I found a 1-click exploit in South Korea's biggest mobile chat app

The reason American apps penetrate the world usually is because America is a superpower that has almost colonised the web.

I live in the USA and EU, and the reason that I prefer a Samsung display in almost all cases is because it is the best product. Korea has not colonized us, but the product is often superior, so that is why I buy it.

Why is it that Korean software cannot do the same? I find it very interesting, and I mean to ask this in a very neutral/curious way.

Nothing prevented Switzerland from colonizing the web first. If Europe was a VC friendly environment it would be ahead in everything.

The reason American apps penetrate the world usually is because America is a superpower that has almost colonised the web.

Love how the word "colonise" is thrown out without any thought.

Please tell us one example where America enacted a hostile takeover of a Korean site, and extracted its resources solely for the benefit of American interests.

Line failed in the Korean market, and only penetrated Japan if I remember correctly.

And it is also partially owned by Softbank.

To be accurate, Uber didn't abide by laws in most countries it went up against. It was a little slimy but also the taxi systems of most places were very entrenched. I remember never enjoying riding taxis in San Francisco for years, the cars were gross and the drivers were grumpy and generally shady about having their "credit card readers being broken" so they didn't have to pay the fees. Uber and a bunch of companies did and end run around those very politically entrenched systems and I certainly am happy to have clean, friendly, safe, modern rides with good tech where reviews keep things in line and payment is easy and I can share my location easily and know I'm going to end up at the right place way better.

It didn't work on Wine?

It was government mandated but it was an attempt by their government to strengthen security at the time when they couldn't import stronger crypto. Then it became established and hard to remove.

Due to restrictions on the export of cryptography from the United States, standard 128-bit SSL encryption was unavailable in Korea. Web browsers were only available to Koreans with weakened 40-bit encryption. In the late 1990s, the Korea Internet & Security Agency developed its own 128-bit symmetric block cipher named SEED and used ActiveX to mount it in web browsers. This soon became a domestic standard, and the country's Financial Supervisory Service used the technology as a security screening standard. ActiveX spread rapidly in Korea. In 2000, export restrictions were lifted, allowing the use of full-strength SSL anywhere in the world. Most web browsers and national e-commerce systems adopted this technology, while Korea continued to use SEED and ActiveX.

https://en.wikipedia.org/wiki/Web_compatibility_issues_in_So...

not every nation rewriting the same tech stack and providing local flavors of software solving similar problems.

Why not? Isn't Diversity good? Wouldn't it be nice to have multiple colors, implementations of things rather than the monopolistic (and probably American) beige?

Why would we think that every country blocking out foreign companies would result in better software being written for consumers in that country?

Why do you think foreign companies are automatically better? Is American software written by non-Americans automatically best? I find this to be incredibly arrogant.

Therefore you can use that website to get approximate location for literally everyone.

Approximate address, surely. Addresses are ... usually not very secret in the first place, though? It'd be absolutely fascinating if your government not only tracked everyone's location but assigned their voting center by current location, but, well,

IMHO That's where the software model could change if more countries gave a serious shake at managing national services.

As you point out it's hard and few can do it, so getting more common open source platforms would be a natural evolution. Then relying on global providers that act as a service developer instead of a service owner would still be a huge difference.

Most countries ARE capable of that. Or rather, most people of a country don't like platforms not dominated by their own primary language, and this is passively achieved by that tendency.

Lots of Russian stuffs on the Internet come through Telegram, meanwhile China has Weibo and TikTok, Korea does its thing in KakaoTalk and Facebook/Insta, Japan uses LINE along Twitter/Insta instead, so on and so forth. Everyone could be on Facebook, but that isn't what is going on.

The Interweb isn't so global, and English isn't the lingua franca of all communications. It's just the perception one experiences through an American door, though the Web do tend to be more developed in en-US.

Therefore you can use that website to get approximate location for literally everyone.

In America, before the Internet took off, every year everyone would get a book called the "white pages" that had the name, address, and phone number, of everyone who lived in their city.

The American view of privacy is that "openness makes for a civil society".

Although one can argue that hasn't been working out well for us lately ..

Likewise, marriages are publicly recorded and accessible online, as are all property purchases, births, deaths, and even property tax payments.

Though for some reason we consider income taxes to be super secret. Everything else is public, but not those! (How much cash someone put down to buy a house? Public. How much money that person makes? Not public. How much money everyone donates to politicians? Public.)

yes, and they also have the power to tell multinationals where they are allowed, geographically, to store the locals' data.

the grandparent has invented a fake problem (data regionalization, as though it cannot be addressed with regulation) and has conflated a nationalist-socialist desire to replace a foreign private enterprise with a nationalized public one. it's nationalist because it assumes that the nation needs to own it, and socialist because at the national level a public solution is proposed.

the solution, in turn, doesn't actually solve the regionalization problem unless the state organization running the nationalized ride share app is required through further legislation to keep the data local -- the same legislation that would be needed to regulate private entities, except now it's the government regulating itself since the public national ride share app is operated and owned by the government, and is now open to all the problems of corruption that plague every command economy.

But by all means, be more like North Korea, South Korea. Just nationalize everything. You don't want American influence. Those American monopolies and American dollars have really made you worse off in the last seventy years. /s

Right, which is exactly why it's dangerous to allow foreign (that is, US) companies to control your citizens' data, particularly if that data is not safeguarded against those foreign governments (e.g. due to "national security" laws).

There isn't any large software company from Korea that is setting up shop in US/EU

Most of its hardware and yes US has slapped tariffs on Korean EVs to boost their own.

Koreans prefer Naver over Google because its interface offers a lot more than Google. It's more of a portal site with social verification.

i meant most common, was an error on my part.

also, if you add internationalization support for 1 language in your app, it’s trivial (these days) to add other languages. My point is they should just add support for other languages, like chinese, japanese, english, etc.

More users = more money?

that’s a fair point. in that case, why not support chinese, japanese, etc?

my point is it seems like good business sense. strange they haven’t done this.

The subway station notification is spoken in Korean and English.

The translating part is by far the hardest. But there are services to organize a crowd sourced translations of your app / service.

Booth android and iOS app building frameworks will try to force you into using variables for every rendered string (allowing you to change them easily and in one place - f.ex. based on user / device settings).

They don't operate in Korea but they do provide Korean translations which seems to suggest they consider inbound tourists as a target market. It is quite telling the Korean apps do not.

Well maybe more people would book taxi rides if they added translation..

This is correct. I live in South Korea and I’ve never heard of any foreigners with kakao bank accounts. That was never offered as far as I know.

Wow, touche

And in an Apples-to-Apples comparison, WhatsApp fared far worse than Telegram on privacy, and not to mention its parent company.

The only benefit I can think of WhatsApp has is claiming to be encrypted by default. So I dont need to press an extra button. I just have to take their word for it.

That's a single point of anecdata from Reddit, as far as I can tell at least for the WhatsApp one.

The Signal one somebody has posted in the adjacent thread was definitely real and horrible though: https://news.ycombinator.com/item?id=27950763

The fact that at least two heavily-used messengers got one of the most essential things in instant messaging wrong is nightmare fuel I didn't need to have in my life :(

Wow, I'm truly baffled! Is this a rite of passage for instant messenger developers!?

Seems like a rather easy thing to go wrong in the client, no?

User sends message via client. Client fumbles the recipient id. Message ends up at the wrong recipient.

Examples: incorrect recipient ID attached to contact in list where users selects recipient. Buggy selection of multiple targets in the selection UI due to incorrect touch event handling. Incorrect deletion of previously selected and then deselected recipient from recipient array of multitarget message. Or if working low level even a good old off by one error and reading out of bounds data for the recipient list (though that one hopefully should trigger a faulty send request due to other stuff no longer matching). There is endless examples.

The server can't really safeguard against the client providing a legitimate send request even though the user intended to send it to another recipient.

Do you know of anyone who has created a US style startup in Seoul? Only two people I can think of are Matthew Shampine and Jason Boutte. Jason Boutte is literally the only foreigner I know who pulled it off, I've lived in Seoul doing startup stuff for 5 years till recently.

yup. i wouldn’t consider sk a startup hub in the remotest. like you said, the vc landscape perfectly reflects it.

Eu citizen here: where in Europe are you talking about?

Europe requires sms plus a apple/google validated app and stock phone.

Which European central government services require you to use an online service or app, with no voice, paper on in-person fallback. I can think of one in the UK - my council's resident's parking permit system

the fact of the matter is that there are massive differences in consumer opinion. Western markets prefer specialist companies that do one thing really well, whereas in East Asia people often prefer trusted conglomerates.

As a general example, department stores are much healthier in Japan and Korea, whereas in the US they were hollowed out by specialty clothing retailers, specialty makeup retailers, etc. and then finally kicked over by online shopping.

None of superapp operators seem to have that kind of boss.

But they also don't have the shareholder/activist investor pressure that Western companies face.

To achieve "superapp" size, you need to have either a strong leader personality driving the push by their sheer will and vision and especially with enough authority/financial power to overrule investors - people like Steve Jobs, Jeff Bezos, Elon Musk or Mark Zuckerberg - or you need to be one of the Asian ultra-conglomerate/"chaebol" companies that have absurd amounts of money flowing through them that enterprising middle managers can divert.

Unfortunately, with the exception of the visionaries I mentioned, corporate America and Europe just doesn't have many company founders with both clear visions and a backbone, and there's (partially "thanks" to de-conglomerisation trends of the 90s and later like with German giant Siemens) nothing at all left that comes even close to the diversification of revenue that Samsung has.

How do you mean? The situation with X seems mostly to do with marketing (people not liking the owner & his behavior) and bots, with maybe a little bit of instability thrown in. As noted elsewhere in the thread, Facebook already has experience with a bunch of different types of services-- from the games they used to host, to Marketplace mentioned elsewhere in the thread, to event management rivaling Meetup & Eventbrite, and even a dating app. X talks about being an "everything app," but they really just have posts (with media) and that's their only feature to date. Facebook does a lot more. So I don't see how pushing harder on non-social features would make them any more like X is right now.

Well that is kinda the point of these vague laws. Just like they eventually nailed Al Capone with taxes in the US - if you can't hit someone directly, you can hit them with the "three felonies a day".

I'm German... our politicians, at least most of them are a bunch of pathologically technologically incompetent buffoons. A lot of that was masked during the Merkel era because she herself was a literal nuclear physics doctorate, but now that she's gone, it's painfully obvious what's going on.

There are many non-Korean non-digital-nomads living and working in South Korea who do pay taxes. Millions, actually. South Korea has a very large international residency.