A Swede who created a $400K Indiegogo-scam - <AUTHOR> https://www.breakit.se/artikel/17260/the-swede-created-a-400-000-indiegogo-scam-is-this-his-next-project <comment><USER2> Indiegogo in particular is super sketchy, I did a campaign with them and they had an employee there contacting me and telling me all the shady stuff they can do to help me be successful and if that I can guarantee I'll raise x amount they'll do all these extra things like put it on the front page and in the newsletter and whatnot. They let you extend campaigns forever if you arne't about to hit your goal so you can keep saying "ending soon", then if you do hit your goal, instead of ending, they will let you keep it open to ride the momentum of that, or they will then let you up (or down) the goal and change the date so you can keep catching people who want to just be able to get it, or who want to pile on to a super successful project whose goal is now 1/10 of the original so it looks even more legit. You can also back your own stuff anonymously for as high as you want, so often you'll see campaigns with like $1MM and only like 20 backers and most are anonymous or not listed and you know obviously 20 people couldn't have legitimately backed for that much.

I can't recall a lot of the other stuff you could get away with, including have no proof of concepts and just using renders and being fully funded already and such, but I had to unsubscribe from their emails it was so disgusting. You can tell if you look at their site overtime which kinds of things just stay up forever or how they instantly are over the goal and whatnot. One item stayed up for like 8 months, constantly over the goal.

<comment><USER3> Funnily enough just this morning my inbox has this:

\---

From: Indiegogo

Subject: Your Indiegogo Innovation Award

Hi there!

We're excited to inform you that your project is eligible to receive an Indiegogo Innovation Award this January!

To honor your crowdfunding achievements, we cordially invite you to reserve your award, available for pick-up at this year's Consumer Electronics Show in Las Vegas.

Our theme at this year's CES is "Indiegogo Means Business," and your campaign is proof that creative ideas indeed grow into successful businesses with Indiegogo. As only 100 entrepreneurs will receive this gift, we hope you enjoy it as much as the Indiegogo community has enjoyed your ingenious ideas.

Thank you for being a pivotal part of Indiegogo!

\---

I have never run a campaign on Indiegogo.

<comment><USER4> Same here. It must have been sent out to everyone with an account.

</comment></comment></comment><comment><USER5> Never pledge on indiegogo, it's for scammers only. Kickstarter (for all it's warts) requires a working prototype to post on their site. IGG requires no such proof that you aren't selling vaporware. Also IGG shows total pledge numbers from IGG PLUS Kickstarter (and potentially other crowdfunding sites you might post to) so that their numbers look bigger.

Stop, Drop, & Retro has some really good YouTube videos calling out IGG/KS campaigns (focused on the retro gaming scene) and he does a decent job breaking it all down.

<comment><USER6> > _Kickstarter (for all it 's warts) requires a working prototype to post on > their site_

What do you mean by "working prototype"? I ran a successful software Kickstarter last year and all we had going in was a mockup (created in Keynote) of what the app would look like.

I expected that it would take hours/days after I "submitted for review" for the campaign to be approved, but it was instantaneously approved and went live.

<comment><USER5> I'm sorry, it apparently only applies to when the project is going to ship a physical item. [https://www.kickstarter.com/rules/prototypes](https://www.kickstarter.com/rules/prototypes)

</comment></comment></comment><comment><USER7> Another one in the long line of either over-promised or outright scams on Kickstarter/Indiegogo.

The oldest one I saw got almost this much funding and that was back in 2012! [https://www.kickstarter.com/projects/zioneyez/eyeztm-by- zion...](https://www.kickstarter.com/projects/zioneyez/eyeztm-by-zioneyez-hd- video-recording-glasses-for)

Every time one of these projects fails to deliver, I'd guess that another set of people get put off crowdfunding.

Personally my approach has been never to back a project by a first time creator, unless I already know their work from elsewhere, doubly so if it's for a physical product.

</comment><comment><USER8> SSE Student? One of the two SSE-programs is arguably the hardest program to get into in Sweden. Sometimes the Karolinska medical school has a higher entry requirement.

Graduating from there usually means you are set and don't need to scam anyone for a _very_ comfortable life.

<comment><USER9> Sometimes people don't steal because they need to, but because they want to. It's a puzzle, it's a rush, it's fun, and for some it's their hobby.

</comment></comment><comment><USER10> These campaign would never be successful without the copywriters on popular digital media promoting them because they are content farms looking for cheap "news".

Wired, CNET, and all these prominent outlets, when was the last time they issued a follow up when something turned out to be a scam? when did they ever put a disclaimer about the risk of crowdfunding in their article? and let's not even talk about the fact that they don't even state clearly that the product doesn't exist and they never even tried it. Without shills, scams can't be successful, they are the shills, literally by the definition of that word.

</comment><comment><USER11> IndieGoGo is a haven for scammers. They have absolutely no interest in protecting you. Even if you point out that the scammer is actively scamming currently, they won't do anything.

<comment><USER10> > IndieGoGo is a haven for scammers. They have absolutely no interest in > protecting you. Even if you point out that the scammer is actively scamming > currently, they won't do anything.

They actually do protect their backers better than Kickstarter sometimes:

this ongoing scam on Kickstarter:

[https://www.kickstarter.com/projects/stillalive/polygons- the...](https://www.kickstarter.com/projects/stillalive/polygons-the- flat-4-in-1-measuring-spoon/comments)

the same project was actually closed by Indiegogo as the creator is a notorious scammer:

[https://www.indiegogo.com/projects/polygons-the- flat-4-in-1-...](https://www.indiegogo.com/projects/polygons-the- flat-4-in-1-measuring-spoon-cool-design--3#/)

Kickstater doesn't protect anybody at all. Kickstarter doesn't get involved in anyway after funds change hands and they take their cut.

<comment><USER12> It's a shame that's a scam, it's actually kind of a cool idea.

</comment></comment></comment><comment><USER13> I wonder if he's the same Swede behind this attempted scam - [http://www.redferret.net/?p=55945](http://www.redferret.net/?p=55945)

</comment><comment><USER14> Waiting to pay for a product until it actually exists won't kill you.

<comment><USER15> It will, metaphorically, if a lack of funding will kill the product (or prevent it from ever being made). Crowdfunding is a financing option, complete with the part where the financiers are exposed to risk.

<comment><USER14> It's a rubbish financing option. The financers on average don't seem very good at comparing their little upside to the risk they're taking.

<comment><USER16> The ones I hear talking about their sponsoring, is that they know full well. I hear phrasing such as "shooting some money their way in case they succeed" and "it's an interesting project, let's hope for the best".

<comment><USER14> It's pretty damn stupid, know it or not.

<comment><USER17> Why? It's effectively a patronage; a model which has been used to bankroll artists, pet projects, and a number of risky ideas throughout history.

<comment><USER14> It's effectively investment, but without any of the benefits.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> > and raised in total $800.000 million from approximately 5,000 backers from > around the world.

I assume this is a typo? Or did a blanket raise almost a billion dollars?

<comment><USER19> [https://www.kickstarter.com/projects/322231573/zen- blanket-t...](https://www.kickstarter.com/projects/322231573/zen-blanket-the- blanket-for-better-sleep) ==> SEK 4,149,969 or $460,4330 USD

[https://www.indiegogo.com/projects/zen-blanket-the- blanket-f...](https://www.indiegogo.com/projects/zen-blanket-the-blanket-for- better-sleep#/) ==>$806,268

so in total $1,266,728

<comment><USER20> You might have a typo: 460,4330?

<comment><USER19> yep, SEK 4,149,969 is USD 461,227.55 rounded up to 460,430

<comment><USER21> Your original message has a typo in it. There's an extra three in the USD value (460,4330 rather than 460,430).

</comment></comment></comment></comment></comment><comment><USER22> If you find the concept interesting, the same type of thing is available today at a lower price from e.g. [https://curaofsweden.com/produkt/cura- pearl/](https://curaofsweden.com/produkt/cura-pearl/) \- no need to risk a Kickstarter order and delays.

</comment><comment><USER23> What I've gathered from my own and others experiences: Just avoid Indiegogo and Kickstarter and buy the inevitable Chinese knockoffs if the item is successful. With this possibly unethical method, you might even get the item before the pledgees.

</comment><comment><USER24> An article this long, and no mention of who it is? Feels strange to read this detailed investigation into the identity of "he who must not be named", when the whole point of the article is the identity of the person.

<comment><USER25> -Norwegian here - the Scandinavian countries in general have _very_ strong laws protecting the privacy of all citizens.

A consequence of this is that defendants in criminal cases are very rarely named by the media until convicted, if even then.

<comment><USER14> In Sweden, this is not a consequence of any law, but by common journalistic practices. Media are protected by constitutional writings that extend very far in terms of the sender's rights to publish. However, Swedish media also has a long tradition of keeping themselves to de facto standards when it comes to things such as identifying individuals.

It would have been _very_ weird to see this person named on Breakit.

