Apple, Google ban location tracking in apps using their contact-tracing system - <AUTHOR> https://www.reuters.com/article/us-health-coronavirus-usa-apps-idUSKBN22G28W <comment><USER5> I have to say, working at Apple and knowing all the hard work that goes into this and making sure your data stays private while also being able to combat this disease, it's very frustrating to read a lot of the comments here. I can understand why the public is skeptical, but I feel like as a society we've swung so far away from institutional trust that now nothing good can actually emerge. The anti-vax movement is a perfect example where the collective work of thousands of people over decades to save millions of lives just gets tossed aside because some celebrity 'feels' like there's a connection that isn't there, and in the process, the level of public harm becomes severe.

Note: All opinions (in this comment and all of mine on HN) are my own.

<comment><USER6> I think the notion of trusting any company over a certain size is crazy - <USER2> wish people would stop anthropomorphizing companies that way. Basically, I can trust specific people if I feel that I know their character, and by proxy I might trust a company that these people have significant control over. Once a company reaches a certain size, any power that individual employees wield will have been diluted to microscopic levels, and even founders' altruistic motivations tend to fade or get drowned out by the basic profit motives of an increasingly large group of shareholders. At that point, it's not a matter of trusting, it's at best a matter of recognizing if the strategic goals of the company aligns with my interests in specific ways. For example Apple has made a strategic choice to double down on privacy, because invading privacy is not core to their business the way it is to Google and Facebook, so this allows them to gain an edge over their rivals. Great, that's something. That doesn't mean I "trust" Apple the way I would a person - it's more akin to how I'd recognize when a wild animal doesn't view humans as prey, so I'm willing to get relatively close to them without protective equipment. I don't trust them in general, I don't expect them to care about me at all, but I trust them to follow their instinct, which is to not attack me unprovoked.

<comment><USER7> I kind of disagree with this. If a company publicly claims to follow certain principles and vows to have mechanisms in place to protect user privacy, people on the inside are able to judge if those principles are being followed. The larger a company is, the lower are chances that everyone would stay silent in case of a (systematic) breach of those principles. So in a sense, it's much harder for larger companies to secretly do things simply because larger groups of people are worse at keeping secrets.

<comment><USER8> But history has proven this wrong. e.g, how did the entire German population wilfully engage in something that they now consider very wrong and ashamed about (WW2)?? (Quite a generalisation I know, but it's an example of a lot of people going along with something they may not entirely agree with, not comparing Apple to the Nazis BTW, nor am I saying that every single person went along with it).

I am merely saying that if it is possible at a national level, it is possible at a company level. If it is a culture where you work you can quickly become swept along with it.

<comment><USER7> WWII is somewhat different in that it was not secret what was happening. Speaking up on the inside is a much bigger step than just talking to outsiders.

<comment><USER9> What? The Holocaust was definitely kept under wraps from the general public until the concentration camps finally got liberated. Sure, some members of the public heard rumors, but it wasn't like Nazi Germany was doing it completely out in the open.

<comment><USER10> > The Holocaust was definitely kept under wraps from the general public

[https://www.theguardian.com/uk/2001/feb/17/johnezard](https://www.theguardian.com/uk/2001/feb/17/johnezard) suggests otherwise.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> If you don't trust Google and Apple when they say their API does what they say it does, then you can't use an iPhone or Android phone.

I understand that people are conscious about these things but what I don't understand is how people say "oh I'd never run an app using an API from google/apple, they have a horrible track record" and then carry a phone in their pocket with an OS from either Google or Apple, where those companies can basically do whatever they want. If you carry such a phone you already trust them. If this API does what it says it does (basically exchange random numbers) then how is that worse than what you already trust your phone to do?

<comment><USER12> > If you carry such a phone you already trust them.

I don't. But not because I think my dumbphone isn't also basically a mic I carry around, but because mobile devices are a joke, one and all. It's like moving back to communicating with infant sounds after I learned how to walk, form sentences and use tools -- why would I? Because so many people do, that they already assume _everybody_ does?

I don't need e.g. Whatsapp to stay in contact with people I care about and who care about me, if I was only reachable by mail they'd send me letters. Anyone incapable of that I would surely dislike for dozens of other reasons already, so the question of "how to stay in contact even though I don't have a smartphone" literally didn't come up once since Apple "changed the world" in 2007, heh.

This stuff is just a very recent blip in our evolution as a species, and the phase we're in is about as impressive as the lies people told each other once they invented writing. It too shall pass.

<comment><USER13> _if I was only reachable by mail they 'd send me letters._

Based on your comments above, I'd bet a lot of money that they wouldn't...

<comment><USER12> Because something you can't even specify rubbed you the wrong way, no person in the world loves me? That's just wishful thinking on your part.

</comment></comment></comment></comment><comment><USER14> The title of this article is incorrect. FTA: "Apple […] and […] Google on Monday said they would ban the use of location tracking in apps _that use a new contact tracing system the two are building_ ".

So, contact tracing apps that don't use that system, such as the one from the UK ([https://www.bbc.com/news/technology-52441428](https://www.bbc.com/news/technology-52441428)) still would be allowed to do location tracking.

<comment> grey-area But will anyone use them? I wouldn't trust an app which has been outsourced and feeds data to palantir:

[https://eandt.theiet.org/content/articles/2020/04/nhs- opts-f...](https://eandt.theiet.org/content/articles/2020/04/nhs-opts-for- centralised-contact-tracing-app/)

[https://www.hsj.co.uk/technology-and-innovation/exclusive- wo...](https://www.hsj.co.uk/technology-and-innovation/exclusive-wobbly- tracing-app-failed-clinical-safety-and-cyber-security-tests/7027564.article)

The Apple/Google solution sounds much better to me - no central datastore.

<comment><USER15> Oh the UK government has got a great plan for that - they're going to stick the NHS logo on it. That way people will incorrectly think it's trustworthy, and when they find out it wasn't it'll damage the reputation of the NHS - which is a key goal of the current government.

</comment></comment></comment><comment><USER16> Will be interesting to see if they can ban Indian govt. app[1] which needs full location access(clarified)[3]. A lot of people like this app(including me) but also know government does not have good track record in securing private data.

Previously Apple were made to bend their rules when India threatened to ban Apple devices if they don't allow TRAI Do Not Disturb app in 2018.[2]

[1] [https://play.google.com/store/apps/details?id=nic.goi.aarogy...](https://play.google.com/store/apps/details?id=nic.goi.aarogyasetu)

[2] [https://9to5mac.com/2018/11/30/apple-approves-india-dnd- app/](https://9to5mac.com/2018/11/30/apple-approves-india-dnd-app/)

[3] [https://paste.gg/p/anonymous/b7c95d3967514e78a652840b5b666d5...](https://paste.gg/p/anonymous/b7c95d3967514e78a652840b5b666d50)

<comment><USER17> Not sure about Android, but if you're on iOS you have the choice to disable "full location access". In case it's needed to run certain feature in the app, you can choose the "Allow while using" option.

I do that will all the apps that require location access: local food delivery, cab services, vehicle rental and what not.

<comment><USER16> We can and for most apps I do this too. But some apps, like this one, require the location or they won't even start. Also at least on android(which also has fine-grained permissions now), this app specifically requires on- going(background?) location access.

Recently this has also been made mandatory for employees, public and private. So organizations have to ensure all employees have this app on their smartphones. We will see how much this is enforced.

<comment><USER18> You're better off with Android then because there you can have extensions that send a fake location to specific apps.

</comment></comment></comment></comment><comment><USER19> I've been wondering about the UK contact tracing app because they seem to be deliberately misleading saying that data is secure on the phone, yet it's a centralised model, and they are using bullshit terms like "clinically secure algorithm" to describe the one-time codes;

Is the source code of these apps something that could be FOI requested from NHSx seeing as it is publicly funded by the tax payer?

Also they've already started moving the goal posts; [https://www.theregister.co.uk/2020/05/04/uk_covid_app_human_...](https://www.theregister.co.uk/2020/05/04/uk_covid_app_human_rights_parliament/)

This* came from NCSC - that image about the NHS version worries me greatly.

* [https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contac...](https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contact-tracing-app)

<comment><USER20> Given that Palantir is involved, I'd not touch it with a long stick

[https://tech.newstatesman.com/coronavirus/palantir- covid19-d...](https://tech.newstatesman.com/coronavirus/palantir- covid19-datastore-coronavirus)

<comment><USER21> Having worked at Palantir, I'm curious which outdated misconceptions you're still harboring?

It's a giant federated search engine... that's about it. They don't even hold any data themselves, it all stays on site with the customer.

<comment><USER22> I'll use an analogy: they might not be the warlords, but they are the weapon traffickers.

<comment><USER21> I disagree with that analogy. Palantir isn't getting them more data. It's helping them use it more effectively. The organizations already have all the data recorded.

If you don't like the data that organizations record, I'm right there with you, but demonizing the tools that allow them to access data more effectively is an absurd stance to take. Their system also does things like add an immutable audit log, or enforce requirements on how data can be accessed.

Working with law enforcement, before Palantir there was nothing preventing an officer from looking up their ex husband or wife, or celebrities, or anyone at random. With it, there's an audit trail of every search, and most of them need a case number as justification. Even then, certain searches would automatically get flagged for review.

We can go back to giving people direct and unaudited SQL access if you'd like, but I'd prefer some more accountability, even if the downside is organizations being able to use data _they already have_ more effectively.

<comment><USER23> I'd rather we not help our own government "more effectively" spy on American citizens, thanks.

<comment><USER21> > Well, in the context of this post, that is irrelevant at best, or > whataboutism at worst. I notice you don't offer a defense of Palantir here. > Why is that?

HN won't let me reply to that, so I'll do it here. I didn't feel the need to offer a "defense" of Palantir there since I already outlined it above and don't feel like there's value in repeating myself.

But you asked, here you go - The government is going to use the data regardless, so long as they have it. The only effective recourse is to make them collecting or storing the data illegal, but good luck with that, seeing as even when it is illegal they do it anyways (see: Snowden).

Do you think is Palantir weren't there they'd just say "Ah well, I guess that's that" and be done with it? Nope; they'd go to Lockheed, Raytheon, IBM, or another long-time contractor to build a replacement almost immediately. The technology is genuinely nothing special. It federates searches across disparate database, and stitches results together.

But for me, having worked at Palantir, I know what mechanisms are provided to attempt to mitigate abuse. So as long as that data does exist and is going to be used, I'd prefer to have it be as well controlled and audited as possible. And sure, you can argue that the government may forego auditing, or be entirely corrupt, but that doesn't seem to me to be a good reason to not use tools that at least provide that capability.

<comment> vertex-four And we would think the same about Lockheed, Raytheon or IBM. Just because there'll always be someone without morals doesn't mean we just shrug and say anything goes.

<comment><USER21> I'm not saying we should shrug and say anything goes. I'm saying all these companies share one commonality - the are building things for the US government.

If you want to see change that is more than just superficial, that's where you need to make it.

<comment> vertex-four Sure. That doesn't mean that what Palantir are doing isn't wrong - <USER3> tools to an entity which is going to use them for harm is wrong, even if they might result in slightly less harm than selling them some other tool.

If someone comes into a gun shop and tells you they want to shoot up a classroom, selling them a pistol instead of a machine gun doesn't make you immune from judgement.

<comment><USER21> What makes Palantir different than any other software vendor that sells to the government?

Want to know how a lot of that data is generated? Microsoft excel. Arguably without excel there would be less data to act abusively with. If only Microsoft just refused to sell excel to the government.

People are happy to accept that excel is general enough that it isn't made for that one purpose, but refuse to apply the same reasoning to Palantir; that may seem like whataboutism, but they genuinely are comparable tools if you take away the marketing and fear mongering.

As for your analogy, it's more like you own shop that makes metalworking tools, and someone buys some. You don't know what they are going to do with it, and (here's where it gets opinionated) you shouldn't need to care. You sold a tool to someone. Can the tool be used to make a gun? Sure. But it can also be used for anything else involving metal work. At some point we need to accept that the responsibility for how a tool of used needs to be placed on the person using it.

<comment> vertex-four Palantir develops tools to be better at tasks that are pitched to them in some degree of detail through the RFP process and similar processes. Palantir as a company _would not exist_ if it were not for the less savoury of those tasks.

We do not hear, "Government X purchases a couple thousand Excel licenses to keep a database on people it'd like to kill", and I imagine that Microsoft does not sell Excel to Government X in response to an RFP for tooling to keep track of people it'd like to kill.

(Of course, it'd probably stick its metaphorical fingers in its ears if it did hear about Excel being used for that purpose.)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> Does anyone else find this a little ironic given Google is a company that has been logging peoples location to a very fine detail for years

<comment> dan-robertson I have four arguments as to why google are behaving this way with regards to this data. I've no idea which, if any, they operate by:

1\. It's actually crap and they don't want their advertisers to know that their ads are sold based on crap quality data/don't want the backlash of doing a poor job helping

2\. Most people at google care a lot about privacy (either in the secret kept between you and google sense or the more common sense definition people seem to use on hn) and they don't really think about this data as something the firm has/should release

3\. They are afraid that if governments realised they had this data then google would be regulated or every minor security agency/random government department would be demanding access to it by law.

4\. They strongly feel that surveillance by (well intentioned?) private companies is ok but by governments it os not.

<comment><USER25> > 2\. Most people at google care a lot about privacy (either in the secret > kept between you and google sense or the more common sense definition people > seem to use on hn)

When I worked at Google, I saw a lot of earnest efforts to keep data private, in a way that really was sufficient (k-anonymized with large k, for example), but in ways that have no outward proof that it was happening. Send all possible data to the server, then make sure it's properly clustered and scrubbed before it gets stored or analyzed. And it's not easy to explain to someone who can see the whole system that from an end-user's view this is identical to just scooping up everything.

<comment><USER26> I can verify that, from an outsider's perspective, this is indistinguishable from just scooping up everything and saying "trust us, we care about your privacy".

</comment></comment></comment></comment><comment><USER27> I mean, imagine the repercussions of allowing third party apps to do this. It's tragedy of the commons for health info.

i.e. A crappy mobile app that spams notifications when you're around someone who was in contact with Covid infected. One which doesn't have any oversight and motivation other than mobile ad views.

<comment><USER28> The repurcussion is.. you know someone near you was in contact with covid (a good thing to know) and it has ads (devs need to eat too)?

<comment><USER27> It means scammy apps will spam contact notifications without proof just to get eyeballs, and that's on top of the ones using covid fears to phish for info. Bad actors will exploit this.

</comment></comment></comment><comment><USER29> Google have flat out banned any apps that have anything to do with combating COVID-19 if they aren't either funded by their government or are a registered health company. I tried releasing a symptom tracker app before Zoe released theirs and it was rejected for this reason.

<comment><USER30> They will ban and flag your account if your app just mentions the word Covid. It is absolutely absurd. Only Google is allowed to make a Covid app.

<comment><USER31> It may be a bit harsh, but it makes sense. Too many people are trying to take advantage of the situation to pull scams.

It's a lot easier for Google to operate on a whitelist model than a blacklist model.

<comment><USER32> Then Google would be building a whitelist. They aren't doing that, they are using a position of power to isolate the market for themselves. That is a monopoly.

<comment><USER31> They are building a whitelist. They even made the criteria public. You have to be a government or health entity to publish a Covid related app.

<comment><USER32> That isn't a whitelist, there is no way on it with a legitimate app when the entry criteria is being a state.

<comment><USER33> That is a whitelist. They don't have to be easy to get on, or, indeed, to even allow any new entries.

</comment></comment></comment></comment></comment></comment></comment><comment><USER34> Sure. It's maybe a bit unsettling to see a global corporate monopoly telling countries what they're allowed to do, but in this case it's the right thing.

<comment><USER35> I think it's unsettling that were so used to companies and people with actual power doing fuck all to stand up to government abuses that it's weird when it actually happens.

<comment><USER36> Apple makes the news periodically for telling the gov't to piss off.

</comment></comment></comment><comment><USER37> Contact tracing with location tracking must surely be more effective than contract tracing without location tracking.

I'd quite like my government to decide how contact tracing should work in my country, instead of two companies making that decision. I cannot vote against Apple or Google if I don't like what they do.

Also, I'd like to leave my home without worrying about catching a dangerous and possible fatal disease, and if I have to sacrifice some privacy to do this then that's ok.

Privacy is important, and it's lovely that IT people care so much about it, but all the people on zero-hour contracts and with underlying health conditions would probably rather that we prioritise the most effective approach to eliminating the virus.

</comment><comment><USER38> Its interesting that they call this a "Contact Tracing app" even after changing the naming to ExposureNotification.framework

I think these restrictions are meant to win confidence with a somewhat skeptical public. This will also confine the apps to be single purpose for contact tracing only.

<comment><USER5> What is interesting about that?

</comment></comment><comment><USER39> The title says "ban use of location tracking", but the article says "will not allow use of GPS data". There are many ways to extrapolate a user's precise location from non-GPS data.

<comment><USER18> That kind of data, for instance visible access points or cell towers, is not available for apps on iOS.

If you disagree, could you please list ways you think this can be done?

</comment></comment><comment><USER40> Can anyone show me an app in the wild that uses Bluetooth like or close to what the Covid apps wants to?

Why isn't HN talking about the technical side at all?

We know Bluetooth on phones can't do what the governments says it can.

We've all gone through the stage of, what if we used Bluetooth to track people indoors and do cool stuff! Then we realise you can't. The best we see is advertising maybe doing low quality beacons.

It like we think C19 makes the impossible possible.

<comment><USER41> The Australian one seems to follow the spec pretty will. Uses rolling random IDs and BT RSSI to check for proximity to infected people. "Infected" is declared by the patients getting the hospital to input a private key when they're diagnosed, which then uploads their last x days of random IDs to declare them as infected.

Source code is public and has been shared/audited on twitter etc but no formal audits that I've seen yet.

<comment><USER42> > Source code is public and has been shared/audited on twitter etc but no > formal audits that I've seen yet.

I don't believe that's true. There is certainly decompiled code floating around, but release of the code has been delayed whilst the Signals Directorate investigate the app. [0]

Worth noting that decompiling the app to see if it actually does what it says it does is a crime under the legislation backing it.

> Agreed. The PIA and source code will be released subject to consultation > with the Australian Signals Directorate's Australian Cyber Security Centre.

[0] [https://www.health.gov.au/sites/default/files/documents/2020...](https://www.health.gov.au/sites/default/files/documents/2020/04/covidsafe- application-privacy-impact-assessment-agency-response.pdf)

</comment></comment></comment><comment><USER43> We probably shouldn't call them "contact tracing" apps since what they plan to do is so different than manual contact tracing. "Exposure notification" is a better term.

Nothing prevents anyone from using their phone's location history to remember what to tell the contact tracing people.

<comment><USER5> What exactly is the difference?

<comment><USER44> Say Alice tests positive.

Contact tracing: Alice is able to say, "I was in contact with Bill and Carol." Then authorities can talk to Bill and Carol, and have them trigger their phones to see who they've been near. But because that's slow, most plans would upload the lists of who's been near who to a central server. Then the authorities can do a simple query to see who's been near who.

Exposure notification: Alice enters a code that she got with her positive test result in to the app. The app has been continually broadcasting rotating, random identifiers which it then uploads to the central service. The code she entered verifies to the central service that she has a legitimate positive result. Bob and Carol's phones periodically check with the central server for the list of positive IDs. Their phones stored one of the IDs from Alice's phone when they were near each other earlier. Once they get the latest list of infected IDs, their phones will alert them that they have been exposed and should be tested.

In CT, the central service has all the data, and you can trace contacts without the knowledge of the users. In EN, the service has a list of infected people, and everyone needs to check that list periodically.

Pretty sure there's some subtlety with the IDs being a cryptographic sequence or something so there isn't a gigantic list of IDs everybody is constantly pulling down, but this is the gist of it.

ETA: The FAQ from Apple+Google is a pretty quick rundown of where exactly each part of the data is stored and when it leaves your device. [https://blog.google/documents/73/Exposure_Notification_- _FAQ...](https://blog.google/documents/73/Exposure_Notification_- _FAQ_v1.1.pdf)

</comment></comment></comment><comment><USER45> covid19 has become a buzzword factory. Politicians popularize terms like "herd immunity" , "crush the curve", "testing", "ventilators", "PPE" etc to appear to be doing something. "Tracing" is the next in line, but it's a total sham. No country has been able to contain the epidemic with bluetooth. And all the countries that manage the epidemic have first waited until they have very few cases , which can be traced manually, and they did isolation well. As long as there is a high number of active cases, tracing won't work.

So, it's good that apple+google are banning those apps because they would be useless and a damn spying vector.

<comment><USER46> You seem to agree with Schneier! I'm with you, the whole premise is utterly useless. [https://www.schneier.com/blog/archives/2020/05/me_on_covad-1...](https://www.schneier.com/blog/archives/2020/05/me_on_covad-19_.html)

<comment><USER47> Schneier's a security expert, not an epidemiology expert. I don't think I'm going to put much weight in his opinion. The UK's epidemiology and behavioural teams have some confidence that this app will have an effect.

It doesn't need to be perfectly effective to be useful. Even a small reduction in R is very helpful.

<comment><USER48> To be clear: Sage thinks it will work, but we're not told who is on Sage not which of them think this will work.

For all we know this is Cummings not understanding any of the science.

<comment><USER47> For what it's worth, I was thinking of developing an app on similar principles a couple of months ago and I talked to at one of the Sage people. They were enthusiastic about it. There have also been papers modelling the effect.

I don't like Cummings' politics but he is a smart guy. I think he'd follow the science.

</comment></comment></comment></comment></comment><comment><USER49> We've been looking at digital contact tracing from the perspective of Australia, as we see a huge push for the COVIDSafe app, based on Singapore's TraceTogether app.

It seems the sensible order of questions is:

1) Do we have a contact tracing problem?

2) Does digital contact tracing generally solve it?

3) Is the specific app / implementation useful / safe / privacy-respecting?

It appears the national conversation almost entirely skips thinking about 1) and 2) and gets lost in the limited analysis of 3).

We had a deeper look at 2) in this recent piece:

[https://blog.crushthecurve.today/why-should-you-install- the-...](https://blog.crushthecurve.today/why-should-you-install-the- covidsafe-app-part-2/)

<comment><USER50> The post has a very city-specific view. (and it may have good points about that environment) Compare it to a regional town: minimal public transport, few/no dense residential buildings, no large offices. For me the app is literally a "does anyone I stood next to in the shop / petrol station test positive" indicator.

<comment><USER49> In a regional context a bluetooth proximity app offers even less theoretical value.

A contact is only registered after 15 minutes of time spent within an estimated proximity of 1.5 metres (itself a primitive model of infectious disease transmission based on a 1942 paper). Note other countries set the distance at 2 metres.

As outlined in other comments in this thread, close contact rules include anyone in a room for more than 2 hours, so even though all close contacts have to be manually interviewed (there is no instantaneous notification and isolation) for most social situations close contacts won't be registered through crude estimates of proximity: home, family / friends, work all require thinking about and providing contacts.

When you strip out all the situations that aren't beneficial, that starts to leave public transport in major metro situations where commutes are greater than 15 minutes.

Keep in mind that also implies the end of any social distancing (as otherwise no contacts are registered). That seems obvious, as public transport becomes overwhelmed if capacity is significantly reduced.

</comment></comment></comment><comment><USER51> Location information, political preferences, socioeconomic status, photos, emails, search locations, to name a few. Is very dangerous that they are openly monopolizing access to everybody's life without regulations in place. I personally believe that Engineering teams do their best to anonimize individuals but reality is that other products teams such as Ads or growth don't do it

</comment><comment><USER52> See [https://twitter.com/GeoffreyHuntley/status/12561244277810626...](https://twitter.com/GeoffreyHuntley/status/1256124427781062656?s=19) for Australia.

<comment><USER42> Where are the bug bounty programs? That's easy. It's a crime to see how any of the app is running. Reporting a security flaw would likely see you receive a $5000 fine, and potential jail time atop of that.

They didn't bother to get the servers running before pushing out a gigantic advertising campaign shaming anyone for not using it.

... Despite it having obvious flaws from day one, that showed it was mostly a cut 'n paste of Singapore's GPL app. (Though you can't access the source. National security trumps freedom of information and promises.)

<comment><USER50> > It's a crime to see how any of the app is running.

Have you got something supporting this? Here's a panel of Australian-based security people decompiling and discussion the details of the app: [https://www.youtube.com/watch?v=U3dN99ljgD4](https://www.youtube.com/watch?v=U3dN99ljgD4) Are you saying they've all publicly admitted to committing a crime and are unaware of those laws? Are all editors here [https://docs.google.com/document/d/17GuApb1fG3Bn0_DVgDQgrtnd...](https://docs.google.com/document/d/17GuApb1fG3Bn0_DVgDQgrtnd_QO3foBl7NVb8vaWeKc/preview#) criminals?

The only serious analysis I can find is in [http://www.austlii.edu.au/au/journals/JlLawInfoSci/2003/2.ht...](http://www.austlii.edu.au/au/journals/JlLawInfoSci/2003/2.html#Heading337) and it's "kinda depends why you're doing it, but either way it's largely untested".

<comment><USER42> It isn't actually a law yet - that happens later this month. Instead, we've received a determination by the minister [0], which will act as a kind of back-date for when those laws are passed.

> A person must not decrypt encrypted COVID app data that is stored on a > mobile telecommunications device.

That video shows them looking into how the data bundle is assembled, but I don't believe they actually touch it or run it in an emulator, which would very much breach the determination - because unless you're one of the exceptions, you're not legally allowed to run the software outside of tracing.

Exceptions are given for those in employ of the health department, or other government bodies.

Whilst that might vaguely not mean decompiling the app, the minister's own press conference is clearer on the intent [1]:

> It cannot leave the country, it cannot be accessed by anybody other than a > state public health official, it cannot be used for any purpose other than > the provision of data for the purposes of finding people with whom you have > been in close contact, and it is punishable by jail if there is a breach of > that.

Decompiling the app steps outside the provisions for looking at the data, and yes, you don't have permission to look at your own data.

[0] [https://www.legislation.gov.au/Details/F2020L00480/Html/Text](https://www.legislation.gov.au/Details/F2020L00480/Html/Text)

[1] [https://www.health.gov.au/ministers/the-hon-greg-hunt- mp/med...](https://www.health.gov.au/ministers/the-hon-greg-hunt- mp/media/press-conference-about-the-covidsafe-app-launch)

<comment><USER50> IANAL, but I think your interpretation goes beyond what they're after.

The determination is clearly aimed at data usage and prevents people from trying to decrypt the reports from other users. The whole fragment of the interview is about the data produced by the app and how it should be protected as sensitive information. I can't see anything there that would prevent you from reverse engineering "to see how any of the app is running."

It's not even obfuscated or protected from decompilation in any way, so it's trivial to look at with static analysis tools. (i.e. without trying to run it)

Even the headings don't mention the code: "Collection, use or disclosure of COVID app data", "Treatment of COVID app data", "Decrypting COVID app data", "Coercing the use of COVIDSafe".

<comment><USER42> > IANAL, but I think your interpretation goes beyond what they're after.

Perhaps more than the intent, but this is a government that doesn't deserve the benefit of the doubt.

Circumventing any "access control technical protection measures" is currently a crime under Australian law (Section 116, Copyright Act). They may well consider any decompiling tools to fall under that particular law, as well as use of said tools.

In March, they pressured a university in firing someone researching into their own data breach to see how bad it is. [0] There isn't a law against de- identifying, especially when it is in the public interest, but they went ahead and threatened severe legal action anyway. Whilst simultaneously claiming that said data breach doesn't contain any personally identifiable information.

They had to be taken to the High Court to be shown that an algorithm cannot be used as evidence that a debt exists, and that decision makers actually need to do more than just trust the system. [1]

If it embarrasses them in any way, then they are not above twisting laws to suit them. [2]

[0] [https://www.theguardian.com/australia- news/2020/mar/08/melbo...](https://www.theguardian.com/australia- news/2020/mar/08/melbourne-professor-quits-after-health-department-pressures- her-over-data-breach)

[1] [https://www.theguardian.com/australia- news/2019/nov/28/robod...](https://www.theguardian.com/australia- news/2019/nov/28/robodebt-the-federal-court-ruling-and-what-it-means-for- targeted-welfare-recipients)

[2] [https://www.abc.net.au/news/2020-02-28/abc-not-appealing- fed...](https://www.abc.net.au/news/2020-02-28/abc-not-appealing-federal- court-ruling-on-afp-raids/12008886)

</comment></comment></comment></comment></comment></comment><comment><USER53> The idea that this won't be abused is nuts after seeing what's already been done by the likes of Facebook, Zoom, Microsoft and others. Privacy is privacy. No one has the right to take that away.

</comment><comment><USER54> I have two questions.

1\. Why are location data needed? What difference could it make vs just contacts?

2\. Couldn't this ban be easily circumvented by telling people to install another app that shares location data?

</comment><comment><USER55> I can't imagine that working out in China.

EDIT: Nevermind. Looks like this only applies to apps using their new contact- tracing framework.

</comment><comment><USER56> Here in Australia our Covid tracing app is already out.

It uses Bluetooth proximity logs and local storage unless you test positive and are asked to upload.

I had a look at whats in the apps DB and it seems it just keeps a log of unique ids it bumps into. When you test positive and upload I'm guessing it publishes those unique ids if the logs show over 15 minutes of contact.

The government already have our locations via cell towers so they just have to match the data if they really wanted to.

<comment><USER49> A misunderstanding is that this system results in instantaneous contact notification and isolation (which is what one of the original papers on digital contact tracing efficacy assumes).

The reality is the entire 'human in the loop' contact tracing process is still manual. Health staff working in state contact tracing teams still need to call and interview every contact to determine whether they could be considered a close contact from an epidemiological perspective.

Also consider that close contacts include anyone you've spent more than 2 hours in an enclosed room with.

So that immediately limits the utility of any bluetooth proximity app: you still need an entirely manual process for home, work, social gatherings - <USER4> situation where you are in an enclosed room.

We've taken a deeper look at the assumptions and expert opinion, both from individuals and institutions, which appear to discount this kind of system from providing significant value.

Even the product lead of Singapore's TraceTogether app, as a natural advocate for this kind of initiative, admits the technology is oversold and is only an additional tool (due to the significant potential for false positives / negatives):

[https://blog.gds-gov.tech/automated-contact-tracing-is- not-a...](https://blog.gds-gov.tech/automated-contact-tracing-is-not-a- coronavirus-panacea-57fb3ce61d98)

<comment><USER56> Thanks for the insight.

Why wouldn't they just auto-alert anyone who came in adequate proximity to get tested though? Surely there is some benefit to letting people know they need to be extra careful now and get tested ASAP.

All the manual human work can continue as normal.

<comment><USER49> If someone is determined as a close contact they have to legally self-isolate for 14 days regardless of symptoms or test results.

The policy there probably reflects the understanding that people in the early stages of infection won't test positive or exhibit symptoms.

</comment></comment></comment></comment><comment><USER57> The GPS data couldn't be "rounded" to have less precision, depending on population density?

<comment><USER58> Wouldn't that sort of defeat the point here?

Contact tracing apps want to use location data to know when I might have been in contact with someone. If you do something like round the data to a suburban neighborhood or a densely populated city block in Manhattan, you can't effectively contact trace.

Any granularity of data that is useful for contact tracing would seemingly raise the same concerns that are leading to them banning this.

</comment></comment><comment><USER59> Does anyone know if the original statements from Apple and/or Google are available online?

<comment><USER60> I believe it comes from here:

[https://blog.google/documents/72/Exposure_Notifications_Serv...](https://blog.google/documents/72/Exposure_Notifications_Service_Additional_Terms.pdf)

Section 3.c.i

<comment><USER59> Thanks.

It sounds like this only applies to Google's own exposure notification service and would not apply to standalone contact-tracing apps such as the one being proposed by the UK government.

</comment></comment></comment><comment><USER61> Somewhat inevitable that the briefing will begin tomorrow against Apple and Google that American big tech firms are deliberately frustrating attempts to fight COVID and wouldn't it be better if we just taxed them out of existence.

Shame, as a UK citizen I'm entirely supportive of the stance Apple and Google are taking.

<comment><USER62> I'm not so sure that this type of framing will work so well in the UK. I suspect a lot of the press will jump straight to "it's because Dominic Cummings wants to benefit his mates who do dodgy data mining". Even if that's demonstrably totally untrue, enough people will believe that narrative for it to become mainstream.

The fact that there are plenty of other countries who are content to go with the Google/Apple API will also neutralize a lot of this type of criticism.

<comment><USER32> I have no idea how to predict the UK public anymore. When it comes to the snoopers charter it went by with barely a whisper from the populace and yet when it comes to the 18+ filter on broadband something like 93% of people had opted out on their home broadband. It's exceptionally rare to find so many people do the opposite of default. I can't work out if the Uk public do or do not care about privacy and their security or what but they surprise me with their actions at times.

</comment></comment></comment><comment><USER63> Interesting. I wonder if countries will try to force them to re-enable it

</comment><comment><USER64> What is the status of contact tracing apps in the United States?

<comment><USER43> Not launched yet.

</comment></comment><comment><USER65> Under the cover of coronavirus, governments punish adversaries and reward friends [https://archive.vn/Ea2qr](https://archive.vn/Ea2qr)

</comment><comment><USER66> Will they boot existing contact tracing apps with GPS from the App Market?

</comment><comment><USER67> this is a text book cluster fack

</comment><comment><USER68> I'm so confused. Can you opt out of this?

<comment><USER69> Can you opt out of installing an app? Is that actually what you're asking here? If so, yes..

<comment><USER68> If Apple wanted to they could force your phone to install an Unremovable app or just add in the software in an update.

<comment><USER70> This is not just a straw man it's a straw giant.

<comment><USER68> True. I just haven't been following this. I'm glad to hear it's completely voluntary.

<comment><USER5> Which is very unfortunate, because it means it'll be far less effective.

</comment></comment></comment></comment></comment></comment><comment><USER71> Awesome but not yet launched.!

</comment><comment><USER72> Yes. I believe them. Totally. The borg has my best interests at heart. My big brothers Apple and Google will look after me.

</comment><comment><USER73> Horrible.

</comment><comment><USER74> if the goal is 'privacy', I'd think contract tracing is every bit if not more more of a privacy concern than is location

<comment><USER5> How so? You're an anonymous identifier in this system.

</comment></comment><comment><USER75> even without location tracking it's creepy. what happens when the govt contact traces a man with his mistress and then blackmails him?

<comment><USER76> I laugh at conspiracy theories which revolve around the Government paying special attention to normal individuals.

Dude, Governments have the power to tax millions of people. They don't need your piddling bribery money. It's too much work for too little reward.

<comment><USER77> It's not about the money and it's not about "normal individuals", whatever that means.

Law enforcement and intelligence agencies find this sort of information useful to further their agendas.

<comment><USER76> Then (in your absurd hypothetical scenario) those agencies are being incredibly stupid, they're wasting their time on on high risk / low reward strategies.

Oh wait, you're probably talking about the United States? It's scary how fucked up that place is just millimetres below the surface.

</comment></comment></comment></comment><comment><USER78> They have to protect their valuable behavioral surplus.

</comment><comment><USER79> I am sure most people would agree life > privacy any day.

Edit: But then again, if there was an option to opt out that would be great too. Got to give people options!

</comment><comment><USER80> Good luck implementing it in other side of the world (India). You can't refuse if Govt mandates it. So what's the point in Apple and Google wants to control Privacy. I can trust Govt more than Greedy Private companies.

<comment><USER81> Just curious: why do you feel you trust your government more than "greedy" private companies?

</comment></comment><comment><USER82> So GPS for me but not thee?

"Privacy experts have warned that any cache of location data related to health issues could make businesses and individuals vulnerable to being ostracized if the data is exposed."

Apple and Google already have that data in-house, it's just as vulnerable as any data.

How is this not an absurd stance?

<comment><USER83> I can't speak for Google, but I know that Apple goes out of their way not to have any clue where your are. For example, when you do mapping directions, you get issues multiple single-use codes, that are refreshed during the trip, so not only does Apple not know what directions you asked for, they can't even associate the trip with a single entity.

When you say, "Apple has the data in-house" \- what are you referring to?

<comment><USER50> > they can't even associate the trip

That's assuming the single-use codes are not persisted on the other side. Maybe they aren't.

"Apple has the ability to have the data in-house" / "Apple promises not to have the data in-house" would be more precise. The rest relies on the current behaviour and T&C.

</comment></comment></comment><comment><USER84> I'm genuinely suprised that an implementation came out so quickly ... one would think the pandemia must have been advanced before the government even considered doing this ... and here we are with Android and iOS approved apps, with bluetooth and permission solutions made by a team of available engineers, implementing goverment documented requirements ... hmmm

<comment><USER85> There is not a single app using this API in "approved" state, let alone active use. The API is kept very simple, its implementation has just entered a beta stage, and the Bluetooth tech it uses is almost a decade old already. And the entire idea of contact tracing via BT has been discussed for months already by several teams worldwide and already been implemented a few times in various ways, so it's not exactly new either.

But don't worry, just go on with your demonstrative "critical thinking"...</comment></comment>


How to turn off Carrier IQ on your iPhone - <AUTHOR> http://www.computerworld.com/s/article/9222336/How_to_turn_off_Carrier_IQ_on_your_iPhone?source=rss_security&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+computerworld/s/feed/topic/17+(Computerworld+Security+News) <comment><USER2> It is these types of stories that make me wince whenever I am linked to computerworld.com. No new information was offered, the title was primed for linkbaiting, and the rest of the story was a regurgitation of pieces found elsewhere (with extraneous bolding). I wish I could un-see the pre-roll advertisement--not because I hate advertising, but because I can't believe computerworld gets money for that type of story.

</comment><comment><USER3> I don't know why exactly I followed these instructions, because I was sure that I had never turned "diagnostics" it on. When I saw the settings I was kind of shocked, because my iPhone 4S (5.0.1) really was running in diagnostics mode all the time.

Probably you should check your settings, too!</comment>


Insanely Affordable X64 Cloud Servers - <AUTHOR> https://blog.scaleway.com/2016/03/08/c2-insanely-affordable-x64-servers/ <comment><USER2> moul: care to comment about how things are at scaleway and how's the roadmap going ? Is VPC the next item on the list ? :)

Congrats on the steady advance anyway. It's been a pleasure to use scaleway so far.

</comment><comment><USER3> It's nice to see that they finally added x86 servers.</comment>


Ask HN: Matlab OR Mathematica? - <AUTHOR> I am looking to get started and learn a numerical computing environment. Any suggestions which one to start with? <comment><USER2> Without any additional context about what industry/scope... use Excel.

All joking aside, pick either one and go with it. Since you are learning there are core concepts/skills that you need to acquire and both tools can help you grow.

As an electrical engineer I learned Matlab first, but later i needed to work with Mathematica down the road.

My advice, start with the one that costs the least.

</comment><comment><USER3> how about julia? It's free and more powerful.

[http://julialang.org/](http://julialang.org/) [http://julialang.org/learning/](http://julialang.org/learning/)</comment>


Scribd CTO: "We Are Scrapping Flash And Betting The Company On HTML5″  - <AUTHOR> http://techcrunch.com/2010/05/05/scribd-html5/ <comment><USER2> I've worked for a big Scribd competitor (bigger than Scribd by some measures) and I am blown away that they would move in this direction. Those saying that they are not taking a great risk are missing the point in a serious way. In this business, the viewer _is_ the company. It is your whole competitive advantage. Taking apart a PDF is nothing - putting it back together in Flash with the right appearance, cropping, individual character metainfo, hyperlinks, caching, progressive loading, etc., etc., is science. To do that you need to be very long on Flash, and they just threw away all that inventory and expertise.

Which is, of course, a killer move if they can actually pull it off as they will be the first and only company to do it (again, comparing with Google's Javascript PDF viewer misses the point, as that 'just' renders images). I am just dumbstruck to see a company do such a 180 degree turn and they deserve all the credit in the world for having the guts.

<comment><USER3> Won't everybody using Flash be able to do the same thing with Flash CS5's <canvas> \+ FXG support?

Isn't the point of this move to support the iPad, the iPhone, and other non- Flash environments?

</comment></comment><comment><USER4> Great. Now I might not cringe every time I see a Scribd link.

A flash PDF reader is worse than useless. I can't use flash on my iPhone, and the Scribd reader used to break back when I used an Ubuntu machine. And it certainly never ran great on my Mac. When you consider that I already had perfectly fine, and free!, PDF readers on all three devices, Scribd was actively harmful.

But an HTML 5 PDF reader could actually be useful! It may be more lightweight than downloading a whole PDF. It will certainly be no worse than what I can currently use to render and read a PDF.

This is good. Scribd may change their image as a widely hated startup.

<comment><USER4> I get it, we'll ignore the fact that Scribd makes the web a worse place when the founders are in the thread.

<comment><USER5> Well that's a pretty ridiculous thing to say. How can a website make the web a worse place? A website either provides something you can't get anywhere else, which is intrinsically valuable, or you can just ignore the site.

<comment><USER4> >How can a website make the web a worse place?

It's easy. Someone sends you a Scribd link. Scribd is written in Flash so maybe you can't read the damn thing. Before Scribd, people would just send you PDF links. Everybody can read PDFs.

Scribd harms the web by reducing the number of people who can view its content. That's what I call "providing negative value".

</comment></comment></comment></comment><comment><USER6> I'll be interested to see how they will deal with the licensing issues regarding font embedding. Right now, there aren't a whole lot of non-free fonts that allow @font-face embedding, because embedding a font with @font- face makes the font downloadable to anyone with a little digging through CSS files for its URL.

I hope a solution is found for this that doesn't require specific allowance of CSS embedding in the license. If it does, some fonts will never be legal to embed.

<comment><USER7> The fonts are what interest me too. Not just the licensing, though (that never stopped YouTube with its videos - at least not for a few years!) but with having to convert a myriad of fonts embedded in documents into SVG fonts (otherwise they won't work on the iPad).. that's no mean feat.

</comment></comment><comment><USER8> Thank god. I like their product, but it's such a resource hog. Here's hoping that HTML5 Scribd will be a little more lightweight.

</comment><comment><USER9> "Betting the company"? Sounds a little dramatic. It's HTML5 not Silverlight. How much risk is there really?

<comment><USER10> My thoughts exactly. HTML5 is going to be (or is already) everywhere, so where's the big risk?

<comment><USER11> Investment risk. Scribd is a small company, and putting a whole battalion of developers on a PDF to HTML5 conversion for half a year without even knowing whether that'll turn out to be possible (as in, good enough for 10,000,000 documents) is a scary move. That being said, check out our upcoming engineering blog for technical details about how we convert to HTML5 now!

<comment><USER12> "putting a whole battalion of developers on a PDF to HTML5 conversion for half a year without even knowing whether that'll turn out to be possible"

The Google pdf viewer seems good enough to me. It'll be interesting to see what you can improve on that.

<comment><USER13> Actual pdf readers like Preview seem good enough to me. I don't understand why I would need to take a PDF and view it as HTML.

I do see the value for formats like .pptx where I may not have a reader, but PDF is already a "lowest common denominator" like HTML.

<comment><USER14> I've occasionally been thankful for Google's PDF conversion. PDF isn't a lowest common denominator - there are computers without that capability (kiosks and terminals, for example). What's more, PDF viewers can be pretty heavy, especially for fancy documents, and their browser integration tends to suck even when it exists.

Sure, I like reading my PDFs with evince, but sometimes HTML is just preferrable.

</comment></comment></comment></comment></comment></comment><comment><USER15> How big of a role did SEO play in this decision?

<comment><USER16> Good question, but none, really. It won't affect our SEO - we did this to improve the user experience on the site.

<comment><USER17> Actually - I heard it did

<comment><USER18> You work for scribd too ?

<comment><USER19> Do you really have to work for scribd to see the benefit of millions of pages of text?

Edit: it turns out they already present the text at least some of the time, but markup and text portability still adds some value (see my comment above).

</comment></comment></comment></comment></comment><comment><USER20> Just in case anyone's wondering -- it's not just converting each page to an image. It's all HTML5 text, graphics, and images where appropriate.

<comment><USER21> Is there anything specific to HTML _5_ there?

<comment><USER20> The new viewer doesn't use the full spectrum of HTML 5 features, to maintain compatibility with older browsers, but it would not be possible before HTML 5.

<comment><USER22> Can anybody name a single feature exclusive to HTML5 that it is actually using? TFA says:

"Friedman estimates that 97 percent of browsers will be able to read Scribd's HTML5 documents"

That pretty much counts IE6 into the picture, so I'm really wondering exactly what "HTML5" features IE6 supports!

<comment><USER23> Using the HTML5 doctype lets you use HTML5 tags and custom data attributes and have a valid document. New HTML5 form fields, custom attributes, and markup elements are usable in IE6 mainly because it just doesn't really bother to explode when it encounters them. Form fields just show up as text boxes, custom data attributes are only used in JS anyway, and new structural elements are usable and styleable in IE6 just by adding JS that does a document.createElement().

HTML5 isn't something that just came around. It's been in the works by browser makers for quite a while, which is refreshing. Rather than it being a spec made up in a purely academic environment (XHTML 2), it's something that's made up of technologies that have already been used by one or more browser makers (and often, developers on real sites.)

Also, using the HTML5 doctype in IE6 causes IE6 to go into standards mode, which is just pure luck.

You can do a lot of good for users if you start using some of the HTML5 features right now, even if it's not apparent. If you use the type="email" for your forms when you ask for an email, the ipod and ipad will bring up the Email keyboard layout. That alone is kinda cool.

</comment></comment></comment></comment></comment><comment><USER24> No offense to Scribd, but what is wrong with viewing a document in your browser using something like Safari? I realize that not all machines are capable of this, but they could pretty easily. Someone asked the other day, "Why doesn't Windows have a native PDF reader?". Surely it's possible for all browsers to quickly and properly render a PDF, with easy controls to navigate.

I understand the added benefits of being able to comment, discuss, share, etc.. your documents with Scribd, but honestly why the need for HTML5 or anything at all? PDF's are viewable just fine in a simple PDF viewer.

<comment><USER25> Well, they don't. Not currently anyway.

</comment></comment><comment><AUTHOR> this is great news. flash was just really overbearing and felt heavy. im sure it was also a bitch to deal on the back end. Can't wait to play around with it.

ps- i win newsyc bingo: YC company, techcrunch article, HTML5.

<comment><USER26> Bzzzt! You're missing: Apple, Facebook. Try again.

<comment><USER27> He got Adobe Flash and HTML 5. That's tangential enough to almost include Apple.

Needs: * Facebook integration (or even better for HN cred - removing facebook connect) * "Now works on iPhone/iPad"

<comment><AUTHOR> Find out how a 30 year old lean startup,Apple, made billions by opposing facebook privacy issues and furthering HTML5 on the iPad by acquiring Kiko (YC S05). (techcrunch.com)

<comment><USER27> Almost perfect. I just realized we missed Erlang.

<comment><USER28> Doesn't scribed use erlang?

</comment></comment></comment></comment></comment></comment><comment><USER18> If this doesn't rely on HTML5 features, why call it HTML5?

DHTML or javascript would have been good enough then, wouldn't it?

<comment><USER29> if they are using html5 features and degrading gracefully, as most html5 does by default anyway, why not say you are using html5?

for one it might help push a few people into using more html5 capable browsers.

<comment><USER18> They _only_ use features of HTML5 that are also supported by older browsers:

From the article:

"Friedman estimates that 97 percent of browsers will be able to read Scribd's HTML5 documents because those parts of the standard are older and more widely adopted."

I don't read that as 'graceful degradation', but as a subset based on older tech.

<comment><USER30> We create basically the same experience across browsers, but use the latest tech that the browser supports. For instance, things will render much faster in Chrome than in IE6.

However, the documents will basically look the same across all of our supported browsers.

</comment></comment></comment></comment><comment><USER31> I don't normally like the "betting the company" metaphor as I feel it's overused and over-dramatic. There's also a sense of motivating staff with fear, in that if you don't work hard enough or if you make any mistakes, we'll lose this bet and the company will fail and everyone here will be out of work. No pressure, or anything, though :)

When I met Microsoft's Chief Software Architect at PDC last year, he kindly thanked me for "betting on Azure" and I thought to myself "I'm just experimenting with a new technology that may make my life easier, I try my best not to ever _bet_ on anything". Not wanting to be a smart-ass jerk, I just talked about lolcats and 4chan instead.

Reading about what Scribd is doing, it seems that the metaphor is pretty appropriate.

</comment><comment><USER32> I hope they succeed and HTML5 replaces Flash, but this seems like a very risky move.

<comment><USER33> Google already does a great job of showing PDF files using HTML and JavaScript. Don't think it is huge risk.

Plus the upside is their stuff will then work on mobile devices too.

<comment><USER20> Google rasterizes the PDF and streams it to you as an image. Scribd will be converting documents to HTML and CSS while maintaining a near perfect facsimile of the original document.

<comment><USER12> Google does a lot more than that. For example copy and paste works if you select some text and copy it out. That's non trivial.

<comment><USER34> That is true, their conversion understands text regions and various other things. However, what makes Scribd's viewer more sophisticated is that it will actually use _structured_ HTML to render the document content. This is more than just putting on a layer that specifies regions in the document, it will actually just be a normal HTML document, made of divs, text, images, etc.

Plus, it will maintain the fidelity of the document -- meaning that even PDFs with complicated layouts will be rendered properly in HTML. No trivial task.

<comment><USER12> What will be the main advantage?

It's a great technical challenge, but will users notice the difference?

<comment><USER35> Users will be able to easily view PDFs on the web from any device. I primarily read HN on my phone. Any time I see a [Scribd] link, I forget about the story because I can't read it. I have also had several occasions where I _needed_ to read a PDF on the go. I had to email it to a friend and then call them, dictating the pertinent bits over the phone.

Once this is live, Scribd will gain at least myself as a user, and I suspect many more.

(Nesting is too deep to reply to axod, so: the fact that Google is doing this should be reason enough. Scribd exists as a place to publish material. That material should be reachable by as many users as they can manage.)

<comment><USER12> [http://docs.google.com/gview?url=http://infolab.stanford.edu...](http://docs.google.com/gview?url=http://infolab.stanford.edu/pub/papers/google.pdf)

Works fine for me :/

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER36> If they really can display PDFs accurately using HTML5, that's great, and plenty of other companies (including CrocoDoc) would benefit from following suit. But PDF still does a lot of things that HTML doesn't, like first-class font embedding (@font-face won't cut it). I'm not sure whether this is the right time to make the switch, though me and my iPad wish them luck.

</comment><comment><USER19> This is a good move. HTML is a better and more natural feeling format for long documents than Flash (and PDF readers) ever were.

</comment><comment><USER37> If they are moving from flash to html5 then how are they drawing?

You can get alot of drawing flexibility if you use Canvas, but performance of any Canvas-bridge for IE makes it not worth using.

<comment><USER38> I might be missing your point, but Scribd does not do any drawing. Any non- text elements are represented as images.

<comment><USER37> Hmmm.... ok, that makes sense. Thanks!

</comment></comment></comment><comment><USER39> Seems like a route to a possible acquisition by Adobe or Google. The technical constraints of HTML5 make it interesting.

</comment><comment><USER40> "Now any document can become a Web page."

Now if only I didn't have to log in to read it.

<comment><USER41> you have to log in to read documents on Scribd? i've never had to.

<comment><USER40> Was it to view them as the source PDF rather than their Flash approximations, then? I can't remember, but they /did/ get on my nerves more than once requiring an account to get at the hosted content.

<comment><USER42> Yes, it was for the pdf. Clutter the web with SE spam, and the make you log in to get the real document. Gee, thanks.

</comment></comment></comment></comment><comment><USER43> I don't get it. It's a shift of technology from one platform to the next. Content, such as ads, is going to be the same. So one gee-whiz thing to the next is just going to result in the next generation gee-whiz ad-blocker.

</comment><comment><USER44> HTML5 really makes sense for the online viewing. Guess PDF will stay as popular offline reading format. At least until we get some universal cross- platform/cross-browser webarchive format. Could be an idea for a start-up ...

</comment><comment><USER45> I'm not happy with the way Apple's been throwing its weight around on this issue but all the same I'd much rather see this kind of thing implemented in HTML than in Flash.

</comment><comment><USER46> Ironically the page is causing me a stack overflow in IE8.

</comment><comment><USER47> Cool. Maybe now I'll actually be able to log in and view a document?

Because I never have been able to before.

</comment><comment><USER48> It looks like it's still flash. Why announce this before it's done?

<comment><USER49> To get at least two waves of attention: (1) announcement; (2) delivery.

</comment></comment><comment><USER50> Nice. Thank you, it's about time.</comment>


GSMem: Data Exfiltration from Air-Gapped Computers Over GSM Frequencies [pdf] - <AUTHOR> https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-guri-update.pdf <comment><AUTHOR> This team used patterns of memory access instructions to modulate a memory bus to generate GSM-band signals that can be read from a hacked baseband. That is a thing that happened.

<comment><USER2> Van Eck, of course, but still.

</comment></comment><comment><USER3> Somehow this reminds me of the various "floppy drive plays the Imperial March" hacks only this time it is "system RAM plays the arbitrary-bits-of-information fugue in C major on the electromagnetic spectrum." The research needed to get this to work is stunning.

<comment><USER4> Toccata and fugue in 101010 minor on a DRAM harp.

</comment></comment><comment><USER5> Could the SSE2 non-temporal instructions used in this (genius) strategy be used to exploit RowHammer in DDR2, avoiding the known "dangerous" CLFLUSH?

This seems like an obvious approach but the only reference to it I can find is in this Google Native Client issue, with no indication of whether or not it's successful: [https://code.google.com/p/nativeclient/issues/detail?id=3970](https://code.google.com/p/nativeclient/issues/detail?id=3970)

<comment><USER6> The recent Rowhammer.js paper showed that you don't even need non-temporal instructions to achieve faults---regular accesses, with a clever eviction strategy, will do: [http://arxiv.org/abs/1507.06955](http://arxiv.org/abs/1507.06955)

<comment><USER7> This type of news reminds me of that scene from the first (live action) Transformers movie where the girl hacker is telling the three-letter suit types that they need to be thinking in a whole other level of technology in order to understand their adversary.

I suppose though, that this means if you have /critical/ security things it really just means you need to have the kind of physical security you hear about in scifi and fictional spy game settings. Not just plain airgaps, but proper Faraday cages, and even vibration dampening (for servers too, not just 'meeting rooms'). Probably even thermal regulation so that there's always /consistent/ output.

</comment></comment></comment><comment><USER8> Just to clarify: They're talking about going into an air-gapped network (i.e. cut off from the outside world as far as network transmission of data goes) and using a conveniently-placed (and hacked) cell phone to read signals, convert them into useful data, and transmit that to the attacker? So the cell phone works as a sort of spigot that pours that data into outside networks? Let me know if I'm not reading this right.

<comment><USER9> You can, by several means, infect computers on the way to the air-gapped facility.

People will use it to store sensitive information, and now you have access to it. You just solved half of the problem.

Now, how to get this data? Internet? No. air-gapped. Send someone to retrieve the machine by force? Too risk and will alert the enemy. Solution: infect the cell phones of the people working there.

Your machine will be continuously broadcasting the information you want and when the infected phone come close to it, communication will occur.

Totally feasible.

<comment><USER10> Definitely. Most sophisticated hacking involves multiple steps and sometimes boxes (esp w/ C&C). People should expect the same in EMSEC attacks. And wireless, reprogrammable devices are _always_ a threat that even NSA et al haven't mapped all specifics on. It's why any installation allowing them is insecure to EMSEC by default in my book.

</comment></comment></comment><comment><USER11> Only a bit related: does anyone know a) why it is standard in scientific papers to be written in 2-col layout and b) how to convert said 2-col layout to a READABLE 1-col layout?!

Man, this is driving me nuts on desktop and mobile.

<comment><USER12> In the case of this specific paper from this specific conference, you're in a lot of luck. USENIX put out the full proceedings as a giant PDF, an ePub, and a Mobi ([1]).

If you want to reflow arbitrary pdfs, then you should check out k2pdfopt ([2]). It's how I read academic papers on my Kindle. It does lots of tricks to slice out a useful format from pdfs of many different formats and make them pretty solid on a different screen size.

[1]: [https://www.usenix.org/conference/usenixsecurity15/technical...](https://www.usenix.org/conference/usenixsecurity15/technical- sessions)

[2]: [http://willus.com/k2pdfopt/](http://willus.com/k2pdfopt/)

</comment></comment><comment><USER13> Previous discussion (of an article about this) [https://news.ycombinator.com/item?id=9955180](https://news.ycombinator.com/item?id=9955180)

</comment><comment><USER14> Ridiculously impressive and extremely hard to shield against, baring using your computer in a faraday cage.

Thinking about it, is there any way to vary the electricity consumption of the computer as to transmit that way if it was in such a cage?

<comment><USER15> Computer enclosure and server rack manufacturers might have a new market for built-in Faraday cages.

<comment><USER16> TEMPEST hardened computer certainly isn't a new market, see e.g. [http://apitech.com/products/sn6730tf-tempest-laptop- notebook...](http://apitech.com/products/sn6730tf-tempest-laptop-notebook- computer)

It is however a very niche market. For server rooms, it's much cheaper to harden the room, which limits the market to desktop and notebooks...

<comment><USER10> Old is New Again meme. ;) True: rooms or safe's are best route. There's also more suppliers for that and more willing to work with non-defense customers. However, you've always been limited on desktop and notebooks in high security assessment given all the functionality (esp wireless) in them. There's just way too much risk. So, I recommended hardened thin- clients/monitor/keyboard/mouse plus key servers in a shielded room, no wireless anything, shielding of building from external signals where possible, and of course a lot of distance around the building. Costs quickly become an issue and most just don't do TEMPEST/EMSEC at all. Open season when the attacks get democratized. ;)

</comment></comment></comment></comment><comment><USER17> This is amazing, I don't think I would have ever thought of that. Of course, it's efficacy is a bit mitigated in that if you could manage to get malware onto such a computer, then there are likely easier ways to exfiltrate the data than presented in this paper. The POC model is nonetheless impressive.

This would be a great side project to play around with on an Arduino or something.

<comment><USER18> I wonder what easier ways to exfiltrate data do you see?

An air-gapped computer is likely devoid of any special radio-frequency hardware (no wi-fi or BT). Acoustic signals (via speaker or mechanical moving parts) and visible light signals (via the screen or various LEDs) are easy to notice.

OTOH a GSM frequency signal is not readily visible and also does not look like coming from a computer unless you look pretty hard; a signal at this frequency can be coming from a mobile device of a passer-by across the street.

<comment><USER17> I mean something simple, such as just using the usb itself or through social engineering to take data. If you can manage to load malware onto the computer, you can probably steal the data in a much easier way.

It's also much more efficient given the communication rate in the article is on the order of just bits/s. Of course, if you're looking for a steady stream of data over time, then this is probably the optimal solution.

<comment><USER19> The supply chain for the computer and the phones of nearby personnel is hackable, given a sufficiently resourced and un-savory-agency. Which gives you a nice datastream that didn't depend on anyone having done anything obviously stupid, and doesn't depend on social engineering to get usb sticks out of the facility.

</comment></comment></comment></comment><comment><USER20> Pretty impressive stuff.

Here I thought it was going to be related to the power-spike decryption that's been show before(and can be hardened against by balancing bits flipped).

</comment><comment><USER10> Ben Gurion is on a win streak in emanation attacks. Neat example with a common culprit: writings on TEMPEST said cellphones within meters of a STU-III telephone compromised it immediately with inadvertant, active attack. This is going in opposite direction with a known attack vector. A nice example of a "known unknown." That wireless devices, cellphones or SOC's, greatly increase risk in EMSEC is even more evident with this. Gotta stay banned in high- security organizations and that presents very tough tradeoffs along with supply chain issues in terms of SOC's. Identifying the hidden functions of SOC's (including analog/RF) is a cat-and-mouse game that rivals the brains that go into software attack and defense from what examples insiders gave me.

Far as EMSEC, I've pushed people in INFOSEC to consider it for a decade. I argued we should because (a) U.S. used such attacks since 1914 w/ Russia using them wisely in Cold War, (b) there's a sizeable industry on defense (TEMPEST) side, (c) most commercial/personal systems were massively vulnerable, and (d) research in possibly hostile countries continued. Supported even more by leaked NSA TAO catalog that features emanation attacks, including one (RAGEMASTER) that looks like my past work. All outside high-security said it was theoretical (despite use by Russia), no evidence/detection of any attacks (how would they lol?), or so rare as to be not important (again, measured how?). Took a while for it to really hit mainstream attention and I'm glad to see people in recent years are finally worrying about a 101-year old attack strategy (emanations).

Ben Gurion's results, past and present, support my case: a new cat-and-mouse game could form on pro side for stealing classified or trade secret information with emanation attacks. Declassified documents on TEMPEST history showed defenders had a _hard_ time for first decade even for passive attacks. The likes of NSA, Russia, Israel, and _maybe_ China are decades ahead of defenders with Israeli researchers innovating the most on attacks. NSA valued it so much, even against allies, that it once diluted its capabilities when sharing with UK and (IIRC) Canada to keep them behind (read: vulnerable).

My recommendation is that research-funding organizations in as many countries as possible start dropping money on their best E.E.'s to recreate those decades of research. Reducing the signal, shielding, masking... all of it for each component that's common in systems. Another easy route, which I used to recommend, was EMSEC safes or rooms with filters on cabling plus the myriad other leaks that crop up (even toilets lol). Seemed to be easier, but not easy, as there were more companies doing it than securing arbitrary equipment operating in the open. We do a ton of research until even our undergrads and amateurs can apply given techniques to solve the problems for boxes, safes, or rooms they own. Maybe. It's quite complicated...

Regardless, these attacks will only get better and for more parties. NSA et al long figured out it was best attack albeit required specialists and sometimes physical presence. Demanded they save it for high priority targets. Attacks with cellphones and interdiction, along with radios in COTS stuff, mean physical presence might not be an issue in future attacks. The game's heating up and defenders got a lot of catch-up to do. I suggest they start by studying the field of electromagnetic compatibility (EMC) [1], books on TEMPEST shielding [2], commercial sector [3], and declassified military documents on similar subjects (some in [4], esp Red-Black).

[1] [https://en.wikipedia.org/wiki/Electromagnetic_compatibility](https://en.wikipedia.org/wiki/Electromagnetic_compatibility)

[2] [http://www.amazon.com/Design-Shielded-Enclosures-Cost- Effect...](http://www.amazon.com/Design-Shielded-Enclosures-Cost-Effective- Methods/dp/0750672706) (An example. Generally, you want author to be TEMPEST certified or have strong background in EMC.)

Free book I just accidentally found on architectural shielding: [http://nashville.dyndns.org:800/YourFreeLibrary/Shielding/Ar...](http://nashville.dyndns.org:800/YourFreeLibrary/Shielding/ArchitecturalEMIshielding.pdf)

[3] [http://www.tempest-inc.com/](http://www.tempest-inc.com/) (Found this in my bookmarks. Think they were good and helped with self-tests, too. Been too long time, though, so memory is fuzzy & many firms are gone.)

[4] [http://www.jammed.com/~jwa/tempest.html](http://www.jammed.com/~jwa/tempest.html)

</comment><comment><USER21> Are we that surprised? I remember being blown away to read that a program could modulate a CPU to play music over an FM radio -- though whenever I google I'm not able to find that reference.

But are we that surprised that a cell phone has software-defined radio, or is extremely sensitive in the gigahertz frequency range? Or that a hacked baseband can listen to the cues from a memory bus in that range, and isolate some predefined pattern that is extremely distinguishable? Or that a memory bus can emit noise at those frequencies? Or that this can be controlled via software?

I mean, this isn't - "this web site can send a text message from any airgapped computer without a sim card, by modulating its CPU to broadcast to all cell phone towers. Using pure CSS."

If that were in javascript, if it didn't require a hacked or modified anything - now _that_ is the realm of science fiction :)

<comment><USER22> Well, of course none of these things are all particularly noteworthy _in isolation_. But it takes someone to put them all together into a working PoC.

On the Javascript part, they might very well be able to port this. Since any modern browser now JITs Javascript, it just becomes a matter of sculpting the JS to get the desired native code from the JIT.

<comment><USER21> I would be _extremely_ impressed with a javascript solution. The reader part of it boils down to: "Hacked baseband can discern two special PC memory access patterns from each other" \- which, if you're willing to transmit for long enough, is all it takes to exfiltrate.</comment></comment></comment>


Show HN: Swipe to delete done right in Android - <AUTHOR> https://github.com/BelkaLab/Swiperoo/ <comment><USER2> `done right`

does not explain in any way how this solution is pertinent

forces you to use inheritance

forces you to use RelativeLayout as root

yeah, right.

</comment><comment><USER3> Such a coool library</comment>


Pair Programming Considered Harmful - <AUTHOR> https://patrickbrown.engineer/essays/pair_programming.html <comment><USER2> An earlier version of this was posted 5 days ago at [https://news.ycombinator.com/item?id=15162530](https://news.ycombinator.com/item?id=15162530) . My comment from then still applies. I wrote the following three paragraphs.

This is a lightweight comment which draws from one published paper, a blog, and a NYT opinion piece. [This new version has 2 more references, but not to any research.]

Its sense of incredulity is no further advanced than the opposition to pair programming in the 1990s, when it was one of the practices promoted by XP. It does not, as I hoped, tie together the decades of research studies on the topic.

For a much more detailed summary of the topic, much more along the lines of what I wanted to read here, see the chapter by Laurie Williams on the topic in "Making Software: What Really Works, and Why We Believe It".

<comment><AUTHOR> I didn't realize my google doc was shared on hacker news :).

Can you summarize what is said by Laurie Williams?

<comment><USER2> No. Go to Google Books, look for the book, go to chapter on pair programming, page 311. You can read a decent amount as a preview.

As this is a topic you are interested in, you can ask your local library for a copy by InterLibrary Loan, assuming they don't have it already.

Not that I've read then, but a DDG search shows that some of her academic publications [https://collaboration.csc.ncsu.edu/laurie/pair.html](https://collaboration.csc.ncsu.edu/laurie/pair.html) and she is the co-author of [https://www.goodreads.com/book/show/1762375.Pair_Programming...](https://www.goodreads.com/book/show/1762375.Pair_Programming_Illuminated) .

<comment><AUTHOR> k

</comment></comment></comment></comment><comment><USER3> What inspired you to write this?</comment>


Nuclide: A unified IDE - <AUTHOR> http://nuclide.io/ <comment><USER2> This was discussed recently: [https://news.ycombinator.com/item?id=9273976](https://news.ycombinator.com/item?id=9273976). Has something major changed?</comment>


Rebuttal to "A hacker's loneliness" / Part II - <AUTHOR>

You guys realize that getting laid and writing good code and loving what you do are not mutually exclusive.
Just like how you taught yourself code, go learn to dress well. Learn how to be interesting. Learn to be the norm; there's no shame in that.
Talk about what you love. Have passion. It's really not that hard. <comment><USER2> Getting laid and being lonely aren't mutually exclusive either.

Don't learn how to be interesting, learn how to be _interested_. Don't learn to be the norm, learn to appreciate others.

Don't talk about what you love, ask about what _they_ love and share what you think might interest them. Discover _their_ passions.

If you want good company, you have to be good company.

</comment><comment><USER3> Having passion about your interests is a great thing, but it's important to be able to relate to other people, and monomania is often pretty insulating. Steve Buscemi's character Seymour in the movie Ghost World comes to mind: Enid asks him what his interests are, and after a bunch of buzzwords about musical categories that I don't remember, she says, "Ok, let's just say, 'music'. What else?"

I'm very interested in programming, but I also really like to cook, bicycling, and several other things, and find those are usually easier for people to relate to. Maybe you like to write, or skateboard, or you love paintball, or have a growing interest in photography, or something. An interest in programming and being able to have a social life are in no way contradictory. (Seemingly unrelated interests also tend to cross-pollinate.)

Also, let's _please_ not fill up the front page with rebuttals to rebuttals to rebuttals.

</comment><comment><USER4> Post this as a comment in the other rebuttal, it belongs there. And it's a good point.

</comment><comment><USER5> it is however hard to be the NORM and to be PASSIONATE.

the norm is the mean, its the center of a bell curve. it would be like running around and shouting, "i love to be human," but wait,... normal people don't do that. normal people are boring.

just understand that men have certain gifts, and women have certain gifts, and each person wants to you appreciate and notice those gifts.

girlfriends want to know that you are paying attention to you, they want to know they can be crazy around you and you wont freakout, they want to know there is something stable in their life. oddly enough women seem to rather not want help with things, but rather a good set of ears, and someone that they know they can rely on, when they don't feel like they need to be so strong.

the modern women is a feminist and yet is somehow still drawn to what men have to offer, even though they can't describe it. they are strong and independent, and they seek to share an emotional tide with someone.

and most of all, they want a guy they can brag about to their friends. so, every once and a while you need to give them something to talk about.

</comment><comment><USER6> You guys realize that human beings are social animals and any time an obsession with anything prevents you from participating an a common human activity there's going to be problems?

</comment><comment><USER7> Wow. Is this what some people sit around thinking about?

Personally, I just "do me". The rest seems to fall into place. But that could be due to the fact I'm awesome.

</comment><comment><USER8> You walk the walk, but do you talk the talk?

<comment><USER9> yes, actually he does.</comment></comment>


Ask HN: Would you sell your startup for equity to another startup? - <AUTHOR>

<comment><USER2> That depends. If I feel like I've accomplished all I need (or really wanted) to accomplish with the first startup and I'm excited to start another one, then there's no reason not to. Besides, you can probably make more money in the sale than you would need to get the next one off the ground.

<comment><AUTHOR> I was asking about selling your company for equity share of another company. Not cash sale.</comment></comment>


Teenager invents vehicular antitheft system - <AUTHOR> http://www.hackaday.com/2008/07/30/teenager-invents-vehicular-antitheft-system/ <comment><USER2> Theres a funny story of a mac laptop owner that set the built in camera to record frames, so that when it was stolen he actually got some pictures taken of the crook flipping it open. Similarly maybe this system should be wifi based, as a small embedded computer, so that whenever it is in range you can interact with it.

For SMS messaging it he uses a go-phone that might be reasonable because I don't like the idea of devoting a SIM card and a regular mobile subscription for this.

</comment><comment><USER3> Seems way a little bit complicated, I still prefer the kill switch option. Costs you like 3 bucks for a switch from radio shack and some spare wire you have at home, and bam noone can steal it w/o knowing where the switch is.

</comment><comment><USER4> Sounds like a good candidate for Ycombinator Africa edition.

</comment><comment><USER5> Cool. He made onstar in his spare time. Nice hack indeed.

As a side note, I really don't want onstar to add the ability to turn off the ignition remotely!

</comment><comment><USER6> God willing, one day cell carriers will be open enough to do this hack without needing a cellphone.

</comment><comment><USER7> From the comments - "..can it shut down a _lion_ remotely? thats seems more usefule in Kenya."

Reading that made the whole story worthwhile. :)

</comment><comment><USER8> Interesting concern: What if some malicious hacker breaks the anti-theft system and starts sending it arbitrary commands?

Just a thought. Still, very nice idea.</comment>


The tech niusances that annoy us most - <AUTHOR> http://www.wsj.com/articles/the-12-tech-nuisances-that-annoy-us-most-1426009886?mod=WSJ_hp_RightTopStories

<comment><AUTHOR> For once, the comments are also worth your time - this is about as good a collection of pain points as you'll find.</comment>


U.S. Push for Free Online Courses - <AUTHOR> http://www.insidehighered.com/news/2009/06/29/ccplan <comment><USER2> Seems more of a pull than a push. Time for public education to play catch up. I just wish my school would have been willing to put courses on the CMS I built.

</comment><comment><USER3> So what is actually missing from these discussions of "Just do everything online" is serious talk about pedagogical results. I don't know what studies are out there on this but I think it's interesting that proponents don't make that first thing they present.</comment>


Ask HN: Smallest blockchain? - <AUTHOR> Are there any cryptocurrencies that focus on small blockchain size? For example bitcoin's blockchain is more than 100GB this might be a bit too large for someone who only has say a 256GB hard-drive. Are there any cryptocurrencies that focus on having the most space efficient blockchain? Say, maybe a few GB? <comment><USER2> The MimbleWimble design [1] allows inputs to be cancelled against the outputs they spend, with no loss of security. Essentially, the entire blockchain history may be collapsed to a single mega transaction, with all coinbases as inputs and the UTXO set as outputs. In his recent talk [2], Andrew Poelstra discusses the achievable savings relative to the bitcoin blockchain.

[1] [http://mimblewimble.cash/20160719-OriginalWhitePaper.txt](http://mimblewimble.cash/20160719-OriginalWhitePaper.txt)

[2] [https://www.youtube.com/watch?v=ovCBT1gyk9c](https://www.youtube.com/watch?v=ovCBT1gyk9c)

</comment><comment><USER3> They don't need to 'focus' on that, since there are various strategies to achieve it without redesigning the blockchain as a whole. For example, there are light clients [1] you can run which only download part of the blockchain and still provide some guarantees.

[1]: [https://github.com/ethereum/wiki/wiki/Light-client- protocol](https://github.com/ethereum/wiki/wiki/Light-client-protocol)

<comment><AUTHOR> The only problem I have with a light client is the fact that it is nigh to the impossible to do any sort of mining at all.

<comment><USER4> I'm curious, why is it impossible? I don't know much about mining.

</comment></comment></comment><comment><USER5> The hole raiblock is 1.7g for 5millions + transactions</comment>


How coding boot camps are filling the talent gap - <AUTHOR> http://www.macleans.ca/work/jobs/how-coding-boot-camps-are-filling-the-talent-gap/ <comment><USER2> I have this theory that coding boot camps are an attempt at further increasing the wage gap. Globalization has brought down developer prices, but the quality dropped too far below what was needed.

How can we reduce costs without having to pay market rates? We'll hire someone with less experience than a college graduate in the field of web development!

Since most websites are nothing that difficult to implement, we can offer courses on teaching people basically how to build these apps, and then hire them at these companies! The employee is happy to be making more than they were (which was either nothing because their previous job has become irrelevant or less because the floor for software development is so high), and the employer is happy to be employing cheap labor.

My guess is the net effect can only be negative. If the business scales, it will need more talented engineers to help with that scale, and either keep these boot camp engineers to do the simple tasks or fire them for failing to continue to provide value. Or the business can't scale because the developers aren't talented enough to scale these apps, and they can't hire talented engineers because they refuse to pay market rates for quality workers. The third scenario I see is that it becomes a Mythical Man-month problem, where companies just decide that high quality engineers at these types of businesses simply aren't worth it, and would rather have a cadre of low cost boot campers, making the demand for quality software engineers drop, save for a few specialized roles.

<comment><USER3> I think the demand for quality software devs is honestly an illusion born out of the mysticism that surrounds tech for much of the older generation. When all systems involving tech map to ~magic~ you end up with highly educated people being highly paid to do work that honestly could be done by nearly any layperson with enough practice. There will likely be some turmoil as ratios of full engineer to effective technician get sorted out but I feel like the end result is not necessarily negative. Odds are that those people with technically fulfilling jobs have little to worry about. The rest of us probably should polish those resumes because the days of six figures to do simple dev work are coming to an end.

</comment></comment><comment><USER3> With the caveat that I don't have any person experience with the situation in Canada, I get immediately suspicious of any article that talks to a "talent gap". At least in the states, it's not hard to find a developer. What is hard however, is finding a developer that wants to code your uninspired CRUD app at below market rates and I that's the issue these bootcamps tend to address.

<comment><USER4> in the land of the blind, the one-eyed man is king How much time can a man invest in learning a really complex stuff so he can work on compilers, creating programming languages or implementing extraordinary search algorithms. And who will pay for that ?

That is the downside of capitalism.

Just take a look at what happened to Oracle when the most brilliant engineers left after they acquired Sun Microsystems. They literally could not find anyone for ages to replace these people just because there is not enough talent out there.

And that's Oracle. Who else is there that can afford to pay these people ? Google ? Maybe. Netflix ? aye IBM ? likely And maybe few dozens of other corporations.

But these people do not want to work for corporations instead they need to be treated as special unicorns.</comment></comment>