Do you need a VPN? - <AUTHOR> https://blog.mozilla.org/internetcitizen/2017/08/29/do-you-need-a-vpn <comment><USER2> Grew up in China (moved to Australia since early 2008) where GFW is in place and getting overwhelmingly powerful, I've been through multiple stages to cross the `great wall`, SSH Dynamic Forwarding, PPTP, OpenVPN and now IPsec (strongSwan). The GFW has evolved so much (capable of massive scale MITM attack, DNS spoofing, traffic sniffing etc. you'll be amazed how capable the GFW is - of course courtesy of the team behind it) that it makes increasingly more difficult for people to access the real Internet.

I've ditched PPTP (not safe any more) and shifted to IPsec (IKEv2 + RSA with X509, IKEv1 + PSK + XAUTH) as it is being used by a lot of MNCs - can't killall. The GFW has developed technique to detect OpenVPN well and it is easily blocked so I don't use it at all. Over the past few years many home brewed protocols emerge - e.g. shadowsocks and variants and many others (I've never used any of them).

The best thing to do with VPN is that to understand the basics of the VPN solution of choice, try to install and configure from scratch on VPS and use that as your main protection (encapsulation) while using public Wi-Fi or untrusted network. There's been many good discussions on how to do this on HN.

NOTE: I am maintaining around 10 strongSwan powered IPsec VPN and 2 OpenVPN to help family members and close friends to access the real Internet (have to keep a low-profile though). Funny though, my networking skills evolved with GFW.

<comment><USER3> I will be traveling to China in a couple of days and was ignorantly hoping my OpenVPN-based VPN would work.

Do you recommend that I set up strongSwan?

<comment><USER4> Another option is roaming on a foreign SIM card - this usually bypasses the GFW quite effectively; roaming is effectively a VPN back to the home provider, and there seems to be some whitelist for these roaming tunnels. The providers probably provide surveillance access to the Chinese govt, but you will not have trouble accessing Google and other blocked sites, and any VPN you like should work fine through a roaming SIM.

Whether you can find one with reasonable data rates in China is probably the main question.

Two that I have used with great success are Kyivstar from Ukraine and China Unicom HK (note it must be HK, not mainland China). Others may be listed at [0].

[0] [http://prepaid-data-sim-card.wikia.com/](http://prepaid-data-sim- card.wikia.com/)

<comment><USER5> I can confirm that the foreign SIM card override works from my experience a couple of years ago.

My T-Mobile had free international roaming baked in at 2G speeds. Unlike the US however, most foreign carriers in developed Asian nations (China/Korea) don't support 2G fallback, so I had free 3G everywhere.

It was pretty much like using the American internet.

</comment></comment></comment></comment><comment><USER6> When evaluating a VPN service for trustworthiness, I always look at what their webpage loads in terms of tracking scripts.

Basically, if you offer me the service to protect my IP address and don't even have the decency to let me inform myself about your offering without handing over my IP address to Google et al., then I'm not using your service.

Unfortunately, VPN providers collectively don't seem to be aware of this presentation layer, so it's neigh impossible to find one which doesn't violate privacy here.

So far, I've found exactly two: azirevpn.com and airvpn.org

They load in Piwik, which I'm okay with.

These two providers also check a lot of other boxes for me, but yeah, it's still just two providers after hours of research, so if anyone knows any other VPN providers with privacy-respecting webpages, please do tell.

<comment><USER7> > I always look at what their webpage loads in terms of tracking scripts.

Note that this is also one of the criteria in the Vpn comparison chart: [https://docs.google.com/spreadsheets/d/1L72gHJ5bTq0Djljz0P-N...](https://docs.google.com/spreadsheets/d/1L72gHJ5bTq0Djljz0P-NCAaURrXwsR1MsLpVmAt3bwg/export?format=xlsx)

by [https://thatoneprivacysite.net/](https://thatoneprivacysite.net/)

<comment><USER8> Which itself is hosted on Google Docs. Does not compute, does it?

I mean, sorry if I sound rude and thanks for trying to help, but yeah, I'm not clicking on that link.

</comment></comment></comment><comment><USER9> I always ask this on the VPN threads here, and don't feel like I get a solid answer (I'm not particularly well-versed on the topic so I'm genuinely curious and would love to be corrected).

If I go to Bob's website on my computer without any VPN, and Bob wants to find me, all he would need to do is get my IP, call my ISP with a warrant, and then get my information.

If I go to Bob's website while logged in with a VPN, and Bob wants to find me, he first sees that he's getting tons of hits from this IP because thousands of users are sharing this same VPN. So then he uses some kind of fingerprint to figure out my unique user sessions. Then he calls the VPN company, and asks them to associate the IP and specific browser sessions with me. In that case a) the VPN really does store logs even though they advertise they don't, so they're able to associate me with my activity, or b) they really don't store logs and have no idea which one of its thousands of users logged into his website with that IP.

It seems in the latter case, even with a malicious VPN, it's one additional (maybe trivial step) to associate me. But it's still better than just using your own ISP. Isn't that why people use VPNs to avoid DMCA letters from their ISP?

So what is the downside to using a VPN if you're aware that they aren't foolproof vs not using a VPN at all?

If you roll your own VPN on AWS or the like, don't you lose the benefit of sharing the VPN with thousands of users? Wouldn't it be easier for Bob to call AWS with a warrant and get your account info than mess with some offshore VPN provider?

<comment><USER10> _So what is the downside to using a VPN if you 're aware that they aren't foolproof vs not using a VPN at all?_

The downside in a nutshell: "Researchers recently tested 300 free VPN apps on Google Play and found that nearly 40 percent installed malware or malvertising on users' machines."

"Bob" very likely doesn't know you even exist and doesn't care. The downside of VPNs is that many VPN hosting companies are even less trustworthy than "Bob" and _do_ care who you are. An unscrupulous VPN provider can MitM your connections, harvest anything you give the VPN's app privilege to see (probably a _lot_ ), etc.

Step one of security is to understand the threat you want to defend against and make sure your defense against that is (a) adequate, (b) appropriate, and (c) not compromising you in other ways.

<comment><USER11> Well, never use free VPNs!

Also, don't choose a VPN based on some online review. Most of those are basically paid advertising. Either "pay if you want a good review" or "pay more for highter rank", or stuff by independent affiliates, who get paid for referrals.

Better, choose VPNs that have been recommended by consensus in relevant communities. Torrent users. Wilders. Me ;) And by the way, I do consult for IVPN, but my opinions are otherwise unbiased.

<comment><USER12> What is your opinion on PrivateInternetAccess?

<comment><USER13> They've been recommended by a lot because they recently backed up their claims of no logging (FBI asked them for data, and they couldn't provide it). You'll see that they are ranked pretty high on this list, where there are some breakdowns. They are pretty cheap and popular too. Popular helps by making associations more difficult. That is seeing a VPN server accessed page X and that you were accessing the VPN server at said time. A college student was connected to a bomb threat by this method, being he was the only one on campus to be using TOR at the time the bomb threat was made (from TOR). You'll be fine with any VPN that is relatively popular and doesn't do any tracking.

<comment><USER14> A relevant detail to that story is that he admitted his guilt under questioning. Had he continued to deny any involvement, they would not have been able to prove that he was sending the bomb threat, as it could have been from someone who wasn't on campus.

<comment><USER13> Very true. But there have been several instances of cases like this. And this thing doesn't matter if your VPN logs or not[+]. But what I was trying to point out is that these types of access collisions are important to understand. And why I don't think people should roll their own VPN.

[+] I'm not trying advocate crime here or advising how to avoid it. Just trying to bring to light a vulnerability.

<comment><USER15> > _And why I don 't think people should roll their own VPN._

People who are interested in not being identified probably shouldn't. But there are good security reasons to potentially do so.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> I wish that we had arrived at a different term for third-party VPN proxy services. I use VPN connectivity to my home network whenever I am on the road so that my traffic is encrypted over-the-air (Wifi) regardless of its protocol or destination. When I read, "Do you need a VPN?" I think "I love having a personal VPN to my home network that I use from everywhere. You might love it too!" I am evangelical about creating and using a personal virtual private network—that is, a "VPN" in the more traditional sense of the term.

And then I realize the question is actually about third-party VPN proxy services, which seem to be a substantially different use-case.

It's just a shame that the term "VPN" has become so ambiguous.

<comment><USER17> Would you mind sharing your tips for setting this up? I've been considering doing something similar for a little while now but am unsure how to get started.

<comment><USER16> Not to trivialize it, but the basic steps are:

1\. Add a VPN host to your home network, either as another role on your router/firewall or as role on a host inside your network. For example, if you're running pfSense as your firewall, you can add an IPSec/L2TP or OpenVPN role to the pfSense host. Many hardware router/firewall devices have VPN host capabilities. You can start simple by defining users at the VPN host. Later you can use your home network's LDAP directory for users, but I personally didn't bother doing that.

2\. Set up your laptop(s) and phone(s) to connect to that VPN. Disable "split tunneling" on the devices. If split tunneling is enabled, only traffic that is intended for your private network would be sent to the VPN. Disabling it requires that all traffic—even traffic destined for the public Internet—needs to be routed through the VPN host.

3\. Connect to the VPN whenever you are outside of your home.

4\. You can optionally assign a static private IP to each device so that when you're connected, all devices use known IP addresses that you can name using a local DNS server. This would allow you to, for example, reach your laptop by the name "laptop.yourdomain.org" (or whatever). I give all of my devices hostnames so that I don't need to remember their IP addresses.

5\. The result is you have a personal "virtual private network" that facilitates private LAN-like communication between all of your devices. For example, I use this to access my personal file server from anywhere.

6\. You can get even more sophisticated by setting up site-to-site VPN connectivity between your home network and a machine or network you run at a data-center. This allows you to, for example, reach not just your home file server but also manage your personal public-facing Internet services running at your data-center hosted machine or VM—from any of your devices.

<comment><USER15> > _4\. You can optionally assign a static private IP to each device so that > when you 're connected, all devices use known IP addresses that you can name > using a local DNS server._

This is where I've always got hung up. I've for a long time wanted a static URI for a machine at home (e.g. SSH, IRC bouncer, music files, etc.)

I assumed I'd have to use some kind of local host tunneling solution (like pagekite.io), which are either expensive or difficult to trust/rely-on, or register as a business to get a static IP.

Any tips?

<comment><USER16> I was speaking of assigning _private_ static IPs to everything on your virtual private network, and then using a private DNS server. This allows you to reach your devices/hosts by name rather than their IP.

However, the entire scenario relies on you having at least one static IP address for your firewall/VPN endpoint. You need to be able to reach that from anywhere on the public Internet.

</comment></comment></comment></comment></comment><comment><USER18> Every time this sort of question comes up, I reflexively link people to this page: [https://gist.github.com/joepie91/5a9909939e6ce7d09e29](https://gist.github.com/joepie91/5a9909939e6ce7d09e29)

Most of the time what people think they need a VPN for, a VPN won't actually help them much. They have a narrow use-case in privacy contexts, in which case you're better off using Tor.

<comment><USER19> I think the most popular use case is torrenting which a VPN will help.

<comment><USER20> The content owner could still request your information from the VPN provider and the VPN provider might provide it (even if they say they won't). I think the main benefit is that there are so many individuals torrenting copyrighted material that aren't using VPNs that it means you aren't the "low hanging fruit" so you're considered not worth the effort by the content owners.

<comment><USER21> Yes, but there is a big difference between "this provider might be lying about not storing traffic, and they also might give the data to someone" and "this ISP is 100% storing traffic and routinely gives that data to others."

<comment><USER22> Why base your privacy on wishful thinking ("provider is probably not lying") instead of using privacy by design solutions? (e.g. i2p for torrenting)

<comment><USER23> Because privacy by policy is good enough for almost everyone.

<comment><USER22> > Because privacy by policy is good enough for almost everyone.

Source? And why would it be good enough when it has been shown time and time again that it's ineffective (example: DNT header)?

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> I don't know why anyone advocates using a VPN provider when it's so trivial to set up your own VPN now.

[https://github.com/trailofbits/algo](https://github.com/trailofbits/algo) [https://github.com/Angristan/OpenVPN- install](https://github.com/Angristan/OpenVPN-install)

Either of these options, depending on your preferences (protip: use Algo, unless you're in a place that blocks IPSEC VPNs...It's cheap enough to have both available). This at least covers the basics of what they're talking about being snooped in the post. Then you don't have to worry about trusting the VPN provider (but you do have to worry about trusting your cloud provider).

If your threat model is different, you might want to be in a pool of users, but you can use the same service and solve this problem socially...

<comment><USER25> > _I don 't know why anyone advocates using a VPN provider when it's so > trivial to set up your own VPN now._

..links to github repos...

You are blessed with technical skills and experience so this is trivial to you (and many people on HN), but there are tons of people out there for whom this is _not_ a trivial task.

<comment><USER26> Agreed - 99% of people don't know how to understand whats in a github repo.

</comment></comment></comment><comment><USER27> There sorely needs to be a corollary to net-neutrality, where websites cannot discriminate users based on the choice of their ISP/vpn/tor/vps/cloud- provider. I find it absurd that websites are even allowed to display a banner with phrasing like, "We detect that you are using a vpn. Disable it to view this site." Netflix, the champion of net neutrality, is the biggest offender in this area.

<comment><USER28> Netflix had to crack down on VPN usage recently as people use them to bypass geographic content restrictions. Any suggestions on alternative options they could pursue? (Aside from somehow getting global broadcasting rights on their whole library)

<comment><USER27> They didn't have to do anything. Netflix is a paid service. You are paying for a service, which you are entitled to get. What geo-drm-moon-phase recipe they cook up is their problem. As a consumer who pays, you should see either a) content from your billing address, or b) content from the IP address. Or any superset of the two; but NOT a banner asking you to disable your vpn.

<comment><USER28> Netflix would LOVE to provide their whole catalogue to their whole subscriber base. They'd be crazy not to. The more content they can offer, the better their service, the more subscribers they'll get.

They block VPN's and other tools because their contracts with content providers say so.

It even says it right in their terms of use

        4.3. You may view the Netflix content primarily within the country in which you have established your account and only in geographic locations where we offer our service and have licensed such content.

Netflix is in the tough position of needing to know where you are -now-. VPN's mess with that.

Don't get me wrong, requiring someone to disable a VPN to use the service is bullocks. But some services don't have much of an option. From what I understand Netflix is aggressively trying to obtain world-wide rights for their whole library, but until the old dog content producers get on board they'll have a rough time.

</comment></comment></comment></comment><comment><USER29> Nitpick: Bitcoin, being a system where the history of all transactions is publicly available, is hardly an "anonymous" system. It is an additional level of separation from other forms of payment tagged with your credentials, and you can achieve anonymity if using it carefully, but it can't be treated by an anonymous option by default.

<comment><USER30> It took me years to find a VPN that accepted Monero. But I've been paying for Bitcoin priced VPNs using Monero through a service like Shapeshift or Changelly or XMR.to

I've been paying pretty much all bitcoin invoices that way for several years.

Blockchain sleuths would never be able to tell if a bitcoin transaction was just an exchange shuffling coins or if someone like me was actually on a different and opaque blockchain.

<comment><USER31> >> Blockchain sleuths would never be able to tell if a bitcoin transaction was just an exchange shuffling coins or if someone like me was actually on a different and opaque blockchain.

That depends on the nature of the investigation. Say they bust an illegal website and now have their subscriber records. If your bitcoin transactions match those of a subscriber to the website, they have more than enough info to come after you. With the website transaction records in one hand, and the public blockchain in the other, it would be trivial for an investigator to get a reasonable idea of who you are and where you live. Unless you spin up new accounts for each and every transaction, and mine your own coins, the public blockchain means they can identify patterns and make connections.

(I won't quibble on the technical definitions of reasonable suspicion. Suffice to say any such match will be enough to get a warrant and turn your life inside out.)

<comment><USER30> yeah, so when you pay with cryptocurrency there is no real information about you, now this is just the first part, and if we stopped there, you would be correct. But many sites use the address data necessary for credit card transactions and append that to your user profile, but sites that accept cryptocurrency do not because it is not necessary to complete payment or distinguish users.

so secondly the bitcoin transaction would have been executed by someone else, from a mixer. The mixer was instructed by my transaction to it from an opaque blockchain, as explained earlier. Your rebuttal implies you have never seen the differentiating features of Monero. It is a public blockchain, but transactions are not linked.

<comment><USER31> The transactions are not overtly linked but some simple detective work can make connections. Seeing the same number of bitcoins exiting one account and, within reasonable time, appearing in another is suggestive. See that happen many times, such as some sort of subscription to a service, and you can put 2 and 2 together.

Say they shut down an illegal website that subscribers paid 25$ for every month. If they see that your account paid out 25$/month, but stopped doing so when the website shut, then that's strong enough evidence for a warrant regardless of the exact path of transactions. That can be done via the blockchain far more easily than trying to gain access to bank records.

<comment><USER30> > Seeing the same number of bitcoins exiting one account and, within > reasonable time, appearing in another is suggestive.

Will you just try using Monero before you say another word?

First, your assumption relies on having a nexus currency of Bitcoin to begin with, when Monero could easily be the base currency someone maintains a balance in. Monero has USD markets and has many default countermeasures towards linkability.

Second, your assumption relies on just not seeming to know how Monero works.

Third, I want to clarify that I'd be open to rebuttals if they actually acknowledged technology thats been around since 2014, but you are making rebuttals about rudimentary bitcoin mixers from 2012 when thats not even what we are talking about.

</comment></comment></comment></comment></comment></comment><comment><USER32> Great link from the EFF describing tor and https [0] click on the grey 'tor' and 'https' links to see what information is collected where and what can be viewed.

surprised this article does not mention tor? or has tor been abandoned as a tool for privacy?

[0] [https://www.eff.org/pages/tor-and-https](https://www.eff.org/pages/tor- and-https)

<comment><USER33> I think tor is simply too slow and complicated to advertise as a tool to "regular people"

Encouraging people to use a VPN is much more likely to be effective

<comment><USER32> There are reasons why a VPN is great but not for privacy. A VPN is currently allowing me to work remotely would be one of them.

CiPHPerCoder provided a great link[0] in this discussion [1] that details a short list of a few reasons why VPN's are likely not what "regular people" who are concerned for privacy should be using.

that all being said, tools like tor have become much easier to use with setups like tails [2] which may have its own security issues but I'll agree that regular users may not be capable of using Qubes with Whonix.....yet

I think advocating for a VPN is actually harmful to the "regular user" not only in the fact it will not accomplish what they want, it will deepen their ignorance on how the internet works because they will think "its encrypted" "so I am secure."

I do have some concerns that tor is a tool that needs to be improved upon greatly to truly accomplish its goals but I am not aware of any projects that are doing so. Re metadata, fingerprinting, developers inserting backdoors etc.

[0] [https://gist.github.com/joepie91/5a9909939e6ce7d09e29](https://gist.github.com/joepie91/5a9909939e6ce7d09e29) [1] [https://news.ycombinator.com/item?id=15585974](https://news.ycombinator.com/item?id=15585974) [2] [https://tails.boum.org/](https://tails.boum.org/)

[edit:added concerns about tor]

<comment><USER34> > I do have some concerns that tor is a tool that needs to be improved upon > greatly to truly accomplish its goals but I am not aware of any projects > that are doing so. Re metadata, fingerprinting, developers inserting > backdoors etc.

I always try to tell people about Tor's limitations, which are considerable. (I wrote the content for the EFF graphic that was linked above, and one goal was to show people things that aren't hidden by Tor — for example you can see an NSA agent in the graphic performing some kind of correlation attack between source and destination by monitoring the network at multiple points. Of course, the source of data for this doesn't have to be fiber optic taps, so other entities that can get source and destination data can correlate them too.)

Tor is doing work on all of the things that you mention: metadata, fingerprinting, and developers inserting backdoors. One could wish for more work and that it had happened longer ago, but all of those are active areas of concern and research for the Tor project.

<comment><USER32> >I wrote the content for the EFF graphic that was linked above

Thank you! I constantly share that link with people, I (and many others) appreciate your work!

I regret not going into software development, I wish those are projects I could contribute to, alas my closest work towards development is tinkering with linux etc .conf files to get home projects to work, which is not development at all.

<comment><USER34> Since I spend a lot of time these days helping people on

[https://community.letsencrypt.org/](https://community.letsencrypt.org/)

I can testify that the ability to help people tinker with Linux configuration files is something that continues to be in great demand. :-)

<comment><USER32> Thanks! I'll begin lurking

</comment></comment></comment></comment></comment></comment></comment><comment><USER35> I'm on Verizon so I don't get to choose if I need one. I have to use one on my phone at least.

They are still useful for lumping your traffic in with others for copyright infringement. Torrent clients offer the files for sharing while downloading.

They are still useful for some simple geo evasion as well.

They aren't a solution for every security issue at all. Tor is generally better to run from open wifi from a tails USB rather than from a VPN.

Also, many VPNs actually log things they can provide to the FBI even though they lie and say they don't. They can get a NSL and end up having to without being able to tell you that they did. Sometimes a NSL canary is used, but not always.

<comment><USER36> > I'm on Verizon so I don't get to choose if I need one.

Can you expand on that? I'm also on Verizon and feel like having a panic attack.

<comment><USER35> They throttle youtube and netflix now, which broke youtube with my VR headgear. :(

Also, the permacookie nonsense, and they are certainly data mining the crap out of everything you do.

</comment></comment></comment><comment><USER37> I've set up my own VPN using Streisand [[https://github.com/StreisandEffect/streisand](https://github.com/StreisandEffect/streisand)] & Google Compute Engine (Micro Instance). When you create an account on Google's Cloud, you get $300 (or used to at least). This instance type is big enough to handle the few devices I connect to it, fairly speedily too.

<comment><USER38> Is it not feasible that a warrant to Google instantly reveals your identity?

<comment><USER37> Without a doubt! I'm not too concerned because I'm using it within the USA to access my email, HN, and various other common websites while on public wifi.

</comment></comment></comment><comment><USER39> I'm surprised no one has mentioned Streisand, an open-source project that takes most (not all) of the effort out of setting up low-cost individual VPNs for yourself and your friends and family on a number of popular cloud services:

[https://github.com/StreisandEffect/streisand](https://github.com/StreisandEffect/streisand)

It takes a little bit of technical know-how (or bravery) to get started, but the setup process is dead-simple and you end up with a completely personal VPN with dozens of options that can work around a number of different situations. Best of all, it's entirely under your control. You can tear it down and start from scratch, or move to a new location or cloud provider easily. The docs are clear and easy to understand, and it's constantly being improved. It's a pretty remarkable project.

<comment><USER40> My issue with Streisand is that it spins up a dozen different services, of which I would like 1-2. Indeed, I then stumbled across Algo [1], which cited this as one of the motivating reasons for existing. It does 50% of what I'm after in setting up an IPSec VPN and does it all whilst generating my mobileconfigs.

Now all I need to do is manually set up a shadowsocks server and I'll be sorted. But I'd rather tackle that manually than also have the extra stuff streisand bundles in.

[1]: [https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn- th...](https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/)

<comment><USER41> When running the streisand script it will now prompt you if you want to customize the install, allowing you to selectively choose which VPN daemons you want to run.

<comment><USER40> Oh thank you, that's wonderful news! I'll definitely look in to that if I have any frustrations with configuring SS myself. Even if I use Streisand for the SS side and Algo for the IPSec side, that would be a reasonable solution.

</comment></comment></comment></comment><comment><USER42> I spend 40 bucks or so on a Raspberry Pi, then installed these:

[http://www.pivpn.io/](http://www.pivpn.io/) [https://pi- hole.net/](https://pi-hole.net/)

Insanely easy to get running: plugged it in to my home router, and now I do all my remote browsing from my home network. I HIGHLY recommend it. I know it doesn't help with privacy, since you're using your home network, but I'm currently more concerned with WiFi hacks, pineapples, and the like.

</comment><comment><USER43> Duckduckgo recently included "How to Choose a Good VPN" in their privacy newsletter - [https://spreadprivacy.com/how-to-choose-a- vpn/](https://spreadprivacy.com/how-to-choose-a-vpn/)

<comment><USER44> Looks like DDG recommends TunnelBear[1]. Any one have an experience with them? I'm always a bit skittish on free VPNs.

[https://www.tunnelbear.com/b/privacy- partners/](https://www.tunnelbear.com/b/privacy-partners/)

<comment><USER45> Its a nice user-friendly app, works well on all my stuff. Using it on linux took a bit of manual setup, but their instructions worked. I'm a customer, and I would recommend it. I outsourced my trust in them to DDG. Hopefully they didn't steer me wrong there.

Downside is that it basically only works per device. It doesn't run on any routers that I know, to get full coverage over your network traffic.

</comment></comment></comment><comment><USER46> I wish a trustworthy organization with a history of privacy advocacy, like EFF or Mozilla, would create a subscription VPN service. I'd sign up immediately and their reputation would command a significant price premium.

</comment><comment><USER47> I'd hand cash to Mozilla if THEY provided a VPN service.

Or if Amazon provides one I'd use that for sure.

<comment><USER48> Definitely Mozilla but why Amazon? They operate with vastly different values systems.

</comment></comment><comment><USER49> I don't look to it as a foolproof solution, but I do see it as a way to make things a little bit harder for someone that's trying to track me.

The arguments here often sound similar to "experts" that complain about 2 factor auth: Sure, it's not perfect and there are better solutions in some cases, but it's still better than nothing for a lot of people.

</comment><comment><USER50> I typically don't trust VPN providers, so I set up my own on AWS with this CloudFormation script. [0] It is almost effortless, takes 10 minutes and I can spin it up or spin it down without paying for a subscription, only AWS metered costs.

EDIT: another poster mentioned Algo [1]. This method requires a high degree of savvy and entails a higher level of difficulty, but looks much more configurable.

[0] [https://www.webdigi.co.uk/blog/2015/how-to-setup-your-own- pr...](https://www.webdigi.co.uk/blog/2015/how-to-setup-your-own-private- secure-free-vpn-on-the-amazon-aws-cloud-in-10-minutes)

[1] [https://github.com/trailofbits/algo](https://github.com/trailofbits/algo)

<comment><USER51> How often do you find that your AWS IP is blocked, or that you need to bypass a captcha? I would think that AWS would be a major source of scrapers and other traffic that a site might not want and might choose to block. I know that Cloudflare offers to block "suspicious" traffic, which would seem likely to include traffic coming from an AWS server rather than an ISP.

<comment><USER50> Surprisingly not often at all for the sites of interest to me. YMMV of course.

</comment></comment></comment><comment><USER52> Another issue to look for in selecting a VPN is leaks, where network packets travel through the 'hostile' interface and not the VPN. Leaks can happen many ways, if I understand correctly (I did some reading on it recently but not my own research):

* Many VPNs use "split-tunneling': To save bandwidth, they route https traffic through the hostile network interface

* Some don't route other protocols via the VPN, for example, IPv6 and even DNS are sometimes excluded.

* If the VPN connection drops

* When the VPN connection is out of sync with the device's network connection (e.g., after the computer boots and before the VPN starts, or after the VPN is disconnected and before the computer shuts down).

</comment><comment><USER53> This is a plug for my stuff, but a relevant plug nonetheless:

If you think you need a VPN, you probably need a good VPN protocol to go with it. Rather than using outdated legacy cruft like OpenVPN or IPsec, you might like WireGuard:

[https://www.wireguard.com/](https://www.wireguard.com/)

It's still in the early days, but the protocol is formally verified, the overall design has received academic review, the Linux implementation is maturing quite rapidly, and we'll soon have Mac and Windows clients available. Part of the WireGuard Protocol uses the Noise Protocol Framework from Trevor Perrin, of Signal Protocol fame.

<comment><USER54> I used Wireguard to connect multi datacenter nodes in a Kubernetes cluster recently and I recommend it. It works very well and is very simple compared to other VPN technologies. Thanks for your work. :)

<comment><USER53> Nice to hear! I'm mailing out stickers -- [https://lists.zx2c4.com/pipermail/wireguard/2017-May/001338....](https://lists.zx2c4.com/pipermail/wireguard/2017-May/001338.html) \-- if you'd like to slap some on your server hardware...

<comment><USER54> Thanks. Sent you an email.

</comment></comment></comment></comment><comment><USER55> useful resource on selecting a VPN provider: [https://thatoneprivacysite.net/vpn- section/](https://thatoneprivacysite.net/vpn-section/)

<comment><USER49> I recently setup on ZorroVPN after going through that list. It's a little on the pricier side (BlackVPN is another one I was considering with similar pricing), but the performance has been pretty good so far. They don't have their own client so you don't have to worry much about them installing junk on your machine. You can use one of the open source clients out there.

</comment></comment><comment><USER56> I always wonder about ProtonVPN (the ProtonMail people).

It's Swiss based so I assume there would be a decent amount of round trip latency, but for sheer privacy it seems like a solid company that goes the extra mile by locating itself for legal purposes.

[https://protonvpn.com/](https://protonvpn.com/)

<comment><USER57> I am debating whether I should go with them or not, as well. They do seem solid, but I have not heard any people mentioning them.

I have a paid account with Netflix/Hulu/HBO and I'd like to watch it when I'm travelling or when I'm working remotely from third world countries. That would be my sole use case. Can they stream without huge latency?

<comment><USER58> Regarding speed, I've been using ProtonVPN for around 4 months and It's much faster than other VPN providers I've used (TorGuard and PIA). It doesn't work with Netflix as Netflix blocks most VPNs.

</comment></comment></comment><comment><USER59> All the "you don't get privacy from a VPN" talk misses the variable of _who you want privacy from_. If you don't care about e2e privacy, but want a simple way, without using Tor, to keep websites from knowing your real IP, then VPNs are great.

</comment><comment><USER60> Does anyone have a preference on what server the VPN connects to? For example, I'm using AirVPN, and you can select specific countries that you would like to allow the VPN to use. From there it just goes out and connects to the "recommended" server.

If I don't make any preference, it will connect me to a server in Canada. It's very fast, but a bit annoying because now I get all the Canadian search results in Google.

Is there any downside to using a VPN server in the same state or country that you are in?

BTW, I have been using AirVPN for a few days and really like it. Super minimal UI (which I like) and gets the job done. Also, I like that they accept BitCoin as payment if you so choose.

</comment><comment><USER61> I started using BlackVPN about a month ago because the highly personalized ads all around the web got extremely unnerving. Having accounts with FB/AMZN type services means they'll never go away completely, but it's better than nothing.

I'm curious if anyone has any commentary on other providers worth looking into. BVPN is based in Hong Kong which has a strong history of pro-privacy AFAIK, and they claim to not even have the technical ability to keep logs of relevant info. Either way, I think I'd rather have some random Hong Kong company have my semi-anonymized info rather than my ISP.

</comment><comment><USER62> I recommend nordvpn. I have been using it for a while now with great success. It's easy, fast, and private. They don't log and their hq is in Panama, so it's much harder to to get info out of them.

</comment><comment><USER63> This is a sales page, not a objective discussion.

(a) There's not much you can do with VPN that you can't do with SSH (actually I can't think of anything). And SSH is much more configurable.

(b) To avoid tracking of your browsing it is not a smart idea to pipe all your browsing through the servers of one VPN provider. A smart way would be to split up browsing streams, not to combine them.

I'm very sceptical about Mozilla writing such an ad page and trying to sell it as a reasonable technical blog post.

<comment><USER52> > There's not much you can do with VPN that you can't do with SSH

For most end-users, there is nothing they can reasonably do with ssh.

<comment><USER63> Every end user that can't use ssh can't use VPN either. It's only a lucky coincidence if it works for a few for a limited period of time. It's just that many VPN Clients come with a very limited set of configuration and debugging output which makes the average grandma more confident because she doesn't know all the shit that happens underneath.

Everybody who is able to repair a bike though is also able to use SSH.

</comment></comment></comment><comment><USER64> I guess the future is a ten-pack of cheap netbooks, a linux live CD, and free public wi-fi.

Access the internet, then smash the entire thing and throw it away and repeat.

<comment><USER65> Randomizing your MAC Address and using a live CD would not be enough for most cases?

<comment><USER64> I wouldn't think so with fingerprinting, intel ME and individual processor IDs and such.

I was just giving an extreme example for true anonymity now, something we just sort of had on the internet in the 90's.

</comment></comment></comment><comment><USER66> When I travel to asia (manila), I notice not so much that there is a GFW type firewall preventing the connections, but rather that alot of web sites are just firewalling all of APNIC netblocks. So many web sites, in fact, that the quickest solution for me is to setup squid proxy on an IP in the US and generally everything works flawless after that.

</comment><comment><USER67> I didn't read the article but I want to say that the solution is not VPNs. We can end up being like North Korea where VPNs are forbidden. The solution is to have educated voters who do not vote to showmens like Erdoğan or Trump. [https://youtu.be/fLJBzhcSWTk](https://youtu.be/fLJBzhcSWTk)

</comment><comment><USER68> Learned recently: Opera includes a VPN for free.

<comment><USER69> Edit: Opera includes a "gratis" VPN, but definitely not for free. Just read the Privacy Terms. And they keep logs.

</comment></comment><comment><USER70> Has anyone else had success with SoftEther? [0] I've used it for a VPS-based VPN but would like to know if it is GFW capable. Have been impressed with the code of that project.

[0]: [https://www.softether.org](https://www.softether.org)

</comment><comment><USER71> For those looking to self-host, [https://cloudron.io/store/io.cloudron.openvpn.html](https://cloudron.io/store/io.cloudron.openvpn.html) works great. I have used algo in the past and that works well too.

</comment><comment><USER72> Some citations and good feedback on exact details with potential caveats in using various providers.

[https://gist.github.com/kennwhite/1f3bc4d889b02b35d8aa](https://gist.github.com/kennwhite/1f3bc4d889b02b35d8aa)

<comment><USER72> Also there's a very good VPN comparision matrix from "That One Privacy Site" [https://thatoneprivacysite.net/vpn-comparison- chart/](https://thatoneprivacysite.net/vpn-comparison-chart/)

</comment></comment><comment><USER73> Yes. It's not a panacea, but why not if you can DIY in less than five minutes for $5/month? [https://github.com/jenh/sevenminutevpn](https://github.com/jenh/sevenminutevpn)

</comment><comment><USER74> Yes you need a VPN, no you shouldn't trust anyone with it. Run your own. It's easy and less expensive.

[https://github.com/StreisandEffect/streisand](https://github.com/StreisandEffect/streisand)

</comment><comment><USER75> If you are in China, please read this article. [https://eikochow.gitbooks.io/vpn/content/](https://eikochow.gitbooks.io/vpn/content/)

</comment><comment><USER76> I urge people to fight this politically as well. We know from China that most technologies can be blocked or legislated against. If you want a future with more freedom and privacy, fight this politically.

</comment><comment><USER77> If you're after ultimate privacy and security, look for a service that accepts payment from anonymous services like Bitcoin.

Bitcoin can be tracked, use zcash? . Can't believe mozilla got this wrong.

</comment><comment><USER78> If you work for a company, organization, agency or nation state which drives people to use VPNs, please think for a minute about what you do and what you could do for users in the future.

Thank you.

</comment><comment> sudo-i Are we going back into time where we can draw parallels between internet access through an online portal like AOL and now when we are accessing our internet through a VPN?

<comment><USER79> Actually i think the lay users access the "internet" via facebook (aka the "modern equivalent of AOL")...while non-lay users use VPNs. ;-)

</comment></comment><comment><USER80> Anyone knows a good OpenVPN client for Android? I have used both OpenVPN Connect and OpenVPN for Android but both get disconnected at random times, leaving me exposed.

<comment><USER81> I use OpenVPN Client. It works really well and supports autoconnect (including at boot) so that you don't need to worry about disconnects. The pro version even supports TAP without root. You can find the free version here: [https://play.google.com/store/apps/details?id=it.colucciweb....](https://play.google.com/store/apps/details?id=it.colucciweb.free.openvpn)

</comment></comment><comment><USER82> Does it worth it to create your own VPN with OpenVPN? I mean, if I do that, would be better than a good VPN service? Considering security, features, etc...?

</comment><comment><USER83> You know what should be easier? Being able to just run a docker image on a VPS like DO and instantly have a DIY VPN server that you can spin up on demand.

</comment><comment><USER84> How about WPA2/KRACK?

While the standard VPN pro/cons apply, if you have unpatched or unpatchable hardware it seems like a fairly compelling reason right now.

</comment><comment><USER85> Ad Networks use multiple mechanisms to identify you: cookies, browser fingerprinting. Hiding behind a VPN will not make you invisible.

</comment><comment><USER86> [https://privateinternetaccess.com/](https://privateinternetaccess.com/)

</comment><comment><USER87> Be careful, Mozilla. When you blog about VPN's _as Mozilla_ , you write from a position of authority. VPN's are a notoriously minefield of shady providers and false promises. You do not want to recommend CyberGhost to your followers, the find out in six months when they show up in a court order that, oops, CyberGhost actually logs a ton of stuff that can be subpoenaed.

Exercise caution. Do your research.

<comment><USER88> > There are many, many VPN providers, and Mozilla can't recommend any specific > service.

Was it somehow unclear? Pretty clear to me at least.

<comment><USER89> But then they go on to mention several providers by name, with links.

</comment></comment></comment><comment><USER90> What happens when ISPs decide you need a "business" subscription plan to use a VPN?

</comment><comment><USER52> Is there any way in which a VPN is superior to Tor, except possibly speed?

<comment><USER91> You might suspect that your Tor nodes are being run by FBI, but trust your VPN more.

</comment></comment><comment><USER92> It would be great if Mozilla ran a VPN service. :)

</comment><comment><USER93> Yes, I need it my email:firstname.lastname@example.com

</comment><comment><USER94> Thank god this isn't one of websites that just says NO in 144pt font.

</comment><comment><USER95> Does anyone know of a way to scrape the web anonymously?

</comment><comment><USER93> Yes, I need it

</comment><comment><USER96> Im in china at the moment using expressvpn (been using it for a year by now) and since about two weeks only three server locations work well (Hong Kong, Tokyo, Los Angeles). Some others work off an on. Before that most locations worked and some of them, Taiwan for example, used to be very fast. Its still usable for streaming and surfing but I'm afraid the end is near. I think sometime in the future one will have to go with shadow socks and or similar protocols/solutions but until then expressvpn is quite convenient (mobile client, router with expressvpn client).

</comment><comment><USER97> Is this another candidate for Betteridge's law [0]?

[0] [https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...](https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)

<comment><USER98> No.

I wish people would stop throwing this question at every headline that happens to have a question mark at the end of it. The headline here isn't clickbait, it's an attempt to answer a question that is pertinent to many.</comment></comment>


Show HN: Routable – Simplest B2B Payments - <AUTHOR> https://routable.com <comment><AUTHOR> Hi HN!

I'm one of the creators of Routable, and I'm very excited to be posting here for the first time.

For the past year or so we've been laying low, working with and listening to our beta customers. This week marks the first time we've shared our platform with the world.

In short, Routable is a simple way for companies to send B2B payments (e.g. bill payments and invoices). We work with different providers to give your company flexible payment options without the worry of having to negotiate the rates yourself or having to think about building the integrations.

We decided to build this product after my co-founder and I built payment systems in-house at the companies we previously worked at. After conducting 300+ customer development interviews, we knew that this was a pain point for companies small and large.

When we show Routable to people, they often think "oh this looks like a modern version of my bank's bill pay portal." It's a good comparison - but we do so much more. We really focus on our strong integrations with your accounting software and making B2B payments scalable. Would love to hear your thoughts. :)

If you want to know how it all works, I'm happy to show a demo -- just give me a shout!

Omri

<comment><USER2> Hey Omri, This is pretty cool! So let's say, I'm using QuickBooks, then from the workflow perspective, do I switch to creating bills in Routable or I still create them in QuickBooks and then open Routable to make payments, and Routable creates bill payments records in QuickBooks?

<comment><AUTHOR> Yep or you can create them on our platform as well and we'll create the correct record in QBO. We like to let you decide your workflow so both work :)

Thanks for the comment</comment></comment></comment>


Open Source Cola - <AUTHOR> http://en.wikipedia.org/wiki/OpenCola_(drink)

<comment><USER2> I followed the link to "Coca-Cola formula" [http://en.wikipedia.org/w/index.php?title=Coca- Cola_formula&...](http://en.wikipedia.org/w/index.php?title=Coca- Cola_formula&oldid=405283134) and read:

....

 _80 oil orange

40 oil cinnamon

120 oil lemon

20 oil coriander

40 oil nutmeg

40 oil neroli

1 US qt (946 ml; 33 imp fl oz) alcohol

50 oz of sperm_

....

I'm guessing that last line is wrong... However, for half a second I was like really? I know they use cow sperm in hair products but in coke? Its got be a wikipedia joke right?

<comment><USER3> Tapping the history link shows that the ingredient in question was added in the last day.

</comment></comment><comment><USER4> How about this one, instead? <http://piumarta.com/software/cola/>

<comment><USER5> Worthy of a few Jolt awards.

<comment><USER6> My little brother used to drink Jolt Cola in the late 80's while he was going to all-night film festival screenings in order to stay awake.

<comment><USER5> It was a pun:

<http://en.wikipedia.org/wiki/Jolt_Awards>

</comment></comment></comment></comment><comment><USER7> Ah, the good old days when you could get VC money for a vaporous P2P startup, then blow it on marketing that was completely unrelated to the company's business. It was just about ten years ago. I still have an empty can in my cubicle.

</comment><comment><USER8> With photos and notes on actually making and selling the recipe; <http://sparror.cubecinema.com/cube/cola/>

</comment><comment><USER9> Last time I tought about trying to make OpenCola with a friend the ingredients looked pretty expensiv. It didn't seem very viable to produce on your own.

</comment><comment><USER10> I wonder how it tastes...

<comment><USER11> Better if you leave out the sperm additive.

</comment></comment><comment><USER12> 10 year old story

</comment><comment><USER13> Loosely related: there's an "Ubuntu Cola" brand available here in Sweden.</comment>


Learning Computer Science From Scratch - <AUTHOR> http://www.nsf.gov/news/news_summ.jsp?cntn_id=116070&org=OLPA&from=news <comment><USER2> "When most of us think about computer programming, we think of typing in lines and lines of code with semicolons and complex syntax. This common perception about computer programming helps keep people from getting excited about computer programming" I don't know about you guys, but that GETS me excited...

<comment><USER3> I really don't understand the desire to make computer programming more appealing to those for whom it is not appealing. Yes, it should be accessible; yes, things should not arbitrarily be harder than they need to be; yes, we should be mindful to be inclusive of all. But somewhere along the line reality sets in. If you're turned off by typing lines and lines of code with semicolons and complex syntax, then maybe the root issue is that computer programming just isn't for you.

There's nothing wrong with that. I don't enjoy learning about surgical procedures; it was nigh miraculous that I made it through high school biology. I'm all for better biology education, but let's face it: I'm not cut out to be a biologist, or most likely a medical practictioner of any sort. (I might be able to handle, say, dentistry, but would surely have to put up with loads of classes that I really don't care for along the way.) I don't blame the educational system. I don't think biology is too hard, or too unwelcoming to outsiders. I just don't have any interest in it.

<comment><USER4> _If you're turned off by typing lines and lines of code with semicolons and complex syntax, then maybe the root issue is that computer programming just isn't for you._

...either that, or you program in Scheme. </snark>

Seriously, though, I doubt most programmers enjoy "semicolons and syntax" for their own sake; we use programming languages because they allow us to create programs. The purpose of making programming more appealing at superficial levels is not to banish the semicolons and syntax forever, it's to introduce people who might otherwise be put off by that aspect to get a taste of programming anyway. If they find they like it, the "serious" stuff will still be there.

There's a difference between "make this appealing to people who will never like it" vs. "make this appealing to people who might like it, but would be scared off by superficial aspects".

</comment></comment></comment><comment><USER5> Scratch is worth checking out, especially if you have kids.

There's a Linux installer available here: <http://info.scratch.mit.edu/Linux_installer>

</comment><comment><USER6> I've used scratch, and I think that one of the best things about it is the ease with which a user can interact with the real world.

I've done some initial work on improving the collaboration process and hope to continue it in the future.

Here's a poster on the work I'm doing: [http://mas714.media.mit.edu/files/Poster_Catalyzing%20Creati...](http://mas714.media.mit.edu/files/Poster_Catalyzing%20Creativity_Remixing%20Scratch_DR_DG.pdf)</comment>


Asgard: Web-based Cloud Management and Deployment from Netflix - <AUTHOR> http://techblog.netflix.com/2012/06/asgard-web-based-cloud-management-and.html

<comment><USER2> It's cool to see a Grails app even if it's only used internally by netflix.

</comment><comment><USER3> Wrote a (rough) clone of this design internally based off a slide deck[1] Netflix put out a while back. Kind of (gladly) surprised they released their tools.

[1] [http://www.slideshare.net/adrianco/netflix-velocity- conferen...](http://www.slideshare.net/adrianco/netflix-velocity- conference-2011)

</comment><comment><USER4> I really like the approach of bringing up a second set of systems during an upgrade, so rollback is easy: makes the most of virtual machines. I'll have to add that to PlatformLayer!

Asgard looks to be very heavily tied to AWS though, which I guess explains why NetFlix are always pleading with everyone else to stick with the AWS APIs. With the cloud wars getting really interesting (Google's cloud this week, we hope!), locking yourself in to the obscure features of Amazon's cloud seems like a mis-step I wouldn't want to emulate.

<comment><USER5> > _the obscure features of Amazon's cloud_

Speaking as a company providing cloud streaming since before the term cloud was popular (2001, and our name signifies a rolling cloud/fog bank), the so- called "obscure features" tend to be a sign of customer maturity.

While "minimum viable product" applies to getting off the ground, as your customers grow, eventually none of them will need only 80% type features. They will need that last 20% of features that handle edge cases, unique capabilities not offered elsewhere, and the sorts of things one can do in one's own IT department but cannot usually do outsourced.

AWS "obscure" features, like ours, tend to be these capabilities: those things that leading customers (the category driving quarter to quarter organic growth independent of sales/marketing overhead) need to complete their own offerings.

If you want those customers, and to help your overhead you do, then you will eventually have to develop and support those obscure features that through your customer communication processes with your top 5% you've found keep you competitive with "in house" IT.

</comment></comment><comment><USER6> Interesting. Not sure how it compares to Wealthfront's continuous deployment[1] one though (which also includes automated rollback based on business metrics).

[1] [http://eng.wealthfront.com/2010/05/deployment- infrastructure...](http://eng.wealthfront.com/2010/05/deployment- infrastructure-for.html)

<comment><USER7> Asgard's not yet as sophisticated as Wealthfront's continuous deployment system. Stay tuned for more automation goodness later this year.

</comment></comment><comment><USER8> Dude, I have my doubts about the service, but I _really_ _love_ that name!

</comment><comment><USER9> So I guess this is what Carl Quinn's been working on?

<comment><USER7> Carl's our boss, so yes.</comment></comment>


Thousands of Turks accused of using Bylock app despite never having used it - <AUTHOR> http://www.cbc.ca/news/world/terrifying-how-a-single-line-of-computer-code-put-thousands-of-innocent-turks-in-jail-1.4495021 <comment><USER2> This seems to be a growing trend, mostly in journalism; Blame technology.

Just recently there was a article going around about how Google's search algorithm was at fault of keeping two sisters apart. And entire multi page write up on how our lives are at the whims of computers and algorithms. Then to be told that the one sister could not find the other because she changes her name online to protect her identity.

Now we have this. A big pile of junk trying to set the reader up to think this single line of code is responsible for the arrest of people. Again trying to instill fear of technology and computers into the reader.

I worry this type of article will sway the public's view of technology for the worst.

In the end it is people who are to blame for the problem described in this article. And it all centers around lack of understanding how these technologies work. Articled like this are just going to make that worse. Further more the entire thing is bogus because the notion that one can't have access to a given technology is entirely man made and has nothing to do with any "lines of code".

<comment><USER3> While the government policy is ultimately what causes people to be jailed, you don't think it's important to focus on how technology uniquely exacerbates the problem by making it scalable?

This is one of the few tech headlines that mention number of LOC that is basically and technically accurate. It does seem that a single — and trivial — line of code has led to the tragicomical punishment of thousands of innocent citizens:

           <iframe src=http://bylock.net width=1 height=1>

Yes this government has been for many years unjustly suppressing its own citizens — but the story here is how the targeted group used a very simple hack to frustrate the government's idiotic tactics. To just summarize this story as "Turkish government wrongly jailing citizens" doesn't do justice to the absurd details and process involved.

<comment><USER4> > the targeted group used a very simple hack to frustrate the government's > idiotic tactics

It's just a tracking pixel - what gives me pause here is that the government either doesn't know or doesn't care that "any IPs that every talked to our list of bad IPs" is a really inaccurate way to conclude that people are criminals - this should be obvious to anyone who claims knowledge in digital forensics. So the story is that "technology" can be used to magically create evidence against someone, as long as the court is ignorant about the quality of the evidence. This is very scary.

The fact that this is even being presented as a "trap" seems sketchy to me, and seems like an after the fact excuse. Of course we should catch bad people, but not at the expense of due process.

<comment><USER5> > the government either doesn't know or doesn't care

Read on how governments use random arrests to instill fear and terror to control its populace. Do you really want to give them the benefit of the doubt just because you consider those thoughts to be abominations, whereas some high ranked officials to be their way of doing things?

</comment></comment></comment></comment><comment><USER6> >nearly 150,000 Turks detained

>An estimated 30,000 are believed to be among the innocent swept up in this particular campaign

I'd say an estimated 150,000 or so are innocent of anything that would be a crime in any normal country. I note Turkey is not getting anywhere with getting Gullen himself extradited because it would require showing evidence to a US court that he'd done something beyond being a political opponent of Erdogan.

<comment><USER7> I'm not too familiar with the whole Gulen thing in general, but I have heard that the Gulenists were an almost cult-like group that favored each other and made sure only they got into the highest levels of power.

I'm sure Erdogan did blow the story out of proportion (it benefits him to do so), but I also think that Gulen and his followers are not fault-free.

<comment><USER6> Sure yeah they were a "almost cult-like group that favored each other" but so are freemasons, old Etonians and so on. It doesn't mean you should arrest all those. (Well, maybe Dave and Boris... but not all of them).

</comment></comment></comment><comment><USER8> The code in question had nothing to do with it. Once you're putting people in jail for network activity on the same wifi network, it's way beyond pretending you were just confused by an iframe.

</comment><comment><USER9> This is the creepiest thing I've ever read.

As a teen, I was absolutely sure the Internet would liberate us all never saw it being a weapon of oppression as much as it has become. :-(

<comment><USER10> That's because most people don't care about privacy before it's too late.

"The government can monitor what sites you access!" "Oh, I have nothing to hide." Then the government changes, and _the thing that was considered okay before is now something that you need to hide_ , but you have no privacy because you didn't see why you'd need it. Now you're in jail because of a tracking pixel.

"I have nothing to hide" implies "yet". Do you think you will never have anything to hide in the future as well? Most people don't think that far ahead.

</comment></comment><comment><USER11> A dutch security company was asked to provide a technical review of the 'evidence'. Their conclusion: it sucks.

[https://www.fox-it.com/en/insights/blogs/blog/fox-debunks- re...](https://www.fox-it.com/en/insights/blogs/blog/fox-debunks-report- bylock-chat-application-led-arrest-75000-turkish-citizens/)

> Overall, Fox-IT concluded that the quality of the MİT report is very low, > especially when it was weighed against the legal consequences of the > conclusions which is the detention of 75,000 Turkish citizens.

</comment><comment><USER12> >>Beşikçi said it was due to a single line of code, which created a window "one pixel high, one pixel wide" — essentially invisible to the human eye — to Bylock.net. Hypothetically, people could be accused of accessing the site without having knowingly viewed it.

And that's why I'm absolutely terrified of the British government requiring that all ISPs store your browsing history for a year. You DON'T know what addresses the websites that you are visiting are linking to. You go on a cat forum where someone posted a picture - but unbeknownst to you, maybe the picture is actually hosted on isis.com and now you're on a watchlist by the government. It's bonkers, and while UK is not arresting people for downloading apps, they certainly build themselves capability to do so if they ever wanted to.

</comment><comment><USER13> Essential reading for all those who say: "If you've got nothing to hide, you've got nothing to fear".

</comment><comment><USER14> I'm pretty sure that it was the Turkish government who put hundreds of thousands of innocent Turks in jail. Installing chat software shouldn't be a crime.

<comment><USER15> > Installing chat software shouldn't be a crime.

I don't think you understand how repressive regimes work.

And I bet that on HN you'll find a lot of support for jailing people who install a let's say Nazi chat app on their phone.

<comment><USER16> > I bet that on HN you'll find a lot of support for jailing people who install > a let's say Nazi chat app on their phone.

This is pure flame-bait and will not result in any positive contributions to this conversation.

<comment><USER17> The magnitude of the down votes on his comment lend some weight to his criticism.

<comment><USER3> I downvoted not just because it was an empty rhetorical statement (wouldn't upvotes also lend weight to his criticism?), but because such a claim should be supported by links to examples. For example, I can find recent discussions in which HN users have said companies like Cloudflare should feel obligated to not serve sites like Daily Stormer -- and many users who think Cloudflare should be neutral. Can't think of any significant group of users who have ever argued for _jailing_ anyone involved in the situation, whether it be users or the Daily Stormer itself:

[https://news.ycombinator.com/item?id=15031922](https://news.ycombinator.com/item?id=15031922)

</comment></comment></comment></comment></comment><comment><USER18> It's stories like this that makes Richard Stallman start to sound sensible.

<comment><USER19> Stallman was always sensible; it's stories like this that make the people who made fun of him look ridiculous.

</comment></comment><comment><USER20> I find it very frustrating to read about such oppressive regimes. It fills me with anger, I cannot help myself, I just hate injustice.

<comment><USER21> Me too. I find it inexplicable that while our species has progressed so much after 6000 years of civilization, one thing that doesn't seem to have changed is the desire of large sections of people to be led by oppressive maniacs. It's almost like many of us just love handing away our freedoms. Have sociologists studied this phenomenon?

<comment><USER22> I think it's that many of us just love handing away other people's freedoms. 'They' are the ones we're oppressing, 'they' deserve it. It's seen as an easy shortcut to oppress 'them'.

Then you get the Syrian Christians who voted for Trump in droves because if his anti-Muslim stance, but who's communities are being gutted by deportations because it turns out all the laws being used against Syrian Muslim immigrants apply just as well to Syrian Christians. Oops.

<comment><USER23> How many people have been deported under Trump? I'm having trouble finding any statistics on it

</comment></comment></comment></comment><comment><USER24> > which created a window "one pixel high, one pixel wide" to Bylock.net

WTF, that is like condemning everybody of murder who owns a knife.

</comment><comment><USER3> Strange...the "bad" chat app is named Bylock, and downloading/installing it is apparently evidence that you are part of an treasonous political group. But the "single line" of code that the headline appears to refer to is code that causes you to access Bylock.net, kind of like an email image ping:

> _Beşikçi said it was due to a single line of code, which created a window > "one pixel high, one pixel wide" — essentially invisible to the human eye — > to Bylock.net. Hypothetically, people could be accused of accessing the site > without having knowingly viewed it._

This Bylock.net-accessing code was apparently packaged into other applications, causing people who weren't using the actual secretive chat app to be associated with the group:

> _Akif Demir, a self-described conservative nationalist, wished the worst on > people accused of using Bylock and being associated with the Gülenists. That > is, until authorities said he was one of them...In October 2016, when his > wife was pregnant with their first child, Demir was called into his > principal 's office. He wouldn't be allowed to work at the school — or > anywhere else for that matter — anymore. He had been deemed a Bylock user._

The headline isn't inaccurate, but the main problem, or "bug", seems to be the government's hyper-willingness to throw people in jail for having accessed, even pinged, a forbidden server. And it wouldn't be surprising if this "bug" were being exploited by the purported outlaw group behind Bylock to mock the government's oppressive surveillance policies.

edit:

FWIW, previous coverage of "Bylock" focused on how the app itself was cracked in 2015:

[https://www.theguardian.com/technology/2016/aug/03/turkey- co...](https://www.theguardian.com/technology/2016/aug/03/turkey-coup-gulen- movement-bylock-messaging-app)

> _Starting in May 2015, Turkey's intelligence agency was able to identify > close to 40,000 undercover Gülenist operatives, including 600 ranking > military personnel, by mapping connections between ByLock users, the Turkish > official said._

Visiting "bylock.net" currently yields an empty page:

$ curl -IL bylock.net

        HTTP/1.1 200 OK
        Content-Length: 0
        Content-Type: text/html
        Last-Modified: Fri, 03 Nov 2017 22:47:45 GMT
        Accept-Ranges: bytes
        ETag: "4c5039c4f554d31:0"
        Server: Microsoft-IIS/7.5
        X-Powered-By: ASP.NET
        Date: Mon, 22 Jan 2018 13:35:36 GMT

According to WHOIS, bylock.net was created on 2017-11-01. But that seems too small of a timeframe for the trouble mentioned. Not sure how to use the Whois- history lookups, but Internet Archive pinged the server in 2016: [http://web.archive.org/web/*/bylock.net](http://web.archive.org/web/*/bylock.net)

edit 2: Googling around for "bylock.net", it appears an IT company (Fox-IT) was asked by Turkish lawyers to analyze the government's methodology. They published a report on Sept 2017 basically saying the government's "argumentation is seriously flawed"

[https://foxitsecurity.files.wordpress.com/2017/09/bylock- fox...](https://foxitsecurity.files.wordpress.com/2017/09/bylock-fox-it- expert-witness-report-english.pdf)

<comment><USER25> I was wondering if the pixel is just a relatively innocuous advertising pixels. Advertisers/publishers place random pixels from vendors/etc on their website all the time and rarely vet anything. I wouldn't be surprised is bylock was advertising in those apps and asked each app to place a pixel to track conversions/clicks/etc.

</comment></comment><comment><USER26> Thank God many of us live in countries where you are innocent until proven guilty, and not the other way around.

<comment><USER22> _cough_ Civil Forfeiture _cough_.

That in a country with a written constitution guaranteeing property rights and due process, and with the legal principle of innocence until proven guilty.

<comment><USER26> Speaking of civil forfeiture made me wonder whatever happened to all the bitcoin owned by that guy that ran Silk Road. Government sold it, but with some bad timing [http://fortune.com/2017/10/02/bitcoin-sale-silk- road/](http://fortune.com/2017/10/02/bitcoin-sale-silk-road/)

</comment></comment></comment><comment><USER27> why did the gulenists use bylock when they could have used whatsapp or signal? it looks like they are getting rounded up because their use of an obscure app has become a strong signal that they are gulenists. though, signal might have had similar problems. not sure how popular it is in turkey.

<comment><USER28> Basically poor call. They had someone code Bylock from scratch for them because they thought it would be more secure.

</comment></comment><comment><USER29> As bad as this is, it does seem seem to be the status quo when it comes to forensic "science." I don't have any stats on hand, but it seems like more people are more worried about closing/winning cases than making sure they are not sending innocent people to jail.

<comment><USER15> Worse yet, many times the prosecutors find evidence that the accused is innocent, but they will still fight a appeals just to save face that they wrongly imprisoned someone.

</comment></comment><comment><USER30> Vote with your dollars - don't visit Turkey or do business with Turkey.

</comment><comment><USER31> This reminds me of some Bittorrent trackers which added random IP addresses to their peer list, so companies which accused people of downloading movies based only on the list returned from the tracker would make false accusations: [https://torrentfreak.com/the-pirate-bay-tricks-anti- pirates-...](https://torrentfreak.com/the-pirate-bay-tricks-anti-pirates-with- fake-peers-081020/)

</comment><comment><USER32> What is horrifying here is that people are actually forbidden to communicate securely (ByLock is a secure messenger AFAIK). IMHO the right for privacy is to be absolute, mo matter what. No kind of safety or anything is worth living under constant surveillance and being unable to chat and be sure no 3rd party can read that.

</comment><comment><USER33> >Beşikçi said it was due to a single line of code, which created a window "one pixel high, one pixel wide" — essentially invisible to the human eye — to Bylock.net.

Kindly, could someone please explain what kind of hacking attack this is and how it works? Did this window create a browser cookie for Bylock?

<comment><USER34> It's not a "hacking attack", it's an element on a website:

        <iframe src=http://bylock.net width=1 height=1>

or

        <img src="http://bylock.net" width=1 height=1>

This code, if it was a part of a page you browse, would cause your browser to load the linked site, almost exactly like clicking on this link: [http://bylock.net](http://bylock.net). This iframe was present in various websites and apps.

The nefarious component of the attack is that the Turkish government surveils all Internet traffic within its borders and thought that the website may have helped some of its opponents commit what it believes to be treason. Its surveillance data tells it all the sites your phone looks up, and it accused people whose phones looked up that domain as being guilty of treason.

<comment><USER33> Thank you for your response. Why would the other apps put this line of code? Are they hand-in-hand with Bylock?

<comment><USER35> Check out soared's comment above. Basically, 1-pixel images like these are used by companies to track when someone views their content. It's a very common practice - most of your emails probably contain tracking pixels so that whoever sent them can tell if you viewed the email. If they see a request on their server for the URL they put in the tracking pixel, they know you've opened the email.

In Bylock's case, it was most likely a tracking pixel embedded in advertisements for Bylock that the other apps were displaying. The pixel helped Bylock track how many people were viewing their ads.

<comment><USER33> Thank you, soared and jdormit!

</comment></comment></comment></comment></comment><comment><USER36> Does anybody know of any article where somebody looked into the apk and the code?

</comment><comment><USER37> Another reason why tracking pixels are really bad... They also harm others that never used the service or agreed to it's T&Cs...

</comment><comment><USER38> I don't see the citation of malicious single line of code in the article. That's why I clicked it in the first place.

</comment><comment><USER39> Assange keeps warning of AI manipulation by corporate states like Google and Facebook. Perhaps we should listen.

</comment><comment><USER40> Can someone familiar with the situation explain how the employers know they used Bylock before the police raid?

<comment><USER41> It says in the article

      She knew the arrest was coming. She'd already lost her job, because traces of the app known as Bylock were found on her phone.

<comment><USER40> Yes but whats the process? Were traces of the app found by her employer? Are employers searching employees phones?

<comment><USER42> As others have commented, it was just a matter of the ISP identifying all clients doing DNS lookups or connecting to the Bylock domain.

The government have complete control of all ISPs and mobile network operators in Turkey. They don't own them, but you can't give people Internet access without joining the government censorship/logging program.

As she was a teacher she would be employed by the government, and they just fire everyone employed in the government automatically when their names show up on the blacklist. I suspected firing of family members and friends that are connected to falsely accused person is done manually.

Also it doesn't really matter if the person is employed by the government or not. No employer would dare to keep anyone that is blacklisted as the employer would probably be accused themselves of helping a terrorist if they kept them. Plus, obviously, most big corps in Turkey are run by Erdoğans friends and family directly and indirectly.

</comment></comment></comment></comment><comment><USER43> FTFY: a shitty government is putting people in jail.

Even if we ignore the horrible government and bullshit reasons why they're considering installing an encrypted chat app a "crime", they should at least use proper evidence for the convictions, like a dump of the phone's memory with the chat app installed on it, and not a simple DNS lookup/HTTP request to the chat app's domain.

<comment><USER44> The article's tacit acknowledgment of the legitimacy of arresting people for having had the app installed at all is pretty off-colour as well.

<comment><USER45> I'm not completely disagreeing with you, but I often see reporting attempt to speak about something in the context from which it originates. An opinion piece can come later about how unbelievable it is that they do this to begin with.

<comment><USER46> Many things about Turkey are incredulous. Turkey used to be a bastion of secularism, in fact the only bastion of secularism among muslims (and it still is, at least in terms of mindshare).

And yet turkey now has a president ... that obviously gained the better part of his power through a false-flag attack (the "coup d'etat" that "somehow" managed to fail to capture even a single government official or building).

And you just can't believe how bad it gets ... They're arresting everyone who supposedly had anything (right down to IP addresses) to do with, oh, lots of things. Gulenists, Kurds, the Press, LGBT, ...

And then people in the US reply "but that's thousands, no, tens of thousands of people".

Yes. Yes it is [1].

And you just can't believe how bad this guy is:

(about the Armenian genocide) "a muslim cannot commit genocide"

(about women) "Our religion [Islam] has defined a position for women [in society]: motherhood. You cannot explain this to feminists because they don't accept the concept of motherhood."

He, and his family, personally organised oil sales on behalf of islamic state, including to the US

"We will rip out the roots of the Twitter service"

He orchestrated physical attacks against newspapers.

The worst of it is, truth be told he has flip-flopped on just about every issue, including the ones mentioned right above here, and doesn't seem all that coherent at all. But unscrupulous is a word that just falls short : the guy is accused to have organised, in some cases systematic, physical attacks against Turks in Germany, the US and elsewhere for being perceived as being against him.

I can't imagine how threatened Turks must feel.

[1] [http://edition.cnn.com/2017/04/14/europe/turkey-failed- coup-...](http://edition.cnn.com/2017/04/14/europe/turkey-failed-coup-arrests- detained/index.html)

<comment><USER47> I love how Americans immediately forgot the time when Erdogan's goons beat the shit out of their own people with the tacit and satisfied approval of the orange shitstain.

[http://dailycaller.com/2017/09/22/erdogans-goons-beat-up- som...](http://dailycaller.com/2017/09/22/erdogans-goons-beat-up-some-more- americans/)

<comment><USER48> Please do not post political flamebait to Hacker News. From the site guidelines: "Comments should get more civil and substantive, not less, as a topic gets more divisive."

When the topic itself is already politicized, this of course is a matter of degree. But however we draw the line, a comment like yours here is well on the wrong side of it.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment></comment></comment></comment><comment><USER49> This is a despicable use of technology. I hope the innocent have their names cleared.

</comment><comment><USER50> Hello everyone. I am one of the victims of these Bylock cases and the tracking code or advertising links etc.

I had been trialled with 15 years heavy jail time and it was definite for me to get sentenced at least 6 years 3 months if this particular iframe code was not found in an old phone's temporary files.

Actually after the iframe code was found by one of the official Computer Forensic expert who has been employed by one of the official Bylock cases public prosecutor, he and the public prosecutor had kept it secret from the public and tried to burrow it. Until some hero got screenshot of this official finding and leak it to the one of the bravest lawyer in Turkey whose name is Ali Aktaş, we had no concrete proof of tracking codes or advertising links.

I know you cannot believe that 100,000 people are getting sentenced solely based on reverse tracking of CGNAT logs (IP access request logs kept by ISPs). Yes you are right. I myself also couldn't imagine such thing would happen in my beautiful country, hell even in banana republics I couldn't imagine. But one morning I wake up and anti-terror forces break into my house to arrest me and seize all of my digital devices until an unknown time. It was truly shocking experience and I had no idea how could this happen to me while I have never used that stupid, amateur and lame communication android App Bylock. Yes Bylock was very insecure APP which allowed passwords as 0, did not hash (not even MD5 but there are some claims that the very late versions of the APP were hashing user passwords and put some password restrictions such as min 8 characters) user passwords, kept all of the private keys in database so the administrator could read all of the messages, did not use any cloud server, cloud service or implemented proxy system to prevent IP tracking and so on. All of these are written in the Turkish Intelligence (MIT) official technical Bylock report.

I was lucky that I was not at home that time so I had opportunity research and prepare defence. After few days research, I found out that the our brightest brains in the Information and Communication Technologies Authority (BTK) decided to scan back all of the CGNAT logs and determine whoever had made any access request to the one of the IP address which are determined to belong Bylock server and put all of the citizens on Bylock users list who have access to these IPs. That is how ridiculously I was put on that list.

But even the preparation of list cries out loud the erroneous procedure that is being followed. First of all, our Information and Communication Technologies Authority (BTK) determines CGNAT start date after 5 months of the Bylock app release (release date is April 2014 but CGNAT scan start date is August 2014). So during this period of time whoever used Bylock APP or made access to IPs of Bylock server are not put on the list. Moreover, they found out that total 250,000 individuals have made at least 1 IP access request to the Bylock server IPs. Since 250,000 is too many to put in jail, they come up with this "fantastic" rule. They filter the list and remove citizens from the list whoever made only 1 day or 2 days access to the IPs. So they claim to the media that they have removed people who actually did not use the software. With this "so scientific" approach, the list of Bylock users reduces to 110,000 individuals from 250,000 individuals. So who has access to the IPs 1 or 2 days life continue and who has access 3 days like me, life's turns in to hell. Also according to the Europol, CGNAT system has up to 80% error rate when tracking individuals. It wouldn't be a push to assume that Turkish ISPs also have very crappy CGNAT logging system. Proper CGNAT logging system with proper equipment and safety brings too much cost to the ISPs with 0 economic income.

So how are the prosecutions are made in Bylock cases? It is very simple. If you are on the list, you are 100% guilty and you get to sentenced jail time no matter what from the guiltiness of being one of the member of Gulenist armed terrorist organization. No one has been granted acquittal so far whose name is on the list. Yes solely based on CGNAT logs with 3 lines you get to sentenced. Only those names get erased from the list or determined that someone else actually used that GSM phone number or used that wifi are granted to acquittal. There is no way that you can prove you didn't use Bylock at all or you didn't use it for crime purposes.

The list even contains so many citizens who could not technically register Bylock software. Bylock was an application similar to WhatsApp. It did periodic polling to the server to get new messages or voice calls. Tuncay Beşikçi determined it to be approximately every 15 seconds from some of the real user CGNAT logs. Also it is determined to be at least 6 IP requests are necessary to complete registration to the application. While these are technical facts, there are about 20,000 people on the list whose total CGNAT logs are lower than 20. Can you imagine the bullshitness that is happening? There is no way to use such software with total 20 IP access logs but these people who is still left on the list is getting at least 6 years 3-month jail time. My CGNAT was lower than 10 and there was only maximum 2 IP access request in the 5 minutes period (we can assume someone would complete registration in 5 minutes). So the only evidence that is used against me was actually technically 100% proving that I did not register the Bylock APP ever! But what happened in the court? The judge didn't give acquittal to me until my name was removed from the list. There are also many other victims who are already condemned to 6 years jail time with less than 10 lines of CGNAT logs and with only evidence as CGNAT logs.

So how did Bylock become this kind of tool of mass arrests? With total and constant poisoning of media. According to the media and so for the Court of Cassation in Turkey, Bylock was following kind of software 1: It had reference and activation feature from the canter of Terrorist organization from Pennsylvania. 2: No one could make IP access requests to the Bylock server except those who had successfully registered to the application and whose registration was approved by the central command center of Terrorist organization It makes sense to arrest from CGNAT logs if the software was like this right? But both pre-acceptance are 100% wrong. Bylock was freely available software on Google Market and anyone who wanted it could download it from Google Market until 3 April 2016. Check out AppBrain Bylock page for more information. Also it didn't have any kind of reference or activation system for registration or usage. Its usage system was very similar to Skype or Discord. What kind of system it was is properly documented in technical report of Turkish Intelligence (MIT). Moreover, no one can prevent who makes IP access request to any IP. Even your access to the particular IP is blocked by that IP's owner, you request would fail but still it would be logged in CGNAT and CGNAT doesn't log whether you have successfully connected to the IP, or duration of the connection or how many bytes you have transferred. At least all of these are not stored in Turkish ISPs CGNAT logs. In a Turkish ISP's CGNAT there are only these data. Access request start date, access request destination IP, access request destination port, access request private port and private IP.

Also since you do not know the atmosphere in Turkey, you cannot correctly evaluate this article. I am sure that Tuncay Beşikçi also knows this was simply tracking code or advertising links etc. But if you tell that Bylock was advertised or used tracking codes like other Apps etc, no one would believe you and hell they would blame you and perhaps arrest you. So announcing that all these tracking codes advertising links were a clever plot of FETÖ (gulenist terrorist organization) was only way to rescue some of the people who had never used Bylock app.

This is the summary of the Bylock cases which still goes on. I am guessing that at least 60,000 people were put in jail at least 1 day due to Bylock since the beginning. There are still about 40,000 on the list waiting to be ambushed by Terror Forces until they learn they are on the Bylock list. I believe many of them even don't know they are on the list since they didn't use Bylock. Moreover, even though I have had full acquittal, all of my digital devices are still held seized.

Finally, I am very shocked that Bylock cases has almost 0 coverage in developed countries. They are totally blind to these cases.

</comment><comment><USER51> Everybody hears the echos of this behavior throughout history. I wonder if Erdogan thinks he'll be the one who escapes the universal fate of tyrants.

As Turkey becomes increasingly alienated from the EU, Putin looks to gain another monster.

<comment><USER6> I'm not sure what the universal fate of tyrants is supposed to be. A lot of them seem to hang in there fairly comfortably till they die of old age.

<comment><USER52> Minus a couple of outliers, I think history has taught us that the fate of tyrants and oppressors is a long, healthy, and comfortable life of luxury and immense wealth. As a bonus, that fate often includes admiration and support from at least 50.1% of the oppressed population.

</comment></comment></comment><comment><USER53> What a horrible country.</comment>


Homebrew LQR Inverted Pendulum/Cart Pole - <AUTHOR> http://blog.benwiener.com/programming/2018/05/10/cart-pole.html <comment><USER2> Is this your project? It is nice, but if you add some empty comment, then people will flag it.

</comment><comment><AUTHOR> Let's talk about it!

</comment><comment><AUTHOR> Wow, great work!

</comment><comment><AUTHOR> Yuk, I don't know...</comment>


The New Google Shopping: 3 Steps for Bidding at the SKU Level - <AUTHOR> http://cpcsearch.com/blog/2012/12/3-steps-to-build-a-sku-driven-plas-campaign/

<comment><USER2> The old Google Shopping is defunct! Now it's time to master the new Google Shopping (aka, AdWords).

Yep, it's pay-to-play, but what else you gonna do?</comment>


Why Why Functional Programming Matters Matters (2007) - <AUTHOR> http://weblog.raganwald.com/2007/03/why-why-functional-programming-matters <comment><USER2> While reading, it made me think:

It's important when approaching architecture—and probably software problems in general—that you do not start by reasoning in terms of the constructs of a particular language (e.g. classes and interfaces). The philosophy underlying this is: your range of potential conceptions becomes wider as abstraction increases; and, as you become more concrete you inevitably introduce auxiliary problems that result purely from the features of the particular language you are expressing with, which means you are prematurely diverting thought from, "what is the correct description of this thing" to, "what is the best wording for this description".

Also:

Working at a higher level of abstraction has a lot in common with looking at a scene from far away, a mountain range for instance: the further away you get, the easier it becomes to change which mountain you are experiencing: you merely turn your head a quarter of an inch and now three new mountains have entered your consciousness. If you're trying to decide which mountain to climb, this is an extraordinary benefit—but at the same time, if you are too far away, you can't perceive the features of the mountain clearly enough for optimal decision making. A similar tradeoff is always present in working at one level of abstraction or another, and understanding these tradeoffs helps you figure out where to stand more effectively.

</comment><comment><USER3> Better formatted version of the blog post:

[http://raganwald.com/2014/12/20/why-why-functional- programmi...](http://raganwald.com/2014/12/20/why-why-functional-programming- matters-matters.html)

The original paper by John Huges mentioned in the posting:

Internet Archive: [https://web.archive.org/web/20070323095313/http://www.math.c...](https://web.archive.org/web/20070323095313/http://www.math.chalmers.se/~rjmh/Papers/whyfp.html)

PostScript, PDF and the BibTeX reference.

<comment><USER4> google has a better pdf viewer: [https://drive.google.com/file/d/1nYvECWLSzedsMew0INhv3tLhwut...](https://drive.google.com/file/d/1nYvECWLSzedsMew0INhv3tLhwutLNUxUy3STz4M6KvquaLLGKv7BO0XKepw5/view?usp=sharing)

</comment></comment><comment><USER5> To me what makes functional programming matter and what differentiates it from OOP _today_ is less its essential properties than the simple fact that it pushes you to think in terms of functions that process collections of objects rather than functions that act on a single one. This may look like a simple statement yet the implications are huge.

Now it doesn't reflect a property of FP as such, it only highlights one of the biggest shortcomings of OOP along mutability that we are slowly awakening to as a community.

</comment><comment><USER6> As an additional exploration of these excellent ideas, I recommend the textbook How to Design Programs (HtDP):

[https://en.wikipedia.org/wiki/How_to_Design_Programs](https://en.wikipedia.org/wiki/How_to_Design_Programs)

It's available online: [http://htdp.org/](http://htdp.org/)

<comment><USER7> Is there a .pdf of the latest version? Couldn't find.

<comment><USER8> The latest version is a work in progress - for example, near the start of chapter VI we find "The rest of this chapter is under development. Use HtDP/1e in the meantime.". I wouldn't be surprised if there wasn't a PDF version until it was finished.

</comment></comment></comment><comment><USER9> It's a good paper, but what it hints at (but doesn't really come out and say) is that in separating concerns, functional programming actually eliminates concerns from the programmer. This isn't really just a question of the language -- you can do FP in any language.

But by thinking about programming differently, we can eliminate concerns entirely. This is what garbage collection does, and it is what FP does.

<comment><USER10> >you can do FP in any language.

Not in my experience or that of my colleagues, no. I'm a Haskell user and writing a book for learning Haskell. I'm friends with several Scalaz developers including the creator and people that have worked on similar libraries for other languages. I've also attempted to use FP idioms outside of Haskell.

You can't take it with you. At best you'll learn to eschew a few bad habits, but that's not FP nor does it bring anywhere near the same benefits.

<comment><USER8> Nor in mine. I worked on some codebases in Java 6/7 with a team who yearned for functional programming. They used various libraries that tried to support a functional style - Guava for the moderates, FunctionalJava for the zealots, lambdaj for those who liked to be different.

None of them really worked well (for functional programming - Guava is excellent in other ways). Java just doesn't let you write the function-like classes concisely enough for it to be worth breaking code down as far as you need to to call it functional programming.

Plus, no higher-kinded types, so no functors. And what's functional programming without functors and their kin?

<comment><USER9> Think about what following the most basic aspects of functional programming would mean in Java:

1\. No private attributes (all state is transparent and immutable). 2\. All methods that transform an object return a transformed copy. So instead of:

        rectangle.stretch_x(2.5);

you have:

        newRectangle = rectangle.stretched_x(2.5);

Even this very small move here moves you way outside Java as typically programmed. This means further that even at this level (the most basic level of FP), your program will:

1\. Be unable to work with standard libraries without mixing paradigms

2\. Be unable to be used in other projects because of the same problems.

Given that ABCL uses supertypes to allow round-trips between Java and Common Lisp, I am fairly sure that functors should be _possible_ in Java, if not elegant.

<comment><USER8> You're conflating a couple of things here: encapsulating state, and mutability of state. Your examples are about mutability. But immutability is already standard practice in Java - standard enough that it's one of the items in Josh Bloch's 2001 book 'Effective Java', the bible of righteous Java programmers:

[https://books.google.co.uk/books?id=ka2VUBqHiWkC&pg=PA73#v=o...](https://books.google.co.uk/books?id=ka2VUBqHiWkC&pg=PA73#v=onepage&q&f=false)

It's not usually pursued with the same rigour as in many functional languages, but it would be absolutely normal to see a Rectangle class with a stretchedX method which returns a new rectangle rather than mutates its receiver.

Now, you might argue that despite what Bloch, and every other good Java programmer, says, "Java as typically programmed" still trades mostly in mutable state. Since Java is actually widely used in the real world, it's typically incompetently programmed, and so this is probably true.

Nonetheless, i am confident that Java code written using immutable objects could both use and be used by other code. I say this because it's what i and my colleagues have been doing for years.

I had a go at functors in Java a while ago. You're certainly right that it's not elegant:

[https://news.ycombinator.com/item?id=7898294](https://news.ycombinator.com/item?id=7898294)

</comment></comment></comment></comment></comment><comment><USER11> Related: Does anyone know of an html / epub / mobi link to the original paper (I could find only the pdf)?

<comment><USER12> Google cache? [http://webcache.googleusercontent.com/search?q=cache:ucpR8Gc...](http://webcache.googleusercontent.com/search?q=cache:ucpR8GcbVSEJ:worrydream.com/refs/Hughes- WhyFunctionalProgrammingMatters.pdf+&cd=1&hl=en&ct=clnk&gl=uk)

</comment></comment><comment><USER13> Pure functional programs either don't work or are bug free. At a high level the entire app can be viewed as one continuous evaluation, which is kind of beautiful. It could transfer to an FPGA without needing a von nuemann simulation.

<comment><USER14> FP isn't a silver bullet. A statically-typed function language with a strong type system will keep some classes of issues away. It will not, however, prevent logic errors or infinite loops or resource leaking.

</comment></comment><comment><USER15> (2007)</comment>