Hacker News new | past | comments | ask | show | jobs | submit | Goleniewski's comments login

Think about it.. You don't even have to be an Apple user to be affected by this issue. If someone backs up their conversations with you to apple cloud, your exchange is now fair game. You get no say in it either.

We all lose.


That's why it's important to use apps like Signal where you can set the retention of your messages. I've got everybody I know using it now!


Setting a retention time out is playing with fire. If the police get ahold of the other party's device, and present an exhibit which they say contains the true conversation, you could be worse off than if you retained the conversation. The fact that you have since deleted it could be incriminating.

In some jurisdiction, yes, legally, such evidence might not be probative, but you might still convicted because of it.


message retention has literally NEVER been used as incrimination in a court of law. So you are wrong.



This isn't Amazon getting in trouble for implementation of a routine records retention policy. It's Amazon getting in trouble for violating a document retention mandate related to an ongoing lawsuit.


I don't think so. Corporate communication is bound by different laws and you have way higher burden of evidence in case of legal requests. I don't think this creates a precedent for personal communications.


Yes, but if I’m reading it right, Amazon staff were already inder instruxtion to retain and share data relevant to an ongoing investigation. They were aware of the process and, if the article is to be believed, worked against the instructions.

That’s quite different from turning disappearing messages on when you’re not explicitly under insteuctions to keep records.


No. That's a civil discovery matter.


Its also a private business directive not a law


The retention time can be set by individual conversation not just the whole app.


Ephemeral messaging is not a crime.


Given historical backups are the norm here, retention only does so much.

Really, apps should encrypt their own storage with keys that aren't stored in the backups. That's how you get security/privacy back.


Many people want control over whether they back up conversations with others, and think it would be crazy for sender to control the retention policy instead of receiver.

I think sender should just be able to send a recommended preference hint on retention and you could have an option to respect it or not.


> That's how you get security/privacy back.

Nothing an app does on a device guarantees you security or privacy if you don't trust or fully control the device.


Yes, but they'd have to issue another one of these snooping demands to either the app's developer (there's loads of developers so this would get out of hand quickly) or to Apple to patch the build or read the memory or something to get the unencrypted data

This current demand isn't blanket access to your device, it's access to things uploaded to Apple's online storage service. Having to get a backdoor that works with every app's encryption takes a lot more work while running the data through an authenticated encryption algorithm is relatively trivial for a developer


I use a patched Signal client that disables retention deletion and remote delete messages.


and that's awfully rude of you, but if you were concerned about message retention you wouldn't do that. so what's your point?


Nothing rude about it -- if the protocol depends on client-side s/w to pinky-swear it respects message retention, then it's an insecure protocol.

I like signal and use it, but I already thought message retention was pointless. It seems at best a trusted informal protocol you can use with known parties but not something you can really rely on.


In a world where they cancel encryption they can't access... doesn't Signal and its CIA funded origins concern you?


Nope. I actually think that would bring more scrutiny and so I feel safer knowing it's not be cracked.


interesting and illogical reply


No more illogical than trusting Apple's security because it is ... Apple.


Well, here you are discussing why UK law needed a pass because they are literally blocked by Apples security. Talk about Low IQ


Thanks for the attack on my IQ. I see I have nothing to worry about.


Very similar to sites like LinkedIn, which ask you to share your personal info & contact list.

I don't want to share my contact details, but the second someone I know decides to opt in, I lose all rights to my own data as they've shared it on my behalf.

Maybe they have other info, such as birthday, home address, other emails or phone #s, etc. stored for me, which is all fair game, as well.


If you are in EU, request your data be redacted.


Security hinges on trust. The only real privacy tool is PGP which uses a web of trust model. But it only works if people own their own computers and storage devices. What they've done is got everyone to rent their computers and storage instead. There's no security model that works for the users here.


Scary - I try to use signal as much as possible now for this reason.


Signal can't evade this law either.


Why not? Signal was willing to run all kinds crazy setups to evade foreign laws, like domain fronting.

https://signal.org/blog/doodles-stickers-censorship/


If Signal can do it, then why doesn't Apple make a stand?


If signal doesn’t make a stand, the entire value prop of signal collapses and they cease to be a thing.

For Apple, privacy is one value prop. But seemingly smaller one than the UK market.


I use it, am currently going through my certifications and also make a living doing it so I feel qualified to comment...

Those people moaning about price... If you have to ask the price you can't afford it. My F500 employer spends upwards of $30,000,000 a year with MS and somehow (Don't ask me, I just work here) everything goes cloud first now.

To state the obvious, the big boys pay nowhere near calculator pricing prices. The pricing is a different galaxy away. Living in a world where one small tweak can save $1,000 a day, its all about efficient planning of what your doing, ie design it right but Azure designers who are good don't come cheap.

What wasn't made obvious (and this is where a lightbulb may go on) is that MS is engaged in a hearts and minds war for Sysadmins like me. So much so that MS have a special program available to big spenders where:

1) Pretty much the entire Azure training catalog is available for free, ie AZ-401, AZ-5XX, AZ-2XX? When I say free I mean real attend in person courses with the full course content as you would normally pay $3,000 for. You can do it as many times as you like, as often as you like. 2) All personal labs are paid for with free credits (its a bit grey area this one) 2) All the exams are 100% free. All those Pearson Vue exams? 100% discounted. Did I also mention unlimited retakes?

As for the complaining about APIs and products being retired, well, the trick is to stay with the mainstream items offered.

In short I have had about $20,000 of training from MS this year alone and its not cost me one single cent. I really dislike MS but if they want to make me a very rich and in-demand person with companies who think cloud will save them from being dinosaurs, I won't bitch too loudly.


If the system is so complex it requires multiple in person training courses and exams, that honestly sounds like more of a disadvantage than an advantage. I guess from a selfish individual perspective maybe the system that lets you build a stack of certificates is better than the one that anyone can use, but that's not a recipe for long term success.


Nothing required certification.

But certification programs are useful for management because they give you a floor level on the expertise you are buying.

That's why all (?) enterprise software that has customization/administration has certification programs (eg https://training.linuxfoundation.org/full-catalog/)


Are you saying that lobbying is a bad thing, but you’ll accept it if it’s you that’s the recipient?


It was light and day. It is what it is because of the man in charge. Billy G knew that even he didn't have the skills to manage the development of NT. Therefore he got a guy called Dave Cutler to head it up.

Dave was the man because he used to work for DEC on a project called Onyx and prism (A hardware/software combo to do essentially what NT does) was cancelled by DEC at the last minute.

MS wanted him that much that they brought his entire Development team to MS (not one person was left behind, at his demand. They where quite ...tribal...)

This is also part of the reason NT originally worked on DEC systems as well.

It's all in a rather fascinating book called Showstopper: The Breakneck Race to Create Windows NT and the Next Generation at Microsoft

For a few bucks it really is a most excellent read that goes into some techy and really fascinating issues they encountered. One of the biggest was Memory was so little back then.


I quite like the NT kernel from a design standpoint. Sadly some of the cooler features were removed over time, like offering Win32, Posix and OS/2 APIs as equal subsystems for interacting with the kernel (though the capability became useful again with WSL1). The entire user management and rights management story is very well thought out; somewhat complicated but incredibly powerful. And while it's not the fastest kernel out there, it really excels at keeping the system interactive and useful under CPU and memory pressure.

If only the userspace was as good as the kernel. A lot of good things were (and still are) obscure because they aren't properly surfaced in the Windows UI.


My favorite details from the book:

• It is old enough where it has to explain email to the reader, and explain why Gates would be obsessively looking at it throughout the day.

• The project got slowed down by adopting a cool but unproven new language called C++. The 'rewrite it in Rust' of its time.


Consider applying for YC's Summer 2025 batch! Applications are open till May 13

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: