Bluetooth's Complexity Has Become a Security Risk - <AUTHOR> https://www.wired.com/story/bluetooth-complex-security-risk/ <comment><USER2> The vast majority of my bluetooth woes are not with bluetooth, but with the complete lack of configurability on Android and other devices.

I end up pairing/unpairing my home speakers with my phone constantly, not because bluetooth is brittle, but because Android doesn't have options like "remember pairing but don't automatically connect with this device", or, "select audio output", or, "do/dont continue playing audio when this device loses connection". Otherwise, when I turn my headphones on to bike to work in the morning, my phone will be paired with the speakers, and the headphone will connect for calls but not audio.

I don't want linux-like configuration. I don't want to root my phone. But having no control on these thousand dollar devices over the most common tasks we use them for despite billions in R&D and tens of thousands of developers is ludicrous.

<comment><USER3> > I don't want linux-like configuration.

I want linux-like configuration. It's the only way to be sure.

<comment><USER4> Linux like configuration is utterly terrible. At least with iOS there's usually two modes: it either connects or it doesn't. When it connects, it works flawlessly. For Linux, it's a variety of possibilities including but not limited to: able to discover device but can't pair, pairs but unable to send any files, Bluetooth daemon crashes two seconds after pairing (GUI hangs and you have to manually grep through the logcat to figure out what went wrong), Bluetooth pairs but on reboot daemon fails to start with a cryptic error code. On googling the error code leads to a post on Ubuntu StackExchange from 5 years ago that references a post on the Arch Linux forum from even further back. On IRC support, you would be recommended to install Blueman/Bluez/whatever-their-favorite-bluetooth-software on top of your distro's version. And after a whole afternoon, it still wouldn't work. When you write a blog post complaining about it, people would tell you in the comment thread to go replace your device with a "ThinkPad" cause Linux is not supposed to run properly on most laptops despite being marketed as such. And then finally two months later someone posts a comment telling you to flip an entry on an obscure config file somewhere deep within the system and the problem magically goes away. So no, I don't want Linux-like configs.

A better solution would be more robust cross platform Bluetooth stacks. We have tons of high quality, open source TCP/IP networking software, elliptic curve cryptography and key exchange libraries. The same needs to be done for Bluetooth. If companies like Google have enough money to relaunch and rebrand IoT home assistants every other week and publish new networking stacks written in Go for their latest container orchestrator/mobile OS/browser every 6 months then I am sure they can find time and funding for better Bluetooth firmware.

<comment><USER5> You are confusing configuration flexibility with bugs.

<comment><USER6> The more configuration flexibility you have, the more bugs you will have.

</comment></comment></comment></comment></comment><comment><USER7> The problems with Bluetooth are it doesn't pair, it doesn't unpair, you need to unpair first, you need to use the other protocol that transmits audio, the latency is way too high, it's insecure, the software stack hangs or crashes, you can't know for sure if two devices will work together, BLE is WAY too low level and a step back, the spec is way too big and complicated, ... In 20 years they have not managed to make it good. It seems hopeless with the current institutions managing it. What a heap of hot garbage.

<comment><USER8> Every Bluetooth device I have ever tried has failed to meet my expectations. I have a drawer full of Bluetooth devices that I regret purchasing. I've been fooled too many times already, I simply won't buy a device that relies on Bluetooth any more. For mouse/keyboard I like RF and for audio you can pry my 3.5mm jack from my cold dead hands.

<comment><USER9> I was initially rather skeptical of bluetooth headphones - but after yet another gardening related headphone incident I bought a cheap pair (£30) and they worked perfectly well. They broke (headband snapped) and I upgraded to moderately priced Sony ones (~£100).

I've literally never had any problems connecting any of these to any devices (desktop PC, iPads, iPhones).

Bluetooth also seems to work pretty much perfectly with my car as well.

I'm not doubting you have problems - but interesting to note that for some people Bluetooth does actually seem to work.

<comment><USER10> I have a pair of moderately priced Sony BT headphones. Could be a similar model given the price range.

You can't charge and listen at the same time (wtf)

I get no warning when the battery is about to die (combined with the above this really sucks, they shut off in the middle of something)

I dual boot OSX and Windows on my laptop and I have to re-pair the headphones every time I switch OSes. I suspect each OS has a different encryption key, but the headphones can't tell the difference between which OS is running.

They cut out and skip all the time when walking through the City. They are borderline unusable when walking between the train station and my office.

They cut out and skip occasionally when not walking through the City, for no discernable reason.

They have an obnoxious and unnecessary blue LED that blinks periodically when they are turned on. This lights up our whole bedroom at night and annoys the crap out of my wife. I have to keep a piece of black electrical tape over the LED.

These are the best bluetooth headphones I have ever owned, they sound great, and I absolutely hate them.

<comment><USER11> _" I dual boot OSX and Windows on my laptop and I have to re-pair the headphones every time I switch OSes. I suspect each OS has a different encryption key, but the headphones can't tell the difference between which OS is running."_

Your suspicion is correct.

The real problem is that Apple and Microsoft both have not provided any way to specify the key to connect with, and they both paired independently, creating a different key each time.

One solution would be to find where the link key was stored in one of the OSs and copy it over to the other OS. Then they would both use the same link key and you are good to go until you re-pair for some reason. I don't know if this (still) works, but some instructions are here:

      https://www.insanelymac.com/forum/topic/268837-dual-boot-bluetooth-pairing-solved/

A different solution could be that the Bluetooth adaptor usually has a way to store the link key within the device in NVRAM. The technicality of that is that the adaptor does never ask the OS for the link key, it just connects. I don't know if tools exist in OSX or Windows to do that, however.

</comment></comment></comment></comment></comment><comment><USER12> In my opinion part of the problem with Bluetooth is that the API exposed by android and IOS is like... two or three layers too low. Imagine if in web programming you set the MTU size in your HTML and you get the idea of what programming Bluetooth is like.

Another issue I see is more of a view point that people have trouble shaking. Typically we think of the server as being more powerful than the client, but in BLE the client usually has more processing power and battery by several orders of magnitude. Once you examine this preconception BLE makes a whole lot more sense.

<comment><USER13> It isn't even the API vendors' fault necessarily.

Compared to HTTP/TCP/IP, abstractions between layers of the BLE stack are extremely leaky. Examples: indicating choice of PHY coding and channels in the equivalent of a `listen/connect` call, or the three different but intertwined places where fragmentation/reassembly can happen. Being effective with BLE requires deep understanding of the entire stack, and since it is difficult for a single person to have such level of understanding, we get bugs. By comparison, being effective with HTTP does not require one to know anything about the PHY layer, or TCP stream reassembly.

I suspect this is due to not having enough independent implementations of each layer - Bluetooth is designed and standardized by one committee, and the entire stack usually implemented as a single "thing", making it too easy to break abstraction when a new feature needs to be added.

<comment><USER14> > Being effective with BLE requires deep understanding of the entire stack, > and since it is difficult for a single person to have such level of > understanding, we get bugs.

Bluetooth or LE? LE with GATT in my experience deals with none of this. At least not on an Apple product, CoreBluetooth hides all of this from me as an iOS or macOS developer.

<comment><USER13> Apple does hide most of this, but consider that an iPhone app isn't the BLE product most developers are building, rather it is the device that iPhone app talks to, and where the bugs lurk. (Not that Apple doesn't have its fare share of BLE bugs at the chipset/driver level, which resurface with every new iOS release.)

</comment></comment></comment></comment><comment><USER15> Become? Become!? That's funny. That's Rich.

Do you have any idea how bloody insanely complex bluetooth is?

Just the the core stuff,

[https://www.bluetooth.com/specifications/bluetooth-core- spec...](https://www.bluetooth.com/specifications/bluetooth-core- specification/)

without the various protocol specs... [https://www.bluetooth.com/specifications/protocol- specificat...](https://www.bluetooth.com/specifications/protocol- specifications/) or the GATT or ...

The bloody core spec is 3000 PAGES of standardese.

All in stuff that costs less than a dollar per chip.

<comment><USER16> I'm someone who actually likes reading standards for fun (sometimes there are interesting things in them), and have read _many_ of them as a result[1], and even implemented parts of some; but I still find Bluetooth, along with WiFi and GSM/LTE very intimidating.

Is there something about wireless in particular that lends itself to this proliferation of complexity? I've read 802.3 (Ethernet) and it was nowhere near as dense and intimidating.

[1] MP3, JPEG, JPEG2000, JBIG2, H.261 to 264, MPEG 1 and 2, USB, SATA, IEEE1284, RS-232, a bunch of RFCs, and too many others to list, those are just the ones I remember reading recently...

<comment><USER17> It's an industry standard designed at closed door meetings where you have to pay to get in and pay to read the spec.

It benefits all of the participants to build a big, deep moat where the paying participants have the expertise.

This is how, by the way, warts like this occur: [https://news.ycombinator.com/item?id=17402274](https://news.ycombinator.com/item?id=17402274)

<comment><USER7> Somehow you'd think it would also benefit participants if it was also reliable and fulfilled end user's requirements. It is not theoretically impossible to have wireless headphones with low enough latency for gaming.

</comment></comment></comment></comment><comment><USER18> I've gotten so tired of protocols and specifications that are overly complex or are poor fits for how they're used that I've started developing my own for the services I'm implementing [0].

Making protocols & specs no more complex or ambiguous than necessary is a hard requirement in this modern, security-conscious world.

[0] [https://github.com/kstenerud/specifications](https://github.com/kstenerud/specifications)

<comment><USER19> Who else is using your specs?

<comment><USER18> I couldn't say; Github doesn't report to me who is including my code or implementing my specs.

The point is to make specs that people actually WANT to use, which requires advocacy (to get more eyeballs on it), and collaboration (to fix things I've missed).

I build these things to scratch an itch, but I want others to find them useful, as well.

</comment></comment></comment><comment><USER20> I hate bluetooth. I hate pairing viscerally.

Recently, I rented a Dodge mini van. Was all they had.

The pairing is voice. Fucking menu via voice! It took 10 minutes...

Please say:

Manage devices Add a new device Configure . . .

What priority, say 1 through 5...

I say 1.

Priority 1 is in use by [device name]

And on and on. I was angry when done. I will never use that POS again. Ugh!

Someone at Dodge needs to try again. I know you meant well. I know you were probably told to do it too. But damn. It is a real fail.

I hate quality changes for very thin reasons.

I hate quality changes for technical reasons.

I hate charging.

About the only time I loved Bluetooth was running windows XP and that excellent driver could pair with my old flip phone and do it all. Network, act as mic, etc... I did it once and done too. Ran that setup for a couple years until I got a better phone.

Here is the thing. Brb

Back! Had to change devices.

I can be convinced to go wireless. It is going to take more than the mess we have today.

Just renewed my phone with headphone Jack. Brand new, should be good for years.

The wireless devices need to be serviceable, the protocols need to be sane and robust too, or the whole affair is a total net loss.

</comment><comment><USER21> Complaining about 3000 pages of spec, in comparison to WiFi, is a bit apples- to-oranges. A lot of Bluetooth is not just the binary protocol. There is a huge surface area of what basically amounts to RPC protocols for different, standardized device interfaces. Bluetooth is a _wonder_ for having things like heart rate monitors, pointing devices, and audio interfaces specified in a single, standardized way. You can generally count on a BT device from literally thousands of vendors to behave in the same way in literally thousands of different client devices.

It's more fair to compare BT to heavy protocols like ZigBee, or worse yet, ZWave. If you wanna dig into a shit-show of wireless protocols, look no further than ZWave. That thing is a complete boondoggle.

I've been pretty happy with BT.

</comment><comment><USER22> It'd be nice if we at least got the easy connectivity promised and just had to work out a few security kinks.

[https://xkcd.com/2055/](https://xkcd.com/2055/)

I have a few Bluetooth speakers. If I accidentally close the app but forget to disconnect from settings too, then no one else can pair with them until I return. This seems like standard behavior, and makes me worry that if I lose my phone at the wrong moment, I might brick a few devices.

I really like common standards, but if the consortium can't fix either security or usability, we might be better off with a clean slate.

<comment><USER23> Lately Bluetooth connectivity with Apple devices has been great for me. AirPods just work and everything is pretty snappy and stable.

<comment><USER24> Yet there is still quite a lot of friction.

Airpods have the best support and they still require you to find out how to pair them when you change device and wait.

Keyboard/mouse is insane. If you want to use them with two different laptops.

<comment><USER25> My mouse (Logitech MX Master) supports Bluetooth. It also supports Logitech' s "Unifying Receiver" and has a button to switch between three different Logitech receivers. I think everyone can guess correctly which of these options just works and always does what you want it to.

<comment><USER26> To clarify if it's not clear - the button switches between three different receivers, Bluetooth or Logitech unifying receivers. Currently I have 2 BT profiles, and 1 Logitech. The mouse works flawlessly

</comment></comment></comment></comment></comment><comment><USER27> Much shorter and general headline concerning the type of problem:

Complexity Is a Security Risk

<comment> ga-vu Ever since they've paywalled their articles, Wired is FUDing it like crazy.

</comment></comment><comment><USER28> How come we can't solve lag?

There should be a part of the protocol that determines the lag and a standard way for programs to then set their delay accordingly, so that when I'm watching a video the sound is synced with the screen. Instead I have to manually try several different lag times until one feels good enough.

<comment><USER29> It seems like something endemic to the protocol. Logitech's recent wireless mice/keyboards have skipped bluetooth altogether - they determined the lag was simply too large for high performance gaming: [https://www.reddit.com/r/MouseReview/comments/99qq4a/about_t...](https://www.reddit.com/r/MouseReview/comments/99qq4a/about_that_1ms_lightspeed_wireless_technology/)

<comment><USER30> I have a Logitech G603 mouse that supports both, and there is no noticeable lag when using the proprietary dongle. I'm still glad BT is supported as a fallback, but the lag is undeniable.

</comment></comment></comment><comment><USER31> The problem with BT is not unique to BT. Any protocol at the time when it's used by app developers is not understood and misused. Most products in the wild just use the example code provided in the sdks provided. You can make a whole product this way. Especially simple stuff like bt speakers.

</comment><comment><USER32> You know what doesn't cause increased attack surface for your devices, doesn't have pairing issues, never cuts out audio randomly, works immediately upon connection, is low power, and doesn't introduce additional RFI into your living space? A headphone jack.

Just saying.

<comment><USER33> But I _must_ have a 1mm thinner phone!

Expensive timebombed unrepairable accessories is a small price to pay in order to have a 1mm thinner expensive timebombed unrepairable phone!

</comment></comment><comment><USER34> It has always been the case. Attending IDC in 1999 before a single device had been certified and the hardware standards and certification docs were already 3500 pages. You can only imagine how this has grown in 20 years. Bluetooth is a "giraffe" technology. It evolved in to the current form through happenstance. Nothing about it is simple or normal, instead randomly weird and inconsistent. And nobody is surprised that after 20 years everyone rightfully assumes that it barely works and is full of holes. However, since the standards are controlled by the people who build the hardware it is not been possible for a functional, non-insane alternative to appear.

</comment><comment> jim-jim-jim IIRC OpenBSD dropped bluetooth for this very reason.

</comment><comment><USER35> I am using thread which is a lot more sensible [https://openthread.io/](https://openthread.io/)

</comment><comment><USER24> The funny thing is that the protocol is meant to be run by tiny devices. So of course one would thing they would have attempted to make it simple.

<comment><USER31> If you want simple you can build your own on top of 15.4. This way your device will work but only with your other device.

The big thing about BT is that it's everywhere.

<comment><USER36> The top players (apple/samsung) have switched to proprietary stacks on top of bluetooth to get the "magic" pairing experience. Google is following suite soon. On non "magic" pairing devices, bt is still a pain in the ass to get to work comparatively.

Imagine if you had to do the standard bt pairing process for wifi. Device to connect to has to be broadcasting, Device trying to connect has to be listening, after connection you have to ensure that the passcodes are the same etc etc. If the connection drops then repeat the process sometimes(<BT 5.0).

</comment></comment></comment><comment><USER37> My main gripe with BT is the inpossibility to limit even which profiles[0] are active. For example: I do not mind allowing audio, but can not allow any form of networking.

0: [https://en.wikipedia.org/wiki/List_of_Bluetooth_profiles](https://en.wikipedia.org/wiki/List_of_Bluetooth_profiles)

</comment><comment><USER38> I've not looked at recent specs but Bluetooth security has always been a bit of a misnomer. It's roots are in FTP etc and older protocols not really designed for security in mind, never was. So to say it's become a security risk, when it already was, may be missing the point.

</comment><comment><USER39> I've been looking for a way to stop bluetooth from pairing with the Macbook asleep, this looks promising to switch it off when the lid is shut at least:

[https://apple.stackexchange.com/a/272244](https://apple.stackexchange.com/a/272244)

</comment><comment><USER40> You wonder why OpenBSD removed it ?

</comment><comment><USER41> it is complex which is usually an issue with security, but the article title makes it sound like maybe security wouldn't be that bad if it weren't for complexity. Bluetooth was broken long before it became complex. A protocol that allows you to negotiate a key size of maximum 1 byte is just plain dumb[1].

[1] [https://twitter.com/matthew_d_green/status/11287020035243745...](https://twitter.com/matthew_d_green/status/1128702003524374534)

</comment><comment><USER42> Become??? BT complexity and security were a joke ever since ver 1.1.

</comment><comment><USER43> What happened to UWB as an alternative for Wireless PAN?

I remember it being proposed as an alternative. Is it any easier to use/secure? The high frequencies should work fine for short ranges, no?

</comment><comment><USER44> I totally agree. Drivers should be easy to write, spec should be slim and modular. It does not stick with the idea of lightweight communication stack.

</comment><comment><USER45> I have to assume the reason that Bluetooth is still annoying 10 years later is the lack of synchronicity between OS vendors and hardware vendors.

Unfortunately, this is something that Apple does well, and most other manufacturers and operating systems have a poorer experience.

I say that as an ex-Apple user, not a fanboy. I love my Linux Desktops, but the Bluetooth pairing is a huge pain. Likewise, when I boot into Windows for games - Bluetooth peripherals are far annoying than their Apple counter-parts.

</comment><comment><USER46> "3,000 pages long" and yet it's still a pain in the ass to use a Bluetooth peripheral with more than one device.

</comment><comment><USER47> Also seen this weekend: x86 security issues, presumably also stemming from its complexity.

Dijkstra must be rolling in his grave.</comment>


Researchers create a Maxwell's demon with a single electron - <AUTHOR> http://arstechnica.com/science/2014/09/researchers-create-a-maxwells-demon-with-a-single-electron/

<comment><USER2> What a well-written article - good lay description of the problem and the results, doesn't go off the deep end with wild speculation of technical jargon which may or may not be entirely accurate.

I'm not terribly surprised by the results - if you stop to think about it the demon in the original experiment is potentially expending quite a bit of work to observe the gas molecules and open and close the gate.

<comment><USER3> I agree for the most part, but it would have been nice for the article to mention _how much_ energy it takes to flip a bit, and whether or not that value varies in different circumstances.

A flipped bit can mean the difference between tons of snow falling down a mountainside or staying where it is. (Down force greater than stuck force? OK, avalanche!) Does _that_ bit cost the same energy as the one described in the article?

If so, I deeply care _how much_ energy that is!

</comment></comment><comment><USER4> Some of my favorite paper's on Maxwell's demon are:

[http://www2.pitt.edu/~jdnorton/papers/ExorcistXIV/Exorcist1....](http://www2.pitt.edu/~jdnorton/papers/ExorcistXIV/Exorcist1.pdf)

[http://www.pitt.edu/~jdnorton/papers/ExorcistXIV/Exorcist2.p...](http://www.pitt.edu/~jdnorton/papers/ExorcistXIV/Exorcist2.pdf)

...and to ease into things, an article by one of the authors:

"The Simplest Exorcism of Maxwell's Demon -- No Information Needed"

[http://www.pitt.edu/~jdnorton/Goodies/exorcism_phase_vol/exo...](http://www.pitt.edu/~jdnorton/Goodies/exorcism_phase_vol/exorcism_phase_vol.html)

</comment><comment><USER5> Once I saw a presentation where they did something similar but with trapping a single atom with lasers [1]. Basically Szilard's engine is a clever "toy" model for predicting Landauer's principle [2] that they verified.

[1] [http://www.nature.com/nature/journal/v483/n7388/full/nature1...](http://www.nature.com/nature/journal/v483/n7388/full/nature10872.html)

[2] [http://en.wikipedia.org/wiki/Landauer%27s_principle](http://en.wikipedia.org/wiki/Landauer%27s_principle)

</comment><comment><USER6> >Researchers create Maxwell's demon with a single electron.

Edit: note the lack of indefinite article.</comment>


How Fast-Growing Startups Can Fix Internal Communication Before It Breaks - <AUTHOR> http://firstround.com/article/How-Fast-Growing-Startups-Can-Fix-Internal-Communication-Before-It-Breaks

<comment><USER2> Not to be too negative as I think all of these things are theoretically good, but they are all just copying things Google does, and Google is a much better example of a successful company than a 20 person startup. FYI I'm sure many companies were all doing these things before Google, they are just an easy example.

1) Google moderator was invented because it was used internally for Google's TGIF (which is essentially a giant version of the "contrarian office hours")

2) Google obviously has tons of tech talks of many different topics that are not only available to people in the company but are often posted to youtube for everybody

3) 1:1s are great (this isn't just common to Google but practically any well- managed company), but if this company reaches 100 employees then there is no way the CEO will be able to have effective meetings with everybody, and it probably wouldn't be a good use of time either. At that time they will need to come up with a sane management structure (very hard) that hasn't been required yet.

Also my favorite part is:

"We tell our employees to check their egos at the door, so as a company we need to do the same thing,"

Coming from the CEO, in an article talking about almost exclusively about how great he is, which includes 2 pictures of himself and 0 pictures of anybody else on his team.

<comment><USER3> > Coming from the CEO, in an article talking about almost exclusively about > how great he is, which includes 2 pictures of himself and 0 pictures of > anybody else on his team.

This is quite well directed criticism. The article is one of those pieces that really directs your attention to what it's _tell_ ing you, but what it's _show_ ing you is just a puff piece about URX and their series A.

</comment></comment><comment><USER4> "We're building a business and a product that has never existed in the market before. There's no precedent,"

I always find these kind of statements amazing. No precedent at all?

</comment><comment><USER5> The article is interesting, though the most amusing part for me was the description of the company itself (URX) and the word "deeplinking".

It's funny how in the past few years we've essentially invented both a problem that was already solved fifteen years ago and its solution.

Hyperlinks have been around as long as the web has existed - in fact, they could be considered the defining characteristic of the web. In contrast, most of these apps (e.g. news publications) really aren't doing anything that can't be done on a regular webpage on a mobile device, and yet we _have_ to have an app for everyt site, which of course means breaking hyperlinks[0].

Of course, as always, Randall Munroe explains this more succintly and with much more wit[1].

[0] Android's "intents" are a sort-of solution to this, but it still raises the question of why this problem exists in the first place.

[1] [https://xkcd.com/1367/](https://xkcd.com/1367/)</comment>


Student can't afford tablet for girlfriend, so builds her one for $125 - <AUTHOR> http://www.geek.com/articles/gadgets/student-cant-afford-tablet-for-girlfriend-so-builds-her-one-for-125-20111125/ <comment><USER2> >One thing Wei may not appreciate is Sun taking the time to stick rhinestones all around the edge of the casing he so lovingly created

What's wrong with her personalising this? That piece of editorialising was unwarranted, I'm sure he was delighted that she fell in love with it enough to put her own mark on it.

To the critics below: it just made me sad because if my boyfriend made me something awesome like this and I wanted to decorate it, I don't want him to feel bad if others comment on it - as if it were something so girly to ruin his hard work (and I own zero rhinestones).

<comment><USER3> I think it was just a humorous comment. I don't see the harm in it. BTW, you just asserted the opposite of the opinion you disagree with without any additional information beyond what the author had ;-)

<comment><USER2> True, I guess that they just look really happy in the photo.

</comment></comment></comment><comment><USER4> Heh, this reminds me of high school. iPods were a year or three old. I managed to get my hands on one with a catastrophically failed hard drive in pieces, for free. I took it home, reassembled the hard drive and the iPod, got it working, and gave it to my girlfriend of the time.

As best I know, it still works to this day. And the more I have learned about computers, the less I believe it myself- among other things, there were _fingerprints_ all over the platters!

<comment> X-Istence I've taken hard drives apart, removed the platters, wiped them down, shoved everything back together after not finding anything really wrong with it (and this wasn't being careful or nice with the platters/heads) and it has worked fine now for the last 6 years... still not sure why at one point it stopped spinning up.

</comment></comment><comment><USER5> By all accounts Wei is a badass hacker in the truest sense of the word. Being able to source the parts on the cheap and basically put it together by himself is remarkable and a testament to good old-fashioned hard work.

I'm going to make a generalization here and say that most Americans have lost this kind of DIY spirit. Instead we just whip out our Visa/Mastercard and decide to just buy what we need on credit. Yes, a solution to the problem nonetheless. But the amount of learning that you gain from doing a project like this should not be underestimated.

<comment><USER6> > _I'm going to make a generalization here and say that most Americans have > lost this kind of DIY spirit._

I disagree - most Americans in my experience are perfectly willing to DIY, just not in the same areas that _you_ or _I_ may DIY. When my car needs a new timing belt, control arms or brake pads, I'm perfectly happy to do the work myself. When it comes time to acquire vegetables, I'd much rather go to the local supermarket or farm stand and buy the them.

On the other hand, my mom has a mechanic do all her car work and grows her own vegetables. I could go on about my friend who makes her own pottery and stationary, my brother who does his own carpentry, a friend who makes his own beer, etc etc. We are all DIYers in our own way.

<comment><USER7> Necessity is the mother of invention.

</comment></comment></comment><comment><USER8> Three years ago for Christmas I built my wife a 14 inch digital picture frame from an old laptop and a nice picture frame from the hobby store. It boots puppy linux from a usb stick, and runs through a slideshow of all of the pictures in the SLIDESHOW folder on the thumb drive, so there are basically no moving parts (old laptop with no fan, just a heat sync). It's been running strong for the past 3 years and only needs a reboot when the house loses power. I love DIY projects.

<comment><USER9> Cute project, but does not sound very energy efficient to me.

<comment><USER10> I did pretty much exactly the same thing a few years ago. The power supply is about 25W, but judging by the heat coming off the frame I doubt it uses half that. The main power draw is probably the screen. I removed the hard drive and replaced it with a CF card (basically no power draw), and the fans have been replaced with a large heat sink.

For my photo frame, I used cron and set various times for it to turn off the screen.

Obviously it's a luxury in terms of power usage, but given that it pulls about as much power as a bright energy saving lightbulb, it's not really a huge issue. In terms of cost, 25W continuous costs about 6c a day, so I'd imagine the whole frame costs less than half that once you take into account the screen-off time and the reduced power draw anyway.

</comment></comment></comment><comment><USER11> Great DIY project, but I don't think it was because he couldn't afford one... for $125, you can get a pretty decent tablet in China (a good iPad knockoff or even one with a unique design and a capacitive touch screen).

<comment><USER12> Maybe he doesn't want to break the law and buy an illegal "knock-off" tablet.

<comment><USER13> Most of the knock-offs aren't illegal.

There is a minority that put the Apple logo on them, which is clearly illegal, but...

Beyond that the look of Apple's products are protected by _design patents_ and the law on them is much less clear cut and varies by country (see the Samsung case for example).

There are a large number of non-iPad knock offs available for under $125, though. A quick search on DealExtreme will help..

<comment><USER14> You mean like the Apple logo that's on the tablet in the article's picture?

<comment><USER15> What should I do with my iPhone with an Android sticker logo on it? Come on man... Jeez.

</comment></comment></comment></comment></comment><comment><USER16> the videos of the build are pretty cool -

<http://www.youtube.com/watch?v=I6TAguL2nFU> <http://www.youtube.com/watch?v=pk7vO7uDjeI>

</comment><comment><USER17> Saw it yesterday on China Daily, which is not the most reliable news source, btw.

Looks like this is just an old laptop wrapped into a shiny shell with a touch screen attached. Nice gift for his girlfriend but hardly worth a news story.

Wrapping old stoff up in a new packaging and then printing some expensive brand onto it is actually common in China. You can get "iPhones" here for under 100USD at everywhere.

<comment><USER18> > Wrapping old stoff up in a new packaging and then printing some expensive > brand onto it is actually common in China.

I wonder whether they don't distinguish the fake from original or are fakes considered "cool" despite known to be fakes?

</comment></comment><comment><USER19> Wait - what about the cost of Windows 7?

Oh, I see - it must have been included on the used laptop he purchased. Makes sense now. ;)

<comment><USER17> Here in China? 5 Yuan in any electronics market. Usually with Office and Photoshop included (and probably some spyware).

</comment></comment><comment><USER20> Comes with DIY games Angry Rectangles and Rectangle Ninja.

</comment><comment><USER21> Kudos to the kid for doing this. Certainly better than selling your kidney to buy an iPad2 ([http://tech.fortune.cnn.com/2011/06/02/boy-sells-kidney- to-b...](http://tech.fortune.cnn.com/2011/06/02/boy-sells-kidney-to-buy- ipad/))

On a side note, is that an apple logo I see at the bottom of the tablet? Wonder how apple feels about that? :)

</comment><comment><USER22> "roughly the same thickness as an ipad" - the photo strongly implies otherwise. It looks nearly an inch thick.

Epic build, I would love it if anyone could find the construction details - hackaday would probably like it too :)

<comment><USER15> It really looks thick. I am almost sure it is not close to the size of an iPad.

</comment></comment><comment><USER23> That image has one hell of an alt text.

<comment><USER24> Looks kinda like a localization failure. If you have e.g. Chinese in UTF-8 but mess up the output (or input) somewhere it tends to look something like that.

<comment><USER25> It looks like it's GB18030, HZ or GBK. At least those are the ones that render with no unknown characters. I don't read/speak any Chinese dialects so I've got no idea which two encodings are likely gibberish.

<comment><USER26> GB18030 is a superset of GBK. HZ is generally used on 7-bit only mediums like Usenet.

</comment></comment></comment></comment><comment><USER27> that is offcourse very cool and encouraging. Will anyone guide me to this kind of stuff, like computer hardware assembling and making. and also where can i found these parts from internet

</comment><comment><USER28> I assume it's a pirated copy of Windows at that price.

</comment><comment><USER29> 78 dollar laptop running Windows 7?

Hmm...

<comment><USER30> That was my first thought as well, but what was he supposed to run on it? Unity?

It does look quite bulky though, but that is often the way with DIY things.

</comment></comment><comment><USER31> Love this title!

That's the spirit!

</comment><comment><USER32> How long will it be before we see the following headline?

Apple sues Chinese hacker for counterfeit tablet

</comment><comment><USER33> Cudos to his girlfriend for conditioning him that well.

</comment><comment><USER34> "but the tablet may end up costing Wei hundreds of thousands of dollars, as representatives from Apple have filed a patent infringement lawsuit against his ass.".</comment>


Remembering Steve and His Greatest Advice - <AUTHOR> http://www.founderimpact.com/remembering-steve-jobs-and-his-greatest-advice

<comment><USER2> A good reminder for those who appreciate Steve Jobs' philosophies.

<comment><AUTHOR> Thank you Brian</comment></comment>


Show HN: Bigroom.video – better video social events - <AUTHOR> https://bigroom.video <comment><AUTHOR> Hello Hackernews!

Over the last couple of months I have been working on a new way to have social events over video ([https://bigroom.video](https://bigroom.video)).

As with the rest of the world, my last company transitioned to being completely remote with the rise of covid. We tried to emulate our old lunchroom and bar happy-hour dynamic over Zoom, but found that we could really only have one person speak at a time. With a 20 person Zoom lunch, this turns into each person telling a story one-by-one, people stepping on each others' toes, and a loss of the small dynamic conversations that would normally happen at any social event.

Bigroom has two major features that help bring the dynamism back to socializing.

 _Dynamic channels_ let you break off into a separate conversation with one click. At any social event I've been to, people are always separated into groups of 3-6 and individuals bounce between those groups. Dynamic channels allow this behavior without the rigidity of Zoom breakout rooms.

 _Whispering_ temporarily mutes your audio to everyone except one person. Click-and-hold on someone's video to start whispering, and let go of your mouse to stop. It's possible for two people to have a complete 1-on-1 conversation within a large group of people by whispering to each other.

Bigroom works on desktop Chrome, Firefox, and Safari, with mobile support planned. On the technical side, Bigroom consists of a web client and a websocket server, both written entirely in rust. I used the elm-like yew framework compiled to wasm for the frontend and async-tungstenite for the websocket backend. The entire client app compiles down to <1MB.

All video and audio is transmitted over peer-to-peer WebRTC connections. This puts a natural limit to how many people can be actively using video in a single channel (depending on the computer I find it is between 10 and 20), although I am considering a client-server architecture in the future to make it scale similarly to zoom.

Bigroom is in free open beta and doesn't even require an account to use.

Looking forward to your feedback!

-Kevin

</comment><comment><USER2> I've been using bigroom for a few weeks now to catch up with friends and family. It makes an unbelievable difference when you can have multiple conversations. It's almost like you're at a dinner table! Highly recommend this. Zoom feels like a work meeting, and this feels like a social gathering.</comment>


Clojure Datatypes (coming 1.2 feature) - <AUTHOR> http://clojure.org/datatypes

<comment><AUTHOR> With datatypes and protocols it's now possible to get pretty much on par with the speed of Java classes while staying idiomatic.

For an example of how idiomatic this can look in action, check out [http://github.com/ztellman/penumbra/blob/master/src/penumbra...](http://github.com/ztellman/penumbra/blob/master/src/penumbra/geometry.clj#L90)

This vector math datatype will be as fast a Java class + the cost of an object clone. The upside is that you have a value entity that has the exact same concurrency safe semantics as Clojure's built in datatypes.

This coupled with Rich Hickey's plans for 1.3 (support for returning primitives from fns) means you'll truly be able to write highly idiomatic Clojure code with host performance without jumping through hoops (much less or no type-hinting, no macro inlining, etc).

<comment><USER2> Jeeze I'm out of the loop, had no idea there was talk of allowing functions to return unboxed primitives. Apparently I need to hang out in #clojure again or the like.</comment></comment>


Say Hi to ArangoDB Oasis: A Fully-Managed Multi-Model Database Service - <AUTHOR> https://www.arangodb.com/2019/11/arangodb-oasis-a-fully-managed-multi-model-database-service/ <comment> noah-kun While I'm a big Arango fan, I was hoping the team could create shared clusters for a lot cheaper. Not exactly for my sake, but to help onboard people. For example, get a free DB with a RAM, bandwidth and storage limit, just to try it out. Then of course a $50 price tier for more resources would be great. Right now, the cost of entry is about $150+ USD.

I'm in a situation where I've been trying to, almost for practice, scale my app before release. That means learning Kubernetes and CDNs and more. Because it's a side project in my spare time, I was haemorrhaging money to GCP, in part because of the ArangoDB.

I'm still not very confident in my scaling or sharding skills. I've lost data a few times. A $0, $15 or $50 learner plan would really help me stay on board and evangelize it. Take a look at mLab/MongoDB Atlas: [https://mlab.com/plans/pricing/](https://mlab.com/plans/pricing/) ($0, $15 and $150 plans).

Lastly, getting deployment options on Alibaba, Huwawei and Linode cloud services would be great. Arango has expanded from Europe and if they don't strike the North American popularity they want, they would be fool-hearty to miss Asian markets--and many of their western customers may ben seeking high availability there. Or just brands better trusted than Western countries.

But yeah, hope I can finally get some reliable Kubernetes!

</comment><comment><USER2> While I've found running ArangoDB to be fairly painless, it's always nice to have a managed service, and I haven't had to scale past what comfortable fits on a single computer myself. Having Arango keeping an eye on updates, and managing scaling and backups would certainly make me happy if I had a pile of data a business relied on (I'm just using Arango for storing academic data, and if it was lost it wouldn't be the end of the world, just irritating).

It would be nice if it was easier to see pricing, but the fact I looked for that first probably suggests I'm not the type of person this is aimed at!

<comment><USER3> In academia the cost for running computers and software deployments is usually greatly underestimated (I speak from experience). If you are a for-profit company and compute the full economic costs of running a database deployment including training, devops, alerting, 24/7 maintenance, upgrades, backups and everything you easily come to some $60000 per year.

Managed services can beat this price by a huge margin, although they seem expensive at first glance.

</comment></comment><comment><USER4> Congratulations on the managed ArangoDB release. Have been waiting for this for awhile now, amazing job guys! Firing it up right now.

</comment><comment><USER5> I have really enjoyed using Oasis during the early bird and I am excited to see it officially launch! Well done everyone!

</comment><comment><USER6> Great news, guys! How does this compare to MongoDB Atlas? Can anybody tell me if it is less expensive or more expensive?

<comment><USER7> Ingo from ArangoDB here:

If you need to scale-out, the ArangoDB packages are more affordable then MongoDB Atlas, as you don't need to spin-up a whole 3 node replica-set to add another shard to your cluster. The smaller instances are cheaper in Atlas, here you benefit from the established cloud service, which can negotiate better conditions with the large cloud providers. However, we will pass on lower cloud costs to customers, so there is hope that we will move closer over time. But, I don't see ArangoDB in direct competition with smaller, pure document-use cases. Most users need the multi-model capabilities and use graphs in combination with document operations.

</comment></comment><comment><USER8> This is really exciting. All I'd like now is Prisma integration, and pricing info : )

<comment><USER9> Thanks :) Jan from ArangoDB here

You can see the exact pricing for the deployment configuration you desire within Oasis when you create a deployment. In general, the actual price for your deployment depends on the cloud provider, amount of main memory & storage you selected. The pricing is usage based, so if you only need a deployment for one hour, you only pay for that hour. Hope this helps a bit at least.</comment></comment>


Inspired by Iron Man, Zazu Makes Mobile App for More Intelligent Wake-Up Calls - <AUTHOR> http://www.xconomy.com/boston/2010/05/18/inspired-by-iron-man-zazu-makes-mobile-app-for-more-intelligent-wake-up-calls/

<comment><USER2> See also the DPAC: <http://egaertner.com/dpac/>

"This will check your Google Calendar, schedule an alarm for the next event while factoring in driving distance, traffic, and weather conditions. It's got an audio system for radio and iPod operation, but also includes some home automation options. Using the X10 communication protocol it can turn on lights, start the coffee maker, and open the blinds as part of a gentle wake- up cycle. All of this is configurable through the clock itself, or via the web interface." (via Hackaday)

Should be pretty easy to port to a Chumby.

For other JARVIS implementations see: <http://projectjarvis.com/> and Stephanie <http://absolutemaximumratings.com/projects_stephanie.php>

<comment><USER3> He's actually a Northeastern alum whom I spoke with just a few weeks back! Great minds think alike and come out of NU! (disclaimer im one of the co- founders of Zazu)

</comment></comment><comment><USER4> Nice to see some competition <http://sleep.fm> . Though your marketing copy/value proposition seems very familiar :)

good luck

<comment><USER5> I tried sleep.fm once. The big problem for me is that the two voice options are either "overly dramatic American-accented movie trailer man" or "extremely bored-sounding American-accented woman", neither of whom I can deal with at six o'clock in the morning.

I'd pay good money for something a little less annoying and a little more customizable. Greet me by name, tell me what today is, what the weather is, how many new emails I have, remind me of anything I told it to remind me, and then launch into playing a song I like. It'd work better as a desktop app than a web app.

<comment><USER4> Thanks for the feedback Hugh! What voice or type of voice would better suit you?

<comment><USER6> Sexy female robot voice. Like in the movies. No, I am not joking.

<comment><USER7> Majel Barrett, please.

<comment><USER4> Thanks for the input & suggestions :).

I see Majel unfortunately passed in 2008. Here's a vid of here [http://www.youtube.com/watch?v=USH7LaXXQ7k&feature=relat...](http://www.youtube.com/watch?v=USH7LaXXQ7k&feature=related) and I learned she was the creator of Star Trek's wife. Interesting.

</comment></comment></comment></comment></comment></comment><comment><USER8> I was gonna say, isn't that the name of the royal major domo from _The Lion King_? But then I read the article and... I see what ur doin there.

</comment><comment><USER9> Using PySpeech (<http://code.google.com/p/pyspeech/>), I put together something in a couple hours last night that will listen for its name (currently "Jarvis") at the beginning or end of a sentence and offer the rest of the sentence to whichever "app" matches it most highly. Right now the "apps" are echo (I say "Jarvis, echo "a big blue house" and my computer says "a big blue house"), a 'manners' app (I say "Thanks, Jarvis" and it says "You're welcome, sir."; it also gives me time of day-appropriate greetings) and a weather app (intelligent responses to "Jarvis, weather" or "Forecast for Friday, Jarvis"). It just runs with my headset mic right now, but once I move in a few months I'll start looking for some better hardware. Alarm and appointment apps are next.

Anyway, the point is that this is really easy to build yourself - most of the hard problems have been solved (I was really surprised how well Win7 speech recognition works), and you just have to write the glue.

</comment><comment><AUTHOR> (I'm Zazu's geek)

Gimme an email if you're interested in beta testing: marc [at] getzazu [.] com

<comment><USER10> Very sweet idea, and something I've been wanting for ages. No android here though so I guess I'll wait for the iPhone/iPad version? Good luck!!

</comment></comment><comment><USER11> Hehe, I was there when these guys were at boston.startupweekend. They should have won!

</comment><comment><USER12> wow. i've been building something similar for myself for about a week now. the x10 integration is a nice touch-i'll have to incorporate that into mine as well.

</comment><comment><USER13> Great idea. I'd much prefer this to an alarm clock!

</comment><comment><USER3> lots of requests for Beta sign-ups, <http://bit.ly/8YUiv9>

</comment><comment><USER14> She couldn't put in the two hours to watch the movie?

<comment><USER5> To write a 300-word article about an alarm clock app?</comment></comment>


Scientist figure out how the Earth looked like a billion years ago - <AUTHOR> http://qz.com/577842/scientists-have-used-groundbreaking-technology-to-figure-out-how-the-earth-looked-a-billion-years-ago/ <comment><USER2> interesting, but already posted a few hours earlier:

[https://news.ycombinator.com/item?id=10817481](https://news.ycombinator.com/item?id=10817481)</comment>


GDPR Feels Useless - <AUTHOR> https://email@example.com/gdpr-feels-useless-b4bb70e89dd6 <comment><USER2> Don't read this. There's so much misunderstanding in this article, I'd be surprised if any good discussion came from it. And refuting it would take ages.

For example:

> And apparently typing your name, age and other information is not consent. > How is this supposed to work by the way? I give you my name but I don't > consent to you using it or remember it?

The way it's phrased is misleading. If you _need_ the data and are going to use it in the obvious way, e.g. for shipping a parcel to my address, legitimate interests works fine. If you're a scumbag marketer or data broker/reseller (etc), then yeah, it's going to impact you. That was the idea.

So instead of bikeshedding arbitrary scenarios, let's do something more productive with our day.

<comment><USER3> The better response to "typing is consent" is that, okay, you gave our address, now we're creating adverts with your house, making it look like you're selling it, soliciting offers in your name, and so on. Even though you just ordered a bumper sticker from us.

So, consent is given for a purpose, and you can't really do that with just an input box. Hence the fancy opt-in modal dialog wizard thingies, and the checkboxes at registration/payment time, and so on.

</comment></comment><comment><USER4> This is just a weird article.

> But do you know what data I have access to when you come on my website ? > Well only your IP and some information about your computer and browser. > That's all.

It's pretty well known by now that that's often more than enough to identify a specific user. "That's all" really undersells it.

> It's true I can create an ID and save it on your browser (I can do much more > but we will stay focus). Your browser, not your computer.

That's effectively the same thing -- the vast _vast_ majority of users don't use more than one browser per device, and I'd be willing to be that the few who do use more than one mostly use them for different websites.

> So the very first thing you need to understand about data privacy is that > YOU protect your own data by not giving it away without thinking.

And here it is. This article is basically just victim blaming. "You didn't want this website to identify you based on the unique combination of user agent, viewport, and feature detection? Then you shouldn't have visited this website with that user agent, screen size, and set of features enabled in your browser."

<comment><USER5> I'd ask similarly, when you enter the public sphere, does that give me the right to collect DNA samples you've "voluntarily" dropped on the floor, like in police shows? You abandon your privacy when you voluntarily expose yourself to the public, right?

I think the public is divided on the issue and have no consensus nor common language for matters of privacy.

</comment></comment><comment><USER6> I don't view GDPR to be quite as useless as the author does, but the point about the user having to protect their data themselves is spot on. GDPR only protects you against good actors that are under EU jurisdiction. Everyone else could very well be doing whatever they want with the data you leak. The EU can't fine a Chinese company if the Chinese company has no presence in the EU.

Another thing the author doesn't mention is that GDPR sets a minimum amount of cost/effort to run a website that's way beyond the actual hardware cost and the cost of making the website itself. It requires every website operator to be familiar with how GDPR works, because you need to know whether you're collecting personal data (you probably are) and how you need to handle it. Furthermore, if you are collecting personal data then you must respond to emails of users who request to know what data you know about them within a set amount of time. In the case of a small website, such as a forum or blog, I would consider the cost imposed by GDPR to be greater than the cost of making the website itself and renting hardware to run it. I think it disproportionately impacts smaller sites. It essentially leads to small sites simply breaking the law and hoping that nobody complains about them.

<comment><USER3> First of all, GDPR does not apply to personal sites. ( [https://law.stackexchange.com/a/28086](https://law.stackexchange.com/a/28086) \- see current "in force" version of the directive: [https://eur- lex.europa.eu/eli/reg/2016/679/oj](https://eur- lex.europa.eu/eli/reg/2016/679/oj) see recital 18)

> [...] GDPR sets a minimum amount of cost/effort to run a website [...]

This is simply false. If you want to post something on the 'net, nothing changes. You want to count page downloads? (You know those old school CGI counters.) Nothing changes. You want to know how many individual visits you got? Well, you need to try to distinguish between new and returning visitors, hence you might put a cookie on the visitor's browser/client/useragent, now you need to ask nicely, because it's eerily easy to use that cookie for a lot of other purposes. (Similarly if you would try to use something else, like IP address, and/or browser fingerprinting.)

And so on. Yes, I like pretty graphs about visitors (browser screen size distribution, fancy geoip charts, etc), but so do the people that live off the not so innocent usage of this kind of data.

And yes, if you collect personal data, then you should be able to protect it. This was always the case, GDPR simply states this and tries to create a mechanism that forces data holders to act accordingly (via the mandatory data breach reporting). Again, similarly, if you handle a lot of data you should be able to accurately take a stock of what kind of data you have about whom, hence the requirement to respond to these inquiries.

> I think it disproportionately impacts smaller sites.

Agreed. But small sites were always at the mercy of random script kiddies. They always lacked resources to properly handle updates/upgrades, security, data, end-of-life termination, etc.

GDPR at least makes WordPress, discourse, and random blog and forum engines able to deal with the reality of how much value their databases represent nowadays.

<comment><USER7> I'd say that medium sized sites are more troublesome in that regard. Once a site has grown big enough to become cumbersome for one person to manage, but not large enough for most to justify staff, then you have an issue. There shouldn't be any excuse for a small site to fall behind with updates, etc... It's simple.

<comment><USER3> Absolutely. This is the typical problem of small-medium sized shops everywhere around the world. If you're just a really small one-man army, big companies don't really care. If you are getting bigger, suddenly you will find competition and a lot of regulatory burden. (Most startups usually fail at this point as far as I know.)

</comment></comment></comment></comment><comment><USER8> GDPR is a fundamental step towards controls of data as a basic human right. It does not define clicking on banners or cookie disclaimers. He's mad that the world hasn't already matured their adherence and that's reasonable but don't throw the baby out with the bathwater.

GDPR is a great step towards empowering consumers. Give the industry and regulators more than 1 year to change it's behaviors and set new standards.

</comment><comment><USER9> All I see is a lot of websites with a cookie notice that I agree to.

<comment><USER3> maybe ... just a thought .. but, don't agree to them?

it should be just as easy to agree as to decline. if not, then they are likely not adhering to the regulation, and eventually someone will/could alert them or whatever authority.

<comment><USER9> Do you mean that if I declined I should still be able to see the content?

<comment><USER3> Yes.

And the whole practice of huge scary obtrusive modal-like dialogs (that tint the background so you can't even read it normally) are the cheap tricks used by sites to incentivize you to consent to tracking. So, it's almost certain that those are not compliant. They replace the fundamental function and purpose of the site with a fake choice.

</comment></comment></comment></comment><comment><USER10> Interesting perspective and I can see some of the intent here, but it takes an odd slant to the issue. There are a few failures in logic here (random number becoming PII, only tracking on one browser, laws protecting you from getting robbed) that detract from the goal of GDPR which is to outline the user's digital rights, not define how data can be collected. GDPR does not define the technological methods because those will always be evolving, much like our understanding and expectations of data privacy will evolve. I agree that users need to educate themselves on how to protect their own data, but there is a ton of technology that they either aren't aware is being used, or simply don't understand. GDPR isn't perfect but it will help in the long run. Here is a summary of some of the details and how it will impact what developers need do as they architect software. Some companies will take it seriously, others won't. Then consumers may decide who to do business with. [https://fusionauth.io/blog/2019/01/29/white-paper- developers...](https://fusionauth.io/blog/2019/01/29/white-paper-developers- guide-gdpr)

</comment><comment><USER11> Here's an issue we ran into when implementing GDPR: marketing software keeps a database of people who have opted out, so even if that email address shows up again, we don't risk spamming them. But if they opt out now, under GDPR we have to delete them completely, even from the opt-out list. So we can't remember not to email or track you.

The author also points out the double set of cookies, which is how most sites deal with tracking. One set of cookies that do not collect PII, that just tell the other set of cookies to turn on or off.

I respect that the writers of GDPR did not confer with the industry insiders beforehand. However, with how poorly some of it understands the technology (implementation of cookies is a great example), I wish they would have had a bit more understanding and drafted a better bill.

<comment><USER12> Uh? Couldn't a hash be used for that?

<comment><USER11> According to our council, even encrypted or hashed data was still counted as PII as those are security measures, not privacy measures.

<comment><USER13> I mean, trust your council over some random guy on the internet (me), but I would seek a second opinion on this from a technilogically savvy lawyer.

There are absolutely implementations available that will allow you to have a hash, not tied to other data, sitting in your opt-out list that you than check other hashes against. No PII in the mix.

<comment><USER14> If I got the hash database I could absolutely test whether specific people were in it, and I could probably reverse a large number of them with dictionary based attacks.

There are no completely robust options where you can claim that this data cannot compromise personal privacy, so I guess from a legal perspective it doesn't stop it being PII.

</comment></comment></comment></comment></comment><comment><USER15> A law is only as effective as it is enforced

</comment><comment><USER16> >This is so broad and vague that basically if I generate a random number to identify you on my website it becomes your personal data.

That's cool. If something can identify me uniquely then it's personal data.

<comment><USER17> Totally agree! Especially, if you keep the link between the number and user, which is very often the case. But even without that direct link one would have to demonstrate a certain level of k-anonymity. Maybe GDPR wasn't detailed enough to describe k-anonymity</comment></comment>


U.S. government worse than all major industries on cyber security - <AUTHOR> http://www.reuters.com/article/us-usa-cybersecurity-rankings-idUSKCN0XB27K <comment><USER2> Schools are pretty bad, too, who are strongly enforced by federal security policies.

Recently I had an fMRI done as part of a research program at North Western and had to sign a bunch of paperwork where it was said that my data would be secured with a best effort.

Well, fast forward to last night where I was curious if their psych department had any webservers exposed to the internet, which it shouldn't. I found sip servers, printers with admin rights, routers, personal computers, etc etc etc. HIPAA hell. And that was only on three subnets and only 80/443.

I sent their heads of technology an email to see if they could look into it, since I'd prefer that my data not be stolen by anyone who knows how to run wget. They closed the ticket with this:

 _bpchaps, I believe you do have good intentions. That being said, we are already performing regular scans of our systems. If you do stumble upon anything significant, please do contact us again._

:(

<comment><USER3> UMD has a great class where their cyber security students do pentesting on the school network for credit, simultaneously securing the network and providing a great education.

[http://www.cyber.umd.edu/sites/default/files/documents/sympo...](http://www.cyber.umd.edu/sites/default/files/documents/symposium/SecureMD_MC2Symposium_2013.pdf)

Nothing to get a network admin to close a hole like an annoying undergrad stopping by your office every day, trying to get his extra credit before the semester is over.

<comment><USER4> I'm a UMD student, and I had no idea this existed!

I've been hesitant about reporting holes/vulnerabilities in the school's infrastructure until now, but it's reassuring to see that there are official channels for doing so.

</comment></comment></comment><comment><USER5> This will make you laugh..

The President just formed a commission to make Americans safe in cyberspace [1]

His Press Secretary says "Issues related to encryption will not be considered by the commission" [2]

[1] [https://www.whitehouse.gov/blog/2016/04/13/announcing- presid...](https://www.whitehouse.gov/blog/2016/04/13/announcing-presidents- commission-enhancing-national-cybersecurity)

[2] [https://youtu.be/FCx2uJWfyao?t=1h4m20s](https://youtu.be/FCx2uJWfyao?t=1h4m20s)

<comment><USER6> I'm not really sure what the problem is with that. I feel like the broader infosec situation is bad enough that having them debate encryption would be like arguing over what lock to put on your cardboard door.

<comment><USER5> The commission is going to have to talk about encryption if they're to address information security. It might not be the same debate as the iPhone case, but encryption is central to cybersecurity. So, to say they won't talk about encryption is a non sequitur.

</comment></comment></comment><comment><USER7> I think part of this stems from the nuttiness that is government contracting and the massive organizational sprawl inherent in our current governmental structure.

Looking at some of the details it seems some agencies are somewhat better than others, it would be interesting to see the whole report and see which agencies do better and which really suck (NASA seems to have done quite poorly).

Given that the security needs for the EPA may quite different than those for the DoD, not to mention countless other agencies, it's easy to understand how standards and enforcement could quickly fragment. A lot of these agencies will hire contractors to do the work, they'll hire different contractors, who are themselves drawn from a limited pool of authorized contractors and soon enough you have Healthcare.gov version 1 again.

Additionally, if FB or Google have a breach, there's a clear line of responsibility that ends up at the CEO. While in theory that's true in government, in practice you have both the executive branch and congress that muck about in the operations of an agency, so although you may get security person X to resign, it's far less easy to get at the people who are actually responsible (Which congressperson? How do you vote them out of a gerrymandered district? Should the president fire his cabinet secretary? How does he get a new one past congress)

<comment><USER8> Probably procurement processes weed out all but the most patient of candidates, along with their pay schedule. But their process can take months before final approval, so by then the candidate is gone.

They need to streamline the hiring process and offer competitive pay.

<comment><USER7> It's not just about patience, there are a lot of guidelines and hurdles to jump through to be eligible for certain contracts. Some of this is for good reason, there have been plenty of cases of contractors bilking the government out of millions with little or no accountability. But it makes the process too complicated for real competition to occur, so perversely although the government turns to the private sector for more competitive prices and cutting edge solutions, it ends up with inferior products.

Also, it's not as though the contractors themselves offer poor compensation. A lot of them actually offer at least market rate, and in some cases higher pay. It's not so easy to figure out how much something is going to cost over the lifetime of a contract. This, combined with the general opacity and bureaucratic hurdles of government contracting makes it so makes it so the government doesn't get the best deal over the lifetime of the contract despite picking what may look to be a good idea at the onset. Of course this is all ignoring political considerations and lobbying issues.

The US Government is the largest corporation in the world, I think the US Defense Department is alone the largest corporation in the world. And none of it is subject to the free market (in many ways for good reason). It's very difficult to do things efficiently at that scale, and its even harder to do it with external political influences of all sorts.

</comment></comment></comment><comment><USER9> "President Barack Obama has made improving cyber defenses a top priority of his remaining year in office."

What happened to the first 7 years?

<comment><USER10> Preventing the collapse of the world economy? Killing Bin Laden? Auto industry bailouts?

<comment><USER11> I don't think the OP was suggesting that Obama has done nothing, but rather the opposite. Obama has definitely talked about the importance of cyber security in the past so it's a bit weird to say that it's a focus just this year.

<comment><USER12> Something can be important but not a priority.

</comment></comment></comment></comment><comment><USER13> In typical US government fashion, the answer to this is to make all major industries worse at cyber security.

</comment><comment><USER14> If anyone wants to help fix the problem, I suggest the newly formed USDS. There are a lot of ex-Google people involved trying to help clean up and secure IT infrastructure in the Government. I spoke with someone who did a short stint with them and it sounds like they're actually being empowered to fix things. [https://www.whitehouse.gov/digital/united-states-digital- ser...](https://www.whitehouse.gov/digital/united-states-digital- service/story)

Mike Dickerson gave a really good in-depth talk at Google about his work cleaning up the healthcare.gov project. The Time article lacks many of the technical details but is still pretty good. Sorry, all I can find is a link to the PDF. [https://blog.newrelic.com/wp- content/uploads/80893.pdf](https://blog.newrelic.com/wp- content/uploads/80893.pdf)

From talking to people who've worked in the USDS, the problem doesn't appear to be lack of capable people, or lack of funds. The problem seems to be in the structure of how projects are bid and executed. The bad news is the problem is universal. The good news it's fixable ... it's just going to take a lot of work by a lot of smart and determined people.

Sign up and go fix it.

</comment><comment><USER15> This is one of the pragmatic/apolitical reasons the USG (or any other government) should not key escrow or hold encryption backdoor master keys.

</comment><comment><USER16> Does anybody know what factors SecurityScorecard considers? The link is just a press release for the real information.

</comment><comment><USER17> As a exemplary symptom of the toxic IT culture in many aspects of government and defence, the US Navy paid $9M for continued support of Windows XP last year [0]. They definitely aren't the only government agency which is doing this and it's indicative of systemic problems in business support and procurement.

[0] [http://money.cnn.com/2015/06/26/technology/microsoft- windows...](http://money.cnn.com/2015/06/26/technology/microsoft-windows-xp- navy-contract/)

<comment><USER16> Why? It's one of the largest organizations on the planet, spending millions on something or other doesn't indicate anything.

<comment><USER17> Spending millions on support for an operating system which is well out of life is indicative of poor IT procurement and lifespan management. Business interruption was a valid excuse about 5 years ago, to continue to argue that is a farce.

</comment></comment></comment><comment><USER18> Information services, construction, food and technology were the top performing industries in this test.

Info services and Technology seem like common sense answers, and maybe food includes fast food which has to defend against the underground's hunger for credit cards, but why does construction earn a top place?

Anyone have a theory?

<comment><USER3> Construction and food are run by good old boys, who aren't going to waste a bunch of money going to IBM for their tech, when they can go to the local company which charges half as much. In so doing, they accidentally hired better tech, because the big companies are bureaucratic nightmares.

The tech companies self-service.

</comment></comment><comment><USER19> Compliance does not equal security.

</comment><comment><USER20> I mean, it tok then a while to get the ObamaCare fiasco fixed ..... shows their competence

</comment><comment><USER21> This is their best effort at making government transparent!

</comment><comment><USER22> This is unsurprising. From what I gathered from @da_667 (former NSA TAO), the pay was terrible. Why work for the government when you can get a job making 2-3 times as much with the same responsibilities?

<comment><USER23> The pay is terrible because it's set by Congress. Agencies don't have the liberty to set pay.

<comment><USER24> Perhaps it's not their _fault_ but it doesn't make it any better for a prospective job hunter. Perhaps competitive salaries need to be part of this push

</comment></comment></comment><comment><USER25> You'd have to have your head examined for willingly working in government IT. The dysfunction is legendary, the pay is abismal and there are no free massages or vending machines. If you had the skills to secure computer systems why would you work for the government? What possible reason?

<comment><USER26> I been associated with (Australian) Government projects and whilst I don't know much about what their own staff got paid, I can tell you not one person there had ever still been in the office by 5:01pm. Managers didn't even have mobile phone numbers of their staff even if they wanted to contact them after hours. People were told not to come to work for things like "multicultural awareness day" and a dozen other special days that never considered a holiday at any business group.

Several of them lamented that every department had "slackers" who'd probably be fired from any real business, but basically couldn't get sacked if they tried due to Government policies.

It's not my thing, but there are reasons people choose these places.

<comment><USER27> >Several of them lamented that every department had "slackers" who'd probably be fired from any real business, but basically couldn't get sacked if they tried due to Government policies.

Seems like the end result would be a really nasty dead sea effect.

</comment></comment></comment><comment><USER28> Time to just outsource USG data and services to Zuckerberg.

He's possibly handling more data, providing more services and doing it with what...10K engineers?

We are just going to see more and more Sony type hacks, Manning/Snowden type events. Just look at what happened with Bangladesh's Central Bank and Philippines voter records.

Going forward I just don't see Govt IT coping on their own. Things are just moving too fast and they have my sympathies.</comment>


Google to developers: We take down your extension because we can - <AUTHOR> https://palant.de/2018/07/03/google-to-developers-we-take-down-your-extension-because-we-can <comment><USER3> In another thread[1] on HN today there was discussion over developers selling out their web extensions to marketing corporations which end up filling them with tracking scripts and malware. Someone suggested that google should be much more aggressive at filtering out said extensions, and one of the responses was a sarcastic comment over a future article about Google attacking extension developers and the free web.

And less than 24 hours later, here we are.

[1] [https://news.ycombinator.com/item?id=17447816](https://news.ycombinator.com/item?id=17447816)

<comment><USER4> The problem isn't that an extension was removed. There will always be erroneous attempts at making things safer for users when playing the game of content moderator. The problem is that Google is impossible to talk to, and makes no effort to help when things go wrong. As a current user of gmail this worries me.

<comment><USER5> This petrifies me. Google provides an incredibly easy way for me to capture all data that I care about. Getting photos and videos of my kids growing up and keeping them for years is trivial with Google.

And in one little error it can all disappear with no recourse.

I continue to struggle today to find a silver bullet solution for someone like me who just wants to hurl money somewhere and say, "use this money to guarantee that my cherished photos and videos will be here in 30 years"

Second to that is getting locked out of my Gmail. I'd consider that more irritating than losing my wallet.

<comment><USER6> > find a silver bullet solution

switch to apple

<comment><USER7> Yeah, sure, with the stories of Apple deleting songs from your _local machine_ because they were deleted from your cloud account because DRM or whatever, and IIRC even deleting some random photos because some bug (but w.r.t. photos I'm not sure if I recall this correctly, or just spreading FUD here.) Or was this Amazon with Kindle and with ebooks? Apple was sure reported as deleting high quality mp3s from your disk because they have mp3s of the same songs in poorer quality as their deduplication reference files on their cloud.

</comment></comment></comment></comment></comment><comment><USER8> Same thing happened to me [1], with a slightly different rationale for pulling the extension.

This happened despite tens of thousands of users, years of good reviews, and an extension so useful that Google's own accessibility team demos it at conferences.

I was only able to get the situation sorted because I know people who work at Google on the Chrome team. Even with all this, it took weeks to get the previous version restored, and after that weeks more before we could push an update without having it get automatically rejected.

The only "good" news is they didn't uninstall our existing user base.

1: [https://medium.com/@BeeLineReader/google-yanked-my-chrome- ex...](https://medium.com/@BeeLineReader/google-yanked-my-chrome-extension- this-sunday-d9c481e285cb)

<comment><USER9> Hey, it's off topic, but I just learned about your product and sent a link of the product page (beelinereader.com/individual) to my colleagues - only to find out that my email was filtered as a spam by FortiMail! Apparently, the offending text was that URL. Maybe it's somehow related? Was this product site previously infested by malware or something?

<comment><USER8> Wow, thanks for letting me know. We have never had any malware, though our inline install of Chrome/Firefox extensions has been flagged by Avast at times (despite our attempts to get whitelisted). Neither our website nor our tools have ever done anything even vaguely shady — we don't gather user-level browsing data or anything else like that, so it's a big bummer when we get flagged like this.

Do you know if there's a way that your company can report this as an inappropriate block to FortiMail? I will try to reach out to them also, but my guess is they'll be more receptive to a customer request than to one of their blacklisted websites!

BTW, we're not publicizing this, but right now we're testing out a "BeeLine Advocate" program. Basically, if you install the extension and complete the free trial (2 wks), you'll be invited to get free access to our Pro tier in exchange for filling out periodic surveys.

We've just opened up this program, and it'll probably be open to new users for 3 weeks or so. Thought I'd share with the community here, since HNers are great for feedback (as you've just shown with your comment!).

<comment><USER9> > Do you know if there's a way that your company can report this as an > inappropriate block to FortiMail?

Our corporate email is outsourced to another company, where they apparently use FortiMail as a packaged solution. So I don't think it's very likely that they'll listen to me - but I'll try anyway. Good luck with the new campaign!

</comment></comment></comment></comment><comment><USER10> They somehow have the man power to ban your extension in 2 hours and 30 minutes without an explanation as to why, but than when I get a fake copyright claim on my most popular YouTube video somehow it takes three months, 12 emails and I still don't get the ~$900 lost revenue back.

<comment><USER11> They optimize for their own profit, not yours. ;)

<comment><USER12> Cannot upvote this enough. People complaining about such things think that "customer is always right" where reality is "customer is always right if he pays enough for us to care". Have some reality check.

Every company does what is in their best interest not particular customer.

</comment></comment></comment><comment><USER13> They took down my bookmarking extension with no notice, replied none of my e-mails. Although @GoogleChrome gives support on Twitter, they completely ignored my and also some user tweets. We had good description, many screenshots and a screencast, our extension is even open source ([https://github.com/kozmos/browser- extensions](https://github.com/kozmos/browser-extensions)).

I don't even know the reason why they took it down.

I just had to re-publish my extension: [https://chrome.google.com/webstore/detail/daababmdfacmmkokdf...](https://chrome.google.com/webstore/detail/daababmdfacmmkokdfikciemmddhpche/publish- accepted?authuser=0&hl=en)

Tweets from users: [https://twitter.com/JesMullins/status/1014085292133888002](https://twitter.com/JesMullins/status/1014085292133888002)

Tweets I sent; [https://twitter.com/getkozmos/status/1013511183519879168](https://twitter.com/getkozmos/status/1013511183519879168)

<comment><USER14> Google is terrible at support. I had to wait 2 months to get my oAuth application reviewed. I had to write an email in all capitals to get their attention.

</comment></comment><comment><USER15> Back when Facebook didn't support linked hashtags I made an extension that removed them from posts on facebook.com (they just annoyed me). It still worked perfectly even after Facebook added native support.

It was active for many years with great reviews and a few hundred users.

Google pulled it early this year because Facebook asked them to... They claimed it violated copyright. There was no option to appeal.

Not trying to make a point here. Just offering another anecdote.

<comment> pure-awesome Nice. If I had known about this extension I might have used it.

When people started hashtagging on FB, I thought it was the stupidest thing. Then, when FB made it a feature, I just had to shrug and go "I guess the hashtaggers are the ones in the right, now..."

</comment></comment><comment><USER16> Happened to my own extension this week too ( [https://habitlab.stanford.edu](https://habitlab.stanford.edu) ), except without warning - especially frustrating since I've been developing it for nearly 2 years and Chrome no longer allows users to easily install anything from sources other than their Chrome store. May end up having to port it to Firefox, except there's so much inconsistencies in CSS and webextensions between the browsers it would take a month or more. It's quite frustrating how these walled gardens can easily destroy years of work at someone's whim.

</comment><comment><USER17> Meanwhile there's an extension on there with our company name and logo (both trademarked) that might be stealing peoples data and Google have done nothing about it after _many_ submissions of their trademark infringement form.

<comment><USER18> Thank goodness that Google is not a court of law and you can engage the legal system for restitution. I mean, wouldn't you want to go that route anyway given the potential damage to your brand by a third-party abusing your trademark? Would pulling the extension undo all the harm the infringement caused you?

<comment><USER19> Given that these copycat extensions usually aren't giving you a way to find their creator - good luck with the legal system. And even if you can find them, what will you do about them if they are located somewhere in China? The legal route is only good enough to force Google into removing infringing extensions. For you, it means more effort and money wasted. And these malicious extensions get more time to catch unsuspecting users. Of course, after being taken down they will immediately resubmit their extension and you start from scratch. All while Google has a way to report such cases but won't act on the reports.

</comment></comment></comment><comment><USER20> I'd guess that the warning period was set to 168 minutes (2hrs 48 minutes) instead of 168 hours (7 days).

</comment><comment><USER21> Isn't that extension going straight against Google's ability to track what users are clicking on, i.e. against their core business? Maybe the warning wording is cumbersome or opaque, but what would the author expect? Company not protecting their turf? The only surprising thing is that they did it in this unimaginative hidden fashion, not fitting their friendly progressive image.

<comment><USER22> The surprising thing is that they let the extension exist for so long.

Google makes most of their money from ads. If you interfere with that then of course you'll be in trouble.

<comment><USER23> Then why are there still ad blocking extensions? Wouldn't uBlock Origin interfere way more than this extension?

<comment><USER21> Maybe it's the next hidden step and this one was just testing the waters for the level of public outcry?

</comment></comment></comment></comment><comment><USER24> It's interesting to observe current landscape of app delivery, previously it was just binaries or sources on developer's site now it's shifting to centralized model in the name of protecting users from malicious actors. I wonder if there is a way to have a cookie (developers don't need to worry about random behavior of your centralized owner) and eat it too (fight malware).

<comment><USER25> In this case the centralized owner is the Chrome Web Store; you're leasing space in their list of offerings at their terms, for better or worse. It's worth noting that the Chrome Web Store is just an easy (and highly visible, of course) way of installing extensions but not the only one; developer mode and self-installing is totally possible (though admittedly higher friction).

Protecting users from malicious actors serves in the best interests of the Chrome Web Store, certainly, but there's nothing stopping users from running their own security software.

In a more ideal world a developer would distribute an extension from their own platform and the user would run a security check against it (and all future versions). Until we get to that world, though, a store that is focused on integrity of security and expresses its right to remove things that don't fit it's model is convenient.

<comment><USER26> Self installation is disabled on Windows. And Developer Mode pops up constant nag warnings, to users asking if they want to disable the plugin.

</comment></comment></comment><comment><USER27> Im a bit confused:

\- [https://chrome.google.com/webstore/detail/google-search- link...](https://chrome.google.com/webstore/detail/google-search-link- fix/cekfddagaicikmgoheekchngpadahmlf) is still in the store

\- it IS missing the picture

<comment><USER19> Oh, that's nice - it was restored without giving me any kind of notification. Developer Dashboard says that the screenshot is there, not sure why it doesn't show.

 _Edit_ : Got a mail now, supposedly the issue here was an internal miscommunication resulting in a rejection. So all is good again and all I have to do is resubmit that screenshot.

</comment></comment><comment><USER28> I've never really been a fan of the whole "browser extensions" thing, with perhaps the exception of UI mods, and things like this only serve to reinforce that notion. I prefer to use a MITM filtering proxy, which works in all browsers and is independent of, so isn't beholden to, the authoritarian institutions which control them. Incidentally I also have a filter which does the same thing as his extension, and I probably added it the same day Google decided to mess with those links.

<comment><USER29> Good luck with that once hsts, cert pinning, and TLS 1.3 become more common.

<comment><USER30> MiTM proxying TLS 1.3 connections works just fine.

Browsers ignore cert pinning when the CA certificate was manually installed, so this is not a problem either.

I have no idea what HSTS is doing on your list.

<comment><USER29> > I have no idea what HSTS is doing on your list.

[https://moxie.org/software/sslstrip/](https://moxie.org/software/sslstrip/)

<comment><USER30> We're talking about voluntarily installed proxy. Why would anyone want to mount an HTTPS stripping attack against themselves?

</comment></comment></comment></comment></comment><comment><USER31> I almost lost a Google account because the Amdroid App I uploaded was I violation of their Terms. I had to work a few emails/calls with Google to demonstrate it wasn't a violation, but it was a very close call.

</comment><comment><USER32> Someone should set up a website listing plugins banned by Google for reasons that fall in a gray area or for reasons that are just outright indefensible. Banning extensions in this manner is a signal of value to the end user. Could also list extensions available on Firefox but not Chrome.

Something similar to hiddenfromgoogle.com but for extensions (doesn't appear to work anymore) [1]

[1] [https://www.bbc.com/news/technology-28311217](https://www.bbc.com/news/technology-28311217)

<comment><USER33> also create third party store focused on foss. Somwthing like fdroid

</comment></comment><comment><USER34> I've had similar stories, accounts banned, extensions denied because they didn't understand what it did, one was denied because it had minified code, the review process could use more work.

<comment><USER35> It's a tough situation, because the amount of access that these extensions have to users' actions can be extreme. Malware is a much greater concern than, say, the AppStore, as access to sensitive information is far less controlled.

<comment><USER36> Agreed. Until extensions as itself get some guidelines - it needs to be inspected closely.

</comment></comment></comment><comment><USER37> I had similar problems with an extension that I am developing. They threatened to take it down because it didn't have a privacy policy attached, although their developer guidelines state that you only need a privacy policy if you collect personal or sensitive user data, which I am not. It took me several resubmissions (each time I was scared I would be banned from all google products), before they finally approved my extension. The clincher was that my extension was marked as unlisted the whole time; it wasn't even open to the public.

</comment><comment><USER38> another StallmanWasRight moment?

<comment><USER39> Yes. And because of that I cannot empathise with this developer.

It's not longer a case of "don't put your time into a closed ecosystem, for your own sake", but "you have the moral duty not to contribute to a closed ecosystem, for everyone's sake".

The developer was doing something imoral and something bad happened to him. It's karma, Kramer.

</comment></comment><comment><USER40> A similar situation happened to the ublock origin maintainer: [https://twitter.com/gorhill/status/997206089132400641?s=09](https://twitter.com/gorhill/status/997206089132400641?s=09) [https://twitter.com/gorhill/status/997162260199075840?s=09](https://twitter.com/gorhill/status/997162260199075840?s=09)

</comment><comment><USER41> Side rant: I have an extension which has been published for about 6 years now. They've broken the extension several times due to removing or changing the APIs. I have a couple of bad reviews due to having to remove features from the app because they removed functionality or APIs. The past couple of years things have been more stable, but still, it's been painful.

</comment><comment><USER42> My google apps account is being shut down the same way. Apparently using it everyday doesn't constitute activity for 365 days...

</comment><comment><USER43> A fun related issue with the Chrome Web Store is that you can submit random gibberish to their DMCA takedown form and they'll pull an extension down anyway. Then they take upwards of 4 weeks to process counter-notices and refuse to fulfill their obligation to provide the identity of the reporter so you can sue them.

</comment><comment><USER44> I had an extension, NoBing which redirected Bing searches to Google. Removed due to copyright so I rebranded it as "Bongle" removed again due to copyright despite no mention of Bing. Gave up.

</comment><comment><USER45> > I guess, Mountain View must be moving at extreme speeds, which is why time > goes by way faster over there — relativity theory in action.

The other way around. The OP must be the one moving at extreme speeds.

<comment><USER19> If you remember special relativity theory, it's the same thing - <USER2> depends on your point of view. From my point of view, Mountain View is moving. But if you are a Google employee, then I must be moving of course.

</comment></comment><comment><USER46> What does the user story look like for installing a Chrome app locally? Do you need to go through tons of menus or is it just dev mode + easy/scriptable setup process?

<comment><USER47> For Chromebooks? I thought Google was deprecating chrome apps.

<comment><USER46> I'm way out of the loop then, I guess. Back in my day you could move code files around your computer's file system, and even run them with interpreters.

</comment></comment></comment><comment><USER48> It's funny because my app just got removed from the Play Store for similar (weird) reasons [https://twitter.com/edhelas/status/1014265845940441088](https://twitter.com/edhelas/status/1014265845940441088).

Basically I'm also providing a link to F-Droid on the home screen. The app is blocked and I can only resubmit a new one…

</comment><comment><USER49> How to get tech support from Google: get a lot of upvotes on HN. Sad.

</comment><comment><USER50> Its their sandbox.

<comment><USER51> but, but, they are NOT evil, are they?

</comment></comment><comment><USER52> My extension, which was just a script block and some CSS tweaks was banned as it was a paywall bypass for a popular news site in Australia.

Fair enough according to their policy but I couldn't help feeling disappointed when I got the email as the extension was quite popular at the time.

<comment><USER26> Adblock: OK.

Paywall bypass: Not OK.

Hmm...

<comment><USER52> Yeah I know right?

The reason given was:

> We don't allow products or services that facilitate unauthorized access to > content on websites that circumvents paywalls.

The functionality from the extension was roughly possible with a set of adblock rules anyway, I just packaged it up for the less technically inclined.

</comment></comment></comment><comment><USER53> I'm very curious to see how this plays out. Obviously, the reason for banning the extension is that it prevents Google from tracking our clicks (I'm surprised it took them so long!) But they can't clearly spell out the reason as it would make them look bad, so they just used some template and try to sweep it under the carpet. Now that it's on HN it's no longer so easy to ignore, so I'm really curious to see what happens next.

<comment><USER54> There's a much more obvious reason: the OP's extension presumably requested permissions to inject scripts to google.com. This is a very common pattern for malicious extensions, which can use that permission to hijack the user's Google session, or to inject third-party ads into Google search result pages. Coupled with the lack of information on the extension page, it looked risky.

<comment><USER53> If it's really so, and it's just an "AI mistake", let's see how quickly Google discovers it and apologizes to the author.

</comment></comment></comment><comment><USER55> > _Anyway, dear users of my Google search link fix extension. If you happen to > use Google Chrome, I sincerely recommend switching to Mozilla Firefox. No, > not only because of this simple extension of course. But Addons.Mozilla.Org > policies happen to be enforced in a transparent way, and appealing is always > possible. Mozilla also has a good track record of keeping out malicious > extensions, something that cannot be said about Chrome Web Store (a recent > example)._

It's interesting to hear this, when Firefox Mobile keeps uninstalling uMatrix and uBlock Origin, while these keep running on Chrome without issue.

<comment><USER56> Are you saying that Firefox mobile has uninstalled add-ons from your browser multiple times?

I've been running Nightly mobile for more than a year and never had that happen. It sounds like a very strange bug, maybe it had something to do with Sync?

<comment><USER55> > _Are you saying that Firefox mobile has uninstalled add-ons from your > browser multiple times?_

Yes. Checked while posting this, and they're uninstalled again.

<comment><USER57> Try wiping Firefox's app data. Sounds like a corrupt profile to me.</comment></comment></comment></comment>