Hacker Newsnew | past | comments | ask | show | jobs | submit | jdong's commentslogin

Do you believe that it is a net-positive for society to see things this way?

If so, can you put in the least bit of effort to explain as to why?

You seem to be expressing an ideological belief that you have some god-given right to listen to any and all radio waves that you might be able to receive, but that doesn't in any way explain why you think the society at large should see things your way.


Radio and light are both electromagnetic waves. A radio is just a way of deciphering those waves into something else like a digital signal or an audio signal. To put it another way, if someone were pointing a video projector of their video baby monitor out of a window and it shown on your wall, do you think it should be criminal to look at it?


>Why are you using such extreme language? Is it possible to converse in a way without over-the-top adjectives like 'god-given right'?

Because of how you seem to be approaching this, you've made no effort to explain why things should be the way you want them to be. You appear to simply treat it as axiomatic, i.e. a god-given right.

> should it be a criminal act to listen to radio waves that are in public? What would define 'private' and 'public' radio waves if that were the case?

An earlier comment in this thread addressed this in it's entirety by citing an example of real legislation which gracefully handles this.

> What would define 'private' and 'public' radio waves if that were the case?

There are radio waves which the transmitter intends you to receive, and radio waves which the transmitter does not intend you to receive. Generally you'd be fully aware if a transmission is meant for you or not, but the legislation referred to earlier would not impose any penalties on you for accidentally listening to transmissions not intended for you.

> if someone were pointing a video projector of their video baby monitor out of a window and it shown on your wall, do you think it should be criminal to look at it?

That would likely be an deliberate act by the transmitter, whereas the RF-based baby monitor example would not.

On the other hand, setting up cameras to look through someone's windows would certainly be a criminal act in many places (as IMO it should).

-

-

What exactly do you think is wrong with this law?

> (2) Whoever receives or otherwise has information on a confidential radio transmission not intended for him/her must not wrongfully disclose it or make use of the knowledge of the contents or existence of the transmission.

The law essentially just mandates you to stop listening as soon as you realise the transmission is not meant for you. Only deliberate violations are penalized.


> Because of how you seem to be approaching this, you've made no effort to explain why things should be the way you want them to be. You appear to simply treat it as axiomatic, i.e. a god-given right.

You are approaching this as if you broadcast something into the common airwaves it is yours and your secret, while I maintain it is no different than yelling that thing out your open windows and then claiming no one can listen to you. Just because it requires a trivial bit of technology to 'listen' to a radio broadcast doesn't make it any different than blasting sound or light waves. This is your issue -- you think that radio waves are somehow distinct from sound or light, when it is just another version of such things.


You have simply disregarded everything that has been said so far and returned to merely repeating the "god-given right"-opinion.

> Just because it requires a trivial bit of technology to 'listen' to a radio broadcast doesn't make it any different than blasting sound or light waves

In many cases it would be illegal to use a fancy (or not fancy) microphone to listen to your neighbours through a wall, and why should it not be?

It's one thing to accidentally overhear something, and another to deliberately go out of your way to spy on others. Even most(?) US states have wiretapping laws which prohibit such activities.


This is not at all like setting up a special microphone to eavesdrop on someone. A person with a baby monitor would be broadcasting a signal onto public airspace with an amplified radio transmitter. If it comes into my airspace why can I not receive it using the same technology? Why does one person get to use publicly allocated radio frequencies and other does not? Is this fair? If the baby monitor broadcast on non-public frequencies it would be doing something much more illegal than me receiving them.

You are criminalizing receiving but not transmitting. I contend this is no different to yelling out of your window and criminalizing people hearing you. if you cannot come up with something other than 'it is wiretapping and private' to argue against broadcasting unencrypted radio into public airspace with a radio transmitter being by definition a public broadcast then I ask you not to respond because there is no answer to something like that, just as there is no answer to someone contending that listening to something people yell out of windows is a violation of privacy.


>I contend this is no different to yelling out of your window and criminalizing people hearing you.

You are deeply wrong. Humans can not listen to radio transmissions without special equipment.

Listening to your neighbours baby monitor generally requires specific efforts on your part. Same is obviously not true of your completely ridiculous example.

A direct comparison would be listening to your neighbour using some special long range directional mic or a thru-wall mic.

>just as there is no answer to someone contending that listening to something people yell out of windows is a violation of privacy.

You are being deliberately dishonest at this point.


We've banned this account for repeatedly breaking the site guidelines.

Please don't create accounts to break HN's rules with.

https://news.ycombinator.com/newsguidelines.html


Humans also cannot transmit radio signals without special equipment either, so your point means nothing. Anyway, you start calling names means you are out of ideas.

You can call me wrong all you want, but these are public airwaves, and the laws disagree with you. That Finnish law you quoted makes exceptions for public channels, so you are wrong about that as well. You can stand on your misguided principles and technological fetishism thinking that radio receivers mean that the airwaves are somehow different than those same exact airwaves with a different spectrum of EMF.


> That Finnish law you quoted makes exceptions for public channels, so you are wrong about that as well

What am I wrong about? It obviously makes an exemption for CB radio which is intended for random people to socialize on.

"public calling channels" refers to a variety of specific channels such as 8.1 for PMR446 or 71,100 MHz VHF/RHA68.


>(This isn't a particularly idle concern. Amazingly Microsoft once got a court to let it take operational control of the domain no-ip.org — that is, to actually hijack the domain — a dynamic DNS service used by countless people — simply because one user was apparently using it for malware-related purposes.)

What a dishonest take. Microsoft didn't wasn't granted this court order because there was one bad no-ip user, Microsoft was granted the court order because there was a bad no-ip user that no-ip wouldn't take action against.

Oh, and it wasn't one bad user. It was 22000 different hostnames.


Author here.

If the sought action of the court case, and the outcome were, "the domain were taken down" that would be one thing. Domains get suspended by court cases all the time, that's not the issue.

What makes the no-ip.org case extraordinary is that Microsoft a) persuaded the court that the domain was being used for malware, and then b) persuaded the court that because of this, rather than doing something normal like compelling its operator to take down the afflicted subdomains, or failing that compelling a third party to suspend the domain, that they should be allowed to take over DNS service for the domain.

Microsoft is not the law and they have no special legal status. If a domain is being used for cybercrime it's one thing, it doesn't mean any random party should get to walk into court, complain about it, and then offer to "solve" the issue by randomly appointing itself DNS provider. Microsoft essentially hijacked and MitM'd the domain via court order, again demonstrating that the registries/registrars will always be a risk here.

The result I might add was a massive outage for a massive number of innocent no-ip.org users.


I think the fundamental issue here is that the court actually granted Microsoft's rediculus request. The only valid ruling here was for the court to order the suspension of the domain.

Seeing that Microsoft are an unrelated third-party, what was the judge's reasoning for granting them specifically ownership of the defendant's property? Wouldn't it have made more sense to assign ownership to a government organization instead?

Did Microsoft reimburse the domain owner the value of the domain or did they just steal it without payment?


It all got reversed eventually after massive negative press coverage. I don't think Microsoft took "ownership" of the domain, but simply got the court to make them the nameservers, though I may be wrong.

I do feel like the only way this request was granted was due to total ignorance on the part of the court of anything about how the internet works.


> I do feel like the only way this request was granted was due to total ignorance on the part of the court of anything about how the internet works.

It sounds like the court, unlike you, has the power to make the internet work the way it thinks it does, and is thereby right about how it works.



It's a completely reasonable request that has been granted countless of times now.

>I do feel like the only way this request was granted was due to total ignorance on the part of the court of anything about how the internet works.

This is absurd. The court ideologically disagrees with you about how the internet should work, not about how the internet works. This does not suggest that the court is ignorant of anything.


>What makes the no-ip.org case extraordinary is that Microsoft a) persuaded the court that the domain was being used for malware, and then b) persuaded the court that because of this, rather than doing something normal like compelling its operator to take down the afflicted subdomains, or failing that compelling a third party to suspend the domain, that they should be allowed to take over DNS service for the domain.

This is a completely normal measure, simply taking down a domain is not nearly as effective anti-malware measure than sinkholing it. A sinkhole could in some cases uninstall the malware from affected computers, or at least identify their IP-addresses for notification purposes.

>Microsoft is not the law and they have no special legal status.

Exactly.

>If a domain is being used for cybercrime it's one thing, it doesn't mean any random party should get to walk into court, complain about it, and then offer to "solve" the issue by randomly appointing itself DNS provider

Microsoft is not a random party, it's a party whose business is directly affected by these illegal malware campaigns and has been repeatedly held to have standing in these cases.

>The result I might add was a massive outage for a massive number of innocent no-ip.org users.

Turns out that possibly most no-ip users were malicious https://umbrella.cisco.com/blog/on-the-trail-of-malicious-dy...


Regardless of whether you think it's dishinest or not, his point still stands: tls mitm is not and cannot be mitigated via DNS.


Nor with DNSSEC: the same government that gave Microsoft control over this zone has de jure control over DNSSEC key management for that zone.


I wish there was wide support for public-key-addressable servers (like tor adresses). It won't solve the issue of memorable names, but it could solve this bootstrapping problem.

Perhaps le should look into encorperating tor into its domain verification process.


“[…] you cannot have a namespace which has all three of: distributed (in the sense that there is no central authority which can control the namespace, which is the same as saying that the namespace spans trust boundaries), secure (in the sense that name lookups cannot be forced to return incorrect values by an attacker, where the definition of "incorrect" is determined by some universal policy of name ownership), and having human-usable keys.”

— Zooko Wilcox-O'Hearn: https://en.wikipedia.org/wiki/Zooko%27s_triangle


Zooko's conjecture predates the invention of Bitcoin, and the article goes on to explain that blockchain-based systems can in fact have all three properties.


I don't think we would need to deal with zooko's triangle in the case of automated systems like let's encrypt. Human legibility need not apply.


It's not that anything in the verification protocol needs to be human-readable, it's that domain names themselves need to be human-readable and therefore can't just be derived from public keys. Which means you have to have some kind of system for deciding who controls which names, that doesn't just come down to who possesses a particular key. Zooko conjectured that this couldn't be done in a way that was both decentralized and cryptographically secure. He turned out to be wrong about that, although the DNS that everyone actually uses remains centralized.


Actually, you can.


I like the downvotes here for stating a fact.

The current CA system is horrendous in its centralization. It is completely possible to make a new mechanism using hashed-addresses and using traffic + user choice as the allocation mechanism for namespaces.

Instead of namespaces being fought for financially, users assign namespaces to site addresses (hashes) which represent a pub key of a keypair and identity of a server. The namespaces, say “search” is then assigned to the address hash with the most users by default. If a user likes a different one, they link the “search” namespace to a different hash and that counts as a vote for that location being the default.

This can be done using just traffic as an indicator for the defaults, in the event unique humanness cannot be established properly for an identity.

One summary of a frictionless scheme without central control that circumvents just about every shortcoming of the current system, and has all three properties.

There are other schemes, btw.

Also, in the event it isn’t clear: tls comes natively to this scheme because the addresses are pub keys. There can’t be a mitm for this scheme unless they have the priv key, or find a way to direct traffic through them and acquire a majority stake for a namespace and phish the original site. Whoever has the priv key controls the properties of the address hash, which is where all the records go.

This would make the internet significantly more democratic and less prone to bad actors. It would eliminate domain name squatting completely, and would enable new technologies which more closely match a namespace than old ones to have a chance, promoting innovation and meaningful competition.


So one day, the "search" default moves to the most popular and everything breaks? based on the amount of traffic generated for the other "search"?

Do you have more detailed write ups of that or the alternate schemes, at first take that sounds horribly flawed.


“Everything” wouldn’t break; the most popular address is the one that gets the name. It means businesses and admins would need to put in the work to have a good product instead of getting lucky / having a ton of money to grab a name. Most likely, once a popular name is defaulted it will never change since this system has a “snowball” effect, but if a ground-breaking innovation occurs, then it would have a chance of taking the name.

Anyone that manually sets a name to an address is unaffected by the default setting. Only people that haven’t overridden the default are impacted. Most people would likely not even participate in this mechanism of “voting”, so it would be a smaller group that I assume is more involved that directs defaults.

Nothing is perfect but I think this would have significantly better results for humanity as a whole once it is matured than the current system.

Additional note: For anything programmatic / apis / etc, the address hash can just be utilized to connect systems. The address hash is not an IP address. It is a record set that can only be modified using signed messages, where the latest signed message determines what is in the record — this is where a record for, say, another IP can exist. Or a record to another address hash, etc. This record set could operate basically the same as current records for domains.


The default is kind of like using top result of a search as the owner then? But I guess you want to count the number of real people who "favourite" a name > hash mapping.

You would need a consistent "easy" name as well at some point though, like a bank for example, can't use a name that could one day change for people who haven't bothered to default it.

Another issue might be names for the smaller, but very long tail of the internet, which would be open for abuse. For example a name could come and go with a social media post that gains traction, which would far outweigh the regular traffic for a name.


How exactly do you make the addresses meaningful to humans if they're public keys?


I explained that in the post. Namespaces / domain names / whatever you want to call them are set by individual users. The act of setting a namespace, ie binding “search” to whatever google’s hash is for example, contributes a “vote” to make that the default address for “search”.

Traffic can also contribute towards the count, either method would eventually settle on accurately capturing the will of people, but I would have to think about the mechanism for measuring traffic in a statistically accurate / honest way with a federated system.


The thing being described here isn't really an address system. The point of addresses is that they're supposed to be stable; I want to know that I can go to google.com and know that the thing on the other end is controlled by Google and not some other entity. This is a lot more important than being able to look up "search" and know that the thing on the other end was chosen democratically rather than auctioned off. If the thing I want is to connect to one particular entity, then under this system the only way I can do that with confidence is by getting their public key out of band, which is deeply inconvenient and the whole problem that domain names were invented to solve.

Registry operators can also hijack domain names, of course, but they have an economic incentive not to do that (except in cases like malware C&C domains that don't affect legitimate users), because their job is to ensure that the whole system of stable addresses keeps working, and failing to do that would undermine confidence in the whole thing. A public vote doesn't have that incentive alignment; anyone who bothers to explicitly configure their system in this way, is fairly likely to be someone who'd join a campaign to hijack a name for the lulz or to make a political statement, at the expense of usability for regular users.

It's true that if you have human-meaningful domain names, then some of them will be more desirable than others, and anyone who can get a good one, or who can distribute good ones to those who want them, is thereby in a position to collect a certain amount of economic rent. Which isn't ideal. But this is all a second-order consideration at best; it's a side effect of the goal of stable addresses, which is the important part.


It is highly unlikely that an entity like Google would not have control of the Google namespace with the scheme I am talking about, as it is clear what google is referred to as and this mechanism would eventually “settle” on the most correct names for each entity.

But if you don’t care about the entity and are talking generic names, like “search” or “market” it allows for a novel way of applying the namespace to the “best” one in a moment, without relying on a central party like an app store to tell us.

It also introduces a self-governance, eliminates stale squatting, gives better tech a chance, and eliminates the ability for authoritarian and bureaucratic entities from controlling namespaces. Who is ICANN really accountable to? If someone makes a site that is disruptive to the “national security” of powerful governments, by being more democratic and representative but stripping away their / corporate power, do you think the current system would just allow it to live?

We need new technologies that can handle fighting against the tyranny of small, unelected boards who subtly influence all of us in seemingly innocuous ways. The way we fight against it is by architecting implicitly democratic systems, bypassing these parasitic middlemen and replacing all of them with mathematically sound code.

There are some tradeoffs. We could go back and forth through this concept and discover a new weakness in the convenience, mainly for business. One might say “well, what about addressability for emails or federated identities” and, one by one, with some thought, these things could be resolved. But the core of the solution eliminates entire classes of putrid rot in the existing mechanism.

The rot I speak of is mostly unseen by people. It stifles innovation with stagnation, where squatters and “I got here first” eliminate the possibilities. This makes those possibilities completely hidden and stifled. Entrenched forces have no reason to innovate or progress. They are rewarded merely for existing, without any forces capable of opposing them without also being entrenched, or begging another entrenched force to aid them.

I can go on and on about the topic, but coming back to “globally stable addresses,” I think that this mechanism can be likened to an iterative / numerical method which, when given time, settles on the correct answer. Once a domain has settled, it would experience stability. And perhaps, when taken in conjunction with the existing system I’d want to see this mechanism replace, we already have “stable” names that come at cost. It isn’t like that would immediately go away. Every technology I talk about is voluntary, at a fundamental level no one should be coerced, whether by force or by implicit means, to use something.


You're punting the problem. You can't securely and objectively measure users and traffic.


You can measure users if users also have an identity bound to a key pair, with a mechanism to have attestations to their identity. In other words, the role of a CA shifts to making attestations that a pub key belongs to a unique individual. With that modification, it becomes possible to use their signature towards voting on which namespace operates as a default binding for an address hash.

This mechanism is very feasible when connected to a larger system involving federated identities, and a trust matrix where users decide which authorities they accept for identity validation (or any other attestation). Binding a physical identity to a digital one has a significant number of additional benefits, and it can be done such that anonymity is preserved via sub identities with verified claims.


Now you're farming out to another "larger system" to ensure that the keys are real people.

How does that system ensure things, and why can't that system do domains directly?

> a trust matrix where users decide which authorities they accept for identity validation (or any other attestation)

So if I tell someone my "domain name" I won't know what site they'll actually get because it's calculated per person?


No one should have ownership of a word. That is an individual choice that should move fluidly with the populace.

With this scheme, there are many ways to enable a stable endpoint that can be shared. But at the base, the addition of a hashed keypair address is introduced which is connected to a recordset controlled by a signed message.

With that, there are a lot of possibilities. Just sharing one of them. While I could outline every little detail, that would be better served in a different format and in the future.

There are going to be a lot of mental shifts required in many different ways. Maybe it will take a generation before those shifts are appropriately executed, I don’t know.


> No one should have ownership of a word. That is an individual choice that should move fluidly with the populace.

The ability to reallocate at some point is fine, but if I'm speaking an address to someone I need to be sure it only goes one place right now and in the near future.


Then I would say someone needs to make the best “thing” that entrenches their “thing” to a name. For the most desirable names, that would be the only way to maintain stability; constant innovation making something synonymous with the name.

This concept can be extended to support more stable namespaces. It just requires a little thinking. Could be as simple as a numeric queue for a name, like say you want the “search” name. You are the first to associate with it. You might have the permanent address “search.one”. Someone else wants to associate with it. They get “search.two”. This goes on and a million people want it. The millionth gets “search.million”.

These sorts of details have meaning but are irrelevant to the core problems what I’m talking about solves, and the core problems that need fixing: the CA system is inefficient, archaic, and tyrannical. They can be, technologically speaking, easily replaced with far more secure, purposeful, and democratic technological, autonomous systems.


If there is nothing between "search result that can be different for everyone except for the most popular brands" and "permanent number suffix that's probably eight digits long" then that's not a very good system.

And I do think that system fails to defeat zooko's triangle.


How do you handle key rotation?


When you connect to the service, the client tells the server which public key (key A) its expecting the server to prove that it has ownership of.

If the key A is still valid, the server can use the corresponding private key to sign a challenge.

If the key has been rotated out, the server instead presents the new key, and a signature. Eg, the server responds by naming key B, and presents a certificate of key B, signed by key A (the presented key). Instead of just a single key rotation the server could present a chain of certificates from A to B to C (the key the server wants to use). And optionally, a message saying "from now on, please make further requests using key B as key A has expired".


This falls apart if keys are ever compromised.


If the key is compromised, there’s two ways the key can be rotated. Either the key is updated upstream (in the dns record or through an app update or whatever). Or the next request uses the compromised key, (and could be MITMed.) The server responds with the new signed key. And requests after that will be safe.

It’s not perfect - it has some properties from TOFU systems. And it expects the client to cache key material. (It’s not stateless like tls). But I think it would be a pretty workable system.


Publish merkle roots on global ledgers like blockchains.


Handshake (namebase.io) comes to mind.


DNSSEC doesn't protect you against the American government if you have a .org domain, but I doubt an American court could give Microsoft control over a domain registered under a ccTLD like .de or .ru or .za for example.

I suspect Microsoft would also have trouble taking control of a domain registered under a gTLD run by a company based outside the US, but it would be interesting to see how the agreements between the gTLDs and ICANN would work out in practice.


Technically they could force root nameservers (based in the US) to intercept/proxy the whole gtld.

So all except n (netnod (EU)) and i (WIDE (JP))


>So all except n (netnod (EU)) and i (WIDE (JP))

US could just drop the records for those.


No, the US could not do that and there is multiple reasons for it. The root zone is rather special in that operating system semi-hard code the root servers. The operating system also have full control here and the number of name servers at the root zone changes very slowly. Operating systems developed by people not bound by US courts could just ignore it.

The other reason is political. If they were to cut out eu or asia from the list then the risk of a split would increase massively. It would be suicide. If they did that people might even split internet further by splitting iana (Internet Assigned Numbers Authority), in which case a computer in EU would be unable to communicate with an computer in US, and then the concept of a global internet would no longer exist. A split is a exceedingly dangerous concept.


I think the hardcoded IPs are typically only used as hints to initially resolve the root-servers.net domains.


Hints are used by the bind resolver software. It hard code the A -> M root servers and use those to initialize a cache. Naturally bind developers could change this behavior, and in the case that none of the hints works, the current behavior is to use a static compiled list that the software also include.


Not just bind, unbound also. Unbound uses the hardcoded list of IPs to resolve a-m once and build it's cache, the hardcoded IPs are never used again.


>DNSSEC doesn't protect you against the American government if you have a .org domain, but I doubt an American court could give Microsoft control over a domain registered under a ccTLD like .de or .ru or .za for example.

What? Obviously they could. ICANN is subject to US law.


This control is indistinguishable from a domain transfer, so this is trivially true.

Zones not under their control, however, are not vulnerable to this. So compared to the current system it would be an improvement.


so fucking what? it's an equivalent of a corporation invading and seizing control of an entire country because some people living there are doing it harm


That's like your landlord handing the keys to your condo to the bully upstairs because you have a cockroach problem.


More like your landlord handing the keys to your condo to the bully upstairs because somebody else on your floor has a cockroach problem.


Or to be more precise, the keys to every condo in the building.


It's like a judge ordering you to hand over your keys to the person living underneath because you have a water leak you refuse to fix.

Perhaps the water leak was caused by someone else, but it's still in your apartment.


1. That would still be ridiculous.

2. The water leak isn't actually in the apartment if we're keeping this accurate to domains. Maybe the only phone the plumber will listen to is in the apartment.

3. As someone else already said, the judge is handing over the keys to the entire building.


>1. That would still be ridiculous.

How would it be ridiculous? A water leak in your flat is causing damage to the flat below yours, it's your duty to address this. If you do not address this, someone will in fact go to court and take control of your flat.

This is something that happens all the time in cases where compliance with specific performance orders seems unlikely.


I have a domain on no-ip.org

I remember when this happened and I was trying to debug why I couldn't reach my home server.


>1. Flight tracking data, collected from ADS-B, is legal and publicly available. Aircraft ownership data is public too.

Not legal in Europe. You can't legally collect this (or any other PII) for fun, you'd need particularly strong reasons to do so without consent.

Mobile phones also broadcast their IMEIs and location, it would be similarly illegal to collect and store those signals to track phone movements.

>2. Nobody has a right to keeping their aircraft movements private, and aircraft movements != personal movements.

While not all aircraft movements are personal movements, many are.


Again, please provide any substantive evidence for that claim.

Private aircraft are neither private cars nor private phones and have he ever been treated equivalently under EU law.

You’re reasoning through false analogies.


It's the general data privacy regulation, it applies generally, to everything. It treats planes, cars and phones in exactly the same way (in that it never specifically mentions any of them).

The GDPR even covers you just writing notes into your diary about what your neighbours have been up to.


Is there a precedent for this or are you just interpreting it as what you think makes sense?


What exactly do you mean by precedent?

Yes, there are a plenty of precedents in the usual sense of the word. Such as this case, https://www.enforcementtracker.com/ETid-851

If you're going to argue (like _djo_) that this is not a precedent because it concerns a different type of a vehicle, you're entering into some rather absurd territory.

We have a clear example showing that simply storing pictures of car license plates by a toll road operator was a GDPR violation. Aircraft tail numbers are functionally exactly the same as car license plates.

The GDPR does not at any point discuss vehicles, from a GDPR perspective it makes no difference if the vehicle is a car, bicycle or your personal submarine. Or if there's a vehicle at all! GDPR concerns all PII for an extremely broad definition of PII.

Tracking locations of personal aircraft without consent is a GDPR violation, there really couldn't be a more obvious example of one.

PS. GDPR places the onus on the data controller to prove what they're doing is legal, not the other way around. You are guilty unless proven innocent. The reasonable question is to ask "Is there a precedent for this being legal?".

The answer to that is probably not, because the European flightradar24.com does have a privacy policy anywhere. This alone is blatantly illegal, but the reason they don't have one is almost certainly that their business is fundamentally not legal in Europe.

If what flighradar24.com and adsbexchange.com are doing was legal, they would have a privacy policy explaining the legal basis for their data collection. It's fundamentally impossible for their business to be GDPR compliant without one.


> It has exemptions for data published o based at n a legal requirement (could be the case here)

Couldn't, there's no legal requirement for anyone to record and publish ADS-B transmissions.

> data that cannot easily linked to an individual (number plates are not protected by themselves)

This is incorrect, number plates of cars belonging to individuals are going to be protected in almost any context you'd be storing them in.

> This jet isn’t owned by musk, it’s owned by a company

Doesn't matter, Musk isn't the only person with a plane. I own my own plane, it gets tracked by these sites.

> Journalists (including citizen journalists) also have broad protections in European law and those must be weighed against the GDPR protections

Websites like flightradar24.com are not journalists, but data brokers. That's simply ridiculous.

>There’s so much nuance to this that it’s possible this might fall under GDPR, but it very far from obvious.

No there isn't, this is crystal clear.


The comment you're replying to perfectly addresses that.


Why should anyone involved need to be in European? The jet in question is known to visit Europe with Musk aboard.

> a company with a European or UK connection about an EU or UK data subject

If you have EU or UK data subjects, you have an European or UK connection and have entered GDPR enforcement territory.


Well Elon still isn’t anything to do with the apparatus of gdpr enforcement so it’s still irrelevant and secondly enforcement would be against the sites which are supposedly infringing rather than people linking to them on twitter. This is a sideshow.


Buddy, not everybody shares your weird Elon obsession.

There are interesting phenomena to discuss here, but Elon's mood swings aren't one of them.


This is completely incorrect. Elon owns Twitter, Twitter is responsible for complying with the GDPR on their platform.

Elon in fact has a lot to do with the apparatus of GDPR enforcement.


GDPR has nothing to do with whether or not you live in Europe. The plane we're discussing here does frequently visit Europe.


Maybe when Europe takes control of the global financial system they'll be able to go after US citizens for doing things that aren't illegal in the US but in the meantime I don't see what difference the jet visiting Europe makes either.


Elon is not protected by the GDPR as he is neither a citizen nor a resident of an EU member country.


GDPR has nothing to do with citizenship, why would you even bring that up?

Really, it even has nothing to do with residency. It's all to do with jurisdiction, when Elon happens to be within EU jurisdiction he is protected by the GDPR.

When Elon takes his jet to visit Greece, he is indeed protected by the GDPR (even if just interacting with US based companies while he's on holiday, GDPR still applies)


Does it? I'd look it up but, well, @ElonJet i.u suspended. it seems it mostly goes between SF, LA, and Austin though. It's a G700 which has a range of 8,053 mi though.

Also, given that the GDPR only applies to people of the EU, I'd say it, at the very least, has something to do with living in Europe, since, umm, y'know, that's where most people with citizenship in an EU county live.


GDPR does not only apply to people of the EU, GDPR applies within the jurisdiction of the states which have implemented it. GDPR protects Musk when he flies to Europe, you'd have to treat that data differently than flights within the US.



This is all well and good but even if the EU claims jurisdiction over people who aren’t in the EU publishing information about the EU (not clear from this article that this is the case; it just says that it applies to you if you are in the EU even if you’re not an EU citizen), how would they enforce that?


Relatively easily? Even if your business has zero presence in the EU, other businesses handling money for you likely do.

US company using Paypal to accept money from US persons? Paypal has presence in the EU and will hand your money over.


I've never heard of this happening and, besides this, ElonJet was being operated by a private individual and not for profit. You think they're going to get his bank account shut down over it? I can't imagine the bank entertaining that.


The elonjet twitter has nothing to do with anything, it's just a bot reposting adsbexchange.


The whole reason for this tangent is a claim somewhere upthread that it’s violating the GDPR.


That tangent was regarding the data sources used by the twitter account.


How could it not be? Your plane's location data is just as personal as your car's, or your cellphone's. There's no special aircraft exemption in the GDPR.


I think there's something perverse about the very concept of having a personal plane. Perhaps that's the real issue here.


> Perhaps that's the real issue here.

I don't see how it could be, that seems like an entirely separate issue.


It's not. If it wasn't his personal plane but a chartered plane or one out of a pool of company planes, this wouldn't be an issue.


Who gives a shit about Elon? What the ADS-B data brokers are doing will continue to be illegal even if Elon never steps on a flight again.


Please provide some evidence of your repeated claim that they're illegal in the US and Europe.


As far as I can see, nobody here has made any claims regarding anything being illegal in the US.

> Please provide some evidence of your repeated claim that they're illegal in Europe

https://gdpr-info.eu/

What kind of evidence do you want exactly? This is crystal clear to anyone with the most basic understanding of the GDPR.


That’s not evidence. That’s just your opinion, based on your assumption that private aircraft are like private cars under the law.

Except that they have never been treated equivalently in any legal venue or government regulation.


Do you have any evidence to share which might suggest that GDPR treats private aircraft differently than ... literally everything else?

If not, why would we just not accept that GDPR treats aircraft exactly how it treats everything else? The law, as written, clearly offers no specific coverage or exemption for any types of vehicles.


As the one making the assertion of illegality in terms of the GDPR, the onus is on you to provide a substantive justification for it. Not me.


I've already done that.

You're the one arguing that there's some special exemption for aircraft, but have done nothing to substantiate that claim.

Besides, with the GDPR it works the opposite way. You have to justify why your data processing is legal, not the other way around.

And for fucks sake, neither of Flightradar24 or ADSBExchange even offer a GDPR-compliant privacy policy. ADSBexchange does not offer one at all.


A big reason these jet accounts were popular is people enjoyed calling attention to how wasteful many of the flights were, which I can’t imagine Elon was unaware of.


There are services you can pay for (in the US) to track a car’s (almost) real-time location without gps. It’s based upon license plates and widespread webcams and it’s not illegal (yet).



A plane is not a person, a phone, a car, or a home. Elon Musk is often the passenger on his jet, but I am quite sure he is often not on board while it moves around.


Why would a plane be treated differently than a car in a GDPR context?


> Why would a plane be treated differently than a car in a GDPR context?

A car is generally registered to an individual. A plane isn't.

You could also -maybe- argue that because there's multiple people on the plane (assuming Ol' Muskie isn't flying it himself) and that those people are potentially different every time, without a passenger and crew manifest, it's not identifying individuals (but I suspect you'd not get far with this.)


Planes are very often registered to individuals, and that doesn't even matter! The plane being company owned doesn't magically change anything, what matters is who's being transported and whether or not they will be easily linked to the aircraft.

From a GDPR perspective it also makes no difference whether it's 5% or 90% of planes that are owned by individuals as opposed to by companies.


Do you have some links that support this theory? I'd be interested to read up on it.

edit: Specifically mentioning planes and their locations, I mean, not "extrapolating from cars to planes".


>edit: Specifically mentioning planes and their locations, I mean, not "extrapolating from cars to planes".

You have to be trolling. What leads you to believe that the GDPR which never mentions either aircraft or cars would treat these two kinds of vehicles differently?

Can you find anything in the GDPR texts to suggest that cars and planes would be treated differently?


> the GDPR which never mentions either aircraft or cars

ICO's guide to the UK GDPR does have a specific example of cars being identifiable[1] - "A vehicle’s registration number can be linked to other information held about the registration (eg by the DVLA) to indirectly identify the owner of that vehicle." Nothing about planes though.

[2] covers car registrations and explicitly discounts company owned vehicles from being PII - "The registration plates of commercial vehicles are not personal data of an individual as the vehicle is owned by an organisation."

All of Ol' Muskie's jets are owned by Falcon Landing LLC, a shell company.

[1] https://ico.org.uk/for-organisations/guide-to-data-protectio...

[2] https://sapphireconsulting.co.uk/is-a-car-registration-plate...


>ICO's guide to the UK GDPR does have a specific example of cars being identifiable[1] - "A vehicle’s registration number can be linked to other information held about the registration (eg by the DVLA) to indirectly identify the owner of that vehicle." Nothing about planes though.

Car registration numbers is a very common kind of data for businesses to handle, of course it makes it on the list of examples.

Same is not true of planes, of course they don't make it on the list of examples.

>[2] covers car registrations and explicitly discounts company owned vehicles from being PII - "The registration plates of commercial vehicles are not personal data of an individual as the vehicle is owned by an organisation."

>All of Ol' Muskie's jets are owned by Falcon Landing LLC, a shell company.

This doesn't work, you can't wash off PII by tying one aspect of it to an organisation. My phone line might belong to a business, but that doesn't give the carrier a free pass to do whatever they want with associated location data.


Are you saying that those Muslims who are driven into these violent deeds by literally interpreting their holy writings are in fact not Muslims? Logically they'd be the biggest Muslims of all.

If you identify as a Muslim you identify as a supporter of those same oppressive texts that these Terrorists support.

It's hard to respect a religion that to all outsiders seems so completely insane.


> If you identify as a Muslim you identify as a supporter of those same oppressive texts that these Terrorists support.

I don't believe there are many modern christians that would say that the unchaste daughters of priests should be burnt alive [0], yet by your logic if someone "identifies" as a christian they "identify as a supporter of those same oppressive texts".

Modern Islam is no more "completely insane" than any other religion (or sect of people, religious or not) and it is incredibly prejudiced to claim that it is any different. While terrorism and oppression is carried out in it's name, the same has been true for many religions and ideologies over time, (take Female Genital Mutilation in parts of africa, where 55% of christian women have experienced it[1], more than their muslim counterparts. It should be noted that this does happen in some muslim communities as well). To categorize a faith as "completely insane" based on the actions of violent extremists is unfair.

[0] http://skepticsannotatedbible.com/lev/21.html#9

[1] http://en.wikipedia.org/wiki/Female_genital_mutilation


And a few months after the release of that article, the guy gets caught with large amounts of rough diamonds in his possession.

http://www.wired.com/2009/07/organizer-of-worlds-biggest-dia...

Sadly I was unable to find out what happened after that.


I bet they were probably purchased legitimately to mess with the authorities. He sounds like he was testing them, to see what would happen. Reminds me so much of penetration testing!


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: