declan

This is not the first time such a law has been proposed. In 1997, a House of Representatives committee approved a ban on domestic encryption without backdoors for .gov access. Here's an excerpt from the SAFE Act, as it was called back then:

`Whoever, after January 31, 2000, sells in interstate or foreign commerce any encryption product that does not include features or functions permitting duly authorized persons immediate access to plaintext or immediate decryption capabilities shall be imprisoned for not more than 5 years, fined under this title, or both...

After January 31, 2000, it shall be unlawful for any person to manufacture for distribution, distribute, or import encryption products intended for sale or use in the United States, unless that product [...] permits immediate decryption of the encrypted data, including communications, upon the receipt of decryption information by an authorized party in possession of a facially valid order [and] allows the decryption of encrypted data, including communications, without the knowledge or cooperation of the person being investigated... http://thomas.loc.gov/cgi-bin/cpquery/T?&report=hr108p4&dbna...

Think of how that would have affected Linux (Android uses dm-crypt for FDE), open source, Github, etc.

That 1997 bill is remarkably similar to what the FBI and its law enforcement allies, including the district attorney quoted in the linked article, want today. And remember that bill was not theoretical. It was approved and sent to the House floor for a vote -- and was defeated only because of a hastily-assembled alliance of tech firms and privacy groups.

I disclosed in a 2012 article for CNET, before I left to found http://recent.io/, that FBI general counsel's office has drafted related legislation mandating backdoors even before the current flap over Android and iOS FDE.

"If you create a service, product, or app that allows a user to communicate, you get the privilege of adding that extra coding," an industry representative who has reviewed the FBI's draft legislation told CNET. http://www.cnet.com/news/fbi-we-need-wiretap-ready-web-sites...

HN readers may want to pay attention...

If you send bogus DMCA takedown notices, and this qualifies as one, there can be legal consequences. The DMCA requires:

"A statement that the information in the notification is accurate, and under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed."

Whoops! This particular list of "infringing" URLs wasn't actually, well, accurate. The problem for whoever sent this bogus takedown (Wicked Pictures or its agent) is that now they can be held liable.

In a case brought by EFF in response to an earlier bogus takedown from Diebold, a federal judge in California held that Diebold could be "liable for damages" -- even though Diebold had by that point withdrawn the takedown request and promised not to send another.

DMCA 512 section (f) says that someone sending bogus takedowns "shall be liable for any damages, including costs and attorneys’ fees..." In the Diebold case, Diebold eventually paid EFF something like $125K in lawyer fees.

Note that this situation probably won't get that far. That's because the DMCA doesn't require Google or any other provider to comply with bogus takedown notices. And Google happens to have some smart attorneys (at least one ex-EFF lawyer, in fact) on its payroll who are well aware of that fact.

But there's no evidence that either of your assumptions is true. Gogo has said publicly[1] that they're trying to "shape bandwidth" to YouTube and other streaming sites. Let's not spread conspiracy theories about "national security" on HN when the truth about the NSA's domestic surveillance hijinks is disturbing enough.

I say this even though I've criticized Gogo[2] and suggested ways in which they may be legally liable as a result of their fake *.google.com cert.

For those who may not be familiar with his work, David Reed, the author of the linked post, helped with the early development of what would become the modern Internet. That includes UDP and IP signaling, which is one reason (I believe) he won an ACM hall of fame award.

[1] http://concourse.gogoair.com/technology/statement-gogo-regar...

[2] https://twitter.com/declanm/status/552365531798716417

>Don't they do peer reviews before publishing articles to the eyes of millions ?

No.

The closest journalism gets to peer review is fact-checking. I know of no newspaper or website that does formal fact-checking; the only times I recall being formally factchecked were when I've written for monthlies like Playboy, Wired magazine, etc. Here's a famous example of where fact-checking would have been useful: http://en.wikipedia.org/wiki/Stephen_Glass#The_New_Republic_...

At other news organizations there is, in theory, informal fact-checking. I've done that as an editor and reporter, and I've had that done to me by my editors and, more frequently, by the good folks working on copy desks. This is not necessarily a rigorous process, but it can flag more obvious problems, hyperlinks to the wrong web pages, information stated as fact that is no longer accurate, etc.

As <jonnathanson> points out nearby, some of these built-in safeguards have been eroded by the journalism crunch. Others have been removed by the perceived need to increase publishing speed. I know of one news organization that had 3-4 humans involved in reviewing a story circa 2002 before it could be published on the web. By 2010-2012, however, reporters were clicking the "publish" button in the CMS themselves for almost all stories -- and then sending a request to the copy desk for an edit after the story was live.

[Disclosure: I worked as a technology journalist, albeit one with a technical background, before leaving CNET/CBS last year to found http://recent.io/]

> I've seen a lot of claims that it's obvious that every one of us is being monitored. I've yet to see any evidence backing it up.

Huh? That was the first Snowden leak. I summarized it in this article for CNET at the time: http://www.cnet.com/news/nsa-secretly-vacuumed-up-verizon-ph...

TLDR: The leak was a copy of the secret FISA court order allowing the NSA to vacuum up pretty much every American's phone records, including local phone calls, "on an ongoing daily basis." I suspect that most people would view that as monitoring.

That's not counting the separate questions of bulk fiber taps (collect it all) and the Obama administration's secret AG opinion blessing warrantless bulk collection of encrypted communications (decrypt it later), which I wrote about here:

http://www.cnet.com/news/nsa-can-eavesdrop-on-americans-phon... "Another loophole is... "enciphered" data. Communications that contain "enciphered" data, which would likely include PGP but also could mean encrypted Web connections using SSL, may be kept indefinitely."

This is a good place to reference cypherpunk co-founder Tim May's email from 1992: http://www.activism.net/cypherpunk/crypto-anarchy.html

Took the world long enough to catch up.

I posted some thoughts on the law here: https://news.ycombinator.com/item?id=8789302

Service provider liability isn't exactly a new topic; it goes back to at least Cubby v. CompuServe in 1991 (note this is not necessarily the law today) and hundreds of law review articles and dozens of conferences have discussed the topic. You might also want to read DMCA Sec. 512: http://www.law.cornell.edu/uscode/text/17/512

>Should SONY's response been DMCA takedown notices?

This lawyer letter goes beyond what DMCA Sec. 512 allows. 512 authorizes requests for "removal of material" that is believed to be infringing; in this case, Sony is demanding suspension of Twitter users' accounts (which even Sony would likely concede are 99.999% non-infringing as measured by number of tweets). The letter also raises non-DMCA CFAA and state law claims.

> Does DMCA cover unpublished copyrighted work?

Yes. The DMCA covers "copyrighted work[s]," and publication is not necessary for copyright to attach. The longer emails likely meet the threshold for copyrightability and the screenplays, even unpublished, are the very definition of a copyrighted work. Note fair use still applies to copyrighted works.

> If the DMCA applies to trade secrets and personal email

The C in DMCA stands for "copyright." It doesn't apply to trade secrets.

David Boies, the lawyer who wrote this on behalf of Sony, is a very capable hired gun (he represented DOJ in its futile pursuit of Microsoft and plenty of other high-profile plaintiffs). Twitter is going to have to be careful in how it responds.

Remember news organizations have also reproduced excerpts from the Sony-hacked emails, and in some cases the entire correspondence. Note Sony hasn't threatened to sue them, at least so far. Also note Boies' letter could have been addressed to the individual Twitter users, who are actually the ones responsible for posting the material. It wasn't.

There are two obvious issues, as I see it. #1 is whether someone's liable for poking around inside the Kayak app in the way the author of the post did. #2 is whether it's legal to "open-source" the API by disclosing this information, once obtained.

My quick take is that #1 likely violates Kayak's terms of use for the app, its web site, or both. The TOU for the website has a host of prohibitions, including don't "bypass or circumvent other measures employed to prevent or limit access to Our Website," no deep-linking (such as a link to the API endpoint), and as a catchall also prohibits all inappropriate-as-defined-by-Kayak activity. I haven't read the app TOU, but it would be standard practice to prohibit reverse engineering of the app itself.

So we don't really need to reach point #2, which raises some 1A issues the first doesn't. (Note I'm excluding DMCA and CFAA issues because Kayak isn't our sue-happy friends at the MPAA or RIAA.)

As a practical matter, though, the author of the linked post, Shubhro Saha, appears to be an undergrad, so is probably judgment-proof and not the most likely target of litigation.

Update: Someone at the Tor project kind-of-answered my question about the expiration of the consensus interval a moment ago here:

"If four out of the 9 dir auths were compromised and taken offline, then the remaining 5 will continuing publishing the consensus and the network will continue operating normally. If more than 5 are taken offline then this was a horrendously large operation and the necessary corrective actions will be taken to ensure the network remains operational." https://blog.torproject.org/blog/possible-upcoming-attempts-...

This is a very big deal if it happens. Roger's linked post on the Tor site talks about "seizure" of directory authority servers; only government authorities would have that power. In the U.S. that would typically happens only after a court grants a seizure order, which would be under seal at this stage.

Of the countries where the servers are located, the U.S. has the most extreme copyright laws, which means, sadly, FedGov is the leading candidate to be behind any possible seizure.

It would be interesting if an enterprising journalist were to ask MIT, SF-based Applied Operations, and RiseUp if they've been contacted by law enforcement on this matter. Those organizations host some of the U.S.-based servers. RiseUp has a warrant canary but it hasn't been updated recently: https://help.riseup.net/en/canary

Of course we don't know what actually is going on and it all may be (I hope!) a false alarm.

PS: If multiple governments cooperate and a majority of servers are taken down, what happens to Tor after the consensus interval expires? I don't know; maybe someone more familiar with Tor does. The consensus interval was changed to 72 hours a few years ago: https://trac.torproject.org/projects/tor/ticket/7986

PPS: Remember that FedGov's "copyright infringing" domain name seizures have on occasion taken down non-infringing sites in error, as I wrote about here: http://www.cnet.com/news/dhs-abruptly-abandons-copyright-sei...

I'm not sure if the above comment is downvoted because of the Patriot Act claim, but that claim happens to be correct. I wrote about this for CNET here:

http://www.cnet.com/news/how-bin-laden-and-911-attacks-shape... "Long before 9/11, the U.S. Department of Justice drafted the so-called Enhancement of Privacy and Public Safety in Cyberspace Act (PDF), which goes by the awkward and not very memorable acronym of EPPSCA. In July 2000, the Clinton administration forwarded EPPSCA to Congress, where it was introduced by Sen. Patrick Leahy (D-Vt.) and met with a generally chilly response... EPPSCA was designed to give police more authority to conduct Internet surveillance, not thwart terrorists armed with box cutters... within hours of the 9/11 attacks, the Justice Department had dusted off EPPSCA as a way to respond to bin Laden. On September 13, 2001, two days after the worst terrorist attack in U.S. history, the U.S. Senate approved the "Combating Terrorism Act of 2001," which includes portions copied directly from EPPSCA."

As for the rest of the above comment, this is likely to be a fluid situation and I'm reserving judgment until we know more. It is possible that the good folks at Tor are wrong (I'd like them to be!) and no seizure happens. Government authorities sometimes bluff.

>Do Google Express customers have to provide their loyalty cards?

No. I order stuff from Target via Google Shopping Express multiple times a week without a loyalty card. I didn't even know Target had loyalty cards, in fact! Also if you're logged into your account you go go here and see what loyalty cards you can type in: https://www.google.com/shopping/express/#SettingsPlace:

The list includes Costco, REI, Staples, etc. but not Target.

In terms of the operating system and included apps, it's remarkably similar after over 26 years.

NeXTMail evolved into Apple Mail. Preview and Terminal retained their functions and their names. Digital Librarian (indexing specified files) was succeeded years later by Spotlight. Unfortunately we lost Digital Webster, a nice thing to have before the days of always-on Internet connections, which I think was linked to all apps via the command-equal-sign. Interface Builder survived. WebObjects survived. There was a TextEdit-precursor, but the very nice lightweight word processor WriteNow from a third party did not survive to be included in OS X.

The OS X Finder is recognizably similar to later versions, maybe >2.0?, of NeXT's Workspace Manager, with the primary navigation the same (albeit with the scroll bar on the bottom instead of the top and favorites on the top instead of the left). The original NeXT design was probably cleaner. And I still miss a dock that you can flick up and down.

I have a NeXT cube in my home office closet. I've turned it on in the last few years and it works, but the original 660MB hard drive -- a monstrosity for its time! -- has failed. :(

The article hangs a key portion of its "violating rules of the air" argument on the claim that using a GoPro or similar WiFi-enabled camera is necessarily unlawful.

That claim seems shaky: it's possible to disable WiFi on newer GoPro devices via the setting labeled "TURN OFF WIFI," and simply leave it passively attached in the cockpit without ever touching it in flight. And as <tjohns> pointed out, not all GoPro cameras have WiFi.

But pointing out that important point would have made it a less incendiary story.

Disclaimer: I'm a pilot, though not a commercial pilot, and have enjoyed taking aerial SLR photos when I'm not pilot in command. Here are some of San Francisco and Baltimore's inner harbor: http://www.mccullagh.org/db9/1ds-3/san-francisco-aerial-view... http://www.mccullagh.org/db9/1ds-3/baltimore-inner-harbor-ni...

I worked full-time as a journalist for a bunch of different news organizations before leaving to found the forthcoming http://recent.io/.

My suspicion is that neither I nor other journalists I know would use this newsclip.se tool. In a single newsroom I've seen people using Word, TextEdit, Google Docs, Notepad, BBEdit, Gmail, phone-based email clients, phone dictation, and even emacs (me, a few times) to write news articles. While the CMS is newsroom-wide, the writing and editing processes tend to be very personal. Journalists also tend to be individualistic and dislike being forced to use a standardized system without clear benefits.

Where something like newsclip.se might be beneficial would be as a kind of preprocessor/lint for the CMS. It could do a lot of what's being described in the linked article but without replacing the entire journalistic stack.

This is a serious drought, but remember 80% of California's water goes to agriculture. More water is used to grow almonds than for all of residential irrigation. There are more non-farmers than farmers in the state; if the drought continues I expect the next step will be to cut back more on agricultural uses.

In terms of desalination, my recollection is that it's a reasonably mature technology now, it's used in many parts of the world that are freshwater-constrained, and San Diego is building a 50M gallon/day desalination plant that will go online in a year or two. But the per-gallon price is largely determined by the price of electricity, and California is rather hostile to new power plants going in. (I don't know enough about the state's aquifers; perhaps others do.)

Meanwhile in a few generations we may look back and wonder why we were flooding fields in California half a foot deep with increasingly scarce water to grow rice in an extremely dry climate. Especially when rice grows perfectly well in areas of the world that actually, you know, get rain all year round.

This bill is flawed but worth your support anyway. It's flawed for at least three reasons:

* It doesn’t stop NSA from weakening security standards, bribing crypto vendors, or hacking into systems to insert backdoors. Even if a future law were to address that, a future president could instruct the NSA (part of the U.S. military, after all) to disregard it. We've all seen some recent examples of aggressive presidential action even in the non-military space where executive authority is weaker.

* Wyden's bill doesn't seem to apply to FedGov spending. So if a company wants that fat .gov/.mil $10 billion-dollar contract, well, it might feel obliged to discontinue that full-device encryption product. It surely makes sense to focus on other unencrypted product lines to support that $10B contract, right?

* A future Congress could overturn it, for instance by enacting FBI’s draft “Going Dark” surveillance legislation. I disclosed some details here about the FBI's proposal to target Internet companies (in retrospect, FBI was carrying water for NSA): http://www.cnet.com/news/fbi-we-need-wiretap-ready-web-sites...

But despite those caveats, Wyden's bill is worth supporting anyway. It does no harm, it's highly symbolic -- and it would stop future agencies from creatively interpreting their statutory authority to screw over the Internet and companies represented here on HN.

While no agency has clear legal authority in this area, that doesn't always stop them, with the FCC the most likely suspect. Remember this is the same agency that unilaterally extended CALEA backdoor requirements to broadband providers, despite Congress never giving it that authority, and despite the FBI director assuring politicians this would never happen. A federal appeals court judge called the FCC's argument for surveillance mandates "gobbledygook" and "nonsense," but unfortunately ended up dissenting in a 2-1 decision, as I wrote here in 2006: http://news.cnet.com/Appeals-court-upholds-Net-wiretapping-r...

This is not a case of a bill doing some harm and some good, like the problematic USA Freedom Act, where different groups applied different weights and reached different recommendations. Wyden's bill does only good, even if doesn't go nearly far enough. Fixing a broken system is not a one-step process.

Google and Facebook offer platforms to advertisers.

For instance, Facebook lets advertisers show ads to users of age X, working at company Y, in location Z, etc. (without disclosing their identities). This is completely different from selling your information, and the companies' privacy policies and practices reflect this.

As mike_hearn says, these sorts of alarmist claims ("they're selling your info!") are easily debunked. And in this case they detract from the rest of Julian's essay, which is a shame because elsewhere he makes some good points.

Yep, Yahoo has said they will honor user choices and allow folks to opt-out by changing CC licenses. The November 20 announcement says:

"Flickr members who don't want their CC-BY or CC-BY-SA photos to be eligible for sale as part of Flickr Wall Art can change the license (e.g. CC-BY-NC, etc.) and the images will be removed from the selection." https://www.flickr.com/help/forum/en-us/72157649323144986/pa...

What's interesting is that CC licenses are irrevocable. So if a hypothetical GreatPhotoPrints.com bulk-downloaded CC-BY- and CC-BY-SA-licensed photos, they could continue to sell coffee mugs, t-shirts, posters, canvas prints, etc. -- even if the Flickr user changed the license later. (And of course if Yahoo ever became desperate for cash, they could reverse the current policy decision that currently permits opting out.)

For CC BY, CC BY-SA, and CC BY-ND, Creative Commons itself explicitly mentions the word "commercial" in its summaries: https://creativecommons.org/licenses/

Of course, if your description is correct, Yahoo/Flickr may have an interest in downplaying that important detail.

Yahoo's actual announcement on November 20 says they're using "a subset of Creative Commons images ('safe' photos with license type CC-BY and CC-BY-SA)." See:

https://www.flickr.com/help/forum/en-us/72157649323144986/pa...

It's important to read Creative Commons licenses carefully: some grant other people the right to make money off of your original work in ways you never envisioned, without any compensation to you.

Photographer Thomas Hawk wrote, correctly: "If you are going to license your photos Creative Commons with no restriction, then you ought to be prepared for this type of use. If it’s not Flickr selling them, anyone else can, legally. If you are uncomfortable with this idea, then you should not use Creative Commons without any sort of restriction."[1]

The photographers who are now upset apparently never read those licenses. And they're irrevocable, according to Creative Commons itself[2], meaning there's no legal recourse if someone wants to sell coffee mugs or T-Shirts with your CC-BY or CC-BY-SA-licensed photos. To Yahoo's credit, they are voluntarily allowing photographers to opt-out.

(What's interesting is that of the 14 photographers interviewed by the WSJ in the linked article, 8 actually didn't care. I would have guessed that number would have been higher.)

This is a separate issue from the "handpicked" Flickr photos, with a 51% revenue split. The actual Yahoo announcement[3] says the handpicked rev-share option is "invite-only," so presumably photographers who opt-in are okay with the terms.

Legality aside, I suspect Yahoo will regret this move. Seems to me that the negatives outweigh the revenue (especially since anyone can also offer CC prints), and users may view it as at odds with Flickr's 2011 claim that "at Flickr, your photos are always yours." Also Google+ has better editing tools and free unlimited photo storage (for <=2048px, I think), so that might prompt folks to move their photos over.

[1] http://thomashawk.com/2014/11/the-controversy-around-flickr-...

[2] http://creativecommons.org/weblog/entry/10296

[3] https://www.flickr.com/help/forum/en-us/72157649323144986/pa...

I'm not sure the criticism in the linked post is justified.

Here's what Uber says about its Android permissions -- the page isn't that difficult to find: https://m.uber.com/android-permissions

Uber says the camera permission is required to take a snapshot of your credit card. The phone call permission is required to call your driver. The get accounts permission is required to enable single sign-in (Google Sign-In, Google Wallet).

The Uber app doesn't, according to the gironsec.com post, request Android's READ_SMS permission, so pointing to a "sendSMSLog" code excerpt by itself doesn't mean much. And so on.

As <andymcsherry> pointed out elsewhere in this thread, there's a "perfectly reasonable explanation for almost all of these permissions" except WRITE_SETTINGS. Uber says in its Android permissions post that: "We use this permission to save data and cache mapping vectors."

It seems as though it would have been useful for the author of the gironsec.com post to read what Uber has to say -- or, better yet, contact the company before posting a critique. If Uber PR can't cough up a good explanation, it makes the final critique more powerful.

I've posted here on HN criticizing Uber before (https://news.ycombinator.com/item?id=8383854), but before rushing to judgment here let's check our facts first.

QuikClot is very nice. I had the opportunity to use the 2013 formulation for the first time last weekend when someone in my kitchen was cleaning a blender with their finger. The blender was not unplugged and, well, turned on. Their finger had multiple deep lacerations down to the adipose tissue. (Fortunately this was not me!)

As one of the other posters in this thread said, the 2013 formulation is impregnated dry gauze. It worked very quickly to stop the bleeding with no heat--the top left of the package, in fact, is labeled "heat free."

We ended up going to the Palo Alto Medical Center's urgent care clinic and they applied glue instead of stitches because of the lacerations' proximity to the fingernail. The nurse was surprised I had QuikClot on hand and mistakenly thought it worked by "cauterizing the wound."

The downside is the price, about $40 for the combat gauze I used.

> You're always making trade-offs between power vs. common, new vs. existing users.

Well put. Google is a data-driven company with the ability to test designs over millions of users (although Jakob Nielsen's work has shown that you reach the point of quickly diminishing returns after testing with 5-10 users).

I've spent quite a bit of time implementing Material Design for http://recent.io/, and then testing the design with normal, not especially tech-savvy users. My impression is that Material Design is a way to simplify and standardize app UIs (to increase app usage overall), and import visual cues from the paper world. It's very thoughtful approach, probably better than iOS, and I say this as someone whose primary mobile device is a new iPhone and who has owned an iPhone since the day it went on sale.

But what works for most people may not work for HN power users. Hence the complaints on this thread.

>notorious webspam/blogspam regurgitation sites like "recode.net"

Actually recode.net does a lot of original reporting in addition to regurgitation. Disclosure: some of my former CNET/CBS colleagues are reporters there.

The problem (and I've seen this when building http://recent.io/ as well) is that every news organization does this to some extent. If organization X has a scoop, Y and Z will "follow" it by summarizing and rewriting it. This has been going on for over a century; the AP, founded in the 1840s, does it very well.

In the most egregious cases like the one above it's just a theoretically fair-use excerpt from the original story followed by a "read more" link. But sometimes it serves your users to link to the followup coverage instead. That's when the original article (FT, WSJ, Economist, etc.) may be behind a paywall, or when the followups have more context or additional details.

TL;DR: This is a non-trivial problem.

I loved this writeup, but was sorry to see the Sunnect digital deadbolt missing from the lineup (http://www.sunnectlock.com/products.html).

I've had mine for 4+ years and have found it very reliable. It's keyless and non-networked, both of which I consider to be features. Aside from initial installation (which was a pain), no other complaints.

That's why I said "one reason."

> corporate capture of politics

If you look at which companies can actually make things happen in DC[1], it's the ones that are regulated (the reasons for this should be obvious with some thought). Those are not Silicon Valley companies, by and large, but telecommunications firms like AT&T and VZ.

And it's those telecommunications firms that have long-standing surveillance "partnerships" with the NSA, according to leaked Snowden docs, which I wrote about last year here: http://www.cnet.com/news/surveillance-partnership-between-ns...

Here's one reason those regulated telecom companies may not be eager to see reform happen:

"ATT, Verizon, Sprint Are Paid Cash By NSA For Your Private Communications" http://www.forbes.com/sites/robertlenzner/2013/09/23/attveri...

[1] AT&T/VZ/Comcast rolled Google/eBay/etc. on Net neutrality in Congress. Twice. Silicon Valley-backed NN bills were defeated in both the House and the Senate. And heck, Silicon Valley can't even get a permanent R&D tax credit passed. They've been trying forever to get a ECPA reform passed (this has failed). DMCA reform? Over a decade, nothing. They should be heavyweights or superheavyweights but they're bantamweights instead.