Hundreds arrested as crime chat network cracked - <AUTHOR> https://www.bbc.com/news/uk-53263310 <comment><USER5> _Claims of said encrochat_ :

* Each message session with each contact is encrypted with a different set of keys. If any given key is ever compromised, it will never result in the compromise of previously transmitted messages – or even passive observation of future messages.

* Anyone can forge messages after a conversation is complete to make them look like they came from you. However, during a conversation the recipient is assured all messages received are authentic and unmodified. This assures non-reputability of messages.

* The algorithms employed are many times stronger than that of PGP (RSA+AES). We employ algorithms from different families of mathematics, which protects message content in the event that one encryption algorithm is ever solved.

* Messages do not employ digital signatures that provide third party proofs. However, you are still assured you are messaging with whom you think you are.

source: [https://encrochat.us/](https://encrochat.us/)

<comment><USER6> > Each message session with each contact is encrypted with a different set of > keys"

Is this not a bad thing? Since transferring key-pairs is the weakest link on these apps. To be really secure, wouldn't you want to do this as infrequently as possible and ideally outside in person outside the app?

<comment><USER7> Sounds like they are trying to achieve perfect forward secrecy per message. Typically you might do this with Diffie-Hellman using ephemeral derivation pairs per session. This is good practice as if any one session key is broken, that has no effect on the privacy of past or future messages encrypted under different session keys. They seem to be claiming to use their own crypto based on the parent comment (red flag) and no signature scheme over the top of it to prove a consistent identity, so I'm not sure what they would be doing. Establishing encrypted pipes over an observable medium is very doable, but providing a way to trust that the party on the other end of the pipe is who you think it is is the hard part as you pointed out.

</comment></comment></comment><comment><USER8> If you wanted to get into the criminal drug trade, how would you start? Is there a guide somewhere I can follow?

$13M in cash is an impressive amount. It makes me wonder: There must be all kinds of operations happening around us daily, yet nobody knows about them. And those operations need members. Where do they come from?

The inner workings of this stuff is fascinating. To be honest, I wish it were possible to go observe the system in action as a spectator. I'd love to see how the packaging is done, the supply lines, the transport logistics...

(I balance this with a deep hatred for cartels. If you trace these questions far enough, it seems to often lead to "the cartels are at the center of it all." And they're responsible for unspeakable miseries.)

To be clear, my question is: how is the knowledge necessary for such operations preserved? I'm a programmer. I learned it from the internet. Where do they learn? And these aren't street dealers. It's an organized, carefully designed, well-oiled machine. How does this machine work? How does it survive the loss of so many members?

<comment><USER9> >(I balance this with a deep hatred for cartels. If you trace these questions far enough, it seems to often lead to "the cartels are at the center of it all." And they're responsible for unspeakable miseries.)

This is why all drugs should be legalized (not just decriminalized, decriminalization still leaves a black market). Cartels are meeting a demand, but cartels make up their own rules and will do anything they want to stay ahead.

Just legalize them, it solves so many problems.

1\. Quality and proper labeling (no more mystery drugs/dosages). Buyers know exactly what they are getting, which would decrees the amount of OD's.

2\. Vast reduction in violent crimes (legitimate, licensed distributors are very unlikely to have violent turf wars as this would jeopardize their license). Black market would suddenly have no market (provided the taxes on legal drugs aren't stupid), which means no money, which means there is nothing to kill/fight over.

3\. Increased tax revenue

It is a win/win/win for everyone, I just don't get it....and please just don't with the tear jerking "What about the children!" The kids will be fine. No legalizing doesn't send a message that "drugs are OK". No it won't make them more accessible to kids, please stop fearmongering you don't know what you are talking about.

<comment><USER10> That can work for drugs with low abuse potentials, like psychedelics. But why do you think drugs like heroin will benefit the society or the people who are taking them?

<comment><USER11> There is a different course of action for high-abuse drugs. Apparently in Switzerland you can get an "addict" prescription from your doctor, and with that prescription you can go to an injection clinic and get a free professional injection of heroin and a bed to lie on.

The result of this is all drug dealers going bust, and no drug dealers - <USER2> one to market the drug, so no new users. All addicts in Switzerland are now old people, and as they die of related diseases and old age the Swiss are having hard time keeping the clinics open because there are not enough takers for free heroin.

I think all opiates can and should be taken care of this way. Not sure about stimulants though - one doesn't just lie down on a clinic bed after a dose of meth or crack. Maybe if regular coke is legalized people will give up meth and crack?

<comment><USER12> You've never been to Switzerland if you think there are no drug dealers there.

I don't know about heroin, but there are something like 3/4 Swiss cities in the top 20 for cocaine consumption based waste water sampling.

<comment><USER13> There are, in fact, even heroin dealers in Switzerland, and of course all sorts of other drugs are still being sold illegally, but compared to the early 1990s, before the heroin prescription policy, there is practically no visible drug addict scene anymore.

</comment></comment></comment></comment></comment></comment><comment><USER14> This story is surprising as there were rumours about 18 months ago that EncroChat had been vulnerable. Esp when other similar services had been taken down and targeted.

Random side story: Governments have become much more aware of the purposes of these sorts of phones and seller.

About 18 months ago I was asked to meet with the sales people from a specialist phone company like this one, they were interested in selling them to the NGO/journalist market. I'm always happy to chat and test the utility of interesting security tech and compare versus more common setups (locked down phones, Signal etc). I've met a load of these sort of companies at trade shows etc as I'm sure many here have but they wanted to meet in person as they were in town talking to various potential clients. The product was decent enough but way beyond the price of anyone in the sector would be able to afford. Anyways the guys were nice and I genuinely didn't get a sense they particularly up to anything bad...

However when I left the meeting (in a European capital) I had physical surveillance all over me. Not a particularly good team, hence I detected them. Totally caught me by surprise. Ran a hastily arranged surveillance detection route and managed to confirm a few (no doubt there may have been more). At first I thought it might be the company I had met doing it to me for some weird reason. However as I thought through the tactics, people profile and operational reason for doing it to me I can only assume that whoever the local police were had been watching closely anyone who was meeting with the secure phone providers (they were foreign to the country in question, so probably came under more suspicion). No doubt this was because of the connection between a lot of these sort of companies and the criminal underworld. (Again, I didn't get the sense these particular sellers were up to no good, I just thought it was an interesting perspective)

<comment><USER15> > Ran a hastily arranged surveillance detection route

What did this entail?

<comment><USER16> I was so curious about this that I did some googling and read this article about it: [https://protectioncircle.org/2016/05/25/surveillance- detecti...](https://protectioncircle.org/2016/05/25/surveillance-detection-on- yourself/)

<comment><USER14> Ami's stuff is excellent. If you ping any of the resources in my bio I can send you more if you are interested.

</comment></comment></comment></comment><comment><USER17> Is it just me or does the timing of this story seem a little fishy considering the EARN IT act that US Senators are trying to push through?

[https://foundation.mozilla.org/en/campaigns/oppose-earn- it-a...](https://foundation.mozilla.org/en/campaigns/oppose-earn-it-act/)

<comment><USER18> Why would the Dutch and French police time the release of this information with a US law proposal?

<comment><USER19> Because that's how global politics and alliances work, sometimes.

<comment><USER18> Sure. Because Trump hasn't completely messed up any form of allegiance the Europe had to the US.

<comment><USER20> Ultimately Trump is just one (albeit powerful) dude - I imagine intelligence and other agencies have built up relationships over a much longer period

<comment><USER18> Yes, they probably have, relationships based on trust. Using information for political gain is not the type of stuff that allows that trust to continue existing.

So for US politicians to both know and abuse this, someone in the US intelligence community would have had to be willing to lose a lot of trust on the EU side by both sharing the intelligence and allowing it to be used for political gain and forcing the EU side to become their political puppet.

That doesn't seem reasonable to me, but who knows. If that's what happened though, the US can forget any trust in the near future.

</comment></comment></comment></comment></comment></comment><comment><USER21> Given the care with which the software was built, I wonder if the hardware itself was compromised. The open hardware folks always talk about the insecurity of the closed hardware in phones; I wonder if any official narrative discussing a software exploit is simply a parallel construction. [1]

[1] [https://en.wikipedia.org/wiki/Parallel_construction](https://en.wikipedia.org/wiki/Parallel_construction)

<comment><USER22> From an different article linked by a comment, the replies from the company itself points towards an compromise between the phone and the update server. The police got access through the SIM service provider and was able to inject their own modified updates to the connected phones.

As a simple guess, I would suspect that the police managed to get a valid certificate from the domain name used by the update server and through that MiTM the connection. One of the comments from the company said "They repurposed our domain to launch an attack", which would fit such scenario.

Attacking the authentication of update functionallity is also in my view the usual suspect in cases like this. When a hardware device get rooted it very often is some kind of attack which allow people to push an modified update in some way. The developer in this case would need to have designed the update feature assuming that the domain name could be compromised, the SIM service could be compromised, and that the path between their server and the phone could be compromised. If they used cloud services for their servers than they would also need to assume that the cloud provider could be compromised. People can write software very carefully and still forget to account for one of those.

</comment></comment><comment><USER23> I don't quite understand how this worked and the article is thin on details - was there not E2E encryption between the participants?

> Our servers are node based and located all over the world; all input and > output are true end-to-end encrypted. The Servers only initiate the tunnel.

Their own statement suggests a zero-day?

> Today we had our domains seized illegally by government entities. They > repurposed our domain to launch an attack to compromise carbon units.

> With control of our domain they managed to launch a malware campaign against > the carbon to weaken its security.

<comment><USER24> The other article I read about this is that law enforcement compromised the service's servers and pushed an update to the clients, making them send unencrypted messages, which allowed law enforcement to read them as they came through in real time.

<comment><USER25> Devil's advocate: Is there evidence law enforcement didn't start and run the project from the beginning? If they did, I wouldn't expect them to come out and acknowledge it.

I'm similarly skeptical of popular VPN apps.

<comment><USER26> Humans are often the weak link here. The most common scenario is that the police had some control over the project due to a compromised person. I'd wager that the police did not start the project, but soon after it was being used for crime, they took over it.

I'm not sure it's possible to me to develop and run something with the assumption that even if I turned police intelligence asset, that the product would be untouched. Open source would help, and some kind of distributed, decentralised thing maybe

<comment><USER25> I agree. That seems more likely. I doubt we'll be told, but I'd be interested in the specifics. It seems like it might have ethical implications to take over it without the blessing of the owner(s) of the company. After all, I doubt they will be able to get many more customers now that it's widely known that it was compromised by law enforcement. Arguably law enforcement destroyed this company, which the owners might normally not be happy about.

It may be as simple as: the business wasn't making money and the owners wanted out, so law enforcement bought it or paid them off. Then law enforcement isn't really "compromising" the company--they're in control of it (whether the employees know or not). At that point they can have the existing devs modify it however they want, or just hire a few new devs.

</comment></comment></comment></comment></comment><comment><USER27> The moral of the story is there's no such thing as plug and play opsec. It requires thought, patience and domain knowledge. You can't outsource it because that contractor becomes your immediate and obvious weak link and will be compromised. Whether it's El Chapo's IT guys or fools who thought a cell phone company would keep them out of prison, this story just repeats itself.

<comment><USER28> Exactly like The Wire plot with burner phones. As soon as compromised phones made it into rotation, they were sunk.

</comment></comment><comment><USER29> Do I sense some Brexit here? The BBC article mentions "The NCA worked with forces across Europe on the UK's "biggest and most significant" law enforcement operation.", while the Joint Eurojust-Europol press release [1] doesn't mention the Brits at all, but calls it a Dutch / French operation.

[1]: [http://www.eurojust.europa.eu/press/PressReleases/Pages/2020...](http://www.eurojust.europa.eu/press/PressReleases/Pages/2020/2020-07-02b.aspx)

<comment><USER30> For what it's worth, in an earlier statement to Vice, a company representative claimed the attacks appeared to originate from the UK.

[https://www.vice.com/amp/en_us/article/5dz9qx/encrochat- hack...](https://www.vice.com/amp/en_us/article/5dz9qx/encrochat-hacked- shutting-down-encrypted-phone)

<comment><USER31> From Cheltenham perhaps?

</comment></comment></comment><comment><USER32> The article says the encryption was cracked on April 1st but apparently a whistleblower said that the police used a warrant to get access to the company's infrastructure back in March - which suggests to me that the whole "cracked encryption" story might not be fully legitimate

[https://medium.com/@fordnic/evidence-suggests-encrochat- is-w...](https://medium.com/@fordnic/evidence-suggests-encrochat-is-working- with-the-nsa-and-other-authorities-281bfd05ed9e)

<comment><USER33> The encryption was likely 'cracked' by gaining access to the infrastructure and then putting something in place to view the encrypted traffic. .. changing keys to a known value, pushing out a custom software update, etc.

</comment></comment><comment><USER34> The amazing thing here is this was a perfect piece of viral marketing - <USER3> criminal presumably recommending / refusing to do business without another one buying a new phone.

But it also has huge knock on effects - I mean there are 60,000 people identified on here - and they won't be the bottom level of crime organisations. I don't have a clear number but this must be a large chunk of all established criminal networks in huge numbers of countries.

Seems to me the level of competition has dropped in the criminal industry - <USER4> opportunity perhaps :-)

</comment><comment><USER35> And the obvious conclusion, if you're a criminal, is that don't rely on others to encrypt your comms. Either go with classic PGP or make your own layers (as Schneier puts it).

But criminals are usually just dumb in regards to this, they are only "street smart". Those who are "intellectual smart" don't do it. Or if they do they don't get caught until they jump over the horse (see the current scandal with 2 billions "siphoned")

<comment><USER36> > don't rely on others to encrypt your comms. Either go with classic PGP or > make your own layers

You're saying "don't rely on others to encrypt your comms" and then the very next sentence says "use something someone else has made". Those two are conflicting. "Making your own" is even worse, because cryptographers don't usually have to resort to crime.

<comment><USER37> There is making encryption tools and then there is using them. "don't rely on others to encrypt your comms" means don't let others use encryption on your behalf, it means encrypt it yourself. It also does not mean to make your own encryption tool.

So your comment parent meant use a reputable tool yourself. And I would agree with that.

<comment><USER36> I'm not sure what you mean. They were using a tool that encrypted their communications, it just wasn't good. What's the difference between using Signal and using what they were using, or using GPG and what they were using?

<comment><USER37> I get the feeling you don't want to understand at this point, but ok, I'll byte:

The difference is the action of encryption and decryption is completely transparent to the user in the case of Signal or this thing they used. You don't encrypt anything, you input plain text and then the system takes over and you have to trust it. If the rumors are true the authorities compromised the servers, pushed an update to the app and the encryption no longer happened.

Just one example on how to do it yourself: using PGP you can use any hardware (not a phone marketed to criminals) and keep it completely offline. And use a phone (worst option but whatever) in which you input the encrypted thing directly. So you don't have to trust the network device. Bonus: neither do you have to use something that makes you stand out to authorities.

<comment><USER36> Okay, but unless you implement the encryption yourself, PGP can push an update and use weak RNG input so that your message is decryptable, and you'd never know.

"Don't rely on others" makes no sense for encryption, you have to rely on others because it's too hard otherwise. You just have to pick trustworthy others.

<comment><USER37> PGP can not push an update in the example I offered. And I already explained what was meant with "Don't rely on others" \- btw now I see you cut the quote to fit your straw-man argument.

</comment></comment></comment></comment></comment></comment></comment><comment><USER38> Looks like another episode in the failed war on drugs. While this may look "good" and someone will be able to say "look at those figures" in reality we're addressing a side effect of a much deeper issue.

<comment><USER39> Am I happy guns are off the streets? Hell yes. Would I be happier with sane drug laws so as to not necessitate a black market? Double hell yes.

<comment><USER40> That wouldn't change anything regarding the guns or the amount of crime - career criminals don't do it because they believe in selling drugs, they sell drugs because it's an easy way to make money.

In that regard: keeping a black market for drugs may even be a good thing. Otherwise they'd move on to other ventures that might be more harmful, kidnapping, murder for hire etc.

<comment><USER41> That's a bold claim. Any empirical evidence on your side?

<comment><USER40> That career criminals are career criminals, not ideological "prohibition is bad, therefore I sell drugs" hippies? Are you serious?

<comment><USER41> "career criminal" is begging the question. You claim these people exist, and by definition they are going to continue crime rather than find legitimate ways of making money.

Furthermore, you're suggesting that when their way of making money through crime disappears they will migrate towards _worse_ crime. That's a bold claim.

</comment></comment></comment></comment></comment></comment><comment><USER42> Is there anywhere we can learn more about EncroChat? Google took me to [http://encrophone.com/](http://encrophone.com/) which is now 403ing

<comment><USER43> Bing gives correct result

[https://encrochat.us/](https://encrochat.us/)

</comment></comment><comment> globular-toast > Officers are said to have prevented people being murdered after covertly > monitoring planned attacks and threats to life on the encrypted service.

Now they can't do that any more. It's a dilemma that British intelligence faced a lot during the world wars: if they acted on information gleaned from secret channel it would reveal to the enemy that the channel was compromised. Makes me wonder how long they were monitoring and possibly letting crime take place before deciding that now was the time to strike.

<comment><USER44> Not just during the world wars. British intelligence apparently faced the same dilemma when infiltrating the IRA, and some of the results were quite ugly (look up Stakeknife if you're interested).

<comment><USER14> Very true. Though Stakeknife was also used in a way to remove hardline individuals seen as problematic to the more pragmatic parts of the Republican movement who were open to negotiate and protect other sources higher up. With obviously terrible consequences for many innocent people.

</comment></comment></comment><comment><USER45> I think the take home message is: Police had a way to intercept these communications, but they managed to have that information leaked before they could finish their operation, only managing success because it was already too late for most of the participants.

Sort of illustrates the futility of giving the police keys to access communications, when the number of times they pull this off without a leak is near zero.

</comment><comment><USER37> Ofc we are going to get no details on how they managed to penetrate the network.

The real question for me is how the criminals trusted the product.

<comment><USER46> Allegedly they captured the servers and compromised the clients through an update. The trust was probably due to not getting caught for a while.

</comment></comment><comment><USER47> More info:

[https://www.vice.com/en_us/article/3aza95/how-police-took- ov...](https://www.vice.com/en_us/article/3aza95/how-police-took-over- encrochat-hacked)

<comment><USER48> This contains some really interesting info. Basically someone (i.e. a government, likely the Dutch) managed to install malware on a bunch of the phones.

Each phone only communicates with other phones in the network so once they got one zero-day and put malware on a phone and could spread it, it could spread very quickly.

</comment></comment><comment><USER49> Might encrochat and its shareholders have a case against various european governments here?

Are they supposed to simply accept that the government will hack into their servers and users devices with no compensation?

<comment><USER50> Considering they operated in France and the Netherlands and even 'had a shop there' (whatever that means): Yes, but looking at all the articles I'm pretty sure they are also building a case against EncroChat for participating or actively facilitating criminal behavior, in which case the point is mute anyway.

Some requests can be made to ask you participate making you sort-of free of prosecution as you are cooperating, but I doubt they would do that with companies with shady structures and owners.

<comment><USER51> EncroChat is not an app you get from an app store. It came with the EncroPhone, which are physical Androids you rent for some absurdly high price (like $3000/year-ish). And EncroPhone didn't sell online. You had to get them via a reseller i.e. someone you knew, or they had a few physical stores in the Netherlands.

</comment></comment></comment><comment><USER31> These tactics are as old as international drug smuggling itself. Howard Marks(Mr Nice)[0] says in his book that he stationed one of his associates in Amsterdam to operate as a communications node, he finds out later that the Dutch police had tapped the phone lines within weeks.

[0][https://en.wikipedia.org/wiki/Howard_Marks](https://en.wikipedia.org/wiki/Howard_Marks)

</comment><comment><USER52> If we mentally replace criminals with dissidents and France/Britain with PRC, what could EncroChat have done differently to shulield its users?

<comment><USER19> Compartmentalize into small groups aka cells. It is centralizing around EncroChat which was the mistake here. All the eggs in one basket will always carry this type of risk.

There is also another difference. Drug dealers usually wants to get rich, and have no real interest in any larger cause than their own profit.

Dissidents are sometimes willing to sacrifice themselves for the larger cause. What is important for such a dissident is not that nobody gets caught, but that the events are beneficial for the cause and that certain key individuals are protected. Even martyrdom is useful for a dissident, but rarely to a drug dealer.

Dissidents should keep working in cells to minimize the risk of discovery. The drop hollows the stone is the working principle for dissidents. The most influential dissident may have a very small network of contacts but with a large fan-out a few layers down. This tactic is for example how Bin Ladin was able to stay in hiding, he was meeting very few people and it was hard to find him because of that even when he was the top target.

<comment><USER14> In reality the nature of drug dealing would make it tricky to implement a cell structure. If you look at the IRA, implementing it meant in theory it was very hard for one cell to know another and only certain parts would supply arms, intelligence etc. This resulted in a drop in attacks for a long time because of the difficulties in keeping to that. Though it did of course decrease infiltration for awhile. Until the UK found the weaknesses and targeted those who had permission to oversee and deal with everything - the internal security section and leadership.

Drugs is a much more dynamic industry where are some points there is a need for a lot of contact, travel, managing big groups of individuals...Not that it couldn't work that way but it would be very hard when people are out making money all day rather then at home in a dissident sense waiting months/years until a short/fast operation.

</comment></comment></comment><comment><USER19> Screen shot of EncroChat message claiming authorities seized their domain names and compromised their "carbon" units with malware.

[https://twitter.com/Borisuithetbos/status/127173017995886592...](https://twitter.com/Borisuithetbos/status/1271730179958865920?s=20)

<comment><USER53> Seems like they didn't sign software updates with an offline key and relied on the transport (TLS via the domain) to authenticate them.

If they used an offline key (GPG?) to sign updates, a compromised transport wouldn't have allowed an attacker to deploy malicious updates to the devices. That's exactly how most Linux distributions operate, the mirrors themselves are untrusted and packages are often fetched via unencrypted HTTP, but that doesn't matter because the signatures are checked independently of the transport.

</comment></comment><comment><USER54> Too risky to use such services,. As soon as they become too big, they have nation state resources thrown at them...and they're without Google or FB resources to defend.

If all else fails, DEA-like agencies can easily offer employees millions of dollars for keys or assistance to plant bugs, offer immunity and so on. Very hard to resist.

<comment><USER55> It's interesting that law enforcement can hack it but eventually they have to burn the network because they have to make arrests using the information.

They should buy/hack all these companies and then run false flag operations to hide the fact they own the comms.

Like the germans never realized that enigma was hacked

<comment><USER54> They do it but at some point they have to arrest...and warn Johnny that he will be killed this Saturday.

</comment></comment></comment><comment><USER56> Dumb question....but would they have been better off using Signal? Assuming a burner sim for registration.

<comment><USER57> Signal is installed from the platform stores, which have the ability to push updates. As far as we can tell, the compromise was done via a pushed update. It's likely that Signal wouldn't have helped.

<comment><USER58> On Android, I recall that updates to a package must be signed by the same key as the package being updated, otherwise the device itself will reject the update. Doesn't that mean that only the Signal developers (who are the ones who signed the original package) would be able to create a compromised update?

<comment><USER57> That is likely what happened in this situation (although I don't have details).

</comment></comment></comment></comment><comment><USER59> Confused: OP says the service was taken down. That seems the most significant part of this action, even beyond the criminal arrests. Is an encrypted communications company liable/responsible if criminals use their product? Surely there were many, many legitimate users e.g. lawyers, business negotiators, lovers. Can the 'bad apples' be laid on the communication company's doorstep? If so, why not Facebook, Zoom or even Apple?

Why is HN not addressing this point? Instead of speculating about criminal activities etc.

<comment><USER60> It's hard to say. At least in the U.S., there has been some precedent relatively recently where companies knowingly facilitating criminal activity can be subject to prosecution. They could probably argue that they didn't have access to the the contents of communications so they were unaware of the criminal activities. However, they (it's unclear if it was resellers or the company doing this) actively marketed to criminals, via ad placements on websites known to be used for criminal activity. Needless to say, it's a pretty complicated situation in terms of liability.

<comment><USER59> See? The websites "known to be used for criminal activity" we ok somehow, but not this company. Were the ISP or site hosting organizations shut down? Why not?

And selling communications equipment to a criminal - maybe they wanted to talk to their sweetie without being monitored. They also bought a bagel and took a taxi ride. Is the bagel store shut down too? The taxi company?

There's lots to talk about here.

<comment><USER60> I think there needs to be a certain level of reasonableness when tracing back liability. I mean, why stop at the ISPs? Why not take it all the way up to RIPE for allocating IPs to the company? Or how about the telecommunication companies that used government allocated RF spectrum to facilitate the communications. In that case, the telecoms and the Government(s) themselves should be liable.

As for people wanting to talk to their sweetie without being monitored, I believe authorities have already said people who were using the services for legitimate purposes may request to have their communications excluded from any legal proceedings and naturally, won't be prosecuted just for using the devices.

<comment><USER59> Yes, of course, the criminal side is well understood. Except, of course, the massive wiretapping without a warrant part.

Gun sellers have been pretty safe from prosecution for selling a gun that gets used in a crime. Why not encrypted communications companies? That's the distinction I wonder about. (Hopefully using the 'g' word wont further derail the conversation)

<comment><USER60> Yeah, I get where you're coming from. So the case I was referring to earlier as a recent example, was Backpage. I think there are some key elements that need to be met, but you can see with that case where lines can be crossed. I'm not arguing encrypted communication companies should be liable for all activities using their service. However, if a company specifically markets to criminals, in my mind, that gets really close to crossing a line.

I think it's the difference between facilitation and knowingly facilitating. With the gun store example, if the person purchasing the weapon said "I'm going to go kill someone, can you tell me which gun would be best for that?", the gun store would be absolutely liable if they sold them the gun.

<comment><USER59> Gun stores have expertise in 'personal protection' weapons. They sell guns to people _all the time_ with the express intention of being easiest to use and the most fatal.

I'd say, marketing to criminals seems pretty close to the line, but depending on the conversation its no closer than the 'personal protection' sale? As long as they're not advocating "use this to break laws", they're just selling privacy. Like selling a fence for your yard or padlocks for your house. No natural illegal nature to those sales. Even if they ultimately get used to conceal crimes etc.

</comment></comment></comment></comment></comment></comment></comment><comment><USER61> >EncroChat sold encrypted phones with a guarantee of anonymity, with a range of special features to remove identifying information. The phones themselves cost roughly £900 (€1,000) each, with a subscription costing £1,350 (€1,500) for six months.

That's a pretty pricey for what's basically a chat app. Is there a reason why they were able to command such a high price even though there are plenty of free/open source solutions on the internet? Marketing? Trust? Criminals thinking more $$$ = better?

<comment><USER62> When you have a ton of money and you aren't super Technically savy, you don't always make the right decisions.

</comment></comment><comment><USER63> December 2017 - encrochat hacked

[https://encrochathacked.wordpress.com/2017/12/09/encrochat-h...](https://encrochathacked.wordpress.com/2017/12/09/encrochat- hacked/)

[https://www.vice.com/en_us/article/mbpyea/encrochat- secure-p...](https://www.vice.com/en_us/article/mbpyea/encrochat-secure-phone- hacking-video)

The writing was on the wall and is was ignored

</comment><comment><USER64> Some more backgrounds: [https://alarmeringen.nl/gelderland/well- gelderland/123823-li...](https://alarmeringen.nl/gelderland/well- gelderland/123823-live-acces-to-criminals-in-the-netherlands.html) Not sure if it was the Dutch or French police that did the actual hack, anyone have details on this?

Apparently the investigation was code named 26Lemont

<comment><USER65> The Europa article links to this document in French: [http://www.eurojust.europa.eu/press/Documents/2020-07-02_Enc...](http://www.eurojust.europa.eu/press/Documents/2020-07-02_EncroChat- investigation-in-France_FR.pdf)

Some parts:

> "Dès 2017, les téléphones utilisant le moyen de communication sécurisée > EncroChat sont détectés par le département Informatique Électronique (INL) > de l'Institut de Recherche Criminelle de la Gendarmerie Nationale (IRCGN)"

First device using EncroChat were discovered in 2017.

> "La JIRS de Lille s'est saisie de l'enquête sur la solution de communication > chiffrée EncroChat à raison de la localisation de serveurs en assurant le > fonctionnement."

Special section JIRS in France was mandated to investigate because the servers used by EncroChat were hosted in the north region of France.

> "un dispositif dont la conception et le fonctionnement sont couverts par le > secret de la défense nationale, mais qui a été reçu et déployé par un > service habilité par la loi pour ce faire, le Service Central de > Renseignement Criminel de la Gendarmerie Nationale (SCRC) du Pôle Judiciaire > de la Gendarmerie Nationale (PJGN) en application de l'article D15-1-6 du > Code de procédure pénale."

The "device" (not necessarily a hardware device) used to intercept coms are classified but was "received" and "deployed" by "Service Central de Renseignement Criminel de la Gendarmerie Nationale".

So it was deployed by French police but it's not clear if they made it.

</comment></comment><comment><USER66> Anyone got a copy of the APK? Let's decompile it

<comment><USER67> I wish more HN threads were of this particular flavor!

[insert "can we run DooM on it?" joke]

</comment></comment><comment><USER48> Now that Encrochat is gone, if anyone fancies playing ethical hacker:

\- buy one of these [https://omertadigital.com/collections/frontpage/products/the...](https://omertadigital.com/collections/frontpage/products/the- signature-magnum-opus-ultimate-privacy-package-with-encrypted-smartphone-sim- card-mobile-data?variant=33265453596808)

\- find a zero day

\- install malware

\- ???

\- Profit!

</comment><comment><USER68> [https://www.vice.com/en_us/article/wjwbmm/inside-the- phone-c...](https://www.vice.com/en_us/article/wjwbmm/inside-the-phone- company-secretly-run-by-drug-traffickers) this is another crazy story about links between secure phone companies and organised crime including torture and murder

</comment><comment><USER69> I guess the lesson here is clear: don't overrely on technology.

There are tried and tested methods for running a covert organisation and they all rely on organisational resilience rather than ultra clever tech. Also, don't reuse channels - actual intelligence operations failed because of breaking this rule.

</comment><comment><USER70> These days messaging security pretty much comes down to end point security ... and end point security is terrible.

If you want to be sure you have to do some sort of air gapping, either with something like a Yubikey, or even better, with a dedicated device with a screen and keyboard.

</comment><comment><USER51> Predicted a few weeks ago, before any news of this came out:

[https://moderncrypto.org/mail- archive/messaging/2020/002586....](https://moderncrypto.org/mail- archive/messaging/2020/002586.html)

</comment><comment><USER71> A few years ago I decided that all of the encryption in the world isn't going to protect you from state-actors.

Even if your software is perfectly implemented (it won't be), your hardware is mostly a black box.

<comment><USER72> Complex systems are the core problem. Hardware, firmware, third-parties and black boxes all over, live updates, OS, apps, network, etc. etc. The upside is that it also makes them hetergeneous which is more difficult to roll en masse.

</comment></comment><comment><USER73> You're only hearing about this now because the cat was out of the bag as of a couple of weeks. If not for that the data gathering would have continued and more people would have been caught.

</comment><comment><USER74> This sounds like a plot device from the most recent season of _West World_.

</comment><comment> ur-whale "several dozen guns"

</comment><comment><USER75> This is going to make arguing against EARN-IT a lot harder just now.

<comment><USER73> No, it actually weakens it.</comment></comment>


Working at Radial: Embracing Empathy (2019) - <AUTHOR> https://www.novumopus.com/blog/2019/9/21/working-at-radial-embracing-empathy <comment><USER2> After reading this -- I want to work for you, Radial!

Related: [https://radialdevgroup.com/about-radial-development- group/](https://radialdevgroup.com/about-radial-development-group/)</comment>


Seeed Fusion X'mas Sale: Up to 16% OFF on PCB/PCBA Order - <AUTHOR> https://www.seeedstudio.com/fusion_pcb.html <comment><USER2> You are a fine company, but this is not the right place for this sort of advertising. If you continue, you'll mess up the good reputation you have here. Instead of links to your sales pages, write about something that interests you, and submit that instead!

<comment><AUTHOR> Thanks for your kind reminding!</comment></comment>


Job applicants over 40 filtered out by employers - <AUTHOR> https://phys.org/news/2017-06-job-applicants-filtered-employers.html?utm_source=menu&utm_medium=link&utm_campaign=item-menu <comment><USER2> How does one determine the age of an applicant from the resume? It's not recommended to put your birthdate. Years in the workforce?

<comment><USER3> graduation year or first employment

though you can just list your education without specific years and also skip mentioning first worthless jobs anyway to make yourself younger

</comment></comment><comment><USER4> It's not about losing the ability to adapt. Older people are more expensive because they're more experienced. Businesses would rather skimp on quality. I say this as a 22yo.

<comment><USER5> That's not entirely true. Also, "experience" doesn't necessarily mean "quality" \- especially when it comes to tech. Older people are also more set in their ways, less versatile, less likely to think outside the box, have far less energy and also have more responsibilities.

In a startup I worked at, we didn't hire any developers over 30. The only people over 30 was out CEO and he got hired after our 2nd round of VC funding. We wanted devs who fit our culture and of course people who could be "molded".

A 40 year old just wouldn't have fit in with a bunch of 20 year olds and he certainly would have trouble keeping up when we developed into the early morning to meet our deadlines/milestones/go-live dates.

But then again, startup culture is very different than established oldschool corporate culture. But starting up a company ( especially in tech ) and trying to survive is geared towards younger people.

Also, a 40 year old with with 15 year of VB experience in corporate america is worth nothing to a startup building enterprise software in VC++. I would choose a fresh grad from a top CS school with strong GPA and good work ethic over some 40 year old VB developer.

<comment><USER6> Sounds like people over the age of 30 are too smart to work "into the early morning" in exchange for lottery tickets.

<comment><USER7> Might be smart at any age to take the cash plus the lottery tickets in addition to the technical progress which could be leveraged to greater worth than both combined.

It can be said that the increasing emphasis on growth rates over other factors in the 21st century has driven the need for average engineers in excess of the above-average engineers that could be supplied, resulting in an overall decline in the quality of the engineering as time goes by.

Most importantly, some 22-year-olds have higher quality standards than others to begin with, and among these some will have trouble maintaining their best quality while others can continuously improve with age in ways that can not be done over the short term.

When it comes to being set in your ways at work, this should not be confused with a lifestyle of non-trendy workwear and preferring to just grill out by the pool every Saturday. Someone whom by nature is more versatile at work, can also have further years dwelling outside more boxes than less experienced operators are aware of. And thousands of hours more training to develop more not less energy plus increasingly efficient application of it, and with more decades of responsibilty-handling experience, no wonder they are filtered out by age-limiting employers who can not yet comprehend the outsized possibilities.

Sometimes older workers are so old-fashioned they don't spend any time at work on Facebook at all, getting shit done out of habit when needed can have its advantages when progress needs to be measurable.

Someone with 20 years of this type of versatility at work is simply 10X more valuable than someone having only two years along the path. You have to expect them to be worth more in compensation.

An outfit that is truly capable of leveraging its people will get a 10X return, and will very rarely approach 10X the compensation.

Too bad for so many so-called leaders it can be beyond their inherent limitations to herd the cats when there is a much more experienced, better- compensated, or more-performant cat in the herd. You can not let team perception of a compensation multiple become inflated beyond reality, instead it should be used to inspire younger workers to double their own productivity as realistically as they can without expecting to get 2X their compensation either anytime soon, while still making visible progress toward being better compensated for years of increasing productivity themselves.

You too, could be there someday, but only if you manage to overcome the obstacles to survive some of which are geared towards younger people.

Or maybe you plan to stagnate if you think it is unavoidable as you get older, your choice.

You probably won't get 10X the appreciation either way.

Then again there are those having decades of preference for working without days off when meaningful milestones need to be reached, and they couldn't realistically depend on many in their 20's to keep up very productively anyway under those conditions during their early years in our 24-hour business. Plus even under ordinary conditions a super-hairy 36-hour day can still come up.

Younger workers just seem less motivated these days, I don't call it lazy like some oldtimers do but it can give an unfair advantage to a seasoned higher performance operator who is often able to overcome milestones in ways that make the difference between a deadline being destructive versus productive financially.

Plus it takes a few years of hand holding and confidence-building before I want you doing this on your own.

These are some expensive ships.

At any age, starting up a company full-in takes a certain particularity of ambition that not everyone will know or understand. If and when I start another company, I would want to be able to leverage both the dedicated top 40-year-old VB developer in addition to the dedicated top fresh academic performer, along with the dedicated top 60-year-old FORTRAN operator.

Anything less would be limiting the shareholders' upside to less than its full potential, I might as well give up if I can't afford the 20X 60+year-old this time (40X the first year recruit).

</comment></comment></comment></comment><comment><USER8> Anyone able to translate the PDF? Google Translate a Document gives me 'insecure connection error'.

<comment><AUTHOR> [http://www.ifau.se/globalassets/pdf/se/2017/wp2017-08-the- ef...](http://www.ifau.se/globalassets/pdf/se/2017/wp2017-08-the-effect-of- age-and-gender-on-labor-demand.pdf)

</comment></comment><comment><USER9> So what are people supposed to do? lol Just die? Seems harsh.

<comment><USER10> Prove it was an illegal action and defend your right to employment: [https://www.eeoc.gov/laws/types/age.cfm](https://www.eeoc.gov/laws/types/age.cfm)

"The Age Discrimination in Employment Act (ADEA) forbids age discrimination against people who are age 40 or older."

<comment><USER11> ...and if you're filtered out at the resume stage, good luck proving the intent.

<comment><USER12> _If_ you can get to discovery, consistent filtering at the resume stage is probably the _easiest_ thing to prove is unambiguous age discrimination.</comment></comment></comment></comment>


Ian Bicking: Reflections on the Closing of Mozilla Labs, a New Role, Etc. - <AUTHOR> http://www.ianbicking.org/blog/2014/09/professional-transitions.html? <comment><AUTHOR> This post was submitted yesterday under the original blog title. I've resubmitted it under a another title that will -- I hope -- better describe why the post is relevant to the Hacker News audience. It's a long post but it's well written and I think the original title doesn't really do it justice.

The earlier post is here: [https://news.ycombinator.com/item?id=8326996](https://news.ycombinator.com/item?id=8326996)</comment>


YouTube censored name of russian opposition leader - <AUTHOR> Updated YouTube android app returns 500 error for users in Russia, if they try to input name "navalnyi". Alexey Navalnyi is the leader of russian opposition, person who continuously reveals crimes of Putin and his friends.
Main issue here - old YouTube app works just fine, so filtering is implemented inside the app, not in the network.
It means somebody in YouTube or Google wants to support Putin in his censorship. It's really awful.
Link to discussion in russian language: https://twitter.com/navalny/status/935818087785476098
Update: added note about user location <comment><USER2> Google/Youtube and the current fake news crusade don't feel to me like supporting Putin. Pretty much the opposite to me.

</comment><comment><USER3> I don't know. I can search him just fine on youtube website.

<comment><AUTHOR> It means you are not in Russia currently.</comment></comment>


Snaps are an anti-pattern on Ubuntu - <AUTHOR> https://techtudor.blogspot.com/2020/06/four-reasons-why-snaps-are-anti-pattern.html <comment><USER2> I had been an Ubuntu user for almost 16 years, on servers, laptops, and recently containers. The snap situation with Ubuntu is just plain unpalatable, both in principal and in practice. I became so disappointed in the move by Canonical that I finally left Ubuntu altogether and no longer recommend it to friends and colleagues.

It takes years to cultivate a garden, but only minutes to destroy it.

<comment><USER3> There are also these "AppImage" files. They launch, but there is no guidance on how to install them to the system.

Launching Chrome: I click the Chrome icon.

Launching PrusaSlicer: Start a terminal and type

        chmod 755 ~/Downloads/PrusaSlicer-2.2.0+linux-x64-202003211856.AppImage
        ~/Downloads/PrusaSlicer-2.2.0+linux-x64-202003211856.AppImage

That doesn't seem like progress to me from a UX perspective.

<comment><USER4> And flatpack. So now there's apt, snap, appimage, and flatpack. 4 fucking systems that need to be maintained just to update apps on an OS. Frankly, it's ridiculous and the apps from all those alternate systems all have some issues too. None work as well as apt. I don't understand what is wrong with apt. If they want newer packages provide a repo for newer shit. Problem solved.

<comment><USER5> Apt is great as long as what you want is available in the repo. Over the years I have had a few issues though.

Often apt's versions trail behind the newest versions. There are some good reasons for this, but it can get in the way sometimes.

I have had to ad a lot of PPAs to get some of the software I wanted. The Aurora channel PPA for Firefox stopped getting updates at one point (they discontinued it), and I didn't realize until a few versions later. I don't think any of these package managers have that problem figured out, but PPAs are commonly maintained by third party community/unofficial folks. I had the same problems with Arch's AUR.

I believe it's fixed now, but for a long time Steam required a lot of 32 bit libraries, which meant two versions of several dependencies were installed on my machine.

Additionally we were using an older version of Ruby at work which required OpenSSL1.0 for certain libraries, and a Ruby upgrade (from an old version to a less old version) broke my development environment.

Not that the others are perfect. Just for example the Spotify snap package from the software center doesn't even work. The Deb had problems on my machine which I couldn't resolve. I finally installed Flatpak to get a working version.

<comment><USER6> I think this thing about apps not available for apt is in the past. I specifically use Ubuntu because there are .debs for everything. Most of the new apps for linux published on Internet "need" to have a .dev available, if they want to became popular.

Well, I have found some strange, out of common, software - mostly comercial stuff - which doesn't have any .deb available nor ppas, nor nothing.

It is clearly a decision from somebody who said "no, we are not spending hours packaging our app, if they want it, they will try to install it with the methods we will provide"

Kind of nonsense, except that if you're in Linux looking to install a comercial app, special snowflake, is probably because you have zero chances to do otherwise, then you bit the bullet and try whatever crazy method to deploy their app they have put in place.

Most common stuff I found: \- Just download my zipped binary, you know how to deploy it \- Just run this command line, "sh something" giving it root credentials to run code from the Internet (YEAH I KNOW TOO, as much insecure as it gets)

Having said that, many comercial apps are there for to be easyly downloaded as .debs (they should just install with a GUI right out from the link, in old- Ubuntu behavior). Or they even offer you detailed instructions to configure a ppa (to manually install with apt).

Heck, nowadays it is common sense and good netiquette to make your installation scripts in the downloaded .deb to just deploy the ppa for apt, so next upgrade happens automatically.

If you ask me and I wouldn't dreaming to control the app-deployment infrastructure in Linux, I would say "yeah, you need to contact EVERY software not providing the .deb format and start working with them, providing them free support, even free scripts to handle the packaging"

I remember in the 90s, there was LOTs of shareware because Microsoft knew this stuff from the 70s and 80s: if you want you're software in use, you need to talk directly with those who could probably use it.

No, links hanging in some flashy website won't cut it, nor repos in github half sharing some code.

</comment></comment></comment></comment></comment><comment><USER7> I think there are some very good critiques of snap (performance, provenance, reproducibility, namespacing, etc), and the first couple points in this article seem reasonable.

However I can't agree with this:

> apt/deb is a wonderful package management system and everyone is happy with > it, at least the majority of Ubuntu/Debian users. Besides, dnf/rpm is also a > similar packaging system for Fedora/RH systems and everyone is happy with > that too.

Debs and rpms are great at assembling tightly coupled monolithic systems. Great! Let's keep using them for the base system. However when I want to install a QT app on a Gnome system or _gasp_ a proprietary app, Debs are insufficient. I want all of the QT libs embedded in the package. I want the proprietary app in a container. I want MAC with a polished UX. I don't want debs to worry about those features. I want an "app store" done right: open yet verifiable. Protection in depth.

<comment><USER8> > I want all of the QT libs embedded in the package.

I don't understand why anybody wants this.

Libraries should have major versions and the latest of each major version should be compatible with anything using that major version, because that's what major version means for a library. You might then need to have more than one major version of the library installed, but any two applications using the same one should be able to use the same copy, and then have it maintained by one person in one place.

If every package has a separate copy of every library, people have to maintain them all separately. When that library has a security update, you now have to update five dozen packages instead of one or two, and have a security vulnerability if _any_ of the maintainers don't keep up in a timely fashion. Which not all of them will.

> I want the proprietary app in a container.

People want containers to be magic but they're actually a hard problem. You want the app not to be able to do anything you don't want it to but still be able to do everything you do want it to.

A backup app that can't read my files is useless; it can't back them up. But it shouldn't be able to modify or delete them. But it should be able to modify its own state. It shouldn't have general network access but should be able to communicate with the backup server, which might have to be specified by the user and not the package maintainer. It doesn't need access to the GPU or the ability to use gigabytes of memory, but it does need to be able to transfer a lot of data over the network, but the data it transfers is lower priority than other network packets.

That requires the person configuring the app's container to have both detailed knowledge of the app and detailed knowledge of the container system. It's common for this not to be the case.

And that's why containers are a mess, not anything to do with the package manager, which should have little to do with the container system outside of packaging the app's default container configuration with the app.

<comment><USER7> > I don't understand why anybody wants this.

Because creating debs is largely a completely distinct undertaking from the dependency and build management the developer of an app does.

Bundles, whether via images or static binaries, allow app developers to distribute their app against the exact dependencies it was developed against -- potentially using the same build system.

There's obviously tradeoffs to each approach, which is why I don't think there's one right way to distribute every bit of executable code on a system.

> People want containers to be magic but they're actually a hard problem.

I work on a container orchestrator, so I understand some of the difficulty. :) Mobile apps are years ahead of desktop apps when it comes to containerizing in a user friendly way. Obviously there's plenty of work still to be done, but the problem is far from intractable and the benefits are enormous.

<comment><USER9> Mobile apps are a hellscape. It's an example of how wrong things can go. Apps treat their privilege model as a license to abuse all their privileges as much as possible.

Ability to read Contact list? Location access? Great let's upload it all to the Googbook analytics for data mining our customers.

<comment><USER7> But what's the alternative? No MAC and every app has all user privileges by default like most Linux distros?

I would argue the concept has not failed, just the implementations have fallen short. And for good reason! It's an extremely complex confluence of cutting edge technology, UX, security, privacy, etc. It's been improving, and surely the open source community can do it even better (or at least with a greater focus on privacy).

<comment><USER10> It would be nice to have a prompt when the phone asks for phone book access:

Allow Deny Fake

The Fake would just have generated names and numbers to pollute their data mining.

</comment></comment></comment></comment></comment></comment><comment><USER11> Largest issue I have with Snap is that it appears to assume the owner of a system is not in best position to make choices for their own systems.

Sure, this might be true for the average user, but it is toxic to the "super user" community that's in the best position to help support the larger community and may end up pushing them away.

Snap at the very least should have an opt-out feature, if not be opt-in during an install.

More criticisms maybe found here:

[https://en.wikipedia.org/wiki/Snap_(package_manager)#Critici...](https://en.wikipedia.org/wiki/Snap_\(package_manager\)#Criticism)

<comment><USER12> Super users should be using Debian. Not being snarky.

<comment><USER13> I'd expect users who go into Debian expecting some power-user version of Ubuntu to be disappointed. To be happy on Debian, you need to adopt their philosophy that stability is better than having the latest-and-greatest.

For those unfamiliar, Debian releases come out about once every two years, at which point all software in Debian's repositories is frozen at its current version. Software receives security updates between releases, but nothing else.

I personally think this is _wonderful_ , and I would absolutely use Debian if I was interested in switching to Linux (which I'm not, at the moment). Constant change is inherently frustrating, even when the changes themselves are a net positive (they often aren't). Debian's approach provides a level of reliability and consistency that is sorely lacking in most modern software.

So, while I also recommend Debian, I do so only if you too agree with the above paragraph.

<comment><USER14> Debian has stable, testing, unstable, and experimental repositories.

If you only enable stable, then you are signing up for very outdated software.

If you add `testing`, you get quite a ways towards having an up to date system, while still not having to worry too much about odd bugs.

Adding in `unstable` gets you about as close to up to date as you can get without compiling the source yourself.

Experimental is good to keep around, but in my experience most things skip it and just hop straight to unstable.

The beautiful thing about Debian compared to Ubuntu is that it actually _is_ a rolling release system. Ubuntu users have to worry about what version they are on. With Debian, you set what track you want to follow and just remember to install updates as they become available.

Because it's a rolling release, you're much more likely to catch small issues and be able to isolate what package is causing the problem, as opposed to doing a thousand package upgrades at once and then being snagged because one of them had an install issue.

<comment><USER13> Debian strongly advises against mixing repositories: [https://wiki.debian.org/DontBreakDebian#Don.27t_make_a_Frank...](https://wiki.debian.org/DontBreakDebian#Don.27t_make_a_FrankenDebian)

Debian Testing is an option, but would you recommend that over a distribution focused on rolling releases, like Arch? From my vantage point (which isn't particularly good, as a non-Linux user myself), most of the Debian project's effort is concentrated on producing Debian Stable. Case in point, security updates for Debian Testing are sometimes significantly delayed.

<comment><USER14> > would you recommend that over a distribution focused on rolling releases, > like Arch?

Everything about Debian except the `stable` repository is explicitly a rolling release.

> Debian strongly advises against mixing repositories

Certainly you wouldn't want to add in the other repositories if you're aiming for Debian Stable type guarantees.

This is the `sources.list` file that I've been using for nearly a decade:

       deb http://deb.debian.org/debian/ testing main non-free contrib
       deb http://deb.debian.org/debian/ unstable main non-free contrib
       deb http://deb.debian.org/debian/ experimental main non-free contrib

And then I have a preferences file that prefers testing to unstable to experimental (actually three separate files in the preferences.d directory, but I'd think you could combine them.

       Package: *
       Pin: release a=testing
       Pin-Priority: 700

       Package: *
       Pin: release a=unstable
       Pin-Priority: 650

       Package: *
       Pin: release a=experimental
       Pin-Priority: 600

It may not be advised, but it works pretty well. Sometimes you have to get a bit creative when you go to run `apt-get dist-upgrade` and it wants to delete half your system, but usually you can just manually install individual upgrades (`apt-get install <x>`) until it unwedges itself.

</comment></comment></comment></comment></comment></comment><comment><USER15> One of my big things with snap is how it locks the snap into the home directory. I get why they do that but it would be nice to override[1]. In my case I want to play audio files outside of my home directory but VLC doesn't have access. And VLC now only updates the snaps and not it's repos so you have to use the snaps.[2]

[1][https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1643706](https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1643706)

[2][https://www.videolan.org/vlc/download- ubuntu.html](https://www.videolan.org/vlc/download-ubuntu.html)

<comment><USER16> The website you linked ([https://www.videolan.org/vlc/download- ubuntu.html](https://www.videolan.org/vlc/download-ubuntu.html)) says:

> If you wish to install the traditional deb package, it is available as usual > via APT, with all security and critical bug fixes. However, there will be no > major VLC version updates until the next Ubuntu release.

This is in line with Ubuntu (and Debian) repo policies. You do not get major software updates in between distribution updates unless you use a third party repository. You do get bug fixes and security fixes, and/or can track unstable if you need the bleeding edge.

<comment><USER15> Ohh yeah I misread that

</comment></comment></comment><comment><USER6> This is a rant against snaps. Well, lets get to it.

Sorry, snaps are a LOT slower than just running a binary. Did I said they're slow, well they're slow.

I have an SSD and it feels like it's 1992 and I'm trying to run some snap from a Cyrix without cache and 16MB of RAM. I switch to binary version (oh my chromium), and it freaking flash, 0.x sec. and you're there, the full app is available.

Snaps are a NO GO my friends.

Besides having LOTS of problems running out of the standard GUI (Gnome3), or even in the standard (supposedly heavy-tested) GUI, they are slow.

Sorry, I've already said that uh? SLOW, that's snaps.

If there is somebody from Ubuntu here, please take a serious look about how snapped apps (pun intended), read/write $HOME defaults.

I mean we have to have defaults somewhere. So thingies like the colour theme, the theme engine, default download path, etc. are fully followed just as the user has configured them.

I use Ubuntu, but I certainly would not be using in the future if my applications which now take merely 0.x seconds to open start to take, 3-4-15! seconds to open. I fact I started to look to Debian and Fedora, they currently appear to have saner defaults than Ubuntu.

No, the second time I open an app in a session doesn't count AT ALL for the speed.

</comment><comment><USER17> As a package manager for my app snaps have really been an anti-pattern and we're considering removing support for them.

Here are some problems I've had:

\- snaps use a different directory than our main app. So if you install our debian package, then go to a snap package, all your data seems to vanish. It's just in another hidden directory. I tried to figure out how to get the directories to sync up but couldn't get it to work as it's yet 'another thing to support'. I only have so much time.

\- snaps have various bugs that you encounter after you've shipped the app that aren't present at build time. Mostly due to being in a container and 'reasonable' things not being accessible and needing to be granted access to via a configuration file.

The strategy I'm thinking of migrating to is to just distribute as a .deb and have our own apt line that is installed during the .deb installation. I think this is what Slack and other Electron packages have migrated to which is easier for them to support.

I mean conceptually it sounds great. Put your apps in a container. They will be isolated. Great. But in practice it's a nightmare.

To be fair though. MacOS has similar issues when they started going with isolation and privileges.

I think the main issue is that none of the OS maintainers spend a day in the shoes of a package maintainer. And if they did they don't care because they own the OS and many of these apps compete with your core product.

At least you have plausible deniability that your behavior isn't anti- competitive - you're just trying to improve the security for the user!

For example, Zoom got a ton of crap about their installer but they compete with Facetime which DOES NOT have to constantly ask the user for privileges. Apple granted Facetime these privileges via the OS.

From the perspective of a user, it's horrible.

"Can this app access your Downloads folder?"

"Can this app access your Webcam?"

"Can this app access your Microphone?"

"Can this app access your Documents folder?"

... and on and on ad nausea.

</comment><comment><USER18> Devils advocate: it is plain weird for every app I install to have so much file system and system access. It's nice to have a sandboxed solution built in. It would be nice if it was a solution that didn't have the problems that this article listed, but snaps could be adapted to be good with a few changes.

Why a proprietary backend though? I suppose cannonical views packaged apps as a platform opportunity and wants to be the first to "capture" the users without somebody bigger coming and taking over?

<comment><USER19> > Devils advocate: it is plain weird for every app I install to have so much > file system and system access. It's nice to have a sandboxed solution built > in. It would be nice if it was a solution that didn't have the problems that > this article listed, but snaps could be adapted to be good with a few > changes.

Exactly. Personally I have been sticking my desktop programs into "firejail"-managed "containers" for a long time. It's a good thing that a similar solution has been implemented that is suitable to bring this too the masses.

<comment> yjftsjthsd-h > It's a good thing that a similar solution has been implemented that is > suitable to bring this too the masses.

Couldn't you just make a "default-firejail" package that installs the symlinks to firejail somewhere that's before the default install install location in your path? And maybe consider installing that in the base install, but that potentially risks breaking things unexpectedly for users.

</comment></comment></comment><comment><USER20> I wanted to love snaps. I really did. I like the idea of a self-contained program that doesn't get into DLL hell, and can't stomp all over my system if it misbehaves, and can be cleanly uninstalled.

Unfortunately, snap comes with all of these extra issues that happen when the developer isn't empathizing with the user. Also, much to my chagrin, snaps don't actually uninstall cleanly, and can really hoop your system. I now install snaps INSIDE of an LXC container so that snap can't misbehave and break my system, or else if I can I just use apt with a custom repo (for docker because the snap is awful). Ubuntu 20.04 will probably be my last Ubuntu system, and that's a shame... I really liked it.

</comment><comment><USER21> The point of snap is you have one single package for all releases instead of one package for each release.

This reduces the maintenance burden, while also allowing you to have up to date packages.

The way this is done is by bundling all dependencies in your snap package rather than using the system ones.

I think it's a great idea for applications you want to be updated frequently, like VS Code, Chrome, etc.

It's not perfect, e.g. back end is closed source, but I'm glad Ubuntu is giving us options and being at the forefront of package management.

</comment><comment><USER22> I like Snaps. After the debacle that is Catalina, I built my first Linux desktop in 15 years. Ubuntu 20.4 worked perfectly out of the box, with Wayland and everything. Snaps and the Snap store are a huge improvement over the previous GUI interface to Apt.

I ended up settling on Silverblue, a Fedora derivative that uses an immutable base system along with Flatpak for applications, and it's been great. Equally trouble free, and Flatpak has many of the benefits of Snaps without some of the downsides (fully open source).

</comment><comment><USER23> I've been using Linux for 15 years as my daily OS, I love the package system, but this point of view is missing the point.

Those arguments are always from very tech saavy people.

They are a good exemple of purity over practicality, completly ignoring all the problems apt/yum have for the average user or dev publishing software.

If you are looking for reasons as why Linux on the destkop never happen, well, this is one of them.

</comment><comment><USER24> The whole snaps business was already annoying. Then my external monitor stopped being detected due to some issue with Nvidia graphics on (which probably is more Nvidia's fault then Ubuntu's). I'm using Thinkpad X1 Extreme Gen 2. Tried Fedora 32's live usb and basically everything worked but the installer didn't detect all partitions and didn't give a choice of choosing exactly what goes into which partition without offering to wipe-out stuff (they need to take a cue from the flexibility of Ubuntu's installer). Finally tried Pop!_os's live usb and everything basically worked + had no issues with the installer either.

I wasn't keen on using a derivative distro of a derivative distro; thought of using Debian but wasn't very confident if the issues won't persist on it. Considering everything just works perfectly with Pop!_os, I might just stick with it.

Ubuntu was such a breath of fresh air at the beginning (I still remember Dapper Drake). It is sad to see it going this way.

<comment><USER25> Say what you will of their hardware, but the system76 team really nailed pop_os. So many little things I was used to suffering through manually configuring on a fresh install were just "right" straight out of the box.

Supposedly they're working on tabbed and stacking layouts for tiled windows- if that is the case I don't know if I'll go back to i3 or sway again!

<comment><USER24> I don't have any experience with their hardware but I'll have to agree on the software front. I have a multi-port hub that I also connect the HDMI cable for monitor to; I connect the hub to the laptop its actually plug-n-play. I haven't had to run one command to hack/override configs etc.

I tried their tiling option but didn't stick to it because when I maximized a window and toggled to another, the original window went back to being tiled. Too lazy to remember shortcuts for tiling WMs (probably to my own detriment)

</comment></comment></comment><comment><USER26> Honestly this article had some poor arguments. Like Apt being fantastic-it isn't-see below. I do not see what the hate around snaps are for.

Yes, some snaps are not updated, and VLC only working in the home directory as another HN commenter said is a pain.

Snaps still solve a lot of issues on Linux that Windows does not have.

What happens if the new version of your editor breaks some well known plugins?

On Windows you just install the older version from the archives. On Linux you risk dependency issues. Snaps are a single command to switch to an older version. Very important in both the software and media space.

One option is to stay on the LTS version of Blender.

Another is back when I used Atom, one upgrade completely broke a popular plugin for me because of a change in Chrome. I thought it would be fixed quickly so didn't revert the package and I lost the older version in the cache. Took the Atom devs 2 weeks to handle the change to Google Chrome-then Arch maintainer of the Atom package didn't get around to upgrading it for a week or two after that.

Things like apt pinning really don't help you when you discover the issue on your main workstation. Also, doesn't change the fact that it is so much easier to revert on Windows. Snaps make version control even easier to do on Linux then Windows.

The back-end being proprietary is a good argument. but for a company that has worked so long with Linux and Free Software; give Canonical a little trust to release it.

</comment><comment><USER27> I honestly like snaps. I like having spotify and discord working as to his other concerns I just don't care.

<comment><USER28> Why not just get a Mac?

<comment><USER29> Not saying you're wrong, but if the response to people wanting to use linux is "Get a Mac" then that's problematic.

<comment><USER28> It isn't. I personally use both a Mac, and Linux. Openness is what makes Linux valuable. I have no desire for Linux to become like the Mac with proprietary parts of the system.

</comment></comment></comment></comment><comment><USER30> I'll take a contrarian/devil's advocate stance. for some applications and some usage scenarios, snaps makes a lot of sense.

Take a multi user system and users who run applications like chromium or firefox.

It's dangerous to upgrade the application while users are running them as the files the running applications depend on can change thereby making them either break in weird ways or force the end users to restart them.

if these apps were just distributed as snaps, it wouldn't matter. they would keep on using the old image without any problem, while new executions would get the new image. If one really wanted to encourage them to exit and restart (i.e. some security hole), the same mechanisms that exist today to get people to restart could be used.

with that said, I think it should be a choice, not something force down our throat. if I install something with apt/dpkg , I expect it to be an apt/dpkg package, not a snap. if I want to use snap, I'll install it with snap.

</comment><comment><USER31> You people do realize that snaps have been around for 4 years right? It has widespread first party support from various companies including Microsoft, Amazon, Mozilla, Google, Spotify, JetBrains etc...

They have wide spread adoption with almost 10x the install base of Flatpaks.

Do you guys really need to keep throwing blogs at something which isn't going away and is useful to users? How is this useful in anyway? Canonical isn't suddenly going to give up on this, and I don't even want them to.

<comment><USER32> The main point here is that Snaps take away control from the user. The user has no control over how and when apps update. The backend for snaps is proprietary and completely in control of Canonical. If they decide to shove ads down through Snaps, they can at any time. And the whole hijacking of the chromium apt package to backdoor in snaps without user consent is a move straight out of the Microsoft playbook

This feels very natural to what Apple, Google and Microsoft do on their OS. But Canonical seems to have forgotten that such behavior is what drove a lot of people to Linux. It is never going to be accepted. Nor it should be.

<comment><USER33> Very well said! I am afraid there is a prophecy in your description. I have started moving all of our infrastructure away from Ubuntu at work. This sounds horrible. 2020 has been bad enough for one year.

</comment></comment></comment><comment><USER34> In my opinion, AppImage solved the problem Snap tried to solve, yet without being horribly intrusive.

Kudos to Linux Mint for taking a stand in regards to it, and hopefully more Ubuntu-based distros do the same until Canonical gets the idea.

I don't think they're out there trying to be malicious, but they need to be set back to the correct path as it has been the case with odd monetization choices for Ubuntu before that didn't really benefit anyone.

</comment><comment><USER35> The anti-features of snap seem like business decisions. Making it easy for users to use alternative stores would kneecap Canonical's paid IoT offerings [https://ubuntu.com/internet-of-things](https://ubuntu.com/internet-of- things). Also, I wonder if the ability for developers to force software updates could be marketed as a kill switch for proprietary software vendors.

</comment><comment><USER36> My prediction (95% confidence): Snaps will become installable from Windows (via WSL) and Microsoft will buy Ubuntu and try to take over the installers for other Linux distros by having them use Snap as the main repo. This will be Microsoft´s long term app installer strategy

</comment><comment><USER37> Am I missing something isn't [https://github.com/snapcore/snapcraft](https://github.com/snapcore/snapcraft) and [https://github.com/snapcore/snapd](https://github.com/snapcore/snapd) Free Software under the GPL3.

I had seen some discussion before about the server not being open source but I can clearly see the store api there. I'm just looking at the code now and haven't taken any time in testing it out for myself yet.

Regarding debian packages and apt as we have seen with the amount of PPAs, there really has to be some solution for that. I like the snap format I believe it's heading in the right direction. It still has some problems with desktop software but that seems to be addressed as it has progressed.

There is this strange cold war between Red Hat and Canonical and Red Had seem to have most of the NIH problems if you look at the history. I really don't think Red Hat or some of it's developers possible like relying on code from Canonical.

</comment><comment><USER38> Snaps and flatpak help Linux work for me. My ideal desktop is a stable core with a few select user applications that I can keep current. Thanks to snaps/flatpak I can run Debian stable on my personal desktop, but keep emacs, firefox, and a few more apps at their most recent versions.

<comment><USER39> I'd like to point out that, as far as I know nobody or very few people have problems with flatpak.

<comment><USER40> There is flatkill.org, but that kind of comes across as FUD.

The privilege escalation attack looks a bit worrying, but aside from that it looks either the same/better as/then native packaging (Sandbox for some apps), or something that is on the developer (Out of date packages).

It's possible I'm misunderstanding something, if so please feel free to tell me so.

</comment></comment></comment><comment><USER41> I'm _fine_ with snaps.

As long as they are limited to applications (i.e. not OS components) and look reasonably like normal applications.

Why? Because you can't ask developers to package their apps for 100+ distros. And they let us run latest versions of apps on an otherwise stable/old OS.

<comment><USER40> Flatpak and AppImage would like a word.

</comment></comment><comment><USER42> Snaps, flatpacks, and other containerization solutions only work on systems with OSes set up in the last 5 years. Most of the containerization is justa symptom of the real problem: future shock re: underlying libraries (c++whatever,glibc, etc) and new features being used.

</comment><comment><USER43> i recently upgraded ubuntu and had to start dealing with snaps.. of the two i tried to install they were both out of date and i ended up using apt to great success. what was the point of this thing?

<comment><USER44> > of the two i tried to install

Which two? I mean, a package is only as good as its curator. That sounds more like a complaint about Ubuntu's Snap update policy or the community support for whatever you were trying to install than anything about Snap.

I don't understand the fuss here. People who want control over the open source software they install still have it, it still works like it always has. People who don't care can't even tell the difference.

And in a handful of situations, like large apps with extensive dependencies, or externally managed builds, or needs for cross-distro binary compatibility, Snap has real and tangible advantages.

<comment><USER45> I think the issue here is that the apt versions are not always maintained after an app moves to snap releases.

> And in a handful of situations, like large apps with extensive dependencies, > or externally managed builds, or needs for cross-distro binary > compatibility, Snap has real and tangible advantages.

I see that snaps can offer these advantages, but so can AppImage and FlatPak, and these are even more cross-platform and don't come with the same limited ecosystem.

</comment></comment></comment><comment><USER46> I think snap versus apt is a question of taste, in the spectrum black box just works vs hard to use but fully at the hand of the user. I'm currently having the same choice with python between pip and conda. At the end, Ubuntu was a very nice bridge between a use system that's just work, and server os for production (db, backend..). I hope snap won't make that old.

</comment><comment><USER47> snaps and flatpaks are something I've wanted on Linux forever: self contained apps. supporting umpteen million Linux distros is a non starter for small isv's (or even large ones). if they aren't perfect, fix them... but don't throw out the best thing thats happened to software deployment on linux in forever.

</comment><comment><USER48> I am currently using lxd to manage containers on a headless server. I just found out that lxd on Ubuntu 20.04 has snapd as a dependency, which seems a bit odd. Does anyone know if there is an easy way to install lxd without snap, or should I just ditch it and try some other lxc-container manager?

</comment><comment><USER49> I've been unhappy with the direction of Ubuntu for awhile, but having said that it's still the best collection of packages that install with fairly sane defaults for desktop/laptop. I've adopted a model of starting with ubuntu- minimal installation and just installing the debs I want (disable recommended packages by default). This gives me a fairly reliable base from Ubuntu but a system assembled how I want (except systemd, can't avoid systemd).

<comment><USER50> Honest question: why not fedora?

</comment></comment><comment><USER51> I've removed snaps on my new Ubuntu installs. Not sure how well this is going to work out in the long run but if things start to mess up I'll move back to LinuxMint.

</comment><comment><USER52> Are the arguments presented legitimate? Doesn't apt put the power in the hands of the distro developers and not the end users? After all they get to decide what is packaged and what is not.

Its all open source code so you can download and install yourself so I don't buy the argument about it being against the GNU philosophy.

Apt and snaps solve different problems. The only argument I can see here is the one about the back-end which is old and tired.

</comment><comment><USER53> ....6 years of NixOS, and I kinda forgot remember that elsewhere unprivilaged users and admins can't manage packages the same way.

<comment><USER54> How is the package situation on NixOS nowadays? Do you find you have to custom install a lot of software or are there native Nix packages for most everything you need?

What kind of learning curve should one expect if migrating from debian/ubuntu based distributions?

<comment><USER53> There are existing packages in Nixpkgs for almost everything. Home-manager has firmly emerged as the "configuration per user" tool. I might say, in fact, get comfortable with home-manager and then switch to NixOS, if cold turkey sounds like a lot.

Its a very, very different sort of distro, but if you know basic function programming and are willing to do some "unlearning", you should be fine.

</comment></comment></comment><comment><USER55> I'm still haven't had a chance to learn more about this. Can pls someone put in plain english what snap is?

</comment><comment><USER56> There are real issues with snaps but "apt/deb is a wonderful package management system and everyone is happy with it, at least the majority of Ubuntu/Debian users" is such an immature argument.

</comment><comment><USER57> If Linux is going to have any chance of replacing OSX or Windows for the vast majority of users it needs to have a uniform executable which Snapcraft seems like the best candidate for. Without a uniform executable a lot of developers won't target Linux which is a deal-breaker for a lot of people. Clearly its preferable to install common packages from a standard package manager, and there should be better controls of how snaps get updated for power users, but most potential Linux users want apps that work like apps on their phones. This means you install it from a GUI app store, have access to proprietary apps, and then the apps keep themselves up to date.

<comment><USER14> Desktop Linux doesn't really have the goal of replacing Windows or OSX. It's a hobbyist thing, target more or less at software developers, and I think that's perfectly fine.

Plus, the desktop is becoming less and less relevant every year.

I spend easily 10 hours a day probably at a traditional computer. My wife spends an equivalent amount of time I'd guess in front of a screen, but it's her phone.

</comment></comment><comment><USER33> The first I heard of snaps was while I was upgrading from 18.04 to 20.04 (I only do LTS for work servers). What drove _me_ away personally, was I had no idea what snap is and it was all over the place all of a sudden. After studying up I was like "no I don't want that, I want to have full control over my system".

I switched to Fedora Server. The packages are much fresher, the kernel is fresher. It is a "staging" area for Red Hat, which for me is a plus.

Goodbye Ubuntu. I've been using you as my primary Linux distro since version 6.06!

</comment><comment><USER58> Please, Canonical! unsnap snaps.

Bye bye Ubuntu if not.

</comment><comment><USER59> > The backend is proprietary.

GitHub is proprietary. I understand that some people don't accept that either. But if you accept and use GitHub, then you should have no problem with snaps on this basis.

Also, on this topic, consider this quote[1]:

"We did that experiment with Launchpad; the people who said they wouldn't use it because it wasn't open source were the same people promoting a closed source alternative. When we open sourced Launchpad, they said that they wouldn't use it anyway because Canonical was the primary contributor."

I am not saying that Flatpak is proprietary. I am saying that the focus on the backend not having source available is specious.

> Developer controls the updates.

Users CAN defer updates (eg. because they're on a metered connection, or they only want to update on Patch Tuesdays, or whatever). However, in the default arrangement they cannot defer them indefinitely. But in today's Internet- connected world, refusing updates forever is also anti-social and unacceptable, so I don't see a great loss there. However you can manually install a snap such that it never updates[2].

> APT does a fantastic job as it is.

No, it doesn't. It _is_ fantastic for distribution releases that don't change their dependency structure after release. It's _terrible_ for shipping new software to an existing distribution release. This is seen both in packages that must have major updates frequently (eg. Firefox, which added _a whole new Rust toolchain_ dependency that had to be backported into existing stable distribution releases). It's also seen in various third party apt repositories that ship software to users that break their systems by causing future upgrade issues because they mess with distribution-provided dependencies in a way that future distribution package updates do not know about. apt/deb also provides no application sandboxing for third party software that you might trust less than your distribution. If as a developer you've ever tried to ship software to users as deb/apt, you would know this. Complaints about it are all over the Internet and this has been the consensus for many years.

> Don't shove it down our throats, make it optional at least.

It already is optional. You can remove snapd and pin snapd in apt to a negative score to never have it installed again[3]. Chromium won't be available to you as a distribution-provided deb in Ubuntu 20.04 then, but nor is it in Mint.

[1] [https://forum.snapcraft.io/t/linux-mint-20-disables- deb2snap...](https://forum.snapcraft.io/t/linux-mint-20-disables-deb2snap- packages-and-snaps-growing-external-adoption-problem/17913/19)

[2] [https://forum.snapcraft.io/t/disabling-automatic-refresh- for...](https://forum.snapcraft.io/t/disabling-automatic-refresh-for-snap- from-store/707/269)

[3] [http://manpages.ubuntu.com/manpages/focal/en/man5/apt_prefer...](http://manpages.ubuntu.com/manpages/focal/en/man5/apt_preferences.5.html)

<comment><USER60> If you don't like Github (or if they make a change in the future that makes you dislike Github), you can use Gitlab CE, Gitea, Gitorius, git over ssh, etc. all open source options while still using the upstream git client.

If you don't like the Snap Store, well, get coding and be prepared to fork the client also.

<comment><USER61> And for the record Flatpak does not have any such limitation - while many people use Flathub to host flatpal repos, there are many more Flatpak repos available, including Distro hosted ones (Fedora has a system for building Flatpaks from Fedora RPMs and hosting the resulting Flatpak repos).

</comment></comment></comment><comment><USER62> I've never felt a desire or need to use snap at any point. Since we've been implementing CIS standards I've started nuking snapd on host bake.

Maybe it's a thing for linux on the desktop, but my time isn't worthless so I don't do linux on the desktop.</comment>


Show HN: Epictopus, a Collaborative Writing Platform - <AUTHOR> http://epictopus.ml/ <comment><USER2> I have a similar app I'm working on called Tome:

\- [https://tome.cfapps.io](https://tome.cfapps.io)

\- [https://github.com/d3sandoval/tome](https://github.com/d3sandoval/tome)

Mine is focused on collaborating on Poetry and other Prose. I'm currently working on implementing versioning and sharing features.

This looks like an awesome bit of competition! Is it open source?

</comment><comment><USER3> Just FYI: [https://bx1525ob52oz.landen.co/login](https://bx1525ob52oz.landen.co/login) , linked from the "Get Started" button at the bottom of the page, returns a 404.</comment>


BII HTML5 Is The Future Of Mobile Apps, But It Won't Come Fast - <AUTHOR> http://www.businessinsider.com/bii-report-html5-is-the-future-of-mobile-apps-but-it-wont-come-fast-2012-12

<comment><USER2> Love the phrase "a standard web browser" - having just written two web apps, I can attest that there is no such thing.

You can write an app that sort of works on most browsers or you have to bite the bullet and tailor a version for each of the major mobile browsers. Fair to point out that almost all of the code is the same but the differences are crucial - and where I suppose I earned my fee.</comment>


Ask HN: I have 10,000 IP addresses over 20 servers - how should I use them? - <AUTHOR> I have a network with 10,000+ IP addresses and 20 servers. Currently I rent the IPs out formats scraping proxies and am expanding into a VPN service like HideMyAss. Does anyone have any ideas for how I could better utilize these addresses? The average resource usage of the servers is a little more than 2% right now. <comment><USER2> If you don't come up with a good idea, please consider configuring Tor Relays[1] to donate your bandwidth to those who need it. You may have legal troubles though[2].

[1] <https://www.torproject.org/docs/tor-doc-relay.html.en>

[2] <https://www.torproject.org/eff/tor-legal-faq.html.en>

</comment><comment><USER3> Create an AS, present your IPs as a end point and route internally to ISPs - there will be ISPs who will feel the pain of no Ip4 soon and will pay and accept the routing headaches for access to another 10,000

<comment><AUTHOR> What is an AS?

<comment><USER4> Autonomous System <http://en.wikipedia.org/wiki/Autonomous_System_(Internet)>

</comment></comment></comment><comment><USER5> In what country are the servers and their IPs?

<comment><AUTHOR> All in the US with 1gbit ports.

<comment><USER6> Just keep the IP's quality. If you are underutilized then sell more.</comment></comment></comment>


RIP Mayor Menino a driving force behind Boston being an innovation hub - <AUTHOR> http://www.bostonglobe.com/metro/2014/10/30/thomas-menino-boston-longest-serving-mayor-has-died-age/zAuWXQ4ccPJSv7uuW0kcDK/story.html

<comment><USER2> He enjoyed being mayor so much, you could say the job really was keeping him alive. The genuine enjoyment that he got from his job was truly inspirational.</comment>


Gamification of deals - <AUTHOR> http://www.fastcompany.com/1774265/dobango-play2win-is-a-new-player-in-the-deal-marketplace

<comment><AUTHOR> Buying deals should be a fun and engaging experience. Not a boring email that goes ignored or sent directly to the trash bin.</comment>