“Ultrasonic cross-device tracking” embeds inaudible tones in advertisements | Hacker News Reader

“Ultrasonic cross-device tracking” embeds inaudible tones in advertisements

arstechnica.com

149 pointsTomte117 comments

This is reaching the point where the only sensible policy is to flat-out prohibit all forms of adverting on any medium. Paying a company to lie to you is already a pretty bizarre idea but the invasion of privacy - online or offline - makes advertising increasingly intolerable.

Some people say your attention is your most valuable asset. Stealing ones attention is unethical in my mind.

I found it interesting that the FCC's recommendation was to build an opt-out system, since this is so obviously anti-human and pro-corporation. It shows where their interests lie.

This kind of system should be opt-in only, with hand-signed agreements.

Exactly. Opt-out systems are fine for things like organ donation, because a reasonable person could go either way. Building an opt-out system that no one in their right mind would ever opt into just reeks of anti-consumer behavior trying to hide behind a polite face.

> Building an opt-out system that no one in their right mind would ever opt into just reeks of anti-consumer behavior trying to hide behind a polite face.

What system are you referring to? If the system is "opt in to being tracked if you want to read this/use this service for free" then plenty of people would opt in. Look at Facebook.

People do this because they get some value like looking at cat pictures in exchange and to some extend certainly also because they misjudge the value they receive as compared to the value they give away. If you only track users and don't provide some value in exchange, then nobody should opt in. And the value probably also has to be immediate to some extend, just promising to provide better services in a year after analyzing the data will probably not convince many to opt in.

Your example is not completely relevant. Facebook has been known to track people who are not actually Facebook users, meaning they never opted in.

Whoa, wait a sec there with your example. How would a reasonable person not want to be an organ donor??

Religious reasons, family not wanting that to happen, etc.

If your religion forbids saving or improving the lives of others with organs you're done with, please consider alternatives.

Religion doesn't work that way. You don't go "Well, I have this set of values, so I think XYZ is the right religion for me". There are exceptions, but most of the time it's actually exactly the opposite.

If one facet of someone's faith is enough for you to dismiss their entire belief system, you clearly don't even try to understand others' differences to yourself...

Oh, I try. But in the case of organ donation, I simply fail to understand the reasoning. If you're dead, why not save a life, renew sight, or otherwise greatly improve the life of another? Are there people who think that organ donation would hurt them in an afterlife? We, at least in the first world, live in societies with freedom of conscience and belief, so people should at least think through the consequences of their choices on others. (And on themselves; if there's an afterlife, do you really want to risk being judged on the basis of having chosen to deny a chance at health and wellbeing to another person?)

Here's some research: https://www.ncbi.nlm.nih.gov/pubmed/18555116

In short, only a few religions have anything to say against being a donor at death, and a few have something against being a recipient from a dead person.

If you think your religion might affect your decision to be a donor, check with a trusted authority figure and make sure.

For sure, FWIW I'm personally an organ donor and broadly agree with your logic. Those are just some times when I feel the choice not to donate organs is valid.

A person's choice is probably always valid regardless of what it is, it's their body at the end of the day. In the normative sense I think everyone should donate their organs, but I'm not sure it can be reasonably codified.

There is a theory that organ donors get worse medical attention and have higher mortality rates in hospitals. From what I've seen it doesn't hold up well against the evidence, but it's still within the bounds of what I'd call "reasonable disagreement".

That doesn't sound reasonable at all. That theory hinges on the idea that doctors would prioritize getting organs over actually saving people's lives, which would be a truly horrific violation of the hippocratic oath.

I wonder if rendering expensive emergency aid rather than harvesting organs is significantly more profitable in the short term?

I see it just as an acknowledgement that I might not want there to be any possible cross-purposes of incentives in my own health.

Doctor's don't need to consciously change their behavior for there to be a difference in care. It's just that incentives are like really awesomely powerful things.

I don't actually see anything in the Oath that requires prioritizing your own patient to the detriment of any number of other sick people.

Perhaps a better way to say it is that it would be a very serious ethical violation.

We're generally unaware of someone's donor status. I agree that unconscious bias would be a concern (directionality unclear) if that were not true.

>> How would a reasonable person not want to be an organ donor??

Because I have fundamental issues with the economics of organ donation. I do not want my organs used in million-dollar surgeries to save elderly rich people. I would much rather that money be spent more efficiently on younger/poorer people where it can save more lives. How many flu shots could be purchased for the cost of one heart transplant? I cannot change the economic realities of modern medicine, but the least I can do is not contribute my own flesh towards the problem.

"No kidney for you, little girl. It might have gone to an old person."

Yes. No kidney for her, but flu shots for 10,000 ... saving many hundreds. The reality is that saving lives is now a matter of resource allocation. Procedures such as organ transplantation take resources from far more efficient treatments that can save many more lives.

I wish I had recorded something I saw at the gym years ago. An old and obviously ill man was bragging about how his firm could hire young interns, pay them nothing, and fire them at the drop of a hat. A young man overheard, walked over to him and said "I;ll never have your money or power, I cannot stop you from being a jerk, but when your liver starts failing you aren't getting even a piece of mine." He then ripped up his organ donation card.

> The reality is that saving lives is now a matter of resource allocation. Procedures such as organ transplantation take resources from far more efficient treatments that can save many more lives.

Do you have a source for this? To me, it seems extraordinary that we're capped out of medical resources in such a way that, were someone to not have donated their organs, ~10k flu shots would be provided instead of the various potential transplants. (I tried some internet searching but everything talking about resource constraints was talking about the organs themselves, not the general medical resources).

Fifty years ago, Larry Niven had some "moral tale" SF stories where the demand for transplant organs led to capital punishment for traffic violations.

Also, technically there is no difference between cannibalism and organ transplants - ingesting the flesh of others of your species to save your life.

Except that some organ donation doesn't involve doing damage to the donor. Blood/marrow donations are different than 'solid organ' donation. A blood donation can save a life very cheaply and the recipient will live normally, without the lifelong costs/complications of carrying a donated solid organ.

Child oriented ads are especially awful. We let some greedy people massively influence our kids just so they profit. I would ban every kind of marketing oriented to kids and youngs.

If you have something really useful and good for the kids, sell it to their fathers. If you want to scam their money then get out.

Yes. Although I think the plural you want is "parents."

You are right, thanks.

I think this is good in a way, because it just reinforces what people are learning already: advertising is an "Us vs. Them" deal. They try to get to us, we try to block them.

A platform that doesn't let me block ads is a platform I won't use.

How do you define an "advertisement" and how do you keep the Advertising Definition Agency from getting stacked with people who define opinions they disagree with as advertisements?

I'm working on an app that passively picks up ultrasonic tones generated by SilverPush and sends out garbled data.

The biggest issue with blanket interference across the entire ultrasonic band is that there are some legitimate uses that don't involve cross-device tracking. That's why we need to address this issue by selectively interfering with only known tracking schemes.

Can you elaborate on which legitimate uses you had in mind?

These are two services I know of that use it for cool stuff with user permission:

* Authentication: http://www.copsonic.com/

* Shopping deals: http://www.shopkick.com/

Anything that requires the ability to detect if it's in the same physical space as another device / item of interest.

Some common examples are:

* guest mode discovery on a Chromecast

* pairing to videoconference system (both Cisco and Polycom do this in their current gen devices), building control, wireless presentation system etc

* a means for transmitting a 2FA code from a personal device for auth / payments

* micro-location service - particularly for temporary events or spaces where BLE is not possible (e.g. embedded in FOH audio at different stages at a music festival)

* proximity based peer discovery for mobile games

You'd be surprised at how common a technique it is. I regularly face issues with environments that have had enough different devices all attempting to use some form of ultrasonic pairing / localisation etc that there's issues with interference.

Where can we follow this project?

It's currently a course project we're working on. I will post it to HN once it's in a "good enough" state.

Do you have details on the encoding? I'm a bit suspicious of it being actually ultrasonic (device microphones often filter at 20khz or below) - seems more likely it would be audible spectrum noise with a ton of FEC.

They map each letter (A-Z) to a single frequency. The range is around 18-19.5 kHz. As far as I know, this range is inaudible to most adults. I couldn't hear it for example. Of course, I may be using the term ultrasonic incorrectly.

Some preliminary work was done last year to reverse SilverPush[1], but my group and I are planning to take it further.

[1]: https://github.com/MAVProxyUser/SilverPushUnmasked

I can't speak for SilverPush, but Google Tone definitely has an Ultrasonic component [1] as does a version of Chirp [2]. Both work through consumer grade speakers/DACs/devices.

[1] https://www.reddit.com/r/AskEngineers/comments/374876/lets_t... [2] https://vimeo.com/177586203

Sorry but I found this to be very disappointing scarebait from Ars, who I expected to have higher standards. It doesn't explain how common this is yet the title makes it sound like it's super prevalent. (not to mention we're already being tracked in other ways that are worth worrying about more) It does a horrible job at explaining what's actually going on and why advertisers might use this instead of alternatives, in fact I still don't know. (something about every ad containing ultrasonic sounds and everyone making their app use the microphone to constantly listen for them—I get that it's a real thing but sounds way too contrived and complicated to be common) The title is also super clickbait and I wouldn't characterize it as the good type of FUD. The solution they propose is a proof-of-concept patch, so not an actual functioning solution (and their extension is supposed to block ultrasonic frequencies, but advertisers will just move to audible frequencies then and mask it as music). Even if they improved the title, the article itself is flawed and is predicated on making us scared of this, even having the gall to say "Now that you’re sufficiently concerned". C'mon Ars... I get wanting to point out troubling practices and increasing awareness, but at least do it in a less knee-jerk and more informative manner.

The key goal is cross-device tracking. Your phone vs your notebook vs your TV vs whatever else around has audio and net uplink.

Given the advertiser benefit, I wonder if the purpose of the article is to boost the sales of ultrasonic services to advertisers. When I say purpose, clearly Ars' purpose is clickbait, but the purpose of wherever the information was sourced/initiated.

Somewhere in an advertising conference dark side corridor there is a booth advertising snake oil "ultrasonic cross device user tracking as featured by Ars Technica."

Most agency advertisers have known about this for well over a year. To my knowledge, no one is particulary interested in it.

I wasn't aware (and would be surprised if) iOS apps with microphone privileges could listen all the time, even while in the background, which is really what would be required in this situation.

Is that really the case, or is the Ars piece suggesting I would be walking around with the advertiser's enabled app open all the time? (And I'd guess Android is in a similar boat.)

On iOS there is a prominent red banner informing an app is listening if it is listening in the background.

Also, if I'm not mistaken, only 1 app can listen at a time.

On iOS multiple apps can listen at one time. On Android only one app can listen at a time.

A quick search indicates that <100 dB ultrasonic is legal. So make a phone cover that generates ~80 dB spread spectrum ultrasonic. That should be enough, right?

Poor dogs...

(and cats, they have much better hearing)

And humans. These things aren't really ultrasonic because phones and computers can't transmit ultrasound (why would they need to?).

This is something I was curious about. Sure, if you're doing serious audio editing and such, you might sample at e.g. 96 kHz, and I wouldn't be surprised if Android also allows that. But does this really not get band-limited at any point in the stack?

Poor me, I can hear the ultrasonics generated to repel dogs and cats...

Yeah, apparently you're supposed to lose that ability in your mid-20's, but I still hear them loud and clear at 28...

I used to hear ultrasounds fairly well. It goes away unfortunately.

I know it's Ars, but there has to be a better link with more detail than "here's a thing some people might be doing, somewhere."

Take a look at Chirp: http://www.chirp.io/

Edit: In Firefox it seems this website is constantly playing audio. I think it is using a WebSocket to do this. Since I don't hear a thing I'm not sure what is going on here.

Perhaps Chirp is what Silverfish metamorphosed to?

Reading the blurb on their site, they state they're the only people doing this, oh, and they reference India too (something that happened a bit on Silverfish's site). Coincidence?

Since I don't hear a thing I'm not sure what is going on here.

Click on the gem and the web page will play a "chirp," which is loud and beepy and not ultrasonic or secret at all. It's an analog modem type system, except probably way slower than 300 or even 110 baud. Everything old is new again, I guess.

In any case, the point is: the Chirp system is distinct from the supposedly-possible secret systems the Ars story is fretting over.

I've seen several articles worrying about the use and abuse of data transmission via secret ultrasound, but I've never seen any claims that named names or that offered a way for readers to verify or check anything.

I don't think you can count on the average laptop/phone speakers, mics, and digital audio systems to deal with ultrasound.

If a computer's audio drivers and audio hardware are set up to play back at standard CD/DVD sample rates (44KHz or 48KHz), then ultrasonics are not happening there, period. The same principle applies to inputs.

Even if all the hardware and software on two devices is capable of and configured for producing/receiving ultrasonic frequencies, it seems pretty likely that loud ultrasonic screeches played on a 50-cent cell-phone speaker would produce audible harmonics, and the jig would be up.

I expect secret ultrasonic data transmission over commodity systems is the sort of thing a well funded state organization might turn to for a targeted operation. Because it might work under exactly the right circumstances, but it would be fiddly and terrible for general use.

Are there other devices besides the audio driver that could produce ultrasonic sounds when driven in a certain way?

I was curious about this too. My EE (particularly RF) studies didn't go far enough for me to chime in.

Is there power circuitry, etc that could likely (a) generate inaudible frequencies that overlap with mass-market microphone capability & (b) would be sufficiently controllable (albeit likely indirectly) for data transfer?

I think that most people (not teenagers) cannot hear past 15 kHz, especially with other sounds playing. This is reproducible at standard sampling rates you mention.

Harmonics are integer multiples of frequencies. Harmonics of an ultrasonic signal are even more ultrasonic. If there's any aliasing, those harmonics might map back to audible frequencies. However, no matter how cheap a speaker is, no aliasing happens. Perhaps there's another reason why an ultrasonic waveform might be audible when played through a cheap speaker, but not because of harmonics, right?

It's not necessarily a function of the speaker but of the low-pass filter on the output. Unfiltered samples played back at 48 kHz will mirror the audio content at 0-24 kHz to 48-24 kHz, and repeat that pattern at every 48 kHz multiple. (This is not quite exact because DACs emit step functions, not delta functions, and slew rate comes into play, but it is a rough approximation.) This happens even if the sampled signal is a sine wave.

So, any output stage after a DAC necessarily incorporates a low-pass filter to eliminate the aliasing artifacts. A cheap low-pass filter will allow these aliasing artifacts through. You can simulate this e.g. by digitally upsampling a, say, 8 kHz sampled signal to 48 kHz without any interpolation.

Harmonics of an ultrasonic signal are even more ultrasonic.

You're right. I was thinking of resonances. Even in that case, I might be wrong.

> If a computer's audio drivers and audio hardware are set up to play back at standard CD/DVD sample rates (44KHz or 48KHz), then ultrasonics are not happening there, period. The same principle applies to inputs.

What do you mean? All you need to do is sample the received audio at 44.1 kHz. Android at least has a low-level API which allows you to customize sampling rate.

According to Nyquist's work, you need a sample rate of 2f to represent a frequency f.

So with 44.1 kHz you could only represent audio up to 22 kHz. There are kids who can hear at these frequencies.

I am aware of the Nyquist rate. You're talking about very rare edge cases though. I believe the cut-off for an average young human is 20 kHz.

Yeah, I get that, just saying, if we are going to worry about people with disabilities, I believe that we should care about the psychoacoustic wellbeing of "edge case" humans who can hear ultrasonic tones.

So you're comparing disabilities, like not being able to walk or see, to a slightly annoying tone? Of course, it also depends on the estimated number of "edge cases" out there.

And even then, you need a few kHz bandwidth for the low-pass filter. Those high frequencies are greatly attenuated.

Nowadays many standard cheap embedded audio chips included in phones and computers are capable of 92/96khz sample rate - so they can easily drive 40+khz ultrasonics.

The letter to the FTC has some more details.

https://cdt.org/files/2015/10/10.16.15-CDT-Cross-Device-Comm...

Couldn't this already be done with Wifi and/or GPS?

Also, doesn't the electronics in the phone already filter out everything outside the audible part of the spectrum, just because it is more efficient to do so (lower sampling rate = better performance / lower power consumption)?

This use case is closed to BLE and particularly iBeacons, but with the advantage of potentially requiring less special hardware and matching physical delineations better than radio (e.g. won't pass through walls to a neighboring business)

This is interesting.

With the permissions system in Marshmallow, you can selectively disable microphone access, which is good. Those of us stuck on Lollipop will just have to be careful what apps we install.

Alternatively, CyanogenMod has had Privacy Guard for quite a while now, so that might be an option if your phone is one of the supported devices.

I'm sorry this is completely bogus, if there was ultrasonic audio emanating from everyone's phones dogs would go nuts. We can't hear it but they sure can.

Discussed ~1yr ago: https://news.ycombinator.com/item?id=10562207

I disagree. I was recently in the transmitter room of a radio station and saw an interesting device. I asked the engineer what it was, he explained it was for ratings and worked exactly in the way the article describes. They transmit inaudible tones on the radio, and they are picked up by certain people with a device or the app installed. I don't recall all of the details but some googling will probably get you going.

They use this to determine how many people are listening to their station.

I wish I knew what those apps were. Or what signs I can look for. I generally don't have many "garbage" apps on my phone, but I've always suspected it with words with friends--Yes, my gf have been playing that game together since we started dating 5 years ago. Every so often an Ad will come on and the volume all of a sudden adjusts itself from mute to about 33%. Its distributing that an advertisement can have that power.

edit: Hey wait, let me read the article--just poured my first morning cup of coffee and reading HN.

I think it's an app specifically installed for the purpose. I just asked him what it was called, he said it was an Arbitron(now owned by Nielson) device. I googled Arbitron device and found this: https://en.m.wikipedia.org/wiki/Portable_People_Meter

Note that it doesn't use ultrasound, it embeds information in the normal audio in a way that humans are not likely to perceive (psychoacoustic masking).

https://en.wikipedia.org/wiki/BadBIOS

Some food for thought.

Ultrasound doesn't mean the volume is really loud, just that it's at a higher frequency. If it's transmitting data then it's gibberish that adds to the background noise for an ultrasound listener. Maybe annoying but not necessarily driving one nuts.

This article is complete hogwash.

"Ultrasonic" beacons are like any other beacon technology, whether audible, inaudible, bluetooth based or otherwise.

All a beacon does is transmit an identifier or URL. It isn't and CAN'T track you. It is just a simple one-way broadcast that is saying "X is here". You need an application that knows to listen for beacons an knows how to translate the identifier of the beacon.

For example, if Starbucks is using a beacon and you go near it with your phone, your phone will do nothing with that beacon unless you have the Starbucks app that is looking for Starbucks beacons so the app knows when you are near a Starbucks.

There is nothing nefarious about this....

Ultrasonic is just another method to achieve the same result, although it seems like a bad way of doing it since it is fairly obvious when your app is "listening" on iOS.

>All a beacon does is transmit an identifier or URL. It isn't and CAN'T track you.

If my devices are transmitting identifying beacons, then they absolutely ARE tracking me. What exactly do you think that "identifier" is?

The article isn't about stores transmitting beacons that our devices pick up. It's about our devices transmitting beacons that are then picked up by anyone who cares to listen.

It isn't?

"The technology, called ultrasonic cross-device tracking, embeds high-frequency tones that are inaudible to humans in advertisements, web pages, and even physical locations like retail stores."

"any device microphone—like those accessed by an app on a smartphone or tablet—can detect the signal"

How is this any different from a bluetooth beacon being detected by a mobile app? You are just broadcasting the identifier in a different manner.

Talking about security, wouldn't it be nice if arstechnica would enable https?

I think it is for subscribers?

> all the time, even while they’re running in the background

This is FUD. iOS does not give an app this ability without it being obvious (a banner across the top of the screen).

Apparently 9 in 10 smartphones today are Android and that lets you do whatever you want in the background.

Still FUD to say its possible on iOS (which they did).

anyone know of an app that can detect these signals?

Maybe decode them.

easiest way to block them is to know they are there in the first place.

i am suspicious that occasionally my laptop makes high pitch noise correlated to mouse movements when its running windows 10.

edit:Thinking about it. seems possible that might actually be facebook. never installed their phone app untill i had android 6 because it wants mic permissions (disabled) and facebook and reading hn is about all i use win 10 on the laptop for.

You most probably have some "coil whine"[1]. It's very unlikely that you are hearing ultrasonic signals (disclaimer: I'm no expert).

[1]: https://en.wikipedia.org/wiki/Coil_noise

sounded like "coil wine".

doesnt stop a phone app decoding it though. it was only when i moved the mouse. and came then went.

And i definately still have reasonable high frequency hearing. for example filing a complaint with Morisons in the UK for those high frequency speakers aimed at stoppping kids loitering. Don't know if they got rid of them or not because i stopped shopping there.

That is just electromagnetic interference.

It may have just been electrical interferance.

But electrical interfance from a trackpad? - made me suspicious at the time.

And one way or another, a proof of concept is only a few lines of javascript.

A very very easy way to link people in a room together.

And it would explain why the facebook app wants mic permissions when afaik it offers no audio features. it doesn't even need to be audio the maker of the app controls - just "fingerprint" sounds and report them back to facebook (or whoever).

Your MacBook microphone can detect ultrasonic frequencies above 22khz, though I'm not sure whether my observed ceiling is an artifact of the microphone, or of the speaker I was using to emit the tones.

In my informal tests, most people are unable to hear any tone above 20khz or so. This is discovered, naturally, by starting with the highest pitch tone I can generate at the loudest volume, and lowering the pitch gradually until somebody covers their ears and starts screaming. This is usually the youngest person in the room.

You can generate and receive audio using web audio APIs. Creating a browser extension to detect ultrasonic comma would be fairly straightforward.

However, most audio output (at least back in the nineties and naughties) is not capable or creating sounds reliably above 16khz. They almost always have a low pass filter on which cuts it out. Apparently most dell laptop speakers cant even manage above 10khz

"You can't hear" doesn't have to be high frequencies though.

It can be more subtle like phase shifts and other "in audible range" fingerprinting.

While I've not used it for getting on 20 years now, I did do a lot of software audio engineering back in the day, everything from RF to DSP.

I've noticed this before on another laptop. I believe it is EFI being picked up by the laptop amplifier, not from the touchpad, but actually from the graphics adaptor or display panel controller. You'll likely actually get the noise any time you cause the whole screen to refresh for a long period.

Also sounds like it could be a ground loop (earthing). Somehow isolating the laptop's power from all others you may use (such as powered hubs, speakers, etc) by placing them on separate power feeds tends to help.

The sound is probably coming from the LCD screen. https://news.ycombinator.com/item?id=8862689

I discounted that at the time by playing a muted YouTube video and using keyboard shortcut forward back.

It only altered in any meaningful way to trackpad movements and clicks.

Can phone speakers really make sound in ultrasonic range?

Just because ultrasonics are inaudible doesn't necessarily mean they're harmless. Energy deposited into those little hairs in your cochlea is still energy. What does the research say about the impact of ultrasonics on hearing? I wouldn't be surprised if they're the same as any kind of sound, decibel per decibel. (They're easier to block out, being at a higher frequency.)

Well, if ultrasound was able to produce significant energy input to the cochlear hairs (stereocilia), it would invoke motion in these hairs and thus the perception of sound. So if that was the case, one would be able to hear ultrasound (which one cannot).

Actually, the inability of the human ear to hear ultrasound is because the impedance matching function (mechanical gain) of the bones in the middle ear rolls off at high frequencies. So the energy in ultrasound is dissipated before it reaches the inner ear.

That being said, exposure to >120 dB ultrasound can damage your hearing (I believe this is because response functions of the ear start becoming nonlinear). According to Wikipedia, above 150 dB ultrasound can even start heating your flesh, and above 180 dB it can be fatal.

Well, if ultrasound was able to produce significant energy input to the cochlear hairs...one would be able to hear ultrasound (which one cannot).

That being said, exposure to >120 dB ultrasound can damage your hearing (I believe this is because response functions of the ear start becoming nonlinear).

Seems self contradictory on your part, unless you're saying people who otherwise can't, can still hear ultrasound, so long as it's over 120db. So, my top frequency for hearing is down to 14.5k from before, last time I tested it. Are you saying that 15.5k sounds now won't damage my stereocilia? That doesn't make sense, unless those things actually get stronger with age. Usually, things in the body get weaker with age.

Perhaps a tin foil hat would also work?

unlikely, it barely covers the head

The acoustic attenuation of aluminum is good, but it would serve minimal use as a hat. If used as a sack instead of a hat, both sonic and micro waves might be reduced, which is probably better than wearing such stiff apparel.

But the more air-aluminum interfaces you can introduce, the better you'll degrade the signal.

Experts recommend wearing a minimum of three tinfoil hats.

Is this why Gmail requires microphone privileges? I've been looking for a feature in the app that actually needs it and have been coming up empty.

The search functionality supports voice input, so maybe that?

Reply on news.ycombinator.com