Youtube, please let me know the country availability of a given video. - <AUTHOR> http://dbasch.posterous.com/youtube-please

<comment><USER2> ...or just don't show it if it's not available. It is sort of interesting to know that information, but it's not like I have time or interest to contact the rights holder in some other territory and promote the potential economic gains of cross-border availability.

Also, I wish the same were true for mobile devices. I am heartily sick of being told 'x is not available on mobile' or spoofing the user agent string in my tablet to watch something. It's really none of a publisher's business where I choose to watch something and this attempt at artificial market segmentation is not worth the administrative overhead it imposes.

<comment><USER3> The suggested purpose of knowing that information is not so that you can correct the situation, it's so that you don't look foolish by sending links to videos that your audience can't view.

Not showing the video in the YouTube interface is only a partial fix, and an unrelated one at that. The use case in consideration is tweeted YouTube links; it's not like YouTube can just switch to a new video because the one which you navigated to isn't available.

<comment><USER2> True enough, but Twitter _et al_ are global; my followers may or may not be able to see a video in a particular territory.

</comment></comment></comment><comment><USER4> Actually their API already returns that information. I think this was it: [http://code.google.com/apis/youtube/2.0/reference.html#youtu...](http://code.google.com/apis/youtube/2.0/reference.html#youtube_data_api_tag_media:restriction)

<comment><USER3> Is there a way to access this information when browsing? An extension, perhaps?

I'm an embedded developer, so please forgive my ignorance if this is a foolish question.

<comment><USER5> Not completely straightforward, but you could do something like this if you have curl and libxml2 installed:

        curl -s https://gdata.youtube.com/feeds/api/videos/oHg5SJYRHA0?v=2 | xmllint --format - | grep media:restriction

The 'oHg5SJYRHA0' part is the video ID from the URL for the video.

<comment><AUTHOR> Thanks. I updated the post and credited you. I posted this example (a Vevo video):

curl -s <https://gdata.youtube.com/feeds/api/videos/eAfyFTzZDMM?v=2> | xmllint --format - | grep media:restriction

shows:

<media:restriction type="country" relationship="allow">BD BE BF BG BA BB WF BM BN BO BH BI BJ BT JM BW WS BR BS BY BZ RU RW RS TL RE TM TJ RO TK GW GU GT GR GQ GP GY GF GE GD GB GA SV GN GM GL GI GH OM TN IL JO HR HT HU HK HN VE PR PS PW PT PY IQ PA PF PG PE PK PN PL PM ZM EH EE EG ZA EC IT VN SB ET SO ZW SA ES ER ME MD MG MA MC UZ MM ML MO MN MH MK MU MT MW MV MQ MP MS MR UG MY MX VU FR SH FI FJ FK FM FO NI NL NO NA NC NE NG NP NR NU CK CI CH CO CN CM CL CA CG CF CD CZ CY CR CV CU SZ SY KG KE SR KI KH KN KM ST SK KR SI KP KW SN SM SL SC KZ KY SG SE SD DO DM DJ DK VG YE DZ US UY YT LB LC LA TV TW TT TR LK LI LV TO LT LU LR LS TF TG TD TC LY VA VC AE AD AG AF AI IS IR AM AL AO AN AQ AR AU AT IO IN TZ AZ IE UA QA MZ</media:restriction>

<comment><USER6> Or you can use fields filtering:

curl -s "[https://gdata.youtube.com/feeds/api/videos/eAfyFTzZDMM?v=2&#...</a>

<comment><USER5> Much cleaner. Thanks for the tip!

</comment></comment></comment></comment></comment></comment><comment><USER7> This is a real pain point, even when just browsing around YouTube from a country like Germany. Probably half of the videos with some mainstream tune in it are 'not available in your country'. Feels like being tricked.

Dear YouTube, you know where I am. If I'm not allowed to see the bloody video, don't show it to me in search results or recommendations. Thanks.

</comment><comment><USER8> I wonder if you could cheat with Where's It Up?

<http://pro.wheresitup.com/>

[disclaimer: i made the tool]

If you got a different page size, or response code, you could check different regions easily.

<comment><USER9> The page still loads, but the Video player displays a message rather than the video itself.

</comment></comment><comment><USER10> The thing that really gets me is when I visit one of these videos, and I can't even find out what the title of the video is.

</comment><comment><USER11> How does one go about making their content on Youtube unavailable to one country? I don't see that anywhere in my settings on my videos, not that I'd want to limit it (which just seems silly, as it will only encourage piracy).

<comment><USER12> I'm a Youtube partner and I can't find the option, but I do remember seeing it somewhere. How strange, seems to have disappeared. I'll check the FAQs.

</comment></comment><comment><USER13> I'd also love to be able to blacklist accounts. I don't really need to see four different accounts from one person, especially if I _really_ don't want to see their videos.

</comment><comment><USER14> On a similar theme, I wish Amazon would tell me earlier when an item won't be shipped to my location. You have to go right through to the purchasing stages to find out.

</comment><comment><USER15> Seems like the solution is to download the video, upload it to YouTube, and tweet your version to your followers. By the time it gets flagged (if it gets flagged), it will be gone from everyone's Twitter feeds anyway.

When your YouTube account gets shut down for posting too many flagged videos, make another one. They're free.</comment>


Hardening your Web Server's SSL Ciphers - <AUTHOR> http://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/

<comment><USER2> I think this CipherSuite is actually better than what you have (and Qualys seems to think so, too):

SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM- SHA256:RC4:HIGH:!MD5:!aNULL:!EDH

Also, I couldn't get your disabling of SSL compression to work (on Gentoo Linux), either by pasting the export line into /etc/conf.d/apache2 (at the end) or /etc/init.d/apache2 (at the top).

<comment><USER3> Yes, but some of the ciphers aren't supported in widely used OpenSSL versions (like 0.9.8). I wanted to give people a configuration that works everywhere and is reasonable secure.

If they want more, there's a link list at the end. Let's not make perfect the enemy of the good.

 _Edit_ I've added an advanced section with a link to here so you get your credit. :)

<comment><USER4> To be fair, that line does work everywhere; the unrecognized ciphers are just ignored. In fact, on my Debian VPS with OpenSSL 0.9.8 it results in the exact same list of ciphers as the Apache one given in the post ("openssl ciphers" on the command line is very useful).

May as well add the newer ones to get the support if you upgrade your SSL library without having to change your Apache/nginx/etc. conf.

</comment></comment></comment><comment><USER5> Take a look at applebaum's duraconf. It has configs for many ssl/tls services:

<https://github.com/ioerror/duraconf>

<comment><USER6> Anyone used his config for nginx? How does his cipher list affect speed?

</comment></comment><comment> hn-miw-i Don't know if I agree re RC4; BEAST is an issue with CBC, not AES. AES-GCM should be ok, if not superior to the ancient RC4.

<comment><USER3> RC4 has no known practicably exploitable weaknesses and is well supported, insofar the "ancient" is actually working in its favor.

That said, if you know as much as you do, you don't need that article and can fine tune yourself. It's for people who want a compatible and secure SSL setup – which it is.

<comment><USER7> The statement that RC4 has no weaknesses is not true. It has well-known biases: <http://en.wikipedia.org/wiki/RC4#Security> It is just better than CBC (as implemented), being a stream cipher, and thus using RC4 is the best solution right now. It is still important to get as much as possible up to TLS 1.2 and using AES-GCM or other AEAD modes as soon as possible.

Edit: Clarified that RC4 is better than CBC _as implemented_ , not CBC implemented with constant-time verification, i.e. RC4 will not be preferable to AES-CBC in the fixed version of OpenSSL, at least against the Lucky Thirteen attack.

<comment><USER3> Absolutely. But since we still have to support SSLv3 from 1996, I wouldn't hold my breath. :(

<comment><USER7> Yeah. The outlook is not that great, and RC4 will definitely be better than CBC for those legacy systems in light of this discovery (<http://www.isg.rhul.ac.uk/tls/>). At least the browsers are actively working on supporting the latest TLS and modes.

<comment><USER3> Yes, the discovery of Lucky13 and the following helplessness by many not- really-ops-but-doing-it-anyway people were the motivation to write that article in the first place. To get a minimal baseline security out there. Those who know better, will do better. There's enough additional links to get hooked up. Can't do more. :)

<comment><USER8> "Lucky 13" isn't exactly an ops crisis. You probably don't need to stay up late patching this one, unless you're using DTLS.

<comment><USER3> Oh certainly not a crisis – especially since it didn't bring new vectors to the table. I just saw many "what now!?"s in my timelines and figured I better give them a solid good-enough solution that just works before they do something stupid.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Anyone else having trouble getting "export OPENSSL_NO_DEFAULT_ZLIB=1" to work on Apache 2.2.22, CentOS 5.9?

I have tried it in /etc/sysconfig/httpd and /etc/init.d/httpd (in start) and SSL tools still report that compression is on.

<comment><USER3> Hm, I'm just on my phone now and going to bed but here's link from RH's bugzilla going into it, maybe it's of any help to you: <https://bugzilla.redhat.com/show_bug.cgi?id=857051#c5>

Can't say any more than that it works for us – we compile Apache ourself though for various reasons. But according to the link above it should work.

</comment></comment><comment><USER10> How does SSL compression work together with Apache's ordinary zlib support?

Is it redundant when you're already deflating text/html pages? Looking at a page fetched from my server, Apache respondents with Content-Encoding: gzip.

<comment><USER11> Focusing on the CRIME attack people are trying to prevent, TLS compression works for the entire session and will thus include the HTTP headers which are out of band from HTTP transfer encoding. That's how CRIME works: if an attacker can use something like JavaScript to make a request in your browser with some text which they control and can observe the packet sizes, they can measure whether the entire message compressed more than expected, indicating that some bytes are shared between the browser-generated headers and their injected contents. Repeat enough times and you can recover cookies byte by byte. See <http://www.imperialviolet.org/2012/09/21/crime.html> for the full details.

The good news is that Content-Encoding avoids the attack; the bad news is that it means we're missing the opportunity to avoid transmitting a significant chunk of repetitive text.</comment></comment>


Modifying Your Own Genes Is Just An Injection Away If You're Feeling Lucky - <AUTHOR> https://www.fastcompany.com/40477808/genetic-modification-is-just-an-injection-away-if-youre-feeling-lucky <comment><USER2> The medical applications are obvious and compelling. On the other hand, let's hope this doesn't usher in a new era of eugenics...

