Hacker News new | past | comments | ask | show | jobs | submit | najqh's comments login

If you can screw somebody over just for asking to comply with a legal request, the problem is the law.


It’s more complicated than that. The email I received was wrong about my legal obligations to respond. First, I received the email regarding a tiny personal site I operate for the fun of it, and I don’t meet the CCPA deadlines. Second, nothing in the CCPA said I have to reply to random information-gathering requests anyway. And yet, the email gave me a deadline to respond and cited a specific law, claiming that I owed them a response.


I don't know whether the problem is the law or not. Interesting to see some people have seen GDPR as a security risk, but its a great way for people to see what is being used to help an entity carry out its function.

I sent this to my politician and am still waiting for a response but I'm more than interested in what they use tech wise, and I think it covers everything!?!

GDPR Request: Everything you have on me, please highlight what you or your 3rd party's consider to be for law enforcement purposes or for scientific purposes and therefore can not deleted, and please detail all & any 3rd party's who may be required to handle my data that enable you to perform your function of MP when dealing with me. Examples will include Anti Spam and Anti Virus software vendor(s), system's backup companies, cloud infrastructure provider's, network infrastructure provider's, computer equipment provider's, external national or regional department's, private assistant's or secretaries, mobile phone company's, data analytics' company's that have (in)directly identified me in order for you to get into office. This list of examples is not exhaustive. After I have received & reviewed the data, I will inform you of what can be deleted.


It seems to me that your politician needs to be a data controller to do that. It's unlikely that he is one.


In order to communicate via email with British politicians, you have to include your name and address.

I also sent a GDPR request, to GCHQ, MI5, various police constabulary's where I have lived or passed through and the Police national database because a Police constabulary dont have to pass information to the central national database.

Its quite interesting knowing what they know about you and would urge all Europeans to do the same ie GDPR your security services & police forces!

I dont have a mortgage, but in theory you could also use GDPR to do this if you have the deeds to your mortgaged property, you could DSAR your mortgage lender and then ask them to remove all your data from their system as its not scientific or law enforcement purposes and you should also time it so that all the credit data agencies like equifax and experian also remove all trace of your mortgage at the same date and time. In theory you should end up with a mortgage free property but I cant try this as I dont have a mortgage.

Hacking isnt just restricted to Computers, you can exploit the law as well. :-)


I'd argue the opposite - they are likely to be one, especially if they've run a successful campaign.

Candidates and parties will canvass the electorate to identify who is (likely) to vote for who so they can put resources in to the right things and make sure likely supporters turn out to vote etc.

That's not to mention that any (prior) correspondence with the politician (or their office) will almost certainly also contain personal data.


OK, that would make sense. That's more likely a party thing where I live (so you wouldn't contact a random MP but someone in an administrative position in the party), but I imagine it's not necessarily the same thing elsewhere.


Not the legal system which requires the steep cost of representation?


They did not screw anyone over, their email specifically says that it is not a data request. I remember one person saying they had a panic attack reading the email. Like come on, let's be real.


I got the email and I nearly had a panic attack. The email wasn’t completely generic: it referred to my specific site. It also read an awful lot as if it was coming from someone who would be looking for the slightest mistake in my response so that they could sue me. Similar things happen[1]. And finally, it lied and said I was compelled to respond, quoting a law that said no such thing (and which wouldn’t apply to my zero-revenue personal project website anyway).

The stress wasn’t from the email. It’s that it gave every indication that I was being contacted by a legal troll, and that I might have to defend my hobby project in a courtroom. I couldn’t afford the costs of doing that, even if I ultimately won, and the idea of “well, there goes the college fund because of a stupid lawsuit on my hobby” was awful.

[1] https://tucson.com/business/group-barred-from-filing-disabil...


Thank you for sharing your experience; you're shedding more light on the situation than anyone else is right now. Out of curiosity, would you be willing to copy and paste the email contents here?

Edit: Ah, I found your blog post[1].

[1] https://honeypot.net/post/dealing-with-princetons-flawed-pri...


You were already shadowbanned permanently, that's why you had 0 likes. There is no difference between that and having no account at all since you cannot interact with any broads. By removing your account, they did you a favour in a sense.

Get a burner SIM card with a new number and create another profile. Easy as that.


> Get a burner SIM card with a new number and create another profile. Easy as that.

People keep saying this without realizing a lot of people practically can’t these days. In an increasing number of countries, getting an SMS/phone-capable SIM can not be done without KYC/ID verification. Where I live, for example, you even need to be a resident; all prepaids are data-only.

And before you tell me to find a homeless drug-addict and make them get one for me, it’s not that easy and no one should have to do that in the first place.

Same restrictions apply for SkypeIn and similar VoIP services (which BtW come in a separate prefix that most of these services blacklist anyway).

There’s a reason why those dodgy “receive anyonymous SMS” sites all only provide the same handful of countries.


Okay? So do ID verification. Tinder won't see your ID. They don't know you are the same person.


Exactly. Some places, like the UK you can just order a bunch of SIMs from Amazon. Though who knows if they'll ban you again if you keep signing up from the same wifi and/or if their app fingerprints the same phone. But worst case is throaway cheap phones and pay as you go.


This is the correct answer. Rotate idents. Use a phone emulator if there is a hardware ban. Occasionally a VOIP phone number might work for account authentication, occasionally not though.

But people really forget that is an option to just walk to the nearest phone store and come out with a $20 sim for the month. Useful for way more than just trying to hook up on a dating app you got banned on.


Precisely the last thing we need is more ads and unwanted features in Firefox.


DDG has been very lightweight with regard to user experience. And they actually have to, otherwise, they couldn't distinguish themselves from the competition (ie. Google). So there's no realistic risk of invasiveness.

WRT the features: Firefox needs market share above all. I'm actually terrified by a future where companies can't be bothered to put even a minimal effort to make a website/service run acceptably on Firefox. Try to use Slack on it, and you'll see what I mean.


> I'm actually terrified by a future where companies can't be bothered to put even a minimal effort to make a website/service run acceptably on Firefox

This isn't the future unfortunately. This is the present.


Future? As a webdev I don't remember having to check if something works on Firefox since probably 7-8 years at least. Userbase is too small to justify allocating resources.


Too small? According to this site [1], market share is about equal to Safari and Edge+IE. If you are supporting Safari, Edge/IE there is no justifiable reason not to support Firefox.

[1] https://kinsta.com/browser-market-share/


Lots of devs (the ones I work with, anyway) don’t even test in Safari until you point out it’s broken in it.

Really feels dev culture has regressed since the early chrome/safari days where working in multiple browsers was seen as priority.


I never did when I was maintaining an embedded web app. I checked in Chrome and Firefox. I would go in and figure it out if someone reported a bug in Safari but mostly no one at the company used Safari so it was really not tested for and the app just was never meant to run on mobile at all so safari wasn't much of concern.


"Firefox has been very lightweight with regard to user experience. And they actually have to, otherwise, they couldn't distinguish themselves from the competition (ie. Google). So there's no realistic risk of invasiveness."


The best is the furniture maker splash screen.

My wife says what does it have to do with the internet. I told her Mozilla has conflicting priorities.


They aren't? Lockdowns are stupid and have affected mom and pop stores disproportionately, making the rich richer. Seems pretty effective to me.

https://www.theguardian.com/technology/2021/feb/03/amazon-re...


I disagree with him, but he makes a solid point, and many people think like him.

HN is enough of an echo chamber as it is, don't make it worse.


The article says:

"""The main criticism was that it is simply impossible to rule out that a backdoor - once it is built - is abused by criminals or undemocratic regimes. A lowering of the security level would immediately affect all users - and not just those who are the subject of a judicial investigation."""

The comment says:

> I'm glad you're keeping safe dealers, pedophiles, and other criminals as well as their lawyers.

This does not look like a solid point to me; it looks like rhetoric.


Citing two different passages from the article:

> This draft included a passage that would have forced companies such as WhatsApp and Signal to decrypt their encrypted chats upon request by the authorities for criminal investigation.

> Belgian intellectuals like Professor Bart Preneel said that "by putting a backdoor into Whatsapp, you would make it less safe for everyone".

This does not look like a solid point to me; it looks like rhetoric. Anyway:

> a backdoor - once it is built - is abused by criminals or undemocratic regimes.

If they can get their hands on a governmental private key, which is unlikely.


The NSA leaked its own hacking tools to the internet. Oops.

The US government gave… gave, not leaked, not accidental, deliberately outright gave.. the identities and other personal information of people who had worked with the US in Afghanistan to none other than the Taliban. Because the Taliban pinkie promised not to slaughter them. Too bad, the Taliban didn’t keep its word.

Let’s not be naïve about the government’s ability or interest in keeping things private.


Who's the problem here? The government or the talibans? Sorry it's not really clear what you mean.


> If they can get their hands on a governmental private key, which is unlikely.

But those private keys aren't going to be created by the government. They will be created by Facebook, Signal, Telegram etc., who will then hand over one of them to my government, one to yours, and one to each and every government that makes a similar law, from Argentina to Zimbabwe. And they could just as easily hand over another to <insert billionaire or other non-governmental figure you dislike here>.


Ahah! Exactly, you have figured what I would have requested to specify in this bill!


Just by virtue of providing the possibility of keys to the "Proverbial kingdom" and centralizing location of those keys gives far greater incentive for hackers or state actors to find new ways to gain access to these tools for decryption.


Yes, but we can always revoke them and generate new ones?


What economic damage can be done in the interval between a private key being accessed by a criminal and the key being revoked?

Depends on the systems connected to the private key of course, but billions per incident are certainly possible in some cases.

Even if this is just private chat on messenger platforms rather than 2FA or HTTPS, imagine how blackmailers would respond to getting all the nudes, the drunk confessions, the adultery, from 30 minutes access to all of the 10th most popular chat app in your country.


Isn't this what happened with some european "digital covid certificates"? Not really unlikely.


Not afaik, people have just been sending screenshots of their QR codes to each others, and the people "validating" just have to "scan and see Valid".


The keys themselves were leaked. https://news.ycombinator.com/item?id=29011537


> If they can get their hands on a governmental private key, which is unlikely.

Why do you believe this is unlikely?


Because I know how state security works.


I see.

Then perhaps you can explain why so much stuff leaks from, say, the USA government?

Not just the stuff from government employees or contractors like Snowden and Manning who appear to be motivated by whistleblowing, but also the actual double agents working for the Soviets in the Cold War, and the apparently accidental leaks of NSA spyware: https://en.wikipedia.org/wiki/EternalBlue


These are the typical use cases for key revocation yes? The key should not be installed on non suspected user devices anyway in my opinion.


Great, that just leaves the possibility that the system to install keys will itself be compromised, perhaps something like happened a few years ago with a downgrade attack to the old USA “export grade encryption” back when crypto was counted as a munition. The use of e2e encryption started to become a general standard in chat apps precisely because centralised keys proved to be a weak point after Snowden.

As for revocation: https://news.ycombinator.com/item?id=29642783

Snowden got a lot of data without anyone stopping him. The risk is what if he’d been malicious instead of a whistleblower?


Isn't it illegal to go that slow? At least where I live the minimum speed on the road is half the maximum speed.


These are classified as "agricultural equipment", and as such they of course have access to most of the road network (not major highways) and do not need to go fast. Only "unnecessary obstruction" of traffic is illegal, "obstruction for reasonable cause" is perfectly fine.

The thing that annoys me is that there is not even cursory control that these cars are used in connection with agriculture. It was fine in the past, because it was relatively rare that the regulation was abused. After a recent change in the law that made it cheap/easy to convert regular cars, it has become a menace.


For cyclists, too?


>Wouldn't this mean more deaths or am I missing something? Are COVID deaths in AIDS patients attributed to AIDS not COVID?

I don't know about SA but many countries count any dead person who was infected with COVID as a COVID death, which is a convenient way of padding the numbers.


Yeah, this was my immediate thought. In the UK it would be counted as a COVID death, so assuming South Africa are recording numbers similarly you would expect COVID deaths to be higher in the more immunocompromised population if anything.


Good luck. I already reached my breaking point with omicron. I am not taking a booster at all. It is quite clear that this will never end. We have to send a message to the authorities.


What is the exact message? I agree this is frustrating but I don’t understand what message not getting a booster will send.


The message is stop playing political theater and creating a media cycle at every variant less it be particularly fatal one.


And how is this archived by not getting the booster?


They don’t try to sell a 4th one when the 3rd one doesn’t sell well.


The point is they gotta get boosters in people before the hospitals get overcrowded (only then people will realize they should've gotten a booster or the shots). People can't figure this out, so they need to use the media to get the message out.


That is... doubling down on a bad idea. Moving the stupid cookie banners to the browser itself so we can not block them. It's so idiotic, the EU bureaucrats will probably consider it.


I think it's the other way around, if the cookie banners were implemented at the browser level, there would be "auto-reject" extensions on day 0. Or, worst case, auto-rejecting forks of Chromium and Firefox.


Precisely what we need is to make the deposit prices so high that the homeless will fight over them. Then we can record them and upload the videos to liveleak.

Oh...


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: