Hacker Newsnew | past | comments | ask | show | jobs | submit | firefoxkekw's commentslogin

Insanity, a person in their free time, out of the working hours discover a bug, doesn't summit it immediately, the google engineers proceed to call it 'an apple engineer' instead of saying the name of the person, this is politics 101.

Funny to see output of years of promoting politics inside a company.


Not insane at all. Just think for a second: ehy would someone withhold a 0day?

I understand a 14 years old kid new to security doing this. But this guy is a pro, he knows the rules of responsible disclosure.

Why help Google? Because Google routinely reports 0days to apple, making their platform more secure for everyone.


Does anyone know why Google focuses so much effort in finding vulnerabilities in their competitors rather than focusing all energy in securing their own products and services?

Is it because they can then publicize their discoveries and make themselves look good (while possibly making their competitors look bad)?


It really saddens me so read this type of comments on HN of all places.

Google has many issues, this is not one of them.


So... what, are you trying to say they do what they do as a form of charity? Trying to improve the security landscape out of the goodness of their hearts, one bug at a time?

To be clear, I'm not complaining, obviously I'm grateful for their work. I'm just trying to understand their motivation.

As you can probably realize, it's highly unusual behavior for a company to employ an entire team to do what they're doing, without any obvious benefit to the company itself (except perhaps PR value?).


> So... what, are you trying to say they do what they do as a form of charity? Trying to improve the security landscape out of the goodness of their hearts, one bug at a time?

My take:

- Project Zero is a public demonstration of their commitment to security. CTOs may be slightly warmer to them as a result.

- It's advertising for IT professionals Google needs to recruit into their own infosec teams. "Come work on internal vuln scanners and PCI compliance and maybe someday you can join the all star analyst team."

- And for the stars, maybe "spend 90 percent of your day Fixing Internet Security, and we'll come to you for expert troubleshooting on our own stuff the other 10 percent of the time" is a compelling recruitment pitch. Notably, the blog post announcing Project Zero concludes with a "we're hiring" paragraph.

- Fixing bugs in Apple products makes their own services more secure in the sense that their most valuable customers come to them through Apple platforms.

- Fixing bugs in open source tech protects their supply chain of crawling the web, making the resulting index available to consumers for search, and pairing searches with real time auctioned ads

- Publicly committing to ethical disclosure and other practices pressures the other 99 percent to match behavior.

- Turning the screws on competitors whose ads touting privacy don't quite match engineering outcomes.


This is exactly the kind of insight I was looking for (considering the limitation that as non-insiders, all we can do is speculate).

Thank you!


8. Using android phones that haven't received any security updates in the last few years because the vendor stopped releasing updates a couple of years after the release.


They just keep adding support to what the market demands, adding FP8 to the H100s and 40xx series was such a good move, their tooling is top notch, like what is the alternative of rapids in amd? Their drivers are so stable that you can rely on them not crashing in projects that need to train for weeks & months, sxm is another big win of nvidia.

They also have their skin in the game and do a lot of research in ds.

A single 4090 can do 0.66 PFLOPS which is mind blowing to me, borderline having in your room a supercomputer of the 200xs for a few k$.

https://ourworldindata.org/grapher/supercomputer-power-flops

Edit ----

Obviously biased towards enterprise users, no clue how good they are in the gaming market.


For me, being able to block/remove all the videos in the main page, shorts, the other people also..., the video recommendations and all the crap that Youtube have these days is so important.

I would pay a lot for a service that gives me the most useful answers instead of what is most likely to make me watch for longer, I know that is their business model to maximize view time to sell more adds but I wish they would sell me a subscription that allows me to customize the UI to show only a search bar, show only educational content when I use the search function and when I'm watching a video don't show me any recommendation or try to pull any tricks on me to spent more time in the platform, nothing more, I would gladly pay 50$ a month for this type of service on Youtube, until then uBlock origin to the rescue, my attention span and productivity is worth more than all the crap the Youtube team tries to pull.


Proton, the company that still in 2023 doesn't allow to cancel the auto renewal without losing access to the services you have already paid, the most anti-consumer thing I have seen in my life.

Here is how it works: 1. You pay for example for 2 years of access. 2. After a few months you decide to remove the auto renew and just use the remaining time of your subscription, your only option is to cancel your current subscription and lost access to any premium service you paid for, they give you credits for the remaining time of your subscription, that you can use if you contract other services.

So you are force to cancel the subscription before the renewal time and hope you don't forget to cancel it.

Run from this company.


Its unfortunate.

I was a happily paying customer for years

One day, i decided to try out the business plan for my naescent startup for organic farming.

When i realized they were missing critical features (autofwd rules one i recall) i tried to go back to the regular paid account.

Not only i couldnt do it, but they forced me to delete emails by hand for years worth of pictures that i had saved in the account to get below the free plan quota. All because i needed to reestablish my personal account so i could move both custom domains to another provider.

then i got below the quota, it would still not allow me to reestablish the account.

To their credit, although their customer service take a while, they did help.

It makes me sad, and have a very bad taste in my mouth because I was really trying to give business to a google competitor.

EDIT: just like OP, I lost access to the existing paid plan when I upgraded. What really made me upset is that I couldnt restore access to my account by downgrading on my own, no matter what I tried. Took custom domains off account, still cannot downgrade...gave up freebie storage space , still cannot downgrade. Meet criteria to buy monthly plan. Cannot downgrade. Reduced feature use to meet free plan tier, still could not downgrade. Reduced storage used below free plan, could not go to free plan, either. All the while I lost access to all my accounts because I couldnt do 2FA challenge sent to my old proton free plan.

Needless to say, proton free plan is not tied to any mission critical access anymore.


This is exactly the reason I only use paypal or virtual cards from Revolut when I sign up to stuff online now. I can cancel the subscription from Paypal settings, or delete the virtual card in Revolut, and that ends up cancelling the service at expiry after they fail once or twice to take payment.

At least here in the UK this works fine. Netflix, Spotify etc all deal with that properly when I've "cancelled" my service this way.


I do the same thing using Privacy.com. Enough companies today use the "fuck you" approach towards their users, hence the users should use the "fuck you" approach right back at them.

What's funny is how people won't use virtual cards because they think bill collectors or the law will come after them. That's extremely unlikely to happen for an unpaid $9.99 bill, especially since it's not like bill collectors work on behalf of companies free of charge. It's in the best interest of companies to ignore the transgression, freeze the account, and wait for the user to come back and reactivate it; much less likely to happen if they actively punish a user because they missed a payment.

Same goes for the "but muh credit score" argument. Somehow my credit score is still excellent despite the numerous times I cancelled virtual cards or didn't feel like paying my utility bills.

So yeah, use virtual cards everywhere.


Privacy.com allows you to use completely made up billing information - transactions won't get rejected if the name/address is a mismatch. You can just feed a fake name and address into each site, even if they wanted to, how would they identify you? Of course, this likely works best if you use an email aliasing service that hides your real email completely, and a VPN to obscure your physical IP address.


I can’t use Privacy.com because they use cellphone numbers. Supposedly, someone had used my number previously to sign up and now I cannot make an account since that number is “tied to an account”. It’s why I hate this standard of 2FA/“identity verification” with something as antiquated as phone numbers. I’d love to use their service, but as of right now I’m simply not allowed.


An admirable tactic, but a lot of services can spot those virtual cards because they "identify" as if they are pre-paid (and maybe they are in the backend, I dunno). Same trick as using Google Voice number for SMS/phone: it identifies as VoIP and more than a few sites give me the "hey, what are you trying to pull giving us a number we can't spam endlessly?!"


When I see those tactics I imagine the company throwing a full screen seizure inducing modal window with a red background and lime text of all their 1 star reviews and search for a new product.


I long for a day when customers get to exclusively vote with their wallet/eyeballs and we're not held hostage by the network effect and/or similar gatekeeping tactics


Virtual cards are the way to go. My bank offers free virtual cards for my accounts and they work flawlessly.


The cancellation varies depending on the service. For Proton VPN for example, the cancellation now does not force downgrade you right away. But for Proton Mail, we have kept the legacy method of immediate downgrade because that service involves data storage. Because VPN has no data storage, so we can auto downgrade you at the end of the subscription to the free plan. This doesn’t work for Proton Mail because auto downgrade to free might require randomly deleting emails to fit under the free storage quota. So for that reason we ask users to actually downgrade at the time they decide to downgrade to resolve storage quota issues themselves since we cannot automatically do that later on their behalf.


Why not remind the users to delete their E-Mails near the end of their subscriptions?


We could, there is no guarantee that they would do it, which is the problem.


The way I would like to see this as a customer would be.

I'm able to cancel the auto-renew. Once I do that with email I will get a warning that says: "We will attempt to cancel renewal the last date of your subscription. If your account exceeds the free quota, your account WILL renew."

As the date for the renewal comes closer and the user exceeds the free quota, as a user I will repeatedly get mail that the account will renew unless it meets said free quota.


Some customers would throw a fit if they paid a renewal fee after scheduling cancellation - for good, legal reasons. Some customers would throw a fit if a cancellation scheduled >1 year ago resulted in random emails getting deleted (imagine the last photo taken of a lost family member being in those emails). Between both options, neither is appealing. It seems as though the current option is best, but I do like your suggestion too: the best of both options, with the risk of something lost (subscription money) being replaceable/refundable in the event of an honest error.


Thank you for that feedback, it will be passed on internally.


Thank you for pointing this out! Not a good look the fact that they feel they have to make it that difficult to switch to a different provider. Even Amazon Prime doesn't do that.


> doesn't allow to cancel the auto renewal without losing access to the services you have already paid, the most anti-consumer thing I have seen in my life.

