John Callaham: Don't be a goat murderer* - <AUTHOR> http://notch.tumblr.com/post/32726020631/john-callaham-dont-be-a-goat-rapist

<comment><USER2> This is a response to this piece by John Callaham: [http://www.neowin.net/news/notch-dont-be-a-hypocrite- about-m...](http://www.neowin.net/news/notch-dont-be-a-hypocrite-about- minecraft-and-windows-8)

<comment><USER3> After reading this I still don't get what Notch's getting at with his "goat raping" joke. I didn't feel like John Callaham's editorial was that violent.

<comment><USER4> > After reading this I still don't get what Notch's getting at with his "goat > raping" joke.

Lies about other people and their stance. Callaham chides notch supposed hypocrisy regarding closed v open, but notch never said he minds closed platforms (he uses them and publishes on them), he said he minds _the PC_ getting closed off, as it breaks a path to indiedom (which he knows about, since he needed it to make Minecraft in the first place, a 2 years alpha/beta taking money the whole way would never have flown on closed stores, as far as I can see)

The goat raping thing is a strawman, just as Callaham's "notch hypocrisy" is one.

<comment><USER3> I don't think it's a strawman, Notch doesn't explain why he's ok with some closed platforms and not others, besides the fact that he "cares a lot about his PC".

Moreover, Minecraft is not exactly "open" itself, it's not open source and even used to be pretty hostile towards modders (even though that is changing, but I don't know how much notch is involved with minecraft these days).

So I think it's fair to call him a bit hypocritical when he suddenly gets on his high horse "RMS style" about software freedom (but only on the PC and only for the operating system). And replying to this by using a "goat rape" argument is beyond childish, I don't think that's a very good way to get his point across.

<comment><USER4> > I don't think it's a strawman, Notch doesn't explain why he's ok with some > closed platforms and not others

Which has nothing to do with the strawman. The strawman is "notch says all platforms should be open (nb: he never said that) but he publishes on closed platforms, therefore he's a hypocrite".

As to why "some and not others", it's not "some and not others" it's "the PC is an open platform, it offers amazing opportunities (nb: Notch got his start from this open platform after all, and it looks like he's not forgotten it yet), I have no desire to see the door closed after getting through".

</comment></comment></comment></comment></comment><comment><USER5> I appreciate notch's position on the whole thing, but I wish he didn't feel the need to make his point with rape jokes.

(Edit: It's not made with rape jokes anymore. Previously, it said "goat rapist", now it says "goat murderer", which is rather preferable to me.)

<comment><USER6> Well, at least goat rape is a bunch of notches below human rape in awfulness.

<comment><USER5> Sure. But goat rape jokes still contribute to an atmosphere where rape is treated as a joke.

<comment><USER7> Are you seriously suggesting that some things can't be joked about?

<comment><USER8> Are you seriously suggesting that there are some contexts where rape is funny?

<comment><USER9> There may be some that are funny even if they are a bad idea and it generally shouldn't be the only criteria. Think at least twice before making a rape joke. If in doubt think of another joke.

Generally they are a bad idea and need to be carefully thought about. You should probably also stick to a few guidelines: the victim of the joke should not be the victim of the rape, it should not be trivialised (this includes inappropriate comparisions and probably the original title), it shouldn't be threatening and it shouldn't blame the victim. If you are not following these you probably need to think about it ten times and consider different viewpoints on it. Those more likely to be victims [women, maybe some other subgroups] (or who have actually been victims) have much more leeway.

Note that I don't think they should be banned unless there is a seriously threatening, harassing or inciting aspect but that doesn't mean there shouldn't be criticism.

I don't think any malice was intended by Notch but I think it fell in the trivialising category and I am glad that he has decided to change it. Being about an animal helped make it ridiculous but probably made the word rape unnecessary. The British 'shagger' or Australian 'rooter' would probably have worked OK although I don't know if there is a US equivalent lighter than the F-word. 'XXXXer' might have worked.

<comment><USER10> The verb "shagged" would have worked well in this case in the US. Not really American slang, but it would be understood.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Good thing John Callaham stopped beating his wife.

Classy response by Notch (ahem). But I do wished more developers would take such a principled stance.

<comment><USER12> That doesn't work. There is no answer to the question "when did you stop beating your wife" except "I never started!"?

Or if you are unmarried, just say "I don't have a wife".

<comment><USER10> Yes, it doesn't withstand careful examination. It is almost as though that phrase were a joke...

<comment><USER12> Depends on the context. Some times it is used as a joke, other times it highlights a loaded question.

</comment></comment></comment></comment><comment><USER13> When you have a multi-million selling game and a new platform comes along, you don't tell the world you're definitely going to port it. You wait for the 6 figure check to arrive and _then_ port it. If it's 7 figures, you call it a platform exclusive.

<comment><USER14> Yes we'll see how principled Notch is when they wave a fat cheque in front of him...

Money is the divider between words and actions.

<comment><USER15> Money is not a huge motivator for Notch... back in March of this year, he gave seven figures ($3 million) of his personal dividends to his fellow Mojang employees:

[http://www.develop-online.net/news/40013/Notch- gifts-3-milli...](http://www.develop-online.net/news/40013/Notch- gifts-3-million-to-Mojang-team)

Given his taken on money — and that Notch has taken a very public stance against participating in helping to close the PC — it is very unlikely that a fat cheque would result in a change of his actions. Time will tell, I suppose.

</comment></comment></comment><comment><USER16> It does seem arbitrary that _only Microsoft_ ought to treat their consumers like tool-using human beings.</comment>


Show HN: Easily send notifications to Android from the command line - <AUTHOR> https://simplepush.io/ <comment><USER2> I installed the app and it created a 6-letter string as my "personal" key. It would be a trivial task to write a script that spams other people's key(s). Of course the sender cannot know if there is a reader at the other end, but neither can a spammer when they send a spam mail.

Also, it is not a all clear from the website what happens to the messages you send. Are they kept on the server? If so, for how long and in what form? Encrypted?</comment>


Google WiFi - <AUTHOR> https://madeby.google.com/wifi <comment><USER2> I did a quick search for Privacy and didn't see anything mentioned. A router wouldn't inherently store your information (packets sent and received) and send it to a third party (this would be hard to do so without you knowing anyway), but it was worth a mention (this connects with Google OnHub, so I'm not sure if that's a point of weakness, in terms of privacy).</comment>


Www. is deprecated - should it be? - <AUTHOR> http://no-www.org/

<comment><USER2> The main problem with the plain "no www" record is that there is much less you can do with it in DNS. Most especially you can't make it a CNAME nor can you delegate the DNS to somebody else without delegating the whole domain.

With a www.example.com I can just make www a CNAME to a cloud or CDN vendor. With plain example.com I have to delegate DNS for my whole domain to that vendor (assuming they do that service) or use a A-record and go with one of the 3 anycast CDN's in the world.

Same if I want to use a GSLB service. I can just make it a CNAME or put in a NS record for my www.example.com . For example.com I'd have to run GSLB myself or put my whole domain under control of the external vendor.

So all work's domains have the smart stuff on www.example.com and the <http://example.com> is just a 301 to the www version.

<comment><USER3> So, I believe it turns out that you can cheat and just define a non-www name as a CNAME to another non-www name. And that mostly works, kind of, maybe, even though it's a violation of the standards. Except that it'll break under some conditions, but maybe you won't care too much. Or something.

Bleargh. Frankly I've forgotten the headsplitting details of trying to finesse the DNS RFCs. What I do remember is that my company, which does cloud hosting on behalf of many customers, looked into this and determined that for now we should do as you suggest and actually follow the spec: Either point your A record directly at your webserver (or its reverse proxy) or use the www. subdomain as a CNAME. I was left with much sympathy for the folks who designed the standard www. subdomain in the first place: They did what they had to do to work sensibly within the DNS system without having to redesign entire corporate domains around the needs of the web server.

<comment><USER4> I think one of the main problems for no www. domains is that even though some dns systems let you assign the root record to a CNAME is that it breaks MX records if you do so.

<comment><USER3> Yeah, it's coming back to me now. Thanks!

</comment></comment></comment></comment><comment><USER5> I don't care much either way, except that I see some cases where using a 'www' hostname can be advantageous. In television and commercials, it's a useful marker that what being listed refers to a website. To the layman who is not familiar with all TLDs, 'example.nu' may be bogus, while 'www.example.nu' is immediately recognizable as referring to a website.

My take: 'www' helps in disambiguation, and sure is nicer than having to prefix all names with '<http://>.

<comment><USER6> It's horrendous, but nowadays many advertisers are directing people to their site with addresses in the form:

facebook.com/productname

<comment><USER7> Why is it horrendous? The string is concise, unambiguous, and works when you put it in the location bar. Including the scheme makes sense only when there is a risk of ambiguity, and even Tim Berners-Lee admits that exposing such a technical detail to users wasn't the best design decision.

<comment><USER8> I believe he said horrendous since there is a certain trend that Facebook will, in some sense, be a closed internet. There may come a time when not being a Facebook user means that you cannot see some significant portion of the Web.

<comment><USER9> Well for facebook.com/productname that means a commercial decision - is it worth excluding a (probably) significant portion of the internet from viewing our product's site.

<comment><USER10> Why exclusion? FB _Pages_ are public by default, no login required. Some individuals' comments may be invisible due to their privacy settings, but technically non-members are not excluded per se.

<comment><USER9> Just in response to the parent poster stating that Facebook could become a closed internet, requiring an FB login to access content.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Every time I enter a www-only-site without the _www_ prefix and see an error page, I think _incompetent idiots_ for a brief period before I add the www

<comment><USER12> Why? The Internet encompasses a lot of protocols. Why assume every domain name supports HTTP? It's not fair to call them incompetent idiots when you're the one shooting in the dark. Without an unambiguous URL, you're only guessing, so accept the risk.

<comment><USER11> Other protocols normally use different ports.

Also in all cases where this happens to me, www.$name is the only service being provided, most of the time poorly.

<comment><USER13> The problem is, the different services could be split across hosts, not just ports. It seems SRV records provide the only option here but they're not supported by browsers. That leaves www as the only viable option to move web serving into a different machine.

<comment><USER14> Most web sites sit behind load balancers and stateful firewalls. They have many, many opportunities to do the port translation to make $name and www.$name work the same way.

The theory you espouse, that www was the only viable option to move web service to a new machine, was true in the 90s when we started doing this. That's how the practice came about. It's 2011. It's not an issue anymore.

</comment></comment></comment></comment></comment><comment><USER15> _"Mail servers do not require you to send emails to email@example.com. Likewise, web servers should allow access to their pages though the main domain unless a particular subdomain is required."_

Sure, email is like this thanks to MX records. We could have the same for web servers by using SRV records ("_http._tcp.example.net" pointing at your "real" web server[s]) but I have no idea how many browsers support looking up SRV before A.

<comment><USER16> What else would you want to use the "raw" domain for?

Or phrased differently, what's the disadvantage of pointing your main domain to the www server?

<comment><USER12> Imagine SmithCo, a family run business where John Smith is the founder, president and CEO; Jane Smith is the accountant and CFO; James Smith is the head of sales; Judy Smith runs quality control and manufacturing; Jeb Smith is the janitor. Someone calls and says, "I want to talk to Smith!" Who gets the call?

At least with SRV records, a framework is available for routing based on context. But without them, it doesn't necessarily make sense to establish a default. In a web-centric environment with a single public facing site with low traffic, it might be useful to assign the top level domain an IP address. In more complex environments, it could create as many or more problems than it solves.

</comment></comment></comment><comment><USER17> The people running this website need to get out of the lab and into the real world. www. is certainly not "deprecated", and declaring it to be so from your ivory tower doesn't change that.

The fact is that it's not important at all. There are plenty of real problems to solve, and interesting questions to ask.

<comment><USER18> Irrelevant to the argument for or against deprecation, whoever did that website certainly don't have the authority to declare parts of the infrastructure of the Internet deprecated.

<comment><USER19> _Nobody_ has that authority, really. The internet's infrastructure evolves by "rough consensus and running code," as the IETF puts it, and that web site is working on the consensus part of things.

</comment></comment></comment><comment><USER20> Too bad that google app engine seems to only allow subdomains, so www seems the only sane choice for now. Or have they fixed that by now?

<comment><USER21> They probably won't fix that, because DNS does not allow CNAMES at naked domains.

<comment><USER22> It is actually a feature they removed. In the early days AppEngine had some support for naked domains. I had one.

<comment><USER23> I'm guessing they ran into trouble with the problems mentioned. It doesn't seem to Google's benefit to remove the feature unless it turned out to be a bigger headache than it was worth.

</comment></comment></comment></comment><comment><USER24> I love this one, listed as a "competitor": <http://www.www.extra-www.org/>

</comment><comment><USER25> Yes, should be, just because "double-u-double-u-double-u" takes a ridiculously long time to vocalize.

<comment><USER26> Should've just been "web" instead of www.

Because, really, what's the point of the "world wide" qualifier. Were there other network-oriented webs that the www might have been confused with? No.

<comment><USER27> World Wide Web sounds more and more like Information Superhighway every year.

</comment></comment></comment><comment><USER28> I think www can be useful offline. We here all recognize domain.tld as a website, but I suspect that www.domain.tld is more recognizable to non- technical folks. "Visit www.domain.tld for more information." etc.

<comment><USER9> Agreed - if it's a site aimed at a non-technical audience I put it on www. and 301 domain.tld to www. And the other way round for sites aimed at a more technical audience.

</comment></comment><comment><USER29> What would happen to wildcard SSL certs which depend on the main site being at www.example.com as opposed to example.com which a wildcard cert does not match?

Likewise with restricted cookies, most browsers fail to allow you to restrict a cookie to example.com alone (this restricts to all subdomains also). Restricting to www.example.com gets around this problem.

These complaints seem unfounded, the real problem is people not using permanent redirects on example.com to www.example.com

</comment><comment><USER30> I wrote up a few pros and cons on using www a while ago. Basically I think only using the TLD is more pure but in the long run you lose less than you might gain by dividing services on subdomains. Whatever that subdomain may be.

[http://vvv.tobiassjosten.net/internet/using-www-for-your- dom...](http://vvv.tobiassjosten.net/internet/using-www-for-your-domain)

</comment><comment><USER31> _Another benefit of hosting static components on a cookie-free domain is that some proxies might refuse to cache the components that are requested with cookies. On a related note, if you wonder if you should use example.org or www.example.org for your home page, consider the cookie impact. Omitting www leaves you no choice but to write cookies to_.example.org, so for performance reasons it's best to use the www subdomain and write the cookies to that subdomain.* via <http://developer.yahoo.com/performance/rules.html>

My own takes: <http://eapen.in/to-www-or-not-to-www/> <http://eapen.in/to-www- or-not-to-www-update/>

</comment><comment><USER32> While designing a webcrawler I found out how a LOT of sites are reachable using www.example.com and not using example.com. Some browser just tend to try the www. prefix if they can't connect/resolve the non-www one. This is why nobody finds out about it and the internet is somewhat broke :(

</comment><comment><USER33> It doesn't matter much. just take care that you don't have two domains with the same content.

www.example.com and example.com are different sites to Google and have different cookies as well.

<comment><USER34> I'm not sure it is a big deal if you expose both to Google. There is a setting in webmaster tools that lets you explicitly set which you prefer: example.com or www.example.com

<http://www.google.com/webmasters/>

Although, the preferred way is probably to use a redirect.

<comment><USER35> And a canonical URL in your header.

</comment></comment></comment><comment><USER36> It wouldn't matter if www.foo.bar and foo.bar both resolved to the target, all too often the www. prefix is the only one that works. Get that sorted then worry about deprecating the prefix.

</comment><comment><USER37> One step further: remove '.com' from the end. For those domains that fit.

e.g. <http://www.hp.com> => hp

<comment><USER38> Type "hp" into your URL bar

Hit Ctrl+Enter and rejoice in the automatic _www._ hp _.com_ goodness.

<comment><USER39> You shouldn't discount his point so easily.

The TLDs have long lost all their meaning anyways, so dropping them would be a great idea.

Of course it's not gonna happen (too much money to be made by inventing yet another suffix), but technically the root-servers could start resolving all .com's without the suffix tomorrow, except for those that clash with an existing TLD.

</comment></comment></comment><comment><USER40> For some stupid reason I was using IE6 in class not portable Chrome. We were told a website to go to and I was surprised the normally with-it teacher said www. Turned out it was required, the page didn't load at all without it.

It's one of those stupid corporate/educational vestiges left, like IE6.

</comment><comment><USER41> yes, it should be, for all the reasons listed in the first post on that page at the bottom

</comment><comment><USER42> I believe Tim Berners-Lee himself has said that he regrets introducing the "www." prefix. [citation needed]

Edit: he was, in fact, regretting the double slashes. Thanks for the correction.

<comment><USER43> He said he regretted the double slash in <http://>.

[http://bits.blogs.nytimes.com/2009/10/12/the-webs- inventor-r...](http://bits.blogs.nytimes.com/2009/10/12/the-webs-inventor- regrets-one-small-thing/)

</comment></comment><comment><USER44> Not until you can do load balancing on GAE/AWS without it.

</comment><comment><USER45> No it should not - missing off the www is as annoying as people who abuse the TLD, e.g. .tv means "I'm in Tuvalu" not "I'm on television lol".

<comment><USER46> Where were you ten years ago before all of this BS became ubiquitous?

</comment></comment><comment><USER47> I never liked the WWW. xxx.domain.tld should be a host name and not a service determinator.

my http blog is accessible on domain.tld:80 and my telnet comment interface runs on domain.tld:1337 :)

if you're curious about the telnet interface: <http://fettemama.org/faq_en.html>

<comment><USER48> But what if your web server is named www.domain.tld?

Speaking personally, I don't even have www.mydomain.tld set up, as I just realized now when I tried to test it. That's ok, in my opinion www is mostly for those people who have learned "When I type something in Internet, it needs to start with 'www'", and my site holds nothing of interest for them :)

</comment></comment><comment><USER49> Sure it should, there is no value whatsoever in `www` subdomains. It's a relic from a time when admins lacked a bunch of tools and clues.

<comment><USER45> Yeah, stupid admins. They only built the internet that you take for granted, right?

<comment><USER49> Not really, but even if that were the case, so what? Does that magically mean they must have been perfect and it's not possible, in hindsight, to realize that not all decisions were good?</comment></comment></comment>


MITM on HTTPS traffic in Kazakhstan - <AUTHOR> https://bugzilla.mozilla.org/show_bug.cgi?id=1567114 <comment><USER2> Hijacking the comment for better visibility. After getting some backlash, the government has already backed down. They claim that installing the certificate is entirely voluntary.

[https://rus.azattyq.org/a/30064788.html](https://rus.azattyq.org/a/30064788.html)

They have been talking about this stuff for some years, though. It will get implemented at some point. I have a feeling it was one of their "test trials": can we boil the frog yet, or do we have to heat the water up a bit more?

<comment><USER3> Are you sure that's really them backing down, and not just a way to obfuscate the issue? _Technically_ yes, installing the certificate is voluntary; it's just that if you don't install it you won't be able to access the internet anymore when the government starts MITMing your connections.

<comment><USER4> Let's say they make it mandatory. Would it be possible for a group of people with one having unfettered access because, say, they cross the border all the time to a place that has full Internet, and they use wget to tar/gzip entire sites, places this on a server in a city, and provides access with a self- signed cert that everyone involved with knows about.

Or failing that, some kind of digital dead drop with the files. If this could be updated a few times a week, that's better than not having access to material that you don't want the government to know about. It has to be possible.

</comment></comment></comment><comment><USER5> A fellow from Kazakhstan here.

Banning this certificate or at least warning the users against using it WILL help a lot.

Each authoritarian regime is authoritarian in its own way. Kazakhstan doesn't have a very strong regime, especially since the first president resigned earlier this year. When people protest strongly against something, the government usually backs down. For example, a couple of years ago the government withdrew their plans of lending lands to foreign governments after backlash from ordinary people. If Kazakhs knew about the implications of installing this certificate, they would have been on the streets already.

If Firefox, Chrome and/or Safari block this certificate, the people will show their dissatisfaction and the law will be revoked.

Sometimes the people in authoritarian countries need a little bit of support from organizations to fight for their rights. I really hope the browser organizations would help us here.

<comment><USER6> I really don't like the idea that some third forces would interfere with internal politics of my country. Browser should work according to technical standards, not according to what US citizens decided to be good or bad. If Firefox wants to forbid locally installed roots, I'm all for it, but implement it for everyone.

That said, I don't see how government would step back. People are uninformed and generally passive, they wouldn't care enough. So, sadly, it might be the only way to push back that decision. But I still don't like it.

<comment><USER7> Encryption is political. The technical standards around HTTPS are politically motivated. The push for HTTPS everywhere, de-facto required TLS in HTTP/2, eSNI & DoH, were largely a response to the US government's mass surveillance.

However, _who_ makes these changes is interesting. It happened to be mostly developers in Five Eyes' countries acting against Five Eyes.

Do we need to have elected representatives in browser vendors and encryption standards bodies? Or given that the elected representatives are for mass surveillance, would that be any good?

<comment><USER8> I disagree that encryption is political. Fundamentally, it's a privacy and security mechanism and on its own it's no more political than locks, safes, paper shredders or curtains.

Because of the complex, un-intuitive nature of encryption, it mixed particularly badly with politics, and we're still suffering from the fallout of that now. (crypto wars 1)

Firefox and other application vendors who use those standards do end up being unavoidably slightly closer to politics (as demonstrated in this particular issue now), but I think Mozilla would do well to keep their goal simple - Protect user privacy where they can and explain to users when they can't.

A notice to the user like "You are using a key known to allow access to third parties" is just a fact and no more political than "the site you are visiting uses weak crypto standards" or similar.

<comment><USER9> Privacy is political.

<comment><USER10> Privacy is apolitical. In fact, it is built into the very fabric of how the world works.

Does the grain of sand on a beach in Japan know whether or not I've just sat down in America? No.

Does the merging black hole/neutron star somewhere in the universe know that it will have consequences for small bags of carbon and water somewhere in the universe? No it does not.

Do you know what your child is actually thinking when you harangue them for the umpteenth time? No, you don't.

Lack of privacy/privileged access to information has always been the byproduct of active human effort. The natural state of things, is for information to only effect it's immediate locality. I.e. privacy.

Lack of privacy; therefore is the political subject. Subtle difference, granted, but that subtlety belies the consequences of letting things get out of hand.

Excessive "awareness" is a problem. There are those that relish the thought for the power such systems confer; they chant

"I can make you safer!" "You lose nothing!" "There is no danger in this!" "It is just the sacrifice a Good Citizen should be expected to make for the Greater Good!"

However, once the check is written, does the government ever relinquish it's right to privacy?

Nay. National Security. Just trust us.

Never mind that the assertion that led to the sacrifice of the initial liberty was that there were those amongst us who couldn't be trusted.

Nay, sir, I agree with GP. The breach of fundamental rights (or imposition of obligation) is the matter of politics, and very infrequently do I see any credible case made where something as fundamental as breaking the confidentiality of the most efficient means of communication anything but a power grab, and eventual tool of tyrannical oppression.

</comment></comment></comment></comment></comment></comment><comment><USER11> What is interesting is that some local internet providers in Kazakhstan used to inject their own ads into http websites their users visit. I wonder if they will start doing the same with https now.

I noticed this behaviour last February with Kazakhtelecom (telecom.kz) internet provider. When I opened an http website in my browser and started clicking randomly on the parts of the page which are usually not clickable, sometimes such click would open a pop-up window with ads. Those pop-ups did also open sometimes, when I clicked on links of the page. It was unusual, because I used the same websites just a few days before that from Russia and nothing like that happened.

To figure out what's going on I opened the same webpage through proxy and compared it with localy opened one. Shell command for that was something like:

      diff <(curl http://website) <(proxychains curl http://website)

And the only difference was that directly downloaded webpage contained a reference to some suspicious script in a place, where the proxied one had a reference to a google analytics script. I reproduced this behaviour with multiple websites from two different homes, on two different laptops (Linux and Windows). So this is unlikely to be a malware in my router, and I'm pretty sure it's not in my laptop.

I'll be back in Kazakhstan in 3-5 days, I'll try to reproduce this once again.

<comment><USER12> This is so bad. I'm from India and at my parents place we have the government run internet provider. They MITM and inject advertisements all the time showing annoying popups whenever you open an http link. I don't know how this is legal even.

<comment><USER13> > I don't know how this is legal even.

Legality is secondary when you are punching up in a 3rd world country. (I am from India)

<comment><USER14> I'm in the US and I've caught my ISP doing MITM exploits over http (not https... so far). It's global and regular folks have absolutely no chance of knowing what is going on. Needs to be criminalized for any hope of resolution.

<comment><USER15> Comcast has even published an informational RFC describing how to inject crap into HTTP requests:

[https://tools.ietf.org/html/rfc6108](https://tools.ietf.org/html/rfc6108)

</comment></comment></comment></comment></comment><comment><USER16> I find the social aspect of this interesting. Us "smart tech people" have been pushing https everywhere for a few years now as a way of protecting internet privacy "for the masses".

And now the government found a very simple non-technical workaround. Send a message to everyone requiring a government root CA with an easy install, or their internet won't work.

Now "us techies" have to find a new technical solution to a very social problem.

It never ends. :(

<comment><USER17> Except I look at the linked mailing list and you already get "us techies" arguing "uh yeah but uhm this isn't so different from the corporate CA intercept thing right so let's not blacklist it uhm".

What the fuck.

<comment><USER18> Actually, I don't see the issue here. It is literally the same thing as corps intercepting the connections of their employees or visitors. In fact I trust my employer even less than I trust the government.

But I disagree with the response that says we should do nothing. In fact, corporate root certs should be blocked / ignored by the browser in the exact same way and for the exact same reason. The _only_ exception should be certs issued for a limited number of domains that are only active in a specific developer mode that can be enabled by knowledgeable users.

Sure, technological solutions can't solve this issue 100%. (My employer can also fork a browser.) But acting as if everything is OK when the connection is being MITMed is wrong and browsers shouldn't do it.

<comment><USER19> > corporate root certs should be blocked / ignored by the browser in the exact > same way and for the exact same reason ... technological solutions can't > solve this issue 100%

Technological solutions can't solve this at all if the entire stack is controlled by the interested party.

In the case of government snooping, you (theoretically) own the end device being used for access. In the case of corporate snooping, you're using corporate owned and managed devices. There is absolutely no technological solution that exists that will prevent another person from building software for (or selling to) corporations who need to snoop on their employees. Considering the selling price of appliances that perform these services (e.g. Bluecoat's range), the cost of a browser is negligible in comparison.

I don't think it's fair to conflate a lack of privacy on corporate owned devices with a lack of privacy on your own personal devices.

</comment></comment></comment></comment><comment><USER20> Would someone with network access in Kazakhstan check if Caddy's MITM detector catches this please? [https://caddyserver.com/docs/mitm- detection](https://caddyserver.com/docs/mitm-detection) \- or [https://mitm.watch](https://mitm.watch) (Cloudflare's unofficial deployment of the same tech).

If it does not, could you file a bug report with a complete packet capture (and _exact_ browser version - multiple browsers are preferred)? [https://github.com/caddyserver/caddy/issues](https://github.com/caddyserver/caddy/issues)

(Edit: Reportedly, "not all Internet providers have started MITM attacks yet" so if you do the test, make sure you are on an intercepted network... if safe to do so.)

<comment> lame-robot-hoax So uh, should I be concerned at all if my connection came back as a likely MITM from my home network in the US? Or is it most likely a false positive caused by my firewall or something?

I tested it both off a VPN and on a VPN from my iPhone yet still had the same result both times.

<comment><USER20> iOS is tricky because of its weird rules regarding TLS libraries and web views. If you are sure you haven't any rogue CA certs in your applicable trust stores, it's probably a false positive.

<comment> lame-robot-hoax Yeah no CA certs as this is a personal phone, and I just checked from my Fedora box and it said MITM unlikely so guessing it's just iOS being weird.

</comment></comment></comment></comment><comment><USER21> The pertinent page [1] of a local ISP, Kcell, is interesting - very devious.

> Kcell JSC informs its customers of the need to install Security Certificate > on personal devices capable of connecting to the Internet

> Due to the increase of identity and personal data theft, including stealing > money from bank accounts, introduced a security certificate as an effective > tool to protect the country's information space from hackers, online > fraudsters and other types of cyber threats.

And some FAQs are hilarious (as in hilariously devious):

> What happens if I do not install the Security Certificate? You may have > problems accessing the Internet.

> Will installation of the Security Certificate affect the protection of my > personal data? The security certificate has no access to your personal data.

Yeah, true that, literally, but you forgot to mention something there...

[1] [https://www.kcell.kz/en/product/3585/658](https://www.kcell.kz/en/product/3585/658), might have to switch to EN in top right corner

<comment><USER22> Wow, if only everyone was as smart as Kazakhstan and figured out that this super awersome Security Certificate was "an effective tool" to protect the entire country's information space. And I've been wasting time with strong passwords, 2FA, E2E encryption, full disk encryption, etc. /s

</comment></comment><comment><USER23> I have custom root certs for internal dev sites for my company. That's fine, but I'd like to add the root with a caveat that I control saying "I trust this root for *.mycompany.com,mycompany.org", but that I know means they wouldn't be able to proxy "mybank.com".

I don't think Firefox or Chrome can do that can it?

<comment><USER24> I'd like that as well, for exactly the same purpose.

To the best of my knowledge, no browser can do this today, and I don't know of any other software that can do that either. (I'd want to have it in the system certificate store with the same constraint, as well.)

Name Constraints, as mentioned elsewhere in this thread, wouldn't solve the problem, for two reasons: most software doesn't support them (and silently ignores them rather than correctly failing closed), and they require the CA certificate to contain the constraints rather than system configuration adding the constraints.

We need a mechanism to place certificates in a certificate store (browser or system) with specific domain constraints configured by the administrator. To avoid the failure mode of Name Constraints, those certificates shouldn't be accessible to software that doesn't know to enforce domain constraints.

That would also require updates to various SSL libraries (and to browsers) to handle this new certificate store and enforce the constraints.

<comment><USER25> > most software doesn't support [name constraints] (and silently ignores them > rather than correctly failing closed)

Could you elaborate on this? Specific examples? CVEs? My experience has been that most software will either honor them, or honor the "critical" flag, which is correct (if disappointing) behavior. If you want it to fail closed, use the critical flag. If you want it to fail open, clear the critical flag.

<comment><USER24> The last time I investigated this this, several years ago, I found that several SSL libraries simply ignored the extension entirely, whether it had "critical" or not. Older OpenSSL did so, for instance.

Doing some additional research, it looks like the situation has improved significantly now, and name constraints might actually work as designed if you don't care about older systems.

That still doesn't address the ability for a browser/administrator to apply such name constraints to a CA that didn't ship as part of its certificate, though.

</comment></comment></comment></comment><comment><USER26> I'm surprised at comments in the bug threads suggesting they do nothing. The idea being that fighting this would force governments to fork/change browsers, ultimately being a worse experience for users. Seems like betraying people's trust is a pretty bad user experience.

There will always be a fight over privacy. Giving up to a foreign government is a terrible idea. It would absolutely just let the problem spread and get worse.

I don't think Kazakhstan has the resources to replace outside online services. A move like this should simply result in them shooting themselves in the foot. This needs to be a firm line such that it's simply not practical for them to implement.

I understand that bugs/discussions should weigh both sides. And ultimately, we may need more than HTTPS. That's fine. The point is we don't just roll over and give up.

<comment><USER27> If a government mandates its citizens to install the government's own root certificate, then it's not that easy to find a long-term technological solution. The problem here is not a technical one, IMHO. The problem is that the government of Kazakhstan is not respecting the freedom of its people.

Point in case: In 2018, Kazakhstan ranked #144 in the Economist Intelligence Unit's Democracy Index. Countries such as China, Cuba and Belarus had a better ranking. [See [https://en.wikipedia.org/wiki/Democracy_Index#Democracy_Inde...](https://en.wikipedia.org/wiki/Democracy_Index#Democracy_Index_by_country_2018)]

IMO what's needed is first and foremost more democracy in Kazakhstan. That's not something that Firefox can solve.

With that said, perhaps anti-surveillance technology can assist the affected users. Maybe Tor. I've heard about some other, similar project but I can't recall its name right now.

[Edit: These where the anti-censorship applications I was thinking of: [https://www.psiphon3.com/](https://www.psiphon3.com/) and [https://getlantern.org/](https://getlantern.org/). Can't vouch for their security though.]

<comment><USER28> I don't agree. First off, no matter how you or me may be enraged by the incident, this is not (and shouldn't be!) a "moral problem" for the Firefox. And, by the way, if you are not living in the Kazakhstan, it's not for you to decide "what is needed first and foremost in Kazakhstan", it's their business entirely.

From the point of view of the Firefox, this should be an extremely simple technical problem. There is CA that is known to be "compromised" in an entirely technical sense, i.e. it is known to allow MITM. So blacklist it, end of discussion. Allow the user to remove it from the blacklist somewhere in browser's settings: it's not for you (Firefox) to decide what the greater good is.

I assume, it would indeed be a problem for Kazakhstan to fixing the service if people are not using the internet, because their browser doesn't work (because it's both an economical and a social disaster, obviously). Or maybe it wouldn't, because Kazakhstan will send troops to every home to replace every browser by Kazakh-fox or whatever. And it may play out to the better in the end, as much as it can lead to massacre.

But (as a 3rd party technological company) don't play mighty and powerful, responsible for the lives of people in Kazakhstan, it's not your fucking business how they live. You see a technological problem (known CA allowing MITM) — you solve it (block the CA!). That's what you promised your users to provide, to fix technological problems, not to fix the political climate in Kazakhstan, USA, China, whatever.

<comment><USER29> The certificate is not in the Firefox trust store. The government is requiring users to add it manually.

</comment></comment></comment></comment><comment><USER30> Google, Mozilla, and Microsoft need to take a stand here and blacklist these certs. All of the efforts to move to HTTPS, and all of the rhetoric surrounding it, are just wasted time and empty words if we as a tech community allow this kind of behavior to go unchallenged. This sets such a dangerous precedent, and governments need to know that this kind of meddling will not be tolerated.

<comment><USER31> Hello,

To continue using internet, you need to install our government-provided fork of Firefox that doesn't blacklist our government-provided root cert.

regards, your Tele2

<comment><USER32> That's exactly what will happen if they all-out blacklist. The best near-term option may be a compromise: a special indicator in the browser UI that the connection has been set up in such a way that some organization may be monitoring.

<comment><USER33> for all we know NSA may already be doing that all the time, and they're only the worst of the good guys.

<comment><USER32> Modern browsers require that leaf certificates which are issued in a chain which descends from a built in publicly trusted root include "certificate transparency" information. This means that the certificate has been published in numerous public logs and so would be discovered.

No doubt the NSA intercepts all kinds of things, but they're not doing it with TLS MITM technology (at least not without further additional hacks).

<comment><USER34> That is, assuming that your downloaded copy of Firefox contains these root certificates and not some different ones.

</comment></comment></comment></comment></comment></comment><comment><USER6> I'm from Kazakhstan using the biggest Internet provider (Kazaktelecom) and that's not true for me. No MITM here. May be not yet. Also checked mobile provider (Activ) and no MITM here too. But I saw local news, so probably not fake, though I'm not sure if it'll be mobile internet only or all providers.

<comment><USER3> This comment on the mozilla.dev.security.policy mailing list says that right now it's only for users in the nation's capital: [https://groups.google.com/d/msg/mozilla.dev.security.policy/...](https://groups.google.com/d/msg/mozilla.dev.security.policy/wnuKAhACo3E/cpsvHgcuDwAJ)

> At the moment, providers started to use the certificate in the capital of > Kazakhstan - Nur-Sultan (ex. Astana).

So it may not be nationwide yet.

<comment><USER6> > This comment on the mozilla.dev.security.policy mailing list says that right > now it's only for users in the nation's capital

I'm from capital (Nur-Sultan, former Astana).

I just checked my wife's phone and apparently she got SMS. Funnily enough, her cellular internet now does not work at all. Probably rollout is not going easy.

</comment></comment></comment><comment><USER35> This sounds very familiar. Oh yeah, 4 years ago:

[https://bugzilla.mozilla.org/show_bug.cgi?id=1232689](https://bugzilla.mozilla.org/show_bug.cgi?id=1232689)

</comment><comment><USER36> They should just put a red dot on the browser bar somewhere indicating a non- normal root cert is being used (this would also help in dev / test scenarios).

<comment><USER37> This is actually the subject of some debate, believe it or not, there is a good argument against it.

Here is the crux of the issue, many TLS middleware providers install their own root certificate for network monitoring, data loss prevention, security scanning and so on. I personally would like them to stop doing that or at least make it obvious to end users it's happening. However, in order to modify the root store, they must have been authorized to do so by the Administrator, and it's their network or hardware.

If we try to make it obvious to users that this inspection is happening, these providers will switch to using alternative methods, such as using Microsoft Detours - which would be even worse, now you have random vendors patching security critical code in such a way that is not discoverable for end-users. This cannot be prevented, because they must already have Administrator access or they wouldn't have been able to modify the root certificate store in the first place.

In this Kazakhstan scenario, imagine if adding the government certificate put a red dot that said "You are being monitored". If the government didn't like that, they could instead require you to install monitor.exe that had the exact same effect, but didn't show the dot by patching and hooking all the crypto APIs. I find this argument against adding an obvious indicator quite compelling.

<comment><USER3> In this case though, it seems like the government has no problem with telling people they're being monitored. The fact that they're willing to tell people to install a TLS certificate is indicative of that.

I think companies in the US are legally required to provide similar disclosure when monitoring their employees, so I don't see why they'd have a problem with a persistent indicator like that.

<comment><USER38> _In this case though, it seems like the government has no problem with telling people they 're being monitored_

Not at all. They spin it as providing security:

"Due to frequent cases of theft of personal and credential data, as well as money from bank accounts of Kazakhstan, a security certificate was introduced that will become an effective tool for protecting the country's information space from hackers, Internet fraudsters and other types of cyber threats.

...

What is a security certificate?

A security certificate is an electronic certificate that allows to protect Internet users from content that is prohibited by the laws of the Republic of Kazakhstan, as well as from malicious and potentially dangerous content. The security certificate is intended to provide subscribers of cellular communication in Kazakhstan with Internet access in the most secure manner."

(source: [https://www.kcell.kz/ru/product/3585/658](https://www.kcell.kz/ru/product/3585/658) \-- but this text seems to be coming from government, since it's quoted by all providers).

</comment></comment></comment></comment><comment><USER39> What makes everyone so sure this isn't happening everywhere already?

The problem Kazakhstan had was that there was no existing CA they could already force to issue certs. So they had to make a new one. It would be foolish to assume that none of the many trust anchors your browser already trusts haven't already been compelled by your local government to do exactly this.

Also, DANE and DNSSEC solves this problem.

<comment><USER3> Certificate Transparency would make it blatantly obvious if any existing CA were being compelled by governments to issue fraudulent certs.

DANE is, unfortunately, not viable to implement in browsers right now for a variety of reasons: [https://www.imperialviolet.org/2015/01/17/notdane.html](https://www.imperialviolet.org/2015/01/17/notdane.html)

<comment><USER40> > Certificate Transparency would make it blatantly obvious if any existing CA > were being compelled by governments to issue fraudulent certs.

CT makes such an attack obvious, but the harm can't be undone.

A case study: root certificates for the GPKI, the South Korean governmental CA primarily used for public institutions, are not included in most browsers except for maybe IE [1] but frequently trusted due to (still) prevalent uses of ActiveX controls. It is of course subject to CA/B Forum baseline requirements [2] and publishes CT records, so you may guess their "accidentally" invalid wildcard certificates [3] are quickly spotted... Heck no! It was only noticed 3 years later [4]. No one knows what happened in this period.

[1] For example, Firefox doesn't include it: [https://bugzilla.mozilla.org/show_bug.cgi?id=1377389](https://bugzilla.mozilla.org/show_bug.cgi?id=1377389)

[2] [https://cabforum.org/baseline-requirements- documents/](https://cabforum.org/baseline-requirements-documents/)

[3] For example, [https://crt.sh/?id=6990343](https://crt.sh/?id=6990343) contains a public suffix `.co.kr` (comparable to `.com`). Note that the BR contains very strong requirements for such public suffixes, which the GPKI didn't follow.

[4] [https://www.mois.go.kr/frt/bbs/type001/commonSelectBoardArti...](https://www.mois.go.kr/frt/bbs/type001/commonSelectBoardArticle.do?bbsId=BBSMSTR_000000000009&nttId=62842)

</comment></comment></comment><comment><USER41> I think the most important thing to keep in mind as you read through this issue and the comments is "be careful what you wish for". No doubt cases like this will be taken as arguments for making it even harder to install your own root certs than it already is, meaning that those who run MITM proxies on their own networks (e.g. to filter out ads even in otherwise unconfigurable browsers and such) get affected negatively, and it takes away from personal freedom. Also, don't forget that the pro-DRM and adtech crowd would love for nothing other than you to get exactly what they serve, whether you want it or not.

The increasing politicisation of Mozilla is also a concern --- it seems unwise for it to fight a government, or turn their core product into a platform for doing so. It's sad to see "privacy" brought up as an argument, and that seems to be Mozilla's main one these days; I think it's perfectly fine for people to desire privacy (and my MITM proxy will help with that, by stripping out trackers and such), and for Mozilla to offer services that do (they could work on their own VPNs and "firewall busters", for example), but the attitude of knowing better than the users or forcing them to trust or not trust certain entities is wrong.

</comment><comment><USER42> So it took them only two weeks to take advantage of Firefox's new policy to automatically "fix"[1] man in the middle attacks through enterprise/antivirus CAs. As expected, this "convenience" will make us all less safe :(.

[1] [https://blog.mozilla.org/security/2019/07/01/fixing- antiviru...](https://blog.mozilla.org/security/2019/07/01/fixing-antivirus- errors/)

<comment><USER43> If an attacker can install a CA on the system, the attacker can probably also apply binary modifications to Firefox.

Or replace it with a compromised version.

<comment><USER42> It can be an authoritarian government arm twisting you into installing it voluntarily, as the article proves.

<comment><USER29> Which they could also do with software, or even hardware via import controls.

</comment></comment></comment></comment><comment><USER3> Previous discussion from back when this was first announced: [https://news.ycombinator.com/item?id=10663843](https://news.ycombinator.com/item?id=10663843)

</comment><comment><USER44> > I think this CA should be blacklisted by Mozilla and Firefox should not > accept it at all even user installed it manually.

> This will save privacy of all Internet users in Kazakhstan.

No. This will mean that users would simply switch to chrome, edge, brave, ... , n + 1.

In case all of them block this CA, the government will force people to install an older version or will patch any open source browser so that it works with their certificates.

IMO, this is also wrong from a philosophical point of view. Your browser should just be your browser and not take part in political disputes. It doesn't sit well with me that Firefox has anything to say in the politics of its users.

And finally, encryption doesn't solve violence.

<comment><USER45> Yes, exactly.

In the United States, for example, it's legal (even expected?) that corporations can install custom CAs into their user's browsers and prevent internet access to any browser without it installed. Is it Mozilla's job to prevent these CAs from being installed on user's workstations? Should Mozilla reject any certificate from Blue Snort, etc.?

Kazakhstan has likewise declared it legal (under their own sovereign legal authority) to prevent web access to its citizens without the required CA installed. Just like it's legal in the US for corporations to "spy" on their employees, it's legal in Kazakhstan for it to spy on its citizens.

Laws of Western countries do not extend into other sovereign nations, regardless of what one thinks of those laws. It's not Mozilla's job to get involved in this case.

> And finally, encryption doesn't solve violence.

Nor abuse of freedom by nation states, unfortunately.

<comment><USER46> American and European companies and organisations put on loads of protest against acts like SOPA and Article 13. I don't see why this is any different.

Just because a nation state decides on something doesn't mean that foreign entities can't protest that decision. Firefox and Chrome can add very scary warnings to users about government sabotage if they want to; they can even start including ads for Tor and comparable services if they want to. Blocking the cert would at most be very consumer-unfriendly to people wanting the certificate to be in place. If they disagree with a particular browser vendor, those people can switch browsers or fork an open source one.

Mozilla's job is to provide a safe and open web. The Kazakh government is opposing that. In this case, it's perfectly in line with Mozilla's mission to warn users as best they can against the scary precedent their government is setting.

Of course this only works well if Google, Microsoft and Apple join the effort to warn users. Google is already showing a constant warning on Android when a device is being MitM'd and many of their apps do certificate pinning. Facebook and Twitter do certificate pinning in their apps as well.

I don't see why browsers couldn't take action as well. Just don't show any green locks during a MitM and show periodic notifications about the users' security being compromised. Block the certificate if you have to; as a party people rely on for choosing what certificate authorities to trust, they can't allow themselves to be compromised by governments enforcing laws endangering the safety of the web.

</comment></comment></comment><comment><USER9> Tele2, a Swedish company and major phone network in Sweden.

Wouldn't be the first scandalous thing in the former Soviet Union that a Swedish phone network was involved in: [https://en.wikipedia.org/wiki/Telecom_corruption_scandal](https://en.wikipedia.org/wiki/Telecom_corruption_scandal)

<comment><USER47> To be noted though, Tele2 has as of recently exited the Kazakhstani market: [https://www.tele2.com/media/press-releases/2019/tele2-has- ag...](https://www.tele2.com/media/press-releases/2019/tele2-has-agreed-with- kazakhtelecom-on-the-terms-of-its-exit-from-kazakhstan)

</comment></comment><comment><USER48> Can we, endpoints outside Kazakhstan, detect when a MITM client is connected and serve a boiler plate message "Untrusted connection"?

If enough high level sites do this (Google, Cloudflare, Wikipedia etc) it might force the hand of the government since they are the ones effectively breaking the internet.

<comment><USER49> No, mitm is not easily detected on server side. It's a transparent proxy. You could start serving these messages to whole KZ ip range, though.

<comment><USER49> If someone could enlighten me where i'm wrong, it'd be much more constructive than simply downvoting.

<comment><USER50> [https://blog.cloudflare.com/monsters-in-the- middleboxes/](https://blog.cloudflare.com/monsters-in-the-middleboxes/)

[https://mitm.watch](https://mitm.watch)

<comment><USER49> Thank you. An interesting technique, but ultimately very easily bypassed with minor effort on interceptors' behalf.

</comment></comment></comment></comment></comment><comment><USER51> Question to local readers: Is Kazakhstan also blocking VPNs and SSH?

<comment><USER6> Kazakhstan is blocking some websites, including home pages for Tor and popular VPN services. Also it uses some sophisticated Tor blocking: it establishes TCP connection but no bytes going there, so Tor client just hangs there without error or traffic, I wasn't able to unblock it, though I did not try hard enough. I think that they are blocking connections to popular VPN services as well, but I don't really know. Without access to their home pages it's hard to connect anyway. I know that people successfully using some mobile apps as VPNs, so while they are trying to block VPN, they are not trying hard enough.

I never had any problems with SSH and I operate my own OpenVPN on VPS using standard port and I never had any problems with it as well.

</comment></comment><comment><USER52> Almost exactly a year ago I asked this:

[https://security.stackexchange.com/questions/189647/what- hap...](https://security.stackexchange.com/questions/189647/what-happened- with-kazakhstans-root-ca-mitm-policy)

Guess it wasn't canceled after all.

</comment><comment><USER53> hmm, certificate pinning will not allow this gov-ca to work for a lot of high profile web sites. i wonder if these sites with cert pins are whitelisted by the kz gov?

\--

somehow i missed that HPKP is dead and will be removed from chromium and all the derivative browsers. now google is focusing on Expect-CT

<comment><USER54> My understanding is pinning will not block this, locally installed trust anchors bypass pinning. [https://groups.google.com/d/msg/mozilla.dev.security.policy/...](https://groups.google.com/d/msg/mozilla.dev.security.policy/wnuKAhACo3E/cbxRVMkxDwAJ)

<comment><USER6> That's correct, HPKP does not block this. If some application uses manual pinning, it'll work (or, rather, won't work at all).

</comment></comment></comment><comment><USER55> Could someone explain to me what this means and/or why it's bad?

<comment><USER56> When you connect to a website via HTTPS, your browser downloads the certificate from that website and validates it by checking that the website's certificate was cryptographically signed by an entity that the browser trusts. If the certificate is valid, then you can assume that your data will only be decrypt-able by the website owner, so the connection is secure. Your browser will display a happy green banner showing that the connection is secure, so you can feel safe sending private data to that website without it being eaves- dropped along the way.

The browser checks for validity by ensuring the website certificate is signed by a certificate that is shipped with the browser. These "root certificates" are usually owned by Certificate Authorities, such as Verisign or any other number of CAs. CAs ought to verify that the entity creating a new certificate is who they claim to be (the website owner) before signing a certificate. This way, you trust Verisign to tell you that you can trust the target website.

What Kazakhstan has done is create their own root certificate and asked people who live there to install it in their browsers. They are also intercepting any connection to facebook.com and giving your browser a Kazakhstan-created certificate, which is then verified against the Kazakhstan-owned root certificate. Since it will pass this check, the browser shows a happy green banner, even though the certificate is owned by Kazakhstan and not facebook.com. In other words, the data people in Kazakhstan send to facebook.com is now being intercepted and decrypted by Kazakhstan before being forwarded to facebook.com. Facebook is the example used in the linked bug, they can perform this with any other website, too.

<comment><USER57> What prevents us from having to trust Verisign (or its employees) or a government warrant, etc. to not do the same?

Can we leverage signed DNS records to add another layer of control needed? Do we also need encrypted DNS where we can choose who to trust? Are we stuck with the CA trust model?

<comment><USER24> > What prevents us from having to trust Verisign (or its employees) or a > government warrant, etc. to not do the same?

Certificate Transparency. Current browsers are moving to not trust _any_ certificate whose issuance wasn't publicly logged. That doesn't prevent an attacker from issuing an MITM certificate, but doing so would permanently burn a CA. (At least, once the policies are in place and enforced.)

</comment></comment></comment></comment><comment><USER58> I'm in Kazakhstan atm, the only solution I can see is to reach Google, Mozilla, Firefox, Apple, banks and all the other popular platforms and social media apps and ask them to ban connections with the government-issued certificate.

This will immediately block their services in the country and will raise awareness at scale.

[https://renatello.com/mitm-in-kazakhstan/](https://renatello.com/mitm-in- kazakhstan/)

</comment><comment><USER59> How does this work technically?

I understand that by making people install the government cert, any website with a cert signed by that government cert will happily speak TLS.

But, how can they read data transmitted between websites they don't control? When the client asks for Facebook's cert, wouldn't the government have to sneak in and show a fake cert signed by them instead? How does that work?

<comment><USER60> It can probably work as MITM. The ISP or whoever controls your net traffic needs to generate a fake certificate(signed by a trusted root cert) for a site you are browsing. Refer example in: [https://en.wikipedia.org/wiki/Man-in-the- middle_attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack)

</comment></comment><comment><USER51> Just think about this for a minute.

The regime has just painted a huge "X" on their backs.

If you hack the governments servers and steal the certificate private key you can pretty much rob the entire country - all bank transactions, pins, passwords etc. will be in the clear for you, ripe for the picking.

This is yet another reason why backdoors are so dangerous, not just for the privacy of all citizens.

</comment><comment><USER47> Does these MITM-middleware softwares usually verify the cert presented by the server? If not, I guess this could be used to double-MITM the user?

If someone manages to redirect traffic by e.g DNS spoof to some server which presents a self-signed certificate for e.g Facebook.com, the government-MITM would just sign that as being Facebook.com.

</comment><comment><USER61> It seems like it's easy to take down the site that's hosting the certs ([http://qca.kz/](http://qca.kz/)). Maybe that's an appropriate response to this...

       $ wrk -t 50 -c 500 -d 5m --latency --timeout 3s http://qca.kz/

</comment><comment><USER62> Absolute morons. They will break windows updates. You cannot easily mitm Windows updates. There is additional undocumented check that the CA is from Microsoft. One needs to hotpatch the windows update dll's to enable it. That's almost certainly one that won't be intercepted.

</comment><comment><USER63> Have other governments requested their citizens to install country specific CAs? For some reason, I thought China already employed this practice (although I guess they wouldn't need to, as they just tend to block everything that isn't government approved).

<comment><USER6> AFAIK it did not happen yet anywhere, including China. Kazakhstan is kind of "leader" there. Though I'm sure more countries will follow.

</comment></comment><comment><USER64> Lets say you have this root CA installed on local machine and won't delete it. Can you protect yourself against https decryption by MITM in any way? Will VPN help or they will intercept VPN connection too?

<comment><USER51> Use a browser that doesn't use the CA list of the OS (such as Firefox) and tunnel all the traffic via a stealthy VPN.

It would probably be illegal and if the regime finds out they'll put you into jail etc.

</comment></comment><comment><USER65> Many of us already trust certificates we shouldn't be.

It's not even this blatant in most cases. About 6 countries have issued certificates for Google, India being one of them. And they all made use of the fact that they were part of the trusted root certificates on our systems.

[https://www.quora.com/Why-are-HTTPS-requests-not- cacheable-b...](https://www.quora.com/Why-are-HTTPS-requests-not-cacheable- but-HTTP-can-be/answer/Karthik-Kumar-Viswanathan)

</comment><comment><USER66> This is being discussed here as well [https://groups.google.com/forum/#!msg/mozilla.dev.security.p...](https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/wnuKAhACo3E/cpsvHgcuDwAJ)

I like the idea of a permanent, non-removable banner saying "Kazakhstan is spying on you, learn more here <link to more info>.".

</comment><comment><USER49> Actually, a dns caa record could be of use in this scenario to at least alert the client that the traffic has been intercepted. Then again it is trivial to intercept and rewrite plain DNS requests and dns over https would also be subject to the same https mitm intercept... Maybe certificate pinning was a right idea.

<comment><USER6> CAA is for issuers, not for browsers. And yes, without DNSSEC it's easily spoofed.

<comment><USER49> That is true, however it could be used for CA verification also, could it not?

Edit: RFC 6844 very unambigously states that it can be used for additional verification:

CAA records MAY be used by Certificate Evaluators as a possible indicator of a security policy violation. Such use SHOULD take account of the possibility that published CAA records changed between the time a certificate was issued and the time at which the certificate was observed by the Certificate Evaluator.

</comment></comment></comment><comment><USER67> I think everyone who is concerned with privacy in states like those, use ToR anyway all the time. I know people who only do meaningful stuff on the Internet through an RDP session on a server in Amsterdam, connected to through a VPN. The rest is just to watch cat videos.

</comment><comment><USER68> This is bad because we don't like it when a foreign government infringes on foreign citizens' rights, but it may also be good (in a limited sense) because it might bring a whole lot more public scrutiny (from all countries and their citizens) towards the issue...

<comment><USER32> This will _not_ be good.

To the extent that Kazakhstan succeeds with this, it will only make other governments jealous of the capability and want it for themselves.

</comment></comment><comment><USER69> Firefox and Chrome updating their browsers to block these certificates won't also work, since the Kazak government can just fork Firefox and create their own browser which accepts their rogue certificate. And block all other browsers which don't.

</comment><comment><USER70> I live in Kazakhstan and have not seen this yet. No MITM according to the provided tests (mholt)

<comment><USER71> It's only rolled out to 20-30% of the country right now: [https://atlas.ripe.net/measurements/22372655/#!probes](https://atlas.ripe.net/measurements/22372655/#!probes)

</comment></comment><comment><USER72> Many "democracy loving" politicians today:

"I knew the techies could do it! They told me they couldn't but I knew they were lies. See! even Kazakhstan can do it, so why can't I also break HTTPS encryption?"

</comment><comment><USER71> At what point does this become an OFAC issue for browser vendors based in the states? I would be stunned if someone at Commerce isn't already circulating enforcement memos about this.

<comment><USER32> I think that's terribly optimistic. I think there are all kinds of people in the US government who would like to be able to point to a success story of a scheme like this, so that they'll have more ammunition in support of implementing it here.

As for whether designating that browser vendors can't distribute software to Kazakhstan, their government would just fork an open-source one, mod it to pre-include their MiTM cert, and force their citizens to use that.

</comment></comment><comment><USER73> It seems like there is a structural problem in relying on authority (in a CA) for encryption. Probably by design.

I think ultimately the solution is going to be p2p content-centric approaches.

</comment><comment><USER74> Would it be possible to also blackhole the domains used to host the bad CAs? Yes they could counter this but it would buy some time before browsers are updated.

</comment><comment><USER75> The best solution would be to blacklist rouge SSL certs.

<comment><USER76> Doing so will make the internet (In Kazakhstan) unusable, because everywhere you go, you will see an 'untrusted cert' warning.

<comment><USER75> Sometimes stuff likes this needs doing in order to show how bad MITM is.

<comment><USER76> Okay, say you live in Kazakhstan. You stop using the Internet.

Do you think the government will care?

<comment><USER77> If it ruins their economy, yes.

<comment><USER76> 99% of the population will happily install the government cert, and life will move on.

The 1% will either put up with it, stop using the internet, or leave.

One thing will happen though - the economy will _not_ be ruined.

Generally speaking, since the Cold War ended, these sorts of countries don't mind troublemakers leaving. It's better international PR for them to have 'problem people' leave voluntarily, than to repress them.

<comment><USER6> For example there's no way for my LG TV to install that root CA, so all that smartness basically rendered useless, unless LG would issue new firmware for that region and I'm not really sure that they would care enough. I bet that there are plenty of devices that would stop working. Think about all those IoT devices. I could imagine some kind of eye surgery laser device to stop working because it can't connect to its Zurich servers to check license. Yes, it won't cause revolution, but there will be a lot of issues.

</comment></comment></comment></comment></comment></comment></comment><comment><USER78> Does such a certificate compromise non-browser traffic as well? Like SSH tunnels, mobile apps, Telegram etc.

<comment><USER79> SSH doesn't depend on certificate authorities, it's up to you to manage your own keys, each end point also has a uniquely generated signature which avoids MITM after first time auth (including by taking over domains).

This is a HTTPS only issue and fundamentally it's the same problem as control over domains (ease of manipulation through centralisation).

<comment><USER78> So that means apps like Instagram are safe to chat in?

<comment><USER47> Not necessarily.

As far as I know, both the apps you mentioned use HTTPS. However, apps have the option of doing what's called Certificate Pinning.

That's when the application ignore OS/User trust settings about certificates, and just allows a list of hardcoded certificates / certificates signed by a hardcoded CA. Akin to how SSH works (kind of...).

If I remember correctly both Telegram and Instagram have pinned their certificates, which would probably block all network communication but not allow for a MITM attack, even if the user installed the KZ root certificate.

<comment><USER80> I think all Facebook apps do this, and probably most major apps from big companies. I tried to do some research on what requests the Facebook app was making on my phone and it was pretty difficult to get it to allow me to use Charles proxy (when I installed the cert on my phone the app just stopped working) because of the certificate pinning. The only way this would work is if the government created their own FB, etc. app and somehow distributed it.

</comment></comment></comment></comment></comment><comment><USER81> Hopefully Starlink will launch soon. Good luck with a MITM attack on a satellite connection.

</comment><comment><USER82> Does anyone have ideas, who is the tech vendor?

Russians? Chinese?

<comment><USER83> They could perfectly well do it themselves.

</comment></comment><comment><USER84> Hooray for firefox! Why use any other browser?

</comment><comment><USER85> What about iot and embedded systems?

</comment><comment><USER86> try ssh tunnel

</comment><comment><USER87> I would actually be shocked if US agencies can't do the same here almost all the time. There has to be at least one trusted root authority that is controlled by an agency. Do you remember when RSA made a $10 mil deal to give .gov a backdoor back in the day. There is no reason any major US based certificate issuer couldn't do the same, or an employee turned into an asset to sneak it to them, or they just straight hack the places and get certs they can generate anything on. You might be able to detect it by logging the issuer of the cert, the browser doesn't care who auths it as long as it is trusted. It would be odd for most places to have certs issued by multiple authorities.

</comment><comment><USER32> I blame, in part, TLS 1.3, E-SNI, and DoH for this.

Previously, a government could monitor what site a user is visiting just by looking at the TLS session startup. Even if it is hosted on a cloud provider and 100 different sites are hosted from the same IP, they could look at the TLS-SNI data in the plain text to choose to interrupt and block the connection.

A fallback would be to manipulate DNS queries and force all DNS queries to be directed to official DNS resolvers. But DoH makes that far harder to control.

This is a bluff being called. Tech said "If we make it so that they have to spend all this money and build a massive scale intercept that actively participates in each TLS session, they won't buy into the cost."

Costs keep going down for this sort of thing. Now there are large organizations and governments willing to work on this stuff.

<comment><USER88> It's probably completely unrelated.

DoH is easy to block. They can look at SNI and cut DoH connections.

Being able to access all the content is far more valuable than hostnames.

<comment><USER32> We have E-SNI now, where SNI is encrypted. And you have DoH providers who'll use that.

And then massive CDNs will start to support it.

Some of them might even enable it, with encrypted SNI, on _every single listener on all of their IPs_.

DoH was designed to evolve into something nearly unblock able. Unless you active intercept 100%.

Which some people believed no one would pay up for or that it would be unscalable. This stuff only gets cheaper and easier.

</comment></comment></comment><comment><USER89> Warning: what follows is completely baseless speculation, and let's concede that right off the bat.

Who's to say that this isn't happening in the US as well? The US has invested billions of dollars in dragnet surveillance that is allegedly useless for anything other than metadata in the context of HTTPS.

Is it out of the question to ask whether our secret courts could issue gag orders and claim that national security mandates CA root keys? Such a gag order would only be served to a small group of engineers at large companies, and those engineers would have no right to report on it. We're talking about only a few hundred FISA gag orders, and thousands are served annually. It would make their multibillion dollar infrastructure useful again, wouldn't surprise me if some (unnamed, anonymous) judge bought the argument.

To employees at vulnerable companies, what's your PKI like? Is anyone aware of a company that implements strong multi-party checks on accesses to important private keys? If the NSA wanted your keys, how many employees would need to be served gag orders? Is it on the order of dozens or hundreds?

<comment><USER90> If the NSA was using their own certificates to MITM all HTTPS traffic it would be easily noticed by security researchers. Its not like they obtain the private keys of every US company. They'd have to make their own replacement certain for every site they wish to intercept. That could easily be noticed by security professionals and targeted companies by monitoring.

<comment><USER89> What about just for the Alexa 100?

<comment><USER91> Far too many people would be able to notice. Someone in one of the companies would whistleblow.

<comment><USER92> But would they? The Snowden leaks were 6 years ago. I am assuming the government didn't just throw up their hands and give up after that...

edit: not to say they are specifically MITM'ing HTTPS widescale.

<comment><USER71> There are a lot easier ways to exfiltrate data than wholesale breaking TLS encryption and MITM'ing 295+ tbps of domestic traffic. That said, every super power is working on better decryption capabilities.</comment></comment></comment></comment></comment></comment>


Yelp Walks Away From Google Deal, And Half A Billion Dollars - <AUTHOR> http://www.techcrunch.com/2009/12/20/yelp-walks-away-from-google-deal-and-half-a-billion-dollars/ <comment><USER2> Yelp is not doing anything revolutionary. Before Yelp there was city search. Yelp came along and improved on what city search had done. Who is to say a better Yelp won't come along. I think they will regret walking away from this deal in the near future. For a very recent example look at Friendster. Although I hope I'm wrong.

<comment> brown9-2 Not to quibble but is what happened to Friendster really _very recent_? Feels like ages ago.

<comment><USER3> [http://www.downloadsquad.com/2009/12/10/malaysian-company- mo...](http://www.downloadsquad.com/2009/12/10/malaysian-company-mol-buys- friendster-in-other-news-friendster/)

Friendster was bought this month for more money then should ever have been spent buying something nobody uses.

<comment><USER4> (Than)

Lots of people are still quite invested in Friendster. Facebook somehow used the college connection to one-up them in "cool." Then they expanded beyond college/high school.

Lesson: don't trust social networking websites.

</comment></comment></comment></comment><comment><USER5> Google is executing their business plan of trying to 100% own the web.

Recent aquisitions are positioned to own the underlying top 10 search results in every category they can get their hands on.

I'm glad that yelp, top of the list for many local searches, is holding out.

And yes, I know they've got a pile of cash and they should use it to improve margins in underlying biz, but still this just seems like a continued march to monopoly.

<comment><USER6> I very much doubt they want to own 100% of the web. Only the profitable bits that fit with their ongoing strategies. Yelp obviously ties into a lot of the good stuff they're doing, OTOH yelp is pretty unheard of outside the US afaik.

</comment></comment><comment><USER7> So the story here is ... Techcrunch published a story about an acquisition that turned out to have no basis in fact. TMZ seems like a more reliable source for gossip.

<comment><USER8> _TMZ seems like a more reliable source for gossip._

TMZ isn't a good example. When it comes to breaking celebrity news, they actually exercise a great deal of journalistic integrity and restraint. They're very reliable and very well-sourced.

<comment><USER7> I understand what you're saying, but you seem to have supported my argument. TMZ _is_ a better source.

<comment><USER8> My comment was meant to be agnostic to the merits of your argument. While we're talking about it, though, I think that this particular situation (reporting the Google-Yelp acquisition talks) is actually a bad example as well.

TechCrunch reported that Google and Yelp were in talks for an acquisition. As far as I know, that is true and TechCrunch broke the story with original reporting.

Then TechCrunch reported that Yelp walked away and talks broke down. As far as I know, that is also true and again they broke the story with original reporting.

Remaining agnostic to your claim about TechCrunch, how does this situation support the argument that they are not reliable?

<comment><USER7> How many other times have techcrunch reported "company x in late stages of being acquired by Google/Yahoo/Microsoft" followed by "Talks for company x being acquired break off?" I'd suggest quite a few. I realize that this can actually happen, but if it happens often enough then the story becomes non- news.

</comment></comment></comment></comment></comment><comment><USER9> Are they crazy? They could have made an awful movie with that money!

<comment><USER10> That one made me laugh!

</comment></comment><comment><USER11> is anyone else tired of seeing all the techcrunch submissions pasted in hn?

this discussion has been had probably a year ago, but it seems like it's getting worse again.. seriously, why?

<comment><USER12> Why does it matter that it's from TC? What's important is the story. How is this the top comment? Does no one here give a shit about the actual story?

</comment></comment><comment><USER13> How old is Jeremy Stoppelman?

<comment><USER14> 31

</comment></comment><comment><USER15> yelp may be onto something but i think they dont realize that goog can kill them by applying a "mapquest".

<comment><USER16> Sure, but it's also important to realize that Google Maps was a rare success in a string of mostly failed projects/acquisitions (Orkut, Knol, Picasa, Google Video, etc).. I'd argue that Google's biggest successes were in areas in which the previous leaders failed to innovate for years (Mapquest, Hotmail), whereas Yelp is a very active company in a constant state of improvement/innovation. If I were Yelp, I'd be more concerned about Google doing something which would cause it to lose placement in search results.

<comment><USER17> Yelp is, from my observations, anything but active. They haven't innovated in terms of UI or features in probably two years. Even geographies have been slow to develop - UK took a long time to appear.

In fact, they're oddly static - the number of reviewed restaurants and stores has increased quite slowly for most cities, they haven't done a good job pushing into smaller markets.

Admittedly this is my anecdotal observation but i've been following yelp pretty closely since they launched and honestly up until the Google acquisition attempt, i was wondering if they were short on cash because they seem to spend so little energy on product/design/site and there seemed to be a bit of desperation in the whole 'yelpscam.com' accusations, which appear to be legitimate.

<comment><USER18> What about the IPhone virtual reality app? I've found that very useful and quite innovative.

<comment><USER19> that was me. thanks :)

</comment></comment></comment></comment></comment><comment><USER20> Never know how this will play out. Would they Become another Google (who refused yahoo's offer and became better for it) Or Friendster (refusing googles offer but lost out to Myspace & facebook) . Only time will tell.

And I Do not understand this views of "Getting aquired is bad" for start up. I think it is up to the founders to decide what is good/bad for them.

<comment><USER21> If they have funding (presumably they do) then it isn't that simple for the founders I think.

</comment></comment><comment><USER22> Good for them! Getting acquired is not victory for a startup, building a sustainable business for the long term is.

<comment><USER23> I think, what a victory for a startup is really depends on what it's founders' think.. for some it may be acquisition

</comment></comment><comment><USER24> Why is it when Google enters the picture into anything many geeks turn into tinfoil hat homeless people?

"The googles! It's coming for your body!"

</comment><comment><USER3> While I agree with the other comments, I'm going to call this a dick move of the week. I understand that google wasn't buying yelp just for the sake of owning yelp, but Jesus Christ, yelp is a terrible terrible website for reviews of anything(I can only vouch for the NYC yelp). It's a pretty widely regarded fact here that yelp reviews do not count for shit, thus making the website a joke. They should have taken the money and ran.

Edit: If you don't agree, feel free to browse the reviews of NYC restaurants for some great advice by hundreds of thousands of self-proclaimed culinary experts and trendy hipsters who's idea of a good bar is one with big game hunter in the back and a 95% mustache rate.

<comment><USER25> What would you recommend in NYC instead of Yelp?

<comment><USER26> nymag.com is pretty good.

<comment><USER27> Seconded. NY Mag is far more in the know, and current.</comment></comment></comment></comment>


New active fork of Grumpy, a Go-based python2 runtime - <AUTHOR> https://labs.getninjas.com.br/released-grumpy-runtime-v0-3-0-a05f1cf8e111 <comment><AUTHOR> This project got a lot of attention when it was first released, but then the original repo went dark. Some community members have decided to take up the mantle and have issued a rallying cry. The new repo is [https://github.com/grumpyhome/grumpy](https://github.com/grumpyhome/grumpy).

Some more discussion on the original repo: [https://github.com/google/grumpy/issues/406#issuecomment-402...](https://github.com/google/grumpy/issues/406#issuecomment-402454063)</comment>


German company switching 12,000 desktops from PC to Mac - <AUTHOR> http://www.9to5mac.com/axel-springer-mac

<comment><USER2> You know, back in the day, it was normal for everyone to have two computers on their desktop. There would be a generic PC running Windows with a 14" monitor for word processing and email, and there would be another machine for "actual work". If you were an engineer, it might be a SPARC or RS/6000 workstation. If you were a designer, probably a Mac or an SGI.

Nowadays you can get one box to do everything, a Mac is a Unix workstation that can run a PC in a VM. Why _wouldn't_ organizations switch?

<comment><USER3> Can someone explain to me why designers should use Mac? I can't see any significant differences between Photoshop and Illustrator run in Windows and Mac.

<comment><USER4> Shhhh, there isn't. But don't bring that up because it's very cool to use a Mac, it makes you so creative and cutting edge. Rainbows and unicorns and dogs shitting ice cream and all that.

<comment><USER5> Don't knock the pettable, portable, ice cream dispensers...

</comment></comment></comment></comment><comment><USER6> That's a newspaper/magazine publisher. I find this hilarious, because back in the day (mid-nineties) most companies in that industry used Macs. Many IT departments probably completed the switchover to PCs in the early part of this decade (standardization was probably the primary reason) - and now they have to switch back.

<comment><USER7> You are right!

They switched some years ago for the exact same reasons they mention now from Mac to Windows PCs.

</comment></comment><comment><USER8> I wonder just how fun a corporate, locked-down, Mac will be.

<comment><USER4> About as fun as a corporate, locked-down PC is.

<comment><USER8> That's what I'm afraid of. I was hoping people would be less likely to completely hose a Mac and therefore there would be a lower need for draconian restrictions.

<comment><USER4> Operating systems are not 'fun', it's like saying my house is 'fun'. It's what you do on or in the OS that makes it fun.

I've experienced this over the years with Linux. I will from time to time install the latest greatest distro, configure it, work out all the little nagging bugs and then ....

Nothing, it's not fun (unless you think getting your graphics card to work and spending 4 hours doing it is fun), in fact the goal is always to get the OS to the point where I can use it ... for something else.

<comment><USER9> Certain operating systems are more conducive to 'fun' experiences than others, much like houses.

</comment></comment></comment></comment></comment><comment><USER4> More interesting is this "Until now the highest profile switcher has been Auto Warehouse Co. which is in the midst of a switch of 1000 desktops"

That's it?!? And they're not even done, which means the largest installation is now under 1K.

Shows how far the Mac platform has to go in the 9-5 world.

<comment><USER10> mac dominates the design/music/film industries though

<comment><USER3> Contrary to popular belief, actually Linux dominates the film industry.

<http://www.desktoplinux.com/articles/AT5611327583.html>

<comment><USER2> That's a bit skewed by the thousands of machines in render farms that could be running _any_ (free/bundled) Unix. It'll be interesting to see if OSX Server 10.6 gives them a compelling reason to switch.

<comment><USER11> It isn't likely, since most of the high-end shops have a lot of custom software on those Linux machines, and even their Linux distros are in many cases heavily customized, beyond what they'd be able to do with OSX.

Smaller FX shops that don't have IT staff are much more likely to consider it, unless they rely on software that isn't available in OSX, like XSI.

Which reminds me, now Houdini is available for OSX (it might still be beta, but it's coming if not here already).

</comment></comment></comment></comment></comment><comment><USER12> by the way, it's not any company. it's axel springer, one of the largest media-companies in germany</comment>


Laws of Power: Machiavelli and Sun-Tzu brought up-to-date - <AUTHOR> http://en.wikipedia.org/wiki/The_48_Laws_of_Power <comment><USER2> Machiavelli itself is not too bad. `The Prince' is remarkably progressive.

<comment><USER3> One theory is that Machiavelli wrote The Prince to make the common man aware of behaviors and practices of powerful people. The same could be said for The 48 Laws of Power.

The books are not necessarily meant to be instructional, but informative about the economics of power.

I haven't read 48 in some time but I believe Greene says something about regardless of if you want to participate in power plays you will undoubtedly find become a part of them so it's best to be aware.

</comment></comment><comment><USER4> I actually love this book. History and strategy. You use the tricks that suit your personality. And become aware of the rest.

I can't compare it with Sun Tzu. Because Sun Tzu is purely metaphorical. You have to think deep to see the applications.

And Machiavelli, while a pretty good strategy book, is very instructional. I like 48 Laws of Power a lot better. Its a lot more entertaining with stories,

(Also - if you want a mindfuck, you should read The Prince by Machiavelli and The Hero by Baltasar Gracian back to back. Both have opposite lessons. But both will get you nodding your heads while you're reading it. (Baltasar Gracian apparently wrote The Hero as a response to Machiavelli.))

</comment><comment><USER5> Or, try "don't be evil"

Edit: Yes, I am suggesting that the 48 Laws of Power are inherently evil.

<comment><USER6> I strongly disagree that they're evil. I have had the book for about a decade, and while I consider myself a low-power individual - that is, unaggressive in pursuit of my goals - I've found it a great aid in understanding the dynamics of many situations, as well as knowing when someone is exercising a power play against me or trying to manipulate me in some fashion.

Sure, it's not '48 laws of harmony and cooperation'; I think it's a legitimate authorial technique to challenge the reader and push them out of their comfort zone - and yet the book is abundant with examples of how greed and hubris can lead to a sticky end. The book seems to generate strong reactions in a lot of people, both those like yourself who say it's evil and from others who say it's too wishy-washy (one hard-charging person I mentioned it to derided it as '48 laws of brown-nosing'). I wonder if you have read the whole thing? If not, why not borrow it from the library, saving yourself the emotional conflict over whether to enrich the author, and give it a full read.

The fact is that it's a competitive world, and attempts to improve upon human nature often turn out to have serious negative consequences; apparently benign beliefs such as christianity can become vehicles of horrid repression. Better, then, to improve the world by securing for yourself the freedom to do so in peace than by wishing away the facts of life.

<comment><USER7> Well said. Most problems are actually people problems. Like other problems having awareness of their nature can help you sort them out when you're in them and occasionally avoid them before they happen.

The biggest lesson I got from this type of thinking is that people are surprisingly predictable. I don't know where to draw the line between recognizing behavioral cues and patterns and manipulating people but at the least being aware of the potential should help you avoid being manipulated yourself.

</comment></comment></comment><comment><USER8> This book has a permanent place on my bathroom bookshelf-- each "law" can be a quick read and they aren't sequential.

Any practical use should be taken with a grain of salt. The book itself is more a great study of history and humanities than it is a guide to power.

Of course, I could be saying that to deceive you so I may gain power. Or something like that.

</comment><comment><USER9> I've read this and it's an interesting book, but it is very, very long and could really do with an abridged version.

<comment><USER10> How about this: [http://www.amazon.co.uk/Concise-48-Laws- Power/dp/1861974043/...](http://www.amazon.co.uk/Concise-48-Laws- Power/dp/1861974043/ref=sr_1_1?ie=UTF8&s=books&qid=1256663323&sr=8-1)

</comment></comment><comment><USER11> This is a great book but The Art of Seduction is more fun.

</comment><comment><USER12> don't forget the 50th law!

<http://en.wikipedia.org/wiki/The_50th_Law>

<comment><USER8> I'm actually excited about that book. I saw an interview with 50-cent on CNBC and he know's what he's talking about.

Before you scoff, remember that he was a seed-stage investor in Vitamin Water. Survivorship bias, but still an interesting point.

</comment></comment><comment><USER13> a.k.a. The 48 Laws of Unhappiness</comment>


Show HN: It's almost four twenty somewhere in the world - <AUTHOR> http://its.fourtwenty.in/ <comment><USER2> [http://i.imgur.com/zXGy9hn.png](http://i.imgur.com/zXGy9hn.png) Doesn't seem to highlight the correct place. Chrome latest.

<comment><USER3> Chrome, FF, Safari - none highlight correctly.</comment></comment>


Worklight for Mobile Apps? - <AUTHOR>

Has anyone tried using WorkLight for developing Mobile Apps?
It is suppose to support multiple mobile environments with single-shared code base making it simpler & faster to develop
Any feedback on performance and cost <comment><AUTHOR> Is it worth using any such software that would help us develop app with single code? I am assuming it would help us manage code & standardise functionality across apps.</comment>