The battle to outlaw end-to-end encryption in the U.S. is heating up - <AUTHOR> https://www.expressvpn.com/blog/the-battle-to-outlaw-end-to-end-encryption-is-heating-up <comment><USER2> A few years back someone was writing software that did potentially illegal things, like more than 40 bits of crypto, which was illegal when distributed outside of the US (maybe still is).

Their response was:

"It's completely legal as distributed. Look at the header and you'll see:

        #define CRYPTO_LENGTH 40

"

<comment><USER3> I believe it was something to this affect that prevented us from implementing decent crypto for vehicles. There was some rule about export (possibly to the US or out of the US) that meant there was a limitation on how secure we could make the software. As a result, everybody ended up getting the same shitty low-security version of the product worldwide (they wanted to limit the number of variations for test coverage).

<comment><USER4> That sounds like a win for vehicle owners, honestly, given that encryption is often used for locking owners out of the ability to change things about their car without paying the manufacturer more money.

<comment><USER3> You might think so, but the encryption used at the time was such that only somebody with quite a few resources (such as a government actor) could reasonably break the encryption. It wasn't a win for owners or tinkerers.

What's more worrying is that there are a bunch of vehicles out there with security that is going to age * very * fast compared to that used every day (SSH, certs, etc). Consider that the automotive industry might be under similar constraints with regards to autonomous vehicles, something a bad actor could really cause some damage with.

</comment></comment></comment></comment><comment><USER5> I used to view steganography as a viable mitigation strategy for the outlawing of encryption.

Over the years, I've come to consider steganography as inadequate as a means of mass communication, as the more people know about how to receive a stegonographic message the less effective it is at hiding the content.

Steganography is most useful in one-on-one communication where the means to read the message is exchanged in a secondary secure channel of communication. Sadly, this just does not scale well.

For this and other reasons, I've kind of become pessimistic about the security and privacy of communication using computers, and even more so towards such security and privacy being available to the masses.

<comment><USER6> The US is giving up it's supremacy in most areas, but that doesn't mean the world won't have viable encryption. It will just come from a more reasonable country.

</comment></comment><comment><USER7> > To make things worse, the Act proposes the creation of a hybrid bounty > program, giving third-parties financial incentives to extract encrypted data > following a request from U.S. agencies. In short, if the tech companies > won't build a backdoor, the U.S. government will pay hackers top dollar to > use whatever means necessary to get the data for them.

Is that worse?

<comment><USER8> I think it's a better solution. Far safer for the government to employ expert lock picks than to outlaw locks.

<comment><USER9> Only if the government tells us when they find a back door, which they obviously would not do.

<comment><USER7> Even if they don't, I think it's still better.

</comment></comment></comment></comment><comment><USER10> From a cynical perspective, this is a market opportunity for VPN services. As were Snowdon's leaks, which hugely expanded the VPN service industry.

And indeed, using VPN services (let alone nested VPN chains and Tor) largely obviates risks from these bills. Without cooperation from the VPN service, gathering sufficient information for a warrant is problematic.

But I wonder. Might the US regulate using VPN services, as authoritarian regimes already do?

<comment><USER11> Doesn't the language of this bill mean that US based VPN services will be forced to provide their encryption keys to the government to allow to decrypt their traffic ?

<comment><USER10> Perhaps so. But then, nobody who seriously cares would ever use a US-based VPN service ;) And even for US-based VPN services, I gather that a warrant would be required, and that'd be hard with no information about what the VPN link had been used for.

<comment><USER12> Presumably a warrant can be obtained if criminal activity is traced back to a specific VPN provider.

Of course that's already the case as far as I understand (ex LavaBit). I also don't see how VPNs would be affected since they already have access to all your traffic anyway - no backdoor is necessary.

<comment><USER10> It depends who you mean by "they". VPN services certainly have access to users' data. But it'd be commercial suicide to cooperate with authorities. HideMyAss lost considerable market share after it came it that they had pwned someone from LulzSec.

Still, it's prudent to assume that any VPN provider will give you up. And that's why I recommend using nested VPN chains. With three different VPN services, it'd be nontrvial for adversaries to obtain enough data.

<comment><USER13> What is the best way to create the chains? Do you recommend spinning up some Vbox images?

<comment><USER10> Most secure would be Qubes VMs. I use pfSense VMs in VBox. So nested VBox internal networks (yes, multiple NAT) leads produces nested VPN chains.

Also, you can include a Debian VM running Tor and OpenVPN in a chain. You configure OpenVPN in TCP mode with "socks-proxy 127.0.0.1 9050". So you can route through 2-3 VPNs, then Tor, and then 1-2 more VPNs.

Or you can include a Debian VM that crudely emulates Tor ( _very_ crudely) by periodically switching among random chains of multiple VPNs.[0]

0) [https://github.com/mirimir/vpnchains/](https://github.com/mirimir/vpnchains/)

<comment><USER13> Thanks for the reply. Just a few questions:

It is necessary to connect to the VPN before Tor, correct?

Also, is your script essentially the same thing as multihop that some of the better providers offer?

<comment><USER12> The issue with multihop is that it's all from the same provider. In the event that they were legally forced to log their network by an abusive local government it wouldn't help you. It might be sufficient to frustrate an adversary that only managed to compromise their operations at a single data center though.

I question the wisdom of placing Tor in the middle of a VPN chain. By routing your traffic back into a VPN account that's linked to you it seems like you would lose most of the benefits that Tor provides.

* A single VPN means that the provider could link your primary ISP provided IP to your browsing history if they so chose.

* Chaining two VPNs means that neither provider can correlate your IP to your browsing history on their own. However the terminating VPN can obviously link your traffic to your payment details. Also obviously a criminal investigation involving warrants is still a serious threat.

* Chaining one or more VPNs into Tor means that you can rely on the above guarantees as a fallback in the highly unlikely event that an adversary manages to directly compromise Tor. It also hides the fact that you are using Tor from anyone that snoops your traffic at the ISP level. The latter might be very important in some jurisdictions.

* In the end, even if you only use Tor without a VPN the biggest threat to your anonymity is probably your own OpSec (or lack thereof). Ross Ulbricht is a prime example of the fact that you only have to slip up once. Related to that, it's important to be aware of all the ways that modern software and hardware leaks potentially identifying information (ie fingerprinting).

<comment><USER10> Hey, that's pretty much exactly what I would have said :) And the language is similar enough that we could be the same person ;) Except that I use sentence fragments. And of course, the fact that we aren't.

That's a good point about using Tor in VPN chains. If you want to do that, you must ensure that you're anonymized as well as possible from those VPN services. When I do that, I use Tor (Whonix) via nested VPN chains. And I pay with Bitcoin that's been mixed multiple times, using different mixing services, and with each mix in a different Whonix instance. And I start with Bitcoin that's not linked to my meatspace identity.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Looking at the other comments in here, I have to say Americans still seem way too optimistic that the USA could not become a totalitarian state along the lines of Russia or China.

<comment><USER15> Idiotic legislation is proposed all the time. I can still call it idiotic and say we need a new president. Can't say that in either of those countries. Just because our elected leaders suck doesn't mean they're totalitarian.

</comment></comment><comment><USER16> If government backdoors are really necessary, the government should be able to provide an explanation without using the words 'terrorism' or 'child pornography'.

</comment><comment><USER17> end-to-end encryption is the only way that you can keep democracy alive/healthy

<comment><USER18> Democracy has existed for hundreds of years without it.

Encryption is an interesting development. There has never been a time in history when anything could be truly secured. Safes could always be defeated. Communication was never provably secure.

I'm opposed to any mandated weaknesses in encryption, but I also think a lot of the arguments opposing them are dogmatic and unconvincing.

<comment><USER19> Communication used to be provably secure when you could meet with the person you want to communicate with without being afraid of ubiquitous surveillance tracking your every move and hidden listening devices (or just your phones) recording your conversation. Until a few decades ago it was never possible to do surveillance at scale. You had to first identify suspects and then start surveillance.

<comment><USER20> I do all my business naked in a sound proof faraday cage.

<comment><USER19> But how do you meet people without security cameras tracking your movement?

</comment></comment></comment></comment></comment><comment><USER21> These garbage attempts resurface periodically. Some just never learn.

