Hacker News Reader

Comment by spoonjim | Hacker News Reader

There are three levels of anonymity: anonymity to the general public, to Apple, and to a state-level actor.

Anonymity to the general public is very easy, incorporate a company behind some of the shell corporation mumbo jumbo that any corporate lawyer can prep for you, it will cost $ but it will be easy.

Anonymity from Apple could probably be pulled off by incorporating in a country with fairly weak transparency and having the company owned by an offshore trust.

Anonymity from a state level actor would be pretty hard. You'd have to have a shell corp in a foreign country owned by a shell corp in another foreign country and even that might not be enough.

View on HN

> Anonymity from a state level actor would be pretty hard.

I'd say "totally impractical/impossible for regular individuals".

As James Mickens so eloquently put it:

If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them. -- https://www.usenix.org/system/files/1401_08-12_mickens.pdf

Some of us enjoy cosplaying extreme privacy nuts, or engaging in recreational paranoia. But don't for a minute kid yourself into believing you stand a chance against the NSA (or your jurisdiction's equivalent).

As funny as this is, you (not you, the person in the example) broke the anonimity when you chose to be an antagonist yourself (and drawing attention in the process).

The best way to be anonymous to those agencies is to be irrelevant to them

Then you just become training data for their threat algo.

> The best way to be anonymous to those agencies is to be irrelevant to them

And to make sure that everybody who has the same name as you also stays irrelevant to them... And that nobody ever uses your name as an alias and does anything "relevant" to them.

"“A senior administration official who spoke on condition he not be identified said Kennedy was stopped because the name ‘T. Kennedy’ has been used as an alias by someone on the list of terrorist suspects.” A number of media outlets carried the same version of the story.

Of course, “Ted” Kennedy’s real first name is Edward, and would appear as such on any ticket or identification documents, so why the senator’s name should set off alarms, even if a ‘T. Kennedy’ appeared on a “no fly” list, is a mystery that has not been explained.

The New York Times reports a different story: “The alias used by the suspected terrorist on the watch list was Edward Kennedy, said David Smith, a spokesman for the senator, who uses his full name, with a middle initial, of Edward M. Kennedy.”"

https://www.wsws.org/en/articles/2004/08/kenn-a21.html

One cannot remain private or anonymous from a state-level adversary indefinitely but throwing your hands up and dismissing it as impossible is also a fallacy. Details are sporadic for easy reasons but quite a few whistle-blowers and other controversial figures have managed to keep themselves anonymous and disappear in a controlled-exit without any obvious retribution. Probably the best case outcome.

Legitimate question: what benefits are there to be anonymous to the general public? Wouldn’t most people be happy to take credit for their code?

If your code is perfectly legit, but lies in shady or non-generally-ethical sectors, like porn, gambling, weapons, one might want to hide their identity to the general public.

If you're a retired gentleman mostly coding for your own and your friend's use, and you've seen the trashfire that social media and the modern internet has become compared to the time before The Eternal September - back when you originally started using the internet... It's very very easy to see why you might desire anonymity before widely releasing simple utility tools.

to: developer@gmail.example.org

from: billy-joe@3rd-grade.nowheresville-elementary-schoole.edu.us

subject: FinderFix

I demand you integrate FinderFix with TikTok and Discord IMMEDIATELY - or I'll come over there and rape your family and pets!!!llII!!1!!

Lots of people are horrible and when you are well-known, this translates into legions of horrible people who know who you are and see you as something to maybe bother. Anonymity should be the first choice for public-facing work, if you enjoy your life as it is and are not interested in hiring security.

Enough with the drama. The vast majority of people with public facing work (whether code, books, etc.) use their real names and don't need to hire security. That's not to say stuff doesn't sometimes happen but it's not the norm.

Something with significant risk that is reasonably easy to mitigate should just be mitigated. Nobody loses with that, except maybe if they view that as drama.

There can also be significant disadvantages to totally disconnecting anything you do online from your professional identity. If the two things really don't have anything to do with each other--say you're a developer and write risque fiction on the side--it may make sense to use a pen name and that's not uncommon.

However, many professionals in the tech space and elsewhere have online work that is intimately connected with their day job--and may even be part of their day job. In that case, anonymity is not really an option.

You could take credit in the interview, field questions, and if there is still some doubt, log in to whatever it is you'd like to show. In other words, show privately, not publicly.

For me at least, it's pretty much nothing to do with interviews. Articles, conference presentations, just being "me" at events, social media, etc. is all part of the package.

Sounds like work is a major part of your identity. Personally prefer to keep them separate-ish.

It's more that I'm paid to have a fairly public role which pretty much has to be under my own name.

When you are part of a company or some entity, the risk is smaller since the credit goes to your company rather than yourself. When you work for yourself that's not the case.

Daniel Stenberg, developer of very popular opensource library/utility curl, once received a threatening email:

https://daniel.haxx.se/blog/2021/02/19/i-will-slaughter-you/

SQLite developers were receiving phone calls in the middle of the night, so decided to change temporary files prefix:

https://github.com/mackyle/sqlite/blob/3cf493d/src/os.h#L52-...

In both cases, their libraries were used in some other software, which upset users.

A friend of mine programs free / open source software and one of his libraries was used in a crypto scam project.

Suddenly he got accusations and threats from a person from a completely different country, because that person thought he was the brain behind the crypto scam where they lost some money. He had to take it to the police to get that person stop threatening and harass him.

People are nuts. I ran a small, simple MUD (a text-based MORPG). Nothing fancy, nothing overly popular, a nice little niche group of people. Seemingly. I ran it anonymously, but there will always be somebody you know who slips something about you that will break that anonymity. The day that happened to me, a couple of disgruntled players found my Facebook account and sent messages to me and my immediate family threatening to kill us in various colorful ways.

My information is pretty locked down, but my family was less so. They started to get threatening phone calls. Very unpleasant stuff.

Anyway, that's when I learned that credit isn't worth the hassle of harassment.

There's an interesting piece about being a mini/micro celebrity by Tim Ferriss. Am too lazy to look it up, but the gist is that for every ~thousand people, several are bat-shit insane and looking for something to obsess over.

So if multiple thousand folks know you exist, prepare for some stalking.

A friend made an app based on some calculation method he found in a youtube channel. Shame on him for not crediting the author, but months later this influencer created an app of his method and wrote a menacing review for my friend's app, backed with thousands of upvotes. He found other apps implementing the method received similar threats as top reviews.

You can also use someone else's ID and metadata, signing up to banking and Apple while remote desktopping in to a compromised windows computer near their postal code.

Compromised windows computers are listed by postal code on some market places.

This will pass practically all flagging on the transactional side.

(You can still use a company you formed as well, and DUNS number, for the public listing on the app store)

Not really that complicated.

Reply on news.ycombinator.com