Supreme Court Rules Police Need Warrant to Track Your Cellphone - <AUTHOR> https://www.npr.org/2018/06/22/605007387/supreme-court-rules-police-need-warrant-to-get-location-information-from-cell-to <comment><USER2> They didn't go so far as to overrule _Smith_ , the ""pen register" decision, where the court held that dial digits are a "business record" of the telephone company. That 1979 decision mentions the pen register's "limited capabilities" \- the device was just not suitable for bulk surveillance. This decision mentions _Smith_ , but the court didn't overrule it.

I own a "pen register". Recently bought it on eBay and restored it. It's a brass clockwork device on a cast-iron base in a wooden box. It prints dashes on a paper tape when connected to a dial phone line. It's extremely simple - one electromagnet and a wind-up mechanism, wound with a huge brass key, to advance the tape. A dial pulse starts the clockwork, a lever pushes the paper tape into an ink roller for each dial pulse, and when the input hasn't changed for four seconds, the clockwork stops. The timing mechanism is similar to Edison's stock ticker from the 1880s. Weighs about 15 pounds. It's a nice looking piece of machinery.

That's what cops had to use for most of the 20th century. Telcos themselves did not log call data except for long distance calls. Electromechanical switches had no large data storage devices. A pen register had to be physically connected to a single phone line, usually in a telephone central office. Someone had to check on it frequently and wind it. No way could those things be used for bulk surveillance. Hence the court's holding as to its "limited capabilities".

The legal system has trouble with scale. Today, every transaction a phone has with the switch is logged to a hard drive for nearly zero cost. Data logged per call has increased by many orders of magnitude since the days of the pen register and the _Smith_ decision. But the court has not seen fit to overrule _Smith_. Yet.

<comment><USER3> If they did not log call data, how did they charge it? Or did they only offer unlimited plans?

<comment><USER4> Local calls have been unlimited on landlines in most US markets for a very long time.

<comment><USER5> Not so long at all. Into this century in California, at least, your Pacific Bell local calling area was something like 8 miles, and your "free" area was the collection of prefixes for which the nearest point for each prefix was within that distance.

San Jose, for example, had 3 calling regions. Anywhere in Sunnyvale to SJ1 or SJ2 was local, but SJ3 wasn't.

I set up message broadcast systems for groups (such that a 100-second message could be broadcast to a database of contacts, loadable from a CSV file). I wrote a program to parcel out which calls were local from each point. 2 parallel systems, one in Sunnyvale and another in SJ3, could cover from Menlo Park to southern Fremont to Monte Sereno to almost San Martin with no calling charges to over 700 recipients.

<comment><USER4> I'm not sure how this doesn't qualify as unlimited local calling?

The situation in rural KY on GTE in the early 90s was quite similar -- I even remember using 3-way calling to bridge an aunt who lived a county in one direction with a grandmother a county in the other direction. For us, either was a local call, but for the aunt and grandmother to directly call each other was long distance.

<comment><USER5>
      I'm not sure how this doesn't qualify as unlimited local calling?

It just depends on how one defines "local". Nowadays, people assume your entire country at a minimum. 15 years ago, it was 10 miles or so. It was the mobile era and its inherent independence of landline tariffs that changed things. For three generations, Ma Bell subsidized local calling and infrastructure with long distance charges; the MCI court case and the subsequent breakup of Ma Bell blew that apart.

</comment></comment></comment></comment></comment></comment><comment><USER6> ROBERTS, C. J., GINSBURG, BREYER, SOTOMAYOR, and KAGAN agreed.

KENNEDY THOMAS ALITO and GORSUCH dissented.

The mix of the court on this particular issue is amazing to me. Roberts is turning out to be one of the most balanced judges since Kennedy in terms of hearing a case of merits and not just ideology. Bush did something right bringing on that guy.

<comment><USER7> While this is an important decision, Chief Roberts' time to prove his balance and foresight as a justice was with Citizens United. His court's legacy died with that decision. If it weren't for the archaic archival privacy rules around Justice Sutter's dissent after his retirement we would all be able to read an insider's proclamation of the court's mockery and decline of the institution.

<comment><USER8> Citizens United has got to be one of the most misunderstood decisions of the Supreme Court.

If Citizens United loses that case, then there would be little standing in the way of, for example, prohibiting the NY Times from running stories critical of presidential candidates within 90 days of the election.

Why? Because the NY Times is a corporation. If the Supreme Court held that corporations don't have standing to claim First Amendment protections, then the NY Times wouldn't be protected either.

<comment><USER9> > Citizens United has got to be one of the most misunderstood decisions of the > Supreme Court.

> If Citizens United loses that case, then there would be little standing in > the way of, for example, prohibiting the NY Times from running stories > critical of presidential candidates within 90 days of the election.

They could have decided the case on much narrower grounds. They could have returned it as improvidently granted. The majority wouldn't have had to conclude that "this Court now concludes that independent expenditures, including those made by corporations, do not give rise to corruption or the appearance of corruption".

I do think there were interesting 1A claims in play, and I don't know how to handle those well. But the decision as written is just naive.

<comment><USER8> The court had to rule that way to protect the First Amendment. Otherwise you're reasoning that it's "corrupt" to say something nice about someone out loud, just because that person might hear you and decide to be nice to you. Again: recall that The NY Times spends a lot of money to say things out loud every day.

<comment><USER9> As I said, I don't know the right answer about the 1A claim. I suspect a factually narrower ruling would have entirely been possible.

But they _definitely_ could have ruled exactly the same way without making the insane "do not give rise to corruption or the appearance of corruption" comment.

That's just entirely absurd, and I think it's fairly obvious that it factually is wrong.

Nor did they have to rule the way they did in speechnow vs FEC, which is largely the case that people think about when talking about Citizens United.

<comment><USER8> Imagine a law that says "you're free to speak, and spend money speaking, but if you mention an elected official, you might get prosecuted for corruption." How is that free speech?

<comment><USER9> How about reacting to what I actually wrote?

<comment><USER8> I am. I'm trying to illustrate why that opinion of the court is not actually absurd or insane.

You might not like its implications, but there are other, worse, implications if merely speaking about a subject (e.g. a candidate) can be considered a form of corruption.

<comment><USER10> If money is speech, then how are any constraints on campaign spending possible? But the Supreme Court has maintained some constraints, so it's a practical judgment call, balancing free speech against the potential for corruption. They didn't have to draw the line where they did in Citizens United.

<comment><USER11> Of course there can be restrictions on campaign spending ( _i.e._ classical bribery). Free speech has never been a defense to crimes like bribery, fraud, etc., that incidentally involve speech. But the situation in _Citizens United_ came nowhere close to that. It was core political speech. The money wasn't a campaign donation, it was used to create and distribute a political movie about a candidate. If the Supreme Court didn't draw the line there, it would have obliterated the line.

<comment><USER10> Citizens United was 5-4, yet it was a sweeping decision that obliterated several decades of election law and bent political advertising expenditures to match the accelerating inequality of wealth distribution in the US. The world would not have ended if, as was originally expected, the court had made a more narrow ruling.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Gorsuch dissent is interesting. His position seems to be that the court's decision is not strong enough in its defense against these searches, not that he disagrees that a warrant is needed.

<comment><USER13> That makes me wonder why he didn't sign on and write a concurring opinion then.

<comment><USER12> I'm no laywer, let alone qualified to interpret the SCOTUS, but from what I can tell he disagrees with the whole approach taken, which relies on the "expectation of privacy" test defined in the _Katz_ case, whereas he believes that the court should go back to the Fourth Amendment text itself and review the data (such as the phone's location) under it. Specifically, he seems to be saying that just because the data is currently held by a third-party, that doesn't mean it's not the person's "papers" and as such fully defended from unreasonable searches.

<comment><USER14> That's true, but it fails to mention that there is a very specific partisan reason republican justices won't get behind a privacy finding. Gorsuch isn't standing for abstract principle here, he's refusing to stand on the same ground the found for Roe.

<comment><USER15> Roe standing on _expectation of privacy_ seems to be a similarly poor analogy.

The real missing piece goes back to the same fear the framers had when enacting the Bill of Rights in the first place — namely that by enumerating some rights it would inadvertantly serve to exclude those unenumerated but equally inalienable rights, such as right to self-determination and ownership of one's own body.

<comment><USER16> With respect to _Roe v Wade_ , the expectation of privacy has already been established with your doctor. Since there are legitimate, non-trivial reasons for abortion, and that's a decision between a person and their doctor, the gov't can't ask why someone may need that abortion. Therefore, the gov't is unable to discern between reasons for an abortion, and therefore can't restrict them (up to a reasonable point, which was set non-arbitrarily around 24 weeks). You have a right to patient confidentiality. The gov't has no more of a say in whether you should have appendix surgery than whether you should have an abortion.

However, this doesn't establish a right to abortion. The justices clearly state that it is not a right by saying it's not covered under the 9th.

<comment><USER15> Thank you for that. Not to get too off topic, but I will need to read more about the reasoning behind the RvW decision.

It sounds to be threading one hell of a needle as a justification to keep government out of elective abortion. I mean, we have databases which track every narcotic prescription written which law enforcement (including the DEA) can access _without a warrant_.

<comment><USER16> It's really not a fine line. Narcotic dissemination is a major problem and there are justifiable reasons for tracking them, but I don't believe that tracking forces an individual to justify a decision between their doctor and themselves to the gov't. The justices did say there could be justifiable reasons limitations on abortions as well, just that it is very difficult to enumerate because politicians are not doctors.

<comment><USER15> > I don't believe that tracking forces an individual to justify a decision > between their doctor and themselves to the gov't.

That appears to be exactly what it's doing though!

<comment><USER17> Practically, while you can share your prescription medications with another person, abortions are not transferable.

The registry is not supposed to about who has a prescription, but rather, who has more than their legitimate share of prescriptions. It's also supposed to be used to identify over-prescribing doctors.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> I'd just like to raise a point that isn't discussed enough:

Requiring a warrant is an extremely low bar to pass. Yet somehow law enforcement has been moving away from even that cursory glance since 9/11\. We keep seeing these arguments about how burdensome warrants are, but judges routinely rubber stamp every warrant request that comes across their desk.

The reality is that this has nothing to do with "warrant Vs. no-warrant" that's just the headline, when crimes are suspected warrants are trivial to get. The fight really being had here is "warrant Vs. routine monitoring."

That's what law enforcement want from this: If you know someone that knows someone that might have committed a crime, they want to invade your privacy "just in case." As I said, if you were directly tied to it a warrant is easy, they want to expand the scope of monitoring.

<comment><USER19> Warrant means an audit trail and coordination with a prosecutor and the judiciary.

That's a good thing, as it creates a virtuous cycle. There is accountability and more transparency, vs an internal process where the whims of an official, or a failure to have adequate controls inevitably leads to problems.

<comment><USER20> _" Warrant means an audit trail and coordination with a prosecutor and the judiciary. ... There is accountability and more transparency"_

Who's actually auditing these people and holding them accountable?

When was the last time someone lost their job because they issued too many warrants, or were too lax in issuing them?

Is a warrant more than just a rubber stamp?

 _" Supreme Court asks surveillance state to wear a fig leaf"_ might be a more accurate title.

<comment><USER21> It is my opinion that just having to ask a judge for a warrant makes law enforcement officers do a lot more work than if they could just invade someone's privacy as a matter of due course. I don't think I've heard of any judges getting fired for issuing too many warrants, but judges occupy a special place in our society: they are people learned enough in the law of the land that we invest in them the power to adjudicate disputes. The assumption is that the judges hold themselves to a higher standard.

</comment></comment></comment></comment><comment><USER22> [https://www.supremecourt.gov/opinions/17pdf/16-402_h315.pdf](https://www.supremecourt.gov/opinions/17pdf/16-402_h315.pdf)

For those who have not read a supreme court opinion before, I recommend it. They are written in plain english and understandable by laypersons, and usually very well written.

<comment><USER23> Gorsuch's dissent is straightforward english and lays out his thoughts and what he thinks is also a possible way forward. I only skimmed through the prior dissents and decision though.

<comment><USER22> Although my initial reaction was to strongly agree with the decision, I find the dissents much more interesting and Gorsuch's analysis compelling.

This case may have made a mess of things. Maybe the right answer here is for Congress to clarify what the digital equivalent of a safe deposit box is.

</comment></comment></comment><comment><USER24> While I am happy about this ruling, I feel like it does not go far enough at protecting our privacy. Call me cynical if you want, but there are two things that are causes for concern for me.

1\. The article says "Roberts noted that the decision also allows for warrantless cell-tower location information searches in emergencies and for national security purposes."

This leaves the door open for any agency to claim that any historic GPS data was obtained for "national security purposes".

This is troublesome because if the government is abusing their power there is no way to hold them accountable since they do not have to explain the specific reasons for accessing the data if doing so will "compromise national security". It is a bit of a loophole in my opinion.

2\. Another article ([https://www.cnet.com/news/supreme-court-says-warrant- necessa...](https://www.cnet.com/news/supreme-court-says-warrant-necessary- for-phone-location-data/)) mentioned "While the decision sets a ruling for historical GPS data, the Supreme Court said it does not apply to security cameras, business records or real-time location tracking."

This means that any other data can still be obtained without a warrant under the CLOUD act which passed just a couple months ago.

[https://www.eff.org/deeplinks/2018/03/responsibility- deflect...](https://www.eff.org/deeplinks/2018/03/responsibility-deflected- cloud-act-passes)

<comment><USER9> > 1\. The article says "Roberts noted that the decision also allows for > warrantless cell-tower location information searches in emergencies and for > national security purposes."

FWIW, that's not how I read Robert's opinion. He said that this decision didn't decide those (at least partially because it wasn't the question presented).

> This means that any other data can still be obtained without a warrant under > the CLOUD act which passed just a couple months ago.

Isn't the stored communications act much more meaningful than CLOUD here?

</comment></comment><comment><USER25> This NPR article was incredibly light on details. Here's the full record: [https://www.supremecourt.gov/opinions/17pdf/16-402_h315.pdf](https://www.supremecourt.gov/opinions/17pdf/16-402_h315.pdf)

<comment><USER26> The full record is a 120-page decision, including 4 separate dissenting opinions, that came out less than an hour ago.

Do you really expect a full digestion of the opinion in that time frame?

<comment><USER25> I'd expect a bit more from a news company that makes the claims on journalistic prowess NPR does, like a brief summary on what grounds the judges wrote their dissents.

Took me all of 5 minutes to ctrl+f through the doc and find each record.

To save you some time, the issue seemed to be that the individual does not create, maintain, or store the records in question, so the 4th amendment does not apply in this instance.

<comment><USER27> NPR's standard of understanding before putting it in the article is likely a little higher than having a reporter skim and a Ctrl+F, especially in the era of "fake news" accusations.

<comment><USER28> If you actually have a writer who is already familiar with the legal aspects of the case, you can put out insightful analysis very quickly (cf. SCOTUSblog). Instead, we live in a world where the NPR journalist (Nina Totenberg) has just about every legal journalism award you can receive but doesn't have a law degree and is most famous for legal soap-opera material (e.g., revealing which supreme court justice had smoked marijuana).

[https://en.wikipedia.org/wiki/Nina_Totenberg](https://en.wikipedia.org/wiki/Nina_Totenberg)

The reason there's no analysis here is because there isn't a market for it.

<comment><USER27> The "legal soap-opera material" demonstrated his background check had missed something, and wound up in the nominee withdrawing his nomination. Single- handedly torpedoing a SCOTUS nomination seems like pretty meaningful reporting.

Expecting journalists to have second degrees in law isn't a reasonable standard, if for no other reason than the financial burden it'd inflict on an already fairly low paid profession. (Hell, many _lawyers_ struggle with their law school loans.) Chances are she's cultivated plenty of legal minds to help with analysis - perhaps even one or more of the justices themselves.

<comment><USER28> You misinterpret. First, the point isn't that marijuana use isn't important, the point is that this class of reporting is orthogonal to legal analysis. It would be as if the most famous professional football players were fantastic comedians but never played ball in college. Second, a law degree is a reasonable (albeit imperfect) standard if legal analysis is desired; that it would be hard for journalists to obtain this just tells us there's no market in it. (That is, people with legal training are not rewarded.) Law degrees are also super expensive to obtain for people who just want to do legal aid, but such lawyers need the training nonetheless because they actually have to understand the law to do their job. Legal journalists do not.

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> From the decision: "This decision is narrow. It ... does not address other business records that might incidentally reveal location information" and "We hold only that a warrant is required in the rare case where the suspect has a legitimate privacy interest in records held by a third party."

Looking side-eyed at the definition of "legitimate privacy interest", because I would think that any request for almost any business records of a person would involve it.

</comment><comment><USER22> Why isn't there some kind of "privileged access" test? If the third party gives the information to anyone upon request, it should be considered less private than if the police need to "ask" for it.

Not in an absolute sense. A concerned citizen might want to be helpful to police by providing them lots of information, and that shouldn't need a warrant. But it seems like a pretty strong signal that, if the police are asking for it, it is more likely to be private.

</comment><comment><USER30> Does this outlaw stingray use by police? If I am near a suspect and they get all calls in the area, I would be tracked unlawfully?

<comment><USER31> I've been skimming but I don't think the data stingrays collect would count as "business records" since they are actually (AFAIK) intercepted communications.

Of course, I think they should be subject to the same restrictions and oversight. It's encouraging that the SCOTUS seems to be recognizing (to some degree) the relatively new and uniquely horrific potential of unchecked electronic surveillance.

</comment></comment><comment><USER15> I wish they had gone further. In the modern age the concept of data hosted or stored with a "third party" is no longer useful in its entirety.

It's questionable to me that where the bits are stored is even a relevant component of a multi-prong test, let alone an overriding factor.

The way the bits are accessed is certainly relevant but the location of the network attached hard-drive should have absolutely zero bearing.

This would have squared up well with the issue of offshore data warrants which got punted off the docket after new legislation was enacted to provide a compromise solution to that specific issue.

In any case, a great step in the right direction.

<comment><USER9> > I wish they had gone further. In the modern age the concept of data hosted > or stored with a "third party" is no longer useful in its entirety.

ISTM that that's much more a task for the legislative branch than SCOTUS. Now congress is also defunct to a significant degree, but there's some limits to what you can infer from the constitution...

> The way the bits are accessed is certainly relevant but the location of the > network attached hard-drive should have absolutely zero bearing.

Hm, but that's not really the question, is it? Email _contents_ , and likely online storage contents, already has a warrant requirement.

</comment></comment><comment><USER32> I haven't read the opinion, but what I need to know is what is meant by "obtaining"? I really hope it was made clear that it is even getting the data, not just looking at it or accessing it. This is a crucial difference. More importantly, it could put legal burdens on companies to ask for a warrant before providing this information.

Also: "the decision also allows for warrantless cell-tower location information searches [...] for national-security purposes." Sigh.

<comment><USER33> and for 911 calls. So in theory, if there's a case involving a 911 call, that location information can be used without a warrant.

</comment></comment><comment><USER34> The NY Times coverage says it's very limited. Roberts wrote:

 _"We hold only that a warrant is required in the rare case where the suspect has a legitimate privacy interest in records held by a third party "_

IIRC the current 4th amendment interpretation, 'third party doctrine' says that is a rare situation. However, Roberts also wrote:

 _"While the third-party doctrine applies to telephone numbers and bank records, it is not clear whether its logic extends to the qualitatively different category of cell-site records," he wrote. "After all, when Smith was decided in 1979, few could have imagined a society in which a phone goes wherever its owner goes, conveying to the wireless carrier not just dialed digits, but a detailed and comprehensive record of the person's movements."_

 _"When the government tracks the location of a cell phone," the chief justice wrote, "it achieves near perfect surveillance, as if it had attached an ankle monitor to the phone's user."_

Also, this seemingly ignorant comment from Kennedy (i.e., it seems a meaningless distinction), though he's not quoted and a brief summary so it is prone to misunderstanding:

 _In dissent, Justice Kennedy wrote that GPS devices provide much more precise location information than do cell towers._

[https://www.nytimes.com/2018/06/22/us/politics/supreme- court...](https://www.nytimes.com/2018/06/22/us/politics/supreme-court- warrants-cell-phone-privacy.html)

</comment><comment><USER35> How much does that help in practice? The judicial branch has a history of taking the police's word without too much push back on the flimsiest of evidence.

<comment><USER36> By requiring warrants, they're involving the judicial branch.

Before, government investigators were dealing directly with the communications providers and bypassing judicial oversight.

<comment><USER35> The judicial branch is just going to rubber stamp anything that the police say they want.

<comment><USER36> Yes, but now the police have to do the work of asking, which is better than nothing.

<comment><USER37> AND a judge has to put their name on it. Granted, IDs of judges are kept secret for certain courts, BUT nothing stays secret forever, e.g. Stasi records in the former DDR.

</comment></comment></comment></comment></comment><comment><USER38> "As technology has enhanced the Government's capacity to encroach upon areas normally guarded from inquisitive eyes, this Court has sought to 'assure[ ] preservation of that degree of privacy against government that existed when the Fourth Amendment was adopted.' _Kyllo v. United States, 533 U. S. 27, 34 (2001)._ "

This is a sensibly balanced way of thinking about the Fourth Amendment.

</comment><comment><USER39> Does anyone know if and how this would affect cellphone companies who sell location data to data brokers?

[http://www.latimes.com/business/la-fi-verizon-location- data-...](http://www.latimes.com/business/la-fi-verizon-location- data-20180619-story.html)

You practically can't opt of this or are often unaware given the complexity of an average app's TOS.

<comment><USER40> The decision seems to be pretty narrowly focused on law enforcement and rules of evidence, so it shouldn't stop practice from continuing.

<comment><USER41> How would this affect law enforcements ability to use data they bought from telcos?

<comment><USER40> IANAL, but the way I read it they would not be able to use that data without a warrant, which will likely mean that law enforcement will no longer be paying for a third party when they could just use the warrant to get it directly from the telcos. (Unless the telcos don't have historical data but a third party does? Either way, a warrant would be required to gather that data without risking jeopardizing the entire case.)

</comment></comment></comment></comment><comment><USER42> Third-party doctrine has been on borrowed time since at least Jones with Sotomayor's concurrence. Carpenter paves the way for moving the legal understanding of privacy beyond narrow property talk and the ill-suited third- party doctrine.

</comment><comment><USER43> So does this Supreme Court ruling mean that when the Oakland Police and FBI used a Stingray to locate an attempted murder suspect without a warrant their actions were illegal? We must hold the FBI accountable for their violation of the 4th Amendment.

[https://arstechnica.com/tech-policy/2017/07/fbi-didnt- need-w...](https://arstechnica.com/tech-policy/2017/07/fbi-didnt-need-warrant- for-stingray-in-attempted-murder-case-doj-says/)

</comment><comment><USER44> There should be another ruling. 3 letter agencies should also need a warrant to track cell phones too.

Basically, this ruling means nothing in the grand scheme of things. We are being tracked without our permission & the police can probably get as much info from the US government agencies by just asking for it.

</comment><comment><USER45> I listen to the local police radio a bit, and if the caller is on a cell phone; they usually have the location of said phone.

I might be misreading, but if they need a warrant to track, wouldn't they need a warrant to get a singular location for an actual 911 emergency?

<comment><USER46> Phase 2 location data for 911 calls can be legitimately treated differently as there is no expectation of privacy necessary when dialing 911 for help.

</comment></comment><comment><USER47> Wow, something that makes sense. Fair for the average citizen. I can't believe it.

</comment><comment><USER48> I would be ok with fishing with CSLI data for crime sprees and other applications.

The shit part about this is that this ruling is going to be very visible and people are going to try to make this data useless.

</comment><comment><USER49> "Secure in their persons, houses, papers and effects" is the text of the amendment so my guess is this counts as persons? Didn't get a chance to read the judgement

<comment><USER50> I believe in another decision they extended the idea that a Phone is becoming part of a person.

<comment><USER51> That's silly. A phone is clearly papers.

Paper has become digital.

</comment></comment></comment><comment><USER52> Does this even matter knowing that police can just purchase location data from carriers like we recently found out (securus) ?

</comment><comment><USER53> Can someone explain why a warrant under the federal Stored Communications Act is easier to obtain?

<comment><USER54> The order under the SCA is not a warrent, and doesn't have the same standard of proof.

Specifically 18 U.S. Code § 2703 means the government can request location information [1] with a court order as described by (d). The standard for the court order is "reasonable grounds to believe that the contents ... are relevant and material to an ongoing criminal investigation".

reasonable grounds << probable cause

[1] under (c)(1)(D) as the cell location is not ljisted (c)(2)

<comment><USER53> that's interesting, but one could assume that if some member of a gang points out the leader of the gang to the police, the court would allow them to employ surveillance techniques needed to acquire evidence. Wouldn't that kind of information be sufficient to pass the Probable Cause test?

</comment></comment></comment><comment><USER55> O like the faceless judges that grant thousands of warrants? There's no accountability and it's absolutely criminal. [https://youtu.be/yVwAodrjZMY?t=7m31s](https://youtu.be/yVwAodrjZMY?t=7m31s)

</comment><comment><USER56> Disgusting that it only passed 5-4.

<comment><USER57> I'm somewhat heartened that 6 Justices were in agreement that cell records should be protected from warrantless lookups.

Gorsuch appears to have dissented because he disagreed with the rationale of the decision and felt the 4th Amendment protections should be far stronger.

<comment><USER58> > Gorsuch appears to have dissented because he disagreed with the rationale of > the decision and felt the 4th Amendment protections should be far stronger.

In that case why did he write a dissent and not a concurring opinion? Isn't that what they are for, or have I misunderstood?

<comment><USER59> It's my impression that Supreme Court justices write their opinions however the hell they want... as a practical matter if the votes were going the other way he probably would have written a "dissenting concurrence" rather than a "concurring dissent".

</comment></comment></comment></comment><comment><USER60> The ethical side of this discussion in Law Enforcement is a never-ending debate.

</comment><comment><USER61> shouldn't that apply to companies too?

<comment><USER12> No, the Fourth Amendment only applies to the government. You'd need to pass a new law prohibiting companies from doing the same.

<comment><USER62> > the Fourth Amendment only applies to the government.

Source? The way I read it there doesn't seem to be any such restriction.

IIRC there weren't corporations in the modern sense when the bill of rights was written.

<comment><USER26> The Constitution is binding only on the government; it is a document that lays out what the United States federal government, and, in a few cases, what the states of the United States can and cannot do.

The Bill of Rights is a set of 10 amendments that restrict what the federal government can do with respect to citizens. The 14th amendment extends those restrictions from the federal government to include state governments as well. (Since local governments are considered extensions of the state government's jurisdiction, it's included as well).

> IIRC there weren't corporations in the modern sense when the bill of rights > was written.

The Virginia Company is a corporation in the modern sense that is literally the origin of the United States. Actually, if anything, corporations have gotten less powerful since the Bill of Rights; we don't have any companies running countries any more.

</comment></comment></comment></comment><comment><USER63> ... in the US.

</comment><comment><USER64> Token HN conservative here. If you ever get curious about the conservative moment please don't hesitate to email me. There's a lot of interesting debate going on in the Bay Area, but it's sort of subterranean for obvious reasons.

<comment><USER65> I'm less liberal than many, but I'm curious how the conservative movement feels issues like climate change and clean oceans and clean air, or even net neutrality ought to be dealt with, if not by govt regulation. Or is the line of thinking that only those rich enough to buy face masks, and have climate controlled mansions with private beaches may enjoy those things.. Maybe this is entirely orthogonal to this thread, so maybe there could be a separate HN thread just for this discussion? I welcome your suggestion and am wholly on board but I really don't think individually emailing you is the most productive method to have, what is in fact, a wide ranging discussion with multiple participants.

<comment><USER66> >I'm less liberal than many, but I'm curious how the conservative movement feels issues like climate change and clean oceans and clean air

Generally, via Pigovian taxes that internalize the externality consistently without creating additional distortions or utilizing arbitrary ad-hoc regulation — ideally in a revenue-neutral way via dividends.

See, for example, the Trent Lott-John Breaux group announced this week to push for the Baker-Shultz carbon dividend plan (supported by economists including former CEA chairs Greg Mankiw and Martin Feldstein and Fed chairs Ben Bernanke and Janet Yellen).

(It should be noted that the Clean Air Act and the formation of the EPA came under _Richard Nixon_ , of all people.)

[0] Americans for Carbon Dividends (new group, political): [http://www.afcd.org](http://www.afcd.org)

[1] Climate Leadership Council (old group, academic): [https://www.clcouncil.org](https://www.clcouncil.org)

[2] AFCD Article: [https://www.nytimes.com/2018/06/19/climate/carbon-tax- climat...](https://www.nytimes.com/2018/06/19/climate/carbon-tax-climate- change.html)

[3] This year's op-ed on AFCD: [https://www.nytimes.com/2018/06/20/opinion/climate-change- fe...](https://www.nytimes.com/2018/06/20/opinion/climate-change-fee-carbon- dioxide.html)

[4] Last year's op-ed on CLC (economists): [https://www.nytimes.com/2017/02/08/opinion/a-conservative- ca...](https://www.nytimes.com/2017/02/08/opinion/a-conservative-case-for- climate-action.html)

[5] Last year's op-ed on CLC (politicians): [https://www.wsj.com/articles/a-conservative-answer-to- climat...](https://www.wsj.com/articles/a-conservative-answer-to-climate- change-1486512334)

<comment><USER67> If that approach truly had broad support among conservatives, it likely would have been implemented by now. (I consider myself very liberal and am a strong supporter of such an approach.) But the reality is that a plurality of US conservatives still (as of 2015) believe that the impacts of climate change will never materialize. [https://news.gallup.com/poll/182807/conservative- republicans...](https://news.gallup.com/poll/182807/conservative-republicans- alone-global-warming-timing.aspx)

<comment><USER68> The Baker-Shultz plan was written in February 2018 so it's going to take some time until it is finally implemented. Also, a lot of hard-core party line Republicans are old and hold the same beliefs from decades ago. These are the conservatives who believe that climate change is all a hoax. When they die, their voices and beliefs will phase out and the voices of the new evolving GOP will phase in. Just my two cents.

<comment><USER67> Older Americans are overrepresented among climate change deniers, but not overwhelmingly so. As of 2014, 44% of climate change deniers are under 50, and 77% are under 65 [0]. So most will still be around for several decades. More concerning to me are those who will acknowledge the impacts of climate change but balk at the costs of addressing it, further delaying action. And of course, even if and when a global consensus is reached that significant action is needed, that action will take years or decades to take effect.

In the meantime, how many trillions of dollars will we spend to address relatively immediate impacts such as flooding in coastal regions and changes in growth patterns for crops? And how many trillions of dollars will we add to the cost of reversing climate change's effects - if it's even possible to reverse them at all? Not to mention non-economic consequences like the disruption of marine ecosystems.

[0] [https://news.gallup.com/poll/168620/one-four-solidly- skeptic...](https://news.gallup.com/poll/168620/one-four-solidly-skeptical- global-warming.aspx)

</comment></comment></comment></comment></comment></comment><comment><USER69> Title: which world country are we talking about? Oh, right... ;)

</comment><comment><USER70> Wow, this site has the best GDPR-compliance solution I've seen so far!

[https://text.npr.org/s.php?sId=605007387](https://text.npr.org/s.php?sId=605007387)

Zero JS, zero CSS, just HTML as it was originally intended. Love it!

<comment><USER71> Look again, there's a bit of javascript in it.

<comment><USER70> Just to remind you where you've came from.</comment></comment></comment>


Solar and wind met nearly 9% of U.S. power demand in 2018 - <AUTHOR> https://pv-magazine-usa.com/2019/02/28/solar-wind-met-over-9-of-u-s-power-demand-in-2018/ <comment><USER2> We're looking into solar for our home. Payback is around a decade (in Michigan), while the components are warrantied between 12 years (invertor) and 24 years (panels). They should last much longer than that: the invertors typically fail like most electronic components (either in the first six months or so, or not for a very long time), while the panels are still above 90% of initial output after 50 years (again, with any catastrophic failures usually occurring early).

The 30% tax credit in the U.S. is scheduled to start winding down next year, so anyone interested in doing it should make sure their installation commences before the end of 2019.

<comment><USER3> I'm not sure where you got that >90% after 50 years metric from. I was under the impression degradation per year is about 0.8%. Which should make the panels drop below 90% of initial in 13 years itself.

<comment><USER2> Depends on the manufacturer, by the looks of it: [https://news.energysage.com/how-long-do-solar-panels- last/](https://news.energysage.com/how-long-do-solar-panels-last/)

.3%/year would be 85% after 50 years, so I was off by a bit.</comment></comment></comment>


Gmail.com being MITM'd by Iran using this certificate - <AUTHOR> http://pastebin.com/ff7Yg663 <comment><USER2> Posting from Iran, Im really worried about the current security status. Iran's opposition mostly exists on internet these days and its very seriously flawed.

Man In The Middle attacks are increasing and users usually ignore error messages about them. (Firefox throws an error dialog but it has an 'I understand the risks' button. People just ignore the error).

Also, last year many Iranian FriendFeed users were arrested and the goverment knew about all their private discussions on FriendFeed. (FriendFeed has been censored since the beggining. But it suddenly became uncensored for a day or two. On the other hand, FriendFeed generates an 'auth' key for each user and lets him see his RSS feed using that key. And puts the auth key in every page: goverment probably collected auth keys and used it to read discussions of people they arrested)

Goverments using internet to spy on their civilians is not a myth. Anonymity, trusting the cloud and related issues seem far more important when you suddenly find out a friend of yours has been arrested and his location and charges is unknown.

<comment><USER3> "Man In The Middle attacks are increasing and users usually ignore error messages about them"

Note that the reported MiTM attack should _not_ result in a popup warning, because the CA certificate used in the MiTM is supposedly technically valid. Does anybody know which browsers include this CA? Browser vendors should consider removing it based on ethical concerns, especially if this MiTM attack is being performed very broadly, at the country level.

<comment><USER4> Mozilla is spinning up new releases to remove the cert.

See [http://blog.mozilla.com/security/2011/08/29/fraudulent- googl...](http://blog.mozilla.com/security/2011/08/29/fraudulent-google-com- certificate/)

Instructions on how to delete it yourself are available at [http://support.mozilla.com/en-US/kb/deleting-diginotar-ca- ce...](http://support.mozilla.com/en-US/kb/deleting-diginotar-ca-cert)

<comment><USER5> They really ought to add a search field to that list view.

</comment></comment></comment></comment><comment><USER6> So help me understand...

A government agency in Iran has obtained the private key of the root certificate for the DigiNotar Certificate Authority. And with that, they can decrypt and re-encrypt SSL traffic by pretending that they have the valid SSL certificate for *.google.com.

Is that the way this works?

<comment><USER7> That's one possibility, and quite scary because someone with that private key could hijack any SSL connection to any site, not just Google. More likely is that Iran caused DigiNotar to issue them a valid .google.com certificate via social engineering, bribery, or hacking. This is slightly less scary because only .google.com would be affected.

Either way, IMHO DigiNotar's root certificate should be revoked and they should be barred from participating in the CA system ever again. The seriousness of SSL MITM attacks is such that a "one strike and you're out" policy is warranted. With so much commerce running over SSL these days, possession of the private key of a CA's root certificate would allow you to implement plots worthy of a James Bond supervillan.

<comment><USER8> In fact, guess what: [http://blog.mozilla.com/security/2011/08/29/fraudulent- googl...](http://blog.mozilla.com/security/2011/08/29/fraudulent-google-com- certificate/)

<comment><USER7> Great! I'm glad DigiNotar will be punished for this lapse. Too bad it takes a code update to revoke their certificate. This won't be the last CA compromise we see.

<comment><USER9> "This won't be the last CA compromise we see."

Indeed. I strongly suspect too that it's only "the first one we've seen", and not "the first one".

I have very little doubt that most nation-state sized adversaries have the ability to forge whatever certs they want. It's only careful use of those forged certs (or dumb luck) by the agencies using them that have kept them out of the blogosphere...

<comment><USER7> Yeah, if NSA doesn't have at least one root CA key they're not doing their jobs. What we need is an alternative to the centralized CA system, like TOFU POP MONK.

<comment><USER10> They do, and it isn't even hiding. Take a look in your cert store and you will see multiple DoD root CAs.

<comment><USER11> I just checked, and at least with firefox, I didn't see any. What are you referring to exactly?

<comment><USER10> Odd, my OS X machine has 2 of them listed. I don't see it in firefox though.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Do we actually know how many SSL certs Google uses, and for what?

From what I can see:

\- Google Search & Google+ (<https://encrypted.google.com/> <https://plus.google.com/>) are using a *.google.com from GeoTrust/Google Internet Authority

\- Google Mail (<https://www.google.com/accounts/>) is using a www.google.com from VeriSign/Thawte

Ofcourse I'm also afraid that this is indeed a MITM attack against Iranian users.

With SSL certs that costs less than $15 you can expect that things cannot be thoroughly checked, however a Wildcard DigiNotar SSL cert is costing you € 750 a year (in a 4 year contract [http://diginotar.nl/OnlinePrijsindicatie/tabid/1417/Default....](http://diginotar.nl/OnlinePrijsindicatie/tabid/1417/Default.aspx)), you would expect that these things would not be possible.

If they however hacked the root CA, it's even more scary, also Vasco (the mother company) makes virtually every Two-factor authentication used for Dutch Banking..

<comment><USER13> Scary indeed. Also responsible for authentication of DigiD, online taxes, pension funds, Chamber of Commerce, Ministry of Security and Justice, local governments, etc.

<comment><USER14> Didn't check it myself, but apparently DigiD for instance is on a different CA/root. DigiD is the Dutch "unified account" for all online government services: you can take out student loans, submit taxes, etc.

<comment><USER13> [http://www.diginotar.nl/Aanvragen/Lopendeprojecten/DigiDMach...](http://www.diginotar.nl/Aanvragen/Lopendeprojecten/DigiDMachtigen/tabid/2059/Default.aspx) They have this listed as an active project, so they are definitely involved. Could still be on a different CA though. And of course _if_ they were hacked.

</comment></comment></comment></comment><comment><USER15> If you want to disable diginotar's root CA on your Mac (for Safari/Chrome) you can open Keychain Access, select the "System Roots" keychain at the top left, find the diginotar certificate in the list, and delete it (or disable it, which is what I did).

EDIT: This definitely works for Safari, not 100% sure if it does for Chrome after all.

<comment><USER16> $ sudo dpkg-reconfigure ca-certificates # for debian-based systems

<comment><USER17> I've always wondered what that package is actually used for, because programs like firefox, chromium, &c, maintain their own list of root CAs.

</comment></comment></comment><comment><USER18> This type of compromised-CA attack is why I never understood why browsers don't use the OpenSSH model: accept and store (prompting for confirmation) the certificate the first time you connect to a site, then throw up enormous red flags if the certificate ever changes.

The Firefox root CA list has dozens and dozens of organizations on it. Could a compromise of any one of them mean that this attack could be repeated?

<comment><USER19> Because that security model means that a compromised ISP can permanently MITM you the first time you visit a site on any computer for the first time. In exchange for losing the single points of failure, it creates a constant stream of opportunities to break the trust model.

You may think that's a good tradeoff. I don't, but reasonable people can disagree about it. However, it's completely untenable for financial information, because attackers after financial information aren't laser targeted and are perfectly happy with a constant stream of compromised sessions. Remember what TLS was designed for in the first place.

<comment><USER20> Wrong.

The OpenSSH model implies that you check the fingerprint of the public key before you send encrypted data using that key. That is why SSH shows you the fingerprint of the server key when you first connect, and you have to answer "yes" in order to accept the key and add it to your keyring. You are supposed to have talked to the person managing the system and that person should have given you the fingerprint of the key.

It is virtually impossible for the ISP to intercept and sniff the stream without changing the fingerprint.

The user still has to trust its SSH client.

<comment><USER19> "Wrong! Random people will totally verify key fingerprints when they're logging into Google Mail at Starbucks! After all, that's what every sysadmin does with SSH, right!"

<comment><USER20> gmaslov is clearly talking about the OpenSSH trust model. You are confusing it with the Trust On First Use model, which is not the same thing.

<comment><USER19> I have no idea what you are trying to express here. "Trust On First Use" is a synonym for key continuity. The fact that you have to type "yes" when SSH does it and click a series of buttons when a browser does it doesn't change anything.

I think you think that "Trust On First Use" means "automatically accept keys the first time you hit a site". In fact, that's only true in practice. Presumably everyone's going to get the "Watch Out! This Could Be Iran!" dialog from their browser, too.

</comment></comment></comment></comment></comment></comment><comment><USER21> Chrome users should be protected from this by the public key pinning feature [<http://www.imperialviolet.org/2011/05/04/pinning.html>], right?

<comment><USER22> Sounds like it. But this isn't an architectural solution. All this does is layer an additional level of "trust" requirements onto the existing protocol. The "pinning whitelist" is isomorphic to the root CA list and can be compromised in exactly the same way.

</comment></comment><comment><USER23> A quick check of Bugzilla didn't turn up a bug directly about this issue, but <https://bugzilla.mozilla.org/show_bug.cgi?id=681902#c6> from one of the people who deals with CA issues at Mozilla mentions "the current DigiNotar incident", so they clearly know about it.

<comment><USER24> It took 3 months to get their customers transferred over to this new cert. <https://bugzilla.mozilla.org/show_bug.cgi?id=622589> I wonder if the CA was compromised since earlier this year, or if it's more recent?

</comment></comment><comment><USER10> I'm confused about how this was detected. The original report provided this screenshot:

<http://i.imgur.com/hs0H4.jpg>

If it is a case of a root CA signing a cert for someone else, this shouldn't have actually produced an error. What did the MITMers screw up here?

<comment><USER25> Chrome feature, as noted here: <https://news.ycombinator.com/item?id=2938905>

</comment></comment><comment><USER26> Found a pastebin with slightly more info: <http://pastebin.com/SwCZqskV>

</comment><comment><USER27> if root is compromised it sounds promising :

[http://www.vasco.com/company/press_room/news_archive/2011/ac...](http://www.vasco.com/company/press_room/news_archive/2011/acquisition_diginotar.aspx)

"...DigiNotar is an official Dutch certification authority, capable of issuing, validating and registering certificates (identities) of Dutch nationals and entities that are recognized throughout the European Union and are used to authenticate government applications. As such, DigiNotar provides VASCO with a strong foothold in the Dutch eGovernment market with the potential to expand the product line to government applications in other countries. Currently, DigiNotar's market scope for its CA activities is limited to the Netherlands. VASCO may decide to introduce DigiNotar as a certification authority in other EU countries...."

all that security was riding on 10M euros (with such [meager] amounts in play, one would think that it would be easier for a player like Iran just buy an authority than to crack/hack it, though seems like VASCO was faster (if of course VASCO isn't in the game as well) :) :

"...VASCO acquired DigiNotar in stock and asset purchase for aggregated cash consideration of Euro 10.0 million..."

what is the cost in Netherlands to have a reasonably secure office building with some access controlled areas suitable for CA authority core operations? Sounds like very cheap.

<comment><USER14> You forget their possible debt...

<comment><USER27> nope. VASCO is a NASDAQ-ed "Inc" and would have mentioned any additionally assumed materially important liabilities in the official press release.

</comment></comment></comment><comment><USER28> In order to mitigate attacks like this Firefox users can use: <http://convergence.io/>

<comment><USER29> There's also another, similar, project called Perspectives: <http://perspectives-project.org/>

The Syrian government was doing this recently as well: [https://www.eff.org/deeplinks/2011/05/syrian-man-middle- agai...](https://www.eff.org/deeplinks/2011/05/syrian-man-middle-against- facebook)

Oh and don't forget about the EFF's SSL Observatory: <https://www.eff.org/observatory>

</comment></comment><comment><USER30> I checked and the cert from gmail.com for me is from Thawte. Is this a targeted attack toward only those in Iran?

<comment><USER8> I think so. This kind of thing are almost always targeted attacks.

<comment><USER31> The Thawte certificate is the certificate issued to google by request of google. This certificate is apparently being used to MITM connections to gmail that originate inside Iran. Outside of Iran BGPing a major ISP into routing through them, or setting up a standard "phishing" mirror site, no one outside of Iran should worry much.

It still is a good idea to blacklist that root certificate on your internet devices though. If this certificate is being used, who knows what other websites it has issued legitimate but malicious certificates for.

<comment><USER22> No one outside of Iran should worry about this particular google cert, you mean.

The obviously compromised root CA shipped by default in every computer in operation is something we very much _should_ worry about. Who else has access to DigiNotar's cert? Surely there are players out there willing to pay more than Iran is...

<comment><USER32> Of course you should worry. The attacker may have sold the cert to other parties, not just Iran. Or if it was Iran directly, they may sell the certs to other parties to make a pretense of deniability.

</comment></comment></comment></comment></comment><comment><USER24> OK, how do we remove this CA from our computers?

<comment><USER33> In chrome looks like you can't remove it, but at least you can disable the use of that CA to identify sites,ecc... from preference>manage certificates.

<comment><USER34> Chrome uses whatever the OS uses, as far as I can tell. Preferences > Manage Certificates just opens up the Keychain Access app. Upthread are instructions for how to do it from there.

</comment></comment></comment><comment><USER35> What are the implications of this? It is potentially unsecured to visit gmail.com from anywhere? Is this web-interface only, or is IMAP/POP access also vulnerable?

<comment><USER36> The consensus seems to be that Iran is poisoning intra-country connections to attach this certificate to gmail.com instead of the real certificate, so this would only be occurring where Iran controlled the network infrastructure. Since the certificate is signed by a trusted CA, no warning is provided to the user that the certificate may be unsafe.

GMail still shows a certificate issued by Thawte for me (in the USA).

<comment><USER27> >The consensus seems to be that Iran is poisoning intra-country connections

more precisely they can poison any traffic (CA-ed by Diginotar) that passes through the routers/wires under Iran's control, that can be anything what they have already hacked into before as well as just redirected traffic using BGP similar like this

[http://www.washingtontimes.com/news/2010/nov/15/internet- tra...](http://www.washingtontimes.com/news/2010/nov/15/internet-traffic-was- routed-via-chinese-servers/)

Btw, aren't China and Iran collaborating usually? There is potential for synergy.

</comment></comment></comment><comment><USER37> Assuming this certificate stuff is legit, how do we know this is being done by Iran? What makes anyone think this is Iran?

<comment><USER23> The claims reported in various places suggest that people in Iran have actively observed this certificate used in MITM attacks on gmail connections. No hard evidence yet, and no idea what original source people keep repeating (possibly the pastebin itself).

</comment></comment><comment><USER38> If your communications can land you in jail or get you killed don't use the internet (or even a computer, keystroke loggers are easy to install and very hard to detect), no matter how clever you think you are, and no matter how many 'lock' icons appear in your browser.

In such cases paranoia is perfectly justified.

It's a real pity this requires a code update because that means that the change will take long to propagate and will likely never be really complete, at the same time I'm sure there are good reasons for that and that an automated process to revoke just any certificate could itself probably be used as an attack vector.

What would happen if they simply revoked the root certificate that was used to sign this fake?

</comment><comment><USER24> Here's a bug report from the user who originally noticed it: [http://www.google.co.uk/support/forum/p/gmail/thread?tid=2da...](http://www.google.co.uk/support/forum/p/gmail/thread?tid=2da6158b094b225a&hl=en)

</comment><comment><USER13> Update on Dutch news site nu.nl (without references or sources, so I can't confirm where they got this information from).

[http://translate.google.com/translate?tl=en&u=http%3A%2F...](http://translate.google.com/translate?tl=en&u=http%3A%2F%2Fwww.nu.nl%2Finternet%2F2603449%2Fmogelijk- nepsoftware-verspreid-naast-aftappen-gmail.html)

Fraudulent certificates were given out for:

().mozilla.org (backdoored software?)

().wordpress.com

().torproject.org

().yahoo.com

And Baladin (an Iranian social network)

</comment><comment><USER39> I am no hacker so I have almost no idea what's going on.

MITM = Man In The Middle.

Does this mean that Iran is eavesdropping on gmail users IN Iran? Or outside their country too?

Does anyone mind sharing what this means to the end user?

I did block the certificate on my Air as wxs mentioned. <http://news.ycombinator.com/item?id=2938755>

<comment><USER32> Yes, this fraudulently-issued certificate is being reported seen in the wild from users of Iranian ISPs. It has not been reported anywhere else.

If you were using an Iranian ISP to log in to *.google.com, you may have been hacked.

<comment><USER39> Thanks for explaining that, kind sir.

</comment></comment></comment><comment><USER40> Anyone can tell us if this is for real or a hoax? I am lacking sufficient ssl knowledge here...

<comment><AUTHOR> Mikko Hypponen of F-Secure seems to think that it is real: <http://twitter.com/#!/mikkohypponen>

</comment></comment><comment><USER41> This attack could of hit people in other countries as well. Small well places malicious BGP updates can reroute traffic into Iran.....

</comment><comment><USER42> SSL snake oil. SSL and the percieved trust around it has to die. It's a big lie, especially with broken CAs, lax security, poor encryption due to international policy and several technical and conceptual flaws.

Some critique here to back me up:

[http://www.theregister.co.uk/2011/04/11/state_of_ssl_analysi...](http://www.theregister.co.uk/2011/04/11/state_of_ssl_analysis/)

<comment><USER43> And the solution is? Getting everyone on to PGP/GPG? Explaining to the general public what a web of trust is and actually get them to use it in the correct fashion (rather then clicking 'trust' the same way they click through all dialog boxes)?

<comment><USER19> The irony here is, if you want "web of trust", you _already have it_ ; just remove all the certs from your browser and trust sites selectively.

<comment><USER44> Where's the "web" in that? Web of Trust is supposed to be a system where users 'tell' each other what they trust, forming a 'web' of trust links.

<comment><USER19> So when the certificate error comes up, ask your friends whether they trust it. You are talking about a web application that is almost "hello world" in Django or Rails.

<comment><USER44> So, build it. Then make it secure enough that any schmuck won't be able to hack it and serve fake 'trusts'. Then decentralize it so that governments like Iran's can't MITM it. Then solve the problem of having a single organization deploying thousands of fake nodes and poisoning the data.

After you've done that, yes, it'll exist.

</comment></comment></comment></comment></comment></comment><comment><USER45> So Google wrote Stuxnet?</comment>


Scientists Confirm 'Impossible' EM Drive Propulsion - <AUTHOR> https://hacked.com/scientists-confirm-impossible-em-drive-propulsion

<comment><USER2> That is a very misleading title. At first I thought it was confirmed that the propulsion was impossible... After reading the article, turns out it _is_ possible, it's just that it should not be.</comment>


Rage Disorder Linked with Toxoplasmosis (2016) - <AUTHOR> https://www.scientificamerican.com/article/rage-disorder-linked-with-parasite-found-in-cat-feces/ <comment><USER2> Toxoplasmosis is an extremely interesting parasite. I wouldn't be surprised if it is recognized as an important public health issue in the coming decade.

Is has been linked to all sorts of disorders, including schizophrenia and bipolar disorder. Prof. Jaroslav Flegr contributed many important studies, especially in the early stages of toxoplasmosis research [1]. He was also featured by an Atlantic article, which was one of the first to bring public attention to the field of research [2].

One particularly interesting finding is how it interacts with the RH factor. It might explain the relative stability of the distribution of the two types in the population even though one of them should have a serious disadvantage (birth complications) [3].

The hard question is how to prevent it. Due to how many different infection vectors there are, the only sound pieces of advice are "eat your meat well done" and "avoid getting in contact with garden soil". Development of a vaccine for cats is a promising solution since the parasite can only be transmitted by cats.

[1]: [https://web.natur.cuni.cz/flegr/publ.php](https://web.natur.cuni.cz/flegr/publ.php)

[2]: [https://www.theatlantic.com/magazine/archive/2012/03/how- you...](https://www.theatlantic.com/magazine/archive/2012/03/how-your-cat-is- making-you-crazy/308873/)

[3]: [https://web.natur.cuni.cz/flegr/pdf/rhWho.pdf](https://web.natur.cuni.cz/flegr/pdf/rhWho.pdf)

<comment><USER3> After learning about the perverse incentives for publishing scientific papers, I find it extremely difficult to trust new research. Any tips for reversing this mindset? I know it's not too great to be feeling this way.

Scientists have immense incentives for publishing new results. As someone quipped, "there is no cost in getting something wrong; the cost is not being published."

Toxoplasmosis in particular seems intuitively like the perfect combination of new research plus massive prestige for whoever publishes papers on the topic. And we can't trust articles written on the topic either; they do little more than parrot whatever the scientists say, and don't really cast a critical eye on the methodology or findings.

Which makes sense. I mean, how could they? None of us are experts the way a scientist is an expert. But it used to be a hobby of mine to dig through research papers and find subtle inconsistencies. Take fatal familial insomnia, for example. It's not fatal due to the insomnia. That's a misnomer. But the fact that it wasn't related to the insomnia was buried on the 7th page of the report as basically a footnote.

I don't know. I just wish it were easier to take a lot of this at face value.

<comment><USER4> >Toxoplasmosis in particular seems intuitively like the perfect combination of new research plus massive prestige for whoever publishes papers on the topic

Eh, not really much prestige, but perhaps lots of press.

The big thing is to not take any single paper as "scientific truth" like what you read in a textbook. The scientific literature is not a textbook, it's the place where science's self-correction happens. Things in text books have been battle-tested, and widely accepted usually due to replication. And even then, textbooks have errors and perpetuate some falsehoods! Any individual scientific paper will not even likely be replicated, because it's working on something that did not turn out to be fundamental to the path of science.

Scientific papers in the literature are how scientists share their small steps while exploring the n-dimensional world. That n is very high, so there are lots of directions to explore, and most of them will not be that interesting. If it is, somebody else may decide to take a look too. If it's a hot-topic, then many many people will. Scientists have to operate in a world where they are exploring what is and is not true, and their relationship with uncertainty is strong; it's absolutely essential to embrace uncertainty.

The biggest thing is to distrust news reporting about science. It's correct about 1% of the time. The motivations of a reporter trying to somehow make an interesting article by deadline on a topic they don't understand are far more distorted than the scientists publishing a paper they expect 30-50 people to ever read. And that's if you actually get a real reporter to look at these things; most articles are just press releases that are cut and pasted from a university press lackey into the newspaper's publishing system. Those are usually even worse.

<comment><USER5> > And that's if you actually get a real reporter to look at these things; most > articles are just press releases that are cut and pasted from a university > press lackey into the newspaper's publishing system. Those are usually even > worse.

Actually if the researchers expect the paper to be high impact they will often provide the press release to the University's press department themselves - these types of press releases are merely a layman directed abstract and tend to be reasonably OK.

This raises two interesting points.

1\. Sometimes the lowest quality newspapers have the best quality article on a given publication.

2\. Why aren't all research publications required to be accompanied by a second abstract written in plain low jargon language that can be understood at some level by someone with high school science?

<comment><USER6> I think maybe it depends a little bit on which university it is: perhaps a small university will not have enough money to hire a big dedicated PR office, so they will rely more on materials submitted directly by the scientist and stick closer to reality. But the PR offices of big universities (in particular MIT) put out pure hype which is very precariously connected to reality. A lot of work goes into these press releases (they will send someone from the PR office to interview the researcher and so on), but the work is not really aimed towards providing an accurate summary of the research...

<comment><USER7> As an MIT graduate I sadly concur with this statement.

</comment></comment></comment></comment></comment></comment><comment><USER8> Joe Rogan has talked about this at length on his show several times, and had Robert Sapolsky as a guest to talk about this.

They actually say the parasite causes rats to become sexually attracted to cats, causing them to pass on to the cat once it's inevitably killed. Life sure does find a way.

[https://www.youtube.com/watch?v=NroiGfNohPo](https://www.youtube.com/watch?v=NroiGfNohPo)

<comment><USER9> If you're starting a family, consider these words from Robert Sapolsky:

"The parasite my lab is beginning to focus on is one in the world of mammals, where parasites are changing mammalian behavior. It's got to do with this parasite, this protozoan called Toxoplasma. If you're ever pregnant, if you're ever around anyone who's pregnant, you know you immediately get skittish about cat feces, cat bedding, cat everything, because it could carry Toxo. And you do not want to get Toxoplasma into a fetal nervous system. It's a disaster."

"There's a long-standing literature that absolutely shows there's a statistical link between Toxo infection and schizophrenia. It's not a big link, but it's solidly there. Schizophrenics have higher than expected rates of having been infected with Toxo, and not particularly the case for other related parasites. Links between schizophrenia and mothers who had house cats during pregnancy."

[https://www.edge.org/conversation/robert_sapolsky- toxo](https://www.edge.org/conversation/robert_sapolsky-toxo)

<comment><USER10> Can also really fuck up your eyes

[https://aapos.org/client_data/files/2015/1230_fig2congenital...](https://aapos.org/client_data/files/2015/1230_fig2congenitaltoxoscar.jpg)

<comment><USER11> And when you have that black hole very close (or over) that light part, it means that your toxo lesion is over the sport where all your eye nerves go, and then you become blind. Or almost, depending the exact position. Or you are "cured" but keep seeing eye floaters for the rest of your life.

</comment></comment></comment></comment><comment><USER11> The treatment for Toxo isn`t a easy one: when thing get serious you take massive doses of pyrimethamine and sulfadizine, for example, and have to take extra folinic acid (not folic, folinic).

And it won't kill all T. Gondii, it will remain latent inside your body.

There were some studied, few years ago, about combining pyrimethamine and aminoacids to kill the latent toxo, but I didn't find the results, if it even worked or not.

For almost everybody, infection will go away without signs. For few others, it will make you remember it for the rest of your life.

<comment><USER12> Thank you for this explanation! I listened to a long radio special about behavior assuring parasites a long time ago. Toxoplasma Gondii played a big role in the report and ever since I've been dumbfounded why we don't treat it. Even though it doesn't seem to have a negative immediate health benefit behavior alteration especially towards higher risk taking is terrifying to me. Thanks to your explanation of the cost of treatment this makes more sense.

</comment></comment><comment><USER13> They say about 20 percent of the US population has been infected and then we see this:

The research team found that 22 percent of the people with IED tested positive for toxoplasmosis exposure, compared with only 9 percent of the healthy control group. About 16 percent of the group with other psychiatric disorders tested positive for toxoplasmosis, too.

So the people with IED had about the same rate of infection as the general population. This looks to me like one of those "nothing to see here" situations based on the numbers.

<comment><USER14> Maybe not. That 9% number for the control group stands out. That number and the 20% number for the population as a whole seem to me to be incompatible - or, perhaps, measured in different ways.

If the 9% healthy and 22% with IED are both accurate (and the 20% number is the one that's off), then there may in fact be something to see here.

</comment></comment><comment><USER15> Years ago I attended a lecture on Toxoplasmosis gondii. Intriguing (unattributed) points made by the scientist: 1) there's a higher prevalance of infection in car crash victims than control 2) by hijacking dendritic cells (blood immune cell), the parasite is able to bypass the blood brain barrier (highly protective filter of brain) 3) once in the brain, it may form cysts that may lay dormat 4) a significant portion of the world population is infected 5) if have cats weren't allowed as pets, there would hardly be any T. gondii infections

</comment><comment><USER16> Toxoplasmosis is naturally contracted from cat exposure and care.

Anecdotally I see mentally ill people as being drawn to cat ownership for their personal comfort and fascination. [https://en.wikipedia.org/wiki/Louis_Wain](https://en.wikipedia.org/wiki/Louis_Wain)

It is a difficult leap to go from saying "people with certain mental illnesses own cats, and thus are likely to have TP" to "TP causes mental illness".

If we are to believe cat owners are more likely to have mental illness, a correlation of mental illness and TP serum positivity follows naturally.

<comment><USER17> Are you saying people with mental illness seek comfort via pets (cats). Shouldn't we see an affinity for other social pets besides cats?

<comment><USER18> You could probably answer this question using this resource [1].

However, someone used it to show no associations between psychotic episodes (specifically) AFTER controlling for other factors (that are associated with cat ownership)[2].

Using the adjustments they made, I could wildly speculate that possibly dog owners will be less likely than cat owners to have mental illness, because dogs require a certain amount of wealth, living space, etc - and the lack of these things is associated both with cat ownership and mental illness, maybe, just not in rural areas...

[1][http://www.bristol.ac.uk/alspac/researchers/access/](http://www.bristol.ac.uk/alspac/researchers/access/) [2][https://www.cambridge.org/core/journals/psychological- medici...](https://www.cambridge.org/core/journals/psychological- medicine/article/curiosity-killed-the-cat-no-evidence-of-an-association- between-cat-ownership-and-psychotic-symptoms-at-ages-13-and-18-years-in-a-uk- general-population-cohort/75C9A48B669BE36E947AFB0BC5CB00CA/core-reader)

</comment></comment></comment><comment><USER19> Note that toxoplasmosis is extremely common and is sufficiently benign for most people that it does not really warrant worry or concern from the general populace. There are more important and actionable factors affecting most of us.

<comment><USER20> Said the parasite!

</comment></comment><comment><USER21> Robert Sapolsky, a neuroscientist, talking about toxoplasmosis.

[https://www.youtube.com/watch?v=m3x3TMdkGdQ](https://www.youtube.com/watch?v=m3x3TMdkGdQ)

He touches on some very interesting observations that have been made about the infection and behavior.

</comment><comment><USER22> This is the same parasite that supposedly causes mice to become permanently unafraid of cats and attracted to cat urine.

<comment><USER23> There are videos showing mice going after cats and the cats know instinctively that there's something very wrong and they run away.

<comment><USER24> Do you have a link?

<comment><USER23> This is not the video I had in mind, but here it is [https://youtu.be/XQ4Y27RQaZk](https://youtu.be/XQ4Y27RQaZk)

</comment></comment></comment></comment><comment><USER25> > _It correlates also with diseases burden associated with bipolar disorder, > obsessive compulsive disorder, and epilepsy_

though the headline does not emphasize it, there's an OCD correlation too.

</comment><comment><USER26> It makes one wonder how healthy those home-grown salad vegetables might really be, given that a garden plot makes a convenient litter tray for roaming felines.

<comment><USER27> What makes you think commercial fruits & vegetables are any different? Nearly every farm has tons of feral cats around.

<comment><USER26> I must admit I didn't know about the feral cats wandering around farms. But I do imagine that farmers wash their produce more _consistently_ than home growers do, and that feline density is higher in the suburbs.

</comment></comment></comment><comment><USER28> I imagine people that grow up around stray cats are likely to have a different upbringing to people that don't.

<comment><USER29> That statement is a tautology. What exactly are you trying to imply by it, though?

<comment> racer-v I imagine GP is suggesting correlation as opposed to causation.

</comment></comment></comment><comment><USER30> This is consistent with research linking Toxoplasmosis with PMDD [0]

[0] [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5012242/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5012242/)

</comment><comment><USER31> So I had a thing with this as a young kid. It caused burn-like scars on my retina. No symptoms after that or vision changes. Did it alter my brain? I don't _think_ so. I will rage in my car when someone is in the left lane driving slow.

<comment><USER32> There is so much visual processing machinery in the retina that some neuroscientists describe it as an outpost of the visual cortex. In that sense, scarring your retina might indeed have altered your brain. But not in a way that's related to emotional control.

<comment><USER33> Your eyes are also an outgrowth of the neural tube.

</comment></comment></comment><comment><USER34> If it makes rats sexually attracted to cats, it may not be such a trivial disease.

</comment><comment><USER35> I can see attorneys using this as a defense going forward

<comment><USER17> Honorable Members of the Jury, you can clearly see that my client couldn't possibly be responsible for his actions, as he just ingested a Twinkie with a Soft Nougatie Cat Feces Filling!

</comment></comment><comment><USER36> reversible? or permanent brain function change?</comment>


CEO salary =  0,5 * board of director salary (No logic at all in Belgium) - <AUTHOR> http://translate.googleusercontent.com/translate_c?depth=1&nv=1&rurl=translate.google.be&sl=auto&tl=en&u=http://m.nieuwsblad.be/cnt/DMF20131220_013&usg=ALkJrhh0tix6h4ymi6KyMi73zEzydNImZA

<comment><AUTHOR> Some explanation, Politicians limited the salary for ceo's of public companies where the governement has 51 % of the stocks. Interesting fact, there is a politician in the board of the directors.. oh yeah, there are elections soon...

Remember the county with the world record without governement. Jup, that was Belgium :-)</comment>


Tragically Lost in Joshua Tree's Wild Interior - <AUTHOR> https://www.nytimes.com/interactive/2018/03/22/magazine/voyages-joshua-tree-lost-hiker.html <comment><USER2> This article is behind a "soft" paywall so I'm unable to view it. It would be nice if there was at least a "soft" policy that discouraged this.

<comment><USER3> Is about the problem that rescuers face in national parks with lost people and some attempts to use computers to recreate their most probable route (taken as a binary tree of decissions in each forking path point). Some nice infra-red photos also of Yuccas and the park at night. An interesting article</comment></comment>


Quirky files for bankruptcy and Wink is being sold - <AUTHOR> http://blog.wink.com/wink-blog/2015/9/22/wink-corporate-update <comment><USER2> End of IOT era again! What was the name of IOT at dot com boom?</comment>


Cost Analysis: Trubrain Proprietary Nootropic Blend vs. Generic Equivalent - <AUTHOR> http://johnback.us/blog/2013/08/06/cost-analysis-trubrain-proprietary-nootropic-blend-vs-generic-equivalent/?ref=hn <comment><USER2> Regardless of whether you make it yourself - is there anything to this truBrain thing? Is this something we should all be doing? I'm looking for opinions/experiences from the HN community in general.

</comment><comment><USER3> This was a nice breakdown of the unit costs, but I surprised by the author's conclusion. Even with a cheap value for his time ($25/hr), he's only saving about $15 dollars a year.

That said, kudos for explicitly including labor/time costs in the calculation.

<comment><USER4> I think you should also consider the risk of getting bored when you do everything yourself. If the stuff really helps, you might not want to risk stopping because it's too much work.

<comment><USER5> It's a hassle. I took a full stack of nootropics daily (a larger stack than what's described here, close to 20 pills / day) for about a year and ultimately just decided it was too much hassle. There are benefits, but laziness overruled. I may actually try this since having it all prepackaged for me is completely worth the difference in cost.

</comment></comment></comment><comment><USER6> It's funny to me that no one has ever claimed to have accomplished anything globally significant while using nootropics to my knowledge.

Mood elevators or stimulants, sure. Hitler was all into those. But, nootropics? I mean, I guess it depends on where you draw the line of what is considered one.

<comment><USER7> Coffee. (Although I'm not totally sure that's considered a nootropic in this context.)

<comment><USER8> Nicotine.

Adderall.

Again, probably not nootropics, but they serve the same function: wake your brain up enough to accomplish something you may not have had the cognitive ability to do without it.

</comment></comment></comment><comment><USER9> Concurring with javert, an analysis of Trubrain's effectiveness would be awesome. e.g. conclusion that Trubrain increased my grades by x%, etc.

Even subjective observations would be interesting albeit not as persuasive.

Thanks for the cost analysis btw, very thorough job.

</comment><comment><USER10> Curious how this compares to something like Modafinil, or other Nootropics?

<comment><USER11> TruBrain gave me a month's supply to try it out ([http://www.gwern.net/Nootropics#trubrain](http://www.gwern.net/Nootropics#trubrain)) and I'd say that, as one would expect since it's not including any heavy-duty stimulants, the effects are weaker than modafinil or nicotine. I think it's more effective than just a normal piracetam+choline stack, but it's hard to be sure. (But on the plus side, it's legal and doesn't come with any concerns about legality (for modafinil) or addiction/social-disapproval (nicotine).)</comment></comment>


Taxpayer Subsidies Helped Tesla Motors, So Why Does Elon Musk Slam Them? - <AUTHOR> http://www.motherjones.com/politics/2013/10/tesla-motors-free-ride-elon-musk-government-subsidies

<comment><USER2> Puff piece.

Focuses on Musk's gently stated opinion that carbon taxes are "a better way" than subsidies for green technology.

Skip it.

<comment><USER3> But... slam?

</comment></comment><comment> jack-r-abbit Is a loan from the government that was fully repaid the same thing as a subsidy? I thought a subsidy was a grant of free money to services the government felt were important enough to keep afloat when they are unable to do so on their own. A loan is... well... a loan. Am I missing something here?

<comment><USER2> The subsidies for consumers buying electric cars that Tesla benefits from. Tesla markets it as a discount when talking about their TCO.

<comment> jack-r-abbit OK. Then this article is horribly written. This text is clear as mud. It reads to me like they are calling the loan a subsidy: _Shortly after paying off his $465 million loan, Musk proclaimed that government should no longer provide such assistance. A "carbon tax would be a better way," he tweeted, adding: "Yes, am arguing against subsidies and in favor of a tax on the end bad created. Market will then achieve best solution."_ It isn't until the 3rd page (really? 3 pages?) that they start making their actual point about the subsidized batteries ans what not.</comment></comment></comment>


Former Sysadmin Accused of Planting "Time Bomb" in Company's Database - <AUTHOR> https://www.bleepingcomputer.com/news/security/former-sysadmin-accused-of-planting-time-bomb-in-companys-database/ <comment><USER2> This seems like the sort of crime that the CFAA was intended for. He was a trusted insider for 14 years, and then this. Also, he obviously wasn't very competent if he didn't consider that the MAC address of the laptop would be logged and traceable to him.</comment>


Placebo Button - <AUTHOR> https://en.wikipedia.org/wiki/Placebo_button

<comment><USER2> One of many articles that's reposted to HN monthly.</comment>


FreeBSD, Building a Computing Cluster - <AUTHOR> http://www.youtube.com/watch?v=BpsRb9fJ4Ds

<comment><USER2> My iPad says "could not load movie"

EDIT: on my desktop it works though!</comment>


Former Sanders Aide Jailed in Belarus Is Being Tortured to 'Confess' - <AUTHOR> https://www.vice.com/en_us/article/ep4w9m/former-sanders-aide-jailed-in-belarus-is-being-tortured-to-confess-to-things-he-didnt-do-wife-says <comment><USER2> > She said Vitali traveled to Belarus "simply" to visit his mother, who is > suffering from advanced cancer. After observing an obligatory two-week self- > quarantine, Vitali stepped out to buy his mother a watermelon, dressed in > shorts and flip flops. He was grabbed off the street on July 29, and driven > 300 kilometers to a detention center, Heather wrote.

</comment><comment><USER3> > _Belarusian authorities accuse Vitali of organizing an illegal campaign > rally in the city of Grodno for jailed opposition leader Sergiy Tikhanovsky > on May 29, a charge that could land Vitali in prison for three years._

"[Sergiy Tikhanovsky] is considered by Amnesty International to be a prisoner of conscience. He is known primarily for his activism against the government of Belarus's long-serving president, Alexander Lukashenko. In May 2020, he announced his intention of running for the 2020 presidential election, but he was arrested two days afterwards." \- [https://en.wikipedia.org/wiki/Sergei_Tikhanovsky](https://en.wikipedia.org/wiki/Sergei_Tikhanovsky)

Belarus sounds like a great place.

</comment><comment><USER4> > The former aide to Sen. Bernie Sanders locked up in a Belarusian jail is > being pressured to confess to crimes he didn't commit, his wife says.

A reliable source if I've ever heard of one.

<comment><USER5> Are you inplying that a man isn't being tortured and is lying about it due to connections to a particular American senator?

<comment><USER6> I think it meant: of course his _wife_ says he's innocent.</comment></comment></comment>


Status of Google Chromium ports - <AUTHOR> http://googlemac.blogspot.com/2008/09/platforms-and-priorities.html

<comment><USER2> "I spent a good half hour on Jay Is Games, as _flash games_ tend to push browser & system perf to its limits"

 _cringe_</comment>