<comment><USER22> They have learned just fine, but the lesson is the opposite of what you want. If the people don't want something, bring it up again and again and you can still eventually make it law, despite the people's desires.

<comment><USER21> Then they should be defeated again and again.

<comment><USER22> It only takes winning once. It doesn't help that public opinion holds little to no sway, and that it takes money from big players to fight it off every time.

<comment><USER21> Corrupt laws can be repealed. Something like DMCA 1201 looks set in stone, but I have no doubt it will eventually be scrapped.

But I agree, if such kind of junk becomes law it's much harder to repeal it, than to prevent it from becoming law in the first place.

</comment></comment></comment></comment></comment><comment> Chiba-City These bills are self-defeating. I suffer no affections for narcotics dealers and human traffickers seeking anonymity, but I also suffer no affections for "Western" bankers fixing LIBOR and NSA tapping phones of our NATO "allies." As is, our USA "cloud" is already a Trojan Horse. At this point, Open Source and strong encryption are already prerequisites of any imaginable national sovereignty. If we can't "export" strong encryption, we'll just "export" strong encryption engineers.

</comment><comment><USER23> Everyone should actually just go read the bill rather than just get news from a bunch of sources that stand to gain or lose from aspects of it.

A ton of these claims are unsubstantiated if you look in the latest versions. There is so much Fear slinging going on around the web it's seriously just bizarre to me after actually reading the bill.

<comment><USER24> Lawmakers proposed a law that would allow them to eat babies. Since lawmaking is a process eventually this eventually morphs into a law that only allows the eating of teenagers and then only those who also have red hair or blue eyes.

Without infinite time lots of people only know that the bill allows eating people and aren't entirely clear on the exact criteria of people allowed to be eaten.

A process that starts in extremely bad faith is unlikely to be negotiated into something reasonable. The best solution is to keep threatening lawmakers who pass stuff like this with replacement in hopes that nothing lands because there is no universe in which they are capable of producing good legislation on a topic they know less than nothing about.

<comment><USER25> How is E2EE related to cannibalistic eating of humans?

<comment><USER26> It's called an Analogy. [https://www.merriam- webster.com/dictionary/analogy](https://www.merriam- webster.com/dictionary/analogy)</comment></comment></comment></comment>


PaqRap, or when senior VPs of Compaq did a rap video in 1990 - <AUTHOR> https://www.youtube.com/watch?v=KB6M0dxWDOo <comment><AUTHOR> I was a baby when this video was made and I discovered it for the first time today! I would never have believed such a video had been made, and cannot imagine one being made nowadays in big corporations. I guess it must have been fun to live the birth and grow of personal computers :-)</comment>


Fair Use coming to Australia? - <AUTHOR> https://www.efa.org.au/2013/06/11/fair-use-australia/

<comment><AUTHOR> The AFACT is opposing the introduction of Fair Use into law in Australia. (It may surprise those in more civilised countries to learn that Fair Use is not enshrined in law here).

[http://www.afact.org.au/index.php/news/watering_down_copyrig...](http://www.afact.org.au/index.php/news/watering_down_copyright_laws_will_harm_australian_economy)</comment>


Apple's Developer Center Is Back After Over a Week Offline - <AUTHOR> http://techcrunch.com/2013/07/26/apples-developer-center-is-back-after-over-a-week-offline/

<comment><USER2> Note, this is only a partially recovery: [https://developer.apple.com/support/system- status/](https://developer.apple.com/support/system-status/)

The forums, tech support, pre-release docs, program enrollment/renewal, and member center are all still down.

The big thing that's returned are the dev centers and certificate issuance.

<comment><USER3> Of course the one thing I most want restored is on the list that still isn't (pre-release docs). I'm trying to roll some iOS 7 fixes into an update and would love dearly to be able to see the docs on the status bar changes.

</comment></comment><comment><USER4> Just received the following e-mail from Apple:

Certificates, Identifiers & Profiles Now Available

We appreciate your patience as we work to bring our developer services back online. Certificates, Identifiers & Profiles, software downloads, and other developer services are now available. If you would like to know the availability of a particular system, visit our status page.

If your program membership expired or is set to expire during this downtime, it will be extended and your app will remain on the App Store. If you have any other concerns about your account, please contact us.

Thank you for bearing with us while we bring these important systems back online. We will continue to update you on our progress.

</comment><comment><USER5> Interestingly, some dev certificates/provisioning profiles I setup in the day prior to the outage do not appear to exist anymore. It seems as though they must have reverted back to some point earlier in the week.

<comment><USER6> Which doesn't hold up with the explanation that they just closed the dev center to add security...

Either someone tampered with the data or made the whole system crash? Or it crashed by itself and there is no security issue at all :)

</comment></comment><comment><USER7> Now let's see if apple is brave enough to publish explanation on what went wrong and what they did.

My guess is they won't because their server stack was ( and probably still is) too embarassing to talk about.

</comment><comment><USER8> You mean I can finally download the command line tools for my new mavericks install so I can build the bcrypt gem and start my rails app? Thanks Apple.

<comment> X-Istence You could have downloaded Xcode from the App Store, from within Xcode you can download the command line tools.

Sure it would have been a bigger download, but it is one route that would have worked and gotten you on your feet sooner.

<comment><USER8> I have xcode installed. It wasn't in the options list and the docs instructed me to download it from the device center. Which 404d.

<comment> X-Istence I just had the same issue whereby I couldn't download the command line tools, installing Xcode worked for me at the time. It was listed in preferences -> downloads -> components.

<comment><USER9> Same here.

</comment></comment></comment></comment></comment><comment><USER10> I hope they do something slightly nice for developers and give everyone an extra year of membership or something (not that $99/yr probably matters to most accounts).

</comment><comment><USER11> I really wonder what took them so long. Something was probably incredibly rotten down there.

<comment><USER12> They were, ostensibly, rebuilding the entire shebang which would involve lots of testing

</comment></comment><comment><USER13> How long does it take before a device is active? I'm stuck on the activation screen in iOS7 :(

<comment><USER14> Having same issue - Added my new iPad UUID to Devices on developer portal, but activation still fails and says this device is not registered. Assuming I still have to wait for Xcode automatic config to be up and add device that way. Pretty frustrating.

</comment></comment><comment><USER15> If you're into things that Tweet, you can get status updates from our (Diffbot's) twitter bot, [https://twitter.com/diffbotappledev](https://twitter.com/diffbotappledev)

</comment><comment><USER16> At time of posting, about 1/2 is online

[https://developer.apple.com/support/system- status/](https://developer.apple.com/support/system-status/)

</comment><comment><USER17> Bit off topic, but I wish the page transitions in the provisioning portal didn't reload all the javascript assets (with a cache busting timestamp in the url) making every click annoyingly laggy.

</comment><comment><USER18> However, I'm still unable to add new devices as the page never finishes loading after clicking "Submit" \- there's also some JS errors in the console, so I guess they are still far away from restoring the Provisioning Portal.

Edit: Deleted my *.apple.com cookies, then it worked.

</comment><comment><USER19> How can I fix my certificate issues? It looks like it's still down?

<comment> grey-area Are you trying to do so via xcode? If so perhaps try using the website instead. Certs/devices etc are working for me via the web interface.

</comment></comment><comment><USER20> Is it just me or is the site much, much faster since this update? The dev center has always been a painfully slow site for me, but it seems really snappy now.

<comment><USER21> Yeah—seems to be much faster. Maybe all those server upgrades were long overdue!

<comment><USER22> Could also just be a case of having fewer users at the moment. Chances are not everybody knows the site is back up again.

</comment></comment></comment><comment><AUTHOR> Alas, no pre-release docs or provisioning yet though :/

<comment><USER23> Provisioning is back up, I'm able to see the site, log in, and look at all of the devices, certs, etc

<comment><USER24> I get a request timed out trying to refresh provisioning profiles from Xcode.

<comment><USER25> Keep an eye on the system status page at [https://developer.apple.com/support/system- status/](https://developer.apple.com/support/system-status/). As long as "Xcode Automatic Configuration" is down, that's likely to keep failing. Doing things manually should work.

<comment><USER24> Thank you for the clarification!</comment></comment></comment></comment></comment>


Ask HN: Accepting Bitcoin Payments? - <AUTHOR>

Has anyone here set up online payments using Bitcoin?  Did you roll your own solution?  Integrate a third-party API?  If you used a third party, how did you select a provider?<p>Edited to add: Do you permit anonymous transactions?  Do you offer refunds under any circumstances? How do you handle refunds? <comment><USER2> Braintree recently introduced support for Bitcoin: [https://www.braintreepayments.com/features/coinbase](https://www.braintreepayments.com/features/coinbase)

Technically, Bitcoin transactions are not anonymous; they're typically pseudonymous. Braintree requires buyers to use a Coinbase wallet. There are many reasons for this, but refunds is one of them. We enable merchants to easily issue refunds and have a cohesive experience in the Braintree Control Panel, with bitcoin alongside other payment methods like credit cards, Venmo, and Apple Pay. Feel free to contact me if you have any questions.

</comment><comment><USER3> If I was going to be doing any e-commerce (with or without bitcoin) I'd be looking at Stripe and Stripe supports bitcoin as well: [https://stripe.com/bitcoin](https://stripe.com/bitcoin)

</comment><comment><USER4> Is this for tax, convenience, or other reasons? I thought one of the powers of Bitcoin was not needing a 3rd party. Then again there's lots of reasons not to roll any part of your own payment process.

</comment><comment><USER5> Check out [http://blockcypher.com](http://blockcypher.com). The APIs are easy to use and it just works, which is my main priority when doing development.

</comment><comment><USER6> I added Coinbase's "pay with bitcoin" button to an e-commerce store a year and a half ago, alongside credit cards and PayPal. One person has used it to buy something for about $2.</comment>


Bezos Just Gave a Private Talk in New York. From Utopian Space Colonies To - <AUTHOR> https://www.businessinsider.com/jeff-bezos-blue-origin-wings-club-presentation-transcript-2019-2 <comment><USER2> > My friends who want to move to Mars? I say, "Do me a favor, go live on the > top of Mount Everest for a year first, and see if you like it — because it's > a garden paradise compared to Mars."

I wonder if that's the best we have for arguments against flying to Mars :( . I understand the talk could be simplified, but [http://www.lettersofnote.com/2012/08/why-explore- space.html](http://www.lettersofnote.com/2012/08/why-explore-space.html) still holds valid reasons to me.</comment>


My Uber driver robbed me, so I took Uber to court and won - <AUTHOR> https://fymhotsauce.rocks/blogs/news/my-uber-driver-robbed-me-so-i-took-uber-to-court-and-won <comment><USER2> I'm glad this worked out for the OP. However, I think he may have made a couple mistakes that could have been avoided for a smoother process.

The big one is not retaining an attorney. No, he doesn't have to for small claims court, but Uber clearly had its legal team looking at this. Now, I understand that lawyers are expensive and carry their own issues - but if he'd won the case with an attorney, he could potentially have secured attorney's fees as well. Plus, a good way to make a company cave on an issue like this is to say "direct all requests to my attorney; I'm not speaking to you on this matter."

I realize getting a lawyer isn't always feasible, though, especially in small claims, so I'll assume it just wasn't possible for this case (also, I'm not a lawyer, this is just based on my understanding of the small claims process). Still, giving Uber all the evidence in the case _after_ a suit had been filed but _before_ any discovery had been ordered was a misstep. Small claims court rarely has formal discovery - the process by which each side finds and turns over evidence to the other side. The OP was - as far as I can tell - under no obligation to give evidence to the Uber rep of any kind. He should not have; they used it against him. What he should have done was say "we can discuss this in court, or you can make me whole now and avoid that," and NOTHING else.

Edit: A line I really enjoyed from the piece: "They were a company that shows blatant disrespect to authority, operating illegally in cities and using technology to intentionally avoid law enforcement." Yep. That's Uber in a nutshell. Well played.

<comment><USER3> I get that big companies are not your friend, but is it really necessary to wage total war by using all possible legal advantages and issuing ultimatums? "Here is the evidence I have that you're in the wrong" can sometimes hurt you later in court, but it can avoid the entire mess by convincing the party that they will likely lose, or yield a compromise.

<comment><USER2> > I get that big companies are not your friend, but is it really necessary to > wage total war by using all possible legal advantages and issuing > ultimatums?

Initially, no. By the time you're in a court of law, yes. Once you file suit - small claims or not - discussion time is over. If you make that decision prematurely, that's not great, but there's no taking it back except by dismissing the suit, which would have been a mistake.

</comment></comment></comment><comment><USER4> _The detective in charge of my case sent me the police report. She had contacted the official law enforcement department of Uber to get more information. She gave Uber the date and time of the ride, as well as the license plate of the vehicle and name of the driver.

The Uber department responded that they had no record of a trip from the vehicle with that license plate on December 5th, 2016, just after 11 PM, and the driver had not driven with them for 2 years._

Funny, I came here to rant that Uber shouldn't really be responsible for that and the OP should have sued the driver instead, but if this is their response then they totally deserved everything they got and more.

How is it even possible to get away with lying to the police like that? They should be in serious trouble for this alone.

<comment><USER5> Individuals lie to police. Corporations merely make unfortunate errors that they are only too happy to correct now that it has been brought to our attention, sir.

</comment></comment><comment><USER6> Damn, one of my driver drove with my girlfriend's phone, we were waving to him but he didn't stop. We managed to call him via the app and he said he would send it back to us but never did. After that it was impossible to do anything/contact him via Uber :/

<comment><USER7> I wonder what recourse you have with a real taxi. I am sure the company contracting a taxi driver would consider firing a driver that steals your stuff. Especially after a few complaints. The main problem seems to be Uber's unresponsiveness to the whole issue. It would not be hard for them to set up some sort of system to prevent fraud and theft and to punish drivers accused of that sort of thing, and to kick them out of the system after a certain number of complaints.

<comment><USER8> I left a DSLR in a taxi in Ballarat.

I live in New Zealand.

They couriered to me for free.

(I sent the driver a box of wine to say thanks).

<comment><USER9> I've had all kinds of positive similar experiences with people all over the world. Most people aren't out to rob you.

</comment></comment></comment></comment><comment><USER10> Wow what a crazy story. The twist half way through after the first court case was cool.

Trying not to spoil anything for someone who hasn't read or finished reading the article.

But first it sucks how much time was spent by everyone in the story especially the victim. It also sucks that if you have to go to court again because something comes up that shows the defense, Uber, in this case, did something clearly wrong that wasn't known the first time, you seemingly can't increase the amount you're suing for. So all the expenses of going back to court again, etc, come out of your pocket. That's lame.

But at least you won in the end^. I'll be weary of Uber from now on and my belongings. I can't completly stop using Uber because of friends who don't care. Finally, who knows how other companies would handle this. Probably better, but, I don't know.

^ not a spoiler like a commentor noted because the title and URL both say he won

<comment><USER11> ... my bi-monthly reminder not to say anything tounge-in-cheek on HN, lest people trip overthemselves to remind you how you said something tounge-in- cheek and downvote you

<comment><USER12> That's also in the title, so isn't a spoiler.

</comment></comment></comment><comment><USER13> I don't get the "should have heard the car drive away and chased him" angle they twice tried.

He should be at fault for not being as fast as a car? Most people aren't going to be able to run at >10mph for very long, forget about anything more.

And even then, suppose he had caught up to the car and the driver didn't want to stop.

Just slimy.

<comment><USER14> That's not what they were trying to argue. They were trying to argue that the video of the car leaving as soon as he got out (and him continuing to walk away) proved that he was expecting the car to leave as soon as he got out, therefore he was lying to the court about having intentionally left a backpack in the car.

<comment><USER15> Could be some middle ground. That video doesn't really help his case to me. He knows the car is in the middle of the street, and not parked. The driver does start rolling while the passenger is clearly very close to the car. Even if you assume he didn't notice the car leaving, it seems to speak to the drivers intent. If the driver was intending to steal something, why risk pulling away when the owner of the bag is so close?

It's plausible to me that the driver didn't hear, or didn't pay full attention to the request to wait, and just pulled away...and that the bag was taken by a later passenger.

I would have been happy to get the money, and probably would have skipped the blog post.

<comment><USER16> This doesn't explain why the driver didn't return any calls. And in this case Uber could give data about that passenger to the police.

<comment><USER17> The driver might have realized (too late) what happened, if the driver noticed the second passenger left with a backpack they didn't come in with. Then gotten scared and decided to avoid calls and lie about things.

<comment><USER18> It shouldn't be possible to avoid police investigation just by avoiding calls. UBER should give all the details to the police and then the police should do their job and call the driver and the next passenger. Where I live (Poland), not responding timely to the police/court calls/mails would get you into big trouble and in the best case would end up in a fee and in the worst case you could be brought to the hearing by force.

</comment></comment></comment></comment></comment></comment><comment><USER19> This guy took the high road - once he had the license plate and an address, this could have taken a very different turn. If you're into someone for $4,000, it's a coin flip whether they invest effort into getting it back, or invest another $4,000 for someone else to get _you_ back. If you are going to steal from someone, always keep that in the back of your mind... you don't know what type of person you're stealing from. Maybe it's an easy mark, or maybe it's a vindictive psychopath that would love an excuse to pull your teeth out in his basement over the next 30 days. "Risk vs Reward" and all that...

<comment><USER20> > This could have taken a very different turn.

Until something similar happens to them, people often take for granted living in a society where the legal process is relatively accessible to those needing it.

</comment></comment><comment><USER21> Ultimately, Uber did not want to establish a precedent for liability. What they should have done is settled for $4,000 and forced the victim to sign an NDA, ensuring that this little conflict remained private.

Instead, in usual Uber fashion, the legal and HR team worked their magic and created a lose-lose-lose situation for themselves:

1\. They established precedent for liability;

2\. They obstructed justice, which could be used as fodder in subsequent lawsuits; and

3\. They did nothing to prevent this story from being broadcasted far and wide.

<comment><USER22> I don't believe ruling before a magistrate judge in small claims court create precedent in a legal sense, though if you just mean it will inspire others to do the same, agreed.

</comment></comment><comment><USER23> For me, the most heartbreaking aspect of this story is the sheer amount of time and effort that had to be squandered.

You could probably have designed an app, coded a site, or written a small novel with that time.

<comment><USER24> IANAL, but he should have revised his damages for the second case to account for his expenses, including time. He probably could have won closer to $6000 without a problem.

The author comes off as deeply uninformed about how legal proceedings in the U.S. work, for example talking about how he had to refute arguments in court and such, which is just not how things work at all at that level. Some basic Googleing would have taught him all he needed to know about defending himself in small claims court without stress.

<comment><USER25> You can't usually get your own time costs back. Even suing for real actual legal fees (that you can document, such as payments to lawyers) is tricky and usually demands that an existing contract is in place to enforce this, or that the suit is frivolous, and a judge has to rule on the frivolity.

You can't just go to small claims court and say "I make $50/hr, and I've spent 20 hours on this, so I also demand an extra $1000"

<comment><USER24> This heavily depends on the judge, which court, and where. All of my cases which have been heard by a court I've been awarded money for my time.

</comment></comment></comment></comment><comment><USER16> So in the end Uber got away with obstructing justice and the driver got away with theft. It is surprising that police cannot find the thief even knowing his identity.

<comment><USER26> That's the most ridiculous part;

in theory you could have discovery to actually get the drivers details and then take the driver to small claims.

in practice even for $4000 you're stretching it being worth it in many jurisdictions.

</comment></comment><comment><USER27> This is sad to hear, and while I don't use Uber anymore, I did have one great experience - my phone slipped out of my pocket into the car as I was getting out, and the car drove off as I got out and did not carry anything there. I was able to contact the last driver by logging into the app from a hotel employee's phone and arrange a pickup not too long later.

I gave her a generous cash tip and many thanks for doing the right thing, as I was far away from my home in the Bay Area (was in Savannah for a race).

</comment><comment><USER28> A fun read. Glad the author prevailed. Not surprised at uber's action, sadly. Claiming they do not control the drivers' actions is their norm.

<comment><USER29> Is it really a fun read? I skimmed through the first few paragraphs and it seemed he mentioned dota, his dad, his old job, how his flight was...

<comment><USER30> I agree. It was like listening to my six year old tell me what happened. Every story begins when he woke.

</comment></comment></comment><comment><USER31> before uber, I don't think I've ever rooted for a company to fail

<comment><USER32> Travis is walking away as a multi-million dollar man. This is whether you root for Uber or not.

<comment><USER33> I do not care about Travis that much as I care about the next victims of this rip-off machine what uber became in the recent years.

</comment></comment></comment><comment><USER34> On a night out drinking, a friend invited their uber driver to join them as they had a great connection (this is Africa so its not really strange). At the end of the night, said friend forgot all his devices in the ride and after trying to reach the driver for days and failing, we reported the issue to uber. Uber called the driver and he denied he'd seen the devices. Uber basically gave us the finger and told us they could do nothing.

<comment><USER35> Sorry to hear, but this sounds like you friend's fault. How does he really knows that driver took these devices? Maybe he lost them somewhere else (he was intoxicated, after all) or maybe the next passenger took them? If this has happened in a bus, would you blame a bus driver too?

<comment><USER34> There were 4 of them out that night. And the driver closed for the day to hang with them.

After he dropped them, they realized the devices were still in the car, and immediately tried to reach him. And he never picked up.

Well, he never pursued the issue further and left it at that.

I've had some rather good experiences e.g. where the driver called me, and brought back the stuff to me after he was done at the end of the day and refused to take any money as a reward.

I guess it all depends on the person.

</comment></comment></comment><comment><USER36> I wonder -- with a company culture on the lookout for loopholes and exploits in order to enter markets, do they tend to see that by default in the behavior of others? This guy got accused of deliberately leaving his bag in the car. There was also that incident with the rape, and the executive who brought back confidential files to discuss whether that was a fraud.

It is as if, "I think you are trying to commit fraud here ... because that is what I can imagine trying to pull off myself."

</comment><comment><USER37> _" I just didn't buy that a company could just get away with that business model. Hire anyone with a car, facilitate everything, and have no responsibility for what happens in the cars."_

If I got food sick from something I ordered off GrubHub could I sue them?

<comment><USER38> I'm curious how far this line goes, too. If I go to Subway and a worker stabs me, does Subway owe me millions? I'm really confused how Uber is responsible here.. it just seems, odd, to me.

Now, if Uber as a company promoted _(in one way or another)_ reckless speeding for the sake of fast drop-offs, and I get hit by an Uber driver, yes I think Uber is at fault _(and the driver)_. However, why does it sound like Uber is responsible for everything "during work hours"?

<comment><USER39> If Subway tells the cops "I won't say who it was", and they say "he hasn't worked at Subway for two years anyway" (this being a bald-faced lie), AND the medical bills from the stabbing set you back millions of dollars... damn right, Subway owes you millions. They're making themselves complicit in the crime by obstructing justice, and making it clear that Subway was OK with the stabbing.

<comment><USER38> Oh I agree completely, but you're adding to what I said. There are many here saying Subway is at fault no matter what.

Eg, if they didn't do anything wrong, the person just randomly stabbed me, many here think Subway owes me millions. What do you think?

I disagree, it seems bizarre to me because Subway can't possible know what crimes all employees might commit and somehow fight to prevent that. Right?

.. actually let me ask you this:

In what scenario should Subway _not_ be held liable? So many here blame Subway in my scenario, when they were not even involved.. so what does a company have to do to prevent being sued by employees random, un-predictable actions?

</comment></comment></comment></comment><comment><USER40> Note to self, "leave doors/trunks open UNTIL I am positive all my luggages are out of the car."

<comment><USER41> Given that the driver did this intentionally, is there anything preventing the driver from taking off with an open trunk? Hell, from the video footage in this article, even an open door wouldn't have done much. He could easily drive a block in a residential area with an open door and then pull over and quickly close the door.

<comment><USER42> Nope. Take off strong enough and the doors close shut, some trunks too.

<comment><USER41> Yea, I was giving the strongest form of the argument but this would probably work too. In the video, the guy took off pretty slowly to minimize sound so I didn't mention this possibility.

</comment></comment></comment></comment><comment><USER43> I tried reading this, when does the guy get to the point? I am not sure what Dota, or his dad, or his hot sauce or his awesome flight has to do with any of this?

Ok, go about 2 pages down, and you can skip the incredibly detailed discussion of his exiting the car.

This seems more like the driver thought he had all his bags, the door was closed, a simple mistake. But no, the driver was a master thief, spying him using stuff in his bag and racing off (at an incredibly slow pace according to the video).

Good on the guy for following up with this, and it is an interesting story.

> They were a company that shows blatant disrespect to authority, operating > illegally in cities and using technology to intentionally avoid law > enforcement.

This is true, and well known. And if you knowingly use Uber, you understand this.

</comment><comment><USER44> You know, if Uber employees started going to jail when they lied to the government, the culture would probably change pretty fast.

</comment><comment><USER45> Awesome work!! Great story about how _awful_ the legal system is given the amount of effort and work you had to go through. You deserved a lot more than just that $4k.

I personally feel bad that it's only after reading this that I'm going to stop using Uber as well...despite all of the terrible stuff that's going on over there, I was willing to strike up to "growing pains" or "bad apples", since I _wrongly_ believed they were 100% committed to their users. That's clearly not the case so there's no more Uber for me.

</comment><comment><USER46> Not a single comment on here about using insurance. I know that a backpack with a laptop can be stolen out of someone else's car and cut-rate renters insurance will cover it. I don't really think Uber was the correct person to foot this bill, I think this is the same as someone grabbing your purse from you when walking down the street. You either have decent insurance or you're SOL

<comment><USER47> If Comcast sent a contractor over to your house, to hook up cable, and the tech stole your TV, is Comcast liable for this?

If you check into a hotel, and the bellboy steals your luggage, is the hotel liable for it?

If you hired a roofing company to fix your roof, they subcontracted it to another firm, which came and set your house on fire, are the roofers also not liable? Especially after they spend a few months trying to prevent you and the police from getting in touch with the subcontractors?

This smells of criminal conspiracy.

</comment></comment><comment><USER48> Can I say that I had the inverse experience where an Uber driver drove off with something that I left in the trunk of the car.

He went to considerable effort over multiple calls over a few days of coordinating and attempts for me to get it back, until eventually I got it back intact.

It was a first class customer service experience.

<comment><USER49> I'm glad it worked out for you.

It enforces the point of the article: your experience with Uber is entirely influenced by your driver.

If you happen to have a bad one (like the author), Uber takes no responsibility (contractor contractor contractor!), and your only recourse is considerable time and effort taking them to court.

</comment></comment><comment><USER9> What I don't understand about Uber after all these months/years of them being horrible to customers is: Why?

#1 rule of capitalism is to coddle your customers as much as possible at every possible expense while still remaining profitable. Why does Uber act so 2nd World?

</comment><comment><USER50> 11 paragraphs of self-promotion before getting to the meat.

<comment><USER51> I wanted to give people knowledge of what I went through so they would be able to avoid what happened to me.

<comment><USER29> I'm about to go to bed so I only skimmed through the first 10-11 paragraphs, but how is your dad calling you, and what you used to do before, and how comfy your flight was, relevant to the story? Maybe it was, and hey, it's your story, but my thought was "Damn, he got off on a tangent, on a tangent!"

<comment><USER52> The comfiness of the flight is the reason for taking the photo that was then used in court.

Yes, it is relevant.

<comment><USER53> "I'll allow it."

</comment></comment></comment></comment></comment><comment><USER54> Any anecdotal stories about losing items in traditional Taxis? The first clerk didn't think that ever worked out, wondering about that claim...

<comment><USER55> You would probably get zilch. People think filing a suit against Uber is bad because they big and have lawyers and stuff. But at least there's a large target. Try suing a private cabman, when you discover owner of the license and the driver are completely different people, and nobody wants to talk to you, and their terms of service, which you have never seen but implicitly accepted, say they are not responsible for anything. And unlike Uber they are not concerned at all about the bad press, and if you sue them them might obstruct and delay you every way possible (or the driver might just disappear and the owner disclaim any responsibility because they just own a medallion and have no idea about what the driver does when), and even if you win they could just refuse to pay up and you'd have to figure out how to get money out of them, while living on the other end of the country.

At least Uber is a big target that can be found, forced to disclose the data that you know they always have, and if you win, you have reasonable assurance you get the money.

<comment><USER56> I thought traditional Taxis assumed liability.

<comment><USER55> Who exactly assumes it? Driver? Whoever hired him? Whoever owns the medallion? I think it'd be non-trivial to even figure out who to sue, let alone win it.

</comment></comment></comment></comment><comment><USER57> You should've added like $50K of punitive damages. The fact that they lied to the police and got away with it is crazy. You didn't even break even, considering how much time and research you spent.

</comment><comment><USER58> This.

"Ultimately I am sad that the company that is trying to reform the taxi industry is so corrupt."

</comment><comment><USER59> I don't fault the driver. He's just following the normal standards of conduct for business transactions in Massachusetts.

I say this as someone who had the misfortune of growing up there.

I'm only being sarcastic about not faulting the driver. Unless you're trying to grow your customer base or know the person you screw them. It's just how things are done.

</comment><comment><USER60> Uber and Lyft are here to stay and if not them then someone else. Cabs suck.

</comment><comment><USER61> did anyone else notice this blog post is on site that sells hot sauce?

<comment><USER62> Actually because I use NoScript, nothing at all shows up when I visit that URL.

Empty white page.

Defective site design.

<comment><USER63> "I block HTML and your site doesnt load for me, defective site!"

I know JS isnt HTML, but at this point, it basically is. Complaining that a site is broken because you choose to break it is just astounding.

<comment><USER64> That's not why the site is broken if you're using uBlock/NoScript. It's broken because it loads everything (even the text of the site) from 3rd party domains and scripts.

<comment><USER65> The text is there. You can see it if you disable CSS.

</comment></comment></comment></comment></comment><comment><USER66> This reads a lot like The Rosie Project, which is a great read!

</comment><comment><USER67> What kind of snacks did you eat on the plane?

</comment><comment><USER68> Deleting Uber

</comment><comment><USER69> >Before my hot sauce set a record on Kickstarter

I would've liked to know more about this relevant detail.

<comment><USER70> $64k in 2014, $13k in 2016. Pretty sure that's just his inner salesman speaking.

</comment></comment><comment><USER71> I get that the court process is the main part of the story, but I still can't believe that you left $4k worth of equipment in the car with a stranger. I guess I'm just much more paranoid. Also, that's how I view taxi drivers as well as Uber/Lyft drivers. Sure there are some protections like background checks and tracking, but at the end of the day it is a stranger we don't know, and anything could happen, so we probably should at least be a bit hesitant.

<comment><USER51> I won't make that mistake again. If I were giving someone a ride I would have helped them with their bags and not thought about taking them. I assumed people shared that quality.

</comment></comment><comment><USER72> Interesting story, but I think it was a bit unfair to Uber. I'm glad this guy was made whole, but I'm not sure Uber's reluctance to paying you 4000 dollars because a driver stole your backpack qualifies as corruption.

From what I can tell, the worst thing Uber did was not be sufficiently cooperative with the police investigation. This part of the narrative is extremely muddled and unclear, so it's hard to take a strong position on their behavior here.

<comment><USER73> FTA: What Uber told the police.

"The Uber department responded that they had no record of a trip from the vehicle with that license plate on December 5th, 2016, just after 11 PM, and the driver had not driven with them for 2 years."

"Sufficiently cooperative" (per you) and outright lying are two very different things.

FTA:

"Why would Uber not have the information on the driver for the police? Uber asserted that they don't have the ability to look up the drive information of my trip with the information provided (license plate, car make and model, name of driver, time and date of trip, and pickup and drop off location of trip) as it was a violation of privacy. "

Uhhh... what? It violates privacy? Your either complying with the police or you aren't. "There was no warrant" would have been an OK answer, but that wasn't what they said.

They aren't being muddled or unclear here, they are literally avoiding giving answers that would make them look bad. Maybe if they had been more honest and responsive the items could have been recovered rather than the blame falling on Uber.

<comment><USER74> >"The Uber department responded that they had no record of a trip from the vehicle with that license plate [...]"

This kind of thing worries me a bit.

This past week I've taken two Lyfts where the license plate provided in the app didn't match what the driver was actually using. One of my drivers claimed they had just gotten a new car, but that's a bit odd to me since when I bought a new car it took several weeks to get my license plate.

So there should be ample time for a good driver to ensure their record is up to date.

<comment><USER75> Did you report the driver? The one time that happened to me, I asked the driver and showed me that he had both cars registered in Uber and had selected the wrong one.

<comment><USER74> Honestly no because I wasn't sure what the process is for that.

<comment><USER73> Well you start by taking photos!

First and foremost for your own safety.

Second just send them to CS. If something terrible ever happens and it shows up on the 11pm news, at least you can say "I tried" and the company can't run and hide from its bad policy

</comment></comment></comment></comment></comment></comment><comment><USER76> Really poorly written. Spends far too long in getting to the event, and really confusing about the court proceedings.

<comment><USER77> The guy makes hot sauce, what do you expect? I thought it was a pretty good read. Although I'm familiar with FYM from Dota 2. (Love Team NP)

</comment></comment><comment><USER78> Misleading title. Robbery is theft by force or threat of force. Although the author says he was "robbed", he alleges theft by driving off with his bag, no violence involved.

<comment><USER79> [https://www.merriam-webster.com/dictionary/robbing](https://www.merriam- webster.com/dictionary/robbing)

to remove valuables without right from (a place)

Does not need to be violent to be a robbery

<comment><USER80> The legal definition is different than the dictionary definition.

In California for example, "Robbery is the felonious taking of personal property in the possession of another, from his person or immediate presence, and against his will, accomplished by means of force or fear."

I know of no case holding that driving off with a person's property is "force."

This probably would fall under theft in a criminal proceeding in Cal.:

Every person who shall feloniously steal, take, carry, lead, or drive away the personal property of another, or who shall fraudulently appropriate property which has been entrusted to him or her, or who shall knowingly and designedly, by any false or fraudulent representation or pretense, defraud any other person of money, labor or real or personal property, or who causes or procures others to report falsely of his or her wealth or mercantile character and by thus imposing upon any person, obtains credit and thereby fraudulently gets or obtains possession of money, or property or obtains the labor or service of another, is guilty of theft. In determining the value of the property obtained, for the purposes of this section, the reasonable and fair market value shall be the test, and in determining the value of services received the contract price shall be the test. If there be no contract price, the reasonable and going wage for the service rendered shall govern. For the purposes of this section, any false or fraudulent representation or pretense made shall be treated as continuing, so as to cover any money, property or service received as a result thereof, and the complaint, information or indictment may charge that the crime was committed on any date during the particular period in question. The hiring of any additional employee or employees without advising each of them of every labor claim due and unpaid and every judgment that the employer has been unable to meet shall be prima facie evidence of intent to defraud.

<comment><USER81> OK, so we've established that the legal definition is different from the dictionary definition. Now we just need to figure out if the OP is a blog post or a legal filing and we'll know which definition we should use.

</comment></comment></comment></comment><comment><USER82> > I ended up going to an Apple store as they had just made everything in their > laptops Type-C, but in typical Apple fashion they were $90 and that just > seemed outrageous. Not too far away a Microsoft store had a charger for only > $30, so I bought that instead.

Was this nugget really necessary? And, by the way, a laptop charger for $90 is a reasonable price; if anything, I'd be more outraged about a $30 phone charger.

<comment><USER83> no 90$ for an item that doesn't even 15$ to make is not a reasonable price !

<comment><USER76> Only if you care about the quality of the charger that can easily smoke your $2000 laptop.

<comment><USER84> Do you think the Microsoft store is selling chargers that will set your laptop on fire?

<comment><USER76> I can believe they aren't up to Apple's standards for their laptops.

<comment><USER85> I don't have a USB-C Mac, but but Apple's $80 MagSafe chargers aren't actually very good. They don't have basic strain relief sleeves on the cables, so they get kinked at the ends and fray/melt/stop working after a year or two of regular use.

This has been a problem for more than 10 years and Apple's never done anything about it. I can only imagine it's because they think the strain relief is ugly, which is one of those random bits of belligerent incompetence that's really frustrating as a Mac fan.

<comment><USER76> I've only had a half dozen MagSafe chargers, and never had one fail.

<comment><USER85> I've had at least four, and never had one not fail.

It may depend on the conditions you use them in; keeping it on your desk most of the time is probably better than carrying it around and using it in coffee shops and so forth. But that's a standard use case for laptops; there's no excuse for not being able to survive that.</comment></comment></comment></comment></comment></comment></comment></comment>


China involvement suspected in hack of US health insurer Anthem - <AUTHOR> http://www.bloomberg.com/news/articles/2015-02-05/signs-of-china-sponsored-hackers-seen-in-anthem-attack <comment><USER2> I honestly don't care who did this. Can we please take public key cryptography mainstream now. The fact that basic metadata like Name, birthdate mother's maiden name and SSN are sufficient to gain access to many aspects of my life are ridiculous.

What I don't want to see is knee-jerk legislation that erodes our privacy and rights further.

Really, just mandate by an act of congress that companies need to rely on public key cryptography within 5 years for everything and you'll see user- friendly solutions appear really friggin quick.

I remember back when I was in banking when they announced some crazy retention policies on all communication (written and voice) that wasn't technically feasible at the time congress passed the laws requiring those retention policies. Within a few years, there were a bunch of vendors with solutions for the banks to implement. Necessity is the mother of invention. Invent a necessity through an act of Congress and people will invent.

<comment><USER3> Do you mean public key cryptography as a replacement to a world-readable SSN, or public key cryptography to prevent breaches like these?

The first suggestion would be much more secure but would be difficult and very lengthy to implement, and the second would not have helped in a situation like this.

<comment><USER2> I'm suggesting the former. For every transaction where my identification needs to be verified, I should be able to sign off digitally.

Identity Theft is a completely made up thing, that used to be called fraud. When it was called fraud it was the responsibility of the institutions to protect themselves. Instead they use the word identity theft to make it the problem of the victim. If someone goes to the bank and pretends to be me and gets a line of credit, spends a ton of money, I am left holding the bag since it destroys my credit rating. Yet, I didn't do anything at all wrong. These institutions rely on woefully inadequate measures to determine identity and when something goes wrong, the person who should pay for inadequately verifying identity is the financial institution that messed up and gave credit to the wrong person under false pretenses.

Anthem is my insurer and now I'm responsible for dealing with the fallout from every institution's completely inadequate processes for verifying identity. How is that fair?

The solution isn't hard, you'd get an account with an identity signing service that goes to great lengths to confirm your identity. Once your identity has been confirmed, you either generate your own private and public keys and upload your public key to them or they can generate both on your behalf. After that, you either host your own service to sign with your private key or you redirect signing to the identity provider if they generated a key for you.

This is not a pipe dream. It just requires mandating that companies need to require that you sign off on things cryptographically. If you have not signed off, then the losses and consequences from fraud are their responsibility, not yours.

<comment><USER4> A few countries already do this around the EU - Latvia, Czech Republic: [http://www.ica.cz/Get-ZEP-package](http://www.ica.cz/Get-ZEP-package)

</comment></comment></comment></comment><comment><USER5> Is this just becoming the easy thing to do? Blame China or Russia while the story is still hot off the press? It seems that every time a company is hacked, the first thing they do is exclaim how some big, scary government is behind it or how "incredibly complex" the hack was. "Oh yeah, we lost your entire life's information, but _it was the most complicated hacking attack we 've every seen_!" "Our team has never seen something of this magnitude." "We immediately disabled the threat the second our complex internal systems detected the activity." Every hack has the same corporate response.

<comment><USER6> Super easy and really annoying but probably relatively effective PR. The news on this stuff sees lots of eyeballs compared to follow-ups or clarifications. Plus the consequences for being found wrong downstream and pretty minimal, sadly. Casting these kinds of aspersions redirects fear & anger from the company to boogeyman nation-states.

[Edit: I just noticed these are government and not private analysts making the claims, so my comment is now a bit cynical for my own taste... but I think it's still effective PR and I expect private security companies to field more "So you're not saying is WASN'T North Korea, right?" kinds of questioning from corporate clients.]

<comment><USER7>
      > I just noticed these are government and not private
      > analysts making the claims, so my comment is now a bit
      > cynical for my own taste...

Not for mine... casting these issues as a threat to national sovereignty is a great way to raise defense funding.

<comment><USER6> Yeah, I don't object to suspecting our intelligence agencies have a habit of using information to benefit their budgets in that way, especially when there are opportunities to be technically accurate but let the media fill in the blanks (ie: "We think the hackers were Russian" becomes headline: "Russia involved in hacks").

</comment></comment></comment></comment><comment><USER8> "Sophisticated attack" = Norton Antivirus didn't stop it.

"Chinese" = we saw an Asian IP address.

"state-sponsored hackers" = This is war!

"Sophisticated attack by Chinese state-sponsored hackers" = force majeure.

Force majeure = We don't owe you a penny.

</comment><comment><USER9> "...and increased pressure on the U.S. government to respond more forcefully."

Rather than responding to hacks with counterattacks or an attempt at diplomacy, the first priority ought to be to strengthen the defences of companies handling sensitive data.

While a large system may never be made impenetrable, it could certainly be a lot harder and more costly to pull off an attack against most of these companies than it is today.

If this is considered a crisis, redirecting a few of those billions earmarked for NSAs offensive capabilities towards vetting and improving the security of US companies would make a good strategy.

<comment><USER10> Not sure about budgetary minutia but surely this qualifies? [http://www.cnet.com/news/obama-adds-14b-to-budget-for- steppe...](http://www.cnet.com/news/obama-adds-14b-to-budget-for-stepped-up- cybersecurity/)

<comment><USER9> Indeed, that seems very appropriate though arguably many years too late. I am not an American myself, but I hope for their sake that it makes it through Congress this time.

</comment></comment></comment><comment><USER11> Like how Russia was behind the JP Morgan hack, until they weren't?

USA Today, 10/07/14: "Report: Russian hackers behind JPMorgan Chase attack"

Reuters, 10/20/14: "Russia ruled out as culprit in Chase cyber security breach, U.S. officials say"

[1]: [http://www.bloomberg.com/news/articles/2014-08-27/fbi- said-t...](http://www.bloomberg.com/news/articles/2014-08-27/fbi-said-to-be- probing-whether-russia-tied-to-jpmorgan-hacking)

[2]: [http://www.reuters.com/article/2014/10/21/cybersecurity- jpmo...](http://www.reuters.com/article/2014/10/21/cybersecurity-jpmorgan- idUSL2N0SF30M20141021)

<comment><USER3> The 2 headlines and claims aren't mutually exclusive. The FBI investigated reports that the Russian _government_ was tied to the hack, and concluded they weren't. That doesn't mean the actors weren't Russian citizens and/or living in Russia.

Just as an example, the Target and Home Depot breaches were almost certainly conducted by the same fairly well-known group of Russian hackers and fraudsters, but they have no known ties to the Russian government.

</comment></comment><comment><USER12> Yeah, it's China's fault <rolls eyes>

The fact that Anthem could not be bothered to spend the time or money to secure their data until it was stolen has nothing to do with it. Not at all.

This is a ploy to get out from under the HIPAA liabilities.

<comment><USER13> This attitude is pervasive on HN, and I find it a little baffling. If someone took advantage of a lax property-management company to successfully burgle an apartment complex, I can't imagine anyone being so cavalier about pursuing the actual criminals behind the theft.

<comment><USER14> Even if the apartment complex didn't lock the doors and didn't allow tenants to put locks on the doors? If the apartment complex was supposed to have employees that install and check locks and cut the budget? If those cuts helped the apartment complex turn $2.56B in net income last year?

<comment><USER15> It's still illegal to enter an unlocked door unless you're authorized.

Two things can be true: you should have locks on your door AND you shouldn't enter someone else's unlocked door.

(Ironically, not locking your doors could also increase your insurance rate...)

<comment><USER16> So we should expect that criminals, who by definition violate laws and regulations, won't do something simply because it is illegal?

In that case, we should just put trespassing and breaking and entering laws on the books and call it a day, that should stamp out the problem immediately.

</comment></comment></comment></comment></comment><comment><USER17> I remember reading cyberpunk novels when I was younger, Neuromancer and everything since, and thinking that all those stories about plucky hackers cracking governments and megacorps were hopelessly mired in the '80s. In the internet era, no group with millions of dollars to spend and a reputation on the line could possibly have such shoddy security.

It really seemed to make sense at the time.

</comment><comment><USER18> What's the advantage to the Chinese government in acquiring the personal info of 80 million Americans? Are they going to bring it up in the next meeting with President Obama? "You know, Barack, it'd be a shame if all that info about your citizens got misused. A real shame-like." That'd be silly. I just don't see their motivation in being behind it.

The usual motivation for stuff like spying and data theft is the acronym MICE - Money, Ideology, Coercion, and Ego. It's unlikely to be money - we're already shipping dollars over there like crazy. It's also unlikely to be Ideology - the Central Committee are closet capitalists these days. Coercion - I don't see them trying to trade this for reducing our support for Taiwan. Ego. Ego is a possibility - but they're not teen-aged boys.

<comment><USER19> I haven't seen any official statement which implicates the Chinese government, only that the attack may have originated from China. Very different things. If the media is reporting it as the former than that's on them.

</comment></comment><comment><USER20> Is it weird that this would make me feel ever so slightly better that my info got hacked?

I mean, I'm not a government worker or contractor. Even if I was, my password is randomly generated and not used elsewhere. If it wasn't for profit hackers, identify theft with social security numbers is perhaps less of a concern. And my password was randomly generated, so they can't get into any other accounts, so identity theft and fraud based on it is probably the biggest threat.

I really wish there was a good health insurance company (or a single payer system) I could switch to, but anthem is honestly the least bad company currently available to me.

</comment><comment><USER21> If it was really detected at egress then that would make it a sloppy operation. The Chinese should object to the FBI insulting their espionage teams - or say it was just a training exercise.

</comment><comment><USER22> Ahh, politics: _(insert nebulous threat)_ is going to eat your children!

</comment><comment><USER23> _Officials at Anthem detected the theft of the trove of customer information as it was being sent from its computers on Jan. 29, according to one of the people, which they said is still in its early stages._

As others have pointed out, running a whois on the anthemfacts webpage returns a registration date of 12/13/2014 [1] which is most likely when the breach occurred. Not January 29th.

[1]: [http://whois.domaintools.com/anthemfacts.com](http://whois.domaintools.com/anthemfacts.com)

<comment><USER24> The domain doesn't prove they knew anything then. It's too generic, it's not like it was something like anthemdatabreachfacts.com.

The company just changed its name from Wellpoint to Anthem in December and could have bought up a bunch of "anthem*.com" domain names around then to keep in reserve.

<comment><USER25> Or they bought the domain back then and planned to use it for this explicit purpose. It's not a question of "will" a big company get hacked, it's a question of "when".

Also I'm sure a major healthcare company that handles tens of millions of sensitive personal records has enough foresight to see a data breach coming. HIPAA and ACA probably mandate healthcare companies having this exact kind of plan ready to deploy in the event of a hack.

<comment><USER26> Come on, give them some credit for the facts they did provide. They detected a breach where sensitive data was stolen on January 29th. This does not preclude that they also detected a breach first, on or before December 13!

Did anyone record any downtime of their public-facing systems in this time? You know when you're a sysadmin and you notice something really bad happening, you shut down the affected systems immediately and try to minimize the damage? You never know what kind of back doors have been put in place, after you are breached.

It is also entirely plausible that the breach is still ongoing now, after a month and a half why not, but they are just no longer able to detect it. These people are some of the most important cogs in the health care machine, the insurance providers! If they had some kind of downtime that was actually affecting their ability to provide services, well then they might actually be subject to some real form of legal action, maybe even pay serious damages to their customers. Thank heavens that didn't happen!

They are paying lip service to security because it's not as important to them as, you know, basically anything else. Like say, receivables. It's only identity theft!

<comment><USER26> Relevant: [https://news.ycombinator.com/item?id=9012996](https://news.ycombinator.com/item?id=9012996)

"The company also confirmed Friday that it found that unauthorized data queries with similar hallmarks started as early as Dec. 10 and continued sporadically until Jan. 27."</comment></comment></comment></comment></comment>


Ask HN: How Does"Never Remember This Credit Card", Not Remember the Credit Card? - <AUTHOR> <comment><USER2> On... Amazon? Using Stripe? Using Paypal?

It would be up to the developers to determine the actual action of that checkbox or button but I'd assume, they just use the CC info for the transaction and not store it in a DB.

Now a days, I think most would advise not to implement such a feature or or use such a feature. It's just to risky to store CC info.

</comment><comment><USER3> I would guess it probably hashes it for later comparison and there by actually remembers it.</comment>


The Mobile CPU Core-Count Debate: Analyzing the Real World - <AUTHOR> http://www.anandtech.com/show/9518/the-mobile-cpu-corecount-debate <comment><USER2> The debate about non-symetric RISC cores feels like a tech battle that was already fought in the 2k10's. Amusingly its nearly the exact same debate this time around. The only difference is 2 orders of magnitude of TDW really, and Google is now playing Oracle.

You say to Oracle, _Yeah T4 SPARC64 RISC chips look nice. But coding against non-symetric asychronous cores is hard._

Oracle counters, _Yup, that is why we wrote /maintain the Java JIT that does that for you!_.

Now Google is selling ARMv8 with A57 non-symetric asynchronous RISC chips, which you optimize with Java and we do this song and dance over again.

Intel, Nvidia, AMD (formerly ATI) solved this problem a long time ago just by putting the binary logic between the scalar processors and only exposing 1 _scheduler_ to pipeline these smaller weaker cores but make them _pretend_ to be a single processor to the OS/User.

<comment><USER3> Apple's recent decision to promote LLVM bitcode as a canonical binary form for apps ("promote" meaning mandatory on the watch) makes me suspicious they're planning something similar in their future A-series or S-series chips.

The paired relationship between the phone and watch could probably benefit from either side being able to do a little computation and coordination without having to spin up the big cores.

There, of course, I'd expect Apple to make it developers' problem to designate which thread(s) could operate in a limited environment.

<comment><USER4> > There, of course, I'd expect Apple to make it developers' problem to > designate which thread(s) could operate in a limited environment.

Less so when using task queues, I guess.

<comment><USER3> Sure, but I'd expect that Apple would provide some API for you to designate certain tasks as intended to be run in the "Deep Background". With the understanding that such tasks are on a very short leash power and capability- wise, and may be arbitrarily cancelled—like iOS's forcible app killing, but at a smaller grain. (Does GCD have a facility for the dispatcher to unilaterally do this already?)

</comment></comment></comment></comment><comment><USER5> In my opinion Qualcomm got it right when they told about better cores instead more cores, despite they are now shipping 8-core SoCs, too. The rationale of that decision comes from how difficult is doing "4 good cores" tuned for both energy-saving and high performance (e.g. Krait 400/450 in Snapdragon 800 series is an impressive design, very optimized stuff for being able to use very high clocks and fine-grained frequency scaling for battery saving). The point of 4 complex cores and 4 simpler cores (or 8 simple cores) is just because simpler core area is tiny in comparison of the total silicon: you get them almost "for free", and in many cases could outperform the complex counterpart (unless we get someday cores with dynamic pipelines being able to work both in-order and out-of-order, who knows).

I hope Qualcomm gets back to 4-core designs with a custom ARM v8 optimized implementation (2.5-3GHz with independent CPU core frequency and voltage dynamic control).

P.S. "Snapdragon --Better Cores, Not More Cores" video: [https://www.youtube.com/watch?v=qdauwqhmsas](https://www.youtube.com/watch?v=qdauwqhmsas)

</comment><comment><USER6> The manufacturers of mobile phones creates CPUs and GPUs that are optimized to win benchmarks but if you rerun the tests over a longer time period the CPU/GPU will overheat and run into thermal throttle issues. Thus consumers are thinking they are buying a phone which is faster than what they really get in practise.

Then marketing wants new features to sell to consumers so you increase the core count which is one way of making the phone faster but at the same time you drain the battery a lot faster.

<comment><USER7> Most of the time when I'm using a phone I'm doing something intensive (rendering a web page) followed by long periods of light use (reading the web page). So I think that running fast for a short period is a good thing for phones to be doing.

And making a phone faster will almost neccesarily drain the battery faster. The important metric is task energy where you multiply the time it takes a phone to do some task by the power it consumes while doing it to figure out how much energy was needed overall to do it. By that metric adding more cores usually has less of a negative effect than speeding up a phone by upping the clock speed or the size of the OoO structures.</comment></comment>


A Web Server in Awk - <AUTHOR> http://awk.info/?tools/server <comment><USER2> I know these are fun little code examples, but calling them web servers is a little extreme. What is the minimum functionality required to label something a "web server"? I mean, shouldn't a web server at least support a skeleton set of HTTP request types and return status codes?

I'm not trying to be pedantic here. I just feel that if a new developer were cutting their teeth and came across these examples of "A web server in X", they'd feel a little confused. "Is this all there is to a web server?" No, absolutely not. Not even close.</comment>


The Privacy Illusion - <AUTHOR> http://dilbert.com/blog/entry/the_privacy_illusion/

<comment><USER2> A very sane analysis of the privacy problem and the government. I would pose that the biggest privacy problems are not with the government, it's with corporations.</comment>


Qt Online Installer 3.2.3 - <AUTHOR> https://www.qt.io/blog/qt-online-installer-3.2.3-released <comment><USER2> If you want to use Qt in commercial closed source product without paying for the license, it's easy to do when you use LGPL version.

1\. Do not buy the commercial version.

2\. Do not change the source code of the Qt library. Use it at it is.

3\. Provide access to either statically or dynamically linked object files with instructions for linking. Static vs. dynamic linking does not matter with LGPL. LGPL requires access to source code and the ability for the user to modify open source library and link it to your closed source object file to create binary.

You compile your commercial code into commercial.o then compile LGPL code into lgpl.o and link them into a single binary.

        ld -o binary  lgpl.o commercial.o -lc

When you deliver the software, you send the binary, provide access to commercial.o and LGPL licensed source code with instructions for linking. User has now the ability to meddle with LGPL version of Qt, compile it into lgpl.o and link it against your commercial.o without having access to your source code.

(note: of course you can modify the Qt under LGPL when you release modifications with the LGPL. But then you have to maintain the fork on your own and you don't usually want to do that.)

<comment><USER3> That's the equivalent of creative accounting for software developers.

Dick move.

Such behaviour just leaves the market to big corps who can afford to release such tools for free while extracting money from elsewhere.

<comment><USER4> The above technique is compliant with the license of Qt (LGPL). If Qt didn't want to allow it, they would have used a different license like the GPL.

<comment><USER3> Then you wouldn't be able to write BSD-licensed apps using Qt at all. Creative accounting is also legal per se. It doesn't make it right.

<comment><USER2> Why not?

There's nothing in the BSD license that prevents you from mixing in code. LGPL doesn't care if you link it against BSD code. Just that the LGPL code must stay under LGPL.

<comment><USER3> I was replying to the suggestion that Qt could be released under GPL if its authors wanted to prevent the creative accounting described by OP.

Also, LGPL is already problematic, because you cannot link statically with it.

<comment><USER2> > Also, LGPL is already problematic, because you cannot link statically with > it.

Damn. I just wrote the whole top level comment to explain that you can link statically LGPL code and how to do it with details.

<comment><USER3> That's just a workaround. Now I need to add *.o files to my deb packages. Or ship source code in deb packages? What is it? Gentoo?

<comment><USER5> You don't, you just need to provide a way to get them (you can even specify that requests must be sent by post and charge postage for the response on a CD). It's not a 'workaround', it's literally how the license is supposed to work.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Slightly off-topic but it's interesting how all of the discussion on this post (right now) is centered around the only other top-level comment rather than the article.</comment>


Labor 2030: The Collision of Demographics, Automation and Inequality - <AUTHOR> http://www.bain.com/publications/articles/labor-2030-the-collision-of-demographics-automation-and-inequality.aspx? <comment><USER2> It mentions demographics as one of the key points, specifically aging workforces in many markets. I wonder if this will eventually lead to an overhaul of immigration rules in developed nations or whether the political climates in places like the U.S., Germany, etc. will make this impossible even in the face of a labor shortage.</comment>