16M Americans will vote on hackable paperless machines - <AUTHOR> https://www.technologyreview.com/s/614148/16-million-americans-will-vote-on-hackable-paperless-voting-machines/ <comment><USER2> It's not just the vote itself we need to worry about.

In the 2016 Presidential election, a lot of people in North Carolina had trouble due to problems with the electronic poll books they used to keep track of who registered and who already voted.

People would show up at their polling place and either be told, incorrectly, that they had never registered, or be told, incorrectly, that they had already voted.

Oddly, they only had trouble with these systems in Durham County, a heavily blue county, and these same devices in other states are known to have been targeted by foreign hackers--but it wasn't until this year that DHS finally agreed to actually do a proper forensic examination of the equipment to see if anything shady was going on [1].

[1] [https://www.npr.org/2019/06/05/729920147/federal- government-...](https://www.npr.org/2019/06/05/729920147/federal-government- to-inspect-north-carolina-election-equipment-over-hacking-fea)

<comment><USER3> Georgia also only had problems in heavily blue districts. They "forgot" power cables, left machines unused in warehouses, and rejected thousands of early votes due to "glitches".

There is nothing odd or mysterious about it. It's the logical conclusion of being a political minority clinging to power and it's been happening for decades both openly and less openly.

<comment><USER4> The state of Georgia was a basket case when I was still active (10 years ago). Per my friends who are still in the fight, it's still a basket case.

As Andrew Gumbel wrote in Steal This Vote [2005], America experiences recurring amnesia.

[https://www.amazon.com/Steal-This-Vote-Elections- Democracy/d...](https://www.amazon.com/Steal-This-Vote-Elections- Democracy/dp/1560256761)

As a burned out election integrity activist, I've really struggled with the recurring incredulity.

My local newspaper called me a "sweaty paranoid kook", because I dared to explain how our jurisdiction's central count actually worked (per their procedures manual).

And all the risks we identified and tried to mitigate? It all happened. All of it. (Where's my parade?)

\--

Some free, unsolicited, hard earned advice from a recovering activist:

Focus on "errors", instead of "fraud". Just because. The moment there's a hint of partisanship, the conversation is over. And really, at the end of the day, fraud is indistinguishable from errors. So just grit your teeth, for the greater good.

Focus on appropriations, aka follow the money. The very minor victories I've had were argued from a framing of good governance. Transparency, accountability, anti-waste, etc.

<comment><USER5> Thanks for your comment. This is good advice about keeping efforts to improve the system non-partisan - it's the only practical way to get people who disagree with each other to both agree to a fairer system.

</comment></comment></comment></comment><comment><USER6> Disclaimer: I served as an election judge in the 2012 general election in Arapahoe County, CO.

I'm so sick and tired of stories like this framing the issue of election security as a software issue or hardware issue. You can mitigate software flaws with chains of custody, tamper proof seals, bipartisan poll watchers, bipartisan election judges, and enough transparency. Most election systems in the United States employ all of these controls, which is why you have few stories of legitimate votes being discarded due to software failure or tampering.

If your argument is that paper ballots are more auditable or harder to hack, they are not. The same access controls above can be applied to paper, and paper is always susceptible to being destroyed, lost, or conveniently found in a clutch race. In Russia, cameras were provided at many election booths in a recent race and caught multiple instances of suspected ballot stuffing [0]. Paper products can be created at will and the requirement for ballots to be anonymous often prevents measures to prevent double voting or outright forging of votes.

Hackable machines are a problem, but they are not the only problem. Ultimately, it's easier to influence an election by discarding legitimate voters from voter registration systems, selectively failing to notify voters of elections, and other indirect interference campaigns that have been known to happen. Not only are hackable machines not the biggest issue, but they turn the camera away from bigger issues like these, which decreases scrutiny on the most vulnerable parts of the system.

Ultimately, if you vote in an election system, you must have something you trust in the system. You need to be able to trust the body running the election, the individuals that makeup the body, or the system elements itself. If you trust the government then you can be certain that collection processes happen correctly. If you can't trust the government, why do you think trusting the terminals that collect votes is any better? It's like trusting your child to bring home important documents from the school about their discipline. Sure, the paper might be tamper proof or tamper evident, but if your child throws it away it's pointless [note 1].

[0]: [https://www.youtube.com/watch?v=pH7uXZQsyHI](https://www.youtube.com/watch?v=pH7uXZQsyHI)

[note 1] The analogy breaks down if you talk about electronic records, and assumes that the child is the "higher authority" bringing the documents to you. The point is to demonstrate that tampering with reporting is much easier than tampering with the record collection.

<comment><USER7> > Hackable machines are a problem, but they are not the only problem.

They might not be the biggest problem, but they're definitely an _extra_ problem. I don't see what problems they take away, in exchange for bringing this extra problem.

With a paper ballot, I can go to the polling booth, see my vote being counted, and see whether any other funky stuff happens, right there. It's all in the open. This in turn gives you extra trust in the system.

With an electronic system, how do I know what happens behind those layers of abstraction between the user interface and the hardware? How can I in any way verify that my vote has been counted?

<comment><USER8> In VA (or, at least in Fairfax County), we fill in a paper ballot which is scanned by a machine. The vote counting is done by the scanners/electronically, but there is a paper trail for audits. Seems like the best of both worlds (when implemented properly).

Like you, I would have zero faith in an electronic voting booth that simply said "Yup, you pushed a button." I have no idea what actually gets "written to disk".

<comment><USER9> With scanning machines there still is a problem that they can be tampered with and even if you see that the outcome doesn't match exit polls, you don't have any solid proofs to require the manual re-counting of paper ballots.

<comment><USER10> In most states, if the election is within a certain degree of closeness (like half a percent), it triggers an automatic recount. And that will catch mismatches between the machine counts and the contents of their ballot boxes, unless you also carefully rig the manual recount - at scale.

And altering the count more than a percent or so is a LOT of alteration.

</comment></comment></comment></comment></comment><comment><USER11> Why this stuff is even an issue is mind-boggling to me.

In Canada we vote completely anonymously on a piece of paper. ID is verified at the entrance to the voting area, but your identity is _in no way_ associated with the piece of paper you mark your vote on. The ballots are counted by hand with numerous bystanders/observers of whatever affiliation. It just works. We have no need for digital (aka hackable/tamperable/buggy) voting system.

Global News has a decent article outlining why the system is so impervious to abuse: [https://globalnews.ca/news/4049932/canada-2019-election- hack...](https://globalnews.ca/news/4049932/canada-2019-election-hacking/)

<comment><USER12> It's complicated in the US because it's the states that administer elections and IDs. Everyone does it differently, with different equipment, ID requirements, and allocation of election resources.

Voter ID, for example, is contentious because a state can influence election turnout through decisions on where ID offices are located and when they're open.

Edit: I always find it ironic that the Republican party--the party of limited government--wants people to have to go to the bastion of efficiency known as the DMV (!!!) in order to vote.

<comment><USER13> _I always find it ironic that the Republican party--the party of limited government--wants people to have to go to the bastion of efficiency known as the DMV (!!!) in order to vote._

Is it ironic? Republicans aren't calling for the abolishment of the DMV for driver's licenses. Requiring ID to vote is inline with requiring ID to drive.

I find it interesting the Democrats seem to idolize European governance, except for the part where requiring ID to vote is the norm.

edit: fixed typo - requiring id to vote is inline with requiring id to _drive_

<comment><USER14> Make IDs free and mandatory for all citizens — like in those European countries — and there's no problem.

Until then, IDs are a poll tax — and to put it mildly, that's a problem.

<comment><USER15> >Make IDs free

Sure.

>and mandatory for all citizens

And what are the consequences if you don't get this now mandatory (federal?) ID? Presumably some sort of passport card like thing that doesn't actually let you travel across borders. What if you don't have the documentation you need? What if you don't have the time to go to the offices that provide these IDs?

For a lot of people, the cost of getting the Equivalent ID to a driver's license isn't the big issue. All the other things are.

<comment><USER14> I would accept those sets of problems if the voter ID serves as voter registration.

<comment><USER15> I would assume that if someone went to the trouble of getting an ID primarily just for voting, also registering wouldn't be a big burden.

<comment><USER14> Yeah, but the crux is making it _impossible to rescind_ that registration a la voter purges!

<comment><USER16> But it is an easy fix. I agree that there should be universal voter registration, and see no reason why we can't issue voter registration cards with a photo on them, which then serve as a valid form of identification for whatever information we choose to make publicly available on them.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> What if there was a remarkable amount of evidence abuse has already occurred?

[https://www.theroot.com/exclusive-thousands-of-black- votes-i...](https://www.theroot.com/exclusive-thousands-of-black-votes-in- georgia-disappea-1832472558)

Or how about a federal district court ruling?

[https://electionlawblog.org/wp-content/uploads/georgia- dre-d...](https://electionlawblog.org/wp-content/uploads/georgia-dre- decision.pdf)

<comment><USER18> Bev Haris' grassroots watchdog movement Black Box Voting also has documented a lot of sketchy behavior as well, such as throwing away paper records of votes.

[https://blackboxvoting.org/](https://blackboxvoting.org/)

</comment></comment><comment><USER19> Electronic voting and vote counting machines pose one of the greatest threats to democracy.

We should really just go back to paper ballots, which are not perfect but are a lots less hackable at scale and are much more trackable than electronic machines are.

<comment><USER20> Paper ballot tied to a voter via a strong voter ID + electronic counting is the best of both worlds.

You get the speed of automation with a paper trail in case you have to go back and audit.

EDIT for those replying that you feel voting should be anonymous. With anonymous voting, how do you stop the "hey we just found this box of filled in ballots" ala Broward County Florida every election? If you can't tie a ballot back to a voter, how do you know the ballot is legitimate?

<comment><USER21> I don't want anyone to be able to look at my vote and know who did it. That's a powerful tool for thugs and tyrants.

<comment><USER22> How do you prevent duplicate voting, then (i.e. me casting 100 votes for Trump)?

<comment><USER23> I think lots of countries will stamp your wrist and check for a stamp before allowing a vote to happen. I could be mistaken, but something akin to this is possible.

<comment><USER24> Just mark it down on a list. Whether someone has voted is not a secret.

</comment></comment></comment></comment></comment></comment><comment><USER25> Is there any other technology in such widespread use with such universal condemnation from experts? Essentially every expert on computerized voting systems says, "don't do this, it's insane." Imagine if every expert on aerospace engineering said that jet engines were too dangerous but everyone ignored them and kept finding more and more places to use jets.

<comment><USER26> Non-TLS HTTP.

<comment><USER25> Not at all the same. Most people are pushing hard for TLS, with just some fringe elements resisting it.

If it was like voting machines, you'd have massive initiatives to run everything on plain HTTP and any suggestion that we should all use HTTPS is completely ignored.

</comment></comment></comment><comment><USER27> I've been working on this issue in North Carolina over the past several weeks.

North Carolina currently is facing two issues:

1) the state Board of Elections will vote on Thursday to increase the standards for certification which will hopefully lead to hand-marked paper ballots for all (except those with disabilities).

2) HB 19, which will delay decertification for insecure voting machines that roughly 1/3 North Carolinians use. This bill passed unanimously in the House.

If you live in North Carolina and care about this issue, please email Damon Circosta (email@example.com) with your viewpoints as he is the new, tie-braking vote on the board.

Additionally, call your state Senator and tell them to oppose HB 19. The bittersweet news is that it doesn't look like it will get taken up this year because of the budget standoff, but it's better to start fighting this battle now.

</comment><comment><USER28> The voting system here in Oregon seems to be pretty nice. I've experienced it in both the UK and here, and voting in the UK is very easy when you're actually present where the council expects you to be on the day, and is very hard otherwise. I was unable to vote in the EU referendum because my council just wouldn't send me a postal ballot, I called them multiple times, they said they'd sent it each time, I got the ballot a few weeks after the results were announced. As I recall the thing was postmarked after the deadline.

I strongly believe using the postal system for everyone's votes is an ideal solution. It's distributed, already exists, is convenient, etc. Oregon's voting is great.

</comment><comment><USER29> I like the idea of a hybrid approach.

10 years ago when I was in school, we took standardized tests using Scantron forms ([https://www.scantron.com/](https://www.scantron.com/)). It's basically a piece of paper that can be run through a machine so the results of the test can be measured.

Something like this would still retain the benefits of an electronic system, while also leaving behind a paper receipt that can be stored separately from the electronic results in case votes need to be audited / recounted, etc.

Paper ballots (with electronic tallying) is also not susceptible to things like power outages, networking issues, software bugs, etc, since you'd always be able to fallback to the paper ballots if a component of the electronic system fails.

Side note: if I had to guess, the biggest risk with paperless machines is the possibility of software bugs that skew the results in unexpected ways. I would love to know what kind of quality checks + testing goes in to voting machine software... can't imagine how to test a system that's only used at full capacity on 1 day every 4 years.

<comment><USER30> Pretty sure this is the current system...

<comment><USER31> It depends on the state; some have this system. Some are fully electronic. Others are all paper and hand count.

</comment></comment></comment><comment><USER32> > Selling a paperless voting machine is like selling a car without brakes

This is comical FUD.

What makes people think paper is safer? The paper copy you have is worthless since you can counterfeit it, and the one in storage can be replaced or falsified just the same. A secure system can be designed regardless of the storage media - i.e. a digital one can be as safe or safer than paper. Brazil has used electronic voting for decades now, and despite accusations (by the winning party!) there has been no proof of tampering or exploitable security flaws.

<comment><USER10> How Minnesota does it: Blank ballots arrive in sealed packages. Ballots, whether blank or marked, sealed or unsealed, may only be handled in the presence of election judges from at least two different political parties. Counts are kept, by those groups. And ballots, either blank or marked, are generally kept under lock and key.

Attempts to insert extra ballots will be detected by the count. Attempts to substitute ballots would have to match counts exactly, and somehow be done without being seen in a room with multiple other judges and other people.

</comment></comment><comment><USER33> I feel like nobody is bringing up one of the core challenges that the U.S. has that many countries don't. You just vote for way too much fucking stuff at once. In Canada, our ballots are literally just a list of candidates for a single seat. Very occasionally, there will be a single referendum question attached to it. That's it. I've never voted and been asked for more than two choices except for municipal elections. I searched for "sample 2016" ballot and the first result (Sumter County, Florida) had--I shit you not--26 separate votes on it.

I bring this up not to criticize, but to put those who think that paper ballets are impractical in a bit of context. Of course you'll be begging for electronic systems when all of your voting is done on a single day and you vote for who gets to be the janitor.

<comment><USER34> Part of that is if you split it up, fewer and fewer people vote. Outside national elections many people do not bother to vote.

</comment></comment><comment><USER12> For anyone interested in how elections are actually run, please volunteer to serve as a poll worker. It's a great way to serve your community and learn about actual challenges on the ground.

</comment><comment><USER35> Simple solution: each voter is given a receipt of their choices and a unique signature for it, and an online website where they can check that their signature was taken into account in the final tally.

With that a fraudsters model have to deal with random checks by any voter.

<comment><USER36> This is a horrible idea that breaks the idea of secret ballot and opens up all sorts of vote buying, coercion and intimidation.

It's absolutely imperative that after you leave the ballot box, noone has the ability to verify what your particular vote was, and you don't have the ability to prove to someone else that you really voted that way, or that ability will be abused on scale, by local "influencers", employers, etc requiring the people to demonstrate that they voted "correctly". The mixing up of ballots in the ballot box is a very important feature for the elections.

<comment><USER37> Or is it? It seems to me simply outlawing both asking and disclosing would deter these problems well enough.

<comment><USER38> It would be pretty hard to stop. Many elections come down to under 50k votes, which will lead to either candidates or their supporters buying votes for cash (with 30% of voters not even bothering to vote, $10 a vote would probably be plenty to entice people), or each side finding a handful of cases where this did happen and claiming it happened on a larger scale. It would call the whole election into doubt.

</comment></comment></comment></comment><comment><USER39> For as long as I can remember, I have been able to get a receipt from every fuel pump that tells me where I was, how much fuel I purchased, what kind of fuel, what pump I was on, how much I was charged, how much tax was added and the time of day. This has been the case throughout every part of the U.S. I have driven. The fuel companies can also verify everything that is on the receipt.

I am not suggesting we vote on fuel pumps. I am simply pointing out that this appears to be an artificially created problem and not a technical problem.

<comment><USER9> Giving a comfirmation that person has voted for a specific candidate simplifies buying votes. Also, an employer might require employees to bring such a confirmation to prove that they support corporate values.

<comment><USER40> The point isn't to get a receipt that I personally voted. The receipt analogy isn't that exact. The point is create a verifiable paper trail for the event that _some_ registered voter voted a certain way. Paper ballots do that. He's just pointing out how ridiculous it is to argue that it's somehow too expensive or onerous to create a paper trail when every parking lot, every coffee shop, every store is able to create a more extensive paper trail even for the most inconsequential transactions.

</comment></comment></comment><comment><USER10> For those proposing solutions to problems that may not actually exist, here's an idealized paper ballot chain of custody, in story form...

A ballot is printed. It is then packaged, along with many of its siblings, in a stack. That stack of ballots is placed in a sealed package, and that package is given a serial number.

The state election officials receive this sealed package from the printer and record its serial number. It is then put in locked storage.

At election time, the package is taken from the warehouse and delivered to a polling place. At the polling place, at least two election judges, from different political parties, accept the package and sign for it.

The package is taken to a table staffed by at least two election judges, along with folders, pens, and "I voted" stickers. It is opened, the contents validated, and custody signed off by those judges.

Another table has printed rolls of all registered voters for the precinct, and at least two judges. When a voter arrives, they give their name (no id needed), and the judges look them up. They sign their name next to their registration, and go to the ballot table. Meanwhile, the judges increment the count of how many voters have signed in.

At the ballot table, our ballot (remember our individual ballot?) is handed to the voter in a folder, along with a pen and a sticker. The ballot is now in the custody of the voter, who signed for it in the registration book.

The voter goes to a booth, fills in their ballot, and inserts it in a ballot box. (This may be a Scantron-type machine that also reads the ballot.) Assuming automation, the box reads the ballot, tallies the results, and drops the ballot itself in a locked internal box.

At the end of the day, the judges write down the total number of ballots in the machines. They compare this to the number of voters who signed the registration. If these numbers do not match, these results are hand-counted again.

Assuming everything matches, the judges report the preliminary results from the machines (or if they are not machines, the judges count the results of the ballots). The locked ballot boxes are removed from the machines by at least two judges, and signed off.

Unused blank ballots, both opened and sealed, are also counted.

The locked ballot boxes are then delivered to state election officials, who sign off on receipt.

In case of an audit or a recount, each box can be traced to the individual machine and compared to the machine count.

So... what security problems do you see with this model? And what solution do you propose for the problem you see?

</comment><comment><USER41> As an eastern european, I see the case a bit different. Corrupt governments and cheating locals were always able to "hack" voting. I would rather trust a blockchain based -fully transparent and real-time- voting system than the actual one.

</comment><comment><USER42> I miss the really old lever machines - they were incredibly satisfying to use.

[https://www.thedailybeast.com/rip-lever-voting- machines](https://www.thedailybeast.com/rip-lever-voting-machines)

</comment><comment><USER43> 1\. Check in the voters as usual, but issue them a paper ID for the ballot they can take with them (either a printed receipt or a tab they can tear off the ballot maybe?).

2\. Publish results to the public Internet using the ID as an anonymizer.

3\. Anyone who wishes to report that their vote was improperly counted or not counted at all can simply present their receipt to verify their identity.

Why is this hard?

Edit: obviously there are complexities when it comes to people who either misremember their selections, but I also see no reason you couldn't also have a copy of your ballot emailed or printed out for you from the voting precinct.

<comment><USER44> Because votes could be sold. E.g.: "Show me your receipt to prove how you've voted for, and we'll give you $50"

<comment><USER43> Can't people already do this with a smartphone?

<comment><USER45> In the US, it depends on the state. Many states have policies or laws about taking pictures in the voting booth. There's quite a few articles about this from the 2018 election.

</comment></comment></comment></comment><comment><USER46> In India, Electronic Voting Machines(EVM) have something called _Voter Verifiable Paper Audit Trail_ (VVPAT) linked with them[1]. When you press the button, you get to see a slip which shows the symbol of the candidate you voted for. If there's a mismatch between both, you can report it to the election official.

1\. [https://jagranjosh.com/current-affairs/what-is-vvpat- machine...](https://jagranjosh.com/current-affairs/what-is-vvpat-machine-with- evm-how-does-vvpat-work-1555312059-1)

<comment><USER47> What happens if the vote is altered after the voter has received their piece of paper?

</comment></comment><comment><USER48> I live and vote in Georgia. It is insanely atrocious here using 20 year old voting machines with absolutely no paper trail.

We had a Secretary of State, whose job it is to secure and maintain the integrity of voting, run for governor but never stepped down from his office due to an obvious conflict of interest, insisted everything was fine, and of course he won.

How can we even remotely trust voting in my state when the impropriety is so thick, we can't breathe. To this day, I do not trust his election or any in Georgia.

</comment><comment><USER49> There never was a need to record and transmit votes electronically. All that we really needed was improvement in how the paper ballots were encoded.

We could have done that with PCs and punch card machines, which have been around forever. No network required.

But companies wanted to make money and elected officials needed campaign contributions. So they decided on over-complicated solutions that we don't need.

</comment><comment><USER50> We have public key encryption and digital signatures but no one wants to put them to good use. Seems by design to me...

</comment><comment><USER51> "16M Americans will vote on hackable paperless machines" just they way _they_ want it.

Who are _they_? I'm not the one for deep state conspiracy or "our corporate overlords" stuff...but what is wrong with paper ballots? What is going on in American democracy?

Is it because it cost more money? It's a f _cking election. One of the most important events in a_ functioning* democracy. Spend. The. Money.

Unfortunately, the US is _NOT_ a functioning democracy in any sense of the word.

      * Disgusting party gerrymandering
      * Packed politicalized court system (esp. the Supreme Court)
      * A broken voting system
      * A broken Senate
      * No limit corporate donations
      * Anonymous super PACS

That's a long and hard list to fix. I doubt we will do it.

</comment><comment><USER52> Obligatory video from Computerphile and Tom Scott on why electronic voting is a _terrible_ idea:

[https://youtu.be/w3_0x6oaDmI](https://youtu.be/w3_0x6oaDmI)

</comment><comment><USER53> Anything can be hacked given enough resources and the temptation to meddle in US elections would simply be too strong for a foreign adversary to resist.

Paper is the only way to do secure elections.

</comment><comment><USER54> Electronic voting is simulated voting. It's that simple.

</comment><comment><USER55> Did someone study the Usability problems of these machines? I would also worry about discarded votes due to some people not being able to use the UI.

</comment><comment><USER56> I'm a bit surprised by many of the arguments posted here trying to problematize paper votes. This is how it is done in Sweden - I don't want to imply that it's without issues, but it should illustrate how all of the "issues" with paper ballots are resolvable.

* Prior to election, all registered voters get a personal "voting card" sent to their home address. The letter also tells you which polling station you have been assigned.

* On election day, each voter goes to the polling station they have been assigned. You need your ID but not necessarily your voting card.

* Staff verify your ID and you go behind a blind where you put paper ballots (with the option to vote for a party, and, optionally, for a candidate in that party) in sealed envelopes, one for each level you are voting on.

* You go back to the staff with your sealed envelopes, staff mark you as having voted and put the envelopes in boxes.

* At the closing of election day, doors are closed, boxes are opened and ballots are counted at the location with multiple people overseeing each step in the process. The results of this counting is announced the day after as a preliminary result.

* Ballots then get put in tamper-proof bags and transported (again, with oversight) to a hub per district where counting is done again. Final results are announced about 10 days after election.

* Voters who can't vote on their assigned location on election day can vote in advance at any location. The process works the same, except the sealed envelopes are put in another envelope, together with the voter card mentioned above. These ballots are saved for election day, when they are counted together with the normal votes.

* There are also mechanisms for voting via mail (arguably less secure) or at embassies in foreign countries. The process is similar as for advance votes.

* The public is invited to be physically present to monitor the counting of votes.

There's zero machinery involved. The votes are anonymous, yet double-voting is prevented. Counting is done more than once by default. I understand from here that the U.S. is exceptional in that you can't expect registered voters to have a strong ID. I am sure some kind of strong voter IDs could be issued (for free, obviously) that can accommodate for that.

I can not imagine that doing manual recounting of votes and ensuring integrity with manual labor is significantly more costly than the contracts with voting machine suppliers. If it is, it's worth it. In my opinion, provably fair, free and anonymous voting is the killer app for blockchain. It is still a theoretically unsolved problem, however, and until we get there (if we ever do), machine-less paper voting is strictly better than both electronic voting and electronic counting of votes. If anything, the manual counting can be _supplemented_ by electronic counting machines.

You think the U.S. is unique and this won't work because of federalization? We still somehow manage to pull off voting for European Parliament.

More info for the curious here: [https://www.val.se/servicelankar/other- languages/english-eng...](https://www.val.se/servicelankar/other- languages/english-engelska/voting-cards.html)

</comment><comment><USER57> Not sure if anyone saw Dr. Robert Epstein testimony. It was scary to hear that Google not only introduced bias into search that could affect 15M voters, and Facebook could send selective "Go vote" to one voting class or another. I'm encouraged to see that Epstein's team has been building monitoring systems for these scenarios.

[https://www.youtube.com/watch?v=kMU2Vo6_CEQ](https://www.youtube.com/watch?v=kMU2Vo6_CEQ)

</comment><comment><USER58> If all sides have equivalent hacking power, my gut would say balance would exist; it would continue to be a fair vote. But I don't think that's the case. Not sure why we can't rely on SSN to uniquely AND securely identify all eligible (living) voters. #gildedAge #foodForThought #redditDoesntUseTagsDoThey

</comment><comment><USER59> EVM with Voter Verifiable Paper Audit Trail(VVPAT). Worked in India, at scale.

</comment><comment><USER60> Hopefully someone will hack the machines so you can only vote No.

</comment><comment><USER61> In the most contested counties and states, one assumes.

</comment><comment><USER62> bush proved paper machines can be falsified too.

</comment><comment><USER63> Actual democracy was never this system's cup of tea anyway

</comment><comment><USER64> why hack the machines which will be watched for, just turn off the power in any city you can, machines won't work and people won't go out and vote

remember it's not a popularity contest, it's electoral college

</comment><comment><USER65> A ten year old technology named Blockchain could solve this problem.

<comment><USER66> I'll wait while you explain this. This only works if you are OK with an immutable record of how you voted which the US officially isn't.

</comment></comment><comment><USER67> Why the GOP so against election security? It seems insane that any group would be against your vote counting properly.

Of course they're also pro gerrymandering and disenfranchisement, so it does make sense...

</comment><comment><USER68> If we've managed to move the entire commerce and financial sector online we should be able to security digitize voting too with proper authn/z.

<comment><USER69> The big difference is with commerce and finance, we want to keep track of who moved what where. With voting, we deliberately want to keep votes secret, so no one can figure out who voted for which candidate, and only know the total votes each candidate got. To minimize coercion, we also want to make sure that a voter can only prove they voted, but not which candidate they voted for. These constraints make electronic voting at least an order of magnitude harder.

<comment><USER47> This seems like the perfect application for zk-snarks. (i.e. prove that a valid vote occurred, but not where the vote came from).

</comment></comment></comment><comment><USER70> We should be more worried about voter id. I still don't understand how you can vote without a legal id. I mean look at California, they require zero proof of your identity to vote according to Wikipedia. That's bonkers to me.

In my home country Bolivia, we are required to present a valid national ID to vote.

<comment><USER71> In the US elections are run by the states, and unfortunately a certain consistent set of them are well known for making it extremely difficult for certain groups of people to vote. Since voter ids would be given by the states, there is historical evidence to suggest those specific states can not be trusted to not use said ids as a way to discriminate against those they do not want to vote.

<comment><USER70> This sounds like bullshit presented as a butter croissant.

</comment></comment></comment><comment><USER72> If we are so interested in fair results, why not have voter ID laws? Instead of fighting these laws, why not make it easier for everyone to get an ID?

<comment><USER73> Because the average activist has absolutely no way of forcing state legislatures to allocate funds and draw up plans for something they have no interest in. Voter ID laws do not currently solve a big problem, are not implemented in good faith, and fighting them is much more effective and realistic than asking for something that will not happen.

If we want voter ID laws, why not make it easier for everyone to get an ID first, and then enforce voter ID once that effort has succeeded?

<comment><USER72> Exactly point point. My problem is that certain political groups are pushing for no voter ID laws, which just makes it easier to fake votes.

Why would anyone be for this if not to subvert our Democracy?

<comment><USER74> Vote-faking is not a problem. Elderly people who have extreme difficulty obtaining an ID (that they otherwise do not need) is an actual, real life problem.

I find it odd you are so concerned about a non-problem but not concerned about the actual problem of eligible voters being actually disenfranchised.

<comment><USER72> So back to my first point: instead of making it easier for entities like the Russian government to subvert our Democracy, why not just make it easier for the Elderly to get IDs?

I also don't think that there are that many people that don't have IDs. I have seen absolutely no statistics on the topic, but I have seen multiple groups survey different parts of various cities and nobody had issues getting an ID. It's pretty much needed in almost any aspect of life.

You can't even get welfare or government assistance without some form of ID, so you can't tell me you can't get one to vote.

My point still stands.

<comment><USER74> I don't know where to start. Your knowledge of these systems may not be broad enough to draw meaningful conclusions. For example, you can apply for and receive government services with only a Social Security card. A state-issued ID is not needed.

Millions of eligible voters do not have state-issued ID. Estimates put it at 10-20 million Americans. The primary utility of a state-issued ID is to drive on public roads and there are 10's of millions of Americans who do not drive on a regular basis.

The suggestion you make, that we should make it easier for people to get IDs, falls apart when we recognize that every state sets up their own system of issuing IDs. It would take a _very_ strong federal law to bring states in line to the point where we could have confidence that every eligible voter in America could obtain an ID for free and regardless of individual circumstances.

As for Russia "subverting our Democracy", there is zero evidence that Russia or any other foreign entity used the lack of voter ID laws in some states to influence any elections.

</comment></comment></comment></comment></comment></comment><comment><USER75> Voting could be digitized with blockchain technology. No need to waist the paper.

1\. Create a blockchain app that runs as a web app. 2\. Tie it to a persons Social Security Number. 3\. Allow folks to download the app. Prove citizenship through a set of questions and cast a vote.

<comment><USER76> My god. You've solved voting! We've been waiting so long. Call the New York Times!

</comment></comment><comment><USER23> > Senator Ron Wyden, a leading Capitol Hill voice on election security, has > persistently pushed legislation that would federally mandate paper ballots, > among other security measures. The legislation has been blocked by the > Republican Senate majority leader, Mitch McConnell.

It's pretty clear what is happening. Given the obvious international attacks on US democracy in the last elections, it seems like a no-brainer that we'd have a bi-partisan effort to secure our elections. But we don't, and the side that doesn't want better election security is also the side that "won" the last election, _while_ it was being hacked by foreign adversaries and _while_ publicly asking the very same adversaries for assistance in hacking the Democrat's emails.

It's beyond suspicious.

<comment> munk-a The beautiful thing with paper ballots is that the case is clear cut and strong enough without even dredging any of that up... it's just that partisan politics has become so entrenched that even mutually beneficial bills need to be passed with concessions to the less interested party.

I'm fine with a debate on the specifics but paperless voting machines have no place in the world. What you're giving up far outweighs the marginal benefits.

<comment><USER77> The problem is that it isn't mutually beneficial in terms of the next election cycle.

<comment> munk-a It absolutely is, while the winner may be influenced by the lack of a paper trail the real cost to society is the erosion of trust, there is a not insignificant portion of the country that currently believes our last election was no democratic[1]. If the Dems win in 2020 and the GOP similarly questions the legitimacy of the election - whether legitimately or not (say if Trump were to refuse to leave until a recount could be conducted) then that proportion will grow. There is a level that proportion of mistrust can reach where the US will devolve into anarchy, then everyone loses the game forever.

Just to note, please don't read politics into this, I've attached my own leanings clearly in case anyone thinks I favor one side or the other but I am trying to state this without it being partisan in nature.

1\. And while I'm a progressive, I'm _not_ in this camp.

<comment><USER78> There are actors, who were involved in that election, who see discord, chaos, and a weakened US as a bonus, no matter who the winner.</comment></comment></comment></comment></comment>


Ask HN: What will the world look like after capitalism? - <AUTHOR>

Simple question: what social or economic arrangement will replace capitalism when the time eventually comes? <comment><USER2> I'm not sure the current system is actually capitalism - it's more like a corrupted version where lobbyists manipulate policy to suit large corporates.

Being a free-markets kind of person, I'd like to see real capitalism at the small-scale: individuals creating products & services of value for the world and being rewarded properly for those things.

I would think that the likely replacement for what we've got at the moment is likely to be the antithesis of capitalism: socialism.</comment>


Scott Aaronson on Penrose's argument (why machines can't think) - <AUTHOR> http://www.scottaaronson.com/democritus/lec10.5.html

<comment><USER2> For those not familiar with the Penrose argument, here it is, slightly simplified:

\- Consciousness is weird and we can't explain it.

\- Quantum mechanics is weird and we can't explain it.

\- Therefore, consciousness and human intelligence must come from quantum mechanics.

Yeah, yeah, I know, that's obviously not how he frames it, but it's close. I read his book a few years ago, expecting some great insight but seriously, that's all there is to it.

He actually claims that mathematicians have some magical ability to "see" in to a parallell universe of mathematical answers, an ability that computers lack. How can this argument even be taken seriously?

<comment><USER3> Quantum mechanics is weird, alright. But we can still predict what's going to happen, as we have theories. Do we have such a formal theory for consciousness?

<comment><USER4> Quantum mechanics is objectively observable, consciousness is not. It's a very different kind of beast, therefore.

</comment></comment></comment><comment><USER5> An interesting argument, but the lookup table argument falls flat.

The number of inputs is pretty much infinite, not finite like he says.

I emailed him this, I'll post here if he replies:

      I think you are incorrect about the lookup table. Just
      walking around a city will provide more input permutations
      than any lookup table could possibly encode.

      You assumed that responses are always deterministic, but
      actually peoples behavior is influenced by what they have
      seen recently. Or even what they have been asked recently!

      Every lookup table will also have to include the result
      of choosing any question from the lookup table - and in
      what order.

      The possible number of orderings of that grows far faster
      than any finite lookup table could encode, because simply
      asking a question in the lookup table changes the answer
      to all further questions.

<comment><USER6> I think you're confusing "finite" and "small enough that I can imagine something that size".

A billion operations per billionth of a second for a billion years is still finite, it's just big.

<comment><USER5> I am not confusing them.

My argument is that each time you add a question to the table, you need to encode an answer that depends on all the other questions asked.

Meaning the number of answers is exponential (actually factorial) to the number of questions in it. Such a table is essentially infinite.

i.e. if you have 10 questions you have 3 million possible answers. But with a million questions you have 8 x 10^5565708 answers. I hope you realize how big this number is.

<comment><USER7> The difference between infinite and "essentially infinite" is that one is infinite and one finite. That is a large number, but it's not infinitely large.

<comment><USER5> You are speaking about math, I am speaking about complexity theory.

<comment><USER7> As far as I'm aware complexity theory doesn't have it's own special definition of "infinite".

Just to be clear, I'm totally in agreement with you that a lookup table based AI would not actually be possible in the real world, but I don't think any sane person would claim that.

<comment><USER5> I didn't say infinite! I said "essentially infinite".

I would have used the exact term from complexity theory, except I don't know what it is for n! - the highest they have is EXPSPACE which is 2^n (which is smaller - much smaller).

<comment><USER8> I thought you said "pretty much infinite". Either way, neither "essentially infinite" nor "pretty much infinite" is a meaningful concept (I can just picture infinity, off at the nonexistent end of the number line, laughing at the puny numbers you describe as "essentially infinite"), so it'd be better to just rephrase it as "really really big", with as many "really"s as you feel is appropriate.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I took a theory of computation class with Prof. Aaronson and this brought back some fond memories. I like the fact that he's formal when he needs to be, but doesn't shy away from using simple "real-life" examples when he can. Think about how many professors would use a line like:

> can the human mind somehow peer into the Platonic heavens, in order to > directly perceive (let's say) the consistency of ZF set theory? If the > answer is no -- if we can only approach mathematical truth with the same > unreliable, savannah-optimized tools that we use for doing the laundry, > ordering Chinese takeout, etc. -- then it seems we ought to grant computers > the same liberty of being fallible. But in that case, the claimed > distinction between humans and machines would seem to evaporate.

Wonderfully written. I may not understand Godel's Theorems or ZF, but i did gain an understanding about some faults in Penrose's argument.

</comment><comment><USER10> How old is the book he mentions? Is the argument still viewed seriously apart from a mental exercise?

If the answer is yes, I'd be puzzled. It's naive to think that computers in XXIII century will be anything like current ones. _We_ are after all machines and I find no reason any complexity (quantum, midichlorians or whatever) that we have can't be introduced in the construction of future computers.

That's like a XIX scientist saying that a microscope will never be able to see atoms. Surely he could have demonstrated it with good math.

Rephrased. the argument should be "computers as are built now can't think" that is so obvious simply because lack of power.

A reasonable simulation of conscience that tries to resemble that of a living organism would need at the very least senses, pain/pleasure, feedback (if I want to move, I can,) all throwed in an integration layer that "feels" everything at once.

First we should see if we're able to simulate an ant, then a mathematician brain :-)

Current simulations of living beings or colonies have value for statistical studies, but they're nothing in which that impossibility assertions can base.

<comment><USER8> It may still be viewed seriously by people who really _want_ to believe that there's something essentially different about human consciousness, and that we are not "just" fancy meat-computers.

I don't know if it has ever been taken seriously by anyone who doesn't approach the problem from that point of view, though.

</comment></comment><comment><USER11> Encapsulated this is Penrose's argument in a crude fashion

1\. Humans can perform _Turing-uncomputable_ operations (mathematicians mainly) 2\. _All_ of present day physics is computable 3\. So there should be some uncomputable physics yet to be discovered. 4\. Penrose feels this new physics should be in quantum mechanics.

A small video of Penrose's argument : <http://www.youtube.com/watch?v=9Gl6aThSs1s>

On one hand the very notion that a computing device is conscious is patently ridiculous. Why? Because everything computes something. Even my fan computes a function so does the engine of a car[1], but are those artifacts conscious? The only honest answer is to say that this is a difficult problem.

This is a very good interview of David Chalmers (the philosopher who originated the term "Hard problem of consciousness") that I found on HN sometime back

<http://www.youtube.com/watch?v=NK1Yo6VbRoo>

Obligatory XKCD reference: Can a bunch of rocks be conscious? <http://xkcd.com/505/>

[1] Very trivially they compute the function which describes their dynamics.

</comment><comment><USER12> Penrose's argument has always been full of it.

Humans aren't Turing-complete; they can certainly emulate a small, finite, Turing machine, but they can't emulate an arbitrary large one.

An individual human is not complete in any way; look at how many people have failed to proof Fermat's last theorem.

Finally, people aren't consistent; Robert Penrose can say "Penrose will never utter this statement" and the roof doesn't fall in.

</comment><comment><USER9> > why not go further, and conjecture that the brain can solve problems that > are uncomputable even given an oracle for the halting problem

Can anyone give me an example of such problems?

<comment><USER13> The halting problem, for instance: whether or not a e.g. Turing machined will halt on a given input or loop endlessly.

<comment><USER9> Sorry if i wasn't being clear. I mean problems that remain undecidable even when you have an oracle for the Halting Problem.

<comment><USER14> I don't know whether you're going to like it, but the most obvious example of a problem that is undecidable even given an oracle for the halting problem is the next halting problem up: i.e. given a Turing machine that has an oracle for the halting problem, does it halt?

<comment><USER4> Turtles all the way down.</comment></comment></comment></comment></comment>


Facebook is embedding tracking data inside the photos you download - <AUTHOR> https://twitter.com/oasace/status/1149181539000864769 <comment><USER2> If anyone who works at Facebook reads this, I am so very curious, when you're asked to build something like this, how do you approach that morally? I really want to know the opinion of someone actually working there.

<comment><USER3> If you live and work in the US, the substantial part of your taxes is spent on invading other countries, killing innocent people and propping up dictators.

> how do you approach that morally? I really want to know the opinion of > someone actually working there.

<comment><USER2> Whatever country I live in, I certainly didn't choose to be born there, and moving to another country is often more expensive than is possible for most people. I don't see how this compares to actively seeking a job at Facebook. I also don't think that the US doing bad things is an excuse for Facebook to do bad things.

<comment><USER4> The question was "how does it feel?". Not a really useful or interesting question, but there it is, at the top, and for a lot of people here, the answer is "exactly like what you're doing".

> _See what gross inconsistency is tolerated. I have heard some of my townsmen > say, "I should like to have them order me out to help put down an > insurrection of the slaves, or to march to Mexico;—see if I would go"; and > yet these very men have each, directly by their allegiance, and so > indirectly, at least, by their money, furnished a substitute. The soldier is > applauded who refuses to serve in an unjust war by those who do not refuse > to sustain the unjust government which makes the war; is applauded by those > whose own act and authority he disregards and sets at naught; as if the > state were penitent to that degree that it differed one to scourge it while > it sinned, but not to that degree that it left off sinning for a moment. > Thus, under the name of Order and Civil Government, we are all made at last > to pay homage to and support our own meanness. After the first blush of sin > comes its indifference; and from immoral it becomes, as it were, unmoral, > and not quite unnecessary to that life which we have made._

\-- Henry David Thoreau

</comment></comment></comment></comment><comment><USER5> Someone else dug further into this [https://stackoverflow.com/questions/31120222/iptc- metadata-a...](https://stackoverflow.com/questions/31120222/iptc-metadata- automatically-added-to-uploaded-images-on-facebook)

<comment><USER6> Yeah, years ago. Nothing new here. Running "exiftool FB_IMG" would reveal the same "structural abnormality" (not an abnormality though because its part of the valid IIM block of the file). See [https://sno.phy.queensu.ca/~phil/exiftool/TagNames/IPTC.html](https://sno.phy.queensu.ca/~phil/exiftool/TagNames/IPTC.html)

</comment></comment><comment><USER7> I can see this being an extremely valuable tool for preventing identity theft on the site. One of my teachers had been the victim of a scammer who had cloned her profile and was reaching out to everyone on her friend list. When the fake profile was reported, it was taken down very quickly, which I imagine could have been done programmatically with this data on the photos.

There's speculation that FB could infer relationships with this. If you've ever shared memes, you'll know this this is unlikely to be effective.

At the end of the day, in an age of reverse image search and public profiles and commodity facial recognition, what is actually the threat model here? That someone is able to tie an unattributed photo back to the URL it was downloaded from? That if someone downloads your photo without permission (why did you upload it in the first place?) and they share it but don't say where they got it, someone else can potentially find out where it came from?

It's unclear whether this ID even uniquely identifies the uploader or downloader publicly. If it's a random UUID, then what? Facebook doesn't reasonably need it to track you (they could use the hash, face recognition, your session, etc). I honestly can't think of a case that would make this valuable to a malicious third party. Beyond content moderation (and maybe saving some CPU time), I can't see much of a use case for Facebook either.

<comment><USER8> Yeah I can't tell what the harm is from the metadata and would appreciate someone actually explaining, rather than seeing some metadata and immediately jumping to the conclusion that there's definite harm and "tracking" going on.

</comment></comment><comment><USER9> ExifTool is the standard app for playing with photo metadata:

[https://www.sno.phy.queensu.ca/~phil/exiftool/](https://www.sno.phy.queensu.ca/~phil/exiftool/)

Looks like Facebook is adding IPTC field Original Transmission Reference, which you can view with:

exiftool -IPTC:OriginalTransmissionReference image.jpg

It seems different for each picture.

<comment><USER10> It is

      exiftool -IPTC:SpecialInstructions

(it will be a string starting with FBMD.)

And while it's obviously (can be used for) for tracking, it's just a exif tag, "Special instructions" is a text for humans, not machine instructions.

So s/Structural abnormality IPTC special instruction/a standard exif tag/ for less click-bait.

<comment><USER11> FBMD01000ab5030000930700008b130000ae130000011400005d3f00009b740000ce750000f1750000277600005eaa0000

</comment></comment></comment><comment><USER12> This isn't something new, it's been known for years: [https://www.hackerfactor.com/blog/index.php?/archives/726-Fa...](https://www.hackerfactor.com/blog/index.php?/archives/726-Facebook- Tracking.html)

<comment><USER13> The value derived from this post is not it's "recentness" but to make aware of a practice by fb to the users of this site, specially in the light of fb importance on privacy matters and global politics in recent years

</comment></comment><comment><USER14> As a hobby photographer who dealt with some image metadata manipulation, I find this quite interesting. Interesting enough to question if this could be something we ourselves can be using, say, for a WordPress plugin, so tracking down copyright abuse would be more simpler.

Does anyone know existing, working solutions for this? Is IPTC purged as well by CMS systems, similarly to XMP or EXIF?

<comment><USER15> Certain providers will strip your exif data completely. I've seen email providers, I think yahoo, and other websites do it. The geotagging has definitely been removed as well as the exif camera data. It might be hard to track images this way if everyone is manipulating it including FB/Insta.

</comment></comment><comment><USER16> What's exactly an IPTC instruction? Seems to be this [https://iptc.org/standards/photo-metadata/](https://iptc.org/standards/photo- metadata/)

It's also not clear what the data contains. Is it info about the original account? The account downloading the picture

I would not be surprised if this was being used to prevent fake accounts being created with pictures taken from legitimate accounts.

<comment><USER17> It would in theory be enough to embed a random unique ID and keep the associated data on your own server so the actual data doesn't leak.

<comment><USER13> Is not only so the data doesn't leak, is also to make it as small as possible so is less likely to be corrupted unintendedly by third party software or protocols.

</comment></comment></comment><comment><USER18> Therefore this is happening with Instagram as well, of course.

<comment><USER19> Is WhatsApp doing it too?

<comment><USER20> So far no, whatsapp isn't doing it as someone checked. Maybe in the future:

[https://mobile.twitter.com/17haval/status/114997853789964288...](https://mobile.twitter.com/17haval/status/1149978537899642880)

</comment></comment></comment><comment><USER18> If the photograph is copyrighted, how does this modification and embedding of tracking data by a third party affect the owner, if it does at all ?

<comment><USER21> By posting the photo to Facebook in the first place, you are giving them near unlimited freedom to do with it as they will according to their usage policies.

<comment><USER22> That freedom can only be granted by the copyright holder, however.

<comment><USER23> It's apparently a bit of a hassle to get it removed at times though. And in most cases far to late for it to really matter: [https://www.youtube.com/watch?v=L6A1Lt0kvMA](https://www.youtube.com/watch?v=L6A1Lt0kvMA)

</comment></comment></comment></comment><comment><USER24> Is it possible that this is for finding out who is re-posting private pictures, like on ex revenge websites and co?

<comment><USER25> The knowledge that people can ref things by their hash is a serious problem for power centers.

<comment><USER17> What does this comment mean? I understand the words, but not the meaning.

</comment></comment></comment><comment><USER26> > The take from this is that they can potentially track photos outside of > their own platform with a disturbing level of precision about who originally > uploaded the photo (and much more).

How is it any more powerful in that regard than just hashing the photo?

<comment><USER27> Uploaded photos on many sites undergo postprocessing that may change the hash of the image, different compression technique, etc. without modifying the EXIF data.

<comment><USER26> Not if you use a perceptual hash, which is a well established technique that Facebook already uses for other purposes

<comment><USER28> Furthermore, plenty of platforms will remove EXIF data.

I made a LaTeX equation rendering script that embedded the source LaTeX in EXIF data, the idea being that you could edit the equation after the fact without having to save the source. But practically every tool I used would strip the EXIF data - so I moved to storing the source in the least significant few bits of the pixel values. This worked much better with the places I was uploading the images to (google docs mostly). Obviously fragile to image format conversion though.

<comment><USER29> Love that idea for LaTeX.

For anyone interested, storing information/messages inside another file is called steganography ([https://en.wikipedia.org/wiki/Steganography](https://en.wikipedia.org/wiki/Steganography))

</comment></comment></comment></comment></comment><comment><USER17> Looking at some examples given in the linked pages on this here, it stands out that there is a structure to each of the 32 bit records in this data. The first 16 bits are nearly random, but the second set obeys some rule: the third octet is a low number and the hole set of records is sorted by that. The fourth is always zero. If this is intended to be a kind of tracking identifier, this structure is a bit odd. Intuitively, I would rather interpret this as a list of tags that are stored in-band with the image.

</comment><comment><USER30> Indian government has asked whatsapp to make all messages traceable to it its origin.

From the twitter thread, whatsapp isn't currently doing it though. But this can be used to find the origin of images.

[https://thenextweb.com/security/2019/06/18/india-is-still- ho...](https://thenextweb.com/security/2019/06/18/india-is-still-hounding- whatsapp-to-make-its-messages-traceable/)

</comment><comment><USER31> Isn't it the same as printers watermarking printouts? I don't see this as a necessarily bad thing. In a public forum in a far from perfect world there should be a place for accountability when people distribute photos they shouldn't.

<comment><USER32> Printers shouldn't be watermarking printouts and neither should Facebook.

<comment><USER31> They shouldn't, true. But they are. And have been for a very long time. People who require anonymity would/should/could subvert all those things. But just to give one example: if the daughter I don't have for example was to be targeted by some ex boyfriend posting private photos, I would like to be able to pinpoint the source of those photos. In the case of Facebook that tracking/watermarking is limited to stuff coming out of the FB platforms. Open any photo done with a digital camera and you can get a lot of information from the raw data as well. What I'm saying - a blanket objection of all 'meta' tracking data is not helpful - because it does and will keep on happening. Education on how to work around it when it's needed is maybe the solution. And in some cases, like the example I gave, that tracking data can actually be used to do good.

<comment><USER32> No amount of tracking is acceptable in the same way the freedom of speech is absolute (no censorship is acceptable).

You can say it is not a slippery slope but our rights _are_ eroded when we compromise.

If you need tracking you put the dots on your own print outs. There is no need to have dots on everyone else's print outs.

<comment><USER31> I do not approve of any printer that watermarks my printouts. There is no two ways about that. Tracking is a side effect of showing us ads. We will be shown ads no matter what because they pay for the services we get for free and the 99% don't mind them. Without tracking on the ad front we'll see random ads, they would be less effective, that industry will ultimately collapse and we will start paying for every single service we use. Again - I do not condone it, but I don't have the will personally to fight it or let it affect me in any way. When i want my actions to be untrackable, I will take steps to make them so. I would however like both the ad world and consumers to reach some sort of middle ground in regards to what is acceptable and what is not. They way things are now are out of balance in favour of advertisers. It should be corrected.

</comment></comment></comment></comment></comment><comment><USER33> Does this 'IPTC' tag survive common image editing? Or are they targeting it towards an external application?

If it was just for recognizing re-uploads, they could have just stored the sha-256 hash serverside..

<comment><USER34> It's up to the editor to keep metadata. In Gimp you can choose in the advanced export settings, but I don't know the default. Re-encoding will definitely change any hash, but editors may (not sure how commonly) keep these tags. You'd have to do steganography if you want it to be more persistent than a metadata tag.

Edit: I just saw it's not a normal EXIF tag, this is something else. I'm not sure how this is handled, might be interesting to do some empirical testing!

</comment></comment><comment><USER35> Normally this would make everyone stop uploading photos to facebook. But most have already.

My facebook usuage has gone from every second to maybe once a day. There is a rot happening and this will become a dangerous time for anyone who used facebook as facebook will slowly sell them out and in the end exort them. Want to keep these photos private you uploaded 10 years ago and deleted? Pay..

</comment><comment><USER36> I think if you email a photo on gmail it strips the meta data from the photo.

I had this problem when I was trying to use the meta data to get the orientation.

<comment><USER37> It's good practice for any website that takes image uploads to strip unnecessary metadata, as people can inadvertently reveal their location (geotags) or identity (serial numbers etc) otherwise.

<comment><USER38> For websites in general yes but I do not want an e-mail client that, unbeknownst to me, manipulates data in transit. Time to pgp-sign the attachments on mails, too? :/

</comment></comment></comment><comment><USER39> No indication of what it means. Has anybody tried to download the same picture from two accounts and see if the data changes? Maybe this is some data they embed into the picture for bookkeeping when inside their infrastructure and they forget to strip it when they let you download it.

<comment><USER13> Nah, is extremely useful for them to know when a picture is being re-uploaded so I dont believe for a second they "forgot to strip it"

</comment></comment><comment><USER40> I'm curious, but are we biased here on HN or is it literally every piece of news that's coming out on that company is about another nasty privacy invading practice at Facebook? Although I admit there are some posts about FB open source projects here too.

<comment><USER41> I think Facebook is biased itself towards doing a whole bunch of nasty privacy practices, not HN in reporting them.

</comment></comment><comment><USER42> I think this may well have been found a while back:

[https://stackoverflow.com/questions/31120222/iptc- metadata-a...](https://stackoverflow.com/questions/31120222/iptc-metadata- automatically-added-to-uploaded-images-on-facebook)

<comment><USER43> What you thought one hour ago, had been already replied 4 hours earlier to the tweet. I'm not sure if you copied it from there?

<comment><USER44> perhaps that's why he thought it

</comment></comment></comment><comment><USER45> Why don't they encrypt that kind of payload? I suppose tampering with it is easy enough that it would prevent using this data in litigation issues, right?

</comment><comment><USER46> Shouldn't a privacy friendly browser/extension be able to defeat this technique by passing said images through exiftool (or similar) and then caching it?

</comment><comment><USER47> Not to jump on the bashing train, this tracking might not be for advertising purpose only right, this could be put in place for copyright protection.

<comment><USER48> It's Facebook. FB doesn't give 2 licks about an individual.

</comment></comment><comment><USER49> One should note that they went to quite a length to hide it from mainstream EXIF readers

It is not in a comment field, nor it reuses any EXIF guid equivalent

A much more grievous thing they may be doing is speculated to be them encoding tracking into photo's hue channel.

There was time when you was able to see a stripe of odd pixels in the right bottom side of some photos.

Later, I read a blog post saying that if you upload a solid grey picture, you will see weird subtle colour banding patterns on it if you download it back.

I tried myself now, and it did not work for me.

<comment><USER50> "Mainstream EXIF readers" are mostly derivatives/wrappers around Phil Harvey's ExifTool, which has supported IPTC tags for a very long time. Whatever may be interesting about this, the fact that the data is stored in an IPTC tag is not really part of it. IPTC/IIM structures predate Exif by decades: [https://en.wikipedia.org/wiki/IPTC_Information_Interchange_M...](https://en.wikipedia.org/wiki/IPTC_Information_Interchange_Model)

</comment></comment><comment><USER51> Right after that $5B fine too

</comment><comment><USER52> when i read the headline i thought stenography. is it possible to know if they are using such techniques? making exif data a red herring

<comment><USER53> You could try uploading a bunch of images and downloading them again, finding out where they differ. This should be reasonably straightforward. However, FB likely modifies the image in various ways (resizing, maybe they recompress the image to save space, etc). Showing the presence or absence of steganography will probably require a large sample size.

</comment></comment><comment><USER54> There's a simple solution to any problem related to Facebook. Stop using it.

<comment><USER55> Any alternatives for maintaining remote friendships?

EDIT: with passive updates.

<comment><USER56> Any other form of communication – email, IMs, phones etc. If you're not having a conversation but just "like" each other's photos it's not "maintaining a remote friendship" anyway.

<comment><USER55> Passively receiving some updates, i.e. where they've checked in, some new photos, posts/comments, etc... is also useful I think.

<comment><USER56> Yeah, good point. I often find myself wanting to follow what some people are up to (friends or not), and it's always frustrating how it requires you to be a part of a certain platform to do that – you can't follow anyone's instagram, facebook, twitter etc without an account, and even then you still need to go on instagram/facebook/twitter to actually check it out.

I recently created myself a Pixelfed (a federated instagram, basically) and was pleasantly surprised how my profile has a plain, old RSS feed, so that anyone can "track" me without ever visiting a website (which is something that ActivityPub itself also allows, but AP still forces you to be a part of the "system", so to say).

I'd much prefer that kind of Federated world, but I don't see how we can get there in any other way than spreading awareness about it and basically nagging our friends (at the risk of isolating ourselves) – "I wish I could follow your adventures and thoughts, but I don't want a facebook account". This of course requires a critical mass for basically each person, and probably a way of automatically updating the locked-in platforms (for each post you push to pixelfed/blog it updates your instagram/facebook) so that the ones who take a step out don't need to leave their locked-in friends behind.

<comment><USER57> How is using ActivityPub any more being part of the system than having to use the RSS 'system'?

<comment><USER56> ActivityPub requires an account on a server of some sort. RSS is client-only, so the "friction" is much lower.

Of all the people who listen to podcasts through some kind of an app, how many of them have created an account anywhere?</comment></comment></comment></comment></comment></comment></comment>


How Apple screwed up AppleTV - <AUTHOR> http://www.lolife.com/2008/12/how-apple-screwed-up-appletv/ <comment><USER2> When setting up a media/gaming center after spending a long time without even a TV, I was surprised by how little progress there had been. The AppleTV is useless.

My current setup is an xbox 360 + mac mini, and I'm pretty satisfied with it. The mini is hooked up to a Drobo (which I regret purchasing) which holds my media. I serve media off the mini to the xbox using Rivet. I also have automated ripping setup on the mini so that I can pop in a DVD and an applescript takes care of the rest, which makes digitizing my library feasible.

The xbox 360 allows me to watch DVDs, stream movies/TV off the mini, watch Netflix instant viewing, and uh, play games.

The only thing I don't have the ability to do yet is to play Hulu on my TV. I'll have to investigate Boxee for that...

</comment><comment><USER3> They forgot the lack of codec support. Having to convert any movies I want to watch is a bitch.

Why I spent $250 on it? I have no idea.

</comment><comment><USER4> The iPod wouldn't have been much of a success either if it had only been able to play iTunes downloads. The Apple TV would have done fine if it had shipped with either a DVD player or the ability to play downloaded divx/xvid videos. The lesson is: support existing standards, then add your own.

</comment><comment><USER5> Just get a mac mini.</comment>


How Smartphones Can Assess and Predict Academic Performance of College Students [pdf] - <AUTHOR> http://www.cs.dartmouth.edu/~campbell/smartGPA.pdf

<comment><USER2> Looks interesting, but I was hoping for a bit more of a sociological emphasis/conclusion. If the authors are around, it'd be great to hear what they think.

<comment><AUTHOR> check this out - it debates the privacy issues around this subject [http://www.ft.com/intl/cms/s/2/634624c6-312b-11e5-91ac-a5e17...](http://www.ft.com/intl/cms/s/2/634624c6-312b-11e5-91ac-a5e17d9b4cff.html#slide0)</comment></comment>


Show HN: Starred Search – search readmes in your starred GitHub repos - <AUTHOR> https://starredsearch.com/ <comment><AUTHOR> I star anything that looks potentially useful when I come across it. The search function on GitHub's stars page only looks at the repo name and description, and manually looking through a few hundred starred repos is a bore, so I made this.

It was also a learning exercise for building a server-side Swift app using the Vapor web framework ([https://github.com/qutheory/vapor](https://github.com/qutheory/vapor)). Source is here: [https://github.com/mjmsmith/starredsearch](https://github.com/mjmsmith/starredsearch)</comment>


Mbox – A lightweight sandboxing mechanism - <AUTHOR> http://pdos.csail.mit.edu/mbox/ <comment><USER2> I am the author of mbox. Since I got too many emails regarding mbox, here are a few things to clarify.

      - naming: pkgfile mbox || echo looks like a good name
      - support: sorry, I don't have Mac or Windows.

I particularly like to use mbox for redirecting modification to another directory. For example,

      $ mbox -- git checkout file

You can checkout a file without overwritting the current file. You can imagine tons of usecases in this vein. Of course, blocking networks, restricting accesses of other directories, and rootless pkg installations are cute. However, to be a mature tool, I have to admit that there are lots of engineering works left -- support of 32bit .. compatibility layers .. still lots of corner cases.

<comment><USER3> "pkgfile jpeg" || echo looks like a good name. Maybe not.

(I don't have pkgfile but I think the above command would echo the string). I do understand that naming a program is every day harder, but mbox is a really famous format, the de facto standard for storing e-mails. Please consider a different name for your impressive program.

</comment></comment><comment><USER4> Seems like poor naming, what with the mbox file format(s).

<comment><USER5> And in the music community, the Mbox is a popular sound interface for Pro Tools.

<comment><USER6> That's exactly what I thought this was from the title; I thought MIT had obtained a license or somesuch.

</comment></comment></comment><comment><USER7> >At the end of program execution, the user can examine changes in the sandbox filesystem, and selectively commit them back to the host filesystem.

This is a cool idea.

</comment><comment><USER8> Out of curiosity, why choose for the name a term that has been around for nearly 40 years and is associated with something very different?

</comment><comment><USER9> Hmm. Seems _very_ secure.. I can't run anything.

      ./configure
      make
       ./mbox ls

       Stop executing pid=20987: It's not allowed to call mmap on 0x400000

Same error no matter what executable I try. I'm assuming that isn't by design?

<comment><USER10> Same here regardless of the binary on two different Fedora/Debian nodes ..

<comment><USER9> Ubuntu 12.04 here.

</comment></comment></comment><comment><USER11> interesting, i agree with the bad choice of nomenclature though.

I wonder how hard it would be to port it to dtrace (also dtrace would defeat the not needing root requirement).

although macs already include a sandbox[1] i find it everything but intuitive to use. it's already ridiculously complicated to setup. see ironfox as reference [2]. since you have to allow all sorts of mach port process execution pasteboard mach port access, etc.

check this app, which is allowed to play music and access the clipboard, but not access the internet. [3]

[1] [https://developer.apple.com/library/mac/documentation/Darwin...](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/sandbox- exec.1.html)

[2] [https://www.romab.com/ironfox/IronFox-1.5-beta.dmg](https://www.romab.com/ironfox/IronFox-1.5-beta.dmg)

[3] [https://gist.github.com/03a481b6d39912b33d52](https://gist.github.com/03a481b6d39912b33d52)

<comment><USER12> Can dtrace do sandboxing the way ptrace can? I didnt think it could.

<comment><USER13> It would probably be possible using destructive actions (e.g. use raise() to kill the process if it tries to do something bad). It would require root and not be easier than using OS X's built-in sandbox (i.e. if you need to allow access to some Mach services for some APIs to work, that still needs to happen regardless of what you're using to sandbox), but it could potentially be more secure, as OS X doesn't otherwise support limiting syscalls to a small set like seccomp on Linux.

</comment></comment></comment><comment><USER14> It would be interesting to run a benchmark. My impression is that ptrace interceptions would add a significant overhead but I can be wrong. Still, it looks like a great project.

Alternatively they could use unshare and aufs to overlay another filesystem on top of a read-only root.

<comment><USER15> This is addressed in the paper. Performance overhead is in the ballpark of 10-20%. They are able to improve on the performance of a purely ptrace-based sandbox by using seccomp to ensure that only the syscalls that need to be intercepted are sent to ptrace.

The benefit mbox has over unshare+aufs is that mbox doesn't require root privileges.

</comment></comment><comment><USER16> Sandboxie ([http://www.sandboxie.com/](http://www.sandboxie.com/)) is a similar tool for Windows.

<comment><USER17> I love sandboxie but an open source solution would be really nice to have.

</comment></comment><comment><USER18>
        apt-cache search mbox | wc -l
        82

Ouch. How disconnected from the real world can academics get?

<comment><USER19> No more disconnected than the 82nd non-academic who named a program mbox.

<comment><USER20> 'Disconnected'?

       $ apt-cache search mbox | tail -1
       libetpan16 - mail handling library

Looks pretty connected to me.

<comment><USER19> Gah. Well, apply it to the first library named mbox that is not actually related to the mbox file format. My only point is that there are a lot of things called mbox. I don't see why we're singling out academics for criticism. People overload good names.

<comment><USER21> The first person to make something mbox that wasn't the format is the main culprit, but people after him are certainly not blameless either.

</comment></comment></comment></comment></comment><comment><USER22> Does this have anything to do with Linux containers (lxc)?

<comment><USER23> Not really; mbox uses seccomp-bpf to filter system calls, from userland, using unprivileged users. A very ambitious project to build on top of mbox might be an even lighter-weight Docker-alike using userland system call interposition instead of Linux containers.

<comment><USER24> I'm calling it now - such a project should be called "Mocker".

Actually, this is really a good idea. I hadn't realized that non-root users can't start their own Docker images, which I think could be a killer application. Perhaps if the overhead from something like Mbox is low enough, this could be feasible. As it is, I'm not sure I'm willing to fork over the extra ~20% overhead, just to have my applications running in a sandbox, but this could be a good method to distribute complete environments.

<comment><USER25> For some applications I would be more than willing to accept 20% overhead in exchange for perfect security. Still better than setting up dummy virtual boxes.

<comment><USER12> Not sure it is perfect security. There are race conditions with ptrace sandboxes. Have not read the paper yet to see if they mitigate somehow with seccomp.

</comment></comment></comment></comment></comment><comment><USER21> ...because this _really_ won't conflict with the obsolete email storage format, right?

</comment><comment><USER26> Kudos to the authors for releasing their source code on github. The code may have some rough edges at the moment, but putting it on Github is a great way to encourage collaboration / improvements, and can only encourage greater adoption of their ideas.

</comment><comment><USER27> Slides end with a few questions:

> Why 20% on tar? just rewriting path arguments doesn't seem to be demanding > work.

Is most of that the overhead from syscalls being filtered by seccomp/BPF?

</comment><comment><USER28> Definitely looking forward to seeing this progress. It certainly seems to fill a void especially in a world where it is quite common to share command line tools as seen earlier today in the post about "hr for your terminal"

[https://news.ycombinator.com/item?id=7213347](https://news.ycombinator.com/item?id=7213347)

</comment><comment><USER29> [http://fakeroot.alioth.debian.org/](http://fakeroot.alioth.debian.org/)

<comment><USER30> If you want to provide a redirected environment for a presumptively non- malicious process, fakeroot works fine. It's not a secure sandbox, though, because it's based on intercepting system calls with LD_PRELOAD, and a process that wishes to can avoid being intercepted in that manner, since it's just enforced by the shared-library loader. So processes that are statically linked, or that have direct syscalls compiled in, will bypass the LD_PRELOAD replacements. The seccomp mechanism, by contrast, is enforced by the kernel.

<comment><USER29> the point is that mbox only uses seccomp with -s and most of it (ie the rest) is what fakeroot does already.

</comment></comment></comment><comment><USER31> Very cool project; really terrible name.

</comment><comment><USER32> The mechanism seems similar to PRoot ( [http://proot.me/](http://proot.me/) ) which uses ptrace to intercept filesystem operations to create a userspace chroot.

I wonder if there's value in creating a library for intercepting filesystem operations via ptrace...

</comment><comment><USER33> Would this work well for sandboxing python? I want to allow users some light scripting to manipulate their data.

</comment><comment><USER34> I'm guessing that this only works with dynamically linked binaries, similar to LD_PRELOAD-based solutions?

<comment><USER35> I don't see why; seccomp should work on any kind of process.

</comment></comment><comment><USER36> I have been waiting for an app that does this for a long time.

Too bad both the deb link and makefile are broken.

</comment><comment><USER37> Some people still run on 32bits machines. Time to git clone and make*.

post clone update: no i686 support.

</comment><comment><USER38> I like it!</comment>