge and share it out of band with other. That method certainly should make relay identification extremely difficult.

</comment></comment></comment></comment></comment><comment><USER8> What authority does the NPA have to force providers based in Japan to do this?

<comment><USER9> Please, there is no mention of force anywhere. Not in the title nor in the article.

Urge is very different from force, and furthermore they are _urging_ ISPs to voluntarily block Tor communications.

<comment><USER10> The problem here is that they want this at all, this is a typical first step for introducing censorship.

Real life example from Norway:

1: Police wanted/suggested a filter to stop child porn (think of the children, etc)

2: This filter is then implemented by the ISP`s that wants to use it.

3: Police/Government suggests/mentions that it should be required for all ISP`s.

4: Government starts talking about implementing filter for stopping sites that "can be bad"(read: piracy sites)

(what will happen in the future, at least as i suspect it)

The child porn filter will be forced upon all ISP`s, it will be changed to also block other sites that the government/police thinks that should be blocked.

Now this filter is as of today easy to go around by simply using other DNS servers, but the problem is that censorship is wanted at all. I will not be surprised if the next step is to put the filter on a lower level on the network stack. And even in the long term, forbid the use of TOR/Freenet etc.

<comment><USER9> Iin their eyes there are already limits on what people can browse and adding a couple more is no different than what is already established.

You're implying that censorship will lead to a slippery slope but we're already sliding down one.

</comment></comment></comment></comment><comment><USER11> Is it even feasible to block Tor connections?

<comment><USER12> Kind of. Tor operates over a standard port, so detecting it is relativly easy. However, people in a non blocked region can create a non-standard entry node that is indistiguishable from normal encrypted connections.

<comment><USER13> That "standard port" is 443, by the way. The same port as SSL traffic. So actually detecting it requires analysis of the traffic patterns.

Blocking known exit nodes, on the other hand, is pretty easy - just block a subset of IPs.

</comment></comment></comment><comment><USER14> I cringed when I read the headline reference to Tor as "hijacking software."

<comment><USER9> Even more worrying are phrases like "the Tor system was abused in a number of crimes." I realize that this is a Japanese translation but the conflation between "maliciously use" and "abuse" is still odd.

<comment><USER15> The use of "abuse" is correct here. It was used in an incorrect/improper manner, which is the definition of abuse.

</comment></comment></comment><comment><USER16> Brought to you by the nation that arrested a developer for creating P2P sharing software called Winny.

[http://www.afterdawn.com/news/article.cfm/2006/12/17/japan_c...](http://www.afterdawn.com/news/article.cfm/2006/12/17/japan_convicts_winny_author)

Japan is inching ever closer to China's version of the internet. BitTorrent piracy is also a criminal offense in Japan (not a civil one as in many other nations).

</comment><comment><USER17> I find it interesting that the police would rather have Tor blocked at ISP's, which is not an easy thing to do, than find how to use it effectively to police those that abuse it. <https://www.torproject.org/docs/bridges>

Head in the sand mentality. Well, I better get my Tor installation updated.

</comment><comment><AUTHOR> > The panel specifically recommends that communications be blocked when there > is access from IP addresses publicly listed as those allocated to the third > in a chain of computers that are used by Tor.

This means blocking Tor exit nodes (third in a chain), right? So this means using Tor won't be blocked, but the exit nodes within the relevant ISPs would be?

</comment><comment><USER18> "First they came ...."</comment>


Show HN: NodePoint – A free ticket system for the modern world - <AUTHOR> http://nodepoint.ca/

<comment><USER2> On such a pleasant Saturday I hate to nitpick, but I do have some feedback:

I think you should take a critical look at the front page and see what it is communicating. My personal take: I have no idea. A modern ticketing system... like TicketMaster? Train tickets? Is this an API that interfaces with venues? After my developer instincts kicked in I thought maybe a bug-tracking system. The page needs to be specific about what type of ticketing and who will want to use it.

Ah, in the Windows Fact Sheet I found this: "NodePoint is a ticket management platform based on the Bootstrap framework. It is meant to be simple to setup and use, yet still offers many features such as user management, access levels, commenting, release tracking, email notifications and a JSON API."

THAT's what should be on the front page, although "ticket management" still is vague, and referring to Bootstrap seems irrelevant to me personally - that's a developer detail.

\----

The "Changes and Improvements" is way more visible than any further information, which is way down in the footer. The "Sales" link is just an email link. What type of enquiries are you expecting? What is there to sell, if it is free? You might have two audiences: small businesses and developers. You may need to totally separate the messaging so they each can see what would interest them.

And finally, the demo requires me to register which isn't going to happen when I know so little. What if you just generate a random login and auto-login the visitor?

So look, I personally think the page could use some rethink for clarity of target audience. Then I might investigate a bit more.

<comment><AUTHOR> Thanks for the feedback! The page is brand new, and yes the professional services we'll be offering are upcoming, so sales will make sense then. I will work on adding more information on the front page itself. The demo is also setup so you can at least view products and tickets without registering, although adding a demo login is a good idea, I'll do that now.</comment></comment>


Project will inject new impetus into the IT industry - <AUTHOR> It is looking for investors and is also looking for the right people to join.
As the title says, it will bring new impetus to the world, and people will use it to bring changes to the world again and again.
https://bit.do/keyboards
Prevent short URLs from invalidating: https://ipfs.io/ipfs/QmaEPHyuoTUkbnmGKuoNmFXBdyCdoAsSc7NR6DPbLibq2f/ <comment><USER2> There isn't a lot of information on this site. What exactly do you mean by bring new impetus to the world?</comment>


Show HN: The Surety – Crowdsource your hiring - <AUTHOR> https://thesurety.com <comment><AUTHOR> We were tired of not knowing what we were getting when finding service providers through online marketplaces, even ones that claim to use algorithms and AI. We think tapping the collective wisdom of the crowd, incentivized by bitcoin bounties, can truly create a better marketplace for hiring for both jobs and gigs.</comment>


Show HN: Full-Scale JavaScript (a weekly roundup newsletter) - <AUTHOR> https://www.getrevue.co/profile/janis_t

<comment><USER2> How much does this differ from other JS related newsletters? I already have a decent amount of overlap between JS Weekly, ng-newsletter, and Node Weekly

<comment><AUTHOR> Well, I really try to focus on more advanced stuff, leaving out tutorials for newbies.</comment></comment>


Researchers use Kinect to scan T. rex skull - <AUTHOR> https://news.mit.edu/2017/kinect-3-d-scan-t-rex-skull-0705 <comment><USER2> Link to the paper on PlosONE [1]

[1] "A method for rapid 3D scanning and replication of large paleontological specimens" [ [http://journals.plos.org/plosone/article?id=10.1371/journal....](http://journals.plos.org/plosone/article?id=10.1371/journal.pone.0179264) ]</comment>


A Multilogue on Free Will - <AUTHOR> http://blog.rongarret.info/2018/01/a-multilogue-on-free-will.html <comment><USER2> It should be noted that a consistent, orthodox Christian view on this discussion is actually summed up in what is called Compatibilism[0]. (tl;dr — autonomous free will does not exist.)

The late Greg Bahnsen wrote on this topic[1] a lot. If you can find some of his debates on YouTube they are well worth the time if you are interested in this topic.

[0]: [https://www.monergism.com/topics/free- will/compatibilism](https://www.monergism.com/topics/free-will/compatibilism)

[1]: [http://www.cmfnow.com/articles/pt131.htm](http://www.cmfnow.com/articles/pt131.htm)

<comment><AUTHOR> I was actually trying hard to get my God character to fairly represent the compatibilist position, though this was a real challenge for me because I personally believe that compatibilism is self-contradictory. If I didn't get it right, all I can say is I gave it my best shot.

</comment></comment><comment><USER3> Ron missed a really good opportunity to throw in a Watchmen-style ending with the switch.

Also, with respect to the Pharaoh, it's interesting because he hardens his own heart the first few times.

</comment><comment><AUTHOR> Posted in response to this:

[https://news.ycombinator.com/item?id=16336629](https://news.ycombinator.com/item?id=16336629)</comment>


The Factoring Dead: Preparing for the Cryptopocalypse - <AUTHOR> http://www.slideshare.net/astamos/bh-slides <comment><USER2> Pluggable crypto algorithms are one of the reasons for a lot of protocols being overly baroque and thus vulnerable (due to implementation flaws), or at least not widely used. This all started due to the export controls in the 1990s -- when you needed to have a US/non-US version anyway, you could then do 10 algorithms. But, if you don't have that concern anymore, it's senseless complexity.

IMO the best way to do all of this is to have one (set of) algorithm per major version of protocol. It's fine to change that (by adding new protocol handling) going forward, and potentially to deprecate old versions too, but cipher negotiation/etc. is otherwise madness-making. That, and shitty encodings, are most of the pain I have when working with stuff.

(The issue raised here of "ECC should be more widely used" is good, though -- I've been looking at blinded ECC algorithms recently.)

<comment><USER3> That's a weird conclusion to draw given that negotiated key agreement algorithms are what allows us to swap RSA for ECDSA opportunistically and without jettisoning the rest of the protocol.

Maybe this would make more sense if you could describe what was madness-making about cipher negotiation.

<comment><USER2> It certainly has upsides, but I remember pain when involved in or trying to fix things with diverse algorithms. Maybe the memory of the pain was worse than the pain itself, or the pain was from unrelated causes. Mostly it's "I'm not very good at _____, so I like things to be as simple as possible".

JCE implementation (mostly related to scope, era, etc.) -- admittedly, we only needed a non-US JCE for a few specific things, as part of an overcomplicated financial transfer system.

PGP/OpenPGP; there were lots of reasons this sucked, but multiple ciphersuites didn't help at all.

Free S/WAN was painful too (and really most of IPsec), but it's an example of the higher level problem of "too many layers of indirection and abstraction", not "too many algorithm choices."

(Poking at OpenSSL internals as a consumer of the library and trying to get it to work with some hardware shit made me mostly want to die, too, but part of that is my inferior C skills, and other things specific to OpenSSL and not to the overall concept of multiple algorithms)

OTR, ecash protocols of various types, etc. which used hardcoded algorithms were comparatively painless.

ssh is probably a good counterexample -- relatively flexible choices, although the big shift from v1 to v2 fixed a lot more things than just algorithms.

<comment><USER4> That last part about openssh suggests that the problem with SSL's cipher choices is not that there are choices; rather it's that the choices are mostly bad, and that they're hardcoded combinations rather than free choice of primitives. MD5/SHA1 lingering for years, and RC4 crippled but limping along and even preferred in some cases because of BEAST, all because there are insufficient, or insufficiently deployed, newer options. Camellia is crippled by not supporting the same ciphersuite variety as AES does in most implementations (openssl ciphers -v 'CAMELLIA', vs openssl ciphers -v 'AES'). That's right, there's no ECDHE+Camellia when talking to any server that's using openssl, it's slow DHE or no PFS at all. What's the point of even having Camellia in a SSL implementation if it's not going to be maintained with current ciphersuites? That's a great example of why hardcoding _combinations_ of primitives is scary.

</comment></comment></comment></comment><comment><USER3> My name is on this talk, but you should know: not only did I not go to Black Hat to help deliver the talk, but I did zero work on its preparation; this is Javed Samuel and Tom Ritter's talk all the way.

How my name came to be on it is a long, boring story.

<comment><USER5> Is this an anti-endorsement of the talk, then, or are you just trying to give credit where it's due? I thought it was pretty interesting, and I'm going to try to move to ECC over RSA where possible (for private SSL certs internally, SSH keys, etc). I know that isn't quite the point, but it seems like it might help future-proof a bit.

<comment><USER3> I endorse the talk wholeheartedly but for reasons even I don't understand my name is first on the title slide and I don't want to claim any undue credit.

</comment></comment></comment><comment><USER6> pdf (who disables save anyway?): [https://media.blackhat.com/us-13/us-13-Stamos-The- Factoring-...](https://media.blackhat.com/us-13/us-13-Stamos-The-Factoring- Dead.pdf)

</comment><comment><USER7> "Most systems are not designed for cryptographic agility" but even if they were, that's yet another vector for attack. If your software is configurable in some way around cryptography (new algorithms in a shared library, new configuration files describing padding or negotiation methods), the the attacker just has to reconfigure your device. When you distribute those changes, they have to be signed; with a configuration currently supported by the app; which probably involves the weak or broken algorithm you're trying to replace.

The Problem® as I see it is one of computational power. Everyone carries mobile devices. Everyone expects their mobile devices to be secure. But everyone appears to be more interested in the perceived speed of their devices. How do we make most algorithms more secure? Larger keys, or some other form of increased work for attackers. That slows down smartphones and now people are having a Bad User Experience™ and well, we can't have that.

It seems like every time someone makes security more user-friendly, they necessarily introduce weaknesses into the entire system. I gave up on trying to solve these kinds of problems long ago when I realized I was terrible at it.

<comment><USER8> For the most part, the concerns over breaking crypto are related to breaking public key cryptography. Becuase of its relative slowness, public key crypto is generally used for key exchange before the devices start using symetric cryptography. Symetric crypto has its own concerns because we have no theoretical foundation for believing it is secure other than the fact that we have yet to break it. At least RSA is backed by factoring, which we have spent much longer trying to break (and also haven't proven to be secure).

<comment><USER9> Nitpick: RSA isn't known to be backed by factoring. More precisely, there is no proof that if textbook-RSA encrypted messages could be decrypted quickly that integer factorization could also be done quickly. (Of course if you can factor integers you can decrypt RSA messages quickly).

[http://en.wikipedia.org/wiki/RSA_problem](http://en.wikipedia.org/wiki/RSA_problem)

There are encryption schemes where decyption of an encrypted message is provably equivalent to factoring.

[http://en.wikipedia.org/wiki/Rabin_encryption](http://en.wikipedia.org/wiki/Rabin_encryption)

</comment></comment></comment><comment><USER10> An interesting analogy is post-quantum cryptography which gets to more or less the same place (can't depend on factoring being hard) by somewhat different path.

There's a nice wikipedia category for post quantum crypto.

[http://en.wikipedia.org/wiki/Category:Post- quantum_cryptogra...](http://en.wikipedia.org/wiki/Category:Post- quantum_cryptography)

The slideshow (which I paged thru pretty quickly) seemed to be a good general coverage of the whole situation, followed by great detail of exactly precisely one solution, ECC. There's lattice, hash, and multivariate. That's too bad that the slides were so general and then suddenly laser focused. I realize there's time limits, etc.

There are also system based issues. What I mean is, lets say you decide to implement a signing only hash algo as a "replacement" for a pure encryption algo which is now magically broken. Well that requires major system changes to move from an encryption system to a signing system to accomplish the same meat-level goal. Its not as simple as search and replace library names. Which is an example of the old saying that crypto is hard.

<comment><USER9> The author's argument is that the probability of impact on ECC of this line of research is less than probability of an impact on factoring. Post-quantum cryptography has to avoid ECC since the elliptic curve discrete log problem is easily solved by quantum computers.

Regarding the possible solutions other than ECC: There are no hash-based encryption schemes, only hash based signatures. I believe there is little faith in any multivariate scheme to remain secure under serious scrutiny. Many such schemes have been broken. The outlook on lattice cryptography, and some coding theory based schemes is slightly more positive. Apparently ECC has received much more attention and study than either of these.

</comment></comment><comment><USER11> Question for the practitioners: is there a hardware token like the yubikey neo, Openpgp card, gemalto.net etc that can do ECC signing or encryption? In some countries, fips140 hardware is required for legal filings, but I've only found RSA tokens.

</comment><comment><USER12> I agree with pushing elliptic curves, but I don't like the way they get there.

First, some historical corrections: the first L[1/2] algorithm for either factorization or discrete log was CFRAC, presented by Brillhart and Morrison in 1974 [1]. This was the first time a L[1/2] algorithm was _formalized_ : descriptions of this basic method go back to the 1930s and the work of Lehmer and Powers [2] and Kraitchik. I presume 1979 refers to Adleman's subexponential discrete log paper [3].

1984 saw Coppersmith's L[1/3] algorithm for discrete logarithms in GF(2^n) [4]. The trick was that, in GF(2^n), the freshman's dream is true: A^2 + B^2 = (A + B)^2. This makes the polynomials we need to check for smoothness much smaller (for appropriately chosen polynomials), so much so that the overall asymptotic running time decreases.

Then in 1990 the number field sieve [5] appears for factorization, also at L[1/3]. You'd think that this had something to do with 1984's Coppersmith, right? Wrong. The number field sieve came from independent efforts, started by ElGamal [6], Coppersmith et al [7], and Pollard [8].

So you can see that Coppersmith's GF(2^n) trick never factored into the number field sieve. The function field sieve [9] is, however, a continuation of Coppersmith's effort in fields of small characteristic (e.g., GF(2^n), GF(3^n), etc). There are many improvements over the FFS that I'm going to gloss over now. More recently, this work has been continued by Joux and friends [10,11,12,13], who have basically annihilated sieving for some specific fields, and most of the time is spent on individual logs. Note that even for small characteristic, where such algorithms apply, well-chosen fields will still be fairly secure: for example GF(2^2039) still has about 77 bits of security, similar to RSA-1024.

There is no reason to believe that the tricks used by Joux carry over to the integers or GF(p), as the 1984 trick never carried over either. We might see an improvement to integer factorization soon, but I seriously doubt these tricks will be in its origin. My _guess_ is that RSA will get an long overdrawn death like Rivest's other brainchild, RC4.

There are plenty of reasons to prefer elliptic curves over finite fields. Elliptic curves are smaller, faster, safer, and shinier. But like the finite field case, there are also classes of curves that are cheaper to attack. Did you know that _all_ elliptic curves over GF(2^n) can be solved in subexponential time [14]? Let's move to NTRU! This kind of scare tactics is unproductive.

[1] [http://www.ams.org/journals/mcom/1975-29-129/S0025-5718-1975...](http://www.ams.org/journals/mcom/1975-29-129/S0025-5718-1975-0371800-5/S0025-5718-1975-0371800-5.pdf)

[2] [http://www.ams.org/journals/bull/1931-37-10/S0002-9904-1931-...](http://www.ams.org/journals/bull/1931-37-10/S0002-9904-1931-05271-X/S0002-9904-1931-05271-X.pdf)

[3] [http://cr.yp.to/bib/1979/adleman.html](http://cr.yp.to/bib/1979/adleman.html)

[4] [http://www.enseignement.polytechnique.fr/profs/informatique/...](http://www.enseignement.polytechnique.fr/profs/informatique/Francois.Morain/Master1/Crypto/projects/Coppersmith84.pdf)

[5] [http://www.iai.uni- bonn.de/~adrian/nfs/lenstra90number.pdf](http://www.iai.uni- bonn.de/~adrian/nfs/lenstra90number.pdf)

[6] [http://link.springer.com/chapter/10.1007%2F978-1-4684-4730-9...](http://link.springer.com/chapter/10.1007%2F978-1-4684-4730-9_22)

[7] [http://cr.yp.to/bib/1986/coppersmith.html](http://cr.yp.to/bib/1986/coppersmith.html)

[8] [http://link.springer.com/content/pdf/10.1007/BFb0091536.pdf](http://link.springer.com/content/pdf/10.1007/BFb0091536.pdf)

[9] [http://cr.yp.to/bib/1994/adleman- ffs.html](http://cr.yp.to/bib/1994/adleman-ffs.html)

[10] [http://eprint.iacr.org/2012/720](http://eprint.iacr.org/2012/720)

[11] [http://eprint.iacr.org/2013/074](http://eprint.iacr.org/2013/074)

[12] [http://eprint.iacr.org/2013/095](http://eprint.iacr.org/2013/095)

[13] [http://eprint.iacr.org/2013/400](http://eprint.iacr.org/2013/400)

[14] [http://eprint.iacr.org/2012/146](http://eprint.iacr.org/2012/146)

<comment><USER3> This is a self-evidently excellent comment, and thank you for posting it. I want to make a couple clarifications:

* From the conversations I've had with cryptographers, there does seem to be a sort of consensus that Joux's DLP work is unlikely to result in a viable attack on RSA any time soon, or, for that matter, on any mainstream DLP scheme.

* But: that isn't a uniformly held opinion. Dan Boneh is an example of someone who seems to believe the line of research Joux is pursuing is going to harm RSA "sooner" rather than "later".

* As you note: RSA isn't looking sturdy today. I think the RC4 example is a good one. The recent attacks on RC4 weren't based on a newly discovered vulnerability, but rather on a more diligent effort to exploit an old one. I'm not convinced that there was any better reason for those attacks being unveiled in 2013 than that nobody had a strong reason to investigate them.

* A (just say) 10-year time scale is still relatively short! If we can reasonably predict material weaknesses in a cryptosystem 10 years out, we should replace it now. We don't generally choose to work with cryptosystems that offer us a margin of just 10 years to work with.

Finally, and most importantly: please understand that the audience at Black Hat isn't cryptographically literate. There are a couple crypto people that show up every year, but the attendees at Black Hat generally bring very little background in the subject with them. So, I think there's value in distilling subtle messages down to actionable information for that audience. A subset of the people in the audience at Black Hat are at some point going to try to develop their own cryptosystems, and they're much more likely to do that by trying to hack together RSA than they are ECC. The less attractive RSA looks to them, the better.

Thanks again for the corrective comment, though. I sort of wish Tom and Javed could have had you up on stage debating them. :)

<comment><USER13> Not cryptographically literate, and hacking together cryptosystems? This can only end badly.

</comment></comment></comment><comment><USER14> Does this help to explain xKeyScore?

If there have been major mathematical advances in the last 6 months what is the chance that mathematicians at NSA made those advances 2 years ago and didn't reveal? (How many good mathematicians know colleagues who 'dissapeared' into a career for the spooks, I certainly know of some). If so , what's the chance that somewhere in the billion dollar budgets they found enough money to turn advances into practical attacks? And _if_ such practical attacks exist, wouldn't that have made it possible to turn a network level tap (such as has been revealed) into a usable 'full take' system that bypasses the 'going dark' problem... given prevalence of RSA based approaches to cryptography on the net today.

</comment><comment><USER15> The slide deck has an impressive list of authors, but slide 55 (about TLS and ECC) appears to be misleading without the context of the talk itself.

I didn't see the talk, so I don't know what they were aiming at, but ECC works the same in TLS 1.0, 1.1 and 1.2. Hybrid chains (i.e. an ECDSA public key in a certificate, signed by an RSA certificate) work fine too.

(Not all implementations of TLS support ECC of course.)

<comment><USER3> It's my understanding (again, I endorse this talk but had nothing to do with its preparation) that they addressed this on stage, just for whatever it's worth.

</comment></comment><comment><USER16> I learnt a little about ECC to make my bitcoin-key-for-encryption-gravatar-as- key-server proof of concept [http://kybernetikos.github.io/VisualSecrecy/](http://kybernetikos.github.io/VisualSecrecy/)

I really love the way that you can visualise what is actually going on by drawing lines on a graph. Factoring is much less visual for me. It just seems very fun that you have a private factor, a public point and, when doing encryption, you have a shared point which is a literal point on a curve.

</comment><comment><USER17> Regarding DNSSEC, it should be noted that ECDSA was specified in April 2012 (RFC 6605) and resolver support started with Unbound 1.4.17 (May 2012) and BIND 9.9.2 (Oct 2012). So this was very recent and the percentage of resolvers on the Internet which have already upgraded to an ECDSA-enabled release is so small that it is absolutely pointless to use ECDSA with DNSSEC now. Most of the resolvers won't recognize the algorithm and will treat the zone contents as unsigned.

Regarding OpenSSL, I tested ECC with S/MIME in 2009 and it turned out to be unsupported. Just tried it again with 1.0.1e and it's still not supported. It works for TLS but the problem is that vendors ship outdated releases: Debian stable comes with 1.0.1 which is good, RHEL comes with 1.0.0 which is not so good (no TLS 1.2), SLES comes with 0.9.8j (even in the recently release SLES 11 SP3) which is very bad.

So support for ECC is still very disappointing and far away from being usable in production.

</comment><comment><USER18> The argument here is approximately this: as solving jigsaw puzzles has been dramatically improved recently, you never know, maybe manufacture of weapons of mass destruction will suddenly get really easy overnight, resulting in an apocalypse.

What Joux and others have done is both important and impressive. But it simply isn't the same as breaking secure cryptosystems. The analogy between the two is simply overplayed.

Did people have reason to believe that the systems Joux and co. can crack were hard? No, despite not knowing how to crack them. Do people believe that their more secure cousins are hard? Yes, they do.

<comment><USER3> That's a weird way to put it, because Joux and Barbalescu's DLP work has already threatened some real (but exotic) cryptosystems (haven't they?).

</comment></comment><comment><USER19> Kinda late here, and unqualified to comment on math - just wanted to mention, in case ECC and the others eventually are compromised - there is something to fall back on. The "one time pad" method "has been proven to be impossible to crack if used correctly" ([https://en.wikipedia.org/wiki/One- time_pad](https://en.wikipedia.org/wiki/One-time_pad)). Given a side channel that's secure for the purpose, I expect there could be a software implementation that would be usable indefinitely.

<comment><USER3> Most systems that attempt to implement one time pads are just stream ciphers built from crappy random number generators; they're crappier versions of RC4. Real one time pads aren't particularly useful (which is why they're rarely used): they require keys as long as their plaintexts.

Schneier calls them "pretty much useless": [http://www.schneier.com/crypto- gram-0210.html#7](http://www.schneier.com/crypto-gram-0210.html#7)

They are, at any rate, a sturdy indicator of snake oil crypto.

</comment></comment><comment><USER11> Question for those in the know: have there been any advances on DLP in galois fields generated by primitive polynomials?

</comment><comment><USER20> Slide 5. Why can no one spell "Appelbaum"?</comment>


Inflation.co – track inflation in real time - <AUTHOR> http://inflation.co <comment><USER2> Great idea but I don't think it's broad enough. You might want to pick a popular product that uses a broad spectrum of ingredients that better represent what people regularly use . The Thanksgiving meal comes to my mind at this time.

Take a clue from the Big Mac Index or the Christmas Price Index.

[https://en.wikipedia.org/wiki/Big_Mac_Index](https://en.wikipedia.org/wiki/Big_Mac_Index)

[https://en.wikipedia.org/wiki/Christmas_Price_Index](https://en.wikipedia.org/wiki/Christmas_Price_Index)

<comment><AUTHOR> Thanks for taking a look! I do like both those indices. As the Big Mac Index looks at inter-country comparisons and I'm looking at intra-country (US). That said, I'm going to see if:

a) it's possible to get pricing data on Big Macs city by city in the US b) do the prices change with any frequency?

WRT b) I am very fascinated by the fact that grocery prices are changing daily within the same major super market within the same city. I can't really understand why and that isn't inflation, that's just pricing. Pricing based on .... ?</comment></comment>


Microsoft will shut down the Cortana iOS and Android apps in 2021 - <AUTHOR> https://www.engadget.com/cortana-shutdown-harman-kardon-invoke-ios-android-191700426.html <comment><USER2> I was a big Cortana + Windows Phone fan (big enough even that I had one in use in 2014) and it did start out competitive. Over time though, Siri got better, Alexa got better; Cortana never did. Microsoft shows an inspirational video at Build every year, but what they show never seems to become reality.

In contrast, I started investing in Alexa mid/late-2018 and while it was great to start, it has become increasingly useful. It makes phone calls to businesses, and gets it right very consistently; it knows business hours; the automation has become more powerful over time (a category Cortana never even began to touch); and the integration ecosystem is superb.

Alexa keep improving, too. Yesterday I invoked a routine that included playing music, while the invoked service was busy playing on another device. While in the past the music just wouldn't have played, now she says, 'Amazon Music is already in use on another device. Did you want to play Thunderstorm Sounds on Bedroom Sonos?' That's just one example, but they are numerous and regular enough that I was able to pick one from just yesterday.

<comment><USER3> Windows phone was actually legit, I was one of the few who loved it I guess. Those big tiles etc...

<comment><USER4> There are dozens of us!

I absolutely loved my Windows phones. I had a couple of different Lumia phones, including the flagship Lumia 920 which had a pretty decent camera for the time, but my favorite was the Lumia 520. The Lumia 520 was only $60, and didn't need a case or screen protector or anything fancy like that. When it was dropped, the back popped off and the battery flew out which reduced the impact on the screen. It had offline maps, a web browser, and the battery easily lasted for 3 days. And if it was lost, it was just $60 to replace! I went through 3 of them before my bank removed their Windows Phone app, which meant that I couldn't do mobile check deposit. I "upgraded" to an android phone, which cost much more and was so much more complicated to use.

<comment><USER5> Ahhh I do miss my Lumia 920. Solid hardware and a refreshing take on software.

</comment></comment></comment></comment><comment><USER6> Obviously Cortana was a laggard, but I wonder how much ROI any of these voice assistants are really delivering for anyone. Besides maybe Alexa. I have not observed anyone talking to their phones since these were a novelty.

<comment><USER7> > I have not observed anyone talking to their phones since these were a > novelty.

Note that people are much more likely to talk to their phone in private than in public. It's rude/weird to talk to one with people around. I use mine at home or when away from people.

I use mine for the following:

* turn on/off the lights * play some music * what's the weather * call people * add X to my grocery list * start a timer * occasionally, open an app. Usually on apple watch where this is faster * Remind me tomorrow to do X * Get me directions home * Show me pictures of X * Start/stop time tracking timers

The common thing is they're all simple functions, quick to say, and faster by voice than going 3-4 steps into a UI and typing stuff out.

This is on iPhone. I imagine all of the above use cases work well on android, and I think others would be effective too, as google assistant is reputed to be more powerful.

Note that siri used to be garbage at understanding me. After using it a while it seems much better. Either she learned or I learned to speak differently.

<comment><USER7> I forgot to note that I have the airpods with always on hey siri. That has increased my usage as I don't have to touch the phone to start the above.

</comment></comment></comment><comment><USER8> > Microsoft is tweaking the software to better compliment apps like Outlook > and Teams.

I wish MS didnt think shiny when thinking about these two apps. Outlook and Teams (at my workplace) log me out from laptop and mobile without warning and send me an SMS OTP I have to use within 5 minutes. They don't even have a resend OTP so I have to restart the apps and hope the SMS arrives on time. Outlook web is slow as molasses on Firefox and of course years behind Gmail.

<comment><USER9> Yeah, that happens to me. I leave my desktop turned on a occasionally get authenticator prompts at random times when not using the computer. And then see the login dialogue when I log back in with no idea which app needs to authenticate.

</comment></comment><comment><USER10> Contrary to popular HN opinion, it's not uncommon nor a user-trust catastrophe for large corporations to turn down products, services, and features over time.

[https://www.versionmuseum.com/history-of/discontinued- micros...](https://www.versionmuseum.com/history-of/discontinued-microsoft- products)

<comment><USER11> Remember: You can't please HN crowd.

Ideal corporation according to HN commenters:

1) Moderately successful, but not too successful (my Foo can't compete with Bar)

2) Run by at most 20 people (why do they need so many people, me and my buddy could do it in a week!)

3) Maintains all products/features indefinitely even if less then 1% of the users use it (Google killed RSS Reader)

4) Directs all earnings back into the product (they have so much money, surely they can afford to all maintain all products/features indefinitely)

5) Pays below market rates (engineers make too much money)

6) Grows organically with no VC/investor money

7) Makes no mistakes. All experiments end up being total hits / cash cows forever.

...

<comment><USER12> >Maintains all products/features indefinitely even if less then 1% of the users use it (Google killed RSS Reader)

1% of all Google users is what, a gazillion people?

</comment></comment></comment><comment><USER13> If only they will shut down the windows app. The darn thing eats up 5-20% of my cpu and my VM doesn't even have a mic. I've tried deleting, disabling, cortana's process comes back and does nothing useful.

<comment><USER14> Give me windows subsystem on Linux any day (for mainly this reason). I need a windows machine but it's so jarring going from my Linux laptop running off a HDD running six months worth of updates and a kernel while I watch a film to windows needing a restart to update a .NET minor version(!?) when running off an SSD.

<comment><USER13> I really like WSL, but I can't turn off cortana from running at the same time.

</comment></comment></comment><comment><USER15> I can only imagine that both users of the curtana app must be devastated.

</comment><comment><USER16> > To be eligible, you'll have to have used your Invoke speaker to ask > something of Cortana between July 31st and before today's announcement.

I'm assuming that "July 31st" means 2019? Otherwise, that's a few-hours window.

<comment><USER17> Yes [https://support.microsoft.com/en-us/help/4566125/cortana- ser...](https://support.microsoft.com/en-us/help/4566125/cortana-service-on- the-harman-kardon-invoke)

</comment></comment><comment><USER18> So Microsoft Cortana will have had about a 7 year lifespan, just like the Cortana in Halo it was named after.

<comment> advanced-DnD So let's see if it goes Rampant, found an ancient galaxy guardians, and return to Earth for that "mantle of responsibilities"

</comment></comment><comment><USER19> Impressive speed of obsolescence.

Should manufacturers be forced to support devices for a set amount of time (5 years?) or should the customer start demanding it?

<comment><USER20> Yeah they just abandoned everyone who invested in their Lumia phones. I had difficulty finding batteries after 2 years for my 950s.

</comment></comment><comment><USER21> I've never used Cortana and tried in vain to remove it, what exactly is it supposed to be used for?

<comment><USER22> It is supposed to be a virtual assistant like Siri or Google Assistant.

<comment><USER23> The only place I ever found Cortana to be useful was on my XBox One. At some point it stopped responding though, so I stopped using it. I suspect if I did some work I could get it working again, but all I ever really used it for was to pause/resume Netflix.</comment></comment></comment>


Authentic Chinese Tea Pots AKA Yixing Zisha Clay - <AUTHOR>

Does anyone know where I can buy an authentic Yixing Zisha Clay pot? I've done some research on what to look for but I can't seem to find a good source. I've tried amazon, ebay, alibaba express, and a handful of boutique websites. Looking for reasonably priced and quality yixing zisha tea pots. <comment><USER2> yeah, anywhere BUT hackernews. flagged.

<comment><AUTHOR> Caffeine plays a big role for myself and a lot of my buddies that are programmers. I think it's appropriate for hacker news. But I'm sure you're content with the high quality instant coffee and Lipton tea that you drink throughout the day. Cheers hater, oops I mean slater*.</comment></comment>


Manifesto from Fugitive Former LAPD Officer Christopher Jordan Dorner /7648 - <AUTHOR> http://pastebin.com/TAzPRfPy

<comment><AUTHOR> I cannot confirm if it's his, but, more significantly, I also can't imagine someone writing this up as a farce so quickly.

Edit: NVMD, it is his. Legit read.</comment>


Bitcoin value tops gold for first time - <AUTHOR> http://www.bbc.com/news/business-39149475 <comment><USER3> One Bitcoin was worth more than, say, one gram of Gold for a long time - <USER2> it's still far from one kilogram. Bitcoin currently is around one troy ounce of gold...

So one unit of Bitcoin tops one unit of gold, the latter unit being pretty much random?</comment>


Neuroevolution of Self-Interpretable Agents - <AUTHOR> https://attentionagent.github.io/ <comment><USER2> A twitter thread with a short summary of this paper from the author: [https://twitter.com/hardmaru/status/1240444144704557056](https://twitter.com/hardmaru/status/1240444144704557056)

</comment><comment><USER3> Is neuroevolution considered competitive with reinforcement learning? (In terms of... sample efficiency I guess)

<comment><AUTHOR> In terms of sample efficiency, it's not - we're looking at 10x difference. But in terms of final performance, after training, it is (and even gets higher scores) for many tasks.

But here, we are not looking at the problem of sample efficiency, but rather at performance at generalization, and we find that evolution allows us to design and train systems that don't need to be differentiable (i.e. have many discrete operations) that may help with generalization.</comment></comment>


Inside the Hacker Dojo – Financial Times(UK) - <AUTHOR> http://www.ft.com/cms/s/0/d2f3e8c4-49af-11e6-8d68-72e9211e86ab.html <comment><USER2> It would be cool to read this, but it's behind a paywall. It's not worth $11 to me to read the article. Can anyone show the text, provide an alt link, or summarize the article?

<comment><USER3> [http://cool2watch.com/index.php/2016/07/16/inside-hacker- doj...](http://cool2watch.com/index.php/2016/07/16/inside-hacker-dojo-the- soul-of-silicon-valley/)

<comment><USER2> Thank you kind friend.</comment></comment></comment>


Minimal - <AUTHOR> http://www.b-list.org/weblog/2008/jun/15/minimal/

<comment><USER2> I think the minimalism analogy translates well to non-web applications as well. I, for one, love Transmission's user interface (that is, the program, not the embedded web server interface, which is nice too). It's super simple, displays all necessary information and nothing more. It uses smart defaults, and configures itself as much as it can. This is where applications stuck on your computer will hopefully go in the future.</comment>


Ultimate Guide to Memorable Tech Talks – Nina Zackarenko [audio] - <AUTHOR> https://testandcode.com/71 <comment><AUTHOR> Nina Zakharenko gives some great advice about giving tech talks. We talk about a blog series that Nina wrote called "The Ultimate Guide To Memorable Tech Talks". This episode is full of great help and encouragement for your own public speaking adventures.

Some of what we discuss:

\- overcoming the fear of public speaking \- breathing and pausing during talks \- planning your talk as well as planning your time to get ready for the talk \- writing proposals and getting feedback on proposals \- Nina's talk in PyCascades on programming Adafruit chips \- types of talks that are often rejected \- pre-recording demos to avoid live demo problems \- why you should speak, even if you are an introvert \- benefits of public speaking</comment>


6502 PRIMER: Building your own 6502 computer - <AUTHOR> http://wilsonminesco.com/6502primer/ <comment><AUTHOR> Thanks to LIV2 for this post:

[https://news.ycombinator.com/item?id=21877283](https://news.ycombinator.com/item?id=21877283)

I think this sub-site deserves its own submission. It's delightful to read.</comment>


Italy Has Broken Up a Multi-Million-Dollar Olive Oil Scheme - <AUTHOR> http://munchies.vice.com/articles/italy-just-broke-up-a-multi-million-dollar-olive-oil-scheme <comment><USER2> So only 10k other similar schemes to go, then? Italy is corrupt from the bottom up. :/</comment>


Tech can't remember what to do in a down market - <AUTHOR> https://www.axios.com/tech-cant-remember-what-to-do-in-a-down-market-ca1e8750-f9f9-4461-97c4-710b9de0e9cc.html <comment><USER2> In 2001 tech ran almost exclusively on recycled VC/IPO money. A company got VC or IPO money, they spent money on ads, the ad company spent money on hardware, the hardware company spent money on ads, and around in a circle it went. When cheap capital disappeared, so did the whole industry.

In 2020 there's a lot more VC money, but there's also a lot more real money. A recession isn't going to stop people from buying diapers on Amazon.

So I don't think the next crash will be as bad for tech as 2002 was. It is going to be a lot worse than 2008, though.

<comment><USER3> Plot twist: Amazon was around in 2001, too. No diapers yet, but they were selling plenty of books.

<comment><USER4> Entertainment, even books, are the first things people start to slash though when their money gets tight. Diapers and other essentials on the other hand not so much. People might go for cheaper options but if you have a baby you need diapers!

</comment></comment></comment><comment><USER5> The question should really be: why should the availability of cheap capital condition whether a tech business is viable or not?

That's not to say that coronavirus doesn't pose systemic risks by itself and can have significant effects on consumer behaviour regardless of the VC rumour mill and financial market sentiment; just that these are increasingly irrelevant since bootstrapping, crowdsourcing and lean startup provide better incubation for good tech business ideas than the more capital intensive planning that went on in the dot com boom/bust.

<comment><AUTHOR> > _why should the availability of cheap capital condition whether a tech > business is viable or not?_

Cost of capital, fundamentally, measures forward-looking risk. (Ideally, unavoidable risk.) A business that would succeed in a stable environment may not in a volatile one.

Set the rate too low and you waste resources. Set the rate too high and you pass on good opportunities. Hence society's interest in measuring this metric accurately.

From a microeconomic perspective, cutting lean when your competitors are buying market share is risky if the next few years will run smoothly. Likewise, burning cash while your competitors build balance sheet is risky if a recession is around the corner.

<comment><USER5> > A business that would succeed in a stable environment may not in a volatile > one.

True, but specifically a good tech business would be one that ought to at least survive in a volatile and capital-starved environment. Treating "good" here in a self-confirmatory sense, which I accept is something of a True Scotsman argument.

<comment><AUTHOR> > _a good tech business would be one that ought to at least survive in a > volatile and capital-starved environment_

Good businesses should be able to survive a normal recession. Start-ups aren't good businesses.

They may _aim_ to become good businesses. But if their first customer cohorts go bust, or their bank goes under in a country without deposit insurance, or their employees--who have to be on site to do their job--can't get to work because of transit strikes, _et cetera_ , _et cetera_ , they're not going to make it. Irrespective of how prudent they were.

<comment><USER6> But if they offer an equal or superior product at lower price, they would have a fundamental advantage: people/businesses would be more incentivized to switch to them when money gets tight, when previously it may not have been a priority.

</comment></comment></comment></comment></comment><comment><USER7> The reason the 2008 recession didn't impact Silicon Valley very much is because tech was still struggling to come back from the devastation of the dot com bust. In 2002, I recall there being 50% office vacancy in the valley in some areas. It was scorched earth.

<comment><USER8> As a former tech recruiter, I can say that March of 2009 was not a pretty time to be looking for work. A lot of people got the axe, and developer supply outstripped demand for a time. I remember posting one ad on craigslist for a Sr. Software Engineer for a seed stage startup in Mountain View and getting 66 applications within a very short period of time, and the candidates were mostly pretty good. Getting that many qualified candidates was very unusual at that time.

<comment><USER9> I have my own anecdotes, but maybe some one here knows more...

Is the tech stack in Silicon Valley that's used by the most recession vulnerable companies wildly different from what "boring" companies are using?

I see C#/Java and SQL used a lot at companies that are not trying to change the world. Is there going to be a great big skills mismatch?

<comment><USER8> I'm not sure. I would expect that mature, older companies would be using less exotic tech on average: PHP, Java, C#, etc. Newer companies would be more likely to be using something more niche I think. It newer companies are more volatile, it may be that when funding dries up, the new company folks may have less tech overlap with the mature, older companies. I suspect this would have been more of an issue in 2009 and 2020. It felt like it was much more common to ask developers to be full stack specialists a decade ago. These days most jobs seems to expect one to know multiple languages regardless of what you're doing. Keep in mind 10 years ago I was a recruiter, and now I'm a developer, so my perspective then & now use different lenses.

</comment></comment></comment></comment><comment><USER10> Only the FAANG companies and some enterprise-focused businesses (Salesforce), all formed > 15 years ago, can be said to be 'booming'. The rest can't feasibly be profitable without ducking municipal and labor regulations (Uber, Airbnb), or requiring eye-watering sums of money to establish the monopoly position they need to take themselves into the the black (WeWork, Uber).

Is it still a 'boom' if valuations can collapse on the opinions of a single large investor (Softbank)? Or if Uber walks back its glittering visions of self-driving cars to focus on e-scooters and food delivery?

<comment><USER11> It's really weird that tech is in a state where almost all of the stars even after being 10 or more years old still don't have the slightest idea how they could make money. Things won't be pretty once the investor money stops flowing.

</comment></comment><comment><USER9> B2C idea that might be robust: Subscription based flu mask delivery service.

<comment><USER12> Or a crypto currency backed by tamiflu.

<comment><USER13> There is one "backed" by the virus, whatever that may mean...

[https://blockchain.news/analysis/the-birth-of-the- coronaviru...](https://blockchain.news/analysis/the-birth-of-the-coronavirus- backed-coronacoin-amid-quarantining-banknotes-in-china)

</comment></comment></comment><comment><USER14> > Advertising and media: Marketing budgets are easy to cut fast, and media > outfits dependent on those budgets feel the pain the fastest.

If a recession materializes, it will be interesting to see what happens to the advertising revenue-reliant companies stock prices of Google, Facebook and to some degree Amazon. It will also be interesting to see what happens to the home prices in the Bay Area if salaries paid in equity in these companies are no longer going up, but going down instead.

</comment><comment><USER15> The implication that this is a down market after a few days of down movement is laughable. Could be a self fulfilling prophecy if the media keeps fear mongering this way.

</comment><comment><USER16> Is it a down market? The bounce is already starting after two days of panic.

<comment><USER17> The only true answer is "TBD". By all indicators the coronavirus has the potential to have a huge impact on people's lives and the ability for markets to function, but it's not yet clear how much of that potential will become reality.

<comment><USER18> This is just the beginning. Some models estimate the climax of the pandemic will be April.

</comment></comment></comment><comment><USER19> Articles like this make me think. There is most certainly a generation of tech workers that have not truly experienced a recession or bad times.

I came of age in 2000, but missed the worst of that crash as I was in school. When I graduated in 2004 things were starting to pick up where I lived (Toronto), but it was nowhere near like it has been for the past 5 years where simply updating your LinkedIn profile would cause a flurry of recruiters to inundate your inbox. The 2008 recession both didn't hammer Canada as bad (especially outside of traditional manufacturing) nor tech really much at all.

My generation of tech workers have simply not known hard times. Many of my college colleagues are obviously not saving and drive $90K Mercedes and live in very nice houses that would stretch tech salaries (Toronto is a bit insane with housing prices right now).

I have no idea if coronavirus, Trump, or what will cause the next recession nor do I know how bad it will be, but if it does impact tech workers, a lot of them are going to be unprepared, I think.

<comment><USER20> > My generation of tech workers have simply not known hard times. Many of my > college colleagues are obviously not saving and drive $90K Mercedes and live > in very nice houses that would stretch tech salaries (Toronto is a bit > insane with housing prices right now).

Why should they save and live frugally? Canada is very socialist, their quality of life will be maintained by the government when things go south. The point of being rich is to live like a rock star. If you can already live like a rock star, you can skip the getting rich part.

But let's say they do save money. It's just going to get eaten away by inflation. If they buy property, it's going to get taxed.

You can either live now, or save lots of money and so stuff in old age. Of course, you'll never get to have the time back, and I'd much rather experience life in my 20's and 30's than in my 60's and 70's.

<comment><USER21> Ahh, to be a teenager again.

<comment><USER22> I think people just live differently and have different values. Nothing wrong with it, really.

<comment><USER23> There is something very wrong with this mindset, as it causes all sorts of negative externalities that impact those of us without that mindset.

</comment></comment></comment></comment></comment><comment><USER24> Folks, it's the flu. We don't have a cure for the flu either. You catch it, you feel awful, your immune system fights it, after a few days the virus runs its course, and then you're fine again. The people who are die from the flu are some combination of old and already infirmed. Same as coronavirus. And every year something like 10-15k people die from the flu but we manage to keep our cool. The disconnect here is really wide. I'm not worried about the coronavirus, I'm worried about all the alarmism and the overreaction it might cause.

<comment><USER25> 18% of cases end up serious or critical. Out of cases with an outcome, for 8% the outcome is death. [1] It's not just the flue. I agree that there should be no overreaction and that that part might be more worrying but it's pretty serious.

[1] [https://www.worldometers.info/coronavirus/](https://www.worldometers.info/coronavirus/)

<comment><USER26> 18% of cases, where the infected person both sought treatment and was actually tested. It is _very_ likely that there are far more asymptomatic and mildly symptomatic people out there.

The 18% number is mostly useless because it's a textbook example of selection bias.

<comment><AUTHOR> > _where the infected person both sought treatment and was successfully > tested_

Isn't the same bias present in ILI (influenza-like illness) statistics?

<comment><USER26> We've had time to do large population studies and build models to somewhat correct for this. Most of the death rates you're seeing throw around for COVID-19 are just naive number_dead / confirmed cases.</comment></comment></comment></comment></comment>


Cloudstock: Salesforce.com's hack-a-thon - <AUTHOR> http://techcrunch.com/2010/12/07/cloudstock-salesforce-hackers-tctv/

<comment><AUTHOR> Anyone out there actually using Salesforce.com's APIs and dev tools? I know they're a huge force in the marketplace but I rarely run into anyone who even understands their offerings in depth. Though the enterprise end of things may not be a sexy part of the market I find it pretty interesting. I'd love to understand how to put what they're building to use in my career.</comment>


Yik Yak lays off 60% of its workforce - <AUTHOR> http://www.theverge.com/2016/12/8/13887622/yik-yak-layoffs-growth-collapse <comment><USER2> So is anonymity the hook to bring you in to an eventually non-anonymous environment?</comment>


Preserving Laptop Stickers – A Post Factum - <AUTHOR> https://grh.am/2019/preserving-laptop-stickers-a-post-factum/ <comment><AUTHOR> This is a retrospective on the original post here: [https://news.ycombinator.com/item?id=20405957](https://news.ycombinator.com/item?id=20405957)

It got enough attention that it only seemed fair to give this a real chance, and for that, I decided to try out Kickstarter.

<comment><USER2> Plese fix the first link in your post, as it gives 404 error.

EDIT: I love name StickerShield

<comment><AUTHOR> Fixed, nice spot</comment></comment></comment>


'Game of Thrones' Sets Piracy World Record, But Does HBO Care? - <AUTHOR> http://www.forbes.com/sites/insertcoin/2014/04/15/game-of-thrones-sets-piracy-world-record-but-does-hbo-care/

<comment><USER2> The bulk of this article is based on a misconception. The author doesn't seem to realize there is a difference between between Time Warner and Time Warner Cable (which is especially ironic here since Forbes automatically links to their separate NYSE listings). HBO is owned by Time Warner Inc., which severed its ties with Time Warner Cable Inc. years before Game of Thrones ever aired.

HBO's reason for staying with cable doesn't seem to have all that much to do with its corporate overlords. It seems to be more closely related to the fact that HBO has evolved symbiotically with cable over many decades, and striking out on its own would require HBO to make use of a lot of muscles it just never needed before (for example, advertising). So until their business model starts actually causing problems, they're OK with being pirated left and right because sticking with the tried and true still makes them money hand over fist.

<comment><USER3> _" It seems to be more closely related to the fact that HBO has evolved symbiotically with cable over many decades"_

Yes, and that might even be an understatement. To the extent HBO moves into direct-subscription or advertising-driven models, it'll need to find a way to do those in addition to its existing, cable-licensing business -- not as an alternative.

The problem is that HBO makes a lot more money licensing to cable providers than it realistically could by selling episodes a la carte, by selling advertising, or by selling HBO subscriptions individually. Any president or C-level exec at HBO (regardless of its corporate parent) is going to have a hell of a time initiating that process, politically, organizationally, or economically. It would basically amount to telling shareholders, stakeholders, and peers that one is going to jeopardize X to pursue a very uncertain X/4.

HBO will go a la carte, or ad-driven, if and when it can figure out how to make the economics of doing so more attractive than the economics of B2B licensing fees. That's easier said than done. It will probably require one of two things: 1) a platform-agnostic licensing strategy, i.e., to diversify away from cable; or 2) a complete rethinking of content forms, types, and salability.

It bears mentioning that even ad-driven broadcast networks make more money off of cable licensing than they do from advertising. (The revenue split is about 48% advertising and 52% cable/distribution fees, trending toward 40/60.)

As for the article's fundamental mistake--conflating Time Warner with Time Warner Cable--that's a pretty big one. TWC spun out from TW back in 2009.

<comment><USER4> The question is: Is the payoff worth it, considering that entire countries are currently "conditioned" to obtain Game of Thrones by illegal means?

Many people speak of Australia, but take Germany as another extreme example. HBO doesn't offer its services here so there are only two options if you want to watch Game of Thrones:

1: Get a subscription of Sky, which is mostly sports and has a minimum subscription time of 2 years. So if you're not into sports, that's about 800$ for two seasons of Game of Thrones.

2: Wait one year and then buy the DVD, because it will be available exactly one year later.

The thing about culture, though, is that you can't participate in the phenomenon that is happening _now_ if you have to wait a year.

So everybody here is pirating it like crazy. Curiously enough, Germany never appears in the piracy statistics because due to some weird legal specialties here, your chance of getting caught when using Bittorrent are 100%.

All the non-tech people I talk to watch it using sketchy streaming sites, thus generating advertising revenue for criminals and infecting their Windows boxen with malware.

I don't know what the long-run consequences are, but they can't be good.

</comment></comment></comment><comment><USER5> HBO gets paid by cable companies, not by end user subscribers.

Subscription fee's go to the cable providers, who are the ones that are potentially losing out by piracy, though many cable providers are also internet providers, so they do get _some_ money.

HBO would be worried if cable companies decided it wasn't worth it to carry HBO, but they know currently HBO is an anchor on many lucrative tv packages, which make cable companies lots of money.

</comment><comment><USER6> There is no model where Piracy makes sense. There is a cost of piracy (both in setting up and in risk of using). That HBO hasn't found a way to easily capture that value speaks to them not having found the right channels to market.

<comment><USER7> > There is no model where Piracy makes sense.

That's not exactly true. Japanese anime companies have found a way to embrace piracy in an interesting way that benefits their businesses.

There are all these piracy groups called 'fansubs', which are groups of fans that take the Japanese comic or cartoon and make their own translations and subtitles. Most of the time these groups are just excited about the show/comic and translate it because it's not available in their language.

The companies used to treat them like any other piracy group, but some of them started changing so that they treat them more or less like market research groups. They can find out, with little or no investment, where a certain comic or cartoon is successful. Then they can invest in doing their own translations if it passes a certain threshold.

Once the creators begin releasing their own official versions of the show/comic, the fansubs usually shut down. Their goal wasn't really piracy, their goal was just to get the show released in their region.

<comment><USER6> That's a very cool engagement model. I think that is more aligned with some engagement with Open source: release the building blocks, let the community of users start manipulating, then package up the best bits as a release. Not piracy outright as you say and very cool way to engage.

</comment></comment></comment><comment><USER8> I'm a little surprised a gray market hasn't emerged where cable companies will rent you a login for HBO Go without stringing cable to your house.

<comment><USER9> Comcast will sell you an HBO subscription unbundled from their TV service.</comment></comment>


Introducing More New Trust & Safety Features - The Airbnb Blog - <AUTHOR> http://blog.airbnb.com/introducing-new-trust-safety-features <comment><USER2> Looks like Brian took people's advice and went with a different photo.

<comment><USER3> I had to go back and check to tell it was even different, not that I care either way or think it matters a great deal.

</comment></comment><comment><USER4> So you can connect to social network profiles. I don't see how this improves security significantly.

<comment><USER5> It makes your profile / reputation more persistent by creating a durable link to your persona external to the AirBNB system.

If I link my AirBNB account to my Twitter account, I can't shirk a poor reputation by simply creating a new AirBNB account, unless I also forego linking to Twitter.

Essentially, if my connected Twitter account has 3 years of activity behind it,* it's a somewhat strong signal that my AirBNB account isn't a disposable, since I'm tying my reputation to something that I've invested a few years into, and will continue to actively use.

* I'm presuming that the AirBNB hosts would be able to see how long I've had the linked account, and whether or not it's active. Or some other measure of guarding against a fake AirBNB account linked to a dozen fake social networking accounts.</comment></comment>


The interesting PLs are C/C++, Go, Dart, JS, and Rust. Everything else is BS. - <AUTHOR> https://twitter.com/ryah/status/258634435161899009 <comment><USER2> Not a single functional language on that list? Someone has a lot of learning left to do. :-)</comment>


Why most hiring processes suck (2011) - <AUTHOR> http://www.adammcfarland.com/2011/12/13/why-most-hiring-processes-suck/ <comment><USER2> This post is why hiring processes suck _for the company_ , but IMO the solutions presented here swing the pendulum too far in the other direction. Aptitude tests and work sample requirements are great, but there's some kind of ethical line crossed when you're constantly _taking and taking_ from your applicants without giving anything back in return (e.g., meeting someone face to face).

I've been on both sides of the fence before and I know what a grueling process hiring is for both applicants and managers, so I certainly appreciate the time commitment that goes into hiring. That said, if your company wishes to present itself in a way that is caring of its employees, a great first impression would be in the hiring process.

<comment><USER3> People should absolutely be respectful of their applicants' time. And applicants should use how they're treated during the application process as a signal for how they'll be treated as employees.

One of the best interviews I had was very informal, was only with the hiring manager, and it was pretty obvious that there would be a good fit between myself and the company. I took the job and had no regrets over it.

One of the worst interview processes I went through had me doing two rounds of phone interviews and then a half-day in-person consisting of four one-hour interviews with various people. The selection of people conducting the one- hour interviews were fair enough -- HR, hiring manager, a peer, and someone from a related department I'd have contact with but wouldn't work with frequently. But you could easily tell there was no organization behind what they were doing, unless their strategy was to have each of the persons doing the interview have the same exact conversations with me. This was at a Fortune 500 company and it became clear from the interview process that the culture would be extremely frustrating for me to work in.

I think it's fair to follow a process like this to respect the time of your applications:

resume cover -> screen -> phone interview -> in-person interview -> tests/samples -> hire

And you drop people out of the funnel at every step. I also think it's best to keep your in-person interviews to two hours max, between however many people they need to talk to.

<comment><USER4> > tests/samples

Technical tests are a double-edged sword. For candidates with little to no prior work experience (fresh out of uni for example), it makes sense. Unless serious question marks arose during the prior interviews, I find it disrespectful to play the "stump the candidate" game with candidates who come in with 10, 20+ years of experience. I'm not aware of any other industry that deploys a barrage of obscure technical tests on their candidates the way some companies do in IT.

<comment><USER5> That's because you can get someone with 10 years of "experience" who can't pass FizzBuzz.

Although trick questions and the like are bad, and a sign that you should avoid the company giving those questions in an interview.

</comment></comment></comment></comment><comment><USER6> The post struck me as an incomplete thought where the author ran out of steam. My hunch was correct when I got to his advice:

      'Attempting to "solve" these problems means that as a
      company you have to throw away everything that you know
      and start from scratch.'

Feel free to go die on that hill, with HR further above in fortified gun nests.

<comment><USER7> Please explain

<comment><USER6> Quick example: His bullet points for "What's Wrong" read like a draft outline. For example, bullet #6 says, "[The interview process is] a very uncomfortable process for the applicants" \-- then he rambles giving reasons that don't really point to why there's a problem: a) he lists issues that every applicant will likely face (even in "great" interview processes b) good processes intentionally make applicants uncomfortable at times and c) lists quirks that are just part of the negotiating process and relatively unavoidable.

These rough edges aside, the structure seemed incomplete. After his unfiltered stream of problems and process, he then says ~"throw away everything and start from scratch" and throws in a quote from a self-improvement, business book, as if he just did everyone a favor.

</comment></comment></comment><comment><USER8> An impression I have is that, bad as hiring practices are, we still hire good people most of the time. At my workplace we have the mainstream HR hiring process, but we hire plenty of talented, creative, engaged people, and have a healthy culture. Some things like the personality test, are a pure cost with no conceivable impact. Everybody should know how to take a personality test by now, just like we all learned how to pass a "behavioral" interview.

A process that admits some variability, even if by accident, may make your organization more robust in the long run by avoiding mono-cultures, both technical and personal. Some of the skill areas that my employer depends on, including mine, were hired by accident.

The most frustrating thing is HR won't let you see what's out there and adapt your requirements to what's available.

<comment><USER6> > The most frustrating thing is HR won't let you see what's out there and > adapt your requirements to what's available.

Good point.

P.S. Though personality tests are EZ to juice, as you mention, they're still a low-pass candidate filter. Honestly, I see their biggest value as "just another ploy" to wear down candidates during interviews.

</comment></comment><comment><USER9> > They minimize or completely disregard whether or not someone will be a > cultural fit.

This is because in practice, "culture fit" is the current buzzword excuse for what is otherwise called "illegal discrimination".

<comment><USER10> So what about it, then? Is cultural fit supposed to be completely ignored? It's important, and assuming that it means illegal discrimination is totally false.

<comment><USER11> I don't think the problem is filtering by cultural fit itself, but rather, the overbroad use of the term for widely different scenarios to the point where it conveys no information at best, or hides bad reasons at worst.

The term can mean a legitimate work compatibility issue like "people feel awkward around him when they try to crack innocent jokes to ease the stress", but can also mean "he insists on picking up his kid every day rather than going out drinking".

</comment></comment></comment><comment><USER12> I wrote this before, but I think the most effective way to hire is to do your best without giving into to grueling whiteboard interviews, and take a chance on someone who seems smart. But also fire the person quickly if it seems like they won't be a good fit. After spending years interviewing people, this is the best conclusion I've come up with, because nothing else works as conclusively. Yes, it's brutal, and a bit ruthless, but effective. Whiteboard interview questions are a terrible measure of whether someone will be able to contribute. Same goes for the other types of interview questions.

Of course, you need to give the person a chance to ramp up, etc, but if they can't be a contributing team member in 2 months, then it's better to give them 1-2 month's severance and get rid of them. I know one late-stage startup in the city that is using this technique, and I believe Netflix uses this technique as well. It sucks, and kind of creates a bit of a harsh environment, but it's a fast way to build out your team, and probably has the same success rate as any other interview method, if not better because you cull your bad performers quickly.

<comment><USER13> > do your best without giving into to grueling whiteboard interviews, and take > a chance on someone who seems smart.

Um, what does that mean in practice? "do your best" is pretty much meaningless. "Someone who seems smart" seems to invite hiring by stereotypes.

</comment></comment><comment><USER14> Get rid of HR completely. The best places I've worked at had no HR team. Instead, the team interviewed and decided together who to hire. Anyone could veto a new hire and anyone could introduce or recommend a new hire. I know this wouldn't work at a _huge_ company but I'm fairly certain I read about Berkshire Hathaway operating like this at the BU/Department level.

<comment><USER15> Let's be clear that this is really terrible advice for every company except very, very small companies.

An HR department is not a "big company" thing that's there to get in your way. Its job is to do things like (e.g.) protect the company against liability in messy sexual harassment scenarios or (e.g.) hiring discrimination lawsuits.

The substitute for this functionality is not goodwill or "just doing the right thing" because this role necessarily involves a detailed understanding of employment law. If you disregard this department when building your company past, say, tens of employees, you are basically certain to be in for a bad time later. The book is written here by companies like GitHub, who have had major scandals that could have been prevented mostly or wholly by a competent HR department. If you look at their example and don't learn, then you are a fool.

</comment></comment><comment><USER16> In the UK, HR are often less involved in the earlier stages, and actually become a problem at the latter stages of the process. Tech hiring still sucks hard though. We like to think there are simple clean bias free processes we can follow and repeat for awesome hiring, but somehow still go with the gut at the end of the day.

</comment><comment><USER17> The problem with hiring is that there are too many applicants, and too many disincentives in the process for companies looking to hire.

Lots of people are looking to catch a break, score their dream job, or just see what's out there, while many more just need _something_ to pay the bills. In almost every case, applicants can't win what they don't put in the middle -- which means that they have to apply if they meet even some of the position requirements.

Unfortunately, for every well-qualified applicant there are many less- qualified applicants, and the deluge of applicants means that it's simply not possible to review each person individually. Instead they get run through a filter built from loose heuristics that try to capture job requirements.

I've long felt that the solution here is the same as a busy nightclub: charge a cover. For someplace like Google that gets hundreds of thousands of resumes, that'll cut down on the applicant pool quickly. Reimburse it with a bonus for candidates who make it to the interview stage. It's not about penalizing applicants, it's about encouraging applicants to be honest about the fit between their skills and the position requirements. I predict there would certainly be fewer applicants failing FizzBuzz.

Employers are also hypersensitive to false positives (candidates who don't work out), and a (justified) fear that they'll invest in a candidate who will move on after learning and maturing in the company. It sucks having to fire someone who isn't working out, and it can hurt morale even if the employee wasn't producing. The cost of onboarding, training, and firing a candidate sets a high threshold against false positives. It's just as bad when a new employee is working out well but leaves abruptly for a better offer. I don't have a solution to the former, but the latter is usually a good indication that you need to review your compensation policies and the overall competitive positioning of your total package compared to the market. Happy employees don't usually leave; people quit when they don't have advancement potential, when they don't feel fairly compensated, and when they're bored. [1][2]

[1] [http://randsinrepose.com/archives/bored-people- quit/](http://randsinrepose.com/archives/bored-people-quit/) [2] [http://www.joelonsoftware.com/articles/fog0000000038.html](http://www.joelonsoftware.com/articles/fog0000000038.html)

</comment><comment><USER18> > The question that wasn't useless? It was "what do you know about our > company?"

This wouldn't work for me. I rarely know much about the company I'm talking to. Once I was so amazingly off the mark about what the company did (I must have confused them with another, though I still don't know which one), that _I_ was shocked and disappointed with myself. I still got the offer. (I turned it down; I would have been good at it, but I got something closer to home instead.)</comment>


Python Moratorium: Let's think about this - <AUTHOR> http://jessenoller.com/2009/12/04/pythons-moratorium-lets-think-about-this/

<comment><USER2> I'm detecting some patterns in language-related blog posts lately:

* Python: What we're doing is correct! Can't you see that it's correct? Just _look_ at the gleaming correctness before you!

* Perl 5: We're not dead. We're actually growing by a number of metrics. Why do you keep saying we're dying?

* Perl 6: We're Perl! Well, actually, we're another language in the "Perl family" ... but we're still called "Perl"! Actually, we're more Perlish than Perl. But also less so due to various improvements! Here, just look at the tutoria... hm... umm ... see you on IRC!

* Scheme: Check out my new implementation!

* Ruby: [empty]

* Lua: Wait. We're supposed to be blogging?

<comment><USER3> Actually, the intention was to add to the rationale which spurred me to help author the PEP. That's ok though, it's still a correct decision. ;)

<comment><USER2> I don't mean to single you out, Jesse. I realize it takes guts to put your opinions online publicly.

<comment><USER3> Nah, it's all good - I've seen the trend too.

