Confiks

And out of nowhere, after posting this comment, Otter.ai now has responded after ghosting me for 3,5 weeks. They are no longer quoting the CCPA, but now are misinterpreting the GDPR and claim that every user is their own little GDPR data controller island and they're merely a "hosting platform". It's all very convenient and creative.

Their response:

    Thank you for reaching out to Otter.ai. Under Articles 12 and 17 of the GDPR, Otter.ai is able to delete personal data that is stored in and controlled by your own account. However, Otter.ai cannot delete personal data that is stored in another user’s account. In those cases, Otter.ai acts as the processor or hosting platform, and the other user is the controller for that content. As such, only that account holder has the authority to remove the content.

    If you wish to have such data deleted, we recommend that you contact the relevant user directly and exercise your rights under the GDPR with them.

    Thank you,
    Otter.ai Privacy Team

To which I responded:

    To whom am I speaking? Is this the Privacy Officer? Why have you been ignoring emails for 3,5 weeks since the 23rd of July, while a GDPR request was filed on the 8th of July?

    You know very well that a meeting agent of Otter.ai, the emails by Otter.ai and the website of Otter.ai fall under the direct responsibility of Otter.ai as data controller. Your privacy statement in no way supports a narrative that Otter.ai would act as a so called "hosting platform". It's preposterous to suggest that every one of your users – not being a company but a private person – would be it's own little GDPR data controller island and you're merely an accidental processor of data. Jurisprudence is very clear on this and this notion will be outright rejected.

    The deadline has long passed, I'm initiating a court procedure this week.

    Hoogachtend,

Their own privacy policy acknowledges their obligations under the GDPR.

A month ago a potential customer automatically included their Otter.ai meeting agent into a Teams call. The customer never turned up (he canceled the meeting somewhat later), but me and a colleague chatted a bit in the meeting. Then the Otter.ai meeting agent posted a link in the chat, from which it was clear that everything had been recorded, up to a complete video of the meeting with full facial imagery.

As I'm a European citizen, I filed a GDPR removal request with them to remove all images of me from their servers. The email address that they list in their privacy policy [1] for GDPR requests immediately bounces and tells you to reply from an Otter.ai account (which I don't have). I was able to fill in a contact form on their website and I did receive replies via email after that.

After a few emails back and forth, their position is that

> You will need to reach out to the conversation owner directly to request to have your information deleted/removed. Audio and screenshots created by the user are under the control of the user, not Otter.

> We are required by law to deny any request to delete personal information that may be contained within a recording or screenshot created by another user under the CCPA, Cal. Civil Code § 1798.145(k), which states in relevant part

> “The rights afforded to consumers and the obligations imposed on the business in this title shall not adversely affect the rights and freedoms of other natural persons. A verifiable consumer request…to delete a consumer’s personal information pursuant to Section 1798.105…shall not extend to personal information about the consumer that belongs to, or the business maintains on behalf of, another natural person…[A] business is under no legal obligation under this title or any other provision of law to take any action under this title in the event of a dispute between or among persons claiming rights to personal information in the business’ possession.”

Which is a ridiculous answer towards a European user, as the CCPA doesn't apply to me at all. Furthermore, I don't think the CCPA prohibits them at all in deleting my face from their servers, as the CCPA merely stipulates that I can't compel them under the CCPA. Otter.ai can perfectly decide this for themselves or be compelled under the GDPR to delete data, and their Terms and Conditions make it clear they may delete any user or data if they wish to do so.

After these emails, and me threatening to file a lawsuit, "Andrew" from "Otter.ai Support Team" promised to escalate the matter to his manager, but I got ghosted after that: they simply stopped replying.

So I'm going to file that lawsuit (a "verzoekschriftprocedure" under Dutch law) this week. It's going to be a very short complaint.

[1] https://otter.ai/privacy-policy

Perhaps "unfathomably" was too strong, but "any undergraduate" is at least very easy to falsify.

It's a very interesting solution that allows for multi-show unlinkability to be married to hardware binding using existing ECDSA hardware keys. It's not limited to age verification; it can be applied to arbitrary attributes.

It's also an unfathomably complex solution [1] which only a few people in the world will grok, and far more complex than existing solutions such as Idemix or BBS+, which lack such a hardware binding on existing hardware.

Age verification in a privacy preserving way is a really hot topic at the moment, but it will always be possible to bypass it – as will any commonly held anonymous boolean – in quite trivial ways. For example by setting up an open proxy to disclose genuine attributes. There are some privacy preserving mitigations, for example cryptography that'll make you linkable when disclosing more than k times per time period, or detecting slower-than-near-light-speed disclosure in a face-to-face disclosure scenario.

However, these mitigations will never be completely secure. That might not be a problem if it's admitted beforehand so expectations are correctly set: it's a barrier to protect the naïve, not an impenetrable fortress. However, if the expectations are that only age verification that cannot be bypassed is "adequate", we only have to wait for the first incidents in production apps after which the open source and privacy story will be abandoned in the name of security.

[1] https://eprint.iacr.org/2024/2010.pdf and https://eprint.iacr.org/2022/1608.pdf

It's even more important if this finding [1] (press release [2]) turns out to be true, namely that the amount of carbon dioxide in the air is not just a proxy for air quality, but that having less of it actually actively destabilizes virus particles.

Also, portable air cleaners seem to work pretty well [3].

[1] https://www.nature.com/articles/s41467-024-47777-5

[2] https://www.bristol.ac.uk/cabot/news/2024/virus.html

[3] https://www.sciencedirect.com/science/article/pii/S295036202...

It's not illegal, but unlawful for data controllers to process such personal data without free permission. But in this case there's likely an exception in GDPR article 85, for "For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression" [1].

[1] https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_85

> Privacy Pass in fact doesn't make sense outside of an anonymizing transport

This kind of thinking is pervasive in the discussion of privacy enhancing technologies. It might not make sense against the most sophisticated attacker, but it lays the groundwork of a complex system that will be able to do so.

Allowing more users will provide herd privacy at the token generation phase. Searches being decoupled from user account primary key offers privacy in all kinds of scenario's, comparable with a browser private tab.

I've similarly been grasping at straws to find some way that makes the fatigue go away, at least a little (although not for myself). As doctors won't prescribe any medication off-label, I've mainly looked at other methods and nutritional supplements. Here's a list (which I've been meaning to braindump for a while now anyway):

- Like you already described, monitoring heart rate variability and associated 'body battery' with a smartwatch.

- Make a log of good and bad days, note the specific symptoms. See if there are any patterns to be found that you perhaps wouldn't notice otherwise.

- Read up about POTS / orthostatic intolerance and dysautonomia in general. The book / guide "The Dysautonomia Project" is a great read. Do a simple standing test [1] a few times (when you're feeling good and bad) to see if your heart rate increases and keeps increased, even if it does not meet the criteria for POTS.

- Do breathing exercises, humming / vocalization, ear massages and meditation to activate your vagus nerve. That might help with dysautonomia. There are lots of videos / guides to be found.

- Increase salt intake if that is not a risk factor for you. That might help with orthostatic intolerance. Find a good balance of different salts in the CFS community.

- Keep light walking and (if you can) light strength training as much as you can without triggering too much PEM.

- Be outdoors in the sunlight. There are many small studies showing a correlation between getting better from CFS and sunlight. An infrared lamp might help a bit as well, but don't buy into the fancy fads. I personally prefer a simple infrared bulb because of the warmth it gives which is great in winter on its own. It's also more similar to the sun with a continuous spectrum (although relatively low intensity). Many studies emphasize illuminating your brain.

- Be aware that food supplements will probably not help too much and cost quite a bit. But you might get lucky and find something that helps. It's hard to separate correlation from causation though. It might also feel rewarding that you're busy trying something. The placebo effect might help similarly.

- Get your ferritin levels checked, and a some other basic tests around CFS as well. See if your ferritin level has been recorded in the past as a baseline, because the one-level-fits-all approach is flawed (and especially for women). 15 (women) or 30 (men) µg / L is probably too low, even if that's considered 'normal'. Lactoferrin might help your body regulate iron levels and keep pathogens from using iron, but the scientific evidence is pretty weak.

- In case of deficiencies supplement with amino acid or organically bound metals, for example iron bisglycinate. Something like Thorne Basic Prenatal at 1/3 or the recommended dosage (1 pill per day) is quite cheap with many nutrients that might help a bit in a form that absorbs well.

- Creatine is widely used in sporting performance enhancement by facilitating ATP recyling and acting as buffer. Because it's so widely used it seems very low-risk and applicable to CFS. There are some very small scale studies reporting positive effects.

- Other things that are doubtful to help, but perhaps worth trying: wide spectrum probiotics, NAD+, D-ribose, nattokinase / lumbrokinase (but be careful and use a small dose), NAC, ALC.

[1] https://www.standinguptopots.org/resources/diagnosing-pots

Same. Including weird audio clicks during supposed 'sleep' (already happend during heavy load while awake). Then one day this summer it just died without any recourse.

Try logging in with the game client from twenty years ago, which is the equivalent here.

That would make the quote true, or at least for early produced models. However, in guides created two months after the release of the Oculus Go, it was was already necessary to create an account: "before you can put your device in Developer Mode, you need to have created (or belong to) a developer organization on the Oculus Dashboard" [1].

[1] https://www.youtube.com/watch?v=tQQDyC2I0R0

> Yeah and the go isn't really an interesting product anyway.

It's a basic, relatively inexpensive model that was sold widely with over 2 million units until July 2019 [1] and continued to sell for 20% of Meta VR until it was discontinued in 2020.

It still carries about a third of it's inflation adjusted 2018 introduction price on the second hand market, and was a logical product to buy in sets of 10-30 for applications like education, science and parties. As Meta stopped "accepting new Go apps and app updates after Dec. 4, 2020." [2], those sets already became obsolete for new applications using the regular developer tools.

A few months ago, some users wrote on Reddit that "90% of my apps stopped working" because Meta "shutdown the entitlement check server" [3], but that seems to have been fixed despite ending support. Sideloading works like you would expect [4] from Android after you've enabled developer mode (which I haven't tried).

Two people on Github managed to run CM 14.1 on the Oculus Go and published the device tree [5]. There doesn't seem to be much interest and it's a rough build for me. The readme claims that everything works, but I'm skeptical.

[1] https://www.cnbc.com/2019/07/12/facebook-oculus-will-never-b...

[2] https://www.cnbc.com/2020/06/23/facebook-to-end-oculus-go-vr...

[3] https://www.reddit.com/r/OculusGo/comments/1csvj8j/90_of_my_...

[4] https://vault.gearvr.net/

[5] https://github.com/AndroidDevice-Porting/android_device_ocul...

> Turns out that the quote isn't true at all

To be clear (too late to edit): the latter part of the quote.

> Would you be able to do it with a fake account

Of course, although it also requires a setting up a 'fake' phone number. I just don't want to touch the Meta ToS – as I haven't for more than a decade – even with a ten-meter anonymous pole.

A better solution would be to ask a friend to activate it, but I haven't because there were other yaks to be shaved.

> it seems harsh to say “isn’t true at all”

You cannot activate an Oculus Go today and "randomly" discover the same activated "shrink wrapped headset twenty years from now". I'm just trying to correct the record, as AFAIK the news stories about this have been undisputed since 2021. It's a fantastic achievement that the bootloader can be unlocked at all, and I certainly hope that it will set a precedent (but I won't be holding my breath).

