'Tor Stinks' presentation – read the full document - <AUTHOR> http://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document <comment><USER2> Today's full Tor coverage by the Guardian is: (Greenwald's article) [http://www.theguardian.com/world/2013/oct/04/nsa-gchq- attack...](http://www.theguardian.com/world/2013/oct/04/nsa-gchq-attack-tor- network-encryption) (Schneier's article) [http://www.theguardian.com/world/2013/oct/04/tor-attacks- nsa...](http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users- online-anonymity) (Leaked doc #1) [http://www.theguardian.com/world/interactive/2013/oct/04/tor...](http://www.theguardian.com/world/interactive/2013/oct/04/tor- stinks-nsa-presentation-document) (Leaked doc #2)[http://www.theguardian.com/world/interactive/2013/oct/04/ego...](http://www.theguardian.com/world/interactive/2013/oct/04/egotistical- giraffe-nsa-tor-document) (Leaked doc #3) [http://www.theguardian.com/world/interactive/2013/oct/04/tor...](http://www.theguardian.com/world/interactive/2013/oct/04/tor- high-secure-internet-anonymity)

<comment><USER3> A lot of these articles use abstruse acronyms. Is there perhaps a place where they're all compiled with their explanations?

For instance, what is (U)? Or (S), (SI), and (REL)?

<comment><USER4> Yes, such as "EPICFAIL".

</comment></comment></comment><comment><USER5> Page 5: "Terrorist with Tor client installed"

And its a picture of a guy with a bandit mask and an AK-47. I don't know about you guys, but all my Tor activities are performed in my Halloween costume!

I honestly can't believe something this tacky would end up in a presentation. Is this supposed to be propaganda?

<comment><USER6> and a beard... like terrorists can be stereotyped like that. This is more than just propaganda, this is the mentality of the type of people who put these presentations together. That fact that whoever wrote this presentation has profiled people like this. I would wager that 99% of online "terrorists" are sitting around in jeans and t-shirts, on safe soil, have probably never handled a gun, let alone an AK-47 (or whatever that is on his back), probably don't have a beard. The ones financing them probably spend their life wearing a suit and tie and are either driving a top of the line vehicle or are driven everywhere in a top of the line vehicle.

If you look at the world around us and review the history of terrorism, most of it's been funded behind the scenes by one of the major superpowers, and you can't overlook the fact that a large portion of this has been by backed by the US. It's funny how when the US wants a government toppled, the terrorists are "friendly" and funded and armed by the US government, but when they're counter to US interests, they're suddenly part of the axis of evil and must be destroyed...

Perhaps if they stopped funding this ignorant behaviour and stopped supplying munitions to these terrorist interests, the problem would eventually go away... spend more on education and tolerance towards all points of view, enlightenment, the world would become a more peaceful place.

When will "democratic" governments eventually realize that money and greed is not the best approach to the furthering the human experience on this planet.

Sorry, didn't mean to get off on a rant there, but that one picture triggered a bit of annoyance.

<comment><USER7> And banks don't actually keep money in big cloth bags with dollar signs on them. It's just clip art, and to say that it speaks to the mindset of a type of people you probably don't really know much about. I would hasten to say that your stereotypes are probably no more grounded in reality than those of the straw men your attacking.

>"If you look at the world around us and review the history of terrorism, most of it's been funded behind the scenes by one of the major superpowers, and you can't overlook the fact that a large portion of this has been by backed by the US."

While this assertion is not completely baseless, it's simply not correct, but is the kind of empty-headed moral equivalence that gets tossed around to unanimous approval among a certain class who consider a shibboleth of sophistication.

To wit, in the history of terrorism, we see the Irish Republican Army, The Tamil Tigers, the Red Brigade, the Weather Underground, FALN, Baader Meinhof group, the Symbionese Liberation Army, the current Chechen groups, the Hindu and Muslim groups prior to the formation of Pakistan, and frankly many more -- all without super power support. While some national actors have stepped up to support terror groups, superpower, or even great power support has been the exception rather than the rule.

During the cold war, the USSR, the US and China fought a number of proxy wars, and supported opposition groups in various national civil wars, mostly in Asia, Africa and Central America. Additionally, the CIA engaged in specific assassinations of political leaders largely in Latin America but not really what anyone would consider terrorism by the current definition. You're statement that a large portion of terrorism has been backed by the United States would require expansive definitions of 'large portion', 'terrorism' or 'backed' to be true.

<comment><USER8> No, it requires the United States' own definition of terrorism to be applied to the US.

Drone strikes in Pakistan alone have killed thousands of civilians.

Many of the opposition groups you mentioned were backed by the US knowing that they committed and intended to commit terrorism and other war crimes.

<comment><USER8> A more detailed argument is here

[http://www.washingtonsblog.com/2012/08/is-america-the- worlds...](http://www.washingtonsblog.com/2012/08/is-america-the-worlds- largest-sponsor-of-terrorism.html)

</comment></comment></comment></comment></comment><comment><USER9> This should provide clear warning to anyone who might consider themselves a cypherpunk: Even if you don't think that you are at war with the US government, the US government (and likely most other governments) believes it is at war with you.

It sounds dramatic because it is.

<comment><USER6> It's all part of the theatre and propaganda. Make the weak minded believe that everyone's the boogeyman. At least people on the internet can think critically and say "Er, this doesn't sound right"

</comment></comment><comment><USER6> When will everyone get off the bandwagon of referring to anyone that's willing to actually stand for their beliefs counter to U.S. interests a terrorist? It's gotten to the point where the word terrorist just makes me roll my eyes and say "whatever", I'm becoming desensitized to it, just like most of the UK did growing up in England during the height of IRA campaigns. After a while, it just became a tedious pain in the ass and everyone switched off.

</comment><comment><USER10> General conclusion from all of the published leaks is that GCHQ punches (in technical capability and general quality of work) way above its weight class (funding and presumed staffing levels); they also seem much more willing than NSA to be completely unbound by any idea of domestic user privacy. Which is fitting for a country with the number of CCTV cameras they have.

<comment><USER11> Although, in effect I think you are right about GCHQ, that whole CCTV thing is pretty much a myth founded in a deeply flawed study focussed on a street in Central London. 90% of CCTV is privately owned, and if you step out of the metropolis CCTV is no more abundant than anywhere else. I suggest you stop using that argument with regard to the UK as it undermines your absolutely valid post.

</comment></comment><comment><USER12> They actually saw it as their job to make the experience of anyone using Tor difficult.

Isn't that kind of like the police deciding to make the roads full of potholes because that would make it more difficult for bank robbers to get away in a car.

Then again, considering the quality of the roads these days, maybe they are way ahead of me on that.

<comment><USER13> They are doing this all the time. They are buying exploits and keep them locked up, they actively backdoor software and hardware.

Basic statistics tells us it is pure insanity to compromise our security for the noise that is "international terror".

</comment></comment><comment><USER14> Depressingly, the document talks about plans to make Tor less reliable to dissuade people from using it:

> Could we set up a lot of really slow Tor nodes ... to degrade the quality of > the network? > Given CNE access to a web server make it painful for Tor > users?

At least the document seems to confirm that GCHQ has a really, _really_ hard time de-anonymising Tor users.

<comment><USER15> I'm pretty sure Tor does smart peer profiling/selection to optimize for throughput. Lots of people run Tor relays on their silly little home DSLs and Tor still works.

<comment><USER16> Which is why the slide also talks about reporting as if being a high throughput node. i.e. Report back that you're handling a lot of traffic quickly while handling traffic very badly. Does Tor have protection against a node doing that?

<comment><USER17> I'm pretty sure Tor profiles against this as well. There's a presentation somewhere on YouTube addressing just this problem.

</comment></comment></comment></comment><comment><USER18> Why are these latest NSA stories getting flagged so much?

I don't like that PG has relaxed the flagging so much. You can probably flag even tens of stories a day now without having your flagging removed.

<comment><USER19> I wonder, if you flag too much, do you get a 'querulant' flag yourself that makes the site ignore your flags? :-D

I would totaly implement something like that if I were PG. Seems to fit the mindset of HN, as it also uses hellbans.

<comment><USER20> Nope, the flag link disappears when you flag "badly".

</comment></comment></comment><comment><USER21> Thats a ringing endorsement for Tor. Its really works! They struggle to get info out of it.

</comment><comment><USER22> Doesn't look like a very ethical/professional presentation. But then again, who said everyone's professional in all agencies. Its a conjecture to think our laws are systematically enforced by ethical folks.

</comment><comment><USER23> [http://s3.documentcloud.org/documents/801434/doc2.pdf](http://s3.documentcloud.org/documents/801434/doc2.pdf)

</comment><comment><USER24> Of course, if they actually have a really easy time de-anonymizing users, they might "leak" a document like this to encourage people to keep using it.

Conspiracy theories are fun!

<comment><USER19> If I had a few million dollars to run compromized Tor nodes, and the ability to subpoena (and gag order) any Tor node operator in USA, UK and a couple of other major countries to give me their keys, I would be able to easily de- anonymize a large portion of the network.

<comment><USER25> It is commonly assumed that the NSA/CIA run a substantial portion of the exit nodes. Morever, they are a global adversary (one Tor is not designed to defeat).

</comment></comment></comment><comment><USER26> Does anyone know what the QUANTUM attack they refer to is? It doesn't seem like quantum computing on the face of it; It looks like it may be a system used to disrupt traffic on the internet, possibly man in the middle attacks.

Edit: I found a reference to something called a "Quantum Insert" in an article related to GCHQ. They state the following:

 _According to the slides in the GCHQ presentation, the attack was directed at several Belgacom employees and involved the planting of a highly developed attack technology referred to as a "Quantum Insert" ("QI"). It appears to be a method with which the person being targeted, without their knowledge, is redirected to websites that then plant malware on their computers that can then manipulate them_

[http://www.spiegel.de/international/europe/british-spy- agenc...](http://www.spiegel.de/international/europe/british-spy-agency-gchq- hacked-belgian-telecoms-firm-a-923406.html)

This might be what they are referring to, or a system that was built for targeting specific individuals.

<comment><USER27> "To trick targets into visiting a FoxAcid server, the NSA relies on its secret partnerships with US telecoms companies. As part of the Turmoil system, the NSA places secret servers, codenamed Quantum, at key places on the internet backbone. This placement ensures that they can react faster than other websites can. By exploiting that speed difference, these servers can impersonate a visited website to the target before the legitimate website can respond, thereby tricking the target's browser to visit a Foxacid server.

In the academic literature, these are called "man-on-the-middle" attacks, and have been known to the commercial and academic security communities. More specifically, they are examples of "man-on-the-side" attacks."

Read more here: www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users- online-anonymity

<comment><USER10> Can we translate that to something sane? Is it "shorter BGP/more specific route announcement?" Or some kind of MITM by being directly in line? Assuming it is TCP traffic, just being "faster to respond" doesn't help all that much without some other logic.

If I were MITMing with full cooperation of only a subset of a network carrier, I'd probably go for some route announcement tricks; easier to interface with the rest of the organization, and due to lack of filtering internally, not much config change required. Would fail safely (== non-detectably), also, and could potentially be explained away as "oh, shit, some stupid ISP leaked routes".

(I guess you could give bad dns responses, too, and then go from there, but that sounds more detectable at the end user device, which is very undesirable.)

</comment></comment></comment><comment><USER28> How do we know this wasn't just a trick to make people think tor is safe and keep using it?

<comment><USER19> Pretty sure it is. If you need serious anonymity, like if your life depends on it, get a botnet and use the trojaned PCs as proxies. Use public WiFi, and use cheap laptops that you replace regularly and/or VMs, and don't forget to fake your MAC address. Create multiple fake personas to confuse attackers. Have stuff you write rephrased by someone else, so they can't do a corpus analysis on your writings. Do as much offline as possible. If you have to transfer information, avoid the internet. Use dedicated lines, dialup, dead drops, etc. etc.

I'm so glad I have nothing to hide.

</comment></comment><comment><USER29> From the Schneier article:

"The good news is they [NSA] went for a browser exploit..." \- Roger Dingledine, President of Tor project

It seems there are assumptions among parties that employ "browser exploits" against unsuspecting users that the persons targeted will be using "modern", complex, Javascript-enabled, graphical browsers, and that they'll use these browsers to retrieve content from the network and to view that content on machines with writeable permanent storage that can connect to the network. Am I misreading all these tales of browser exploitation?

Can these parties accomodate reboots from read-only media, text-only browsers, write-protected storage and offline viewing of content?

Maybe the problem isn't so much with Tor as with with the popular browsers and their gratuitous complexity.

</comment><comment><USER30> The slides were from over a year ago, I'm sure a lot has changed since then. Also the timing of this is very suspect, obviously it's been in the news and the Guardian either want to run with this new line brought on by the Silk Road "bust", or they just want to "soothe" (take as you will) our worries with the network.

Would also love to know more about NEWTONS CRADLE, anyone heard of anything more specific?

</comment><comment><USER31> [http://webcache.googleusercontent.com/search?q=cache%3Ahttp%...](http://webcache.googleusercontent.com/search?q=cache%3Ahttp%3A%2F%2Fcache.nevkontakte.com%2Fproxy.html#go=http://www.theguardian.com/world/interactive/2013/oct/04/tor- stinks-nsa-presentation-document)

</comment><comment><USER32> Some nice recommendations tho for usage.

ORBOT / Tor Router Project / Hide-my-ip-address / Tor Project and the bootable OS Tails.

Some of the more advanced Obfuscation for the tor project

Skype Morph - Hides Tor traffic in Skype packets mmm fun and worth a look

Someone better be working on tor Obfuscation with flash packets, no one is going to block those things.

/tinhat

</comment><comment><USER33> It's important to note this is from 2007 and thus things have probably changed immensely since then.

Edit: Nevermind, it says it's sourced from a 2007 file but dated 2012.

<comment><USER34> I think your original conclusion, 2007 is correct.

What exactly does sourced vs dated even mean?

The document states "still investigating" for multiple issues. It doesn't take the NSA 6 years to investigate these things.

The questions are very basic, such as, browser/JS exploits, leftover cookies, and owning the majority of nodes. That is hardly top secret, all of these were things that were public concerns long ago.

The other alternative is they just don't care. They can still slurp down a good portion of the incoming and outgoing email traffic. If one of wikileak's origin stories are to be believed most Tor users have no idea how Tor works or what they are actually doing, including government operators (with the appropriate code name EPICFAIL on page 9.)

Going completely off topic, I had an idea earlier. Bitcoin right now is using something around 16,000 petaflops of processing. This shows that when proper incentives exist massive computational and network resources can be utilized in a distributed manner.

What if a protocol existed which forced user participation or required them to exchange a store of value to use it? For example, if a user acted as a node (relay not exit) they mined a currency (probably inflationary.) If a user did not act as a node, they had to pay a currency which would then be distributed to exit node operators. The currency could be bought and sold through exchanges rather than to a central commercial entity.

The end goal, besides having a lot more network bandwidth, would be to have so many relay and exit nodes running it would be economically impossible for a single entity to compromise a significant number of them.

Of course, easier said than done.

</comment></comment><comment><USER35> After reading many of these articles about the NSA I keep wondering if they have an office specifically tasked with thinking up code names for these projects. I personally would find it difficult to keep them all straight—this article, for example, contained a new one to me: ONIONBREATH.

Just an odd image in my mind of a group of top-security clearance, extremely well trained, able-minded people who think up silly code names like these.

<comment><USER36> Many government agencies do this - check out the names for DEA stings, or even FDA operations.

</comment></comment><comment><USER6> I also quite like the point "Analytics: Cookie Leakage", like anyone that uses Tor doesn't use it in incognito mode with cookies disabled... or flushes their cookies before they use anything else...

... that either says they're stupid, or they're only after stupid terrorists... as if they're the ones they should really be concerned about.

<comment><USER9> I think Tor recommends surfing from a dedicated virtual machine, IIRC, which is probably the safest way to surf, though something like Flash or Java can still probably report the actual host IP.

</comment></comment><comment><USER37> After watching the presentation, I can think in two things to make TOR better, from the point of view of the anonymity of its users:

* Better education on how users can browser carefuly (no javascript, no plugins, updated browsers) * More nodes.

</comment><comment><USER38> Somehow I find this presentation reassuring. It mainly suggests to me, that the NSA/GHCQ has to do 'honest' traffic analysis, implying that they did not break any of the crypto primitives used in Tor.

</comment><comment><USER39> So, according to these documents, NSA and GCHQ do have few "owned" exit nodes, but not so many, hence, they want to own more. Interestingly enough, GCHQ set up Tor exit nodes on the AWS cloud.

</comment><comment><USER40> Most fascinating part - using DoubleClick ad cookies to trace Tor users.

</comment><comment><USER41> Given that it says that the NSA and the GCHQ is trying to setup tor nodes.. is it possible for us to identify these nodes? Some sort of trust network perhaps?

<comment><USER42> The document is dated 20070108, seems they'd be a lot further on with Tor now. Also they mention using AWS to set up Tor nodes.

Was interested in the user profiling to establish from raw network traffic which users are likely using Tor - so for example from this message.

Not sure what QFP is though?

</comment></comment><comment><USER43> This is a glorious release. I'm suspecting we have Schneier to thank for the full release of the slideshow that is mostly unredacted.

<comment><USER11> if you follow ioerror and ggreenwald on twitter you probably have some idea of what forced this particular cache of articles.

</comment></comment><comment><USER44> Of course it stinks. It's "only" weakness is a "global, passive adversary" \+ It was built by the US Government.

</comment><comment><USER45> Don't we all know, that Tor is low latency solution and therefore directly voulnerable to statistical correllation attacks?

</comment><comment><USER46> Dated: 20070108

Declassify on: 20370101

</comment><comment><USER47> That is a lot of our tax payer money at work...

</comment><comment><USER47> Freedom lover with Tor client installed.</comment>


How does Apple privately find offline devices? - <AUTHOR> https://blog.cryptographyengineering.com/2019/06/05/how-does-apple-privately-find-your-offline-devices/ <comment><USER2> Total aside, but kinda relevant.

I lost my phone like a dufus about a two weeks ago. Battery died and I had no idea where it was. When I pulled the my google location history, it was too coarse to tell me anything other than 'at your house'. However, I was able to pull the raw data from google and post process it by time stamp into a series of rasters that were fine enough for me to see that the phone was definitely in the bedroom/ bathroom area. After processing my data, finding my phone took all of a minute.

<comment><USER3> This is interesting. By the raw data you mean from Google Takeout, or something else? Did you have to filter/smooth the data points?

<comment><USER4> Also interested. Could you describe the process?

<comment><USER2> Sure. I pulled my data in the standard takeout.google.com/ process. The result is a json (? iirc). I parsed the json into x, y, and rasterized it using gdal.

[https://imgur.com/a/ZhyTsDV](https://imgur.com/a/ZhyTsDV)

See I wasn't sure if I lost it in the couch in the living room, the office, or the bedroom. This got me within a few feet.

<comment><USER5> That's amazing, so cool.

Is that something Google's not doing with the data, but could? (E.g. they don't because their maps don't show most houses precisely enough or whatever, so it wouldn't be useful?)

Or is it relying on the fact that you are triangulating or similar from the known exact position of your WiFi routers or similar down to the inch, and Google doesn't have any way of knowing that?

<comment><USER6> Or they do and have internally assessed that it would be too creepy to provide to users, but are happily using it to better target advertising.

<comment><USER7> Or they have decided that it's too creepy to use at all, so they don't use it for targeted advertising. Seriously, why does everyone assume that companies are evilly cackling in volcano lairs? They know that violating user trust is really expensive and a bad idea.

By the way, I'm pretty sure I've seen that Google's advertising targeting is only allowed to use "neighborhood level" location, which is designed to be coarse enough to not allow specifying individual people.

<comment><USER8> On the other hand, if the information is aggregated to a final answer, why is the data then kept? What if the _wrong people_ get ahold of the more sensitive information _because_ the data was kept beyond its useful life?

<comment><USER9> In their defense: it is perfectly fine _with me_ to keep my location data, so I can download it later and do cool and/or useful things with it as long as

\- it is opt in,

\- it can be deleted by me

\- is not given to anyone else

For all my trashing of Google lately (check my comment history) I actually expect and belive them to defend my raw data in a way that few others are able to. It all boils down to incentives:

\- as long as they keep the data between them and me they can sell targeted ads again and again. If the data leaks then others can skip the middle man.

\- as long as they keep their reputation as nice guys that is an immense advantage.

Now this might of course be changing, so everyone should consider if they personally trust this arrangement going for the future:

\- it seems some part of the organization is tightening the screws around the Chrome team to squeeze out more revenue.

\- of the data is available there is always the risk of attacks both cyber attacks as well as legal attacks.

<comment><USER10> Describing Google's data collection practices as "opt in" is a bit generous.

>In going through a set of privacy popups put out in May by Facebook, Google, and Microsoft, the researchers found that the first two especially feature "dark patterns, techniques and features of interface design mean to manipulate users…used to nudge users towards privacy intrusive options."

[https://techcrunch.com/2018/06/27/study-calls-out-dark- patte...](https://techcrunch.com/2018/06/27/study-calls-out-dark-patterns-in- facebook-and-google-that-push-users-towards-less-privacy/)

<comment><USER9> > Describing Google's data collection practices as "opt in" is a bit generous.

Maybe it is not clear but I was talking about location history.

At least I think I had to opt in to that at some point.

<comment><USER10> Location history is one of the areas where Google has employed dark patterns.

For example:

>Ways that Google tricks users into sharing location

Android users are pushed through a variety of techniques:

Deceptive click-flow: The click-flow when setting up an Android device pushes users into enabling "Location History" without being aware of it.

Hidden default settings: When setting up a Google account, the Web & App activity settings are hidden behind extra clicks and enabled by default..

Misleading and unbalanced information: Users are not given sufficient information when presented with choices, and are misled about what data is collected and how it is used. Information about location data being used for advertising, for example, is hidden away behind extra clicks.

Repeated nudging: Users are repeatedly asked to turn on "Location History" when using different Google services even if they decided against this feature when setting up their phone.

Bundling of services and lack of granular choices: If the user wants features such as Google Assistant and photos sorted by location, Google turns on invasive location tracking.

[https://www.forbrukerradet.no/side/google-manipulates- users-...](https://www.forbrukerradet.no/side/google-manipulates-users-into- constant-tracking)

More alarmingly, when users attempted to turn off location tracking:

>In a wonderfully clear example of "dark patterns" designed to mislead users and retain control over their data, Google continues tracking your location even when you turn off Location History and are told that "the places you go are no longer stored." Google says it tells users, but its disclosure is the bare minimum and users are discouraged from further interference with data collection.

[https://techcrunch.com/2018/08/13/google-keeps-a-history- of-...](https://techcrunch.com/2018/08/13/google-keeps-a-history-of-your- locations-even-when-location-history-is-off/)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Well...a bit off topic but kind of relevant.

My car got broken into and my iPad nicked. I was able to locate that, however, the cops here in NZ were really unhelpful.

They said the GPS location wouldn't be sufficient for a search warrant as they have had many cases of false positives.

I said I would give the ssid and ip address of their wifi network, even then they wouldn't agree for a raid.

It was only when the thief (who was a minor) took the pic of his family member, which I then furnished to the police (via iCloud), they could do something.

Wondering what good is technology, if the law takes a while to catchup, well at least here in NZ.

<comment><USER12> Legally could you go get it, and in the resulting skirmish perhaps attract the attention of the police?

Is trespassing to retrieve stolen property still trespassing?

<comment><USER13> This reminds me of a (probably apocryphal) story a South African friend of mine told me once about the state of policing down there in the late nineties / early noughties.

The story goes that a man wakes up in the middle of the night to the sound of burglars looting his garage. Given the occurences of aggravated robberies in SA at the time, often involving guns, he didn't want to confront the miscreants himself, and so called his local police department.

Apparently since no actual violence had been done at this point, the police- person to whom he was speaking claimed that they had no free units to come and attend, and that they'd send a car round in the morning to collect evidence. At this point the call ended.

The man who was being burgled was understandably unimpressed with this, thought about what he could do, and then rang the police back.

"Don't worry about the burglars here. I shot them." he says.

Within minutes his house is surrounded by police cars, and the burglars are under arrest.

The commander of the responding officers says to the man "I thought you said you shot them?"

The man replies "I thought you said you had no units free?"

<comment><USER14> With the gist of the story being that "no units free" actually meaning "no units free _to prioritize a burglary_ ", or what?

An active shooting incident would certainly reshuffle the prio list...

</comment></comment></comment></comment><comment><USER5> Can this be used as essentially 100% effective anti-theft?

If an Apple device is constantly emitting a BLE beacon code that can't effectively be changed in any way by a thief...

...then unless a thief keeps the device in their basement and never has anybody visit, your stolen device will almost certainly be detected sooner or later, and then you just call the police?

Even if the thief has sold it by that point and disappeared, if local law means the stolen good reverts to you, then people would quickly learn never to purchase any phone there's even a chance of having been suspiciously acquired.

Am I missing something here?

<comment><USER15> Thieves already know that stolen iPhones are usually not operable. Even with the old Find My iPhone, even after the device has been wiped, only the original owner can activate it again. So these stolen phones are usually broken down, with parts sold separately.

<comment><USER16> They are getting smarter. A family member had their phone stolen and Find My iPhone reported that the phone was off for months and so she gave up searching. One day, she got a text on her new phone saying "Find my iPhone has found your phone, click here to login to Find my iPhone". It turned out to be a phishing page for her AppleID credentials. She fell for it and I'm assuming the thieves were able to finally get into her phone. To this day I have no idea how they were able to get her phone number. From the SIM maybe?

<comment><USER17> > To this day I have no idea how they were able to get her phone number

Guessing here but maybe using "emergency call" and another phone to get the caller ID?

<comment><USER18> How would that work? I though you can only call emergency numbers from that mode?

</comment></comment></comment></comment></comment><comment><USER19> The problem I see with this is that your phone _always_ has to be broadcasting the BLE beacon, regardless of if it is lost or not. Otherwise it could randomly end up lost in a place with poor/no service... and would never be found

For phones, how often is this really an issue? Sure, this is useful for the Tile type "dumb" devices... but if my phone has no cell or data service... it's probably because the battery is dead.

<comment><USER20> Complete speculation here, but I wouldn't be surprised if devices could keep broadcasting the ping after they're "dead". Tiles last for years without charging, so I bet if Apple can leave on only the bluetooth beacon after the battery drains past where it can power the rest of the phone then this would be doable.

Again complete speculation, I have zero clue if the current hardware is even capable of doing this.

<comment><USER21> The current hardware might not be, but you could run this on a secondary chip similar in specs to the T2 or Secure Enclave. You could theoretically even have a second battery specifically for this purpose, but that would likely be cost-prohibitive.

<comment><USER22> The T2 chip is a derivative of the A10. It has similar power requirements to the SOC in modern iPhones.

They could probably use a cut down derivative of the W2 chip used in AirPods with the audio codec etc. removed. I'm guessing phone batteries reach a point where they're still storing energy but can't provide enough current to safely boot the whole phone. The BLE chip could sip on the remainder of the battery for a long time.

<comment><USER21> That sounds reasonable. I had no idea the T2 was that powerful.

<comment><USER6> It's also the SSD controller, and quite impressive in that regard.

<comment><USER23> I bet the T3, whenever that arrives, will be a derivative of the A12 or A13, and provide the neural network accelerator to MacOS and CoreML.

<comment><USER6> This would be excellent. I'm hesitant about the prospect of an ARM based macbook, but having both seems mighty compelling. As a lower power application CPU for light usage, or a full x86 with accelerators / co-processors when needed.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> Milwaukee Tools (and possibly others) do something similar. Not sure about the privacy part though.

[https://www.milwaukeetool.com/OneKey](https://www.milwaukeetool.com/OneKey)

Basically anyone who runs the Milwaukee One Key app will watch for signals from tools and other devices with the One Key transmitter and upload the location. So if your tool is stolen and comes within range of someone running the One Key app the location should get uploaded.

<comment><USER25> Tile meshes the same way.

</comment></comment><comment><USER26> > generate the list of pseudonyms from a single short "seed" that both Timmy > and Ruth will keep a copy of. This is nice because the data stored by each > party will be very small. However, to find Timmy, Ruth must still send all > of the pseudonyms — or her "seed" — up to Apple, who will have to search its > database for each one.

I would imagine something along the lines of TOTP would provide a better mechanism here. There would be no need to scan a whole list of pseudonyms, and the BLE would rotate the identifier it transmits frequently. The lassie device can include GPS timestamps when it reports the device to apple.

</comment><comment><USER27> >can use a single [private] key regardless of which randomized version of her public key was used to encrypt.

I have not seen this before. Trying to wrap my brain around how this works. In terms of ECC I thought public and private were a single pair. Can anyone explain what is going on with public key randomization?

<comment><USER28> You can derive a new public key from someone's ECC public key, and they can derive the corresponding private key by applying the same transformation. It's somewhat magical! I wouldn't be surprised if Apple is using a scheme based on this instead of ElGamal, they already use ECC extensively.

[https://github.com/bitcoin/bips/blob/master/bip-0032.mediawi...](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#conventions)

<comment><USER25> Interesting, I hadn't thought of using the techniques of deterministic cryptocurrency wallets to solve this problem. I need to read more about exactly how they work.

It is also easy to solve this simply using ECC and ECDH. I just wrote a scheme on the board in the office. It might have slightly larger data payload than the deterministic wallets approach.

</comment></comment></comment><comment><USER29> I designed a similar system a few years back to provide proof-of-presence. Imagine a block chain of devices at locations (an alibi lets say). All devices are miners and only devices in your vicinity (think BLE) can "confirm" "transactions" (your presence) on the chain.

As with anything public + blockchain it had all the Cryptoeconomics incentives problems you would expect and I never solved them.

Finding a lost device has much lower stakes than proving an alibi in court so I see how this model would work.

</comment><comment><USER30> This sounds like the perfect infrastructure for a trusted, encrypted P2P mesh network.

</comment><comment><USER31> A potential concern - does this system implement forward secrecy? Is that even possible?

The threat I'm thinking of is some organisation that is able to crack the private key at some point in the future and therefore able to work out where you have been in the past.

Of course, the phone's location in the recent past is exactly what this system is designed to produce. Would it be possible to rekey the connection on a regular/opportunistic basis?

</comment><comment><USER32> Tile has quite a few patents in this area: [http://patft.uspto.gov/netacgi/nph- Parser?Sect1=PTO2&Sect2=H...](http://patft.uspto.gov/netacgi/nph- Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=%2Fnetahtml%2FPTO%2Fsearch- bool.html&r=0&f=S&l=50&TERM1=tile&FIELD1=ASNM&co1=AND&TERM2=&FIELD2=&d=PTXT)

</comment><comment><USER33> Can the signal be jammed? Or simply put the stolen device in a metal box.

As for the tracking: I really like the idea. However, in my country finding your device isn't the issue, it is getting it back that's the problem. Police won't go and enter the particular house were your device is.

<comment><USER34> I'm not sure how useful a device is that has to be kept in a metal box at all times.

<comment><USER35> My new startup: Faraday gloves

</comment></comment></comment><comment><USER36> Nice article, and also nice application of cryptography. I hope Google and Apple will both compete and challenge each others about inventive ways to defend people privacy, both at the hardware and software levels

</comment><comment><USER37> Can we turn this off? please?

I would like 100% passive bluetooth. (and wifi, and nfc)

<comment><USER38> How is that going to work? All communication that you initiate must be active. The only passive option would be broadcasts like TV or radio stations, but that's not particularly useful if you want to view a specific website.

<comment><USER39> NFC is passive until powered by an external signal. It's very short range, but it does not require internal power. There could be a longer range version at some point.

<comment><USER38> Yes, but an NFC tag cannot initiate a connection on its own volition. And that's very much a feature I like in WiFi: I can actively start downloading something. A WiFi card that only responds to an external ping is useless.

<comment><USER37> I think what berbec is saying is maybe you can locate an NFC device that has a depleted battery.

That said, I don't know if apple NFC works that way. Apple can use NFC to read nearby NFC tags, and possibly become an NFC tag, but I don't know if it can respond in a static way without power.

</comment></comment></comment></comment></comment><comment><USER40> I see lots of poor Lassies in airports, conferencies and generally in crowded places. Not even mentioning flood or replay attacks.

Lassie's help needs to have some limits otherwise it may quickly drain batteries or mobile plans especially in roaming.

<comment><USER41> "Apple's recommended setting of 100 ms advertising interval with a coin cell battery provides for 1–3 months of life, which increases to 2–3 years as advertising interval is increased to 900 ms."

iPhone's have about at 10X larger batter than that. So iPhones can do this for ~20-30 years if configured correctly.

<comment><USER29> If I'm not mistaken the normal self-discharge rate for a phone's lithium ion battery will exceed the maintenance of BLE advertisement.

</comment></comment></comment><comment><USER42> TLDR; The idea of the new system is to turn Apple's existing network of iPhones into a massive crowdsourced location tracking system. Every active iPhone will continuously monitor for BLE beacon messages that might be coming from a lost device. When it picks up one of these signals, the participating phone tags the data with its own current GPS location; then it sends the whole package up to Apple's servers.

</comment><comment><USER43> The post is speculation; perhaps s/does/might/ or s/does/could/ in the title.

<comment><USER44> The title is a question. Which is why it ends with a questionmark. The article attempts to answer the question with theories. The article isn't written by Joe Random; it is written by Matthew Green who teaches cryptography at John Hopkins university.

<comment><USER45> Johns* Hopkins.

</comment></comment></comment><comment><USER46> Okay, so this would make it insanely easy to stalk any iPhone user.

1\. Get BLE tracking tags, and register them with Find My.

2\. Covertly attach the BLE tracking tags to things your target owns (backpacks, cars, bikes, etc).

3\. You constantly get updates on your tags locations via their iPhone and other iOS devices near the BLE tag(s). This gives you their approximate location and movement history, facilitated primarily through their own iPhone and data plan.

<comment><USER47> I have no idea how the FindMy BLE system works, but i strongly suspect that the cheaperst compatible "tag" you will find will be an iPhone. Might get a tad expensive to do this...

<comment><USER48> The potential of low cost tags is in the first paragraph, and an overview of how the system would work is in the second. My takeaway is that you will be able to use something far cheaper than an iPhone.

<comment><USER47> Cheap ble tags do NOT use fancy rotated private keys or anything of the like. At best they use BLE privacy mode. That is as private as the spec gets.

Source: worked on Bluetooth for years

</comment></comment></comment></comment><comment><USER49> > The good news is that Apple claims that their system actually does provide > strong privacy, and that it accomplishes this using clever cryptography.

But that does nothing to protect your privacy against Apple.

I already have to make sure that I disable WiFi and Bluetooth when I enter commercial establishments. Now I have to stop using Bluetooth whenever I leave my house?

<comment><USER20> Why do you do that? All Apple devices generate randomized MAC addresses for networks that they haven't connected to, so they shouldn't be able to track you. In addition, no other actors will be able to gain useful information from the bluetooth pings, they simply forward the encrypted data to Apple. All they can tell is that an Apple device exists nearby, but not who owns it or if they've seen the same device before.

If you're talking about apps on your phone tracking you by looking at nearby wifi networks, then Apple also fixes that in iOS 13.

<comment><USER50> Did not know this. I figured all those wifi connections I get near stoplights were slurping up mac addresses to track people. I wonder if it generates a mac address every single time or just upon first interaction with a wifi network it doesn't know about?

<comment><USER51> Apparently the initial implementation (iOS 8) randomized it every time the screen sleeps or wakes. I wasn't able to find any recent documentation detailing the current behavior - probably similar?

<comment><USER52> Beginning at the top of page 41: [https://www.apple.com/business/site/docs/iOS_Security_Guide....](https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf)

``` iOS uses a randomized Media Access Control (MAC) address when conducting Wi-Fi scans while it isn't associated with a Wi-Fi network. These scans could be performed in order to find and connect a preferred Wi-Fi network or to assist Location Services for apps that use geofences, such as location-based reminders or fixing a location in Apple Maps. Note that Wi-Fi scans that happen while trying to connect to a preferred Wi-Fi network aren't randomized.

.... [continues with all the cases] ```</comment></comment></comment></comment></comment>


Ask HN: What is HN doing to stop foreign misinformation during Covid-19? - <AUTHOR> In this short intense time period misinformation will amplify economic changes quickly, we should assume all sites are under some sort of attack.<p>Has HN increased security? <comment><USER2> Wouldn't _" What is HN doing to stop misinformation during Covid-19?"_ be better?

Foreign, domestic, deliberate or otherwise.

</comment><comment> blaser-waffle HN is the newsfeed of Ycombinator -- it's right there in the URL -- which is a start-up incubator. They've got a vested interest in promoting their start- ups, and keeping discussions about their former startups as positive as possible.

Like, if they're not making money from adds or in-app purchases (aka reddit gold), then their value is in shaping consensus.

So assume everything on here has some freakin HUGE biases.

<comment><USER3> This comment misunderstands the basics of how we manage HN to benefit YC. People naturally assume the worst, but it's important to know how HN actually works, because we're luckier than that here.

The way to maximize HN's value for YC is to have HN be as good as possible, where 'good' means gratifying intellectual curiosity. That's what makes the community happy, and the community is what's valuable about HN. Since a happy- community HN is the most valuable-to-YC HN, that's all we try to optimize for. HN is in an odd sort of sweet spot on the internet where the way it can best serve the business interests of its owner is simply by being as good as possible. We don't have to juice engagement, pump numbers up, and so on. We can just be 'bookish', something pg used to say he wanted for this place. Like I said, we're lucky that way.

[https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...](https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20yc%20business%20interests&sort=byDate&type=comment)

[https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...](https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20curiosity%20optimiz&sort=byDate&type=comment)

So no, we don't focus on promoting startups or keeping discussions about YC startups as positive as possible. (There are plenty of negative ones. Just look in on any Airbnb thread.) The community wouldn't be happy if we did that, nor would it be good for intellectual curiosity, so we don't. We do use moderation as a counterweight against predictable indignation in general (on any topic). But we do that kind of moderation thing less, not more, when YC or YC startups are involved—see [https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...](https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20moderate%20less%20not%20more%20yc&sort=byDate&type=comment).

There are three formal things that HN does do for YC: job ads for YC startups (which appear on the front page and then [https://news.ycombinator.com/jobs](https://news.ycombinator.com/jobs)), Launch HNs for YC startups (which appear on the front page and then [https://news.ycombinator.com/launches](https://news.ycombinator.com/launches)), and usernames of YC alumni appearing in orange to other YC alumni. Those are definitely special privileges. We do that as a way of giving back to YC in exchange for funding HN. But we keep them very delimited and explicit. I really need to add this to the FAQ.

</comment></comment><comment><USER4> Sorry, you must be new to the Internet. Everything besides World Health Organisation website (in this particular case) is an opinion here. 99.9999% of the information on the Internet is not to be treated in any other way from the start. Not only you are not supposed to trust HN, as they just folks like you, it is very rude to demand them to work for you and verify facts instead of you.

<comment><USER2> > _Sorry, you must be new to the Internet. Everything besides World Health > Organisation website (in this particular case) is an opinion here._

It is ironic you mention the World Health Organization as a source of truth given this tweet:

> _If you do not have any respiratory symptoms, such as fever, cough, or runny > nose, you do not need to wear a medical mask. When used alone, masks can > give you a false feeling of protection and can even be a source of infection > when not used correctly._ [0] - WHO Twitter Account

I put a spin on it:

> _If you are not drunk, you do not need to wear your seat belt. When used > alone, seat belts can give you a false feeling of protection, and can even > be a source of accidents when not used correctly._

[0]: [https://twitter.com/WHOWPRO/status/1243171683067777024](https://twitter.com/WHOWPRO/status/1243171683067777024)

<comment><USER5> Yep, looks like the WHO chose to manipulate the public into not using the masks so that enough is available for health-care professionals. It had a positive short-term impact, but also damaged their reputation and trustworthiness, which is very bad.

<comment><USER6> Wait, really? As in, the WHO followed an intentional strategy of misleading the public, akin to a real life trolley problem? I'd be interested in reading more about this if there are sources.

</comment></comment></comment></comment><comment><USER7> Ask not what your HN can do for you, but what you can do for your HN

</comment><comment><USER8> Excellent question.</comment>


Why Not Insider Trade on Every Company? - <AUTHOR> http://www.bloombergview.com/articles/2015-08-11/why-not-insider-trade-on-every-company- <comment><USER2> It's actually still possible to perform a specific type of legal insider trading.

Example: you are an executive at E Corp and the company will announce its acquisition in two months. You had previously set up planned trades to sell x number of shares each month before then. Because the acquisition is at a premium on the current price, you will make much less money if you go forward with your trades before the announcement. So, what do you do? You cancel the trades.

Was this insider trading according to the SEC? Surprisingly, no! Even though you're profiting from insider information, the SEC rules are such that for insider trading to occur, you actually need a trade.

[https://en.wikipedia.org/wiki/SEC_Rule_10b5-1#A_possible_loo...](https://en.wikipedia.org/wiki/SEC_Rule_10b5-1#A_possible_loophole:_canceling_plans)

Martha Stewart did exactly this before her company was acquired earlier this year:

[http://i.imgur.com/ZikHCpP.jpg](http://i.imgur.com/ZikHCpP.jpg)

<comment><USER3> Politicians in Congress are explicitly allowed to insider trade based on information they hear about. This is why congressmen's stock portfolios are far more profitable than an average person's.

<comment><USER4> It makes sense to insulate Congressman from insider trading charges. They are exposed to so much inside information that the executive could bring charges against them on a whim. Which would have significant separation of powers concerns.

Of course, the answer to that is to require all Congressmen to put their assets in a blind trust.

<comment><USER5> > _It makes sense to insulate Congressman from insider trading charges. They > are exposed to so much inside information that the executive could bring > charges against them on a whim. Which would have significant separation of > powers concerns._

How about disallowing them to trade altogether in the first place for as long as they hold office?

<comment><USER6> This would make more sense if there weren't career Congress-critters, though perhaps this would encourage movement in that direction...

<comment><USER7> Yeah, that is a huge issue in itself. Public office should not be a career but something you take time out of your career to perform.

</comment></comment></comment></comment></comment></comment><comment><USER8> I think I will end up upvoting every share of this Bloomberg View columnist's columns here on Hacker News. The author, Matt Levine, thinks like a hacker in the best sense, by pushing ideas to their extremes and seeing what the consequences might be. He adopts a humorous tone, but his columns are full of food for thought.

[http://www.bloombergview.com/contributors/matt- levine](http://www.bloombergview.com/contributors/matt-levine)

<comment><USER9> You should also take a look at his writing at Dealbreaker, where he used to write before joining Bloomberg View. [http://dealbreaker.com/author/mlevine/](http://dealbreaker.com/author/mlevine/)

</comment></comment><comment><USER10> Perhaps someone will change my mind, but I see the block on insider trading and spoofing as harmful to the financial industry overall.

Someone starts shorting a ton of Apple stock? That probably means something big is happen at Apple, and it's not good. It's information.

Spoofing as a technique can be used to combat and inhibit other types of trading, and is in some sense an algorithm to 'keep the opponent honest'.

As best as I can tell, the biggest reason that we as a culture are against insider trading is because 'it's not fair'. (happy to read a response that adds more depth to my understanding). It isn't fair, and the people with insider information are going to make a lot of money. But in the process of making that money they bring the information to everyone else. And insider trading incentivizes knowing as much as possible so that you can have an edge on the competition.

<comment><USER11> The main reason we don't like insider trading is that we like participation in the market by relative amateurs. A system that allows insider trading discourages participation by amateurs, because they do not have insider information. Insiders would earn money at the expense of these amateurs, so it's better for them to stick to other sorts of investments to avoid this "tax".

This isn't necessarily a problem. As a society, we've decided that we like having amateur capital in the markets more than we want the improved efficiency of allowing use of inside information. It's a tradeoff, and while both options have their merits, society has chosen one way.

<comment><USER12> > _A system that allows insider trading discourages participation by amateurs, > because they do not have insider information. Insiders would earn money at > the expense of these amateurs_

How so? Can you flesh out the scenario a bit since I'm having trouble seeing how this is the case. To me, it seems like if there were no trade prohibitions on insider trading the share price would immediately reflect inside knowledge, thereby _protecting_ amateurs from making investments based on facts that they don't know that others do.

<comment><USER13> The share price likely wouldn't reflect insider knowledge. To see this, take an extreme example. The CEO owns less than 1% of most publicly traded companies. Even if he was allowed to sell his whole position without public disclosure, it wouldn't affect the stock price that much. Say he wakes up and finds out through insider knowledge that his company will go bankrupt tomorrow. He sells all his shares today. The stock drops a bit. It doesn't go to 0 just because he knows it should.

A stock price reflects a weighted average of individual investor's knowledge and their capital.

(Efficient market gets around this by assuming people are cool with not just selling the stock but shorting it all the way until it is as low as they think it should be. People don't tend to bet the farm (or have the ability to borrow funds to bet the farm) like that.)

<comment><USER14> But assuming that public disclosure _was_ required for insiders, the CEO selling all their stock could drive the price down pretty quickly. People will be watching that particular 1% closely.

<comment><USER15> This assumes really fast turn arounds on this information.

There's time taken to submit data to a central clearing house and time taken for them to publish it.

Many people may not want you to have a real time feed letting people know what shares they have just sold.

There also exist accounting cycles and hence corresponding disclosure cycles. CEOs can make non related entity trades, mask trades, etc. Seasoned financiers are far smarter than the new entrant. They will find ways to reduce their "downside", and increase their upside.

You always want to ensure that new entrants are not left to the mercy and warm fuzzy feeling of finance experts. The rule is that they can't afford them.

</comment></comment></comment></comment></comment></comment><comment><USER16> I am wondering if this centralized infrastructure for financial news is actually a good idea. This could always happen again and again. All the employees in these news companies could get a mass of insider information which they could sell.

Isn't maybe an alternative decentralized news publishing service a better idea? Couldn't the CEO of a company publish their financial news only on their own website at the given publication date? Why is it necessary for these news to be stored in some central news database days before their publishing date? And I mean these as honest questions because I have really no idea what the advantage would be?

And another related question: wouldn't it make sense with today's Internet infrastructure to reduce the interval between earnings reports. Maybe it could even be something like a continous automatic publishing of these company finances. Always when some financials change it could directly be published. That way all investors would at all times have the same information as the insiders, so everyone would be on the same level. Of course some extraordinary news like mergers or acquisitions might still give some people insider information who prepare the deal, but at least the quarterly earnings could not be insider information.

<comment><USER17> > Why is it necessary for these news to be stored in some central news > database

Amusingly it's because of the hedge funds. They want to have a limited list of places to check for news to make sure no one gets there ahead of them.

This is why they were so upset when the Netflix CEO made something public on Facebook -- because they weren't watching his Facebook page for news (but they sure are now!).

The SEC actually has a very limited set of places that you can release financial news because of this.

<comment><USER18> I mean, hedge funds have the resources to monitor thousands of websites. Joe Retail Investor doesn't. Reg FD was introduced to level the playing field.

</comment></comment></comment><comment><USER19> The tone of this article was really, like, interrupted by a prolific use of "likes."

I wish it were so simple to hand-wave all security risks. Mr. Levine's ability to find a MySQL tutorial was quite impressive, but his dismissal of very real security concerns is childish. It's like saying cars are known to crash, so quit crashing cars. It's so, like, simple!

<comment><USER20> I love reading Matt Levine's writing; I enjoy the humorous tone. A bit of Louis CK for the financial world. But I didn't get that he was dismissing the security concerns. I read it as he was dismissing the idea that some aspects of the hacking could have been more easily thwarted. For example, two factor authentication is a relatively straightforward protection. Now he may have been underselling how complex it is to implement, but I would have to agree that items like two factor authentication are relatively straight forward tools at this point.

<comment><USER21> 2 factor authentication has nothing to do with this, though, and would do absolutely nothing to protect against this occurrence or similar ones. 2 factor authentication is great in certain situations... but only when your code is operating correctly. If someone has achieved arbitrary code execution (even if only at the SQL layer) it's game over. 2FA won't save you.

<comment><USER22> they also brute forced employee accounts (likely the sql injection was in the employee facing section of the site)

</comment></comment></comment></comment><comment><USER23> Replace hackers with the NSA. Imagine the trades one could make with access to the world's email inboxes.

<comment><USER24> Given the number of NSA employees who have confessed to abusing their access to LOVEINT, it must have been tried already.

</comment></comment><comment><USER25> Would it be so bad if insider trading laws just went away? Information is spreading faster than ever. So a few Mak outsized gains on some inside info. Is it that big a deal?

<comment><USER26> Corporations are supposed to operate on the behalf of their shareholders - insider trading is in direct conflict with that

<comment><USER25> How is that? Set up a private mailing list for shareholders, then.

<comment><USER27> Not all the upcoming announcements can be shared with all shareholders. Too much risk in leaking.

</comment></comment></comment></comment><comment><USER28> I enjoyed the tone and the piece. His assessments of brute-forcing and SQL injections were quite accurate.

</comment><comment><USER29> I've been noticing a lot of spikes across assets lately. Always timed a minute or two before the official release print. That used to constitute a somewhat unusual occurrence. One expects relative calm before the storm. Now it seems to happen with every bit of data. It could be chalked up to algos pre- positioning in anticipation. But many times if you are tracking fellow traders on your twitter feed as well as the price action, you'll notice a cry of "Leaked!" coupled with the price swings. I always assumed something far more nefarious and insidery was taking place. Powerful forces manipulating markets for various geo-political ends and so forth. So am somewhat relieved to see ordinary everyday greed to be the culprit. Am waiting for a Nanex style expose on this phenomenon.

</comment><comment><USER30> Then there is the story of the really sophisticated guys who didn't get caught. Unfortunately that's a story you won't be reading online, but will just have to imagine.

It really makes me question the sanity of doing this illegal trading. For as much effort you could do something legal and make money. Maybe not as much but surely without the risk of going to prison.

<comment><USER31> Sadly, insider trading is _pervasive_ on wall street. You don't read about the guys that don't get caught, and there are a _lot_ of them. Remember, if you can't spot the sucker at the table, you're the sucker. That's why I keep my money far away from the stock market except for index funds.

<comment><USER32> If you believe that the _entirety_ of the market is rigged, what possible reason is there to make an exception for index funds?

<comment><USER31> Because individual stocks can be rigged in either direction (for or against your position), but at the level of sector or index funds all of that activity balances out.

</comment></comment></comment></comment><comment><USER33> What blows my mind is that these people don't encrypt their emails with some form of plausible deniability envelope. I mean, if you're smart enough to set up servers for customers of your illegal activities, you should be smart enough to know what to avoid.

<comment><USER34> Not really, especially in East European countries where the legal system is weak. When everybody hacks everybody every day and nobody gets sued then you stop to worry about hiding.

</comment></comment><comment><USER35> I believe if you become a member of the US Congress you are explicitly excluded from insider trading laws. So you could always stand for office.

Sigh.</comment>


Texas Prison System Slashes Price of Inmate Phone Calls by 77 Percent - <AUTHOR> https://www.theroot.com/texas-prison-system-slashes-price-of-inmate-phone-calls-1828612862 <comment><USER2> You can't charge $1/minute for the video call if that's what you're charging for a regular phone call.</comment>


Stanford Medicine COVID-19 test now in use - <AUTHOR> https://med.stanford.edu/news/all-news/2020/03/stanford-medicine-COVID-19-test-now-in-use.html <comment><USER3> _How test works

The Stanford test uses a technique called reverse-transcriptase polymerase chain reaction, or RT-PCR, to rapidly identify the presence of viral RNA in swabs from the noses of potentially infected people. RT-PCR uses short stretches of DNA called primers that bind tightly and specifically only to matching sequences in SARS-CoV-2 RNA. An enzyme called reverse transcriptase then converts the viral RNA into complementary DNA, and as the reaction continues, an enzyme called polymerase is used to generate billions of DNA copies that can be detected by fluorescently tagged molecules called probes._

<comment> semi-extrinsic What I don't get from this description is hos they get the virus to release the RNA?

I thought virii only release their RNA after entering a cell? Is there some sort of artifical cell wall involved?

<comment><USER4> You can just destroy the virus, e.g. by grinding it down or via a certain chemical and then you have a resulting crude mixture of RNA + other virus parts. In the past you had to separate the RNA first, but with newer methods you can do the PCR directly on the crude mixture.

</comment></comment></comment><comment><USER5> Why can't RT-PCR tests be used to detect virus in a sample mixed from a large number of individual samples? This would enable cheap and accurate mass testing, since you can find P positives from S samples with O(P*log(S/P)) tests. What's the catch?

<comment><USER6> Just curious, can you expand a bit on the analysis? I see that by binary search you get O(log(S)) to identify a single positive, and naively rerunning search from the beginning P times yields O(P*log(S)). One can certainly do better by avoiding redundant tests but at some point one needs to start reasoning about the distribution of the positives in the samples and I'm not sure how to do that.

<comment><USER6> Thought about it overnight and this is what I have:

To reason about the distribution of positives in the sample, we consider two limiting cases, then interpolate between them. The cases are:

1\. All positives are clustered exactly together. We start with log(S/P) queries to find the parent node of all positives, then test every node in the subtree with 2P-1 queries to identify all positives. In total, this is O(p + log(S/P)).

2\. All positives are uniformly distributed. By the pigeonhole principle, the lowest level where every node tests positive must occur at log(P). Above this level, every node tests positive, so we must perform 2P-1 tests. Every P nodes on the level must be binary searched; each node has a subtree of height log(S/P), for Plog(S/P) operations. In total, this is O(P + Plog(S/P)) = O(Plog(S/P)).

It is not immediately obvious that the worst case distribution is either case 1 or 2. To address this, we define an interpolation variable K in [0, 1] which describes a distribution where all positives begin clustered together, then KP positives are adversarially moved elsewhere. We claim that K = 0 is case 1 and K = 1 is case 2.

Consider the case where KP = 1. As in case 1, we need 2P-1 + log(S/P) tests to fully identify the cluster; we also need a single binary search starting at the 2nd level corresponding to the other half of S, which takes log(S) - <USER2> operations, for a total of 2P-1+log(S/P)+log(S)-1. As KP increases, the level at which we transition from testing every node to initiating binary search on a node will decrease; as an example, when KP = 4, we fully test halves, then quarters, and then begin binary search. In general, we will need KPlog(S/KP) queries for all binary searches. Finally, no matter what KP is, we need no more than O(P) queries for subtrees where we need to test every node. This yields O(P + KPlog(S/KP))

This allows us to navigate around an adversary choosing the worst distribution of positives possible by taking the upper bound where K = 1, yielding O(P + Plog(S/P)) = O(Plog(S/P)), though this bound is not expected to be tight.

</comment></comment></comment><comment><USER7> Looks like it's a RT-PCR. How different are their primers compared to the IDT sets ([https://www.idtdna.com/pages/landing/coronavirus-research- re...](https://www.idtdna.com/pages/landing/coronavirus-research-reagents))?

There are also a couple of papers on biorxiv with primers for RT-LAMP tests, which should be much faster, easier to perform than RT-PCR. And it requires non-sophisticated equipment.

It all comes down to the false negative rates though.

</comment><comment><USER8> To everyone questioning the false positive and false negative rates: your point is well-taken, and it is the reason why it was necessary to push the FDA to allow non-CDC labs to perform COVID-19 testing based on a fast-tracked version of the clinical validation process.

To those that point out that there are newer/faster/better ways to actually achieve the same results: you're right but that doesn't mean that the machines, reagents, collection media, etc. are ready for prime time in this type of setting. Remember: the entire process needs to be clinically validated in order to earn the trust of doctors and public health officials who are literally making life vs. death decisions.

TL;DR - Your points are valid, and there are real challenges that make certain solutions impractical at this point in time. Consider this a call to action to entrepreneurs who are serious about helping patients at home and around the world.

</comment><comment><USER9> Do we have any idea of what the false-positive rate of these types of tests generally are? It sounds pretty thorough but some actual data on that would be nice.

Also, given that the prevalence of the virus is still very low, I am assuming (and the article seems to support this) that the test would only be used on people that have some pre-existing risk factor, like exposure to a known infected person, or travel to/from one of the high risk locations. Otherwise (let's assume a FP rate of 1%) you would still be getting a large number of false positives. Even with the assumption that there are a large number of very mild undiagnosed cases.

The reason I bring this up is because I have seen many people calling for mass testing of _everyone_ in the United States, regardless of symptoms or risk factors. I think doing that would be a very big mistake because then you end up with a few possible scenarios:

1\. You tell everyone who tested positive without any symptoms/high risk factors that they probably don't have it actually.

2\. You end up treating massive amounts of people with potentially risky treatments, or quarantine people for no reason.

3\. You have to do lengthy/expensive follow up tests of millions of people and waste valuable time and resources.

I guess 1 isn't a big deal, but then how do you prioritize who to treat given the symptoms alone don't provide a very useful criteria for judging who has it?

Obviously the doctors and scientists working on this know all of this already, but the general public and politicians seem to be demanding mass testing of the entire population, which worries me.

<comment><USER10> False negatives may actually pose a greater public-health problem. A suspected case, assayed as a false negative can be released back into the community without quarantine.

<comment><USER11> Right now we are releasing everyone who has non-extreme flu symptoms without testing whether it's flu or covid-19, so even a small false negative rate would be a great improvement.

</comment></comment></comment><comment><USER12> RT-PCR is the typical way to test viral infection. Anyone knows if Stanford Clinical Virology Laboratory has invented anything new or just a press release to note that they are prepared to do SARS-CoV-2 viral testing since CDC has finally authorized all private and university labs can perform tests just recently?

<comment><USER13> The last two paragraphs mention that they look for two gene while the CDC test looks for a different gene. So I don't think anything fundamentally new but having multiple tests let them crosscheck each other.

</comment></comment><comment><USER14> Is nobody else bothered by the logic in the 3rd paragraph?

> As with all currently available tests, it's not yet clear how long a person > needs to be infected before testing positive, or whether someone who's > infected could be identified by the test before displaying symptoms.

<comment><USER15> A recently saw a paper calling that COVID-19 was easy to detect early in the course with an oral swap. But later in the disease course it was easier to detect with a fecal test. Turns out a lung scan was more accurate than either.

</comment></comment><comment><USER16> Isn't China using rtpcr for the test from the beginning?

</comment><comment><USER17> Hug of death.

</comment><comment><USER18> I hope the publish their own (anonymized) stats and don't let the whitehouse tamper with hiding numbers like they did with the CDC.

NY State has their own test too right? Are they going to publish stats?

</comment><comment><USER19> > As with all currently available tests, it's not yet clear how long a person > needs to be infected before testing positive, or whether they could be > identified by the test before displaying symptoms.

Kind of made me sad. We're celebrating that we are able to test something, in very... precarious? .... results. Of course it's amazing that we're able to known the genetic sequence in so few days. But as travels are much faster around the globe, it takes so few days to spread. Everything being so fast isn't exactly helpful to settle emotions.</comment>


How To Opt Out of Facebook Ads Based on Your Real-Life Shopping Activity - <AUTHOR> https://www.eff.org/deeplinks/2013/02/howto-opt-out-databrokers-showing-your-targeted-advertisements-facebook?ad <comment><USER2> Even though I use ghostery and provide unique email addresses to websites I don't trust, I still feel a bit uneasy about voluntarily providing my personal information to these companies just so I can "opt out". I know these sites are legitimate, and I trust the EFF; however, it still feels unnecessary.

Maybe I've just been conditioned by the fake unsubscribe links found in email spam, but I don't want to accidentally give these advertisers more information than they already have. Even if they already have complete information on me (which they undoubtedly do), I don't want to provide them with unnecessary confirmation that the information they have is correct.

<comment><USER3> I never understood the "fake unsubscribe" thing. In a previous life I did infrastructure consulting for people with ROSKO listings and they collected and processed every single unsubscribe. They even traded unsubscribe lists.

Back then everyone was using pinks (contracts with an allowed quota of complaints per day baked in) for mailing. If you scrubbed your lists against unsubs and bounces, you got less complaints and could negotiate better rates in the future.

<comment><USER4> I agree, I've seen a few but not many, and when they Email me again I just mark it as spam and never see another one. Email is commanded by algorithms right now, which take a heap of hints from their users, it's seriously stupid not to unsubscribe people kind enough to unsubscribe instead of marking you as spam.

<comment><USER5> Last year I read an article about someone doing an experiment with unsubscribe links on a very old email address. It got loads of spam, and he clicked all the unsub links (or maybe wrote a script to do it). The amount of spam that address received decreased _significantly_.

So whether or not the "fake unsubscribe" thing was real (my intuition says yes it was), it appears that times have changed!

</comment></comment></comment></comment><comment><USER6> There's always the option to delete your FB account. I went nearly 10 months without logging into FB last year, and doing so made it quite easy to delete my FB account at the beginning of this year.

Regular removal of cookies, and LSO cookies, as well as clearing the browser cache, is also recommended.

Then there's the ubiquitous "Connect" buttons which are spammed all across the web. Prudence dictates that we avoid connecting our logins across the net in an indiscriminate manner.

Finally, there are "burner" email addresses which I use only to register with certain websites. Nearly all of the spam that makes it past my filters is from so-called "legitimate" websites.

Caveat emptor.

<comment><USER7> Deleting your account does not stop Facebook from tracking you, unfortunately.

<comment><USER8> Does Facebook actually delete stuff yet? For a long time they wouldn't delete accounts, photos, etc.

<comment><USER6> That's a good point, regarding whether, or not, FB actually deletes user data after we "opt out." Another consideration is how, when Facebook started out, users were supposed to actually know, IRL, the people on their "Friends List." I adhered to that rule all the way until my account deletion last January, but now a great number of users have people on their "Friends Lists" who they have never even spoken to in real life. This point is illustrated by corporate entities being on people's "Friend Lists."

As for FB allegedly tracking me subsequent to my account deletion, could someone explain to me how it could be so? I never posted my actual DOB, nor my cell phone, the email address I used to register hasn't been logged into for many months, and I'm using a new ISP - which uses dynamic allocation addressing.

<comment><USER9> A possibility could be if your email shows up in your friends' contact list which FB gets from their email accounts.

FB continuesly harrassing me to give them my email password - of all things to ask for! - is something I will never get. 'We'll check your contact list for friends! We won't save your password!' My _email password_! You wanna install a camera in my room while you're at it?

But some people apparently actually use the service, and thus FB can find out you exist and who you're friends with. They might also mention you etc.

</comment></comment></comment></comment></comment><comment><USER10> Or, just don't use facebook. I'm not trying to be facetious, if you don't trust the company with your most personal information then you probably shouldn't be using their service. Because that is what they trade in.

<comment><USER11> From what I understand, Facebook builds profiles of non-members as well, so they are still a threat.

</comment></comment><comment><USER12> I actively prefer ads for things I might actually be interested in purchasing. If there were an option to tell advertisers "Please show me more ads about..." I would take that option. whenever I was waffling on some purchase. Most ads suck even so - they don't actually tell me about a new feature or fact that could potentially change or spark a buying decision - but at least it's not a total waste of time.

The only economically productive use-case of marketing is to lead trades to take place that would not have taken place otherwise, or higher-quality trades to take place; which can have its roots in consumer gullibility, but ideally reflects some new company telling me about a relevant product that I didn't know existed. This happens rarely. Having it happen more often sounds like a good idea to me.

</comment><comment><USER13> I highly recommend Ghostery. I've been using it for quite a while now and have no complaints.

<comment><USER14> Lifehacker just did a comparison of popular privacy extensions and called Disconnect the best (over Ghostery and others): [http://lifehacker.com/the- best-browser-extensions-that-prote...](http://lifehacker.com/the-best-browser- extensions-that-protect-your-privacy-479408034)

<comment><USER15> Yeah... You really should have put a disclaimer in there to let everyone know that you were advertising your own product.

That makes me never want to try the extension, no matter how good it may be.

<comment><USER16> I don't think he wrote the Lifehacker article he linked to.

<comment><USER15> He was advertising it on HN, not LifeHacker, with that comment.

</comment></comment></comment></comment></comment><comment><USER17> One thing this shows is just how powerful Facebook could become/already is. When they connect the dots online and offline of billion user's buying information and habits they essentially can electronically understand who you are better than you do, and can predict what you'll do even better. Just food for thought.

<comment><USER18> _When Facebook connects the dots online and offline of billion users' buying information and habits, they essentially can electronically understand who you are better than you do, and can predict what you'll do even better._

Why are people disturbed by this?

<comment><USER19> Predictions based on partial data could be problematic.

One example: I pay for fresh food and staples in cash, and buy 'grocery' items on a card. A data collection system that tracked only card purchases would give the impression of a very unhealthy diet.

<comment><USER20> This is how it is for me, too. I buy fresh vegetables, fresh meat, milk, eggs, bread at a local farm shop and pay cash. I buy other things like pizza, coffee, processed foods at a supermarket and pay with card - and also scan my loyalty card.

I regularly get offers from the supermarket for money off yet more unhealthy food - they are blissfully unaware that I eat quite well in reality!

</comment></comment></comment></comment><comment><USER21> Am I the only person who would actually prefer targeted ads based on things I might actually be interested in, rather than the crap I've been exposed to before.

If you're going to use a walled garden like facebook, you expect to see walls now and again.

<comment><USER22> Since they have proven that they are awful at targeting, I don't want it.

The fact is, 90% of advertising exists because the product is not worth buying in its merits. Word of mouth recommendations and independent research studies are where good jnformarion comes from. Targeting doesn't help that.

<comment><USER21> I think every effort they make to better target is only a good thing. Attempting to block their efforts will skew their results which could lead to worse ads.

</comment></comment></comment><comment><USER23> The method I have found to stop tracking is to use /etc/hosts to block all traffic to sites that I don't want anything to do with including Facebook and their CDNs. I based it around [https://github.com/leto/Util/blob/master/config/etc/hosts.bl...](https://github.com/leto/Util/blob/master/config/etc/hosts.block) and have added more tracker/advertisement domains as I have encountered them.

<comment><USER24> Large host files really slow down browsing in Windows. Is their a solution for this besides clearing the DNS cache every hour?

<comment><USER25> You can block it on your router.

</comment></comment></comment><comment><USER26> Using Ghostery over AdBlock is good but I won't recommend using any of such tracker blocking extensions to anyone until I know they understand what it does.

At times these extensions do break websites as they block some vital scripts on the site. You have to manually unblock that to make sure the site runs fine on your browser.

I used Disconnect long time ago, but that time it literally broke all the tech blogs, as its blocking was very crude. The site now looks totally different and so do the screenshots, would give it a shot.

Oh and by the way I use Ghostery now.

<comment><USER14> Breaking _literally_ every tech blog would be way hard to do. :-)

We've gotten literally two bug reports about broken blogs of any sort in the last year (I just checked; and both are now fixed, btw), so I assume there aren't issues anymore. But if you experience any, let me know!

<comment><USER26> When the Firefox extension was released ( I remember it was released as a Chrome only solution at first ), I tried and all the famous tech blogs used all possible social buttons and TC had just started with Facebook comments, so for most sites, half the page loaded and other half was stuck.

The new UI looks great, defintely would give it a try. I actually have no problem with Ghostery but I like how Disconnect categories all the tracking.

<comment><USER14> Oh yeah, our original Firefox add-on was outsourced ... and I think kind of sucked. I learned not to do that (even though the devs were and are great).

Thanks a lot for the feedback on the new UI.

</comment></comment></comment></comment><comment><USER27> I've said this before and I'll say it again -- why the complaints now, when Google has been doing this for years? Essentially, they can collect your information from emails, purchasing habits & financial information from Google Wallet, income, and combine that with Google+ social data, files you put into Google drive, and you have a complete profile that's ripe for advertising.

<comment><USER28> I don't quite understand this either. Google have been doing this for ages and no one has said anything, but now all of a sudden its a thing?

I just want people to acknowledge that what Google has been doing and what everyone else is doing is essentially the SAME THING. No reason one company should get a pass over others.

Now as for whether privacy is a legitimate concern or not is another matter entirely and I think comes down to a bit of personal preference too.

I for one, don't care about my privacy -- to an extent. There I said it. I don't care if Google knows that I eat somewhere or do something because it's trivial to me as long as my data is SECURE and I have fine grained privacy CONTROLS. If you give me security and control, then I'll gladly hand over my data for a useful service such as mail, or chat, or photos or whatever it may be.

Privacy in 2013 is different, and we must acknowledge that. This is a new generation, a new era. If you want to stay disconnected, then you don't get to experience this new world and if that's your preference, that's perfectly fine. (note: there will always be a subset of vocal technically inclined people like many of us on the forum that will try to resist, but in the long run, we won't prevail; I have ghostery installed for the hell of it, but a large amount of people don't even know what it is).

I think moving forward, every individual is going to have some type of public web presence that will be as much a part of who they are as anything else. Some parts of this presence will be private and tucked away behind anonymous usernames and private content. Other parts will be open for the world to see. To an extent, all of this is already true, but think about all the kids born from 2005 onward. They're only 8 years old now and are going to be part of the new, always connected generation (meaning, they've never known a world otherwise).

Therefore I think security of data is more important than EVER. Every company should make security of user data a TOP priority. In addition, every company should provide FINE GRAINED privacy CONTROL to allow the user to decide what he/she wants to show and to whom. On the other hand, a user should expect that a web company pays its bills through targeting via user data, and should reflect upon his/her expectation of privacy on the web.

The web is the new TV, but different, and more powerful, much more powerful.

</comment></comment><comment><USER29> Another line of defense it to install an ad-blocker, so even if they somehow know the perfect ad to show you, you probably won't see it.

<comment><USER18> _Another line of defense it to install an ad-blocker, so even if Facebook somehow knows the perfect ad to show you, you probably won't see it._

Why wouldn't you want to see it? A perfect ad is a win for the consumer.

<comment><USER29> A perfect ad is one I asked for, when I asked for it, like in Google or Amazon search results.

I go to Facebook to check on friends. I don't want a fried-chicken billboard to appear beside the photo of my friend's new baby. It's the wrong context (even if I'm craving fried chicken).

<comment><USER30> what if it was a baby shower gift? What if they managed to connect enough dots to know that this is what you want, and thus, make the sale via this channel?

<comment><USER31> I still may not want to make the purchase via that channel. In fact, I find most important to be able to enter any web to read its content without those distractions. If I want to buy something, I'll go to any online store, thanks.

</comment></comment></comment></comment></comment><comment><USER32> if they're using hashed emails for tracking, we're pretty much clucked. There is an option in gmail that can prevent this.

if your email is firstname.lastname@example.com, use email@example.com (gmail will ignore the stuff after the + ). You can also use . separators.

Now, to keep track of that...

<comment><USER33> Since Gmail's account name semantics are well known, the top data collecting agencies have no doubt adapted by now.

Also, frustratingly, a lot of sites will break, often silently, if you give them an e-mail address with a plus symbol (e.g. it might end up in a GET request to an internal API without proper escaping, and be interpreted as a space).

<comment><USER34> Yes, the only way to go is your own domain. Use an add-on like Virtual Identity for Thunderbird to keep track of which From address goes with which recipient. <https://www.absorb.it/virtual-id> (their cert seems to have expired over the weekend)

<comment><USER22> I do wonder when/if trackers collapse all addresses on a small domain into a glob. They totally could.

</comment></comment></comment></comment><comment><USER22> > product warranty cards

Why hasn't the FTC shut this scam down yet?

</comment><comment><USER22> > phone number

Holy cow FB uses my private security tokens as a source of ads?</comment>


Ask YC : [Optionally] Statically typed languages on the JVM? - <AUTHOR>

I know of 2 statically typed languages on the JVM : Java and Scala. Any other interesting languages on the JVM which are more or less stable enough to use? I already know a lot of dynamic laguages run on the JVM like Jython and JRuby but not too many nice statically typed languages around.<p>Something with optional static typing like Common Lisp will also do. (I know about ABCL but its GPL and I am not sure how well CLOS maps to JVM for example). <comment><USER2> <http://flp.cs.tu-berlin.de/~tolk/vmlanguages.html> mentions Groovy - <http://groovy.codehaus.org/> \- a dynamically and/or statically typed language (i.e. static typing is optional, otherwise it defaults to dynamic typing) high level scripting language for the JVM which compiles down to bytecode either at run time or compile time. It features closures, neat List and Map syntax, integrated markup language and expression language, auto- boxing, operator overloading, mixins, AOP interceptors etc.

</comment><comment><USER3> "but its GPL"

What's wrong with the GPL? Are you planning to modify the language itself?</comment>


25 Homer Simpson quotes to help guide your career - <AUTHOR> http://digg.com/business_finance/25_Homer_Simpson_quotes_to_guide_you_to_a_successful_career

<comment><USER2> Why link to Digg instead of to the actual article?

<comment><USER3> Well, why didn't _you_?

[http://www.examiner.com/x-3040-Life-in-the-Cubicle- Examiner~...](http://www.examiner.com/x-3040-Life-in-the-Cubicle- Examiner~y2009m6d30-25-Homer-Simpson-quotes-to-guide-you-to-a-successful- career)

P.S. what sort of information storage engineer came up with that horrible URL format? all unnecessary tags could moved to their own tag-info table:

examiner.com/tag-id/readable-url-for-your-pleasure

where tag-id uniquely identifies the tag-info for this particular article, etc.

D'OH!</comment></comment>


Students are failing AP tests because College Board can't handle iPhone photos - <AUTHOR> https://www.theverge.com/2020/5/20/21262302/ap-test-fail-iphone-photos-glitch-email-college-board-jpeg-heic <comment><USER2> > But the testing portal doesn't support the default format on iOS devices and > some newer Android phones, HEIC files. HEIC files are smaller than JPEGs and > other formats, thus allowing you to store a lot more photos on an iPhone. > Basically, only Apple (and, more recently, Samsung) use the HEIC format — > most other websites and platforms don't support it. Even popular Silicon > Valley-based services, such as Slack, don't treat HEICs the same way as > standard JPEGs.</comment>


Your chocolate is picked by enslaved kids. - <AUTHOR> http://www.kamikazecookery.com/blogs/210

<comment><USER2> Might as well mention some local chocolate-making startups that pay particular attention to their sourcing in areas with HN readership, to try to avoid this problem:

SF Bay area --- TCHO. Factory and shop between Fisherman's Wharf and the Ferry Building.

Boston area --- Taza. Mexican style chocolate made in Somerville, just over the Cambridge line.

Bonus: the stuff tastes a hell of a lot better than what's on sale in supermarkets.

Clickable: <http://www.tcho.com/> <http://www.tazachocolate.com/>

<comment><USER3> Are they Fairtrade (or similarly) certified?

\- <http://www.fairtrade.org.uk/what_is_fairtrade/default.aspx>

\- <http://www.fairtrade.net/> (international site)

Fair trade has been making in-roads in the UK and we do now have mainstream chocolate manufacturers that sell certified fairtrade products as well as the smaller companies that sell only Fairtrade expanding.

<comment><USER2> Both deal directly with local producers; neither has done the paperwork for full FT certification. Taza's also committed to paying above-market prices, and has an external auditor checking up on them.

FWIW, their own pages on sourcing are here:

Taza: <http://www.tazachocolate.com/AboutUs/Taza_Direct_Trade_>

TCHO: <http://www.tcho.com/tcho-is/faq#17>

</comment></comment></comment><comment><USER4> It's certainly horrible— more horrible, perhaps, is that not buying commercial chocolate isn't going to help those people. There's always a market for slave labor.

Is this a good place to talk about what a socially conscious individual could do to actually fight slavery, rather than just not support it directly? Somehow I feel like writing emails does not have a huge effect.

<comment><USER5> While those people may not be immediately helped by not buying, we are only directly in control of our own actions. Do we want to participate in a process that supports slave labor? If not, the first responsible action is to stop buying the product. From there, one can find other creative ways to address things.

<comment><USER4> Let me restate that— Sub-Saharan Africa is not, in general, a nice place to live for a vast number of people. These particular people are involved in the production of a luxury export, so they happen to show up on our radar screen, but the fundamental problems are not being caused by chocolate, and my buying chocolate from someone else, or indeed the collapse of the entire chocolate industry, is probably not going to do a lot more than make me feel better about myself.

So okay, I stop financing slavery. What am I going to do to actually make it _stop_?

</comment></comment></comment><comment><USER6> There's a spectrum of responses from buying less-objectionable nutty-crunch bars, to financing a mercenary sweep of chocolate farms and whisking the kids off to an orphanage.

I don't know how effective it is to change buying habits - are elephants any safer now that we don't permit selling ivory in the US?

As dilute as the effect of changing my checkout-counter impluse buy is, so must be diluted the responsibility for the crime. After all, cynically, 90% of the cost of that bar is the transportation and sales cost. So only a penny or so is going toward child-enslavement.

Sadly I fear that on the scale of ineffective responses, blogging comes even further down the list.

</comment><comment><USER7> Something that the article did not mention is that money from the cocoa exports are used to fund a political war in the Ivory Coast. A few days ago the internationally recognized president there issued a ban on all cocoa and coffee exports in hopes that it will prevent his rival from financing his mercenaries - [http://www.timeslive.co.za/africa/article869870.ece/Outtara-...](http://www.timeslive.co.za/africa/article869870.ece/Outtara- slaps-ban-on-Ivory-Coast-cocoa-exports)

</comment><comment><USER8> Much as I'm sympathetic to the subject this is not hacker news and I've flagged it.

<comment><AUTHOR> I thought about this a bit before I submitted it today. My feeling was that although it's not directly tech-related, chocolate's definitely in the Geek Food Groups, and most HN types I know are concerned with being ethical in their lives, even if they're skeptical of Big Green Movement stuff (as I am).

Nonetheless, totally respect your decision.

<comment><USER8> HN needs an 'other' category. But I can see why PG keeps it off the site, once you add 'other' everything that is off-topic suddenly is 'on' topic and it would probably take people away from the topical stuff as well as lead to things that cause people to lose respect for each other (politics and such).

</comment></comment></comment><comment><USER9> Here's the documentary that tells all: <http://j.mp/fzlrBu></comment>


Show HN: InboxBear, secure instant inboxes for temp emails - <AUTHOR> https://inboxbear.com <comment><AUTHOR> Can also share a link to a collection of inboxes you share with friends like so [https://inboxbear.com/q/b5dmq7x/k2tuep8](https://inboxbear.com/q/b5dmq7x/k2tuep8)

</comment><comment><USER2> That makes total sense. Good luck, you guys.

<comment><AUTHOR> thx!

</comment></comment><comment><AUTHOR> made this after users asked me to be able to protect their temporary inboxes. Works on mobile and Desktop, uses React, Nodejs and Mongo as backend. Haraka for smtp.</comment>