tyrion

Some years ago I thought it would be interesting to develop a tool to make a python script automatically install its own dependencies (like uvx in the article), but without requiring any other external tool, except python itself, to be installed.

The downside is that there are a bunch of seemingly weird lines you have to paste at the begging of the script :D

If anyone is curios it's on pypi (pysolate).

Helping improve the spec and all is great, but being 100% honest, as a user, I would rather have a type checker I can bend to my needs. As you said, some code patterns in a dynamic language like Python are difficult, or even impossible, to type-check without custom code. Type checkers are becoming more popular than ever, and this implicitly means that these code patterns are are going to be discouraged. On one hand, I believe the dynamism of Python is core to the language. On the other, I would never want to write any collaborative piece of software without a type checker anymore. Therefore, to get the benefits of a type checker, I am occasionally forced to write worse code just to please it.

Considering how fast uv and ruff took off, I am sure you are aware of the impact your project could have. I understand that supporting plugins is hard. However, if you are considering adding support for some popular libraries, IMHO, it would be really beneficial for the community if you could evaluate the feasibility of implementing things in a somewhat generic way, which could be then maybe leveraged by third-party authors.

In any case, thanks for all the amazing work.

More than the limit, what seems absurd to me is that businesses seem to be allowed to refuse cash as a form of payment. I am reading the translated version of the article, and it says:

> A seller can decide not to accept cash above a certain amount. Or not accepting cash at all.

Why would not accepting cash at all be allowed? What is the other alternative? Mastercard, visa etc? If for example, a super market chain stops accepting cash and starts accepting only Visa, and for whatever reason I do not have a visa credit card, or worse I am banned by Visa,then I cannot buy groceries anymore? Also, I am not exactly sure everybody has access to a credit card. Maybe I am missing something here, but this seems a bit stupid/crazy to me.

> there's never place to discuss the elephant in the room, that the whole game is rigged. The backdoor massive, right in front of us, and nobody's doing anything to fix it

I am tempted to take the bait, and ask you what would be this massive backdoor, which nobody has time to discuss. If I am guessing right, you are still referring to "no default E2EE". In that regard, I would encourage you to consider that not everybody has the same security requirements, and many people are fine trusting Telegram and with the security it provides.

Personally, I cannot wait for Matrix to become more widely adopted, and to see the UI/UX of their clients to become remotely comparable with the one of Telegram.

Anyway, since it doesn't seem our discussion is going anywhere, maybe it's time to stop.

Thank you for the chat, I liked how we managed to stay polite even though we completely disagree :)

> Given that you wrote your article before Signal had even desktop clients, I don't think it's even remotely up to date to vouch for any kind of fruitful discussion

Yeah, I intentionally did not want to compare it to Signal (because the article was already too long that way).

> But it is living proof Telegram authors don't have the know-how on how to implement secure protocols

I strongly disagree with this claim. Can you back your claim with some evidence? The vulnerabilities shown here are mostly purely theoretical, I don't see how this goes to show that Telegram engineers are incompetent.

What I see is that Telegram engineers chose to ignore what the Computer Security academic community regards as best practices, and this has led to an infinite amount of criticism (including by the authors of the vulnerabilities we are discussing). Despite this, in ~8 years since launch, the only serious vulnerability which I am aware of, has been discovered and immediately patched right after Telegram was first launched.

I did not claim Telegram to be secure. It has nothing to do with what I said. Moreover, saying that something "is secure" does not make too much sense, without specifying secure against what.

Assuming you are in good faith, I will try to explain better: The title of the article states there are vulnerabilities in the encryption protocol.

According to RFC 4949 a vulnerability is:

> A flaw or weakness in a system's design, implementation, or operation and management that could be exploited to violate the system's security policy.

Clearly stating that there are vulnerabilities in Telegram's encryption protocol raises concerns, a lot of confirmation bias among Telegram haters, and leaves people who only read the titles with the feeling that Telegram encryption is vulnerable to attacks.

However, among the 4 flaws reported by the researchers, 3 are not exploitable ("This attack is mostly of theoretical interest", "Luckily, it is almost impossible to carry out in practice", "Luckily, this attack is also quite difficult to carry out, as it requires sending billions of messages to a Telegram server within minutes") and the other one is about reordering encrypted messages.

Therefore, a more fair headline which would undoubtedly raise less interest could be "Researchers found a way to change the order of your Telegram messages, even if they still cannot read them", or "Researchers found some purely theoretical or almost impossible to carry out vulnerabilities in Telegram's encryption protocol".

And don't even get me started about the fact that literally everybody, including expert security researchers, feel entitled to bash Telegram for having rolled their own crypto at every chance they get.

It may seem an advantage to use the latest cutting edge features of a single platform, instead of using well established standards which are compatible with every browser. Sure, you are going to leave out some small minority of users, but you gain access to many new features.

However, you are helping push the web become an increasingly centralized place, controlled by just a few entities, with interests which are very different from yours.

You may think that there is no harm in doing so. Most people use Chrome anyway. And what difference can one more web app make?

However, it is exactly this laziness by skilled developers, who are the only that understand the problem, which brought us to the current situation. There is no way to fix this problem, if the people that understand it do not take a stand.

Next time that your manager asks you if you can have that sweet feature, instead of saying "sure, we just need to drop support for Firefox", please consider trying to explain what are the consequences in the long term.

I know this isn't easy for many people, which do not feel comfortable questioning orders or plans. However, this is our responsibility. Nobody else is going to care, if we do not care.

You praise HN because we can have "meaningful" discussions, yet in the next sentence you ask people not to upvote an article just because the author is not great at communicating his thoughts, and makes some grammar mistakes, completely ignoring the "meaning" of the article.

You feel the need to "urge the people" not to upvote it. However, wouldn't it be more "meaningful" to explain why you do (or do not) agree with what is said, instead of just complaining about grammar?

I personally found the article interesting, even though it's poorly written. Instead of ordering others around, what about urging yourself to refrain from commenting unless you have something meaningful to add to the discussion ;)