I’m a bit obsessed with fortune cookies. I, an otherwise non-superstitious person, have no fewer than five incidentally meaningful ones stashed away in special places. I know I shouldn’t take them seriously — they’re not even Chinese! — but breaking open a cookie and attempting to find a higher truth is an inexplicably satisfying way to end a takeout meal. But just eating them wasn’t enough. I wanted to unlock their mysteries. 
 
 Sure, we know how fortune cookies are made, but I wanted to break inside the dough and find out what could be learned from the wisdom within: the fortunes, the “lucky numbers” and even the lessons in Mandarin. So in the spirit of this earlier experiment with tarot cards, I set out on a data-driven mission. 
 
 I bought 1,050 fortune cookies from an internet wholesaler. A week later, the FiveThirtyEight offices welcomed three bulk boxes of the purportedly portentous pastries; within yet another week, after assiduous disassembly, categorization, alphabetization and digitization, I was able to say with resounding confidence: Those jerks only sent 1,035 cookies. Despite the 15-cookie deficit, I had an intimidating sample size to crack wide open. Here’s what I found. 
 
 How many fortunes are there? 
 
 I bought the bulk cookies — Panda brand, with fortunes at times directing me to Wonton Food Inc.’s web page — expecting a random sample, but it turns out that buying in bulk gives you an entire slice of a production run. I bought enough that we got fortunes beginning with the letters “A” through “I,” and letters “W” through “Y.” There were 676 unique fortunes in the 1,035-cookie sample. The obverse side of the fortunes repeat more often; there were just 556 unique combinations of lucky numbers on the back of those fortunes, and 173 individual Mandarin vocabulary words and phrases. 
 
 We can estimate a few things with this information. We know the general distribution of letters in the English language, but we also know the approximate distribution of first letters in sentences, thanks to cryptographers who need to keep such information handy. About 46 percent of sentences begin with the letters “A” through “I,” and about 8 percent begin with “W” through “Y.” And while the fortune cookie distribution differs from most English in a number of ways — for instance, way more sentences beginning with “You” — I’d venture, given our 54 percent coverage, that there could be roughly 1,200 to 1,600 fortunes in the overall corpus. So we’re far from a census here, but we have a decent sample. 
 
 Are fortune cookie “lucky numbers” actually lucky? 
 
 Lucky? Don’t be ridiculous, of course they’re — 
 
 It’s complicated. 
 
 In order to figure out if one set of six numbers was legitimately luckier than a random set of six numbers, we would need some sort of highly transparent, public-facing random number generation system carried out over years and years at organized intervals with specific monetary amounts allocated to specific chance outcomes. The logistics alone would be breathtaking. Such a study of luck could easily require a multi-state body to organize the venture and ensure that the game remained solvent. 
 
 We only worked on this story for about a month, so instead of setting all that up, we let Powerball do the work for us. I took all the lucky numbers from the fortunes and compared them to the Powerball numbers stretching from Nov. 1, 1997, to May 27, 2017, and calculated what the winnings would be if a degenerate gambler bought one Powerball ticket for every single one of the allegedly lucky number combinations over all 2,043 drawings. Such an individual — buying one ticket for each batch of numbers, including repeats — would make $4.4 million on $4.2 million in ticket purchases. The expected value of that investment using “unlucky” randomized digits and assuming an average jackpot at each drawing? $1.7 million in winnings on $4.2 million in ticket purchases, based on multiplying the current probabilities of each event by the current prizes for each event across 2,043 drawings. 
 
 It would appear that the lucky numbers are legit lucky: 
 
 Obviously, this is weird as hell. It’s mainly thanks to several $1 million prize-winning jackpots with the numbers 19, 30, 55, 18 and 53 with the Powerball number 21. There are certainly logical explanations for this. Maybe the lucky numbers were added into the fortune cookies after those Powerball wins. Or, according to Occam’s razor, play several thousand lotteries with several thousand combinations, and you’ll hit a winner eventually. Plenty of people have won lotteries, even the Powerball, with fortune cookie insight. 
 
 So I can’t say they’re lucky, but I’m pretty confident we can’t claim the numbers are unlucky . 
 
 How much of the language can one learn from the backs of fortunes alone? 
 
 Anyone who tried to pick up Mandarin from our 1,035 fortunes in some bootleg flashcard stratagem would be in decent luck. At 173 words, we’re talking the vocabulary of a highly precocious 2-year-old or a late-blooming toddler. You won’t be carrying on any particularly insightful conversations; with 21 verbs at your disposal — mostly exercise-, eating- and illness-based — an adept student could eat, find a doctor and roller-skate (assuming tenses are no object). Intensifiers and modifiers are very much in the cards; with 21 adjectives in your arsenal, you could order that food cheap, delicious or even blue. It’s with the 124 nouns that your vocabulary range sings — assuming you’re hungry. 
 
 Seventy-four of the 173 words you’d learn pertain primarily to food, so the cookie has educated you just enough to keep you trapped in a restaurant. We’re talking lesson two, maybe three of the Mandarin Rosetta Stone set. If you can’t bear the course cost, downing 1,035 snacks with the approximate nutritional value of Froot Loops could do the trick. 
 
 But what are the fortunes telling us? 
 
 Only about a fifth of fortunes had predictive or forward-looking statements about what may or will occur in the misty future, but a majority hit the most delightful topic of all: you. Based on some laborious topical tagging, more than half of the unique fortunes mentioned “you,” your character, your strengths, your weaknesses. Outside of those two main themes, there was not a ton of consensus in terms of topics covered (again, I coded these by hand). 
 
 Fortune cookies aren’t really about the future; they’re all about you THEME SHARE OF FORTUNES Mentions “you” 52.9% – Predicts the future 22.3 – Success, failure and happiness 10.0 – Work, education and doing things 8.1 – Intellect, curiosity and creativity 7.6 – Character traits 7.3 – Journeys, beginnings and change 6.9 – Friends and people 4.8 – Love, beauty and romance 4.0 – Chance, fortune and fate 3.7 – Based on an analysis of 676 unique fortunes from 1,035 Panda brand fortune cookies, which were not quite sampled randomly. All fortunes begin with the first letter “A” through “I” or “W” through “Y” because of the way the cookies were packaged for bulk purchasing. 
 
 Are all the fortunes innovative and unique? Of course not. I have qualms about “Everyone agrees you are the best.” Perhaps “Dance like nobody’s watching,” and “Genius is one percent inspiration and ninety-nine percent perspiration” feel a bit glib for “wisdom.” It’s a bold move to crib from Yoda and write, “Do or do not, there is no try,” but good god It’s an extremely bold move to straight-up rip off Jesus with, “Do onto others as you wish others do onto you” and try to pass it off as an original fortune. 
 
 Beyond this, we can perhaps look at the words that appear disproportionately in fortunes compared with the standard English corpus — lots of action words and positivity, like “good,” “life,” “go,” “never,” “make” and “always” — but, of course, the real fun comes in when smashing them together and creating brand-new tokens of wisdom with bots like this one. Even though I equipped my bot with hundreds of fortunes to draw on — it builds a fortune by randomly selecting subsequent words based on how often they succeed the previous pair of words — it may not be perfect, and all the Markov-bot-generated fortunes may not be winners. Some of the algorithmically generated advice that can now be found at @FortuneBot538 is terrible. 
 
 But I’ll never forget when, wrist-deep in a box of shattered shortbreads sometime around fortune number 863, a wise cookie told me, “You may be disappointed if you fail. But you are doomed if you don’t try.” 
 
 Tweets by FortuneBot538 ||||| Logging out of Facebook is not enough 25th September 2011 # 
 
 Important Update: Facebook has responded and issued a fix for this issue. See the follow up blog post "Facebook Fixes Logout Issue, Explains Cookies" 
 
 Dave Winer wrote a timely piece this morning about how Facebook is scaring him since the new API allows applications to post status items to your Facebook timeline without a users intervention. It is an extension of Facebook Instant and they call it frictionless sharing. The privacy concern here is that because you no longer have to explicitly opt-in to share an item, you may accidentally share a page or an event that you did not intend others to see. 
 
 The advice is to log out of Facebook. But logging out of Facebook only de-authorizes your browser from the web application, a number of cookies (including your account number) are still sent along to all requests to facebook.com . Even if you are logged out, Facebook still knows and can track every page you visit that has Facebook integrated. The only solution is to delete every Facebook cookie in your browser, or to use a separate browser for Facebook interactions. 
 
 Here is what is happening, as viewed by the HTTP headers on requests to facebook.com . First, a normal request to the web interface as a logged in user sends the following cookies: 
 
 Note: I have both fudged the values of each cookie and added line wraps for legibility 
 
 Cookie: datr=tdnZTOt21HOTpRkRzS-6tjKP; lu=ggIZeheqTLbjoZ5Wgg; openid_p=101045999; c_user=500011111; sct=1316000000; xs=2%3A99105e8977f92ec58696cf73dd4a32f7; act=1311234574586%2F0 
 
 The request to the logout function will then see this response from the server, which is attempting to unset the following cookies: 
 
 Set-Cookie: _e_fUJO_0=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly c_user=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly fl=1; path=/; domain=.facebook.com; httponly L=2; path=/; domain=.facebook.com; httponly locale=en_US; expires=Sun, 02-Oct-2011 07:52:33 GMT; path=/; domain=.facebook.com lu=ggIZeheqTLbjoZ5Wgg; expires=Tue, 24-Sep-2013 07:52:33 GMT; path=/; domain=.facebook.com; httponly s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly sct=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly W=1316000000; path=/; domain=.facebook.com xs=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly 
 
 To make it easier to see the cookies being unset, the names are in italics. If you compare the cookies that have been set in a logged in request, and compare them to the cookies that are being unset in the logout request, you will quickly see that there are a number of cookies that are not being deleted, and there are two cookies (locale and lu) that are only being given new expiry dates, and three new cookies (W, fl, L) being set. 
 
 Now I make a subsequent request to facebook.com as a 'logged out' user: 
 
 Cookie: datr=tdnZTOt21HOTpRkRzS-6tjKP; openid_p=101045999; act=1311234574586%2F0; L=2; locale=en_US; lu=ggIZeheqTLbjoZ5Wgg; lsd=IkRq1; reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Findex.php%3Flh%3Dbf0ed2e54fbcad0baaaaa32f88152%26eu%3DJhvyCGewZ3n_VN7xw1BvUw; reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Findex.php%3Flh%3Dbf0ed2e54fbcad0b1aaaaa152%26eu%3DJhvyCGewZ3n_VN7xw1BvUw 
 
 The primary cookies that identify me as a user are still there (act is my account number), even though I am looking at a logged out page. Logged out requests still send nine different cookies, including the most important cookies that identify you as a user 
 
 This is not what 'logout' is supposed to mean - Facebook are only altering the state of the cookies instead of removing all of them when a user logs out. 
 
 With my browser logged out of Facebook, whenever I visit any page with a Facebook like button, or share button, or any other widget, the information, including my account ID, is still being sent to Facebook. The only solution to Facebook not knowing who you are is to delete all Facebook cookies. 
 
 You can test this for yourself using any browser with developer tools installed. It is all hidden in plain sight. 
 
 An Experiment 
 
 This brings me back to a story that I have yet to tell. A year ago I was screwing around with multiple Facebook accounts as part of some development work. I created a number of fake Facebook accounts after logging out of my browser. After using the fake accounts for some time, I found that they were suggesting my real account to me as a friend. Somehow Facebook knew that we were all coming from the same browser, even though I had logged out. 
 
 There are serious implications if you are using Facebook from a public terminal. If you login on a public terminal and then hit 'logout', you are still leaving behind fingerprints of having been logged in. As far as I can tell, these fingerprints remain (in the form of cookies) until somebody explicitly deletes all the Facebook cookies for that browser. Associating an account ID with a real name is easy - as the same ID is used to identify your profile. 
 
 Facebook knows every account that has accessed Facebook from every browser and is using that information to suggest friends to you. The strength of the 'same machine' value in the algorithm that works out friends to suggest may be low, but it still happens. This is also easy to test and verify. 
 
 I reported this issue to Facebook in a detailed email and got the bounce around. I emailed somebody I knew at the company and forwarded the request to them. I never got a response. The entire process was so flaky and frustrating that I haven't bothered sending them two XSS holes that I have also found in the past year. They really need to get their shit together on reporting privacy issues, I am sure they take security issues a lot more seriously. 
 
 The Rise of Privacy Awareness 
 
 10-15 years ago when I first got into the security industry the awareness of security issues amongst users, developers and systems administrators was low. Microsoft Windows and IIS were swiss cheese in terms of security vulnerabilities. You could manually send malformed payloads to IIS 4.0 and have it crash with a stack or heap overflow, which would usually lead to a remote vulnerability. 
 
 A decade ago the entire software industry went through a reformation on awareness of security principles in administration and development. Microsoft re-trained all of their developers on buffer overflows, string formatting bugs, off-by-one bugs etc. and audited their entire code base. A number of high-profile security incidents raised awareness, and today vendors have proper security procedures, from reporting new bugs to hotfixes and secure programming principles (this wasn't just a Microsoft issue - but I had the most experience with them). 
 
 Privacy today feels like what security did 10-15 years ago - there is an awareness of the issues steadily building and blog posts from prominent technologists is helping to steamroll public consciousness. The risks around privacy today are just as serious as security leaks were then - except that there is an order of magnitude more users online and a lot more private data being shared on the web. 
 
 Facebook are front-and-center in the new privacy debate just as Microsoft were with security issues a decade ago. The question is what it will take for Facebook to address privacy issues and to give their users the tools required to manage their privacy and to implement clear policies - not pages and pages of confusing legal documentation, and 'logout' not really meaning 'logout'. 
 
 Update: Contact with Facebook 
 
 To clarify, I first emailed this issue to Facebook on the 14th of November 2010. I also copied the email to their press address to get an official response on it. I never got any response. I sent another email to Facebook, press and copied it to somebody I know at Facebook on the 12th of January 2011. Again, I got no response. I have copies of all the emails, the subject lines were very clear in terms of the importance of this issue. 
 
 I have been sitting on this for almost a year now. The renewed discussion about Facebook and privacy this weekend prompted me to write this post. 
 
 Update 2: Followup 
 
 The reaction to this story has been amazing. I am writing a followup that will analyze both the data that I have collected as well as the response from Facebook (which you can read below in the comments). If you wish to view the raw logs, I have saved them here. Specifically the datr and lu cookies are retained after logout and on subsequent requests, and the a_user cookie, which contains your userid, is only cleared once the session is restarted. Most importantly, connection state is retained through these HTTP connections. There is never a clean break between a logged in session and a logged out session - but I will have more on that in a follow-up post. 
 
 Erratum: I refer to the wrong cookie name in the post above. I also say 'all sites' can be tracked, when I meant to say 'all sites that integrate facebook'. 
 
 Comments ||||| Verizon users might want to start looking for another provider. In an effort to better serve advertisers, Verizon Wireless has been silently modifying its users' web traffic on its network to inject a cookie-like tracker. This tracker, included in an HTTP header called X-UIDH, is sent to every unencrypted website a Verizon customer visits from a mobile device. It allows third-party advertisers and websites to assemble a deep, permanent profile of visitors' web browsing habits without their consent. 
 
 Verizon apparently created this mechanism to expand their advertising programs, but it has privacy implications far beyond those programs. Indeed, while we're concerned about Verizon's own use of the header, we're even more worried about what it allows others to find out about Verizon users. The X-UIDH header effectively reinvents the cookie, but does so in a way that is shockingly insecure and dangerous to your privacy. Worse still, Verizon doesn't let users turn off this "feature." In fact, it functions even if you use a private browsing mode or clear your cookies. You can test whether the header is injected in your traffic by visiting lessonslearned.org/sniff or amibeingtracked.com over a cell data connection. 
 
 How X-UIDH Works, and Why It's a Problem 
 
 Like a cookie, this header uniquely identifies users to the websites they visit. Verizon adds the header at the network level, between the user's device and the servers with which the user interacts. Unlike a cookie, the header is tied to a data plan, so anyone who browses the web through a hotspot, or shares a computer that uses cellular data, gets the same X-UIDH header as everyone else using that hotspot or computer. That means advertisers may build a profile that reveals private browsing activity to coworkers, friends, or family through targeted advertising. 
 
 Also unlike a cookie, Verizon's header is nearly invisible to the user and can't be seen or changed in the device's browser settings. If a user clears their cookies, the X-UIDH header remains unchanged. Worse, ad networks can immediately assign new cookies and link them to the cleared cookies using the unchanged X-UIDH value. We don't know which data brokers and ad networks are using the header to create behavioral profiles, but Cory Dunne found at least one GitHub repository contained code to extract the header value, as of October 27. The repository has since been quietly deleted but can be viewed at the Internet Archive. Twitter's mobile advertising division also appears to use the header for ad auctions. 
 
 Besides cookie clearing, the X-UIDH header bypasses several other built-in browser privacy mechanisms. Cookies belong to a single website and aren't shared with other websites. But one unique X-UIDH header value is shared with all unencrypted websites a user visits, making it easier for ad networks to track that user across many sites in a way not possible with cookies alone. Browsers provide Incognito Mode or Private Browsing Mode in order to defeat some kinds of tracking, but the X-UIDH header, since it is injected at the network layer, ignores those modes. Verizon also chooses to ignore Do Not Track, a setting users enable in their browser to indicate they do not want to be tracked. Similarly, disabling third-party cookies in browser settings does nothing to stop the X-UIDH header. 
 
 To compound the problem, the header also affects more than just web browsers. Mobile apps that send HTTP requests will also have the header inserted. This means that users' behavior in apps can be correlated with their behavior on the web, which would be difficult or impossible without the header. Verizon describes this as a key benefit of using their system. But Verizon bypasses the 'Limit Ad Tracking' settings in iOS and Android that are specifically intended to limit abuse of unique identifiers by mobile apps. 
 
 Because the header is injected at the network level, Verizon can add it to anyone using their towers, even those who aren't Verizon customers. Notably, Verizon appears to inject the X-UIDH header even for customers of Straight Talk, a mobile network reseller (known as a MVNO) that uses Verizon's network. Customers of Straight Talk don't necessarily have a relationship with Verizon. 
 
 But according to AdAge, "Corporate and government subscribers are excluded from the new marketing solution." We haven't verified (and Verizon refuses to say) whether the header is still sent for those subscribers or not. If they are indeed excepted from the program, that indicates to us that implementing an opt-out is feasible. We're disappointed that Verizon takes some of its users' privacy more seriously than others. 
 
 Verizon's Claimed Protections 
 
 Verizon does provide a sort of limited opt-out for individual customers, but it appears that the opt-out does not actually disable the header. Instead, it merely tells Verizon not to share detailed demographic information with advertisers who present a UIDH value. Meaningful protection from tracking by third parties would require Verizon to omit the header entirely. 
 
 According to Verizon, the header value is a salted hash, and the hash changes on an undisclosed frequency. However, it's easy for third-party ad networks to create a continuous profile by associating old and new X-UIDH values through their own identifier cookie . Verizon has refused to say what identifier they hash to create the identifier, but their recent patent suggests hashing a phone number. If they are indeed hashing phone numbers, it would be a major cryptographic mistake. Phone numbers can easily be deduced from hashes, so sending those hashes to untrusted web sites is practically equivalent to giving them your phone number. 
 
 Besides the ad networks, the unique X-UIDH header is a boon to eavesdroppers. We have seen that the NSA uses similar identifying metadata as 'selectors' to collect all of a single person's Internet activity. They also have been shown to use selectors to choose targets for delivering malware via QUANTUMINSERT and similar programs. Having all Verizon mobile users' web traffic marked with a persistent, unique identifier makes it trivial for anyone passively eavesdropping on the Internet to associate that traffic with the individual user in a way not possible with IP addresses alone. 
 
 According to Verizon, it began the Precision Market Insights program in 2012, but has consistently refused to provide technical details about how the program worked. The injection of the X-UIDH header went largely unremarked by the technical community until recently because it is so hard to observe. The header is inserted in requests after they leave the phone, so customers cannot detect it using only a phone. In order to detect it, a user needs to run a web server configured to log or echo all HTTP headers, which is very rare. 
 
 How You Can Protect Yourself 
 
 Verizon can only modify plaintext traffic. It can't modify encrypted requests without breaking the whole connection. There are four options for encrypting web requests: HTTPS, an encrypted proxy, a VPN, or Tor. Only a VPN or Tor provide full protection in this case. 
 
 The best protection against this specific problem is to use a VPN that encrypts all requests made from your phone, regardless of whether they were made by an app or a browser. Most VPNs are paid services, and when using a VPN you have to trust the VPN operators the same way you would normally trust your ISP. Advanced users can also use Tor via Orbot Android app in transparent proxy mode (requires root). Tor is free, but you have to trust exit node operators not to interfere with your connection. Tor is more appropriate if you are trying to be anonymous. 
 
 The second-best protection is to use an encrypted proxy, which protects browser traffic but not mobile apps. Mobile Chrome provides the 'Reduce data usage' setting, which is reported to prevent the X-UIDH header injection. Unfortunately, this connection is not reliably encrypted, because an ISP can disable encryption on it at any time. 
 
 HTTPS, which is the best protection for many types of harm, is actually the least powerful protection for this one. The header cannot be injected into an HTTPS request, but since websites choose whether to offer HTTPS, a site that wants to track users can simply avoid HTTPS and get the tracking headers. The web needs to become fully encrypted, and these X-UIDH headers provide a strong disincentive for sites and advertisers who wish to track their users to adopt HTTPS. In fact, the AT&T patent on similar headers recommends downgrading (redirecting) secure HTTPS requests to HTTP ones in order to receive the tracking header. 
 
 What Verizon Should Do 
 
 Verizon should immediately stop injecting the X-UIDH tracking header into its users' traffic. It is entirely possible to re-design their marketing programs so that the header is only injected for users who explicitly consent to having their Internet connections modified to add tracking information, and to do so in a way that doesn't allow third-party sites to track users across the Internet. 
 
 We're also concerned that Verizon's failure to permit its users to opt out of X-UIDH may be a violation of the federal law that requires phone companies to maintain the confidentiality of their customers' data. Only two months ago, the wireline sector of Verizon's business was hit with a $7.4 million fine by the Federal Communications Commission after it was caught using its "customers' personal information for thousands of marketing campaigns without even giving them the choice to opt out." With this header, it looks like Verizon lets its customers opt out of the marketing side of the program, but not from the disclosure of their browsing habits. 
 
 More generally, Verizon should stop tampering with their customers' Internet traffic without their customers' consent. ISPs like Verizon act as trusted connectors to the world, and shouldn't be modifying our communications on their way to the Internet. People should not be required to subscribe to a VPN and put their trust in a third party in order to get a modicum of privacy on the Internet. 
 
 AT&T has been reported to be testing a similar header.
– Imagine you're so obsessed with fortune cookies, and the destinies they claim to foretell, that you order more than 1,000 of them to "unlock their mysteries." That's exactly what data journalist Walt Hickey did for FiveThirtyEight.com, picking through the prognostications (676 unique ones among his 1,035-cookie sample), the "lucky numbers" included on each slip of paper, and even the Mandarin vocab printed on the reverse sides. Despite his inventory being 15 cookies short of what he ordered (did anyone really think someone in love with data wouldn't count every single cookie?), he made some fascinating and surprising finds. Here, a sample: Those lucky numbers aren't not lucky. Hickey calls this discovery "weird as hell," but he admits that, after comparing the numbers on the fortunes to winning Powerball numbers over a nearly 20-year stretch, the value of playing the fortunes' numbers over that time period would have left a hypothetic gambler with a slight profit (just under $175), while playing random numbers would leave that same gambler with a $2,540 deficit. He's got some common-sense explanations for why that may be. What do the fortunes really tell us? They don't so much tell our fortunes as appeal to our egos and sense of good citizenship, apparently. Only 22.3% of the themes enclosed within the cookies actually dabbled in prophesy: The vast majority (52.9%) included the word "you" and spit out praise or criticism of one's strengths and weaknesses, while others included basic life advice and well-worn wisdom like "Do onto others as you wish others do onto you." Hickey even built his own online bot to see what randomly generated fortunes it would churn out. Check it out here. Break open the steamed dumplings and read more on what the FiveThirtyEight analysis turned up.