<comment><USER26> Especially since no real link has been made between both companies and the student. You can't even affirm that the IGG campaign was indeed a scam or just an utter failure.

</comment></comment></comment></comment><comment><USER27> Indiegogo and Kickstarter are doing a very bad job at screening applicants.

At least something obviously physically impossible should've been cancelled.

They are burning their credit of trust.

</comment><comment><USER28> I bought a product from Aliexpress (12 euro IoT wifi relay) which i later found in the exact same name and package on kickstarter for around 20 euros. I contacted kickstarter, who quite abruptly removed the kickstarter. If their only intentions were faul they would have let it be, but they actually did the right thing in this case. Just offering another perspective of their work.

</comment><comment><USER29> Help me understand why the consumer protection is not used here?

In order to do card payments the merchant (IGG) need to be able to refund. It they cannot, the acquirer must do so. Anyways, one of the purposes of Visa and MasterCard is protection from these scams. If you don't get 100% of what you bought, you can get refunded by the card issuer, which will collect acquirer/merchant.

<comment><USER30> Maybe because the consumers are investing in a future product. It is not the same as buying directly online from ECommerce store like Amazon. Investing implies risk. The consumers can probably still get a refund for fraudulent charges from CC.

</comment></comment><comment><USER31> Unfortunately, back in 2014, I contributed to an Indiegogo campaign for DreamQii PlexiDrone 8 blade drone. It has not shipped, though they've been in a state of almost shipping for about two years. Lesson learned. DreamQii raised over US$2.2 million.

</comment><comment><USER32> But when Canonical's Ubuntu Phone didn't meet its pledge people goal on Indiegogo people got their money back? How did this even happen? Not that this individual isn't to blame.

</comment><comment><USER31> Unfortunately, back in 2014, I contributed to an Indiegogo campaign for DreamQii PlexiDrone 8 blade drone. Still not shipping. Almost shipping for the last two years. A costly lesson.

</comment><comment><USER33> Aren't these platforms meant to protect against this kind of scam?

<comment><USER34> How can you protect against such kind of scam on such kind of platform?

An airplane can reduce the risk of falling down, but if you want to be protected(!) against falling down from the sky you shouldn't enter a big piece of metal that lifts off from the ground.

<comment><USER35> Entering a piece of metal that can uplift you is a calculated and well-known statistical risk you can evaluate if it worth being taken for the service it provide.

Indiegogo seems to not have such statistical intelligence.

<comment><USER36> sending cash, to someone who can't at this time provide you the product you want to buy, and who makes no bones about not providing you with any assurances that they ever will is a calculated (and easily avoided) risk. You can evaluate if it is worth being taken for the product you may or may-not ever receive.

The fact that a house-fly already has the statistical intelligence for funding Indiegogo projects doesn't mean that there isn't any

</comment></comment></comment></comment><comment><USER37> Big Mike, we are coming for you.

</comment><comment> abc-xyz [https://outline.com/xxPp9N](https://outline.com/xxPp9N)</comment>


A Forebrain for the World Mind (W. Danny Hillis) - <AUTHOR> http://www.edge.org/q2009/q09_12.html#hillis

<comment><USER2> Of these I found Sam Harris's "True Lie Detection" essay to be the most intriguing.</comment>


Work Practices and Challenges in Pull-Based Development [pdf] - <AUTHOR> http://swerl.tudelft.nl/twiki/pub/Main/TechnicalReports/TUD-SERG-2014-013.pdf <comment><USER2> Would love to see a TL;DR summary. Long academic PDFs are frustrating to read.

<comment><AUTHOR> Papers provide their own TL;DR: just read the introduction, skip to the conclusion and lessons learned, then go back and read any graphs. :)</comment></comment>


First Dose of JuniorJobs at Juniorjob.co - <AUTHOR> https://mailchi.mp/b1d7e685a698/your-first-dose-of-juniorjobs <comment><USER2> How does this work? At least 4 of the jobs I see are not software dev roles. Is it only entries from indeed? Is it only US? It doesn't seem to have any ability to filter based on geography.

Also, the font appears larger on numbers 6-10 than for numbers 1-5.

<comment><AUTHOR> So it's a subscriptions list for Junior and Entry-level roles from everywhere. This is the first newsletter. Currently crawling for much more data so the subsequent newsletters are gonna have much more dynamic content. But it's not an entirely Software role list, the intention is to spread it across.</comment></comment>


The Obesity-Hunger Paradox - <AUTHOR> http://www.nytimes.com/2010/03/14/nyregion/14hunger.html <comment><USER2> It's only a paradox, I suppose, if you buy the prosperity hypothesis of obesity. Another word for "paradox" might be "refuting evidence". Gary Taubes has done some excellent work on this. My mind was changed by watching some of his talks, which are readily available on Youtube.

</comment><comment><USER3> It would be interesting to know how many groups or classes of people have bridged the gap from insecurity to plenty _without_ experiencing an obesity problem. Even Japan is struggling with a rise in obesity. Remember when the rich were all plump, and gout was a rich person's disease? Upper-class culture evolved to deal with the problem, but it didn't happen overnight. This looks like an instance where the upper classes took a few generations to adapt, but now we're looking at the poor (and also the middle class) and saying _why don't you just catch the fuck up right now?_ Obviously people arriving at the problem later have more information to work with, but cultural change is hard. Give 'em a generation or two.

This article concentrates on the availability of food, but I think that's only one side of the problem. I remember an NPR segment a couple of years ago where they went to a food bank near a wealthy area and compared what people were donating to what people were taking from the food bank. The rich folks were donating whole-wheat bread, which ended up just sitting on the shelves. Either the poor folks didn't know what to do with it, or felt insulted that the rich folks were trying to change their eating habits, or they just didn't like it. The poor folks wanted white bread and canned vegetables. Just because you've got whole-grain bread and fresh vegetables doesn't mean you know what to do with them or how to get your kids to eat them. Better supply might help, though: provide healthy food, and maybe they'll figure out what to do with it, even if they didn't really want it in the first place.

Getting kids raised on junk to start eating healthy food is another problem: I don't have kids myself, but evidently kids are little nutritional self-harm monsters. If you give healthy food to a kid who is used to pizza rolls and potato chips, he won't eat it, and he'll get cranky and nasty because he hasn't eaten. He'll torture himself and everyone around him until he gets candy or a Coke or mac and cheese. If you've let your kids get accustomed to eating junk, there's going to be a hell of a lot of suffering -- for both parents and kids -- before healthy eating starts to feel normal. Maybe that's why the adjustment time is measured in generations.

Personally, my parents had some crude notion of healthy eating, so I didn't get soda, candy, or sugary cereal, but we ate a lot of pancakes, french toast, spaghetti, bread and butter, bacon, buttery popcorn, etc. Those are foods that it's easy to gorge on, quantities were not consistently limited, and I liked eating, so I ate way too much. My parents maintained discipline and knew it was important that I ate a healthy diet; they just didn't have a good enough understanding of nutrition. Hopefully with my own kids I'll maintain what they achieved and add a better understanding of nutrition.

<comment><USER4> >Remember when the rich were all plump

I don't think that was ever true. The converse might have been true, but just look at old pictures - not a whole lot of fat people, and certainly not many morbidly obese people.

Obesity has been an epidemic since 1980 or so. It must be something that changed around then. In other news, high fructose corn syrup hit the market in 1975.

<comment><USER5> There was a good lecture titled _Sugar: The Bitter Truth_ by Robert Lustig, a professor at UCSF, where he argues that HFCS is poisonous. What I found most interesting was that although HFCS is a sugar, it supposedly is primarily metabolized to fat. It seems pretty easy to then link low-income, food insecure (hungry) people with obesity.

The video is worth watching: <http://www.youtube.com/watch?v=dBnniua6-oM>

<comment><USER6> He said fructose is poison. Sucrose is just as hazardous; it's just that HFCS happens to be pumped into everything.

</comment></comment></comment></comment><comment><USER7> If you're poor and buying mostly fast food you're just stupid. Dare I say you're poor and fat because you're stupid.

Convenience and time? You're going to do better healthwise and financially with any of ten products you can eat straight out of the can/jar. How can you beat a can for convenience and time efficiency?

Dare I say there aren't decent grocery stores in poor areas for the same reason there are many liquor stores in poor areas. It's not some policy problem.

<comment><USER8> Sorry you are wrong. Food that is good for you is just more expensive than food that is bad for you. I have never been really truly poor but I have been a poor student and I can tell you from first hand experience that it is definitely the case that if you are trying to save every penny you are more or less guaranteed to eat bad food.

I don't know what are those cans and jars of healthy food you are referring to. The only thing I can think of is canned fruit/peppers but they are definitely more expensive than the caloric equivalent of junk food.

Also as the article said, if you have uncertain income you will end up going on a starve/binge cycles which are also guaranteed to make you fat.

Another issue is that any affordable healthy food usually requires cooking and many poor people (esp in urban areas) do not have access to clean kitchens.

So it is a real issue and saying "they are poor because they are stupid" is pretty fucked up.

<comment><USER7> > Food that is good for you is just more expensive than food that is bad for > you.

It's not a relevant difference. Sugar and rice are the absolutely cheapest calories, and they're not so good for you. But a can of coconut milk is ~700 healthy and tasty calories for about a buck. Eggs are healthy and pennies a pop; you can even buy them already hard boiled. A can of sardines is a couple bucks. A can of sauerkraut is a buck and loaded with nutrition.

You have to be a moron to fail to put together a decent day's worth of food at a grocery store given $8. If you're willing to eat high starch you can eat for a couple bucks a day.

<comment><USER9> > Sugar and rice are the absolutely cheapest calories

You can bulk bags of rice as needed to supplement smaller amounts of healthier foods if you need to save money. (Stay away from the sugar) A diet of rice, beans, and vegetables may be boring but with little research you can live on it just fine.</comment></comment></comment></comment>


Flair Climate Control System Available for Preorder - <AUTHOR> https://flair.co <comment><USER2> The product video nails it. I would purchase this if only there was a major city with a tech industry that was affordable enough to buy a house in.

One thing though, how well do the vents block air from flowing through? I know the vent grates I have now always have a some air flow seeping through when I close them?

<comment><AUTHOR> Glad you like the video. For a somewhat subtle product, it took quite a while to really hone in how to get things across. Had a lot of internal debate as to whether to include some of the other fun things the Puck can do (related to heating/cooling in some cases or in others less so) but ultimately decided to try and keep things clearer.

It is a little quitter and with less leakage than the traditional stamped steel vents installed in most homes. I am hoping to do a blog post in the not too distant future that shows some of the testing at the factory since that has been really cool. The audio side is neat but the RF tuning is the really fun part.

<comment><USER3> I'm interested to see the test results. How much airflow open vs closed.

Show me a graph of room temperatures vs time over a 24-hour period, with the vents open. Then show me one with the vents being smart. That's the real story :)

<comment><AUTHOR> Definitely agreed and have some nice charts that show this, I should add them to the site. Although I would point at 24 hour window doesn't make sense.

</comment></comment></comment></comment><comment><AUTHOR> Founder Here: AMA!</comment>


Google finds the web has over 1 trillion unique URLs - <AUTHOR> http://venturebeat.com/2008/07/25/google-finds-that-the-web-has-over-1-trillion-unique-urls/ <comment><USER2> This is a dupe, and a link to a secondary source. Here's the story linking to the actual googleblog entry:

<http://news.ycombinator.com/item?id=256896></comment>


Study Refutes the "Long Tail" Theory - <AUTHOR> http://online.wsj.com/article/SB121493784638920147.html <comment><USER2> > "The Long Tail" seems to have followed the template of many Wired articles: > take a partly true, modestly interesting, tech-friendly idea and puff it up > to Second Coming proportions.

That template is true for many business books, which is why sites like my own Squeezed Books, and others exist: it's easy to extract the meaningful bits.

<comment><USER3> I don't mean to go off topic, but thank you, that's a great site.

Too many books are like padded out Wikipedia entries.

Its great when people on HN, distill a post to its essentials.

</comment></comment><comment><USER4> Let's review. The long tail exists because links and traffic on the web (roughly approximating attention/buying intent/market size) follow a power law.

So of course there are still going to be hits that seem to be "winner take all"; if it weren't for the "fat head", we wouldn't need to talk about the long tail.

The long tail becomes important in the age of the web because it's more accessible. Just because it's accessible doesn't mean it is going to make you rich -- but it's more possible than it was before the web.

You really don't have to look very hard to find business that could not exist without the web. So the long tail as a "theory" is almost self-evident.

So, I just don't understand what there is to refute or debunk.

<comment><USER5> _So, I just don't understand what there is to refute or debunk._

What the study is trying to debunk is that publishers/etc should cut down on their focus on the blockbuster hits and focus more on the "long tail" titles. From what the study is showing, doing the exact opposite may be the way to go.

<comment><USER4> Fair enough. However, it seems obvious that if you're _capable_ of big hits, that's what you should be going for. But if, for example, your only competitive advantage is the acuteness of your awareness that big-footed women have trouble finding heels, then the Long Tail is your friend.

</comment></comment></comment><comment><USER6> I listened to the audiobook of "The Long Tail" and maybe I misunderstood it. I thought it was showing how the internet can lead to better choices for consumers and give an outlet for niche content creators to sell their wares. In my mind it's done both. If it acts as a rising tide, lifting the fortunes of the head as well as the tail, all the better.

There are big winners among sites, like YouTube, but there also are niche winners like TechCrunch which has done very well against big media companies by finding its niche. Not to mention places like Hacker News which I visit far more often then TechCrunch and YouTube combined.

</comment><comment><USER7> Chris Anderson's own blog has a post more or less debunking his own theory.

</comment><comment><USER8> The article uses YouTube as an example of a new "cultural category" that has nevertheless settled into the old "winner-take-all dynamic". What??

<comment><USER9> Yeah, that's a bit bizarre. YouTube is a great example of the long tail in action. Instead of considering YouTube a hit compared to the rest of the web, consider its content. If I post a video of me and my friends goofing off at the beach, only a handful of people will watch it. But there are a ton of those "niche" videos available on YouTube. That's the long tail, and YouTube is successful precisely because it exploits the long tail of video.

<comment><USER10> > That's the long tail, and YouTube is successful precisely because it > exploits the long tail of video.

Considering how much money they lose everyday, I would argue that's why they are not successful (without the all mighty Google to pay the bills, of course).

</comment></comment></comment><comment><USER11> Intellectual laziness.

Study _disputes_ Long Tail theory.

</comment><comment><USER12> Long Tail = Bubble ?</comment>


Jarvis: Personal Assistant in Python - <AUTHOR> https://pythonspot.com/personal-assistant-jarvis-in-python/ <comment><USER2> This is a small python script that uses Google Text To Speech API to identify what you say, and if it is one of three questions ("how are you", "what time is it", "where is") it gives canned responses. This is along the lines of the beginnings of very simple expert system, and seems like a fairly cool project to give someone when they are learning to program. This isn't exactly what I expected from a personal assistant called Jarvis, however.

<comment><USER3> Damn. And I was going to run it on my Ironman platform.

</comment></comment><comment><USER4> Page has been suspended.

</comment><comment><USER5> Jasper is another cool project that has a bit better of a foundation. You can make little Python modules for pretty much anything.

<comment><USER6> For more advanced workflows, you can use Huginn for Ruby:

[https://github.com/cantino/huginn](https://github.com/cantino/huginn)

or Node-RED for JavaScript (this one is backed by IBM and has a neat drag and drop UI)

[http://nodered.org](http://nodered.org)

I think once the voice processing is done, the hard part is getting it to actually do something useful.

</comment></comment><comment><USER7> anyone get it working on a macbook?

jarvis.py", line 53, in <module> data = recordAudio() File "jarvis2.py", line 19, in recordAudio audio = r.listen(source) File "/Users/user/anaconda/lib/python2.7/site- packages/speech_recognition/__init__.py", line 377, in listen buffer = source.stream.read(source.CHUNK, exception_on_overflow = False) TypeError: read() got an unexpected keyword argument 'exception_on_overflow'

<comment><USER8> _go to cache, copy cache_

      $ mkdir jarvis; cd jarvis
      $ vi jarvis.py

_paste, then cleanup and read closely for badness_

      $ chmod +x jarvis.py
      $ brew doctor
      $ brew update
      $ brew install python3
      $ pip  install --upgrade pip
      $ pip3 install --upgrade pip setuptools
      $ pip3 install --upgrade gTTS
      $ pip  install --upgrade gTTS
      $ brew install portaudio
      $ pip3 install pyaudio
      $ pip  install SpeechRecognition
      $ brew install flac
      $ brew install mpg321

      $ ./jarvis.py
      Hi Mike, what can I do for you?
      Say something!
      You said: how are you
      I am fine
      Say something!
      ^

</comment></comment><comment><USER9> Hit me up if you want free hosting.

</comment><comment><USER10> Link is down

<comment><USER11> Cached version: [https://webcache.googleusercontent.com/search?q=cache:fjLltw...](https://webcache.googleusercontent.com/search?q=cache:fjLltwI8kSoJ:https://pythonspot.com/personal- assistant-jarvis-in-python/+&cd=1&hl=en&ct=clnk&gl=gr)

<comment><USER8> I used the cached script and after installing the various Python libs as it complained got it working. A neat little kit. Now I need to make it always running and listening for my command. "Jarvis?" "yes, sir?" "Jarvis, <commands>" To have it awaken and process follow on commands.

Only process when the double Jarvis exchange has occurred. And then keep on processing, waiting for more leading "Jarvis, <command>"

Putting this onto a RaspberryPi would be cool. Could even train it verbally. "Jarvis, 'let's try something new'"

This is such a cool little simple toy with great potential.</comment></comment></comment>


iOS14 reveals that TikTok may snoop clipboard contents every few keystrokes - <AUTHOR> https://twitter.com/jeremyburge/status/1275896482433040386 <comment><USER2> It seems like a ton of apps are abusing this feature: [https://www.youtube.com/watch?v=pRSWdtoUAjo](https://www.youtube.com/watch?v=pRSWdtoUAjo)

I categorize this as another reason why "just trust us," just isn't acceptable enough when it comes to data privacy and ownership. Companies just cannot be trusted to treat their users' data with respect given the option of: profit or privacy.

(sourced from reddit: [https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches...](https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches_apps_spying_on_your_clipboard/))

<comment><USER3> People love to hate on Apple but the fact is, they continue to release features to better showcase or restrict developers that abuse your privacy. The "walled garden" also ensures they apply a ton of checks to apps to better restrict abuses. Sometimes it's overly sensitive and bad things happen, but in general it's awesome that over time it becomes harder and harder to get away with apps blatantly spying on you.

<comment><USER4> I am certainly happy about the steady pro-privacy process. I personally consider Apple full of shit until two features are released:

1\. Contact sharing needs a complete overhaul. Some apps need to have access to my contacts. I get this. But they only need the name and the phone number. They don't need addresses, birthdays and additional notes I put in m contacts.

Sure, I could have a separate contacts app with "meta data", but this would break the integration of Contacts in other Apple products.

2\. Photos. It is either full access or no access. For example, I don't trust WhatsApp. I share photos through WhatsApp by opening the Photos app, tap share, share via WhatsApp. This works okay.

But generally speaking: why can't Contacts and Photos have the same sophisticated access control system like Health? Heck, make it optional for iPhone users, but at least offer it.

<comment><USER5> Looks like photos is addressed in iOS 14 [https://appleinsider.com/articles/20/06/24/apple-fine- tunes-...](https://appleinsider.com/articles/20/06/24/apple-fine-tunes-photos- privacy-in-ios-14-to-tailor-access-to-specific-images)

Agree tighter control over contacts sharing would be nice but I don't think it's malicious on Apple's part that this isn't possible - they've quite clearly shown they are on the side of user privacy, but they do also tend to move at a fairly slow pace

<comment><USER6> The choice of only allowing access to specific actual photos seems an unusual one.

I would have thought there was a big debate in Product Mgmt over this vs the more obvious allow an app access to a given album.

One presumes the sticking point came when someone took a photo _out_ of an album. Does that mean they are explicitly removing access? I don't see it as a huge issue... maybe there is some kind of technical hurdle involved as well, otherwise the choice seems unusual

<comment><USER7> Do normal people really use albums? Other than the autogenerated ones I have a single one, from 2013.

<comment><USER8> Nailed it. Using albums is the engineer's answer to what is technically best. In the real world it doesn't work because nobody knows how to, much less actually uses albums. And even if you do, what are the chances you have an album with exactly the photos you want to share? So you've got to select the pics you want anyway, but now you've also got to create an album first to put them in. It just adds to the work and confused and irritates people.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Here's a test you should run.

Create a bitly account if you don't have one and login and create a bitly link for anything, it doesn't matter what it is.

Copy that bitly link to your clipboard and repeat what you're doing in that video.

Monitor the bitly link for clicks.

Better still do it on a website you control with a unique URL that won't get indexed by a search engine and monitor the web server log files for hits and keep a record of the IP addresses.

<comment><USER10> It is honestly still kind of crazy that Apple still hasn't fixed this gaping hole in their security model, along with others. A notification is not solving the problem.

I wonder if Apple is playing 4D chess here though. As people learn about this, they will become outraged and care more about privacy. This in turn benefits Apple since that's their marketing stance.

I wish they just cut the bullshit and fixed these holes though, they've been around for years. It's really depressing to see Apple's fantastic security work in other parts of the stack be completely and utterly compromised by OS design decisions like this.

<comment><USER11> Agreed. Reading the clipboard should require the user to choose "paste" just like the browser does. You can't read it unless the user expressly trying to paste into your app.

<comment><USER12> JavaScript can manipulate the contents of your clipboard without any interaction from the user. It's not just apps that can do this.

<comment><USER11> Manipulating the clipboard is not the problem, reading it is. AFAIK there is no way to read the clipboard from JavaScript without user interaction. If there is please post a repo.

It used to be true but all that was fixed like 10 years ago.

<comment><USER13> I'm curious, how does Google Docs paste from the clipboard when I click the "paste" button from within the Google Docs UI?

<comment><USER14> Reading from the clipboard is allowed on a user-triggered event.

It's somewhat similar to how Firefox has disallowed auto-playing videos except on user permission or a user-triggered event.

Which has been mostly worked around by the bad actors, who use things like mouse-over or scroll to trigger the event.

<comment><USER15> > user-triggered event

"Click _Reject All Cookies_ to exercise your GDPR rights!"

<comment><USER16> This is a really good point. Those popups are disgusting and this is yet another reason to not disturb your users. I'm fine with a button in the footer of every page to do this, I think displaying a popup for this is terrible and I won't do it unless compelled to. Does anyone know what the rules are, I think they are much vaguer than most people suggest.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Using fiddler I briefly looked and didn't see tiktok sending my clipboard contents anywhere.

Edit: However, tiktok is one of the chattiest apps I've looked at. They have a huge number of tracking/logging/collection endpoints constantly slurping data in the background. See my hosts list which aims to block this:

[https://github.com/llacb47/mischosts/blob/master/tiktok- host...](https://github.com/llacb47/mischosts/blob/master/tiktok-hosts)

<comment><USER10> Genuine question, why don't companies proxy tracker data through a single host that the app also depends on to serve data?

That way it wouldn't be possible for users to block individual hosts to prevent tracking. I guess it's not worth the effort though because laypeople won't care either way?

<comment><USER18> Most trackers are 3rd parties that require you to go through their hosts. Additionally, these trackers are usually picked out by business analysts / product managers on different teams - so marketing my have their own tracking solution, sales might have their own, and engineering might have their own. Tends to be faster/easier to plop javascript on a page than engineering your own tracking/analytics pipeline at early stage startups

<comment><USER19> > Additionally, these trackers are usually picked out by business analysts / > product managers on different teams

This. I remember at my last company, we ended up with 8 or 9 different analytics tools all getting different data and showing one or two "cool views" the PM had put together.

It's such a big problem that solutions like segment.io exist to broker your events to N different downstream solutions.

Truly, this is the darkest timeline.

</comment></comment></comment></comment><comment><USER20> I know there are a few apps which will check the clipboard in order to provide functionality to the user. For example, some shipping apps will check the clipboard to see if the user has a copied tracking code and if so, ask the user if they want to track their copied code.

Not sure if TikTok does something similar, but there are certainly innocent reasons for checking the clipboard.

<comment><USER21> I'm disappointed that so many people think "hey they could just be doing this for innocuous reasons" instead of "oh maybe nobody should be doing this even if it's the absolutely most straightforward way to do it."

Even _if_ you're only looking for a shipping tracking number and then _only_ so that you can provide useful auto-populate, will you lose out by only checking the clipboard when the user hits your text input field? Is it that much to ask that you find the least offensive way to serve your user?

On the other hand, what will you lose when the news gets out that you've created a keylogger? What about when someone else at your company pushes you to monitor for something else for strategic advantages? Or what about when another developer doesn't understand the implications and now your app is responsible for revealing passwords or other sensitive information? Are all of these worth saving one click?

<comment><USER11> This is a OS bug not an app bug. You can't expect millions of app developers to get this right. An app should not be allowed to read the clipboard until a user chooses to "paste". That's on the OS for allowing this behavior. It's silly to think that making it possible to read the clipboard at any time that some how all millions of app developers will use it correctly even if they have no malicious intent.

<comment><USER22> A high speed collision happens on a freeway, killing both drivers. This is a car manufacturer bug, not a human bug. You can't expect millions of drivers to get driving right. A car should not be allowed to drive fast.

How about: stop apologizing for billion dollar corporations. Fault can be placed on both the OS and applications. I expect better, from everyone.

<comment><USER11> The difference is one problem is trivially solvable. If an app isn't allowed to read the clipboard the problem is solved. Smart people choose solutions that actually solve the issue when those solutions exist rather than just making some guideline and praying people read it.

<comment><USER23> Companies developing apps should be held accountable for their decisions, i.e. spying on the clipboard in this case. Don't excuse them with the reason "well it was easy to do, so it's ok" that's like saying "well my car was stolen, but it was easy to break the lock so it's ok"

<comment><USER24> By this logic, how do you trust Apple? they're a famously blackbox company with access to all your data. just because they say they're not data mining you, doesn't mean they are not.

slippery slope arguments go all the way to the bottom

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> In the coming days I feel as if we are going to see a lot more threads about the new privacy features in iOS 14. Apple has a video overview of a lot of the new stuff [1]. I suggest watching it (at 2x speed - they talk very slowly). Especially at 16:30 where they emphasize that SDKs are part of your app and that you the developer are fully responsible for the data collection of any SDK you include in your app. This is going to be a huge problem for a lot of developers.

[1] [https://developer.apple.com/videos/play/wwdc2020/10676/](https://developer.apple.com/videos/play/wwdc2020/10676/)

<comment><USER26> That's it. I'm switching to iOS. Android is like child's play when it comes to privacy compared to the features introduced just in this version of iOS. I'm sure I'll hate the lack of customizability but at least the privacy features are solid.

</comment></comment><comment><USER27> It looks like there could be a reasonable explanation for this. There are apps that have different behavior whether or not there is text in the clipboard (e.g. enabling a "paste" button), and they're only checking that the text exists, not what it is. There's a new API that will let devs do that without triggering the user notification.

If TikTok is actually constantly loading the clipboard, that's obviously terrible. I'd bet this behavior is gone by the next release, and that shows how useful this new notification is.

Same issue with notes from that app's developer saying what's going on and how they will fix it: [https://twitter.com/ecormany/status/1275903947899797505](https://twitter.com/ecormany/status/1275903947899797505)

<comment><USER28> > There are apps that have different behavior whether or not there is text in > the clipboard (e.g. enabling a "paste" button)

People keep saying this but I've _never_ seen one of these app-specific paste widgets. And even if I did, I wouldn't miss it in the slightest for the sake of not allowing _every app to be reading my clipboard at all times_.

It's inexcusable to me that there isn't a permissions prompt for this. Two of my most common types copy-pasted strings are URLs and _passwords_.

<comment><USER29> > I've never seen one of these app-specific paste widgets

IIRC having an address (or address-looking string) in your clipboard will cause it to show up as the first result on the search screen in Google Maps.

<comment><USER30> So google also sends the contents of my clipboard to their servers when I use their app? Wonderful.

<comment><USER10> I can't imagine being one of the PMs/higher-ups that decided to allow clipboard content to be shared willy-nilly like this. Like, what must be going through their minds when they make decisions like this? "User experience at all costs?" Seems contrary to their stance on privacy.

<comment><USER31> Personally I couldn't care less about google seeing whatever junk I sometimes have in my clipboard if it means I can more quickly go to the address I'm looking for

<comment><USER30> and I'm sure there are many who couldn't care less about the malware running on their windows machine as long as they can browse facebook. What's your point?

</comment></comment></comment></comment></comment></comment></comment><comment><USER32> I use bitwarden as my password manager. Out of paranoia, I have been logging into Bitwarden only while an empty tab is open in case some random website is able to access my keystrokes while I use the plugin.

I am a web developer, but I wasn't actually able to find information about whether this is a real risk or not last year when I began doing it. Can anybody clarify?

<comment><USER33> The problem is that iOS doesn't differentiate between a call that merely checks for the presence of a clipboard entry (e.g. so you can enable "Paste" in a menu/submenu) and _actually_ copying the contents of the clipboard.

The workaround (for legitimate apps) is to simply always keep that "Paste" option enabled--even if the clipboard is empty. That way you won't freak out your users and only suffer the most minor of usability consequences.

Having said that I don't think TikTok has any relevant functionality such as enabling a "Paste" option so... Most likely nefarious!

<comment><USER34> iOS differentiates between this since iOS 10:

[https://developer.apple.com/documentation/uikit/uipasteboard...](https://developer.apple.com/documentation/uikit/uipasteboard/1829416-hasstrings)

Also iOS 14 has new clipboard related APIs to further check the content without actually accessing it.

<comment><USER35> If iOS 14 adds new APIs to check, then I wouldn't be surprised if the codepath hasStrings uses triggers the warning

The purpose of hasStrings was performance not indicating intent, so that wouldn't be surprising

</comment></comment></comment></comment><comment><USER36> Crazy thing is that I would open TikTok on my phone and occasionally see a loading dialog that said "Pasting Clipboard" (from MacBook Pro). I finally freaked back in March and Googled it and found this... [https://www.forbes.com/sites/zakdoffman/2020/03/12/simple- ap...](https://www.forbes.com/sites/zakdoffman/2020/03/12/simple-apple- security-hack-if-you-have-tiktok-on-your-iphone-look-away-now/#6d5081731d61)

</comment><comment><USER37> iOS already prompts for other things like "app Foo would like to know your location: Never, Only when open, Always". Users are use to this. I'd love a popup like:

"TikTok wants to see what you've copied into your clipboard: Never, Once, Always, Uninstall that spyware".

Then I could make informed decisions, like sure, my package tracker can see if there's a FedEx URL in my clipboard. I'm OK with that. There's literally no reason why I'd ever want Instagram to check my clipboard, though. May you do, and you could give it permission.

<comment><USER38> There should also be a log "App foo has used your location at these times: <list of dates>}

<comment><USER39> They actually have this, and I think its intentionally very creepy: [https://support.apple.com/library/content/dam/edam/applecare...](https://support.apple.com/library/content/dam/edam/applecare/images/en_US/iOS/ios13-iphone- xs-app-using-location-in-background.jpg)

<comment><USER38> Can I as the user see these logs?

</comment></comment></comment></comment><comment><USER40> Chinese investment money is everywhere so they try to control the narrative. I have seen for sometime that on HN, we are open to criticize but don't take a standpoint unless its something to do with western government.

I think this is due to the flame war or rating system of HN, where active discussions are relegated to oblivion. Instead of trusting biased and funded media - we here need to introspect, without us being silenced.

May be we are mostly left so we don't have a much stronger opinion unless its right - is that the case?. Just curious - why the slack?.

</comment><comment><USER41> Apps abusing clipboard can steal the passwords from the password managers when user copies it and associate with the user account via parallel construction.

e.g. Time of stealing password from clipboard + time of my HN comment.

I've been long weary of this, android 10 has made some changes like allowing only IME & in-focus apps to access the clipboard. Not a fool-proof way to prevent the issue.

One more reason to destroy app duopoly, switch to pure Linux OS [1][2][3] and force app publishers to stick with web apps/PWA with more user control.

[1][https://store.pine64.org/product/pinephone-community- edition...](https://store.pine64.org/product/pinephone-community-edition- ubports-limited-edition-linux-smartphone/)

[2][https://postmarketos.org/blog/2020/06/15/pinephone- postmarke...](https://postmarketos.org/blog/2020/06/15/pinephone-postmarketos- community-edition/)

[3][https://puri.sm/products/librem-5/](https://puri.sm/products/librem-5/)

<comment><USER42> Apps can still read the clipboard at any time they want on Linux. A pure Linux OS is definitely better, but for other reasons.

</comment></comment><comment><USER43> Perhaps there should be a separate security level for "access whatever was just Copied in the last 4 seconds, if the only other action taken was to switch to the app requesting the clipboard". Almost any app could clear that bar, since under those conditions it probably means "user grabbed something and wants to use it here".

What is the use case for "read whatever was copied from anywhere for any reason at any time"? If there is one (e.g. full-fledged word processor maybe), that should _still_ be a separate entitlement and require a higher bar, e.g. extensive app review.

<comment><USER44> That's probably not going to work well because people use devices at different speeds

</comment></comment><comment><USER45> Appears that a lot of third party apps are just using an older api that forces this notification to show. a lot less nefarious than it originally appears.

Seems that iOS14 offers a specific new API to check if there's something on the clipboard without actually seeing it which is what all these apps are trying to do.

<comment><USER46> The API to check if the clipboard has contents has existed since iOS 10.

> Starting in iOS 10, the UIPasteboard class provides properties for directly > checking whether specific data types are present on a pasteboard, described > in Checking for Data Types on a Pasteboard. Use these properties, rather > than attempting to read pasteboard data, to avoid causing the system to > needlessly attempt to fetch data before it is needed or when the data might > not be present.

[https://developer.apple.com/documentation/uikit/uipasteboard](https://developer.apple.com/documentation/uikit/uipasteboard)

<comment><USER47> That doesn't seem to stop the app from checking for, say, string content, and getting access to a copied password.

</comment></comment></comment><comment><USER48> I wonder how the clipboard API could be fixed.

I suppose that the current scheme is that apps are monitoring paste events, and when it happens have a look at the clipboard for copied data.

Perhaps the clipboard shouldn't be visible at all, and only when the user decides to paste content should the targeted app receive a "paste" message with the copied data (or perhaps some more complicated selection mechanism with a list of recent copies à la emacs). This would essentially merge the 2 steps process outlined above into a single operation.

It's probably more complicated than that though.

<comment><USER49> I think we should have some kind of "clipboard firewall" where you can restrict if a clipboard copy operation in an app X could be pasted in app Y.

We have developed a free Windows app and will release it soon.

</comment></comment><comment><USER50> I was shocked to find out that firefox enabled websites to access the clipboard sometime in the last five years or so. .. and I'm left stressed out that I could have had important passwords or key stolen this way.

This can be disabled by setting a preference: [https://www.ghacks.net/2014/01/08/block-websites-reading- mod...](https://www.ghacks.net/2014/01/08/block-websites-reading-modifying- clipboard-contents-firefox/)

<comment><USER51> Firefox prompts for your permission to read from the clipboard: [https://developer.mozilla.org/en-US/docs/Mozilla/Add- ons/Web...](https://developer.mozilla.org/en-US/docs/Mozilla/Add- ons/WebExtensions/Interact_with_the_clipboard)

But I'm not sure if that's always been the case.

<comment><USER52> that's for addons, not websites

</comment></comment></comment><comment><USER53> I'm certain Apple knew in advance that a fair number of apps would trip this up and which ones were going to run into issues in advance. It's interesting that they went ahead and turned this on immediately without warning developers it was coming. Perhaps they wanted people to see what they were preventing.

<comment><USER54> This is in a beta of iOS14. It's expected to have changes, sometimes breaking changes.

This is the beta process working exactly as it should.

</comment></comment><comment><USER55> I applaud Apple for the continued privacy efforts, including finer-grained Photos access (linked by another poster in this thread: [https://appleinsider.com/articles/20/06/24/apple-fine- tunes-...](https://appleinsider.com/articles/20/06/24/apple-fine-tunes-photos- privacy-in-ios-14-to-tailor-access-to-specific-images)).

But at the same I can't help but be bitter. The smartphone scene is very active ever since, I don't know, 2011? All the companies and shady information dealers have gathered _mountains_ of private information.

Is this not too little, too late? This would have been welcome at the iPhone 5 release. Nowadays I wonder what difference would these measures even make.

<comment><USER56> It is steps in the good directions, and as far as I know they are way more advanced than Android on this point.

Those features would have been welcome a few years ago, that's for sure, but let's not blame them now that they do what's right.

What's out there is already out there, you're right, but we can hope that those shady information dealers will have much more trouble in the future.

<comment><USER55> > _It is steps in the good directions, and as far as I know they are way more > advanced than Android on this point._

I have the same impression. Which is saddening because I thought of going back part-time to Android and experiment with homelab builds and p2p architecture with a few spare Android devices. But I am not comfortable with how much and lower-level Google and the phone's vendor have and I am sure that no matter how I secure an app with access to photos/contacts/etc. then the kernel could likely still extract the info it needs... Don't know, but I am quite paranoid about smartphones lately.

> _let 's not blame them now that they do what's right._

Agreed. Better late than never. I simply feel that marketing trumps privacy concerns here. Apple wants to have what to brag about every year so features that should come once every 2-3 months are coming annually instead.

</comment></comment></comment><comment><USER57> It does make me wonder how many apps on Android also do this and go completely undetected. Hopefully Google adds something similar.

<comment><USER58> In my Android 10 phone, if I copy a piece of text that looks like an address and open Google Maps, Google Maps will immediately offer the copied text as a search option. Google Maps doesn't do this if I copied, say, some random numbers.

I'm not sure how the Google Maps app can do this without snooping at my clipboard.

<comment><USER59> I'm pretty sure that's the OS itself analysing the highlighted text and offering suggestions on which app to open it with.

</comment></comment></comment><comment><USER60> TikTok is known to be Chinese malware. Is anybody on HN surprised by this?

[https://www.military.com/daily-news/2019/12/30/army- follows-...](https://www.military.com/daily-news/2019/12/30/army-follows- pentagon-guidance-bans-chinese-owned-tiktok-app.html)

<comment><USER61> I know this and I get it....but damn it's so much more entertaining than Instagram now. The content is more varied, more raw, and the for you page filtering is so well-tailored.

</comment></comment><comment><USER62> hm... seems that privacy issue: [https://developer.apple.com/app- store/review/guidelines/#pri...](https://developer.apple.com/app- store/review/guidelines/#privacy) can led to ban from AppStore

<comment> dan-robertson Fortunately for tiktok, such rules only apply to small apps. They will probably get a polite phone call from a VP asking them to please stop doing that but noting more.

</comment></comment><comment><USER63> This needs legislation. Apps should not be allowed to inspect foreign private content if they don't manage it. Only a few apps would need that.

That new technical solution in the beta certainly comes handy, but legislation is better.

</comment><comment><USER64> The clipboard belongs to the user. It is quite obvious how clipboard-snooping could disclose sensitive information, and as far as writing to it, I should be able to expect the thing I copied last to be there when I hit paste next.

I'd be in favor of banning application-initiated access entirely. I realize this would interfere with 1PW and similar. That was always a hack, and the fact that so many apps snoop on the clipboard is a great reason for it to stop! Sensitive dataflows for things like passwords need far better protection.

</comment><comment><USER65> clipboard access should really be permissioned just like mic access etc

<comment><USER66> Real solution is to make the clipboard behave like a channel (both must be running and target must be on foreground), not like a buffer. No permission mess.

</comment></comment><comment><USER67> Woke up this morning thinking...

There is a part of me that is little sad Apple did not just wait to add this feature until iOS 14 released or one of the last GM's.

If only because it would be a huge wakeup call for users about what their apps are doing and possibly collecting, instead of it all being patched out now. Instead we are seeing basically no traction on this outside of tech circles.

</comment><comment><USER68> TikTok and many popular Chinese apps, including Taobao, Baidu, and Alipay, to name a few, snoop clipboard contents, because Tencent censors and forbids almost all kind of links sharing in WeChat and QQ.

[https://news.ycombinator.com/item?id=23654345](https://news.ycombinator.com/item?id=23654345)

</comment><comment><USER69> I've been trying to bring the clipboard privacy issue to people's attention for awhile.

[https://news.ycombinator.com/item?id=21383241](https://news.ycombinator.com/item?id=21383241)

Happy to see it's going mainstream. I'm hopeful that iOS 14 will provide a way to limit this behavior on a per-app basis.

</comment><comment><USER70> At least signal messenger doesn't do this behaviour. Still keep incognito keyboard turned on from settings for extra protection:

[https://community.signalusers.org/t/ios-14-catches-apps- spyi...](https://community.signalusers.org/t/ios-14-catches-apps-spying-on- clipboard/15254/2)

</comment><comment><USER71> It seems like this is nothing new:

[https://www.forbes.com/sites/zakdoffman/2020/03/12/simple- ap...](https://www.forbes.com/sites/zakdoffman/2020/03/12/simple-apple- security-hack-if-you-have-tiktok-on-your-iphone-look-away-now/)

</comment><comment><USER72> It would be easy to see foul play here... But I can only imagine the size of the development team behind such app and it's probably some dumb feature commit implemented by someone who isn't there anymore that checks to insert "Tok" every time someone types "Tik".

Or some other evil purposes.

</comment><comment><USER73> I find it interesting that people automatically assume nefarious reasons for accessing the clipboard... If your privacy is so important, don't use platforms you cannot trust. If that means not using a smart phone, then maybe you will do something positive for yourself.

</comment><comment><USER74> Zoom, WeChat, Weibo has all been exposed of sending users' data back to Chinese servers. Why would TikTok be different? It's already alarming enough that a Chinese social media app is at the top of the App Store.

People need to learn to stop trusting these apps.

</comment><comment><USER15> Can one app copy data into the clipboard and then another app paste it out?

They could even collude behind the scenes, once they've communicated over the clipboard as a channel to establish a link, to replace the original data in the clipboEOF[CITIZEN:8EF7720=FLAGGED]

</comment><comment><USER75> This is actually a big reason why I always prefer to use the mobile site instead of the app. The modern browser treats the web much more as an "unsafe" place. Not to mention I prefer standard ways to do things like "go back". Plus you get Adblock.

</comment><comment><USER76> Do most of these apps mention this in their privacy terms? I would imagine it's somewhere in there, but who has the time to read all of that. This reminds me of HEY.com Apple is following suit in terms of notifying the user on privacy...

</comment><comment><USER77> Lyft is doing the same thing. But it seems the frequency is lower compared to TikTok

<comment><USER30> People were saying the Google Maps also does it.

</comment></comment><comment><USER78> Why is this still on their store? I assume it breaks their walled garden approach. It seems Apple is putting kids at risk, in fact it looks like kids are having their privacy actively abused.

</comment><comment><USER79> My bank (bunq) offers me to pay the iban (european bank account number) as soon as I open the app with an iban on te clipboard. That's the same, isn't it?

<comment><USER80> In the twitter video Tik Tok is pasting _from_ Instagram though. I also don't know why Tik Tok would be looking for text on the clipboard (to be fair I've never used Tik Tok though).

</comment></comment><comment><USER81> I use Bitwarden on my iPhone and sometimes copy passwords to the clipboard for some reason. Does this mean any app could have snooped on it without me knowing before?

<comment><USER82> Yes, that's probably part of the reason why 1Password clears the clipboard after a minute or so

<comment><USER81> That's crazy. IOS prompts before giving apps your location, clipboard data is many times more sensitive

</comment></comment></comment><comment><USER83> Is it even clear whether this data is being sent back to Tiktok or any company or is it simply to check for activating keywords to add app functionality?

Is it all done locally?

</comment><comment><USER84> It's a shame that this turned into a discussion about iOS. It's still the burglar that's faulty, not the homeowner that leaves a window open

</comment><comment><USER85> LoL... Why doesnt it block it in addition to revealing it? I don't think that it would break any features that I want to use.

</comment><comment><USER86> It also revealed to me that that Dropbox was tracking my location in the background while i was traveling on a train..

</comment><comment><USER87> I wonder what this sort of spam does to your battery life. This really should be a permission configuration.

</comment><comment><USER88> Why does any app have access to the clipboard? Seems like a big security hole.

<comment><USER89> In order to know when you should enable the paste option.

It can be an elegant design choice, but also a design choice that appears to be or is an abuse of privacy.

<comment><USER90> Couldn't IOS just have a peek API that tells the application if the clipboard is empty or not without revealing it's contents?

<comment><USER46> They've had one for several years.

[https://developer.apple.com/documentation/uikit/uipasteboard...](https://developer.apple.com/documentation/uikit/uipasteboard/1829416-hasstrings)

</comment></comment></comment></comment><comment><USER91> It might be that an API that many of these apps use is using this feature.

</comment><comment><USER92> Yet another reason web apps are generally better for security than native!

</comment><comment><USER93> if only they'd do this for apps accessing the microphone, or do the same thing as they do with the camera making the application visibly request access

</comment><comment><USER94> Apple is really setting the tone.

</comment><comment><USER16> Is there any logical reason to do this apart from harvesting things people have copied. Seems purely evil to me?

</comment><comment><USER95> Hopefully we can turn this off, this is going to destroy usability be very annoying.

<comment><USER96> You mean so you can snoop from the user without being detected?

<comment><USER95> There are a lot of valid usecases for clipboard saving, I don't have an iOS app but I run CopyClip which would be kinda ruined by this "feature".

<comment><USER97> Then there should be a setting that has to be manually approved to allow the clipboard interactivity feature.

I use a password manager on my iPhone and I am copying and pasting my passwords all the time. If some random app is scraping my clipboard silently and sending the data to a third party, that means my passwords are compromised. I am very much NOT OK WITH THIS.

Keep in mind, this permission should be fundamentally different than the permissions for just manually copying and pasting. I don't want to have to deal with permissions to "allow clipboard use" that I have to approve every time I want to paste something. That would be obnoxious. I am only worried about restricting permissions for invisible passive snooping.

</comment></comment></comment></comment><comment><USER98> Here is an explanation from a 3rd party reddit app developer:

tl;dr: Since Apple doesn't give a way to open URLs in 3rd party apps, he inspects the paste buffer for reddit URLs, but he aptly points out that he could read anything in the paste buffer if he wanted to:

"Hey! I make Apollo for Reddit and a few people asked me about this and if Apollo does anything with the clipboard so I wanted to answer.

Since iOS doesn't have a mechanism to open URLs in a specific third party app Apollo has a feature where if you open the app with a Reddit URL on your clipboard it'll offer to open that URL in Apollo, I think I copied this from Instapaper awhile ago. This does cause a potentially creepy looking notification with Apollo sometimes, but just wanted to explain why/what it's doing. It's literally just like "Hey iOS, is there a URL on the clipboard? Oh there is, is it a Reddit one? Okay cool let me ask them if they want to open it." Obviously at no point does anything else happen like it leaving the device or anything. It'll show this banner even if there's not a Reddit URL because it needs to check the URL to see if it's a Reddit URL in the first place. Schrodinger's Reddit URL.

But the clipboard API (prior to iOS 14) was very open, as someone else said, what if medical records were on your clipboard as text? Well in Apollo's case, that doesn't qualify it as a URL, so it wouldn't even "look". (And even for URLs, it doesn't store a list of them even on the device, it just opens it if you ask to, and then saves the most recent URL so it won't keep repeatedly prompting you if you say no.)

But that doesn't mean other apps couldn't be! They could be doing some Creepy Shit™ so I think this API change is good. It means I'll have to be more clear with Apollo doing this, and I've already had a few Apple engineers reach out with ways, but I think it's a very good change for user security."

From: [https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches...](https://old.reddit.com/r/apple/comments/hejb9i/ios14_catches_apps_spying_on_your_clipboard/fvscjyz/)

<comment><USER99> We need an answer from TikTok not Apollo.

<comment><USER98> Of course. The point is there are legit reasons for this to happen.

<comment><USER10> Sure, and the counterpoint is that those legit reasons are not worth the breach of privacy. The average user is horrified when they learn this happens, and "just trusting the developer to not abuse your clipboard" isn't an acceptable security model.

<comment><USER98> I agree. It's also why they changed the api.

</comment></comment></comment></comment></comment><comment><USER100> We can expect every security hole possible to be exploited by these Chinese military apps. Heck, Fortnite intalls a rootkit on your PC for "anti-cheat" and that's even more egregious, yet it is allowed. The situation on Android is probably worse, most apps request access to everything these days and users are afraid to say "no" because of fear of breakage.

</comment><comment><USER101> This is unacceptable.

</comment><comment><USER102> running old app on new OS can cause unpredicted behavior is normal, and here is assuming it is not iOS14 bug

<comment><USER46> iOS 14 added this feature (the clipboard notification) to catch this type of behavior.

It's _possible_ that TikTok isn't doing anything and this is a bug, but it's more likely they're using the clipboard in a way they shouldn't.

</comment></comment><comment><USER103> Let's be real. Is anyone honestly surprised?

<comment><USER104> "Surprise" is not a good standard for concern.

<comment><USER105> Depends on what you're doing, driving or flying - you don't want surprises, they'd definitely be concerning. Privacy too in my opinion.

<comment><USER104> You're driving along and get t-boned by a semi. Someone says, "I don't know why anybody's surprised, the crash happened at an intersection where two roads cross perpendicularly, and vehicles are traveling on those roads," are you going to nod at their profound observation?

</comment></comment></comment></comment><comment><USER106> Apple is fine with this but have a problem with hey.com's own charging structure!!!

</comment><comment><USER107> TikTok users seem to be incredibly young, like children, so I doubt they care their privacy is violated.

</comment><comment><USER108> Chinese Communist Party [1] [1] [https://www.vox.com/open- sourced/2019/12/16/21013048/tiktok-...](https://www.vox.com/open- sourced/2019/12/16/21013048/tiktok-china-national-security-investigation)

</comment><comment><USER109> Whats the point of having an App Store as the gatekeeper for installing apps if you aren't going to catch this shit?

<comment><USER110> I believe iOS14 has features to detect this: [https://www.reddit.com/r/apple/comments/hejb9i/ios14_catches...](https://www.reddit.com/r/apple/comments/hejb9i/ios14_catches_apps_spying_on_your_clipboard/)

<comment><USER109> Yes - I mean why hasn't the App Store review process already caught this in previous versions of iOS? Why do we need to wait for the technical capability to be surfaced to users?

How are we supposed to know if the app's continuous request for clipboard access is ok or not?

I feel like that was literally the only value-add in the App Store review process and the fact that its a feature in iOS seems to indicate that Apple is throwing in the towel here and saying "we don't know if this is a privacy issue or not so we will just notify you about it".

</comment></comment></comment><comment><USER111> Is this really news? Google maps suggests to navigate to an address you copied to the clipboard. No app should have permissions to access the clipboard without you explicitly selecting 'paste'

</comment><comment><USER38> I think in general operating systems shouldn't just ask the user for permissions when an app wants to do something. But they also should provide a log about when, to what extent and how often apps are using that permission. For example when I give an app permission to read message I still have no clue how often the app does it.

</comment><comment><USER112> This is the problem with Chinese apps. You just can't rely on them. They simply don't have the same principles of privacy like US companies do. Even Facebook won't do something like this.

<comment><USER113> Plenty of US companies build apps that do the exact same thing (checking your clipboard).

<comment><USER114> Do you like TikTok reading your clipboard?

<comment><USER113> I don't even have a TikTok account. I simply pay enough to have realized a long time ago that the contents of the system clipboard are available to the application that's in the foreground on pretty much every OS I've used. Hence I have no need to jump to pearl-clutching xenophobia over it.

</comment></comment></comment></comment><comment><USER115> As society cannot allow this impunity of powerful corporations, a nation-state sponsored Corporation in this case.

Why do members of our own society not know the negative effects of using this technology?

</comment><comment><USER115> Fu*king A... uh maybe we need to make Open Source required by law... just anything but this.

WE as society cannot allow this impunity that is occurring by a very well powerful corporation, a nation-state sponsored Corporation, no less. Where does it end? Why do we allow this to occur? Why do members of our own society not know the perils of using this technology?

<comment><USER116> Finally someone tackles the real issue here. You can't trust proprietary software, no matter which country or company is behind it. Aim for free software instead of putting your trust in a company's black box.

</comment></comment><comment><USER117> Fairly impressive if true - they must have already gobbled up tens of millions of passwords and other sensitive data that users had no idea was being stolen from their clipboard.

<comment><USER118> To the coffers of the CCP.

<comment><USER119> Since you're obviously using this site primarily for ideological battle, and that's against the rules here, we've banned the account.

No, not because we're communists. Rather, this is an existential issue for HN: if we want to have a forum for curious conversation, we have to limit the amount of damage people can inflict on it in this way.

Please don't create accounts to break HN's guidelines with.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)</comment></comment></comment>


Hulu CEO: Revenues 'Vastly Exceeding Expectations' - <AUTHOR> http://www.alleyinsider.com/2008/11/hulu-ceo-revenues-vastly-exceeding-expectations-clip-

<comment><USER2> yes, well, based on how the companies were talking during the writers strike, "expectations" were only a smidge above nothing.</comment>


Show HN: Get AI generated business report on absolutely any topic - <AUTHOR> http://researchcue.com/search1?&source=hn&search=augmented+reality <comment><USER2>
      > 500 Server Internal Error

<comment><AUTHOR> Hi Paul

Thanks for taking time out for this.

Can you try tool again?

<comment><USER2> I am still getting the error.</comment></comment></comment>


Ask HN: 💳 Credit card icon in plain text. How it works? - <AUTHOR>

<comment><USER2> I see these things often.

I can't have every font active. (Or, can I?)

Is there some way that I can see all these things when received/viewed, regardless of my font?

At the moment, being able to _write_ everything seems in conflict with not being able to _read_ everything.

</comment><comment><USER3> It's called an emoji

<comment><USER3> 😜</comment></comment>


Google Voice Local Search Launched (pale in comparison) - <AUTHOR> http://www.readwriteweb.com/archives/google_voice_local_search_launched.php <comment><AUTHOR> <http://labs.google.com/goog411> for those that want the url. I've seen the sms version around for a while.

_'... The service can't understand me. What should I do? ... if you own a mobile phone, use Google SMS instead. ...'_ [0]

I like the comments in the faq if you cannot get the system to understand your query.

Reference

[0] google labs, "Q4, 411 faq"

<http://labs.google.com/goog411/faq.html#not_understand></comment>


A bit of sugar for the fastest Python framework - <AUTHOR> https://github.com/imbolc/japronto-extra <comment><USER2> What's up with magically doing implicit things when one line can explicitly define the URL? Remember, the more magic things that happen behind the framework, especially with syntax and overloading of operators, the worst the library will be to maintain as it grows.

Explicit > implicit.

<comment><AUTHOR> I agree with your point in general. But in other hand explicit urls feel like repeating yourself.

</comment></comment><comment><USER3> I thought FastAPI was the fastest python framework?

[https://fastapi.tiangolo.com/benchmarks/](https://fastapi.tiangolo.com/benchmarks/)

[https://www.techempower.com/benchmarks/#section=test&runid=7...](https://www.techempower.com/benchmarks/#section=test&runid=7464e520-0dc2-473d-bd34-dbdfd7e85911&hw=ph&test=query&l=zijzen-7)

Japronto does rank number one in the json serialisation and plaintext benchmarks. But any real work use case is going to require more than that.

<comment><AUTHOR> Even bare ASGI app running on uvicorn would be a few times slower comparing to Japronto and also its memory footprint would be significantly higher. So I guess it depends on your use case. I'd say FastAPI is more for complicated, exposed APIs while Japronto is for small internal microservices when speed is the bottleneck.

<comment><USER4> So....not the fastest

</comment></comment></comment><comment><USER5> Japronto is unmaintained...

<comment><AUTHOR> Yeah, but it's already good enough for performance-critical microservices</comment></comment>


Bulk Remove OCR from PDFs with Swift - <AUTHOR> https://devblog.digimondo.io/bulk-remove-ocr-from-pdfs-with-swift-f4e2aedec3c0#.j49yshg5j <comment><USER2> Great write up</comment>


Stanford Stats 385: Theories of Deep Learning - <AUTHOR> https://stats385.github.io/ <comment><USER2> I feel like asking: did they solve the problem?

Let me see if I can state the problem: Neural Networks are non-linear because of their activation functions. You need a differentiable function in order to take the derivative so you can back-prop the error, more or less.

The consequence of the non-linearity is that you can't do some kind of short hand calculation to figure out what the network will do. You have to crank through the network to see the result. There is no economy of thought. That is to say, there is no theory.

I am excited that they are working on it, but I would love to have a summary or overview of how they approach what I consider to be the basic problem.

<comment><USER3> Why is the lack of theory a problem? At some point we have to accept some problems are "out of our league" and use whatever is available even without fully understanding it. We can't even understand simple specializations in computer vision, yet we expect to understand a more general method? It's not like 15 years ago there weren't math theorems proven by enumerating them on a computer. I understand it breaks psyche and pride of some scientists, so what? Universe can't be expected to fit into humanity's collective brain.

<comment><USER4> Because it's much easier to work with and improve something if there's a theory behind it?

There's a spectrum between "just keep trying tons of crap and see what works" and "do this simple, well-understood calculation to see exactly what will work." Is it not obvious why it's nicer to be on the latter end of the spectrum than the former?

<comment><USER3> Sure, but currently deep learning is more like experimental physics. You try stuff and see what works and empirically improve your understanding. Then you can generalize some heuristics from this and use that "recipe" in the future. You figured out ReLU suddenly made something work, yet Swish turned out better so you can forget about ReLU now. And as you can treat deep learning (in supervised mode) as non-linear optimization, I doubt we'll come up with a proper theory unless P=NP. We can't even understand far simpler non-linear optimization problems, not to mention ones which can be arbitrarily parametrized in 2nd order...

<comment><USER5> But to just restate the comment you're replying to, clearly theory can prune a _lot_ of branches on the "iterative experiment-based design refinement" method you are proposing.

Also, I'll mention that you're being too pessimistic about what theory can accomplish. The learning problem is much more constrained than P = NP.

The use, for example, of a training set of N examples, drawn iid, and evaluation on samples drawn from the same distribution imposes a lot of structure. I don't know if you're familiar with VC theory, but it's an example of the kind of "surprising" guarantees that can be derived in this setting. Other general examples are weak learning, the bias/variance tradeoff, and (in SVMs) the notion of large margin classifiers.

An applicable "theory" of design is what separates engineering from just mucking around.

</comment></comment></comment></comment></comment><comment><USER6> Does anybody know if they plan on releasing the lecture videos? I couldn't find them on the site and this looks very interesting.

<comment><USER7> They are being recorded and posted to YouTube as unlisted videos. You can find links to some of them on Twitter[1] and ResearchGate[2]. It looks like highlights of the lectures are being posted to Twitter and the full lectures are being posted to ResearchGate.

[1] [https://twitter.com/stats385](https://twitter.com/stats385)

[2] [https://www.researchgate.net/project/Theories-of-Deep- Learni...](https://www.researchgate.net/project/Theories-of-Deep-Learning)

<comment><USER8> Oh those full lectures on researchgate are awsome. Thanks for sharing!

</comment></comment></comment><comment><USER9> I'm a bit surprised that Soatto's and Tishby's papers aren't on the reading list ([https://stats385.github.io/readings](https://stats385.github.io/readings)). I think they have some of the most interesting theories, at the moment, about why Deep Learning works.

[https://arxiv.org/abs/1706.01350](https://arxiv.org/abs/1706.01350)

[https://openreview.net/pdf?id=ry_WPG-A-](https://openreview.net/pdf?id=ry_WPG-A-)

<comment><USER10> Is anyone looking into/using algebraic topology and sheaves to analyze or interpret these deep networks?

</comment></comment><comment><USER11> What a privilege to study at that college.

<comment><USER11> From the downvotes, I suppose people thought I was being sarcastic. Quite the contrary, I was really in awe about what a cool lecture (series) this is! If you're into that kind of topic, of course, YMMV. But if you are, you will agree that this is an excellent class -- it underlines (not surprisingly) what an outstanding place to study Stanford is.

<comment><USER2> I didn't down-vote you but I suspect people reacted negatively because the implication is you have to stop learning after college. They may feel you can always learn it at any time. You can take deep learning and math courses online etc.

<comment><USER12> > I didn't down-vote you but I suspect people reacted negatively because the > implication is you have to stop learning after college.

How on earth does their comment imply _that_?

<comment><USER2> I misread it as "to study that at college" instead of "study at that college"!

I now have no idea why it was down-voted.

</comment></comment></comment></comment></comment><comment><USER13> Can general public attend these sessions?

<comment><USER14> Technically, no, because you have to be enrolled as a student (not just a student of life ;).

However, Quora seems to think you may be able to sneak in, at least sometimes:

[https://www.quora.com/What-does-Stanford-do-about-non- Stanfo...](https://www.quora.com/What-does-Stanford-do-about-non-Stanford- students-sitting-in-on-classes)

</comment></comment><comment><USER15> The pictures on the first page look exactly like what I expect graduate students and professors of Stats to look like.</comment>