4

Ask HN: Is it still conceivable to remain an anonymous developer nowadays?

 1 year ago
source link: https://news.ycombinator.com/item?id=31763451
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.

Ask HN: Is it still conceivable to remain an anonymous developer nowadays?

Ask HN: Is it still conceivable to remain an anonymous developer nowadays?
119 points by synappser 4 hours ago | hide | past | favorite | 85 comments
HN has been my morning coffee favourite read for years now but it's my very first post. I'm an old man, so please bare with me.

I am a seasoned systems architect and developer, now retired. While I was tempted in the first few weeks of my retirement to just turn the page and let it go, I remembered how much I used to enjoy writing small utilities for my own daily workflows. A year ago, I asked my fellow forum members (a Mac-dedicated one) if they would like to beta test some of my applications (and oh, they did). I got high quality feedback I would not have gotten elsewhere. I kept striving to answer their feature requests and today many of my first beta testers are insisting that my applications have outgrown the private beta.

I was caught completely off guard by FinderFix (https://synappser.github.io/apps/finderfix/), the first application I'm opening to public beta, making the top row on Reddit a couple of weeks ago. This sudden limelight is both an opportunity and a challenge.

I am not complaining. Any publicity is good publicity and I got this kind of genuine enthusiastic feedback: "OH MY GOD! Bro you’re a god sent. Thanks man I love this app. Also that Cmd + X for cut/paste. Oof so good!".

I however cherish anonymity and I laud the Internet for allowing me to enforce it. I am thus publishing my software under a pseudonym (a pen name, if you prefer) with a free Apple Developer Certificate. How long will I be able, with Apple's current Gatekeeper policy, to preserve my anonymity if I were to turn this hobby into a real business, albeit a small one?

For more context, please refer to a couple posts of mine (a manifesto of my core ethos):

http://synappser.github.io/blog/

I guess this is a tough question to answer, unless you're an Apple insider, but I'd really appreciate any guidance you could give me.

Thank you

If you prefer to use a pseudonym, why not just register an LLC? There are services out there that will register your company and be your registered agent in states that do not require your name ever made public (Wyoming for example). These services also provide a mailbox that would work for anything you need.

You can then get a business checking account (Mercury works well) with your newly registered business.

You can then create a business account on Apple and Google (and anywhere else).

All of the public facing information will be your company name. If you want more details or help, just ask here.

s.gif
In many states if you want anonymity you ALSO have to pay a lawyer to be the principal agent in addition to the registered agent.

Basically the lawyer is the CEO/“Owner” but since you pay them to do exactly as you say, they delegate everything back to you and just sign forms occasionally that you put in front of them.

s.gif
> If you prefer to use a pseudonym, why not just register an LLC? There are services out there that will register your company and be your registered agent in states that do not require your name ever made public (Wyoming for example).

Congress passed a bill with rider a that now makes the creation of anonymous LLCs difficult.

https://thehill.com/policy/finance/467017-house-passes-bill-...

https://maloney.house.gov/media-center/in-the-news/congress-...

https://corpgov.law.harvard.edu/2021/02/04/the-end-of-the-an...

s.gif
That looks like it requires disclosure of the owners to the US government, not on the public record. If I'm misunderstanding the documents you linked, please let me know.
s.gif
Anon LLC is US specific. Not available in other countries.
s.gif
Not limited by LLC, registering a company anywhere can ensure it to an extent
s.gif
At least where I am from (Serbia), registry of all LLCs is publicly available with personal data on all the "members" (whole- or part-owners). The best you can get is by having a foreign LLC where there is no name requirement register an LLC here.
s.gif
No, company board and owners are public and readily available data in virtually all countries, US being an exception to the rule.
s.gif
The seychelles is also a good choice for a completely anonymous company (note that banking may be a bigger issue to solve)
s.gif
In Switzerland that would require you to deposit at least 25k or you can not use a fantasy name.
s.gif
Well there goes my "Middle Earth Orc Roundup Pest Control" business name...
s.gif
...or strike a deal with existing LLC. This is what my company does. We sign contracts and you re hidden behind offshore corporate veil.
So.. I'd suggest a project of mine. Full disclosure, you require more than one burner device. Ultimately you'll want a VPN you can trust. Also - it depends how much your anonymity is worth to you, and your relative cost. Similarly - to whom do you want to be anonymous?

I wanted to create a fully digital individual. My goal was to go from end to end. I bought (in cash) a prepaid credit card. I used said prepaid credit card to sign up to the VPN, paying for 3 years - under the assumption the card is burned. With said VPN I created a paid for email account with a trusted service (not gmail or office). I used said email to sign up with a VOIP provider, to receive a telephone number that could receive SMSes.

Then, I signed up for a twitter, and a domain. Use the above to set up a corporation with nominee shareholders in the jurisdiction of your choice, same with bank account. Congratulations - you can now buy your certificate.

Now, using the funds of the corporation do everything above again - such that you're able to tie the corporation's CC to the outcomes.

There's a lot more - but this is a reasonable start.

This may be illegal where you live. At the very least, depending on how you use the above there are tax implications.

s.gif
Setting up a corporation in most jurisdictions would require a valid ID proof, no?
s.gif
On top of that, at least in EU, the regulation has gone further, and major shareholders of private companies now need to be identified publicly.

I'll caveat this by having only experience of this from my own European country of residence, which had to put this regulation in place due to EEA requirements.

s.gif
Further, Apple requires registering your certificate under your full name if you are a “singly owned company” at least in the EU
s.gif
not related but is "prepaid credit card" a debit card? Also why is the card with the debt is called "credit" and the one with actual money is called "debit"? Driven me crazy.
s.gif
Possibly because debit is debt from the bank's POV? They owe you that amount of money. I'm not sure though.
Does "turning into a real business" mean "making money"? If so, how do you expect to anonymously receive funds from the app store (or any other payment service provider).

The only way you could remain (externally) anonymous and comply with all the AML/KYC and other legal, corporate and service requirements (including taxation, etc) would be to have a company with a nominee director.

s.gif
You don't need a nominee director you just need the better jurisdiction. Several US states do not list directors or the names of anyone involved with the company, publicly. Some states don't have that information at all.
s.gif
How does that work for AML? Not having to disclose UBOs it seems like you wouldnt be able to even open a bank account.

EDIT: seems you still have to disclose UBOs for IRS, banks, subpoenas, etc with these "anonymous LLCs" - unless you also use a nominee

s.gif
It depends on what level of anonymity you want.

There are about 3 or 4 levels

1) anonymity to the public and search engines

2) anonymity to the app store platform and most of the private sector

3) anonymity to the state, banking and legal

4) anonymity to intelligence community

the business entity as I described satisfies 1) and 2).

its not really clear to me that a nominee director legally satisfies 3), AML has always required decision makers and ultimate beneficial owners (UBO) to be the ones that financial institutions have records of, and the IRS requires that the UBO report it on their tax. If your criteria for 3) does not require strict adherence to legal, then there are plenty of other things you can do as well.

and if you aren't needing to list on "App stores" or use financial institutions, then 3) isn't necessary at all

s.gif
Not sure I’d consider anonymous corporate entities “better”…
s.gif
You're the only one that read that.

The jurisdiction is better because it has more features, and those features are applicable to a broader audience. Additional features = better, less features = worse. You don't have to chose any specific feature of the jurisdiction yourself, like forming an anonymous corporate entity. You can [typically] form one that gives out all of your information in those places too.

It is, yes. You can simply self-sign and then tell users how to bypass the security warning, which is what you're already doing so what's the problem?

It's a common misconception that macOS forces all software to be signed by Apple. It doesn't. ARM Macs require all software to be signed, but crucially, any signature is OK at the kernel level. It's only at the first-run-from-finder level that Gatekeeper gets involved. This has been true from the start and I've seen over the years scattered comments from Apple developers that they view the Mac as a true general purpose computing device, and thus have no plans to change this. The ramped up signing requirements on ARM are more to do with simplifying the core OS by ensuring all code has an identity than stopping non-Apple approved software.

If you think users should trust you despite your anonymity then you can simply point them to Apple's official documentation on how to work around Gatekeeper:

https://support.apple.com/guide/mac-help/open-a-mac-app-from...

The process is straightforward if you know about it:

1. Download a self-signed or unsigned app.

2. Locate it in the finder.

3. Hold down the control key and right click it, then choose open.

4. Click open when the security alert appears.

Most people think you have to use the command line to open non-signed apps on macOS but it's not actually the case.

To self-sign an application you can generate certs using the Certificate Assistant in the Keychain Access app, or use OpenSSL from the command line. Then sign as normal. The fact that the cert doesn't come from Apple means Gatekeeper will ignore it, but, allows the app to run on ARM and ensures the OS has a stable identity it can use for assigning permissions across upgrades.

I’d say it depends what you mean by anonymous. If you mean you don’t want every mention of your software to be “John Smith’s app” then just start a company. That would make it “Company X’s app.” No one would care much about who owns Company X or which of their developers wrote the code. You wouldn’t be completely anonymous, as you’re still the owner of Company X, but users referencing your apps wouldn’t know about or mention you by name. They could, but they won’t.
Yes, it is absolutely conceivable to be anon developer, except for officially publishing in the Apple/Google/MS walled gardens.

Then if you would want to accept donations or payments, anonymity is only possible with cryptocurrencies and cash-by-mail. The easiest one (anonymity wise) is Monero and the most popular one is Bitcoin.

s.gif
> anonymity is only possible with cryptocurrencies and cash-by-mail. The easiest one (anonymity wise) is Monero and the most popular one is Bitcoin.

Can we just stop with the "Bitcoin is anonymous" bullshit here?

Anybody here is smart enough to know better, so it just earmarks you as another fucking crypto-shill.

s.gif
I think you have some kind of point but it's lost by being rude
s.gif
Yeah, fair criticism. But I'm just so over the insane mass hallucination these planet burning pyramid scheme grifters keep wanting to convince everybody is real. There are no clothes, there isn't even a damned emperor. They all deserver to be called out and ridiculed at every sighting. And yeah, I'm rude while doing that.
s.gif
> Can we just stop with the "Bitcoin is anonymous" bullshit here?

Care to point to Satoshi’s real identity since anonymity in Bitcoin is bullshit?

s.gif
They didn't use any modern services - we mainly know of an old, idle account. If they were actually active today and we knew which transactions to look at, there would be some trail to follow. So, that isn't a counterexample you're after.
s.gif
Bitcoin is anonymous (ie your key is not linked to your identity) but not private (all your transactions can be seen)
s.gif
It's somewhere between (not including) anonymous and multi-pseudonymous.

Each address is a random pseudonym. A wallet is a collection of pseudonyms but it's secret that they belong together. Except network analysis can infer that some of them do. Pseudonyms are persistent, can't "change them", only transfer coins out of the pseudonym to a different one, i.e. log a transaction.

s.gif
Bitcoin is anonymous in the sense that you don't necessarily need to link your wallet to your real name, it's just not the best choice for privacy since transaction details are public. Besides, mixing services exist.
s.gif
> Besides, mixing services exist.

And don't work. They were revealed to be useless way back when the Magic The Gathering Online Exchange crypto grifters pulled the first high profile scam, and they got hounded through all the "mixers" anyway. Chainalysis has been able to see straight through "crypto mixers" for almost a decade. (Yeah, there are probably way that right now you can't track bitcoin through other crypto currencies and back into bitcoin, maybe... But we are now a long long way from "good advice to an old guy who want to sell macOS utilities anonymously")

s.gif
Mixers on programmable blockchains like TornadoCash do seem to provide strong anonymity when used correctly. If you have evidence suggesting its cryptography can easily be cracked, feel free to point to that.
s.gif
If HN was anonymous, then we couldn't see that two posts were made by the same account or not. But HN has pseudonyms with (unlimited?) pseudonyms per person, and Bitcoin is a bit like that, except that it's commonplace to have many pseudonyms (wallet).
s.gif
HN is also similar to a blockchain in another regard - You can't really delete your account and its content, which really annoys me to be honest. I like to purge online accounts from time to time, but that's not possible with HN.
s.gif
No, we can't. Bitcoin *is* anonymous against average Joe which is what the OP needs here.

Pretty irrelevant here but for your fucking information, with significant expert effort, Bitcoin *can* be also anonymous against big actors.

s.gif
I'm being tongue in cheek here, but to support your point a little, if Bitcoin was not generally anonymous in nature, we'd know who Satoshi is.. no? :-)
If writers can write under a pseudonym why can't coders?
If your app stands enough chance of making enough to cover the costs, you could probably hide your identity behind a company identity.
As Banksy is said to have said : "My work speaks for itself, I'm a Painter not a talker."
I've read your post on anonymity, considering that there are successful developers from Russia or some other fake-democracy countries for example, I don't really see why you should have any problems. And which kind of problems? Less revenues?

Opening a small company could probably be ok to preserve some sort of basic anonymity (meaning, it takes a variable but not negligible amount of effort to understand who the owner is).

You can easily be an anonymous open source developer at least.
As someone who grew up when they printed your address when your photo and name appeared in the paper, and when everyone had their name, telephone, and address in the telephone book -- this seems bizarre. Are you never planning to appear at a trade show and promote your product? Hiding who you are seems cowardly, or maybe you have nefarious motives with your program. Transparency and honesty are the best policies in business and personally.
s.gif
  - One might be working on multiple, own, competing products.
  - One might want to have a normal fulltime job where managers and HR aren't worried about their little side project.
  - One might not want people who google them to see they have a project going.
  - ...
Privacy doesn't exclude transparency and honesty.
s.gif
> Hiding who you are seems cowardly, or maybe you have nefarious motives with your program. Transparency and honesty are the best policies in business and personally.

I don't understand your absolutist viewpoint here. Can you really not imagine a non-nefarious situation in which someone might not want to associate themself publicly with their work?

s.gif
Yeah, that comment they don't like? Crazy people will false report some incident to get a SWAT team at your address. Other crazy people will call your employment and start a campaign of attacks to get you fired. Plenty of examples of this out there. Some people, eg youtubers, get swatted multiple times. Police turn up multiple times. These aren't isolated cases.
s.gif
Here is a non-nefarious situation:

Let's say your side project is for a political party. Then, two years later, you apply for a job and the hiring manager is from a different political party, and has strong views on the matter. You don't get the interview.

s.gif
Wow. Just wow. Since when someone choosing to be anonymous equals “cowardly” or “nefarious”?
s.gif
That might have been ok in your small town or small city of people who didn't read the paper. An internet phone book might exist in some fashion, but I'd rather not have stalkers able to find their victims so easily for example. I agree transparency and 'honesty' are good policies in business in general, but having a name, number, and address exposed to the public seems like a bit much, no?
s.gif
>"Are you never planning to appear at a trade show and promote your product? Hiding who you are seems cowardly, or maybe you have nefarious motives with your program."

Just fucking wow. There are whole bunch of totally valid reasons why one would want to be anonymous. It is ok to refuse to deal with such person / entity but to blame them in such terms is highly insulting and totally incompetent.

s.gif
Those newspapers and telephone books were not indexed and trivially searchable by anyone with a computer in any part of the world. It's like asking why people don't want ubiquitous facial recognition technology, when people have openly displayed their faces for other people to memorize for millenia.
s.gif
Are you never planning to appear at a trade show and promote your product?
Wait... there are "free Apple Developer Certificates"?
s.gif
From the downloads page [0], I presume he means he's distributed the applications as unsigned applications [1]. So "free developer certificates" in the same sense that self-signed SSL certificates are free.

[0] https://synappser.github.io/downloads/ [1] https://support.apple.com/en-gb/guide/mac-help/mh40616/mac

s.gif
I'm also curious what this is. Apple wouldn't give free certificates even for open source apps! $99 to give their users free apps.
s.gif
The free developer accounts don't get your apps into the iOS app store. That requires a paid up $99 developer account.

I think (but am not sure) that you can use them (for now) to sign a macOS app that you distribute from your own download somewhere, and Mac uses can download your apps and click through the "Yes, I trust apps signed with that Satoshi Nakamoto certificate" dialog and install them.

There are three levels of anonymity: anonymity to the general public, to Apple, and to a state-level actor.

Anonymity to the general public is very easy, incorporate a company behind some of the shell corporation mumbo jumbo that any corporate lawyer can prep for you, it will cost $ but it will be easy.

Anonymity from Apple could probably be pulled off by incorporating in a country with fairly weak transparency and having the company owned by an offshore trust.

Anonymity from a state level actor would be pretty hard. You'd have to have a shell corp in a foreign country owned by a shell corp in another foreign country and even that might not be enough.

s.gif
> Anonymity from a state level actor would be pretty hard.

I'd say "totally impractical/impossible for regular individuals".

As James Mickens so eloquently put it:

If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them. -- https://www.usenix.org/system/files/1401_08-12_mickens.pdf

Some of us enjoy cosplaying extreme privacy nuts, or engaging in recreational paranoia. But don't for a minute kid yourself into believing you stand a chance against the NSA (or your jurisdiction's equivalent).

s.gif
As funny as this is, you (not you, the person in the example) broke the anonimity when you chose to be an antagonist yourself (and drawing attention in the process).

The best way to be anonymous to those agencies is to be irrelevant to them

s.gif
> The best way to be anonymous to those agencies is to be irrelevant to them

And to make sure that everybody who has the same name as you also stays irrelevant to them... And that nobody ever uses your name as an alias and does anything "relevant" to them.

"“A senior administration official who spoke on condition he not be identified said Kennedy was stopped because the name ‘T. Kennedy’ has been used as an alias by someone on the list of terrorist suspects.” A number of media outlets carried the same version of the story.

Of course, “Ted” Kennedy’s real first name is Edward, and would appear as such on any ticket or identification documents, so why the senator’s name should set off alarms, even if a ‘T. Kennedy’ appeared on a “no fly” list, is a mystery that has not been explained.

The New York Times reports a different story: “The alias used by the suspected terrorist on the watch list was Edward Kennedy, said David Smith, a spokesman for the senator, who uses his full name, with a middle initial, of Edward M. Kennedy.”"

https://www.wsws.org/en/articles/2004/08/kenn-a21.html

s.gif
Then you just become training data for their threat algo.
s.gif
Legitimate question: what benefits are there to be anonymous to the general public? Wouldn’t most people be happy to take credit for their code?
s.gif
Daniel Stenberg, developer of very popular opensource library/utility curl, once received a threatening email:

https://daniel.haxx.se/blog/2021/02/19/i-will-slaughter-you/

SQLite developers were receiving phone calls in the middle of the night, so decided to change temporary files prefix:

https://github.com/mackyle/sqlite/blob/3cf493d/src/os.h#L52-...

In both cases, their libraries were used in some other software, which upset users.

s.gif
People are nuts. I ran a small, simple MUD (a text-based MORPG). Nothing fancy, nothing overly popular, a nice little niche group of people. Seemingly. I ran it anonymously, but there will always be somebody you know who slips something about you that will break that anonymity. The day that happened to me, a couple of disgruntled players found my Facebook account and sent messages to me and my immediate family threatening to kill us in various colorful ways.

My information is pretty locked down, but my family was less so. They started to get threatening phone calls. Very unpleasant stuff.

Anyway, that's when I learned that credit isn't worth the hassle of harassment.

s.gif
If you're a retired gentleman mostly coding for your own and your friend's use, and you've seen the trashfire that social media and the modern internet has become compared to the time before The Eternal September - back when you originally started using the internet... It's very very easy to see why you might desire anonymity before widely releasing simple utility tools.

to: [email protected]

from: [email protected]

subject: FinderFix

I demand you integrate FinderFix with TikTok and Discord IMMEDIATELY - or I'll come over there and rape your family and pets!!!llII!!1!!

s.gif
Lots of people are horrible and when you are well-known, this translates into legions of horrible people who know who you are and see you as something to maybe bother. Anonymity should be the first choice for public-facing work, if you enjoy your life as it is and are not interested in hiring security.
s.gif
A friend of mine programs free / open source software and one of his libraries was used in a crypto scam project.

Suddenly he got accusations and threats from a person from a completely different country, because that person thought he was the brain behind the crypto scam where they lost some money. He had to take it to the police to get that person stop threatening and harass him.

s.gif
If your code is perfectly legit, but lies in shady or non-generally-ethical sectors, like porn, gambling, weapons, one might want to hide their identity to the general public.
s.gif
You can also use someone else's ID and metadata, signing up to banking and Apple while remote desktopping in to a compromised windows computer near their postal code.

Compromised windows computers are listed by postal code on some market places.

This will pass practically all flagging on the transactional side.

(You can still use a company you formed as well, and DUNS number, for the public listing on the app store)

Not really that complicated.

This may have been a mistake. Apple will have a reason to revoke your certificate.
s.gif
Satoshi does/did not have an Apple Developer account, and never needed his code signed by Apple to run on it's target platform.
s.gif
Even if it was needed, they would not have had a hard time finding a trustworthy volunteer.
s.gif
Like Craig Wright?

(Oh, you said "trustworthy". My bad...)

s.gif
Who hasn't been heard of for 12 years.

12 years ago doesn't really qualify as "nowadays".

s.gif
That's hardly helpful for someone who develops Mac apps.
s.gif
Great plan!

A guy who writes utilities to make his Mac work exactly the way he wants it to, should avoid Apple.

Brilliant!

:facepalm:

Hey! A couple days ago I launched anonfriendly [1]. It's a site that shows jobs where you can work pseudonymously. You might find it useful.

I launched on HN yesterday and it went #1. You might find that discussion [2] interesting as people were discussing the feasibility of working pseudonymously.

[1] https://anonfriendly.com

[2] https://news.ycombinator.com/item?id=31755025

s.gif
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search:

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK