How We Discovered the Underground Chinese App Market - <AUTHOR> https://medium.com/startup-lessons/374a4f06c903

<comment><USER2> >Then we came across KuaiYong (aka 7659.com), an app market that allows users to install iOS apps without even jailbreaking their phone.

How is that possible? Do the chinese markets use different iphone exploits than western ones when it comes to iphones?

On 7659.com, after google translate it says:

>Prompted to enter your Apple ID case solutions Installed applications prompt "Enter the Apple ID bomb box" or "flash back", you can use the top right corner of the "flash back (bullet box) Repair" resolved. If the repair is not successful, please update to the latest version of this application. Since this month Apple service adjustments, it is recommended not to use the recent Apple ID or appstore, to reduce repair frequency. On the phone or iPad directly fix "bomb box", "flash back" of the upcoming release of new features, so stay tuned.

Found some info about it:

[http://9to5mac.com/2013/04/19/chinese-pirates-create-web- bas...](http://9to5mac.com/2013/04/19/chinese-pirates-create-web-based-pirate- app-store/#more-268855)

> KuaiYong used a bulk enterprise licence to get around the safeguards > designed to protect apps from being pirated. The new website, 7659.com, is > essentially just a front end to the app: downloading any iOS software from > the site will download and install the KuaiYong app if it isn't already > installed.

</comment><comment><USER3> Look, I realize it's fun to make enemies and drop big names, but this app was not "listed in Cydia" any more than an app might be "listed in Firefox": the closest something can get to being "listed in Cydia" is to come in a default repository, and those are all (as is Cydia itself) anti-piracy.

<comment><USER3> (The author of this article saw my comment on reddit and modified his article.)

</comment></comment><comment><USER4> There are a lot of successful software companies in China. Think about Alibaba IPO. Tencent also has a lot of successful Apps. I just don't like the way you show your opinion. It sounds like "we made money in USA; we made nothing in China. China is wrong! Chinese market is weird, their civilization is bad." Maybe it's you don't understand China and Chinese enough, haven't done enough research, haven't talked or made friends with any Chinese-your future customers.

Maybe I misunderstood your point, but when I read articles like this in which China sounds like a big ridicule, (actually it is a market you haven't win and don't know how to win),I feel angry and sad. You are criticizing your customers, how can you win? (I am a Chinese living in the US working at software industry.)

Go to China. Make friends. Sit with them and observe how they use their iPhones.

</comment><comment><USER5> Another great example of how to hone your app's strategy by adapting to the cultural expectation (even when the obstacles are illegal and unfortunate). Thanks for sharing!

<comment><AUTHOR> Thanks Jenn! Really glad you enjoyed it.

</comment></comment><comment><USER6> Love the connection between Robert Fortune and the tea heist as a lasting wound and a reason for China's underground app market. Such an interesting/frustrating read!

<comment><AUTHOR> It was amazing the similarities once I started researching the background of Intellectual Property rights in China

</comment></comment><comment><USER4> [http://buswk.co/1izo5t9](http://buswk.co/1izo5t9)

</comment><comment><USER7> would love to see a follow up with details about revenue from ads and if it was able to offset any of your lost revenue from sales.</comment>


Tinder Plus premium paid-for service starts TODAY - <AUTHOR> http://www.standard.co.uk/news/techandgadgets/tinder-plus-pay-service-starts-today-10079983.html <comment><AUTHOR> "Users under the age of 28 who want the extra functions will be charged £3.99 a month, and those over 28 will pay £14.99."</comment>


The Facebook birthday reciprocity experiment - <AUTHOR> http://blog.favo.rs/2011/12/the-birthday-reciprocity-experiment/ Here's neat little side project to figure out birthday reciprocity (who has given and received birthday wishes) from Facebook.  I found it pretty interesting as it really surfaced those who I was closest with on Facebook.  You can see my results here or try it out yourself here http://favo.rs/birthday/o/AsdjkBashcBbf0wj. <comment><USER2> Neat tool. Looks like I need better friends :(</comment>


Police fine pedestrian for disorderly behaviour after he tried to cover his face - <AUTHOR> https://www.dailymail.co.uk/news/article-7036141/Police-fine-pedestrian-90-facial-recognition-camera-row.html <comment><USER2> > The force had put out a statement saying "anyone who declines to be scanned > will not necessarily be viewed as suspicious".

That's why it's called "erosion of rights" and not "outright nullification of rights". Unfortunately, it works, and it's entirely unsurprising that face surveillance will become normalized.

<comment><USER3> There's a reason they're doing it in London first. In a wealthy city like London you can get away with going full "law and order" because the ratio of rich to poor is better (i.e more rich people) and the rich generally view this as no threat to them. Then once it's normalized they roll it out to Liverpool, Belfast and everywhere else that the poors are less under the thumb of the government.

You see this in the US. Boston, DC, New York, etc are littered with surveillance cameras and ALPRs. Once it's normalized they'll roll it out to places like New Bedford, Norlfolk and Buffalo and all the other places where the government (as an organization, not as individuals) feels its respected less.

<comment><USER4> If there is one place where the authorities might take a bit of care around implementing new surveillance technologies you would hope it would be Belfast.

<comment><USER3> That's basically what I was thinking. I figure as soon as the system is sufficiently "mature" they'll use it there.

I hope they totally screw it up and touch off the kind of "civil unrest" that you need in order to remind the government that people have rights.

</comment></comment></comment></comment><comment><USER5> This makes me very sad for many reasons:

* People are losing their freedom of privacy in the name of safety and most accept it. Many are likely unaware at this stage of the trade-off.

* One activist was in presence by happen chance, otherwise this likely would have gone unreported.

* The database _currently_ only keeps peoples data for 30 days. When the UK leaves the EU, this will likely be extended. China has already experienced multiple data breaches.

* It's unclear what data is kept and deleted, I suspect that metadata may be retained indefinitely.

* The money being spent on these systems could be spent getting more officers on the ground. I have no doubt they are sinking millions of pounds into this project.

* The police initially started testing this system illegally, there were no repercussions.

* The majority of people being arrested as a result of this technology are probably not the worst people in society. I believe this will be used to disproportionately target poorer people and petty crimes.

* Telling an officer to "fuck off" or "piss off" is not a crime. It's not an offense to be rude and you certainly shouldn't have to "Wind your neck in" in fear of a public servant.

<comment><USER6> > Telling an officer to "fuck off" or "piss off" is not a crime. It's not an > offense to be rude and you certainly shouldn't have to "Wind your neck in" > in fear of a public servant.

Yes it is: From the Public Order Act 1986 ([http://www.legislation.gov.uk/ukpga/1986/64](http://www.legislation.gov.uk/ukpga/1986/64))

A person is guilty of an offence if, with intent to cause a person harassment, alarm or distress, he—

(a)uses threatening, abusive or insulting words or behaviour, or disorderly behaviour, or

(b)displays any writing, sign or other visible representation which is threatening, abusive or insulting,

thereby causing that or another person harassment, alarm or distress.

<comment><USER7> There are exceptions for police officers though, who are expected to tolerate some swearing. Relevant cases are listed on Wikipedia.

[https://en.wikipedia.org/wiki/Section_5_Public_Order_Act_198...](https://en.wikipedia.org/wiki/Section_5_Public_Order_Act_1986#Police_officers)

<comment><USER8> Well it is just like I learn for driving test that one should remain calm if other driver jumps red light, cut him off or honks unnecessarily. It does not mean aggressor is right, just that one should try de-escalate the situation.

</comment></comment></comment></comment><comment><USER9> From the Independent coverage:

> The force had put out a statement saying "anyone who declines to be scanned > will not necessarily be viewed as suspicious". However, witnesses said > several people were stopped after covering their faces or pulling up hoods.

> "The guy told them to p __* off and then they gave him the £90 public order > fine for swearing," Ms Carlo added. "He was really angry."

I live close to Romford, and I'm quite tempted to wander past with my face obscured and then politely decline if asked to be photographed.

Of course, I'm white, middle class and middle aged, so I probably wont be stopped.

<comment><USER10> _"The guy told them to p_ off and then they gave him the £90 public order fine for swearing,"*

This is a common use of laws in the United Kingdom. They put lots of laws on the books around trivial things that they almost never enforce on their own, but then which officers arbitrarily use in "convenient" situations like this. The average person swearing in the street will not be accosted, someone arguing with a cop who wants to make a point will.

<comment><USER11> This is called selective enforcement and is part of the erosion of the rule of law in the UK. When you have mountains of laws such that most people are always violating them, you can target anyone you don't like. This leads to abuse of power and is formative in the transformation of police from those that uphold the law to thugs. The thugs decide when to punish on whim.

</comment></comment></comment><comment><USER12> We haven't really even come to terms with the false positive rate associated with just looking at people. When law enforcement wants to check ID all they have to do is say they thought you looked like someone. The high rate of false positives is a feature not a bug. You could set up an empty box with a lens drawn on it with a motion detector aimed to go off 4% of the time and the result would be almost as useful to law enforcement as a facial detection system that actual did something. The facial detection just increases the efficiency of the "papers please" checkpoint.

</comment><comment><USER13> Slight correction: It seems he wasn't exactly fined for hiding his face. Police asked him to uncover his face and he told them to "piss off", for which he was fined.

<comment><USER5> You'll find in the UK that it's quite common practice to use the vagueness in the law to pin a different charge on somebody. Being rude to a police officer isn't a chargeable offense, yet it'll be treated as such. The police have no requirement or training available to actually understand the nuances of the law, nor are they updated when the law changes. The British police is mostly under-trained and under-funded, especially as you break out of the London bubble.

One of the major issues with UK law is it's vagueness and openness to interpretation, which is all of course by design. You don't tend to notice erosion until the ground beneath you collapses.

<comment><USER14> In the US you would just get charged with resisting arrest. This is what happens when they ask for your ID and you refuse to give it to them. You wont be convicted but the fact that you can be arrested for resisting arrest without committing any crime is a problem

</comment></comment></comment><comment><USER15> In a science fiction world, those of us who cared about privacy would start wearing make-up (until it was banned):

[https://www.theatlantic.com/technology/archive/2014/07/makeu...](https://www.theatlantic.com/technology/archive/2014/07/makeup/374929/)

We don't do this en masse now because "The very thing that makes you invisible to computers makes you glaringly obvious to other humans"

<comment><USER16> I wonder, what about methods that do not obstruct human vision but do obstruct the camera? Like a faceshield, transparent mask or bag that you can wear (like a transparent raincoat hood) but one that has scattering features for near IR light that will hide your face to cameras.

Or laser dazzlers that look for lenses. Both will probably be quickly banned as criminal tools (like 'hacking tools' are in some nations).

You could also project time-dependent illumination patterns on your own face, throwing off algorithms.

<comment><USER15> I think we need temporary tattoos: they should dissolve over a few days, so you can new ones and avoid re-detection, but not be able to be "taken off" by police wishing to scan you. Something that is worn would be considered as disobedience, like the shirt the man in the article pulled over this face.

We just need one of the Kardashians to make it fashionable and then it's all over for face detection.

</comment></comment></comment><comment><USER17> How do they enforce this on people wearing hijabs or other religios clothing that covers the face?

<comment><USER18> Hijabs do not cover the face. A niqab or burqa would, but the former are very rare in the West, and the latter virtually nonexist.

<comment><USER19> Maybe in the countryside. Go to any West EU capital and you'll see planty of niqabs and burqas.

<comment><USER18> > you'll see plenty of ... burqas

No, you won't. The burqa is extremely rare in Western Europe. This is pointed out whenever political parties propose a burqa ban: a country would be banning something that isn't even a significant thing there. IIRC, the total number of burqa wearers in all of France, for example, does not exceed 300.

As for niqabs, you do see one from time to time, but they certainly aren't common against the total Muslim population, and when you do, it may be that the wearers are visitors from e.g. the Gulf states and not locals.

<comment><USER19> I see a burqa weekly and 10+ niqabs every day, and the area that I live is not what you would call a "muslim zone". It's certainly not a tourist zone, so unlikely to be non-locals.

<comment><USER18> At this point I can only assume that you are not operating with any standard scholarly definition of the word "burqa". There are different terms for the various modesty garments from the Muslim world for a reason.

<comment><USER20> He just used the terms correctly. Is your response to losing an argument to gaslight their vocabulary? That is not very sporting, even for hn.

<comment><USER18> How do you know he is using the term correctly? Seeing burqas regularly in Western Europe would be so extraordinary a thing, that assuming that he is using the term incorrectly is kinder than the other conclusion that could be drawn about his claim. From the downvoting of his posts, others too notice something is off.

<comment><USER19> I know very well what a burqa is. It's a weekly sight. I wouldn't call that extraordinary. I see it way more often than a kippah

[https://www.novinite.com/media/inpictures/201003/photo_veryb...](https://www.novinite.com/media/inpictures/201003/photo_verybig_2908.jpg)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> Very interested to understand what sort of metadata is being stored from these cameras. It wouldn't surprise me in the slightest if the cameras are being used to build a database of individual's movements, whether deliberate or as a side effect of logging.

Any more information on this from a better source than the DM?

<comment><USER21> Did a little more digging around this and discovered [https://www.met.police.uk/live-facial-recognition- trial/](https://www.met.police.uk/live-facial-recognition-trial/) through Reddit.

"Live Facial Recognition uses NEC's NeoFace technology to analyse images of the faces of people on the watch list. It measures the structure of each face, including distance between eyes, nose, mouth and jaw to create facial data.

The system detects a face, creates a digital version of it and searches it against the watch list; where it makes a match it sends an alert to an officer on the scene.

The officer compares the camera image and the watch list image and decides whether to stop and speak to the person. We always explain why we've stopped someone; we also give them a leaflet that explains how they can contact us to ask any questions afterwards.

The system will only keep faces matching the watch list, these are kept for 30 days, all others are deleted immediately. We delete all other data on the watch list and the footage we record."

</comment></comment><comment><USER22> This was on BBC Click, which is on YouTube (for me, I'm in UK though). A good programme overall.

[https://m.youtube.com/watch?v=KqFyBpcbH9A](https://m.youtube.com/watch?v=KqFyBpcbH9A)

They give stats and details.

It may not be the same incident as the OP, but it sounds broadly similar and the programme fleshes out the general situation well.

Edit: Actually it is the same guy. The issue and provision of the fine, etc., it's on the show.

</comment><comment><USER23> Is there another source for this? I don't even want to visit the Mail's website, let alone read whatever misrepresentation of what actually transpired that they have put down in their article.

<comment><USER24> As someone also not interested in giving the Daily Fail/Heil any traffic what- so-ever, I found this : [https://www.independent.co.uk/news/uk/crime/facial- recogniti...](https://www.independent.co.uk/news/uk/crime/facial-recognition- cameras-technology-london-trial-met-police-face-cover-man-fined-a8756936.html)

<comment><USER23> Cheers.

</comment></comment></comment><comment><USER25> >> After being pulled aside, the man told police: 'If I want to cover me face, I'll cover me face. Don't push me over when I'm walking down the street.'

Jesus, it's a good thing cops in London don't have guns. Can't imagine how this would have ended in one of the whitebread suburbs here in the US with our 'roided-out school-yard-bullies-turned-pro.

</comment><comment><USER26> Well said that we are the last free generation.

It so weird how much of our freedom and privacy we are giving away. People used to fight for these stuff.

And then you would think how far this can go in near future if this is just the beginning.

After all, all these fear and mixed feelings about security and conflicts are caused by a long chain of reactions and consequences of bad decisions governments are making themselves around the world. And it is sad that normal people end up losing their privacy more than responsible ones do.

It requires a fundamental strategy change that is not going to happen in reality. I wonder what kind of destructive side effects it will have for the future generations specially to the culture.

</comment><comment><USER27> For those who prefer not to go to the Daily Mail directly:

"Camera cross-checked photos of faces of passers-by against wanted database. One man covered face before officers stopped him and took his picture anyway. He was fined £90 at scene in Romford by police who arrested three other people Police say they know of human rights concerns but want to make London safer"

<comment><USER28> Technically he was fined for swearing at the police, not for covering his face. If he had said nothing he would not have been fined but might have been searched as the police have the power to stop and search anyone who they have reasonable cause to suspect is acting suspiciously.

<comment><USER29> But they didn't have reasonable cause.

<comment><USER30> Actually in England they don't need reasonable grounds.

[https://www.gov.uk/police-powers-to-stop-and-search-your- rig...](https://www.gov.uk/police-powers-to-stop-and-search-your-rights)

> You can only be stopped and searched without reasonable grounds if it has > been approved by a senior police officer.

This can happen if it is suspected that:

        serious violence could take place
        you're carrying a weapon or have used one
        you're in a specific location or area

<comment><USER31> > _you're in a specific location or area_

Are the specific locations this applies to defined in law, or can a senior police officer just say "this neighborhood has a lot of criminals; search everyone"?

<comment><USER30> Bit of a mix, seems possible to make justification for an entire city. [1]

[1] - [https://twitter.com/brumpolice/status/1100765101156634624](https://twitter.com/brumpolice/status/1100765101156634624)

<comment><USER31> That's... even worse than I feared, and most of the responses to the tweet are supportive.

</comment></comment></comment></comment></comment></comment></comment><comment><USER32> Another report [https://metro.co.uk/2019/05/16/moment-man-fined-90-hiding- fa...](https://metro.co.uk/2019/05/16/moment-man-fined-90-hiding-face-police- facial-recognition-cameras-9571463/) It's a little bit like saying "If she doesn't want to be tossed into the water she must be a witch!"

</comment><comment><USER33> I regularly see people going around with their faces covered in Portland. For example, guy in dark clothes on a bmx bike riding down east bank esplanade.

I assume that these folks have warrants. But I am not aware of any deployed facial recognition in Portland.

<comment><USER34> If they are doing it for that reason, that seems like a bad choice. That would stand out even more obviously than had they worn a T-shirt that said "The police are looking for me".

<comment><USER33> I thought the same but you still see it all the time.

</comment></comment></comment><comment><USER35> 1984 was not intended to be a how-to manual.

</comment><comment><USER36> I wonder if you could copyright your face and then use the law against the law. DMCA takedowns etc etc.

<comment><USER22> It's not an artistic work, and there are broad rights to images in public that preclude you from making a work on your face to prevent imaging of it.

It's a nice idea but it would allow lots of law breaking of things worked that way. Eg paint something on your car, now police can't capture you on speed camera!!11one.

<comment><USER36> Yes sadly that is the crux. Whilst the people do have concerns, those concerns are shared for nefarious reasons by your criminally inclined.

Way things are going, how long until we have camera technology as CCTV that is comparable to Holywood camera's - certainly the standard today is up there with 80's offering.

Might even come a time when you can do a film in places like London without needing any cameras as you can just ab-use the data protection act to get copies of any footage your in and get all the camera angles and video you need to edit into a film. Kinda doable now, though not all cameras are 4k and well light area's. But certainly doable.

One interesting legal aspect about CCTV in the UK - the only camera's that are allowed to record audio are the ones located outside police stations. Which is reassuring as with mic-arrays - intrusion into privacy and indeed voice recognition would be far greater than any CCTV/facial recognition. But that is one to watch and keep an eye upon as I'm sure that will change/erode over time.

</comment></comment></comment><comment><USER37> How good is this software if you just close one eye and make a grimace while walking by?

</comment><comment><USER38> Show your face, slave!

</comment><comment><USER39> ... and now his face is all over hackernews. Great.

</comment><comment><USER40> Police state intensifies

</comment><comment><USER41> I personally don't see any issue with this.

If you want absolute privacy, than stay at home.

If you want absolute freedom, than go live somewhere where nobody else lives.

Society runs on compromises: your freedon to swing your fist ends where my nose begins (and viceversa); your privacy ends where my safety is concerned (and viceversa).

<comment><USER42> What's your full name, phone number, and street address?

If you want privacy, then don't post online.

<comment><USER43> He doesn't even have an Online Commenting License. A hefty fine under the Against Hate Speech Act of 2022.</comment></comment></comment>


EU wants to criminalize "Hacking Tools" - <AUTHOR> http://www.wired.com/threatlevel/2012/04/hacking-tools/ <comment><USER2> Sam gets arrested because he's carrying burglary tools at 03:00 in the morning and gets charged with burglary.

Defending himself he appears before the judge and asks the judge if they're going to accuse him of rape as well.

The judge, somewhat surprised at the turn of events bellows: "Don't tell me that you raped a woman as well?"

Sam responds: "No, obviously not. But I was carrying my tools.".

\--

Even if you had the worst of the worst hacking tools sitting around on your system, it should be the actual use of those tools against someone else's machine for which you have no permission to access that creates the offence.

Those that break in to systems are not going to be deterred by this at all and those that make a living doing penetration tests and such will be unable to do their job giving the bad guys a nice advantage.

Silly lawmakers making silly laws with the best of intentions are the worst thing that can happen. I really wished they would limit their lawmaking to areas where they have some expertise.

<comment><USER3> _> Even if you had the worst of the worst hacking tools sitting around on your system, it should be the actual use of those tools against someone else's machine for which you have no permission to access that creates the offence._

It's not quite that simple. Consider firearms. You might argue it should be the _use_ of a firearm — to threaten, maim, or kill another person — that ought to be legislated against, not mere possession. Plenty of people disagree, as exemplified by the numerous democratic countries around the world where possession of a firearm is illegal in one form or another.

The obvious retort — the "guns don't kill people, people kill people" argument, if you will — is that possession of a tool alone should not be illegal because mere possession is not inherently harmful. That's the point you seem to be making here.

Indeed, both hacking tools and firearms can, in addition to their more obvious harmful uses, also be used to alleviate and even _prevent_ harm — authorised penetration testing being the obvious example in the former case.

Nevertheless, plenty of people are willing to forego those benefits in the case of firearms; why not the same for hacking tools?

<comment><USER4> guns are not a good example. there is no way i can use a gun for constructive purpose.

think of a knife. 99.99% use the knife for good reasons. However, some use it to harm others. Does it make sense to outlaw knives?

I use wireshark often to see what goes into the request. A lot of developers use it. I think it is mostly used for good intentions.

<comment><USER5> > guns are not a good example. there is no way i can use a gun for > constructive purpose.

That tells us more about you than it says about guns. It says is that you're either ignorant or a thug.

We can easily distinguish the two. How many people have you assaulted? If 0, you don't know that folks who use guns criminally have a history of other criminality. If not...

> think of a knife. 99.99% use the knife for good reasons.

That's true of guns as well.

<comment><USER6> Not really. I use and own many knives, and would never use one on a person, even in self-defense. No one wins in a knife fight. I use knives for cutting food in the kitchen, but also for cutting fishing line, rope, slicing through grass and undergrowth to get to the soil, shaving down wood to fit where I need it to fit, etc. Knives are a tool.

I use a gun to kill. That's its only purpose. Hunting/killing and target practice for hunting are the only things a gun is useful for. I can't use a gun to help me with the crops, to fish, or while working in the garage.

Knives can be used to construct. Guns can only be used to destruct. Not saying guns have no legitimate purpose (I use one for hunting many times per year), but that legitimate purpose begins and ends with killing or practicing to kill. It's a long leap from taking the life of a deer to taking the life of a human, but you use the exact same tool in the exact same way, the only way it can be used.

<comment><USER7> So are we ruling out target practice for the sake of target practice? I go shooting around once a month for the sole purpose of making a steel plate ring. I have no intention of hunting animals or killing a human being with the firearms that I use; The sole purpose is recreational target shooting. Of course, in a wild scenario such as home invasion that would be a different story, however the same can be said of any object used for defense purposes, be it a knife, pipe, flower pot, etc.

And lets be honest here, you would most definitely use a knife in self defense if it came down to that. It's a preposterous argument to say that in a life or death scenario, you'd opt for a lesser source of protection in order to not use a sharp object.

<comment><USER8> > And lets be honest here, you would most definitely use a knife in self > defense if it came down to that. It's a preposterous argument to say that in > a life or death scenario, you'd opt for a lesser source of protection in > order to not use a sharp object.

Really?! Well, I guess it's different if, thanks to your gun laws there's a good chance the intruder might be carrying a firearm. No scratch that, if they got a gun, then you're still screwed with a knife.

First, do you know where to hit them to disable them at once? If not, you're now standing really close to a really angry, bleeding intruder.

Second, even if you do, they now bled on the walls, the furniture, everywhere. Have fun cleaning that up.

Third, you just killed a person. You can't really "disable" someone with a knife, either you kill them or you don't.

My advice? A big stick. Like the wooden handle of a broomstick or something. Keeps people with knives at a distance, you can hit them, poke them, and pin them to the ground while you call the police. (stick locks below the chin, behind the jawbone, base of the neck, pushing backwards. very uncomfortable)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> In Germany there already is a law called "Hacker(tools)paragraf" (§ 202c StGB).

It roughly states, that if you provide, create, sell, or distribute tools, which can / will be used to commit / prepare a computer related crime, shall be punished with one year in prison or a fine.

The problem with this is the vague wording: If dual-use tools like nmap are affected is open to discussion.

Maybe someone else finds a better translation; you can find the original text here:

<http://de.wikipedia.org/wiki/Hackerparagraf>

<comment><USER10> I would hate to be someone teaching networking in Germany right now. This "paragraph" is throwing out the baby with the bath water.

<comment><USER11> After criticism they made clear that the good-intended use of those tools is legal.

</comment></comment></comment><comment><USER12> Almost all politicians in power today (1) didn't grow up with a pervasive Internet, and (2) truly don't understand information technology. For example, the median age of US Senators is currently 62 years [1], and not a single one of them is an engineer (let alone a software developer) [2].

Consider how the term "dangerous hacking tool" sounds to a 62 year-old person who doesn't have even a basic understanding of how software works. No wonder they want to outlaw these "weapons"!

Alas, it's probably too late and too difficult to teach these old dogs new tricks. Realistically, we should expect more idiotic political decisions to be made... until a new generation of politicians (with a better understanding of software and the Internet) gradually takes over.

I wish I could be more optimistic about this.

[1] [http://en.wikipedia.org/wiki/List_of_current_United_States_S...](http://en.wikipedia.org/wiki/List_of_current_United_States_Senators_by_age)

[2] <http://www.senate.gov/reference/resources/pdf/R41647.pdf>

<comment><USER13> It's not obvious that the next generation of politicians will be much better. Using computers, including iOS and Android devices, is not enough. Technically minded individuals who understand how those devices work below the surface are still unlikely to go into politics.

</comment></comment><comment><USER14> This article is a little bit sensationalist. Here is analysis of the actual text of the law:

[http://blog.c22.cc/2012/03/29/eu-legislation-digging- below-t...](http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-the- fud-line/)

[http://blog.c22.cc/2012/03/29/eu-legislation-digging- below-t...](http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-the- fud-line-cont/)

</comment><comment><USER15> Brilliant. I commend the EU on its harsher stance on cyber security, cracking down on criminal computer usage and protecting the systems crucial to how we live our lives.</sarcasm>

So now we can't use penetration testing tools? I'm sure computer systems will be much more secure without the threat of security testing software, especially since the only threats we know of are from the EU.

Oh wait.

</comment><comment><USER16> Wouldn't this in effect make credit card handling software etc impossible to create within the EU?

I'm fairly sure part of "due diligence" would be to perform some form of security audit / penetration test which this would render illegal.

<comment><USER17> I suspect it's much worse than that. Consider a tool like Wireshark, which is widely used by people developing and testing all kinds of networking software, which in turn handle small tasks like running every home and office network on the planet, not to mention the Internet. Of course, any protocol analyser that you can hook up to your switch/router/etc. to make sure it's sending the right traffic in the right directions could also be stuck on a laptop near any unsecured WiFi network and used to sniff other network users' unencrypted traffic.

The correct solution to this problem, if secure communications is your primary concern, is for the people who understand the technical and security implications to make networking secure by default. Get rid of unsecured WiFi and replace it with something using full-time encryption.

It's also important to educate users of insecure networks so they understand the risks and know what to look out for and what they should do and not do to protect themselves. Use HTTPS where it's available, check you've got the little padlock icon before you type private information into a web site, that kind of thing. Obviously much of this is good practice if you're using the Internet, even if your immediate connection is over an encrypted wireless link.

Of course, there is always option 3: do nothing about the technical vulnerability, but legislate to ban Wireshark and numerous other "hacking tools" like it in the hope that bad people won't exploit that vulnerability. Unfortunately we'll probably have to close down the Internet shortly afterwards and revert to connecting a printer to everyone's PC at the office so they can exchange documents, because no-one will be able to make any networking kit that actually works any more. But that's a small price to pay, for at least we will have stopped Evil Hackers from monitoring our networks!

(Obviously there's a little hyperbole in that last part. But only a little...)

</comment></comment><comment><USER18> EU internet laws has no effect. Look at the cookie legislation that made it impossible to set cookies on peoples machines without explicit consent. What is dangerous is that one day they may be put into use. But for now they are just largely ignored.

<comment><USER19> Yeah, except recently our govt (Poland) got to this 'brilliant' idea <http://hackerne.ws/item?id=3794883>

//edit: original to translate in case the above doesn't work [http://www.tvn24.pl/-1,1740364,0,1,rzad-bierze-sie-za- ciaste...](http://www.tvn24.pl/-1,1740364,0,1,rzad-bierze-sie-za- ciasteczka,wiadomosc.html)

<comment><USER20> That link only gives me an empty page

<comment><USER21> Maybe that's now the only legal kind of web page in Poland?

</comment></comment></comment></comment><comment><USER22> This is a dupe. Original source: <http://news.ycombinator.com/item?id=3797026>

When the original got posted, I already called the MEP in question:

<http://news.ycombinator.com/item?id=3797114>

TL;DR: They already know this is silly and the final law text will not criminalize tools being used in a research/penetration testing context.

Nothing to see here, move along...

</comment><comment><USER23> Yeah, german legislation for erveryone!</sarcasm> "Hacking tools" were made illegal 5 years ago in germany, resulting in a huge outcry and face palms from those involved in security research (and gnu-tool users)

</comment><comment><USER24> Bold move but may undercut the knowledge base in EU in terms of Computer Security. Because in CompSec if you don't know how to break it, you don't know how to secure it. Hacker( the other meaning ) community is a part of the internet and a quote as old as internet is: The Net treats censorship as a defect and routes around it. \-- John Gilmore.

</comment><comment><AUTHOR> I wonder if they include most of the unix/linux command line tools like nmap, netcat, etc...

Laws about computers made by computer illiterates...

<comment><USER25> I believe I've heard that there are virus scanners that will immediately delete any copy of netcat they come across.

</comment></comment><comment><USER26> What is considered a hacking tool? Does it only affect highly automated, single purpose tools which can not be used in any legitimate way, or does it affect things like hexdump or nc?

Also, who makes the distinction? Is it eveluated on a case by case basis by the court or is there a list of "verboten" tools?

<comment> guard-of-terra Let me guess, it is evaluated on per case basis and then it gets into the list. Some stupid court in the middle of nowhere outlaws tcpdump and then every linux user is a criminat.

</comment></comment><comment><USER27> The temptation to pass laws like this (an unstoppable force) exists in fundamental opposition to the reality of tools as powerful, as versatile, as cheap, and as highly distributed personal computers (the immovable object).

This conflict is the essence of Cory Doctorow's thesis that all the superficially-unrelated tech related battles we've seen are simply proxy fights in the War on General-Purpose Computing.

I know that opinions about Cory vary considerably, but if there's one article that everyone should consider with an open mind, this is it: <http://boingboing.net/2012/01/10/lockdown.html>

</comment><comment><USER28> Well, a computer itself is an hacking tool, no?

<comment><USER29> In fact your brain is a hacking tool, so everyone born with a working brain could go to jail.

<comment><USER30> Which means politicians would once again be exempt from the laws they create.

</comment></comment></comment><comment><USER31> The argument that this would hurt legitimate hacking is a bad one. The example given was white hats hacking into e-voting machines. You aren't allowed to break into government buildings to make sure they are secure, it's illegal.

As far as preventative laws go, I don't think they are right but they are widely accepted by most people as right. I'll use one that most people agree with as an example. Drunk driving in and of itself doesn't hurt anyone, and some people can do it their entire lives without ever getting in an accident. But we make it illegal to try and prevent people from killing each other.

<comment><USER32> Yes you can't break into government buildings to show they are insecure, but you could buy the same kind of door as they have, and show how insecure it is.

I think this is how a lot of the e-voting machine hacks are done.

</comment></comment><comment><USER33> It's already illegal in the UK to enter and/or use a computer system without permission, you don't even have to crack it. Presumably this is true in most of the EU too.

So, the only reason I can see that anyone would want this law is so you can prosecute without having to show someone committed a real crime. Kinda like having a law saying you could prosecute people for hit-and-run if they own a car.

If the "hacking tools" are capable of causing near instantaneous death then I think there's an argument for it. Otherwise this seems to be over-stretching the law to infringe on hackers liberties.

</comment><comment><USER34> This type of legislation clearly stems from ignorance and a lack of understanding. It infuriates me that people can make judgements like this without actually understanding what they are making judgements on.

</comment><comment><USER35> In my newly awaken state I first thought this was from The Onion. That's where it should be, at least.

</comment><comment><USER36> Well, I don't know what to say - this is just stupid. I hope it doesn't go through, but if it does, I'll just store all the potential "hacking tools" on a server in the US, or China, or Japan, or Brazil, or Australia... or encrypted UHS SD cards (it took them a while, but they already know about encrypted hard drives, you see :-)... Seriously, how is this even going to be enforceable (especially with the push for cloud storage)?

</comment><comment><USER37> > While the law seems aimed at blackmarket tools that can be used to create > malware infested sites, it's also likely to criminalize tools used by > researchers, developers and black hats alike – including tools like fuzzers, > the Metasploit penetration testing tool and the wi-fi sniffing tool > Wireshark. (Perhaps even the command line would be outlawed.)

They take away your guns, so that you can not rebel against them.

</comment><comment><USER38> Isn't a computer a "hacking tool"?

<comment><USER39> This seems like the obvious ban. If you outlaw computers, honest people won't be able to use them, leaving no systems for the dishonest people to hack into.

</comment></comment><comment><USER40> So would Chrome and Mozilla have to disable "view source" and "developer mode"? Would Apple have to stop shipping Xcode? Would I have to register with an "authority" as a developer? Like a boxer registering his fists as "deadly weapons"?

The insanity continues...

</comment><comment><USER41> How far doe this go?

Can i have a laptop with vi or nmap installed? I imagine most DOS attacks come from people with a pretty generic install, vi and an internet connection.

</comment><comment><USER42> If you are in the UK, please consider writing to your MEP(s):

<http://www.writetothem.com>

</comment><comment><USER43> What about hacking tools that have been installed on your machine without your knowledge, i.e. malware that runs DDoS attacks?

</comment><comment><USER44> The Low Orbit Ion Cannon isn't a DDoS tool, it's a crowd sourced network stress testing utility!

</comment><comment><USER45> We need to reinvent the law making! The current system is simply outdated.

</comment><comment><USER46> "Perhaps even the command line would be outlawed."

Jesus, Wired. Sensationalize much?

</comment><comment><USER47> I live in the EU and this is simply ridiculous.

</comment><comment><USER48> Everything is a hacking tool. Every programming language and every pre- existing piece of software, every computer and every phone is a potential hacking tool. Thought itself is the biggest hacking tool.

How are these fucking morons going to define legally what is and isn't a "hacking tool"?

<comment><USER3> This is 'hacking' _a la_ the popular meaning of the term (gaining unauthorised entry to a computer system), not the definition adopted by self-described 'hackers'.

Think port scanners, password crackers, vulnerability identification and exploitation tools. Any reasonable person would consider these to be 'hacking tools', and that's all a legal system needs for a definition.

<comment><USER49> As an ex network admin, not having port scanners and vulnerability testing tools would make me feel blind. Those tools have very legitimate uses. Port scanners don't even have to be used for security purposes, sometimes you can't access a machine and want to see what services are active and open to the world etc.

<comment><USER50> There will probably be a vague exception for legitimate professional use, the way there is for burglary tools. Varies based on the jurisdiction, but whether carrying a lockpick set is illegal depends a lot on factors like whether you're a locksmith, the circumstances in which you were carrying it, etc. The crime essentially boils down to something like: carrying a lockpick set while seeming suspicious and not having a good excuse.</comment></comment></comment></comment>


How to Solve Hard Problem Sets Without Staying Up All Night - <AUTHOR> http://calnewport.com/blog/2007/10/08/monday-master-class-how-to-solve-hard-problem-sets-without-staying-up-all-night/

<comment><USER3> > your brain can only work productively on a hard problem for 1 -3 hours > before needing to reboot

This is very different from my experience. For advanced math or physics problems, it general takes at least a couple of hours to assemble the relevant mathematical structure in your head. Only once you are familiar with the "setting" can you really start to work.

I've heard similar things about writing code.

If I took a break every 2 hours, I'd never get anything done.

<comment><USER4> While that is true, sometimes stepping away from the problem will let it coalesce in my head and give clarity to what I wasn't making any headway on earlier. If you aren't getting anything done, working longer is probably not the path to victory. But if you are in the zone, you can sometimes work for hours straight and zip through.

<comment><USER3> Agreed.

</comment></comment></comment><comment><USER5> I solved most of my graduate algorithms problems while lying in bed in the morning, lying on the couch, or in the shower. I simply do not understand how some people can concentrate on problems like that while jogging. My thoughts while jogging are primarily about how much jogging sucks and how I just gotta keep going. If I could solve a technical problem in my head while exercising then either the problem is really easy or I'm not getting very much exercise.

<comment><USER6> _If I could solve a technical problem in my head while exercising then either the problem is really easy or I'm not getting very much exercise._

Remember that walking is technically exercise. 5 miles walking is 5 miles jogging is 5 miles running, at least as far as your heart is concerned. Calorie burn is roughly equal too.

I won't pretend to know anything about you (You might run laps around me!) but if you think jogging sucks there's a chance you're making some classic mistakes re: not investing in slow base miles, not developing 'cellular piping' so your body can efficiently wick away waste, etc...

This topic strikes a chord with me because I hated running a few years ago. A marine friend of mine knocked it into my head that I was going about it all wrong, and I finally came around (kicking and screaming) to his way of thinking. I read Galloway's book ([http://books.google.com/books?id=3kqUP3upHQ4C&printsec=f...](http://books.google.com/books?id=3kqUP3upHQ4C&printsec=frontcover&dq=galloway+on+running&hl=en&ei=wAW0TPXPMsKC8gb5lOnaCg&sa=X&oi=book_result&ct=book- thumbnail&resnum=2&ved=0CDcQ6wEwAQ#v=onepage&q&f=false)) changed my approach and started running for pleasure. Now I log 20 to 30 miles a week for recreation, and formerly 'breakneck' paces feel comfortable (I think the charge from that natural pace is a positively excellent time to let the endorphins supercharge your thinking). And for the record I'm not blazing fast... my 5k PR is 20 minutes and change. But again speed doesn't really count for beans; It's really about following the fundamentals and letting the miles take care of themselves. BONUS: The boost to my fitness helped me earn a qualifying time for my fire department's Rapid Intervention Team, which was really gratifying.

You don't need to kill yourself to see awesome benefits from running, and I truly believe (moderate) physical exertion can plausibly yield higher order thinking.

<comment><USER7> can you expand on "'cellular piping' so your body can efficiently wick away waste"?

<comment><USER6> Sure. The act of running creates waste, typically in the form of dead blood cells and lactic acid. It's natural, but if the muscle cells are ill-prepared to properly dispose of the waste it can create inefficiencies in the form of poorer performance.

It's important as a runner that you have a solid "highway system" of muscle fibers that can handle the waste throughput of your regimen. The most popular way competitve runners achieve this is by running lots of slow* comfortable base miles over several months. Increasing mileage 10% a week will break the cells down, while planned rest allows the body to regenerate 'heartier' cells capable of handling greater and greater loads. In the most relatable sense that burn you feel when you work out will start happening later and later; In physiological terms you've "increased your lactic threshold." The advantages of building an aerobic base transcend the muscle highway concept and seem to have really solid implications for cardiovascular health. Just something to think about.

*slow is relative and implies that you're running about 2 minutes off your tempo pace. A little huffing/puffing is okay, but it should feel natural to hold a conversation. Maintaining this slow pace - even when you feel you could run faster - is the hardest part of base building and therefore that piece which seems to pay the best dividends (for those who are disciplined).

</comment></comment></comment></comment><comment><USER8> You should also work while standing up.

There's a reason why academics prefer whiteboards and chalkboards to pen and paper. It's because they feel genuinely more productive and creative while working on them. I personally think that it comes down to improved blood flow, and it's one of the key tricks that my friends and I used to earn physics degrees from Caltech. We'd go camp out in empty lecture halls late at night, filling chalkboard after chalkboard with scrawl, and only sit down to copy finished problems in their final form.

<comment><USER9> I like standing up while reading and doing more free-form work like exploring ideas. But for concentrating on specific problems or focused study, I _need_ to be sitting down. I just can't concentrate my efforts as well when standing.

</comment></comment><comment><USER10> "When you're given a reading assignment, for example, you can estimate, within 10 – 20 minutes, how long it will take you to complete."

As long as it's not a scientific paper...

<comment><USER11> Or a bad engineering textbook, god I hate Wiley publishing.

</comment></comment><comment><USER12> Meat of the article: "Repeated fresh attacks are how hard problems are solved in the real world. ... Until you've approached a problem fresh, 3 – 4 times, you haven't really yet tried to solve it."

<comment><USER13> There is more meat. Such as that you can't focus for extended periods of time. It is important to schedule time to work, preferably in the morning. It is useful to have a study partner around your level, but generally not useful to have a large study group. Get started early.

Those are all important points.

<comment><USER14> And strangely, they actually all run counter to my experience. For hard problems, I generally work best alone in long blocks of time at night.

<comment><USER12> Good point. This recent HN item speaks to that. <http://www.stevestreeting.com/2010/09/04/work-2-0/> The interruptible programmer

</comment></comment></comment></comment><comment><USER15> > The ideal configuration for a problem set is a single partner who is at > roughly your ability and is willing to meet earlier in the week.

I agree with everything he said, but in my experience, the part I've quoted is at least an order of magnitude more important than the rest. And don't forget the "roughly at your ability" part - if you work with someone much smarter, you may just get more confused and you certainly won't feel like you're contributing much; if you work with someone much less smart, it's a waste of time (which is not to say that helping people isn't a nice thing to do - <USER2> just won't help you complete the problem set).

</comment><comment><USER16> This mostly matches up with my own experience. I always start several days early, and I always work with one or two other people if at all possible.

Starting several days early gives you a few days to think about a problem if you need it and ensures you don't have to pull any really late nights.

Working with people means that you won't get stuck on the easy problems if you didn't understand everything perfectly or forget one crucial fact/lemma exists (which I find is otherwise a real danger). It also gives you people to bounce ideas off of for the really hard problems,

The other thing I always do is to do my problem sets in two stages. In the first stage (which I do with other people), I figure out how to solve the problem and outline how I'm going to write it up. In the second stage (which I do alone and after solving everything), I write the problems up. As I do this, I walk through how we did the problems when we first solved them, and very often find mistakes we made.

</comment><comment><USER17> There's also the <http://www.c2.com/cgi/wiki?FeynmanAlgorithm> (it's a pretty good C2 post).

</comment><comment><USER18> >The ideal configuration for a problem set is a single partner who is at roughly your ability and is willing to meet earlier in the week.

There's really a lot of substance to this remark. I work with another guy in my class frequently and often come away feeling as though I've free-ridden somewhat.

But after looking more closely the results we get, it becomes apparent they are the product of our combined efforts and wouldn't have been achievable alone. The verbalisation is also highly conducive to understanding intuitively - a principle Salman Khan talks about and I can't agree with enough.

</comment><comment><USER19> I gotta ask, is this a really dedicated & not too bright student or a crazy hard curriculum? Most educational problems are not this hard.

<comment><USER20> Ha! I didn't get my degree in engineering, but most of my friends did and this describes many classes they took in their field. _Especially_ applied engineering physics.

I had two friends in AEP that were problem set partners, and they spent so much time working together her now-fiancé didn't ask her out for ages because he thought her problem set partner was her boyfriend.

And no, these kids were not dull buds. The girl is currently a grad student at MIT, and the not-boyfriend problem set partner is a grad student Harvard.

</comment></comment><comment><USER21> One tip I'd add: don't limit asking for prof/TA help to office hours. Knock and ask politely, and most (all, in my experience) will gladly answer questions on homeworks or lectures. Many seem to appreciate the chance to have a break from their work to talk with a student.

<comment><USER22> When I was tutoring, I was glad to have students who cared enough about the work to attack it in advance.

</comment></comment><comment><USER23> Sometimes I found solution in my dreams.</comment>


Short Seller Takes on St. Jude Medical with Claim of Remote Exploit Risk - <AUTHOR> https://www.bloomberg.com/news/articles/2016-08-25/carson-block-takes-on-st-jude-medical-with-claim-of-hack-risk <comment><USER3> This is bananas. Justine Bone, fairly well known in vuln research circles as, among other things, the former CEO of Dave Aitel's Immunity, teamed up with a well-known hedge fund to publicize research into medical device security with the intent of generating product recalls and thwarting M&A, so that they could profit from trading against those companies.

B- A- N- A- nanas.

<comment><USER4> Bananas maybe. But if there's truth in the allegations - and I'd bet there is- then the net result will be an improvement in the security of the available devices, surely a good thing.

And a stinging reminder to these guys to take security goddamn seriously - <USER2> seriously as if lives were at stake. Which they are.

Who cares if some rich guys further enrich themselves in the process.

</comment></comment><comment><USER5> Not sure how I feel about this, seems rent-seeking. I also don't think it is going to work. But analyzing speculative big bets in the stock market is not something I can demonstrate any competency in.

</comment><comment><USER6> I wonder if this will bump up security bug bounty payout averages...</comment>


Ricochet-IM: Anonymous, decentralized, metadata-resistant instant messaging - <AUTHOR> https://github.com/ricochet-im <comment><USER2> > Do not rely on Ricochet for your safety unless you have more trust in my > work than it deserves

This is an interesting line from the github readme. And I applaud for being humble. This is something which seemed lacking when I read about dapps (etherium) -- people rarely talked about having low trust on contracts written by somebody else.

<comment><AUTHOR> I personally prefer as you said the humble approach - in fact seeing any security software not display a big fat warning is for me a warning. Telegram has a RCE 0day, not to mention their snake-oil cryptography track record (Diffie-Hellman backdoor).

Ricochet was audited in 2016: [https://twitter.com/torproject/status/699668346921332737](https://twitter.com/torproject/status/699668346921332737)

And since then things have moved forward only very slowly, but I do not see this as a sign of the project being abandoned more like that there aren't enough people to maintain it.

FWIW the @torproject still endorses ricochet for now: [https://twitter.com/torproject/status/1073322441836036096](https://twitter.com/torproject/status/1073322441836036096)

<comment><USER3> > Telegram has a RCE 0day

Can you provide more context about this, or somewhere I can read about this please? Very curious.

<comment><AUTHOR> can't sorry, and there are no public discussions on this (for now)

<comment><USER4> Given that it was mentioned off-hand and you're unable (or unwilling) to give more information, why would I consider this anything other than FUD?

Please substantiate your claim or don't make it.

</comment></comment></comment></comment></comment><comment><USER5> I'm building something similar using Tor, but using v3 addresses. As v3 is now the default and recommended onion version, will this project move to them? The address are much larger and more unwieldy. However, I've found publishing ephemeral v3 services to be much faster (i.e. a couple of seconds vs a minute). Also since it's basically the ed25519 pub key, the address is enough to be able to verify signed content.

<comment><USER6> I believe cwtch[0] is essentially Ricochet, but with support for group chats and v3 addresses.

[0] [https://cwtch.im/](https://cwtch.im/)

<comment><USER7> So my security knowledge is a bit lacking. Is there anything that would make using cwtch less secure than using Riochet by itself?

<comment><USER6> Just potential vulnerabilities in the implementation AFAIK.

Cwtch hasn't been audited whereas Ricochet has.

</comment></comment></comment></comment><comment><USER8> Briar project is doing something similar. [https://briarproject.org/](https://briarproject.org/)

Actively developed

</comment><comment><USER9> The design doc is here. [https://github.com/ricochet- im/ricochet/blob/master/doc/desi...](https://github.com/ricochet- im/ricochet/blob/master/doc/design.md)

It describes one of its goals as, "Resist blacklisting or denial of service against users."

Preventing both blacklisting and DoS seems contradictory to me in an anonymous messaging protocol. If an anonymous party wants to spam me to make the product effectively unusable, I either need to be able to blacklist them, or to whitelist known contacts, in which case none of them are anonymous.

<comment><USER6> It means there's no third party (including Ricochet devs!) that can blacklist users.

You can easily delete contacts you don't want to receive messages from -- and in fact the UI is lacking in this regard: if you delete someone and subsequently change your mind, the only way to fix this is to edit the config file manually and remove them from the list of blocked contacts.

Source: am a very happy Ricochet user.

<comment><USER9> But the anonymous user can create N anonymous accounts and spam you N times with N accounts, right?

That's where spam forces us to choose between blacklisting people and whitelisting (which breaks anonymity).

<comment><AUTHOR> I'd never accept a request from a random user. My workflow would be like this: agree to discuss on signal or via pgp, which you use to get the ricochet-ID from the person that intends to connect with you. Once they tell you their id via this out of band channel, it's easy to reject any other requests that you don't expect. My ricochet-id is public knowledge now.

But say you're a journalist who wants to protect their source (on your end) e.g. a total stranger who is going to tell you some secrets then no need to even have a contact list. No need for a history. You just use the ricochet-id once. Maybe in a short-lived VM, Qubes or Tails whatever ... And tear down the whole system anyway once I'm done with the chat.

So in the first case you can simply avoid spam with boostrapping a safe rendezvous point, the second case would never see any spam.

<comment><USER9> If you'd never accept a request from a random user, then you're not doing anonymous messaging.

If you're a journalist who wants to receive a message from a total stranger, then you'd have to accept a contact request from a that stranger. Spammers can then deny the journalist access to anonymous requests by spamming them with anonymous requests.

The journalist could try to keep their contact ID a secret, but then anonymous sources would have no idea how to contact the journalist.

<comment><USER10> Terminology is the single biggest problem here: "Anonymous communication" in CS does NOT mean you do not reveal your identity to the person you are communicating with. It means you stay anonymous from the network perspective: No third party learns with whom you are communicating, and everything you reveal to your communication partner becomes an explicit attribute: Your "identity"/name/nickname, but also your location.

</comment></comment></comment></comment></comment></comment><comment><USER11> Project seems inactive, last commit on github in mid-2017. Is there any special reason this was posted?

<comment><USER12> I think it's in reaction to Show HN: Whapp-irc – A simple WhatsApp IRC gateway (github.com) [https://news.ycombinator.com/item?id=18897347](https://news.ycombinator.com/item?id=18897347)

I think there's a pattern that an open source alternative or lookalike project gets posted when a proprietary one (or linked to a non-opensource one) hits the front page.

<comment><AUTHOR> I shared it because I've been messing around with ricochet this weekend. I did look at the sources and couldn't find anything that I hated. Some problems exist in the latest debian package (in sid) related to the AppArmor configuration ... (see my issue I created in their github). So this is how I ended up posting it ... I wasn't aware of this other WhatsApp post. WhatsApp is snakeoil imo.

Though you're probably right about the tendency of people to share related things. Not just when a non FOSS project gets posted on HN but in general people remember similar things and then post it. See the comment here on briar, which is a promising project too. But it serves a different use-case - I want a non mobile solution I can run on FOSS system with FOSS hardware TL;DR: I no longer use phones in the traditional sense - only burner phones for 2FA without apps and not for making calls ... Ricochet delivers that because I can launch it via a Debian, Tails[1], QubesOS whatever ... :)

[1] requires a little fuckery but not too bad: [https://incoherency.co.uk/blog/stories/ricochet- tails.html](https://incoherency.co.uk/blog/stories/ricochet-tails.html)

</comment></comment></comment><comment><USER13> I hope open source IM focus more on client usability & UX. Many of the feature centric programs are simply too ugly to use.</comment>


A Modern Architecture for FP - <AUTHOR> http://degoes.net/articles/modern-fp/ <comment><USER2> The people in the horrible, horrible world of enterprisey OO programming call this Aspect-Oriented Programming. It's often accomplished with postcompilers or source transformations and whatnot, because the languages used aren't Haskell, but it boils down to roughly the same thing.

AOP never really caught on because the advantages (keep logging and error handling separate from the business logic) were too small for the extra mess it added. Notably: difficult debugging, plus really weird COMEFROM-style behavior[0] if some well-meaning colleague added a little too much magic to the "aspects" (e.g. the automatically mixed-in logging code). The function suddenly does stuff that you never programmed. Good luck hunting that one down!

I strongly suspect this style of programming has similar downsides. Anyone tried it in large projects?

[0] [https://en.wikipedia.org/wiki/COMEFROM](https://en.wikipedia.org/wiki/COMEFROM)

<comment><USER3> I have some monads from when I was less experienced that are screaming to be turned into that. I'm keeping them on my to-do list for now, but it would be a gain. (But I have a logger to write, and will probably adapt to something like it.)

The main downside is complexity. It gets hard to reason about it fast. As types depend on more things, and grow bigger, error messages are hard to read, parenthesis abound, and people really start switching off. Type synonyms help here, but are not a panacea. (A similar problem for your "hard of debug" complaint.)

The COMEFROM style is mainstream on FP, so people are used and expect this kind of thing. That means that your functions better support doing stuff you never told it to do, because it will, you know it, and you'll adapt accordingly. It's normally not a problem, notice the "normally" there.

</comment></comment><comment><USER4> Free monads are very much `initial'. Compare the final approach: [http://okmij.org/ftp/tagless-final/course/](http://okmij.org/ftp/tagless- final/course/)

<comment><USER5> Note that there's a bit of a pun here. "Finally" tagless isn't really any less initial than free monads are. The final encoding would give us something codata like, not just described via a typeclass. That said, both are still "initial" as in "initial algebra".

<comment><USER4> Interesting. Could you expand on that, please?

<comment><USER5> "Initial" usually means "the initial algebra over a functor". This means that for some functor f the algebra `i : f (Initial f) -> Initial f` is initial in the category of f algebras. This means that for any X and `g : f X -> X` there's a universal function `universal g : Initial f -> X` such that `g . fmap (universal g) = universal g . i` at type `f (Initial f) -> X`. Or, we have a function

        universal : (f x -> x) -> (Initial f -> x)

and we can actually define Initial in this way

        universal' : Initial f -> (f x -> x) -> x

        newtype Initial f = Initial { universal' :: forall x . (f x -> x) -> x }

In "strict Haskell" where we can act only finitely, we construct values of `Initial f` only by slapping finitely many layers of `f` on top of one another. For instance, when `f` is `data ConsF x = NilF | ConsF Int x` we can make a list [1, 2, 3] like

        Initial $ \join ->
          let nil   = join NilF
              a : x = join (ConsF a x)
          in 1 : 2 : 3 : nil

In other words, Initial things are described by their construction.

Clearly, this relates directly to initial objects constructed via, e.g., Free, since it does roughly the same thing. Free emphasizes the notion of layering things atop one another. In Lazy Haskell we can still use this layering to construct non-initial objects (more to come below) but if Free were transported to Strict Haskell it would clearly only construct initial things.

\---

So what about Finally Tagless?

        class List l where
          nil :: l
          cons :: Int -> l -> l

We're still going to be constructing values of `List l => l` by application of finite layers! If anything, we're more stuck to this process now.

        cons 1 (cons 2 (cons 3 nil))) :: List l => l

If we swap this out for explicit dictionary passing we can see that we're missing an argument like

        data ListD l = ListD { nil :: l, cons :: Int -> l -> l }

        \d -> cons d 1 (cons d 2 (cons d 3 nil)) :: ListD l -> l

and also that `ListD l` is equivalent to `ConsF l -> l`. It's really the same thing as the free method and is again operating initially.

\---

So what does it take to make something "final"? A final coalgebra of `f` would be an object `i : Final f -> f (Final f)` such that for any X and coalgebra `g : X -> f X` we have `universal g : X -> Final f` such that `i . universal g = fmap (universal g) . g` at type `X -> f (Final f)`. Or,

         universal : (x -> f x) -> x -> Final f

which again can be used to define `Final f`

        data Final f where
          Final :: (x, x -> f x) -> Final f

No longer can we define things by how they are constructed, now we must define them by how they are _viewed_. This opens up the doors to new kinds of structures, even in "Strict Haskell"

        natsFrom :: Int -> Final ConsF
        natsFrom n0 = Final (n0, \n -> ConsF n (natsFrom (n + 1)))

<comment><USER4> Thanks!

</comment></comment></comment></comment></comment><comment><USER6> I like the ideas of the article. An abstraction over IO and being able to distinguish between inherently serial operations and parallel ones on a different level are good ideas. I do not think this article exemplifies these benefits. Instead, it focuses much time on implementing a toy DSL. I want to see what Free can do but IO cannot (functionally or stylistically).

</comment><comment><USER7> What is really cool about this approach is that, unlike the counterpart design patterns you might find in an imperative OO language such as the Interpreter and Command patterns, within the strong-statically-typed functional languages we can rely on the guarantees the type system gives us for abstractions such as the Free Applicative to allow for optimizations that would be merely convention in a less type-enforcing type system.

<comment><USER4> Some `design patterns' are expressible even in very weak type systems.

For example, array of tuples vs tuple of arrays. In pseudo Haskell notation:

:: ([a], [b], [c])

:: [(a, b, c)]

The second option enforces that you have the same number of a's, b's and c's. The second option can be faster to access in, say, C.

(I wonder whether you can do a similar, but more complicated, analysis for internal vs external linked lists and other containers.)

</comment></comment><comment><USER8> _While ideal from a theoretical perspective, as a practical matter, can you imagine renaming a 10 GB file by first creating a copy of it, and then deleting the old version?!?_

 _That kind of inefficiency is not practical for most real world programs!_

 _To solve this problem, we can write an optimizing interpreter, which is a special kind of interpreter that can detect patterns and substitute them with semantically equivalent but faster alternatives._

But why?

</comment><comment><USER9> "There are problems here I haven't talked about, and most languages don't make this particular style of programming very easy or performant."

...hmm, that's a rather big caveat arriving at the end of the article

</comment><comment><USER10> HtDP changed the way I look at programming. But today I'm a diehard OOP fanatic. I want code that reflects the way I think, not code I have to work to understand.

I did not know but am not surprised to find that people write procedural Haskell. Procedural is how we all start out thinking about things. You do A, then B, to reach goal C. It takes time and experience and deliberate practice to improve upon that way of solving problems.

Functional moves the code in the direction of math. OOP moves in the direction of the domain. Math is harder to understand than domain logic, you will inevitably hack together an object system on top of your FP in order to implement domain logic.

Both styles have properties that are work better for certain domain concepts. What's nice about modern programming languages is that they build in primitives so you can use whichever style fits the concept you're fleshing out.

But trying to do everything functionally is ultimately counter-productive, in my opinion. It's the wrong format to declare high-level domain logic in, because high-level domain logic is that which is closest to human thought, not the underlying math.

Any FP 'architecture' will pretty much be object oriented. Math may treat state as ugly cruft, but humans need to group information close to where it's needed and in ways that make sense, that means state. Don't let the quest for mathematical beauty get in the way of solving your problem.

<comment><USER11> Most bugs I make are about state being out of sync - in fact every bug that is not because I misunderstood a problem is because state is out of sync.

In OOP programs, every object usually has it's own state, and it is updated all the time. If I can describe the world as one big hash-map, and my whole program can be while(true){writeToScreen(render(appState))}, then I'm very happy.

Haskell, which you seem to dislike, has a lot of syntax and some new concepts you need to pick up to get going. I recommend you to try out something that is extremely simple, like Clojure.

In Clojure there are not many things you need to learn before being dangerous. The data structures are lists '(), vectors [], hash-maps {} and sets #{}. There are functions (fn [] ) and macros, but you don't need them.

When coding functionally you can be sure you don't fuck something up by changing some state somewhere. And you don't need to mock data. And you don't need to do ORM. It's freaking great.

<comment><USER10> But I don't need Haskell or Clojure or anything like that to solve my problems. Ruby works just fine for me. I have lists, vectors, hash-maps and sets in Ruby. I can data pipeline simply and idiomatically. I don't work with math-heavy domains, so I don't need heavy math (type system) to write my programs.

When I have bugs in my code it's because I misunderstood the problem domain. State is missing somewhere, state that was unaccounted for and so is running loose in the code. The process of fixing the bug also illuminates what I was missing about the domain. Working on a program is the process of tightening the code around the domain.

> If I can describe the world as one big hash-map, and my whole program can be > while(true){writeToScreen(render(appState))}, then I'm very happy.

I want my code to be flexible, and I only want to represent concepts once. I want to be able to interact with it on the command line, on the web, as an API. To do this I need to manage all the different ways other systems can get at the domain logic because otherwise I'm reimplementing parts of the system inside other systems. My program needs to be self-contained.

The best way I've seen to write and manage this kind of flexible code is with dynamic typing and OOP. Dynamic typing isn't a necessity, but it is a big help. OOP just makes everything sane.

<comment><USER12> _" I don't work with math-heavy domains, so I don't need heavy math (type system) to write my programs."_

I don't think you know what you're missing.

Type systems can be used to enforce pretty arbitrary things. Representation of data can be handled fairly well automatically, so types describing representation are only marginally useful (mostly where we care about interchange or care a _lot_ about performance). However, if you make your types domain relevant, they can help you with domain relevant things. This can be simple - "I don't want to pass a bid price where I expected an ask price" \- or it can be surprisingly sophisticated; I was able to ensure that certain actions were only taken on the correct threads, checked at compile time, in _C_ \- this helped me _tremendously_ in refactoring when I discovered some piece of logic needed to live somewhere else. I really can't imagine doing that work without type checks, and it wasn't the slightest big "math heavy".

</comment></comment></comment></comment><comment><USER13> This is what i'm doing in javascript over in redux-effects: [https://www.github.com/redux-effects/redux- effects](https://www.github.com/redux-effects/redux-effects)

</comment><comment><USER14> I'm still new to FP, but I like how PureScript solved this problem by having an Effect Monad: [http://www.purescript.org/learn/eff/](http://www.purescript.org/learn/eff/)

</comment><comment><USER5> I program like this all the time in Haskell. Much of the latter bits can be replaced by so-called "mtl-style" typeclasses (used similarly to Oleg's Finally Tagless idea). I have a brief talk on this at last year's LambdaConf but didn't really give it sufficient space I suppose. I think the whole Prism/Inject machinery can be completely eliminated in this way.

</comment><comment><USER15> I am not sure you can get rid of IO monad. It's how the Haskell programs interact with the outside world, and I think IO is a primitive that you can't build from other things.

But in metaphorical (architectural) sense, yeah, you can probably get rid of it and use different monadic datatypes for different parts of the program that access different pieces in the world.

However, I am not clear how you then combine/serialize those different monads. It seems eventually you will get something like IO monad again. I am not sure but I think there needs to be some master monad going on in all Haskell programs that (potentially) serializes all the actions to the outside world.

<comment><USER16> Haskell had a different system for IO before the IO monad existed, so it's not _strictly_ necessary.

<comment><USER17> Yeah, but that system sucked. You essentially sent commands to an external interpreter to do I/O. Simon Peyton Jones calls it "embarassing" in _Coders At Work_.

</comment></comment></comment><comment><USER18> Is the audience of this article only people that think about Functional Programming (as a philosophy) often enough to refer to it as FP?

<comment><USER18> Downvoted, and yet - is it not wise to start with a headline that is clear enough to attract a broad audience? If the article really only wants to attract a smaller slice, that's fine, but I asked a valid question (in my opinion.)

</comment></comment><comment><USER19> A modern architecture for functional programmers

I don't understand. This was posted yesterday ([https://news.ycombinator.com/item?id=10806075](https://news.ycombinator.com/item?id=10806075)) and you didn't even change the shortcut nobody outside domain could possibly know.

<comment><USER20> From the FAQ:

 _Are reposts ok?

If a story has had significant attention in the last year or so, we kill reposts as duplicates. If not, a small number of reposts is ok._

<comment><USER19> I have no problem with reposts, I have problem with using shortcuts that nobody outside domain can possibly know, and then, using the same unexplained shortcut in repost.

Normal thing to do would be understand that not everybody knows what "FP" is (free pascal, floating point?) and use full term in "corrected" repost. Perhaps original post didn't get any attention because people don't care about floating points.

Shortcuts are usefull when you mentioned term 100 times and it's just annoying, but you don't mention FP in title 100 times did you? There should be ban on using shortcuts on HN titles until it is well known shortcut (CPU, RAM, MB, ...)

Title should have enough information that if you stop random stranger on the street, can he understand or guess what is it about? The first thing rubber duck ([https://en.wikipedia.org/wiki/Rubber_duck_debugging](https://en.wikipedia.org/wiki/Rubber_duck_debugging)) would ask is: "what is FP?" and that means title is wrong and deserves zero comments.

Edit: another thing - title is only write once, but read hundred of thousands of times, you are literally wasting manhours here.</comment></comment></comment>