How publishers are defeating ad blockers and how ad blockers are fighting back - <AUTHOR> http://blog.bugreplay.com/post/153861574674/fkadblock-how-publishers-are-defeating-ad# <comment><USER2> Not only publishers it would seem: This weekend I tried visiting the website of a streaming video provider I was interested in subscribing to only to be informed that, roughly, "there was a problem completing my request. If you have an ad-blocker, please disable it and refresh this page. <company in question> uses certain tools for marketing purposes that can be blocked by ad- blockers"

... ironically for their marketing department, I decided not become a customer then and there.

<comment><USER3> They wanted to see information about how you use something they offer. You wanted something they offer. You declined, which is your choice, of course. I think you both lost that battle.

<comment><USER4> I think the company insisting they know better than myself what I need to see and how I need to see it is not going to be good to do business with. If you know your tech doesn't work well with adblockers, you have two choices: a) accept that some part of the audience doesn't want ads and work so that your tech supports them and b) tell them "screw you" and refuse to take them as the clients. The company chose the latter. Why anybody would insist on being a client of somebody that doesn't want you as a client, given the choice?

<comment><USER3> The bit about them insisting they know better than you what you need to see and how you need to see it, coupled with the bit about ads, is a non sequitur. We're talking about tracking usage stats.

Some people simply can't be bothered to disable an ad blocker for non-ad related things. Others take a more extreme stance and consider analysis itself to be an affront. Everyone loses. Producers don't know what works or doesn't and consumers don't get the content they desire.

One thing I've noticed is that these comments tend to come from pure consumers but rarely from those who both produce and consume. It's partially an issue of having a lack of perspective of the other part of the equation.

<comment><USER4> > We're talking about tracking usage stats.

We're talking about refusing clients who use adblockers. There are many ways to track usage that doesn't require that. I've implemented some myself. If the reason for refusal is because their tracking can't work with it it's doing it wrong.

> tend to come from pure consumers but rarely from those who both produce and > consume

Produce what? And why does it matter? Imagine coming to a grocery store and being asked to change into store uniform, before you are allowed in, because it's easier for them to do business that way, marketing and stuff, and when you ask "WTF?" \- they'd say "well, you don't know how it is to farm, do you? Did you ever milk a cow or harvested rye? You only consume, not produce, you lazy slacker, right? So either strip and wear the uniform or shut the heck up!". No thanks. I wouldn't visit such store. Would you?

> It's partially an issue of having a lack of perspective of the other part of > the equation.

I am not obliged to serve everybody's perspective. I have no obligation to make life easy for somebody's marketing department or support somebody's business model. It's their business to convince me to support it with my money, and, frankly, telling me I'm too ignorant to appreciate how wonderful they are is not going to work well. Telling me "we're too lazy/cheap to do it any other way, so please disable all security features in your browser, disregard your privacy and risk your safety because our marketing needs some nice graphs in their next monthly presentation" won't work either.

</comment></comment></comment></comment></comment><comment><USER5> I'd just like to point out that the "war" developing is not so much between advertising and ad-blockers. I think most of us would be fine with advertising on some page you are visiting. The real problem comes from trackers and other tactics that don't try to show a product TO you, but try to show YOU to a company. The problem is not that I don't want to see advertising, I just don't want to share my information with someone I don't even know. Maybe there is a way in between.

<comment><USER6> Personally, I wouldn't mind SOME ads feeding companies... Hell, I'll watch short videos to get ahead in some games I play...

the problem is massive ads, 3 line stories turning into multi page ad fests, "Around the Web" type crap, security risks injected via ad networks, etc...

It's not the ads per-se: it's the MASSIVE abuse of ads. it's why we can't have nice things.

Same can be said of TV shows and how it went from a minute of ads... t0o 10 minutes out of a 30 minute slot being ads.

<comment><USER7> Good point about TV. I'd happily subscribe to cable if it weren't for the fact that I'd be paying to have ads blared at me every 5 minutes.

<comment><USER4> I just DVR everything and then skip ads. I can't watch non-recorded TV anymore - not only ads are extremely long and mind-numbingly boring, they insist on showing the same ads several times during the same show! I don't know how people tolerate it.

<comment><USER8> You're still affected as the time allotment for actual content is going down. Even reruns are getting compressed

</comment></comment></comment></comment></comment><comment><USER9> My largest annoyance after ads is autoplay html5 videos from news sites. CNN is especially bad. I wish Ublock could have an option to stop all html5 autoplay.

(yes, I've got the "Disable HTML5 Autoplay" in chrome, and no, it mostly doesn't work)

<comment><USER10> CNN are dicks for this but I also blame Chrome and Firefox for not enforcing click to play.

<comment><USER11> When so much is controlled by JS these days, is it reasonable to expect they can block it all the time? With flash, at least it is one element that the browser can lock until you click it. With JS, who knows what/where the developer will inject and start playing audio / video.

</comment></comment></comment><comment><USER12> I never used an adblocker until recently when Youtube started showing those fucking World of Tanks ads and ads for similar games from the same fucking company.

Many of you don't understand how that could be a huge nuissance, because your systems are powerful enough to shrug it off, but for my old system, those fucking ads would freeze up the UI of the page.

Even with my new system, many of the ads offered enough of a slowdown to the experience of using many sites on top of sometimes causing the system to crash completely that an adblocker became necessary.

<comment><USER13> If your company is really that slow because of adds you might want to think about blocking some ad providers with your host file. I tested it with a verge page and it went from about ~50mb down to ~10mb. (Disclaimer it was 50mb because of an auto playing ad video)

<comment><USER14> Or a custom DNS cache if you want to block on all of your network. There is a Perl script on github that generates a local rule set for unbound using Dan Pollock's list. There are other services as well.

</comment></comment></comment><comment><USER15> Dear publishers: you're fighting the wrong battle, and the wrong people.

You look at people who visit your site without seeing the ads as "stealing" your content without paying the price (suffering, apparently I guess) of viewing the ads. Forcing them to view ads is a dumb move that you've been forced into because of the bizarre incentives in the business, but it's not a sustainable strategy.

Forcing people to view ads won't make those ads effective, and it'll make your viewers hate you more. Ads are likely not a long-term stable source of income either. Precisely because people are becoming more and more savvy when it comes to figuring out what to buy and less and less tolerant of being told what to buy.

I know that advertising is one of the easiest ways to make money, especially with a content site on the internet. But you need to put serious effort into finding a better way. If you don't then you'll be caught flat footed when both your ad revenue and your viewers gone. Foster stronger bonds with your viewers, figure out how to monetize them without ads (there are a zillion ways without paywalls), keep innovating, laziness is how you die.

<comment><USER16> What are some of the zillions of ways?

<comment><USER15> There are two important things to understand when it comes to monetizing content production effectively. One, when you have a strong, unique brand that produces content that people love and identify with people _want_ to give you money. Two, the concept of consumer surplus, market segmentation, etc. (see here: [https://www.joelonsoftware.com/2004/12/15/camels-and- rubber-...](https://www.joelonsoftware.com/2004/12/15/camels-and-rubber- duckies/)).

