Ask HN: how do you manage encrypted email? - <AUTHOR>

I've recently (re-)decided to make an effort to use PGP, and to convince others to use it too.  (My effort to do so: http://www.ocf.berkeley.edu/~rwl/encryption.html, linked from my .signature.) But I've run into a couple of problems fairly quickly.  If you use PGP regularly, how do you solve them?
1)  Reading encrypted mail that I sent.  If I need to remind myself what I said to someone, or recover an attachment, etc., I can't, because the only copy of my message is encrypted with the recipient's public key.  I could work around this by Bcc'ing myself on every message, but that would have the mildly annoying effect of duplicating all my outgoing messages; every time I were to look for a message I sent to Mr. X, I'd get two results, and I'd have to figure out which one was encrypted with my key to read it.
2)  Search.  The more serious issue is that I can't search encrypted email, whether I sent it or received it.  It is conceivably possible to search mail encrypted with my public key by decrypting it before running the search (though not encrypted mail that I sent, pending a good solution to problem 1).  However, that seems like it would be extremely slow in practice, and I am not aware of any software that would make this simple or practical.
I am currently using Mutt as a client for a local Maildir, with offlineimap and notmuch to download and index my mail, but I am willing to switch to a different setup if there is one out there that solves these problems.  What's frustrating is that both problems seem pretty obvious, and solutions are conceivable, but search results for practical solutions elude me.
I don't want to recommend to others that they use PGP if it means they cannot reasonably search their mail archive and read their sent messages.  What should I tell them to do? <comment><USER2> Regarding point #1, on OS X I manage my encrypted mail via Mail.app and GPGTools, which builds support into Mail.app. This automatically encrypts messages with the public keys of both the recipient(s) and yourself, allowing you to read your own sent messages.

<comment><AUTHOR> Thanks. How do you deal with the multiple copies problem? (Or is it all transparently handled by Mail.app?) Do you just not save copies of messages encrypted with someone else's key? keep your version in a special folder? etc.

<comment><USER2> GPGTools via Mail.app encrypts a single message with both keys rather than saving two copies with each encrypted to one key. When doing this via the command line interface you just need to specify each recipient when encrypting.

[http://stackoverflow.com/questions/597188/encryption-with- mu...](http://stackoverflow.com/questions/597188/encryption-with-multiple- different-keys)

<comment><USER3> What's the go to solution for doing the same on a Linux or OpenBSD box? I've been thinking of making the switch to some sort of *nix from OS X and I'd like to start on day 1 with 100% security practices. Moving to a new machine seems like the perfect way to start implementing everything in my life securely from the ground up.

<comment><USER2> I've never used Enigmail with Thunderbird, but it's the commonly recommended GUI implementation for Linux. Enigmail has a setting in the preferences to "Add my own key to the recipients list", which will let you decrypt your own sent messages.

</comment></comment></comment></comment></comment><comment><USER4> > The more serious issue is that I can't search encrypted email, whether I > sent it or received it.

The tools to do this simply don't currently exist, but GnuNet has developed an approach to convergent encryption of keywords which points to how one might implement this in an email system.

The first step to do this would be to run the email through an extractor. It might do things like extract keywords from the email text (perhaps all non- common words and their frequency), attachment file names, MIME types &c. This extractor would then encrypt or hash these keywords and add an entry into the index for each keyword/email ID pair.

As a simple example, let's take your first paragraph. It might reduce down to the following words/weights:

((convince 1) (couple 1) (decided 1) (effort 2) (encryption.html 1) (fairly 1) ([http://www.ocf.berkeley.edu/](http://www.ocf.berkeley.edu/) 1) ([http://www.ocf.berkeley.edu/~rwl/](http://www.ocf.berkeley.edu/~rwl/) 1) ([http://www.ocf.berkeley.edu/~rwl/encryption.html](http://www.ocf.berkeley.edu/~rwl/encryption.html) 1) (linked 1) (make 1) (others 1) (pgp 2) (problems 1) (quickly 1) (recently 1) (regularly 1) (run 1) (signature 1) (solve 1) (too 1) (use 3))

You might then hash each element with your keyword hashing key, to get the following:

(("bea916398ce5fafc4497d378fc4555d9" 1) ("c81dc4aa3b1ae95487f288b297f51a6b" 1) ("8b801b4290ce10372b400330c737858b" 1) ("80b3e9090ee572563e67ebdecdb9b936" 2) ("cdd4c4efda80451e4dd1ff340dd2ed17" 1) ("9d4bcdc88159f8d830384f1696c32c19" 1) ("cb7baeb2e45e5e9d69fcf37c4df25669" 1) ("707f687e23bbbce127970361fd6bda10" 1) ("e6656976f2c6944f7aefd16b5786d6cd" 1) ("df9c284344194e1887e56478ec655dda" 1) ("ec8e0c526c105fc8ebb1ebdf293cf717" 1) ("f2d031d514795444be32f18690f6961f" 1) ("270273a76f0d974c2a06f96d40e2430a" 2) ("46bd41b18d2de638bbd3c126cb4ed716" 1) ("d96c629e01788ed763529620f308bd0c" 1) ("2d5fe4b610334160f178a1977b7d1db1" 1) ("211d0c274e8fb59bbcfe6e74241c317a" 1) ("ae5360545c4e008ed683df468136a8b0" 1) ("d6a5babaa2da167ef4548e7c34b49f40" 1) ("adcf3cd322f7ce16ad015f4725ddbda8" 1) ("e7e89d9c445263f9835c483aabf4f453" 1) ("84f0d11faa98a86f9624df86bd71901d" 3))

And then you'd store your document ID (in this case, the paragraph ID) and the weight in the index under each keyword.

To search for "use PGP", you'd extract the keywords "use" and "pgp", then hash them with your hash key to produce "84f0d11faa98a86f9624df86bd71901d" and "270273a76f0d974c2a06f96d40e2430a", look those up in your index, see that paragraph ID and the weights 3 and 1, retrieve the paragraph, decrypt it with your decryption key and you're in business.

Interestingly, this same architecture works securely if the index lives on another system, so long as the keyword hashing is executed on your system and your hash key is itself secure. Thus, there's no good reason that Google couldn't offer keyword-based searching on messages that only you can decrypt—no reason except that they do not wish to.

<comment><AUTHOR> Hmm, very interesting!

> The tools to do this simply don't currently exist, but GnuNet has developed > an approach to convergent encryption of keywords which points to how one > might implement this in an email system.

What you describe sounds a lot like "fully homomorphic encryption" (given my pretty amateur understanding of that term). Is the technique you describe one that could be layered on top of PGP? Or does it need an entirely different crypto scheme?

<comment><USER4> > What you describe sounds a lot like "fully homomorphic encryption" (given my > pretty amateur understanding of that term).

Well, not really from a technical standpoint. Homomorphic encryption is about me encrypting 1 and 2, handing you #x8495 and #x7835, you executing (homomorphic-add #x8495 #x7835) to get #x1932 and handing it back to me, whereupon I'm able to decrypt it to get 3.

You can imagine why this could be cool: there's the potential for someone to be able to perform work on one's behalf without compromising one's privacy (imagine TurboTax working on encrypted data, with Intuit unable to know what one's finances are).

The technique I describe is different, but it does enable a similar end result: someone else can run an indexing/search engine on my behalf, and I can consult it to search my data without ever revealing that data to the engine- runner. The engine isn't really able to perform any calculations though.

> Is the technique you describe one that could be layered on top of PGP?

Well, it would work in parallel to PGP (or any other data-at-rest scheme). PGP would encrypt the plaintext, and this would be used to index the plaintext.

GNUnet uses this technique so that two different people can arrive at the same encryption for keyword searches (which of course has vulnerabilities, since one's adversary can perform those same searches); I use it so that the same person at two different times can index and search by keyword, and protect against an adversary through the use of a secret hash key.</comment></comment></comment>


Hiding JSON-formatted data in the DOM with CSP enabled - <AUTHOR> http://mathiasbynens.be/notes/json-dom-csp

<comment><USER2> The data attribute method is immediately what came to mind when I was reading the beginning of the article and it was referencing a hidden attribute. It seems much cleaner to me to pass the data through a data channel, rather than through the content of an element which then relies on CSS to remain hidden. Although it does require slightly (or more, depending on payload) space to escape correctly.</comment>


Doppio: JVM written in JavaScript - <AUTHOR> http://plasma-umass.github.io/doppio-demo/ <comment><USER2> This is cool. Not because it's useful or performant etc. but because it shows how simple java bytecode is.

After seeing this I wanted to know:

\- how many opcodes exist in the JVM

\- how easy would it be to create another language that compiles to the JVM.

\- how does the JVM represent basic data types

The list goes on. All because someone built a JVM in JS.

What happened to the hacker mentality of HN? Where's the curiosity gone?

<comment><USER3> This. I don't think enough people appreciate how the simple and clear the JVM byte code's design is.

Most platforms in use today are so complex. Take a look at x86, or one of the latest ECMAScript specifications. Even LLVM bitcode is a bit complicated compared to the JVM bytecode.

I think in programming language research, going forward, we need some research into "high-level bytecodes". I.e. bytecodes that capture high-level concepts in a clear and simple way.

<comment><USER4> I've actually found CIL to be simpler than JVM bytecode, even with additional capabilities. Simple addition is a good example:

JVM: dadd, fadd, iadd, ladd. Addition for double, float, int, and long data, respectively.

CIL: add, add.ovf, add.ovf.un. Addition, signed addition with overflow check, and unsigned addition with overflow check.

<comment><USER5> Those bytecodes happened because the JVM bytecode was designed to be easily interpreted, whereas CIL was designed for JIT compilation. So for example CIL's `add` opcode is missing info that needs to come from the context in which it is used and the JVM's `iadd` and variations are easier to interpret.

You can see this design choice even today in how the JVM and CLR work. The JVM starts execution in an interpreter mode, then gradually compiles pieces of code as it detects bottlenecks. So the compilation that happens at runtime is very gradual and based on runtime measurements.

The CLR on the other hand has done JIT compilation, with the ability to cache the compiled code for faster startup (e.g. Ngen). So it has been oriented towards ahead of time compilation.

Different trade-offs.

<comment><USER4> Sure. I tried to find information yesterday when I posted that regarding whether / how the `add` code handles differing types. Now since I'm not on my phone, I looked up the ECMA spec and it looks like CIL still only allows like types, with some minor exceptions involving `native int`. So it's just up to the compiler to make sure that actually happens and extend types as necessary.

</comment></comment></comment></comment></comment><comment><USER6> If you like Doppio JVM, you may find our project interesting too [http://blog.leaningtech.com/2017/06/announcing-cheerpj- java-...](http://blog.leaningtech.com/2017/06/announcing-cheerpj-java- compiler-for-webapps.html). Our approach is to rely heavily on AOT compilation of JARs to JS to achieve higher perf, while still supporting full reflection. Moreover the RT is automatically split to reduce download time and bandwidth. A Swing application starts with ~15MB on our system. [http://cheerpjdemos.leaningtech.com/SwingDemo.html](http://cheerpjdemos.leaningtech.com/SwingDemo.html)

<comment><USER7> Also, see our follow-on project, Browsix ([http://browsix.org](http://browsix.org)), which makes it possible to run Unix applications inside the browser.

</comment></comment><comment><USER8> So now you can run the JVM in JavaScript running in the JVM....

For those who don't know the JVM comes with a JavaScript engine by default: [http://www.oracle.com/technetwork/articles/java/jf14-nashorn...](http://www.oracle.com/technetwork/articles/java/jf14-nashorn-2126515.html). And you can even get v8/nodejs to be compiled in your java jar binary: [https://github.com/eclipsesource/J2V8](https://github.com/eclipsesource/J2V8)

<comment> Capt-RogerOver This is very cool. You can basically even call all Java classes (and the other way around) from that JavaScript! (And reliably limit the classes that can be used if you want to execute JS in a safe environment.) Why isn't this used more often? (Or is it used more often?)

<comment><USER9> I can't speak to whether it is used more often, but I would bet the java-based Nashorn vm is significantly slower than the c++-based nodejs. In fact, a cursory google search shows this is the case, and it's not even close.

See: [http://blog.jonasbandi.net/2014/03/performance-nashorn-vs- no...](http://blog.jonasbandi.net/2014/03/performance-nashorn-vs-node.html) [http://pieroxy.net/blog/2015/06/29/node_js_vs_java_nashorn.h...](http://pieroxy.net/blog/2015/06/29/node_js_vs_java_nashorn.html)

(I can't speak to the quality of either of these tests, but the results seem decisive)

<comment> Capt-RogerOver While it is of course going to be slower, "it's not even close" is a judgement claim. The tests you have link talk about 1.6-2-3 times the difference. In a lot of applications the performance hit is going to be worth gaining access to the whole Java ecosystem of libraries. Also the performance is very likely to increase with newer versions.

</comment></comment></comment></comment><comment><USER10> I think it is impolite not to give accurate credit. It is Typescript... and not vanilla javascript.

[https://github.com/plasma-umass/doppio](https://github.com/plasma- umass/doppio)

<comment><USER11> May as well write Java.

<comment><USER12> How so?

<comment><USER13> Use Java to create bytecode which is executed in JS to produce JVM bytecode

</comment></comment></comment></comment><comment><USER14> Impressive, loaded a clojure.jar, got a repl and wrote/called some silly functions, it worked...

<comment><USER15> Of course, the Java bytecode has only a limited number of instructions.

</comment></comment><comment><USER16> I would like to run this in Rhino[1] - Mozilla's Javascript engine written in Java - just because. Turtles all the way down...

[1]: [https://developer.mozilla.org/en- US/docs/Mozilla/Projects/Rh...](https://developer.mozilla.org/en- US/docs/Mozilla/Projects/Rhino)

</comment><comment><USER17> I investigated trying to use Doppio for Peergos. It is a very cool project. In the end we decided against it because it wasn't fast enough for our use case yet, and it requires the page to download the whole JVM (at least the rt.jar - the runtime) which is >60 MiB. We managed to get around this by manually stripping out the parts of the JVM that we didn't need, which brought it down to a few MiB.

I imagine that once they update it to Java 9 with the modular JDK (and resultant splitting of rt.jar) this reduction will largely happen automatically with it lazily downloading the parts that it needs.

</comment><comment><USER18> A similar project from Mozilla: [https://github.com/mozilla/pluotsorbet](https://github.com/mozilla/pluotsorbet)

It was targeted toward running J2ME apps on FirefoxOS phones. With that project dead it's no longer under active development.

</comment><comment><USER19> Atwood's Law:

"Any application that can be written in JavaScript, will eventually be written in JavaScript."

<comment><USER20> Corollary:

"Any module written in JavaScript will eventually be ported to Go."

<comment><USER21> Done [0] and done [1]. Though, the latter one at least, isn't really in a production state because compiling the JVM stdlib takes hours in Go.

0 - [https://github.com/zxh0/jvm.go](https://github.com/zxh0/jvm.go)

1 - [https://github.com/cretz/goahead](https://github.com/cretz/goahead)

</comment></comment></comment><comment><USER22> See also luje. "An experimental (read: toy) Java virtual machine written in pure Lua."

[https://cowlark.com/luje/combined.html#index](https://cowlark.com/luje/combined.html#index)

</comment><comment><USER23> Does it run java applets?

<comment><USER24> Java applets for JVM written in TypeScript transpiled into JavaScript will be the next big thing. Freeze any browser, anywhere, instantly. Imagine the print out of stack trace with error - so exciting.

</comment></comment><comment><USER25> (2014)

</comment><comment><USER26> "Any application that can be written in JavaScript, will eventually be written in JavaScript." \- Jeff Atwood

<comment><USER27> So, every application will be written in JavaScript?

<comment><USER16> Every application that can

<comment><USER27> Very few can't

</comment></comment></comment></comment><comment><USER28> There is also TeaVM:

[http://teavm.org/](http://teavm.org/)

</comment><comment><USER29> This is actually quite awesome.

</comment><comment><USER30> Would be cool if it could run GUI programs!

</comment><comment><USER31> JVM written in Javascript, what could be wrong?

<comment><USER32> Don't worry, it has Nashorn ;)

<comment><USER33> Like Taco Town :D Run Javascript in the JVM in Javascript

</comment></comment></comment><comment><USER34> But... why??

Edit:

> This paper presents DOPPIO, a JavaScript-based runtime system that makes it > possible to run unaltered applications written in generalpurpose languages > directly inside the browser.

Someone should really have told them about webassembly...

<comment><USER35> The first commit to Doppio was 13 Feb 2012

One year before asm.js appeared, in Mar 2013

Three years before WebAssembly appeared, in June 2015

Five years later, In 2017, WebAssembly still doesn't have a GC and cannot run the Java/Scala/Groovy programs that Doppio was able to run in 2012

<comment><USER36> Doppio's lineage goes back even further than 2012. A "JVM in JS" was given in Emery Berger's 691ST course in the fall of 2011. My notes show that I submitted my "finished" JVM on October 26, 2011. I say "finished" because it became obvious rather quickly that a lot of things would be difficult if not impossible in JS (like threading and synchronization) and so we negotiated with Emery to come up with a subset of Java that we could reasonably implement for a class project. IIRC, there were 6-8 VMs written that semester.

Doppio proper (the repository you refer to) started during the spring meeting of 691. Those guys went above and beyond the minimal spec we implemented, and they tackled a lot of stuff that we thought was impossible. Thus the research paper.

IIRC, we also had to write a decentralized chat program in JS that semester. That was also "fun".

Yes, I created a HN account just to post this.

<comment><USER37> Thank you. This is great work from both an engineering and scientific perspective.

</comment></comment></comment></comment><comment><USER38> > _(Read the academic paper)_

I admire the effort, but: doesn't "academic" mean "scientific"? Can there possibly be any "science" in having a well-known VM reimplemented in a well- known programming language?

<comment><USER39> Yes, in the sense that it's called "computer science" with little scientific method involved.

<comment><USER15> I got an error, so I falsified it according to the scientific method:

        Error extracting doppio_home.zip: Error: ENOENT: No such file or directory., '/persist/vendor/java_home/lib/images/cursors/cursors.properties'

<comment><USER7> File a bug report, please. Doppio is actively maintained, though our current focus is on Browsix (which incorporates and extends some of Doppio's functionality -- see browsix.org).</comment></comment></comment></comment>


Ask HN: Under quoted, late, no contract unpaid project - <AUTHOR>

Hi there, I am learning the hard way how to manage client. I am in the end of a contract, well without any contract, with a client. I quote way under because I wasn't clear on the work that needed to be done. I am really late on delevery of the contract - client is pissed and angry. And I only received part of a security deposit. I probably should have step away from the contract months ago, but I stayed with the process in the feeling that the project was just about to be done.
One major problem that arose, is that the brief for the project wasn't complete. It was in the form of, 'We want that part like it was, but make these change' 'This part leave it as it was working on the site' 'This part you can remove'. So I had to learn the site itself without knowing really what I was doing. Now that site was half broken on it's way out, and now it's not working anymore, so I cannot have the bigger picture.
Now the client wants the site done. I am not sure when it will be done since I don't have a clear image. They don't want to pay until the site is done, I need food so I work on other project at the same time, which makes me a lot slower on delivering on that first project. I invested hundreds of hours on that project, so I feel like walking away would be a huge loss, but the time I spend on this project I cannot spend it on paying project...
That seems the typical, I just started to freelance and getting the learning experience in! What would HN do with that project? The remaining payment is around 10 000$, which is quite substantial for me. <comment><USER2> Create a scoping document now. You need to put down on paper what needs to be done.

Find all the emails between you and your client that happened up until you sent the quote to the client. Put any requirements from those emails into your scoping document. That is what you work towards. Send this to the client to sign off on.

Gather any requirements asked for since and put that in a new scoping requirement for releases 2, 3 and 4 if need be. Send these to the client to sign off on.

Explain to the client that you are happy to deliver what is being asked for, but you will need payment on delivery of the first release, and each release after. If you have to split the $10k up over different releases, do so, but explain to them that as the scope of the project has evolved you will have to charge for the extra work that has fallen outside of the original project.

All that said, if you are skipping actual paying work to try and get this to work, you are missing out twice. You have already sunk a lot of time into the project for potentially nothing. Don't skip your baths on the chance that it rains.

<comment><AUTHOR> That's what I was wondering about. Seems like there is a lot of dirty clothes to clean at this point. I sent an email to the client yesterday to sit down and talk, instead of them sending angry email of 'Why isn't this ready- and how about that part - and this part which we never talked about'. Not only that, but there is an intermediary person between me and the company. And there seems to be another intemediary person between her and the 'bosses'.

If I take one thing from that is learning to work 16 hours a day for many days in a row. I am getting tired but at least I know I can put the extra effort when needed, as long as it doesn't stay like that for too long.

<comment><USER2> Yeah mate at this stage I would work out a timeline for the next six months and if this project can't fit in you're better off getting rid of it. It sucks for everyone involved, but if things are going to carry on the same for the next 6 months you might as well end it sooner rather than later.

</comment></comment></comment><comment><USER3> Aside from in the future work with a contract, I would also recommend breaking all projects up in to phases with incremental payments. That way you are satisfied the client is paying and the client can verify they are happy with the work. And you'll find out if there are going to be issues early on.

Sounds like things are getting out of control with this project as far as scope and payments.

I would setup a scope of work in phases for what you quoted initially. Note what is completed. Then setup a reasonable time frame to complete the remaining items along with incremental payments and an initial payment to cover some of the work you completed above the initial deposit.

Be careful with this as far as when you can complete it and how much payment you expect. If things are way more work than they should have been now is the time to ask for extra time/money. And if you can pad your schedule some I would do that as well so you meet all the remaining deadlines to keep them happy and paying.

This will document that you have far exceeded what they have paid for so far . . . in their initial payment.

Once you have this, contact them and let them know you are committed to completing the project this is the time frame and payment schedule you are proposing to make it happen.

If they balk at doing this I would indicate you will send them an invoice for the work completed beyond their initial payment and you'll be happy to provide their next developer with a summary of the status of the project to get them up and running.

Follow up and send them an invoice for the % of work completed. Best case they pay this . . . but this is mainly to allow them to screw you by not paying this invoice and not think about trying to ask for their initial deposit back.

They might not be as mad as you think and just want a cost/time frame for their project so if the scope is out of line you could even propose more fee. To cover items they have added or if the existing app was in bad shape.

You should probably weigh if you'd be happy getting away from this project with just their initial deposit. If so you might want to try to go the invoice for % complete route and move on to other projects.

Good luck.

</comment><comment><USER4> I'm not a freelancer so my advice may not be practical. Talk to your client, let them know 1) you are committed to finishing the project 2) you don't know how long it will take 3) you want to better understand your client's needs, and in doing so, you can get a better idea of how long it will take.

Let them know that because you are a freelancer, you have other contracts too, so that will be a factor in determining how much time it will take to deliver for them. It's reasonable to say that not having any of the project fee will mean you need to have more parallel projects to pay the bills, and you might see if you can get some amount for work delivered so you can scale off other contracts and dedicate more time to them.

</comment><comment><USER5> The advice so far is very sound; I will add this as well. In the future, work with a contract, and never work without one again. This first thing to do in future projects is define the scope and make sure that both you and the client are in agreeance on what will be delivered and when for how much.

For this project, the blame is entirely on yourself. That is not meant to be harsh. No contract, you were not clear on what you were doing but took the job and did not set expectations correctly. This is a learning experience - communicate where you are with the project to the client on a regular basis from now on.

</comment><comment><USER6> Another way to look at it is the time spent already is a sunk cost.

Figure out how much time it will take you to finish, and your effective hourly rate to get the remaining $10k. If it's a reasonable hourly rate, go ahead and finish. Otherwise, walk away.

Also, that's why it's better to work hourly rather than fixed-price. That way you avoid arguments when the client increases the scope.

You don't need to always have an airtight contract. What I do is make a limit on how much I'm willing to risk, and once that limit is reached I stop working until I get paid.

</comment><comment><USER7> Do you want to walk away from it, or try to complete it? Your post doesn't seem to say, so I'm not sure, but it does sound like a bad situation where it may be in everyone's best interests to move on.

Don't obsess about the time you spent on it. It is a sunk cost; try not to let it bias you against the best course moving forward. Instead you might consider:

1) How much deposit did they make? Can you afford to walk away and return this amount?

2) What is the best case scenario if you proceed? $10k is a lot (although not that much if this is a 250-hour project) but are they likely to pay it? Without a contract?

3) What is the worst case scenario if you stop the project? Are you incorporated, in case this comes to legal action? Feel free to ask a lawyer for a free consultation to find out more.

<comment><AUTHOR> My plan is to finish the contract - but not held hostage by it. Trying to find the best solution for everyone.

I can't afford to walk away and give back the deposit at this point. The client seems serious enough to end up paying. I might have high hope as well since they're German (why do I trust them more is probably just a preconceived idea).

The site itself is live and 95% working for the user. There will still be a big part of administration and management that I see coming shortly - which is working as far as I can tell but will be another story when they start managing their site.

I have talked to a lawyer, but at this point I got told, since it was international online business stuff I needed to get a specialize lawyer and would need to put the money down first. We aren't incorporated yet, just moved from freelancer to owning my own business. I am not too worried legally at this point, I am more worried about tears and sweat - and the negeative impact it has on the other part of my business.

Thanks for the comment, it help just to put it out there and see different points of view!

</comment></comment><comment><USER8> Future advice: at the beginning, sit down with clients and draw up a comprehensive list of _specific features_ they want created. Quote them for this exact list. Any adjustments, updates, new features, etc.--charge an hourly rate.

Don't feel like a dick charging for every single little feature. An hourly rate guarantees fairness. If the feature only takes ten minutes to add, great, they're only paying ten minutes of cash. If the feature takes longer, you deserve to be paid for that too.

<comment><USER9> I lost 2K this way many years ago. Didn't have a contract. I didn't get the money. It was like 2K or something. It felt bad but I got over it. Learned a lesson.

Another freelancer who was there bragged how he had a lawyer on retainer. I didn't get into freelancing much so don't know how good of an idea that is. Would love to hear best practices.

</comment></comment><comment><USER10> Easier said than done but: Fire the client, cut your losses and move on. Be direct - tell him/her that the project wasn't managed right, their expectations are out of line and there is no end in sight.

Don't try to convince your self you can fix the project. Faster you get away the faster you can get new clients that you will be able to manage better.

Also don't panic: everyone learns the hard way to manage clients :)

<comment><AUTHOR> I hear you with that. It's hard to let go of something you sunk hundreds of hours. It would be quite healtier to just fire them and move on. It would have a tremendous positive effect on my days on my business.

I am thinking to do it in 2 phases. I am finishing the last wave of update to the site today or tomorrow. From then on I'll let them know as I said to them previously if the want any other update/changes, they have to pay if not the contract is done. At least I give them a bone, and if they pay I am willing to continue the relation.

Yes indeed, it was the hard way to learn to manage client. Although I read about it so many time, I just jumped in hoping it wouldn't be one of those...</comment></comment>


Firefox 57 available - <AUTHOR> http://ftp.mozilla.org/pub/firefox/releases/57.0/ <comment><USER2> While I did download this, I feel like you should let Mozilla decide when it is released. Last minute release chaos is common, in which case they might go live with a point release.

</comment><comment><USER3> If anyone is wondering, it should evergreen tomorrow: [https://wiki.mozilla.org/RapidRelease/Calendar](https://wiki.mozilla.org/RapidRelease/Calendar)

</comment><comment><USER4> I wonder why so much news about firefox ?

<comment><USER5> No one was expecting they're resurrect from their ashes and come up with sucha wonderful product.</comment></comment>


Atari Has a New Console in Development - <AUTHOR> http://www.shacknews.com/article/100374/atari-has-a-new-console-in-development-ceo-says <comment><USER2> The real title should be "The company formerly known as Infogrames is developing its first console".

Hasbro purchased the brand name and IP of Atari in 1998, then sold it to Infogrames in 2000.

Infogrames officially changed its name to Atari SA in 2009.</comment>