* Edit your genes to be less risky, or face higher insurance premiums!

* Anyone with genes that tend toward criminality must report for genetic "repair."

* All childhood vaccines will come with DNA editing to provide extra resistance to the flu! And as a bonus, genes shown to improve attention and obedience...

So many possible dystopian futures here. This tech will inevitably be abused in some ways, as all are, but let's hope that society can keep it to a minimum.

<comment><USER3> The reason for annual flu vaccinations isn't because we can't make vaccines, it's because the flu virus mutates quickly and the mutations are sufficient to make all existing "knowledge" in the immune system not see it.

The average annual flu vaccine actually includes markers for two to three different strains that are /estimated/ to be the ones that are likely to take off each year. The reason for this years flu being so bad is that they got it wrong.

As far as general immunity, that's unlikely: immunity basically isn't inherited - "inherited" immunity is generally derived from the mother's immune system through milk and some of the microbiome picked up by the baby during birth.

Generally gene editing is unlikely to allow magic vaccines to be built in to your dna. These days the primary problem in creating vaccines is first finding a set of markers that are sufficiently stable to make it unlikely that they can be trivially mutated away, that also doesn't match any markers people have on their own cells (otherwise you'd just create an injected autoimmune disorder), and also can be packaged so that trains the immune system correctly.

<comment><USER4> There are other reasons why flu vaccines don't work from year to year. For instance, this year there is evidence that vaccines made in eggs acquired mutations that limited the effectiveness of the immune response ([https://www.statnews.com/2017/11/07/flu-vaccine-egg- producti...](https://www.statnews.com/2017/11/07/flu-vaccine-egg- production/)). Viruses made by other means don't seem to have this problem but are a lot more expensive and we'd need to retool the entire flu vaccine industry to solve this.

<comment><USER3> True, I didn't mean to discount other issues,

My wife is the actual scientist, I just write code :D (she actually understands all of this, so take my entire commentary as being a CS major interpreting a molecular biologist - I'm an idiot, my wife is amazing :D)

</comment></comment></comment></comment><comment><USER5> >Let's get on with it now. Let's use this to help people. Or to give people purple skin.

IIRC, the skin whitening industry in Asia, which hawks products of very questionable efficacy, is worth tens of billions. I wonder how much a CRISPR solution would be worth, given that it has a better chance of working than snake oil in a soap.

Jokes aside, is it really as simple to administer as injecting one's self with a, as he calls it, plasmid?

<comment><USER4> No it is not that simple. You need a carrier to help the DNA get into cells efficiently. If you want to modify specific cell types then you need a cell type-specific carrier. Today, editing your DNA is "easy" \-- targeting the right cells is "hard."

</comment></comment><comment><USER6> We changed the URL from [http://www.frogheart.ca/?p=24764](http://www.frogheart.ca/?p=24764), which is mostly copied from this and another article: [http://www.cbc.ca/radio/quirks/diy-dna-hacks-wounds-take- lon...](http://www.cbc.ca/radio/quirks/diy-dna-hacks-wounds-take-longer-to- heal-at-night-why-daydreams-are-good-quirks-bombs-and-more-1.4395576/meet-the- human-guinea-pig-who-hacked-his-own-dna-1.4395589).

</comment><comment><USER7> This is very interesting if used for treating diseases or help people to live a better life but if left without regulations of what is ok and what is not, people will definitely abuse or misuse it.

<comment><USER8> What sorts of things would not be ok in your mind? Speaking strictly of editing _your own_ genes, of course.

<comment><USER7> well having weird body parts or modifying one of the symetric parts by mistake. Example having an arm full of muscles while the other one is quite weak and small. Becoming blind or loosing taste ... etc due to mistakes.

<comment><USER9> Those are issue with the process or a mistake in the process not in the result.

</comment></comment></comment></comment><comment><USER10> > Of course, an app store for genetic editing doesn't yet exist.

That actually sounds amazing.

<comment><USER11> Dear God, NO.

Some lunatic will write some possibly underhanded-C-esque/probably just ignorant implementation of some modification which causes apoptosis after some chemical feedback loop.

At the _very_ least, it needs to be understood and administered by licensed professionals. I'm not saying we need full blown-FDA trials spanning years (though there are very good arguments for that), but this can't be a direct to consumer market.

<comment><USER12> We don't need the regulations. We need this technology now, hell, we actually need this technology 20 years ago.

If progress means death as a byproduct, than this death is totally welcome.

<comment><USER11> Doctors, medical professionals with detailed knowledge of the body's chemistry, need this now.

Joe Dirt, looking to make the next big thing on the street by causing your white blood cells to secrete fentanyl for a life-long high, does not.

This technology is easily if not more dangerous than firearms. It is literally in the same class as chemical warfare. Desensitizing ourselves to that danger AND allowing any old schmuck to publish his flawed plasmid to a public store for anyone to try is criminally negligent.</comment></comment></comment></comment>


What's Wrong with This Dialog? (2010) - <AUTHOR> http://thesmithfam.org/blog/2010/05/16/whats-wrong-with-this-dialog/#

<comment><USER2> Really? OK, Cancel, Apply. I'm not even reading the rest of it.</comment>


Science Fiction Sent Man to the Moon - <AUTHOR> https://www.nytimes.com/2019/07/20/opinion/sunday/moon-rockets-space-fiction.html <comment><USER2> But also US/USSR competition for tech and military dominance.

<comment><USER3> Existential threats are a hell of a drug.

<comment><USER4> As are the private profits generated by the supposed goals.

</comment></comment></comment><comment><USER5> I can't read the article due to a paywall, but I assume it talks about Jules Verne etc.? I really hope they also included Herge's "Tintin - From the Earth to the Moon" (and "Explorers on the Moon"). I remember reading that as a kid which triggered my whole fascination with the US/Soviet space program.

I believe it was written in the early 50's but still had the concept of a nuclear powered rocket, and a moon rover vehicle etc.

<comment><USER6> I don't think Tintin was mentioned, but you're right, it was written in the early 50's!

<comment><USER7> [https://en.m.wikipedia.org/wiki/Dunno_on_the_Moon](https://en.m.wikipedia.org/wiki/Dunno_on_the_Moon)</comment></comment></comment>


Amazon EC2 C6g and R6g instances powered by AWS Graviton2 processors are now GA - <AUTHOR> https://aws.amazon.com/about-aws/whats-new/2020/06/amazon-ec2-c6g-r6g-instances-amazon-graviton2-processors-generally-available/ <comment><AUTHOR> Press Release: [https://press.aboutamazon.com/news-releases/news-release- det...](https://press.aboutamazon.com/news-releases/news-release-details/aws- announces-general-availability-sixth-generation-amazon-ec2)

See also the Graviton2 video overview by James Hamilton: [https://www.youtube.com/watch?v=LNqRvP6Xvrw](https://www.youtube.com/watch?v=LNqRvP6Xvrw)

And the results running a OpenFOAM Computational Fluid Dynamics HPC workload on C6g, with up to 37% improved price/performance: [https://aws.amazon.com/blogs/compute/c6g-openfoam-better- pri...](https://aws.amazon.com/blogs/compute/c6g-openfoam-better-price- performance/)</comment>


The Erlang Rationale - <AUTHOR> https://rvirding.blogspot.com/2019/01/the-erlang-rationale.html <comment><USER2> I think the world of Joe Armstrong (may he rest in peace), and was really excited about jumping into this world. In practice, I think this philosophy is better on paper than in the real world.

Start with message passing over multiple processes. The Erlang/Elixir ecosystem leans toward lightweight processes and message passing for everything. Isolation is great, but it has a cost. Part of that is paid in reduced inspectability. Good luck getting a meaningful stack trace, or figuring out what someone else's code does, when even the simplest action is split over a half-dozen concurrent processes and supervisor trees. I know it's a bridge that eventually has to be crossed, but a very expensive one!--like pouring the foundation for global HQ before the first customer has even signed.

Dynamic typing is another pain point. Wrangling types is not fun, but to keep growing something, they're non-negotiable. Facebook and Hack. Microsoft and TypeScript. The preponderance of C# and Java in the enterprise world, and C++ in games. These weren't accidents of history. Without mandatory compile-time type-checking, re-factoring eventually becomes so perilous that it is avoided, and the product withers. Why they chose that in a "robustness" language is a head-scratcher.

Also, the compiler is slow--which wouldn't be so bad if it caught more errors (like type mismatches), but it doesn't.

<comment><USER3> In my experience the stack traces from Elixir (or even Erlang) are pretty useful. Sure there isn't a full stack trace back to a main function however that really isn't different than a framework with any level of indirection. Given the choice between a C#/Java stacks trace 40 lines deep and a BEAM stacktrace of only 6 lines I'll take the latter. Even better you get both the value of the last received message and the state of the process in the stack trace makes reproducing an issue simple.

Based on what you're saying given the lack of inspectability it sounds like you haven't tried out some of the introspection capabilities of BEAM. Maybe you have, but I've seen little that compares to the Observer module that comes included in a language. Realtime introspection of processes and the ability to see the message queue for any process makes inspecting the whole system very interactive and powerful.

There's a point that message passing lowers max performance, but given the rise of multicore processors it's pretty powerful platform. Future hardware likely could weaken memory coherency between cores which could be taken advantage of by BEAM. Overall it takes a different mindset to work well with Erlang philosophy IMHO.

<comment><USER4> I'm getting the same issue with async/await in Javascript and I'm worried about the same happening in Rust.

There should be a way to extend these traces. I don't know what the costs would be like to trace back across calls, but I would expect they should be somewhat reasonable in the case where the caller expects a response (you already have the bookkeeping and the stack frames).

<comment><USER5> >As of V8 v7.3, --async-stack-traces is enabled by default. [https://v8.dev/blog/fast-async](https://v8.dev/blog/fast-async)

<comment><USER4> Yeah we aren't on 12 yet. In fact we just got off of 8.

</comment></comment></comment></comment></comment><comment><USER6> Should be of interest to anybody interested in this, Joe Armstrongs Ph.D. thesis: [http://erlang.org/download/armstrong_thesis_2003.pdf](http://erlang.org/download/armstrong_thesis_2003.pdf)

<comment><USER7> Is this better of an introduction to Erlang (and in general distributed fault tolerant systems) than other sources (e.g. programming Erlang)? I come from a telecom background and worked on high reliability/robust systems, somewhat on the principles of this book [1]. Wanting to learn Erlang.

[1] Robust Communications Software: Extreme Availability, Reliability and Scalability for Carrier-Grade Systems - Greg Utas

<comment><USER8> Am a noob in Erlang studies but i have settled on the following three books.

1) Introducing Erlang: Getting Started in Functional Programming. - Just to get an easy intro.

2) Programming Erlang: Software for a Concurrent World by Joe Armstrong himself.

3) Erlang and OTP in Action - This one seems to be the advanced book.

</comment></comment></comment><comment><USER9> A not very useful level of indirection: it's a blog pointing AT the Erland rationale, not the rationale itself.

</comment><comment><USER10> It's a shame that the elegance of Erlang has been distorted with Elixir.

<comment><USER11> I don't particularly care for Elixir, but it's kind of nice having more people on the BEAM.

<comment><USER12> I don't think the above comment is put in the best way...

But I do have a certain duality about my feelings on Elixir

On one hand, yes, it is cool to see more adoption of BEAM, I do wish Erlang could have done that by itself.

I vastly prefer Erlang to Elixir and find it does slightly... taint the simplicity and cleanliness of the syntax Erlang made made me fall in love with, just to be Ruby-like.

I don't feel it actually benefits the language at all past the meta reason of attracting Ruby-ists (which again, isn't necessarily a bad thing by itself)

<comment><USER13> It's interesting that you would say a language could 'taint the simplicity and cleanliness of the syntax' of another language. You can still work purely in Erlang and not deal with Elixir can you not?

I'll say my own personal experience is that I knew of Erlang but had never really looked into it or knew of the benefits of OTP and BEAM. Being a Rubyist, Elixir bridged that gap for me and I've been reading more and trying to learn more about this new (to me) environment.

I would also say that Elixir has benefited Erlang because José hasn't just built Elixir, but has gone and helped implement new things into Erlang; the entire environment is benefiting from drawing in new engineers.

<comment><USER14> My problem with Elixir is kind of similar to C/C++. Interfacing with C code from C++ is easy, interfacing with C++ code from C isn't easy and you end up with loads of ugly wrapper code. The same goes for Erlang and Elixir, interfacing with Erlang code from Elixir is easy, interfacing with Elixir code from Erlang is ugly. And the more people start writing code in Elixir I fear that more people are turning away from Erlang. And even if the entire environment in total benefits from more people using Elixir, that environment will more and more turn into an almost pure Elixir environment with very little of Erlang left.</comment></comment></comment></comment></comment>


$194 for hand sanitizer? You must be joking - <AUTHOR> https://www.reuters.com/article/us-health-coronavirus-cma/194-for-hand-sanitizer-you-must-be-joking-idUSKBN20S1TU <comment><USER3> You can easily make it yourself: [https://www.wikihow.com/Make-Hand- Sanitizer](https://www.wikihow.com/Make-Hand-Sanitizer)

<comment><USER4> Yep it is silly for people to be hoarding hand sanitizer. A simple 70% alcohol solution would work just as well. That's what we spray our gloves and biosafety hood with in the lab.

<comment><USER5> Yes, but what kind of alcohol? Grain alcohol is impractical because of the expense, isopropyl alcohol is likely to sell out quickly as well.

The only other option available to the public that comes to mind is denatured alcohol and it's unclear whether there any risks related to skin absorption of the denaturing agents. Anybody know?

<comment><USER4> One common denaturant is methanol which is probably not best to absorb on your skin.

It seems doubtful that all alcohol would become scarce and also all Everclear from the liquor store, which isn't really that expensive in bulk (1.75L of 95% EtOH for ~$35). Certainly cheaper than $160 hand sanitizer.

</comment></comment></comment></comment><comment><USER6> One thing I'd like to see architecturally change is the creation of hand washing stations at the entrances to large buildings. I'd love to simply wash my hands before and after entering Costco, but the bathrooms are out of the way and you need to wade through reverse cart traffic to get there when entering.

Places were groups of 100+ people are gathering should simply have a hand washing station near the entrance, outside the building. And we should all use them!

<comment><USER7> I'm curious how much the habits created during this situation will have lasting impacts that might be beneficial in the long run.

</comment></comment><comment><USER8> During a shortage:

Commodity is available. Commodity is affordable.

Pick 1.

<comment><USER9> 3) government intervenes

<comment><USER10> And does what? make more supply appear from thin air?

<comment><USER9> Resource allocation that favors public wellbeing over market efficiency.

<comment><USER10> Market efficiency is precisely about public wellbeing. Concretely, what are you suggesting? In face of limited supply, there's only 2 choices: keep the prices low or raise the prices. The former accelerates supply depletion; the latter helps maintain supply availability. You're asking for the government to come in and pull a third choice out of their sleeve, but I don't see such a choice. If you're the government, _concretely_ , what would you do?

EDIT: Now, if you suspect price gouging, that's different. wtfrmyinitials was referring to a genuine shortage, though.

<comment><USER9> That's true if the proposed intervention is simply price caps, as opposed to rationing.

</comment></comment></comment></comment></comment></comment><comment><USER11> I've noticed a curve model happening on Amazon.

First it was basic medical masks that went out of stock. Then people realised DIY/Building masks are the same if not better, they went out of stock. So the next step was half face respirators for spray painting. They are now either out of stock or overpriced.

Same thing with hand sanitizer. Wipes and small bottles. Then larger family sized ones, then industrial acohol cleaner and aloe vera.

Its very fascinating, its almost like early adopters vs. mass consumers.

</comment><comment><USER12> I bought some early last week. I got supplies two weeks ago when friends and family were laughing at me saying I was being paranoid. Now they are asking me where to get some hand sanitizer or bleach since it's sold out everywhere.

<comment><USER13> Yup, gotta clean all those bacteria off your hands to avoid a virus, right? Just use hand soap. It's more effective. (yes I know alcohol still kills the virus, but buying hand sani isn't necessary when we already have a more effective tool at pretty much every sink)

<comment><USER14> I have to ask, why do you assume that people are using hand sanitizer instead of washing their hands? In the case of a pandemic, I would like to disinfect my hands mostly in places where there is no access to running water. Like, in my car after being in a public place, or at my desk.

This feels like the coronavirus-related version of that infamous Stack Exchange response where you say "I must do (thing) because of these requirements, what's the best way to do it" and people respond with "Don't do (thing), do (other thing which is arguably better but does not satisfy the requirements)"

<comment><USER13> Sorry, just being an asshole. Using sanitizer in those situations makes perfect sense.

</comment></comment></comment></comment><comment><USER15> Poor Syrians, they can not even make their hand sanitizers nor buy off the shelf: isopropyl is an essential ingredient in sarin production. People were put in jail for shipping it overseas. [https://www.bellingcat.com/news/2019/01/22/isopropyl- alcohol...](https://www.bellingcat.com/news/2019/01/22/isopropyl-alcohol-and- sarin-one-is-needed-for-the-other/)

<comment><USER16> They can still make it with ethanol. [https://www.who.int/gpsc/5may/Guide_to_Local_Production.pdf](https://www.who.int/gpsc/5may/Guide_to_Local_Production.pdf)

</comment></comment><comment><USER17> Protip: cheap vodka works well.

Protip #2: it comes in minibar-sized bottles.

Provided you don't live in a strangely puritan nation (I won't point fingers), this basically has no downsides.

<comment><USER18> Vodka is 40% alcohol, which is not a high enough concentration to be effective.

<comment><USER17> Correction (you're right, of course, if you live in a country that thinks vodka must always be 40%): Everclear is effective. It also comes in minibar sized bottles.

95% isopropyl alcohol is even cheaper, and puritan-compatible. ;)

</comment></comment></comment><comment><USER19> I don't get it - is normal soap ineffective?

<comment><USER20> The benefit is you can place hand sanitizer in a lot more locations. Near doors, desks, entrances/exits, conference rooms, etc.

A thorough wash with soap and water is better, but harder to distribute around an office building, hotel, conference center, etc.

<comment><USER19> Didn't think about this - <USER2>

</comment></comment></comment><comment><USER21> So what happens to the cellulose after the alcohol evaporates?

<comment><USER22> you wipe it on your jeans

</comment></comment><comment><USER23> Given we're pretty much all going to catch it anyway, whats the point? I'd be happy to get it over with soon.

<comment><USER23> I'm sure no-one's reading this far back, but for the record I would edit or delete the above if I still could. It was a pretty silly statement for a number of reasons. I never had much cause in the past to read or think much about epidemiology, and now I have .. well I'm thinking quite differently about it all.

</comment></comment><comment><USER24> water + detergent is more effective than sanitizers.

</comment><comment><USER25> Is anyone ACTUALLY surprised? Seems like an obvious supply/demand situation, and of course (bad) people are going to take advantage of that.

> "We urge retailers to behave responsibly throughout the coronavirus outbreak > and not to make misleading claims or charge vastly inflated prices,"

Urging retailers isn't going to stop the train of capitalism. I applaud their optimism, though.

<comment><USER26> Ok, so you set a price cap and it all sells out in 10 minutes. What then?

<comment><USER27> What do you mean, what then? Then it's gone. That's all. There's no moral component to this.

<comment><USER28> Maybe it would be better if the people who needed it more and were willing to pay more got it, instead of one average guy who wants to panic buy the whole shelf. In terms of giving the right stuff to the right people, the ranking is probably "price cap and instant sell-out" < "price-based rationing" < "need- based rationing."

<comment><USER29> >the people who needed it more and were willing to pay more got it

And there the idealism breaks down. Willing to pay more - which you always are if it becomes a life-or-death situation - does not mean able to pay more; able to pay more does not mean deserves it more.

<comment><USER30> > able to pay more does not mean deserves it more.

Yes, but what's a good allocation metric for 'deserves' ? It's not an easily quantifiable metric.

<comment><USER31> There is no law that prevents stores from having limits. Most places seem to manage not running out of inventory with significant sales or coupons just fine.

<comment><USER27> "Most places manage not to run out of inventory when they give out their own coupons or choose to run sales and have decades of experience in knowing what to expect from them" does not translate to "will know how to avoid running out during a black swan event like a pandemic".

Limits are legal, but sufficiently desperate people will do what it takes to get around them. A major component of the problem here is that neither you nor these stores can take their normal day-to-day experiences and apply them to black swan events like this. Your System 1 (bleh, what a terrible name that is....) heuristics are lying to you; you need to engage System 2 for this. [https://en.wikipedia.org/wiki/Thinking,_Fast_and_Slow](https://en.wikipedia.org/wiki/Thinking,_Fast_and_Slow)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> Go on Amazon, literally half of their listings for sanitizer are "currently unavailable".</comment>


Will 3D Printing Reboot Manufacturing? - <AUTHOR> http://mashable.com/2011/04/10/3d-printing-pics/?utm_source=twitterfeed&utm_medium=feed&utm_campaign=Feed%3A+Mashable+%28Mashable%29&utm_content=Twitter#12393Z-Printer-650 <comment><USER2> It's good to see 3D printing in the news all the time now, but in reality the bigger story is that all manufacturing methods are becoming more and more accessible. With open hardware, digital manufacturing, and the burgeoning maker scene - hardware is becoming the new software.

Wired's article delved a little deeper into the "New Industrial Revolution": <http://www.wired.com/magazine/2010/01/ff_newrevolution/all/1>

<comment><USER3> The biggest obstacle between seeing more hardware being built isn't the up- front price structure of manufacturing techniques, it's the twofold information gap between would-be entrepreneurs and manufacturing processes.

One gap is simply the body of knowledge necessary to spec and drive that process. The second gap is actually knowing who does what, and who has a good history of meeting their promises. Right now to bridge both gaps you need to go through intermediaries, but it's easy to immagine a world where technology solves both information problems. And to me that's a lot more exciting than 3d printing.

<comment><USER2> Are you saying that the knowledge needed for manufacturing a product is more than a small software startup could muster?

To me, it seems the gaps are the same as software products:

Software: Business Guy w/ idea -> Developer + Servers -> Product

Hardware: Business Guy w/ idea -> MechE/EE + Manufacturers -> Product

Are you saying the MechE/EE are harder to find/coordinate and/or typical software startup guys don't have the skills to develop hardware?

I agree with you - when we can solve this gap - then we've got something cooler than any one manufacturing process.

<comment><USER4> My experience working in a ME/EE/FW/SW team is that the turnaround times in ME and EE are much higher and more expensive. Making masks for chips and molds for parts is extremely expensive and time consuming. Our EEs and MEs use high- end modeling tools and draw on a lot of outside vendor experience to get their work done. Turns can take weeks or months and that's after your prototyping phase and/or process development is done.

Whether it's harder to find and coordinate ME/HW resources is hard to judge. It doesn't appear like that to me and the disciplines have been around longer so there's more maturity in the industry. Typically you won't find the MEs bickering about the latest framework or tool to use. There's more of a get-er- done attitude, especially since the best MEs tend to be more practical minded people in the first place, more likely to go out and pour some concrete on the weekend instead of spending it at their computer screen.

My team mates frequently joke that my job as FW engineer is easier and I tend to agree - only half jokingly. On the other hand, more than once we've sent out firmware fixes to the field that prevented a gear box from stripping or some part from overheating so everything has its place and value.

</comment></comment></comment></comment><comment><USER5> Maybe in a few years we can even have printers printing printers.

<comment><USER6> <http://reprap.org/wiki/Main_Page>

<comment><USER7> I know that this is the stated goal of the reprap, but it's practically impossible [1].

Now, if the goal was to build a _factory_ that could build more factories, then sure.

How do you build motors for the rep rap? How do you build the circuit board for the rep rap? How do you build a heating element for the rep rap? How do you build an extruder head than can withstand the heat required to liquify the material that it's made of?

Don't get me wrong, I think that the rep rap is _awesome_ (I carry a little gear that I printed on one at my local hackerspace around on my keychain so that I can tell people about how yes, we're living in star trek and yes, replicators are almost a reality), but it's nowhere even remotely close to being able to print itself, and likely never will be.

I wish that makerbot got more attention. It's a much better, much more reliable printer.

<http://www.makerbot.com/>

[1] - I want to clarify: I'm not saying that people shouldn't try things that are impossible, in fact my personal philosophy is basically the exact _opposite_ of that (if something sounds impossible, do it). I just think it's important that budding hackers realize that the rep rap has an interesting _goal_ but that the product itself is currently pretty sub-par when compared to other things that are available. If you've already got a makerbot or something like it, and you want to build a rep rap for fun, then I applaud you, but I definitely wouldn't look at it as an alternative to a "commercial" (if you consider makerbot commercial) alternative.

<comment><USER8> > Now, if the goal was to build a factory that could build more factories, > then sure.

This sounds vaguely like a Java library.

</comment></comment></comment></comment><comment><USER9> Not a single mention of Reprap. I find this extremely disappointing.

<comment><USER10> Reprap seems like a neat idea, but it's not yet capable of making stuff that I'd want. It's low-res, and doesn't print metal. If and when it does these things, I think it'll be worth talking about. So maybe it's like the Apple I was back in 1976. The Shapeways printer the article talks about does cost something on the order of a 1970s minicomputer...

The reason I'm skeptical about Reprap is that it's not a business, but they're trying to make hardware. So I'm not sure that they'll _ever_ achieve their goals before a startup does it first and better. Apple had a _lot_ of money, and they used plenty of it to create the Mac, which was the first desktop computer that had the interface and capabilities that most people really wanted (easy desktop publishing, for example.)

<comment><USER11> The big deal about RepRap isn't so much what it can do but the fact that it is:

1) Low cost

2) Open source

3) Self-replicating

These attributes make it a lot more economically accessible to people who wouldn't otherwise be in a position to learn about and use this technology.

It could allow a bootstrapping hardware startup to produce their first product prototype. The economic value that could result is immense.

Just because RepRap doesn't meet your needs doesn't mean it's not worth talking about.

<comment><USER12> It's only Self-replicating in the least useful way possible. The components it can create that are used to make more copy's of it's self could be vary cheap to buy in other ways. AKA if you used injection molding and sold it as a kit the overall costs would decrease (assuming a reasonable market existed for them).

I am not saying it needs to be able to use dirt, sunlight, and water to make another copy. Just that the components need to be a little simpler before the cost really drops.

<comment><USER11> I could be wrong but I do believe that RepRap was the first working self- replicating device after decades of theorizing on the topic.

Sure it can be improved on massively, but you must acknowledge that it is at least a step in the right direction.

<comment><USER10> It's a step, alright, but how do you know that it's a step in the _right_ direction? RepRap has not set very much of world on fire yet. When I can do more than print out more than a low-res plastic coathook, I'll get excited. How many years will it be before I can replace my car's crappy plastic door panel with a high-quality printed one? Will it ever happen? It doesn't seem like this will happen soon enough for me to hold out on buying a new car.</comment></comment></comment></comment></comment></comment>


Ask HN: Any way to monetize a simple game? - <AUTHOR>

Hi,
I have a simple math practice game at http://zetamac.com/arithmetic/.
I've had it up for about 5 years now and have never made any money off of it so I was just wondering if there's any reasonable chance of me making anything off of it. It gets played about 5000 times a week (~500 uniques).
I've tried applying to AdWords, but have been rejected because they claim the site is "Under construction". Presumably it's not enough text content, anyway. Are there any ad networks that would be better for this sort of thing? Should I instead look for specific sponsors who can just sponsor a single ad for a while? (Also, about how much would you expect would be reasonable to make from ads from a site like this?)
I've thought about adding features and charging for them, but I couldn't really think of any that would be interesting enough to make me want to pay for them, so presumably most other people wouldn't want to either.
Any suggestions would be appreciated. <comment><USER2> I clicked and gave it a run, hitting the defaults I was presented with "752 / 8". My mind just lost interest (it is almost 4am mind you) and I closed the tab.

Then it occurred to me that this arithmetic would be much easier if I had built up to it, i.e. I was used to doing sums like that.

So, with that in mind, perhaps you need to offer more? I mean, a lot more. Ways to track my progress as I do build up, ways to give me good places to push the boundaries of my mental arithmetic. I mean, you could go on extending it and making more useful. You could dig out research for the best way to get the user to learn.

I'm thinking along the lines of the "goal" to be able to perform sums like those Japanese students who use abacuses to solve massive sums very quickly even once the abacus is removed.

There are plenty of interesting features you could add to it! Make people grow from it!

I would imagine your target audience would be the younger generation with their parents (schools?) paying their son's education interests. I could imagine every parent seriously considering purchasing if their child was interested.

<comment><USER3> ffr. 752 / 8 might look hard, but it's actually just 800 / 8 - 48/8 = 94

</comment></comment><comment><USER4> Currently your game looks Bland. Focus on a niche(may be kids 3-10). Add bit of bright colors. You could either ad support it using HTML5 webapp for ipads and iphones. or built an iphone/ipad app.

</comment><comment><USER5> Ideas monetizing this game I built: <http://thewikigame.com>? It has ~1500 players per day, w/ average time on site ~10mins.

I'm currently starting on a iPhone/Android app. I've thought about virtual goods and adds, but so far I have shied away from adds, and virtual goods I'm not sure about. There is also that upcoming Chrome app store which might be a possibility. Any other ideas?

Anyways, good luck _spicyj_ , you're not alone in your quest.

<comment><USER3> Nice game :-) I've been playing for half an hour and registered my username.

I pretty much suck at this, but it's fun :P

<comment><USER5> Awesome!

People really love the game for a while, the word "addicting" comes up a lot. But, the long-term retention is pretty low, and understandably so, there are no variations or other features except the main game.

I'm working on making more features/game types/etc to make the game players have better retention, and make it overall more enjoyable for long-time players. Specifically, I'm working on the top voted requests here: <http://wikipediagame.uservoice.com>

</comment></comment></comment><comment><USER6> Well, Firefox doesn't seem to know what to do with a BIN file called 'play' when I hit the 'Go' button. I don't know why, but you might want to look into that. That could be a sizable slice of the market to simply ignore.

I was surprised that I actually got into the game a bit. The problems are challenging enough to make it a real race with the timer. I didn't quite expect it to be as interesting as it turned out.

This might work well as one of those IQ quiz/survey things that seem to crop up a lot in banner ads. You could push it with a slogan along the lines of "How fast is your math?" although you might want to get a bit more creative. Checking just now, I see the domain fastmath.com is already taken. In fact, it looks like there are already some games out there along similar lines. Don't expect to find a lot of low hanging fruit.

That said, I think you might still find some opportunity. I would probably look at hooking the game into Facebook to get it in front of more people, and promotion deals for self-help books targeting math skills.

You'll probably need to liven up the design, though, and you absolutely MUST make it work with Firefox, without telling or expecting the user to do or install anything. I don't know if it's a problem for anyone else, but I JUST freshly installed FF on my Windows laptop, just in case the problem was Linux, and it failed the same way there. Google Chrome handles it on Windows (as I assume does IE), and Konqueror on Linux even knows what to do with it. What Firefox is missing, I don't know, but I suspect that slice of the market is a little bit big to just ignore. You would probably do well to look into it.

Good luck!

UPDATE: Had another look with Windows Firefox, and it's identifying the file as MIME type "application/octet-stream", which is probably what my Linux version considers a BIN file. I'm also noticing that sometimes the browser does seem to dectect the file/MIME type and run the file correctly on both Linux and Windows. Less often than not, though.

At a guess, you're going to need either to set the Content-TYpe (text/html?) explicitly, or give the file an extension. Otherwise, Firefox is unlikely to handle it consistently, let alone correctly, and that's liable to KILL your chances of monetizing anything.

Again, good luck...

</comment><comment><USER3> Your best bet is probably to talk to some company that's selling arithmetic- improvement books and mind-skill books, even mind-improvement software and offer to advertise for them. Just tell them up front what they will have to pay etc..

You could also search for affiliate networks that have some of those categories, but that will probably not pay off as much.

I can't see that you'd be able to make any money selling access to your software unless you added some more benefits and made a full product out of this, where you'd actually be helping the user improve his math skills. Heck, I think I'd use that, my arithmetic skills are really poor (despite being a decent developer) and I'd like to improve them.

Your last option would probably be to try to get some partnership with other companies or offer schools or websites in this category white-labeled version of your software so they can set up a widget of your application on their website for value addition, etc. Come to think of it, that might be your most lucrative option, plus you get more users and can continue to develop and add more value for the user...

<comment><USER3> Btw. Is your leaderboad supposed to work? Because it's not working for me... I'd like to see where I rank compared to other people.

I also have a lot of ideas of how you could improve the game aspect itself, but you probably have them as well, you just haven't been developing the app for the last 5 years, right?

<comment><AUTHOR> No, I took it down a while ago because of vandalism. I guess I forgot to remove the link! It'll be fixed soon (I was working on moving it to a new server today and fixed that in the process, just haven't changed the live site).

</comment></comment></comment><comment><AUTHOR> (Clickable link: <http://zetamac.com/arithmetic/>)

</comment><comment><USER7> I'm still trying to find ways to further monetize my iPhone math game: <http://www.mathogen.com>

Mathogen teaches kids (3-10) addition, subtraction, multiplication, and division through a cute and colorful pattern matching mechanic (faster comprehension means higher scores).

I thought $2.99 in the App Store would be a sweet price but anything over 99 cents seems like a deterrent.

Does anyone have experience making money with their games on Facebook? If I release my game on more platforms, more people will talk about the game and purchase it, right? I would love your feedback.

</comment><comment><USER8> You have to get crazy traffic and plays to make anything off of ads. In-app purchases are really the only way to make money from a game and, as you mentioned, that requires compelling content that one would want to pay for.

The article below is for flash games but it shows the difference between popular ad supported games and popular 'premium' (in-app purchases) games.

[http://blog.gambrinous.com/2009/10/07/you-should-be- making-a...](http://blog.gambrinous.com/2009/10/07/you-should-be-making-a- premium-flash-game/)

</comment><comment><USER9> I know a site (gamesforthebrain dot com) that runs affiliate ads of this site: <http://www.lumosity.com/partners>

Hope it helps.

</comment><comment><USER10> [http://vandelaydesign.com/blog/make-money/101-ways-to- moneti...](http://vandelaydesign.com/blog/make-money/101-ways-to-monetize- your-website-or-blog/)

</comment><comment><USER11> You could install openX and sell your own ads

You can find a sponsor who wants the advertising to brand it theirs (some sort of school supply or test prep company maybe?)

You could add some advanced features only accessible after pay paling 5 dollars.

</comment><comment><USER12> iPhone/Android/WebOS/Windows Phone 7 app.

You could, you know, look around for ad networks.</comment>


North Korean Social Media Offenseive - <AUTHOR> http://www.gulf-times.com/site/topics/article.asp?cu_no=2&item_no=380599&version=1&template_id=45&parent_id=25

<comment><AUTHOR> Here are the YouTube videos: [http://www.youtube.com/results?search_query=uriminzokkiri...](http://www.youtube.com/results?search_query=uriminzokkiri&aq=f)

Twitter account: <http://twitter.com/uriminzok></comment>


Ask HN: Are Viruses Alive? - <AUTHOR> I keep seeing advise to wash hands and use hand sanitizer to kill viruses but are they alive? Original sources would help in the responses. <comment><USER2> How can you kill that which has no life?

Humans apply taxonomy to nature, useful but ultimately flawed models.

Reality seems to be continuum, nature does whatever works and has no concern for neat categories.

My opinion is viruses are "alive" as they are unique replicating and evolving genetic code that can be identified distinctly from the host.

Other opinions are they must have other biological process to be considered "alive". The debate does not seem to be settled, its pretty similar to the is Pluto a planet, again another human taxonomy that not everything in nature fits neatly into.

I think as we discover more of the universe our definition of life will probably need to evolve. Already our computers make us question the definition, when will software become "alive" or "conscious". We already sometimes speak in terms of "biological" or "organic" based life.

</comment><comment><USER3> > I keep seeing advise to wash hands and use hand sanitizer to kill viruses

Sorry this really doesn't answer your question, but "inactivate" is probably more accurate than "kill."

<comment><USER2> Except no one normally says that. Also inactivate connotates it can be reactivated, destroy would probably be the better word for something not considered alive at least for lay people. I know some people worry inactive viruses in vaccines can reactivate and infect you.

Then again most people will just say kill since the same agents that kill bacteria and other fully agreed upon microscopic life forms tend to work similarly on viruses.

</comment></comment><comment><USER4> Is 79°F hot?

Alive is just a word. It means different things to different people and any formal definition will necessarily be arbitrary.

<comment><USER5> They told me at school that viruses are not life forms. But, that is a good point I suppose, and, should want to know how that is determined "is it alive"?</comment></comment>


Black Holes Orbiting Around Each Other Send Off Waves - <AUTHOR> http://www.npr.org/sections/13.7/2017/09/27/553953118/when-two-black-holes-dance-space-quivers <comment><USER2> That's an excellent title.</comment>


Teenager facing prison for downloading unsecured files from government website - <AUTHOR> http://www.cbc.ca/news/canada/nova-scotia/freedom-of-information-request-privacy-breach-teen-speaks-out-1.4621970 <comment><USER2> This reads like the beginning of The Hacker Crackdown..

As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication.

Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content.

Shame on them for building a poorly secured site, but even more for trying to railroad a curious kid who made them look stupid.

<comment><USER3> i can see how the older generation is thinking though, they see it like leaving a window unlocked doesn't mean you can

the laws are interpreted and applied by powerful people in a way that suits the way they think - that much i think could have been predicted (but not by a teenager)

did the weev ruling surprise anybody other than hackers?

<comment><USER4> Since it helps the older generation to think about digital content in metaphors, I'd argue that the kid was entering through an open window of a public building. Although a bit strange, no one would give this hypothetical person a third look.

<comment><USER5> I think the most precise metaphor is: a kid walked through the front door of a public library, borrowed a couple freely available books, then the government realized those books mistakenly included sensitive information.

In order to address that error, 15 police officers raided the kid's house.

<comment><USER6> That would be an accurate analogy if these documents were linked to from a publicly-accessible portion of the site. They were not. This is more like someone walking into an unlocked back room and grabbing books that hadn't been shelved.

<comment><USER7> I think that's a bit harsh. The documents at that URL were understood to be freely available to the public.

As I physical analogy, I'd think about it more as one of those restaurant straw dispensers. He got tired of pressing the button each time for a new straw, and instead opened the lid and grabbed a bunch out.

<comment><USER8> Going to a restaurant and taking every single straw out of the top of the straw dispenser is clearly anti-social and is probably theft.

<comment><USER9> But there's a near infinite supply of straws and it didn't damage the dispenser.

<comment><USER8> It did, however, damage the privacy of various Canadian citizens.

<comment><USER10> _> It did, however, damage the privacy of various Canadian citizens._

Did it? I understand that the stupid contractor who put this data on the website did (potentially--but note that nobody is saying that anyone has actually suffered harm because of that data being accessible). But did the teenager who got this bomb dropped on him damage anyone's privacy? As I understand it, he downloaded the data, put it on his hard drive, and left it there; it never went anywhere else.

<comment><USER8> Can you please send me a copy of your last 3 tax returns? My email address is in my HN profile.

I don't know you have don't particularly care about your financial situation, so I'm not gonna read them or share them with anyone else. I'll just keep them on my hard drive.

<comment><USER11> > Can you please send me a copy of your last 3 tax returns?

Options:

A) Sure, here you go. Oh wait! I didn't mean to send you those. You tricked me and stole my information. I'm going to send 15 police officers round to arrest you and then you're going to prison for years.

B) No, that's confidential.

^^ Which option do you think is more reasonable?

<comment><USER8> A) is not comparable to the current situation because you are the one initiating the action. I can't stop you from sending me an email so it can't be a crime on my part if you do so.

<comment><USER11> No, you are initiating the action by requesting the file from me. You did request the file didn't you? Even though you should have known it wasn't public information?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Seems like a move by the provincial government to shift blame from its poor security to an imaginary bad actor; this article also from the CBC goes into more detail and asserts that fraudulent intent is necessary for a conviction, so hopefully this goes nowhere.

[http://www.cbc.ca/news/canada/nova-scotia/concerns-teen- bein...](http://www.cbc.ca/news/canada/nova-scotia/concerns-teen-being- railroaded-in-privacy-breach-to-cover-government-slip-1.4616972)

<comment><AUTHOR> Yes, it's really not clear that any crime was committed. The relevant section of the Canadian Criminal Code[1] requires either fraudulent intent or some actual manipulation/destruction of the server - not simply downloading data. It seems like overreach by the police to distract from the fact that the government failed to secure private data.

[1] [http://laws- lois.justice.gc.ca/eng/acts/C-46/section-342.1.h...](http://laws- lois.justice.gc.ca/eng/acts/C-46/section-342.1.html)

<comment><USER13> Honestly, I'd like to see the kid's lawyers push back and claim damages against the province and its contractors.

How else shall we force problems like this to be fixed?

</comment></comment></comment><comment><USER14> I agree with many of the comments here, along the lines of "intent?" and "bad law", etc... How can I provide _material assistance_ to either this kid and/or to the problem at large?

I'm looking for something other than "donate to the EFF [or equiv.]" ideally though; I'd prefer to donate directly to his legal fund, or even do some legwork myself that will help, etc.

And ideally in a way that not only helps him, but that helps prevent these situations from occurring in the future -- i.e. working towards law change, influencing prosecutorial discretion (meh), etc...

<comment><USER15> I'm not an expert in Canadian law, but are there any elected officials in the chain of the decision to conduct a raid? If so this ought to be severely career limiting. If it was an elected judge who approved the warrant, for example.

<comment><USER16> The provincial government or federal government appoints judges. [0]

But if it is anything like here in Australia (we are both Westminster systems) then this does not mean the government is held accountable. Judge appointments are assumed to be fairly neutral and it hardly ever comes up at election time.

[0]: [https://en.wikipedia.org/wiki/Judicial_appointments_in_Canad...](https://en.wikipedia.org/wiki/Judicial_appointments_in_Canada)

</comment></comment></comment><comment><USER17> The teenager was downloading publicly available records on a Freedom-Of- Information portal. Why law enforcement is involved, or why this is even remotely a criminal act, completely baffles me.

<comment><USER18> It's easier to prosecute than to fix. More than that, the kid pointed out the service is broken. Pretty humiliating. It's not at all unusual to prosecute to save face, especially rather than admit that your org gave the info to a teenager when that's illegal.

</comment></comment><comment><USER19> Really worried about what the authorities might find in his 30TB of 4chan backups. Hoping for the best outcome for them.

<comment><USER20> Exactly. Why did this kid admit that? How astronomcally low are the odds there's nothing illegal to possess in there?

<comment><USER21> As the amount of 4chan material you've archived increases the probability of not archiving something illegal quickly diminishes to zero.

<comment><USER22> Depending on the boards archived there's a pretty good chance he doesn't have CP. Only /b/ (and I hear /sp/ as well but I never go there) really ever have child porn, and then very very rarely and quickly deleted to the point that an archiver might not pick it up. Due to the sheer size and uselessness of a possible /b/ archive I kind of doubt there's anything bad.

<comment><USER23> If his archive was automated it's basically guaranteed he's saved a fair bit of loli content. Not sure of the legality in Canada, but this is seems like a case where they'd railroad you for something they normally don't enforce, e.g., Chris Handley in the states.

CP would not be unlikely even if he just archived "safe" boards like /a/, /tv/, and /g/.

<comment><USER24> If he's scraping the softcore or hardcore boards (because nobody's archiving 4chan for its intellectual discussions), he's absolutely going to have more than a few under-18 subjects in there doing sexually explicit things. If the state can verify the age and identity of any of them, he's toast.

<comment><USER22> >nobody's scraping 4chan for its intellectual discussions You'd be surprised. There's quite a few archives out there just for keeping up board history and discussions.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> Just like Aaron Swartz. Is it really necessary to send 15 officers and / or sentence people to 20+ years in prison for downloading freely available information?

Aaron Swartz faced a longer prison sentence than most murderers within the US, and the sentence for murder in almost any other country in the world.

Common sense has completely gone out the window in both policing, and the criminal justice system.

Was anyone injured? Did anyone suffer financial loss? Fear to self? Any form of significant damage at all? The answer to all the previous questions is a definitive and resounding NO!

</comment><comment><USER26> God dammit. An almost identical thing happened to me after submitting a public records request to Seattle's IT department for email metadata for January 2017. Instead of sending me the email metadata I requested, they ended up accidentally sending me millions of _actual emails_. FBI investigations, cheating husbands' texts, SSNs, credit cards, zabbix alerts (so many 100% disk space alerts).

When I contacted Seattle them to tell them what happened (on my own will), the conversation quickly turned to a point where we had to get lawyers involved. Basically, they told me that if I agreed to have Kroll [1] scan my hard drives to prove that I deleted the records, then they would give me "legal indemnification". They eventually agreed to accept an affidavit that I deleted everything, and had to wipe TRIM and that I wrote a script to confirm deletion to the effect of, "grep -r $FILES_HEADER_FIELDS /".

One part that led to such a strong action by them was that they didn't see in their logs how I downloaded everything and thought that I found a backdoor to download all of their emails. They had some annoying rate limiting that prevented too many files from being downloaded at once, so I copied the files from the page's source, then ran a wget against everything. Since the files were being downloaded from S3, their webserver logs didn't include most of the downloads, which led to some suspicion.

Funny enough, Seattle told me it would cost $32m and 320 years of employee salary, but I ended up sending them $40.

It just blows my mind.

[https://crosscut.com/2017/10/seattle-information- technology-...](https://crosscut.com/2017/10/seattle-information-technology- department-email-leak-city-scrambles)

[1] [https://www.kroll.com/](https://www.kroll.com/)

<comment><USER24> The way things played out for you is exactly how we handle corporate exfiltration. Employees are unilaterally terminated for the violation, but we'll agree to not press charges if they disclose any dissemination and attest to its deletion.

Good for you for not having to deal with Kroll.

</comment></comment><comment><USER27> I am absolutely incensed reading this.

The government made no reasonable effort to conceal the information and put it on a _publicly accessible_ web server. They made the information available to the public whether or not that was their intention. How can any reasonable person conclude that typing in an HTTP url qualifies as an illegal breach?

<comment><USER28> They've made the information publicly accessible via HTTP, yet react like this when someone then views in. Scary stuff.

I just can't comprehend this at all. To even describe it as a "breach" is inaccurate -- the real headline is "government publishes data they hadn't intended to".

</comment></comment><comment><USER29> I've contacted the reporter to see if we can setup a legal fund for this guy. It sounds like he's being bullied. This could also get a very bad precedent in Canada as this is totally absurd.

<comment><USER30> I would love to help out if possible. I'm a Canadian citizen but not in Halifax, so I guess I can write my MP but I don't think they have much authority to look into a provincial matter like this.

<comment><USER31> [https://www.gofundme.com/ns-teen-railroaded-by- government?ut...](https://www.gofundme.com/ns-teen-railroaded-by- government?utm_source=internal&utm_medium=email&utm_content=campaign_title&utm_campaign=donation_receiptv5)

</comment></comment></comment><comment><USER32> Add "help avoid sending teenagers to prison" to the list of reasons why you should prefer UUIDs over integers in your Internet-facing REST API.

This API was supposed to be private and yet supported trivial enumeration?

<comment><USER33> Many UUIDs aren't secure either and can be trivially enumerated. A better approach might be a long number generated using a secure random number generator and converted to a BASE-64 string.

<comment><USER34> If things should be secure, they should be behind authentication and authorization for that content. To argue about what is the best ID to be used is just trying to fix what is not broken, IMHO.

<comment><USER35> Security is multi layered.

<comment><USER36> Obscurity is not a security layer.

<comment><USER33> So a password or private encryption key isn't security?

</comment></comment></comment></comment></comment></comment><comment><USER37> Since this is publicly accessible, what would be the chance that search engines indexed the files? In this case, would Google bot be charged? Or if this were, say, Equifax or Facebook. I mean, in those situations, the companies were blamed for "the leak". It seems rather convenient to cherry pick the law to apply on this poor teenager.

<comment><USER38> I think I read that Google had, in fact, indexed all of these pages.

<comment><USER39> Google did indeed index these files according to the following article:

[https://evandentremont.com/some-information-on-the- freedom-o...](https://evandentremont.com/some-information-on-the-freedom-of- information-hack/)

</comment></comment></comment><comment><USER40> >Officers took her 13-year-old daughter to question her in a police car.

Why are the cops allowed to do this? Why do you have to be "rescued" by your lawyer in order to not be questioned by the police without legal representation? Not sure how it works elsewhere but the cops badgered the _fuck_ out of me until my lawyer finally got to the station and chased them out. So, if I was a 13 year old on the way to school and thrown into the police car, they could just do that until I crack?

</comment><comment><USER41> Not the kind of response I would expect as a Canadian. Can't they send someone undercover ahead of time to find out it's just some kid at his family house and then take the appropriate response? There are better ways to handle this, and there are certainly better ways to secure government files!

If it's publicly accessible, it's public information. Obfuscation doesn't count!

<comment><USER42> There really should be accountability of whoever chose to store the data in an insecure manner.

</comment></comment><comment><USER43> If you can see the data by iterating a single number in a URL, and there's zero authentication or verification of credentials, there's no possible way to call it malicious. The fact this family's home was raided was already a colossal mistake. The fact charges are even _suggested_ is such a joke I don't even have words to describe it.

</comment><comment><USER44> Please write to CIPPIC [0] and the Members of Parliament [1] and Members of the Provincial Leglisation [2] for both your local jurisdiction if appropriate and Halifax, Nova Scotia to help protect this kid. The federal Minister of Justice [3] and Technology [4] may be good additions. Remember what happened last time we let a government go wild on a kid incrementing a number in a public URL.

The fact is, it is the organization who published "personally identifiable information" on the public internet who should be punished - and, in any case, criminal law is not the tool to do it. The kid who incremented a number in a URL to download that information is not the bad guy. What if the kid was not Canadian? Are you going to try to extradite a Russian national over accessing information on a public web server?

When a server announces to the world that it can answer HTTP requests, making a reasonable number of HTTP requests is, to me and most technologists I know, authorization (and thus, should be seen as with colour of right or non- fraudulent). The fact those HTTP requests released data he was apparently not entitled to is a security issue, a bug, a problem to be paid for by the actor who manages the HTTP server, not a problem of law. Unfortunately, this section of law has not been used often enough to clarify to me the interpretation of those words.

Here are some follow on questions:

\- Why was there "personal information" in FOI releases? Surely a FOI release was intended _for the public_ , as that is the intent of the act. Who's fault is it that there was undesired information in the releases?

\- How do we get this law changed? As the law is written, it hangs on the words "fraudulently and without colour of right" \- the rest of the clause is incoherent babble of a 1985 technophobe.

[0] [https://cippic.ca/](https://cippic.ca/)

[1] [https://www.ourcommons.ca/Parliamentarians/en/members/Andy-F...](https://www.ourcommons.ca/Parliamentarians/en/members/Andy- Fillmore\(88325\))

[2] [https://nslegislature.ca/members](https://nslegislature.ca/members)

[3] [http://www.justice.gc.ca/eng/contact/index.html](http://www.justice.gc.ca/eng/contact/index.html)

[4] [http://www.ic.gc.ca/eic/site/icgc.nsf/eng/h_00279.html](http://www.ic.gc.ca/eic/site/icgc.nsf/eng/h_00279.html)

</comment><comment><USER45> If you're frustrated by this story and live in Georgia, USA, you should immediately contact the Governor's office and express your concern and share that he veto a similar bill sitting on his desk, SB 315.

[https://action.eff.org/o/9042/p/dia/action4/common/public/?a...](https://action.eff.org/o/9042/p/dia/action4/common/public/?action_KEY=10692)

</comment><comment><USER46> And this is why I'm going to route all my kids traffic through an offshore VPN by default and whitelist low latency stuff.

<comment><USER47> I've been thinking I wanted a router with two wi-fi networks.

One that goes through the ISP and one that goes out over a proxy.

I haven't found a solution just yet. I guess a raspberry pi with iptables and routing based on device ID could do the trick too.

<comment><USER48> I use the following configuration:

I run two tinyproxy instances on my home server and I point all browser traffic to the first instance. The first instance run with the default routing table on port 8888 and has entries like upstream localhost:8889 ".somesite.com" the second instance, which run on port 8889 is run with the vpn as default route (I use setfib under FreeBSD).

With this setup, traffic goes by default directly on the net, but the tinyproxy config file can be used to redirect some traffic through the VPN.

Of course, you can do it the other way around to have traffic by default on the VPN and direct some traffic.

<comment><USER47> Won't this leak DNS and won't lots of system process go avoid the HTTP_PROXY settings?

<comment><USER48> I have my own DNS server on my local network. And yes, this is only for my browser. But this is intended.

If you want to route all traffic to a vpn for a specific machine, you can use pf rules to forward an ip through another routing table.

</comment></comment></comment></comment></comment><comment><USER49> This is appalling. The operators of the site should be charged for criminal negligence. You don't get to call it stealing if all it took was 3 keystrokes in the address bar of a browser. Backspace. Number. Return. Hacked!!

</comment><comment><USER50> Good thing he's in Canada and _only_ got raided. If he were in the USA, they would have tossed flashbangs and tear gas into his house, vaulted in through the windows, shot the family dog, and held the whole family at gun point, boots on their necks.

It's a shame that police departments think these "shock and awe" tactics are even remotely appropriate for dealing with non-violent suspects.

<comment><USER24> I don't like or agree with it either, but it is unfortunately necessary for the preservation of digital evidence.

Many nonviolent actors involved in cybercrimes have prepared killswitches or some other manner of instantly burning everything to the ground if you give them enough time to react when you show up with a warrant.

<comment><USER51> If we can't enforce the law without making society terrible, let's get rid of the law.

</comment></comment></comment><comment><USER52> I wonder how they noticed.

Perhaps the lowest-bid contract company that made the site decided to use something like amazon glacier for storage of boring documents nobody will ever need. Then along comes someone that causes them all to be extracted at great cost, some middle manager receives a bill for $millions and wants to blame the kid rather than his own failings.

<comment><USER43> The truth is even sadder than you might expect (the rest of this post is a quote from this article[0]):

Conrad said the breach was detected by a provincial employee, but it was a fluke.

"The employee was involved in doing some research on the site and inadvertently made an entry to a line on the site — made a typing error and identified that they were seeing documents they should not have seen," Conrad told a technical briefing.

[0]: [http://toronto.citynews.ca/2018/04/11/halifax-police- probing...](http://toronto.citynews.ca/2018/04/11/halifax-police-probing-n-s- freedom-of-information-site-breach-government-says/)

<comment><USER51> There's a bit of a leap from that to knowing this dude had done the same thing? That describes the employee finding a vulnerability. It probably took some study of the logs to find "the breach". How many similar breaches by actors overseas and less-vulnerable Canadians did they ignore?

</comment></comment></comment><comment><USER53> This might be a controversial opinion here, but intent does matter. If I see a bunch of stuff sitting the sidewalk and I take some because I think it's free, that's a reasonable thing to do. But going into someone's house and taking their tv is not. _" It's their own fault for not locking the door"_ isn't a valid legal defense, and I would prefer not to live in a country where victim- blaming becomes a get-out-of-jail-free card.

Based on what little I've read thus far, the teenager does indeed seem to have good intent. If that's the case, I'm cautiously optimistic that the court system will set him free without any consequences. But if the prosection can prove that he was aware of the data's confidentiality and was acting with malicious intent, then he deserves a conviction. Let's let the legal system run its course, before gathering our pitchforks.

<comment><USER54> That analogy assumes a lot about how hard/hidden obvious id numbers in URLs are. I'd counter that this situation is more like "putting your stuff on the curb and being mad when people take it". Rather than scapegoat the kid, the government should be investigating themselves for criminal negligence.

<comment><USER53> > _" That analogy assumes a lot about how hard/hidden obvious id numbers in > URLs are"_

Well, I did give 2 different analogies, and without knowing more specifics, I'm not taking a stand on which analogy better fits this case. Depending on the specific design the government used, and the steps the teenager took to access the content, either analogy could be applicable.

> _" Rather than scapegoat the kid, the government should be investigating > themselves for criminal negligence."_

That's a false dichotomy. Investigating government officials for negligence shouldn't preclude prosecuting a (hypothetical) malicious hacker.

</comment></comment></comment><comment><USER55> Wow. The trauma inflicted upon the children in the family when the Canadian government bursts into their house can never be undone or taken back. Nor can the financial and mental, emotional stress of losing their computers and ability to do productive work and go to school. (Edit: will there be any reparations for this abhorrent behaviour? Have they apologized? Will they, at least? Not that it matters, the damage to this entire family is done.)

Some questions. Is the website still online? What happens if every Canadian downloads the files?

What a dystopia. Do we only have one part of the story, can the situation really be as bad as depicted on the article? This is atrocious.

Edit: And where is the case against the people in the office who put the sensitive information of others into public view, (assuming and against the law), the _actual_ perpetrators of an actual crime?

<comment><USER56> The Gov of Nova-Scotia shut down the site, but you can still find some documents on Google (they're cached).

The subcontractor of the site fucked up and they're blaming this kid.

</comment></comment><comment><USER57> Cases like this make me want to attend law school. I am well versed in technology, have acted as CISO and other capacities. I bet I could decimate many prosecuting attorneys trying to make their weak cases.

<comment><USER58> Interdisciplinary skills are really undervalued in law practice. Usually (US) lawyers try to fill a room with 1 subject experts, which is uneconomical, and a government typically is not going to do it. So, in a run-of-the-mill matter like this there is no interdisciplinary skills available to stop the slow motion train wreck.

</comment></comment><comment><USER59> This story resonates with me. I faced a similar charge in college. I got indicted by a grand jury, and it was years before the DA dismissed the charges. Absolutely nerve-wracking, and I was innocent!

</comment><comment><USER60> This is crap. Late last year I found a public S3 bucket with 23,000 JSON files in it, which I used to make a visualisation: [https://vimeo.com/249970399](https://vimeo.com/249970399)

The reason I felt confident to do this was because there was no access control on the files and I'd reported it to PUBG Corp, with the bucket remaining public weeks later.

Before people are punished for downloading unprotected information, the person who left it like that should be hauled up in front of the courts.

</comment><comment><USER61> He's archived portions of 4chan?

It's likely then that he's gotten some "bad" stuff without him really knowing it. The police will search through his files, find the bad stuff, and charge him with some sort of possession/accessing/downloading charge.

Life = ruined.

</comment><comment><USER62> I've actually done a similar thing myself. When my wife was doing her Nursing degree she was downloading some documents she wanted to reference from an NHS web sites. The report for one year wasn't linked, so I checked the URL scheme, figured out what the URL for the report should be (only the date was different in the file names of reports for different years) and downloaded it directly.

It never occurred to me I might be committing a crime.

</comment><comment><USER63> Am I crazy? Aren't FOIA requests, by definition, public information?

<comment><USER64> This happened in Canada. They might have a FOIA equivalent, but I wouldn't assume it has the same rules as in the US.

<comment><USER65> In this case, most of the documents were public, but there were a small number which had confidential information and were inappropriately stored on the public portal.

</comment></comment></comment><comment><USER66> If a URL responds to any unauthorized HTTP request with data, how is the requester supposed to know that the data they received is supposed to be private or sensitive?

<comment><USER67> A better (more accurate) analogy than finding an open window/door is that of asking a government employee for data.

Kid: "Hi, what is the personal info in that file?"

Employee:

        What they should say: "You are not authorised to see the contents of that file."

        What they actually said: "Sure, here's all the information in that file."

</comment></comment><comment><USER68> Damn kids. They're all alike.

<comment><USER69> [http://archive.org/stream/The_Conscience_of_a_Hacker/hackers...](http://archive.org/stream/The_Conscience_of_a_Hacker/hackersmanifesto.txt)

[https://en.wikipedia.org/wiki/Hacker_Manifesto](https://en.wikipedia.org/wiki/Hacker_Manifesto)

</comment></comment><comment><USER70> In France, we had a similar case, a computer guy with the pseudonym Bluetouff[0].

He downloaded loads of national agencies confidential documents, because they were available on Google.

However, he was sentenced (3,000€ fine), because when he explored the website, he arrived on a connection page, thus realizing he should not have accessed these files, but continued anyway.

I just hope for the teenager that he did not encounter any login page in his search (which seems unlikely because he used a script).

[0] (in french): [http://www.maitre-eolas.fr/post/2014/02/07/NON%2C-on-ne- peut...](http://www.maitre-eolas.fr/post/2014/02/07/NON%2C-on-ne-peut- pas-%C3%AAtre-condamn%C3%A9-pour-utiliser-Gougleu)

</comment><comment><USER71> > His bedroom is upstairs. That's where police found him sleeping when 15 > officers raided the family home last Wednesday morning.

Calculate the cost of the 15 officers raid plus prosecution plus the damages to the teenager and repeatedly bash it over the head of the responsible officer in the next election. This is how to deal with this shit in democracy. Even if people are insensitive to someone else's freedom they are sensitive about their money.

</comment><comment><USER72> This reminds me of a purported "hack" back in the Governor Schwarzenegger days. An employee from a rival campaign found a public-accessible FTP directory full of audio files, which they then leaked to the press. IIRC, the California Highway Patrol opened up an investigation but ended up not pursuing charges.

[https://www.dailynews.com/2006/09/13/arnolds-audio-open- to-p...](https://www.dailynews.com/2006/09/13/arnolds-audio-open-to-public- foe-claims/)

edit: the other parallel, IIRC, was that part of the web site was kept private. But the user found the audio by navigating to a parent directory which was apparently open to the public:

[https://www.dailynews.com/2007/02/02/chp-clears-angelides- ca...](https://www.dailynews.com/2007/02/02/chp-clears-angelides-camp-in-flap- over-web-audio-files/)

> _Essentially, aides opened the Web address, or URL, from one of > Schwarzenegger's speeches and lopped a few characters from the end of the > address. That yielded a directory of audio recordings._

</comment><comment><USER73> The most interesting part of this to me is that for the charge to stick, they have to prove he did what he did with malicious intent.Keeping in mind the article states that other employees of this business also viewed these classified documents and are facing no repercussions because the company states they did it on accident. While in every scenario this kid should get off completely, that very well may not be the case. The US is extremely stringent when it comes to cyber crime, more often than not they like to make an example out of people rather than show mercy. The technical writeup for this was spot on, it seems like the company is embarrassed and instead of admitting they severely screwed up, they are doubling down on trying portray this teen as some super high tech malicious hacker who was trying to steal government secrets. It doesn't matter how lax your security is, if you can convince the population that this teen was nothing but an unethical, scumbag hacker, no one will show him sympathy.

<comment><USER74> Isn't this Canada though?

</comment></comment><comment><USER75> Each officer and official involved in this should face prison, as would any common burgler who holds a family at gunpoint in their own home.

</comment><comment> zupa-hu Couldn't it be argued that clicking links on a web page are no different from changing an ID in the URL?

Web pages contain loads of URLs. You can't tell if you have the right to access the content behind it. The URL itself is simply an address to something - or nothing (404).

Having an ID in the URL is a compact way of signaling a huge list of URLs.

Thus, the kid simply followed links published on the website.

</comment><comment><USER76> perhaps we need an RFC that defines this type of approach (pages "secured" behind easily guessable urls) as public information.

<comment><USER21> Instead of actual security why not have a spec for /humans.txt which can say things like "Please don't read anything in the /secret directory."

<comment><USER77> and what would that achieve? all it's going to do is force companies to add legal boilerplate (eg. those "this message is intended for the recipient only..." that you see in email signatures) to every imaginable place to cover their ass, meanwhile doing nothing to improve security.

<comment><USER78> Talk about no sense of humour.

</comment></comment></comment></comment><comment><USER79> What is it about headlines involving charges that love to focus on "facing prison". At the very _least_ this should indicate the RANGE of punishments, and there is a hell of a range.

From the article, he's been charged with "unauthorized use of a computer". IANAL but there would seem to be at least two possible interpretations of this charge [1], and the "Summary Election" variant has a MAXIMUM punishment of $5000 fine or 6 months. The other interpretation "Indictable Election" is a _maximum_ of 10 years.

As with any case, details matter. Judges aren't just sending every hacker to prison for 10 years. He may be judged not guilty (evil intent must be proven; then there's his age, etc.), or given a way, way, way smaller punishment than this "prison" he "faces".

[1] [http://criminalnotebook.ca/index.php/Unauthorized_Use_of_Com...](http://criminalnotebook.ca/index.php/Unauthorized_Use_of_Computer_\(Offence\))

</comment><comment><USER80> Remember Aaron.

<comment><USER81> Aaron Swartz' situation is substantially different. Swartz knowingly violated the terms of service of JSTOR, and deliberately circumvented it's rate limiting. And he knew what he was doing was against the law, he even published a manifesto outlining his intentions to do this as a form of civil disobedience.

The kid in this story just incremented sequential IDs on what was supposed to be public information.

</comment></comment><comment><USER82> >He estimates he has around 30 terabytes of online data on hard drives in his home, the equivalent of "millions" of web pages.

Wow.

</comment><comment><USER83> This is pretty disgusting. The provincial government should be absolutely ashamed of themselves.

</comment><comment><USER84> No one will face prison for making these documents public in the first place, I'm sure.

</comment><comment><USER85> what part of _freedom of information portal_ do they not understand?

</comment><comment><USER86> > Around the same time, his Grade 3 class adopted an animal at a shelter, > receiving an electronic adoption certificate.

> "The website had a number at the end, and I was able to change the last > digit of the number to a different number and was able to see a certificate > for someone else's animal that they adopted," he said. "I thought that was > interesting."

He's like, 20 years ahead of his classmates.

</comment><comment><USER87> This is really funny to see people comparing downloading a file to breaking into an unlocked window.

You guys don't really have a clue on what Internet is.

<comment><USER88> It's more like taking a photo of a public bulletin board with a hundred posts on it, where three of the posts contain private information and so shouldn't have been posted.

Anyone could have viewed the posts on the board one by one; he just copied them all at once for later viewing.

</comment></comment><comment><USER89> I work in a US city government doing government transparency work. I have a title that can get people on the phone. What can I do to help?

</comment><comment><USER90> The levels of security:

1) Formal methods and cryptography

2) Obfuscation

3) Litigation

Looks like they chose the latter.

</comment><comment><USER91> After figuring out that they screwed up, government agents should have politely visit the teen, interview him, go through his computer together and delete compromised files.

Then quietly fix the vulnerability.

Instead they produced PR disaster by disrupting lives of a law-abiding family.

These are signs of arrogance and incompetence of decision makers at that government department.

</comment><comment><USER92> It isn't a breach if the administrators of the repository failed to secure the information. Regardless of the likelihood of conviction it is reprehensible to terrify some kid with the threat of losing his freedom as a means of saving face, which is what this appears to be. I certainly hope he gets out of this.

</comment><comment><USER93> I assume it was the large number of requests over a short period from a single IP that drew their eye to it?

I wonder how many other people found the same thing and slurped this data down in a more circumspect way before this kid was kind enough to expose this privacy breach for us?

</comment><comment><USER94> This is very sad. Any information that is not secured, and thus CAN be accessed, should be considered publicly available. If that rule or precedent were in place (a law would never happen) it might force system owners to be more cautious.

</comment><comment><USER95> >At the family's request, CBC News is granting him anonymity because of his hope the charge will be dropped and his reputation preserved.

The only thing about this article that didn't irritate me.

</comment><comment><USER95> >At the family's request, CBC News is granting him anonymity because of his hope the charge will be dropped and his reputation preserved.

The only part of this article that didn't irritate me.

</comment><comment><USER15> This is shockingly heavy handed. Would they try and extradite Sundar Pichai if Google's crawler happened to index the pages?

</comment><comment><USER96> Teenager facing prison for looking at poster the government (mistakenly) put up...

Mandatory xkcd: [https://xkcd.com/932/](https://xkcd.com/932/)

</comment><comment><USER97> I can give a very anecdotal example, where I live all the doors on the flat look the same, the just have small numbers over the door. Because the exit door is the same just without a number and it is next to the door of my flatmate. Because I was in a hurry I accidentally entered my flatmate room when I intended to get out of the flat. This is more or less the same.

</comment><comment><USER98> I think people would be less upset about the teenager going to jail if the chain of highly paid Peter principle executives responsible for the files being accessible would also have to face any investigation at all.

</comment><comment><USER78> From the article: "When he was around eight, he remembered playing around with the HTML of the Google search page, making the coloured letters spell out his name."

Isn't the Google logo an image? Smells a bit fishy to me.

<comment><USER99> I make that about 11 years ago - the page was rather different then.

<comment><USER78> It was an image 11 years ago also.

[http://web.archive.org/web/20070106132559/http://www.google....](http://web.archive.org/web/20070106132559/http://www.google.com:80/)

</comment></comment></comment><comment><USER100> Sounds an awful lot like the computer fraud and abuse act

</comment><comment><USER101> What an age we live in, utterly depressing.

</comment><comment><USER102> American culture strikes again.

</comment><comment><USER103> I find the his story of "archiving the Internet" extremely amusing. Good luck with that defense. He was 19 at the time and knew exactly what he was doing - or should I say "archiving".

 _He estimates he has around 30 terabytes of online data on hard drives in his home, the equivalent of "millions" of web pages. He usually copies online forums such as 4chan and Reddit, where posts are either quickly erased or can become difficult to locate._

 _" I preserve things, I archive the internet. I have history on my computer, and all of that should be saved and preserved," he said._

<comment><USER104> You are not providing any argument against why he should not do that.</comment></comment>


How To Turn A Laser Into A Tractor Beam - <AUTHOR> http://www.technologyreview.com/blog/arxiv/26448/ <comment><USER2> Dup: <http://news.ycombinator.com/item?id=2271287>

Lots of points, no comments.</comment>


Harry Lewis: Not Your Father's Censorship - <AUTHOR> http://chronicle.com/free/v55/i19/19b00901.htm <comment><USER2> _"...it is hard to think of anything else that we depend on so heavily yet know so little about."_

Except for the power grid, communications infrastructure, medical system, food system, water system, the internet itself, monetary system, etc.

It's not really the lack of knowledge about search engines that bothers the author. What makes it stand out is its novelty and the fact that it's visibly controlled by a few entities.

</comment><comment><USER3> Once, when I had Harry Lewis as a professor, I was telling a friend something about him, referring to him as "Professor Lewis." My friend asked me if I meant a different Lewis, as there was more than one professor with that last name, so, to clarify, since he was a professor of computer science, I said, "I mean the CS Lewis." I have called him "C.S. Lewis" to myself ever since.</comment>