</comment></comment></comment></comment><comment><USER4> "The one that really gets me is the assertion that the moratorium was some ego-driven "python is perfect" statement. That Guido/core dev think the language is "done" and that no new syntax or constructs are needed."

I'm pretty sure anyone who has assumed that didn't bother to read _anything_ Guido has written/co-written on the subject,, including PEP3003.

<comment><USER5> As someone who has (had?) this opinion, I think this is a straw-man: my sentiment is that "python syntax is good enough to take a 3 year break from evolution" seems too confident.

<comment><USER6> I'd rather python take a break so libraries can develop/upgrade than go the ruby route where everything is consistently upgraded to the point that no substantial libraries really exist and you are learning a new framework or tool every few months to a year on the ruby speed of light track

<comment><USER5> That's a good point. I must be in a mind-changing mood, because that definitely seems like the better option.

</comment></comment></comment></comment><comment><USER7> I think that the Python moratorium has a very good chance of being Python's Perl 6 moment. It's just to easy to lose mindshare. People complain about new being unstable, whether strategically or technically, but a lot of them still _like_ new.

I just like to feel like something is alive.

This is Python we're talking about, not ADA. Both have their place.

<comment><USER8> The thing about having a "Perl 6 moment" is that there needs to be something better than Perl 6, and Perl 6 needs to suck.

Python neither sucks nor has any competitors that are obviously better. And of course there's that nice feature that Python has that Perl never had in any version - the ability to read code twice.

<comment><USER9> > ... of course there's that nice feature that Python has that Perl never had > in any version....

I expect better from HN comments.

"I've tried, repeatedly, but I still find sigils difficult to understand" is fine.

"I prefer postfix method calls to infix or prefix symbolic operators" is fine.

"I've never figured out how to use Perl's copious testing libraries or static analysis tools to write maintainable code" is honest.

"I believe that consistent indentation is a primary factor in long-term maintainability" starts to trip my hogwash-o-meter.</comment></comment></comment>


How Instagram uses your mobile microphone to spy on you (and serve ads) - <AUTHOR> https://medium.com/@damln/instagram-is-listening-to-you-97e8f2c53023 <comment><USER2> This is maybe the third time I've seen an article with the same anecdotal proof. If you have any real proof, show us, if you don't be clear and don't use a bullshit clickbait title.

For those that want to spend some time trying to figure it out - take a look at MITMproxy, find proof that they are spying and show us.

<comment><USER3> > take a look at MITMproxy

This was my first thought. I haven't taken a look yet, but I suspect that if an organization this large was doing something so nefarious, they'd encrypt/encode or otherwise mask what it is their doing. Perhaps, by misdirection, odd naming of params, or outright encryption - take this all with a grain of salt, my domain is server-web, not mobile.

</comment></comment><comment><USER4> One theory: Instagram and Facebook have hacked iOS to bypass the built-in bright red flashing 'recording' status bar and are recording your conversations constantly for their own benefit.

Another theory: At some point you looked at a web page that mentioned projectors, or you happen to be in a demo that frequently buys projectors, so you saw an ad for projectors.

I know which theory I'd buy. These conspiracy theories pop up constantly, they're quite tiring.

<comment><USER5> Another theory: it's just a coincidence that Instagram shows this ad the same day the guy talked about such a device. I know computer scientists aren't actual scientists, but I would not present hypothesis as conclusion. At least do some experiments before you jump to conclusions.

I've seen an ad on Instagram of a t-shirt that says "Winners are born in $MY_BIRTH_MONTH", which is quite transparent targeting...

<comment><USER6> > computer scientists aren't actual scientists

I think a lot of folks here are gonna disagree with that.

</comment></comment></comment><comment><USER7> I know FB have a lot of really smart data-scientists working on this stuff but I doubt that it's worth the effort to analyse everything you say on the hope it'll contain some kind of keyword that can trigger an advert.

It's more likely that you and the friends posted pictures at around the same place/time your friend later googled micro projectors and was tagged via an embedded like button on the page (yeah... those things track you!). Then they just made a jump that two people in the same area may have similar interests and served you an ad.

It's just like how I get recommendations for people I've never met before after attending an event that we both just happened to go to.

</comment><comment><USER8> The "experiment" described doesn't even seem to have been intentional, that's just an anecdote.

On the other hand, nearly _everyone_ I talk to has experienced these mind- reading ads - if this happens solely through correlation of social networks and their online activity, it is maybe even more mind-blowing than the conspiracy theory, and brings up scary questions about what we should expect from AI in the future.

</comment><comment><USER9> Maybe the cousin did some web research on micro projectors, and the ad was served to those he/she was with?

Some experiments discussing obscure products should help determine.

</comment><comment><USER10> This article is obviously anecdotal and not proof... But me and my wife have been experiencing very similar things and she is convinced that Facebook or Google are doing the same thing. We have had a few, instances in the last month where our conversation in the car was followed by relevant advertising just minutes later when she looks at Facebook... Not actually making an accusation, but we are definitely suspicious at this point.

<comment><USER11> Anecdotal as well, but I took all the app media permissions away from Facebook and Google apps and the weird advertising coincidences stopped. The apps run just as well.

I still get targeted ads based on my FB posts, but that's the accepted trade.

</comment></comment><comment><USER3> As others have said, this is not causation nor has hard evidence been provided, however, I am curious:

What moral obligation does a developer have, if any, to expose this sort of "feature"?

The mob came when Snowden et all exposed the large passive-collection programs run by the federal government - do people not believe that we have the same protections from private companies as we do from public entities? Yes, it's their app and I don't have to download it, but we're talking about covert activities - aka spying - that a user has not consented to.

You wouldn't let General Electric put a "passive" video camera in your oven to capture what goes on in your kitchen for the sake of a "better cooking experience" or "personalization"; our digital real estate should be no different.

</comment><comment><USER6> Wouldn't it be easy to test your hypothesis even further?

Instead of a random conversation, keep repeating a certain outrageous/uncommon phrase (say Korean cuttlefish snacks) and monitor your feed to see if any weird ads appear.

My guess is that Facebook/Instagram probably categorised your profile as someone who enjoys the outdoors and watches movies (which can be said of a large proportion of the world population), and knew that you might have been hiking then (location tracking and possibly via your face appearing in a friend's post?). Consequently, a "relevant" ad was pushed to you.

</comment><comment><USER12> Creepy. So let's have a Mic / Camera icon blinking in the status bar whenever an application accesses them. At least it will keep people informed.

<comment><USER13> I believe this is how it works at least in iOS if the mic is used by an app in the background

</comment></comment><comment><USER14> Repeat after me, "Correlation does not imply causation"

<comment><USER15> But it does hold up a big sign saying "Hey, look over here!"

</comment></comment><comment><USER16> The day I became sure of this, I was painting a house together with this guy whose dad used to work for my dad. The day before I had gotten a job offer for working at some startup, can't remember the name right now (I haven't heard about the company since this day). They were supposed to record DJ sets and put them on their web site, and the guy I was working with was into the EDM scene so I mentioned it to him, mostly because I couldn't quite understand the business proposition, and thought perhaps he could. He couldn't, though - according to him, it was already a big thing but the DJ set videos were posted to YouTube, which makes sense to me.

Not 15 minutes later, he comes around to me and says "What was the name of that company?" I reply, and he goes, "wow, that's strange - I just got an ad for them on my FB."

Again, I've never heard about the company before or later.

Well, it's going to come out, and when it does, people will go from "what?! that can't be true" to "well duh, what did you think?! everyone knows that".

</comment><comment><USER17> Another possible explanation is that someone else in that conversation performed a search that Facebook could see. Facebook also knows where you are, and perhaps pushed ads to everyone within X meters of that search.

Creepy, but not "listening to every word you speak" creepy.

</comment><comment><USER18> I don't know if that is being done or not but would immediately question if this is just a coincidence. How many different things have been talked about over the years and how many adverts have been served.

Was this just a case of a random though possibly slightly profile targetted, advert happening to appear during the time he remembered the conversation. Did he get ads for everything they discussed?

</comment><comment><USER13> Mods: Title is misleading and not the original.

This post never shows "how" ig uses a mic, just theorizes about it without any proof.

</comment><comment><USER19> I have another anecdote. I saw a friend I haven't seen in over a year randomly at the airport. We had a drink, never took out our phones, and he told me he was going to take photos in the Yukon. Later that day on my phone I got an ad on Instagram for "Visit the Yukon!". That creeped me out a bit.

<comment><USER20> The obvious conclusion is that the Yukon tourism board, after paying Instagram to show you the ad, also paid your friend to "randomly" connect with you at the airport and try to further sell you on the Yukon trip.

</comment></comment><comment><USER21> Agree with what everyone else is repeating about the article. I'm curious though: why does Instagram ask for your mic in the first place? I don't use the app so the presence of that option is weird.

Personally I am sure that I am tracked online, but I block ads very aggressively so at least there's that.

<comment><USER22> I only ever post photos taken in other apps, but I believe you can shoot photos and video+sound directly in Instagram.

The "stories" feature that they knocked off from Snapchat would definitely use audio.

</comment></comment><comment><USER23> It has happened to me too and far too many times to be just a coincidence. I don't even have Instagram or Facebook on my mobile so won't be surprised if Google is involved too as I have an android phone.

</comment><comment><USER24> Isn't it much more likely that this was a predictive algorithm doing a good job of guessing what you might want?

</comment><comment><USER25> i've similar experience, my location permission is always turned off for Facebook, it was showing the realeaste ads right where i was.

</comment><comment><USER26> or someone on a related device has been googling for products related to that conversation.

</comment><comment><USER27> I think an assumption should be made for every single app on your phone: It will read, listen, take, and record everything.</comment>