Palantir is using War on Terror tools to track American citizens - <AUTHOR> https://www.bloomberg.com/features/2018-palantir-peter-thiel/ <comment><USER3> I'm much less concerned with Palantir being used internally by corporations to detect information leaks (although in practice this also means it will be used to quash whistleblowers), since that's at least a viable use for their technology. And it's good that Palantir is pivoting towards less invasive applications of their technology such as supply chain tracking.

But the article touches on the biggest issue with Palantir, which is that they seem to be completely fine with allowing law enforcement agencies to use their software for parallel construction, which is in my opinion a pretty egregious violation of the 4th amendment. Although it may be constitutional for police departments to purchase data from e.g. Facebook or some data broker, even local police departments are known to employ dragnet-style surveillance through things like Stingray devices. Of course we have a number of three- letter agencies, also Palantir customers, who don't even need to pretend that they're following the 4th amendment.

Since Palantir is essentially enabling the construction of all the tools required for a complete surveillance state, and actively using their tools for that purpose for financial gain, I think that makes them one of the least ethical companies in tech. I certainly wouldn't be able to live with myself if I knew I was writing software with the explicit purpose of being able to track down rebels in Yemen, catch illegal immigrants, and violate the constitutional rights of millions of Americans.

<comment><USER4> Can you expand on exactly how Palantir is used for parellel construction?

<comment><USER3> Law enforcement uses dragnet warrantless surveillance to gather data (such as who is calling whom, who is in physical proximity with whom). That data is loaded into Palantir's software.

Law enforcement uses that data to acquire admissible evidence of the perpetrators' crimes. This is the crucial step, because although the original evidence couldn't be admissible in court due to its collection without a warrant, it _can_ be used to acquire more evidence. If the warrantless surveillance includes information such as the time and place of where you plan to commit a crime, law enforcement can stop you for a random check on the way there, giving them actual evidence for prosecution. Now that evidence can be used in court, even though the only way law enforcement were able to acquire it was through unconstitutional practices.

The thing about Palantir is that it needs big data to work. Police departments don't just have random chunks of data lying around containing large numbers of connections between large numbers of people - they might have something like that for something like suspected criminal gangs, but that wouldn't be enough data to make Palantir's software worthwhile. So acquiring the data necessary to use Palantir's software requires mass data collection. Some of their mass data collection techniques may not require a warrant, such as using license plate captures, but some does, such as who you're calling.

So does Palantir perform warrantless surveillance themselves? To my knowledge, no. But when they sell their software to law enforcement agencies, they must know that the only way their customer could get bang for their buck is through mass surveillance. In my opinion, the person willingly and knowingly selling tools for oppressive purposes holds a lot of blame for the actual oppression that occurs as a result.

<comment><USER5> You raise several good points, but a few clarifications here:

\- In our software that we deploy to police departments, generally the origin of any piece of information is tracked, as well as when it was entered and by who. The intention with this is to prevent this (and other) kinds of abuse. Malicious users can still abuse the system and do a parallel construction e.g. outside of our system or maybe in a way that the two actions (finding non- admissible data and finding admissible data) seem unrelated, but at that point they would be spending quite a bit of time and criminal energy on this. I don't think this would happen commonly for a variety of practical reasons (but ultimately there's no way to completely prevent it).

Ultimately trust in the government and that law enforcement (in the various shapes and forms it comes in) is a force for good and prevents many bad things from happening every single day, is at the heart of the palantir philosophy. If you fundamentally think the government is evil, palantir would probably not be the workplace for you. But once you see all of the bad things LE can prevent thanks to our software, it becomes pretty easy to believe in, even if individual bad actors exist (and always will), like racist cops, cops that abuse their power, etc.

\- If the organization is acquiring warrantless surveillance, then this generally means that there is the legislative base for them to acquire the data in the first place. What this looks like varies from country to country, some countries are much stricter with the regulations than others. So for instance in some countries it is not allowed to get information from a suspects public facebook profile, whereas in other countries this is considered A-OK. Especially in europe these things have recently become much more strict with GDPR (and similar rules that apply to government entities). You'd think that be a downside to palantir (less data = less value?) but actually it's a big business opportunity, because our software is the only thing available that is even remotely close in this space to having enough access control 'finesse' that it can enable organizations to be compliant to this law. So this is an area (and competitive advantage) we are investing a lot into -- and typically organizations go from 'completely non-compliant' when we arrive there (e.g. never even deleting data like license plates that are supposed to be deleted after 3 months etc, audit-logging any searches investigators do, limiting search scope, ...) to being fairly or even fully compliant.

Now my personal opinion is that everyone should be able to enjoy great privacy and control over their PII just like citizens of the EU do, so if you live e.g. in the US other another country where the law is lax, you should consider taking political action to change the situation.

Of course we never endorse or support any workflows that are in any way unconstitutional, and we have terminated relationships before with very big government agencies when we had doubt about whether our tools would be used for unlawful purposes.

\- The "big data" thing is a bit of a misunderstanding I think -- we have "big data" tools too, but usually these are not of interest to local law enforcement. If you check out our youtube channel you will find some (atrociously old!) videos of the tool that's popular in LLE ([https://www.youtube.com/watch?v=yMv3TBxulu4](https://www.youtube.com/watch?v=yMv3TBxulu4) for instance). This tool is in fact often used with just hand-entered information -- analysts create objects (e.g. persons, links between them) in their investigation. So the data really isn't that big and mostly hand- curated, and the tool works fine without mass data collection (better than with, perhaps). Most of what local law enforcement does with 'big data' tools is to generate reports like crime statistics.

"Police departments don't just have random chunks of data lying around containing large numbers of connections between large numbers of people" \-- actually, they really do! Any police department of any size that has existed for a while will have a database with millions of convictions, suspects, court-cases etc in them. Usually on some crufty mainframe or in some crufty old SQL database that contains a lot of terribly inconsistent data (dead links, data duplication, etc.) Also sometimes some of this data is shared between countries, states etc. You can find some videos on youtube of our CEO talking about the challenges of data integration and such.

Ultimately of course there is a general statistical trend (belief?) that 'more data is better', because if there is more and more complete data, you have a bigger chance of finding that connection between e.g. a terrorist and some billionaire who might be funding said terrorists, etc. At least up until a point (at which the data probably becomes just too noisy/hard to deal with, because every individual piece of information carries very little meaning. At least the NSA seems to subscribe to this belief according to their public statements, and I'd think if anyone knows about this stuff, it's them) and assuming you have the necessary CPU power and talent (data scientists) to actually do something useful with this data. Local law enforcement orgs like police generally lack the latter. In police departments, most users are only sophisticated enough to run searches for things like names, SSN, number plates etc, really.

\- We generally know a lot about how our software is used at most of our installations, and almost always actively take steps to prevent abuse (auditing etc). Most government organizations will not let us see things like what their analysts exactly searched for (because that is obviously sensitive information) but we do a lot of work to help organizations prevent abuse and insider threats at a higher level. As mentioned above, we have taken action in the past in situations where we suspected abuse. It's on a case-by-case basis, of course -- imagine if there is e.g. one analyst abusing the system, then that analyst getting fired/reprimanded would probably be sufficient action (obviously this is not in our responsibility), but if we suspect systematic abuse or we see signs of repeated abuse without repercussions, then we might pull out completely.

<comment><USER6> Thank you for participating here.

 _" Ultimately trust in the government and that law enforcement ... is a force for good and prevents many bad things from happening every single day, is at the heart of the palantir philosophy."_

Trust is built on transparency, accountability, responsibility.

Can I make FOIA requests to Palantir?

<comment><USER5> FOIAs are not made to companies, they are made to government entities. But yes, of course you can make FOIA requests to government entities we work with (the law guarantees you this privilege), and about the work we do with them -- reporters do this all the time.

In some of the more liberal countries the things we do with the government are even part of public record and you can find contracts and services we provide them etc documented online without having to do any kind of request.

<comment><USER6> How do I determine everything Palantir knows about me, and all the ways they've used and shared that data?

<comment><USER7> That is like asking everything Oracle or Postgresql knows about you. It doesn't make sense.

Palantir is _software_ deployed for specific customers. The customers then use Palantir against their data and publicly available data.

<comment><USER6> Thank you for the clarification. I had always assumed Palantir, like their competitors (Seisent, ChoicePoint, etc), did both services and software.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> > The U.S. Department of Health and Human Services uses Palantir to detect > Medicare fraud.

Having worked in this field, I can say that this is hilarious overkill. The vast majority (in dollar terms) of Medicare/Medicaid fraud is drug companies misreporting their Average Market Price (AMP), the critical variable in how much they get paid. In 2012, Glaxo settled(!) a small bundle of cases, some of which I worked on, for three billion dollars [0].

You don't need police-state surveillance of individuals, you need visibility into company transaction records.

[0] [https://www.justice.gov/opa/pr/glaxosmithkline-plead- guilty-...](https://www.justice.gov/opa/pr/glaxosmithkline-plead-guilty-and- pay-3-billion-resolve-fraud-allegations-and-failure-report)

<comment><USER9> Medicare fraud is estimated to be around $60B per year or 10% of the whole budget. So if Palantir can decrease that rate by 1 or 2% then it's tough to call that overkill

[http://abcnews.go.com/Politics/medicare-funds- totaling-60-bi...](http://abcnews.go.com/Politics/medicare-funds- totaling-60-billion-improperly-paid-report/story?id=32604330)

>Going even further back, in 1998, a Senate investigation into Medicare fraud found $6 million in payments to a "business" whose fake address would have been smack in the middle of the Miami Airport.

>The report released today shows no improvement, but investigators say it is not that hard to fix the problem.

>ABC News went to one of the locations listed in the report that was on Chicago's Southside next to a porn shop, with no doctor's office evident, where Medicare sent nearly $600,000 using an ineligible mailbox shop location as a billing address until 2013.

Seems like exactly the kind of problem Palantir can solve to the advantage of taxpayers.

<comment><USER10> These things could be fixed by simple address verification. Amazing they have to wait for something like Palantir.

<comment><USER11> This is like someone saying web search could be solved by a simple database lookup.

</comment></comment></comment></comment><comment><USER12> > The LAPD uses Palantir's Gotham product for Operation Laser, a program to > identify and deter people likely to commit crimes. Information from rap > sheets, parole reports, police interviews, and other sources is fed into the > system to generate a list of people the department defines as chronic > offenders [...] The list is distributed to patrolmen, with orders to monitor > and stop the pre-crime suspects as often as possible, using excuses such as > jaywalking or fix-it tickets.

This is pretty much everything I was afraid of when it comes to this field - big data "prediction" being used to predispose people into crime, and by extension, algorithmic racism.

<comment><USER13> For all we know, keeping a closer eye on previous criminals deters them from repeating their crimes. This strikes me as a very benign way of preventing a crime from happening in the first place. Rather than letting it happen, creating a victim and perpetrator, and then having to punish the latter yet again.

At the very least, this should give them the impression that policing is much higher than it actually is. Sounds like a good deterrent to me.

<comment><USER14> There is a lot of problems with this strategy when introduced into the real world; the chaotic vortex that it is.

The data can be wrong. This could be easily fixed if law enforcement agencies had to actually verify that the data was correct, but in practice this seems to rarely occur.

When people are told by a group that they are a thing, repeatedly, they eventually accept that they are that thing. If the cops keep harassing you for being a gangbanger when you have never been one your whole, you just happen to be associated with a few individuals who are, you eventually just move towards that group. Why not? The powers that be already think you are one and they treat you like one, which causes other people to treat you like one, so why not just be one?

You also need to consider the idea of enforcing crime that hasn't happened yet. That defeats the whole point of law enforcement. It is meant as a reactionary force, not an offensive force. Policing someone who has the _potential_ for crime assumes that they will do it again, which makes it so your essentially treating them as guilty for something they haven't done yet. From my perspective, that seems to defeat the purpose of our legal system.

Anyway, I think I will end my rant here...

</comment></comment></comment><comment><USER15> This isn't Palantir, this is the companies who buy Palantir software.

The data from JPMorganChase isn't visibile to Palantir as an organization, but to the bank.

This headline is weird and as accurate as "Microsoft knows everything about you" because the bank uses SQL Server. Or "the Python developers" because python and pandas is used to link a bunch of data together.

Since this is Bloomberg, I would expect them to know the difference between software and data services. Google gets your data when you use them (except for enterprise), most other products don't.

Cynically, this seems like oppo PR against Thiel. How could you prove this suspicion?

<comment><USER16> Is it really the case that data does not cross boundaries among Palantir clients? And that the algorithms used by any given client are only informed by the data that client provides?

<comment><USER9> Unless proven otherwise, then that is hearsay.

<comment><USER15> Good point, but this is the risk for every cloud hosted software. So every AWS and azure product has this suspicion that's impossible or extremely difficult to remove.

If you're really paranoid, then all non-OSS software.

So again, why is Palantir more worrisome than Salesforce?

</comment></comment></comment></comment><comment><USER17> Whilst the article may not have any surprising information for the regular hacker news reader, it may come as a surprise that a non-insurance, non- government business holds more private data about an individual than Facebook does, especially since most individuals will not recall ever interacting with said company. I think it is beneficial if more people become aware of this.

<comment><USER4> > it may come as a surprise that a non-insurance, non-government business > holds more private data about an individual than Facebook does

Where in the article is that stated?

<comment><USER18> In the title?

<comment><USER4> It's clickbait. It doesn't state it or give a citation for it anywhere in the actual article.

<comment><USER18> Yeah, but you edited your post to specify "in the article" after I'd posted. At the point of my reply, it was correct.

</comment></comment></comment></comment></comment><comment><USER19> I used to be intelligence analyst that utilized Palantir on a daily basis. Ask me anything.

<comment><USER3> To what extent are searches/queries/data-accesses performed by analysts logged and audited? Were there actual and official repercussions for looking at the data of family members and romantic interests?

<comment><USER19> From what I recall all activity is logged. We also had numerous external databases/tools that were essentially API connections to reduce the number of separate logins we'd have to do, and each of those databases had their own audit mechanisms. Long before we ever had Palantir in my department, we did have an employee who had misused a database for personal reasons. They were initially terminated but that was undone upon appeal. They were reprimanded either way and lost access to various tools/databases going forward for a long time. I know of many stories of police, for example, getting fired for abusing the NCIC databases for personal gain. Sadly it often falls on the agencies to self-police these issues, and most don't have anyone dedicated to this effort. So it really falls on the first line supervisors, of which some are great about it and some couldn't be bothered. I am of the opinion that all security, intelligence, and LE agencies should have an internal team solely focused on audit & review actions for internal abuse/misuse/privacy concerns, but that is a minority opinion from my experience.

<comment><USER20> _From what I recall all activity is logged._

My apologies in advance to offtopic haters. But this is too good to overlook. Did anybody else notice how this question relates to the origin of the name?

</comment></comment></comment></comment><comment><USER21> This isn't surprising. In fact it was expected. This company was born out of the Total Information Awareness mandate by GWB shortly after 9/11\. Total Information Awareness means monitoring of everyone and everything. They got contracts and funding and grew to the original vision set in motion 15 years ago.

</comment><comment><USER22> > Aided by as many as 120 "forward-deployed engineers"

This term popping up again made me curious. To my surprise, that's not just some overloaded nickname (what's cooler than styling yourself with a military or martial arts term, right?), that's what they are actually called:

[https://www.palantir.com/careers/teams/forward-deployed- soft...](https://www.palantir.com/careers/teams/forward-deployed-software- engineers)

<comment><USER23> What's the difference between a normal software engineer and a "forward- deployed" software engineer, though? It sounds to me like that's just their military-flavored version of "rockstar developer" or "code ninja".

<comment><USER24> Well... simply put, a forward deployed engineer is on the front lines of totally crushing it

</comment></comment></comment><comment><USER25> I've always thought - I don't care if the NSA is spying on US citizens because their job is national security. The problem is when those tools trickle down. All of a sudden you have a local cop with too much time on their hands spying on you. But if you're not doing anything wrong, you shouldn't have anything to hide, right? Isn't that how the saying goes?

<comment><USER26> > But if you're not doing anything wrong, you shouldn't have anything to hide, > right? Isn't that how the saying goes?

The problem is that "wrong" can be anything arbitrary, and what's not "wrong" today, it can be "wrong" tomorrow, however arbitrary it is. Somewhere it is wrong (illegal) to call someone a "n*zi", even online.

Also anyone who tells me that they have nothing to hide, I ask for their password. For some reason they don't give me their password. Interesting, huh?

<comment><USER27> Nothing to hide from the law != nothing to hide from you.

<comment><USER26> Law? These are people who have access to your data, how am I, a stranger, any different from any other stranger who have access to your data? Would it be OK if I indirectly obtained your password and use it to access your data or something?

Mind you, I was speaking in general about people who claim they don't care about their privacy, or about these companies collecting their personal data, or having a history of their private messages, etc.

How can you not care about them saving your conversations in plain text, but then suddenly care about it when I ask you to show it to me? The only difference seems to be that I'm actively, personally, directly asking you for it, but ultimately it would be the same outcome.

<comment><USER27> > Mind you, I was speaking in general about people who claim they don't care > about their privacy

We are talking in a thread about NSA having your data vs other companies having your data.

</comment></comment></comment></comment></comment><comment><USER28> Let's suppose you have an actual solution, like a free open source platform that is used by millions of people and took you 7 years and half a million dollars to build, because you saw the problems coming back in 2011? A platform with 5 million users in 110 countries?

It seems the press of today won't really care about solutions, but only highlighting a scandal. Am I wrong? What would one do to get them to write a story about actual solutions like solid.mit.edu or ours:

[https://m.youtube.com/watch?v=pZ1O_gmPneI](https://m.youtube.com/watch?v=pZ1O_gmPneI)

Press kit? News conference? Some kinda weird publicity stunt?

Serious question.

</comment><comment><USER29> And they sell GPDR compliance solutions: [https://www.palantir.com/solutions/gdpr/](https://www.palantir.com/solutions/gdpr/)

Oh, the irony!

<comment><USER15> Is it though? It's pretty hard for companies with lots of diverse data on their users to comply. Finding it all and deleting it is pretty hard. The hope I had was that companies wouldn't track it at all. I fear that only companies that afford stuff like Palantir will collect it, because they can comply and show evidence of complying.

</comment></comment><comment><USER30> When a company is named after the crystal ball an evil wizard uses to spy on his enemies in The Lord of The Rings, and that company's founder was the first large investor in Facebook, and that same founder is able to fund company ending lawsuits against media outlets, headlines like this are akin to "water is wet"

</comment><comment><USER31> After September 11, thre was a big push for "Visual Analytics," which is basically rebranded statistics plus visual data mining tools. There's a report called _Illuminating the Path_ that lays out the research agenda. I read it in grad school when my advisor was trying to tag everything under the sun as Visual Analytics in an attempt to get access to the Visual Analytics money pot. (We didn't.) It's creepy to see it come back around, fully realized by Palantir.

</comment><comment><USER32> Ignoring the enormous argument over whether what I am about to say is legal in the US/America's particularly constructed law...

Is it time to consider whether companies who's primary business is the collection, summation, synthesis, and re purposing of information should be defacto illegal?

Its not that having the government do this is meaningfully better, but I'm convinced that is a better overall path. The public seem more afraid and more willing to engage in a more serious discussion over ethics. At the very least, it would enable the public to have more oversight over how such data is collected, stored, embargoed (or not), and used. The level of abstraction and fuzzing that is allowed by allowing a non-governmental entity like Palantir or Facebook to have (whether as a collector or aggregator) the data and governments be only a user seems too difficult to regulate and even have a transparent discussion about because claims of national security and secrecy are nested within claims of trade secret and intellectual property in ways that create a moat around effective oversight.

So seriously...if we made this business model illegal, what do we lose? What exceptions would need to exist?

<comment><USER33> > Is it time to consider whether companies who's primary business is the > collection, summation, synthesis, and re purposing of information should be > defacto illegal?

You mean IBM/SAP/Oracle?

<comment><USER32> I don't think it is unreasonable within what I said to differentiate the industry that supports data collection and archiving as a broad process (e.g., those you describe) with those that seek and intent specifically to collect and operationalize data about people without fully informed consent.

<comment><USER33> Palantir does not do data collection in that sense. They're much closer to IBM than you realize.

<comment><USER34> Especially if you consider IBM's systems for tracking the Holocaust and Apartheid. Special purpose people-tracking systems.

</comment></comment></comment></comment></comment><comment><USER35> > Cavicchia was in charge of forensic investigations at the bank. Through > Palantir, he gained administrative access to a full range of corporate > security databases that had previously required separate authorizations and > a specific business justification to use. He had unprecedented access to > everything, all at once, all the time, on one analytic platform. He was a > one-man National Security Agency, surrounded by the Palantir engineers, each > one costing the bank as much as $3,000 a day.

I've long thought that the "secret sauce" of Palantir is just that signing a Palantir contract gives executives a reason and excuse to pull together data that had never before been indexed against each other.

I mean, if you take any old dumb BI platform and give it access to data that people have not previously connected, you're going to get new insights.

Someone once described Palantir as a data mapping consultancy that marketed itself as a software platform.

</comment><comment><USER36> Why isn't there a privacy watchdog that constantly monitors these kind of companies?

I also expect this watchdog to test for data leakage from one site/company to another (e.g. by taking on the role of customer).

They should do this on a frequent basis.

Without this, companies seem to be free to do whatever they want.

<comment><USER37> Hahahaha

This is how the fucking government gets around the Bill of Rights, primarily the 4th. When it's outsourced, you have no rights. Parallel construction needs to be the next addition to the 4th or it's own amendment.

</comment></comment><comment><USER38> Sort of off-topic, but I have a need for a graph/relationship oriented database like this (on a relatively tiny scale) and am having a hard time choosing between the many alternatives. Open source is a must, but otherwise I'm primarily interested in ease of use and visualization compatibility - <USER2> want to focus on my problem domain, rather than writing a lot of code or hacking for its own sake. Right now looking at Neo4j and GraphDB, would welcome other suggestions.

Thanks in advance!

</comment><comment><USER39> I think I heard the maxim once "If it can be abused, it will be abused."

We need to start getting ahead of worst-case scenarios and to hell with people that think that approach is paranoid.

</comment><comment><USER40> Wouldn't be interesting if all the Facebook data being collected is really to feed info to Palantir...with a layer of deniability and they get data on billions.

</comment><comment><USER41> This was a huge debate when the Patriot act was passed, that US citizens would get caught up in surveillance.

It seems common in history that during war time, a country aggressively pursues it's own population for spies or sympathizers for the enemy. It send also common that the country goes overboard so as not to let anyone through the cracks and a lot of innocent people get swept up in the process.

</comment><comment><USER42> Why does the media seem to be publishing so many "well duh" tier articles about various companies at the moment? "Big data company collects big data", "company known for monetising private data collects private data", "political consulting company profiles voters and tries to affect vote".

No shit?

<comment><USER43> I know this might be a surprise to you, but not everyone knows everything that you do.

<comment><USER42> I'm not exactly tapping my own research here. Palantir is a big data/spying company, what do you expect from them? Facebook asks you for lots of private data and it's clearly obvious that when you post data on Facebook, Facebook gets that data. So what's the shock that they hold this private data? The only surprising aspect of the current Facebook drama is that they apparently mine your phone for additional data but that's not the main focus of the outcry. Why are people surprised that Cambridge Analytica, a political consultancy, did political research and affected a voter outreach strategy? None of this requires any real background knowledge, and yet the outcry seems extremely disproportionate to the revelations at hand. It seems like the Snowden reports all over again, where the world was up in arms that an intelligence agency was collecting intelligence.

<comment><USER44> Most of the people knows nothing about all these things, until the media picks up the story. They at most believe Palantir is a Skype stone for elves and that Facebook makes money just running ads just like printed newspaper TV stations and radios run ads on very basic criteria (i.e. different ads during a soap opera than during an action movie), but they're not aware of the depth of analysis FB et al. perform.

Example from other field: aircraft passengers have breathed compressor bleed air since jet engines were introduced in the 60s, everyone in the industry knows this is how it works, and yet it wasn't until last year, when major publishers such as Fortune [1], The Guardian [2], Bloomberg [3], The Telegraph [4] etc. happened to simultaneously run this issue, that lot of the general public learned about it for the first time, most of them having assumed that cabin air was taken directly from the atmosphere.

\---

[1] [http://fortune.com/2017/08/09/dangerous-cabin-fumes- planes/](http://fortune.com/2017/08/09/dangerous-cabin-fumes-planes/)

[2] [https://www.theguardian.com/science/2017/aug/19/sick-crew- to...](https://www.theguardian.com/science/2017/aug/19/sick-crew-toxic-air- planes-frequent-flyers-ill)

[3] [https://www.bloomberg.com/news/articles/2017-08-08/airline-w...](https://www.bloomberg.com/news/articles/2017-08-08/airline- workers-warn-of-dangerous-fumes-onboard)

[4] [https://www.telegraph.co.uk/travel/news/world-health- organis...](https://www.telegraph.co.uk/travel/news/world-health-organisation- report-toxic-cabin-air/)

<comment><USER42> the thing is, articles about how facebook collects private data and analyses it have been running pretty much non-stop for the last few years. I would totally understand the reaction if that hadn't been the case.

</comment></comment></comment></comment></comment><comment><USER45> Pop Quiz: Which two companies had their first office at 101 University Avenue in Palo Alto?

The answer says quite a lot, I think.

<comment><USER18> I've found Piazza's Fine Foods Inc and PhysioTouch Inc. Not sure what I'm supposed to take away from this answer though.

<comment><USER46> Facebook

</comment></comment></comment><comment><USER47> this is kind of scary and sad when powerful technology is being misused ...probably it is better to live in China ??? ..the government openly monitoring its citizen instead of spying on them

<comment><USER48> Definitely not, although that specific aspect - you _know_ you're being watched - makes life different, in some way, simpler. The rules are obvious, however, if they change, you might find yourself in a much worse situation, than in the West - for now.

<comment><USER49> > you _know_ you're being watched - makes life different, in some way, > simpler.

Arguably, what happens when people are aware of surveillance is one of the worst parts of it. Following the Snowden revelations, there were noticeable chilling effects:

[https://www.washingtonpost.com/news/wonk/wp/2016/04/27/new-s...](https://www.washingtonpost.com/news/wonk/wp/2016/04/27/new- study-snowdens-disclosures-about-nsa-spying-had-a-scary-effect-on-free- speech/?utm_term=.824c5af75415)

</comment></comment></comment><comment><USER50> So it's a double play on the name now. I.e. it's in the hands of Sauron?

</comment><comment><USER51> Given Thiel's purported views on privacy, the hypocrisy is overwhelming.

</comment><comment><USER52> My main takeaway is that the corporations don't have the funds to waste on this and don't see the ROI (given how many large companies listed in the article stopped using Palantir) whereas the government does. Peter Thiel being a libertarian is clearly aware of the scale of government wastage and decides to go in for the win.

</comment><comment><USER36> How can we build a case against them, and sue them? EFF?

</comment><comment><USER53> > As shown in the privacy breaches at Facebook and Cambridge Analytica, the > pressure to monetize data at tech companies is ceaseless

Says Bloomberg, and includes Facebook code on their pages

</comment><comment><USER54> _" the vast increase in welfare beneficiaries and the extension of the franchise to women [...] have rendered the notion of 'capitalist democracy' into an oxymoron."_

That guy is a nice piece of work.

</comment><comment><USER55> Does anyone else remember a time when paranoia was considered a mental illness rather than a virtue? Or am I imagining that?

</comment><comment><USER56> i find the peter thiel conspiracy-theoretic spiderweb in the article ridiculous (i believe you could make a similar one for any well known vc). I wonder however why he invests in these companies. i mean centralizing intelligence seems a very anti-libertarian thing to do.

</comment><comment><USER57> I can't wait that EU citizen will hit them hard after May 25th.

<comment><USER58> I think palantir is CIA related... They probably are not going to worry about pesky international regulations

<comment><USER59> That's what sanctions are for. But I highly doubt the EU will ever sanction the US as they are so dependant on them.

<comment><USER60> EU has more people and an equivalent sized economy.

The EU could stand up to the US if they felt it mattered.

Other than defence partnerships the EU is no more dependent on the US than the US is on the EU.

It's a two way street.

Unless you think the US would be happy to walk a way from the largest single market in the world (by GDP).

<comment><USER61> Except the EU isn't a country. Poland doesn't have the same incentives that Greece might, as an example.

<comment><USER60> Except trade deals and regulations are negotiated/implemented top down.

So the EU has teeth if the US pushed it too far.

It's hard to get the EU to agree on a lot of things but something sufficient to make the EU consider punishing the US would likely be important enough they would agree.

</comment></comment></comment></comment></comment></comment><comment><USER62> My biggest issue with former military people is that their skills don't easily translate into any other fields and that their mindset is usually heavily canted towards statism, which is a big problem when you combine the kinds of surveillance technology we have with needing to turn a profit. It makes anything East Germany did look like they were underachievers.

</comment><comment><USER63> Culture flows from the top. Peter Thiel apparently views women's suffrage and poor people as "tough for libertarians [like him]". Can we talk about, well, how problematic it is that a company that has information on just about everyone (and all the power this yields) is lead by someone like this?

> As Thiel's wealth has grown, he's gotten more strident. In a 2009 essay for > the Cato Institute, he railed against taxes, government, women, poor > people, and society's acquiescence to the inevitability of death. (Thiel > doesn't accept death as inexorable.) He wrote that he'd reached some radical > conclusions: "Most importantly, I no longer believe that freedom and > democracy are compatible." The 1920s was the last time one could feel > "genuinely optimistic" about American democracy, he said; since then, "the > vast increase in welfare beneficiaries and the extension of the franchise to > women—two constituencies that are notoriously tough for libertarians—have > rendered the notion of 'capitalist democracy' into an oxymoron."

</comment><comment><USER64> Is this really surprising? Palantir's value comes from its data not that god awful interface it has.

<comment><USER65> Really? Because others have frequently claimed the opposite -- that it is a visualization company with the insight to focus on lucrative government contracts.

[https://news.ycombinator.com/item?id=14674460](https://news.ycombinator.com/item?id=14674460)

<comment><USER64> I'm just speaking from my interactions with their platform during my time as a govie. I don't disagree with what you are saying, they definitely capitalized on gov contracts in this space; I should have been clearer with my statement. For groups that know their data well, they tend to push for custom features from Palantir in lieu of developers resulting in some crap shoot interfaces.</comment></comment></comment>


Magnetic Memory Breakthrough - <AUTHOR> http://www.sciencedaily.com/releases/2010/11/101115090802.htm

<comment><USER2> Racetrack memory mentioned in the text of "Spin torque dynamics with noise in magnetic nanosystems (Phys. Rev. B 82, 144404 (2010))": <http://prb.aps.org/abstract/PRB/v82/i14/e144404>

Nik_2213 mentions in <http://www.physorg.com/news/2010-11-racetrack- memory.html> : "Sounds like bubble memory again... Big problem with that was organising data to access it efficiently. FIFO does have a significant latency as block sizes rise..."

I'm betting existing SSD technology though.

</comment><comment><USER2> Related: <http://news.ycombinator.com/item?id=1907174></comment>


Kaspersky: SSL interception differentiates certificates with a 32bit hash - <AUTHOR> https://bugs.chromium.org/p/project-zero/issues/detail?id=978 <comment><USER2> I don't understand how these antivirus vendors are still in business. Even when they do have marginally better detection rates than the built in solution, the licensing, annoying popups, system slowdown, and security- defeating 'features' make them a losing proposition.

Pre-bundled and even purchased AV is so dramatically deleterious to PC performance that MS should kill it as public service. It gives the entire ecosystem a bad reputation and nowadays is completely unnecessary.

<comment><USER3> They've done a wonderful job convincing the majority of people that anti-virus is something that you absolutely need, full stop. Once you have that ingrained in someone, they'll put up with all the annoyances.

<comment><USER4> > They've done a wonderful job convincing the majority of people that anti- > virus is something that you absolutely need, full stop.

I think Microsoft did that for them by being so terrible at security for so long. Windows Defender came out 5 years after XP shipped and several years after average XP systems were riddled with malware.

<comment><USER5> Microsoft had a statute of limitations against shipping anti-virus with the operating system because it was "anti-competitive" according to the EU/DOJ anti-monopoly decisions. Anti-virus wasn't seen as a core security need for an operating system at the time, because the third party AV vendors fought hard for that and used the "Browser Wars" as justification to do that.

<comment><USER4> Then they should have made a much more secure operating system. You only need an AV if your OS has already failed.

<comment><USER6> So literally every OS of any notable use in the world has failed then? Because I'm not aware of any widely deployed OS that hasn't had a successful exploitation written for it.

<comment><USER7> Most OS have some level of penetration, but it is so clearly not the same with windows. Even with the latest exploits free spreading viruses on android are rare but hook a windows machine up to the Internet without a router or firewall and get a virus in seconds.

Android easily outnumbers windows, by some counts 5 to 1, yet it has a smaller percentage and absolute level of malware installation.

The old truism of computer security arms race is bullshit. Computers that are secure from general mass spreading infections it not even all that hard (securing from governments is much harder). Simply ignore all incoming connections and don't execute downloaded data (or give to untrusted executables. The only hard part about this is making sure that network card drivers can be trusted, this isn't hard on most operating systems, but most windows users are totally at the mercy of some low budget buggy vendor.

Windows is well positioned to fail at computer security and they have done a great job at leveraging their position.

<comment><USER8> > Even with the latest exploits free spreading viruses on android are rare but > hook a windows machine up to the Internet without a router or firewall and > get a virus in seconds.

I don't buy this at all. Unless you are comparing Android with Windows XP?

First of all, you'd have to go out of your way to disable the firewall on a modern Windows install.

Secondly, there have been tons of Android infections: [http://arstechnica.com/security/2016/07/virulent-auto- rootin...](http://arstechnica.com/security/2016/07/virulent-auto-rooting- malware-takes-control-of-10-million-android-devices/)

I'm sure the percentage is lower than "all infected Windows machines" but I very much doubt it's lower than "all Windows 10 installations" or even "all Windows XP SP2 + Windows 7 + Windows 10 installations with updates enabled".

Nonetheless, it's definitely the case that an app sandboxing model provides some defence in depth, at the cost of reduced flexibility w.r.t. e.g. a real generic filesystem, ability to distribute/install without an app store, etc.

The Windows Security Development Lifecycle material is worth reading: [https://en.wikipedia.org/wiki/Microsoft_Security_Development...](https://en.wikipedia.org/wiki/Microsoft_Security_Development_Lifecycle) [https://www.microsoft.com/en-us/sdl/](https://www.microsoft.com/en-us/sdl/)

Ultimately, if you were to allow Android devices to by default, open and run arbitrary native code that users download from the internet, you'd see the same host of problems (probably much worse for the average Android device given the fragmented OS patching nightmare).

<comment><USER7> >First of all, you'd have to go out of your way to disable the firewall on a modern Windows install.

There is a screen that pops up everytime you plug in a network cable or connect to a wifi network for the first time. It asks what kind of network you are on, personal, work, public. Depending on what you answer here it does stuff to the firewall.

Then there are the multitude of AV products that disable the firewall with their own suboptimal garbage. These wouldn't have been made if they weren't once necessary. Windows should have had a firewall when it got its own networking stack, but it went a couple of decades without one, so people got used to needing to add one.

Even if that article is correct it is Android off of windows by an order of magnitude.

> Ultimately, if you were to allow Android devices to by default, open and run > arbitrary native code that users download from the internet

But they aren't setup that way. That is part of why they are more secure.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Besides the obvious badness of the overall system described, things like

> The cache is a binary tree, and as new leaf certificates and keys are > generated, they're inserted using the first 32 bits of > MD5(serialNumber||issuer) as the key.

You know. That's not a mistake. That's what a consciously designed-in vulnerability to enable taking over the system looks like.

<comment><USER10> I've met plenty of programmers who are stupid enough to do this kind of thing. Don't attribute to malice what could easily be attributed to stupidity.

<comment><USER11> I'm not a fan of conspiracy theories, but this vuln was not patched in 90 days. Kaspersky frequently patches things faster than that, and this sure sounds like it's a pretty trivial fix.

<comment><USER12> Sounds like it was patched:

> This issue was fixed on the 28th, there was some delay unrestricting this > bug due to the holidays.

And it's been less than 90 days since the issue was reported, so they wouldn't have disclosed yet if it wasn't.

<comment><USER11> Ah, sorry, Nov 1 -> Dec 28 is 58 days.

</comment></comment></comment></comment></comment><comment><USER13> AV = Trashfire. If there were actual repercussions for writing code irresponsibly, even their billions in revenue wouldn't keep them from bankruptcy.

Time and time again we see these ridiculous vulnerabilities but nothing changes. AV insists on massively increasing system attack surface under the guise of security.

<comment><USER14> It's security theatre for your computer. It's truly astonishing how little these programs do and how much they do _wrong_.

<comment><USER15> So what should a non-technical Windows user use on a daily basis to protect their PCs?

<comment><USER16> Whenever I set up a Windows PC for a family member or non-technical friend, I just make sure Windows Defender is running, set everything that is installed to auto-update and install an adblocker. Also, I check every once in a while if the auto-updates are working correctly because in my experience they will inevitably and inexplicably stop working at some point :)

<comment><USER17> > I check every once in a while if the auto-updates are working correctly > because in my experience they will inevitably and inexplicably stop working > at some point

I think Windows 10 tries REALLY hard to make sure that doesn't happen.

</comment></comment></comment></comment></comment><comment><USER18> This puts in perspective the Eugene Kaspersky's recent rant about Microsoft making AV vendors life harder: [https://eugene.kaspersky.com/2016/11/10/thats- it-ive-had-eno...](https://eugene.kaspersky.com/2016/11/10/thats-it-ive-had- enough/) Maybe Microsoft is actually improving the Windows users experience.

Discussion on HN: [https://news.ycombinator.com/item?id=12929230](https://news.ycombinator.com/item?id=12929230)

<comment><USER19> There's no "maybe" about it: there are a lot of security professionals, including ones with no great love for Microsoft and their past anticompetitive practices, who are longing for the day when MS announces that third-party AV software is malware and takes action accordingly. I for one would be spitting on their grave if and when it happens.

</comment></comment><comment><USER20> An even dumber TLS bug in the same software:

[https://bugs.chromium.org/p/project- zero/issues/detail?id=98...](https://bugs.chromium.org/p/project- zero/issues/detail?id=989)

</comment><comment><USER21> I wonder why nobody assumes Kaspersky might be working at the direction of Putin.

<comment><USER20> Kaspersky's connections with the Russian government are discussed all the time in the industry.

<comment><USER21> There would seem to be significant benefits to maintaining a white hat presence while gaining access to thousands of machines and maintaining a body knowledge about the latest threats/techniques.

Do you have any thoughts on the validity of the speculation?

<comment><USER22> No idea if Kapersky is a black hat in white haberdashery, but the behavior you describe is 100% Kremlin modus operandi. That's how they do propaganda too -- a bunch of real news with some fake news mixed in. It's a good idea for _any_ propaganda outfit.

</comment></comment></comment></comment><comment><USER23> Trying to understand this: Is it that Kasperkey thinks its certs are more secure? Which I suppose would be the whole point behind this WPF driver?

<comment><USER24> It wants to look at the contents of every connection in order to hunt for malware.

<comment><USER22> sort of like following ones own footprints.

</comment></comment></comment><comment><USER25> Just yesterday I had posted a similar thread where an AV was MITMing traffic between the browser [https://news.ycombinator.com/item?id=13307096](https://news.ycombinator.com/item?id=13307096). I'm still curious why this practice is allowed and these CAs are still trusted by browsers and such.

<comment><USER26> Because the AV is doing it to check for malicious content being downloaded via a secure connection - content that may be exploiting security holes that have not been patched yet, or which have been patched but the user hasn't updated. It's not at all uncommon for me to be asked to look at a PC and find it has an old version of Firefox and the only user is running as a non-admin, or even more commonly to find all those nice little buttons in the system tray advising about updates to Adobe Reader, Java, and maybe a few drivers.

Many things that would take advantage of those would need to be written to disk and the AV could presumably catch them then, but how about JavaScript exploits? And how does the browser respond to writing things to disk (presumably having exclusive write access) then losing access to them?

There's a juggling act going on there, and I suspect it's a lot easier for an AV vendor to capture and review the network traffic as a single point of contact rather than trying to work with multiple browser and other software vendors to make sure that their software interoperates correctly with the AV.

</comment></comment><comment><USER27> Is there a convenient way to check whether your Windows 10 and Firefox certificate stores contain anything that Microsoft and Mozilla didn't suppose to be there?

<comment><USER28> RCC from [https://www.trustprobe.com/fs1/apps.html](https://www.trustprobe.com/fs1/apps.html) does iirc. It's been a while since I've used the tool and I'm not on my PC to check.

<comment><USER27> That's exactly what I had been looking for. Thank you so much!

</comment></comment></comment><comment><USER29> Something similar is done by my organisation with the firewall(Fortinet/Fortiguard). We are forced to install a certificate as a trusted authority in the system store. So as the link says if we check the issuer it shows issued by FortiGate CA. This is very annoying and needs to stop.</comment>


Ask HN: Websites that allow Python to run in browser for learning? - <AUTHOR> <comment><USER2> [https://repl.it/](https://repl.it/)</comment>


Spy Agency Consensus Grows That Russia Hacked D.N.C - <AUTHOR> http://www.nytimes.com/2016/07/27/us/politics/spy-agency-consensus-grows-that-russia-hacked-dnc.html <comment><USER2> I can easily imagine that state hackers in Russia would want to penetrate the DNC. It's full of great political information on one of their rivals.

Releasing it? I'm not sure if that is traditional spy craft.

Julian Assange has hinted that the WikiLeaks dump was originally sourced from an insider.

It's not impossible that BOTH narratives are true.

Conspiracy theories:

I'm not entirely convinced that it was Russia. They point to an IP address that is a proxy server in Russia. If it was Russia, wouldn't they put the proxy server in another jurisdiction to throw people off the trail?

<comment><USER3> > Releasing it?

Why not. Governments hack each other to get an edge. Sometimes to just know what is going on, sometimes for silent diplomatic 'cheating'. And if they think they would benefit, I am quite sure its not above Putin to release it for propaganda reasons.

</comment></comment><comment><USER4> Excerpt from the article:

The Crowdstrike report ... concludes that the Federal Security Service, known as the F.S.B., entered the committee's networks last summer.

The G.R.U., a competing, military intelligence unit, was a later arrival. Investigators believe it is the G.R.U. that has played a bigger role in releasing the emails.

(end of quote)

One has to wonder: who else was wandering through the DNC's computers?

<comment><USER5> The emails only confirm what everyone already knew. It was like Snowden, a shock only to those who weren't paying attention.

</comment></comment><comment><USER6> >But intelligence officials have cautioned that they are uncertain whether the electronic break-in at the committee's computer systems was intended as fairly routine cyberespionage — of the kind the United States also conducts around the world — or as part of an effort to manipulate the 2016 presidential election.

Does this bother anyone else? I appreciate that the NYTimes is willing to print an admission that the US also plays rough in cyberspace, but only probably because public awareness of this already exists. It appears as an attempt to setup the possibility that this hack was not "fairly routine cyberespionage which the US also does" which is apparently OK, according to the NYTimes, but as possibly some other type of malicious hacking.

So what they're saying is: Nation state hacking is OK, as long as it abides by some untold, arbitrary guidelines, but we're not sure yet as journalists yet how to spin this any further.</comment>


Rackspace Launches Service Registry - <AUTHOR> http://www.rackspace.com/blog/keep-track-of-your-services-and-applications-with-the-new-rackspace-service-registry/

<comment><USER2> I think this will be a great product for startups -- everyone wants to build products on top of a dynamic environment, but to really do it, you would need to invest in heavy use of things like using Zookeeper -- but Zookeeper has a very high cost to integrate and maintain.

Netflix has released something very similar, Eureka, as open source here:

<http://techblog.netflix.com/2012/09/eureka.html>

But the Rackspace Service Registry comes with a SaaS model, more client libraries, and is hopefully easier to integrate.

(disclaimer, I work at Rackspace, but not on this product)

<comment><USER3> This is interesting. How er the true cost of inter service discovery is in maintenance. Adding a new service is trivial. Deprecating a service, or an API major rev, is a PITA. Eventually you just end up with an unmaintainable morass of "deprecated" services and dead ends.

Speaking of, what's the work flow around service API revs? New config knob then query on the client side? Create a new service instance.

<comment><USER4> The service registry I wrote (<http://github.com/substack/seaport>) is fundamentally version-aware to avoid this problem. You register services with a semver such as `firstname.lastname@example.com` and then clients or other services query for registered services with semver query strings such as `firstname.lastname@example.com`. This way you can specify your breaking changes much more explicitly and not need to port over the clients to the new service all at once.

</comment></comment></comment><comment><USER5> You can also use Doozer(d)[0] which is similar to Apache Zookeeper[1] and Google Chubby[2].

[0] <https://github.com/ha/doozerd>

[1] <http://zookeeper.apache.org/>

[2] <http://research.google.com/archive/chubby.html>

<comment><USER6> I was under the impression that Doozer was ditched by Heroku, keep in mind this was through the grapevine and therefore; it's speculation.

<comment><USER7> This[1] seems to be the fork most people are following these days.

[1]: <https://github.com/4ad/doozerd></comment></comment></comment>


You Don't Have to Ditch the Day Job - <AUTHOR> http://www.businessweek.com/smallbiz/content/mar2008/sb20080317_710238.htm?chan=smallbiz_smallbiz+index+page_top+small+business+stories <comment><USER2> I was reading the article and I realized I'd read the article before.. Congratulations to Tony Wright of RescueTime getting a by-line about building his sustainable Web business in BW!

I'm curious how BW found him. Does BW read News.YC? <http://www.aiderss.com/all/www.tonywright.com>

<comment><USER3> Heh-- yaw, it's a reprint. No clue how he found it (mebbe VentureHacks).

Heh-- not sure my business is sustainable yet-- but we're gettin' there.

<comment><USER4> I've read the article before too, but congrats on getting published in BW!

<comment><USER5> very cool fellas, and it also parlayed into a sweet shout-out for Weebly founder David Rusenko. YC power!

</comment></comment></comment></comment><comment><USER6> Yeah, but it's hard and can get downright depressing. I am doing this right now and while I find my project interesting, it sucks most of what little free time I have without any guarantees of actually producing anything permanent. The thought of wasting 4-5 months of my life like that scares me.

Not only that, but because you can't devote much time, things tend to progress somewhat slowly leading to infrequent milestones, further sapping your motivation.

Anyway, enough with my bellyaching. That's pretty good advice, although I'd add "frequent releases" to it, even if these releases will be shown to no one but your cheerleaders. It is both motivating to have something to show others and also forces you to tie up and finish a ton of small, but important things which would have otherwise been left in favour of working on the larger features.

<comment><USER7> "The thought of wasting 4-5 months of my life like that scares me."

I get that. It is incredibly difficult when you look at it like that. I have personally felt that pain of, "So, who I do I take time from, my wife or my kids?"

However, in the case you mention, it is only 4 or 5 months of nights and weekends. What is that, 30 actual days max? Would you trade 30 days of the thousands and thousands in your life to be able to make something you are proud of and potentially allow you to spend all of your time doing what you love? I know I would.

Obviously, thinking like that can lead to a workaholic, Cats in the Cradle (google it, young'ns) type existence, but with measured use of it and diligence at maintaining boundaries, I think it is possible.

I remember when I had a friend ask to me run in a 5K. Before that, I wouldn't run unless being chased, and even then... However, I realized as much as a pain as it might be, even being slow 5K is about 30 minutes. No matter how painful, annoying, embarrassing, it is, that's half an hour. 2% of 1 day. I decided right then that I could do anything for 30 minutes - and did. This is the same sort of thing.

You can do anything for 4 or 5 months and see what happens. This IS your life, and it's ending one minute at a time.

</pollyanna boosterism>

</comment></comment><comment><USER7> Great article and lots of good advice.

The one about cheerleaders is important. I'd hemmed and hawed around my idea for months, but once I started building it, using it myself, and had a few friends as alpha testers, it became much more exciting to work on because I was making it for me. I could see the incremental things needing to be done to improve it as opposed to just a giant mount of unformed and uncompleted toil.

I also like the idea of using wasted time to at least learn something. Of course, the danger there I face is reading a new blog post that more elegantly solves a problem than I recently had and wanting to go back and refactor (or worse, rewrite from scratch). As long as I can keep that in check and moving forward, it's great advice.

</comment><comment><USER8> Love number six about using down time at work to get smarter about useful things. The nice thing is that when you are in the media or marketing biz, there's not much you couldn't make a case for wanting/needing to know for your day job anyway.</comment>


FixSSL.com - HTTPS for any URL - <AUTHOR> https://fixssl.com/ <comment><USER2> Who would want to "fix" the pop-up problem by making the images load less quickly by going through a proxy? Also, this would affect performance for all users with every browser, not just IE (Chrome doesn't have those annoying pop- ups, instead it shows a warning in the URL bar).

In my opinion, this is finding a solution to a non-existing problem. I'm pretty sure users can deactivate that pop-up anyway so it's not the website's problem. They could always serve the images in https on their own server.</comment>


Ameelio wants to take on for-profit prison-calling rackets after - <AUTHOR> https://techcrunch.com/2020/05/14/ameelio-wants-to-take-on-for-profit-prison-calling-rackets-after-starting-with-free-letters-to-inmates/ <comment><USER2> Prisons are horrible places, we need to treat prisoners like humans who made a mistake and can be redeemed, not like cattle to extract resources and value from. In the USA, at least, prisoners are almost literally slaves and are basically tortured.

Good luck to this team, I hope it's a great success and demolishes the competition.</comment>


Mirage OS - <AUTHOR> http://www.openmirage.org/ <comment><USER2> What is an average Joe optimal use case of a cloud-based OS?</comment>


More than 500,000 Google Reader users have joined Feedly in the past 48 hours - <AUTHOR> http://blog.feedly.com/2013/03/15/priorities-keeping-the-site-up-and-adding-new-features/ <comment><USER3> I believe most users are currently in a "searching" phase, and have joined more than one alternative, so this sudden growth might be misleadding. That said, for now, Feedly is my favorite alternative, so good luck.

<comment><USER4> "Misleading" in the sense that only a fraction of those may become loyal Feedly users, sure.

But it seems like a pretty good estimate of the number of active and aggrieved Google Reader users out there.

<comment><USER5> A good lower limit. Not everyone has the time or inclination to take immediate action. I'm a heavy user of Google Reader and I haven't yet taken an action. I probably won't for at least a few weeks.

What is baffling is that Google can't or won't monetize a product with that many users.

<comment><USER6> >What is baffling is that Google can't or won't monetize a product with that many users.

Shockingly, nerds that consume media via RSS don't tend to click on ads.

<comment><USER7> Google Reader didn't have ads. I've seen guesses that Google didn't want to risk upsetting media producers by displaying ads with their content.

<comment><USER8> There used to be adsense for RSS. Google discontinued it sometime last year I think.

<comment> mkr-hn It was completely voluntary and managed by the producer through their AdSense account.

<comment><USER8> Yeah, But adsense publishers share the money with google. Same way blogger (blogspot) does.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I tried feedly, the old reader, and newsblur. The old reader is nice, but no mobile :-(. Newsblur is a mess ... i want a reader that gets out of my way. The only thing it really needs to do is let me organize things my way. Newsblur has that intelligence nonsense ... i already curated and organized. I don't need more. Sorry - i don't want to share with others either. It's for me. The interface has so much going on. I can't understand why HNers like it so much. Feedly is the (im)perfect choice so far. I wish it had more organizational settings, especially global. The "today" page is interesting, but i wish i could exclude some feeds that publish way more than others and just fill up the screen (sites like Ars Technica where i prefer to see their list of articles in rss rather than on their site). I expect LOTS more option to appear in the coming months, but right now, for a web based solution, Feedly is head and shoulders the best (imo). Their android app is really nice - takes a bit of getting the handle on, but after a few minutes, it seems like the absolute right way to do things (nevermind the great integration with Pocket). Cheers Feedly -- looking forward to an expected innovation run by you folks and hopefully a pay version.

</comment><comment><USER10> Feedly seems to be doing the best out of the alternatives for performance in light of the deluge of Reader refugees (Newsblur, WTF?) -- but it is still very "sparse" in layout. I haven't figured out a way to get a simple listing of articles per feed like Reader does, which means it won't work for me.

I want something even more dense than Reader, or at least no worse. TheOldReader is close, but I would prefer something with iOS clients as well.

TT-RSS is looking like the best option (even though it has no apps), but I don't really want to have to host a PHP app.

Philosophically I love Feedly (YC company, startup, etc.), but I don't think they want to make some dense power user tool like a direct Reader replacement.

<comment><USER11> See: [http://blog.feedly.com/2013/03/14/tips-for-google-reader- use...](http://blog.feedly.com/2013/03/14/tips-for-google-reader-users- migrating-to-feedly/) (linked from the post)

Tip #1: "A more condensed view"

<comment><USER10> I mainly meant the iOS app, and the per-story view -- there is a lot of whitespace. The iOS app doesn't seem to actually accept the more condensed view as a global default, either, and only sometimes accepts it when I set it within a given rss feed.

I also dislike the Chrome extension (vs. pure web-only).

OTOH, it is really pretty, so I'm thinking of using it for recreational use anyway. It's just not an ideal research replacement for google reader yet.

</comment></comment></comment><comment><USER12> Add to Chrome:

\- Access your data on all websites

\- Access your tabs and browsing activity

Yeah, right. I'm an idiot?

<comment><USER13> Also it adds a button to the bottom right of every web page. I immediately uninstalled when I learned this.

Newsblur has no such shenanigans and is developed by a HNer.

<comment><USER14> Was very excited to try Newsblur.

It's not free, for those wondering, and free accounts are temporarily suspended.

Oh well. Time to move on.

<comment><USER15> What's wrong with paying for a service that you find useful?

<comment><USER16> I don't have any method of paying online, well, there is, but it takes too much of effort doing the paperwork in bank that it's not even worth it. I don't live in first world country.

<comment> mkr-hn Install a LAMP/WAMP thing (+ python) and run NewsBlur locally. You could even make a local edition where people can pay you in person.

</comment></comment></comment></comment></comment></comment><comment> mkr-hn FYI: There's 1400+ votes on a feature request for getting rid of the extension [https://feedly.uservoice.com/forums/192636-suggestions/sugge...](https://feedly.uservoice.com/forums/192636-suggestions/suggestions/3744181-make- fully-web-service-because-some-corporation-c)

Vote for it if you want to hammer the point in. The extension is probably for that irritating button that's on all pages until you disable it (preferences at the bottom of the folder list).

</comment><comment><USER17> It scares me that they add 500,000 users and I don't understand how they make money.

At this point I'd like to either pay for a service or use something self- hosted to make sure I don't have to go through a painful transition again.

<comment><USER18> They must be selling your info. Just look at the Chrome access: "Access your data on all websites" and "Access your tabs and browsing activity"

<comment><USER19> Are you really just going to defame a company based on nothing but the granularity of Chrome's extension permissions? That's not just irresponsible but downright malicious.

Any extension that interacts with webpages needs that permission. Even if it's just to add a button. Before you go accusing them of selling information about your web browsing, you could at least check if they collect that information in the first place. Which is easy, since a network inspector is built-in to Chrome, and Chrome extensions are just ZIP files you can open up to read the code inside.

Hint: They don't. The plugin inserts a share image into the page, and the image is embedded in the plugin, not hosted on Feedly's server. It creates no network requests at all, so there's no involuntary information passing happening.

</comment></comment></comment><comment><USER20> If 500k users switched in 48h, 3 months before the shut down, how many users the Reader actually has? It seems it must be a lot.

<comment><USER21> Do you think all of the 500k were actual Google Reader users? It's possible a portion are jumping on the hivemind's bandwagon. Not discrediting the cause, just saying that some people like to join causes for the sake of joining causes.

<comment> brown9-2 Exactly - how do they know which product their users were using before signing up for Feedly?

<comment><USER22> They let you import your google reader data.

</comment></comment></comment></comment><comment><AUTHOR> I looked at 10 or 15 readers and am using Feedly at the moment. I tweaked it a little to get a minimal and compact layout.

<http://wp.me/aseR-cs>

I added an extension [1] to open articles in a background tab (their keyboard shortcut foregrounds the new tab).

I made a simple new style in Stylish [2] to streamline the UI:

      #feedlyTitleBar {display:none !important;}
      #feedlyPageHeader {display:none !important;}
      #systemBar {display:none !important;}

So far this works for me.

[1] [https://chrome.google.com/webstore/detail/feedly-will- open-e...](https://chrome.google.com/webstore/detail/feedly-will-open-entry- in/ebjjigiapfaenlmhdidmmcaekjhclehj)

[2] [https://chrome.google.com/webstore/detail/stylish/fjnbnpbmke...](https://chrome.google.com/webstore/detail/stylish/fjnbnpbmkenffdnngjfgmeleoegfcffe?hl=en)

<comment><USER23> So much relative effort and baggage compared to how Reader works. Reader's death continues to sadden me.

<comment><AUTHOR> Actually I had to make the same changes to Reader.

<comment><USER24> For background tabs, Reader doesn't require an extension. All links should be normal <a> tags, just middle-click (or right-click > new tab) and it opens behind Reader.

<comment><AUTHOR> It has been a long time since I checked, but it didn't work for the keyboard shortcut ('v' I think in Reader?)

</comment></comment></comment></comment></comment><comment><USER25> Congratulations on being well-positioned and ready to handle the onslaught when Google announced that they were axing Reader. You clearly were "where the puck will be" :)

</comment><comment><USER26> Just when we were discussing the complete lack of online privacy, here's a _free_ app that just happily added new servers and 10x bandwith to accommodate 500 000 more users.

Sweet. Nevermind how they can afford all that capacity. Maybe they're a charity, funded by Bill & Melinda?

<comment><USER27> I'm sure they will come out with a premium version or some such eventually. If you were Feedly would you really turn down the opportunity provided here just because you can't immediately monetize the new users?

</comment></comment><comment><USER28> If this many Reader users converted in so short of time, then it is amazing that Google could't find a way to monetize the service or at least keep it revenue-neutral, or even have it be a useful loss-leader

</comment><comment><USER29> So, nobody was using Google Reader anyway, declining numbers and so on, eh?

<comment><USER30> It's a question of scale. When a company has services with more than 400 million users, a stagnant half a million is not that great.

<comment><USER31> I suspect the number of active GR users is closer to 50 million, seeing as 24 million people are subscribed to the CNN feed alone.

(I'm subscribed to hundreds of feeds, but CNN isn't one of them. I also think most users outside of the US won't be subscribed to the CNN feed.)

[http://googlesystem.blogspot.com/2013/03/google-reader- data-...](http://googlesystem.blogspot.com/2013/03/google-reader-data- points.html)

<comment><USER32> If it was anywhere near 50 million active users, Google Reader would not have been shut down. Even if it was 25 million actives it would still be kicking. Plain and simple. Subscribing to CNN seems like the behavior of beginner RSS readers who abandon the concept. Seems like a good idea, but a general, high volume feed with more noise than signal for the average person doesn't really make sense for Google Reader user. I'd be shocked if the number of those actively reading the CNN feed was anywhere above 5 million.

For comparison, CNN on Twitter only has 7.7 million followers. Do you honestly believe 3x more people are reading CNN's RSS feed than their Twitter feed?

<comment><USER33> Yep. RSS is a better way to read news. If I subscribe to an RSS feed then I get to pick through the whole thing at the point where I feel like reading it. Twitter just blasts past so fast it's gone in minutes, I miss maybe 90% of my Twitter stream (conservative estimate, it's probably more). I realise you can go and look at an individual Twitter feed but it takes several clicks to see the whole thing and it's not as fast as RSS.

</comment></comment></comment></comment></comment><comment><USER34> As far as I can tell Feedly has no OPML export feature, so if it eventually goes away it's a dead end for users.

(Please prove me wrong, but I searched the site and also installed the extension to try and find one.)

<comment> mkr-hn It's a frontend for Google Reader right now. I think most are assuming the option will appear when they switch over to their own API after Reader goes dark.

However, you should vote on the suggestion just in case: [https://feedly.uservoice.com/forums/192636-suggestions/sugge...](https://feedly.uservoice.com/forums/192636-suggestions/suggestions/3744603-google- reader-an-option-to-export-ompl-data-we-ne)

<comment><USER34> Ah, right, thank you. I hadn't realised they weren't importing, just accessing.

I'm not a feedly user so I don't mind but thanks for the link to the suggestion, good to see it's being considered.

</comment></comment></comment><comment><USER35> They are currently #1 in trending apps on the Chrome store: [https://chrome.google.com/webstore/category/trending?utm_sou...](https://chrome.google.com/webstore/category/trending?utm_source=chrome- ntp-icon)

And #4 in Android trending apps: [https://play.google.com/store/apps/collection/movers_shakers...](https://play.google.com/store/apps/collection/movers_shakers?hl=en)

</comment><comment><USER36> I wish it worked in IE. By that I mean I wish it worked without a browser extension.

</comment><comment><USER37> "You venture to call Ferdinand a wise ruler," he said to his courtiers—"he who has impoverished his own country and enriched mine!"

</comment><comment><USER38> In contrast to a lot of discontent about the Reader's demise, think about the opportunities it brings for this market? I've seen at least 10 alternatives popping up these last 2 days. Google leaving jump-started the competition in a seemingly stagnant field.

</comment><comment><USER39> Surprisingly, Feedly seems like the best replacement at this point. But it's bizarre that Feedly requires plugin/extension for browsers and an app for iOS. Obviously the winning solution is a web site and iOS-optimized web pages.

</comment><comment><USER40> I would love to see how Feedly is, but it's completely broken in Safari. It asks for approval via Google OAuth on every page load, and once it has approval it displays a login page, again.

There seem to be a number of issues surrounding this. Some people point to OAuth being the problem. Some people point to the Safari extension. One way or another, it's broken, and there's absolutely nothing on their Twitter, blog, Uservoice, or Get Satisfaction even indicates they're aware of the cloud of problems surrounding Safari usage.

</comment><comment><USER41> Feedly must be having a party now. Kudos to them.

</comment><comment><USER42> One man's trash is another man's treasure.

</comment><comment><USER43> Sounds like a <http://highscalability.com/> post to me!

</comment><comment><USER44> Man, how I hate blogs that I can't find a link to the main site!!! And it appears to be the rule!! :-/

</comment><comment><USER45> Does Feedly for IOS have a feed limit? I have I think 160 feeds and it seems to cut me off at 90 I think. My feeds just aren't there. I dont find any settings that help with this either.

</comment><comment><USER46> Is there any way of turning off the "Featured" content at the top? This is like Facebook pushing content that I never asked for. Here it's right at the top too.

Other than looks good.

<comment> mkr-hn Switch to a different view with the little gear icon at the top. I don't know about other views, but the Titles view doesn't have the featured articles thing. That said, Featured only shows posts from your own subscriptions within the folder, not from some shared collection or advertiser pushing.

</comment></comment><comment><USER47> Feedly is a good alternative, but not great. Those guys should prioritise a bit more functionality over designs (and remove all those CSS animations!!!)

</comment><comment><USER48> I'm happy for them but I just don't like their interface. Anyone knows if Feeddler has plans to keep going? I like that app.

</comment><comment><USER49> If I had a feed reading service, I'd consider making a blog post just like this, hoping to make it self-fulfilling.

</comment><comment><USER50> Don't understand why more people are not just sticking with Google Reader until it closes instead of switching now.

<comment><USER51> If you rely on Google Reader for your daily workflow, figuring out which service or application is a suitable alternative after Reader closes is too late. Unless you're hoping for a 180 from Google, which there's no evidence to support right now, waiting just cuts the amount of time you can use to test the alternatives while still having access to Google Reader as a fallback.

<comment><USER15> One good reason is that the RSS reader landscape is going to change drastically in the coming months as other developers jump to fill the hole left by Reader. The app you end up using may not even exist yet. Sure, the cost of switching is low, but it still seems like a waste of time to start searching now when so much will change in the next 3 months.

<comment><USER51> If you're sure the app you'll end up using hasn't been made public yet and the current alternatives are not going to do it for you, that's a risk you can take, definitely: but it's still a heck of a risk if Reader is integral to what you do online. At any rate, I don't think it's _that_ hard to understand why thousands of people are already making contingency plans this far out.

</comment></comment></comment></comment><comment><USER52> To add Chrome, but provide data access on all websites and access to table and browsing activity?

No way.

</comment><comment><USER53> Just how do I register on Feedly and read the feeds via the browser not mobile device?

</comment><comment><USER54> Hey I hear you can download software to your own computer and use it without having a dependency on a cloud service. Craziness!

<comment><USER55> Which was a great solution when I only had one computer and a phone that could send SMS and nothing more.

These days? Not so much.

</comment></comment><comment><USER56> I see a lot of users just going to every service mentioned by that blog or that blogger. Without any research. As '@nsns' says it's the searching phase.

There are services that are famous as of now, very famous. Not because those are best out there(or even better than average) but because they played good on social scene the day Google read out Reader's death sentence. Feedly, having used them, is certainly not a great service. It's a client that is everywhere. It's a good one(must be) I personally never liked it.

But at least they are handling the load better than others. NewsBlur looks like a slow clunky web app. There are few others like FeedHQ.org and 1kpl.us but none of them are still there.

Looks like Feedly is just hoarding users with a promise to be sth that at least they are not going to be - the 'holy grail' of RSS sync service - <USER2> is the void GR actually created. A clean and fast web app/server where our feeds can reside in the cloud. And all the blog posts out there are talked about just one thing - these clients; and users listened.

That is how they have these many numbers.

</comment><comment><USER57> Of course! This seems to be the most recommended substitute, my question is why? Is it really that much better than the rest?

<comment> mkr-hn NewsBlur was a kludge when it worked and let you add more than 12 feeds. And Feedly was prepared for Google announcing the Reader shutdown. NewsBlur could be a strong contender for the next exodus when Reader finally goes dark, but it has a long way to go.

The rest are a bit weird, mobile-only, or don't know what they're going to do when the Reader API they depend on shuts down.

Personally, I like Feedly's UX. It's like an evolution of Reader. It's much smoother, and has a magazine view for feeds where it makes sense.

</comment></comment><comment><USER58> marketers dream right there. retention strategy a/b 101 week</comment>


Ask HN: Who is the guy I see every time I click on the Y logo accidentally? - <AUTHOR>

I have probably seen his face 50 times. You know the guy I am talking about, the one with the glasses pushed up on his head. Is he part of any successful or failed YC company that I might know? Just curious. <comment><USER2> [https://news.ycombinator.com/user?id=tolmasky](https://news.ycombinator.com/user?id=tolmasky)

<comment><AUTHOR> Ha, thanks!

</comment></comment><comment><USER3> I was also really curious about that. What about the other people? Can we get some context on the photos (the rest of the slideshow, that is)?

<comment><USER4> The red-haired guy is Patrick Collison (co-founder of Auctomatic and Stripe).</comment></comment>


10/GUI is the most dramatic reimaginations of the desktop user interface - <AUTHOR> http://ignorethecode.net/blog/2009/10/13/10_gui/

<comment><USER2> This is truly amazing. I'm almost speechless.</comment>


Ask HN: Develop a mobile or web app for starting a business? - <AUTHOR> I have a few ideas in either space, but I'm wondering which one would be better, in general, to base a 1 man business out of? Which out of the two would be most likely to allow me support myself just by the project? <comment><USER2> Solve a problem first, then decide which platforms best help you do that.</comment>


Petascale Tcl with NAMD, VMD, and Swift/T - <AUTHOR> http://www.mcs.anl.gov/publication/petascale-tcl-namd-vmd-and-swiftt

<comment><USER2> And to think it started with my decision to roll Tcl into VMD rather than continue with our homebrew command language.</comment>


Financing my Game on 8BitFunding: Day 2 ($1765 pledged, $4235 remaining) - <AUTHOR> http://blog.tametick.com/2011/01/cardinal-quest-on-8bitfunding-day-2.html

<comment><AUTHOR> For those interested in what the game is about:

Video: [http://www.youtube.com/watch?v=WEopZAmMd1E&feature=playe...](http://www.youtube.com/watch?v=WEopZAmMd1E&feature=player_embedded)

Screenshots: <http://imgur.com/a/JcgVL>

Concept art: <http://imgur.com/Hcfvy>

Page on 8BitFunding: <http://www.8bitfunding.com/project_details.php?p_id=65></comment>


A Superscalar Out-of-Order x86 Soft Processor for FPGA (2017) - <AUTHOR> https://tspace.library.utoronto.ca/handle/1807/80713 <comment><USER2> From section 6.8 (p. 69) "Note that the decoder's microarchitecture design is complete, including the branch predictor design and micro-op sequences for nearly every x86 instruction and behaviour. Our circuit implementation is less complete than our microarchitecture design (implemented as a detailed pipeline simulation)"

Still an impressive work.

</comment><comment><USER3> How is this legally handled considering amd owns x86-64 and Intel owns x86?

As long as it's not used in commercial settings, will they pretend not to see it while users are in a legally gray area?

<comment><USER4> This is x86 only, and a quick skim of the dissertation suggests that it doesn't implement any post-P6 (Pentium Pro) instructions. The P6 is 24 years old now so presumably all patents are expired?

<comment><USER5> The last time I looked, the MMX patents were close to expiry too, and by now they might be.

<comment> Const-me MMX is from P5.

P6 supports MMX and later revisions SSE 1.

The next one after P6 is NetBurst, it introduced SSE2 and later revisions SSE3.

</comment></comment></comment></comment><comment><USER5> _Our microarchitecture achieves 2.7 times the per-clock performance of a performance-tuned Nios II /f, Alteraâ s fastest (RISC-like, single-issue, pipelined) soft processor, and 0.8 times the frequency, for a total performance improvement of 2.2 times._

It'd be very interesting to compare this to RISC-V.

<comment><USER6> Note that this the Nios II/f is an in-order CPU, while this is a superscalar CPU. A more relevant benchmark would be the superscalar dual-issue ARM Cortex-A9, illustrated in figure 13.4. It's about the same performance as that one if you average all the benchmarks.

In theory, RISC-V should be at about the same performance as ARMv8 (note that Cortex-A9 is ARMv7): [https://news.ycombinator.com/item?id=15343287](https://news.ycombinator.com/item?id=15343287)

<comment><USER7> >In theory, RISC-V should be at about the same performance as ARMv8

Or POWER9, the cpu with the fastest IPC. And it's RISC.

There's nothing to prevent RISC-V ISA from getting high performance implementations.

</comment></comment></comment><comment><USER8> I am by no means an expert in digital design (I have only worked with them as a SWE), but it seems to me that the use cases for a high performance soft processor are pretty few and far between. After all, if you want a fast processor you can get a hard processor with excellent performance/support for less than the FPGA fabric likely cost.

Still a cool piece of tech though.

<comment><USER9> The main use for soft processors is for hybrid designs. Stuff that needs some significant programmable logic for really performance or timing sensitive applications, but where other functionality is better implemented in an easier to program CPU. If you're gonna have to use an FPGA anyway, it is frequently easier/cheaper to just implement a soft core processor versus adding a separate discrete processor (which is more involved than just adding a single chip, you need all the supporting circuitry, interconnects, routing on the board etc).

The other use case is sorta the same thing, but is as a normal CPU with a few custom extensions. Sometimes no manufacturer's product fits your needs well and ASICs are expensive (also difficult to change), so some companies just ship customized CPUs on FPGAs with whatever extensions they need.

Xilinx's Zynq chips (FPGA with an ARM core) have been very successful, which kinda demonstrates that this is an attractive combination.

<comment><USER10> Time to market is also sometimes a factor; putting a soft processor onto the unused parts of an FPGA is far easier than bringing up a SoC combining CPU cores with special-purpose compute or IO.

The high-end SSD market has had a lot of FPGA-based products for years, and recently many of them are using any leftover gates to add user-accessible CPUs (or occasionally ML-focused compute resources). It turns out that there are quite a few uses for having a CPU extremely close to your massive pile of data, rather than having a relatively narrow PCIe link between the storage and the CPU. These SSD controllers are usually forced to use pretty large FPGAs in order to have a high enough pin count to manage several TB of flash, and it seems that they often have logic elements to spare.</comment></comment></comment>


Undeletable Cookies - <AUTHOR> http://www.schneier.com/blog/archives/2011/08/new_undeletable.html <comment><USER2> Very interesting, and evil: abusing the ETag mechanism for user tracking. (If a user requests some sort of unchanging resource without an etag, you give them a fresh one; and if they request a resource with an etag, you give it to them, with the supplied etag, and record the user.)

Even if Hulu turned off cookie respawning via etags, you can still track users this way, on the server side. I guess the tricky thing is to correlate the etag of the tracker resource with the rest of the requests that a user makes on a site.

<comment><USER3> > Even if Hulu turned off cookie respawning via etags, you can still track > users this way, on the server side. I guess the tricky thing is to correlate > the etag of the tracker resource with the rest of the requests that a user > makes on a site.

The important distinction is that the ETag is literally no different than a cookie, when used this way. Turning off caching is the new turning off cookies.

<comment><USER2> There is a difference: cookies get sent on requests to any resource in a domain, whereas etags get sent only to specific resources.

</comment></comment></comment><comment><USER4> From wikipedia:

 _ETags may be flushable by clearing the browser cache (but browser implementations may vary).

In 2007, two Mozilla Firefox add-ons were made to prevent the usage of ETags for tracking.[5][6]_

[5]<https://addons.mozilla.org/en-US/firefox/addon/safecache/> [6]<https://addons.mozilla.org/en-US/firefox/addon/safehistory/>

<comment><USER5> The safehistory plugin doesn't seem to work for the newer versions based on the comments on their page.

</comment></comment><comment><USER6> Schneier does not tell so much here, instead he links to this article giving more details:

<http://ashkansoltani.org/docs/respawn_redux.html>

</comment><comment><USER7> ETag and cache based cookies are old news. I assume that Schneier didn't notice these components last time he reported on evercookie.

[ <http://google.com/search?q=evercookie> ]

<comment><USER8> It is a lot older than evercookie. I remember porn affiliate scripts that were using ETag back in 01-02. It is a well known method, as is using Last- Modified.

</comment></comment><comment><USER9> I wonder how this will be treated under the EU's Directive on cookies...

Edit: sorry, not found an answer yet, but the top Google result for 'EU cookies' is rather fun: [http://www.davidnaylor.co.uk/eu-cookies-directive- interactiv...](http://www.davidnaylor.co.uk/eu-cookies-directive-interactive- guide-to-25th-may-and-what-it-means-for-you.html)

</comment><comment><USER10> See also: <http://news.ycombinator.com/item?id=2844321>

</comment><comment><USER11> Not undeletable. Just not deleted via the browsers "delete cookies" function.

<comment><USER12> I would not advise that argument as a legal defense strategy.

</comment></comment><comment><USER13> Reminds me to write a firefox plugin to strip etags and "if-none-match" - pretty sure most pages can function just fine without them and use last- modified, etc instead. Kind of surprised to not find anything yet on addons.mozilla.org

<comment><USER14> You do that, and I'll just assign a unique UNIX timestamp to each visitor.

<comment><USER13> That's a good point and this would not be practical in a regular browser session but if someone chooses private browsing, an extension could be sure to strip "last-modified" as well as "if-none-match".

Would hurt the server a little and reduce speed because there would not be any caching but still helps guarantee no tracking.

<comment><USER15> On a properly written server you could "fuzz" the date of "if-none-match". Then it would still work for caching, but would not uniquely identify you.

The trouble is that most servers are not written properly, the date is not parsed, rather it's string compared with the file date.

For example if the server sends the timezone as EST vs +0400 the browser will send it back exactly as it gets it, when normally you would think that should not matter.

</comment></comment></comment></comment><comment><USER16> I don't understand why this keeps getting press. It's nothing new, this method has been around for at least 4 years. Schneier should be well aware of it.

<comment><USER17> You blog to make OTHERS aware.

</comment></comment><comment><USER18> This is not news. Evercookie has been doing this for _years_ , and it's just as easy to defeat as it was years ago.

<http://samy.pl/evercookie/>

</comment><comment><USER19> We created a PoC a while ago showing ETag + browser fingerprinting to replace cookies/client-side storage: <http://www.adperium.com/tracking>

It works in all major (desktop) browsers, but not in some mobile browsers.

I think the cookie debate (in the EU) is not in the best interest of users: with cookies, the user has full control of the data stored, can easily purge cookies, etc. With user-tagging technology moving server-side, this gets a lot more complicated.

</comment><comment><USER20> What it really boils down to is this: you cannot have both caching and privacy.

For the cache to work your browser must reveal to the server what it has already downloaded, this way or another. And the browser cannot really tell which of the downloaded pieces of data were specially generated to track this particular user.

A possible workaround is to create an intermediate cache to share it with multiple other people, but this creates other privacy concerns.

</comment><comment><USER21> Even better is the paper (written 2003) linked in the comments of the article:

<http://www.arctic.org/~dean/tracking-without-cookies.html>

</comment><comment><USER22> Obligatory link to Panopticlick: <http://panopticlick.eff.org/>

</comment><comment><USER23> I believe Google is doing this with its google voice product. We're unable to access our google voice accounts outside the USA, despite disabling flash, deleting all cookies, etc. The ironic thing is, of course, that this is when we need it the most, as we miss more calls being in a radically different time zone.

<comment><USER24> I'd say they disable access by IP, but I can access my account from two countries that are far outside the US.

<comment><USER23> Well, I'm using different IPs than the "home" IP we used when we signed up. Any attempts to get into google voice for me, though, say that it is not allowed outside the USA.

<comment><USER25> Yep, so they just filter by whatever IP you are connecting from from outside the US and that's it. Countless websites and services have been doing that for a looong time - just as evil but should not have anything to do with cookies because then you should be able to sign in just fine on a different machine and use voice.

</comment></comment></comment></comment><comment><USER26> The potential of etags as a way of tracking has been known about for a while...

To put the other side of this argument Kiss Metrics put up a pretty strong denial that they were using etags for tracking <http://bit.ly/r5lPbx>

Guess it might need a bit more research

<comment><USER27> Well, they said that they "made the following changes" -- one of which is not using eTags. So I guess they stopped that.

(That said, they never aggregated this data across multiple websites, so I really don't get what the whole fuss was about.)

<comment><USER18> They tried to make their cookies undeletable. Why would they do something like that? The fuss is that it's a bad, dishonest, skeezy thing to do. Kissmetrics has shown that they are not an honest company, they're a dishonest one that will disregard the privacy concerns of their user's visitors.

<comment><USER28> RyanGWU82 makes a good point though. People only whined about the "evercookie" method of tracking because of the potential for abuse (across multiple Web properties). Why on Earth would you care if someblog.com knows for sure that you've been to their site five times? I don't think the problem here is that you can be tracked using multiple methods that were not originally intended for use in tracking. I think the problem is that people always had a false sense of privacy (i.e., there was ignorance about what can and cannot be used to track your client).

You're accessing a remote server. There will always be a way for sites to track your visits. _There is a necessity for those sites to track your visits._ Don't care about their necessity to track you? Stop going to those sites.</comment></comment></comment></comment>


Updates to the Dashboard in Kubernetes 1.3 - <AUTHOR> http://blog.kubernetes.io/2016/07/dashboard-web-interface-for-kubernetes.html <comment><AUTHOR> Brand new visibility into deployment objects, inline editing of yaml files, and underlying resources (how much CPU & memory are free for the cluster).

Cool!

Disclosure: I work at Google on Kubernetes</comment>