Goed afternoon everybody. I'm Brenno de Winter en I would like to tell you a random story about technology we use in the Netherlands with these transportation cards. I'm a journalist and I started covering this case actually by accident. I never wanted it to cover in the first place but you know what happened? I was at Giles Computer Club and I'll tell you that in a second. I'm Brenno de Winter from the Netherlands. I started programming it the age of five. I focus go figure on security and privacy. And I write about it, I talk about it and I teach about it. If you want to know more about me, then buy me a beer and that always works, worked yesterday by the way. And I want to say one thing on the record and this is article 10 of the European Constitution of Human Rights. Everybody has the right to freedom of expression. This right should include freedom to hold opinions, to receive and impart information and ideas without interference by public authority regardless of frontiers. And you guys, you know what? You've got one too. So let's get started and I want to make one step back. I came back last year in the Netherlands and one day after DEVCON I found myself arrested for photographing somebody driving on a Segway. Why? Because the Segway is outlawed in the Netherlands or it was outlawed in the Netherlands. En this one was driving, not this one, but this thing that I saw was driving through the train station of Utrecht. And I thought like, oh cool, that's so cool for the block of the magazine I write for. So I took a picture, this guy went berserk, phoned the police, I was detained and they erased my photo. Boy, did they make a mistake. Together with the Federation of Journalists we sued the police and guess what, within two weeks they apologized, they reimbursed me, blah blah blah blah blah. Sorry sorry sorry. Then I came to the station of Amsterdam and I told this guy who I was and he remembered the case and he stood in front of me and he went, go ahead, take a picture. I love this man. But this was a wake up call for me that we have to be vigilant for freedom of speech all the times. This is why I'm here. Okay. Last year at CCC, the conference, the chaos communication camp, always held between Christmas and New Year's. Yeah, I used Twitter. They were short of goons and goons in Germany are called angels. So I volunteered and they said, like, can you do the my fair talk? So I said, no way. I want to go to this other thing. I want to report on that. And they like kept bugging me. Like we're really short of people. Please do this. So I went on stage because they always announced who's talking and I went like these two guys, they correct apparently RFID and it's kind of interesting. So guys take the floor away.  I went down set in set in the room and was typing with my editor in chief apologizing. And after the second thought slide, I thought over. This is real. They've got a story and this is a story to report. What did these guys do? They took the chips out of these cards. They scratched it off layer by layer. They photographed it and then started analyzing the cryptographic alpha algorithm called crypto one basically showing that security through obscurity does not work. So what do you do because now here's a story and to be honest, that might kill the company that's making the chip. So I phoned them and when I was back, I waited this story. Normally you would report it right away, but I thought let's be careful on this one. So on December 31st, when I was back, I phoned them and I went like, hey, this is going to do in the from the Netherlands. I've got a question for you. And you know, just before New Year's Eve, that's not a nice question. So right after New Year's Eve, January 2nd, I started publicizing it and thought this is the end of it. This is it, done and nice story. And then the second comment by a reader was like, hey, do you know that this card is being used in the Dutch transportation card? The one that we are introducing, the one that we already spent more than a billion euros. That's like 1.6 billion dollars on.  And then I started digging a lot more. You know, I started spending a lot of time on it and I found a find out that we are also introducing a way of paying with your cell phone. It's called these things with new field communications. They use my classic, but it turns out they use something else in encryption.  And they go like, well, you know, we don't trust it. It's kind of old, it's kind of closed, it's kind of unreliable. So they only use the my fair part for the communications and that part is kind of good. And then I found also that we have at Shell, if you're at the Shell station, you drive in, you've got this payment system, you press a button, you give your PIN code. And that was my fair classic using crypto one. Well, then January 17th, Rob Holmgeb restated the obvious that security through obscurity does not work. And we kind of found that out. And then all of a sudden a second case started developing. And this is what we called calling the Netherlands the Goud case because this was a public bid. This story is a total sideline. It is important because I started to work with this other reporter and we started to file a whole bunch of freedom of information act request. I really hadn't done that before, but you know, 1.6 billion dollars. That is something you want to spend some time on and at least, you know, file some for us. So I met them through this case, just that's my angle in it. And the story went on. And I hope there are no duchies in the room. And I know there are at least two because they are working with the transportation system that built these cards.  And I think that's great. But here we are. We have these broken cards. Something has to be done about this. So what did they do? They started a research, a study. Like, okay, what can we do with this card still? Is it broken? Should we replace it? And you know, this company called TNO, they started to study this and they said, you've got to replace the cards in two years. I always thought broken is broken and then you've got to replace it. But they thought we had still two years of time because you needed to do a brute force attack. And that basically for them would say like, okay, that's so much work. We've got two years of heads up. Kind of a strange thing. And when this was presented, I had something like, you know, this is not right. This is not correct. And then they said something else. There is no criminal business case in cloning these cards. You only can travel for free. So don't worry about it. If there's any damages, it's only damages for the company that runs the card. You know, does all that. I know that, you know, that's not what everybody thinks, but they weren't too worried about it. And together with that, the Secretary of Transportation announced a so-called attack plan. An attack plan, she wanted to attack the negative image of the card.  At that point, I had a hard time because the company that did this study and the company that ordered the study is not government. And you can't use a freedom of information act request on such a report. So what can you do? And then the secretary announced a contra expertise. So they would re-study the case. And they would hire this London based university, the Royal Holloway University of London. En dat is kind of interesting. Because if the Department of Transportation does it, that's the government and that's something you can do about it. And before that study was published, the German attackers announced that they would publish parts of the algorithm. And on March 10th, they did. And then on March 13th, something very interesting happens. All of a sudden, there's this announcement. We can open doors with my fact classic. We've known that since last Friday. We found the Dutch Secret Service. They verified our attack. And the Dutch Secret Service has warned all the governments of befriended nations. And we label this a matter of national security. En dat is kind of interesting. On one hand, we have caught a card that still can live for another two years. On the other hand, the same technology to open doors is apparently an issue of national security. Well, then right it is because you can walk into any ministry or department. Basically do the Jedi wave and the doorbell open. I have a little movie to show this. And it's really a very, very simple attack. You can see I, you know, I didn't have much time to prepare. So it's kind of chaotic, but there we go. Here you see the guys from Nijmegen explaining that they made this little device. You can hold it in front of a reader. And then it does. I'm not going into the technical part. It does a magic thing.  Corrects the key. Now it's on there. Don't you like these lights? And they do something magical and all of a sudden you can clone cards. And what was once secure is no longer secure. And this is the highly secure data center. I'm not going to start all over again. Don't worry. So now we've got two storylines. We've got the doors and we've got the transportation cards. And slowly it starts to hit the United Kingdom. That there might be an issue here. So MI5 starts to make announcements on the oyster card, which is the same. This is called the overchip card. And the oyster card is basically the same card as they have in the United Kingdom. And basically those two companies are kind of sister companies. You know they work together a lot. And technology is the same. System is the same. So similar. The Dutch is a little bit more advanced because they also use it in buses and stuff. And in trains they want to use it. But MI5 wants to use travel data to spy on their citizens. Oh no sorry to find terrorists. That raised for me the question. Gee, would we do the same in the Netherlands? Meanwhile there was this debate in parliament on the door issue. And nearly unanimous, I think it was unanimous though. Everybody agreed that the next system should be at least an open source security system. Because then you can repair it and then you can have a look at it. You know why? Because part of the TNO report that said that we still had two years of heads up was secret. And we still don't know what's in there. The company that's behind it wouldn't release it. En in a second statement, and that is very interesting. Our minister of the Interior said in response to a question of somebody of one of the Christian parties. You cannot silence researchers. They have a right to problems, they have a right to research and the government is not there to stop them. This socialist woman is kind of cool even though she's a socialist. I raised questions and I was telling you about the Dutch Secret Service. I found that already we've got two chambers, second chamber, first chamber. That already the second chamber passed the law that the secret service could gather intelligence on telephone data and on travel data. So my question was like, hey, this Dutch transportation card is coming up. They're storing the data for seven years. Are you interested in that? No. They're not yet. Then on April 12th came a big breakthrough. On April 12th, the researchers of the Nijmegen University announced that they found a new way to attack the Maifa Classic in such a way that they can crack a key in seconds. And they think below ten seconds. Or as this researcher has numerous times explained to me, your iPhone will be your RFID device in the future. Don't worry about it. So you can crack a card in seconds now and now the whole ballgame changes. Now I can stand in the bus, walk through the bus and everybody that has a Maifa Classic card, I can clone it by having an iPhone in my pocket. I'm so sure that nobody here has an iPhone in their pocket. So this is of course purely theoretical. Sounds travel slow that way. Together with the new attack scenario, the same day the report was released. This was kind of interesting. The Department of Transportation must have had the report at least for a couple of days. And they were supposed to release it around noon. Noon became one o'clock, two o'clock, three o'clock, four o'clock, five o'clock, six o'clock. Six thirty, I got a short message on my cell phone. Can you come to The Hague because in thirty minutes there's a press conference. The Hague is over eighty miles away from me. I haven't developed that Jedi skill yet. So I was walking the dog, I was running home because I was watching the press conference on the internet. And as soon as they published the report, I filed together with the other journalists my freedom of information act request. Could you please give me all the information related to the Contra expertise. Because if I do it like that, I automatically ask all the information on the first report. Because the second report was studying the first report. So this basically gives you all the information and I can tell you later on we got it and it was a pile like this. But we'll get to that in a second. All the time so far the Secretary of Transportation has said TransLink, the company behind the card, is responsible for everything. I cannot change that. I cannot do anything. And all of a sudden it was like I believe one a.m. in the morning somebody rang me out of bed and it went like hi, I'm an anonymous source and I got to tell you something. I sent you a link and you probably want to open it right now. So I went down, opened the link and there was this report that stated that the Secretary of Transportation can, if she wants to influence the Dutch railways, close all funding. Like you have had an issue on the highways in the U.S. She can do that on the Dutch transportation system and then only on the Dutch railways. But the Dutch railways have been funding for, I guess I'm not sure, but I guess for about 50% of TransLink. They are like a 50% shareholder. I don't know this exactly because they won't tell me because they say it's none of my people business. They've been funded by the way by public money, but that's a different story. So if you close down the money towards the Dutch railways, then basically you're influencing policies. So I wrote this up and then something very interesting happened, emergency debate in parliament and they said we'd want to do a vote of no confidence. That vote was really determined by the opposition versus the reigning parties. But one of the reigning parties said we fully support the Secretary of State, but as of now, every step you take, you've got to report to us. How much trust is that? So we call her now a lame duck among journalists because everybody knows she will step down and we don't know over what. It would have been cool though because that would have been the first time that somebody loses their job over a field IT project and field security. That would have been cool. April 22nd, MiFA Plus is announced by NXP. NXP, the company behind it used to be Philips and they say now, okay, we have the basic infrastructure, we have what we have. That's broken, we know that, but we add AES encryption to it. So you have a smooth migration path. En now very interesting during one of the talks with NXP, they said like, you know, if we would like to deliver this to the Netherlands, it would last probably about two years before we can deliver this. I heard that before. I'm not saying that it is because I'm just purely speculating, but it might be. On April 29th, totally as a surprise to me, I didn't know this was coming. This new report came out and apparently we have somebody who is the public transportation ambassador. And this political woman, she made the report and she basically said that if you want to save the cards, I would say, you know, fix the security. But basically she said like we have to be customer friendly. So we're solving security with customer friendlies now. I'm so sorry you lost your money on your card. And the second thing, and that was kind of issue, that was kind of interesting. She also wrote privacy is not a cause of concern until the media starts writing about it. At first, that was my response. And I actually, you know, basically she was saying that Brenno and the other guy Vincent were the cause of it. So I was pretty offended, you know, secret report all of a sudden it's there. And you know, it's an indirect personal attack. Then, you know, you drink a couple of beers and you think about it and go like, no, she's right. People in the street do not need to know if they have a payment system. They do not have to think about all the consequences. If you get on a bus, you should be thinking, gee, that might end up in a database for the next seven years. Have you been counting cameras when you went to the toilet here? No, you don't. I mean, you don't want to worry about it. It's the role of the media indeed to put this on the agenda, to discover this and to write about it. So I didn't report about it, but I wrote a column about it and I told basically that she was so right. And then she was offended. And maybe you remember April 29th because that was the day that the hand riser was found guilty. On June 5th, we had all the information of the Freedom of Information Act request. And the report, the Contra expertise was labeled 1.00. Now I was reading that and I thought like, okay, I know this document. I turned it around and there was document 1.0. Now I went back and I looked at Microsoft. You know whenever it's about security, I always look at Microsoft. I saw Windows 3.0, Windows 3.1, Windows 3.11. And here I've got the report and it's labeled 1.0 and 1.00. That's strange. That would nearly raise the suspicion that there's something to hide. En de funny thing is, both reports were the very same. There were only three differences. Two sentences and the final conclusion. The first one is that the Royal Holloway University feared a denial of service attack on the transportation system. And this was for me, this was the most important sentence that disappeared. Why? Because that gives me the opportunity to make a criminal business case. If you give me 100.000 euros, I will not disrupt the morning rush in Amsterdam. That is a criminal business case. This changes the entire report that there was before. All of a sudden I can do something that makes it very interesting to abuse the card. Now the ballgame has changed. The second thing was that the printer to make these cards, because you know you can clone the chip, but then you would still have a white card. But to copy this could be very cheap. Today I checked on eBay and it's less than 100 dollars if you're looking good. And that means that it would be interesting for a family of four. You know? A criminal business case doesn't have to be like massive no more. You can do it like out of the comfort or the leisure of your own home. Both statements basically boiled down to a change conclusion. The first conclusion was if we were you, I would basically seize the current project, get a new card and then start over and go, you know, move on. Which from a security perspective to me makes sense. The new conclusion was, you know what? Carry on what you're doing, but do start. And I must say to be honest to them, I must say they did state do start to change to new cards as soon as possible. But the difference is fundamental. Seize and then continue or continue and then replace. You know, that's a big difference. And if you have a secretary of transportation that nearly lost her head politically, that's a very big difference. So I was writing this up and then I got a very negative response by the department of transportation. And of course you can expect negative response, but also very emotional. Like we did not alter this. We didn't do this and they showed me extra documents. That basically indicated that they started a very thorough procedure to select the university that was doing the contract expertise. They hired even this company for it. That's kind of strange. And then what I found out is that the Royal Holloway University is advising to Transport for London. And Transport for London is the company behind the oyster card. The oyster card is the sister card of the Dutch over chip card. But you know, that's not a smoking gun. Neither is it a smoking gun that the guy who wrote the report used the word for Philips, the division that's now NXP because he wasn't involved in smart cards back then. Neither in itself is it a smoking gun when your company receives or your university receives money from Transport for London to do extra research for them. But you know, it starts to get itchy at the moment that somebody is part of the Board of Transport for London. You know that with journalists that raises questions. So I'm not saying that they did force the conclusions. Maybe something else happened. Maybe they did get scared about the denial of service attack and I'll say it in a second why they should be afraid for that. But it does raise questions and at least it might have happened you know by being over enthusiastic. On June 18th, there was this session in Parliament and two things were discussed there. One of that, this was the Nijmegen researchers. They were like hurt and they had to make a formal statement on what they did, how they did it, blah, blah, blah, blah. And then all of a sudden they asked like, did you apply your research in any other city anywhere in the world? Kind of strange question all of a sudden. But their answer was like, oh yes, we were on holiday in London. And we travelled the tube for free for a day. But we had to figure out which card to use because the first card kind of ruined the first gate. And later on, you know, when you start to hear the stories and you start like digging into this, they explained that the first gate went down and they didn't think much of it. The second gate went down and at the third gate they were like, no, no, no, no, no, no, don't do that, don't do that. And they realized they basically had a denial of service. I'll make a jump in the time because within a month the Transport for London decided to service a new patch. That was on July 15th. And this patch basically was meant to resolve the issue although all the gates went down. En the people that were using the gates anyhow, holding the cards in front of it, their cards were damaged. They had to replace on the Saturday morning, or at least on the Saturday morning, over 40,000 cards were ruined. This is your denial of service attack. I'm not emotional by the way, I'm just trying to shout. Probably the beer that I had yesterday. All of a sudden, there is this situation now. We have this real life scenario. It's happening for real in London. And it didn't happen in the Netherlands because we're not using this officially yet. The system is only in use in Rotterdam and in Amsterdam it's being tested on the subway and the Dutch railways haven't got jumped on the bandwagon really. It's kind of remarkable if you're the number one sponsor. I think they're really afraid to do so. At this point, there is no emergency plan. So if you were to roll it out fully, what is still the ambition, then if it were really broken, if there would service attack or open source tools would service or anything of that were to happen, then we wouldn't have a plan contingency plan. So what are you supposed to do then? What the Secretary of Transportation now demanded that there is a contingency plan. And as far as I'm aware, just before I left, I verified, they don't have one yet. But they are supposed, they are due to deliver that next week or the next week thereafter. So they should think of something. I, by the way, gave the department free advice. I would say like, in case of emergency, go for paper. On June 20th, the University of Nijmegen announced that they are starting an open source project to make a secure smart card. And that has been funded by NLNet to do it in a secure and privacy friendly way. At this point, if you want to have a discount in the Netherlands, this is my discount card, it gives you a rebate of 40%. So kind of interesting. You cannot have it anonymous. Even though you can think of systems that you could do it anonymous, I mean, you could have two cards and you know, put your tick on this one and then when the train conductor comes by, you show this as proof. And then basically that would work. But the Dutch railways don't want to go that route yet. I know of somebody who is planning to sue. So I think that's giving European regulations that they might have to adjust that part of the system. On July 10th, I did a lot of research. Oh, no, sorry, minor detail. On July 8th, NXP started a lawsuit against the Nijmegen researchers. They were suing the university. And they were suing the professor that is doing the research. Basically what they were trying to get is a temporary restraining order. That means that you are not allowed to do something. And they were not allowed to publish their results in October. Because this would like to be a real nightmare for national security. And it would be a real nightmare for all the companies that use my classic. Of course, I would have loved to have gone to that lawsuit, to the trial. But by really big exception, given the national security interest, it was all behind closed doors. Because it's all about the closed protocol. And if that leaks out, then basically the security is gone. Basically this is why security through obscurity doesn't work. We all know that. So I started digging in another way.  And I started doing a lot of research and found that since 2004, Chinese vendors have been selling clones of the smart cards. En the readers. So all this time, Chinese people have been able to clone tickets, access to the department, like the department of the interior. And military installations and you name it. That's kind of scary. I found the Dutch Secret Service and I asked them, have you known this? And how long have you known this?  We'll get back to you. And they phoned me back and they were like, why do you want to do it? And I always try to be as fair as possible. So I said, well, if you've known it for years, you've ignored a very big security risk. And if you haven't known it, why didn't you know? That's why your Secret Service. En they took another four days or three days, I'm not sure. And they came back like after the Nijmegen demonstration was given, NXP basically gave us this information. This part of their statement, I know for a fact, is not true. And if there's anybody of the Dutch Secret Service, don't be offended because I fully understand why you didn't tell me. But I've heard from multiple sources that after the Nijmegen University researchers showed their demonstration, like one or two weeks later, basically the Dutch Secret Service went to NXP and they went like, you are going to give us crypto one. No, we're not. It's like corporate secret. We're telling you, national security interest, you're going to give it to us. And apparently, you know, without too much lawyer work, they were so bullied that they gave it all. So I have to hand it to the Dutch Secret Service. I think that is awesome. Well, I told you about the oyster crash. And then on July 18th, something important happened, the verdict came in. I have to remind you because I told you about the minister of the interior telling me that she was standing behind the researchers. Pure coincidence on July 7th, I asked the department of the interior if they still were standing by the statement and they said yes. One day later the lawsuit came and it was kind of handy to use it in the article like the minister of the interior. I've got to tell one thing. When this thing in parliament was going down and the debate was finished, I was asking the, I was walking towards the minister of the interior and she walked towards me and she went like, are you that little troublemaker? So I'm like, yeah, good going boy. That was kind of cool. So they were like totally cool about it, especially the department of the interior was and they were very, very proactive in solving it. But now the verdict came in. What do you think the judge said? We give the Nijmegen researchers a temporary training order? Of course not. Remember the first slide in the Netherlands, we've got freedom of speech and that's what the judge said. You know, NXP, you've got freedom of speech in this country. You cannot silence researchers. The judge said no. You know what else the judge said? NXP, if you're making a faulty product and it doesn't work, that's your problem and it's not the messenger's problem. I could understand that. And the last thing the judge did was, he wrote down, they wrote down everything that happened like on a high line in the courtroom. So everything was behind closed doors, but every journalist had access to it all of a sudden. So what they tried to keep away from us and they wouldn't respond to us about it, blah, blah, blah. All of a sudden was out there in the open. So I asked NXP, are you going to appeal this verdict? And they went like, not really. So this is what we've been up to in the Netherlands. Currently we are rolling out a system that we know it's kind of flawed. I know that they are looking at different cards, but of course it's such a fundamental part of the system that is kind of hard to do. I must also state that the company TransLink has never, ever, ever bullied me. They've never, ever, ever stood in my way in any way, shape or form. Of course they did sometimes say that we are not going to answer questions. That is their given right of course. But they never, ever stood in my way. I know that in some countries, you know, that is different. And I know that in some countries, like the United Kingdom, it is very hard to get a response at all. I've had that TransLink was actively sometimes pointing me like, hey, did you see this? So on one hand, you know, you're the difficult reporter that is following them. On the other hand, you know, they're the grown up people that deal with it in a grown up way. And I think that's cool. And then what will happen in the future? Well, I know two things. In oktober, de study will be published by the Nijmegen University researchers. Ten minutes, okay. I was nearly done, so that's kind of cool. The Nijmegen researchers will publish their findings and then we can crack my classic cards all over the world in a matter of seconds. I guess that will be perfect over time. I cannot imagine that it would take longer than three or four weeks to have open source tools on the market. And I wouldn't be surprised if they would service before that. If anybody in the room is using my classic at this moment, this is your final wake up call. This is your final heads up. You've got two months left and if you haven't done anything, you're screwed. The second thing that I know is that we won't get this transportation card ultimately and will go for a different system. I've talked quite long, so I think I have only a few minutes left for questions. After that we can go in the Q&A room. Again, I'm pretty technical, but I've been advised by several lawyers not to go into technical details of the my fair classic. But anybody who has access to Google, any questions? Sorry, I couldn't hear that. The tools you need is that expensive? No. The cards. Oh no, no, that's like one or two euros. Because there's a unique identifier there and they would register the unique identifier that is registered to a name. They did make some privacy safeguards, but you know for like law enforcement, that would be kind of interesting. Think about what the issue is with that.  And that kind of ruins your day. Oh, how much does the equipment in China cost? I don't know exactly. I sent them a couple of emails. What I found was that they wouldn't, they will only discuss larger numbers. I also asked them, is it possible to buy totally blank cards without any factory identifier? And they only would talk about that in person. I would like to ask, at one thing I forgot to tell and all of a sudden I remember, in Canada, there is a report available that you can buy with all the information. It's about $60,000. Anybody else? Well, that kind of sums it up. Thank you.


The Tiger, financial news network, headline news update. Hi everyone, Basel Chapman on this very snowy here in Boston Day and this is a Friday, the 25th of February. This is the Tiger Financial News Network, 10 a.m. market update, down to 89 and 30,310 slump to 32,272 yesterday had a really nice turnaround. This green candle right here is a green Chapman wave, a Roman candle at a low, a whole bunch of criteria that you could go with and see what happens. You'd close above the high of yesterday for two out of three sessions and that says yes. That's a much better signal now you can start moving a little bit higher to the next resistance. If we start to fall and close into this body of the candle today, that's going to say whoops, maybe a starter for some kind of a reversal. We'll see what happens. I'm going to go through this in my show, the Tiger Traditions Hour coming up in a couple of minutes and I'll show you all the different criteria that I've been looking at to pull back sharply to say we can have some form of sustained ready going on a little longer. The S&P's up two at 42.90, slumped yesterday to the low 41.00s, had a huge spike to the upside, really good looking candle, but it also has to close above the 42.00, I'd say I prefer to see 43.00 level today to say hey that's going to improve the weekly chart. That monthly chart, we'll talk about in my show, you've gone to the lower part underneath the Roman candle at the highs. That is the exact opposite thing we're looking at. Looking at the QQQ, NDX100, down two and a half at 338.00, almost touched the nine-period moving average, came up to 318.00 low of yesterday, really good rally. Now maybe there's a give back of some we'll see on by Tuesday, we're able to rally into the 346.00 or higher level, IWM Russell 2000.00, that was a really good candle yesterday. There's some follow through, there is 190.60 was the low on the 24.00, 187.92 was the lower low yesterday in the dreaded H pattern, I'll be talking about that in my show coming up because this is an important moment. Now what we're looking at is we're looking at gold. Had a huge move in today yesterday, spirals, spirals all the way into the 19.00, 76 level and now it's trading at 18.77, big comeback and Crudall is holding near the highs, we're pulling back a little bit down 92 cents and the TLT is just terrible, cannot get a rally what it's up to 10. I'll be back in a moment for the take of the Christmas hour, check out my opening form again.


a couple more minutes, but that's my real good life. Hello, video people's. Hello, video people's. Hello. And we are going to have a shorter post show today. I apologize for that ahead of time, but I've got a jet to the comedy film nerds podcast as soon as I'm done. Well, um, that is a good excuse. Tom, I don't know how many times we have to tell you this podcasting thing is not going to take off, Tom, like I just give up or really limit your plan B for sure. Yeah, the the Good Day Internet folks got extra pre-show to make up for it. So if you are a Good Day Internet subscriber, you can go do that. Yeah. And then, you know what? I don't give creative arts enough praise. I know there's only like, you know, less than a hundred people that do it. But he he goes and takes the Good Day Internet audio, marries it to the video and then uploads it privately and puts the link in the Discord and on Patreon. So people like, oh, but I want to listen to Good Day Internet on YouTube. They can. Yes. And I get those notifications in my email. And every day I'm like, that's a nice, such a nice thing you're doing. Oh, my informed daily digest has come in. What's in my mailbox? And it's nothing good informed. Yes. USPS will, you know, they send you an image of all your mail. I like that service. I love it. It's just a scan of the of the envelope, the outside of the envelope. So you can know, like, oh, it's just junk mail today. I'm not going to worry about it or like, oh, well, my check is coming. Totally. Yeah, you're expecting something. That's what I'm like, OK, there's that. It will even you won't scan it, but it'll give you links to tracking numbers if you're getting a package. Well, somebody else named Sarah Lane, not me. Somebody in the UK apparently bought some ceramic pots and she was informed via my email that the pots are on their way. So this is a very annoying thing. I was one time fans of the show have heard Roger go off on this one before. I get so many. OK, so it's bad enough I get other people's emails in my inbox, but I can't even register for like the DMV site using my email because someone used it already and now it's been banned or suspended because of something that I don't know what because that wasn't me. Who signed up with that email? That's so annoying. Yeah, I got to make a different account or something. There was and I've complained about this before. Just just you got a common name. You're going to get other people's emails. But there's a it's like swimming lessons in North Carolina, one of the Carolinas. And I kept getting these invoices like you've been invoiced on square. I was like, you know, I'm kind of looking. I'm like, OK, I don't see a transaction. But I kept emailing them like, am I being charged or something? Like, I've never even been to that state. I don't know how to swim, like for sure, for sure, not me. You know, and the woman kept ready back like, so strange, I'm sorry. I'll make sure that this gets fixed.  And so and then she, I mean, this was this has been going on for well over a year. And she finally got really annoyed with me, like, you're not getting charged. Or I'm like, OK, but whoever you're trying to charge, could you stop sending me the invoices? Yeah. Would it be the person that should be getting these? Stop sending the wrong person.  Right. I used to get. They're like, they're taking them in. I think it was the same person. I would get email for a dentist and a car dealer in Florida. And then I would I would get like the the the weekly minutes of the architectural committee for a church in Minnesota. Were they interesting? No, I never looked at it. Was it was it for a new dental office? No, the dentist was in Florida. Well, I was trying to combine off. Yeah, it didn't that I don't think you can combine. Use dentures that use car prices. Hey, you know what we can do, though? Daily Tech News Show, who's in? Me. Really? I am. Yeah, I guess. All right. It can only be one or and that's me. You're already here. Yeah, I'm already sitting in the chair, got everything turned on. And might as well hang out for the next half hour or so. A man wants a name from our Patreon. And I'm going to add it here shortly. And then, Sarah, could you read it? Yes. Can and will. Do we do we have coming on tomorrow? Yes, OK, because we didn't have anything at the bottom. So just make sure I didn't get missed. Oh, thanks. Yeah, and Scott is often on our bonus show as well. Yes, it worked out nicely. And he will be again tomorrow. OK, Ryan's with Ryan's with Kevin, you think? I was going to say Javon. OK, all right. But, you know, your mileage may vary. All right, here we go. Three, two. Javon Phillips has supported independent tech news directly for five years. Be like Javon and become a DTNS member at patreon.com slash DTNS. We have to do that over again. I'm sorry. I wrote it. I didn't change it. He hasn't done it for five years. Oh, I just signed up. Five minutes. I forgot to change it. OK, so here we go. All right, let's try again. Take two, three, two. Javon Phillips has supported independent tech news directly for about a day. Why not be like Javon and become a DTNS member at patreon.com slash DTNS. This is the Daily Tech News for Tuesday, May 21st, 2019 in Los Angeles. I'm Tom Merritt. And from Studio Feline, I'm Sarah Lane. And from somewhat overcast skies, I am Roger Chang, the show's producer. Well, we've got more Huawei news for you today. We tried to make a Huawei sandwich. All right, we've got a little non-Wahway news at the top, then some bunch of Huawei news in the middle, and then some non-Wahway news for the bread at the bottom. But it's all important. It's good stuff to know and try to understand what's going on as things get a little crazy in the supply chain world of technology. So let's start with a few tech things you should know. Sony Interactive Entertainment President and CEO Jim Ryan told investors, the streaming era is upon us and is about to begin a period of rapid growth. He said 5.6 million PS4 owners use remote play. Ryan did say that the next generation of PlayStation will have a disk drive. Yeah, take that Google. Mozilla launched Firefox 67 for Windows, Mac, Linux and Android. The browser includes faster startup, deprioritizing lesser used features to save you on some memory, suspending unused tabs, crypto mining blockers and fingerprinting. Firefox 67 also adds password saving and support for extensions to your private browsing mode and adds voice input in the Android search widget. For desktop users, the toolbar is now fully keyboard accessible and web render support for Nvidia comes on Windows 10. The desktop version is available for download at Firefox.com and existing users can upgrade automatically. The Android version is rolling out on Google Play. Man, considering I have 400 unused tabs open at all times, it's probably time for me to switch back to Firefox. Huawei launched its new Honor 20 series of smartphones in London on Tuesday. The Honor 20 Pro runs on Huawei's Kirin 980 processor with quad rear cameras, side-mounted fingerprint scanners and has a 6.26-inch display with a hole punch for the front-facing camera. The Honor 20 Pro, Honor 20 and Honor 20 Lite will sell for 599 euros, that's about $669, 499 euros and 299 euros respectively. Huawei says the models are certified by Google, so we'll come with Google Apps. However, they're released too late to receive lowest-level updates from Google while U.S. restrictions exist. Huawei will have to provide those as they appear on the Android open-source project. And Alphabet-owned Verily announced a strategic alliance with pharmaceutical companies Novartis, Sanofi, Azuka and Pfizer to help it expand its reach in the medical studies market. Verily wants to make it easier to enroll and participate in trials and then be able to combine data across sources like electronic medical records and health tracking devices. Verily uses Google Ads to find patients based on health-related searches and suggests that they join company projects. All right, since we last met, the U.S. Department of Commerce has had a marginal change of heart. Sara, tell us about it. Monday afternoon, the U.S. Department of Commerce granted Huawei a general license to buy some U.S. goods until August 19th in order to maintain existing telecoms networks and provide software updates to Huawei phones. The move is intended to give telecom operators time to make other arrangements. This will allow Google to provide security updates to Huawei for its existing Android-based phones. Otherwise, Huawei would have to delay as it waits for security updates to appear on the open-source project that's behind Android. Huawei is still prohibited from buying U.S.-made hardware and software to make new products and the Commerce Department will reevaluate the extension in 90 days, perhaps extending it beyond that, perhaps not. Huawei CEO Ren Zhengfei said that the U.S. underestimates Huawei's capabilities. Oh, yeah, we're gonna get into that a little bit, but the upshot here is a little bit of the pressure is off. I don't know if Huawei is allowed to stockpile parts under this. I don't think they are. I'm not sure if Huawei is allowed to provide those Android updates to new phones like the Honor phones we just talked about. We don't think they are. There might be a way for them to get around it. There's still a lot of details to be worked out on this, but it is a softening of the move from yesterday, which probably has more meaning in the world of trying to figure out trade negotiations than it does in consumer tech. But for the moment, it's good news if you hold a Huawei phone already. If you already own one, it means that you should be able to get those Google security updates for Android at the same time that you normally have. They will not be delayed and you'll continue to have access to all your Google Play services and everything. You mentioned stockpiling. Is there some sort of a number where it's like, now you guys are just buying too much more than you would need for 90 days? Yeah, that is the question, right? Is sort of like what they want to do. What the Commerce Department has said particularly is we want ISPs to figure out a transition off of Huawei equipment. However, we're giving them 90 days to figure that out. And so during those 90 days, we'll allow Huawei to sell them parts to fix and maintain the units they have right now. So, you know, a card goes bad. They can order a replacement card from Huawei, you know, that kind of thing. But how do they tell? How do they enforce that? That's the Devils in the details there. Yeah. The Verge took the list of components from iFix. It's teared down to the Huawei P30 Pro to give us an idea of what kind of parts come from the US and where it could get replacements once that stockpile of parts runs out. This is just the P30 Pro so this isn't representative of every phone from Huawei. Different phones use different parts. But for the P30 Pro, the Gorilla Glass comes from the US. So that would have to be replaced and could be replaced by Dragon Trail from Japan's AGC Asahi Glass which is also used in the Pixel 3a. So there's even a major phone out there with it. Micron storage could be replaced by Toshiba or Samsung or possibly even be replaced in-house. High-silicon has supposedly been developing some external storage, some SD card kind of stuff which could be adapted. Skyworks and Corvo networking cards might be the hardest. Now, those aren't used in every model of Huawei but in the ones used in the United States or sold in North America and Europe for LTE. Those are gonna be the harder ones to replace. They might need to be developed in-house. And of course, Android which as we just heard right now they can continue providing some security updates. Also, they can just use the Android open source project which delays updates from what they would get from Google. But Huawei is supposedly developing its own operating system as well. Yeah, and that's the whole, we were talking about this yesterday like, okay, well, how much is the company bluffing because they have to seem like they're strong. We knew this was coming. We've already thought about this. How easy in theory, it's like, okay, well, there are other companies who make the same kind of technology that Huawei would be interested in outside the US. But in practice, how easy is it to change all of that supply chain? Yeah, and it sounds like in some cases it might be easy to find the replacement part. Remember, there's also the difficulty of changing your supply chain of validating that a part works well in the system you've put it in and good putting it through testing and making sure you can support it and your drivers are there for your software. You know, it's not as easy as just swapping out the part.  It's never simple. There are also parts that are gonna be difficult to replace and that's where this comes down to is can they keep going after they eliminate their stockpile? They are putting on the bold face saying, yeah, we will not have any problems. Don't worry. We'll keep delivering new security updates. We'll keep delivering new phones.  And I will add that the biggest hurdle will of course be the OS, right? Like delivering a software product is one thing, but maintaining and iterating it successively to the satisfaction of your customer base. That's the tricky part. Yeah, well, I mean, I think it's all tricky, but yeah, you're right. That is not an easy thing to do, which makes me think they'll want to stay with the Android open source project, which is what most phones in China do. It's what Huawei does in China already, so. The Verge notes that while Microsoft has not made any statement about licensing Windows to Huawei, the Mate X Pro Windows laptop is no longer available in the Microsoft Store as of this weekend, Mate 10. Huawei uses Windows on its consumer laptops in its network servers and in a hybrid cloud solution for Microsoft's Azure Stack. My interpretation of this is that Microsoft is being very cagey. They don't want to make any announcements about Windows until they have to. And so until they need to provide a new license agreement, it's possible that Huawei has an agreement that's already signed that allows them to install a certain number of Windows and it was signed before these restrictions went into place. So Microsoft doesn't have to take any action or take on any liability for it. And at which point they can hold off and see if this ends. I get the feeling that Microsoft is hoping that this just all goes away before they ever have to make an announcement about that sort of thing. But just to hedge their bets, they pull the Mate Book X off the store so they're not seen as selling something from Huawei, which might muddy the waters. The U.S. has issued an alert warning consumers that Chinese-made unmanned aerial vehicles, aka quadcopters, aka drones, could pose a security risk to U.S. businesses and other organizations. The alert did not name companies, but China's DJI holds around 70% of the U.S. market for UAVs. DJI said it gives its customers complete control over their data, adding for government and critical infrastructure customers that require additional assurance. We provide drones that do not transfer data to DJI or through the Internet and our customers can enable all the precautions that the Department of Homeland Security recommends. However, despite all those assurances, the U.S. Army prohibited troops from using DJI drones starting in August 2017, which was the same month that the U.S. Immigration and Customs Enforcement Department accused DJI of providing U.S. critical infrastructure and law enforcement data to the Chinese government. So there's a little dispute of opinion between DJI and parts of the U.S. government. DJI, since that day, since August 2017, has introduced a privacy mode that prevents any data from being uploaded to the Internet if you so desire. U.S. states are all using UAVs for things like road and bridge inspections, as well as creating complex farming programs and the like. Yeah, so I guess at this point, do you trust DJI when they say, we'll give you a super secure mode if you don't want anything transferred to the Internet? Don't worry. Is there any scenario where that would not be true? I think that one of the things that I would tend to want to say is, well, these things are fairly well audited. And if the privacy mode wasn't blocking off Internet connection, if there was a backdoor, enough eyes are looking at this sort of thing that I would guess it would be found. But that sort of rhetoric doesn't seem to change this thing. There has also never been evidence that there is a Huawei backdoor. And the only evidence we've ever had of security problems in Huawei are the normal security vulnerabilities, some of them very bad, as we've talked about in the UK study, but the kinds of things that are just bugs and aren't phoning home. They aren't backdoors that malicious actors take advantage of on purpose. So you could argue that like, okay, well, maybe the Chinese government is taking advantage of those vulnerabilities the way that hackers and attackers do. And that's possible. But that's quite a difference from saying it was designed in, which there's never been any evidence of. So I'm saying there's never been evidence of that Huawei. That hasn't changed the US approach to Huawei. Why would the lack of evidence with DJI change the US approach to DJI? It shouldn't, really. I guess it would, yeah. Yeah. Yeah, I don't know. The story, it is, gets more interesting every day. Well, the Huawei meat in our sandwich is over now. It was good. Yeah. You know, it depends on what kind of sandwich you like. I liked it. Apple announced the 15-inch MacBook Pro will now come with eight core and six core processors that should make it run twice as fast as the previous quad core models and 40% faster than the six core. The 13-inch MacBook Pro with Touch Bar will now come with Intel's eighth gen quad core processors. Apple also announced three things regarding its keyboards. This should be good news for some of us who have had keyboard issues. A new material in the keyboard mechanism should reduce double type and the no-type issues. All butterfly keyboards are now part of the keyboard service program, so you've got more care there. And it's promising faster repairs for those who do have issues anyway. Older MacBooks needing repair may get the new improved material as well. Both of us, I have had MacBook Pro keyboard problems. Mine were a long time ago, a couple of years ago. Mine would spark when I hit certain letters. Yeah. Spark? Yeah. Coming right out of it? Yeah, just a little blue spark every once in a while. My keyboard issues are not that big a deal, but I've got, you know, the backlight just decides that it wants to take a nap sometimes. Oh, yeah, I had that too. That's actually why I got it replaced. The spark I couldn't reproduce, but the backlight going out, they replaced it, and then the new one didn't spark anymore. Hmm, yeah. I never had the no-type or the double-type issue, though. Me either, although I'm actually using a MacBook Pro for the show that also has a display that no longer works, so I have to use an external monitor. So, you know, this is a 2016, late-era 2016 touch bar, 13-inch model that is known to be problematic. But anything that could be covered under an extended warranty, which Apple historically can really drag its feet on, even though there are many, many message board issues that make it clear that it's a known issue. Yeah, it's, if it applies to you, then it's a good thing. Or if you're in the market for a new MacBook Pro, might be the time. So here you go, Butterfly Keyboards, now part of the Keyboard Service Program. So even your older models are now covered under this, which is good. That is a good move by Apple. It's promising faster repairs and detailed a few of the measures that will allow for that, which, okay, you know, devils in the details there, proofs in the pudding, all those cliches, but yeah, that's a great thing to promise. I hope they follow through on it. New material in the keyboard mechanism that should reduce the problems. That's the one where it's like, okay, you put in the little, like, the lining before. They didn't really make a big deal out of that when they didn't even admit they did it, but they did it. New material, they won't tell us what the material is. I'm a little, I'm most doubtful about that when they're like, I don't want to tell you what we did, but we did some new material. We did the science, and now the science will say that. Like, why can't we know the material? Is it not addressed for the material? Is it such, is it like a new Space Age patented material that you don't, you can't explain because it's a trade secret? If it's a material, if that's an advance in material science that big, then that's amazing. You should probably tout that and just not tell me what it is, but that's not what they're saying, so I don't know. Yeah. The US Postal Service started the first of five round trips moving packages between Phoenix and Dallas, think it's about a thousand miles, using autonomous trucks from San Diego Startup, too simple. In a press release about the two-week pilot, the USPS said it could possibly use a future class of vehicles to improve service, reduce emissions, and save money. Too simple will have a safety driver behind the wheel during these tests, and also an engineer in the passenger seat who's kind of monitoring everything. The USPS spends more than $4 billion per year on highway trucking services and costs have been rising due to a shortage of drivers. Yeah, I don't think a lot of people realize this. I didn't until then. Yeah, when we talk about, like, robots taking jobs, sometimes they're not taking jobs. They're doing things that not enough people want to do, and this is one of them. So I don't want to be glib and say, and so truck drivers don't need to worry because maybe they do, but it's a little early to worry, especially when this is supplementary. They're doing five round trips for two weeks, and then they're going to stop and reevaluate. But it's a step along that road, and it does show, to my mind, that trucking and freight is probably, just like enterprises for augmented reality, trucking and freight is probably where we'll see autonomous driving technology really become a useful thing first. I know that they say, hey, listen, you know, costs have been rising because not enough people are driving our trucks, so we're going to get the robots to do it. Will the savings be passed along to us eventually? Hard to say. But you know, you can't, you can't, won't happen unless you try, right? No, that's not the way it works, right? Right. It's not, they don't like, this is, I'm just going to go off on it. I'll try to limit my rant here, but you know, it's not like everyone says, well, it costs this much to make a widget, and so we will always sell it for five cents more than that, no matter what it costs. That's never the way it works. It's always like, how much more than what it costs us can we sell it for? That's what's called margin. That's why when you talk about Amazon was operating at such thin margins, they were not charging a lot more than it cost them to run for a long time. So no, the costs might not be passed along to us, but they also might be if the pressure has been not to use the postal service, which has been the problem, and lowering the price could bring more people in and allowing for cheaper delivery would allow them to lower the price and maintain their margin or even increase it a little. Then yeah, it could pass the savings along to us, which would be a good thing. Watch out, Amazon. USPS coming for you. Yeah, maybe think of Amazon, didn't it?  Lots of other companies are. Amazon's going to do the self-driving trucks, except they're not. The US postal service is in this particular case. So I'm not saying Amazon won't ever do this stuff, but they don't even need to be first, right? And I mean, the knockoff effect really is once this technology is used, especially with a governmental agency, and they can scale it to where they can actually leverage the automation into, at least maybe not lowering costs, but stabilizing so they don't see an increase year after year. That could bring down the price of the technology, but also encourage other companies, hey, if the US Postal Service says this works and it's working with them, why can't it use for Joe Blow, a short haul freight or moving company? And our intern Amos points out that USPS has run out of budget deficit for some time. So if it could just reduce that, that would be great. Finally, new imaging methods combined with a better understanding of the chemistry of fur and feather pigments has let scientists know what color a 3 million year old mouse's fur was. We'll explain why that's important. The reddish brown with a white underbelly, if you're wondering, is what the color was. Fur color comes from two kinds of melanin, U melanin, which produces the black and dark brown, combined with pheomelanin, which does the red and yellow. Now, U melanin holds up over time. A lot of time when they tell you what color bird feathers were, or even some dinosaur feathers, it's because they can find the U melanin. But if the fur or the feathers relied on pheomelanin, they can't see it. It breaks down and it's gone. University of Manchester geochemist Roy Wogelius and his colleagues determined that tiny traces of zinc do remain behind after broken down pheomelanin turns into sulfur and then the sulfur disappears. So a technique called synchrotron x-ray fluorescence imaging causes interactions that can be used to determine the patterns of metal traces. This is a kind of imaging they've been using for a long time, but they haven't been looking at the effects of the interactions with metals. So they started looking at it and figured out, oh, when it's zinc left from pheomelanin, it interacts this way, which lets us tell where the pheomelanin was, which then combined with the traces of U melanin allow us to determine what color the fur was that was on this mouse. Now, has to be a pretty well preserved mouse, which this 3 million-year-old mouse was. And there may be hundreds of these, certainly not thousands or millions of these kinds of fossils that are preserved well enough to tell this. But that's enough to be able to start making some advances on telling what these older animals looked like. And if you want more on this, read Keona N. Smith's article at Ars Technica. It's really good.  Like how does that change anything? But I assume we would have a lot to do with how a species would evolve to escape prey. And it gives us a lot more context on, you know, how things may have changed over the last million years. Yeah, and Amos was telling us in our pre-show that one of the things that you can tell is a certain amount of intelligence. If there are parts of the coat or parts of the feathers that can be displayed for mating purposes or to avoid being prey purposes, that will tell you that this animal had a little higher level of intelligence because they had to know when to display the right parts of their coat or their feathers. So all kinds of things you can tell from this sort of thing. Topology can determine roughly climate, right? I mean, if you have a reddish brown animal, it's probably not living in a tundra or area with heavy amounts of snow. So you can... Or it had to lay on its back all the time in the tundra. Or that... Had to hide really well.  They see in an ultraviolet shift. And so when you look at it that way, all these things help determine not just what the animal looked like, but what the surroundings were. And that can kind of lead to all sorts of things like you can kind of maybe extrapolate climate, temperature, how long the day was, you know, stuff like that. So it's really fascinating. It's pretty cool. Yeah. And I think the thing that brings this into a tech show is the fact that they're using a technique that has been around, but finding a new way to use it, that synchrotron x-ray fluorescence imaging. Say it's three times... Synchrotron! If you want to get all the tech headlines each day in about five minutes, say DailyTechHeadlines.com three times, and you'll be...  But you can also just search Daily Tech Headlines in your favorite podcatcher, and it'll show up there as well. It's on the Amazon Echo. It's on the Google Home.  Find out more at DailyTechHeadlines.com. Speaking of headlines, you know who helps us with our headlines every day? In fact, they did this morning. Everybody who participates in our subreddit, you can submit stories and vote on others at DailyTechNewShow.Reddit.com. We're also on Facebook. If you like Facebook groups, Facebook.com slash groups, slash Daily Tech New Show is your new favorite. All right, let's move on to Chris Christensen, the amateur traveler who has a niche hotel booking site for people who might want to stay near a subway. This is Chris Christensen from Amateur Traveler with another tech in travel minute. I haven't used a travel agent in decades, and so I book, like most of you, probably online. I tend to use hotels.com, which gives me a free night for every ten-eye book or bookings.com, which is the other big site. But occasionally, I'll run across a niche site that is interesting, and one of these is hotelsnearthemetro.com. And this is a site that if you're going to a major city with a metro system, you can find a hotel near a metro station, and it will show you all the hotels and how far they are from the nearest metro station. Sometimes a niche site just answers the question you have. I'm Chris Christensen from Amateur Traveler. You know, at first, I thought he meant sandwiches, but I think this might be better. I actually, this comes in real handy, especially if you're going somewhere where the weather's not going to be nice. Being near a subway, I'm also a fan of subways, and metro systems in general could really come in handy. Yeah, I always look at my hotels and see if they're near train stations for this very reason. So I might make some good use of this. All right, let's check out the mailbag. Let's do it. Jeff wrote in, hoping for an answer to a 5G conversation that we've been having. Keep kicking it around on the show. Jeff says, do we really need new spectrum every time we move to a new G? It's never been clear to me how much of each generation's speed up comes from improvements in protocol versus inherent benefits from the new spectrum. Could the next Gs use software-defined radio, SDR, such that as the G after that comes along, we can stay on the same spectrums as carriers push out new SDR definitions to all devices. Over the course of few months, staged rollouts, we could be on super G plus advanced evolution together. As the carriers phase out the current legacy networks, the spectrum could be added to the SDR network to broaden capacity. I'm sure some frequencies would be better than others in this case, but that's not all that different than it is now. What's wrong with this approach? I recognize that this reduces the economic motivation for network equipment makers to develop future networks, but is there a technical reason that I'm not understanding? Yeah, I imagine if this was easy, we'd probably see a bigger push to do it. He's talking about using software-defined radio to obviate the need to just get clear spectrum for things, because you can share spectrum that way. I know that one of the reasons that we need new spectrum is because there are capacity issues. So you have to sometimes, for a protocol to work, it just has to be on a different spectrum. I also know that older spectrum doesn't get released as fast as maybe you think. There are still 2G uses out there. So you have to wait a long time for spectrum to be released. There was a whole battle over getting rid of the licenses for the white space between television channels, because the interference between television channels on digital broadcast is not as much as it was on analog broadcasts, but all that said, that doesn't really bear on his idea of using software-defined radio to create new capacity. That is outside my area of expertise, but if there's anybody working in the telecom industry who, and I know you're out there, who can say like, this is why we could or why we couldn't or what the challenges are with software-defined radio, send us an email feedback at dailytechnewshow.com. Well, thanks everybody for joining us. Yesterday I made the mistake of saying we had five more people than last month.  So if you are thinking of becoming a member of DTNS, why not do it now? We've got a new bonus episode looking back at five years ago. We just look at the actual Daily Tech News Show lineups from five years ago and talk about what was going on then. That's for folks at the $10 and up level. We've got all kinds of Live With It content planned coming from Sarah Lane. We've got Roger's Column coming out on Thursday. And that's all available for members at patreon.com slash DTNS. We also live your feedback. Our email address is feedback at dailytechnewshow.com. Keep them coming. If you can join us live, well, good news for you. We're live Monday through Friday at 4.30 p.m. Eastern 2030 UTC. And you can find out more at dailytechnewshow.com slash live. Back tomorrow with Scott Johnson. Talk to you then. This show is part of the Frog Pants Network. Get more at frogpants.com. The Diamond Club hopes you have enjoyed this program. Hey, John, welcome to the live show. I'm glad you could join us. Hey, John. Good to see you. I'm going to give you a little thumb up right now on the Discord. So what should we call this show? Not late for dinner. You say that all the time. Not late for dinner of the Wally Sandwich. Wally Sandwich? Yes, please. It's for dinner. What's for dinner? We're getting trolled for my... Thank you for your five years. I mean, minutes. Javon... Oh, yeah. Javon has been a very loyal member. We could do Wally Sandwich, I guess. What else we got here? Being well-preserved helps. OG versus NuG Spectrum. Way a lot of Wally News spelled W-E-I. It's Wally News, Wally Sandwich. Where there's a will, there's Wally. Apple did that. There's Wally. Actually, like, Wally Sandwich. Should we do that? Yeah. Why not? Yeah. It's kind of what it was. What are the toppings? What are the... What's in a Wally Sandwich anyway? Flowers. Besides, you know, compiles. Well, it depends. Up until today, it was Gorilla Glass and Qualcomm chips. They're on the side. But now, it's like, we don't have a Qualcomm chips. Can we get you some high-silicon chips? It will have... Some of Apple's new material. What's an edible flower? Is it dandelion? It's not a flower. Yeah, you can eat a dandelion. Yeah, you can put that in. Huawei is like flower, like Hua is flower in Chinese. Oh, oh, oh. I see where you're going. So they would put some sort of vegetable. I don't think we don't eat dandelion. Is that dandelion a thing that people eat? Yeah, you can eat it. Most people don't. Yeah, most people make stuff out of it, like dandelion wine or something. But you can't actually fry up dandelion. And the greens, the leaves are often even sold in whole foods and stuff. Yeah, you're right. You're right. It grows on your lawn, but we'll charge you, eat bucks for it. Yeah, it's organic. Yeah, because your lawn probably has pesticides. Not my lawn. Not my lawn. Nothing on it. At this point. Does your landlord... I know you sort of have a landlord, Roger, but Sarah, does your landlord do pest control? Oh, I do pest control. I mean... Yeah, well, then your... I hope so. Your dandelions might have pesticide on them. Oh, well... Those are nutrients. My yard doesn't have any dandelions in it. Wow. That's really weird, because mine does. Do you have moles? Like animals? Like burrowing animals? No. No, not my yard. I don't... I mean, there might be pest control going on, but I just... Nobody ever told me about it. Yeah. So GDI, what do you think? Oh, bringing back web rings has been... Crappy Comcast Speakers, because they're in the bathroom. Yeah. I don't know. Crappy Comcast Speakers. Yeah, because we were talking on Good Day Internet about the Comcast plan to... Oh. ...a lot of our you in the bathroom. Right. Streaming from the bathroom speaker. Oh, I like that one. All right. I give that to... GPEG says a dandelion is a weed, and I say that's just a matter of definition. A weed is an undesirable plant. A weed is just something you decide. It's not a category. I think most people would call a dandelion a weed. Yeah, but... It doesn't mean... It doesn't mean it's bad. It's usually... I would find a dandelion to be a desirable plant, and now I love my yard. It's full of these... I mean, isn't that what an English garden is? Isn't that what an English garden is? Kind of like... Kind of a little wild with weeds and stuff. Oh, I have the best flowers in my garden. They're all yellow and sometimes silver.  In hopes that they would flourish? No, they were flourishing too much, and so much that they were blocking the way, and those thorns are problematic with kids. Yes. Very true. I wish I had a rose bush in my yard. You want one? I got a bunch. Well, I... Yeah, sure, I'll take one. I'm not... I don't have a green thumb. Again. I'm okay with plants that are in a pot. Like, I can take care of that plant, but when it comes to, like, planting something in the earth, I don't really know what I'm doing. I was using aquarium water for a while to hydrate all the plants. I don't know if that worked out. Why were you... Why? Well, I was got... I'm always paranoid about putting anything to growth intensive down the sewage line because I have a tree next to the sewage line. For some reason, I think they sense it, and we'll try to go after it. So I just dumped it. Plus, it's a lot of water. It's like you're talking 10 gallons of water, so I just throw it away. Yeah, yeah, yeah.  Might have poo in it, and it's had a fish in it, so dump it in the garden. Did it seem like it was... It didn't kill anything. I will say that. Well, there you go. Yeah. I really like Roger's math on here. He's like, I had the water, smelled like poo, nothing died, worked out nice. I mean, isn't fertilizer just poo? Some other animals poo? Well... Right? I mean, is that what they make it from? Yeah. I... Well, some... I think natural fertilizer is often made, but not all poo is good fertilizer. Depends on where it came from. I would not use dog poo for a fertilizer. No, dogs are terrible for fertilizing. Yeah, dog poo is just to be avoided. Well, it's a lot... High amounts of... Is it not sulfur? It's... Is it potassium? Digested anxiety. What's the stuff that people will use potash for? Potash, what's in your poo? Potash. Potassium, alkaline potassium. Is it potash? Not potash? Potash, potash. Potash? Hold on. What does the internet say? Potash. Ooh. Potash. Potash. I don't know if I trust the internet. Very breathy. Yeah. Yeah. Who's that? What does she know? She was saying how much? Potash. I don't know. That much. I'm not a farmer. I'm not a... I just got an email from Google saying that due to legacy functionality that enabled customer domain admins to view passwords, some of your user's passwords were stored in our encrypted systems in an unhashed format. This primarily impacted system-generated or admin-generated passwords intended for one-time use. We have reviewed the login information for the user account and have found no evidence that the unhashed passwords were misused. The following is a list of users impacted in your domain. Anthology at sordenlaser.com. So our sordenlaser account had... We made this email for people to send us their stories when we did the sordenlaser anthology, and apparently it had unhashed. So they've changed that password. That's good. But it sounds like there was a little security thing they found and stomped on. Security. I would like to see the... I want to give a plug to SecurityBits on NoCillicast with Allison Sheridan. Bart Bouchotte joins her and just runs through kind of the medium and higher security issues of the week. And it's a good... You'll hear things... You'll hear him talk about things that we've mentioned on the show, but he'll go into a little more detail and tell you what you really need to worry about. So we're good. Nice. Anyway, it didn't mean to bring everybody down with a security vulnerability. How about that potash? Potash. Best sandwich. It's the lifeblood of Saskatchewan in Manitoba. Is that one of the main exports of Saskatchewan? Saskatchewan. Not a success one. Saskatchewan. Whatever. Whatever you said. Saskatchewan. Saskatchewan. Does Saskatchewan have a yearly conference called Saskatchewan? It should. I think there is. Or am I thinking of Central Canada Con, which is in... Is it Edmonton or is it Calgary? Calgary. I don't know. All those middle provinces blur together for me. Oh well. Somebody in Canada right now is shaking their fist. But they're doing a play. Sorry. Nice play. Sorry. And that's... That accent's hard. Ontario. By the way, welcome to iHeart Infotech, aka Technology Fan Girl, who is now a proud patron of Daily Tech News Show. Aw, hot dog. Flower. That's flower in the discord. Good to have you. Yeah.  No, definitely not. All this talk of sandwiches, I think, has sealed my fate. I need a big sandwich. Which is like... I'm not sure I've eaten. You know, there was that Italian deli by my old house, Roger and Tom and I, we all went there that one day. It was really good, but so busy. Really busy. Yeah, it's a whole thing. Or you just got to deliver it. But I don't know of a sandwich place near me, or at least not one that I'm taking advantage of. There's gotta be. Actually, that's not true. There's a vegan sandwich place up the street that is delicious. I know it sounds weird, but it's really good. But they're too expensive. It's like a $16 sandwich. I'm like, I want it to be under $10. Yeah. And I want it to be like two meals. Even in LA, it should be under $10. Yeah. Yeah. I want it to be a large sandwich for sure, but anything over $10 is a little crazy. Not filling up my tank. That's not much. Well, I guess it's... I mean, okay. So that's the only real deli I can think of around here. Well, folks, we'll keep thinking. A video, folks. Thank you for joining us. I know we're a little abbreviated today. I apologize. But audio, folks, stick around. There's a little bit more to come before we get going. So thank you for that. Maybe it's me telling about the sandwich shop near me. It's a chain. What's...


So I'm Felix. I'm a WordPress core committer and I'm a developer programs engineer at the content experience team at Google where we collaborate with content management systems like WordPress to improve user experience on the web and advance and advocate for modern web technologies We are also essentially the WordPress team at Google, which you might have heard about before and In this session, we will look at two rather new browser APIs that grant you more control over how certain features Act on your site to enforce solid user experience and best practices so The web has obviously been constantly evolving over all these years We've seen great features being introduced like responsive images age X requests Yeah, I know these two have been long around But imagine at some point they were really big features that were introduced We have location access you can now add your sites to home screen, especially on your phones We have web payments, which are a standardized way to process payments on the web and there are Probably hundreds more of new features of features that are constantly being introduced to the web and these features all of them are certainly great and powerful but when used Incorrectly or when used over aggressively or when completely abused they can seriously harm user experience So Well web features being used in the wild. You might have seen something like this Maybe here. There's a slow loading image Coming up coming up There's oh, you can add this to your home screen Nice. Well, it also wants your location access And it also wants to access your cameras because why not? So I'm sure you've seen examples of these sites around I made this up. It's not actually my website is not that bad So as you can see this can happen if you just randomly use all features that are available without actually Thinking about how they impact user experience and whether this would provide enough benefit to do that So we have all these cool new features But how do we use them responsibly and this can especially become a problem in WordPress where you deal with so much third party code and Think about it further you yourself. You might be responsible citizen of the web You might know what you're doing But all the third party code that you use might not it might have flaws It might misuse features in ways that you aren't even aware of and This is where a new API a new browser standard feature policy comes into place So this is a proposed web standard on you can see you can read more about it on W3C website and This standard it grants you control of our certain features behave on your site So that you can so in so that you can enforce solid standards throughout As an example Imagine you installed a Google Maps plugin on your website just to display a map Maybe but then the plug-in suddenly asks the user for their location Which is something you didn't you weren't even aware of when installing the plug-in. You just wanted to display a map So by default if that happens in the third party code that pop-up it would just show possibly possibly Make the user experience worse because maybe the user doesn't get any anything real out of it. That's valuable to them so By default it shows up, but with feature policy you can send a Response header like this which would completely disable the feature on your entire website ensuring that this cannot happen Basically, it would just say the gearchs location service failed Which isn't maybe that great either but generally it would it's a good start to enforce Best practices for this of course sometimes you would want to want this to actually show up So then don't use it But this is for controlling third party code to do things in the way you want them to For every feature you can control basically how and where it is allowed For example, if you specified any here instead of none, which is the default it would be allowed everywhere You can define self which about means it will only allow it on your own site But not on other sites sites for example in iframes from third parties Or you use none, which is just a super aggressive. No, don't use this ever And even you can specify specific origins like specific domains. You want to allow this on or not Another example is This we are nice image Imagine you look at this image in a mobile phone, but it's actually sized for a large desktop You can over you can disallow using over sized images in this case This would show up so it wouldn't so the image wouldn't load and this is especially useful for development Of course on a production site, it would be still better to show this image than showing this But for development, this will easily allow you to spot weaknesses where you accidentally maybe forgot to optimize an image Feature policy can be used in production and development and it totally makes sense to apply different policies in the different environments And in production for example, you probably don't wouldn't want to do this But in production you can also set up the policy for over sized images to be in report only mode So it would allow it to be notified about the about the Violation of the policy, but it will not actually just disabled image So that leads us to the next big thing which is yes, I said It's also possible to monitor violations of feature policy, which I will get to in just a bit There are many many more features Supported by the feature policy specification You can control media so that it doesn't just autoplay when this user access your site You can enforce lazy loading across your entire website. Yes lazy loading is actually a standard That's coming natively to the web at some point You can disable synchronous Ajax requests, which we shouldn't be doing Camera access full screen and many many more there currently 11 features supported and 17 more come in So think about this further again feature policy is a very powerful ally, especially in WordPress where you deal with so much third-party code So looking at browser support the API is quite new And it's also still in draft is a proposed standard But it's already supported by a couple browsers as you can see here You can see the full stats on can I use comm? So as I mentioned before you can get you can get Reports of feature policy violations and this takes us to another new web standard, which is called the reporting API that standard allows you to receive reports about client-side errors or policy violations on your entire website and they will be automatically sent by the browser So several types of reports are reported here and feature policy violations are one of them as Well, this API relies on a new HTTP response order that you can send and we will look at what this looks like under the hood now So you can basically specify in this example You specify Did you tell the browser to send the To send reports to this URL which should then that that URL should host an endpoint of that follows the specification of the reporting API standard and Then all reports are going to be sent there as you can see This is an object and it's actually possible to specify multiple different groups with different endpoints And then you can allow different report types For example feature policy violation is just one of the possible report types to be sent to different groups depending So you can really granularly go with it But this basic example will make sure that every everything is sent to this one endpoint So there are a couple report types supported here as well. So we have content security policy You get crash and deprecation reports Which basically allow you to be notified when doing something wrong in JavaScript or when something wrong happens You're not even involved is right now Another super powerful feature is network error logging which it basically allows you to receive reports About network request failures. So if your site is down, for example So that is something you would previously needed to rely on an uptime service for but it's becoming possible With native web features and that native web APIs Well, I talked about feature policy right now. This is actually not supported yet, but it will be very soon So feature policy feature policy itself is reported is supported reporting API supported But they don't work together just yet, but that will be that will be introduced very soon Yeah, looking at browser support here. It's even more limited because the reporting API is even more bleeding edge. So It's only supported in Chrome right now, but given the Given the distribution of browsers and how much they used this still means 60% of about a little more than 60% of browsers throughout Are prepared for this and can use the reporting API standard Actually, this API is so bleeding edge that it doesn't even have stats on can I use comm yet? So I don't have a link here So, yeah, WordPress surely I wouldn't leave you here without looking at WordPress specifically so but it's probably better because that if you do it because We we built we have built as part of our as part of our goals to improve the user experience We have built plugins to introduce these new API APIs and bring them to the WordPress platform and The fragmentation of the WordPress ecosystem is provides a perfect scenario for using and applying feature policy and using the reporting API with it So you can start using these new API today and you don't need to even need to be a coder for that You don't need to write code. You can just manage all of this from your WP admin So this is the first one of them So the future policy plug-in it lets you control feature policy headers and it will take care of sending them in the front end and Yeah, that's basically all that this does for now and you can start using it It's now available in an early version 0.1 on wordpress.org and That plug-in is complemented by the reporting API plug-in Which you can also install they work without each other, but they also integrate with each other if you have both of them So the reporting API it provides an endpoint with using the WordPress REST API an Endpoint according to the reporting API standard and it also sends a header in the front end to make sure that all Headers that that all reports are sent to this API endpoint and as you can see here You can browse the received reports from your admin back in Yeah, and as with the feature policy plug-in this plug-in is now available in an early version on WordPress.org So wrapping up in addition to all the other links so far here's some further resources to learn more about these new APIs For real deep dive. I recommend looking at the actual w3c draft documents, but those are very very detailed so The first is especially the first three links here There are very great resources to get a quick understanding and an easy to understand way to learn about how these policies how these APIs work and And last but not least please make sure to use the plugins There as the APIs are in an early state the plugins are in an early state, but we wanted to get them out there early So we because we're closing we're working closely together with the w3c team That have been drafting these specifications and we would like to get your feedback. So and we can actually all Influence how these specifications come out when they're actually made completely a standard So let's join forces to make it easier to come back to create a compelling user experiences on the web That's it. Thank you