kevcampb

"Due to copyright and other legal issues, this South Park episode cannot be viewed in your Country"

So yes, banned in China (Hong Kong)

'jobs for the boys' is a well known phrase for a reason. It's rarely used in a positive way

By degraded performance they mean, it's broken but we don't want to admit to breaking SLAs

If I am another company competing against Apple and paying my share of taxes, then yes.

Amazon, Google, seem far far worse. I wasn't intending for my post to me representative, just that the CF outage is recent and affects me more personally than the others atm. Also, I had zero expectation my comment would actually be read, this is quite a surprise.

If it's any incentive, if the status page had any inkling that something was wrong, I'd be first on here posting "omg their status page is real".

Thanks for the acknowledgement. Appreciate it's hard, false positives etc. Glad you see our PoV.

Let me quote from the previous HN discussion

”"”sauldcosta 4 days ago [-]

We use downdetector.com because status pages tend to take up to an hour or so to update, if they ever do. reply

jgrahamc 4 days ago [-]

1042 UTC First alert of global traffic problem 1057 UTC Internal group chat room up and running 1102 UTC Status page updated So, first alert to status page was 20 minutes.”””

In those 20m we had repeatedly checked your status page, realised it was our issue and started pulling engineers to deal with it as per procedure. People are on call, it's highly disruptive.

Surely you knew within those 20m that something was up?

In the end we realised it wasn't our issue because we checked Twitter.

Edit - added quotes

The recent outage was very very delayed. I stand by my comment.

Also don't get me wrong, you do a great service. It's just a pet peeve that it seems invariably status pages are a lie.

If it's any consolation, their status board has actually been reporting errors (hi cloudflare)

They've probably modelled the failure rate for the first one you bought.

"Just avoid holding it in that way"

Is machine learning really to blame for the reproducibility crisis? I'm not in academia, but it seemed to me that the problem was entirely present without machine learning being involed.

For example, Amgen reporting that of landmark cancer papers they reviewed, 47 of the 53 could not be replicated [1]. I would have assumed that most of them didn't involve 'machine learning'

[1] https://www.reuters.com/article/us-science-cancer/in-cancer-...

City full of tech companies working on facial recognition, bans facial recognition being used on it's residents

The Ocean Conservancy report has been cited by quite a few articles now, and it pains me every time I see it. As ever, the conclusions drawn are quite misleading.

1) The source of the data is cleanup on beaches, not ocean trash. If anything it's more likely to be representative of items discarded on beaches or waterways.

2) Cigarette butts are greatest purely in number of individual pieces, not in terms of weight or volume.

The following paper reports fishing nets to be the largest contributor to ocean plastic (by volume). Cigarette butts aren't even worthy of a mention in their report (see Supplementary Table 4 which lists the top 5 items per item size group).

https://www.nature.com/articles/s41598-018-22939-w

At peak times in Hong Kong's subway, it pains me to see one side of the escalator basically empty. Normally I walk up, so that should make things faster for me, except it's impossible to get to the escalator for the queue of people. If people just used both sides it would be faster - for everyone.

One important thing to note.

PCCW the main local telco uses Hong Kong ID numbers as passwords by default, or at least they used to do so. This means that this database contains usernames and passwords in cleartext for a significant number of users who have never changed their accounts.

It cannot

Source: I worked in a related field for five years, and evaluated a lot of technologies from major players.

Future job role: Sesame Credit Optimisation (SCO)

There's going to be so many ways to game this system when it gains wider adoption, it's going to be insane.

Multiple keywords on your resume (S3, AWS, Lambda, Serverless)

Except it isn't, it's fishing nets

https://www.nature.com/articles/s41598-018-22939-w

The fact that this is news is the real story

To do this you need access to the SS7 network. I don't believe this is the issue in question, as the providers have APIs for partners doing location services.

Source: I used to have direct access to such an API

The information is likely to be provided by an API from AT&T and others, which is obtained from cell towers.

Providers who uses these services need to agree to follow guidelines such as obtaining opt-in, sending notifications to devices being tracked with option to opt-out by replying with STOP, etc.

The guidelines are not enforced or audited.

I'm not clear if you missed the point here? This isn't aggregate data, it's obtaining the location of a specific individual just by knowing their phone number. It can be done without their knowledge or consent.

By your webserver analogy, the equivalent would be more akin to google publishing the contact details and search queries of anyone using the service.

I'm betting the opt-in is something along these lines

"FirstName LastName wants to obtain your location..."

Also betting that you can put 160 characters into those fields, so effectively a blank SMS is received

Betting further still that you can just spoof the SMS reply

Can you post the SMS opt-in message you received? Curious as to whether this is exploitable as well

I just discovered this treasure trove from the UK house of commons in 2006

https://publications.parliament.uk/pa/cm200506/cmhansrd/vo06...

"To extend that to adults, The Guardian journalist Ben Goldacre showed recently that someone needs possession of another person's mobile phone for only a couple of minutes to appear to give the consent required under mobile phone companies' current procedures. The person he was tracking never got any of the warning messages that were meant to have been sent to her. Even more scarily, a hacker's website has recently published information telling how to spoof consent without even having to have temporary possession of the target's phone; all that is needed is the number. If someone has a person's number, he can track them. It is not a problem. I know where the website is, but I am not going to tell Members. It is possible to track people just through their phone numbers."

Carriers have been providing these services to 3rd party providers since at least 2006

https://www.theguardian.com/technology/2006/feb/01/news.g2

A few points to note:

* Obtaining consent is entirely left to the provider to implement. It does not appear to have any auditing. A provider can query any number they like.

* The opt-in process used by many providers is easy to exploit, by spoofing SMS replies or abusing the SMS template so that the surveillance target does not get notified

* The providers have are well aware of the potential to exploit this and have been for some time. It has never been resolved in over 10 years.

Have a look at https://www.theguardian.com/technology/2006/feb/01/news.g2

This news article was about a year later than the original once, from what I remember. It misses the part that you can replace the name and spoof the SMS though. The SMS quoted in the article does demonstrate the vulnerabilities mentioned though

"Ben Goldacre has requested to add you to their Buddy List! To accept, simply reply to this message with 'LOCATE'"

Interesting to re-discover this now, I had no idea who Ben Goldacre was at the time.

If you find services still vulnerable, let me know. I'm still friends with the journalist who initially spoke to Vodafone before publishing in the first place. I remember them not being too pleased, but as I say, it never got fixed.