Uh... really? That's the most anti-consumer thing you've ever seen? It may be anti-consumer, but that's nowhere near one of the worst. At least it's actually feasible and straight-forward to cancel with Proton, unlike certain big-name Silicon Valley firms; at least they aren't known for outright stealing your money, canceling your accounts at a whim, or refusing support. I don't like it, but they explicitly warn the user what's going to happen if they downgrade, and there's of course the refund you mentioned.

Having been a happy customer of Proton for many years, I wouldn't say "run" on that basis. It may be a deal breaker to some, but I've been happy enough with what I get that I find it a tradeoff worth tolerating.


As a Protonmail customer, and since they're active in this thread, I think this would be an excellent place for them to reply to your concern here to say that they agree that it's not customer friendly and that they'll fix it.

:)


The cancellation varies depending on the service. For Proton VPN for example, the cancellation now does not force downgrade you right away. But for Proton Mail, we have kept the legacy method of immediate downgrade because that service involves data storage. Because VPN has no data storage, so we can auto downgrade you at the end of the subscription to the free plan. This doesn’t work for Proton Mail because auto downgrade to free might require randomly deleting emails to fit under the free storage quota. So for that reason we ask users to actually downgrade at the time they decide to downgrade to resolve storage quota issues themselves since we cannot automatically do that later on their behalf.


It might have gotten lost, but we replied here with some context: https://news.ycombinator.com/item?id=36512900


> your only option

A calendar reminder to cancel the week before renewal is another option


It’s not “another option”. It’s a tool for dealing with the only option they give you.


And also happen to have the time to switch email providers that same week. No, what they do is just shitty.


I never said what they are doing isn't "shitty".


Thank you, I believe that was obvious to everyone.


Yes this is an option but a very annoying one.


Yeah, I have the exact same issue with them.


I havent seen a single server or workstation running rhel in the data science field, the most used distro in ds already was ubuntu and with the launch of pro covering the universe repository for security updates, I cant understand why redhat is making this move, cant see the endgame.


Reddit have been scrapped for years, doesn't matter if reddit itself delete any of our data, tons of sites like https://camas.unddit.com/ have scrapped and stored everything.


Most people who care enough to delete their content, not just their accounts, are probably aware of archiving, and likely think it’s a good thing. The goal is to prevent Reddit from profiting off of voluntary contributions.


Typo, “scrapped” -> “scraped”.

Scrapped (from: scrap) - discarded, e.g.: “scrapped design”.

Scraped (from: scrape) - when something was removed from a surface, e.g.: “scraped website”.


The site you linked does not work and the GitHub repository is disabled.


If this device delivers 80% of what they showed, this is insane.

Like with iOS, the devs that adopted early where able to make a lot of profit, 3.5k looks way too cheap for what they showed.

Legit makes me want to work for apple.


Neo-Luddism.

Like they are going to stop China or any other country outside US or EU.

The most they can hope to do, is to force some companies to move off-shore.

Wonder where was all this people when Elon Musk started releasing betas on FSD.

Self-appointed 'Center for AI and Digital Policy', nothing more to add.


If some half-baked regulation take place in US on AI research, most probably many corporations will just spin-off some "new" startup somewhere less touchy about AIs. Let's say Germany, France, Ireland, it could be almost anywhere, as long as the money get to bootstrap a sufficiently effective replacement for any inhouse research division. It could take time, or not, now the money isn't a problem, and if some regulation begin to cripple the market, suddenly you have a hungrier market with even less offer to satisfy demand, hence the money get hotter and will be pumped even faster into AI research.

I think these guys looking for regulations, stopping development, etc. don't know anything about economics. Everything they are doing, will backfire quite soon.


> Wonder where was all this people when Elon Musk started releasing betas on FSD.

Loudly and openly for the entire duration, including governments specifically saying the marketing was misleading.


365 is the cloud base suite of Microsoft Office, you can still use the Microsoft Office 2021 Professional or older versions.

365 is a nice way of collaborate at work, if you are a small business is a nice product, for the big companies this is just going to be more headache for their I.T department, so now instead of relying in the Microsoft servers to allocate and store the documents, they will use any other server from who knows what company and hosted who knows where, some will be hosted with e2ee including at rest while others will end up using some shit show of servers from a company owned by some dude from not so friendly countries.

I understand that privacy for companies is a big risk, but regulating it this way can easily end with a cobra effect.


Yeah, the file storage is so messy - I still don't know if the file I saved is in SharePoint or onedrive, and that they seem to be the same but different at the same time


I've found these cloud editing solutions great for working with your colleagues but terrible for collaborating externally. You can't share a doc with their company for policy reasons and likewise they can't share with you.

I've resorted to sending docx back and forward instead.


> I've found these cloud editing solutions great for working with your colleagues but terrible for collaborating externally.

You can blame this on your O365 admins rather than Microsoft. For admins who want to generally restrict external sharing, it can even be limited to select Document Libraries. https://learn.microsoft.com/en-us/microsoft-365/solutions/co...


It is admins that are to blame, but not making easy for an end user to get permission to share something is on Microsoft.

Also not just Microsoft is at fault. Using Google docs to share with a company that doesn't have Google docs is just as painful.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: