Something is wrong when the 'telephone app' on your phone becomes 3rd party - guy-brush https://martinruenz.de/article/data-privacy/2017/05/03/something-is-wrong.html#page-content <comment><USER3> Or that just means that we still call the device in our pocket a "phone" for legacy reasons. If we are okay with having a third party handles our messages, VoIP etc, why not the phone app?

<comment><USER4> I don't carry a phone in my pocket, I carry a personal computer that also makes voices calls over cellular networks.

<comment><USER5> I've been joking lately that there is a new one syllable word for "personal computer": phone. At the current rate that's how the language will shift. I suppose we'll know if people start referring to things like "macOS deskphones" and think "laptop" always meant "laptop phone". :)

It's like those futurist ads from the 50s (and 80s/90s) AT&T that soon there will be phones capable of amazing things everywhere in our lives, except they aren't all AT&T branded and most of them started with the name "personal computer". (Though savor the irony that Ma Bell's legacy lives on in Linux by way of Bell Labs' contributions to Unix.)

Then again, I'm also strongly for renaming 3D Printers to facsimile machines because the word fax is too useful to lose to ancient toner-based modem printers.

<comment><USER6> Mobile phones are called "Handys" in German. It's become such a satisfying and appropriate name for handheld computers, as distinct from traditional personal computers.

In British English, they've always called cellphones "mobiles", which is also a nice short name for mobile computers.

<comment><USER7> In American English, a handy means... something else.

Mobile could work, though, and I've heard it used.

<comment><USER8> In Argentina is "el celular" as in "teléfono celular", or sometimes like in Spain "el móvil" which I like better because it means "the mobile", which in the long term could mean "the mobile computer".

<comment><USER9> In Polish it's "komórka" which literally means "a cell"(like a cell in your body).

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> I completely disagree with the title. The fact that "telephony" can be an app on the phone is a WONDERFUL thing. It means that the author of this article has a choice, as opposed to NOT having a choice.

<comment><USER11> I'll be Mr. Reasonable Compromise. It's both a wonderful thing and a risk. Which of those two it becomes depends on the entire ecosystem around installable apps, trust and verification.

I've never had a problem with 3rd party dialers on Android. But I can smell a scam and I'm technically literate.

To the best of my knowledge there's never been a major dialler related security mishap. In fact much of the panic about Android's "malware ridden ecosystem" seems overblown. Nobody I know has ever had an issue to the best of my knowledge.

But it's definitely a possibility and it's highly probable that eventually something bad will happen on a large scale without some better controls - albeit hopefully not the type that Apple imposes. Cost vs benefit and all that.

<comment> proto-n More choice always means more responsibility. You could argue against democracy with the same idea - what happens if the voters choose someone not worthy? A lunatic or someone downright malicious?

</comment></comment></comment><comment><USER12> > This leaves me in an unpleasant spot as I, where I can, avoid using google > services and now need to find an alternative dialling application. Isn't > this sweet? I am searching for a dialling application for my smartphone. A > DIALLING application

You bought a Google phone and don't want to use Google services, but complain that the dialler can be provided by a third party? Isn't that a good thing?

<comment><USER13> Why is dialing a phone a "Google Service"?

<comment><USER14> The AOSP dialer is not a Google Service, it comes with android.

Google phones have use a different launcher (Which might be a modified version of the AOSP launcher, haven't used AOSP in a while) that provides unknown number names, access to the voicemail-to-text feature of Project Fi (and probably Google Voice), and probably a couple more things.

BTW, from the little I know, seeing google contacts in the dialer doesn't mean that it's talking to google. Google services adds the contacts to the phone's centralized contact management and the dialer gets them from there.

<comment><USER15> ..but the point is the manufacture didn't provide the AOSP dialer. They added a 3rd party dialer that you have to root the phone to disable and you need to install a non-privacy invasive dialer either by finding an apk for the AOSP version, using F-droid or using Google Play/AmazonApp services.

</comment></comment></comment></comment><comment><USER16> It's always been a "telephone app", on smart phones. And in many cases, it's already been somewhat "3rd party" because in reality it's from the ODM who made your phone or the SOC vendor, not the company that branded your phone. The author is only just becoming aware that this is "3P" because he happens to have a branded dialer added on his phone, versus a "white label" dialer that was already there.

I'm fairly certain Wileyfox didn't make the dialer that previously came with his phone, either. (They're a smaller OEM.) They probably just used the one provided by the ODM assembling the device for them.

</comment><comment><USER17> It's a real problem. Are there any voice dialing programs for Android phones which do voice recognition locally and don't require Google services? That's the way it used to work until Google broke it so they could monitor all your dialing.

<comment><USER18> Google in 2007: Do no evil.

Google in 2017: Skynet didn't build itself people! We need more ML training data!

<comment><USER19> Skynet v. 0.1 didn't build itself. Clearly, though, once it becomes a minimum viable product, it will produce the next generations of itself.

Or will it? If it's an AI intent on approximating human speech processing, why should it be any good at programming? See also [https://www.fanfiction.net/s/9658524/1/Branches-on-the- Tree-...](https://www.fanfiction.net/s/9658524/1/Branches-on-the-Tree-of- Time).

<comment><USER20> I wonder what makes people think that an AI needs to be able to code to improve itself. I don't see infant brains "programming" themselves to get better.

The next step in programming is probably not anything like programming. Machine learning certainly isn't. Creating a neural net that achieves superhuman image recognition takes 30 lines of code in keras. And terabytes of training data. But the programming doesn't look anything like someone in the 90s would have thought. Except maybe for a bunch of AI researchers.

<comment><USER21> > _I wonder what makes people think that an AI needs to be able to code to > improve itself. I don 't see infant brains "programming" themselves to get > better._

That's largely because you haven't looked. Infants are constantly developing and pruning pathways and connections in their brain, which effectively changes both the hardware and the software.

<comment><USER20> They don't do that consciously (with an agenda). Infants are just being infants. If an AI just needs to keep doing AI things to "reprogram" itself, then theres no barrier for it to do that.

<comment><USER22> Infants also don't survive by themselves. Leave an infant alone and it will die.

<comment><USER20> im just saying that infants are learning a whole lot without consciously making an effort to do so. they just provide data through their sensors by existing.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> [https://www.wileyfox.com/the-brand](https://www.wileyfox.com/the-brand)

>UNRIVALLED PRIVACY AND SECURITY

>Choose precisely the data you wish to share; protect apps with additional PINs; prevent spam with Truecaller Integrated Dialler.

So their idea of privacy is privacy from everyone except the manufacturer (and "trusted" third parties)

>Of course, you can always root the phone and install custom roms. But this process takes some time and the development and compatibility with these roms is less than satisfactory.

Maybe he shouldn't have bought a device with such a small userbase?

<comment><USER24> FWIW their phones originally ran CyanogenOS. They're in the process of updating to stock android [1], after cyanogen's recent layoffs/pivot/rebranding/disaster [2].

[1] [http://www.androidpolice.com/2016/12/31/after-cyanogen- colla...](http://www.androidpolice.com/2016/12/31/after-cyanogen-collapse- wileyfox-is-working-on-its-own-software-updates-for-nougat/) [2] [http://www.androidpolice.com/2016/11/28/cyanogen-inc-will- sh...](http://www.androidpolice.com/2016/11/28/cyanogen-inc-will-shutter- seattle-office-by-end-of-year-more-layoffs-happening-kondik-could-be-out/)

<comment><USER25> This.

CyanogenOS couldn't make money, and WF has trouble making money, because everyone else subsidises the cost of the handset and software by selling data.

If you want to provide what they claim - unparalleled security and privacy - you have to charge more, or charge a phone subscription fee for updates, or something.

One can't expect to get subsidized-by-data-selling prices, and have no data selling.

</comment></comment></comment><comment><USER26> I don't agree. It's simply that some vendors are untrustworthy.

Frankly if the telephone app on my "phone" stopped working I wonder how long it would take me to notice.

<comment><USER27> If the dialer stopped working I'd never notice, but if the phone app broke entirely I'd stop getting calls from telemarketers and loan scams.

<comment><USER28> And vacation sweepstakes, and shitty recruiters, and IRS scams, and...

This must be the elephant in the room. Traditional telephony has become dominated by bad actors. They hit a critical mass and now my phone app is a waste of space.

<comment><USER29> I've always found it weird how everyone I know seems much more cautious about phone usage than me: for example, I've never understood why people don't answer numbers they don't recognize.

I'm slowly realizing that this is because apparently people are inundated with spam calls? I think I may have received one solitary spam call in my entire life. I can't really account for the discrepancy

<comment><USER30> Where do you live? I'm the same, 0 spam calls ever, but I live in NZ.

<comment><USER31> Looking over my call log, I have five incoming from humans I wanted to hear from over the last seven days.

I have 27 from random numbers/places that I know from experience are scams. This is a US number.

If you find your life lacking opportunities to get in to obscenity shouting matches with random con artists, it is great! Otherwise, not so much.

<comment><USER30> Wow, that's terrible. No wonder Google Dialer has a spam filter - I never understood the point of it but now I do.

</comment></comment></comment></comment></comment></comment></comment><comment><USER32> I have never heard of a "Wileyfox Swift". If you need an awesome and capable Android 7.0 based dual SIM phone with zero carrier crapware/bloatware and a close to stock Android experience, the OnePlus 3T (64 or 128GB version) is a good choice.

Since Oneplus' falling out with Cyanogen Inc, and the financial failure of Cyanogen, Oneplus' own OxygenOS is essentially a re-implemented CyanogenMod that has all of the same features.

<comment><USER33> I've almost buyed the Wileyfox Swift last week, but I'm glad that I've seen discussions around Truecaller and the Zen ads, which changed my mind and opted for a BQ Aquaris X5 Plus instead.

<comment><USER34> I recently bought a Swift 2+. I still like it.

Hopefully, Zen can be disabled with the next update: [https://www.reddit.com/r/wileyfox/comments/64xga8/it_should_...](https://www.reddit.com/r/wileyfox/comments/64xga8/it_should_be_possible_to_disable_wileyfox_zen/)

<comment><USER35> Zen can already be disabled. Long-tap the launcher background, tap settings, and there should be a toggle labelled "Wileyfox Zen".

</comment></comment></comment></comment><comment><USER18> This why we need [edit] GDPR.

Next time someone tries to harvest my personal data using an "all-inclusive" EULA I'm going to sue his ass in EU-land.

<comment><USER36> GPDR is actually GDPR in case you are trying to read up on what that means and don't know already.

<comment><USER37> Which is the EU General Data Protection Regulation (GDPR)[0]

[0] - [http://www.eugdpr.org](http://www.eugdpr.org)

</comment></comment></comment><comment><USER38> i just bought a Volkswagen, which comes with Car-Net, which apparently relays telemetry to Verizon Telematics via a 3G connection. oh and there's a gps reciever and an in-car microphone.

their privacy policy is scary.

[https://carnet.vw.com/web/vwcwp/privacy- policy](https://carnet.vw.com/web/vwcwp/privacy-policy)

dealer refuses to disable or remove this carnet module. their "solution" is to tell me just not to sign up for the services. ummm..lol no. needless to say i'm taking matters into my own hands via vw message boards and:

[http://www.ross-tech.com/vag-com/](http://www.ross-tech.com/vag-com/)

may have to physically remove the module and/or neuter the antenna.

</comment><comment><USER39> Found myself in the exact same situation (have a WileyFox, updated and ended up with the awful true caller app as the default dialler + found I couldn't use the default google dialler), I've since been using: [https://play.google.com/store/apps/details?id=com.contapps.a...](https://play.google.com/store/apps/details?id=com.contapps.android.dialer&hl=en) but it does have adverts, I'd welcome any other suggestions (aside from re- flash).

Only today I was joking about how absurd it is that I was struggling with such a fundamental feature.

</comment><comment><USER40> Which is why I switched to Google-made phones (Nexus). No bloat, frequent security up dates and default apps. Sure, Google knows what I'm having for dinner, but it's a single entity I trust. At least I don't go about moving through apps, reading their TnCs.

</comment><comment><USER41> Too much traffic -- couldn't access the page.

Here's the cached version: [http://archive.is/vs4a7](http://archive.is/vs4a7)

</comment><comment><USER42> Looking at my cell phone bill I use far more data than I do actual voice a month. It's kind of an anachronism to call it a phone anymore. It's a pocket computer.

<comment><USER43> This is why I ported my phone number to Twilio and now I get an email when someone calls me with an mp3 of voicemail + transcription. And I make free outgoing calls with Google Dialer.

</comment></comment><comment><USER44> Can someone recommend a good, safe, privacy-respecting 3rd party phone app for Android, preferably for Cyanogenmod or LineageOS?

</comment><comment><USER45> You're not only using Android, but you're using an Android phone from a smaller company.

While this is bad, it's not really unexpected.

</comment><comment><USER46> What exactly is wrong with the dialler being an app ?

It allows exactly what the author wants with his specific desire for a dialler that does not rely on play services or true caller.

<comment><USER47> From the article:

"When You install and use the Services, Truecaller will collect personal information from You and any devices You may use in Your interaction with our Services. This information may include e.g.: geo-location; Your IP address; device ID or unique identifier; device manufacturer and type; device and hardware settings; SIM card usage; applications installed on your device; ID for advertising; ad data, operating system; web browser; operator; IMSI; connection information; screen resolution; usage statistics; default communication applications; access to device address book; device log and event information; logs, keywords and meta data of incoming and outgoing calls and messages; version of the Services You use and other information based on Your interaction with our Services such as how the Services are being accessed (via another service, web site or a search engine); the pages You visit and features you use on the Services; the services and websites You engage with from the Services; content viewed by You, content You have commented on or sent to us and information about the ads You see and/or engage with; the search terms You use; order information and other usage activity and data logged by Truecaller's servers from time to time. Truecaller may collect some of this information automatically through use of cookies and You can learn more about our use of cookies in our Cookie Policy"

and

"We transfer information to trusted vendors, service providers, and other partners who support our business and Services, such as providing technical infrastructure services, bug testing, analyzing how our Services are used, measuring the effectiveness of ads and services and facilitating payments as well as potential partners who may wish to work with us to provide other services."

<comment><USER46> Again, if the dialer is a system component does this and you can't remove it, you are out of luck.

Since the dialer is an app, if for some reason you don't like it, you can deactivate it (you can't uninstall preloaded apps since they are on a private system partition, but disabling it is enough : it does not appear in the app least and can't startup).

So you just have to install another that suits you better.

<comment><USER48> The thing that did that IS a system component. They can't remove it. They can only disable it.

<comment><USER49> Disabling it is every bit as effective as removing it, though. It can't be removed because it's on a read-only partition that pulls double duty as the factory reset partition. But once disabled it's as good as removed. It doesn't run. It doesn't get loaded. It basically doesn't exist outside of the button that restores it.

</comment></comment></comment></comment></comment><comment><USER50> I just came across this: [https://www.reddit.com/r/Android/comments/696dre/warning_to_...](https://www.reddit.com/r/Android/comments/696dre/warning_to_all_wileyfox_owners_your_location_data/)

<comment><USER18> Oh, Yandex... So lovely.

Of course if NSA has my data its only fair that FSB also gets some too...

</comment></comment><comment><USER51> Something is wrong when OP writes about dialer app that sells your private info were installed on device without any warnings — and everyone tells the OP that they don't really use phone app. Makes me question the humanity.

</comment><comment><USER52> Disagree entirely. The stock phone app is likely the least used app I keep on my phone.

<comment> guy-brush My main point is actually that I am forced to use this dialler without my consent. I am not trying to say that users shouldn't be able to customise the system but I am opposed to manufacturers forcing data-hungry 3rd party programs on customers.

<comment><USER53> at the same time, we can choose to install a different third party dialer no?

maybe what we need is a 3rd party dialer that pledges privacy.

<comment><USER18> The point is, this should not happen to core functionality. Specially not sneaky like this.

<comment><USER54> Define core functionality. We are carrying computers that happen to have a radio that can communicate with cell towers. The phone functionality is just as "core" as any other service that the OS exposes. (Camera, Web Browser, GPS)

<comment><USER55> It's still called a "phone", and it really sucks at being a computer (it is a good entertainment device though). Since a lot of things are still done over phone calls and every citizen in a civilized country is expected to be in possession of a phone number, I'd qualify it as core functionality.

</comment></comment></comment></comment></comment></comment><comment><USER56> Somethings wrong with the idea that there can be apps installed in your phone that could do things you don't know

</comment><comment><USER57> When I updated it at the weekend, I too noticed that the dialer had gone - which is annoying as I find the interface to Truecaller a bit of a pain - <AUTHOR> as I rarely make calls it's something I can live with. The incoming call filtering and showing of names not in my phonebook is actually pretty useful.

When I bought my Wileyfox Swift 18 months ago it came with Truecaller as an app already installed, and it integrated with the standard dialer well - ie I could use the dialer app to make calls, and incoming calls would show info from Trucaller. Not sure why they couldn't keep it like that.

</comment><comment><USER58> Many have already posted about how the phone is less important than email/browser which we're ok with being 3rd party.

I didn't really think there could be a difference between phone apps until I got project fi from Google. Their phone app comes with voicemail transcription and spam detection. Some of that is obviously from the service itself, but these features seem like things that I'd want to be able to acquire even if I had an AT&T Samsung (which is what I moved from and didn't have by default). Third party seems fine with me.

</comment><comment><USER59> You don't need to root a phone to install a new operating system. What you do likely need to do is unlock the bootloader, if at all possible.

If it's supported by LineageOS, use that instead. If not - perhaps consider buying a phone that is. If you're really privacy conscious, perhaps look at the CopperheadOS options - they're specifically known for privacy.

Other than that, this is the sad state of big data and advertising. Unless you fight back agasint it, everything about you is going to be poked, proded, and collected for futher processing and aggregation. Hell, a lot of you probably work in that industry here.

You should not assume that any device manufacturer has your interests in mind, as the trends have overwhelmingly shown that anything proprietary always leads to them finding a way to further line their pockets as interest for their product wanes, or their investors get greedier.

These are facts of life; take action but don't be surprised when you're being misled and taken advantage of when you're putting the trust of something so integral in a proprietary party.

Godspeed.

</comment><comment><USER60> I was out riding motorcycles with a friend. He went down and was pretty broken up. As the ambulance loaded him up, I tried to use his Android phone to call his wife to let her know he had been hurt and what hospital he was being taken to. It was a stressful situation but I could not find the phone function at first easily (no idea which distribution). The phone function is still really important!

<comment><USER61> Over here (Finland, EU) there used to be standardisation that a mobile phone must be able to make an emergency call even when the phone is locked, and even when the phone's own carrier is out of coverage, or when there is no SIM card - the call must be routed as a guest in any GSM network that is there.

That may now have changed, because the user instructions for iPhone say (translation mine):

"iPhone can be used to make emergency calls in many locations, if mobile services are available, but you should not trust on it in cases of emergency".

Yes, apparently iPhone user instructions say that when you're in an emergency, don't count on iPhone. You should carry a phone with you in addition to iPhone.

When dialing 112, the phone goes to a special mode: the call is prioritised (if the cell is full, another call is dropped) and if carrier's network is not there, the phone tries any other network.

(I've seen this work on my phone, but that time it didn't help, the guy died.)

</comment></comment><comment><USER25> One thought. A company like WileyFox must spend significant bucks to provide after-the-fact engineering to provide updates. It would be a classic error to underestimate the cost of ongoing engineering, and provide a lower up front cost, then be strapped for cash later. At that point, WileyFox management needs a revenue stream to provide the engineering to push 7.1.1. It would - again I am guessing - typically turn to outside companies who pay for placement, like the dialer. Those companies make money by selling data.

Thus I am not surprised that this is happening, although I had not heard of WileyFox until today. It's also possibly WileyFox is greedy, but I'm going with incompetence; I will believe first that someone made a mistake in pricing and planning, and they're looking for the best outcome for customers, company, brand.

I am, perhaps uncomfortably, saying that "you got an unexpectedly low price" going with a company like WileyFox. They gave you a cheaper phone, and frequent updates, and now they need to pay for it. They could either start charging subscriptions for the 7.1.1 update ( which would be fair, no? ), or they could do what they are doing by making a deal with what sounds like a shady dialer company, or they could bail out and not provide the updates they promised ( like most handset providers do ).

I could get all high-horse about software consumers being trained to expect free software. That expectation being set by the billions of dollars in VC money that has been spent to capture markets - markets that later require "exploitation". But I won't go there - it's a complicated argument, there are other market forces, there are models that work, companies can be "up front" about data-driven business models.

My way of saying - you do have to pay for software, you took the 7.1.1 update, you should expect to pay..... right?

</comment><comment><USER62> Is it true that carriers are increasingly switching to calling over WiFi? I understand the new iPhones have this feature, with switchover happening automatically.

Did the popularity of Facetime, WhatsApp, etc. have anything to do with this? I have seen claims from carriers that WiFi calling "improves coverage".

At some stage, will anyone question what is the point of the cellular network? Especially in urban areas.

What is the difference between

a. a "smartphone" and

b. a portable, pocket-sized computer with rechargeable battery where the user chooses what to install and can remove any pre-installed software, where user gets a choice of 1. using pre-installed software and default settings or 2. using her own bootloader, kernel and userland, and where the user can easily open the case and tinker.

Does a computer need to have any association with the company selling internet access? Today's "phones" are manufactured for carriers (who are often ISP's, too), not for users. The carriers in turn sell these customized "phones" to users.

<comment><USER63> There's a few things at play here:

* [https://support.apple.com/en-au/HT203032](https://support.apple.com/en-au/HT203032) WiFi Calling, which is (AFAIK) prioritised VoIP. Helps offload some calls from the provider's network which may help in congested areas

* [https://support.apple.com/en-au/HT203124](https://support.apple.com/en-au/HT203124) VoLTE. Voice over LTE, rather than GSM (?) channels. Highly prioritised VoIP over LTE data. Should improve call quality via better voice codecs. Seems to simplify tower equipment for the telcos - Telstra in Australia has some "4G Only" towers in a few places where "standard" voice calling is unavailable. VoLTE isn't particularly widely available here.

Really happy to be corrected here - this is interesting stuff.

<comment><USER15> Sprint's older WiMax systems (4G), when enabled, would put all calls over IP (starting with the HTC Evo 4G). It ate through battery though.

</comment></comment></comment><comment><USER64> So what makes you think Apple or Google aren't using your call information for advertising purposes in the default diallers?

<comment><USER6> Apple's record on privacy and business model give me pretty high confidence on this one.

Google may have an incentive to add call info to the profile they keep on you, but surely you're not thinking that they are as big of a privacy risk as some random third-party that puts a dialer up on the play store.

Edit: I couldn't get the article to load, so I'm going by the other comments to assume this was about scammy dialers tricking regular users on Android into installing them. Obviously a dialer on a custom ROM modified for extra privacy is a justifiable reason for making it replaceable on Android.

<comment><USER16> He's actually writing about the dialer that _comes_ with the device OS (in this case an OTA, I believe, but still, it's the default / 1P dialer. It just happens to be a branded one rather than the "usual" white label dialer a smaller OEM might provide.

</comment></comment></comment><comment><USER65> One of the central complaints in the blog post is that it's too hard to get your hands on an Android phone that doesn't come with impossible-to-remove bloatware. I've been amazed and annoyed by this too.

I understand all the reasons why manufacturers add these apps to the phone. But still, I would gladly buy a phone that came with a stripped down version of Android, no bloatware, and received regular updates and security patches.

Sure, you can root your phone, and there are various ROMs out there that you can install. But as someone who's never done this it seems kind of complicated and annoying.

I want a simple experience where it just works right out of the box. Heck, I'd be happy if to buy a phone from someone who just resells devices after flashing a decent ROM onto them and makes updates easy somehow.

<comment><USER66> > Heck, I'd be happy if to buy a phone from someone who just resells devices > after flashing a decent ROM onto them and makes updates easy somehow.

Sadly this would be useless without Google Apps and it's license forbid it. Google doesn't care as long as you install GApps on your own device, but anyone who try to sell would clearly trigger lawsuit.

</comment></comment><comment><USER67> Did I read that correctly?

 _Isn't this sweet? I am searching for a dialling application for my smartphone. A DIALLING application._

Does this mean he can't practically call someone outside his contacts list as there's no way to key in phone numbers? Or would he still be able to make regular voice calls?

<comment><USER30> He can't make calls, because he disabled the dialer app. The functionality is still there in the phone, but he has no app that exposes it. Android truely does provide enough "rope" to hang yourself if you start to disable apps you shouldn't.

<comment><USER55> Yeah, the thing is, if dialer is an app you "shouldn't disable", then it also should not be silently replaced by the vendor with third-party service, with no easy way to revert that.

</comment></comment></comment><comment><USER68> > This leaves me in an unpleasant spot as I, where I can, avoid using google > services and now need to find an alternative dialling application.

AOSP dialer. Done. Don't want the truedialer app? Run CM, like it says in the post.

<comment><USER48> You mean the thing they were running, which updated to include the 3rd party dialer app against their wishes?

</comment></comment><comment><USER69> No, this is simply proof that consumers must pick carefully the hardware vendor they decide to buy as which software it comes with will vary greatly between devices. This is simply not an issue with Google Pixel/Nexus devices, Samsung or any of the other major vendors.

Running Cyanogen (which has now no longer developed) nor 'GAPPS' (Google's standard package of apps that gives you access to the Play Store, and the stock dialer) is a pretty fringe use of Android.

<comment><USER34> Wileyfox officially came with CyanogenMod. That was one of their main features. Now that CyanogenMod Inc is bust, they build their own stuff and with the Update to Android 7 you get that. Turns out they also integrated two other companies TrueCaller and Yandex.

</comment></comment><comment><USER70> Well in the end modern smartphones are just general purpose computers which have some artificial restrictions on what you can do with them and happen to have a touchscreen/modem/speaker/microphone etc.

So the dieler just being a app is a direct consequence from smartphones not being any kind of "special/magical" embedded device.

Through silently overriding the Dialer with a program I would normally suspect to be malware which sneaked on my phone is a horrible think to do...

</comment><comment><USER71> The Swift originally shipped with CyanogenOS, which is not the same thing as CyanogenMod. CyanogenOS already featured Truecaller on the dialler to show names on incoming calls. I was confused too when the dialler disappeared from my launcher, but I use it very rarely and essentially to receive calls so not a big deal for me. I understand OP's concerns though.

</comment><comment><USER72> Many companies are betting that phones will be phased out for augmented reality glasses. Magic Leap, Microsoft, Facebook, Google, and Apple all have teams working on it.

People expect these devices to accept sim cards, will this break the confusion? My Smartglasses are a personal computer that also has phone functionality.

</comment><comment><USER73> Aren't there loads of free "phone" (dialer) apps in the Play store? Just use one of those?

</comment><comment><USER74> Funny, I'm reminded of my HP Ipaq back in 2005 or so. 800mhz smartphone with a stylus, wifi, running Windows CE.

It struck me as a portable computer, with "cellphone" functionality added as an almost afterthought.

Guess that's still the case if you think about it.

</comment><comment><USER75> I have and idea for a VOIP app called The Stallminator. The app would feature a nice backdrop of Richard Stallman's face [http://tinyurl.com/msbkwb3](http://tinyurl.com/msbkwb3)

</comment><comment><USER76> This issue echoes many privacy-related discussions and the same approach for android applies here:

      - <USER2>
      - install minimal 3rd party ROM (ie LineageOS)
      - choose what you want from Google via Open Gapps or use F-droid

</comment><comment><USER77> It's fine. If you want a phone just for voice go buy a flip phone, they are basically free and plans are cheap. If you want a smartphone, then deal with the implications.

</comment><comment><USER78> Whether thats a Google service or not, the OP has clearly stating the point that the problem he's facing now will have an evolution and affect even us in future.

</comment><comment><USER79> Unfortunately, in this day and age, I don't think it's reasonable to expect privacy even from a first party application.

</comment><comment><USER80> truecaller is something alltogether evil

</comment><comment><USER81> My iPhone is my pocket computer. It's on a tablet plan (data only - up to 1GB for $20 CAD) because voice and text is something I would hardly use. TextNow worked fine for me in past for phone calls and texting non-apple devices but I've since switched to Hushed as my go-to. I've never used the built in "Phone" app.

<comment><USER82> What do you do about phone interviews?

<comment><USER81> TextNow/Hushed provides me with a local number to use. Any "burner" phone app should work as well for that.

</comment></comment></comment><comment><USER83> _Double check which software you get with which device. Not being an apple fanboy, I have to admit: At least you know what you get when buying an Iphone._

I don't understand why some people compare a $650 iPhone 7 with cheap phones loaded with some half-assed vendor fork of Android?

If you wanted stock Android, you should have bought a $650 Pixel phone.

</comment><comment> guy-brush I just updated the article to include further emails from truecaller and wileyfox.

</comment><comment><USER84> i am still wondering how comes that nobody came up with a phone application for linux computers.

I have a 3G modem in my ThinkPad X220 and i am fairly sure it is technically capable of doing and receiving phone calls.

</comment><comment><USER85> And this is yet another reason why Cyanogenmod no longer exists.

</comment><comment><USER86> I thought it was about LinkedIn selling people's profiles :)

</comment><comment><USER87> How do I find a dialer app that's cloud-free?

<comment><USER88> I haven't used it yet, but a quick search on F-Droid showed [https://f-droid.org/repository/browse/?fdfilter=dialer&fdid=...](https://f-droid.org/repository/browse/?fdfilter=dialer&fdid=org.dnaq.dialer2), which looks promising. I fit still works on a current android, but at least F-Droid marks it as compatible.

</comment></comment><comment><USER89> I miss my motorola v3650.

</comment><comment><USER90> paixun

</comment><comment><USER91> I hardly make recommendations but i wish to recommend SpyhackGod to those who genuinely need the service of a good hacker. He is probably the best of the best. He helped clear some bad records i had online, he was actually able to change my records in less than 24hours then my husband was a big cheat and i could not easily pin anything on him so i went on to hire him and he helped me hack my husband's whats app and gave me unrestricted access to his accounts including getting me on his facebook messenger, viber,wechat and he never suspected…. He is a pro at Facebook,emails,twitter ,Instagram hacking and cloning of phones.Contact firstname.lastname@example.com...I am sure he will help you. (promised to make this recommendation)

</comment><comment><USER92> You purchased a Chinese mobile phone and it installed spyware in an update.

Anybody who's ever purchased a mobile from eBay or AliExpress has already seen that. They need to get their revenue from somewhere. Next time stick to a known, trustable brand.

</comment><comment><USER93> I fought having a phone through to 2008 - now I'm reconsidering wanting one again

if there was a pure messaging device right now with no voice - I'd bite their hand off

I don't need a mobile browser or even apps - all they do is stop me from disconnecting from work for a few minutes or hours - I don't think always-on is good for anyone over time

<comment><USER94> I'm sure you can find an android device that has a physical keypad, root it and disable any call or mobile data functionality while keeping SMS intact.

<comment><USER88> Actually, that's not that easy. There are not many android phones with keyboard, and even less with a proper community for rooting it. I wouldn't know a single one.

<comment><USER15> I don't think there's anything decent with a physical keyboard anymore. It's sad. I'd seriously welcome the extra thickness for something like the old HTC Evo Shift.</comment></comment></comment></comment>


Facebook screws iFart author - <AUTHOR> http://scobleizer.com/2009/01/24/facebook-kicks-off-ifart-author-for-having-too-many-friends/

<comment><USER2> It's the tyranny of the cloud. You trust Facebook with your personal contacts, Gmail with your mail, and YouTube with your videos until the day a nameless admin script decides you crossed an unwritten threshold and dumps your account into the bit bucket. I don't trust anything of importance to someone else's service, especially Facebook.

<comment><USER3> Why especially Facebook? Because of the code leak (and abysmal code quality) a while back?

<comment><USER4> The code must not be that abysmal, considering how much it handles. When you make a separate load request just to poke somebody, when Chat is constantly making requests, then you've got to have code that's handling itself pretty well. And the end results are gorgeous compared to most any other site.

Perhaps especially Facebook because of that silly "Facebook is run by the CIA" video a while back?

<comment><USER5> wasn't <http://www.iqt.org/> one of Facebook's earliest investors?

</comment></comment></comment></comment><comment><USER6> Interesting that the iFart author was not just a random lucky hacker. Also, despite all his other accomplishments, he will from now on be known as the iFart author? I hope for his sake that it won't be like that, but I guess there is a lesson in that somewhere...

<comment><USER7> Yes, I think it's odd that the submitted post, and its SEO link title, mention iFart as that Facebook user's most noteworthy accomplishment, when he has done other things that are more significant and perhaps more relevant to why his Facebook friends count is so large.

</comment></comment><comment><USER8> Perhaps there would be mileage in an app (or browser plugin or Evernote mashup etc) that created backups of your Facebook data in some way.

Impetus / further example: A friend of mine took the decision to remove himself from social networks for privacy reasons. While I respect his decision and motivation, the loss of comments on our holiday photos from his albums was a real shame.

Further application: 1\. Access to historical data/ versioning of your own and others pages (ahem, all sorts privacy issues there). 2\. Those popular map- the-people-i-know graphics could be created as videos showing growth over time. 3\. Generating a Lulu book from the collected data (I think we all know at least one Facebook addict who would love this).

Of course the irony is that Facebook would likely have ban you for using anything that mined your account at any sort of interval. To avoid suspicion it would need to be "watching" (or mimicking) your regular access and saving the juicy bits rather than logging in for you and crawling.

<comment><USER9> What we _need_ is a decentralized, XMPP-or-similar-based Facebook clone that you could _own_. I'm not a Facebook expert but I've been shoulder-surfing as my wife uses it and I see little that could not be cloned in this manner.

Facebook itself is almost entirely unnecessary, and not with "pie in the sky" technology that may exist someday... it could be done right now.

<comment><USER10> Any concrete ideas on how to implement that idea? Sounds really interesting.

<comment><USER9> It's technically so easy it's hard to even make it take long to describe. Define XMPP pubsub nodes that correspond to the events of interest. Create a client that subscribes to these nodes and translates them into web events. This is probably a good time to consider a non-SQL based backend.

Personally, I'd do it all in the context of ejabberd + yaws using Mnesia. If I'm feeling particularly saucy, I would use comet-connections to make all the events live, not just "chat". (That's an advantage you would get from the web server and XMPP server being in one (OS) process; the same event can very, very easily trigger both XMPP handling and some JS shipped down to a user with one handler.) I would actually not bother scaling to umpty-bajillion users, the entire idea for people to actually own their implementation and for there to be bajillions of implementations out there.

I could pretty much spec this in my sleep and implementation wouldn't be that much harder. The thing is... that's not the hard part. The hard part is getting people to use it, and "I provide a hosting service for the first few thousand people and create a de facto point of centralization" rather defeats the point. I have no idea how to address that step.

</comment></comment></comment></comment><comment><USER11> My gut reaction is that people like Scoble with "5000 friends" are abusing the service, and that when they combine that abuse with mass messaging, it's easy to see why Facebook would react.

<comment><USER12> Exactly. Facebook is only useful for keeping in contact with your friends as long as the connectivity graph of your friends actually only includes real friends.

If a friend posts a status update, and a friend of that friend comments, you see the comment. The likelihood you will see comments from some random person you will never meet increases by the sum of fake friends of _all_ of your friends.

Even if you have say, 100 real friends, but each of them has ~5 fake friends, you are exposed to comments from 500 random strangers.

<comment><USER13> You may be right, but I've never seen it happen. I have over 600 "friends", many of which I've conversed with online, but none of whom have commented, posted, or tagged me on -anything-. The exception being the people whom I've met in person.

</comment></comment></comment><comment><USER14> But but... this guy is a "social media expert" ...

</comment><comment><USER8> Possible fix: institute a "real" friend limit that is reasonably low. If a user has reached the limit, subsequent requestees are automatically added to a fan page. Allow the user to swap people between the two. Facebook's fan pages, updates etc keep a good balance between marketing & spam... this would enforce the use of them.

</comment><comment><USER15> Am I the only person who thinks the author really missed a headline opportunity by not using "iFart author thinks that Facebook policy stinks"?

</comment><comment><USER16> I use Facebook only because my friends are on it. I like the ease of access Facebook provides to people I like, but this has more to do with it being the most-used social site. Facebook itself sucks and I would do very gross things to make a living before I would have Mark Zuckerberg as a boss.

<comment><USER4> Facebook isn't perfect, but it's not a sucky site. It's streamlined and efficient, it runs _very_ quickly (especially compared to MySpace or Bebo or Hi5), and it's got a surprisingly slim history of messing things up for people. Yeah, it gets in trouble, but Facebook deals with hundreds of millions of accounts, and it does a pretty damn good job at all of that. Compare to MySpace, which has had incidents of murders, suicides, massive spam, site breakages, _page_ breakages, and a week-long removal of "gay" statuses from their websites, and Facebook's track record is incredible. They've got an impressive team.

I've also written to a person who works at Facebook, and he says it's a pretty good job with some brilliant co-workers.

I'd be willing to bet that Facebook reinstates this account, similar to the way they reinstated Scoble's. And this is a way way edge case: most people don't write to 900 not-friends. I'm sure Facebook's spam filter picked that up, but I'm just as sure that in a week's time this account will be back and running.</comment></comment>


Ask HN: Legal Hacks. - <AUTHOR>

I recently found out that the best state for registering a C-Corp is Delaware.<p>Post your legal hacks here. <comment><USER2> The Mozilla Corporation (which employs many developers and has revenue deals with partners like Google) is a for-profit company, owned entirely by the non- profit Mozilla Foundation.

This lets Mozilla have a taxable, revenue-generating entity that is not subject to various restrictions on activity of non-profits. But because the sole owner is a charitable non-profit, the corporation can act in altruistic (i.e. non-profit-maximizing) ways without compromising its "shareholder" interests.

I thought this was a neat legal hack because it uses existing legal structures in an unusual way, and lets Mozilla use the best parts of the non-profit and for-profit structures as needed.

<comment><USER3> I once worked for a for-profit student newspaper that had a non-profit landlord, which existed almost solely to lease space at a discount to the for- profit company and support that for-profit's "educational" mission. It saved thousands annually on property tax, while leaving the for-profit paper completely free to do whatever it wanted.

Editorial endorsements, for example, are a legally murky area for non-profits (though the IRS traditionally lets newspapers slide) but completely fine for for-profits.

</comment></comment><comment><USER4> I think the IKEA "legal hack" can top just about anything out there. Check it out: [http://www.economist.com/business- finance/printerfriendly.cf...](http://www.economist.com/business- finance/printerfriendly.cfm?story_id=6919139)</comment>


Ask HN: Does bootstrapping a clone within an established market make sense? - <AUTHOR> Fresh account here created to ask this question. I'm in my late thirties and I spent my entire career at tech startups (as founder or employee up to CTO and VP Product positions). I never scored really big, but I earned well. I'm currently free to start something new and I might look for a new job as tech or product lead, but I'm also entertaining a thought of launching a SaaS business.
I don't have a groundbreaking or innovative idea, but I'm great at execution. I'm more than happy to bootstrap something small, without ever taking outside capital, a company which will never grow over few dozen employees. I'm looking for a quite likely path to build a $5-25M company rather than a quite unlikely path to build a $100M-1B company (the latter seems to be the dominating goal in startup community).
Considering the above, can creating a clone within an established area be the way to go? Something like another website monitoring service, another ticket system or another ecommerce CRM. None of these is actually something I want to pursue, but you can get the idea.
I understand that building a product is just the beginning and that much more effort is required into marketing and sales and I'm prepared for that (I know that underestimating it is a common mistake made by techies wanting to launch their own business), but they are also the areas I'm least experienced (although not totally inexperienced), so I'm unsure if this is a good idea.
I would love your opinions on whether what I want to do is viable. Or should I forget it because I will just do better by launching a software house or by creating an offshore development center for some US/EU company (I'm from the Central/Eastern Europe so it's the best place for this considering talent/culture/salaries mix)? Let me know what do you think or share your experiences if you've done or tried the same. Thanks! <comment><USER2> I'm paraphrasing a little bit, due to imperfect memory, but I've always been inspired by something Bob Parsons (of Godaddy fame) said:

"Never be afraid to enter a crowded market. Just be better than everybody else".

So yeah, if you're confident enough if your ability to execute at a high(er) level, then I think it can make sense to do something that's fundamentally similar to an existing business.

OTOH, it you want to make _big_ money, it might be better to pursue something in line with Peter Thiel's ideas about wanting a "monopoly" and having something that's 10x better instead of being an incremental improvement.

I think either model can work though, depending on your goals and on your ability to execute.

See also: discussion of "fast follower strategy".

[http://www.forbes.com/sites/avaseave/2014/10/14/fast- followe...](http://www.forbes.com/sites/avaseave/2014/10/14/fast-followers- not-first-movers-are-the-real-winners/#5bfe137f9d7e)

[https://hbr.org/2012/06/first-mover-or-fast- follower](https://hbr.org/2012/06/first-mover-or-fast-follower)

[http://www.forbes.com/sites/oracle/2016/06/02/why-fast- follo...](http://www.forbes.com/sites/oracle/2016/06/02/why-fast-follower-is- yesterdays-tech-and-business-strategy/#47ea05f74805)

</comment><comment><USER3> I honestly beleive taking this approach puts you at an advantage and a better chance of success. Everyone else has done the ground work for you and educated the market. Just do not be worse than them and you have a good business.</comment>


Ask HN: Does software exist to digitize scanned books and articles? - <AUTHOR> I've noticed that when I view a PDF of an old book or article, often I can't select and copy text. I assume this is because (1) text selection is disabled somehow, or (2) the document is essentially just a collection of images. Does software exist that can convert a printed page with a lot of math notation into a truly digital document? I'm looking for the same level of quality as TeX. Thanks! <comment><USER2> Yes, PDFMiner in Python [https://github.com/euske/pdfminer](https://github.com/euske/pdfminer)

Apache PDFBox in Java [https://pdfbox.apache.org](https://pdfbox.apache.org)

Previous discussion [https://news.ycombinator.com/item?id=11327493](https://news.ycombinator.com/item?id=11327493)

For a list of others, see [http://okfnlabs.org/blog/2016/04/19/pdf-tools- extract-text-a...](http://okfnlabs.org/blog/2016/04/19/pdf-tools-extract-text- and-data-from-pdfs.html)

<comment><AUTHOR> According to the PDFMiner site, pdf2txt.py cannot recognize text drawn as images that would require optical character recognition. I'm interested in software that combines OCR with some sort of math notation rendering engine.

<comment><USER2> For handwritten character recognition, see:

[https://www.tensorflow.org/tutorials/mnist/beginners/](https://www.tensorflow.org/tutorials/mnist/beginners/) (also google "tensorflow ocr")

[http://yann.lecun.com/exdb/mnist/](http://yann.lecun.com/exdb/mnist/)

CROHME: Competition on Recognition of Online Handwritten Mathematical Expressions [http://www.isical.ac.in/~crohme/](http://www.isical.ac.in/~crohme/)

Closed-sourced API: [http://mathpix.com](http://mathpix.com) [https://photomath.net/en/](https://photomath.net/en/)

Best off-the-shelf OCR (originally developed by HP, now Google):

[https://github.com/tesseract-ocr/tesseract](https://github.com/tesseract- ocr/tesseract)

[https://github.com/tesseract- ocr/tesseract/wiki](https://github.com/tesseract-ocr/tesseract/wiki)

Two Clojure talks...

Machine Learning Live - Mike Anderson [https://www.youtube.com/watch?v=QJ1qgCr09j8](https://www.youtube.com/watch?v=QJ1qgCr09j8)

Adventures in Understanding Documents - Scott Tuddenham [https://www.youtube.com/watch?v=94NjRg8zoCA](https://www.youtube.com/watch?v=94NjRg8zoCA)</comment></comment></comment>


Chrome DevTools for Mobile: Screencast and Emulation - <AUTHOR> http://www.html5rocks.com/en/tutorials/developertools/mobile/

<comment><USER2> Can you debug webviews in Android with this? Or is it only for the dedicated browser?

<comment><AUTHOR> Yes, the new WebView in Android 4.4 is totally debuggable: [https://developers.google.com/chrome-developer- tools/docs/re...](https://developers.google.com/chrome-developer- tools/docs/remote-debugging#debugging-webviews) It doesn't yet have the screencasting, but every other DevTools feature is in there.

</comment></comment><comment><USER3> I'm not seeing the screencast icon. (chrome 32/ubuntu desktop, chrome 31/android 4.1)

<comment><AUTHOR> Chrome 32 Beta on android ([https://play.google.com/store/apps/details?id=com.chrome.bet...](https://play.google.com/store/apps/details?id=com.chrome.beta)) is necessary. I'll update the post to make that clear. Thanks.

<comment><USER4> So WebViews in KitKat are not screencast-able as they are currently pegged at Chromium 30. Nevertheless, a debuggable WebView is an enormous leap forward in Android Web development.

I found: [https://developers.google.com/chrome/mobile/docs/webview/ove...](https://developers.google.com/chrome/mobile/docs/webview/overview#will_the_new_webview_auto- update)

      Your apps inside a WebView are just as important
      and deserve a runtime that keeps users up to date.
      There are large engineering and logistical
      challenges. We're not quite there yet, but we're
      working on it.

I presume that the engineering feat is getting WebViews packaged in an updatable form. Right now WebViews are linked through the Android system, exposed as Java classes to apps... code that is not contained in APKs.

I can think of two ways to solve this:

1) Android learns how to receive partial system updates outside of device and carrier certification processes (maintenance releases). Through the Play Store, for instance.

2) WebView architecture is changed to run WebViews as a service hosted in a dedicated WebView app, upgradable as an APK. This would require either an enhancement to RemoteViews or a new solution altogether.

<comment><USER5> >1) Android learns how to receive partial system updates outside of device and carrier certification processes (maintenance releases). Through the Play Store, for instance.

That's what google is doing with the Google Play Services 'super app' \- it's meant to untie Android API updates from carriers. With the bonus of the app being closed source and thus not part of stock AOSP.

</comment></comment></comment></comment><comment><USER6> I'm really in need of accurate iOS Safari emulation in the browser so I hope this brings it. I have a javascript "push-menu" effect that works properly on every device except the iPhone's Safari and debugging it is proving tedious because the effect works in the current dev tols "simulation" of the iPhone as well. On every device the push-menu pushes the other content aside, leaving the button that activated the originally hidden menu still visible. On mobile Safari, the menu covers up the existing content, including the button I would use the close the menu.

<comment><USER7> Note that Chrome for Android (and the desktop emulator) are very different than Safari on iOS. Even when they were both built on top of Webkit, they had different renderers and platform bindings (and the iOS binding was not open source, which caused some of the friction that caused the split). Now that Blink has forked from Webkit, they are diverging even further.

So while this means you can do basic mobile web development this way, testing that your UI generally works on mobile devices, it's not substitute for testing and developing on actual iOS Safari.

<comment><USER8> More details about this here: [http://www.paulirish.com/2013/webkit-for- developers/](http://www.paulirish.com/2013/webkit-for-developers/)

<comment><USER7> Right. And this was before the Blink fork; they've diverged even further by now.

</comment></comment></comment></comment><comment><USER9> Are there any similar articles explaing how to use what Firefox has to offer?

[https://developer.mozilla.org/en- US/docs/Tools/Remote_Debugg...](https://developer.mozilla.org/en- US/docs/Tools/Remote_Debugging)

<comment><USER10> I used both and while I can't give a precise comparsion I think that the chromeDevtools are generally more advanced but Mozilla is working really hard to improve with actually good results.

</comment></comment><comment><USER11> Anybody know if screencasting works with a Galaxy Nexus? I am not seeing the icon in Dev Tools and I can't find a list of supported devices.

<comment><AUTHOR> Yup, it works on anything that Chrome's on. Though: make sure you're on the Chrome Beta ( [https://play.google.com/store/apps/details?id=com.chrome.bet...](https://play.google.com/store/apps/details?id=com.chrome.beta) ) on your phone. I recommend Canary or Dev Channel for your desktop.

<comment><USER11> Getting Chrome Beta for Android did the trick. Thank you for the fantastic tools you Chrome folks are building.

</comment></comment></comment><comment><USER12> Does this only work with stock Android installs?

Verizon S3 and S4's are not popping up as devices.

</comment><comment><USER13> holy moley screencasting is amazing.

<comment><USER14> It is nice.

One thing that got me stuck for an entire coffee was that I needed to run Chrome Mobile Beta on the device to get the Screencast toolbar button to appear, otherwise you just get regular remote debugging with no button.

</comment></comment><comment><USER15> _Devil 's Advocate_ (from an uninformed newbie): What's the benefit of this when no one uses chrome for mobile? All android devices come with "Internet" and all iOS devices come with Mobile Safari. This doesn't help me resolve issues on the browsers that people actually use on mobile devices.

<comment><USER16> Android has shipped Chrome as the default browser since Android 4.1, which makes up more than 50% of Android devices.

[http://developer.android.com/about/dashboards/index.html](http://developer.android.com/about/dashboards/index.html)

<comment><USER15> Ah, good to know. Thanks

</comment></comment></comment><comment><USER17> Can you get the debugging screencast to cast from your computer to your Chromecast?

<comment><AUTHOR> Yes.

</comment></comment><comment><USER18> Does anyone have instructions on how to get this working on linux google chrome?</comment>


Unlimited vacation time in remote teams - <AUTHOR> https://remotehub.io/newsletter/unlimited-vacation-time-in-remote-teams <comment><USER2> "Unlimited vacation" is just a gimmick that originated in the US.

Since there are no legal right to anything over there they can advertise "unlimited vacation" but the reality can be quite different because (1) approval is obviously still required, and (2) there is obviously a pressure not to be seem as being a slacker.

In Europe you have 20-25 days mandated by law and people do use them because companies tend to force them for fear of getting into trouble for flaunting employment law.</comment>


New Tonido iPhone app offers Over The Air (OTA) file transfers and much more... - <AUTHOR> http://tonido.posterous.com/new-tonido-iphone-app-offers-over-the-air-ota#

<comment><USER2> Works great. Easy way to access and download files to iPhone. Doesn't play mp4 though</comment>


Proof I Am Not Radio Active - <AUTHOR> http://www.justazilch.com/2008/05/proof-i-am-not-radio-active.html

<comment><USER2> Is it just me, or is anyone else just not even surprised anymore when a big company treats their customers like crap.

</comment><comment><USER3> Sirius' online service does this as well.

</comment><comment><USER4> Pandora does this too. Drives me NUTS.</comment>


Sliding right into disaster: Left-to-right sliding windows leak - <AUTHOR> https://eprint.iacr.org/2017/627 <comment><USER2> It might not be clear from the title without context that the setting for this attack is a local cache-timing attack, which can work cross-VM on the same physical hardware. So if you have an attacker running code on your physical machine, but not necessarily in the same process, account, or VM, you would be vulnerable to private key recovery.

Although the researchers describe mitigations that will dramatically reduce the information leakage, this is further evidence that it's quite dangerous to do software crypto on hardware that may be shared with an adversary.

<comment><USER3> Is there a cheap alternative? I know there are a few vendors selling secure hardware USBs (though how secure I don't know) for various uses, but are there any SoCs to run arbitrary sensitive code without hardware sharing?

<comment><USER4> Intel SGX provides good isolation, it is still vulnerable to some side channel attacks, though it can be mitigated using a TSX hack.

Of course, SGX is not quite available yet on server class CPUs.

<comment><USER5> The details aren't completely spelled out here but SGX looks to be an interesting extension of the idea of "virtual machine per block of code" [https://software.intel.com/en-us/sgx](https://software.intel.com/en-us/sgx)

It appears a runtime per-site-per-use license is required though.

<comment><USER6> The latest SDM strongly suggests that some future CPU will change this. Also, certain Linux x86 developers think that SGX support is vastly more likely to be acceptable upstream if this changes :)

</comment></comment></comment></comment></comment><comment><AUTHOR> "We also provide strong evidence that the same attack works for RSA-2048 with only moderately more computation."

This is the fix: [https://git.gnupg.org/cgi- bin/gitweb.cgi?p=libgcrypt.git;a=c...](https://git.gnupg.org/cgi- bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=8725c99ffa41778f382ca97233183bcd687bb0ce;hp=78130828e9a140a9de4dafadbc844dbb64cb709a)

<comment><USER7> Yes, I was installing it with Homebrew just yesterday. That was fast. Was this code already in review?

</comment></comment><comment><USER8> How can you compute modular exponentiation in a Time Safe way, regarding some pseudocode or a link?

<comment><USER9> They give a partial answer aka right-to-left vs. left-to-right, but at the high level.

Make sure you do fixed computation regardless of data involved. This involves slowing things down and making sure the CPU/compiler does not optimize anything so things become unbalanced.

<comment><USER8> Okay, I saw that, but thanks for saying it. What does right to left mean specifically? How would you compute it without a sliding window / or make it fixed time?

<comment><USER10> Straightforward implementation involves taking exponent bits from the MSB on and multiplicating by the base for 1 bits and then squaring the intermediate result.

Straightforward way to make this constant time is to do the multiplication always and discard the result for 0 bits.

Motivation of the sliding window algoritms is that they are faster and also believed to be "more constant time" than the straightforward square and multiply.

<comment><USER8> Thanks.

</comment></comment></comment></comment></comment><comment> JH-Lee Can you provide an example and explanation of rule 2 on page 9? I understand about Theorem 1.

</comment><comment><USER11> Dear moderators: Can you adjust the title? I misunderstood it, as I think many others will, as defeating all RSA-1024 by all GPG users done on any computer. It's actually about people who share a computer with someone doing a GPG decryption.

The paper's title is: "Sliding right into disaster: Left-to-right sliding windows leak". Standard HN practice is to use the page's title as the post title.

Alternative options that seem clear to me:

\- "Local-machine side channel attack defeats RSA-1024 decryption using GPG (CVE-2017-7526)"

\- "Complete break of RSA-1024 in GPG (CVE-2017-7526) for local attackers"

\- "Sliding right into disaster: Left-to-right sliding window attack against local-machine RSA-1024 in GPG (CVE-2017-7526)"

Thanks!

<comment><USER12> I was an expecting an article about waterproofing differences between windows that open to the left and those that open to the right. Forgot this was HN.

<comment><USER13> My first thought was window managers... like, a flaw was found in some code that does window sliding somehow.

<comment><USER14> I thought this too!</comment></comment></comment></comment>


Thirty-Six Thousand Feet Under the Sea - <AUTHOR> https://www.newyorker.com/magazine/2020/05/18/thirty-six-thousand-feet-under-the-sea <comment><USER2> Fun fact, though unrelated: the title 20,000 Leagues Under The Sea refers to the distance traveled while under the sea, not the depth.

<comment><USER3> Saturday Night Live did a whole skit on this.

[https://snltranscripts.jt.org/93/93qleagues.phtml](https://snltranscripts.jt.org/93/93qleagues.phtml)

Why am I cursed to remember these awful things? From 27 years ago!

[https://streamable.com/bf8f](https://streamable.com/bf8f)

<comment><USER4> Is that Kelsey Grammer!? I had no idea he did an SNL stint.

</comment></comment></comment><comment><USER5> Good article, but discussed just 10 days ago.

[https://news.ycombinator.com/item?id=23153640](https://news.ycombinator.com/item?id=23153640)

</comment><comment><USER6> > micromillimetre

Somebody doesn't know how SI prefixes work.</comment>


Dam Project Threatens to Submerge Thousands of Years of Turkish History - <AUTHOR> http://www.nytimes.com/2016/09/02/world/europe/turkey-hasankeyf-ilisu-dam.html <comment><USER2> These people can't win. They try to remove the reliance upon oil and coal, and add surer supplies of water for their populace, and still people find reasons to criticize. As opposed to pumping more carbon into the atmosphere, thanks, I'll take the dam. Infrastructure to serve the living is far more useful than infrastructure to observe the dead.

<comment><USER3> Environmentally, dams are hardly harmless. Just the opposite: they tend to have devastating consequences for the ecosystems they withhold water from downriver. Sure, they don't pump out carbon dioxide, but they cause lots of local damage.

</comment></comment><comment><USER4> I spent a few hours in Hasankeyf in 1999, on a tour to view a total solar eclipse. The buses parked on the Tigris shore and we all climbed up through some of the cave passages and houses. Here are some pics[1]. Certainly the town is a hugely impressive historic site. However the population is small and poor, so probably has little political clout.

[1] [https://cortesi.smugmug.com/Solar-Eclipses/1999-Turkey- Hasan...](https://cortesi.smugmug.com/Solar-Eclipses/1999-Turkey-Hasankeyf)

</comment><comment><USER5> The story is very important and thanks to NY Times for covering it. However, calling it "Turkish" history is a few thousand years short.

<comment><USER6> Yes; about 11 of them, according to the article itself. Though I assume they meant "Turkish" as in belonging to the land, Turkey, not the nation.

12,000 years... Older than our planet, according to Young Earth creationism.

</comment></comment><comment><USER7> Are dam projects ever a good idea? I'm not being flip or sarcastic.

When I think of dams, I think of catastrophic failure which almost always ends in thousands of deaths. I think of how quickly untended dams will fail. I think of what kind of target a dam makes. I think of flooding and burying wilderness and wildlife and even towns like this.

I also think of hydro-electric power and water availability... but aren't there other ways to tackle those problems?

Are dams ever a good idea?

<comment><USER8> I can see a point to what you are saying. Dams can result in 1000s of deaths, but they already help millions to survive.

>>Are dams ever a good idea?

Yes, I guess, without dams the developed nations would not have been so developed either in terms of technology and even sociology. Without dams there won't be cities, without big cities there won't be mixing of different strata/groups of society.

So, when I think of dams I think of the immense value they provide to humans and their progress. It's difficult to get rid of dams. What we need is a lot better technology to ensure their reliability and robustness.

Another reason why we need dams more is: the sheer population increase is putting a hell lot of pressure on natural resources (including water, of course) these days as compared to 19th century. So we must address this issue also.

Also, the increasing consumerism should be restricted/reduced. The mindless consumerism is also adding to this pressure.

<comment><USER9> To take issue with your later points: a lot of resource pressure is due to humans being to stupid to not throw away their resources. Take California for instance. They have two really big environmental issues: drought and fires. LA purposely diverted rain water to the sea [1]. This meant they didn't resupply their ground water. Billions of gallons of water effectively lost over the years. The fires are due, in great part, to poor land management at a state and federal level [2]. Historically rational loggers cleaned out the forests. This prevented the type of fires we have now. It also prevented the landslides because the forest survived fires and kept the soil in place.

All this is not to say that we aren't putting pressure on the environment. It just goes to show that the pressure we're applying is a result of decades of arrogance and stupidity.

1 - [https://www.marketplace.org/2016/01/08/world/down- drain](https://www.marketplace.org/2016/01/08/world/down-drain) 2 - [http://www.thenewamerican.com/tech/environment/item/16396-bu...](http://www.thenewamerican.com/tech/environment/item/16396-burning- up-the-west-feds-greens-cause-catastrophic-fires)

</comment></comment></comment><comment><USER10> Hate to be that guy, but saying "thousands of years of Turkish history" is exactly as ignorant as saying "thousands of years of American history"

<comment><USER11> America is a group of continents that's been around for many thousands of years, Turkey is a country that hasn't.

Perhaps you meant USA. Calling people out as ignorant is always dicey IME.

Personally I don't mind the titling of historical situations using modern geographical designation as long as the head of the section tells me the historic context.

</comment></comment><comment><USER12> The thing is that history is not "Turkish" as such. But otherwise important issue.

</comment><comment><USER13> I am sorry to see that resistance doesn't stop the dam project. It's a beautiful heritage but will be gone :(</comment>


Using CAPTCHAs - <AUTHOR> https://www.gov.uk/service-manual/technology/using-captchas <comment><USER2> I understand why people don't like captchas - specifically recaptcha - but I believe it's a 'necessary' evil. Many small startups and hobby sites don't have the resources to roll their own bot prevention/detection or subscribe to paid captcha solutions. Without recaptcha, these sites likely wouldn't exist or would be few and far between.

> Your service could still be at risk, even with a CAPTCHA in place. Advances > in computer imaging and the use of CAPTCHA farms means some bots will still > be able to access your service.

I don't think anyone will tell you that captchas are a 100% effective method at preventing automated/falsified actions. The main reason they are so widely used and generally the 'one stop shop' for bot prevention is that it increases the cost of attacking your service. Without them, an attacker could set up a simple loop that gets a site's csrf token and attempts a username/password combination. With them, an attacker does have to have a bot with "advances in computer imaging" or will have to rent a click farm. ReCaptcha is fairly good at preventing these two anyways since they will often blacklist a client[0] while still collecting the known good captcha answers for their car NN.

> Alternatives to CAPTCHAs

Transaction monitoring can be effective, but costly. Honeypots are only effective against non-targeted attacks, as an attacker can just submit one form themselves and see the browser's network request and know what to send to look like a regular browser. Rate limits are also pretty easy to bypass, new IPs are easy to obtain since every VPS provider I know hands them out like candy (the only cost to this is not getting kicked off the provider).

0: [https://news.ycombinator.com/item?id=16164549](https://news.ycombinator.com/item?id=16164549)

\---

For the UK government, I do expect them to employ better mechanisms than captchas to protect their services. But without them, there would be even less small communities than there are now. They may be up at the mercy of Google, but nothing is done without the permission of the biggest companies.

<comment><USER3> For those who have no resources rate limiting still works better and easier than captchas. You shouldn't do rate limiting per IP though, do rate limiting per /24 subnet, /16, /8, /0 per http method per URL, etc. Typically it takes just a few lines of nginx configuration.

<comment><USER4> ^ Good and thoughtful idea.</comment></comment></comment>


Dear NY Times, Here's Why I Haven't 'Grown Up.' Love, a 20-Something - <AUTHOR> http://www.lemondrop.com/2010/08/19/nyt-op-ed-what-is-it-about-20-somethings/

<comment><USER2> Our parents and grand parents worked so hard to give us more choices than they had, and now that we have them and are choosing to navigate them in our own way, there is a whole class of people who think that is wrong.

Choice. Its a powerful word, and many in this generation have more choices than in any other generation before, or (quite likely) after.

Good on them, I hope they enjoy the hell out of it.

</comment><comment><USER3> Summary: "Because I don't want to."

</comment><comment><USER4> I don't see how this is hackernews</comment>


Ask HN: How much of "You don't need a degree to get a job" is true? - <AUTHOR> As a point of reference, Elon Musk has been very vocal about University education. However, if you visit the career page of either SpaceX or Tesla, you will note that a degree is a requirement. Furthermore, assuming it is not required and a nice to have, most postings require multiple years of professional experience in a related field. Of course, due to the nature of these businesses, I completely understand requirement of degree or a related professional experience. However, I wonder if a person without a degree can even land a job in other companies in an effort to hop to SpaceX/Tesla.
My goal with this thread is not to shit on SpaceX or Tesla. I am just trying to start a dialog about what someone seeking work in similar fields without a degree would do.
Unrelated: I do have a degree, but my grade are in upper B (B/B+ or A- at best depending GPA scale) range and was just checking out some places that I consider 'dream job'. This question sort of just popped up in my head and I decided it to blurt it. I already have a full time job waiting for me at a startup I loved to work at :)
Good day <comment><USER2> How much? Very little. Any vaguely formal hiring system will weed out non- graduates faster than you can say "Elon". Without a degree, you'll have to live and die by your network and your hustle, which may or may not work well for any given person.

The cynic in me thinks the current "you don't need a degree" wave is a fashion to get more people working for ramen. After all, VCs work in aggregate: throw enough sleep-deprived ramen-eating younglings at the keyboard, and one of them will eventually give you a unicorn. The more you can chain to that way of life in the long term (because they can't fall back to traditional careers without that magic piece of paper), the better.

I say this as a dropout who learnt these lessons the hard way.

<comment><AUTHOR> Yeah, this was my problem. I do not think its a good idea not to have some sort of a backup. I want to take the leaps of faith that one needs to make to start a startup (or heck, even join one in its infancy), but having this shitty piece of paper that will act as a cushion is good. At least, I know that if I start a family, I won't be feeding them ramen as well.

I am... really worried about that part of one's life, being ~24/25.

</comment></comment><comment><USER3> 1) Once you're a couple years out of school, nobody (and I mean nobody) gives two fucks what your grades were, just that you got the degree

2) getting the first few years of experience without the degree is the hard part. A whole lot of job postings have an implicit if not an explicit "or equivalent experience" tacked on the the bachelor's requirement.

<comment><AUTHOR> Thank you,

I agree with #1 100%. I actually took a year off and found a startup in a field where I had an idea for a startup but decided not to do; statistically, it would've been a challenge.

In any case, while my friends were doing co-op (which is like an internship but you get paid and companies get tax benefits), I found and worked at a full-time job. They were busy commenting legacy code while I got to learn so much about everything. This company I worked at even trusted me to fly out and meet directly with clients who would show up with a team of 30 or so Engineers. I truly love this company and I am going back to them.

Regarding #2, I guess I must have struck a universal magic cord and lucked out! But my worry is that, 5-6 years down the line, if I won't be able to goto a company like Tesla/SpaceX for a) having shit grades, b) not getting experience in their field (my startup is more CS/CE) but my degree is in Systems Engineering.

Regards,

B

<comment><USER3> If your experience is in the field you want to go into, you should be able to work at those places without a degree in said field, but you may have to circumvent parts of the hiring process. Don't submit your resume to keyword- sifting online black holes. Network your way into an interview, even if you have to do it through recruiters (which should be your last resort).

If your experience is not in the field you want to be in, regardless of whether your degree is, get that experience first. That may mean a few more years paying dues at entry level again. Once you've established yourself as competent in that field, go after the big players.

Also, many places will accept a closely related degree as a substitute for a specific degree. For instance, a bachelors in electrical engineering will get your foot in the door for many programming jobs.</comment></comment></comment>


SCO boss: I was offered $2 million by Utah's top prosecutor - <AUTHOR> http://arstechnica.com/tech-policy/2013/05/sco-boss-i-was-offered-2-million-by-utahs-top-prosecutor/ <comment><USER2> "McBride says he needs $2 million". Still a loser.

Be sure to review some of his public statements about Linux to get a flavor for what kind of person Daryl is.

[https://duckduckgo.com/?t=lm&q=site%3Agroklaw.net+sco](https://duckduckgo.com/?t=lm&q=site%3Agroklaw.net+sco)

@HN readers -- I am sorry if my comment depresses you, but as long as stories like this are posted comments like mine will be generated.</comment>


Why Everyone Missed the Most Mind-Blowing Feature of Cryptocurrency - <AUTHOR> https://hackernoon.com/why-everyone-missed-the-most-mind-blowing-feature-of-cryptocurrency-860c3f25f1fb <comment><USER2> I'm so sick of this sort of content about BTC, and cryptocurrencies in general. States the well known features of a blockchain in 10 different ways and feels that's the point made.

</comment><comment><USER3> Irritating click-bait National Enquirer-style title (and content, to some extent) should instead have been something like: Decentralized distribution of Crypto-currencies is still a problem.</comment>


Loop – Interest based social network - <AUTHOR> http://www.loopus.com <comment><AUTHOR> Loop is a social media platform that cultivates communities of like-minded individuals and provides users with engaging content through the use of behavior-based badges. Checkin-in at your favorite locations and earn badges while and pursuing your interest and hobbies. Unlock, level-up, and evolve Badges to show-off your real life interests and achievements.Make meaningful relationships with people around you.

</comment><comment><USER2> Is the differentiating factor between Loop and Swarm the ability to meet people outside of your current network who share the same interests and hobbies? Fwiw, I got a 404 error when I clicked Introduction at the top. But this looks interesting.

<comment><AUTHOR> Yes, but it's not the only differentiating factor. I think the main difference is that Loop is an interest-based social networking media platform. Swarm is the "check-in" app. Since most interest and hobbies require you to go to a location and thus check-in makes sense. However, we(loop) have a couple of tricks up our sleeves to capture a person's interest and hobbies beyond just checking in. ;).We also have a focus on building communities around interest and hobbies.. btw, we still working on our website. Thanks for the feedback

</comment></comment><comment><USER3> Have you heard of the horrible disease called lupus? Consider changing your URL.

<comment><AUTHOR> hahaha... Yes. we realized that. We are working on that. What you think of the app though?</comment></comment>