Smart ovens shouting out to servers in Russia and China | Hacker News Reader

Smart ovens shouting out to servers in Russia and China

svrooij.io

98 pointspseudotrash116 comments

The device in the article (an internet connected oven) is checking for internet connectivity by pinging: google.com, baido.cn yes, and yandex.ru every 5 minutes.

My guess is this isn't about sending data to those sites, but rather using relying on high availability urls that you can connect to from most countries.

Is this bad engineering? Probably. Is it nefarious? Probably not.

One thing to keep in mind is that the companies making these smart appliances do not make their money from the internet connected features. Internet connectivity may be enough for to push a buyer over the edge or for the device to qualify for some rebate.

The manufactures make them from selling ovens. This means they probably don't have the best software development team or processes.

You can never tell if it’s a covert channel.

Maybe it’s signalling bits by slightly differing the timing of each ping. The bandwidth would be extremely low but it’s always connected

What would be the information the oven can expose over thus a channel? How often I cook? How much energy I use for cooking? The oven will not even know if I'm at home or not if not used. I can't think of any critical spying done that way?

Of course if the oven had cameras and microphones - but then again, the bandwidth of a covert channel would be rather limiting.

Oven usage data is probably extremely valuable for advertisers.

The things you can do with statistical methods nowadays might blow your mind if you think there is not much information in oven usage.

You could infer likely occupancy periods of the home, since obviously if the house is empty no one is pushing buttons on the oven, and use some basic priors (9-5 jobs, x number of kids) to develop what is likely a pretty accurate model that would be profitable to sell to advertisers. Perhaps there are sensitive voltmeters on the power supply that can detect usage of other devices on the same circuit. Not to mention that it is yet one more channel of information alongside the flood of data being generated about you and your home by the rest of the devices you have incorporated into your life, and these things tend to have superlinear benefits when combined a la "multi-task" ML contexts. This is not an exhaustive list.

Moreso, you never know if there's some logic bomb inserted in the response.

And it's not at all far-fetched. We have the Sony PS2 Linux yanked away after it being a sold feature. And with a joke of a response to that, indicates that any internet connected device is a rental to the ever-changing terms of the real owner.

For now, maybe its only pinging the servers (for which we still don't have the full story) but who knows what happens with the next update, assuming it doesn't brick your device, that is.

No fan of the internet of shit here or anything, but I don't think these aspects of the firmware will get any more nefarious. The other terrible things about smart home devices are already well-known.

As usual, I just recommend sticking to only smart home equipment that can work over local radio or some other bus that's not internet connected. Strongly recommend people check out home assistant; for moderate power users it's pretty easy to wrangle a bunch of Bluetooth LE, ZigBee and Zwave devices. I can find off the shelf Zwave devices at my local Lowe's and ZigBee at my local Best Buy (Philips Hue devices work fine for me out of the box.) Of course, when it comes to ovens, you're probably shit out of luck. But whatever. Not sure what serious value add a radio on an oven adds. Guess you can see the timer from the couch...

I'll be keeping my Samsung appliances off the network personally. No real need for whatever SmartThings might offer anyways.

I agree its probably benign, but its really hard to trust companies these days to do the right thing. Consumers are basically being treated as sheep to be sheared.

And literally any piece of Internet-connected software could start doing nefarious things, whether or not it pings google.com (or non-Western equivalents).

This is a sensationalist piece of blogspam, probably designed to get picked up by a unscrupulous tabloid and boost the author's engagement metrics.

looks like an OR relationship.

Since such an oven won't be able to connect to google.com if it is located in China, looks like lazy/resourceful engineering instead of malicious intent.

I'm stunned that almost anyone would go through the effort of connecting their oven to WiFi. I'll be more concerned when these become 5G connected and start charging you a monthly fee for connection. I wouldn't be surprised if in the future you can get $100 OFF! by signing up for the $5/mo service that you just can't seem to cancel (or it's free for the first year when you sign up with a credit card).

Device manufacturers are starting to build mesh networks so pretty soon your devices won't need to connect to your WiFi in order to phone home.

Removing antennas from electronics isn't too hard, or worst case, physically damaging them or installing faraday cages.

Seems like an interesting cottage industry that could bloom around intentionally stupifying your unwanted smart home.

I'm sure they'll just throw error messages until they've managed to establish a connection. Device manufacturers have already shown they'd rather cripple your devices than respect your wishes.

Antennas on cheap consumer devices are often just a trace on the PC board. Still not that hard to remove (could just cut the trace), but harder to do without damaging anything than unplugging an external one.

Enclose your kitchen in a Faraday cage.

I was about to scoff that even if the oven, fridge, microwave, and dishwasher are all talking to each other, I'm not going to connect any of them to the Internet.

But then I realized that my neighbor might connect his to the Internet, and that a low-bandwidth 433 or 900 MHz radio mesh can hop from house to house until it finds any house that's connected to the Internet.

BRB, off to replace my drywall with a Faraday cage...

Amazon Sidewalk already does this. For what it's worth, they claim you can opt out. I'm not sure I trust that the transceiver is always off.

The best feature of an internet connected oven is that the clock is always accurate. No more manual updates after a DST change.

or a notification on your phone when the oven is at temperature, has been left on, when the timer has gone off...

We've had clocks for decades that synchronize to atomic time sources accurate to within 1 second over 100 million years that automatically correct for daylight savings time that do it all by just listening to publicly available radio broadcasts, no wi-fi or information harvesting required.

This solution is so cheap that you can buy it in the cheapest alarm clocks.

This is not a good reason to have wifi on an oven.

> We've had clocks for decades that synchronize to atomic time sources accurate to within 1 second over 100 million years that automatically correct for daylight savings time that do it all by just listening to publicly available radio broadcasts, no wi-fi or information harvesting required.

In the US we have:

https://en.m.wikipedia.org/wiki/WWVB

> WWVB is a time signal radio station near Fort Collins, Colorado and is operated by the National Institute of Standards and Technology (NIST).[1] Most radio-controlled clocks in North America[2] use WWVB's transmissions to set the correct time.

Radio time has never worked for me in Boston on any of the devices I've owned. I'm sure I'm not alone. It's simply too far away or there's too much interference or both.

Atomic clocks are less reliable and require more expensive circuitry. Everyone has wifi and a simple SOC that has everything needed to run the oven, display, and do WIFI at the same time can be found for pennies. Plus, internet connected is a selling point.

Huh? Wifi soc is way more expensive than a statically tuned radio receiver. The atomic clock isn't in the device, that's the point.

I was thinking more of the case of poor reception where you need a receiver outside and the device is inside.

Ok, I did not know about that. Why isn't this more popular? I have a fancy $1000 high end microwave that does not have wifi and does not sync its time. We've learned to ignore its clock.

If only everything in my home would sync to my local NTP GPS time source...

WiFi should provide a clock even if you're not connected.

Some routers (e.g. asus with asuswrt-merlin) can intercept all NTP traffics and redirect them to router's NTP server.

Can you elaborate, how does that work? Just having a wifi radio chip, you can get the time by listening to other wifi broadcasts in the area?

This came up in a Reddit thread[1] yesterday; anecdote from there[2]:

> "My favorite part is I have 3 Samsung Wifi Appliances including microwave and double oven and I really couldn’t think of a great feature other than the clock automatically setting. Well fuck me when I found out they don’t set themselves at all, and in fact they don’t even have memory so the slightest power outage means I have to reset $3k worth of appliances manually. Oh and each of them have different ways to set the clock so it’s always fun trying to set them differently in PM. No I’m not salty."

[1] "Appliance makers sad that 50% of customers won’t connect smart appliances" - https://old.reddit.com/r/Futurology/comments/10l6vl0/applian...

[2] https://old.reddit.com/r/Futurology/comments/10l6vl0/applian...

Just finished reading "Ubik", I found it partly amusing and also prescient that to get thru a door or make coffee required putting a nickel in the slot. Practically everything required a small payment in order to use it. We seem to be almost there: cars, ovens, tv's, dishwashers...the list goes on.

Yes, agreed. No other writer has so well captured the helpless, bemused terror of being imprisoned by small helpful machines.

I worked on a project that did this very thing to determine if the software was online. It’s a very common way of doing it, even if it’s not the best way, because it’s reliable, simple, and cheap.

Well, just connect to your own service, then? If it's offline, then you will not be able to "sync data" or whatever anyway, even if the device is connected to "The Internet". These connectivity checks sound completely pointless.

Do you know how many ovens there are? The AWS lambda fees are going to be insane!

So much cheaper just to ping google.com instead.

Hopefully no one is using lambda for connection health checks. An empty static page on a CDN is probably a better use of resources.

But yeah, at that point just ping google since they’ve spent millions on availability.

I worked for a Company that was a vendor for Lenovo. They had some sort of "News about Lenovo" app on all of their commercial grade machines. The content and translations were managed in our system and each computer would pull down the feed from our servers. It was decent traffic, but nothing crazy... Until they made a change and all of the sudden every machine was pulling every hour at zero minutes and zero seconds. We had one minute of DDoS every day at noon for about a week until that was mitigated.

Let's see: ping packet size is say 64 bytes so 128B both ways

My $3 VPS has 1TiB/mo bandwidth limit. So that's 2^40 / 128 / 24 / 60 / 30 = ~200k ovens pinging once every minute (which is ridiculous frequency) for $3

I guess if manufacturer can't afford $3 per 200k ovens sold, he should go out of business or stop stuffing ovens with IoT shit. :)

It is always better for debugging purposes to be able to distinguish if the problem is with the client's connection (if google/baidu/yandex all are not reachable) or with the vendor server (if those former are reachable but the vendor server isn't).

Then ping your own server, and if there’s a failure then fallback to pining another public service with known high availability to determine if it’s an Internet issue. Pinging Yandex by default every 5 minutes is not necessary

Why pay for bandwidth when you can make Google take the cost?

I don’t agree with it but I’m sure it saves a few dollars.

You don't pay anything. You either complete whatever you intended, or if there's no connection to your server, no request hits your server.

It doesn't save anything.

The devices would reach out to other third party services as well. The check would ensure they didn’t pointlessly do so. Knowing whether there was internet or not was used for a lot more than talking to our own servers.

> Well, just connect to your own service, then?

When you’re pinching pennies as a startup there’s a real cost associated with that. Several thousand devices checking in every few minutes isn’t expensive, but abusing Google was free.

Fwiw I’m not defending this, I’m just saying it’s common even if bad practice. There’s a reason IoT devices have a bad reputation.

I can't imagine this passing code review on any project I've worked on.

It was a startup, things weren’t super strict.

When I worked at the BBC, there was a substantial proportion of all traffic to the homepage which were just some devices checking for an internet connection. I believe as part of the move to HTTPS-only there was serious discussion over whether or not there was a public service responsibility to not break some random devices out there, as moving from a 200 to 301 response on http://www.bbc.co.uk might have broken some things.

There should be official services for that. I'm sure Google (or in Germany, heise.de, which publishes multiple IT-related magazines since forever) sees a lot of that as well. The BBC's home page currently weighs in at around 45kb compressed or 230kb uncompressed. Imagine how much traffic is needlessly generated just by connectivity checks, not to speak of the amount of computing power.

A good use case for using HEAD instead of GET

Ancient wisdom… easily forgotten.

There are alternatives like simply pinging the servers or one of the many alternative DNS servers like 1.1.1.1 or 8.8.8.8 that are out there.

Some internet connectivity check endpoints I see in my home networks:

- http://detectportal.firefox.com

- http://ping.manjaro.org/check_network_status.txt

- http://connectivitycheck.gstatic.com/generate_204

- http://captive.apple.com

- http://www.msftconnecttest.com/connecttest.txt

- http://api.ipify.org

The manjaro one will respond with "NetworkManager is online" when accessed from curl, but redirect to manjaro homepage when accessed from a browser.

Given that nuclear subs were supposed to use the ability to pick up BBC Radio 4 as a signal to determine if London had fallen, I think, no matter how improbable, it would at least be prudent to check the MOD didn’t have any alarms set to go off if the BBC website stopped responding on port 80.

XKCD 1172 is both fun and realistic

I was on the phone with my BT customer support a while back and part of their debug process was to ask me to ping bbc.co.uk.

Perhaps they just want to make it useful in the Chinese market where Google is blocked by the great firewall without having to have a separate firmware build just for that.

that was my thought -- ping google, which is reachable in the Americas and Europe, and hit the Chinese and Russian sites that might limit Google.

Guess you're out of luck in Turkmenistan, but works well enough most other places.

> Is this bad engineering? Probably.

Curious, how would you implement it?

Yeah I sighed when I got to that point. You have no problem to expose your oven to the internet, but then a ping to Yandex or Baidu is taking it too far? If they wanted to exfiltrate data they'd surely find a way to piggyback it on the legitimate traffic to the cloud service they're using...

They're actually making their money from negligence. If you plan to sell an internet connected device you better be prepared to to put care and effort into designing & maintaining it.

So what IS the correct way?

The real wtf here, I mean once you get past how stupid it is that your oven is now connected to the internet. Is why does it need to check if the internet is available? There are two cases, it can reach it's api endpoint and will work, or it can not reach it's api endpoint and will not work. The availability of several well known domains has no effect on this. The only reason I can think of is so you can have a different error message for "the oven service is down" and "unable to access the oven service". Even then you only need to make that check when the api access fails.

Tangently: I don't quite buy the prewarming use case, the only halfway legitimate use case for a internet connected oven is if you are the type to worry if you left the oven on.

Prewarming notification/timer complete is nice especially when I'm gaming/programming and tend forget the world exists.

Also reaching out for NTP and keeping the time updated is useful.

But yea, keeping these internet of shit devices on their own VLAN and monitoring what they are up to leads to a lot of 'um, what is going on' moments.

Ovens with a probe: is my roast at temperature yet?

Of all appliances in my kitchen the oven makes the most sense to have network features. Fridge perhaps a distant second, and that's only because I really wish I knew my compressor had failed and could've rescued the $350+ of groceries that spoiled if something had alerted me to the temp rising while the compressor was still attempting to run.

Not that I'd ever connect an iot device to my wifi/internet, but yes, that only reason is the reason. I absolutely would want to know if it's potentially a problem on my end or their end.

> the only halfway legitimate use case for a internet connected oven is if you are the type to worry if you left the oven on.

Do they still sell ovens without a timer? Mine (which is quite old) requires setting the time in advance. Forgetting is simply not an option.

Of course, they could start selling ovens without timers to stimulate the sales of internet-connected ones...

Certainly they do, mine has 3 primary modes, either just go indefinitely, go indefinitely but ring a bell after a set time, or go for a set time. The easiest mode to get set up is "go indefinitely", so that's what we use the most. Time isn't a great sopping criteria for most baking anyways, probing the interior is much more reliable.

There are some without timers but I've never seen one with a timer that required the timer to be set.

Checking whether they can connect to google.com, baido.cn, and yandex.ru in order to know whether "the Internet is up" is like me driving to Walmart, Target, and McDonalds to check if the highway system is working. When my actual goal is simply to get home.

> The only reason I can think of is so you can have a different error message for "the oven service is down" and "unable to access the oven service".

To the user, there is no difference, because the user wouldn't take different corrective action for each case. How can the user correct it if the appliance's cloud service is down? Just ping your own cloud service and if it doesn't respond, tell the user "Unable to access the oven service. Check your Internet connection, and if it's fine, please wait a bit more."

We have a simple rule: do not buy anything with wifi that does not actually need to have wifi. Which is most things. I've survived my entire life with dumb appliances. Maybe I am just becoming a cranky old man, but there aren't any smart 'features' that seem worth the surveillance and security hassles, as well as the eventual obsolescence and failure of the smart components, which will only serve to shorten the useful lifespan of the appliance. Are we being promised support for 20 or more years of service?

I fucking hate the "It's because of security" excuse companies default to so god damn much. Really burns my hide. 99% of the time it isn't. It's just an excuse to cover lazy or poor product management and engineering.

I'll at least give this company credit for giving an example, but like usual, the response is flimsy. There's almost always much better ways to handle situations these companies claim they're covering.

I recently discovered I couldn't change my email address at Target.com. When I asked the rep why, they responded "It's because of security." I told them, "I know you have nothing to do with the policy, but please let your managers know there's better ways to handle this. One thing you guys can do is never again hire an MFA as a CISO in the future."

>I fucking hate the "It's because of security" excuse companies default to so god damn much. Really burns my hide. 99% of the time it isn't. It's just an excuse to cover lazy or poor product management and engineering.

See also liability/safety and in a more limited set of contexts, national security and children.

The people who really make me want to break out ye olden guillotine are the ones who'll spot the BS in one context but who's knee-jerk reaction is to take it right down the throat or even defend the BS without even a hint of critical thought in another. Have some self-awareness people.

Wow… Russia AND China… that’s like the axis of evil, dude!

Why would an oven need Internet access? You physically need to open the oven and put stuff in it and then take it out. Food over IP is not a thing yet.

Unless it has an internal camera with which you can observe the food while it's cooking, I see no advantage of using an Internet connected oven.

edit: okay, preheat, fair - that's actually useful

The electromagnetic radiation from the wi-fi antenna helps the food cook more quickly.

I'm against stuff like this and totally eschew even offline gadgets, but its not that hard to come up with some use cases.

After you left the house: "Did I turn off the oven? Did I turn off a burner (eg slowly cooking a bean bot)?" Now you can know.

Is a (top or interior or anywhere) burner slowly leaking and should alert the owner? Maybe.

And as you said, pre-heating, though this is actually a feature that makes things more dangerous! If you or someone else was temporarily storing something not-ovenable in the oven and pre-heated remotely, you could come home to something very bad.

I'd much rather have the oven connect to a physical device on my home LAN instead, which I could then access through a web interface with a tunneled port or whatever. Same with security cameras, smart lightbulbs, etc. None of this stuff should ever be connecting to the Internet directly.

You could add a camera to the oven to see what's inside from the app.

"How did that batch of cookies get in there?"

I wouldn't mind having "read-only" or "make-safe" functionality: in addition to "Did I turn off the oven?" above, things like timer and burner status would be nice.

A "Turn off oven NOW" button on an app would be an example of "make-safe". Worst case situation is that your dinner is undercooked.

Preheat, give warnings, etc.

All potentially lethal/flammable objects in your household would probably benefit from some kind of remote monitoring capability, assuming you can do that securely.

Maybe they're preparing for a ST:TNG future where you can use an app to tell your food replicator to make tea, Earl Grey, hot while you're arriving home.

Why would an oven need Internet access?

So Frigidaire, or whoever, can sell data about how and when you use your oven. Maybe this info will be used to show you ads for turkeys on your phone, or even on the oven if future versions have screens.

If one's life is such a blur that they can't wait the 20 min it takes to preheat the oven, with the risks that comes with (is there something already in there that you don't know about, like a flammable cleanser, etc.) then I dunno. I think they can find other things in their lives much more useful.

Not to mention most ovens have the ability to schedule pre-heating your oven to a set temp at a later time just using the oven controls.

Who buys such data and why I wonder.

> "Oh no did I leave the oven!?"

Opens app.. "whoops I did, toggle off"

> "Oh I'll have to cook soon"

Opens app.. "start preheating to x degrees, notify when ready"

> "Oh how long do I have left on my roast?

Opens app... "ok cool 30 minutes, I'll continue my workout."

I mean... putting the food in is only one short step in the very long process of an oven.

Give phone to child to entertain them - come home to find out they have somehow turned the oven on hours ago.

OT- give a two year old child a device and watch them crash it just by jabbing their finger at it.

If you can only preheat and toggle off remotely that couldn't happen. The preheat could just auto turn off if you don't proceed.

They can also play with the oven at home too. You should teach them not to do those things.

If for some reason you can't teach them to use your phone responsibly then don't hand off your phone unsupervised.

All that being said, plenty of people don't have kids...

> watch them crash it just by jabbing their finger at it

"Organic fuzzing"

Not to mention, if you have a child at home, you can just call them to turn the oven on.

Where are these magical children that reliably obey commands at any time?

Interesting those are totally valid use cases but I would NEVER use those through a vendor specific app/cloud. Only locally connected to Home Assistant or something like that via MQTT or some other protocol. I wouldn't want someone from the outside turning my oven on or worse, start the super hot cleaning cycle when I don't expect it the same way I wouldn't want someone having control over my front door or garage.

not a internet thing, but some Jenn Air ovens had (and maybe still have) a "sabbath mode". Observant Jews would prepare their Saturday dinner, place it in the oven before sundown on Friday, then the oven would turn iself on sometime on Saturday afternoon to begin to cook the food so it would be ready at sundown on Saturday.

A similar use could be used for internet connectivity. not for people skirting sabbath rules, but someone that has the turkey in the oven but doesn't know when exactly they'll get home to eat, but want to start baking it while you're away. Not saying that is a likely of common need, but it could happen.

i have jenn air appliances and tried to connect to my dishwasher solely because i was curious as to why anyone would want their dishwasher to be connected to the internet. i could never get it to actually work, so i am still in the dark as to what i am missing out on in the world of internet connected dishwashers.

Many fancy ovens have temperature probes which relate to cooking profiles you can use as well. Being able to actually look at a glance how the roast is doing would be nice. Sure, one could also do this with another device, but having it all integrated is cool.

I spent last weekend moving my access point behind an opnsense firewall so that I can see what's happening. Things having wifi is grand...but needs to work locally.

I've also had one case already where it works locally (HA) but eventually the device hits a overflow issue if it can't resolve the phone home address.

My Siemens dishwasher is smart and it’s got a nice feature where from my phone I can set it to start or finish washing at a certain time.

Except, if there is a power failure it forgets the schedule. At the moment in South Africa we lose power 2-4 times a day for 2 hours at a time due to load shedding (useless government and power utility). This powerloss scenario is not a rare edge case here.

It’s a pity because I would like to schedule the dishwasher to start after the power is due back (the load shedding is on a mostly reliable schedule), but with this loss of memory, that doesn’t work.

Relatedly, on my oven (and the AEG one at my previous place) you can’t turn them on until you set the clock, as someone who lives where there are multiple power outages a day, this seems like the most counter productive “feature” ever, is it actually useful in some way?

If your dishwasher is simply idle until you schedule it, a small UPS may be able to do the job, as during a power outage it would just be powering the electronics and not anything else.

Unrelated, but it sounds like scheduled power outages is a great use case for a backup inverter for your home.

I actually do have an inverter and solar panels and I have my house divided into two circuits, essential and non-essential.

Non-essential loses power when grid is disconnected, essential is on UPS. I have 10kw/h of batteries, but I’ve set their minimum charge (while on grid) to 40%.

Things on my non-essential: - Geyser - Stove and Oven - Pool pump - Dishwasher - Under floor heating (which is on a timer to only run during sunlight hours).

I have been considering moving the dishwasher to the essential circuit, but if someone accidentally runs it when the grid is offline, it drains the batteries very fast.

What would actually be nice is if the dishwasher could out the box integrate with some sort of home automation system and it could then make decisions to stop it during power outage automatically.

This article got me thinking about the use of the term smart. I'm not sure why we call the every connected device smart. For the most part they're connected devices not smart devices. Smart to me means more than just being able to be controlled remotely. I think this is likely been pushed by marketing, but just because corporations say it's 'smart', does that mean we should all blindly start following suit.

On a bigger note, we probably do this blindly for lots of products and services, trust and use the terms we're sold by entities that are mostly only interested in one thing...

I'm as guilty as anyone, bit it would be good if we wised up to this stuff a bit more.

House fire as a service...

I started to write "surely the network connection can't control the temperature" but, ah, on second thoughts you're probably right. Expect it gives root access if asked sternly too.

My oven and refrigerator pump out RF beyond the range of my RF meter.

I found the wifi chips in both and pulled them out. There was no way to turn them off through the interface for either.

You know what's much worse? When I was playing with blocking shady countries via pfSense, I found that making a NVIDIA GeForce Now account uses .cn servers by default.

Why?

You can supposedly keep the internet alive with just this method of using your stove...

If you want more look up doomsday survival plan using stoves.

Yeah, an oven you can turn on remotely, I'm glad it's secure but that really should not be a thing, no no and no again.

Now the entire CCP knows I just burnt this souffle, my god!

Individually the vast majority of IOT data points will not be of any espionage value. But I'm sure intelligence agencies will be able to glean insight from the data in unexpected but still useful ways in aggregate.

Imagine being able to turn on all electric ovens at once in time of war. That already might be enough to cripple your enemy's electric grid.

Well, it would definitely be enough to cripple your exports because nobody would buy from you any more. You might want to re-calibrate your imagination.

It would be a bit late to demand a refund, wouldn't it? There are more incentives in this world than such a narrow profit-oriented view.

More likely all this IoT garbage gets recruited into a botnet for domestic DDoS/amplification attacks.

Those spies are going to know I burned the roast!

Tbh as American should I be more worried if my data is shared with some far away government agent who is probably pronouncing my name incorrectly or our domestic favourites NSA or FBI? I believe the current paranoia about China completely overshadows the real danger for american citizens, but maybe that is the intention.

Reply on news.ycombinator.com