Js;dr = JavaScript Required; Didn't Read - <AUTHOR> http://tantek.com/2015/069/t1/js-dr-javascript-required-dead <comment><USER2> Not everyone surfs the web with Lynx. Whilst I understand the need for websites to stand the test of time and be "curlable", there are still many 'appy' websites out there that fall back to plain HTML when we need it. I'm a big fan of archival services like Pinboard which I have been running now for 3-4 years under an archival account ― it has terabytes of raw HTML data that I can peruse at any time and do a full text search for any page. The bulk of those pages are very JS dense pages that somehow, through some wizardry on the site's backend; have managed to preserve some text for me to read. GoogleBot struggled with this not so long ago, but can now crawl fragmented URIs with a hashbang in them, as if the page was a normal HTML page. I suspect GoogleBot is a stripped down Chrome that renders the page and does a scrape. Infact GoogleBot has been proven to execute JS. SEO and search aside, there is (hopefully) some server black magic that detects browsers like Lynx and then serves us some 'neckbeard text'. Webapps which are not doing that are probably not worth your time anyway.Also noteworthy:

[http://christianheilmann.com/2011/12/06/that-javascript- not-...](http://christianheilmann.com/2011/12/06/that-javascript-not- available-case/)

Also, there are great proposals by the W3C to get webapps working without the need for JS. A lot of the behavior you see now in webapps could be done with simple HTML tags.

<comment><USER3> It's not just Lynx users. I surf the web with NoScript (a FireFox extension to block java script on a per-domain basis, the sake of security). That also enforces "js; dr". Some pages show absolutely _no_ content unless you allow JS from their domain, and perhaps others. I often don't bother; just back button out of there and go somewhere else.

<comment><USER2> Yeah but adblockers, noscript, and other privacy plugins break the web. As such, they are not a magic bullet. Many of these plugins are well intentioned, but only address the problem at a surface level. I like to surf the web with no addons. By "surf" I mean properly surf and having hundreds of tabs open. I want to see a page the way the site author intended it to be, untainted by plugins. A lot of the privacy issues you see in browsers are fingerprinting issues related to useragent strings, cookies, and IPsec (or lack thereof). This is trivial to address with VMs, VPNs, and private sessions.

</comment></comment></comment><comment><USER4> Thanks. I'll be sure to post this for websites that won't show anything with NoScript on.

</comment><comment><USER5> ironic since the language used to retrieve this immortal data you speak of, will be javascript

<comment><USER2> follow up: [http://blog.higg.im/2015/03/22/the-futility-of-building- full...](http://blog.higg.im/2015/03/22/the-futility-of-building-full-js- websites/)</comment></comment>


India creating new identity card system for 1.2Bn people - <AUTHOR> http://www.economist.com/world/asia/displaystory.cfm?story_id=13962574

<comment><USER2> Wow, they are going to be the first country to self-consciously grapple with all kinds of fascinating privacy issues that emerge from this kind of system. In most countries, as far as I know, privacy depends on the crappiness of government IT and the difficulty of systems integration. It's mostly accidental. In a powerful, well-designed system, you have to _decide_ to have privacy. This is an exciting prospect -- India is by far not the worst country to be investigating these issues. They are democratic and are familiar with the problems of corrupt officials. I think people in countries where corruption is not a problem are too willing to trust the good intentions of their government officials. It's very educational to see how ruthless and venal people are when systems are not in place to stop them.

<comment><USER3> I'm curious which countries your are thinking of where government corruption is _not_ a problem?

<comment><USER2> In the US, citizens don't have to pay bribes, perhaps with the exception of getting government business. You don't have to pay bribes to get a marriage license, get a crime investigated, get your garbage collected, get fair treatment in court, or get your child admitted to a good school.

Larger-scale, more obscure corruption thrives. Everybody knows that most political campaign contributions are made with the expectation of a return on investment. If you're an ordinary citizen, though, you don't have to worry about being shaken down by a bureaucrat or a traffic cop.

<comment><USER4> It is not just the basic facilities. Corruption hits in a lot of other ways also.

The traffic sucks because most traffic police are jerking off somewhere. If you want to get something done (e.g. setup a business) you should know someone with influence. A new risk in big cities is if you own a land there is a risk of the property being forcibly occupied by a thug and the police wouldn't do much.

<comment><USER5> Ambani(Relience fame) built an empire in the same country where you live in. Don't blame the system.

<comment><USER4> If you read the comment properly - I am not blaming the system. Only pointing the current ills in it and hoping he UID scheme cuts down at least some of them.

</comment></comment></comment></comment></comment></comment><comment><USER6> I had predicted here ( [http://cycle-gap.blogspot.com/2009/06/all-honourable- men.htm...](http://cycle-gap.blogspot.com/2009/06/all-honourable-men.html) ):

"As the good old days of inflated head counts and billing rates comes to an end for Indian outsourcing companies, the big outsourcing companies will bid for, and push for huge local government projects."

It's amazing how uncritically such huge projects are treated by the press in India - privacy issues, potential conflict of interest for the person leading this effort (Nilekani). Public discussion in India in general is very worshipful of proposals like this or the usage of voting machines - there is little to no discussion of the meta issues like privacy, corruption, etc.

<comment><USER4> Nilekani is the current CEO of Infosys. He has already stated he is going to step down from Infosys before taking up the effort to create an India wide UID. Bidding for this mega project will be an international one, with some Israeli companies already showing interest (in addition to Indian majors like Infosys, TCS, Wipro...).

So the question is not as much as about conflict of interest as it is about the success of the project. This will be the third such attempt - Seshan's voter ID, the PAN card and now the UID.

From anti-corruption point of view, this is really going to be helpful. Any government aid etc can be tracked using the UID (i.e. to see who the beneficiary was). Currently a majority of such funds are eaten up by the politicians and bureaucrats. So perhaps that will get reduced. As a state, India is currently a failure: perhaps the UID will help make some ammends.

The implementation is going to be a challenge - currently there are options that are doing rounds: a smart card approach or using a mobile sim card (a govt reserved security domain in every sim card - the sim ID can act as a proxy for UID).

<comment><USER7> Actually he has long stepped down as a CEO of Infosys. He, however, continued to wield the title of co-chairman until now.

<comment><USER8> He has resigned now.

</comment></comment></comment></comment><comment><USER9> ID cards are a bad idea everywhere. Loss of privacy; loss of the presumption of innocence. Being required to produce the card by aggressive cops. Corruption and collusion between fat cats and government.

The cards will be hacked and sold on the black market almost immediately upon being released (if that ever happens -- it probably won't even after billions of rupees have been spent). Hence they'd make ID fraud and terrorism easier, not harder.

The article mentions 20 different forms of ID which are currently recognised. This sounds better to me. Historians, for example, prefer several pieces of evidence which can be cross-referenced to support a story rather than just one piece.

Just as it's not a good idea to allow private companies to collect data on people without their explicit consent, so it's a bad idea to let the government do so. Actually, it's an important check on government power not to let this happen. And I think many politicans involved in such schemes realise that ID projects won't reach completion. They either think it's a neat and simple idea, or in the worst cases they're out to build empires and make profit for their 'friends'.

</comment><comment><USER10> The article includes a good discussion of the governmental issues involved in implementing this plan in India. I'd love to see links to articles about this from the Indian press.

</comment><comment><USER11> Opinion piece in the Times of India: [http://timesofindia.indiatimes.com/Opinion/Columnists/SA- Aiy...](http://timesofindia.indiatimes.com/Opinion/Columnists/SA- Aiyar/Swaminomics/Netas-and-babus-can-outsmart-smart- cards/articleshow/4739109.cms)

</comment><comment><USER12> Instead of wasting(<http://tr.im/pX87>) 10,000 crores tax payers money on this UID project they could have issued PASSPORTS to all Indians at a nominal fee of 10 rupees.

<comment><USER4> No the allotment is only 100 crore in the first year.

</comment></comment><comment><USER4> For a project of this scale the India Govt. has allocated just above 20 million $ (100 Crore in India). Not sure what to say.

</comment><comment><USER13> 1.2 Billion cards? They better not use a smallint as a primary key then</comment>


Extensions for Google Chrome coming soon - <AUTHOR> http://blog.chromium.org/2009/05/extensions-at-google-io.html

<comment><USER2> Nice. Looks like we'll have a browser that has extensions that aren't an utter pain to write, and rocks on all fronts.

Chrome is looking like it's going to be as refreshing as fire(fox|bird|whatever) was back in the day - really, it already is if you ignore the lack of extensions.

This makes me giddy like a schoolgirl.

</comment><comment><USER3> Big plus for no restart!</comment>


Failure to recognize J. M. Keynes's work guarantees further crises - <AUTHOR> https://www.the-tls.co.uk/articles/jm-keynes-footnotes-to-plato/ <comment><USER2> On the contrary; it is our slavish devotion to Keynesianism that promises a continued future of boom and bust cycles:

Keynes vs. Hayek, Round 1 & 2:

[https://youtube.com/watch?v=d0nERTFo- Sk](https://youtube.com/watch?v=d0nERTFo-Sk)

[https://youtube.com/watch?v=GTQnarzmTOc](https://youtube.com/watch?v=GTQnarzmTOc)

</comment><comment><USER3> High unemployment means that people with money are buying too slowly and/or too non-uniformly.

The responsibility to spend money quickly/uniformly falls intuitively on the rich, and thoughtfully also with the poor. Everyone, truly.

This is the fundamental monetary-macroeconomic problem. How to guarantee the flow of money through everyone.</comment>


Show HN: Introducing Code Connect for Visual Studio - <AUTHOR> http://codeconnect.io/#

<comment><USER2> I watched the video and will try it out on a new and small project as a test.</comment>


CodePlex is Microsoft's free open source project hosting site. - <AUTHOR> http://www.codeplex.com/

<comment><USER2> And has been for years. News?

<comment><USER3> maybe cos of a redesign? looks different to when i last saw it?

<comment><USER4> nah, redesign's been around for a while.</comment></comment></comment>


Noutube: the most recently uploaded video on YouTube, before filters applied - <AUTHOR> http://noutube.net <comment><AUTHOR> Pretty cool thing I made. Can be boring, if its lots of Russian kids vlogging, but it's the only way I've found to see something 0.1ms old and YouTube themselves haven't even auto-deleted it yet. Twisted a couple APIs around...

You're guaranteed to be the first person to see that video. Murder count: 3. "Porn" count: too many. Definitely changes depending on the hour you watch, as well.

Refresh for the now-newest video. Enjoy...</comment>


Ask HN: What research areas would you consider if you were to start a CS PhD? - <AUTHOR> and why...? <comment><USER2> I encourage you to think in terms of what is achievable thiout a CS PhD. What areas don't tend to be dominated by PhDs, and what areas are dominated by PhDs.

My conclusion: Theory, algorithms, cryptography, and machine learning.

There are tons of world experts in operating systems, graphics, databases, distributed systems, compilers, programming languages, computer architecture, security, and HCI without PhDs. In fact, I would argue some of these fields are dominated by non-PhDs (see: Ken Thompson, Linus Torvalds, etc.) I don't see a lot of non-PhDs doing cutting edge work in CS theory, algorithms, cryptography, or machine learning. Probably because these fields involve lots of theory and mathematics.

Just a thought.

</comment><comment><USER3> HCI. The 'front-end' encompasses far more than just web dev, and some of it is quite interesting. VR? Smart cars? AI? People all need to interact with them.

Even standard web app problems can get quite complex on the UI. For example, recently I've had to use finite automona to verify that a combination of options on a form can result in all possible valid combinations. Since it was quite complex, I was worried that there was either: a) an invalid path in the options, or b) a valid but unreachable path.

</comment><comment><USER4> Machine Vision and Robotics are at a crossroads where fundamental research is starting to cross over into industry, but the technologies are still far enough away from the mainstream that a Ph.D will give you a huge advantage.

That said, if you just want to do a Ph.D but are struggling to figure out what to do a Ph.D in, I would seriously re-evaluate why you want to do a Ph.D.

</comment><comment><USER5> Maybe 'Crypto Smart Contracts', eg. Ethereum/BitShares- or 'Distributed Computing' eg. MaidSafe.

Why? Just personal preference, I think these are very interesting, & hold much potential.

</comment><comment><USER6> Quantum computing!

<comment><USER4> This is more in the realm of physics than computer science at this stage.

</comment></comment><comment><USER7> Compilers, it's an area that has held my interest for at least a decade.</comment>


Chrome, the Google Docs-mobile - <AUTHOR> http://www.pchristensen.com/blog/articles/chrome-gdocs-msoffice/ <comment><USER2> Here's the simple, god honest truth to why Google is making Docs as well as all the other apps they have. Because it makes people use google more! The more time people spend online, the more money google makes.

Why the hell are people coming up with complex theories on this. The whole reason Google is producing Android is because Google.com will be the fucking default page! Chrome was released, because Google.com will be peoples default page! Any search on Google gives them money, so they want people to search more.

It's an infinitely expandable market. When people spend more time on the internet, more advertising revenue goes into a smaller window. Hence why advertising in the half-time of the Superbowl costs companies millions, but if you advertise on another channel at the same time you'll get the best deal all year because no ones on any other channel.

The more people use google, the more advertisers spend money through google's AdSense. When the price to advertise goes up on the search page, google is making more money for just as much expense. There's only a limited amount of advertising space on a google search page, and the more it gets in demand, the more it's worth.

It can cost like $4,000 for an advert on a local cable channel. It cost $2.7 million per 30 seconds during the 2007 superbowl break, for the same time slot. Google doesn't want shitty little companies advertising for a few bucks a pop, they want adverts by Coca-Cola and Pepsi who are worth millions per advert.

<comment><USER3> That's not the entire reason. Firefox defaults to Google as the front page and as the search engine. Unlike Chrome, it doesn't even ask if you want to use a different search engine.

Of course AdSense is a part of it. But assuming that they needed to invent a browser just to get AdSense revenue is stupid. There's more to Google's strategy to that.

Docs: again, it's not just AdSense. It's letting Google index more. It's giving them primary control over content. No surprise Docs lets you publish directly to BlogSpot. It's all about keeping it in Google and giving it primary access to indexed material.

</comment></comment><comment><USER3> I've heard this argument thrown about before, and it really doesn't work for me.

First off, I'm fairly certain that Docs doesn't allow for offline editing yet, and that's a biggie. Google would want to have that in place before launching Chrome, if that was their goal. There would also be much more of an effort FROM Google to do this.

Second off, look at how Docs has been evolving. It's not being treated as a huge, money-throwing competitor. I mean, it's been passed by several document editors, most primarily Buzzword, and it's happened without Google making any sort of a fuss.

The method of saving documents is horribly inefficient. If you need an SSB for every single document, it's merely adding clutter and it's using a fairly inefficient task process to do so.

Frankly, I don't think that Docs is an Office competitor. I think that people who think that are deluding themselves. Docs is an effort by Google to hold more of your work and to index it. I've seen several people using Docs as a blog to distribute papers. That's what Google wants. It's like how they will give you links to Notebooks if you look for certain research information. They're going entirely the wrong way with Docs for it to work well.

If anything, I think they made Chrome to force everybody else's hand. Ultrafast Javascript, advanced script handling, Gears support: they're doing that so everybody else feels forced to catch up. I'd guess the goal of Chrome is to advance the web browser so that Google can make its own products more complex. Other theories ring hollow.

<comment><USER2> Oh man, you're hilarious. You're fairly certain Docs doesn't allow for offline editing yet? REALLY?!! They've offered it since May 2007 when they released Gears, that was the whole purpose of Gears to allow offline access to online content. It works in YouTube for gods sake, did you not even bother to read what Docs or Gears is before claiming knowledge about them?!

Why do you claim saving documents is inefficient, when a SSB of a document can be HTML, OpenOffice, PDF, RTF, TXT or Doc. I'm sorry, I'm failing to see how this is inefficient? I mean, how can it be any more inefficient than Office that makes a clutter of files without a users consent?

With Docs I have full access to my files anywhere, including offline. Then whenever I need it in an actual file format, I merely download it, which incidentally can be done whilst using offline mode. BTW, the application shortcut provided when allowing Docs to run through Gears actually defaults to offline access and connects if it detects an internet connection.

Oh and, here's the trumps of using Docs. The one time an error happened, I wasn't told the problem the error report was sent to the developers. And you know what, the error never happened again and I didn't have to wait till Office 2012 for the fucking fix! That's why Docs is better than Office, because it's not updated every half-decade and still a buggy CPU hogging piece of expensive crap.

<comment><USER3> I was under the impression that you could access files but not edit them. That was how it stood the last time I used Docs, and a version of Gears then wouldn't allow for editing.

I use "inefficient" because when I look at SSBs I tend to look at them as a whole. When you open an SSB, it creates a separate process for that one browser. (I haven't tried this with Chrome, but that's how it works in Prism, Safari 4, and Fluid.) That means, among other things, that when you go to pick default browser and other various browser commends, you get a cluttered list of documents taking up space where your various important browsers ought to take precedence.

Of course the SSB defaults to offline. Isn't that the point of Gears? I never suggested that Gears didn't work as mentioned.

And I've used Docs. I'm aware that there are good things to it. That doesn't mean that it has no flaws, or that it's actually a decent replacement for Office. It doesn't have nearly the power that Office does. That's where Microsoft excels. Every small thing you might ever need to do, you CAN do. It's bloated but it never lacks a feature. Docs still lacks a decent page arrangement tool. And I know that some people don't care about page layouts, but _that's the point._ Docs is extremely lightweight and it helps people who need a generic word processor. That doesn't make it an Office competitor. And I don't think it _wants_ to be an Office competitor, which is the point that I made when I posted.

I'm not saying this as an Office fanboy. I use TextEdit and Pages for my work. (I'm pretty sure that I can actually do more in TextEdit than I can in Docs, by the way: just to make a comparison point.) I use Dropbox to sync up my files, which is nice because it's much more intuitive when it's already installed on both computers, and because I get to use the more potent desktop editors.

I won't begrudge you the ability to make angry posts, but for the love of God: make sure you actually know what the other person was _talking_ about before you make an angry response. I used Docs intensively for 2 years with a group of people; I used Gears over the same period of time; I'm a huge fan of Chrome. I disagreed with the central point of this blog post. Not over everything this post mentions or stands for. Cool it a bit.

</comment></comment></comment><comment><USER4> While I think it's a great article Peter, I also think that Google's main incentive lies elsewhere. Incidentally Joel also wrote about this in his strategy letter V (<http://www.joelonsoftware.com/articles/StrategyLetterV.html>)

In my mind, what google tries to do with chrome is to commoditize the browser, which is a complementary product to their online services.

<comment><AUTHOR> I don't know, I'd say that browsers are already pretty commoditized. Pre- installed on every machine, several free alternatives available, etc. If anything, they're commoditizing Javascript processing, effectively giving a clock speed boost for internet usage.

But their pages are already the fastest pages on the internet, so it probably doesn't help them sell too many more ads just with speed.</comment></comment>


Heroku Free Dyno Hours - <AUTHOR> https://devcenter.heroku.com/articles/free-dyno-hours <comment><USER2> I'm sad about this change but can understand the need for it.

I run more than a dozen apps on herokus free tier and things have been great even considering their (gradually increasing) limitations on free dynos. This change could likely mean that I have to switch half of my apps to a self hosted server or competitor.

</comment><comment><USER3> I wonder nobody cares or just incorrect post time, so people can't see it? :) No more Heroku Free Tier fleets.

<comment><USER4> Had already been discussed ([https://news.ycombinator.com/item?id=11722329](https://news.ycombinator.com/item?id=11722329)) and I feel like many people probably are happy that they can have at least a dyno running 24/7 again.</comment></comment>


No stupid designer ~ No Photoshop, Go Sketch - <AUTHOR> http://forums.macrumors.com/showthread.php?t=1681801 How a newbie designer designed an app featured by App Store in 153 countries. <comment><USER2> I'd say it competes more with illustrator but i do love my sketch. It really does feel like the fastest way to put ideas together. It's the little things, like how you're not confined to a page when you open up a new doc or the layer management that includes the object grouping. There's still a few rough spots but the philosophy is bang on. And this is before you get to the price, which frankly makes illustrator's pricetag incomprehensible.

</comment><comment><USER3> I've had a similar experience with Acorn. I own the Adobe creative suite, but Acorn just gets out of my way. I've got enough to learn as it is.

</comment><comment><USER4> Just like saying you know how to program after learning basic Html & CSS.

Design is not on the visual, and certainly not on the app you use.</comment>


Telegram.org Bot Platform Webhooks Server, for Rubyists - <AUTHOR> https://github.com/solyaris/BOTServer <comment><USER2> author here, I'll be pleased to answer questions. feel free to share notes/feedbacks/criticisms! giorgio</comment>


Trump's Wobble-Gait Problem - <AUTHOR> https://thedeductible.com/2020/07/13/trumps-wobble-gait-problem/ <comment><AUTHOR> Interesting this post downplays the Parkinsons theory

Some studies have shown that extreme emotional stress can trigger the onset / worsening of Parkinsons

[https://pubmed.ncbi.nlm.nih.gov/24259593/](https://pubmed.ncbi.nlm.nih.gov/24259593/)

</comment><comment><USER2> Is this an attempt to draw attention away from the fact that Biden seems incapable of enunciating a single coherent sentence?

<comment><AUTHOR> the two things do not have to be mutually exclusive</comment></comment>


DJI to Install AirSense (Ads-B Receivers) in New Drones from 2020 - <AUTHOR> https://dronelife.com/2019/05/22/dji-to-install-airsense-ads-b-receivers-drones-from-2020/ <comment><AUTHOR> For those that do not know: ADS-B is a transponder protocol that broadcasts an aircraft's GPS location, speed, heading, altitude, etc. The FAA is mandating just about all aircraft in the US will need one starting January 2020 (the EU mandates many classes of aircraft in June 2020).

By having a receiver, the drone can tell the operator about nearby aircraft in the UI.

There's a decent (PR) video in the article showing things.

Presentation by DJI's VP Policy & Legal Affairs:

* [https://dronedj.com/2019/05/24/dji-elevating-safety-protecti...](https://dronedj.com/2019/05/24/dji-elevating-safety-protecting-the-skies-in-the-drone-era-ads-b-drone/)</comment>


Horizontal Attention Leans Left - Jakob Nielsen - <AUTHOR> http://www.useit.com/alertbox/horizontal-attention.html

<comment><USER2> What I can't tell from his research is:

How much are his findings affected by the content-organization of the pages his subjects viewed.

His summary:

"Web users spend 69% of their time viewing the left half of the page and 30% viewing the right half. A conventional layout is thus more likely to make sites profitable."

I have to wonder also about the prior experience of his subjects: were they (like me) accustomed to surfing many sites where they are accustomed to the right sight of page being filled with ads? I know that _I_ am conditioned to mostly ignore what is on the right because so often it is filled with ads that have little interest to me.

<comment><USER3> Nielsen is well known for his Jakob's Law of the Web User Experience, which states that "users spend most of their time on other websites."

<http://www.useit.com/alertbox/9605.html>

Yes, any designer of any one website has to plan for an audience that has already developed habits of viewing on other websites. That's why banner blindness

<http://www.useit.com/alertbox/banner-blindness.html>

is such an important issue in website design. Don't put ANYTHING on your site that looks like a banner advertisement if you want site viewers actually to see it.

<comment><USER4> a startup we advised for some time had a registration teaser that looked like a banner ... surprisingly nobody registered... they also had a flashy news section with images, when we changed it to text only the click trough rates doubled...

</comment></comment></comment><comment><USER5> What his data suggest to me is that people spend most of their time looking at the _middle_ of a standard ~800px browser window.

</comment><comment><USER6> Reminds me of this old website, I think it was mentioned in a Blue Man Group song: <http://wordsontheleft.com/></comment>


Dealing with Data Breaches – Why Having a Plan May Not Be Enough - <AUTHOR> https://www.elvidence.com.au/dealing-with-data-breaches/

<comment><USER2> Sounds Logical to me. I would say, this is going to be a new wave in InfoSec, similar to password changing policy. It took the community several years to realize that changing password often leads to insecurity. The same applies to the Incident Response. In-house folks are often out of practice. The do know their IT infrastructure better though, so I would suggest that an effective IR is a team work.

</comment><comment><USER3> Nice comment Barmental. Good point.

</comment><comment><AUTHOR> Please let us know what you think.

</comment><comment><USER4> Like the picture :-)

</comment><comment><AUTHOR> Thanks</comment>


Recruiting Humans with HTTP Headers - <AUTHOR> http://blog.maxcdn.com/recruiting-humans-http-headers/

<comment><USER2> _While we haven't yet closed the loop and hired anyone from this method_

That's the key measure. To be honest, this is such an old technique that it doesn't seem especially cool or interesting. We've found writing good blog content and working on open source to be effective at finding good people.

</comment><comment><USER3> HN user randomdrake and I threw together a "standard" for this a few months ago and put it up here:

[http://www.humanheaders.org/](http://www.humanheaders.org/) and [https://github.com/randomdrake/human- headers/](https://github.com/randomdrake/human-headers/)

randomdrake actually built a few browser extensions that will read out the headers and show them to you if they exist, which is pretty cool.

<comment><USER4> I like it. Thanks for sharing @zrail

</comment></comment><comment><USER5> This was cool in 2008, maybe even earlier. It's not anything fancy anymore. I was able to view headers of pages when I was 15 and it is probably the worst way of getting applications. Instead, put up a few problems you had while development of your product and get solutions to your recruiting email. See if people can come up with similar or better things. This will make you find better engineers. Headers will get you script kiddies.

<comment><USER6> Don't be so negative. Recruiting is hard. For small things that like this that might get attention and are entirely harmless? Let it go.

<comment><USER7> How about an X-Human recruiting message with a LINK to some problems you have?

Very few people will see that link and it would be your onboarding process for new hires and it will save you time reading resumes and interviewing candidates.

<comment><USER8> Maybe what Google did[0], like:

X-Human: Work for us! {first 10-digit prime found in consecutive digits of firstname.lastname@example.com

[0] [http://www.npr.org/templates/story/story.php?storyId=3916173](http://www.npr.org/templates/story/story.php?storyId=3916173)

<comment><USER9> I don't even need a computer for that, just use leading zeroes: 0000000002

</comment></comment></comment></comment></comment><comment><USER10> Yay this! Another way to bounce off developers is through a humans.txt

[http://higg.im/humans.txt](http://higg.im/humans.txt)

Mine is nothing special, just a simple quote. There is even a whole site that crawls these files.

[http://humanstxt.org/Standard.html](http://humanstxt.org/Standard.html)

Some of them are gold. Get ready to see lots of ASCII art :)

</comment><comment><USER11> Seems like it would be less effective if everyone was doing it.

</comment><comment><USER12> @zrail humanheaders looks cool. nice job!</comment>


Tell HN: Bug in UberEATS app gives you $75 coupon - <AUTHOR> Apparently there is a bug in Uber Eats app at the moment where if you apply a specific promo code you get 2 coupons for $75 off, instead of $10 off.<p>(Looks like there is a bug in the bug as I did place an order and the $75 off coupon was not applied :) ) <comment><USER2> This is useless info without the code. If you want to tell Uber about the bug, just do so directly.

</comment><comment><USER3> There is a bug bounty program. Submit the bug here:

[https://hackerone.com/uber](https://hackerone.com/uber)</comment>


Multi-account containers add-on sync feature - <AUTHOR> https://blog.mozilla.org/security/2020/02/06/multi-account-containers-sync/ <comment><USER2> Sync is a very nice side feature for containers, and helps make the experience consistent.

Going a little off topic, the current UX for using different containers is still cumbersome. Not being able to have or assign keyboard shortcuts or other ways to open tabs in specific containers (not referring to tying domains/sites to containers) allows for easier mistakes. Container extension extensions like Temporary Containers help a bit to avoid mixing up usage. I also find the container colors to be not as prominently visible on the tabs as I'd like.

<comment><USER3> The colors used to be very prominent. It was ugly, but more usable than the current dot.

<comment><USER4> I use this extension, which makes the colouring much more prominent: [https://addons.mozilla.org/en-US/firefox/addon/container- col...](https://addons.mozilla.org/en-US/firefox/addon/container-color-theme/)

</comment></comment></comment><comment><USER5> Please just start syncing cookies and local storage (on a best effort, maybe opt-in basis) and I would probably worship Firefox. Also sync non-default containers

At this point Firefox needs to learn from Ballmer. This isn't the place to post because this one is good news but in general stop focusing on "cool stuff" and do what you do best:

1) Provide open alternarive in absence of such.

2) focus on your strengths. this is where the ballmer part comes in. Firefox is now mostly for power users. Grandmas use chrome now. But after edge nobody will use anything else. So how about empowering developers and power users to do cool stuff ? Perhaps (paid and verified?) native add-ons? Maybe only from trusted partners... Or maybe only if you sideload.

</comment><comment><USER6> Browser sync seems like a really cool feature but the last time I tried to host my own version of the sync server from Mozilla I found the documentation to be sparse and the software ultimately non-functional.

Has anyone had any positive experiences with self-hosting the Firefox Sync Server?

<comment><USER7> I wrote my very own Firefox Sync Server, completely from scratch, based on their docs but also based on mozilla-services's Python code and some Firefox OS codebase. I mostly used Go as a programming language and AWS Lambda/DynamoDB as a way to store and serve API endpoint.

> [...] I found the documentation to be sparse and the software ultimately > non-functional.

Yes, my first take on the documentation was the same - existing but hard to understand in first proof-read. As I implementing my own sync and token server I really often I was catching myself "hey, you don't have to look into Python code, they really wrote how it should work in docs", especially [0] and [1] pages. There are also few other websites owned by Mozilla, which are very outdated, so also misleading.

Ah, worth noting is about:sync extension [2] and logs stored in the profile directory, which may help you to investigate some issues that might come during development and maintenance.

> Has anyone had any positive experiences with self-hosting the Firefox Sync > Server?

I am biased a bit, because I had one very negative experience related to token verification error, which costed me ~4 dollars, before I noticed and I had put service into downtime for some months. However, I am really happy about a whole project. Operational costa are is about few cents per month. It also helped me to write some tools I use on daily basis and preserve knowledge I have learned about serverless applications on AWS.

[0]: [https://mozilla- services.readthedocs.io/en/latest/storage/ap...](https://mozilla- services.readthedocs.io/en/latest/storage/apis-1.5.html)

[1]: [https://mozilla.github.io/application- services/docs/sync/faq...](https://mozilla.github.io/application- services/docs/sync/faq.html)

[2]: [https://github.com/mhammond/aboutsync](https://github.com/mhammond/aboutsync)

<comment><USER8> Wow. I did the same thing, except that mine was written in Python/Django (and it was a crude hack) and that I've hosted it on bare metal.

I've used that for 3 years, then I've abandoned it because mainenance was a pain, and I haven't figured out (despite the code being there in the open!) how to get iOS app to log in - my JS was missing some magic call and all Firefox did show is an error message (not the served HTML page).

I've commented a bit about my experiences here: [https://news.ycombinator.com/item?id=18448125](https://news.ycombinator.com/item?id=18448125)

<comment><USER7> Yeah, I don't complain on maintenance by now, but I anticipate it might be problematic as soon as new features comes in. I am looking forward to create a fork from their Rust[0] backend and include DynamoDB as a storage to keep compatibility with the latest version of Firefox Sync Server protocol.

[0]: [https://github.com/mozilla-services/syncstorage- rs](https://github.com/mozilla-services/syncstorage-rs)

</comment></comment></comment></comment><comment><USER9> Really cool! I wish I could sync per-container though. I have a "personal" container at work for personal things, and have configured some websites to always open in the "personal" container. Syncing that with my personal laptop seems not very useful (and would actually be annoying)

</comment><comment><USER10> I really wish multi account containers had better support for the back button. Default behavior for a clicked container-designated link is to open a new container tab and close the current one.

This little annoyance was enough to make me drop the extension, unfortunately. I'm not trying to break a 20 year habit over a browser extension.

</comment><comment><USER11> I've been giving Firefox a chance over the past two weeks, but one thing that I haven't figured out is how to open a new tab in the current container that I'm in via the keyboard. It's driving me nuts that I have to use the mouse. Does anyone know what I'm missing in the settings?

<comment><USER12> You can pass Ctrl+L to focus the address bar, type in the url and then press Alt+Enter to open a new tab in the same container.

<comment><USER5> Also alt-d

</comment></comment></comment><comment><USER13> Could someone explain what is the best way, or the intended way, to use containers?

Because, right now I am using the Personal container for most of the websites that require login (except Shopping and Banking), and I am not sure if it is the right thing to do.

I am also blocking by default all third party cookies (and despite FF warning that it may break sites, I find that everything works fine). So, I am also wondering if that is enough and makes Containers useless or not.

<comment><USER14> I think it's important to put as many websites that require login inside containers (as you already do). Separating them is also a nice plus: Having FB and some other website B in the same container can give website B knowledge about your FB identity (through fb like buttons and such). See [https://robinlinus.github.io/socialmedia- leak/](https://robinlinus.github.io/socialmedia-leak/) I try not to log in to any website on my default container. Also keep all the news websites where I accepted those giant cookie overlays in a "Reading" container.

</comment></comment><comment><USER15> I have a question... If mozilla automatically blocks third party cookies, can e-commerces actually track you when you are not on their site? And if so (and I gues its very possible) how do containers help?

<comment><USER16> Containers are useful for more than just site isolation.

For example, I use one container for browsing this website, and another for Reddit.

If I click an Amazon link from reddit, it might be a funny product I want to look at, but wouldn't consider buying. I don't necessarily want Amazon to know that.

Or similarly for Google Accounts: I can log into separate accounts for youtube and gmail, work and personal, etc. Google has some account-switching built-in, but I find it easier to work this way.

At work, I use multiple AWS accounts, and if I want to look at the AWS dashboards, containers let me use multiple AWS accounts at once. That's not something Amazon makes easy otherwise.

</comment></comment><comment><USER17> Somewhat related: If I'm using Nightly as my main browser, is there still a reason to install the Multi-Account Containers extension?

<comment><USER18> Multi-Account Containers is a specific way to enhance privacy that, at present, requires some manual setup of each container.

Sites that rely on authenticating or payment processing with other sites will not work outside of the established container. For instance, if you try to pay for something with paypal, but you have a paypal container, then you'll either have to sign into paypal in both containers, and if you set paypal to always open in the paypal container then you'll lose whatever session you had in the other container so you need to pay attention.

<comment><USER3> My current workaround is to open a private window when I need to do something like this.

<comment><USER18> Containers remember your login details, etc. And you can do one for each company, whereas you can only have one private session open.

So I can seamlessly browse facebook, google, amazon, paypal, my bank, and so on and feel confident that my cookies and sessions aren't being leaked across websites. That they aren't tracking my behavior off the site via the browser.

And I don't even consciously need to open a specific type of tab, I can set it so that it will always load that tab for that site.

And the Facebook Container plugin, in particular, sets everything up for facebook automatically with regard to any domains owned by facebook.

</comment></comment></comment></comment><comment><USER19> I need a 'Firefox account'? What's that?

'an identity provider that provides authentication and user profile data for Mozilla cloud services.... give us a pre-existing email address and choose a password.'

Uh, yeh, no thanks ... been down that road before. (I didn't like cookies right away either.)

Gorhill lets us backup far more complex settings without signing up for a UO account.

<comment><USER20> You do realize that UBO's backup functionality relies on the browser's native data syncing functionality (and thus on Firefox Accounts, for Firefox), right?</comment></comment>


Tesla saboteur claims to be whistleblower - <AUTHOR> http://www.dw.com/en/tesla-saboteur-claims-to-be-whistleblower/a-44338218?maca=en-rss-en-all-1573-rdf <comment><USER2> > He also said he was not, as Tesla lawyers claimed, disgruntled about not > getting a promotion. "That's their generic excuse. I could literally care > less," he noted.

I already don't like this guy. I feel like buying some TSLA stock to spite this guy and protest the use of "could care less" instead of "couldn't care less". It's a pet peeve. I got into a heated argument with friends in the 90s over this and I'm still seething....

<comment><USER3> >"could care less" instead of "couldn't care less"

This deeply irritates me also, but we should not see it as important here, surely?

<comment><USER2> I just found it interesting (and grating) that he was quoted as saying it.

Substantively what stands out is that Musk's earlier accusations seem to have been misleading and an attempt to shift blame for internal problems. But it's perhaps still too early accuse Musk of misleading the public.

</comment></comment></comment><comment><USER4> "News headline claims Tesla whistleblower is saboteur." Runs both ways ...</comment>


Ask HN: Monitoring Installs on OS X - <AUTHOR>

I am curious to find out what files are being installed and where on my hdd when I install a program on my HDD. I am wondering if there is a way to start a 'monitor' before the installer runs such that it will show hdd/filesystem activity and that will show what new files/directories were created and which existing ones were touched modified.
Atleast in Windows, I knew where the files were install most of the time and if I wanted to remove something i could clean up manually what the uninstaller left out. AS for OS X i have no idea where stuff goes when a installer is used. I understand that straight forward apps are packages/directories themselves and contain most the files. But what happens when the program comes with a installer (say ms office or something like that)
Does OS X apps follow a certain structure like linux where configs go in one location, binaries in another and so on.
If anybody can point me in the right direction or explain what goes on when a program is installed that will great. Thanks. <comment><USER2> File system monitoring:

      • sudo fs_usage
      • sudo opensnoop
      • lsof

With respect to package-based installations:

      • /Users/*/Library/Receipts/
      • /Library/Receipts/

Tools of interest (check man pages):

      • /usr/bin/lsbom SomeBOM.bom
      • /usr/bin/defaults read /Path/To/Receipt/org.example.foo.plist (Explicit, general PList reading example.)
      • /usr/bin/defaults read net.example.Bar (Searches in Preferences locations for matching name.)
      • /usr/bin/installer

Preferences (configurations):

      • /Library/Preferences/ (Computer-wide, Local Preferences)
      • /Users/*/Library/Preferences/ (User Preferences)

Application Support (serials, etc.):

      • /Library/Application Support/
      • /Users/*/Library/Application Support/

Further/related readings:

[https://developer.apple.com/library/mac/#documentation/MacOS...](https://developer.apple.com/library/mac/#documentation/MacOSX/Conceptual/BPRuntimeConfig/Articles/UserPreferences.html)

[http://developer.apple.com/library/mac/#documentation/FileMa...](http://developer.apple.com/library/mac/#documentation/FileManagement/Conceptual/FileSystemProgrammingGUide/FileSystemOverview/FileSystemOverview.html#//apple_ref/doc/uid/TP40010672-CH2-SW14)

[http://www.gnustep.org/resources/documentation/User/GNUstep/...](http://www.gnustep.org/resources/documentation/User/GNUstep/filesystem.html)

[http://osxdaily.com/2011/04/22/monitor-mac-os-x- filesystem-u...](http://osxdaily.com/2011/04/22/monitor-mac-os-x-filesystem- usage-access-with-opensnoop/)

[http://hints.macworld.com/article.php?story=2006081704414926...](http://hints.macworld.com/article.php?story=20060817044149264)

[http://developer.apple.com/library/mac/#featuredarticles/Fil...](http://developer.apple.com/library/mac/#featuredarticles/FileSystemEvents/_index.html)

[http://superuser.com/questions/97980/view-filesystem- access-...](http://superuser.com/questions/97980/view-filesystem-access-in- real-time-on-mac-os-x)

[https://developer.apple.com/library/mac/#documentation/Darwi...](https://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/man1/pkgutil.1.html)

[http://developer.apple.com/library/mac/#documentation/Develo...](http://developer.apple.com/library/mac/#documentation/DeveloperTools/Conceptual/PackageMakerUserGuide/Introduction/Introduction.html)

<http://support.apple.com/kb/TA26118?viewlocale=en_US>

Note: Different tools are available/unavailable in different versions of OS X.

<comment><AUTHOR> Thanks Man ! Will learn a few new commands as well.</comment></comment>


UDID Leak : Identifying the Traitor - <AUTHOR> http://fredericjacobs.com/identifying-the-traitor <comment><USER2> Sorry, I don't think this strategy is workable. Consider - 74% of apps I tested sent the UDID to one or more upstream servers. Furthermore, Flurry alone received UDIDs from 15% of apps I tested. That's just one aggregator, and they surely have nearly 100% of UDIDs on file. The APNS tokens narrow it down somewhat, but not too much. It's also not at at all clear that there is a single source involved - this could be an amalgamation of a number of sources.

See this post for the source of these figures: <http://corte.si/posts/security/apple-udid-survey/index.html>

<comment><USER3> Statistics created with the sample of 25,000 udids, Fruit Ninja is suspect? (Not conclusive) pic.twitter.com/vlyoE2ij

</comment></comment><comment><USER4> Why do people keep assuming that the FBI is actually involved in this? The only evidence of that is from the pastebin page. They could just as easily be lying.

We know nothing. Other than that there are 1,000,001 leaked UDIDs. Everything else is just speculation and needs to be regarded as such until such time as proven otherwise.

<comment><USER5> Anonymous' credibility is good. I haven't heard of an instance where they were caught lying in a high profile incident like this.

<comment><USER6> I have followed these lines of thought before. They contain a fatal mistake.

Anonymous is not a group that can have a reputation. At best, it's a subculture. Anyone can call themselves anonymous. Whoever didn't lie in all the previous incidents may not be behind this one - this could be a totally different person or group of persons with totally different ideals.

<comment><USER7> Cultures can have a reputation. They can also fight back when someone uses their name for something they disagree with.

</comment></comment></comment></comment><comment><USER8> I doubt it's Apple. I checked the list, and there're tons of German people in there too (one can see that by how they named their iPad). I really doubt that the FBI would be interested in tons of German girls, for example (many iPads seem to belong to girls named 'Sandra' (iPad von Sandra)). If Apple were the culprit here, they would have been able to just deliver the UUIDs from people residing in the states (since they know which UUID is connected to which app store).

I hardly think it's Apple that leaked the information. Even if it's hard to believe for some people: Apple values their users' personal information pretty high.

I personally believe that this is from a internal FBI job, so they got this information in a non-legal way.

<comment><USER9> Seconded. The UDID for one of my iOS devices was there, and I am in Poland. It is definitely not just the US.

</comment></comment><comment><USER10> Well, one piece of the puzzle is in the Lulzsec Pastebin itself. the hacked file's original filename is supposed to be "NCFTA_iOS_devices_intel.csv" and a quick Duckduckgo gave me <http://www.ncfta.net/> those contractors as source of the data.

<comment><USER11> <http://www.fbi.gov/news/stories/2011/september/cyber_091611> "The exchange of strategic and threat intelligence is really the bread and butter of the NCFTA," said Special Agent Eric Strom, who heads the FBI unit—the Cyber Initiative and Resource Fusion Unit (CIRFU)—assigned to the NCFTA. "The success of this effort at every level comes down to the free flow of information among our partners."

Dan Larkin (the FBI Agent who setup NCFTA in 1997) <http://www.linkedin.com/pub/dan-larkin/25/90/910>

Note that he used to be with CIRFU.

Now, check it out: <https://www.allclearid.com/plans/mobile-app>

</comment></comment><comment><USER12> The whole FBI story is not credible, it's the _least_ likely explanation. I'd start looking for the app that all these UUIDs have in common. This data is probably a dump of that app's server-side database. And what about the zip codes? GeoIP.

</comment><comment><USER13>
      I've Never Installed: ... Other [            ]

This is a joke, isn't it? How could I possibly answer this question correctly?

(My deadpan-sarcasm filter isn't working very well right now.)

</comment><comment><USER14> Traitor? Is Apple a nation state now?

Which leads to an interesting question for me. Given that many web sites have more users than many countries, should there be a more proscribed relationship?

<comment><USER15> Maybe you're thinking of high treason? It's possible to be a traitor to things other than countries. Actually I think the reason more people are on FB than the US is because there are fewer obligations.

</comment></comment><comment><USER16> This is a question we should keep asking Apple until they give a proper, real answer: Who gave this information to FBI? If they say they gave it, then we know Apple gave this information and it will be a PR nightmare for them. If they say they didn't, then they will imply FBI obtained it illegally and we can focus our attention on FBI.

<comment><USER17> It's rather like the FBI having a list of 12,000,000 wifi MAC addresses. Would the mere possession of such a list by the FBI be illegal? What if the MAC addresses supplied by Starbucks are from customers who voluntarily connect their devices to Starbucks' network and transmit their MAC address as part of the connection negotiation?

Similarly, what if the UDIDs are from people who installed a common app on their devices and agreed as part of the terms and conditions to allow information about their hardware (including device name, UDID, etc.) to be transmitted to the app vendor and to other parties including law enforcement?

EDIT: the question of whether they _should_ have this information is completely separate from whether it's _illegal_ for them to have this information. And, as noted by others, no proof has been presented that it was obtained from the FBI.

<comment><USER18> MAC address, user name, phone number, street address...

</comment></comment></comment><comment><USER19> What about PokerStars?

Their US operations were shut down the FBI recently on bank fraud and money laundering charges.

<http://www.tightpoker.com/news/pokerstars-shuts-down-2347/>

Can anyone else confirm they have PokerStars installed? <http://news.ycombinator.com/item?id=4473730>

</comment><comment><USER20> Can someone explain what a UDID is (sounds like a MAC address or similar) and what the privacy or security implications are?

<comment><USER21> Some insecure apps and services use the UDID as a way to identify users. For example you can get some profile data from OpenFeint with the UDID. There are probably a ton of other small things like this, but overall I wouldn't worry too much.

<comment><USER22> And some secure ones used to use it for multi-factor authentication - e.g. you still username/password, but you can only do it on the device that you registered on.

However, use of UDID has been deprecated by Apple, and they are now rejecting some new apps that read it. You're meant to use a unique application-level ID instead.

</comment></comment></comment><comment><USER23> Small datapoint: my iPhone and iPod aren't in this dump. The iPhone hasn't been used in about a year. And the iPod is infrequently used for playing games.

<comment><USER24> Negative datapoints are nearly completely useless in this scenario, as we only have ~8% of the leaked UDIDs.

Think about it this way: there are more than 250m iOS devices in the world[1]. I think 300m is a good, conservative estimate.

12m (~4%) of the world's UDIDs have leaked. 1m of _those_ (~.33% of the total, 8% of the dump) have leaked.

A data point saying "my iOS device is in the dump" represents 1/1m of its group. Pretty significant, relative to 300m devices!

A data point saying "my iOS device isn't in the dump" has two possibilities; a 96% chance it isn't in the dump and a 3.66% chance it is but wasn't leaked.

As one of the 99.66% of iOS users, your data point represents just 1/299m of its group, and is thus ~300x less powerful than a positive data point.

[1]: [http://www.engadget.com/2011/10/04/apple-250-million-ios- dev...](http://www.engadget.com/2011/10/04/apple-250-million-ios-devices- sold/)

</comment></comment><comment><USER25> It's an interesting question...but as someone who used to word in the survey world, I've gotta say it: the questions here are not going to give very useful data. Here's a couple of examples (& a tl;dr):

1) "Have you been to the US recently"? The way this Q is worded suggests that the audience is not people who live in the US. Either way, the non-specificity of the Q makes me worry with what info will be extrapolated from the responses.

2) "I haven't installed the following apps: Facebook, LinkedIn...OTHER".

...there are a lot of apps I haven't installed. I hope you don't want me to list them all...?

tl;dr - when putting together a survey like this, be careful to look at it from all sides and see where you could be introducing a bias of some sort. Drawing conclusions from flawed data = FTL.

</comment><comment><USER26> I love all the outrage and concern. All your information is for sale in the walled garden, outside the walled garden, everywhere! You don't deserve to expect anonymity and privacy because you offer up all your secrets willingly.

Rabble all you want over this traitor business, even clamor for new laws to protect us (although that just makes things worse and poisons the waters). In my humble opinion, you breathless bloggers are all just wasting energy. Until we techies start designing networks and storage systems for anonymity and privacy, all your dirty laundry is money in the bank to these service providers and easily searchable by big brother.

</comment><comment><USER27> For what it is worth, the languages used by users to name their devices are certainly not limited to US English. Out of the 1,000,001 device list, about 10,000 device names contain the Korean possessive "ui", about 5,000 contain the Japanese possessive "no", and a whopping 32,000 contained a Chinese possessive. Unsurprisingly, none contained all three. :-)

$ grep 의 iphonelist.txt | wc 10682 23316 1469444 $ grep 的 iphonelist.txt | wc 32168 77171 4522336 $ grep の iphonelist.txt | wc 4838 15191 671159 $ grep 의 iphonelist.txt | grep 的 | grep の | wc 0 0 0

</comment><comment><USER28> I recommend everyone to fill in this form, even if you don't own an iDevice. The person who leaked the information could be any ones son or daughter, we all know how careless we were ourselves when we were younger. The stakes have become higher, but that doesn't mean we should try to jail a kid with an Internet connection and deprive him/her of his/her future. We should all try to help ensure that incidents such as this leak cannot happen, in the simplest form by rejecting privacy policies which waive your privacy.

Please, why won't anybody _think of the children_?

</comment><comment><USER29> Actually, the notification tokens are a bigger threat, because they allow imposters to send notifications to apps. We know this from our own experience: [http://www.ikangai.com/news/udids-leaks-and-push- notificatio...](http://www.ikangai.com/news/udids-leaks-and-push-notification- token-security-threats/) However, there is also a good thing: sending notifications with the tokens from the data can be used to identify the apps which collected the UDIDs.

</comment><comment><USER30> Finally it all depends on AntiSec. We have no idea wich 1'000'001 datasets they published (first 1m, last 1m or random). If they have access to all 12m UDIDs + the additional information (Country, Postal code, Addresses) they could at least release some statistics about it, this would make it a lot easier to find a (potential) source. (E.g. If we knew wich percentage of the UDIDs came from Europe etc.)

</comment><comment><USER31> Is the formatting of this blog meant to be iPad unfriendly?

<http://pic.twitter.com/rLOyOHbh>

<comment><USER32> Had the same problem. Use Safari's Reader feature.

</comment></comment><comment><USER33> There are a lot more than 12 million iDevices out there, so why only 12,000,000?

The small number leads me to think that the UUIDs might belong to people the FBI are particularly interested in tracking. If your UUID is in there, fasten your tinfoil hat.

Just a thought.

<comment><AUTHOR> Or it may be have been released by some dude making a fart app.

<comment><USER34> Or maybe the FBI are secretly releasing fart apps in order to get UDIDs.

<comment><USER35> I'd give a lot to be on the briefing where that was agreed on.

</comment></comment></comment></comment><comment><USER36> FBI will just fill 1000 fake datapoints to cover its informator.

</comment><comment><AUTHOR> Let me know if you find other relevant questions to ask.

<comment><USER37> You might want to ask whether users have installed any game associated with OpenFeint. Some examples are listed on their Wikipedia page: <http://en.wikipedia.org/wiki/OpenFeint>.

<comment><USER3> Yes, but is very dangerous, for example: [https://twitter.com/jotaro17/status/243144140878143488/photo...](https://twitter.com/jotaro17/status/243144140878143488/photo/1/large)

<comment><USER37> Heh, I've been compiling the same list as you already did. My results look a lot like yours.

What do you mean that it is "very dangerous"?

As I posted in another thread... I wonder if it is significant that so many of the UDIDs are known to OpenFeint. If you took a random sample of UDIDs, how many would OpenFeint have data on?

<comment><USER3> I think that about 50% have openfeint data. I do not know the legal terms of OpenFeint, but I would not like anyone could see that I play.

</comment></comment></comment></comment></comment><comment><USER38> "I've never installed: Other" That's a looong list.

</comment><comment><USER39> Why is "Facebook" pre-checked?

<comment><AUTHOR> My bad. Fixed

<comment><USER31> <http://pic.twitter.com/rLOyOHbh>

The formatting of this blog is just awful for iPad users zooming in on the text.

</comment></comment></comment><comment><USER40> Are any jailbreaked iphones with privacy patches installed being leaked? Xhi2 analysis is not only about what triggers the correlation, what does not trigger the correlation is also important. My guess is jailbreaked are underrepresented in leaked UDID either because jailbreak is shielding users or because users able to install a jailbreak are more aware of computer security issues. Regular Iphone are cell phones remotely controled by a 3rd party, jailbreaked iphones are computers you control. I am no paranoid freak, I am just a regular sysadmin with a pretty low security awareness.

</comment><comment><USER41> It would surprise me if intelligence organisations _didn't_ make databases like this. I assume the CIA could get the user information from Apple, with or without Apple's consent.

I have no real problem if the UDID:s of my iPad/iPhone/iPod are stored with my name by intelligence organisations in democracies.

But... I do have problems with them being so incompetent that private information about me is leaked!!

<comment><USER42> You have no real problems with the secret police monitoring you? Is that an expression of acceptance to something you cannot control or that you really are ok with it?

We have to accept that we are being spied upon because we have no control over that, but we should always resent and resist it when possible.

<comment><USER41> Terrorism is quite easy in today's world. By definition terror scares people, hence a strong voter pressure to stop it. This results in a Big Brother society.

The number of stopped terror attacks in the West over the last decade is quite large, that would hardly have happened without spying on the citizens.

Is it worth the security? I don't really know. As long as it is in very stable democracies, it _ought_ to be safe...

<comment><USER43> > Is it worth the security? I don't really know. As long as it is in very > stable democracies, it ought to be safe...

Uh, hell no. We have already seen the kind of evil things the FBI are willing to do in the US: <http://en.wikipedia.org/wiki/Cointelpro>

<comment><USER41> Wow, it is scary when intelligence organisations start to infiltrate political organisations... an even worse variant of regulatory capture.

But that was during the cold war, 40 years ago. The levels of paranoia increased after 9/11, but hardly to the pre-1989 levels.

<comment><USER41> The down votes here are interesting. I don't argue an extreme position, imho?

No one has attempted to argue against my point about active terror threats imply high voter pressure for security.

But maybe the problem is that I'm Swedish.

Traditionally, Swedes trust the state uncritically to do the right thing (I've heard the explanation that the king historically was allied with the lower classes against the nobility).

I thought I was immune to those Swedish attitudes, after e.g. seeing oligopolies (food, building, etc) keeping prices high and hurting both individuals' economy and the country's, without getting any problems from either politicians or media.

But maybe I still have naive reflexes.

Edit: I wish I hadn't gone away for a while, so I could have added this comment while people still were reading and give feedback. :-)

</comment></comment></comment></comment></comment></comment><comment><USER44> i wonder if the FBI got the UDID list from Apple, or if the FBI has a stealth app in the App Store and people gave up their info voluntarily when they installed it...</comment>


Microsoft approves WinMo 7 rooting app - <AUTHOR> http://tech.icrontic.com/news/windows-phone-7-rooting-app-available-in-marketplace/ <comment><USER2> No. ChevronWP7 does not "root" your device; it seems to simply unlock developer access. The result is actually still quite limited: it would be nice to have "root".

"""Provided unlocks are equivalent to those provided by Microsoft's App Hub. That means 10 side-loaded applications. That also means no "Interop access"."""

\-- [http://www.chevronwp7.com/post/12369366007/chevronwp7-labs-l...](http://www.chevronwp7.com/post/12369366007/chevronwp7-labs- launch-1-update)

</comment><comment><USER3> > This is definitely a new direction for Microsoft in many ways, and it is a > cunning method for promoting the brand. It may be a tad bit risky, but it > seems like the most popular mobile device makers are the ones making the > boldest moves.

Isn't the direction reversed in the last sentence? The popular devices are playing it safe, the unpopular devices - Windows Phone - are according to this article taking a risk and making a bold move.

</comment><comment><USER4> I never thought that I'd read about Microsoft allowing something like this. There seems to be a sea change in culture towards openess amongst the Big Guys at the moment. It's unfortunate however that these companies are only beginning to invest now that their core products are at stake.

<comment><USER5> Although I'm happy MS is doing it, I'm absolutely positive that the only reason for it is to attract more developers to their platform and try to compete with Apple in one of the few areas they are widely regarded as deficient.

I don't think it's a sign of sea change at all, sadly.

<comment><USER6> Is "to attract more developers to their platform and try to compete with Apple" not a good enough reason?

<comment><USER5> Well, it suggests that if they ever became competitive with Apple they would lose all interest in providing open access to their platform.

</comment></comment></comment></comment><comment><USER7> I'm still waiting for an official c/c++ sdk

<comment><USER8> If you feel brave enough, you can port MeeGo to the Nokia WP7 handsets and boot it with this tool. Their C/C++ toolchain is excellent. ;-)

<comment><USER4> I saw a MeeGo port running on the Nexus One, tempted: <http://wiki.meego.com/ARM/MSMQSD>

<comment><USER8> Yes, but it wouldn't make Ballmer throw a chair.

</comment></comment></comment></comment><comment><USER6> Windows Mobile doesnt exist anymore. It's Windows Phone now.

<comment><USER9> WinPho?

Microsoft branding sucks. Phones don't even have "windows", and they're delusional if they think that Windows has a positive brand association with consumers.

<comment><USER10> WP7 is the acronym used instead of WinMo

<comment><AUTHOR> My bad. Noted. I did like "WinMo" quite a bit though.

</comment></comment></comment></comment><comment><USER11> While I don't like you have to pay for it, I do like the fact that your warranty isn't voided when you "unlock" the phone.

</comment><comment><USER12> As an avid WP7 user, this is completely awesome.

<comment><USER5> As a relative newbie to WP7, is there actually anything of interest to do with it right now? I get that there is a ton of potential for the future, but I haven't seen any interesting root apps yet.

<comment><USER12> You're right, I don't believe there is much you can do with a jail-broken WP7 phone yet.

Tangentially, you can also accomplish a similar "jailbreaking" by registering with App Hub and making your phone a developer phone. If you are a student you can get a year free of App Hub through DreamSpark too

</comment></comment></comment><comment><USER13> My ATT contract is up in June. I've been planning on ditching my iPhone 4 for WinMo when I'm in the clear to switch back to verizon. This just makes it that much more attractive.

I just hope there's some good WinMo hardware by then.

<comment><USER5> There is some good WinMo hardware available now... just not on Verizon. I picked up a Samsung Focus S and I'm very happy with it. Not jailbreaking yet as I can't see any really useful apps that require it. I'm sure that will come with time, though.

</comment></comment><comment><USER14> I cant help but think this is analogous to a desperate guy offering free sex and all quality women rejecting his offer!

Economics 101: Supply and Demand</comment>