Photographer Suing Getty Images for $1B - <AUTHOR> http://petapixel.com/2016/07/27/photographer-suing-getty-images-1-billion/ <comment><USER2> Using some examples from the comments of the article:

It's akin to Getty setting up a small tent inside of Central Park, and asking people that walk by to pay an entry fee.

But Getty goes 1 step further: They hire strongarm guys to go around the park and tell people (one-on-one) that they skipped out on their 5 dollar entry fee and they can 'settle' with them right now or be taken to court.

It's terrible.

I can't imagine how to solve that without a total change of copyright laws, other than scare the bejesus out of them. Which seems to be exactly what the photographer is doing.

<comment><USER3> Don't know why this needs an analogy at all.

Getty [allegedly] took images that didn't necessarily belong to them, charged for them, and also sent copyright notices after anyone that hadn't paid for them.

It's pretty simple. edit: allegedly

<comment><USER4> The issue isn't really with Getty charging for those images. If they're in the public domain, then (as I understand it) the photographer has relinquished her copyright on the images. It's perfectly legal for other people to make money with them in that case, but that doesn't mean those other people own the copyright.

I think the issue comes into play when Getty tries to _enforce a copyright they don 't actually own_ by threatening people who use the images. That's where they've crossed a line, and I'm fairly confident that if Getty tried to sue anyone over it, the courts would decide in favor of the defendants. Of course, just defending oneself in court against someone like Getty could get expensive, so it's obviously better if the issue could be sorted out preemptively (as this photographer seems to be doing).

<comment><USER5> From other sources, she licensed them for free use with attribution, she didn't abandon the copyright.

<comment><USER4> If that's true, then either the Library of Congress didn't get the memo (they very clearly specify that it's in the public domain), or this is somehow a case where "public domain" means something different from the standard definition.

<comment><USER5> It's possible they mislabeled it, but one would think they were still on the hook if they sent any DMCA notices, as they should not have any reason to believe that they were the copyright holders or in any way authorized to sue for "infringement" of the works... particularly when sending notices to the _actual_ copyright holder.

</comment></comment></comment></comment></comment></comment><comment><USER6> Read the court filing. She can win this.

She owns the rights to the images. She licensed the Library of Congress to distribute them for free, but did not release them into the public domain.

Getty is selling her images. That's a for-profit DMCA violation. The statutory penalty applies, which is from $750 per image to $30,000 per image. She makes a case that the higher end of the scale should apply, because some of her images are quite famous. Two have appeared on US stamps, for example.

Getty recently lost a DMCA case for doing something similar. That makes this a second offense and triggers the triple damages provision in the DMCA. So, as a matter of law, she is entitled to at least 18,755 * $750 * 3, or about $42 million. That's a minimum.

<comment><USER4> > ...did not release them into the public domain

This is incorrect. According to the Library of Congress:

"Ms. Highsmith has stipulated that her photographs are in the public domain." [1]

[1] [http://www.loc.gov/rr/print/res/482_high.html](http://www.loc.gov/rr/print/res/482_high.html)

<comment><USER7> It's not possible to renounce copyrights in the US; they're inalienable rights. The only way to get something in the public domain is for the copyright term to pass... and even then there are problems (see the Sherlock Holmes saga).

<comment><USER8> I don't think this is actually true. Can you cite any sources referring to copyright as inalienable in the US?

<comment><USER7> My bad. In the first place, what I meant is that you can't give up copyright - you can't say "this work is in the public domain". (Or rather, you can, but there's nothing legally preventing you from saying a year later "I changed my mind".) See [http://www.rosenlaw.com/lj16.htm](http://www.rosenlaw.com/lj16.htm)

However, "inalienable" was incorrect - you can most definitely _sell_ your copyright.

Second, apparently I was wrong even then: see [https://cr.yp.to/publicdomain.html](https://cr.yp.to/publicdomain.html)

Face, meet egg.

<comment><USER9> just to clarify because i think you sort of said you were wrong but i'm not entirely sure...

if i read 17 U.S. Code § 201 (d) clearly, it suggests you can transfer ownership of copyright in any normal legal way of executing a contract.

I think your confusion is around the idea of works _falling_ into the public domain via expiry of copyright, and/or works that do not have an explicit declaration of rights ownership.

In this case it seems she was pretty clear about her transfer of ownership. I don't believe you can rescind that just as you prefer, at any time.

see [https://www.law.cornell.edu/uscode/text/17/201](https://www.law.cornell.edu/uscode/text/17/201)

</comment></comment></comment></comment></comment></comment><comment><USER10> While $1B seems excessive, and more of a number to make a point, it does seem outrageously egregious to send her a bill for her own photo on her own website that she donated for public use.

It would be like coming home to find a naked vagrant sitting on your couch, demanding that you pay him rent.

<comment><USER11> It's likely that Getty have also fraudulently charged many other customers licenses for these photos. It's not inconceivable that each of them could individually sue Getty for their own damages. This looks like it could become a very expensive case of sloppy (or deliberately negligent) copyright overreach.

<comment><USER12> Nit: by definition, negligence can't be deliberate.

Edit: "negligence" means you should have known of the risk. "Recklessness" means you knew of the risk but acted anyway.

<comment><USER13> > Edit: "negligence" means you should have known of the risk. "Recklessness" > means you knew of the risk but acted anyway.

No, "negligence", in law, means you failed to act according to the duty of care you owed, which can include knowing about a risk but failing to act reasonably to mitigate it as much as it can include not knowing about a risk that one reasonably should have known about.

Negligence and recklessness are not mutually exclusive

<comment><USER12> I'm not sure which law school taught you that, but it's just wrong. Here's a law review article that discusses the differences in mental state between negligence and recklessness: [http://scholarship.law.duke.edu/cgi/viewcontent.cgi?article=...](http://scholarship.law.duke.edu/cgi/viewcontent.cgi?article=1561&context=dlj)

<comment><USER14> Negligence is a stand-alone tort/cause of action in civil litigation, as well as a qualifier for intention-based infractions in criminal law. The two meanings to the term are connected, but do not overlap 1:1.

The poster above you is correct as to the test for negligence in civil causes of action.

The likely cause of this mix-up is that false-licensing touches upon the law of misrepresentation, which contains as a subset, rules for both fraudulent misrepresentation as well as negligent misrepresentation.

</comment></comment></comment></comment></comment></comment><comment><USER15> Ars has some good coverage of this as well: [http://arstechnica.com/tech- policy/2016/07/photographer-sues...](http://arstechnica.com/tech- policy/2016/07/photographer-sues-getty-images-for-selling-photos-she-donated- to-public/)

> Lochting also underscored that LCS and Getty Images are "separate entities > and have no operational relationship."

> However, DNS records show that LCS' listed address is 605 5th Avenue South, > Suite 400 Seattle, Washington, which is Getty Images' corporate address, a > fact that she would not explain to Ars.

> "It's a no comment in response to your follow up questions," Lochting > e-mailed.

</comment><comment><USER16> I'm seeing lots of analogies here, but are they really necessary? A rights company notorious for fiercely defending its own copyrights flagrantly violates those of a photographer, appropriating and then aggressively defending illegitimate copyright over her work. Is this not a straightforward enough situation to explain without the overhead of analogy-making?

</comment><comment><USER17> This is beyond shameless but I'm not surprised that this happens. Big players of copyright seems be doing this sort of thing all the time and getting away with it.

This comes from the same mindset that allow a original video by the author to be put off youtube by a big studio.

I think I read that big recording studios similarly uses lesser known artists songs in records under some weird law (pretending they couldn't find the copyright holder) and basically strongarm them if they come out and complaint. Does anyone know if its true and provide reference?

Essentially the legal system worldover is extremely for the power broker. The ones who needs the least protection gets the most and those that need it in most cases cannot even afford the least.

<comment><USER18> Yes. This is becoming ever-more-salient as large portions of the programming that airs on multi-national news organizations comprises original content posted to social media and owned by the user that originally authored it. Just in the last month we have Nice, Dallas, and Turkey, where it felt like all the news orgs were doing was reading tweets and playing back 60-second clips that people were posting online.

On the one hand, news orgs probably have a reasonable fair use case there, but on the other, they _are_ profiting off content that the OP owns, and OP is rightly entitled to a portion of that evening's advertising proceeds if their content comprises a substantial part of the programming.

If someone snippeted CNN and played it repeatedly on their own channel as fair use, they'd get pursued hard, be unable to fund the legal battle, and be forced to do whatever CNN said lest a long and ruinous legal battle occur with spotty if any representation for the little guy. It'd a big multi-national law firm that bills at $1k/hr v. an innocent little person who probably doesn't know any legal terms at all and would be lucky to have $10k in savings.

Meanwhile, CNN and other large companies will openly trounce anyone and everyone they can because they understand that only a tiny fraction will actually be in a position to hurt them for it, and they'll try to leave that tiny fraction alone if they can help it. You'll try to sue them for an injustice and for the $20k they owe you and it'll explode into an 8-year, multi-million legal battle. The little guy _still_ gets completely screwed over. Since big companies know this, they take full advantage and effectively, operate under a different set of laws from the rest of us.

The easy way to mitigate this specific problem wrt copyrights is to reform copyright law so that we no longer divert a grossly disproportionate amount of money into content companies and so that they don't file lawsuits that there is no hope of winning, but it doesn't really solve the larger issue, which is that the legal system is only really available and functional for those with the capacity to spend $10 million on lawyers at any given time. Unfortunately, it doesn't seem that we're going to resolve that during the lifetime of anyone currently living.

</comment></comment><comment><USER19> Isn't the problem here that she donated all her photos to the Library of Congress without clarifying what that meant? Apparently, the LoC thought that the photos were placed in the public domain, and the photographer thought she was retaining the copyrights.

Also, why the hell is Getty charging for public domain photos? Are they not aware that people can use those without paying Getty?

<comment><USER20> Perfectly legal to charge for public domain photos, just as it is legal to charge for software that's released under open source licenses, so long as you follow the terms of the license.

People are lazy and will pay money so they don't have to think about licensing. If you are a graphic designer working in an ad agency and you have a choice between "go online and download a PD work and not be sure" and "pay Getty $50 and if there's a copyright issue, you can tell your boss that you paid Getty", which do you do? Pop it on the corporate credit card is the easier option.

It's the same reason big companies were suspicious of open source for a long time. And some still are.

<comment><USER21> Is it legal to charge for public domain photos, if you mislead the person who is charged to believe that the photos are not public domain?

I guess this depends on local legislation, but in most jurisdictions, I think this would be called fraud.

<comment><USER18> It's legal to charge for public domain content. It's not legal to misrepresent your wares to the buyer (fraud, as you said). There is no duty to inform buyers that the thing you're selling is available for free somewhere else, but when you're going around and demanding royalties from people using something that's PD and claiming to have an exclusive right to licensing the image, it's a different ball game.

So yeah, just selling it on their website is probably fine, but extorting money out of people who have equal right to use the image is probably not.

</comment></comment></comment></comment><comment><USER22> A lot of people here seem to be taking issue with the fact that the photographer donated her works to the Library of Congress. As it happens, she's apparently bringing the case under the DMCA's provision for false attribution of copyright, and has addressed the issue of donation in the brief. Good luck to her.

</comment><comment><USER23> Looking at the actual legal filing[0] it seems that the relevant section is 35:

      35. Since approximately 1988, Ms. Highsmith has made her photographs available to
      the public for free through the U.S. Library of Congress, thereby exercising her exclusive rights
      under 17 U.S.C. § 106 to distribute copies of her copyrighted work to the public by sale or other
      transfer of ownership, and to authorize others to do so

Now looking at what 17 U.S.C. § 106 says[1], it appears that they are claiming that she did not transfer her copyright over to the Library of Congress to put the works in the public domain, but merely provided the library of congress with the right to distribute copies of the work to the public.

(Not a lawyer).

[0] [http://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?articl...](http://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=2249&context=historical)

[1] [https://www.law.cornell.edu/uscode/text/17/106](https://www.law.cornell.edu/uscode/text/17/106)

<comment><USER24> > did not transfer her copyright over to the Library of Congress to put the > works in the public domain

This isn't a thing. There's no well-defined mechanism by which that could be done.

</comment></comment><comment><USER25> I will just point out that the two statements that "the photos are in the public domain" and "she never abandoned her photo copyrights" are not in opposition.

Orphaned works (abandoned copyright) can be subject to re-copyrighting by another party from what my laymen's understanding of copyright law is.

Instead she specifically stipulated that these photos are in the public domain and so Getty is obviously operating under bad-faith principles.

<comment><USER26> Yes, those two statements are in direct opposition. A work in public domain has no copyright. If she kept the copyright, the works are not in public domain.

<comment><USER25> Abandoning copyright is different than assigning the works to the public domain from what I know.

One is an explicit act (moving works into the public domain) and the other is simply a sin of omission.

</comment></comment></comment><comment><USER27> >she found out about Getty Images charging for her photos when she was sent a letter from Getty that demanded she pay for her own photo that was being displayed on her own website

Such insolence should be punished hard.

</comment><comment><USER2> The fact that their internal processes show total indifference as to whether a photo is sourced from Public Domain or any other source speaks volumes about their attitudes re: the art they sell; and from the top of the company down.

It shows their #1 priority was collecting as many pieces of work as they could, and their #2 effort was reinforcing their payment system (a la threats if you don't pay).

No where in that equation was the artist, the art itself, or any related interests. They only cared about being the middleman and acted like it.

</comment><comment><USER28> If CloudFlare hates you, here's an archived copy:

[https://archive.is/Bmpg4](https://archive.is/Bmpg4)

</comment><comment><USER29> People working at Getty and blindly sending cease-and-desist letters should be fired at once. These guys are similar to debt collectors and harassment is their virtue. They could have at least spend sometime time researching about her. Maybe Getty would have been $1 Billion richer today. She should be compensated for something at least.

</comment><comment><USER30> Honestly, I hope she wins, and then donates a huge chunk of it to some worthy cause just to further piss on Getty.

It's okay that Getty lists high quality images that are public domain or restriction free as part of their search engine, but it is beyond ethically wrong to charge money for them.

<comment><USER26> Why is it unethical to charge for public domain images? I'm not saying this is what happened here, but there are many reasons to charge for public domain images, and for someone to pay. One big reason is for proof they are public domain. If my business was using images, I would want to make sure I have the right to republish those images. Even if that means I have to pay for public domain images. Getty is providing a service and they are charging for it. Sure, perhaps you can go elsewhere to get those same images for free... Then you should do so if you don't want to pay the fee. But there is nothing unethical about charging for public domain images... Now sueing people because they didn't not pay you for those images is wrong. The federal good government needs to get involved in this as well.

</comment></comment><comment><USER31> Maybe someone should analyze all other images hosted by Getty to find other infringements...

</comment><comment><USER32> > public domain

> but are falsely and fraudulently holding themselves out as the exclusive > copyright owner (and suing others)

So the federal government should be suing them instead of the photographer? It doesn't seem like the copyright office has its own enforcement agency, so it probably would be up to the photographer to start a proceeding, since nobody else will.

This makes her attempt to get copyright damages to be a red herring which could undermine her entire case.

Therefore, I realize she has no claims, except the single one where Getty tried to sue her for using her own public domain images.

<comment><USER24> No, the images are not actually public domain. She owns the copyright and Getty have infringed her copyright thousands of times. She has many big claims.

</comment></comment><comment><USER33> My goodness gracious, I hope she wins and helps inform other Copyright-based individual professionals of the avenues that are available when one's work is being exploited in ways that aren't legal (the whole "pay us a penalty" aspect here, not the selling Public Domain stuff which is okay). Good for her. Will stay tuned to see how this plays out.

</comment><comment><USER34> There's a story about Deep Purple getting similar demands for their concert in Russia in 2008. They went to court...and lost. [1]

[1] [http://bravewords.com/news/deep-purple-ordered-to-pay- royalt...](http://bravewords.com/news/deep-purple-ordered-to-pay-royalty-to- themselves-in-russia)

</comment><comment><USER35> A google search returned this PDF as the actual court filing:

[http://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?articl...](http://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=2249&context=historical)

<comment><USER36> This is interesting in there:

Getty was found by this Court to have violated 17 U.S.C. § 1202 within the last 3 years, and ordered to pay over $1 million in damages.

Because Getty has already had a final judgment entered against it by this Court under 17 U.S.C. § 1202 in the past three years, this Court may treble the statutory damages in this case against Getty.

</comment></comment><comment><USER37> I believe this is why the Creative-Commons license was created. It stipulates how others can use your free-to-use intellectual property.

</comment><comment><USER38> So the library of congress says they're public domain. If they're public domain are you not free to sell copies of them? Such as how you can sell copies of famous paintings or copies of Firefox for that matter.

If they're not actually public domain shouldn't she be suing the library of congress for misrepresenting the license?

Yes, if they're public domain Getty shouldn't be trying to enforce ownership but that seems their only misdeed.

<comment><USER10> You might be able to sell prints, but you can't sell the rights to display those prints. You certainly can't come into people's homes and demand that they pay you for a copy you got from the Library itself.

<comment><USER39> I think you can, if you generate a derivative work. And I would bet that could be something as insignificant as color correction of the image.

<comment><USER40> Pretty sure that doesn't qualify as a derivative work. Changes must be substantive. Otherwise correcting a typo in a book would give you a copyright for that correction, preventing others (including the original publisher) from making the same correction.

Moreover, the photographer here certainly didn't use any "derivative" from Getty. So even if Getty could claim copyright on their "derivative", they cannot justly claim copyright over the original.</comment></comment></comment></comment>


How to explain RSS the Oprah way - <AUTHOR> http://cravingideas.blogs.com/backinskinnyjeans/2006/09/how_to_explain_.html <comment><USER2> IMHO the main reason we're usually getting RSS wrong is that we even mention the word RSS.

We need people to be unaware of RSS in the same way they are unaware of HTML. People don't use "HTML Readers", they just browse stuff online. An RSS based app should simply do something useful. The fact RSS is involved should be completely irrelevant to users.</comment>


Apple sues HTC - <AUTHOR> http://www.telegraph.co.uk/technology/apple/7353896/Apple-sues-HTC.html

<comment><USER2> Did you really need to post this story 5 times from 5 different sources?

<http://news.ycombinator.com/item?id=1162941> <http://news.ycombinator.com/item?id=1162940> <http://news.ycombinator.com/item?id=1162937> <http://news.ycombinator.com/item?id=1162936> <http://news.ycombinator.com/item?id=1162930>

Edit: make that 6. <http://news.ycombinator.com/item?id=1162925> Edit: 7: <http://news.ycombinator.com/item?id=1162947>

Anyone moderating this: is there even a rule against this?</comment>


Intel converts ET: Quake Wars to ray-tracing - <AUTHOR> http://www.tgdaily.com/html_tmp/content-view-37925-113.html

<comment><USER3> This is good stuff. I really hope raytracing starts taking off. Current GPUs are blazing fast at heavily pipelined rasterising, but that particular model of rendering is incredibly awkward. Most effects have to be "truncated" because every level of indirection incurs a huge cost: you can only render to texture, use the result to render to another texture, etc. so many times - <USER2> latency kills you and you're often wasting cycles repeating the same calculation over and over. Complexity increases disproportionately with every added effect.

There's been some success with getting ray tracing working on current GPUs, but it's pretty inefficient due to the architectual assumptions. A large number of simple CPU cores with their own decoding units (as opposed to GPU cores, which run in lock-step in groups) are much more convenient for ray- tracing. Intel may well be on the right track here.

I doubt nVidia has been sleeping though, and AMD are known to be working on a GPU/CPU fusion project...

It wouldn't surprise me if the next PlayStation had hardware support for ray- tracing instead of a classical CPU. Of course, we'll have to wait a while for that. Microsoft won't do it because they have too much invested in Direct3D, and Nintendo, uh... yeah. I don't think so.</comment>


How we commoditized GPUs for Kubernetes - <AUTHOR> https://medium.com/intuitionmachine/how-we-commoditized-gpus-for-kubernetes-7131f3e9231f <comment><USER2> Current discussion, [https://news.ycombinator.com/item?id=14137961](https://news.ycombinator.com/item?id=14137961)</comment>


Show HN: Vimalin - Backup VMware Fusion VMs, even when they are still running - <AUTHOR> https://www.vimalin.com/show-case/backup-your-vmware-fusion-vms-even-when-they-are-still-running/ <comment><USER2> Looks cool, but I do not own a mac.

Have you thought about building this for VMware Workstation?

<comment><AUTHOR> Hi, thanks for the question.

This is the most common question I get whenever I introduce Vimalin. "Where's the Windows version?"

It is not there yet, but this is something that I am actively working on and hope to have ready for a beta soon.</comment></comment>


Reddit is down; tells me to disable adblock - <AUTHOR> https://www.reddit.com/ <comment><USER2> If I had to guess, they're in the process of restoring a database backup and warming up the caches. It looks to me like the front page just regressed by a few hours, but the front page is up for me intermittently on old.reddit.com

<comment><AUTHOR> Luckily it's just a website, not the _front page of the internet_.

</comment></comment><comment><AUTHOR> The error rate is spiking while the request rate has plummeted, however reddit status page says it's operational [1]. Also, it's telling me to disable adblock:

> It looks like one or more software blocking extensions you are using may be > interfering with Reddit's ability to serve you content. Please try disabling > them or changing the rules you use.

If I disable the adblocker, I get a generic error anyway. My console shows `Gateway Timeout`:

> error before Error: "Gateway Timeout"

[1] [https://reddit.statuspage.io/](https://reddit.statuspage.io/)

</comment><comment><USER3> It's not coming up for me - I get the "all of our servers are busy right now" message. I am not using any kind of blocker.

</comment><comment><USER4> Search seemed to fail a bit ago on the old.reddit.com and now it's just not returning anything useful.

</comment><comment><USER5> Sam here.</comment>


People's racist Facebook comments are ending up on billboards near their homes - <AUTHOR> http://finance.yahoo.com/news/peoples-racist-facebook-comments-ending-234400980.html <comment><USER2> This might* backfire. I can just imagine the race among immature teenagers to say the most offensive things they can dream up in hopes of getting their words on a nearby billboard.

This campaign follows the same format as many promotions asking you to tweet about product X, with the best tweets going up in Times Square. The goal of course, being to make more tweets about product X.

*by might, I mean will

<comment><USER3> See also (in the other direction?): #mynypd

[https://www.washingtonpost.com/news/post- nation/wp/2014/04/2...](https://www.washingtonpost.com/news/post- nation/wp/2014/04/22/well-the-mynypd-hashtag-sure-backfired-quickly/)

</comment></comment><comment><USER4> So you're giving attention seekers (read, a lot of trolls) a way to get even more attention for saying the most horrible things they can think of.

Why do I get the feeling this isn't going to work well? Seems like a pretty good marketing strategy actually, especially if your product/service relates to freedom of speech, censorship, harassment or something else and you can stick a link in at the end of the tweet.

I also wonder how the hell they try and verify where anyone actually lives, given the existence of proxies and other such devices. Seems like it could be very easily 'abused' to frame someone else, especially if you know it could cause a falling out between them and someone they're close to.

And on a funnier note... good deal for bilboard owners. Flame the hell out of people on Twitter, then jack the prices up a few hundred times and watch a charity pay to put your angry messages up in the street...

</comment><comment><USER5> > _" We omit names and faces of the authors because we have no intention of > exposing anyone._

The big reason you shouldn't publish names and faces (even if you otherwise _want_ to) is because you have not verified their authenticity; you can be gamed into acting as the unwitting tool in some smear campaign whereby an innocent victim is made to look like a racist.

<comment><AUTHOR> Exactly, naming names carries a huge legal risk.

</comment></comment><comment><USER6> "We omit names and faces of the authors because we have no intention of exposing anyone. We just want to educate people so that in future they think about the consequences before posting racist comments,"

This is always the same thing, educating people, make them realize that comments have consequences, etc. But, at the end of the day, does it ever work? I mean if someone makes racist comments that's because they're racist, they're racist in a world where racism is daily condemned, how can a billboard change that?

All these campaigns against racism, domestic violence, etc. Do they ever yield any result?

<comment><USER7> I wish they wouldn't blur the images.

<comment><USER8> Which you posted from a pseudonymous throwaway account. Classy.

<comment><USER3> That isn't logically inconsistent, i.e. "if you don't want things associated with your name forever, don't put them on the internet under your name". If someone posts racist bile under a pseudonym, it also won't be associated with his or her name.

kazinator's comment is the real issue with that idea, I think.</comment></comment></comment></comment>


Google takes on Yubico and builds its own hardware security keys - <AUTHOR> https://techcrunch.com/2018/07/25/google-takes-on-yubico-and-builds-its-own-hardware-security-keys/ <comment><USER2> Wouldn't say they are taking on Yubico. This is all based on the same standards. Looks like they got a much better price from a Chinese manufacturer (Feitian). Hope they are programming the firmware outside of China though, otherwise I'm not going to trust it.</comment>


Spotify CEO Daniel Ek Was Taunted by Steve Jobs with Mystery Phone Calls - sahin-boydas https://9to5mac.com/2019/07/24/steve-jobs-spotify/ <comment><AUTHOR> This title is different than the article, and seems to imply as fact what is merely an unverified claim in the book.

Title: "'Spotify Untold' book claims CEO Daniel Ek was taunted by Steve Jobs with mystery phone calls"

In the article: "As stress sets in, Ek becomes convinced that Apple's Steve Jobs is calling his phone just to breathe deeply on the other end of the line, he purportedly confesses to a colleague. ..... We [the authors] have that from a trusted source. Whether Steve Jobs actually called Daniel Ek is something we can't verify. To us, Ek's claim is as a reflection of how paranoid and anxious he must have felt ..."

"Daniel Ek declined to speak to them as they wrote the book" (so authors were going on second-hand accounts from Spotify executives and investors)</comment>


In short the US has no clue where Snowden is. - <AUTHOR>

With all their PRISM tech the US cannot find Snowden which is clear from the Bolivian incident. <comment><USER2> India has rejected NSA leaker Edward Snowden's request for political asylum, the External Affairs Ministry said Tuesday. [http://www.wral.com/india-turns- down-nsa-leaker-s-asylum-req...](http://www.wral.com/india-turns-down-nsa- leaker-s-asylum-request/12618307/)

<comment><USER3> It looks as if he is on the run for shelter now-a-days and there's not a single country thinks he has done a great job keeping with interest to business in the US

<comment><USER2> Thats what the whole thing is about but i think he will get a shelter

</comment></comment></comment><comment><USER4> Let's hope it stays that way.</comment>


Markdown in HTML - <AUTHOR> https://gist.github.com/1343518 <comment><USER2> By my opinion markdown sux..

I'd rather write in pure html.

Markdown is irrational, unhandly thing.

The only reason to use it in projects is to make life easier for developer and avoid using wysywyg and html sanitising..

But for me as for end user (wikipedia, googlecode.. other shitty editors..) it is incredible headache..</comment>


FDA authorizes two-minute testing kit to detect coronavirus - <AUTHOR> https://www.axios.com/fda-coronavirus-two-minute-testing-kit-bodysphere-a665429d-488d-4edf-bd36-9180e2a06e4c.html <comment><USER2> > The Bodysphere two-minute test can only detect the coronavirus in people who > have had the infection for several days...

