At baseshift.com we're building a solution to this. We generate isolated clones of production databases and expose operational control of clones via MCP (start/stop/reset). This provides agent autonomy for development and analysis workloads without risking production.
We support PG, MySQL, MariaDB, and MongoDB (more coming). We're currently in private beta but we're happy to onboard fellow HNers!
> Mistake #1 : switching to an even more closed computing environment, where user has strictly no control
I've been with Google Nexus and Pixels for many years, roughly starting with the Nexus One. Ironically, I switched from an iphone 3GS at the time that I owned for a few months.
After many years of being on windows, then linux, then Mac, then back to linux, now back to Mac with linux on ssh, my conclusion is that user control doesn't necessarily mean a better user experience. A closed computing environment allows for consistency and sturdiness. When you start looking at your phone as a device, rather than as a computer, it becomes obvious.
> Mistake #2 : running on a tech. stack you do not control: closed-source, walled-garden
I don't control android in any way. I could read its source code if I really, really wanted to but why would I? I want a product. A device. Would you read the source code of your washing machine? Dish washer? At some point you want to live your life and stop reading anything and everything as if you actually have enough time to tinker with all of it.
> Mistake #3 : using a wallet instead of your own private cold storage to hold any kind of significant amounts of money
Meh. 'Significant amounts of money' is subjective. Some would say the amount of money I lost would be a life changer, some would shrug it off as a yearly bonus on the lower end of the scale. Fact is, I had my bitcoin on some version of a pixel for roughly 7 years and never had a problem.
> Mistake #4 : trusting that Apple is making huge efforts to secure their environment.
They made a huge effort to secure their hardware; its some of the best in the world. The thing is they put a ton of focus on hardware security but hardly enough on software / service stuff. In this case, the app store search was compromised by some bots leaving reviews.
Your general theme seems to rely on having access to open source on all levels leads to more security.
This is patently false. For example, the vast majority of smartphones use baseband processors that are not just closed source with closed source drivers, but the ICs themselves are tightly guarded secrets by their manufacturer (probably Qualcomm). There are probably a dozen or so chips in every smartphone running all sorts of firmware you have no access to. Same goes for computers.
In fact, I would argue that Apple's model might be the most secure, because they do SoC, which requires they know far more about and have much more control over the inner workings of every sub component.
When I installed it, it was the #1 organic search result. Other commenters report seeing the same app as #2 organic search result.
Just because an account is newly created does not make their first post FUD. Their story is precisely what happened to me, although for a slightly smaller amount of money.
Others have reproduced it, see others comments. Perhaps for them the ranking changed slightly but the fact is a scam app is ranked as high as serious companies.
Gmail / Google are open, the App Store is closed and supposedly vetted and guarded. Apple sells to its customers security, quality, and trust. It’s one of the reasons one pays 2x for an iPhone. All of these promises of a better ecosystem have been broken through this experience.
One of the supposed advantages of the closed App Store is to absolve (to some extent) the user of having to do said due diligence.
Also, it’s not like it’s impossible. Google are doing it well - show me a scam app that’s in the top 10 of the play store for bitcoin, banking, finance etc. Hardly any to be found.
If only there was a website I could use to contact other like minded people where they could vote on posts they like and discuss them in comment sections.
How am I supposed to prove I didn't seek the app out? What level of proof do you expect? Do you expect me to create a brand new apple account, replace the one in my phone (which might require wiping it?), and then search again, just to satisfy your default assumption that my claim is false?
When I first installed the app it was the first search result. I can't go back in time and prove it because I'm not paranoid and I don't screenshot the result of every search in every app store and search engine.
I reported it. I'm not trying to rally a mob against Apple. The bitcoin is gone.
I'm trying to prevent others from suffering the same fate as me. Based on what I'm reading in the comments here some other people in the world do trust apple app store search results, and I believe they've gained something from my post.
> (1) How much more valuable do you think it is to the scam app developer to appear at the top of the search results than for a legitimate wallet developer?
Well, the scammer got CAD $150k out of the reddit guy I linked to and I lost a slightly smaller amount - and we're just two out of who knows how many thousands of app store users that installed this app. I'd say people trust the top 5-10 results quite a lot.
> (2) Do you think a legitimate wallet app will engage in the same black-hat SEO tactics a scam app developer will?
I think all the black-hat SEO in the world should not be able to surpass the obvious value disparity compared to legit apps with hundreds of thousands of installs and hundreds of reviews.
> You can't escape personal due diligence and "it was top ranked!" has never been that.
On one hand that's a fair point and I should've known better. OTOH I think it is legit to trust top app store search results to return quality apps, especially if there is a massive disparity between their quality. The scam app has obvious repetitive spam reviews. The developer's website is terrible and the submit button doesn't even work. This is basic quality control on apple's part. If every single app store user needs to manually vet every single app they install to the proper extent there would be a fraction of a fraction of the installs and respectively, a fraction of a fraction of the revenue.
Consider the extent of lawsuits between apple and companies with app store apps - does it not strike you that apple protects that revenue stream? Wouldn't it make sense to give app store users a sense of trust in the top search results?
Here is a screen recording including this hacker news post + your comment & and a switch to the app store with the search phrase. The first result is the scam app. I scrolled down so you can see where serious apps are in the list of results.
https://streamable.com/q2mulu
In hindsight, this is quite obvious. Coming from years of using Google Pixels I just got used to trusting the search results. I've never hit a fraudulent app when searching in the Play Store. I trusted apple that at least the top 5 results would be legit.
EDIT: added the word 'top' at the end
Honestly, I got lazy, and that's on me. I was using the standard bitcoin wallet app on android. It did seem weird I can't restore the wallet I backed up in the android app, but the android app github doesn't point to an app store app, so I figured there just isn't and the android app's backup format is something detached.
Then I figured a legit apple app could generate a wallet and I could transfer the bitcoin between them. Which is what I did. The apple app indeed received it and promptly sent it off somewhere else. What's even crazier is that the apple app shows this info! You'd expect the scammer to hide the scam but I suppose it just made it easier to pass the app store inspection.
You're right, I shouldn't trust a random app. Also, it's pretty much my first serious foray into Apple land. I trusted Apple's search results. There are multiple apps, far more mature and backed by serious developers, that would also match the phrase "Bitcoin Wallet".
The question is why is the scam app the #1 organic search result? For a new app with such scammy reviews and questionable metadata I would expect it to be #30 in the list. For context, the app store reports the scam app as #85 in all finance apps.
Nice work! If I'm not mistaken, the root requires morphological disambiguation, which may change depending on the context/phrase in which the word is observed.
This is an active area of research in Morphologically Rich Languages (MRLs), since this problem also appears in other semitic languages like Hebrew, as well as Turkish. There's a nice body of work to learn from, both with and without neural nets. For example, this paper from 2017 (http://aclweb.org/anthology/D17-1073) uses a neural model for morphological disambiguation. You can see a nice comparison of tools in the recent 2018 Universal Dependencies Shared Task results: http://universaldependencies.org/conll18/results-lemmas.html (look for ar_padt).
If you're looking for training data, the Arabic treebanks in http://universaldependencies.org could help. I think some of them contain surface tokens with lemmas. I'm quite sure they also have roots.
At baseshift.com we're building a solution to this. We generate isolated clones of production databases and expose operational control of clones via MCP (start/stop/reset). This provides agent autonomy for development and analysis workloads without risking production.
We support PG, MySQL, MariaDB, and MongoDB (more coming). We're currently in private beta but we're happy to onboard fellow HNers!