At the simplest level if you offer a quality product and you let people pay whatever they want for it, even nothing, _you will still make money_. That alone may not be enough to cover your costs, but it's an important realization. The difference between the "you need to control your customers, sell them to advertisers, and force ads down their throats" mindset versus the "you need to engage with your users and they will support you no matter what" mindset is like night and day, being so diametrically opposite can make it difficult to make the transition.

The easy level of monetization is to let people give you money in exchange for "nothing". Offer donations, or patronage support with token rewards (such as being thanked, put in the credits, etc.), and merch that allows people to show off their support or that allows people to express their identity through a connection to you or your content (this works for _everything_ not just rock bands or web comics).

Up from there you can offer more substantive rewards. You can offer subscriptions that gain people access to extra content, to content earlier than it will be publicly available, to higher levels of credit, or to higher levels of engagement and connection with creators.

You can package your content in different forms and release it as a compilation, charging money for it or offering it to subscribers. Say you're a web comic, you can print books containing your comics by year or by story line or whatever. If you're a musical artist you might release all of the tracks you're working on at any given time freely (through youtube or mp3 downloads) but then cut an album of the tracks (perhaps after re-recording them and having them professionally mixed/mastered) and sell that (either digitally, in physical form, or likely both). If you write you can compile stuff into books focusing on certain themes. And so on.

You can break your work up into specific projects and crowd fund each project. This also gives you the advantage that you'll typically end up having to figure out how to produce various products out of that project to use as rewards, which you can also sell afterwards.

And that's just a start, there are tons of other options.

These things aren't viable for "content" creators who don't produce a lot of original content or that don't produce content of high enough quality to engage strongly with their fans, and I'm mostly ok with that. There are tons of clickbait and tabloid content creators out there who survive not because they produce anything of value but because today eyes can be monetized through ads. The main problem here is that income inequality is at such an extreme level that a lot of people have hardly any disposable income to support anything, no matter how much they value it, but the effects of _that_ are even more wide ranging.

</comment></comment></comment><comment><USER17> This article concludes that adblockers are "losing"... But do you know what happens when I see a modal asking me to whitelist the site? See ya! This isn't some critical thing I rely on to survive. It's Forbes. I don't _need_ any of their content, and I'm totally fine walking away until my particular blend of adblockers can block the garbage on their site again.

<comment><USER18> Shortsighted, wouldn't you say? Eventually this will choke out all competition except for companies with the smartest people/deepest pockets. We'll end up creating monopolies around content by refusing to pay for it when there was healthy competition.

<comment><USER19> I for one am willing to pay for content as long as it's large enough to o cover most of the sites I frequent, fixed rate subscription, no extea fees for content (pay per comment/timed exclusivity for paid members to drive membership fine by me), and most importantly, a way to personally choose who gets a portion (at least 25%) of the subscription fees.

Short of that I really don't give a damn. It's not my problem.

</comment></comment></comment><comment><USER20> My eighty year old grandparents can't [be trusted to] browse web pages with internet ads. If internet ads were billboards in the same way we see highway advertising, I wouldn't mind. Today a significant percentage of them are scams, with victims.

</comment><comment><USER21> The cat and mouse game between publishers and blockers continues to pollute the web for everyone. Sad to see things escalating so quickly.

</comment><comment><USER22> The victory I'm waiting for is CSS selectors to finally get updated, so I can block something like so: div > $p > .adindicatorclass

The p element would be blocked. This will also be great for getting rid of non ad content that you just don't want to see.

<comment><USER23> Won't happen. The point of CSS is that all selectors and properties only ever trickle downwards. If they could propagate upwards (from `.adindicatorclass` to its parent, in this case), the cost of evaluating them would become prohibitively expensive. (And even worse, you could probably construct self- contradicting stylesheets.)

</comment></comment><comment><USER24> Basically, after reading this article, use uBlock instead of AdBlock. It works.

<comment><USER25> Specifically, uBlock Origin!

<comment><USER26> I wish someone would port Origin to Safari. :(

<comment><USER13> Looks like you got your wish! UBlock Origin for Safari - [https://news.ycombinator.com/item?id=13112280](https://news.ycombinator.com/item?id=13112280)

<comment><USER26> It's like an early Christmas!

</comment></comment></comment></comment></comment><comment><USER27> Its amazing how much of this I am unaware of because of tools like noscript. Anti-adblock tech that relies on js just doesn't matter much..

<comment><USER28> ...until you visit a site that gives you a blank page without javascript. speaking of which, i wouldn't be surprised if more and more sites start to require mandatory js to view their content.

<comment><USER29> Happens frequently to me with uMatrix. Then you look at the list. You know the usual suspects like jQuery, google ajax, bootstrap, Akamai etc. fairly fast.

On other sites you look at what they want to include and you just think "yeah, no, let's not do that" and just close the page.

</comment></comment></comment><comment><USER30> As a JS guy, I open the devtools and just delete the modal div elements. Problem solved.

</comment><comment><USER31> It reminds me of the music/movie industry in terms of how these adblock detectors mimic something like DRM. Anyway the problem is with the business model. People are installing adblockers in response to more aggressive advertising, and then the ad companies get more aggressive because of it. It's a never ending cycle.

</comment><comment><USER32> How are the ad blocker not moving to the rendering engine already...

<comment><USER33> See: the Content Blocer system on iOS. The interface is a rules specification, and the implementation is delegated to the OS/hardware manufacturer to save power and performance.

<comment><USER34> Right, too bad the entire architecture is useless because blockers are not allowed to use JS. Filter expressions are not enough anymore.

</comment></comment></comment><comment><USER34> What's the best iPhone/iOS solution?

Apple's new hooks for blockers only allow regex filters, so the blockers can never win without being able to add code.

There are other browsers besides Safari but then you have other problems:

1). Do they have daily updates to their ad blockers to keep up the arms race?

2). How do you use important Safari plugins like LastPass?

<comment><USER34> Found an answer, this is working well so far: [https://purify- app.com](https://purify-app.com)

</comment></comment><comment><USER35> So, this has nothing to do with the article itself and is instead about the HN post.

This is a dupe of the exact same article posted 2 hours earlier. The URL is only different because this one, the dupe, had a # at the end of the URL and bypassed dupe detection. Why isn't that something that is identified and fixed automatically? Even better, if HN detects that someone is purposefully trying to bypass dupe detection, does HN punish that user? This case looks like it could have been a simple mistake, but there's zero reason that HN shouldn't be stripping a trailing # and in general having the dupe detection flag URLs that only differ in fragment ids.

</comment><comment><USER36> Interesting. Is there an adblocker that blocks or prevents the most annoying parts of ads - sounds, animations, taking over chunks of the screen?

Maybe one that limits cross-domain traffic, so requests for more than, say, a megabyte get nixed?

</comment><comment><USER37> Interesting to see how others are doing this. I recently was tasked with adding some logic to determine the number of ad-blocking users across the network of sites I help maintain.

I added my own custom script into Appnexus (ad provider) and attempted to load it. Ad-blockers, I discovered do one of two things in this case. The first is to just block the loading of the content, in which case it was easy to detect. Others would inject their own custom content, hence adding a custom script and then checking the contents for a special string.

A fun task for sure though.

</comment><comment><USER38> Does anyone know of a blacklisting plugin that will, for example, let me add wsj.com and then remove all links to that domain from any page I'm on? Ideally it would have a community driven list of known bad players. If something like that became very popular, I think companies would start to fear "disappearing" from the internet and start behaving a little more sanely.

</comment><comment><USER39> Why can I not pay a reasonable amount of money to get past advertisments? Usually I do not need the subscription for 300$ a year but I want to read one article in a adfree way and pay for the advertisments they are losing. Unlike in apps, I haven't seen a website where I can give them money for no-ads. So for me their business model is broken.

<comment><USER40> I'm curious as to the actual breakdown, but I know that most subscription- based journalism still receives the majority of its revenue from ads. I suspect that ad-free experiences would be prohibitively expensive for most if not all subscribers. This is largely speculation though. Anyone in the industry have some harder numbers?

One example I know of that I believe is ad-free is theinformation.com which has a yearly subscription of $399. [https://www.theinformation.com/payment- policy](https://www.theinformation.com/payment-policy) Running an institution like the NYT or the WSJ must be much more expensive.</comment></comment>


The Cost of a Logo - <AUTHOR> http://www.huhmagazine.co.uk/view_article.php?id=4140&s=art&t=design

<comment><USER2> Please note this mixes up the cost of a logo with the cost of a rebranding effort.

Creating the logo is only one very small piece of a rebrand.

<comment><USER3> Right, I'm sure the BP rebrand included new expensive signs at all of their gas stations. I isn't like the logo design walked off with hundreds of millions.

<comment><USER4> The designer does the rebranding, not the customer. This means generating all the new style guides, promotional material templates, business cards, even sometimes ad templates.

All of that derives from the logo/wordmark, but it's usually the majority of the work.

<comment><USER5> In the case of BP's rebranding, the numbers quoted here seem to be mainly BP- side spending, such as replacing signage on facilities and repainting vehicles: [http://www.telegraph.co.uk/news/uknews/1350238/BP- attacked-o...](http://www.telegraph.co.uk/news/uknews/1350238/BP-attacked- over-136m-logo-as-petrol-prices-soar.html)

</comment></comment></comment></comment><comment><USER6> It's interesting that the London Olympics logo is so embarrassing. The UK government have form, as the old Office of Goverment Commerce found to their chagrin. Their logo was even more naughty when rotated 90 degrees, and its logo was literally just the text OGC in a very elegant font. They paid £14,000 for it.

In fact, it's an awesome logo, if not for the unfortunate letter formation...

[http://www.telegraph.co.uk/news/1901656/OGC-unveils-new- logo...](http://www.telegraph.co.uk/news/1901656/OGC-unveils-new-logo-to-red- faces.html)

For the image...

[http://www.google.com.au/search?tbm=isch&source=mog&...](http://www.google.com.au/search?tbm=isch&source=mog&hl=en- GB&gl=au&client=safari&tab=wi&q=ogc%20logo%20fail&sa=N&biw=320&bih=416#i=1)

<comment><USER6> Hmmm... second link not working!

Try:

[http://www.chewdesign.co.uk/wp-content/gallery/latest/ogc- lo...](http://www.chewdesign.co.uk/wp-content/gallery/latest/ogc-logo.jpg)

</comment></comment><comment><USER7> There is a direct correlation between the size of a company and the cost they pay for a logo, if twitter gave a marketing company the power to rebrand their logo now it would cost thousands.

There is a certain amount of responsibility in rebranding a large company and the myriad of brand documentation that goes with it.

It's funny how a startup only really cares about the logo looking nice but once they get big then it goes into the brand position and how that brand speaks to people.

I find it really interesting all this, I work for a company that specialises in branding (I work on the web side mind) but I know how much work companies are doing for the 400k price tags

<comment><USER8> > but I know how much work companies are doing for the 400k price tags

I absolutely agree, by far the biggest portion of most redesigns isn't so much "just" the logo, it's changing the whole corporate design that is attached. Letterheads, website, slide design, business cards etc. etc. etc.

That is obviously only the case if you already have an established brand and established corporate culture. The small startup with just a handful of people doesn't have to worry to much (since not much is in place), but if you need to ("retroactively") change the specs for thousands of workers, subsidiaries etc, that quickly ramps up the price and the amount of work needed.

</comment></comment><comment><USER9> >To fix this, Lambie-Nairn simply straightened up the boxes, removed the dashes, and changed the font to Gill Sans - _a typeface which had been invented 60 years ago, meaning there were no worries of it quickly looking outdated._

A really clever design principle. I've always thought it was most effectively used in film (e.g. Gattaca).

</comment><comment><USER10> Shameless ripoff of [http://stocklogos.com/topic/famous-logo-designs-and-how- much...](http://stocklogos.com/topic/famous-logo-designs-and-how-much-did- they-cost) posted 1 month ago

</comment><comment><USER11> Wow, $100 million USD for the Accenture logo is baffling to me. I'm guessing there must be more being delivered behind the scenes that just the image. Anyone with experience in this area care to elaborate on how they come up with these prices?

<comment><USER12> They didn't pay $100m for a "logo", they paid for brand identity, marketing, they paid for their entire image to be changed. Same with BP.

<comment><AUTHOR> Physical changeover of signage at all sites with the logo is another big cost. It usually must all be done at around the same time which often means higher after hours costs. For BP, this means all of their petrol stations.

<comment><USER13> Not to mention letterheads, business cards, envelopes, labels, internal paper forms. Both the sign and the printing industry benefit when a company rebrands.

</comment></comment></comment></comment><comment><USER14> The cost of a logo: $0

The cost of endless iterations, navigation of bureaucracy, corporate politics, egos, lack of respect for your field, phasing out the old stuff, documentation, pricing according to what the company can pay, etc.: what the market will bear

BP can afford $211K. In 2011 they averaged $70 million in revenue per day.

<comment><USER15> Please note that the amount was $211 million

<comment><USER6> About 3 days of revenue... Not bad!

</comment></comment></comment><comment><USER16> For context, more Olympic logos.

My favorites are Grenoble, 1968 and Nagano, 1998 and Cortina d'Ampezzo, 1956.

[http://www.digitalhorticulture.com/a-history-of-olympic- logo...](http://www.digitalhorticulture.com/a-history-of-olympic-logos-from- london-2012-to-london-1948/)

<comment><USER6> I have to say that apart from the current London logo, these are all amazing! They each capture the mood and place of the games at that time... I can't believe that so many countries got their logos so consistently right for one event!

One dud amongst many is remarkable...

</comment></comment><comment><USER17> Some of these examples are redesigns so it makes the actual cost extremely difficult, or impossible to quantify.

</comment><comment><USER18> Incidentally PepsiCo released an interesting PDF document which revealed their redesign "process."

[http://bunnitude.com/misc/files/pepsi_gravitational_field.pd...](http://bunnitude.com/misc/files/pepsi_gravitational_field.pdf)

</comment><comment><USER19> FWIW: <http://www.50dollarlogo.com/>

<comment><USER20> Don't use this website. It's a scam.

[http://www.complaintsboard.com/complaints/50dollarlogocom-c1...](http://www.complaintsboard.com/complaints/50dollarlogocom-c137424.html) [http://answers.yahoo.com/question/index?qid=20080324152924AA...](http://answers.yahoo.com/question/index?qid=20080324152924AAuYUiK)

Plus my own experience.

If you want to pay $50 for a logo, google "Stock logos". If you want an actual good logo, 99 designs has a logo section (they start at like $300).

</comment></comment><comment><USER21> The conclusion I draw from this list: boring companies spend money on rebranding efforts to change their image; good companies give meaning and value to their logos by themselves.

</comment><comment><USER22> Just spent $600 on a logo at 99 designs.com. I ended up receiving over 300 submissions. No rebranding necessary seems like $500-1000 is a good price for a graphic.

</comment><comment><USER23> it's price anchoring based on the size of the company or how many cash they have - more money more bucks spent on logo and nothing more

</comment><comment><USER24> The Fat Man with a red shirt and blue pants...

</comment><comment><USER25> Was interested to learn about Nike actually doing the right thing by their logo designer when they made some money. Which doesn't excuse their manufacturing history.</comment>


You can use Code School for free next weekend - <AUTHOR> http://www.codeschool.com/free-weekend?fb_action_ids=10201128707883052&fb_action_types=og.likes&fb_ref=.UZaSvvvXBpk.send&fb_source=aggregation&fb_aggregation_id=288381481237582

<comment><USER2> I was mildly interested until I read the T&C at the bottom. Not being available to current or past users, agreeing to learn more about New Relic, and explicitly stating no time extensions being possible came across as overly negative for 2 days of free access.

<comment><USER3> What you say simply isn't true. The Free Weekend is offered to all users (past or present) as long as they don't currently have a subscription to Code School.

Time extensions aren't stated because this is a limited-time event.

New Relic is our sponsor, in exchange with the agreement to be contacted by them via email you obtain access to all our content for 48 hours — something that would otherwise cost you $25. Is that really unreasonable?

<comment><USER2> > What you say simply isn't true.

What did I say that isn't true? Negative T&C gave me pause about trying Code School. This turned me off forever.

> The Free Weekend is offered to all users (past or present) as long as they > don't currently have a subscription to Code School.

This is the only statement I see that differs from my interpretation of the T&C. The line in question, "Free Weekend is not available for current or past subscribers and is intended to allow new Code School users to sample the benefits of a Code School education."

How common is it for a current or past user to not have a disqualifying subscription? The wording makes it clear (intentionally or not) that the promo is for new users.

> Is that really unreasonable?

I didn't say it was unreasonable, but that the T&C as a whole appeared to me as overly negative for what they protect, 2 days of free content valued at $25.

<comment><USER3> > What did I say that isn't true?

Actually, I was wrong. The terms incorrectly stated that past subscribers couldn't have access to the Free Weekend. That's what was untrue and has now been fixed.

</comment></comment></comment></comment><comment><USER4> They e-mailed me earlier today, with the message "New Relic wants to buy you a free weekend of Code School to celebrate!" however, after typing in my e-mail on the promo page, I was told I was not eligible! Have now added Codeschool to my e-mail block list.

<comment><USER5> You could have just unsubsidised. This will just do unnecessary harm to their email delivery rates.

<comment><USER6> Crappy business decisions deserve crappy responses. Don't advertise to your existing customers and then tell them they're ineligible for the product you spammed them with.

<comment><USER7> Codeschool has made crappy decisions in the past. I paid for a course and shortly after they made it free (but the free version had ads). They also discontinued said course so I can't even watch it anymore. Yeah ... they lost me as a customer.

</comment></comment></comment></comment><comment><USER8> Code School is not for people who know how to program. I found their material very basic and slow, even for things like node that I did not know at the time. I felt like the same material could be absorbed much quicker using other means (blogs, etc.)

<comment><USER3> That's a rather bold statement. We've helped quite a few people with prior programming experience learn new technologies and languages.

It's certainly possible that you're too experienced for the levels of expertise we aim for. In that case, of course, there are surely more appropriate resources for you out there.

</comment></comment><comment><USER9> In April of 2011 we pitched codecademy type service at a startup weekend. It didn't get picked as an idea to work on but after seeing reaction to codecademy we created CodePupil and then everyone and their mom created a codecademy clone too.

There is room for more/better, but to do these types of start-ups/concepts it takes a ton of testing and iteration.

Good to see codeschool is still in the game, they were around prior to codecademy.

<comment><USER10> I've tried codeacademy briefly before (Spent ~8 hours total on there). After only 10 minutes on codeschool it feels a lot better. It seems like it's much easier to learn it show you 'real life applications' which is one thing that I thought codeacadmy didn't do well.

I'm definetly going to be spending some time on codeschool, seems like a great site.

<comment><USER11> Insightful review! What about HN? It seems you've spent about 10 minutes here. That should qualify you to review it, right?

<comment><USER10> I can't tell if you're comment is meant to be sarcastic ('10 minutes is not long enough to review') or not but i'm going to go with not:

I've been lurking on HN for a few months, have recently come back to it after a month hiatus and wanted to comment on something so signed up this morning :)

I love this site, I'm usually a redditor but I find that there is much more interesting and gripping content here whereas reddit is more of a quick laugh. I do find that I can easily waste an hour on the front page here but I just learn so much in that hour! I'm sure that I'll stick around and find out lots of new stuff.

<comment><USER12> Go back to Reddit

</comment></comment></comment></comment></comment><comment> cupcake-unicorn I've been meaning to sign up so it's a good option for me, thanks for the link. Am I supposed to get an email now or next week? Using a throwaway email that sometimes gets blocked, so just wondering.

<comment><USER3> You should receive a confirmation email soon, and you'll receive a link to access your Free Weekend next week when it starts.

</comment></comment><comment><USER13> How is their Node.js course? Are there comparable courses out there for learning Nodejs from scratch?

<comment><USER14> I really liked it. Good introduction, but it won't offer too much if you've worked with Nodejs in the past. It goes over the basics, some refactoring, then introduces socket.io and redis. Their Rails courses are also quite excellent.

</comment></comment><comment><USER15> That's great and all, but why pay for an online coding school in the first place? The web has a ton of freely available programming learning materials.

<comment><USER16> CodeSchool has a consistent quality, with professionally done videos. By now, the site has enough of a reputation, that you can show around your profile that lists what challenges and courses you've passed.

<comment><USER17> Doesn't the old-fashioned Lynda.com offer much better videos? At first blush, Codeschool doesn't seem to be teaching so much as introducing. The JavaScript lessons seem way too high-level, and way too focused on frameworks and libraries (these are important, but only once you have the basics down).

</comment></comment></comment><comment><USER18> My biggest gripe about Codeschool is that they switched to 'Paths,' seemingly to compete with Treehouse. I much preferred the prior iterations of the product.

I'm also not fond of partnerships pitched as courses. I'm not sure if revenue is low, or if the money offered by partners (such as New Relic and Github) is so good that they can't resist, but I lost interest in the product after the TryGit course.

Both Treehouse and Codeschool are decent for beginners, but even amateur programmers will outgrow them quickly as their thirst for new knowledge outgrows the offerings. This is one of the reasons I like paying per course instead of per month.

If you are new to programming and want to start learning quickly, I'd recommend paying for Peepcode, Codeschool, Treehouse, and anything else you can get your hands on. Having access to a variety of content and styles can be invaluable.

</comment><comment><USER19> If you're looking to learn iOS and know how to write other software, skip Code School and go to iTunes U.

[https://itunes.apple.com/us/course/coding-together- developin...](https://itunes.apple.com/us/course/coding-together- developing/id593208016)

<comment><USER3> Or you could skip iTunes U and check out Try Objective-C for free right now: <http://tryobjectivec.codeschool.com/> ;-)

</comment></comment><comment><USER20> For the people who actually sign up for this and are learning rails -- ie have done the M. Hartl tutorial but might not have seen many projects live -- take a look a Rails Best Practices.

Its definitely doable within a weekend.

</comment><comment><USER21> If you're a newbie it says, which I know I'm not so keep that in mind.

Edit: whilst saying noobs it actually just means subscribers are out, anyone already with an account seems eligible.

<comment><USER3> We meant "Code School newbs" as in people who haven't tried Code School before, not programming newbies.

</comment></comment><comment><USER22> IMO, there should be a free trial period who users who sign up. At least a day, or one premium course? But yeah, looking forward to seeing what Code School is all about

<comment><AUTHOR> They have seven courses that are always free, mostly intro stuff but they are worth checking out: Ruby, RoR, Objective-C, DevTools, Git, R & jQuery

<http://www.codeschool.com/courses#all>

</comment></comment><comment><USER23> Does anyone else find this to be a cruel kindness to geeks given that it coincides with the release of Arrested Development Season 4?

<comment><USER3> We didn't plan for it but it's going to make for a perfect little refreshing break for people between courses and we're definitely going to have Netflix playing in the office while we work to keep everything running smoothly.

I don't think this was a huge mistake. ;-)</comment></comment>


Google Mail Hacked? - <AUTHOR> http://www.securelist.com/ru/blog/32625/Massovyy_vzlom_ili_Gmail_bag Russian security company "Kaspersky lab" reports infiltration into a number of gmail accounts. Seems to range across all accounts with different passwords. Trojan? Gaia sources?
This report (and follow ups) in english: http://www.google.com/support/forum/p/gmail/thread?tid=77127463d8f40cb6&hl=en
Kaspersky report (russian): http://www.securelist.com/ru/blog/32625/Massovyy_vzlom_ili_Gmail_bag <comment><AUTHOR> This report from Kaspersky lab is in russian, but there are reports in english see the google question and follow up comments:

[http://www.google.com/support/forum/p/gmail/thread?tid=77127...](http://www.google.com/support/forum/p/gmail/thread?tid=77127463d8f40cb6&hl=en)

Could be a trojan stealing gmail passwords, or a Gaia-related hack? Any other sources?</comment>


What does "there's a shortage of talent" mean? - <AUTHOR> I've heard from various reliable sources that there's "a shortage of talent" in the tech industry.
On the other hand, I read things like http://unemployable.pen.io/ about people struggling to find jobs. Additionally, I recently graduated from one of the top coding bootcamps, and while I did find a job, I got non-responses or rejections from pretty much everywhere I applied. And this is the story I hear from everyone I talk to at the bootcamp. We're told that it's a "numbers game".
So what is meant by "there's a shortage of talent"? In the context of that claim, what is threshold you have to surpass to be considered "talent"? <comment><USER2> It can mean a number of things.

1\. Truly there are not enough trained people for the jobs available, but I don't necessarily think that is our core problem in the US based market right now.

2\. There is a shortage of new graduates to fill the entry level jobs available to do the grunt work on projects, and paying a senior engineer 6 figures to write programs or utilities slightly harder than Hello World is a bad investment (obviously a bit of an exaggeration but you get the idea).

3\. Employers are not willing to pay the wage necessary to hire the people that are available in the market with the capability to do what the employer needs. e.g. they want to pay 70k/year for a 10 year senior engineer instead of a 6 figure salary. Supply and demand issue basically.

4\. Employers are not willing to invest in an employee with 75-80% of the skill set to get them to the 100% they need. This can be because companies are so focused on quarterly numbers that they don't want a carrying and training cost or that they are fearful the employee will just leave once they are trained. I have heard both fairly recently.

Personally, I think all of these are true at different times and in different places, and I think there is some type of "shortage" now depending on the market you are in.

<comment><USER3> I would not call an employer's unwillingness to pay market rates a "Supply and Demand issue."

<comment><USER2> When supply of talent availability outweighs demand for the talent, wages go down or remain flat. McDonalds, Dairy Queen etc all have an abundance of high school aged kids to work the counter every year as an example of ample supply and relatively flat wages.

When demand for talent out paces the supply then wages should generally continue to rise until some equilibrium is established. Tech is on the rise side of this. A side affect is it has made it harder for small businesses to afford senior engineers. Many companies are also playing games primarily using foreign workers that essentially is manipulating supply which allows them to control wages.

There are of course other reasons an employer could be priced out of the market or unwilling to pay market wages of course. Maybe they just can't afford a senior engineer because their business isn't mature enough, it happens so they need to get creative. e.g. Use an outside firm or hire an individual who has less experience and hence has a lower cost.

</comment></comment></comment><comment><USER4> Speaking as a hiring manager in a tech company here for a moment, I do find there's a shortage of reasonable people to consider. I found this thread because someone had pointed me at unemployable.pen.io and wanted to comment on it specifically, because having read that particular blog post, I started off thinking "man, that's someone I'd like to talk to," and then realized a few things:

If you're trying to get hired, then maybe when you write a blog post on the fact, you also include a link to your resume. Or at least your name. Because otherwise, I'm sitting here thinking to myself "welp, no idea who this person is"

This person acknowledges that for more than a decade, she/he coasted in an office job. I tend to hire for strong initiative and drive, and I'd worry about this person. And that still wouldn't stop me from talking to them IF THEY MADE IT EASY FOR ME TO FIND THEM.

</comment><comment><USER5> A "shortage of talent" is actually economic shorthand. The full phrase is "shortage of talent at the rate I'm willing to pay." You can _always_ find a fantastic developer, if you're willing to pay more than the other guys.

That said, the hiring process is completely broken. I know barely literate programmers making bank, while exceptional programmers are just scraping by.

<comment><USER6> The problem is the hiring process tests for your ability to make it through the hiring process, not for your ability to actually do the job.

</comment></comment><comment><USER7> You might take a look at this article from the New York Review of Books on "STEM" jobs and all the noise about the talent shortage.

[http://www.nybooks.com/articles/archives/2015/jul/09/frenzy-...](http://www.nybooks.com/articles/archives/2015/jul/09/frenzy- about-high-tech-talent/)

My take, as an older, very experienced software engineer (with 25+ years of professional experience): it's basically bullshit. Big employers just don't want to pay for American citizens, especially ones who want to be compensated appropriately for their degree of skill and experience, because they have a track record of getting stuff done. These employers want H1-B warm bodies to fill seats at half my salary. These employers can go !@#$% themselves.

<comment><USER8> Part of the problem, too, is that there are too many people making outrageous salaries.

I am currently hiring and as part of the interview process, I ask a very straightforward question. I expect it to take on the order of 5 minutes and 7 lines of code. It is programming 101. Out of the 10 or so people I've interviewed, exactly none of them has gotten past this question. Most of them take 45 minutes to work on it and few of them get it to work even then. These are people who have contracted at big name places, with 10+ years of experience, with CS degrees, H1-B and non-H1-B.

So if I am going to hire someone who is unable to write a simple algorithm, I would rather do it at offshore prices. And sadly, that is something I am seriously considering doing.

<comment><USER7> You might consider whether this is really a valid test, or just something that you _think_ truly evaluates whether a candidate can do the job. In my experience hiring, it's not that valuable. I do think some kind of screening for basic skills is valuable at the low/inexperienced end, but writing code in front of an expectant audience may not be it.

I have written hundreds of thousands of lines of shipping code, and I've faced this kind of code-for-an-interview process repeatedly. The last time I had to do it, I found that I actually choked on a simple string reverse problem.

It was a really basic algorithm; there was absolutely no difficulty with my understanding of how the algorithm worked, or how to code it. I just choked. I was talking to three people on Skype with a shared whiteboard, and I had to give up. It was very frustrating. This had more to do with the fact that I had been out of work for several months and was facing a huge amount of stress about things like paying the mortgage than it did with my actual abilities on the job.

<comment><USER8> What should I be doing to find a candidate who can code and understands basic concepts without asking them to demonstrate that ability to me? I've been burned by people who talk a good game.

<comment><USER7> I don't have a great simple answer for this. I think it some combination of maybe looking at code samples, talking to previous employers, maybe doing some code in a timed exercise, either on or off-site, or maybe even contracting with a prospective employee to pay them to work on some small trial piece of code. I agree with you that there are definitely candidates out there who are all talk. I'm just not sure demanding code on a whiteboard during the interview itself is really a foolproof proxy for "smart and gets things done." I think it might weed out obvious duds but it might also weed out some people who might be having a bad day. It also is, I think, quite possible to game this kind of interview question, by studying some of the many books of coding interview questions coming out and just memorizing some of them.

</comment></comment></comment></comment></comment><comment><USER9> If they _could_ hire someone if they paid 1 million dollars, it means that the market rate is somewhere between what they are offering and 1 million dollars. Remember "market rate" means what you could actually purchase something in the market for.

If we set aside the possibility of greed on the part of employers, it may mean that they cannot afford to pay market rates i.e. _their business model isn 't compatible with paying the market rate for the labor they need_.

</comment><comment><USER10> "Shortage of talent" is code for "we abandoned our in-house training program and want other companies to foot the bill"

</comment><comment><USER11> The software industry has a fundamental problem in that we don't have a broad objective measure for what is "good" software. It is also a very young industry that is still in the crazy iteration/development phase. This leads to changing "best practices" and wheel reinvention to the extreme.

This causes software projects to be both extremely expensive, hard to estimate and with terrible success rates.

Because all of that, finding software developers that can regularly deliver business value is extremely difficult and it is usually priced too high for most businesses.

Personally, I don't view this as a hiring problem, I view this as an oddity of the times we live in. Give it another 25 or 30 years and maybe we will actually know something about how software projects should work.

</comment><comment><USER12> > I got non-responses or rejections from pretty much everywhere I applied.

Turns out that Corporate America is really bad at recruiting, thanks to poor technology investment decisions.

Here's an excellent assessment on the hiring situation by headhunter Nick Corcodilos > [http://www.pbs.org/newshour/making-sense/ask-headhunter- recr...](http://www.pbs.org/newshour/making-sense/ask-headhunter-recruiting- technology-costs-job/)

</comment><comment><USER13> What does it mean? There is no Linus-level genius willing to work for $10 an hour.

</comment><comment><USER14> It means companies refuse to:

1) train people, and 2) pay for talent

Businesses have pretty much tapped out the supply of devs who will spend thousands of hours of their own time on l&d for the love of the craft. So now if they want the expertise they have to pay.

If I am learning on my own time in order to increase my income I expect to get returns of at least 1cent/hour (and that's the extreme low end). So if I invest 10,000 hours I expect at least a $100/hr return.

How many companies complaining about a dev shortage are offering salaries of $300k+/year (intermediate dev salary + $100/hr compensation for all the l&d)?

</comment><comment><USER15> What is a top coding bootcamp? Is that a degree? If not, then I don't find it surprising that it was difficult. Just as that article implies, many employers have minimum requirements that you may not meet, and they aren't necessarily crazy requirements.

But a bigger question than that is what market are you talking about? Are you talking about the valley? Boston? Have you considered that IT shortage is not a local problem, and a broader search could turn up unexpected opportunity?

</comment><comment><USER16> As far as I can tell, 'shortage of talent in tech' just means companies are hiring.</comment>


Somebody Snuck a Potato into CES to Make a Point About Useless Smart Gadgets - <AUTHOR> https://www.forbes.com/sites/petepachal/2020/01/10/somebody-snuck-a-potato-into-ces-2020-to-make-a-scathing-point-about-useless-smart-gadgets/ <comment><AUTHOR> Submitting this because it borders on performance art and it's also funny, plus it could lead to interesting discussion</comment>


JavaScript Particle System Sandbox - <AUTHOR> http://jarrodoverson.com/static/demos/particleSystem/

<comment><USER2> A lot of fun to try to make an enclosure of fields to keep the particles in.

<comment><USER3> Its so cool. How about making gravity so that particles collide and form bigger particles and increase their gravity. Can this be simulated?</comment></comment>


Continuous Backwards Compatibility - <AUTHOR> http://www.braintreepaymentsolutions.com/devblog/continuous-backwards-compatibility

<comment><USER2> This is a really interesting technique, and were I in charge of the build system here I'd try and implement something similar.

The code samples are particularly useful as you can see how best to adapt this to another version control system, even something draconian.</comment>


IBM Quad9 – A free security solution using DNS to protect against cyber threats - <AUTHOR> https://www.quad9.net <comment><USER3> Namebench says...

        Mean response (in milliseconds):
        </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>--
        188.8.131.52          ########### 71.90
        192.168.1.1      ############# 85.92
        188.8.131.52          ##################################################### 369.26

        Mean response (in milliseconds):
        </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>--
        22.214.171.124          ################# 85.49
        126.96.36.199         ################################################## 252.25
        184.108.40.206          ##################################################### 268.93

... give it some time.

<comment><USER4> Wait, is 126.96.36.199 the secondary? That's in the same allocation as 184.108.40.206. What's the point in having a secondary if there's no real separation or redundancy?

22.214.171.124 and 126.96.36.199 are separate allocations - both /24.

<comment><USER5> The most useful reason to have two addresses is for client resolvers that often demand them, assuming the whole configuration is running anycast with multiple PoPs, the extra "redundancy" provided by Google DNS is essentially meaningless thanks to BGP route aggregation, a /24 is too small to be treated uniquely for internetwork routing in the general case, and in any case, both of Google's subnets are announced by the same AS 15169. The most likely use for Google's subnet is to make the backup address more memorable.

In both networks, those IP addresses are almost certainly treated identically, virtualized to all hell with multiple physical termination points leading to the same pools of machines. One extra /24 isn't going to help reliability much if at all, especially considering it is part of the same AS.

Perhaps I'm wrong and Google use the /24 somehow for the purposes of internal routing. If that's true, in the same scenario IBM may be content to have just these two /32s in their internal tables where route aggregation could be be made to not apply.

<comment><USER6> Having the backup in a separate /24 allows the option of steering BGP announcements differently at different peering points (even if they aren't announced differently in the everything is working case).

</comment></comment></comment></comment><comment><USER7> Looks like an interesting alternative to Google DNS (184.108.40.206), and possibly a little more anonymous. Google logs your IP address for 24 - 48 hours[1], while Quad9 appears not to[2].

[1] [https://developers.google.com/speed/public- dns/privacy](https://developers.google.com/speed/public-dns/privacy)

[2] [https://www.quad9.net/#/faq#does-quad9-collect-and-store- per...](https://www.quad9.net/#/faq#does-quad9-collect-and-store-personal- data)

<comment><USER8> It is surprisingly easy to set up a recursive resolver for oneself.

That way, nobody can log and aggregate the queries you run, and nobody can mess with it either, unless they manage to break DNS itself in a big way.

<comment><USER9> > nobody can log and aggregate the queries you run

So who do you forward your queries to? :)

<comment><USER8> A recursive resolver does not need to forward queries. ;-)

Conceptually, it starts with the root nameservers and works its way up - <USER2> by dot, recursively, hence the name - until it finds the domain the host in question in it, then asks the nameservers for that zone and caches the result.

It is possible - with BIND9 at least, but I guess other DNS servers offer similar capabilities - to use forward servers for convenience/caching or to redirect queries to specific servers depending on the name in the query. But it is not mandatory.

<comment><USER9> True, seems I read over the recursive part. In which case it is definitely not easy to set up.

But even for a recursive DNS server that is only used by a single client aggregation for popular dains is not impossible.

There are better and definitely easier ways to have anonymous DNS lookups

</comment></comment></comment></comment></comment><comment><USER10> You shouldn't use it in Germany or Europe. It resolves www.google.de with an IP based in SFO, instead of a local Google server. Even 18.104.22.168 (which is said to support EDNS Client Subnet) doesn't work.

<comment><USER11> This is a byproduct of edns not being transmitted on 184.108.40.206 resolutions for privacy reasons. 18.104.22.168 will transmit edns, but has no blocking. Soon we will release another ip that will have blocking+edns transmission on it, as well as documentation outlining all this and the differences. We just ran out of time for all that and focused on 184.108.40.206. Sorry for any inconvenience on your end. (Also sorry if my response latency is high, im a big fan of this community so im focusing my attention here as best i can)

<comment><USER10> Thank you for responding. I think four different DNS IPs on your side could be a little overkill for the standard user in terms of choosing the 'right' one. Apart from that, good luck with the product!

<comment><USER12> Totally understand, we are trying to find the right balance for those that need options. We can always shift how we present things, configurations, technologies implemented etc based on end users feedback. We really do want folks to help us make this system better.

</comment></comment></comment></comment><comment><USER13> There is something very funny about that service being immediately unavailable right after launch.

I think I'll pass for now.

<comment><USER3> The DNS server works though. Only the website appears to be unavailable. EDIT: Even the website loaded eventually.

        » dig @22.214.171.124 news.ycombinator.com +short
        news.ycombinator.com.cdn.cloudflare.net.
        188.8.131.52
        126.96.36.199

Not great but not a complete failure either.

</comment></comment><comment><USER14> After recently setting up Pi-hole on my Turris Omnia I had to choose between using Google's DNS (which supports DNSSEC) or sticking with OpenDNS (which does not...yet?), so I gave up using DNSSEC. The submitted IBM site is really slow to load but I did manage to grab a screenshot of the FAQ page[0] which confirms they do support it. And the privacy policy looks pretty good also[1].

I tried to archive the pages with archive.is but it did not appear to be loading for them either.

Hopefully the site comes back up soon but I have to say I expected to see yet another surveillance capitalism service and I was pleasantly surprised. I'll try it out for a week and see how it goes.

[0][https://screenshots.firefox.com/LiNdj97Ck3qaLXze/www.quad9.n...](https://screenshots.firefox.com/LiNdj97Ck3qaLXze/www.quad9.net) [1][https://screenshots.firefox.com/YEsWa5TwhGYQDZFZ/www.quad9.n...](https://screenshots.firefox.com/YEsWa5TwhGYQDZFZ/www.quad9.net)

<comment><USER15> Why would you use Google/OpenDNS/whatever when you can use dnscrypt [1]?

[1] [https://dnscrypt.org/](https://dnscrypt.org/)

<comment><USER16> Which still requires you to pick a resolver you trust to send your (then encrypted) traffic to, and if the parent wants DNSSEC it still requires them to find one that supports that (DNSCrypt is not a replacement for DNSSEC)

The list of resolvers they have there it's not exactly obvious why I should trust any of those more? (and OpenDNS is _on_ that list) [https://dnscrypt.org/dnscrypt-resolvers.html](https://dnscrypt.org/dnscrypt- resolvers.html)

</comment></comment></comment><comment><USER17> That's funny the quad9.net website it down at the moment, I guess that answers if their DNS will be reliable.

