Hacker News Reader

chmarson Bone marrow was kept in a Stone Age meat locker

Bone marrow, still in the bone and with Fleur de Sel, is one of my favorite dishes!

How do Americans think about bone marrow as a dish?

Our CRM works only with Mail.app and we cannot use G-Suite Mail directly. (Gmail support is a longtime issue with Mail.app, Apple still does not use the API …)

chmarson Bitwarden: Free, open-source password manager

In 1Password, you cannot share passwords at all …

(Sharing is useful if you set up new accounts for other users.)

chmarson macOS no longer allows changing wifi mac address

1/2 OT: The Apple Watch does not work with captive portals either. And since 4G does not work abroad, I can use my Apple Watch without my iPhone nearby only in my home country.

chmarson Harvesting LinkedIn data for fun and profit

Just four letters: GDPR. And anyway: Just because something is published only does mean that you can collect, store etc. it however you like. That is pretty basic in my opinion.

chmarson Quantum Air buys Bye's electric airplanes

In practice, 4 hours of endurance give you around 2.5 to 3 hours of actual flight. You must plan for an alternate and with Reserve fuel. And you might not get all the clearances you expect.

Charging will take in any case much longer than refueling.

chmarson The Mystery of Why Gas Pump Interface Design Sucks So Badly

Diesel instead of gasoline is almost impossible because the filler necks are different – at least where I live … Gasoline instead of diesel, however, is still possible.

chmarson “Carpe Diem” Got Lost in Translation

You are right:

https://de.wikipedia.org/wiki/Carpe_diem

chmarson The Celera 500L aircraft may fly soon

Getting there … Especially if you are slow, you are causing issues for air traffic control.

Another issue is the survivability of incidents. If something goes wrong, for example with your pressure cabin or your oxygen supply, you have only seconds to start your mitigation measures.

chmarson Why aren’t more companies remote-first?

How do you deal with the various legal issues, mainly local labor laws, local tax obligations and local social security insurance systems?

chmarson Why aren’t more companies remote-first?

That’s correct, however, it is a one-stop shop instead of becoming a local employer. It can be tricky though because contractors without their own legal entity can be qualified as employees in many countries, especially if they have only one client or only a few clients.

chmarson Password expiration is dead, long live passwords

Most users with TOTP assume that TOTP is bound to their app (often Google Authenticator without a backup option / migration path AFAIK). Technically, you are of course fully correct.

chmarson Block Fingerprinting with Firefox

Do you have a suggestion for a good alternative?

I dislike Google reCAPTCHA, however, it brought down contact form and comment spam to almost zero. (With the price of an unknown number of false positives and some frustrated users.)

chmarson ProtonMail Voluntarily Offers Assistance for Real-Time Surveillance?

I have bad news for you:

Switzerland is a close US ally. It is even a second-tier partner to the NSA as we know from the Snowden leaks:

https://www.elmundo.es/espana/2013/10/30/5270985d63fd3d7d778...

Geneva, the home of ProtonMail, is a major international spy hub thanks to the UN. Snowden was even working in Geneva for some time.

chmarson ProtonMail Voluntarily Offers Assistance for Real-Time Surveillance?

My own definition does not matter. Swiss law matters:

'The order may require real-time surveillance to be carried out and the handover of the retained secondary data of telecommunications from past communications (retroactive surveillance).'

https://www.admin.ch/opc/en/classified-compilation/20122728/...

chmarson ProtonMail Voluntarily Offers Assistance for Real-Time Surveillance?

There is no need for a conspiracy. The Swiss surveillance state is a fact. It is also a fact that the relevant laws were recently updated with a focus on services like ProtonMail.

We are not talking about a public televised event. We are talking about a statement during a presentation. It happens all time time: People talk, sometimes they talk too much.

chmarson ProtonMail Voluntarily Offers Assistance for Real-Time Surveillance?

In a nutshell: No data retention (yet) but real-time surveillance of metadata.

chmarson ProtonMail Voluntarily Offers Assistance for Real-Time Surveillance?

My own definition does not matter. Swiss law matters:

'The order may require real-time surveillance to be carried out and the handover of the retained secondary data of telecommunications from past communications (retroactive surveillance).'

https://www.admin.ch/opc/en/classified-compilation/20122728/...

The question is not whether ProtonMail has access to user data. (They have, you are absolutely right.) They question is if they perform real-time surveillance, i.e., lawful surveillance (whether voluntarily or not).

chmarson ProtonMail Voluntarily Offers Assistance for Real-Time Surveillance?

Source in Swiss law?

'By default' is of course legalese. If a user can turn on the IP logging feature, you can too. And you did in at least one case according to your own transparency report:

'In April 2019, at the request of the Swiss judiciary in a case of clear criminal conduct, we enabled IP logging against a specific user account which is engaged in illegal activities which contravene Swiss law. Pursuant to Swiss law, the user in question will also be notified and afforded the opportunity to defend against this in court before the data can be used in criminal proceedings.'

https://protonmail.com/blog/transparency-report/

chmarson ProtonMail Voluntarily Offers Assistance for Real-Time Surveillance?

Isn't it more likely that the state prosecutor spilled the beans?

The statement even matches your own transparency report where you describe a case of IP logging, a typical real-time surveillance measure:

https://protonmail.com/blog/transparency-report/

(You mention April 2019, the statement by the state prosecutor was made at the beginning of May, i.e., he was probably really happy about your cooperation.)

chmarson ProtonMail Voluntarily Offers Assistance for Real-Time Surveillance?

Please answer one simple question: Do you perform real-time surveillance of users? Yes or no?

chmarson ProtonMail Voluntarily Offers Assistance for Real-Time Surveillance?

Source in Swiss law?

chmarson ProtonMail Voluntarily Offers Assistance for Real-Time Surveillance?

Switzerland is a member of SWIFT. There is also a data center in Switzerland according to Wikipedia:

https://en.wikipedia.org/wiki/Society_for_Worldwide_Interban...

chmarson ProtonMail Voluntarily Offers Assistance for Real-Time Surveillance?

You 'forgot' to copy the full addendum. It reads as follows:

'Public prosecutor Walder of the Competence Center Cybercrime contacted me, saying he had been misquoted. He claims that had not divulged at the above-mentioned event that ProtonMail voluntarily releases real-time data. He had merely described ProtonMail as a potential provider of derived communication services (PDCS).

I was live-tweeting the event, including the interesting presentation by public prosecutor Walder. The remark that ProtonMail was a (potential) PDCS would have been too trivial to be live-tweeted. The insight on the other hand that ProtonMail voluntarily offers assistance for real-time surveillance, was spectacular and I therefore live-tweeted the statement. In its transparency report, ProtonMail – as mentioned above – itself refers to at least one case of real-time surveillance.'

https://steigerlegal.ch/2019/05/23/protonmail-real-time-surv...

Important: The English text is just an unofficial translation.

chmarson Notifying administrators about unhashed password storage

Same here: One user!

chmarson Security lapse exposed a Chinese smart city surveillance system

Neither the Snowden leaks. In many countries, the became the blueprint for new security laws …

chmarson Show HN: CC Search – search engine for 300M CC-licensed images

@kgodey: Your default HTML source code includes CC icons loaded from creativecommons.org. That is a problem:

1. It results in tracking and could violate the GDPR and other data privacy laws.

2. It is third-party content and might get blocked by ad / content blockers.

I suggest to offer a default HTML source code without CC icons.

chmarson Apple: Rotate tracking IDs on iPhone each month

https://techcrunch.com/2019/02/06/iphone-session-replay-scre...

Same for websites. It makes sense for development, however, it remains turned on in most apps. And at least under iOS, there is no actual ad / tracking blocking available for, well, against apps.

chmarson Refused U.S. visa eight times, Zoom CEO is now a billionaire

I am a heavy Zoom video conference user but I had no idea about Slack-like chat features. Thank you!

chmarson Apple: Rotate tracking IDs on iPhone each month

Scummier tactics are still used. The tracking and surveillance density of a typical iOS app – including screen recording – is shocking.