arkem

Google fights against subpoenas and warrants all the time but sometimes they lose. At that point they have to comply or be held in contempt and I can't really blame Google for complying in that situation.

With many thousands of engineers it is totally possible for bad actors to have infiltrated Google. It's one of the reasons why there are such strict protocols for accessing customer data or production hardware. The idea is that by default no one has access to anything and that all accesses to data and production hardware are logged and audited.

I'm sure there're still opportunities for a rogue employee to do something bad but Google are way better at protecting access to their customer's data than many of the companies I've seen.

If you're asking whether I was the director of my agency or the CEO of Google then the answer is no. I have also not worked for the Government in about 6 years or Google in 4 years so maybe everything changed the moment I left.

However, I was an Assistant Director (which is a senior tech / middle management kind of level) at first an intelligence agency, and then at a similar grade in a law enforcement organization and then later a security engineer at Google.

The idea that an intelligence agency (or law enforcement agency) would ask Google for help isn't far fetched, in fact when I was in law enforcement we'd ask private companies for help all the time. Some of the time they'd help, the rest of the time they tell us to come back with a warrant.

Google was famously in the second category, to the point where we'd not even bother asking. Even if we had a warrant we'd hesitate because we'd expect Google to challenge the warrant in court and it'd be a huge expensive hassle.

When I worked at Google it was the same, the idea of sharing private information with anyone was anathema. Engineers even being able to see private information without an audit trail and alarms going off was next to impossible.

The idea of a secret extra-legal conduit of information from Google to the US Government seems so far fetched to me that I have trouble even considering it. If there is a conduit for information it's there because the US Government has some legal instrument to compel Google to create it and that Google grudgingly has accepted the instrument as valid.

But what do I know, like I said, I wasn't the CEO of Google or DIRNSA. Maybe I just was never in the right rooms or policy meetings? Maybe everything I saw was staged for my benefit.

As someone who has worked for a five eyes intelligence agency and at Google I can tell you that Google does not share sensitive data with the Government unless compelled to do so by law.

I'm not particularly worried, Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data.

The amount of convenience I get from Facebook and Google outweigh the risk I'm exposed to in my opinion.

If Governments want to create data protection regulations I'll save my opinion until I see whatever regulation is proposed but I think it'll be difficult to create data protection regulation that is effective at protecting people without imposing a large expensive burden on companies.

I haven't lived in WA for a while now but I always thought of the RAC as kind of a default roadside assistance and insurance provider.

There are plenty of other providers and with a little effort I can recall some of their names but when thinking about car insurance RAC springs to mind immediately.

Last time I lived in Australia I owned an electric bike and not a car and it was great. I would rent a car maybe once or twice a year for a long road trip but would otherwise just stick to my bike.

Can you provide me with a pointer to more information about this?

It seems pretty extraordinary and I'd like to see more before I believe it.

I think calling this a ban on end-to-end encryption is an mis-characterization.

According to the press conference where this comes from[1] it seems that they're talking about legislation that would expand the Telecommunications Act's provisions to require communications providers to assist law enforcement[2] to cover internet messaging platforms.

This doesn't necessarily mean that Facebook would be obligated to backdoor their encryption or store a keys for all communications or change the architecture of their platform. They would be obligated to comply with interception warrants to the best of their ability.

Forms that this assistance could take (from the act):

  (7)  A reference in this section to giving help includes a reference to giving help by way of:

    (a)  the provision of interception services, including services in executing an interception warrant under the Telecommunications (Interception and Access) Act 1979 ; or

    (b)  giving effect to a stored communications warrant under that Act; or

    (c)  providing relevant information about:

      (i)  any communication that is lawfully intercepted under such an interception warrant; or

      (ii)  any communication that is lawfully accessed under such a stored communications warrant; or

    (ca)  complying with a domestic preservation notice or a foreign preservation notice that is in force under Part 3-1A of that Act; or

    (d)  giving effect to authorisations under Division 3 or 4 of Part 4-1 of that Act; or

    (e)  disclosing information or a document in accordance with section 280 of this Act. 

I prefer to see law enforcement have broad authorizations but limited special powers (i.e. they're allowed to do a lot of things in pursuit of an investigation but they don't have many ways to compel assistance) but I think this story is overblown (largely because Turnbull's quote out of context is pretty funny).

[1] http://www.pm.gov.au/media/2017-07-14/press-conference-attor...

[2] http://www.austlii.edu.au/au/legis/cth/consol_act/ta1997214/...

I successfully went from E3 to Green Card without getting a H1B first.

It's a more annoying path (there was a ~6 month period in which I couldn't leave the US) and riskier (more ways to end up rejected). That said the H1B route would have taken significantly longer even if I won the lottery.

The way the article is written makes it clear that it's talking about market capitalization (since the first sentence mentions the Hong Kong stock exchange).

When talking about public companies it is accepted practice to shorthand market cap movement as "gains" or "losses" and the way this is generally disambiguated from earnings is through a reference to the exchange or a particular earnings report.

Which options are more convenient? I'm always looking for something better.

What do you mean about distributing passwords in plaintext? Can you be more specific for me?

It's not the pareto frontier of security, it's the pareto frontier of security versus convenience. It's not exactly a "thing", it's just a mental model I use for thinking about security trade-offs.

I have a security background and I've found (minor) security bugs in lastpass before and yet I still use it.

I use lastpass because it is safer than what I was doing before using a password manager and most inconvenience I'm willing to put up with for my day to day computing.

I like to think of it as a convenience vs security chart of password schemes and for me lastpass is on the pareto frontier of it and happens to be the most convenient option on that frontier.

My guess is it's because Google's security team is top notch and happy to share their threat intel with their users and that's much more relevant to journalists than using a non-US based service or one that avoids content based ad serving.

and two other times even more recently:

https://news.ycombinator.com/item?id=13425159

https://news.ycombinator.com/item?id=10661581

I know a few people who went TN to green card, and I myself went E-3 (a non-immigrant visa) to green card. It made the process more convoluted and risky but in my mind was way better than playing the H1-B lottery.

It'd probably be eligible for a design patent or trade dress protection.

Maybe things have changed in recent years but here's some information on what I considered benchmark prices when I was more involved in this kind of thing. I have some background in vulnerability selling and I used to do this for a living (first government, then later tech company bug bounty programs).

The "grey market" prices I've seen (~5 years ago now) from independent researchers, small firms specializing in vulndev for law enforcement / intelligence and the bigger famous security firms go something like this ("black market" criminal markets are similar I hear but I have no first hand knowledge there):

250k would get you a iOS jailbreak (for a recent iOS version)

100k would get you an IE/Firefox/Chrome zero day (though not with a sanbox escape, you'd have to pay separately for a privesc)

~25k for a Linux privesc

For an RCEs in medium popularity services (databases, ftp servers, etc) you'd be looking at something like 10k (or often thrown in free with a bigger purchase or support contract as a good will gesture).

The prices would also change based on the quality of the exploit, how recent the version the exploit targeted was, the amount of exclusivity you want (more for full exclusivity) and whether the research was specially commissioned (if you had asked a firm to look into a specific piece of software the price would be higher). The larger providers also encouraged organizations to sign subscription deals and longer term service contracts that could include free exploits or reduced costs.

That said, there's a lot of information asymmetry in the market so I'd expect a lot of variance in prices.

I don't agree that this could have been easily monetized.

This vulnerability only allows you to intercept future incoming emails that are delivered to sendgrid domains. Even if it did allow access to all of their customers internal emails there aren't many buyers (and no obvious marketplaces) out there for that kind of access.

The risk is simply too high, if you're Lyft (for example) being caught with that access (even if it was never used) would be a possible terminal event for the company. Purchasers would be buying a giant liability and a small competitive advantage.

Maybe there are shady companies or criminal groups who would be interested in the access but even then I feel $10k would be roughly how much money they'd be willing to spend (considering the same amount of money could also buy thousands of verified credit cards or a million email addresses at legitimate providers).

I think it's hard to monetize most bug bounty bugs.

There isn't really a market for most XSS, CSRF or even RCEs bugs for web properties. Getting the bounty payout for a bug from the owner is often the best deal available. I think the only exception to the no-market situation is browser RCEs and smart phone OS jailbreaks.

I don't think it's very charitable to imply that the parent only holds their opinion due to their assumed economic status.

Citi and Bank of America both seem to offer temporary credit card numbers for their customers.

https://www.cardbenefits.citi.com/Products/Virtual-Account-N...

https://www.bankofamerica.com/privacy/accounts-cards/shopsaf...

The analogy that's sometimes used is that of a safe full of documents. Current case law says that you can be compelled to turn over a key but cannot be compelled to turn over a password [1].

The Department of Justice is saying that a fingerprint is more like a key than a password I guess. Or alternatively that unlocking phones is search and not testimony.

The EFF seems to be primarily objecting on the grounds that a search of "all devices in the building" is too vague to be a correct warrant.

[1] http://www.uclalawreview.org/the-fifth-amendment-encryption-...

This exists, it's not 100% effective because it's generally implemented as a UI flow change where less trusted binaries get scarier "are you sure?" popups and only the most obviously malicious files are blocked.

Edge has Microsoft SmartScreen[1], Chrome has CAMP[2] / Safe Browsing and Firefox has a system that also uses Google's data[3].

[1] https://technet.microsoft.com/en-us/itpro/microsoft-edge/sec...

[2] https://www.cs.jhu.edu/~moheeb/aburajab-ndss-13.pdf

[3] https://wiki.mozilla.org/Security/Features/Application_Reput...

Edit: I missed that part where you were meant pro actively check against publisher provided signatures. The above systems do that only via looking at the code's embedded signature and indirectly via "wisdom of the crowds" style reputation.

Google is an advertising company, but is it also a product company?

Is Apple also an advertising company?

How about the local minor league hockey team? Are they an advertising company?

Google is an advertising company.

Is Apple an advertising company? Why or why not?

Is Rooster Teeth (one of my favorite creator groups) an advertising company? They make a large percentage of their revenue from selling advertising but they also make video content.

Of course, I'm not saying that Google isn't an advertising company.

If Apple made 50% of its revenue from adverting would it still be a product company?

Is this distinction about the size of the business unit?

What makes Google an advertising company and Apple a product company? Since both make products and sell advertising.

Obviously advertising is more important to Google than it is to Apple but at what point does Apple become an advertising company and Google a product company? Is there a revenue threshold? A branding threshold?

Edit: I'm not saying Google isn't an advertising company. I'm asking what makes Google (but not Apple) an advertising company.

A company I worked for did the same, they raised some money and used some of it to purchase a portion of the employees' vested equity. In other cases the company's major investors were willing to tender to purchase employee equity to increase their stake.

In this context the parent is probably referring to the Oculus Rift Development Kit 2 and the Oculus Rift Crystal Cove prototype (which was very similar)

As an aside, in Australia a car's turn indicator lights are commonly referred to as "blinkers".

Artillery is in testing at the moment and has landed a publishing deal with Tencent (along with an investment): http://blog.artillery.com/