On an unrelated note, in 2021 Carmack and Meta announced [1] unlocking the Oculus Go bootloader, explicitly mentioning that it "opens up the ability to repurpose the hardware for more things today, and means that a randomly discovered shrink wrapped headset twenty years from now will be able to update to the final software version" [2].

I thought that was great, wanted to hack [3] on it a bit, so I went ahead and bought an Oculus Go on the second hand market. Turns out that the quote isn't true at all [4]. Updating the firmware requires enabling developer mode [5]. Enabling developer mode requires activating the Oculus Go with a Meta or Oculus account [6]. I don't have or want to have a Meta-related account, and in twenty years the online activation process likely won't work at all, making Carmack's shrink-wrapped headset useless without a fight.

I'm sure the point is moot in twenty years because you'll just ask Skynet to write you an Android root exploit, but right know my second hand Oculus Go is surely acting like a brick in my drawer.

[1] https://www.theverge.com/2021/9/27/22696030/oculus-go-root-a...

[2] https://xcancel.com/ID_AA_Carmack/status/1441496416463904768

[3] https://github.com/AndroidDevice-Porting/android_device_ocul...

[4] Although at first I couldn't believe this and assumed I must be doing something wrong instead. I'm still not ruling out that possibility; I would very much like to hear a solution.

[5] https://developer.oculus.com/blog/unlocking-oculus-go/

[6] https://ez-360.com/knowledge-base/how-to-enable-developer-mo...

A project I contributed tried to use this, but eventually switched to pdfkit [1] for better PDF accessibility support and smaller files [2].

[1] https://github.com/foliojs/pdfkit

[2] https://github.com/minvws/nl-covid19-coronacheck-web-pdf-too...

> Undisclosed (...) Vulnerability

RFC 7258 - Pervasive Monitoring Is an Attack was published in 2014 [1]

[1] https://datatracker.ietf.org/doc/html/rfc7258

Many commenters point out that Bluetooth MAC address randomization on phones mitigates most of the privacy risk, but forget that most other devices – even including the pressure sensor in you new car's tires – use a static address that allows you to be tracked.

Please be aware that Microsoft bundles news from MSN with Windows, and will show trash articles like the one submitted here to a very large part of the population. Including students of all ages who must use a managed laptop from their school, and cannot disable this because Microsoft has for a long time made it impossible for them to do so [1].

It's completely distracting and frankly dystopian.

[1] https://www.windowscentral.com/software-apps/windows-11/micr...

> For single-serve coffee (...) and uses standard #4 filters

Automated machine here [1] (except putting the filter in, and coffee and water every ten cups). Seems to be the only one of its kind as far as I'm aware.

[1] https://severin.com/en-en/coffee/coffee-maker-coffee/coffee-...

Indeed. Comma.ai [1] does this [2] in a very open way. Including eye-tracking (which doesn't work for everyone yet apparently [3]).

Unfortunately existing manufacturers are unlikely to implement this in a local-first way.

[1] https://comma.ai

[2] https://github.com/commaai/openpilot/blob/master/selfdrive/m...

[3] https://github.com/commaai/openpilot/issues/2436

The headline is completely speculative. The meat of the article is "A survey by Business New Zealand and Southern Cross Health found sick days hit a record high in 2022" and "Auckland University immunologist Anna Brooks said (...) we still don't know the broad spectrum impacts of [a novel virus infection]", which is very weak.

Fixing the TPM is hard because taping out semiconductors at scale is not yet facile [1] and there's also still a proprietary PDK in the way of 'traditional' manufacturing [2]. The article submarines [3], which looks very interesting. I do wonder how the Lattice iCE40 will fare under fault injection and just how many grams of epoxy you'll need to stick to it.

[1] https://atomicsemi.com/

[2] https://www.bunniestudios.com/blog/?p=6606

[3] https://github.com/tillitis

Bought the book last week, it's beautiful! Would anyone have any recommendations for other books that can offer deep insight into technology but also just can be leafed and skimmed through, perhaps part of a small library collection? I bought (a Dutch version of) "The Way Things Work", as well as "A Cat's Guide To Internet Freedom" and "Grokking Algorithms".

Was your case publicized? [1] looks quite similar but is a case from two years earlier. Similar procedure?

[1] https://www.sciencedirect.com/science/article/pii/S000649712...

ICTU for the Dutch Ministry of the Interior | Software engineer (authentication, open source, Rust) | https://github.com/MinBZK/nl-wallet | REMOTE NL (1 day onsite) | Full-time freelance

Under the Working Agenda Value Driven Digitization, the Dutch government is preparing for the introduction of European digital identity wallets through the revision of the eIDAS-regulation. One of the ways in which they are doing this, is by developing a public reference wallet called the NL Wallet. These ID-wallets will be mobile apps that citizens can use to identify (or 'log in') to public and private online services, share data about themselves, and sign electronically. The first version of the NL Wallet will focus on online identification and data sharing and will be piloted at small scale in 2024.

We're looking for a experienced software developer with experience in Rust, to work on the implementation of authentication protocols such as OpenID4VC, ISO mdoc/mDL, OIDC, or similar. You will work on a Rust library that can be integrated into mobile apps as well as backend code.

You are the suitable candidate due to your personality, knowledge, skills, and experience, including:

- Experience in developing applications in Rust.

- Experience with cryptography, PKI, digital signatures, digital identity (SSI), and/or authentication functionality.

- Experience with mobile platform development, language bindings, Unix toolset.

- You are decisive, creative, analytical, able to justify choices and thrive in complex environments.

- You have good communication skills, both verbal and written in English and preferably but not necessarily in Dutch. You can engage in constructive discussions with users, stakeholders, and team members. You know when it's time for a cup of coffee or tea.

- You have an affinity for the applied methods and techniques, but you are also open to learning and mastering new things/technologies. You have a solution-oriented mindset and act with a high degree of autonomy.

Applications can be done through [1] [2] or informally through the email address listed in my HN profile [3]. Dutch language skills are preferred but not required. For more information about the architecture and design considerations, please see the documents listed under [4].

If you have any questions, please get in touch with me.

[1] https://hinttech.com/vacature/i23257-wallet-rust-developer-3...

[2] https://between.com/opdrachten/stichting-ictu-bt/wallet-rust...

[3] https://news.ycombinator.com/user?id=Confiks

[4] https://edi.pleio.nl/news/view/93f40956-3671-49c9-9c82-2dab6...

The wording could have been better (and the whole private beta thing as well).

For what it's worth, the protocol and data model is open and designed for redistribution [1], and the event stream of messages is freely available without login [2]. It's quite similar to Secure Scuttlebutt (which has the most beautiful protocol guide itself [3]) including the disadvantages that come with radical publication – for example described in this 2018 pre-LLM Facebook v. Cambridge Analytica-era comment [4].

[1] https://atproto.com/specs/data-model

[2] https://firesky.tv/

[3] https://ssbc.github.io/scuttlebutt-protocol-guide

[4] https://news.ycombinator.com/item?id=16877892

Boots in 5 minutes, minimum allocation of 24 hours, is "low stock" if you actually try to allocate one, and was recently "no stock". I'd be unsure if its actually available when you need it. They offered bare metal ARM some years ago and discontinued them (but I guess M1 hardware is a bit more reliable and/or popular enough [1]).

Would be nice to see a Virtualization.Framework as a service, such as with Tart / Orchard [1], but perhaps there are performance and security issues when making those M1s multi-tenant. The license limits it to a maximum of two guest systems anyway, and only for the purposes of software development and testing [2].

[1] https://www.theregister.com/2020/04/21/scaleway_arm64_cloud_...

[2] https://github.com/cirruslabs/tart/

[3] https://www.apple.com/legal/sla/docs/macOSVentura.pdf#page=2 (2B iii)