rqs

Duplicate: https://news.ycombinator.com/item?id=19176524

From that news:

> ... But the company failed to protect that database with a password, Victor Gevers, a Dutch security researcher with the GDI Foundation, discovered Wednesday. The database contained more than 2.5 million records on people, including their ID card number, their address, birthday, and locations where SenseNets' facial recognition has spotted them.

> From the last 24 hours alone, there were more than 6.8 million locations logged, Gevers said. Anyone would be able to look at these records and track a person's movements based on SenseNets' real-time facial recognition. ....

> Logged locations include police stations, hotels, tourism spots, parks, internet cafes and mosques, Gevers said. The researcher found that there were 1,039 unique devices tracking people across China.

> One camera was logged monitoring the Uygur population in Xinjiang, a Muslim minority group that the Chinese government has been accused of targeting with human rights abuses.

I don't know, first image came to my mind was in a deeply frozen city (like the one in the movie The Day After Tomorrow), workers who just been laid off are exiting from tall towers. Some of them sitting on street, some joined fire pit barrel party, others just wandering aimlessly.

Those towers are really really tall, and bright, the setting sun makes them even brighter. Beautiful lights are shining through the glass, cold but colorful.

Among those towers, one of them looked especially alive, the one skinned with a big big screen. And on the screen, was the live view from the company's executive meeting, hosted by non other than the CEO, a well dressed, brilliant, sharp, humorous and polite man.

It was too far to make out what he said, strong wind and echos makes it hard to hear. The only few fragments I could recognize was:

"... Our financial situation this year were the best in our history ..."

"... Change must happen ... to help us reach our full potential ..."

"... the future with our extraordinarily talented employees ..."

Could be a very good scene for a game.

That take forever to summarize. How about learn PinYin from the basic?

I just found this video on YouTube, can be a good start: https://www.youtube.com/watch?v=9XbQJPF817I&list=PLWXyZU_NJb...

Thank you for point that out. I should have checked the spelling before posting.

> The teacher (young girl, never left China in her life) told us that everything "French" means "sex/porn/etc", i.e. "french book", "french movie". Funny, but tragic.

I think this is a typical example of stereotype rather than racism. But actually, I think that kind of stereotype is the exact major driving force behind racism in China.

From my own experience, I don't think we in China have received enough education about races or even our own ethnic groups. That eventually lead to ignorant and insensitive.

I once was in a dinner with my parents and their colleges. One of the college is identified as Hui, they don't eat pork (While us Han try everything edible). Somebody on the table got curious and ask why, before the Hui can answer, someone else intercepts and said "Because pig is their god" (when in the reality, they believe pig is filthy). Thankfully, Hui was very nice and explained it to us, and that someone was very embarrassed.

So, I think the solution of the racism problem in China is to encourage more interaction between different people.

Still remember the Bugged Chip story from Bloomberg? One comment under the story tells me that it is very hard to test bugged hardwares. So I guess every country should just by default distrust any communication equipment regardless where the equipment came from.

Oh silly me. I've implemented my own HTTP/2 server according to RFC 7540[0]. I forgot in the real world web browsers just send "h2" TLS-ALPN.

[0] https://tools.ietf.org/html/rfc7540#section-3.2

I rather believe HTTP/2 will die when HTTP/3 is available.

After all HTTP/1 is very simple to implement and already widely used and optimized. It is usable for most of cases. Plus, maybe in the future, CDN can serve HTTP/2 to client while use HTTP/1 to read the source.

And currently web browsers still need to send Upgrade request in HTTP/1 to know whether or not a unknown HTTP server supports HTTP/2. I guess this will still be true after HTTP/3 comes out (alt-svc).

Are you sure about the SSH part?

I have few VPS's outside of China, and when I trying to SSH them directly from China, the connection would only alive for few minutes before gone slow (20 seconds delay), and eventually went dark (All packet dropped).

So I wrote my own proxy. It supports port mapping so I can map my local:2211 to server:21. When I connect to local:2211, the proxy will first connect to proxy-server (located outside of China) to establish an encrypted data stream, and then the proxy-server connects server:21.

This way I can keep the SSH connection alive as long as I wish to.

If you are using tools like Shadowsocks, you can use `ssh -o ProxyCommand ...` to ask ssh to go through Shadowsocks (Socks5 proxy).

One day I was watching The Thought Emporium, the host did the same thing[0].

It was cool to watch, but then I was starting to worry what if one day my doctor want to put me through a MRI machine ...

[0] https://www.youtube.com/watch?v=3aVwvJn7vpo

Well, if you want to dig more, I've found one regulation[0](technical standard rather) mentioning something maybe related. It says, I quote:

> 2、禁忌症

> （1）有如下情况之一者，不得实施体外受精-胚胎移植及其衍技术

> ① 男女任何一方患有严重的精神疾患、泌尿生殖系统急性感染、性传播疾病；

> ② 患有《母婴保健法[1]》规定的不宜生育的、目前无法进行胚胎植入前遗传学诊断的遗传性疾病；

> ...

Translated to English and overly sum up: IVF-ET is forbidden if:

1, The donor or the receptor is currently carrying STD (Or genitourinary infection, or severe mental illness);

2, The patient not recommended to be pregnant according to the 《母婴保健法[1]》(Mother and child health-care law);

3, The patient is suffering from hereditary diseases that cannot be diagnosed with Preimplantation Genetic Diagnosis.

The rationale that you are curious about is still unknown here, but I do think this document and the law mentioned can be a good start if you want to figure it out. Sadly though, this field is far out of my range of knowledge, I can't even translate most of them for you (And That page on npc.gov.cn is still loading after 5 mins of waiting).

[0] http://www.moh.gov.cn/open/uploadfile/2005112816435508.doc (人类辅助生殖技术规范)

[1] http://www.npc.gov.cn/wxzl/gongbao/2000-12/05/content_500462... (母婴保健法)

I think take precautions is a good thing for this case. It generated benefits for both who stayed and left.

1, Because GitHub need to be careful about their decision, they will likely to give out more to convince people to keep using their product.

2, People now starting to trying tier 2 product from other companies, this is apparently a good thing for those companies. Also, you don't want to feed a monopoly.

> <a href="javascript:;" target="_blank" class="cell">中文 / Chinese</a>

Why?

By law, yes.

And redistribution of porn materials is a crime that can send committers to prison, depends generally on how much money they've earned from it or/and how many redistribution has been made etc.

But personal consumption is not illegal.

To put it simple, if you want to be a 100% law obeying person in China, then you can watch porn, but you cannot produce it, you cannot copy it and send to others, you cannot recommend it to others. The real life situation is bit different of course.

I quote from myself: Among those haters, idiots hurts the most.

Been an idiot myself, I know how many damage I can cause & caused. Lucky, through out many years, I've learnt to investigate the problem first, before deciding whether or not to send hate mail/comments.

Sometime, during the investigation, I'll found out the fact that I was the one who actually caused the problem, because I'm such an idiot. When that happens, I will just sit on my chair for few seconds to appreciate the time that I've saved for not to write the hate message with my broken English.

Sadly, investigating is a skill not everybody have.

People will spend their time on anything they feel useful to them, not the "mobile app".

I think you've been mislead by the current situation where everybody is using apps on their phone. But really, the "mobile app" it's just another thing that is attractive to them.

If you lock somebody in a room with only a TV inside, eventually that person will turn on the TV and start watching, even the TV only plays China Central Television channel one (FYI: It's boring like hell).

It's basically the same effect, the only twist here is that people chose to be addicted to their phones.

Don't let that effect blind you :)

> 99% of HN readers are not representative of the intended general userbase of 99% of the apps for ios/android.

Not that I agreed with the website vs. app debate, but with all respect, that "userbase of 99% of the apps" was likely made up by those people who would also begs for bigger keyboard on their phones so they can send SMS a bit faster back in 2006.

> offenders can "buy" points from other people so that they still can drive

It's illegal, some local official already been prisonized for doing that[0]. So the argument is no longer true.

If the "social credit point" will become a reality, then I don't think it can be traded in a lawful fashion as well, as allowing it will discredit the system.

Might be a good way to destroy the system by rending it useless now that I think about it.

[0] https://translate.google.com/translate?sl=zh-CN&tl=en&u=http...

Off topic, but that www.court.gov.cn is awesome.

After dug it a bit deeper, I found wenshu.court.gov.cn which seems to contain all the judgment papers across all the courts in a searchable manner. Cool!

"Foreign investment law", does that implies the "forced technology transfers by administrative means" is still OK if it is enforced upon domestic companies?

I will be happy if by "some other mechanism" they meant "Encrypted SNI".

The thing I really don't like to see is that they might eventually keep using the "Host" header and thus potentially creating ambiguity.

Wow, just reading this RFC makes my more comfortable compare to reading RFC7540. Possibly because they hided a huge portion of technical details under the keyword QUIC.

I'm not sure I should continue to implement my HTTP/2 server now, as HTTP/3 will overlay almost (as far as I can tell) all the benefit that provided by HTTP/2.

One thing makes me confused though, since:

> The QUIC version being used MUST use TLS version 1.3 or greater as its handshake protocol.

And most TLS 1.3 implementation supports RFC6066, then why:

> .... This may be done using the Server Name Indication (SNI) [RFC6066] extension to TLS <bold>or using some other mechanism</bold>.

? I mean, why include any other mechanism while SNI can do the job?

Well, I think all opinion is biased. After all, opinion is not truth, and lets face it, people are biased.

The thing is, the reason behind those biases is rather logical, that makes those comments worth noting.

(And yes, I know how bad some comments on Slashdot can be :)

> Google employee did become more active on these issues which I think is progressive.

Because the world is changing. The concern around privacy and censorship hasn't reached that level back in 2006 (Mainly because most westerners hasn't been effected by it, funny).

The situation today is much different now.

BUT, I don't think this will be a easy battle. Many people on Slashdot don't even believe Google will just stop trying after this.

The harm is done, Google.

Wasting money on infrastructure is better than wasting on wars. The government of the U.S. need to learn better.

The problem with war is that no matter which side wins, both side will always in some way hate each other (Once war started, it will never end).

While even in the worse scenario, locals can still benefit from the infrastructure. Booming strategy is something Chinese people play very well.

Then it will probably be banned in China, so nobody can actually pay the ransom.

Plus, I have read a news article on Wired[0], I don't think Monero is private enough to against state/police launched attacks?

Consider there are many ways to make money legally, doing something at that level of risk maybe just not worth the trouble.

[0] https://www.wired.com/story/monero-privacy/

Well, too late to know for that guy, he's already been arrested[0]. Guys on Solidot[1] digged out many interesting things, including one issue he posted on one of he's own GitHub repo saying "Help! How can I delete this repo, I have to run!".

LOL

BUT, I almost feel pity for him. Take look the picture of him on the news[0], look the environment he's living in and how thin he is, pretty rough life I'd say.

I hope hes doing well in prison and become a better man after this. If he can write a virus capable of doing all that, then I think he will also doing well in most companies that does web related works.

[0] https://news.163.com/18/1207/10/E2DS6H800001899O.html

[1] https://www.solidot.org/story?sid=58856

> 5. Hostility

Got me curious. I don't think we in China have reached that level (hostile).

Many people in China is passive, meaning most of the time you better open up by yourself, otherwise people are likely to leave you alone.

Yes, that can makes people feel helpless sometimes, but that's not because people are hostile, no, it's because people are cautious and don't want any trouble. It's not cautious towards foreigners, it's cautious towards others. In China, strangers just don't exchange much. If you want to feel the same level of friendliness that you might have in America, you need become somebody that other people familiar with (So maybe they know how to treat you well without piss you off, or other way around).

Weird.

Huawei made an carefully worded announcement early this day and states that they are didn't violate any related law:

- https://www.zhihu.com/question/304821204

- https://weibo.com/2557129567/H5WbTkTkj

December 1, the same day Xi and Trump met at G20. Wonder if anything goes wrong.

Americans better find something this time, one Yinhe incident[0] is bad enough for PR already :)

[0] https://en.wikipedia.org/wiki/Yinhe_incident

> The account will likely be locked upon investigation

The WeChat account already been banned. http://www.xinhuanet.com/fortune/2018-12/05/c_1123807970.htm

Now it's time for the police to dig out the real criminal.

A proxy/jumper account might work until (as you said) somebody starting to cash the money out.

Seems a very dumb thief, but again, how do somebody steal money online without been caught now days?