ray991

You might be interested in this article that tries to explain what happened - from my perspective it was nothing short of a scandal.

https://www.theguardian.com/world/2020/jun/03/covid-19-surgi...

Others studies by one of the authors (Sapan Desai) whose company Surgisphere is supposed to be behind the alleged fraud are being scrutinised and even his credentials are under question now - https://www.theguardian.com/world/2020/jun/10/surgisphere-sa...

I really wish the PDF layout was easier to parse. No matter which library you use, you always run into edge cases which make text selection and extraction an issue on certain files. I was recently extracting financial data from a bank which provides only PDFs and every time they changed the format just a little bit I had to change large parts of my code to extract the transactions I wanted.

But that is just swapping one privacy issue with another, as NextDNS is also free to sell user’s private metadata to data brokers.

https://news.ycombinator.com/item?id=23318830

So NextDNS is free to sell metadata. What is the extent of this metadata - is it like ‘this user spends 10 hours a day actively using the internet’, or ‘this user consumes a lot of streaming video content’, or this user ‘watches netflix every friday evening’, or ‘this user uses duckduckgo instead of google’? Can these examples be considered metadata?

The opt-out form [0] asks only for the name, phone number, DOB, address, email, etc. How do they ensure that someone else did not opt-out or opt-in on someone else’s behalf without their permission? And how are they deduplicating people with the same name and DOB? By a fuzzy match against their address? How do these things usually work in UK?

[0] https://www.organdonation.nhs.uk/register-your-decision/refu...?

The author mentions that this bug saved him 1000s of hours in development. How is a sandbox escape useful in development? Can someone give me an example?

I think this is the right way - store data but publish it publically when you are confirmed with coronavirus. Then apps installed on others phones would automatically see your data and would do an intersect to see if they were in proximity, and notify you accordingly. This way only the data of those impacted by coronavirus becomes public. And although it’s public technically, as the app has access to it behind the scenes, but legally you won’t be allowed to reverse engineer the response data and publish it online on a map,etc. so that adds some privacy from the general public’s eyes.

What if every coronavirus victim voluntarily uploads their location data publically (their identity kept anonymous). Now you can, without uploading your own data anywhere, check if you have ever been in vicinity of any of them. If you have been, you can get tested and then upload your own data if that comes out positive. This way not eveyone has to share their data, only a few who have been infected.