EU proposal to clamp down on Bitcoin curb terrorism funding - <AUTHOR> http://mobile.reuters.com/article/idUSKCN0T81BW20151119?feedType=RSS&feedName=topNews&utm_source=twitter <comment><USER2> The headline is misleading. This is a Reuters reporter reporting that some ministers are planning to discuss non-bank methods of money transfer at the upcoming emergency meeting. The report seems to get it's information from a "draft conclusion" document, but does not reference it.

The headline suggests the EU has already decided to clamp down on Bitcoin, but it is far from clear to me that it will even be discussed. All we know is that some unnamed officials want to talk about it (together with transfers of precious metals, etc).

<comment><USER3> Thank you. We changed the title to reflect that.

</comment></comment><comment><USER4> Good timing. Yesterday, the UK Treasury released an official document stating that Bitcoin and cryptocurrencies have the lowest risk and lowest likelihood of money laundering amongst the areas of finance they studied. Guess who came first, Banks. Good job HSBC! You have laundered more money ever then the entire cryptocurrency industry is worth... 10x over

[http://www.coindesk.com/uk-treasury-digital-currencies- low-m...](http://www.coindesk.com/uk-treasury-digital-currencies-low-money- laundering-risk/)

HM Treasury link to the National Risk Assessment carried out by the Home Office: [https://www.scribd.com/doc/290214176/UK-NRA- October-2015-Fin...](https://www.scribd.com/doc/290214176/UK-NRA- October-2015-Final-Web)

<comment><USER5> I'm a big supporter of bitcoin and I have a superficial understanding of how the public ledger works, but why is it not incredibly easy to launder money through bitcoin? Since the currency is fungible, aren't there services that allow you to send bitcoins and it will send move your bitcoin around through many other accounts, including bitcoin from deposits of others? The end result being that the end state of some bitcoin cannot be traced back to the origin. How would someone reasonably trace that with any degree of certainty?

<comment><USER6> It's not anonymous. All transactions are trivially followable, up to an anonymizer. But anonymizers have to eventually send the money to a destination, so their effect is pretty muted - just track the flow and user the resultant amounts to differentiate.

I think people look at bitcoin and hear "crypto" and immediately think opaque and unbreakable. Neither are true, but first impressions matter a lot.

<comment><USER7> > just track the flow and user the resultant amounts to differentiate.

The usual mitigation for this is to use common denominations for all inputs and outputs.

</comment></comment></comment></comment><comment><USER8> Given how extremely traceable bitcoin payments are, I'm pretty surprised that they're not _trying_ to get Bad People to use Bitcoin, whether publicly or behind-the-scenes.

I mean, in a way, maybe this is what this story is all about: a great big advertisement saying "Come use this _completely anonymous_ payment system," with a sly nudge and a wink because bitcoin's nothing of the sort.

Just imagine: a plot is discovered, payment details made via bitcoin stumbled upon - and now you have a long list of _every transaction_ those people have ever made using Bitcoin!

(for the inevitable bitcoin cult members wanting to chime in about "tumbling" or "fog" services, aka bitcoin money launderers, 1. they're still traceable and 2. there's not enough money going through them to successfully launder a four-digit amount, let alone anything greater.)

<comment><USER9> It's impossible to track bitcoins when people transfer in and out of other currencies between bitcoin addresses.

The process is called _tumbling_ , and it's primarily how bitcoin tax evaders use it now to get around the "public ledger".

<comment><USER8> >It's impossible to track bitcoin laundering when people transfer in and out of other currencies, between bitcoin addresses.

>The process is called tumbling, and it's primarily how bitcoin tax evaders use it now to get around the "public" ledger.

I very briefly addressed this at the bottom of my comment.

In short order:

\- Tumbling is traceable: throw a beefy server at the list of transactions, and since you know how much money arrived in someone's possession on a given date, you can now trace it backwards by crunching the numbers. Analysing long lists of transactions like this is something computers are _really_ good at.

\- But that doesn't matter, because tumbling sites _can 't_ work: they don't have enough capital in them to successfully launder more than a few play dollars at a time.

<comment><USER9> I think you're under the assumption that currency conversions are traceable. Once you convert bitcoins to dollars or yuan, your beefy server can't see the remaining transactions.

For example: 20 BTC -> $4000 -> 25000 yuan -> 4 new addresses @ 5, 10, 2, & 8 BTC

The only way to trace these is to compromise the exchange servers, get account information, and subpoena transactions from the banks. Very difficult to do given the international nature of these exchanges and banks.

<comment><USER8> >I think you're under the assumption that currency conversions are traceable.

I was specifically addressing tumbling services. I'm guessing that you accept those services are easy to compromise (heck, for all we know, various governments might operate the current ones) which is why you bring up currency conversion.

>For example: 20 BTC -> $4000 -> 25000 yuan -> 4 new addresses @ 5, 10, 2, & 8 BTC

Let's turn this around: you have a list of transactions, you know when they took place, you know where the money ended up, and now you're tracing the line backwards, knowing that at some point, there will be a connection (or connections) to other transactions _at least as big as this one_ ; why do you think this is so hard to analyse?

>The only way to trace these is to compromise the exchange servers, get bank account information, and get transactions from the banks. Very difficult to do given the international nature of these exchanges.

Not really, given how little is known about some exchanges' operators.

<comment><USER10> huge list of assumptions there, but having read your responses you dont really understand bitcoin, transactions or tumblers. Tumblers can delay sending transactions by anywhere from hours to days, so matching 1 input with 1 output would be dificult at the very least. If 1 input is split into 6 outputs of varying sizes, sent at various times how would a beefy server help you. Say I send in 10BTC to a tumbler and my output is split into 6 outputs of between 1 and 2 btc each, these are issued to different addresses over a 5 day period. How do you trace that in amongst all of the other several thousand transactions that occurred in that 5 day period? I would genuinely be interested in how you think this would work, as would many in law enforcement and the bitcoin ecosystem.

</comment></comment></comment></comment></comment></comment><comment><USER11> I didn't see in this article where they actually gave a valid reason for the crack down. Is there evidence that the funds for these attacks, or any others, originated from bitcoins?

The initial reaction of my inner knee-jerk skeptic says this is another example of those in power, this time banksters, not letting a good crisis go to waste.

<comment><USER12> There's no evidence for this, they are using the attacks as an excuse.

It's like the encryption hysteria. Look at this blatant propaganda from the BBC: [http://www.bbc.com/news/technology-34842854](http://www.bbc.com/news/technology-34842854)

Some choice quotes:

 _" They are not using the big obvious systems at all," he tells the BBC._

They were using _SMS_.[1]

 _" They are all now using the OTR [Off the Record] protocol, which offers end-to-end encryption," he says._

 _" The arrests that are going on now have come from a trawl through metadata"_

This is actually how they found the other would-be attackers:

 _European media outlets are reporting that the location of a raid conducted on a suspected safe house Wednesday morning was extracted from a cellphone, apparently belonging to one of the attackers, found in the trash outside the Bataclan concert hall massacre. Le Monde reported that investigators were able to access the data on the phone, including a detailed map of the concert hall and an SMS messaging saying "we're off; we're starting." Police were also able to trace the phone's movements._

The amount of bullshit and propaganda coming out is scary.

This is the website of one of the BBC's experts, for added hilarity[2].

[1] [https://www.techdirt.com/articles/20151118/08474732854/after...](https://www.techdirt.com/articles/20151118/08474732854/after- endless-demonization-encryption-police-find-paris-attackers-coordinated-via- unencrypted-sms.shtml)

[2] [http://www.pmsommer.com/](http://www.pmsommer.com/)

<comment><USER13> Peter Sommer's nom de plume was Hugo Cornwall - a name Brits who got their start in the 80s will recognise. I'm not sure where the hilarity is?

</comment></comment></comment><comment><USER14> _sigh_ this /feels/ like it's in the same vein as "ban encryption". As in "we have no proof this is happening but the Paris attacks give us a window where we can push through whatever BS we want and silence any critics with 'Do you want this to happen again?'"

</comment><comment><USER15> So is this a case of _" never let a serious crisis go to waste"_, or _" We must do something. This is something. Therefore, we must do this"_?

<comment><USER16> The Politician's syllogism:

[https://en.wikipedia.org/wiki/Politician's_syllogism](https://en.wikipedia.org/wiki/Politician's_syllogism)

</comment></comment><comment><USER17> Check out the book "Money: The Unauthorized Biography". It does an excellent job making an argument that a sovereign that loses control of the primary currency loses control of political primacy. This isn't just about terrorism or money laundering. It's very much about political power.

review 1: [http://www.nytimes.com/2014/04/13/books/review/money-by- feli...](http://www.nytimes.com/2014/04/13/books/review/money-by-felix- martin.html?_r=0)

review 2: [http://www.cato.org/publications/commentary/book-review- mone...](http://www.cato.org/publications/commentary/book-review-money- unauthorized-biography)

review 3: [http://www.theguardian.com/books/2014/jul/08/money-the- unaut...](http://www.theguardian.com/books/2014/jul/08/money-the-unauthorised- biography-by-felix-martin-review)

</comment><comment><USER18> More importantly than their intent, exactly how do they expect to enforce this new "policy"? It seems to me to be as enforceable as banning individual to individual cash transactions. Good luck with that.

<comment><USER19> You can ban/heavily regulate legitimate usages of the currency, which devalues it. If no-one outside of illegitimate circles can accept/process bitcoin money laundering becomes a lot more difficult, since the bitcoin loses value for legitimate purposes.

<comment><USER20> This is a great idea. The legitimate users will have to find someone to offload their bitcoin to, and since the legitimate outlets are shut down, they'll have to do local, difficult to trace trades. And since the only people buying bitcoin at that point is going to use it for illegal purposes... wait this is a terrible idea

</comment></comment></comment><comment><USER21> Will they also clamp down on Transferwise?

The fallacy here is, Bitcoin doesn't actually _move_ money. It can only move _ownership_ of money. If I want to finance terrorism, there must already be someone with e.g. $1M where I want it (in Islamic State), so that I can trade 3000 BTC with him/her.

<comment><USER22> TransferWise hasn't done anything with Bitcoin since April 2013 - [https://transferwise.com/blog/2013-04/notice-to-bitcoin- user...](https://transferwise.com/blog/2013-04/notice-to-bitcoin-users- april-2013/)

<comment><USER23> Transferwise accepts payments from debit cards or to their eastern European bank (Latvia or something), and then they pay from their US bank for example.

They do ask for ID documents and perform AML checks, but then again so do all proper bitcoin exchanges with the exception of the shady btc-e from Russia or thereabouts.

But its not like bad guys are afraid of using fake IDs (as seen in Europe this last week) which brings the obvious question as to why they would bother with all that when they can just use cash and traditional banking.

The whole article is click bait of the highest order based on fud.

\----

If the powers to be want to hit ISIS where it hurts how about destroying their oilfields, oil refining and transport capabilities. A few armed drones can do this on the cheap remotely. Make it clear that any oil extraction, processing or transport equipment in the area controlled and sympathetic to ISIS will be destroyed and grant these scum their wish if living in the middle ages.

</comment></comment></comment><comment><USER19> It looks to me more like this was something that was already planned and now they're using the Paris attacks as an excuse. Bitcoin is a lot less anonymous than cash, since everyone can follow who pays what to whom, and it's often possible to tie a wallet to an identity.

</comment><comment><USER24> Before they had the "pedonazis", now they have the terrorists to justify whatever they want to ban.

Since the terrorists used cars for their attacks (there was even mention of a Volkswagen Polo involvement) I propose we ban cars for our collective safety.

I wonder, did the terrorists ever used cash, a debit or credit card ? Maybe we should ban this too then.

<comment><USER8> >I wonder, did the terrorists ever used cash, a debit or credit card ? Maybe we should ban this too then.

FYI The various known terrorists/terrorist organisations lists are a large part of Know Your Client (KYC) checks.

</comment></comment><comment><USER25> "It was difficult to transact legitimate business with cash in the Sprawl; in Japan, it was already illegal."

</comment><comment><USER26> Perhaps we should be looking at GNU Taler ([https://taler.net/](https://taler.net/)) instead. They're supposed to provide personal liberty and many of the other benefits of crypto currencies, but without criminal security.

</comment><comment><USER27> The Saudis use Bitcoin? Within the EU?

</comment><comment><USER28> So it goes. Terror attacks provide opportunities for special interest groups to advance their agenda while public is frightened and irrational. Makes you think about the implicit beneficiaries of terrorism, doesn't it?

<comment><USER29> Indeed, governments around the globe absolutely love terrorism. It's good for business.

<comment><USER30> I think this is not true for several reasons. One (only in multi-party systems) is the rise of new political parties (for example here in Germany) that are very "right-winged" and strongly oppose the current government. I think it can not possibly be in the governments interest to loose power to these groups.

</comment></comment></comment><comment><USER31> EU should be focusing on the funders, but social repercussions would be negative towards certain groups.

I mean, if the payment process was the problem, they should ban money.

</comment><comment><USER32> How much funding is really needed? They talked about this after Sept 11, but that always seemed like a rather cheap thing to pull off. Certainly "bootstrappable" given a few dedicated people. Some flight sim time, perhaps a few lessons to get some insight into ops, and uh, go? Really, the creative spark and meeting of a few collaborators was the only hard part.

How much funding did Breivik need?

</comment><comment><USER33> So we shouldn't let refugees in, even though no refugees were part of recent terrorist events.

We should outlaw encryption, even though the attack was planned with unencrypted off the shelf technology.

We should crack down on bitcoin, even though the attack wasn't funded with bitcoin.

Do lobbying groups just wait for this kind of thing to happen? It seems completely ridiculous to me.

Then again, I'm not afraid.

<comment><USER34> They do, actually. "Never let a good crisis go to waste."

As morally abhorrent as most of us may find the practice of profiting on human suffering to be, we often forget that there are people out there whose morality is almost entirely incompatible with our own, or who lack any sense of morality whatsoever. For a variety of reasons, those same-species parasites are drawn to positions where they can manipulate overly credulous humans for their own gain.

These propaganda campaigns are roughed out ahead of time, like a Mad Lib, and the details are filled out after any relevant crisis occurs, with any inconvenient facts stretched out and re-tailored to fit the narrative structure.

It's not a conspiracy. Those people are not working together. They just coincidentally fired their bullets on the pull of the same trigger.

The terrorists didn't use Bitcoin? Well, in that case, imagine how much worse it could have been if they did use it! They didn't use encryption? How many more would have died if they did?

</comment></comment><comment><USER35> Terrorists have traditionally raised their own local funds through organized crime. They kidnap for ransom, extort businesses and target drug dealers and other black markets in their neighbourhoods to jack and tax for money. Al Qaeda in Iraq started as highwaymen robbing commercial trucks and assassins for hire, the realIRA group robs and kills dealers, 70s terrorists robbed armored cars and banks, ect. One of the Boston bombers jacked and murdered some local drug dealers and cops wrote it off as common gang crime.

Since they already are criminals doesn't seem that any money laundering crackdown will make any difference, they will just extort somebody else to receive their money through all these regulation hoops they specialize in being thugs.

</comment><comment><USER36> I don't think it's about money laundering, which isn't even mentioned in the article. With Bitcoin, governments can't order anyone to freeze the accounts like they can with a bank. That makes it harder to prevent terrorists from accessing funds.

</comment><comment><USER37> Then ban cash. Either we're for anonymous currency or we're not.

<comment><USER38> They are already planning it (I think, I heard it already from Sweden). But to ban cash will be much more difficult than Bitcoin, since so many people will shout up -- with Bitcoin, who cares, when a few hackers who are probably already involved in illegal activities (drug, sex, copyright violations, .... you name it) will be mad.

<comment><USER39> There are already stores in Sweden where cash is not accepted. One notable example is the ABBA Museum, where ABBA songwriter Björn Ulvaeus believes a cashless society will reduce crime:

An ABBA Star's Campaign for a 100% Cash-Free Sweden [http://www.bloomberg.com/bw/articles/2014-10-28/abbas-bj- rn-...](http://www.bloomberg.com/bw/articles/2014-10-28/abbas-bj-rn-ulvaeus- does-his-part-to-make-sweden-cashless)

<comment><USER38> While a cashless society might reduce crime (for a little while), it will definitively bring an Orwellian system onto us.

Also, we have seen, that there are enough corrupt banks and bankers around, so crime will go on ... (money laundering also does work today in company with banks).

</comment></comment></comment></comment><comment><USER40> Tinkering around the edges. Why don't they clamp down on religion?

<comment><USER27> Why don't they clamp down on freedom? Oh wait...

<comment><USER40> Freedom? Religious people have been trained like animals from youth. There's no choice there. That's not freedom.

<comment><USER9> I'm sorry you haven't had any positive life experiences with people of religion.

<comment><USER40> I've said nothing of my experiences with people of religion. Please control your knee jerk.

<comment><USER9> Your aggression towards and stereotyping people of religion is speaking enough.

</comment></comment></comment></comment></comment></comment><comment><USER41> What is the evidence here. If i were a terrorist i would avoid any online / electronic "anonymous" transfer method like the plague. Good old print oil money is the best.

<comment> maze-le They (Daesh/IS) are accepting donations in bitcoin, I don't think it is beeing used for something else. I recently read an article, describing how a teenager was scentenced to prison, because he showed how such a transaction can be done.

[http://www.dw.com/en/us-teenager-sentenced-to-prison-for- sup...](http://www.dw.com/en/us-teenager-sentenced-to-prison-for-supporting- islamic-state-online/a-18680144)

</comment></comment><comment><USER42> I assume this is because they found the vast majority of terrorism funding is done through Bitcoin, and not just another knee-jerk reaction to "crypto" \- right?!

</comment><comment><USER43> Never underestimate the money laundering "bandwidth" of a shipping container full of cash crossing the oceans[1]

[1][http://people.exeter.ac.uk/watupman/undergrad/ron/methods%20...](http://people.exeter.ac.uk/watupman/undergrad/ron/methods%20and%20stages.htm)

</comment><comment><USER44> This is so stupid do they really think that terrorists care about their own privacy when they know that they are not going to come out of the attack alive.

And if they believe that they are going to catch the activity before the attack happens they are smoking crack.

They signal to noise ratio is just too high.

Plus they can always just use cash.

</comment><comment><USER45> Here's the non mobile link

[http://www.reuters.com/article/2015/11/19/us-france- shoootin...](http://www.reuters.com/article/2015/11/19/us-france-shoooting-eu- terrorism-funding-idUSKCN0T81BW20151119)

</comment><comment> guard-of-terra What can we do to counter this and teach them a lesson so this does not happen again?

Where is our community long term planning?

They (people that nobody voted for doing what they do) are engaged in this unrightful activity without no punishment in sight. This is wrong.

</comment><comment><USER46> Bitcoin is not anonymous. Something must be done to disabuse journalists of this notion!

It's misinformation and particularly dangerous for people who need actually anonymous payments like dissidents living under oppressive regimes.

<comment><USER47> Yes, people hear "crytocurrency" and think "hidden". Bitcoin just uses cryptographic signing for authentication, to prevent theft and double spending. It's the opposite of anonymity.

</comment></comment><comment><USER48> Hi Barbra, meet Streisand!

</comment><comment><USER49> RIP localbitcoin.com?

As of right now individuals can trade bitcoin through via personal bank transfers thanks to sites like this. I see this being squeezed to death eventually, which is a real shame.

</comment><comment><USER50> This is why we can't have nice things.

</comment><comment><USER51> This is how they will try to ban cash.

<comment><USER48> I think Bitcoin is slowing the demise of cash- I think the powers that be will prefer the devil they know (cash) over the devil they don't know (cryptocurrency).

</comment></comment><comment><USER52> Bitcoin is a good deal less anonymous than cash.

<comment><USER53> But also a good deal easier to smuggle across borders, just saying.

</comment></comment><comment><USER54> Never let a good disaster go to waste...

</comment><comment><USER55> "Carpe Diem!"

Sincerely,

 _Your banking industry_

</comment><comment><USER56> Quite possibly the dumbest thing I've ever read on here. I hate to be cliche, but to quote Chomsky, "Everyone's worried about stopping terrorism. Well, there's really an easy way: Stop participating in it". Regardless, the CIA and Mossad didn't use bitcoin to finance ISIS.

</comment><comment><USER57> Down with terrorism! Woo hoo! Take _that_ ISIS!</comment>


Help: need fsevents wrapper (Java or Obj-C) for Tiger - <AUTHOR>

<comment><USER2> 1\. This is off-topic.

2\. If you know Obj-C you also know C, so you can use the standard POSIX system calls to open and mess with /dev/fsevents. I couldn't find docs for this interface, but a quick google search shows a bunch of code that works with /dev/fsevents. Also: <http://lists.apple.com/archives/darwin- kernel/2007/Jun/msg00026.html>

<comment><AUTHOR> 1\. Yup, my apologies for being off topic. Noob error. Can't find a delete on YC (pass expiration time?).

2\. Yeah, you're right but wanted something I didn't have to digest.</comment></comment>


You Can't Innovate Like Apple - <AUTHOR> http://www.pragmaticmarketing.com/publications/magazine/6/4/you_cant_innovate_like_apple <comment><USER2> I'm reminded of the story of NUMMI [1], the American automobile plant that was a 1980s joint venture between GM and Toyota. (It was covered in an episode of This American Life).

In a nutshell, the story of NUMMI involves American GM workers building Toyota-designed/GM-branded vehicles using Toyota's radically different manufacturing processes. The plant itself was a smashing success for GM; the plant achieved much higher quality and productivity than any of GMs traditional plants, and it gave GM valuable insight into their rival's manufacturing and design processes.

But this insight into Toyota's processes failed to transform GM because the GM corporate culture was so entrenched. It took the company the better part of 20 years to really adopt these changes they learned in 1984, as they continued to bleed market share to the Japanese.

The point of that story is that I believe the corporate culture of any large tech company is equally entrenched, and in my experience it's this corporate culture that utterly determines how a company's products are designed and produced.

So it really doesn't matter _how_ Apple does things, it only matters that they're different and successful; their competitors will be completely unable to react or change. Every company is full of powerful employees who have worked their entire careers to get where they are, and they will fight tooth and nail to prevent losing their position over anything else. Do you think all those PMs at Microsoft are going anywhere?

So companies like Microsoft, Motorola, HP, Acer, Nokia, Sony, and Nintendo can only do what they've always done. And if you look at their products, that's exactly what they continue to do in the face of a radically changing landscape. That's why a Toyota or an Apple or a Google is so truly threatening to their entrenched competitors. They achieve dramatically better results by doing things differently.

[1] <http://en.wikipedia.org/wiki/NUMMI>

<comment><USER3> > So companies like Microsoft, Motorola, HP, Acer, Nokia, Sony, and Nintendo > can only do what they've always done.

I'm not sure Nintendo fits well in this list. They have seemed pretty willing to "take risks" (in a controlled way) and do things differently in recent years (since 2002~2003 and the start of the DS project, though they weren't initially as bold with it as they could have been, calling it a "third pillar" alongside the GBA and the GC, which we now know was utter bullshit)

<comment><USER2>
        > I'm not sure Nintendo fits well in this list.

I think Nintendo is a great example.

The GameCube was clobbered by the PS2. How did Nintendo respond? Not by trying to be more like Sony but by being more like Nintendo. The point is that it's very difficult change corporate culture, for better or worse.

<comment><USER3> > How did Nintendo respond? Not by trying to be more like Sony but by being > more like Nintendo.

Erm… how? Since the NES and the GB, Nintendo had been following a pretty "normal" path of giving more power each time. You could argue that they always had something of an interesting approach to controllers (see N64 and GC controllers), but they'd never entirely opted out of the current/existing performance races and picked "wacko" control schemes before the DS.

<comment><USER4> Neither the DS nor the Wii is really an exception to the "more power" rule, though the difference between a GC and a Wii is obviously minimal.

The N64 controller was a much "wackier" step than you imply too, in my opinion. Nobody else had the idea of sticking an analogue stick on the controller for a 3D-oriented console. Nintendo did it, and now everybody else has copied.

The Virtual Boy is another contradictory example, though a failed one.

</comment></comment></comment></comment></comment><comment><USER5> I think there are plenty of companies that innovate like Apple, but none of them make hardware.

You can make a great piece of software with just a few programmers. But making a great gadget requires so many different specialized services and such a large scale operation that it's impossible to get everyone drinking the same kool-aid.

If DIY manufacturing ever takes off, that's when you will see Apple caliber products coming from other people (but you'll have to print them yourself).

<comment><USER6> This is a fascinating hypothesis but I predict a big caveat: Much of Apple's quality derives from _standardization_. Everyone with an iPhone 4 has the same iPhone 4. You can design a case, a bicycle mount, a Twitter client or a learn- to-juggle app for the iPhone 4 and know that everyone will have the same experience.

Consider the world of free software, for example, where we have DIY manufacturing. Everyone can write their own Drupal, Wordpress, or Rails. But the market is not moving toward such bespoke products. Quite the opposite: customers want something that is based on customizations -- as minor as possible -- of a standard product.

Part of the problem, actually, is that you underestimate the effort of design. When you can turn a blueprint into hardware overnight, you'll still have to sweat over every line of that blueprint, and document it, and support it.

<comment><USER5> A standard design can be done by one person and printed by millions. That's the theory anyway.

Perhaps a more realistic scenario is that cheap manufacturing tech reduces the barrier to entry enough that small startups can mass produce affordable gadgets, without contracting everything out.

</comment></comment></comment><comment><USER7> To me, the most important part of this (great) post was that _Apple doesn't do market research_. It reminds me of a recent episode of Mad Men ("The Rejected", season 4, episode 4).

In this episode, the agency explores the idea of a cream being part of a beauty ritual rather than the traditional approach of linking beauty to matrimony. Near the end there was this exchange:

> Dr Miller: Well, turns out the hypothesis was rejected. I'd recommend a > strategy that linked Ponds cold cream to matrimony... a veiled promise.

> Don Draper: A la 1925. I'm not going to do that. So... what are we going to > tell the client?

> Dr Miller: I can't change the truth.

> Don Draper: How do you know that's the truth? A new idea is something they > don't know yet so of course it's not going to come up as an option. Put my > campaign on TV for a year then hold your group again. Maybe it'll show up.

To me this so succinctly sums up the disconnect between market research and the best products.

Take the iPad: I don't know why they decided to do a 10" tablet but I would bet money that they came up with several form factors then Steve Jobs walked into a room, picked one and said that's the one they're doing. This may be an oversimplification but I'm sure it's not far from the truth.

<comment><USER8> Market research is generally extremely difficult to do well. And for consumer products its less clear how useful it is. Most people use consuer products and Apple engineers/designers are probably fairly close to their target market, which are early adopters (others fall in line after early adopters).

And we should also be clear, Apple has tons of market data. These Apple stores I'm sure supply them tons of data, as an example. While they may not do targeted focus groups, I'm certain that they go into meetings where they say things like, "Verizon would expand our user base by x%, but likely add these additional costs".

<comment><USER7> The Verizon iPhone story is both my favourite and most hated tech story.

It's my most hated because I'm sick of hearing it. Every month it pops up.

It's my favourite because it's a classic example of rumourmongering becoming "news" perpetuated by people who don't really understand Apple at all.

See, it doesn't matter what % increase in revenue or market size Verizon would deliver to Apple, there is still one huge problem: CDMA technically doesn't support simultaneous voice and data. There is no getting around that (beyond the inevitable transition to LTE).

Anyone who thinks that Apple will release a CDMA version of the phone and then try to explain to consumers that version A can do this but version B can't is, well, off their rocker.

A CDMA iPad however is a completely different matter, but I digress...

Just like Apple could make more money--at least in the _short term_ \--by releasing a new phone more often than every year. The fact is though that people don't like the instant obsolescence of tech products. You buy an iPhone 4 today and you know it's as good as an iPhone will get til mid next year.

Compare that to the anarchic shotgun world of Android handsets.

Apple is driven by product and user experience not market research ("market data" isn't quite the same thing).

<comment><USER8> "Anyone who thinks that Apple will release a CDMA version of the phone and then try to explain to consumers that version A can do this but version B can't is, well, off their rocker."

Apple does this with every product they ship. And in some cases they have even more extreme cases.

For example, upgrade to the latest iPod Nano and whoa, no camera. So wait, if I get the old version I get a camera and now I completely lose it. But if I go up to the iPod touch I get the camera, but the classic line never had one?

I seriously doubt Apple is not moving to CDMA because of the issue you site. If anything its because CDMAs life is a relatively short one now. Further, my point wasn't that they go to CDMA, it was that I suspect that they have analyzed that market up and down. I bet they've gotten data from ATT to know what percent of their users use voice/data concurrently. I think Apple knows more about the market then they let on.

<comment><USER5> _For example, upgrade to the latest iPod Nano and whoa, no camera. So wait, if I get the old version I get a camera and now I completely lose it. But if I go up to the iPod touch I get the camera, but the classic line never had one?_

But this is a deliberate choice by Apple, not one forced on them by technology. And users understand that this year's iPod Nano is a different product from last year's, with different features. iPhone CDMA vs iPhone GSM is gibberish to them.

<comment><USER8> I'm not sure if customers care about the distinction of confusion caused at the initiative of Apple versus that caused at the initiative of the "technology".

Regarding GSM vs CDMA specifically, there is hardly been any type of outcry regarding voice/data on CDMA, even amongst people who move from GSM to CDMA. In fact, I've never herad anyone complain about it. The only real complaint I've heard about CDMA is that you can't use it anywere, except the USA and like three other countries. But no one says, "I can't use voice and data on my phone".

In any case I think we're bickering about a meta issue. I really couldn't care less if Apple goes to Verizon or not. I'm not on Vertizon and I don't want an iPhone. What I do believe is that Apple has a very good understanding of what it means to go to Verizon.

<comment><USER7> It doesn't come up because the US mobile phone market is almost completely balkanized: how many handsets are released in GSM and CDMA versions (or even that do both GSM and CDMA)? Hardly any.

Buying a cell phone in the US basically means picking a carrier and then picking a handset. In almost every other country--and certainly those that are GSM based (including all of Europe and Australia)--have handsets that are interchangeable on networks.

Why there aren't cross-technology phones (barring some minor exceptions) is exactly why Apple won't do it either. Particularly because CDMA is a dying technology anyway (at least in the developed world).

<comment><USER8> But people change carriers a fair bit. Churn is huge in the US. And yet almost no one picks one carrier over another due to this feature. The big CDMA carrier is bigger than the big GSM carrier. And the little CDMA carrier (Sprint) is bigger than the little GSM carrier (TMo). It's really a non-issue.

And even the Samsung Galaxy S phones... read the reviews. While people talk about some differences on the phones, I haven't seen a single review mention the voice/data issue. And they just announced selling 5 million units in just a few months -- so its not exactly a niche phone.

And a quick search brings up a ton of "Android Fragmentation" issues. They talk about everything from 1.4 vs 2.2. of Android to screen resolutions to keyboard/no keyboard to camera support, etc... I haven't found a mention of voice/data fragmentation.

So if this is a problem that Apple would have it would be one that no one else in the industry has had to explain. I fully expect Apple's magic would make this the same non-issue it is for everyone else.

<comment><USER7> Apple isn't "most companies". That's kinda the point.

<comment><USER8> My point is that I don't think the following conversation happened:

CFO: "Hmm... we get an extra $30B in profit if we support Verizon, and effectively end Androids short run and block WP7 from ever breathing.."

Jobs: "Screw it. This will mean that some customers will have voice/data and some won't. And while our current users can't touch their phone and make a call at the same time, and the fact that we're selling a neutered product in AppleTV, this is where I draw the line. Even if it means that we completely dominate the mobile space for here to eternity. I draw the line here."

I just don't think it happened at Apple or at "most companies".

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Before starting my company, I worked as a product manager for a good 10 years and few other things after that. Truths like the Henry Ford quote: "If I'd have asked my customers what they wanted, they would have told me 'A faster horse.'" are good and true but as this article points out, there is only room for one Apple and one Ford at any one time or any one industry. The rest of us have to be pragmatic and consider product innovation as something that's very central and very interdependent with all other aspects of a company's strategy and tactics (people, technology, customers, capital, competition, etc.).

<comment><USER10> Can you elaborate further on why there is only room for one company of this type in any one industry? I am struggling to see why that would be the case.

<comment><USER11> I've actually heard the same for fashion. There is usually one fashion house that basically dictates style for a few years. All other highend designers are basically lockstep behind this and then it trickles down through ready to wear, and finally consumer brands (like H&M).

You also see this in consumer electronics where bezels alternate between glossy black, flat black, silver, gold, white. If you go back further you'll find woodgrain, yellows, greens, etc. But it would never be one manufacturer. They all did it around the same time.

Today, Apple has decided a keyboard isn't necessary on a smartphone. 3 years ago that wasn't that case. Nintendo has decided that motion was how to play games. 3 years ago that wasn't the case. Ford decided that 4 wheels on a chassis is what makes a car. Why not 3 wheels, 5 wheels, or 6 wheels?

The market likes to be given new options, but not too many options. People are willing to take a chance but they won't accomadate everything. For now motion controllers are where it's at. Nintendo decided it, MS and Sony have to follow suit. In a few years it might be brainwave controllers. While those controllers exist they aren't marketable. The public isn't ready for it, yet.

</comment></comment></comment><comment><USER12> This was there on HN 6 months back. More discussion here: <http://news.ycombinator.com/item?id=1280304>.

</comment><comment><USER13> If this is true then how did ping and the new iTunes icon make it past the 10-3-1. I am joking but not everything is perfect. Just not sure how those two slipped through.

<comment><USER14> Exactly. He says, "Quick, identify 10 different pieces of technology that truly meet your needs and that don't bug you due to a major flaw you either have to live with or compensate for in some fashion. Could you come up with more than five? I didn't think so," as if Apple's strategy is to land on that list.

I use and enjoy my share of Apple's wares, but even if I _could_ come up with 10 different pieces of technology that never piss me off, none of them would be from Apple. Has this guy ever used iTunes, or dealt with the App Store?

<comment><USER15> I am not enthusiastic about the App Store as a developer, but as a user I'm pretty happy as it is the best app store I've seen judging by the quality and number of the apps available.

Surely I'm seeing Android taking over just because it will sell more devices, but the Android Marketplace is really shitty ... I can't even sell or buy apps for Christ's sake, as my country is not on their list (I can do both from the App Store).

And you would think Google has experience in building web services.

So the iTunes App Store may be painful with lots of restrictions and cursed with an awful workflow for publishing apps, but at least it works.

<comment><USER16> From the consumer point of view, the App Store could be _much_ better at finding relevant apps and the iTunes integration is pretty irritating

<comment><USER11> I'm of the mind that Apple is like most companies that is has a runaway product, they know what the defects are yet are reluctant to fix them. The App Store is exactly this. They could do a lot of things to improve but because their nearest competitor is so far behind they don't feel the need to right now.

Hopefully the coming amazon app store lights a fire under the ass of Google and Apple to get their shit together.

</comment></comment></comment></comment></comment><comment> brown9-2 One interesting thing about the idea that most companies can't be like Apple because their super-focused design attitude is risky and costly is: how did Apple get here? If it's so hard for a company to bootstrap themselves into this philosophy (and get large while doing it), how did Apple pull it off?

If my understanding of history is correct, it took a few failures and a dark period of non-success. Perhaps there is an additional lesson in there about recovering from failure and turning unsuccessful enterprises around.

On a related note, can anyone recommend a good book about Apple's history and particularily the story of how Steve Jobs turned the ship around when he returned? I'd be willing to bet there are a lot of interesting stories in that history which probably haven't been widely disclosed.

<comment><USER8> Absolutely. The biggest factor in Apple's current success is their past failure. Apple's willingness to completely redo their OS is a result of their OS struggling, both in the market and technologically.

The other thing that their failure also helped solidify is their base. Being the perpetual underdog they had a very strong enthusiastic core fan base. This allows them to get decent sales on even their worst sellings products. And for products with public displays (think iPod and iPhone) it helps them create early viral marketing. This base is much less effective for non-publicly displayed items (think their new touchpad or AppleTV).

I think these two things have allowed Apple to do bolder moves, yet actually have less risk associated with it.

The only other tech company I could think of that would have been able to do something similar was Commodore. But they self-imploded before publicly displayed technology devices were very viable.

</comment></comment><comment><USER17> It reminded me of something Knuth once wrote: "Judge an artist not by the quality of what is hanging on the walls, but by the quality of what's in the wastebasket"

</comment><comment><USER18> The reason Apple was successful at coming back from the dark period is because of Steve Jobs. Here is my question. Is it more important to have a CEO that has an innovative vision or is it more important to have a employee base thats is innovative?

And I would argue that the former is the crucial sauce for success... which makes it hard to be sustainable...

</comment><comment><USER19> "Apple wraps great ideas inside great ideas", reminds me of JJ Abrams Mystery Box idea at TED:

<http://www.ted.com/talks/j_j_abrams_mystery_box.html>

</comment><comment><USER20> While their culture might be necessary, its not sufficient.

You also need the high end of the market with its fat profit margins to support the cost of maintaining that culture.

</comment><comment><USER21> Never tell me what I can't do.

</comment><comment><USER22> Lorem Ipsum is Greek huh? How can I read the rest of the article without vexation knowing that the writer can't identify a simple foreign language and a prolific tool of design?

<comment><USER23> "Greek" is the correct design term for any dummy text in a mock-up.

See: <http://en.wikipedia.org/wiki/Greeking>

<comment><USER22> No way. I would have called it Latining! Don't I feel like an idiot.

</comment></comment></comment><comment><USER24> "Apple designs for #2. No other mass-consumer products company puts as much attention to detail into the fit and finish of the box—let alone the out-of- box experience."

I'm sorry but no they do not put as much attention to detail into their products as you would think. They didn't even have multitasking in the iPhone until recently! And what was the antenna problems all about?

All I see is just enough attention to detail to make people go "wow, shiney." and that's it.

<comment><USER25> I'd actually argue the opposite; Apple pays so much attention to detail that they figured out that multitasking isn't really important, so they could just do it later. Copy and paste is awkward, it isn't absolutely necessary, they could just do it later.

Even the antenna thing: only the tech press knows anything about this. Apple said that just under 2% of people returned an iPhone 4. During that whole scandal, I asked my friends that haven't ever heard of HN, "What do you think about the iPhone 4 antenna problems?" and they had no idea what I was talking about. Even among those of my friends that have iPhone 4s, only 2 out of 5 even had the issue at all, and lately, my Nexus One's antenna has been acting up...

Apple is good at making MVPs, and then improving upon them. Eventually.

<comment><USER24> Being a curious one, I had a look round your site as listed in your profile. You say have a Nexus One, yet your personal site, Watch.Steve, releases the tutorials in "iPhone + Apple TV" format and the filenames have iphone in there.

Just an observation ;-) Prompted mainly by the strange pointless dig at the Nexus One which had no relevance to the conversation or OP.

<comment><USER25> Yep. The site was originally a copy of the code for Railscasts, which does the same thing. I'm a life-long Mac user, but I do own a Nexus One, because I absolutely refuse to do business with AT&T.

I don't think the dig was pointless. I'm not an EE kind of guy, but from my understanding, basically all modern cell phones can have their antennas interfered with through touching the bottom of your phone. But the way that the iPhone 4's case was designed increased the severity of the interference... my Nexus One does the same sort of thing. Just yesterday, I was talking on the phone, and when I tried to hold it with my shoulder rather than with my hands, I was told that I "sounded like I was underwater." This is almost 100% reproducible.

<comment><USER24> Interesting about the Nexus One. I've got the Desire which, when I get out of my reception-less flat, I'll test for that problem.

I think the first time I tried holding it on my shoulder I dropped it so never held it like that again :-D</comment></comment></comment></comment></comment>


Rosetta Is Tailing a Warming Comet - <AUTHOR> http://www.nytimes.com/interactive/2015/03/20/science/space/rosetta-comet-photos.html?_r=0

<comment><AUTHOR> This is the best gallery of photos I've seen. One close up views the comet from only 6 miles away.

</comment><comment><USER2> Awe-inspiring stuff.</comment>


Fuchsia Web Demo - <AUTHOR> https://mgoulao.github.io/fuchsia-web-demo/ <comment><USER2> There's a lot of console.log statements being executed...

</comment><comment><USER3>
        C O N T E N T</comment>


Building a chatbot on Facebook Messenger with Ruby on Rails - <AUTHOR> https://tutorials.botsfloor.com/chatbot-development-tutorial-how-to-build-a-fully-functional-weather-bot-on-facebook-messenger-c94ac7c59185 <comment><USER2> Erm .. what is the point of Rails here? This can be done with Rack, Sinatra, Node, Go.

I really like Rails, but I get a bit annoyed when people use it everywhere even where it is not a good fit e.g. no need of activerecord, no server side templates or other 70% of Rails feature set, it is all just there adding to bloat without any usage.

<comment><USER3> You can run rails without active record, you use it in API mode as well.

Go is a language not an application framework. So that's not a fair comparison.

You get a lot of nice things right out of the box with Rails so it's a good choice for many projects.

Node isn't a framework or a language, it's a runtime environment. You'd still have to write a Javascript application.

With Rails you get rapid development speed and you can just use the pieces you want.

You could argue that writing this sort of app in Swift is a good choice as well.

As far as bloat.. what's the actual consequence? A slightly bigger deployment? It's negligible in terms of real world consequences and offset by the convenience of Rails conventions.

</comment></comment><comment><USER4> For those of you who are interested in chatbots and Ruby, we open sourced Clarke, the framework we are using at Applidium to architecture them: [https://github.com/applidium/clarke](https://github.com/applidium/clarke)

And if you're more interested in the thought process behind, we did a presentation of what led us to this architecture [https://docs.google.com/presentation/d/1kGiHfMMjf- OL7ZUODttu...](https://docs.google.com/presentation/d/1kGiHfMMjf- OL7ZUODttuDEy94b175TzSeL-ad0OPhnw/edit)

If you have any question or feedback they're very welcome :-)

<comment><AUTHOR> Is it possible to develop chatbot on any of the messaging platform using Clarke?

</comment></comment><comment><USER5> In this case, why even use api.ai? The sample cases seems very simple to just do some basic regexp instead?

I've done my own Raspberry "bot" using speak synthesizer and STT and some basic plain ruby. Using regexp it handles _a_lot_ of scenarios just by simple regexp for words such as "rain", "weather" (which then is enough to understand that I'm asking for the weather). Combined with "today" or "tomorrow" it can tell weather at different times.

I was also intrigued by using api.ai in my case but It just felt overkill.

(Perhaps I've just missed the whole point here).

<comment><USER6> I will make the disclaimer that I don't think I am an "expert", but I do some coaching for API.AI and have been helping a couple of clients build out simple chatbots.

I keep hearing this question a lot, and I think right now the best way to teach chatbot programming seems to be by using the simplest examples and this is a little misleading (is that all?). You can use regexp to build out a chatbot, but it might be a good idea to consider some pros/cons of using a service like API.AI.

Under the hood, API.AI (and similar bot programming frameworks) allow you to go much further:

1\. Their entity matching system will let you start with a few examples and then keep matching many more similar examples (remember Google Sets?) without you explicitly defining every single one of them. The best example for this seems to be the food/recipe & geographical locations stuff for now, but if they can get it right for more domains that can be quite useful.

2\. There is a way to use templated definitions of "here is what the user might say" which is quite powerful. Sure, you could probably do the same yourself, but think about it: you will be handling so many corner cases with such a system that if there were a prebuilt service already doing that work for you (and which is improving quite rapidly) you could probably build it out faster with the external service.

3\. There is also enough flexibility where you can add webhooks (like the author has done) and basically put a lot of business logic into your chatbot.

4\. Assuming API.AI will soon be acquiring some of the ML knowledge which Google already has, it is reasonable to expect that the intent mapping (the process of figuring out what the user said) will only keep getting better.

Having said that, here are some advantages of rolling out your own:

1\. You don't typically get the full picture of what is going on under the hood with an external service. Unlike the case where you write your own code, this means when things fail (and they will), you sometimes don't know what is the cause, and worse, how to get around it.

2\. There is always the inherent risk that the service you rely on might shut down some day :-(

3\. The current tooling around moving your chatbot from staging to production in API.AI is fraught with risk. I don't know if it is the same with the other ones too. If you roll out your own chatbot, you don't have such issues.

4\. There are also some features which have been added to API.AI which are sort of all or nothing. A good example is the small-talk feature which you can import into an agent. The trouble is, you cannot really customize it much, so when it doesn't give you the behavior you expect, it can become a bit of a liability.

Hope that helps!

</comment></comment><comment><USER7> Even if I'm an happy Ruby developer,

I feel that realizing a chatbot \- in a specific programming language, \- with a standard framework (Rails), \- for a specific channel (Messenger), is an ERROR, in the log terms.

BTW, I realized naif, my personal micro framework just to build chatbots in Ruby (see slides: [https://github.com/solyaris/naif](https://github.com/solyaris/naif)),

Nevertheless, I decided to NOT publish the code and no more deepen that "hard- coded" way, instead I suggest to use and support a chatbot scripting (meta)language. About rationales, I wrote a bunch of articles: www.medium.com/@solyarisoftware

I support opensource great ChatScript ([https://github.com/bwilcox-1234/ChatScript/](https://github.com/bwilcox-1234/ChatScript/)) and BTW I wrote simple client in Ruby ([https://github.com/solyaris/rChatScript/](https://github.com/solyaris/rChatScript/))

My two cents giorgio @solyarisoftware

<comment><USER8> An happy?

<comment><USER7> exactly!

</comment></comment></comment><comment> nevi-me I've got mixed feelings about api.ai, I haven't tried others like wit.ai because more hype was around api.ai.

Firstly, their libraries feel incomplete. 2 months ago I tried their nodejs one, and after some frustration, I ended up wrapping their REST calls. Last week I was working with someone new on our team, and we tried the Python one [0], again a mess, and we ended up wrapping the API around Python requests.

There is little activity on GH given that there might be other people having similar issues.

Webhooks are a take-it-all-or-leave it IMHO. When invoking a webhook call from an action, you can only respond once (i.e. no follow-up through api.ai). My conclusion from this part was that you can't build a serious (are they ever) bot relying solely on api.ai, and you have to do some heavy lifting on your server side.

What I have appreciated so far is their NLP part, it's hard (or impossible for some of us without the knowledge) to roll our own NLP solution, so I can give them props over making that part easy.

I'll keep using it as I'm training our team using api.ai, but if there are "better" solutions that other people have tried, I'd be keen on hearing their experiences.

[0] [https://github.com/api-ai/apiai-python-client](https://github.com/api- ai/apiai-python-client)

</comment><comment><USER7> Even if I'm an happy Ruby developer,

I feel that realizing a chatbot

\- in a standard programming language (Ruby),

\- with a standard framework (Rails),

\- for a specific channel (Messenger),

is an ERROR, in the long terms.

BTW, I realized naif, my personal micro framework just to build chatbots in Ruby (see slides: [https://github.com/solyaris/naif](https://github.com/solyaris/naif)), nevertheless, I decided to NOT publish the code and no more deepen what I call the "hard-coded" way,

instead I suggest to use and support a chatbot scripting (meta)language. About rationales, I wrote a bunch of articles: www.medium.com/@solyarisoftware

I support opensource great ChatScript ([https://github.com/bwilcox-1234/ChatScript/](https://github.com/bwilcox-1234/ChatScript/)) and BTW I wrote simple client in Ruby ([https://github.com/solyaris/rChatScript/](https://github.com/solyaris/rChatScript/))

My two cents

giorgio @solyarisoftware

</comment><comment><USER9> Can someone explain to me, please, why we see so many bot-related topics recently?

<comment><USER10> Because they are currently somewhere near the maximum in the hype cycle.

[https://en.wikipedia.org/wiki/Hype_cycle](https://en.wikipedia.org/wiki/Hype_cycle)

<comment><USER11> Is it just a hype, or is there any real advantage for the user? From the point of view of the interaction, why should I chat with a bot instead of using a more classical gui? I'm asking because i teach ux/hci, and a student just asked me to be her supervisor for a chatbot based interface, and I'm trying to understand if - in a user centered perspective - this approach makes sense

<comment><USER12> I assume we're talking about chatbots on phones.

For the users the advantage is that they don't have to install anything. The disadvantage is that it's a more crude UI than a full fledged app or a modern mobile website but that can be hidden by a good design.

However a conversational UI mostly flows in time with little memory (scrolling and searching are possible but not user friendly), whilst apps/desktop/websites mostly spread in a 2D space. The design of the interaction is very different. Just try some mockup tools for chatbots and you'll find it out quickly.

There are advantages for developers too: it's easier to develop a chatbot than an app (unless you go very deep in AI), as much as it was to develop a web app than a desktop one. It costs less, it delivers earlier, it can be updated 100 times per day without app store approvals.

Edit: s/full fledged API/full fledged app/

</comment></comment></comment></comment><comment><USER13> Is this just an add for API AI?</comment>


Apple patent covers hovering gestures for iphone displays - <AUTHOR> http://techcrunch.com/2016/02/03/new-apple-patent-covers-hovering-gestures-for-iphone-displays/ <comment><USER2> Dies this mean that my Android app that uses the proximity sensor to autolock my phone is now patent infringement? I often use my finger or palm to cover the sensor and lock the phone.

<comment><AUTHOR> hopefully the patent is for iphone displays ;)</comment></comment>


Flash 101: The NOR Flash electrical interface - <AUTHOR> https://www.embedded.com/design/prototyping-and-development/4460964/Flash-101--The-NOR-Flash-electrical-interface <comment><USER2> I worked with this stuff for a while and I guess the main realization is that every layer of your stack, down to the hardware, is often as hacky and duct- tape-like as the web is.

<comment><USER3> yes, but the web meets end users, not other developers. I think a lot of the disdain for the web is because we have to use it regularly. Whereas memory interfaces or other low level implementations we only touch if we're working on something related to them.</comment></comment>


Show HN: Share company announcements in your coworkers' new tab - <AUTHOR> https://sametab.com <comment><USER2> Homepage. You've re-invented the homepage.

I've worked in companies where the default homepage was the announcements feed on the Intranet. Didn't make people actually read them though!

<comment><USER3> A homepage which you will see every time you open a new tab, instead of once a day.

I think it's pretty useful and will make the chance of people actually reading them a lot higher, right?

<comment><USER4> wait homepage is something you see on every new tab, isn't it?

<comment><USER5> Nope, for Chrome you have to use an extension, and Firefox needs an extension or some about:config changes.

<comment><USER6> Firefox > Preferences > New Windows and Tabs

"Choose what you want to see when you open your homepage, new windows, and tabs"

You then have the choice of what the default is for new windows (and 'homepage' which I assume means clicks on the Home icon in the toolbar, which I always remove...) and for what appears in new tabs. No about:config needed!

</comment></comment></comment></comment></comment><comment><USER7> There is an extra danger with this (we built this at my previous company, and then deleted it), where users end up not seeing the messages anymore, but when they go to internet cafes / planes / public areas they leak very critical information (typically quarterly goals and how we're doing).

Leads to really bad media leaks.

</comment><comment><USER8> Sounds like a smart way to replace emails with no replies and avoid useless overhead in having your employees using/learning a new product.

</comment><comment><AUTHOR> Last week we had some fun building a lightweight (mostly to see how chrome extensions work) tool to let companies send company announcements in all their coworkers' new tab.

If this sounds a little odd, here's how it works:

1\. Install the Chrome extension [0], open a new tab and you'll see sample content. Hit the signup button and create a new account.

2\. Now that you have an account, configure your company's page and invite your coworkers (they have to signup with their work email).

3\. You're ready to create and publish announcements from the admin area. Everyone in your company will see them when opening a new tab.

[0] [https://chrome.google.com/webstore/detail/sametab/glmeidaaam...](https://chrome.google.com/webstore/detail/sametab/glmeidaaambjhneppgaalmcjmcjpedeb)

</comment><comment><USER9> A lot of people ignore their work announcements because "they dont really care" about their jobs/companies (except for the paycheck to cover health/mortgage).. Why should an employee be fully engaged at work when she/he is just a "disposable" part of a machine and can be let go at any time (and should be ok with it because this is how it always was done)?

Ummm they really think company wide emails (that are often pushed to personal cell phones) are not enough? Now lets see it in the browser tab as well? Really? Whats next? Automatically engraved announcements on coworkers foreheads?

The problem is NOT that people "dont have an opportunity to see the announcements" \- the problem is that people are not really interested in their jobs. Make job interesting to an employee and truly care about an employee (prove it by action) then people will be more engaged at work!

"Of the country's approximately 100 million full-time employees, 51 percent aren't engaged at work -- meaning they feel no real connection to their jobs, and thus they tend to do the bare minimum...Another 16 percent are "actively disengaged" ... feel their needs aren't being met at work etc."

[https://www.cbsnews.com/news/why-so-many-americans-hate- thei...](https://www.cbsnews.com/news/why-so-many-americans-hate-their-jobs/)

<comment><USER10> Even if 10% of employees like their jobs, that's still a market of 10 million people. If somehow this extension could reach them all and bring 1 cent a month per user to it's creator, that's still 1M$ a year for what's probably a week-end project. Not too bad.

And if it end up reaching 1% of this market that's still 10k$ a year.

So, hey, good job doing this !

</comment></comment><comment><USER11> That's a great idea!

Some feedback: It would be great if this could be used as a widget on top of an existing new tab page. I really like [https://tabliss.io](https://tabliss.io), which shows the time, weather, and a nice photo from unsplash. If I was working somewhere that used this for company announcements, I would prefer to continue using tabliss, and show company announcements as a small widget on the bottom right.

But yeah, I like using the new tab page as a dashboard for this kind of thing. Email and slack notifications are too disruptive, and this is more like a notice board where you can casually glance at it when you have some time.

EDIT: Tabliss supports custom CSS and JS, so I could add this myself. Or could even contribute an official widget, because it's open source: [https://github.com/joelshepherd/tabliss](https://github.com/joelshepherd/tabliss)

EDIT 2: This is unrelated, but I just saw that Tabliss added a "literature clock" widget. That's really cool! Here's my new tab: [https://imgur.com/gallery/99hL1Ei](https://imgur.com/gallery/99hL1Ei)

</comment><comment><USER12> It mentions _" they have to signup with their work email"_, so there's some notion of the page data being private.

I'm curious how well protected it really is.

Also, is the first email from domain X to sign up the default admin for that domain? How do you resolve disputes?

<comment><USER13> Hi,

Antonio from Sametab. You need to signup w/ Google or validate your working email before being able to read the announcements. This security rule is enforced into the database (it's Firebase Firestore).

> I'm curious how well protected it really is.

Feel free to ask questions!

> Also, is the first email from domain X to sign up the default admin for that > domain?

The first one becomes the admin. We already implemented a RBAC system for managing users' permissions. You'll be able assign admin permissions from the webapp soon.

> How do you resolve disputes?

Drop us an email and we will re-assign the permissions!

<comment><USER14> Are you able to defend against this type of thing?: [https://medium.com/intigriti/how-i-hacked-hundreds-of- compan...](https://medium.com/intigriti/how-i-hacked-hundreds-of-companies- through-their-helpdesk-b7680ddc2d4c)

<comment><USER13> Interesting article, thanks for the link! If a company uses its main domain in the same way gitlab does, SSO is the only way to avoid security flaws. We do not support SSO now, but implementing it is feasible. Feel free to send us an email if you have a company IdP and you want to use Sametab.

</comment></comment></comment></comment><comment><USER15> I can maybe see some companies having actual use for them, and the discipline to only include emergency/super important info.

I can't see that being more than 10% of the companies, and the rest will just post really useless garbage.

</comment><comment><USER16> Cute idea, though I did spot a minor spelling mistake "openening" should probably be "opening".

<comment><AUTHOR> Fixed, thank you.

</comment></comment><comment><USER17> or slack channel, or email.

<comment><USER18> Yea I prefer email for these things, so I can filter it appropriately (e.g. only show when I am interested) and refer to past announcements. You cannot do either of those, especially the second, easily with a browser tab thing or homepage.</comment></comment>


The death of Windows XP will impact 95 percent of the world's ATMs - <AUTHOR> http://www.theverge.com/2014/1/20/5326772/windows-xp-powers-95-percent-of-atms-worldwide

<comment><USER2> If they are inconvenienced by having to upgrade from Windows XP to continue support, why the heck are they migrating to a different legacy Windows version (non-current)

With all the headache and expense of this, I don't feel sorry for them if they didn't (yet) learn their lesson! I hoped/wished that banking would have the sense to use a customized *nix server for this sort of thing that can be supported in-house as long as there are computers and people who work on them (where you don't have that kind of access to self-patch windows)

</comment><comment><USER3> A question that occurred to me reading this: ATMs aren't connected to the internet, are they? (Seems like that would be very tempting for the bank in terms of convenience, but very dangerous.)</comment>


Freenet: A Distributed Anonymous Information Storage and Retrieval System (2000) [pdf] - <AUTHOR> http://snap.stanford.edu/class/cs224w-readings/clarke00freenet.pdf <comment><USER2> I've always loved the ideals and design of Freenet for what it does, but the main issues I always ran into when I'd check it out were that discoverability was horrible and then once you did manage to dig into things and find content it was usually stuff I wouldn't want to find to begin with. That's left a lot of bad impressions on people I think, and caused it to have a reputation for only illegal things on it.

<comment><USER3> That's rather inherent: if you create a network whose primary feature is anonymity and lack of rules, your early adopters will be everyone barred by the rules of other services, which means you become a cesspool.

Tor did a good job with marketing and optics early on, to make its _intended_ use cases highly visible.

<comment><USER4> VOAT turning into a cesspool of everything that was being banned from Reddit is another example of that, too.

<comment><USER5> "The moral of the story is: if you're against witch-hunts, and you promise to found your own little utopian community where witch-hunts will never happen, your new society will end up consisting of approximately three principled civil libertarians and seven zillion witches."

<comment><USER6> The solution to that may be to separate the hosting from the discovery.

If the hosting is anonymous and censorship-resistant then you'll get every type of content, but for anybody to use it they would first have to find it.

Then you have a slew of independent discoverability portals. Some are created for child pornography, so the FBI hacks into them and then uses them to arrest everybody there. Others are created to replace Tumblr and YouTube and refuse to link to child pornography, so child pornographers have no reason to go there and the people disgusted by child pornography can safely use them.

But setting up a discoverability portal is a lot less expensive than setting up a hosting service (because a link uses much less bandwidth than high quality video), so there should be more competition, and in particular it should still be difficult to censor anything that has more than a modest amount of popular support.

<comment><USER7> This is what Freenet already provides with three different messaging systems and anonymously run indexes.

<comment><USER6> Are you aware of any YouTube-equivalent? Something that allows you to search user-generated/submitted content and content feeds and has a builtin player to display them.

<comment><USER7> I am aware that we are just one release away from serving video in a video- tag. That's not as convenient as youtube (because it takes time to load), but much closer than before.

For convenience, we need m3u lists of video-chunks and a simple player shipped, since browsers cannot play m3u out of the box.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> It makes me wonder about use cases for tools like freenet, tor, etc. Espionage of some sort comes to mind and the need to deliver a message from sender to receiver without identifying any participants . Otherwise there is some other implicit recognition that anonymity can be productive.

Anonymity clearly changes how individuals communicate, but the research I know of tends to focus more on how people like to behave badly and mischievously when there is no known reputation or name associated with the consequences of a action.

Anyone who has spent any time on the internet knows the ability to obscure identity, however thin or unsophisticated, elicits changes in behavior. I highly doubt the producers of these tools construct them with the goal of inviting mayhem in mind. Regardless, the more anonymous a data transfer is, the less social pressure there is to communicate within certain permitted boundaries.

Outside of a authority point of view, there's also the potential for creativity and free association related to anonymity. If one feels you won't be judged because of saying something, you might open up.

<comment><USER7> You might be interested in the method Freenet uses to avoid disruption of communication: [https://www.draketo.de/english/freenet/friendly- communicatio...](https://www.draketo.de/english/freenet/friendly- communication-with-anonymity)

" In the past decade there hasn't been a year without a politician calling for real names on the internet. Some even want to force people to use real photos as profile pictures. All in the name of stopping online hate, though enforcing real names has long been shown to actually make the problem worse.

This article presents another solution, one that has actually proven that it keeps communication friendly, even in the most anonymous environment of the fully decentralized Freenet project.

And that solution does works without enabling censorship."

</comment></comment><comment><USER9> When I was young I thinkn internet is freedom. These day it is more of a control device by the state.

In the older days, you can hide from the state. These day you can't. Your day to day activities are recorded.

China is just one example. And they are not the only one.

</comment><comment><USER10> >A recent court case in the Peel Region of Ontario, Canada R. v. Owen, 2017 ONCJ 729 (CanLII), illustrated that Law Enforcement do in fact have a presence, after Peel Regional Police, located who had been downloading illegal material on the Freenet network.

I haven't looked into the architecture of Freenet, but would someone be able to give a quick rundown of how this is possible? I was always surprised there weren't more well established, long-form, human rights blogs on Freenet but maybe there are security concerns I'm not aware of.

<comment><USER11> Investigators run modified Freenet nodes that serve illegal content. They log connections with peers, and track chunks of illegal files, based on hashes. So if your node peers with one or more of their nodes, they can see if it requests any of those illegal chunks. If it does, you are "downloading illegal material".

Freenet is a pure P2P system. Your peers know your IP address, and vice versa. So your only defense is that your node was just relaying those illegal chunks to some other node. But that requires expert testimony, and a jury that's capable of understanding that expert testimony.

<comment><AUTHOR> I enjoyed this nugget of info. But a few questions (if you can answer them)

> They log connections with peers Of course (I'm assuming via just IPs)

> and track chunks of illegal files meaning what exactly? How could they track > a 5KB chunk being sharded across say 10 different nodes? (further, flexible > nets like freenet adjust the location of data over time based on the use of > said data)

> they can see if it requests any of those illegal chunks My understanding is > that yea you can see who's talking to who (via IPs), but I guess traffic > analysis is the way to see the chunks (i.e., Peer A sent Peer B 100 bytes at > 5:65 PM PST)? Even then, the payloads are encrypted, so I'm not seeing how > you could infer that the content is "illegal"

Again. I enjoyed that little nugget of insight you shared. Hoping you can share more :)

<comment><USER11> Missouri Law Enforcement's Freenet Attack Now Public Record[0]

Levine et al. (2017) Statistical Detection of Downloaders in Freenet.[1]

0) [https://www.reddit.com/r/Freenet/comments/66f0n3/missouri_la...](https://www.reddit.com/r/Freenet/comments/66f0n3/missouri_law_enforcements_freenet_attack_now/)

1) [http://ceur-ws.org/Vol-1873/IWPE17_paper_12.pdf](http://ceur- ws.org/Vol-1873/IWPE17_paper_12.pdf)

<comment><USER10> I'm going to assume Ontario is using the same method that the Missouri police are using above. Here's a response from Freenet outlining an 83% false- positive rate.

[https://freenetproject.org/police-departments-tracking- effor...](https://freenetproject.org/police-departments-tracking-efforts- based-on-false-statistics.html)

<comment><USER11> Yes, that's the Freenet Project response that I was thinking of. Thanks for citing it.

But the problem now is that there's technical backup for both sides. So defense counsel will likely need a credentialed expert to submit a report, be deposed, and testify. Although I haven't followed any of these cases, I'm guessing that many defendants have accepted plea bargains. Because battles of experts can get expensive fast.

And then you've got the challenge of explaining this stuff to a jury. And countering the emotional "evil child molester" rhetoric. I wonder if the Freenet Project would provide such an expert?

<comment><USER7> There is one. If you've been falsely accused and you need one, contact firstname.lastname@example.com

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Does anyone still use Freenet? What happened with it?

<comment><USER11> You can find usage stats on Freenet. But I found a couple reports on clearnet:

Uploaded: 2018-11-28 (UTC) [https://d6.gnutella2.info/freenet/USK@sUm3oJISSEU4pl2Is9qa1e...](https://d6.gnutella2.info/freenet/USK@sUm3oJISSEU4pl2Is9qa1eRoCLyz6r2LPkEqlXc3~oc,yBEbf- IJrcB8Pe~gAd53DEEHgbugUkFSHtzzLqnYlbs,AQACAAE/random_babcom/379/#Changesinstatsfrombandwidthchanges)

Generated August 25, 2017. [https://www.asksteved.com/stats/](https://www.asksteved.com/stats/)

</comment></comment><comment><USER13> My brother worked on freenet it was cool until tor came up and supplanted it

<comment><USER14> Freenet still does a lot of things better than Tor. For example, no server is involved so there's nothing to attack or track down, making anonymity guarantees seem to be much better. Yet they've still managed to pull off some forms of interactive communications.

IPFS is closer really, but doesn't move in an anonymity friendly direction at all.

<comment><USER11> > For example, no server is involved so there's nothing to attack or track > down, making anonymity guarantees seem to be much better.

Not really "no server". I mean, Freenet users collectively _are_ the servers. As in BitTorrent, I2P and IPFS.

What Freenet does better than Tor is keep content available, even if the provider goes away. As long as it's popular content, that is. Although Tor .onion services are perhaps harder to find, once they're gone, they're usually just gone. There are exceptions, of course, such as the The Hidden Wiki. But any mirroring that happens is entirely _ad hoc_. In Freenet, it's automatic.

<comment><USER14> The point is, Tor relies on establishing a connection with a server which will provide content, Freenet simply distributes data and that data can come from any client/server on the network, Tor's hidden services are modeled off the traditional client server model, while Freenet operates more like a P2P network.

That difference in model is what provides a potential anonymity benefit as there's no longer a path to the origin of the content</comment></comment></comment></comment>


10 Benefits of Rising Early, and How to Do It - <AUTHOR> http://zenhabits.net/10-benefits-of-rising-early-and-how-to-do-it/

<comment><USER2> Got in to work at 5:30am this morning, people were like "Hey asshole, why are you leaving at 3:30pm? It's within standard core business hours!"

</comment><comment><USER3> I find it nearly impossible to wake up early.. it's been a problem my whole life.</comment>


How a movie changed one man's vision forever (2012) - <AUTHOR> http://www.bbc.com/future/story/20120719-awoken-from-a-2d-world/all

<comment><USER2> But;

We're sorry but this site is not accessible from the UK as it is part of our international service and is not funded by the licence fee. It is run commercially by BBC Worldwide, a wholly-owned subsidiary of the BBC, the profits made from it go back to BBC programme-makers to help fund great new BBC programmes. You can find out more about BBC Worldwide and its digital activities at www.bbcworldwide.com.

<comment><AUTHOR> Strange. I can access it without problems from Australia</comment></comment>


Takeaways from the $566M BriansClub Breach - <AUTHOR> https://krebsonsecurity.com/2019/10/takeaways-from-the-566m-briansclub-breach/ <comment><USER2> Open question; What's the long game on securing the way credit cards work? Who's working on something interesting that could thwart the whole 'name+number+ccv' leak thing that's been perpetuating in this industry for decades?

I'm just reaching out for anyone who knows about any grand plans, initiatives or rehabs of how credit cards currently work. Keen to read more.

<comment><USER3> This is a solved problem, really, some banks are less keen on implementing it: generate single use / single purpose credit card numbers in your ebank / mobile app. Leaks are total useless. Also, more than a decade ago already many European banks were sending a text SMS above a treshold and only approved on a positive reply. Today you'd likely offer sending a push notification.

You have 16 digits on a Visa/MasterCard, the first six is the bank identifier and the last is a checksum digit thus you have 9 digits to "waste" \-- and you can recycle them.

<comment><USER4> Bank of America has discontinued their ShopSafe system for single-use credit cards. Citibank seems to still have their virtual credit card system, but it requires Flash. Are any banks currently embracing it?

The impression I've gotten is that since most of the costs of fraud are on the bank, rather than the cardholder, there's not much incentive for the cardholder to go through the trouble of using single-use cards. And so it's a better investment for the bank to develop good fraud detection algorithms.

In my anecdotal experience, the fraud detection has gotten really good. Every time in the past decade that someone's gotten hold of my credit card number, the bank's caught it nearly immediately.

<comment><USER5> Also, since they now just text you, they can make the algorithm more stringent.

I've had BoA fraud detection ping me about a monthly rent check before, so I'm not sure it's really good.

</comment></comment></comment></comment><comment><USER6> > _KrebsOnSecurity [has] a link to 26 million credit and debit cards. So far > the banking sector is [not in a hurry for] re-issuing cards._

Krebs should publish those card numbers to light a fire under the feet of the bankers to re-issue the cards and get them to demand better security on merchant terminals or servers or wherever the info came from. Of course he should publish _only the numbers_ , without the associated names, CVVs, expiry dates, PINs, or other security info.

I don't think there is a risk in publishing just numbers, is there? The search space for valid card numbers is _so_ tiny that I find it hard to believe that anyone could generate a false transaction with _just_ the number and no other associated info.

Krebs could go a step further and provide a verification site à la haveibeenpwned.com where your enter your card number, or the last ten digits or something, and it tells you whether you've been pwned.

</comment><comment><USER7> Why don't credit/debit cards use elliptic curve cryptography?

<comment><USER8> Chip cards (EMV) use crypto - the signing of the transaction happens in the chip, with an embedded private key.

</comment></comment><comment><USER9> I find this kind of black hat cybercrime stuff fascinating. If I wanted to learn more about it (just for learning sake) what would be some good resources?

<comment><USER10> Honestly, join these groups and read what they talk about on the forum. Look up what the bigger fraud marketplaces are. Go on tor and read stuff in the dark net markets. All of them more or less talk about methods they're using and they help each other out. This type of stuff ranges from low level script kiddie (copy cat) people to high-level hackers that develop their own methods, search out vulnerabilities and so on.

A good podcast I would recommend is called dark net diaries. They have lots of episodes on cryber crime. Episode 32 specifically talks about carding and how the secret service took down a guy who acquires the credit card numbers. Most of it involves putting malware on point of sale machines or hacking companies.

[https://darknetdiaries.com/](https://darknetdiaries.com/)

</comment></comment><comment><USER10> Are these idiots really still using bitcoin for doing shady stuff lol? Bitcoin can totally be traced. Most people using it are so weak in terms of their security.

<comment><USER11> This is not looking at the whole picture. The key is, you do not allow your BTC usage to comingle with your real identity. This means you both buy and sell stuff solely with BTC. If you want to buy stuff in the "real world" then you can trade some for Monero or maybe ZCash, and then convert to USD. (Optionally mix it further in other ways..)

BTC is really "psuedoanonymous" because while you can certainly trace my transactions if you know a wallet address, you still have no idea who or where I am as long as I do not reveal that wallet to be connected to any "real world" identity.

This is still not easy though. For example, if you're serious then you must only transmit transactions within Tor, otherwise the originating IP may single you out. Ideally you should use different wallets for each transactions, and only pool them together after they have each been converted to XMR or similar.

There's lots of gotchas but frankly it's a decent system.</comment></comment>


Tell HN: Make a choice for your Obama-care discussion - <AUTHOR>

Lots and lots of submissions about the healthcare ruling - make a choice about where you want the discussion to go and don't split it over several submissions, repeating the same points over and over:
http://news.ycombinator.com/item?id=4171770
http://news.ycombinator.com/item?id=4171791
http://news.ycombinator.com/item?id=4171806
http://news.ycombinator.com/item?id=4171814
http://news.ycombinator.com/item?id=4171828
http://news.ycombinator.com/item?id=4171830
http://news.ycombinator.com/item?id=4171837
http://news.ycombinator.com/item?id=4171880
http://news.ycombinator.com/item?id=4171885
http://news.ycombinator.com/item?id=4171886
http://news.ycombinator.com/item?id=4171959
http://news.ycombinator.com/item?id=4171978
http://news.ycombinator.com/item?id=4172033
http://news.ycombinator.com/item?id=4172217
http://news.ycombinator.com/item?id=4172263
http://news.ycombinator.com/item?id=4172343
http://news.ycombinator.com/item?id=4172389
... and still the submissions come in.  I'll stop updating now. <comment><AUTHOR> Clickables:

<http://news.ycombinator.com/item?id=4171770> <\- some comments already

<http://news.ycombinator.com/item?id=4171791>

<http://news.ycombinator.com/item?id=4171806>

<http://news.ycombinator.com/item?id=4171814>

<http://news.ycombinator.com/item?id=4171828>

<http://news.ycombinator.com/item?id=4171830>

<http://news.ycombinator.com/item?id=4171837>

<http://news.ycombinator.com/item?id=4171880>

<http://news.ycombinator.com/item?id=4171885>

<http://news.ycombinator.com/item?id=4171886> <\- PDF of actual decision

<http://news.ycombinator.com/item?id=4171959>

<http://news.ycombinator.com/item?id=4171978>

<http://news.ycombinator.com/item?id=4172033>

<http://news.ycombinator.com/item?id=4172217>

<http://news.ycombinator.com/item?id=4172263>

<http://news.ycombinator.com/item?id=4172343>

<http://news.ycombinator.com/item?id=4172389>

</comment><comment><USER2> It's weird none of them are making it into the front page. Are they being flagged or blocked?

<comment><AUTHOR> They're not just not on the front page, I can't find them at all. It appears they're being blocked. That happens when contentious political news happens, and personally I'm pleased about that.

<comment> why-el I thought HNers actually choose not to upvote these things since they are maybe irrelevant to hackers?</comment></comment></comment>


Google Play (Android App Store) does not work at all unless you enable Equifax - <AUTHOR> https://twitter.com/php_austin/status/349751588090421250 I'm using ICS.  Go and disable the certificates yourself and see if you can confirm it. <comment><USER2> Pull up [https://play.google.com/store](https://play.google.com/store) in a browser and look at the TLS certificate chain.

Equifax Secure CA is the root CA for the certificate chain.

The intermediate CA (Google Internet Authority) issues the certificate for the end entity. Its CRL distribution point is [http://crl.geotrust.com/crls/secureca.crl](http://crl.geotrust.com/crls/secureca.crl). There is no OCSP resource.

The end-entity certificate is wild-carded for a number of Google sites. Its CRL distribution point is [http://www.gstatic.com/GoogleInternetAuthority/GoogleInterne...](http://www.gstatic.com/GoogleInternetAuthority/GoogleInternetAuthority.crl). There is no OCSP resource.

The relying party would validate the end-entity and intermediate CA certificates using CRLs (as no OCSP is available). These requests would be the only "data" sent as part of the certificate validation.

As the root CA is explicitly trusted (since it is present in the trust anchor compilation), it (Equifax Secure CA) is not contacted.

Explicitly removing trust for arbitrary root CAs (which can be prudent) will of course remove trust for end-entity certificates traceable to those CAs. Thus, if one removes trust for Equifax Secure Certificate Authority, one will no longer trust certificates issued by Google Internet Authority, such as the one used by [https://play.google.com/store](https://play.google.com/store).

Trust via contemporary CA compilations and relying party PKI implementations is quite coarse. One essentially trusts all all CAs and subordinate certificates for a variety of purposes. Implementations vary in precision (or even presence) of revocation and constraint checking.

<comment><AUTHOR> I don't think it's just a coincidence or necessarily a secret:

"Equifax Inc. (EFX), EBay Inc.'s (EBAY) PayPal and Intuit Inc. (INTU) have beguntrials to see whether social posts can help prove identities,and, in some cases, detect whether customers are lying abouttheir finances." [http://finance.yahoo.com/news/facebook-posts-help-credit- bur...](http://finance.yahoo.com/news/facebook-posts-help-credit- bureaus-040100420.html)

Actually I remember blogging about this years ago, back when Myspace was at its peak. So it's not news. I'm just wondering if Google has revealed what data it reports to Equifax, if any. And if that's the case, I think the next question is: What sort of app activity will help improve your credit?

</comment></comment><comment><USER3> Is there another tweet that explains this tweet?

<comment><AUTHOR> No, I just discovered this moments ago and posted it. I had disabled a lot of my security certificates the other day and then realized I couldn't get into Play. So I added just about all the certificates back except the creepy ones like "Japanese Government". Well, Google Play still didn't work.

So I was just watching a movie at home and this was my process:

1\. Enable creepy certificate. 2\. Try Play. 3\. Play doesn't work? Re-disable creepy certificate. Go to #1 (Try next creepy certificate.)

That's not to say Equifax is the ONLY certificate you MUST have to use Play. But it appears it's at least ONE of the required certificates. If I was really bored and had several hours to blow I suppose I could figure out which certificates are mandatory.

The annoying thing is, Google makes you tick a checkbox, then scroll, then Enable, then Confirm (four steps) for each certificate. So it's very time- consuming. Maybe easier to toy with the certificates if you have root access to your phone, which I haven't bothered to do yet.

</comment></comment><comment><USER4> So? Is that a problem?

<comment><AUTHOR> I'm no expert, but seems like a big deal for all Android phones to report to a major credit bureau that determines whether you can rent an apartment, buy a house, get a job, a promotion, etc.

Not only that

a) It's mandatory, not something you can turn off. Unless you want no apps on your phone.

b) There is no error message saying "Could not connect to Equifax." It just asks if you want to "Retry" starting the app.

<comment><USER5> Their server certificate is from Equifax Secure Certificate Authority, disabling it will make the https connection fail.

To my knowledge, verifying the server certificate from a local CA store does not send data to the CA itself, do you have any reason to think otherwise?</comment></comment></comment>