Most use cases of ActivityPub would be better off as Atom or RSS feeds - <AUTHOR> https://beesbuzz.biz/blog/2535-ActivityPub-hot-take <comment><USER3> I feel need to address some points of the authors (I realize it's a hot take so it's meant to be biased):

> But what does this buy us? For the most part it means that every piece of > content everyone writes needs to be replicated to every point in the > federation mesh to be useful.

This is because ActivityPub is tied to RDF and linked data concepts. This isn't specific to ActivityPub, just a criticism of the linked data web. As we will see later, the author doesn't quite understand that linked data can be fetched only on demand and represented otherwise as only an IRI, reducing data replication to a minimum. It depends on the specific ActivityPub implementation.

> This isn't creating a distributed network, this is creating a whole bunch of > massive points of failure.

This is a pretty ungenerous characterization. It's a distributed system where robustness is not a part of the protocol. It needs to be solved elsewhere, so innovation is needed.

> Meanwhile, what does this buy you? Immediacy of updates? Okay, does it > really matter how quickly you see someone's new content, if it's worth > seeing?

I think this is another ungenerous characterization. It buys a federated set of communities and applications that can exchange linked data in real time.

> For example, user-agents and RSS providers can use the If-Modified-Since: > header to only get the feed updates if the content has changed since the > last fetch.

ActivityPub also has a diffing system of data in place with Update activities too.

> Oh, and ActivityPub stuff generally also means that all attachments and > other content also get replicated.

This is not true and is entirely implementation specific. If Mastodon creates local caches of federated data, that's it's design choice. Other applications can always fetch-on-demand and go back to the Pull Model.

That being said, static sites are not served by ActivityPub so that portion of criticism is definitely spot on.

<comment><USER4> For me, a key negative witb ActivityPub is the complexity. The RSS/Atom spec is pretty simple, and it fairly easy to see how it could be extended to allow for similar functionality. What are the disadvantages to an RSS based system?

<comment><USER5> RSS is poorly specified, and cannot handle any feedback.

Atom is well-specified, and has provisions for feedback. But what user agents / popular libraries / whatever else actually uses the feedback (commenting) features? Which servers that serve Atom feeds support that, too, and how well?

</comment></comment></comment><comment><USER6> This reads pretty distinctly like "Get off my lawn you damned kids with your attempts at decentralization!". ActivityPub is a pretty new protocol and what it looks like in the wild is still evolving - but it's clear it's filling different voids then RSS.

Sure, you could probably force most of these cases with some hacked up RSS implementation, and I can also use a longsword to mow my lawn. I'm personally very excited to see what ActivityPub brings with it and projects like PeerTube show that it's an extremely capable protocol even if we're still learning how to best use it and implement it.

<comment><USER7> Well, an alternative reading of this is "maybe we can solve _some_ of the same problems with IndieWeb principles instead of ActivityPub."

[https://www.indieweb.org](https://www.indieweb.org)

These are not "hacked up RSS"; they're just RSS (well, more often Atom or JSON Feed) combined with other technologies like webmentions. These are all, like ActivityPub, IETF recommendations/standards. I've mentioned Micro.blog before, but it's worth mentioning again: it's a centralized server producing a Twitter-esque timeline, but the sources of posts might be individual blogs using any number of different blogging engines. When I post articles to my WordPress site, people can reply on Micro.blog and have those replies show up both in their timelines and as actual comments on my blog. (And in fact, behind the scenes, a "hosted" Micro.blog site is actually using all the same technologies, with Jekyll as the blog engine.)

As much as I like many things about Mastodon, I'm not convinced that it's a superior _philosophy_ to Micro.blog's; the dark cloud to federation's silver lining is that the admins of any instance that your social graph connects to (that is, you follow someone on that instance and/or vice-versa) can break those connections without warning and with no recourse to you, beyond moving to another instance and hoping it doesn't happen again.

And, speaking more generally, I think the author definitely has some points that shouldn't be dismissed out of hand: it's possible that ActivityPub might indeed be better than other feed protocols at solving certain problems, but it's worth looking at each use case and asking if that's really true in _this_ case. PeerTube might be one that ActivityPub excels at and that feeds don't, for instance. (I don't see anything about PeerTube's implementation that proves what it's doing with ActivityPub couldn't be done just as easily with, say, JSON Feed, but I haven't dug into that.)

<comment><USER8> I think the main draw of Mastadon is that it's an intentional experience, with blessed clients, discovery, etc etc. I'm unlikely to read _anyone 's_ blog if it's not put in front of me somehow. Furthermore, all I need to do to interact is install the client; I don't need my own site to do it.

Overall I think your argument is very strong if you can provide a comparable experience to mastadon. If not, then it's not clear why the benefits are worth it.

<comment><USER7> Micro.blog proves it's possible to provide a comparable experience--in some ways I prefer it, although that has much more to do with its aesthetics and nascent culture than any underlying technology. At any rate, if your blog is hosted on Mastodon itself, you don't even have to know it's a blog, per se-- you can just use it exactly like Twitter.

The catch right now is that Micro.blog is a paid service. I don't see any reason why someone couldn't set up something very similar built on the same tech--other than, of course, the willingness to put in the time and money. :)

</comment></comment></comment></comment><comment><USER9> I'm not an ActivityPub user, but this post remindeds me of the initial comments to "Show HN: Dropbox" [1].

"For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem."

1: [https://news.ycombinator.com/item?id=8863](https://news.ycombinator.com/item?id=8863)

<comment><USER10> I wonder how that user feels about always being referenced in this context.

<comment><USER11> Five months ago:

> It's funny how often that comment—which I made as a 22-year-old > undergrad—resurfaces. Someone even reached out to me 2 weeks ago because > they wanted to use it in an article as an example of "the disconnect between > the way users and engineers see software"!

> I like to think that I've gained a lot of perspective over the last 11 > years; it's pretty clear to me that point #1 was short-sighted and exhibited > a lot of tunnel vision. Looking back, though, I still think that thread was > a reasonable exchange. My 2nd and 3rd points were fair, and I conceded much > of point 1 to you after your reply (which was very high quality).

> Obviously, we have the benefit of hindsight now in seeing how well you were > able to execute. Kudos on that!

</comment></comment></comment><comment><USER12> I agree with those statements.

That is why we are using Atom on top of Pubsub in XMPP to built social networking features. The sub-layer is changing (Atom is embeded into Pubsub XML on top of TCP real time streams, XMPP) but in the end the content is not "transformed" but just "transported".

Atom already provides most of what ActivityPub provides regarding the description of the content (rich content, attachments, external links, comments, reply-to...).

You just need to put it on top of a layer that specifies how this content can be accessed, subscribed and delivered. In our case it's XMPP Pubsub but it can also be pure HTTP requests. Good thing is that moving from one to another is pretty easy.

This is a static page generated from Atom articles published on a XMPP Pubsub feed from TechCrunch RSS/Atom feeds [https://nl.movim.eu/?node/news.movim.eu/TechCrunch](https://nl.movim.eu/?node/news.movim.eu/TechCrunch), we can even generate back an Atom feed from it easily. On a similar way you can handle personal "blogs" [https://firstname.lastname@example.com](https://email@example.com) with likes, shares and comments :)

The XMPP Standard Fundation is working for more than 10 years now on integrating those concepts together and glueing existing standards to deliver social-features next to IM features and so on...

You don't have to create "new standards that will cover everything else" (see [https://xkcd.com/927/](https://xkcd.com/927/)) if you can just glue the existing ones together.

</comment><comment> phoe-krk The author doesn't see the difference between ActivityPub as a specification and implementations of ActivityPub that make some implementation choices of their own. No one forces the AP clients or implementations to build local caches, no one forces them to replicate everything on their own.

</comment><comment><USER13> That's weird that you have to download from a whole other instance, I would have thought the client requests what it needs when it needs it, and points to some sort of UUID to another instance that can be queried later by a client.

I'm really lovestruck by the capabilities of ActivityPub and I want to work on a federated Tumblr alternative, but I just have not found the time with all the personal stuff I have going on currently, but ideally you wouldn't store everything on your instance (unless you rather cache it, now THAT makes perfect sense to me) you would let a browser request certain things via AJAX and maybe your instance could tell the other instance, hey guy you keep asking me for this waaay too often, can you cache it for me? kthxbai and those who don't do it would be considered broken instances and possibly rejected? Not sure I feel like the protocol is still way too young. Also not sure about the security implications but let's assume that sane SSL cryptomagic is a requirement for blogging instances (or just all of them).

<comment><USER14> Pet peeve: it's "would have", not "would of".

A problem with opportunistic caching would be degraded user experience for the first user that sees some specific piece of content, since they'd have to wait (potentially for seconds) for their instance to fetch the content from the origin instance.

<comment><USER15> pleroma's media proxy is works just like that and the user experience is fine. actually, i've run instances that don't have caching configured and it still works fine (if a bit unfriendly to other instances).

</comment></comment></comment><comment><USER16> I like the W3C WebSub standard (formerly known as PubSubHubbub) which uses RSS/Atom underneath to syndicate content. The only catch is that it requires a publicly visible URL for callback. This is great for services like Feedly but may not work for individual subscribers who just want to use a client application and not run a server with public facing URL. But maybe, this is better than running a Mastodon server because we can still have the benefits of a simple Atom format and protocol.

<comment><USER17> > I like the W3C WebSub standard (formerly known as PubSubHubbub) which uses > RSS/Atom underneath to syndicate content.

While you can use Atom/RSS with WebSub, WebSub doesn't expressly use any particular syndication format (it can distribute any content directly, not just Atom/RSS feeds) and hasn't, IIRC, since one of the PubsubHubbub drafts (I think 0.3, but maybe 0.4.)

</comment></comment><comment><USER18> Yeah, I've long thought that the syndication that happens via server-server communication could be replaced with a smarter client. As far as UI goes, Twitter seems more like a browsable network, e.g. @ IDs, follower/follows lists, and those features seem to be key, not the specific transport. Would like to see something like Mastodon but based on RSS.

</comment><comment><USER19> Some weeks ago I replaced my long-closed Twitter and Facebook accounts with an RSS feed: [https://rinzewind.org/shared.xml](https://rinzewind.org/shared.xml). Given that 99 % of what I was doing there was share articles, this works pretty much the same (and it's troll-free!)

</comment><comment><USER20> It seems like you would want to support RSS, Atom, and ActivityPub to allow both news readers and newer things like Mastodon to work?

Maybe RSS could be dropped? Are there news readers that support RSS but not Atom?

<comment><USER21> > Maybe RSS could be dropped? Are there news readers that support RSS but not > Atom?

Unfortunately yes. Gnus has not gotten Atom support yet (people keep using external programs to translate). Also far too many feeds still output RSS instead of Atom. RSS is a horrible format and there is no reason today to use it instead of Atom.

</comment></comment><comment><USER22> Forget RSS/atom, use microformats2 h-feed.

[https://indieweb.org/sidefile-antipattern](https://indieweb.org/sidefile- antipattern)

And there is existing tech for the popular reply-like-repost UX for this, based on webmention.

<comment><USER23> Are there any feed clients that support h-feed? I'm legitimately asking. I was looking for a h-feed capable client (like a traditional feed reader with h-feed support) only a few days ago and came up with none.

<comment><USER22> [https://indieweb.org/reader](https://indieweb.org/reader)

Usually things that integrate more into the whole indieweb ecosystem, but some are (plugins for) more traditional feed readers.

</comment></comment></comment><comment><USER24> I actually dream about bringing Atom (as far as I understand it's better than RSS but RSS just seems a better brand-name for this, in fact in many cases when you click on a link that says RSS you'll get Atom) back, expanding it with social functionality like likes, reposts and comments, implementing it better (auto-generated feeds on many sites are pretty crappy) and popularizing generic feed readers so non-geeks would be able to interact with others' self- hosted blogs (like my blog built on GitHub Pages) as easy and fun as it they do with Facebook, Instagram etc.

<comment><USER21> > expanding it with social functionality like likes, reposts and comments

One of the problems I had with blog comments is spam. Blogger would queue up moderated comments and send you an email about them. The idea occurred to me that that was redundant and it would be better to cut out the middleman - <USER2> are getting email notifications about comments needing moderation, and email already had long established and much better spam filtering. Why not have people submit comments via email? That way you can also reply to people privately. This is also convenient for people who read their feeds via RSS-to- email or in newsreaders/email clients like Thunderbird and Gnus.

Another aspect of comments via email is that it is much more like a letter to the editor. Your blog posts are articles, and you can choose to update them with corrections and comments that people send in, instead of trying to manage a half-baked message board that is the standard LiveJournal/Blogger/Wordpress/Disqus comments section.

I think an easy and valuable way to get non-geeks to use web page feeds more is to provide the option to sign up for the feed via email, by offering a "newsletter" option.

<comment><USER24> I upvoted your response as your ideas are very reasonable but as for me, I don't like e-mail for a number of reasons, both psychologically subjective and technical.

The first things the e-mail ecosystem is to do to become more adequate to the modern day world are to deprecate all the codepages but UTF-8 for any part of a message (header included), eliminate the overquoting tradition (including full text of the message the message is a response to) and introduce an efficient thread tracing mechanism instead, establish a more reasonable signature culture (i.e. people and software to stop including redundant and useless information in the bottom of every message) and make Markdown a core part of the standard (while HTML should better be deprecated).

<comment><USER21> Those are all very good ideas for email. Part of it could be dealt with in RFCs, part of it by changing default email client behavior.

I also agree that email should be a personal preference. I think that DFeed[1][2] shows how open discussion systems should be built. DFeed provides a unified discussion system that is simultaneously accessible through email, NNTP, a web interface, and Atom feeds. That would be a really nice way to offer a comment discussion system on a blog.

[1] [https://forum.dlang.org/help#about](https://forum.dlang.org/help#about) [2] [https://github.com/CyberShadow/DFeed](https://github.com/CyberShadow/DFeed)

</comment></comment></comment></comment><comment><USER25> It doesn't seem very smart to download a whole RSS feed for users who tweet 5 times a day every time they do it, it's 9000 entries after 5 years. Incremental updates are fine and scale.

<comment><USER26> Push architectures are no panacea, they create problems all of their own. For example in an unregulated landscape like the Internet, it becomes difficult to impossible to control the flow of updates to any individual peer. Options are unsubscribing or dropping updates, resulting in data loss.

The equivalent scenario in polling land produces a better result: an oversubscribed producer that begins dropping requests will typically just cause a transient delay, as clients retry at a later time.

RSS feeds commonly _don 't_ include their full history - certainly this is true of the biggest providers like Blogspot.

Finally a good client will know to adjust its polling delay according to the traffic of a particular feed. This is a <5 line function, and something Google Reader was implementing a decade ago.

Pull-based systems of course suffer from latency, but they require vastly less centralized state and coordination than a push based system, and suffer from much less painful failure modes

Most exciting of all (in my opinion), is that pull-based designs can exist on top of all the infrastructure that already existed, rather than requiring dedicated active network components all of their own -- that's a whole lot of crap code we can avoid rewriting over and over again for the next decade.

</comment></comment><comment><USER27> Most use cases of new thing would be better off as old thing.

</comment><comment><USER28> I don't believe in federated solutions, but I'm also not sure if and when our end-user devices are ready for p2p.

<comment><USER29> P2P and self hosted stuff is what I want out of the internet, not SaaS style platforms. People's cable modems are _almost_ always on so it's reasonable for them to have some almost-always-on services behind them, but circumstances make it difficult to build viable P2P tech:

\- It's tough to monetize since true p2p software can just get pirated. You can't gatekeep to make sure people pay.

\- The shortage of IPv4 with the help of buggy insecure operating systems made closed-to-the-outside NAT standard, making peers inaccessible without manual configuration or some helper technology.

\- Data hungry government and corporations see independent communication channels as an obstacle to their goals. (See the recent story about five eyes pushing for backdoored crypto in Australia.)

<comment><USER30> I've always felt that NAT ruined the internet. It made it basically improbable that someone might host something at home like the internet was made for.

<comment><USER21> If you care about this, the best thing to do is to start using IPv6, and insisting on IPv6 support in any interactions with service providers (SaaSS, hosting, data providers, etc.) that you have.

<comment><USER30> All my sites support IPv6. My router is horribly old and doesn't. But, once it kicks the bucket, I'll be sure to get an IPv6-compatible one.</comment></comment></comment></comment></comment>


Co - <AUTHOR> https://github.com/visionmedia/co?foo

<comment><AUTHOR> As always TJ pulls off something brilliantly simple.</comment>


Apple does right by users and advertisers are displeased - <AUTHOR> https://www.eff.org/deeplinks/2017/09/apple-does-right-users-wrong-advertisers <comment><USER4> Which is exactly why as of last month bought my first iPhone. The pro privacy stance that Apple is taking is wonderful to see. No idea if anyone pushing this at Apple will ever read this but you have a customer for life if you continue to do so and will champion your products to their entire sphere of influence.

<comment><USER5> Is your iPhone more secure than an open source version?

<comment><USER6> AFAIK there's no such thing as a completely open source cell phone.

<comment><USER5> Unfortunately not. Even if there was, it's the mesh network they run on that breaks security - corporate & gov controlled cellular towers

</comment></comment></comment></comment><comment><USER7> It cracks me up how much the hn userbase has changed. Apple has traditionally been very user hostile, but they make some grandstand PR move and so many people fall for it like Apple cares about user privacy/freedom, etc.

As Richard Stallman said, Apple puts the user in a prison. Just because the warden is getting better at playing nice some of the time and making the prison more beautiful doesn't change the fact it is a prison.

In a free system, the users could have done this themselves years ago instead of waiting for Apple.

<comment><USER8> Unless you're installing AOSP android on your phone, you're in the same boat with Google. You're increasingly limited to what Google will allow on the play store. You may have some more flexibility, but to continue your analogy: android is a like a low-security prison run by gangs you may have more freedom but at the end of the day you're still on the inside and now you run the risk of getting shanked.

<comment><USER9> (Almost) All Android phones allow you to sideload apps without having to root, AFAIK. So you aren't really limited by the Play Store.

<comment><USER10> I have little idea about how the android market is. But when I had a rooted phone, the rooted market of apps/tweaks wasn't too impressive. I personally felt like iOS's jailbreak market was doing better even though it had dramatically shruken too. This is about 2 years ago.

So if the rooted tweaks and apps market isn't that strong for Android, how big would the side loading market be? I'm obviously thinking there's not much there. At least not for people where Google services and apps are included normally with Android like the US.

</comment></comment></comment></comment><comment><USER11> Yes, this benefits Apple customers. I'm pleased.

But it also attacks the revenue of the other 3 horsemen (Google, Facebook, Amazon). Which also pleases me.

If I was Apple, I'd mess with advertising, just because.

<comment><USER12> Apple knows this; in fact, I'd say it's their core business strategy. They did this before with the iTunes Music Store, and they will continue doing it as long as they exist.

Apple focuses on the mass consumer as their sole and perpetual customer. This allows them to maintain laser focus on solving the problems of the end users rather than solving the problems of an advertiser and forcing the solution on end users.

Apple's refusal to "innovate" on its business model has actually put them where they are today. Most other tech companies have other motives in making mobile devices: Amazon wants to sell you content, Facebook and Google want to show you ads, while Apple just wants to make the best damn phone out there and sell it at a very high price.

If the market definition of "best damn phone out there" starts to include "protects your privacy", Apple doesn't have the conflicts of interest that Google or Facebook do. I'm sure everyone else will eventually follow suit, but Apple is the only one with the capability to take the lead on privacy.

<comment><USER13> Oh spare me. Apple is waaay in bed with rightsholders when it comes to DRM. It's all wine and roses as long as you're 100% bought in to their ecosystem. Try playing your iTunes purchase on a non-Apple product and you're SOL. I fail to see how this solves "the problems of the end users."

<comment><USER14> > Try playing your iTunes purchase on a non-Apple product and you're SOL

What are you talking about? Did iTunes add back DRM? Around 2009 or so Apple made all of iTunes DRM-free and were, I believe, the first major online music store to do so. It was a huge deal; Apple published an open letter from Jobs on their home page and everything.

[http://www.nytimes.com/2009/01/07/technology/companies/07app...](http://www.nytimes.com/2009/01/07/technology/companies/07apple.html?mcubz=0)

"iTunes Plus refers to songs and some music videos* in high-quality AAC format that don't have Digital Rights Management (DRM). All songs now for sale in the iTunes Store are iTunes Plus."

[https://support.apple.com/en-us/HT201616](https://support.apple.com/en- us/HT201616)

and, as of 2014, you could kill DRM on DRM-ed iTunes purchases made before 2009 [https://www.wired.com/2014/03/kill-itunes- drm/](https://www.wired.com/2014/03/kill-itunes-drm/)

<comment><USER15> Movies are still generally protected with DRM. Do you know if you can play iTunes movies with a third party player (like VLC).

<comment><USER16> Who sells DRM free movies?

<comment><USER15> gog.com

Plus, not all DRM schemes are equal. One that is exclusive to Apple is worse (IMHO) than one that isn't. For example, I can go to a store and buy a DVD or BluRay disk that has DRM yet I am very sure that I can play it on every player I own.

<comment><USER17> As big of a fan of gog as I am and as much as I dislike itunes I think it's pretty disingenuous to compare their movie store to itunes. They have 56 movies on their store and I don't think any of them could be considered mainstream.

<comment><USER15> Oh I agree with you.

I was originally responding to the person that said the iTunes store doesn't sell DRM'd stuff. The movies definitely are but I don't know if the DRM restricts the movie to being played on an Apple device or if it uses some non- Apple DRM making it playable elsewhere.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Browsers are really where privacy needs to come from.

I know a lot of people have hopes for a legislative solutions, but I think the EU (also UK and others) "cookie law" really needs to make us consider how effective they can be. The motivation for the law was good. They put their finger in the right place. . We got nag screens and little improvment in privacy.

Not every piece of privacy legislation does as little as this, but I still think we need to be wary. Browsers, OTOH, are in a great position to improve user privacy.

Maybe instead of letters to parliamentarians, letters to browser makers?

<comment><USER19> _Browsers are really where privacy needs to come from._

There's only so much a browser can do against someone who can follow your IP address around. What we _really_ need is ISPs who randomize what the server sees from their pool of IPs and NAT it internally.

<comment><USER20> That would remove any way that you had to run a server on your home machines - trade one freedom for another?

<comment><USER19> Static IP is already an optional extra on most UK ISPs, so most people would lose nothing

<comment><USER20> It's an optional extra just about anywhere, but most routers have dyndns or some equivalent built in these days, and besides your address changes so seldom that you can run a server for a small group by just telling them the new IP when it changes.

<comment><USER19> Well, it's a trade-off. Personally I just use cloud VM now and don't run a home server anymore (previously I had DynDNS and would SSH X11 tunnel into my IRIX box from outside).

</comment></comment></comment></comment></comment></comment><comment><USER21> Was recently telling my dad about this. I might get an iPhone X just because of Apple's new stance on browsing privacy. I recently quit my ad-tech job and what FB/Google does with tracking is incredibly sketchy.

Glad to see a large company with leverage fight back.

<comment> blubb-fish Why not an iPhone 6?

<comment><USER22> Don't know why people are downvoting this, but the 5C just got "obsoleted" so that could mean the 6 is right on the brink of update oblivion. So that could be a reason.

<comment> blubb-fish could be - but the question is so stupid - not worthy to actually reply.

In the light of such pretentious behaviour I have no idea why apple users have a reputation of being pragmatic and down2earth. </irony>

<comment><USER22> I'm an apple user, perhaps even a fan. I don't have a clue why your comment was downvoted. Is it a lot? Maybe it's a misclick.

<comment> blubb-fish just joking. nonetheless my question was serious.

I wouldn't like to pay more than €500 on a smartphone. And ...,iP6 < €500 < iP7,...

Actually I am a happy Android user. But I don't like too much of my data in one basket. Which is why I would consider iPhone for my next phone.

But the praise of iOS regarding privacy is rather new. So my question aims at whether I could expect also the privacy for older iPhones or if this is only coming with newer versions.

Of course data safety is in this case a result of an Apple policy - <USER2> would affect all products - but possibly older iPhones still send too much data to Apple.

F.x. let's assume a Catalonian opposition politician who's investigated by the Spanish police and a judge decides his data should be searched. With this warrant they contact Apple. Would apple now send all their data about the guy to the police - how much do they have?

That's another question I ponder besides ad tracking policies.

<comment><USER22> Well, the data sending is (AFAIK) about the OS, not the phone itself. So if did they made this policy change for iOS 11 [1] then all phones that run iOS 11 get it. And honestly, the 6 is probably fine. They stopped updated 5C and before because they were 32-bit phones. I expect 6 and on to keep getting security updates, etc. for a long time. At least I hope so because I had planned on staying with my 6 for as long as I can.

For your spanish case, I would refer to the case of the US terrorists: Apple prefered to pay a fine to the US government rather than unlocking it.

[1] I think they've always had this kind of policy, for the record.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> I wonder if Apple will make it easier to block tracking pixels in emails. I know they let you turn off remote image loading in total, but this is a pretty blunt instrument and makes many emails hard to read.

I would love if they came up with a smart solution that blocked all pixels, but didn't by default block substantive images. This is increasingly important as new email apps come out that offer consumers the ability to easily send emails with tracking pixels [1].

1: [https://techcrunch.com/2017/08/18/rapportive-founders-new- st...](https://techcrunch.com/2017/08/18/rapportive-founders-new-startup- superhuman-is-what-gmail-would-be-if-built-today/)

<comment><USER24> You can load images on an as-needed basis in mail. Generally, any email that is solely images and has no text is not going to be worth looking at.

I can't see how defining 'substantive' images could ever work. The other issue is that email clickable links are often unique and tracked, so images are unfortunately only part of the problem here.

<comment><USER25> > _I can 't see how defining 'substantive' images could ever work_

You can't? Seems pretty straight forward, so long as you remember first and foremost that 100% accuracy is completely unnecessary. The "load all images" option can still be there, so all that's needed is a solution that's good enough to suffice the majority of the time and shape norms and standard-case. That leaves lot of low hanging fruit. To start with are basic heuristics like that there is no need in email for 1x1 or 2x2 or 3x3 or whatever pixel images, or images where the pixels are entirely set to transparent. A lot of tracking stuff, particularly mass scale efforts tied to multiple parties beyond the sender, is pretty blatantly content free for even a totally dumb static rule set. Slightly more smarts could be used to discriminate based on simple sender trust heuristics, such as whether the email is cryptographically signed, they're in your contacts book, whether you've ever replied or clicked through, etc. Finally this could be another area where, just as they did here with cookies, Apple applied some basic ML to answer the "likely substantive" question. Again, remember that failing here doesn't necessarily matter because it can still be an improvement over the status quo.

<comment><USER24> Sure, I agree that blocking pixel images and similar stuff like transparent images is an easy win, but the workaround for that would be for trackers to start supplying more substantive parts of the email appearance, such as company logos and so on.

<comment><USER23> Yeah, the question is what is the proportion of low-hanging fruit versus persistent actors. We didn't just give up on spam because "spammers will find a way around".

And if we can eliminate a bunch of low-hanging fruit (e.g., from consumers who don't care enough about tracking to put a trackable company logo image in their signature), that's better than nothing.

<comment><USER26> Just cache all images in apple's servers (even if the user doesn't open the mail) by default and tracking is useless.

</comment></comment></comment></comment></comment></comment><comment><USER27> Hopefully FireFox and-or IE will be the next to step up. I don't see Chrome stepping up until every other browser has.

<comment><USER28> Firefox, I doubt it. They love the ad money so biting the hand that feeds them is risky, never know who will feed them next and how much.

Microsoft might, even though Bing is profitable and in 2015 brought in ~ $1b a quarter [https://techcrunch.com/2015/10/22/bing-is- profitable/](https://techcrunch.com/2015/10/22/bing-is-profitable/) . Might be too much money for Microsoft to ruin it.

All Apple right I think, but if they wanted to hurt Google they could start a search engine, maybe by buying DDG.

<comment><USER29> DDG is not a search engine.

<comment><USER30> Can you elaborate? DuckDuckGo[1] sure looks like a search engine to me.

[1] [https://duckduckgo.com/](https://duckduckgo.com/)

<comment><USER31> OP probably means that DDG uses Bing search results to populate the index

</comment></comment></comment></comment></comment><comment><USER32> Would I be right to assume that safari on iOS defeats browser finger printing, given the absence of flash and the fact that you can't really customise the platform, adding new fonts, etc, so the entropy is close to zero?

<comment><USER33> It doesn't seem so, visiting Panopticlick[0] on my unmodified Safari/iPhone7/iOS 10.3.3 gives "your browser has a nearly unique fingerprint"

[0][https://panopticlick.eff.org/](https://panopticlick.eff.org/)

<comment><USER34> So, panopticlick marks down my browser because it doesn't unblock third parties that promise to honour "Do not track".

In what way is this bad? (Yes, I have third party cookies blocked. No, I'm not unblocking them.)

<comment><USER35> The more things you do that aren't like what everyone else does, the easier it is to single you out from the combination of those choices.

</comment></comment></comment></comment><comment><USER36> > Apple does right by users and advertisers are displeased

Looking at all the anti-Apple bile and conspiracy theory crap on this thread, it looks like the anti-Apple crowd are completely unhinged by it as well.

</comment><comment><USER37> I usually turn off 3rd party cookies in my browsers and it is fine with mostly all sites, but often I forget about that and can't log into few services, cause they implement logging in a somewhat wrong way. For a big example, Atlassian lost me (and my small dev department) because their auth is too complicated to fit in one domain, while all I wanted was a simple svn hosting backed by serious player, no matter the price. /mycookiestory

<comment><USER38> I'll write a theorem that every company ends up with single sign on, no matter how poor it is (oh hi Youtube, hi Ted Cruz).

</comment></comment><comment><USER39> From a consumer privacy standpoint, Apple has the advantage over Google that they are not beholden to advertisers for any significant portion of their revenue.

</comment><comment><USER40> you folks remember steve's letter on flash?

[https://www.apple.com/hotnews/thoughts-on- flash/](https://www.apple.com/hotnews/thoughts-on-flash/)

i'd love to see such thing wrt the ad industry whinging like this. it would be so great.

</comment><comment><USER41> Related: Check if your browser is currently allowing third party cookies [https://alanhogan.github.io/web-experiments/3rd/third- party-...](https://alanhogan.github.io/web-experiments/3rd/third-party- cookies.html)

</comment><comment><USER42> Beyond ads/retargeting, does this render analytics services useless? Will Google Analytics and Mixpanel show anyone who isn't a daily active user as "new"? Will Optimizely not be able to customize my site and have that be retained for that user going forward beyond a day?

</comment><comment><USER43> For the first time, I'm also tempted by an iPhone.

But, it's still a proprietary system, and there are far fewer open source apps in the App Store compared to the Play store.

Maybe I'm better continuing as I do now -- Android, but with Firefox + blocking plugins installed.

<comment><USER15> I think you are looking at it the right way. If the software you want to run isn't available on some platform, that should rule out the platform.

I've always had an Android phone and an iPad so I've tended to choose applications that are cross platform so switching is easy for me. I think my next phone is going to be an iPhone because I'm starting to feel like a sharecropper on the Google farm.

</comment></comment><comment><USER44> Does anyone have a guide as to how this affects things for ecommerce?

If I have a third party reviews module - Feefo, BazaarVoice etc. - will that work?

Is this the end for 'AddThis' and other tracker things marketing type insist on bulking the page load times with?

</comment><comment><USER45> If Apple really wants to do right by users, they need to open source their software.

I don't like any giant company saying, "trust us, our code is completely closed and we put up tons of road blocks for you unless you use it the way we say you should, but we take your privacy seriously. Trust us <EvilSmile />"

As long as Apple is a closed and secretive company, I won't consider them advocates for users.

<comment><USER46> If you have that view of Apple and don't trust them, then what would be different if the code was open source? You think they couldn't do a special "evil" build for devices where you can't access the binary and then provide the "non-evil" source for it?

</comment></comment><comment><USER47> Does that mean the feature is also present in chrome on ios? Or is that controlled by the interface?

</comment><comment><USER48> why don't site and advertiser just set up a subdomain of the primary site, and point the DNS to an ad server?

<comment><USER48> (maybe this is just too much work?)

</comment></comment><comment><USER49> This is all lovely and all, but... cookies?

If I were an ad network, I'd long ago switched to local storage and browser fingerprinting. Especially if it's my very survival as a business is at stake.

<comment><USER50> The localStorage is not readable across sites. Cookies are. The issue is mostly with 3rd party cookies which many in the industry rely on to do tracking.

<comment><USER49> My main point was in browser fingerprinting.

LocalStorage is just an icing on top to better cross-reference users in the scope of the same site.

</comment></comment></comment><comment><USER51> "Does right by users" is quite a claim, to deprive users of targeted advertising.

Be aware of this - we all know advertising is abused, and has tired users - but it's tricky to find a vendor of hardware being the gate keeper of such stance.

Next step is main media groups start to block safari browsers.

<comment><USER52> > deprive users of targeted advertising

Poor users, deprived of the joys of targeted advertising :(

<comment><USER51> You would rather be blasted with pet snake food, hemorrhoids cream and nail polish - over the laptop with a drop in price after you visited a website and added it to the cart.

But if giving all your biometrics data to Apple and limit yourself to their brand is the way to go - mate, you're using the right products. In a near future your world will be all-Apple, and you won't even notice.

<comment><USER53> ? You don't give your biometrics data to anyone when you use touch or faceId. Are you sure you know what you're talking about?

Right now Apple _might_ be a dominant share in the SmartWatch category but certainly not in any other category they produce products in (phones, tv boxes, computers).

In a current future some people buy almost everything through Amazon, do all their socializing with Facebook, and do all their e-mailing and internet searching with google. All three of those comoanies track you as you go around the web and exploit every little bit of information they can to build expansive profiles about people in the world.

Apple doesn't track you around the web and is (and has, they stopped apps from tracking users in particular ways in the past) activitely making it harder for entities to follow you around the web.

Kudos to Apple.

<comment><USER51> > ? You don't give your biometrics data to anyone when you use touch or > faceId. Are you sure you know what you're talking about?

That data is stored in your phone - when the FBI has to ask permission to Apple to have access to a phone, that phone doesn't belong to you - it belongs to Apple. They can blast through your door and get through everything you have - phone records, phones, laptops, photos, documents, even your bank account. But not your Apple smartphone - that's some fucked up shit going right there.

> Apple doesn't track you around the web and is (and has, they stopped apps > from tracking users in particular ways in the past) actively making it > harder for entities to follow you around the web.

Apple doesn't need to track you around the web - Apple knows who you are. They just don't want everyone else to know who you are - keep you locked up.

<comment><USER54> > That data is stored in your phone - when the FBI has to ask permission to > Apple to have access to a phone, that phone doesn't belong to you - <USER3> > belongs to Apple.

Not even Apple can gain access to the secure enclave as this older article explains: [https://blog.cryptographyengineering.com/2014/10/04/why- cant...](https://blog.cryptographyengineering.com/2014/10/04/why-cant-apple- decrypt-your-iphone/)

The SE has advanced further since then, with Apple's stance appearing to be even if compelled by law they would rather be able to say there is nothing they can do to help.

</comment></comment></comment></comment></comment></comment><comment><USER55> Two things:

1\. Methinks the advertisers doth complain too much. iOS devices have essentially no way to block advertising. Not in the browsers, not by configuring certain settings. Advertisers should count their lucky stars over this.

2\. Don't assume altruism here. Apple is a gatekeeper of very valuable data for advertisers. Afaik they don't have an ad tech arm, but they're sitting on an inordinately large amount of strong signal. They could sell it, and sell advertisers into their own ecosystem.

Edit: I'm told by several commenters that I'm wrong. And I'm happy to be. I'd like to move my goalposts and say that native apps do not have those capabilities :)

<comment><USER56> Actually you can now download ad blocker extensions for Safari in the App Store.

</comment></comment><comment><USER57> Meanwhile they allow locations services to continue even after the user "turns off" the wifi following android footsteps(1). So tracking in apps will be worse for users.

As a customer really it seems they talk a lot about privacy yet implements "sneaky" changes like this, it seems a bit dishonest.

1\. I know the feature is a different in IOS (it only disconnects connected devices) but for location services/tracking this is effectively the same as android. see: [https://support.apple.com/en- us/HT208086](https://support.apple.com/en-us/HT208086)

<comment><USER58> You seem to be confused about that post. That _only_ refers to turning off WiFi from Control Center. If you go into settings and turn off WiFi, it will actually turn the radio off. Separately, in Location and Privacy, you can disable location for your whole phone or on an App by App basis. Control Center WiFi is not tied to this.

<comment><USER59> It is a massive step backwards though in my opinion, changing the functionality of the toggle in control center from disabling WiFi to just disconnecting the device.

A privacy conscious user now has to do 4 actions (Unlock, open Settings, WiFi, disabling it) instead of two (swipe up, disabling it) to disable the WiFi.

I doubt many normal users would notice the difference, maybe thinking the toggle has the same functionality as before thus thinking they won't constantly broadcast their known WiFi networks and thereby the pretty accurate location of their frequently visited places.

Please correct me if I misunderstood something!

Edit: I meant standard as in: If no other option than SMS 2FA is available.

<comment><USER58> You got it, you're right, and I agree.

I rarely go into Settings to disable WiFi, but it seems like I'll have to start doing that now.

</comment></comment></comment></comment><comment><USER60> This is a complete guess ...

Apple "does right by users". That's ok. But I'd wager this is only because that type of positioning is now Apple's chosen market differentiating* strategy. Against Google. Apple seems to want to position itself as the device that guarantees privacy and security. Apple would like to maintain exclusive access to a market segment that values security and privacy above all.

It worked for BlackBerry. Strong and almost cult-like loyalist following mostly guaranteed BB's reach in the executive circles. Even after BB became "Veblen", the device was in high demand. In such a market segment, the price per device doesn't really matter. My view is consistent with the apparent "horror" prices seen for the new iPhone.

If my guess is right, it's a shame about Apple's chosen direction. I love their products.

<comment><USER61> > Apple would like to maintain exclusive access to a market segment that > values security and privacy above all.

You make it sound like Apple has some kid of unfair advantage over competitors. Or that Apple has monopoly power over the ideas of security and privacy. Bullshit.

> it's a shame about Apple's chosen direction.

I can't believe anyone could say that with a straight face.

<comment><USER60> You misunderstood.

Security and privacy should be a given. Security and privacy should never have been an easy opportunity for Apple to differentiate against its competitors.

Edit: Would I expect my wife to cook me a lovely welcoming dinner if I phoned her from work to tell her I had been an honest and loyal husband for the whole day? No.

(She would, had I had gotten her flowers without saying a word though! But that's another thing.)

<comment><USER15> > Security and privacy should be a given

I couldn't agree more. The news shouldn't be that Apple is doing something remarkable, it should be how other browsers fail to protect their users in similar ways.</comment></comment></comment></comment>


How to tell if a designer is good. - <AUTHOR> https://scoutzie.com/blog/how-to-tell-if-designer-is-good-from-portfolio

<comment><USER2> I disagree on item #1 (Taste). A good designer should solve problems, not do something that looks beautiful to you.

<comment><USER3> I don't think taste conflicts with problem solving skills. They can coexist - because design is choosing which solution to apply to a problem, and the choice reflects your taste / stylist preference. Rarely is there only one answer to a problem. Agreement in taste is important else it will be hard for you and your designer to move any design decision forward to implementation.</comment></comment>


Show HN TinySXSW - a mobile meme generator for Austin - <AUTHOR> http://tinysx.com/

<comment><USER2> Ok, this is why this app is winning: <http://tinyreviewapp.com/sx/post/48579/>

<comment><USER3> Hilarious. It's pretty good for short, witty puns.

</comment></comment><comment><USER4> Wish more apps would support an Html5 experience, but the functionality isn't there yet. Is this just for SXSW or a supported product?

<comment><AUTHOR> This was a 3-day hack to test a mobile version of our iPhone app (Tiny Review). It worked out pretty well; next week we'll convert our existing site tinyreviewapp.com into the same hmtl5 mobile format.

</comment></comment><comment><USER5> Isn't SXSW over, in the Portlandia sense of the word, by now?

<comment><USER3> I (site author) kinda thinks so - that's why we decided to make fun of it from afar

</comment></comment><comment><USER6> Zeldman said, "In 1999 it was Razorfish's money. That sucked too. There's always been a garish commercial sideshow alongside good indy content."

Ben Brown responded, "But Razorfish made websites. Amex makes debt. Is SXSW the product that we consume, or are we the product SXSW sells to Amex?"

<comment><AUTHOR> Interesting existential question. Just so all of you know, we're just having a bit of fun and not selling anything to anyone.</comment></comment>


They don't care - <AUTHOR> http://www.michaelonsystems.com/?p=268

<comment><USER2> You might not care about a user's message because he only sees his pet feature, but you only see your pet project. The customer isn't always right, but what they teach you at college about stupid customers not knowing what's good for them isn't true either. Interesting stuff will happen when you find the balance between their and your "don't care" points.</comment>


The Audacity of Chinese Frauds - <AUTHOR> http://www.nytimes.com/2011/05/27/business/27norris.html?_r=1&src=tptw

<comment><AUTHOR> here is the blog of the research firm that called a lot of these Chinese tech firms early:

<http://citronresearch.com/>

Interesting reading.</comment>


How does 280slides.com do Cocoa on the web? - <AUTHOR> http://280slides.com Apart from all the Objective-J talk going on, I wanted go in detail about how they managed to port Cocoa to the web. Apparently they write absolutely positioned divs for everything, and calculate position-size. This way they never have to deal with the actual CSS/HTML, and write only javascript code. This is really cool stuff, not only because it makes your frontend more stable and cross-browser, but also for development purposes. The people at qooxdoo.com have been doing it as well, but I havent seen many other folks doing it. <comment><AUTHOR> Apart from all the Objective-J talk going on, I wanted go in detail about how they managed to port Cocoa to the web. Apparently they write absolutely positioned divs for everything, and calculate position-size. This way they never have to deal with the actual CSS/HTML, and write only javascript code. This is really cool stuff, not only because it makes your frontend more stable and cross-browser, but also for development purposes. The people at qooxdoo.com have been doing it as well, but I havent seen many other folks doing it.

<comment><USER2> Soon Objective-J and Cappuccino will be open sourced and all your questions will be answered, but until then...

Yes, that's correct. Most visual elements are absolutely positioned divs (called "views", CPView in Cappuccino, NSView in OpenStep/Cocoa). We catch all events and handle them ourselves (i.e. determining which views get the event, etc). This gives us things like the "responder chain" and much better control over events. Normally it's impossible for an element behind another element to receive an event, but not in Cappuccino. A lot of little problems are solved by this approach.

There's a lot more to it than that, but it's late and I need sleep...

<comment><AUTHOR> Awesome, i really didnt go through your code much, but i was trying myself to make this technique happen using simple old javascript. Things that were bothering me were for example the fact of passing the div element around, i think you have the CGRectMake() function that returns that div element, interesting though is that you dont add any of your methods/property to that div dom element. Another interesting thing is that you're able to figure out the size of elements before they are written to the client (browser), do you write it 2 times, one to get size and another to actually display it?

<comment><USER3> CGRectMake does not make a div, it makes a rectangle that defines the location and size of views ( see [http://developer.apple.com/documentation/GraphicsImaging/Ref...](http://developer.apple.com/documentation/GraphicsImaging/Reference/CGGeometry/Reference/reference.html) )

<comment><AUTHOR> What is a rectangle on the web? Isnt it a div?

<comment><USER2> He means an abstract "rectangle"... just the dimensions and coordinates.

In JSON:

        {
            origin: {
                x: a,
                y: b
            },
            size: {
                width: c,
                height: d
            }
        }</comment></comment></comment></comment></comment></comment>


Making the BBC micro:bit display the BBC Micro owl logo - <AUTHOR> http://blog.jgc.org/2016/03/making-bbc-microbit-display-bbc-micro.html?a=bc <comment><USER2> Next project - get it to send FSK tones over Bluetooth A2DP?

I'm looking forward to general availability of these.</comment>


Guano Islands Act - <AUTHOR> https://en.wikipedia.org/wiki/Guano_Islands_Act <comment><USER2> "Guano?" "Bird Shit, Sir" \--Ripping Yarns: Across the Andes by Frog (1977)</comment>


Add Tabs and features to OSX Finder (for free) - <AUTHOR> http://www.trankynam.com/xtrafinder/

<comment><USER2> Anyone can point out the differences between this and TotalFinder from BinaryAge (apart being free)?</comment>


Login.gov encryption is badly designed - <AUTHOR> https://gist.github.com/sdrapkin/92836da1d82d45df664460361f1fa943 <comment><USER2> Scrypt isn't badly designd. It's also difficult to misuse.

This is like saying "bcrypt is badly designed."

Note that you are specifically attacking scrypt with the title -- "login.gov encryption" can be substituted with "scrypt."

If you were to say it's illegal for them to be using scrypt since scrypt is not an approved KDF, that would carry more weight.

 _Cryptographic flaws

1\. scrypt is used as password-based KDF, which violates NIST 140-2_

This isn't a cryptographic flaw! The phrase "cryptographic flaw" means something.

 _5\. hash(E) is stored right next to the ciphertext from (4). Who thought that storing a hash of the encryption key right next to PII ciphertext encrypted with that key was a good idea?_

Storing the hash of an encryption key is fine, as long as the hash function is strong.

It's frustrating that a government website is making solid cryptographic choices and then being lampooned like this. It would be far more productive to make scrypt an approved NIST KDF.

<comment><USER3> If anything, this is an argument to expand FIPS, not an argument to deauthorize login.gov.

</comment></comment><comment><USER4> This is mostly complaining about a lack of FIPS 140 compliance. While that might be a regulatory issue for a .gov site, technically-speaking FIPS compliance is a hinderance to building a sound system, not an aid.

Putting that aside, there might be some valid points in here: using Hash(IKM + nonce) to generate a key is probably not ideal, depending on what Hash is. That's generally a job for HKDF. The post also mentions a "non-approved KDF" elsewhere, but doesn't say what it is.

On the other hand, storing Hash(key) isn't immediately an issue unless something else in the scheme depends on Hash(key) being secret, but the post implies without justification that it's some sort of obvious error.

So there might well be some issues here, but this post doesn't provide sufficient detail to condemn login.gov out of hand.

<comment><USER5> FIPS compliance is honestly THE WORST.

This is a butchered version of my standard write-up for customers who have customers who ask about FIPS.

FIPS is really an unsuitable way to evaluate the security of large or complex systems. The major cloud vendors who claim to be FIPS compliant do so by describing one key part of their system as FIPS compliant (e.g. their VPN technology, for Azure, and SSL termination for AWS), and then proudly displaying a compliance badge on their website. It is more or less impossible to make a modern cloud system completely FIPS compliant, and it is a waste of time to try. Organizations asking for FIPS compliance seem perfectly happy as long as one or two key parts are compliant.

Usually, the simplest FIPS compliance goal is to target the transfer of <key data> over the Internet. That will satisfy most customers.

Actually it is a bit worse than that, because your customers will need to do some work on their side, and based on a realistic profile of customers who enquire about FIPs compliance, they are extremely unlikely to undertake that effort. So the key thing is to be "FIPS ready". More on this shortly.

DEFINITIONS

FIPS - This is actually a broad range of standards. In the context of security, most people mean FIPS 140-2 - "Security Requirements for Cryptographic Modules".

* FIPS Certified: If you create cryptographic modules, you can have them certified as compliant by an accredited lab. This costs a lot of money. There is an official list of all FIPS certified cryptographic modules.

* FIPS "Level" \- There are 4 levels. Software can really only ever be level 1. Levels 2+ start talking about features only possible in hardware, such as tamper evident seals.

* FIPS Compliant - If your product uses only FIPS certified cryptographic modules and FIPS approved algorithms for all cryptographic operations, it is FIPS compliant.

* FIPS Ready - This is a "made-up term", but it sounds good. It's a way to express "Our software can be compliant, but you need to do some things which we can't do for you".

FIPS ON THE CLIENT

Windows is only compliant if it is operating in "FIPS mode". Obviously, you can't turn that on for your customers, they need to do it themselves. See: Enabling FIPS compliant algorithms in Windows. Note that enabling FIPS mode will often break a lot of things (e.g. TLS connections to some web sites, inter-operation between different versions of Windows and so on). Also, it will actually tend to weaken security. This is because the FIPs approved algorithm list is several years old which means that the system is forced to use ciphers which are weaker than modern defaults. Furthermore, FIPS-certified code can't, if you read carefully, be patched without re-certification.

FIPS MODE, IN GENERAL

Most vendors meet the requirements of FIPS by providing a specific, certified "mode" in which the system is compliant. Why? Well, when a software cryptographic module is FIPS certified, the certification just applies to that exact version. If a single byte changes in that software module, it isn't certified any more. Naturally, vendors want to keep improving their software. So they keep the old, certified code around and only activate it in FIPS mode. Also, in FIPS mode, the software must perform time-consuming self-tests every boot (ok, that is not that bad).

It is really an untenable situation for software. Here's a great write-up of the software certification process from a member of the Oracle Solaris team: Is FIPS 140-2 Actively harmful to software?.

[https://blogs.oracle.com/darren/is-fips-140-2-actively- harmf...](https://blogs.oracle.com/darren/is-fips-140-2-actively-harmful-to- software)

The engineer (an architect on the Solaris crypto team) writes:

So should I run Solaris 11 with FIPS 140-2 mode enabled ? - My personal opinion is that unless you have a very hard requirement to do so I wouldn't ...

And then, regarding patching:

So what we do we do in Solaris ? We make the bug fixes and and new non FIPS 140-2 relevant algorithms (such as Camellia) anyway because most of our customers don't care about FIPS 140-2 and even many of those that do they only care to "tick the box" that the vendor has completed the validation.

FIPS IN THE CLOUD

Given the difficulties with FIPS mode for just operating systems vendors, you can see that operating an entire cloud service using FIPS-certified cryptographic modules is going to be extremely difficult.

You will need to think about OpenSSL, any database encryption code, OpenSSH, NSS, PAM, password hashing and all sorts of other services which may or may not do encryption.

Various compliance schemes often allow you to have unencrypted transfers within certain trust boundaries. Ironically this can mean that the quickest path to compliance is logically to turn off any encryption which your regulators do not strictly force you to use. Because FIPS doesn't say what to encrypt, it just says how to do it - if you do!

FIPS AND AMAZON

Then you have to ask: Wait, is Amazon itself "FIPS compliant"? For example, when I send data to and from Amazon S3, will the SSL be protected with FIPS compliant algorithms and are they using FIPS certified cryptographic modules?

Amazon do claim to have a FIPs mode, but only in Govcloud. As far as I can tell, they claim to be FIPS 140-2 compliant by virtue of using FIPS-compliant TLS on their endpoints.

RECOMMENDED COMPLIANCE STATEMENT AND POSITION

The reality is that customers tend to think of "FIPS compliance" as a check in the box. A binary state - is it compliant or certified, or is it not?

This view makes sense for a chip or a software library. However, when we talk about a large system with many moving parts, it is not strictly clear what "FIPS compliant" even means anymore. Different vendors seem to solve this problem in different ways:

\- Operating systems vendors achieve compliance by having a "special mode" which no-one in their right mind ever turns on.

\- Amazon claim they achieve compliance by providing "FIPS compliant" SSL on their endpoints.

\- Azure claim they are FIPs compliant because "Azure uses Microsoft cryptographic modules in the validated list published by NIST, enabling customers to configure and use Azure Virtual Network services in a way that helps meet their information encryption requirements."

\- Rackspace and Google Cloud, as far as I can tell, do not even try.

It is pretty clear that the cloud vendor claims are just pandering to the "rubber stamp" mentality of customers, and proudly displaying "FIPS compliance" by ensuring that say, some key aspect of their system is certified or compliant (not the entire system from end to end).

This mostly works because customers who are looking for rubber stamp compliance neither care enough nor know enough to question the veracity of claims.

SUGGESTED COMPLIANCE STATEMENT

The software we deliver to you (XYZ & ABC) is FIPS ready. To achieve FIPS 140-2 Level 1 compliance, you need to operate your systems in FIPs mode via Windows Group Policy. When systems running ABC SOFT are in FIPs mode, all <sensitive data for your regulatory domain> transmitted to and from our systems will be protected using FIPS 140-2 approved encryption algorithms.

<context is operator providing a web service on AWS with mostly windows clients>

DELIBERATE WEASELINESS

Of course that statement is weaselly. The only thing you can promise is that you're gonna use FIPS compliant TLS, and even that only really works right if the customer configures their stuff in the right way and your cloud supports it.

The minute anyone opens their eyes to the broader scope of things, of course the system as a whole is not going to be "FIPS compliant" because there is a ton of crypto required behind the scenes to get software systems to work and NONE OF THAT IS FIPS COMPLIANT.

<comment><USER6> Side note - please don't use a code block for lists like that. It is unreadable on any screen narrower than the length of the lines, and there are no line wraps.

</comment></comment></comment><comment><USER7> This is a rather sensational title for an article that amounts to "Login.gov does not use FIPS 140-2-compliant cryptography". Its main argument (aside from point 5) appears to be that scrypt is used in multiple locations, without passing judgement on scrypt itself.

Given that this is a US government-run system, this is still a compliance problem, but that's a different issue.

</comment><comment><USER8> I opened an issue on their bug tracker a couple days ago because I had more fundamental questions about how their algorithm was designed.

HN comment: [https://news.ycombinator.com/item?id=15204989](https://news.ycombinator.com/item?id=15204989)

Github Issue: [https://github.com/18F/identity- idp/issues/1665](https://github.com/18F/identity-idp/issues/1665)

Now I may be misunderstanding their implementation, but it seems to me actually worse than "this isn't FIPS 140". I take no issue with their use of scrypt at all. The complaints in this Gist actually seem to miss the mark to me.

The problem isn't scrypt, or storing a hash. The real problem is storing _d_ which, seems to me, defeats the purpose of using an HSM in the first place!

Again, with the disclaimer that I'm not 100% certain that's what they're doing, it's just what the documentation says, and what it seems like is happening from reading the Ruby code. I don't develop in Ruby, but while the language is fairly easy to read, with all their variables named 'encryption_code', 'encryption_key', 'encrypted_key', 'encrypted_code', etc. it's easy to get lost.

EDIT: Can someone please co-validate my analysis please? Or please tell me what I got wrong! From what I can see, the design is obviously broken. I don't consider myself qualified to find flaws in other people's crypto so, when I find obvious flaws in what should be well designed crypto I get a little freaked out.

<comment><USER9> EDIT: OK, I think I see what's wrong with this analysis: [https://github.com/18F/identity- idp/blob/master/spec/service...](https://github.com/18F/identity- idp/blob/master/spec/service..). They do include Z1 in the data they pass to KMS decrypt. This is because they have XORed the ciphertext with Z1 - so now in order to recover the initial ciphertext back (i.e. the cipher text you can decrypt with KMS to get R back), you need to XOR with Z1 again. So even if you get D from the database, you can't decrypt it unless you have Z1, and if you were trying to brute-force it, you would need to call KMS for every attempt with the Z1 for this attempt.

Original comment:

I am not any kind of crypto expert. But I agree with you.

I think they should be XORing with "AssignedSecret" (not "EncryptedAssignedSecret"). Then in order to compare password hashes you would need to decrypt the "EncryptedAssignedSecret" using KMS. (using the terminology in the description of the algorithm here: [https://github.com/18F/identity- idp/blob/master/docs/encrypt...](https://github.com/18F/identity- idp/blob/master/docs/encryption-and-key-rotation.md)) (EDIT: you actually cover this approach in the GH issue, and point out a problem with it).

I think there is another approach like what the OP proposed where they should be using some portion of the scrypt hash (either Z1 or Z2 or just the whole thing) as part of the encryption context passed to KMS. But this seems a little more complicated to me. (EDIT: You also mention this as a possible solution in the GH issue).

I think there's also an approach using the GenerateDataKey API : [http://docs.aws.amazon.com/kms/latest/APIReference/API_Gener...](http://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html)

Where you get the key and the key's cipher text back from KMS and store _that_ , and then you have to use KMS to decrypt whatever you encrypted with the key.

<comment><USER8> Yes, you need to know the password to decrypt. That's the basis of their very interesting PII protection scheme!

My point is you can brute-force the password without the HSM. And their docs specifically say this should not be possible. Isn't the whole point of the HSM to prevent that?

'hash' is derived from 'z2' and 'd' \- and they give you 'd'. Password will produce 'z2'. So that's the brute-force attack.

To say it another way, the 'z1' path is secured. But there is the 'z2' path and it's wide open.

<comment><USER10> I've left a comment on your github issue, but the tl;dr is that the encryption document doesn't seem to reflect the code. The comment in the ruby test case suggests that the actual step is 'E = hash( Z2 + R )' instead of 'E = hash( Z2 + D )' where 'R' is the user's randomly generated 'AssignedKey' and 'D' is the masked HSM ciphertext 'KMS(R) ^ Z2'.

Perhaps somewhere during implementation someone realized the document doesn't make sense as written.

</comment></comment></comment></comment><comment><USER11> I don't think "NIST" approved is that compelling of an argument.

If the author wishes to identify known vulnerabilities, that would be interesting.

FIPS has some various issues that actually increase vulnerability and not decrease it. Eg, FIPS approved OpenSSL was always an anchor that caused more problems than it solved.

<comment><USER12> The OP seems to misunderstand the function of NIST, as well. NIST does not "approve" other agencies' software systems. NIST is a standards-setting organization only. They create and publish standards, but do not enforce them.

<comment><AUTHOR> The OP is referring to the OP-linked 18F writeup (you might want to read it), which says "Based on consultation with NIST we follow these steps..."

</comment></comment></comment><comment><USER13> While there is some weird design in Login.gov, this particular report is mostly generating giggles among crypto engineers I know.

<comment><USER14> You mean to say that the outdated requirements of FIPS-140-2 aren't the best practices for designing a crypto system? That the lack of TMTO attack resistance in PBKDF2 makes it a sub-optimal choice for storing passwords? Surely not! NIST would never recommend anything but the strongest cryptography!

</comment></comment><comment><USER15> What an immature analysis with click-bait title, I was expecting something big to read and it turns out he was just not happy about the site doesn't comply to NIST, and using scrypt is a _flaw_? Seriously?

</comment><comment><USER3> Also note: scrypt ends with a PBKDF2 round, so if PBKDF2 is acceptable then scrypt may not actually be a problem. Legally speaking you might be able to ignore the use of the SMIX (including Salsa20) and the HMAC entirely as long as the final PBKDF2 uses a FIPS 140-2 acceptable hash function.

<comment><AUTHOR> "OMG, you're totally right - if only the OP knew that scrypt ends with pbkdf2.."

Um, no. But thanks for playing. For those who wish to argue that everything that precedes PBKDF2 in scrypt should be considered as "key extraction", you should read NIST SP800-56c, also referenced by FIPS-140-2 Annex-D (tldr: scrypt does not fly). Welcome to USG infosec compliance.

</comment></comment><comment><USER16> Can anyone explain why scrypt would be inadequate or flawed?

<comment><USER13> It's not.

</comment></comment><comment><USER17> Hey, at least their transport security gets an A+ from SSL Labs. Honestly, I still find a lot of government sites, particularly state governments that get F's because they are still using SSL and 56 bit ciphers.

[https://www.ssllabs.com/ssltest/analyze.html?d=login.gov&lat...](https://www.ssllabs.com/ssltest/analyze.html?d=login.gov&latest)

</comment><comment><USER18> The construction seems bad, but FIPS isn't anywhere close to being as good as NACL, and scrypt isn't the enemy. Bad constructions, lack of nuance and faith in certifications are the enemies.

<comment><USER19> It's worth noting the author is elsewhere critical of libsodium.

</comment></comment><comment><USER20> Am I the only person who suspects this is a work of performance art?

</comment><comment><USER21> Ouch

</comment><comment><USER22> Is anyone really surprised?

<comment><USER23> If your implication is that 18F has the same reputation as past Web-related efforts in the federal government, you may need to look into 18F more closely.

It's only 3 years old and was specifically intended to fix all of those stereotypes and make the government software production efforts more similar to those in Silicon Valley.</comment></comment>


tilde.town: A social network over SSH - <AUTHOR> https://tilde.town/ <comment><USER2> Hi

I'm the founder and primary admin of tilde.town.

I see many people signed up! Every application is manually reviewed, so, uh, give me a few days.

Regarding "good" and "bad" users; this question has been at the center of tilde.town since its inception. We're a community first and a technological project second and encouraging a sense of belonging for users is our primary goal.

Certain users sign up to abuse resources; that's easy to catch and deal with. Other users want to import the wider culture war aspects of the internet into our space, using a variety of tactics to provoke anger and discomfort.

I'm a generally conflict-avoidant person so this took getting used to. On the server, I had to learn to be willing to ban the persistent trolls. I want to provide a space where people can grow and mature as I was given on IRC and web forums back in the early 2000s instead of a place that throws people out at the first hint of having "incorrect" beliefs. Unfortunately this gave too much leeway to people that were consistently there to recreationally troll or promote genuinely hateful movements.

I became much more free with both temporary and permanent bans and made the signup intentionally cumbersome, wracked with nerves about the "good" folks who might be intimidated. I still have that anxiety, but ever since increasing the scrutiny on applications and doing more banning we've had a much more stable community environment.

I read a lot of books on digital communities; the Virtual Community by Howard Rheingold is a great starting point, but the book that helped me the most was Cyber Chiefs by Mathieu O'Neil. It helped me understand that all communities that manage to grow over time will hit an unsustainable point and either retract or dissipate.

Dissipation was a real possibility; for a long time I felt completely emotionally burned out by the town. I chose retraction though, and in retrospect, it was the right choice.

I'm still learning and thinking all the time about ways to encourage quieter or less technologically inclined people to sign up and make a home on the town and am always excited to talk about it or hear ideas.

(edited to clarify i'm not the only admin)

<comment><USER3> Hey! Miirc here! I really have to get my plant back up and running. Plant, RIP.

You've done a great job with the community. Thanks for all you do!

</comment></comment><comment><USER4> I run tilde.fun. It's currently defunct but I'm migrating the site to a new server today.

We have an SSH signup form with no need for any personal details but an email address, written in Python, in the making ([https://code.tilde.fun/tilde/ssh- reg](https://code.tilde.fun/tilde/ssh-reg)) I'd really like to automate account creation and have someone look over it before I actually deploy it.

Write me an email (address in my profile) if you're interested in helping run/develop this or some MB of free HTML web hosting.

We are two admins and run a few other services ([https://wiki.tilde.fun/tilde/start](https://wiki.tilde.fun/tilde/start) lists some of them). We want to take back the internet from megacorps into the hands of users. I have an empty server just waiting for some people with dank HTML skills!

<comment><USER5> > address in my profile

Note that the HN profile e-mail field is not public. That field is for password reset stuff or something.

If you want people to see your e-mail you will need to write what it is in the profile description.

<comment><USER4> Ah right, thanks. I'll edit my profile to include it in my bio.

</comment></comment></comment><comment><USER6> An interesting monologue about pseudonymity hidden here: [http://tilde.town/~karlen/nowertb/anonymous.mp3](http://tilde.town/~karlen/nowertb/anonymous.mp3)

<comment><USER7> I've been listening to the other notes on there, and enjoying them. Where are the text posts that he's talking about though? All I see are these voice notes.

<comment><USER8> (not the narrator, but I was active when the narrator was creating these ...)

The rule for these audio clips was to do a search for any blog post on the internet which started with "No One Will Ever Read This, But ..." and where the blog had been abandoned for at least a year. If you listen to the audio and do some searching, sometimes you can find the post, if it's still up.

</comment></comment></comment><comment><USER9> Tilde Club -- [https://medium.com/message/tilde-club-i-had-a-couple- drinks-...](https://medium.com/message/tilde-club-i-had-a-couple-drinks-and- woke-up-with-1-000-nerds-a8904f0a2ebf)

</comment><comment><USER10> Hey, I'm a user here! I never expected a tilde site to get on Hacker News again; I thought the wave of interest in the tildeverse died out years ago.

I don't really use the HTML part of it; I only interact on the command-line forum and play with some of the games/sims.

</comment><comment><USER11> If you'd like a guided tour of the tildeverse, there's one on The Dork Web: [https://thedorkweb.substack.com/p/tales-from-the-dork- web-5](https://thedorkweb.substack.com/p/tales-from-the-dork-web-5)

Also relevant community: [https://tildes.net/~tildes](https://tildes.net/~tildes)

<comment><USER12> tildes.net is an independent, nonprofit reddit replacement.

<comment><USER11> Yup, but when I originally wrote the tildes piece it was shared there and people lamented that I didn't mention them, so I am now :)

</comment></comment></comment><comment><USER13> I'm curious about the general way tilde sites are administered. How do they keep people from using them as hosts for cyberattacks or spam?

<comment><USER4> I can only speak for tilde.fun, but it's helpful to not have any users currently (^^) and disable outside communication apart from ~/html/ where our users can put static files into.

Most tilde sites don't have public mail servers and only federate mail between them and other tilde servers. See also [https://tilde.team/](https://tilde.team/).

<comment><USER13> Do you use a VPS on AWS or something like that, or an actual physical box?

<comment><USER4> It's currently a VPS rented from Strato.de, one of the biggest German hosting providers.

Since I'm paying out of my own pocket I currently don't want to afford a colocated server, even though I realise that'd be cooler and possibly more secure.

I'll try to have a detailed cost overview online somewhere soon-ish.

</comment></comment></comment></comment><comment><USER14> So is this a BBS?

I find that amazing that the BBS acronym doesn't show up although it would seem an obvious comparison.

<comment><USER8> It's a bit like a BBS, yes, and that's what drew me to the concept initially (I'm an early member of tilde.town; still reasonably active).

We do have an internal bulletin board, and an internal IRC (like the chat rooms of multi-line BBSes of the late 80s/early 90s). There are a ton of little projects by members, and the projects are pretty varied.

I find it a fun place to hang out, personally.

</comment></comment><comment><USER15> There are lot many good Tildes out there which forms Tildeverse : [https://tildeverse.org](https://tildeverse.org)

</comment><comment><USER16> You could also take a look at:

* tilde.club

* tilde.team

* ctrl-c.club

* tilde.institute

* thunix.net

* remotes.club

* yourtilde.com

* envs.net

* squiggle.city

* aussies.space

* radiofreqs.space

* rw.rs

* tilde.pw

* dimension.sh

* breadpunk.club

* cosmic.voyage

* hackers.cool

* rawtext.club

* tilde.black

* tilde.pink

I'm sure many others do exist…

</comment><comment><USER17> I'm not really sure I get the point... is there some kind of fuse mount that gives people the possibility to see live posts, user profiles, and other stuff? Are you directly logged into a game like shell when you connect? Or is this just plain old ssh to bash?

<comment><USER18> It's a community, like HN is, but accessed via ssh instead of http. So it's a community where the active participants necessarily can navigate a shell, irc client, tmux/screen, and maybe even prefer socializing in that environment vs. something like the web or mobile apps. Access is also a privilege which can be taken away. So everyone you interact with there is either new or cooperative and mature enough to not get banned from a shared resource with very few safeguards preventing abuse.

~town is by far the largest multiuser system I've logged into in the last decade, not that I've been looking. It kind of reminds me of the university UNIX systems I dialed into in the 90s, fingering users to read their plans, updating my .plan, running ytalk to chat with friends, email w/pine, and usenet w/tin.

<comment><USER19> > ~town is by far the largest multiuser system I've logged into in the last > decade

You may wish to look at sdf.org then.

<comment><USER18> I'm aware of sdf.org, and I haven't logged into it in over a decade :)

</comment></comment></comment></comment><comment><USER20> For good or bad, that scrolling title really reminded of the early 90's HTML galore <3

</comment><comment><USER21> I signed up for a shell account on a similar service, b.armory.com, in 2008. Since that time, the website is gone and activity is very low. It was a nice way to learn about Linux thanks to someone's generosity in sharing their server.

</comment><comment><USER22> I'm always wary of using SSH services which aren't running on systems I control. If I'm not mistaken, an SSH service is able to see all of the pubkeys you have in your ~/.ssh/, so there goes your privacy.

<comment><USER23> But they were public keys, it's completely fine if the entire world sees them

<comment><USER24> Perhaps the parent commenter is worried of public keys being used as a tracking vector?

<comment><USER4> Then they should create one key per service and only use that one.

<comment><USER25> Which they've done from the sound of it, and are concerned about the ability to read those _other_ public keys and use them as a tracking vector.

<comment><USER26> As another commenter already pointed out, the IdentitiesOnly config option removes that ability. The ssh-config man page explains this.

<comment><USER27> Out of curiosity, are there reasons that that behavior shouldn't be the default?

<comment><USER26> I'm not sure it makes much sense unless you also override the default IdentifyFile.

<comment><USER26> Argh, Identi _t_ yFile.

I make the same damn mistake in my actual config file, too.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> pretty neat, i signed up. reminds me of the days hanging out on sdf.lonestar.org.

<comment><USER29> I was just thinking about that, but I could not remember "sdf". Thank you

There's also hashbang.sh, for those curious

</comment></comment><comment><USER30> I thought "Wow, cool - I gonna sign up".

And then I saw their sign up form. 10 fields is a bit too much.

<comment><USER18> Even such low barriers as a small form do wonders for the quality of people on the other side, you won't be missed. (if you genuinely can't be bothered)

<comment><USER19> From personal experience in running similar things, they aren't a good method of discerning quality of people.

<comment><USER31> I'm curious, what are the "good" methods for discerning/filtering quality of people? How are "good" and "bad" quality of people categorized? (binary? spectrum/distribution?) How can you estimate/measure the quality of the filter/method with precision?

I assume no filter is perfect and mistakenly filter out "good" quality people too, so if this method isn't good that suggest there's a metric and a more efficient method out there. In your personal experience what worked better?

<comment><USER19> > I'm curious, what are the "good" methods for discerning/filtering quality of > people?

Observation is probably the best method. I rarely have found form options to be effective. A good chunk of 'good' people tend to get filtered out from my observation.

Generally the approach that has worked for me having a tier system. People who meet your criteria get greater access etc over time.

> How are "good" and "bad" quality of people categorized?

Generally, "good" is anyone that helps your community prosper. "Bad" are typically people who cause unwanted conflicts, create a toxic environment etc.</comment></comment></comment></comment></comment>


Money as Message: How WeChat got users to adopt payments to grow its network - <AUTHOR> http://a16z.com/2016/07/24/money-as-message/ <comment><USER2> Lovely article, and a great introduction to the red envelope culture.

But I think the real reason WeChat's payment system has taken off is much simpler:

\- People pay for everything with cash

\- Sometimes you don't bring enough cash with you

\- Paying for each others' meals, sending red envelops, etc is a daily thing here

\- People don't have credit cards (so that whole technology has been completely leapfrogged, and why Facebook's money transaction haven't take off and we're stuck with our crappy CC system in the US)

\- Everyone and their mothers has a WeChat (I've never met anyone that doesn't... it's more ubiquitous than Facebook in the US)

So even if you're not invested in the platform you'll most likely have some money on your wechat account just as emergency cash. And it's only true that you need a bank account if you want to take money out. For instance I don't have a bank account hooked up, but I have money on mine just from times when friends wanted to comp me for a meal.

<comment><USER3> It's the existing social graph that's important.

Some other points you made aren't the main drivers of success:

 _People pay for everything with cash_ They also have bank cards and Alipay, and had them before WeChat payments existed.

 _Sometimes you don 't bring enough cash with you_ Yeah, and I used to use Alipay to reimburse friends, before WeChat payments.

 _Paying for each others ' meals_ WeChat doesn't help with that. It helps you pay for your own portion, as you can use WeChat to reimburse the person who paid the restaurant.

 _People don 't have credit cards_ I'm not sure that _credit_ is relevant. Everyone has a chip+pin bank card (what I'd call a debit card in the UK). People have been paying with bank cards in restaurants for many years.

You made one point which _is_ important: "Everyone and their mothers has a WeChat (I've never met anyone that doesn't... it's more ubiquitous than Facebook in the US)"

But practically everyone has an Alipay account as well. The thing is, I have 100s of contacts on WeChat (which I added for messaging) but only 10-15 on Alipay. It's the existing social graph, not just the number of users, that's important.

<comment><USER2> I think that's simplistic. All of the points are important together

Like I said, Facebook has the social graph and no one uses their payment system b/c

1 - you pay with credit cards and they're super entrenched and you don't forget your credit card like you may forget to bring enough cash

2 - at least personally... I rarely find I need to give my friends money in the US. It happens once in a while.. but not every week like in China

<comment><USER3> Sure, the social graph is not enough on its own. There's something different about China or its stage of development.

But the specific points you raised mostly don't help us understand what's going on. (1) is incorrect, (2) applies even more in the US than in China, (3) is just wrong _, (4) is irrelevant as people have bank cards.

_ I say (3) is just wrong because: (i) WeChat doesn't facilitate paying for each others' meals; it only helps when splitting the bill, and (ii) red envelopes weren't a daily thing before WeChat. They were only for special occasions.

Anyway, I think we can agree there are multiple factors that got WeChat payments to where it is. I'm not sure I have any additional insight :)

</comment></comment></comment></comment><comment><USER4> The "gamification" aspect is interesting but the overall usage isn't too surprising. When Google split Pay and Wallet into two apps I kept both but whereas I stopped using Pay - the part for buying stuff at the store - for the most part (never seems to work properly on my phone) I use Wallet - the part for sending money to people - all the time.

I live with my SO and we each have various bills in our name. Rather than setting up additional profiles on each account, when a bill is due, one of us pays it and tells the other person their share. A quick email with attached funds or fire up the mobile app to send funds and the money is available immediately in the other person's Wallet and can be used for Googly stuff or transferred to their checking account without any fees.

Going out for drinks or dinner and splitting across credit cards is a pain in the ass or it turns out they only take cash and only one person has cash? One person pays, the rest of us just open the Wallet app and send them our share.

It really is useful and convenient. Honestly the only complaint I have is that they recently discontinued the physical Wallet card. That made it easy to draw off those funds at an ATM or use it as a credit card (see earlier point about Pay app not always working properly).

It's one of those things that I'd never have expected to use but it's sort of like a PayPal that doesn't terribly suck.

</comment><comment><USER5> I have a lot of questions about payments on WeChat:

Do you need someone to verify your ID to get a WeChat account with a wallet? I don't think it would be legal to implement something like that in North America without ID checks and a money transmission license, no?

What are the fees? If non-zero, why do people prefer it to cash? If they are zero, how does WeChat make money on the feature? How is it connected to the banking system and how much does WeChat have to pay the banks for that hookup?

I honestly don't see any innovation here, the tech is dirt simple. It's just too difficult to do in the US because of the PATRIOT act, greedy banks, and overzealous AML regulations.

<comment><USER6> American in China here. I can answer this:

>Do you need someone to verify your ID to get a WeChat account with a wallet?

I set this up a while ago but I don't recall an explicit ID checking step. There might be something going on behind the scenes since your wechat account is closely tied to your phone number.

>I don't think it would be legal to implement something like that in North America without ID checks and a money transmission license, no?

Oh the irony that in this respect China is a libertarian paradise. The PRC isn't as paternalistic. They don't really make laws to stop people from taking personal risks.

>What are the fees?

Transferring to/from the bank is .05% I think. Transferring wallet to wallet is free.

If they are zero, how does WeChat make money on the feature?

I think right now the plan is still to run at break-even and/or loss until alipay dies. otoh with a sizeable amount of money sitting in their virtual wallets, tencent can effectively become a bank and do fractional reserve banking. Right now I'm just speculating.

>I honestly don't see any innovation here, the tech is dirt simple.

Often people on this forum are so concerned with the gears that they've missed the point of the car. End users don't care if the tech is literally built from sticks and stones. IMO there is a great wealth of good business ideas that require very little technical innovation. But programmers don't want to work on something which feels beneath them.

>It's just too difficult to do in the US because of the PATRIOT act, greedy banks, and overzealous AML regulations.

I agree completely. If the US keeps these arcane laws, other countries will bury us. I'm doing my part to change this situation by voting for..... oh shit.

<comment><USER7> "Often people on this forum are so concerned with the gears that they've missed the point of the car. End users don't care if the tech is literally built from sticks and stones. IMO there is a great wealth of good business ideas that require very little technical innovation. But programmers don't want to work on something which feels beneath them."

As a programmer, you just blew my mind. I completely agree.

</comment></comment></comment><comment><USER8> This post just reminds me how payment systems are so tacky and awful. It's really something when you have to turn to taking over a beloved cultural tradition to trick people into giving up their bank account information to your 'platform'.

I'm sorry but there is a special place in hell reserved for the creators and marketers of these systems.

<comment><USER3> Have you used WeChat payments? Almost everyone I know here uses it, and everyone is very happy with the functionality and convenience.

</comment></comment><comment><USER3> Can anyone shed light on this statement? "WeChat initially launched Red Packets as a mobile web experience and it was only after they saw the dramatic uptake in 2015 that they included the feature in their native app."

AFAIK there is no mobile web version of WeChat. There's a desktop web version, but it has fewer features than the native client.</comment>


Visual Studio now builds libav without C99-to-C89 translator - <AUTHOR> http://git.libav.org/?p=libav.git;a=commit;h=16381923fb7b9087ce559fb1cd3594469ac6788b

<comment><AUTHOR> A year ago, libav developers introduced a tool to translate a subset of C99 syntax in order to build libav with Visual Studio* . At the time Microsoft famously recommended that developers wanting modern C language features simply use C++ instead* . For a long time, up until earlier this year* , it was thought that C in MSVC had been permanently relegated to legacy support. Even for those of us who don't develop for Microsoft platforms, the attitude towards adoption of newer C standards has ostensibly had a negative impact. Which is why, even in lieu of full conformance, it's refreshing and a good sign to see this tool become unnecessary with the public release VS2013 today.

* [http://blogs.gnome.org/rbultje/2012/09/27/microsoft-visual-s...](http://blogs.gnome.org/rbultje/2012/09/27/microsoft-visual-studio-support-in-ffmpeg-and-libav)

* [http://www.infoq.com/news/2012/05/vs_c99_support](http://www.infoq.com/news/2012/05/vs_c99_support)

* [http://msdn.microsoft.com/en-us/library/vstudio/hh409293.asp...](http://msdn.microsoft.com/en-us/library/vstudio/hh409293.aspx)</comment>