When the virus is killing in a matter of several days, how is this useful? Are we only interested in tests that will get people "back to work", not preventing deaths?

Honestly asking because I don't understand the severe lack of proactive testing in the US.

<comment><USER3> This would allow effective contact tracing when we get cases down to a manageable level. One positive case is enough to catch an entire group of possibly infected persons. This will probably have the most effect after we have already reduced cases through social distancing by preventing the re- ignition of a second pandemic.

<comment><USER2> Thanks for the explanation - Let's hope we come up with a way to do effective contact tracing, too.</comment></comment></comment>


New York Builder Sues Amazon for $25M - <AUTHOR> http://www.forbes.com/sites/ryanmac/2015/01/12/new-york-builder-sues-amazon-for-25-million-and-reveals-retailers-new-york-plans/

<comment><USER2> I don't think we will ever see a traditional brick and mortar Amazon store. It goes against everything Amazon has accomplished online. If anything you might see some smaller warehouses for order pickup but not a brick and mortar store.</comment>


Dadamachines Doppler: FPGA open music hardware - <AUTHOR> https://cdm.link/2019/03/dadamachines-doppler-fpga-open-music-hardware/ <comment><USER2> This is cool, but I question that the addition of a FPGA will really make that much of a difference to make it stand out against the other products on the market that can do realtime DSP, except maybe for battery-operated devices (where maybe the FPGA can be more power-efficient than a general-purpose CPU?)

I would have expected the raspberry pi 3 to meet most needs for this market. Quad cores clocked at > 1GHz, USB ports for connecting a controller, analog audio out (or SPI/I2C to a better DAC if you're not happy with the quality), and even HDMI if you want to drive a display, or MIPI for embedded displays.

Is it not easy to drive headless, and that's why developers need a different device for this? Or does the FPGA really unlock that much extra possibilities beyond what a quad-core, 1.2 GHz ARM SoC w/ a neon fpu can achieve? Or is there a demand for lower-power devices than the rpi for audio processing? Or am I missing something else entirely?

A month back I took a raspberry pi 3 B+, wired a midi keyboard to it, and then launched an open source virtual synth, Helm. I was extremely disappointed by the perf: it was actually unplayable. So clearly there's still a lot that can be done in this domain, and there's probably a reason why already-commodified hardware like the rpi doesn't cut it.

<comment><USER3> My takeaway from the associated links in this thread is that the key benefit to an FPGA is that it runs at a much higher rate than DSP-based technology, and this has a direct impact on the clarity of sound.

<comment><USER4> I saw some links in this thread, but they look like marketing materials to me. Aliasing is more or less solved problem, and the claim that running a DAC at 24 MHz makes it "better" in any measurable way seems ridiculous at face value. I don't know what is actually going on, but as far as I know they're just taking a delta-sigma DAC and talking big talk about the oversampling. In truth, oversampling here is usually just a boring engineering choice where you trade off bandwidth and SNR.

If the Novation Peak is running an 8-bit DAC at 24 MHz, they might be making it perform equivalently to a 16-bit DAC at 48 kHz—note the ratios. This is not anything new, it's just something old that happens to have big numbers in it.

</comment></comment></comment><comment><USER4> The engineering challenges here have already been solved with DACs, and FPGAs really bring nothing new to the table. Anything you want to do with audio signal processing is going to involve a lot of multiplication and table lookups. Sure, you can do that with an FPGA, but what you've basically got are pieces of DSP stuck in your FPGA that you can wire together with Verilog instead of C. Not exactly something to write home about, since it's not like you look at your off the shelf DSPs these days and say, "Gosh, these definitely have enough computational power for my needs but I really wish that they were more expensive and more difficult to program."

The problem is that for most synthesizers and music applications, any problem you have is simply not going to require that much computational power by today's standards.

A good way to make digital music toys is to put all your signal processing on a DSP, and then run your UI and random other code on a standard microcontroller. Microcontrollers are cheap, and this way your real-time DSP code isn't fighting for memory or time slices with anything else. Some people are asking whether you can just use a Raspberry Pi. I'm sure the hardware is capable of cool things with audio, but I'm _not_ sure that you guys would enjoy wrangling Linux into giving you reliable real-time performance.

<comment><USER5> _Some people are asking whether you can just use a Raspberry Pi_

Can you point us to what hardware (DSPs or DACs) we should use instead?

Can I use them as digital synths?

Can I use them for digital FX?

If I want to make a digital synth with lower latency than a RPi, what hardware should I use that won't be as hard as an FPGA to program?

<comment><USER4> The comment was mostly aimed at the poor state of audio on Linux. I think it's important to understand what your goals are when you're doing this. Are you building something? Will it be mass-manufactured? Does it need to be reliable? Does it need to be low-latency?

If you're building something one-shot or playing around, RPi is great it's just that real-time audio on Linux is a pain.

If you want to play with real-time, low-latency effects I would get a Mac or Windows PC and hook it up to a $100 USB audio interface.

If you want to mass manufacture a box that makes noise, at that point it starts to make more sense to research DSPs. They often have weird architectures and the toolchains might not be great. But I suspect that more and more audio stuff is moving to general purpose CPUs and microcontrollers.

</comment></comment></comment><comment><USER6> Can this do recording, too? I'm wondering how to record and process rodent vocalizations in ultrasound (around 20khz) using the cheapest way possible, akin to the "Deep Squeak" project. There are some interesting applications in lab animal welfare, psychology and even training for land mine or TBC detection.

High frequency measurement microphones are very expensive. If there was a way to churn a high sampling rate ADC through an FFT inside an FPGA, that would help a lot and it may be simpler or cheaper than for more sophisticated measurements. But beyond basic things like Nyquist frequency I don't really know what I'd need in a microphone and the analog/digital backend...

</comment><comment><USER7> Ask HN: For someone who has done a lot of microcontroller development, but never worked with FPGA's, does this look like a good platform for me to get my feet wet? I'm not sure I _need_ FPGA for anything, but it would be interesting to at least learn the basics.

<comment><USER6> At the moment if I were to start with FPGAs I would probably get an TinyFPGA. It has an open source toolchain, and at the price and form factor, it could fit into a lot of projects, even as a slightly expensive customized port- expander.

But alas so many things out there to learn and dive into...

</comment></comment><comment><USER8> The fact that it doesn't have an audio output on board by default seems like a really odd omission.

<comment><USER9> Come again?

>2 DAC pins, 10 ADC pins

Pins 35 and 39, 2 channels of audio out.

<comment><USER2> I expect GP meant a 3.5mm audio jack (or similar).

<comment><USER8> Yes, I did.

I work with industrial controllers with analog outs on a daily basis, but when I wanted to build an audio board I had to do a bunch of research to find out what voltage range I needed to output, and what current I'd need to be able to source/sink.

An audio jack is a hardware API contract, basically: plug a wire in here and you will get audio out of it.

I don't understand why people would go so far as to be annoyed by the presence of a jack. Are you annoyed by the LED present on most project boards, if you're planning to seal up the board in an enclosure that means you'll never see it?

To be fair it would add to the BOM and probably impose additional limits on the board design (large footprint, through hole pins) but I'd argue that the beginner accessibility, and the classification of this board as _for audio_ rather than just another assorted MCU/FPGA board, would be worth it.

Of course, the board designers seem to have felt otherwise.

</comment></comment></comment></comment><comment><USER9> The specs for this specific Cortex-M4 incarnation:

[https://www.microchip.com/wwwproducts/en/ATSAMD51G19A](https://www.microchip.com/wwwproducts/en/ATSAMD51G19A)

The DAC is only 12-bit.

<comment><USER4> Only 12-bit is fine, it's 1 MSPS. DACs you can trade sample rate for precision.

<comment><USER9> Ah, that finally makes sense. Thanks for that.

</comment></comment></comment><comment><USER10> To have an impression of the parallel signal processing power of this board, how many 16 bit multipliers fit on the FPGA?

</comment><comment><USER11> Didn't see it mentioned, but bela.io is also a good hardware platform that focuses on low latency. Definitely recommend it.

</comment><comment><USER12> Anyone know an affordable microcontroller with a few good dac channels?

<comment><USER13> The STM32F4 Discovery board -- among others from ST -- has a decent audio DAC on board.

[https://www.st.com/en/evaluation- tools/stm32f4discovery.html](https://www.st.com/en/evaluation- tools/stm32f4discovery.html)

</comment></comment><comment><USER14> Does _" 6 DSP Cores"_ imply only 6-note polyphony if developing tone generators?

<comment><USER15> no. does having one cpu mean 1-note polyphony when using a laptop to generate tones?

you can always mix in software.

<comment><USER14> well... you never know with these hobby DSPs. Once bitten, twice shy.

<comment><USER15> well, oscillators are pretty darned lightweight ...</comment></comment></comment></comment>


The Encryption Debate Isn't About Stopping Terrorists, It's About Solving Crime - <AUTHOR> https://lawfareblog.com/encryption-debate-isnt-about-stopping-terrorists-its-about-solving-crime <comment><USER2> This is ridiculous. Prosecutors now have so much more information left as breadcrumbs; GPS locations, tower pings, metadata, emails, social media posts, etc, than they ever had before the rise of smartphones.

It used to be easy for people to make anonymous phone calls from phone booths - try making an anonymous call today.

Strong on-device encryption of data at-rest has the nice effect of making mobile device theft much less attractive.

Strong encryption of data in transit, including auto-deleting messages, can prevent lots of other crime as well, and protects vulnerable people such as victims of domestic violence who may have to show their phone to their abuser at any time.

<comment><USER3> The Austin bomber is a perfect example. They caught him because he brought his cell phone with him when dropping off the bombs. He didn't use it--it was just powered on and with him.

Imagine that happening before cell phones. The criminals carrying a tracker 24x7.

The Unabomber sent mail bombs for 18 years. The austin bomber gets caught in 3 weeks.

[https://www.dallasnews.com/news/crime/2018/03/21/authorities...](https://www.dallasnews.com/news/crime/2018/03/21/authorities- tracked-austin-bomber)

<comment><USER4> I used to work with the local Sheriff's Dept doing IT stuff. The detectives said they were amazed at how much data they could get from phones / cell providers. It's helped solve so many crimes like bomb threats, abuse cases, and even some murders.

They also said that if someone was smart, they would just leave their phone at home, or somewhere else as an alibi and do whatever. Then they would have to go back to the drawing board which they admittedly said they haven't had to do in a long while.

<comment><AUTHOR> If you're smart, not impulsive, able to plan and consider other points of view, you _tend_ not to be the murdering, bomb threatening, abusing type. People who can lay plans and carefully follow through with them tend not to rob liquor stores, and deal drugs. If you don't care about poeple, or hurting them, but can plan and have good impulse control there's a world white collar crime, politics, business and law for you. In short, the police tend to deal with idiots, or people who have poor planning/impulse control.

In other words, the guy who plans out a careful alibi tends not to be the guy who needs one. The previous post mentioned the Unabomber, who was a rare example of someone who had excellent planning skills, high intelligence, and excellent impulse control. It took almost two decades to catch him, and only because his brother recognized his writing.

</comment></comment></comment></comment><comment><USER5> I keep hearing phrases like "debate" or "the issue", but there is none. Mathematicians and computer scientists universally state the fact that crackable encryption is not encryption. This is totally understood. Across the aisle sits a group of prosecutors and legislators whose argument devolves to "but if we wish hard enough, maybe...?" and who insist on trying to plow ahead with a discussion as though it were something to be discussed.

There is no "debate", or "the issue". There are only those who understand reality and those who refuse to do so.

<comment><USER6> Matt Blaze said it best: 'When I hear the if we can put a man on the moon we can do this, I'm hearing an analogy almost as if we are saying if we can put a man on the moon, well surely we can put a man on the Sun'.

<comment><USER7> That's a really good analogy for the encryption situation as it contains the sort of "fuzziness of definition" that loses the attention of 'the common folk'.

We could say that we put a man on the sun, but by what measure a 'man' by the time they arrive, and upon what part of the fusion reaction do we land in order to define 'on'?

Excellent, I say, into an echo chamber.

</comment></comment></comment><comment><USER8> Framing it as "the encryption debate" instead of "the eavesdropping debate" is telling, in terms of the inherent bias in the article.

The free ride enjoyed by law enforcers in terms of solving crimes by following the money and listening to unguarded communications may be coming to an end, thanks to cryptography. But end-to-end encryption by default isn't going to do anything but raise the lowest-hanging fruit a bit higher. Stupid criminals will still be easily caught, because they cannot avoid doing stupid things. And no one has perfect op-sec. Everyone makes mistakes, and mistakes lead to convictions. The difference is that police resources will have to be prioritized and targeted to uncover those mistakes, rather than continually picking up cheap finds from a surveillance dragnet.

This is no longer a matter for debate, at least in the US. We already went over this with Clipper Chip, and rehashed it several times. Encryption is protected by the 1st Amendment. Back doors can be used by adversaries in addition to law enforcers. Law enforcers cannot be trusted to use their granted powers responsibly. Indeed, encryption has advanced this far in part _because_ governments cannot be trusted.

<comment><USER9> >Encryption is protected by the 1st Amendment.

Maybe it is, but the actual point of the 1st Amendment seems to me that to be able to express idea, opinions, etc. publicly and without fear of retaliation by the government, which is a much higher grade of freedom IMHO than merely allowing pople to exchange those ideas and opinions in a form that noone else but the recipient can access.

It would somehow feel more appropriate if encryption was protected by (an extension of) the Fourth and/or of the Fifth.

<comment><USER10> Encryption is pretected by all three of those amendments.

</comment></comment></comment><comment><USER11> You can't have it both ways. Pick one:

1\. Insecure systems: government can get in, but so can hackers.

2\. Secure systems: hackers can't get in, but neither can government.

It's a binary choice. Like being pregnant. You are, or you are not. There is no try.

<comment><USER12> That's wrong. Encrypt all necessary data with government-controlled public key. Government can get in, but hackers can't.

<comment><USER13> That's wrong. Insiders can leak the private key, or hackers can take it.

<comment><USER14> Or the government can leave it behind their remote servers along with their cyber weapons for anyone to wander by.

<comment><USER15> Or anyone who is willing to spend enough computational power now only needs to crack one key instead of millions of different ones.

<comment><USER12> If there's anyone who can have enough computation power to break key, then that key is weak and its size should be increased.

<comment><USER15> One can only make keys so large to be useful—my point is the same, still, that one would only have to break/find/buy/steal a single key instead of millions.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> Shorter former prosecutor: "Making programs that preserve user privacy by default would have made my job harder."

</comment><comment><USER17> If all we cared about was solving crimes, we could make US law enforcement much easier by doing away with a lot of things, such as certain amendments to the US Constitution.

But law enforcement is only one component of a functional society.

And the rest of us, from time to time, have to deal with the criminals who have yet to be caught by our acceptably-efficient law enforcement apparatus.

This includes people who like to steal information, many of whom are probably out of US law enforcement's reach.

The author doesn't address that problem, which I can understand, as he's a lawyer and former fed prosecutor. And while it's tempting to tell him to stay in his lane, we're stuck with him and others like him.

And it doesn't seem possible for the people (whom government doesn't really trust, despite platitudes uttered for generations) and the government (whom the people do not trust, for reasons I have a hard time impeaching) to agree on a system for safeguarding information.

Which is too bad, because most people would probably like to help enforce laws, espeically those involving children and other vulnerable types.

BUT, we live in a world where even the most open and free societies do the following:

1) Use the police (more accurately, the threat of legal trouble) to silence, bankrupt, and intimidate problematic people.

2) Defeat or ignore the controls designed to prevent abuses of power.

3) Refuse to hold government institutions accountable for malfeasance.

It might help Dr. Rozenshtein's case if he would apply his gifts to solving the political problems listed above, which might restore the trust between government and governed, which in turn might get him the tools he thinks government should have for enforcing the law.

</comment><comment><USER18> Solving crime is not a right. The government _trying to_ is (a right of the people).

Privacy (and hence encryption) is a right.

End.

<comment><USER10> Says who?

<comment><USER18> About the right to privacy: [https://en.wikipedia.org/wiki/Right_to_privacy](https://en.wikipedia.org/wiki/Right_to_privacy).

Governments have no rights (and prosecution is part of the Government), they only have mandates. To comply with these, they have powers, not rights.

Edit: no->not

</comment></comment></comment><comment><USER19> It does not matter if busted encryption would solve crimes. It would also solve some crimes if police went door to door and searched every house for any signs of law-breaking. The plaintive cries of 'but it would stop criminals, terrorists, whatever' are not anywhere close to being sufficient reasoning.

</comment><comment><USER20> NatSec, terrorism, and the victimization of children are the standard gotos for the government wanting a blank check to do things.

Been that way for a _long_ time.

<comment><USER21> The tactic is sometimes called "Think of the children"

The Four Horsemen of the Infocalypse [https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...](https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalypse)

</comment></comment><comment><USER22> No, it's about enabling complete surveillance of everything.

For those who don't know, Lawrefareblog has always been pro-mass surveillance. They only started doubting themselves a little when Trump won the election. But it seems they're back on the pro-mass surveillance horse now.

> _When we founded this site more than six years ago, I never in my wildest > dreams imagined myself writing these words about a man who will take the > oath of office as President of the United States. We began Lawfare on the > assumption that the U.S. federal executive branch was a tool with which to > confront national security threats. While I accepted that its manner of > doing so might threaten other values—like civil liberties—or prove > counterproductive in protecting national security goods, I never imagined I > would confront the day when I ranked the President himself among the major > threats to the security of the country._

[https://www.techdirt.com/articles/20161111/00230136015/long-...](https://www.techdirt.com/articles/20161111/00230136015/long- time-mass-surveillance-defenders-freak-out-now-that-trump-will-have- control.shtml)

Huh, no kidding? So a "bad" president could abuse the extensive powers that are given to him thoughtlessly to "fight crime and national secure threats"? It's only the argument privacy activists have _always made_.

Lawfareblog seems to always work with the assumption that the government is always the "good guys" and therefore will never abuse the powers given to them. That is wrong.

<comment><USER10> The name of the blog is the big hint. They are advicates of using the law as a weapon of war. It's extremely authoritianism.

</comment></comment><comment><USER23> The genie can't be put back in the bottle, counselor. Move on.

</comment><comment><USER24> "Solving crime" sounds great as a sound bite or headline. But it is a heavy handed government action. It almost directly translates to removal of free will and the choice to dissent.

</comment><comment><USER25> Most of the comments here seem to be about the cons of removing encryption or backdooring encryption, but I don't think the author is suggesting that.

I think the article is only advocating for a checkbox in the settings menu to enable encryption for any would-be communication medium, which is turned off by default. I'm not especially against this, so long as there are no detractors to enabling this option.

<comment><USER26> > which is turned off by default.

Defaults matter.

\- Most non-technical users won't know of this setting, and thus be unprotected.

\- The consequence of forgetting to enable this setting is severe (forget it even once, and you risk leaking a secret for eavesdroppers).

\- When security is optional, having security enabled is suspicious. When everyone has security enabled all the time, an attacker can't know whether someone is sending secrets or cat pictures.

This is why we're currently seeing a push towards encrypted by default everywhere. Not because everything needs encryption, but because then there's no risk of forgetting.

</comment></comment><comment><USER27> Bullshit. We already know the FBI is acting in bad faith and doesn't care about actually solving crimes as much as it does about having access to all data. If this wasn't the case, they would have never demanded a backdoor from Apple when they had other alternatives ([https://www.macrumors.com/2018/03/27/fbi-san-bernardino- ipho...](https://www.macrumors.com/2018/03/27/fbi-san-bernardino-iphone- disorganization/)). If the trust in the FBI, and consequently in all other law enforcement organizations, somehow still existed, it should no longer after these latest lies. The FBI isn't interested in solving crimes, it's interested in exploiting secrets of its enemies for political reasons as they did to Martin Luther King Jr. and many others and working towards goals that are not publicly declared. One would have to be completely ignorant of history to think that the FBI (and by extension all US law enforcement organizations) are benevolent institutions that only care about stopping crime. History tells us otherwise. Articles like this by former prosecutors are just more propaganda from the FBI's propaganda machine. Bullshit and more bullshit pandering to the "law and order" types who have never studied any history and likely any other subjects as well.

</comment><comment><USER28> Removing encryption is the final nail in device ownership, and probably the idea of a democratic society.

<comment><USER29> Just to play devil's advocate: does democracy require privacy? It's not like the early 20th century where if you're were a part of the communist party you were suspect. We can pretty much say whatever we want (and we do) without fear unless we are actually criminals. I know the "if you have nothing to fear" argument doesn't hold up, but privacy is actually a relatively new thing in the human experience. And I'm not sure why democracy would fall apart without it.

But boy do I like privacy / hope it sticks around.

<comment><USER30> Alternative history, if perfect surveillance existed in 1950:

The first private conversation that Martin Luther King, Jr. had about the injustice of his time was captured and automatically analyzed, and as a result he was identified as a disturber of the peace and arrested for unrelated violations long before his message ever reached an audience.

Rosa Parks was detained for disorderly conduct long before she made her stand, and as a result her stand never happened.

There was never a zeitgeist of change in the oppressed community, because there were never any stories of people resisting. They were all prevented from acting in any significant way, or from getting together to share their stories and find support.

The issue of racial discrimination never made it to court because all of the people who could have brought it there were stopped before they could get started.

Perfect surveillance can stop any threat to the status quo while it's in its infancy, long before it amounts to anything. It can probably do it without introducing any new, draconian laws by simply looking through recent history for "questionable" actions and harassing people over them.

The argument that it's okay now basically amounts to saying that there is no longer any injustice and that today's system is a perfect example of virtue and fair play, and that anyone who disagrees is a malcontent who _really does_ deserve to be silenced.

Sometimes the majority is wrong, and it takes brave people willing to break the rules in order to point it out and change things. I'd say that democracy _does_ depend on privacy for this reason.

<comment><USER29> The argument I have against this is we now _have_ near perfect surveillance and this isn't happening. I can be a part of a far left socialist movement and spread my ideas as easily as I can be part of this crazy new nazi movement. And both of those ideologies are rampant on the internet, but nobody is being arrested for it (at least not until they do something stupid). I understand in the past this wasn't the case, but as of now it's pretty difficult to stop ideas. And when/if you _do_ stop them the internet history is right there for martyrs to be made.

I'd argue with little to no privacy the government actually has less power in situations like this. Because the lack of privacy extends to what the government is doing also. Cameras/microphones/eyes everywhere means it's much more difficult to get away with a lot of the covert insanity that was happening before.

I would say things like Snowden/Panama Papers/Wiki leaks/many other examples are showing that having privacy can actually benefit the people in power more than the average Joe. Joe Blow doesn't want his dildo collection known about, the government doesn't want (insert insane things like funding drug cartels/terrorist organizations) to be known. All in all I'd say sacrifice knowledge your dildo collection for the greater good.

That said I do believe privacy still needs to be a thing. I hope it is a thing again in the future. But I actually don't know how horrible it is that it's gone away. People might just have to tell the truth for a while, which might benefit society in its current corrupt state?

</comment></comment></comment></comment><comment><USER31> I'm not sure I agree with what I'm about to say myself, but wanted to see how others feel....

The advent of the internet has caused us to question a lot of our rights as a people. We originally felt strongly around our right to free speech and our social networks embodied that to its logical conclusion, and now we're here at a dire state of hate speech and vitriol that threatens the (perceived) stability of our democracy. While the printing press and television have contributed to our partisanship, it's almost undeniable that the internet - and the ability for _anyone anywhere_ to publish _anything_ \- has pushed us over the edge.

There have been serious considerations about what we can do about this. One of the issues is that, as a people, we might not be ready to have all this power ourselves.

I'm wondering if that extends to encryption and privacy. Can we, as a people, be trusted with this level of autonomy, power, and security?

<comment><USER32> >> Can we, as a people, be trusted with this level of autonomy, power, and security?

A philosophical question is one worth considering for fun, but it has little practical value. There is no way to stop people from using mathematics to protect their privacy and their data, and any debate around that come from people who are innumerate.

We can discuss the should/could stuff as a matter of interest to waste taxpayers' dollars and time, I suppose, but that's not what lawmakers generally try to discuss. They want to figure out how to do the impossible, or at least lie about it.

<comment><USER10> It's not impossible, you are confusing math with opsec I reality. Stop it. Pretending it's possible to encrypt effectively is going to give the government an excuse to apply rubber hose decryption under cover of deniability.

<comment><USER32> >> Pretending it's possible to encrypt effectively

Is not something I did.

</comment></comment></comment></comment><comment><USER33> tl;dr Common criminals go with default security settings.

This is about to get even worse for law enforcement. To date, iCloud backup still offers a way for law enforcement to access data with a warrant. However that is about to change. Apple is about to roll out iMessages on iCloud, which sounds innocuous, but actually will premiere a major step forward in security: end-to-end encrypted data in the cloud _by default_.

This is huuuuuge.

The thing that has been holding back E2EE as the _default_ is that it has sacrificed recoverability. That is, it has required a strong password, which is easy to forget, and if you forget it, no one can help you. So it's something you had to opt into. Not a default.

Now, Apple has created a backup solution that -- get this -- removes the need for a strong password. Sounds crazy, right? All you need to remember is your iPhone passcode. Obviously, this is brute forceable and can't secure your cloud data...

Except yes it can. They've implemented hardware security modules that prevent brute forcing. Then they destroyed the signing key for the HSM firmware. Neat.[1]

So, iMessages are going to transition to this, which probably means they won't be in the iCloud backup, and thus not available to law enforcement. And then it's probably just a matter of time until the whole backup is secured with E2EE.

[1] [https://www.youtube.com/watch?v=BLGFriOKz6U](https://www.youtube.com/watch?v=BLGFriOKz6U)

<comment><USER22> I'll believe it when I see it. One simple privacy-focused solution Apple could have implemented since many years ago is _keeping_ iMessages E2EE, instead of backing them all up to the cloud automatically and _not_ allowing the users to disable the backups for iMessages unless they disable the whole iCloud backup (which is enabled by default).

<comment><USER33> _> One simple privacy-focused solution Apple could have implemented since many years ago is keeping iMessages E2EE, instead of backing them all up to the cloud automatically_

Which means they would not be recoverable or even restorable to a new iPhone. Not a good default for a consumer device.

Apple made the right choice, letting you opt into stronger security at the sacrifice of recoverability. And now they're working on the best of both worlds.</comment></comment></comment>


What's the probability we're idiots? - <AUTHOR> http://compphi.com/2012/01/04/whats-the-probability-that-were-idiots/

<comment><USER2> I'll play the devil's advocate.

Casinos - The odds for many games are only slightly in the casino's favor. Most of my friends go to casinos because they're fun and provide entertainment, not to invest their money!

Insurance - If the man absolutely needs the lawnmower, yet can't afford a new one every two years, insurance suddenly seems more attractive. Common insurances, like car, health, life, home, etc. are based on this. After all, if you have unlimited money, you wouldn't buy insurance.

Religion - There is supposedly an eternal reward if you believe and the belief is correct. There is no reward if you don't believe, whether the belief is correct or not. Having a slight chance of an eternal reward is certainly better than having no chance at all.

<comment><USER3> My thoughts exactly. Any complete risk analysis factors in what lies on the "other side" of the event you're insuring against. Not to mention, the value of something is relative. An example:

Let's say you need a car to commute 30 miles to work (no public transit available). You have a monthly surplus income in the amount of $700 -- provided you keep your job, which means you have to show up every day. You drive a modest, but reliable, used car that cost you $8,400 to purchase. If the car were a complete loss in an accident, it would take you 12 months of surplus income to purchase a replacement. However, if the car is suddenly unavailable to you, getting to work reliably becomes an issue. Opportunity cost! In this case, it makes sense to use a portion of your surplus income to insure the car.

The same might be true of someone who relies on a lawn mower for work. A better example might be a laptop like a MacBook Pro. I use a nicely equipped MacBook Pro that cost me around $2,700 to purchase. When I was just getting started as a freelancer, I bought a 100% replacement warranty from SquareTrade.com for a couple hundred dollars because I only had enough money to buy the laptop one time. Now that I can afford to replace the laptop any time, I take the risk myself and keep the $250.</comment></comment>


San Diego: join us for SD Hacker News meetup #29 (Fri 5/25) - <AUTHOR> http://anyvite.com/t3wl6d8wfi

<comment><USER2> I always enjoy this crowd of local tech enthusiasts. The meeting has two parts which enables the younger and older hacker crowd (who enjoys a beer) to participate. Anyone interested in tech conversation should definitely attend.

</comment><comment><USER3> I've been a few times now and I always enjoy the crowd and conversation.

</comment><comment><USER4> Will be my first time. Looking forward to meeting everyone.

</comment><comment><USER5> Friday night?</comment>


Unboxing free flags requested from every country's embassy [YouTube] - <AUTHOR> https://youtu.be/Jbix9y8iV38 <comment><AUTHOR> The guy has a great sense of humor and the individual replies and flags are cool.</comment>


Researcher finds Tor exit node adding malware to binaries - <AUTHOR> http://threatpost.com/researcher-finds-tor-exit-node-adding-malware-to-binaries/109008

<comment><USER2> This is a known attack on the tor ecosystem, and why the tor project keeps a list of these bad relays so they can be routed around [1]. As the article stated, it's why it's important to use https as much as possible, and also why things like signing and/or hashing any sort of downloaded file is useful. If it's signed and hashed, it makes it a lot harder to sneak a malicious program in this way.

[1] [https://trac.torproject.org/projects/tor/wiki/doc/badRelays](https://trac.torproject.org/projects/tor/wiki/doc/badRelays)

<comment><USER3> "As of April 2013 this list is no longer being maintained".

Although there's an alternative mentioned in the document.

<comment><USER2> Yeah, they stopped publicly stating they know who's naughty and who's nice, which is probably useful in avoiding playing whack-a-mole with someone determined to cause trouble. Then again, I imagine that a knowledgeable attacker would just look through their logs of who's hitting their node to figure out when they've been caught.

</comment></comment></comment><comment><USER4> The research being done in Karlstad analyzing Tor, which is mentioned in the article is very interesting. I recommend looking at the Spoiled Onions project:

[http://www.cs.kau.se/philwint/spoiled_onions/](http://www.cs.kau.se/philwint/spoiled_onions/)

They identify several exit nodes that perform injection attacks etc. Monitoring Tor exit nodes for malicious behaviuour seems to be needed.

</comment><comment><USER5> Let me be clear: unless you use end-to-end encryption (e.g. TLS) the exit node owns you. Injection, modification, even good ole fashion spoofing, all become trivial.

I really need to start a blog on this stuff. There are so many misunderstandings around Tor and "stupid Tor tricks" like this to show off.

<comment><USER6> Please do.

<comment><USER5> Cool, it's on my list. But are you _the_ Uwe Schmidt? Because if so I'd probably have to start that blogging today :)

</comment></comment></comment><comment><USER7> Again. This shows us why we need to operate HTTPS everywhere.

Many software download sites delivers its software over http, and don't provide a checksum or provide one over http only. This is really unacceptable yet it is common practice. (Example: Skype, ZeptoJS)

Please. If you're a dev at a company that doesn't offer HTTPS download, make it happen! If your software got patched with malware, your users will blame you.

</comment><comment><USER8> Discussion from yesterday on the actual article and not a news rewrite [https://news.ycombinator.com/item?id=8501557](https://news.ycombinator.com/item?id=8501557)

</comment><comment><USER9> Just supporting HTTPS is great, but you really want to start redirecting HTTP requests as well. For example, this HN post links to the HTTP version of a site that not only supports HTTPS, but purchased the expensive certificate that shows up more prominently.

</comment><comment><USER10> More and more I feel that an IP standard that uses public/private key encryption needs to be a goal that is being worked towards. Ad-hoc and optional encryption through higher level protocols are not viable long term options to protect people.

We already know that if a connection can be exploited, at some point it will be.

</comment><comment><USER11> Being a bit naive about Tor, what is there to prevent an exit node operator from doing some transparent traffic manipulation and injecting tracking pixels into non HTTPs webpages?

Or playing silly games like flipping all jpegs upside down?

<comment><USER12> Nesting an encrypted connection inside the traffic being routed through tor is what you would need to protect HTTP traffic from being manipulated and/or monitored by an exit node.

So instead of doing (you -> tor -> internet), do something like (you -> tor -> VPN -> internet). To be even safer do (you -> VPN -> tor ->VPN -> Internet) that way your ISP isn't aware of tor traffic and the exit node cannot manipulate requests.

Easiest way to accomplish that is with a VM. The host has a VPN connection, force route the VM through tor (with something like Tortilla) and install a VPN client on the VM as well. This requires you anonymously set up the VPN running in the VM so there is no connection back to you, of course.

<comment><USER13> The most difficult part in your setup is to make untraceable the VPN you run after going through Tor. The problem is: if you believe this VPN is safe / untraceable enough, why do you even use Tor in the first place ?

The problem is that you, at some point, pay the VPN, and that is very likely to be linked to your real identity somehow.

<comment><USER12> Paying for the VPN anonymously is possible with Bitcoin.

The reason you tunnel it all through tor is because you can't trust the VPN not to fold if the government subpoenas them. So if the data center hosting the VPN is subpoena all they can hand over are logs of tor exit nodes. If you didn't use tor, they would get your home IP and the jig is up.

</comment></comment></comment></comment><comment><USER14> not sure but it seems the answer is trivial.

a public api with checksum of all www files or a http header of the checksum, ie a new http method "CHKSUM /url/file" possibley the nodes should not know if they are exit nodes, and then the checksum can be compared via 3-4 nodes.

if tor then compiled a list of nodes sending viruses the bad nodes could be cleaned out.

imo it would be nice if http had this for every page also; we could then have a browser plugin to verify checksums over https+3rd party to stop mitm attacks.

<comment><USER15> While I doubt the downvotes are necessary, you're misunderstanding the scope of a MITM attack.

In order to mitigate a MITM you must in some way communicate with someone else. Your checksum idea either gets routed _through_ the malicious node, which means they could change it, or it _doesn 't_, which means you're revealing to some third party other than the exit node what it is you're browsing, and you're also telling them who you are.

In a sense, this is what https is for, by trusting certificates you know to be valid, a malicious node won't be able to see, let alone manipulate the data being sent to you (Though obviously they will see who you're talking to.)

<comment><USER14> edit: nvm, i do see what youre saying

<comment><USER15> to be fair, I misunderstood you as well, you implemented self checking between nodes. That's not as obviously broken...</comment></comment></comment></comment>


Show HN: Timestrap – Self-hosted online time tracking - <AUTHOR> https://github.com/overshard/timestrap <comment><AUTHOR> Hello HN, developer here. I started this Friday night because I wanted something much simpler than all the options I was given and something that I could host myself. There is a lot to do on this project still and I wanted to see what the reception was for the start.

Timestrap currently does fully support time tracking and CSV exports for multiple projects and tasks. It has a full REST API and admin panel. Invoicing will come after I get the dashboard more fleshed out, more export options and better security.

<comment><USER3> I don't know if I speak for other users, but rather than focusing on invoicing, why not tie into Quickbooks? Or similar services. i.e. There's already invoicing software. If the integration between the timesheets is the only differentiator, why rewrite the invoicing part?

<comment><USER4> This app fits a use case I had a few years ago. I was travelling and doing odd jobs (WordPress tweaks and the like) and needed something I could use to track time and generate an invoice.

QuickBooks & Xero et al were waaay more than I needed or wanted to pay for.

I ended up using the free tier of Toggl, doing a CSV export and generating a butt-ugly invoice from Excel.

If this tool were available, I'd have used it.

<comment><AUTHOR> What you're describing is the exact point of this project!

</comment></comment></comment></comment><comment><USER5> This is super nice and much simpler than all of the other software I've been using to cobble together work logging + time tracking + invoicing this past year. After trying Toggl, Harvest, and everything else I totally understand why you built it.

The only changes I'd like to see are: allowing one to log the time work is started (not just the date), a confirmation before deleting data that can't be recovered, and a way to filter the hours charts by day / week / date range.

<comment><AUTHOR> The time work is started is something I'm debating with myself on. I think I will add start + end date + time since it would help with making a timer persistent across pages/connection issues.

Confirmation is a must, mistakes happen!

Filters/reporting is coming over the next week, also a must, what's the point of time tracking if you can't compile reports of your time.

<comment><USER6> +1 for start/stop times because that's how I keep my data now. I have been looking for a simple solution like this for quite some time. Also: thank you OP

</comment></comment></comment><comment><USER7> Are there people interested in following the development of this app? What's the best way to "watch" a project like this come together?

I see some great suggestions in the comments, I thought the idea of automating the screenshots that go into the documentation was kind of interesting. The idea that it's cost effective to automate something like that, and further the idea that if the UI changed the documentation would, in a way, automatically update...

I always think when I first see these types of Shows, I'd really live to see an animated gif walkthrough. Ideally, buttons beneath the walkthrough that are labeled '30 seconds', '3 minutes', '15 minutes'. Or some variation on this theme. Does anyone do product demos this way?

<comment><USER5> A 30-second product demo video would definitely be a nice to have.

</comment></comment><comment><USER8> This looks nice! I fail to see any use for the dashboard, though - <USER2> as you can't drill down into the timesheets from the pretty graphs.

I think the quickest, most prominent action should be to start tracking a task - or change which task is currently tracked.

<comment><AUTHOR> I agree the dashboard is pretty worthless, I made it because I wanted to fiddle around with some Charts. The best thing would be what you're saying is tracking tasks.

</comment></comment><comment><USER9> if anyone wants a nice CLI tool then Timetrap is pretty awesome, been using it for years.

[https://github.com/samg/timetrap](https://github.com/samg/timetrap)

<comment><USER10> Yup, that's what I've been running. Really like it, especially after I made a very simple little "on off" widget to display on my tmux status line. No more forgetting I have a timer running :)

</comment></comment><comment><USER11> Ah, what I really miss about time tracking software isn't necessarily something where I manually type in what I've been working on, as much as it's something like a self-hosted RescueTime[0].

Instead of manually adding things to it, it allows you to mark certain applications and websites as you doing something productive (for example, if you're running Atom and visiting StackOverflow and GitHub, you're probably doing something productive) and then tracks that via its clients and shows you a nice overview of how much of your time is actually spent on doing something productive.

Now, of course, the fact that RescueTime is centralized and hasn't released the source code of its clients makes me instantly dismiss it as a software I would use, but I would _love_ to find a certain self-hosted solution that does pretty much exactly what RescueTime does.

[0] [https://www.rescuetime.com/](https://www.rescuetime.com/)

<comment><USER12> If you're on the Mac, Timing might be similar to what you're looking for (one of their selling points is that your data is stored locally and never leaves your Mac):

[http://timingapp.com/](http://timingapp.com/)

And on Windows, Mac & Linux, it looks like ManicTime will also store data locally if you don't use the Server component:

[http://www.manictime.com/](http://www.manictime.com/)

<comment><USER11> Ah, I'm on Ubuntu, and ManicTime would be an awesome choice, but their Ubuntu version is for tracking only, and requires a server to actually view the reports[0].

Seems like the same thing applies for macOS, so I would call it Windows-only solution in the serverless mode. Alternatively, you could run the server[1] on some always-on Windows machine, pay for the license(s) and use the server under your control to store the data.

[0] [http://www.manictime.com/linux](http://www.manictime.com/linux)

[1] [http://www.manictime.com/teams/download](http://www.manictime.com/teams/download)

</comment></comment></comment><comment><USER13> Would it really hurt to include a screenshot of what it's like to use? Sorry for the grouchy comment but we're all busy people, there has to be a modicum of convincing on a programmers part to encourage us to divert us attention to their project.

<comment><AUTHOR> Some screenshots would be useful but I'm still rapidly developing Timestrap and the interface is getting stuff added to it every few hours so I feel like it'd be a wasted effort on my part right now.

EDIT: Added some screenshots to the bottom of the readme

<comment><USER14> Automate it! Set up a browser test that screencaps the important pages for the documentation (and checks them for basic errors like 500 status or no text).

In the long run you can diff the images and assert that they haven't changed more than N% from the reference, but for now, it makes evergreen documentation.

<comment><AUTHOR> Good idea, I've already automated most everything else for testing and pushing to Heroku. I may as well!

<comment><USER15> Nightmare is great for this: [https://github.com/segmentio/nightmare](https://github.com/segmentio/nightmare)

</comment></comment></comment></comment></comment><comment><USER16> We also tried to create a super simple time tracking app. We will give it for free (also biz version) very soon.

[https://tokkapp.com/](https://tokkapp.com/)

<comment><USER17> Moving between days seems to be broken; I moved from April 23rd to 22nd and then tried to go back to the 23rd and didn't work. I couldn't advance beyond that either.

Despite this; great idea and looks beautiful. Seems to fill a bit of a void among task trackers I've used.

</comment></comment><comment><USER18> When I was freelancing, I have looked at many services for online time tracking. As an Emacs user, I finally settled for org-mode:

\- [http://orgmode.org/manual/Clocking- commands.html](http://orgmode.org/manual/Clocking-commands.html)

\- [http://orgmode.org/manual/The-clock- table.html](http://orgmode.org/manual/The-clock-table.html)

</comment><comment><USER19> I have a DevOps consulting company (shameless plug [https://elasticbyte.net](https://elasticbyte.net)) and been on the lookout for a time tracking solution. I've been using AirTable and just adding in hours manually into a table, but it has really been limiting.

How is the reporting in Timestrap? Can a run a query like give me the sum of hours for client Acme Inc from March 23rd to April 23rd?

<comment><AUTHOR> It has the ability to do this at the API level but not on the interface yet. All the reporting functionality is coming over the course of the next week since that's pretty critical to time tracking.

<comment><USER19> Right on. You going to charge (hosted solution)? I'd like to support you.

<comment><AUTHOR> I don't really have any interest in making money on this project and I feel like a hosted solution defeats the purpose. The best support you could give is writing some issues on GitHub, testing things, helping with documentation, or submitting some features.

<comment> dyu- Paid feature requests. If the user (like the GP) wants a certain feature and don't want to implement it himself, accepting his offer to pay would benefit both parties.

</comment></comment></comment></comment></comment><comment><USER20> Thanks for sharing! I've used Kimai [[https://github.com/kimai/kimai](https://github.com/kimai/kimai)] for a while, which offers similar functionality. Timestrap is MUCH nicer to look at, though the feature I use the most on Kimai isn't as well-implemented: the big stopwatch that adds entries quickly.

<comment><AUTHOR> Kimai does handle the stop watch functionality much better than I do right now. This is a huge feature for me personally so I do plan on making it much better.

</comment></comment><comment><USER21> Kinda off-topic, but the screenshots were (probably) made on Windows 10 while you write that Ubuntu is your primary OS. Do you use Windows for work/coding and Ubuntu for other stuff? Because I do it more or less the other way around.

<comment><AUTHOR> I'm using a variety of operating systems at the moment. My primary OS is Ubuntu, I happen to be on my home desktop which is used for gaming at the time of these screenshots. (Ubuntu gaming is still mediocre.) I use OS X at my office quite a bit but my primary laptop that I use at home and work is 100% Ubuntu.

I'm fairly OS agnostic and sync all my systems very well and use whatever I'm sitting at.

</comment></comment><comment><USER22> [https://taskwarrior.org/docs/timewarrior/](https://taskwarrior.org/docs/timewarrior/)

</comment><comment><USER23> Huge thanks from me, I been looking to develop something to keep track of my own development hours for invoicing purposes. From early look it seems like you nailed it. Thanks!

</comment><comment><USER24> Looks really great! Would love to see a cloudron package for it. Not sure how hard this would be as there doesn't seem to be a dockerfile in the repo.

</comment><comment><USER25> This is great, I've been looking for something just like it. Once invoicing is included I think I'll try using it, I'll donate as well.

</comment><comment><USER26> Awesome! Now all you need is to import from WakaTime to automatically fill the Tasks/Entries for me.

</comment><comment><USER27> Awesome, exactly what I was looking for for a long time. I'll see if I can contribute something.

</comment><comment><USER28> Thanks for sharing. Loving it.

</comment><comment><USER29> Server error 500. Well too bad then.

<comment><AUTHOR> It resets every 10 minutes or so, it's bound to break with HN hitting it and doing whatever they want to it.

</comment></comment><comment><USER30> What service is running the test instance?

It is so slow that I first thought the app was broken, but after 8 seconds TimeToFirstByte after clicking "Add" in the "Tasks" window, my entry finally appeared.

<comment><AUTHOR> It's Heroku with HN accessing a single "Free Tier" instance. If you install it locally or on your own server it is very fast.</comment></comment>


Show HN: Cavy – an integration testing framework for React Native - <AUTHOR> https://github.com/pixielabs/cavy <comment><AUTHOR> We were building a client app in React Native that had quite a long and complicated data entry journey that we got really bored testing over and over ourselves on our devices or in simulators.

We built Cavy to automate that process. It's in early stages, it's not perfect, and it makes nasty use of component refs to achieve its aims. But it solved our problem, so it might solve yours too!</comment>