<comment><USER18> The site is down, but the DNS server seems to be fine.

<comment><USER13> The DNS server is also super slow.

<comment><USER19> Hi this is Alex from GCA! Could you please run `dig +short @22.214.171.124 id.server TXT chaos` and post the results here? That will help us troubleshoot. Thanks!

<comment><USER20> Quad9 DNS is 10x (or worse!) slower then Google's for me (I'm in São Paulo, Brazil). Will this output help you troubleshoot DNS performance?

      $ dig +short @22.214.171.124 id.server TXT chaos
      res300.ams.rrdns.pch.net

<comment><USER12> Thanks for this, we will see what we can do to run this down.

<comment><USER21> I wrote you an email to the address in your profile but got a failure notice:

      Sorry, we were unable to deliver your message to the following address.

      <email@example.com>:
      550: 5.1.1 The email account that you tried to reach does not exist.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> It's designed quite badly to be honest.

18.104.22.168 is allegedly with security features. 188.8.131.52 does not have any security features.

People will put 22.214.171.124 in the Primary DNS, 10 in the secondary in many of OSes.

Also What is Quad9 resolves to a video rather than a quick explanation. There is almost no information that this is a DNS server service on landing.

>It's easy to setup Quad9 on your Mac or PC. Watch the video for your operating system.

Where is Linux? I doubt people who are using those OSes will bother changing their dns.

<comment><USER23> I have a new rule: if I have to watch a video to understand the 'value proposition' or even what something does, I will close the browser tab and keep looking.

Video is not documentation.

<comment><USER3> Product presentations aren't even the worst offenders. The absolute worst are providers doing "webcasts" in lieu of writing actual user documentation.

</comment></comment></comment><comment><USER24> Quick performance test comparing these 4 players:

* Google: 184.108.40.206 * Quad9.com: 188.8.131.52 * [http://OpenDNS.com](http://OpenDNS.com): 18.104.22.168 * [https://CleanBrowsing.org](https://CleanBrowsing.org): 22.214.171.124

Results:

      New York:
      64 bytes from 126.96.36.199: icmp_seq=2 ttl=60 time=1.62 ms
      64 bytes from 188.8.131.52: icmp_seq=2 ttl=60 time=0.924 ms
      64 bytes from 188.8.131.52: icmp_seq=2 ttl=60 time=1.18 ms
      64 bytes from 18.104.22.168: icmp_seq=2 ttl=57 time=1.93 ms

      Montreal:
      64 bytes from 188.8.131.52: icmp_seq=2 ttl=55 time=13.0 ms
      64 bytes from 18.104.22.168: icmp_seq=2 ttl=56 time=16.7 ms
      64 bytes from 18.104.22.168: icmp_seq=2 ttl=56 time=16.5 ms
      64 bytes from 22.214.171.124: icmp_seq=2 ttl=50 time=9.18 ms

      Dallas:
      64 bytes from 188.8.131.52: icmp_seq=1 ttl=61 time=1.09 ms
      64 bytes from 184.108.40.206: icmp_seq=1 ttl=59 time=29.8 ms
      64 bytes from 22.214.171.124: icmp_seq=1 ttl=58 time=1.03 ms
      64 bytes from 126.96.36.199: icmp_seq=1 ttl=57 time=1.29 ms

      Paris:
      64 bytes from 126.96.36.199: icmp_seq=2 ttl=56 time=4.61 ms
      64 bytes from 18.104.22.168: icmp_seq=2 ttl=56 time=6.71 ms
      64 bytes from 22.214.171.124: icmp_seq=2 ttl=56 time=4.60 ms
      64 bytes from 18.104.22.168: icmp_seq=2 ttl=54 time=3.85 ms

      Tokyo:
      64 bytes from 126.96.36.199: icmp_seq=1 ttl=59 time=1.10 ms
      64 bytes from 18.104.22.168: icmp_seq=1 ttl=55 time=65.7 ms
      64 bytes from 126.96.36.199: icmp_seq=1 ttl=57 time=1.57 ms
      64 bytes from 18.104.22.168: icmp_seq=1 ttl=59 time=0.551 ms

Only New York and Paris were close. Their performance in Tokyo & Dallas were sub optimal. OpenDNS has a much better performance and closer to Google than quad9.

But I will still try it out and hope they keep supporting it.

</comment><comment><USER25> Sending DNS queries in open does not protect from DNS hijacking which is ubiquitous in SE Asia for example. So you end up getting 'free security solution' that at the last mile is deliberately slowed down, registered and falsified.

Much better and more secure solution could be assembled in 15 minutes using dnscrypt-proxy with ip and domain filtering and caching. [^1]

Additionally I am always suspicious why IBM suddenly wants to collect my DNS queries? Sorry big corpo but I don't trust your good intentions any more. We are long past the innocence of first years of the Internet.

If IBM or any other big name really wants to help with DNS security why don't they give financial and material help to heroes like jedisct1, Martin 'd0wn' Albus, soltysiak and others who put their time, effort and money into running DNSCrypt servers? Money plunged just in design of Quad9 webpage they could have kept some servers running for years[^2]

[1] [https://github.com/jedisct1/dnscrypt- proxy/wiki](https://github.com/jedisct1/dnscrypt-proxy/wiki)

[2] According to soltysiak his monthly costs are c.a. 40€/month but as it is his private expense he had to limit memory in his server.

[https://dnscrypt.pl/2017/04/02/finacials- in-q1-2017/](https://dnscrypt.pl/2017/04/02/finacials-in-q1-2017/)

</comment><comment><USER26> The website seems to be down for me.

Doesn't DDoS defense fall in the "internet threat protection" bucket? :p

</comment><comment><USER27> Re: "In some circumstances this may result in suboptimal routing between CDN origins and end users."

Maybe it's better now, but a couple years back I found streaming iTunes movies (I think Apple used Akamai at the time and may still) would not work at all if not using my ISP's DNS servers. So I had to configure dnsmasq to forward CDN domain lookups to my ISP's DNS servers.

I wonder if a good compromise for EDNs w.r.t. privacy would be that instead of forwarding the client subnet, instead have a lookup table mapping the client IP to their ISP's DNS servers, and then insert subnet of the ISP's DNS servers. I suppose it could be any "representative" subnet of the client ISP though.

Also, minor typo in the FAQ answer for "Does Quad9 implement DNSSEC?": "... Note that some variations of our resolver (differente IP addresses) may not provide DNSSEC."

Different has an extraneous trailing "e".

<comment><USER20> Maybe the author's mother tongue is Portuguese (we spell "diferente"). This typo is probably the one I commit the most :)

</comment></comment><comment><USER28> I totally just got the name, Quad9 == 220.127.116.11, duh

<comment><USER29> Ugh... same here.

</comment></comment><comment><USER30> The response time depends on network peering from their anycast locations. I am seeing different response times based on test locations.

From US:

      # ./dnseval.py -f google-vs-quad9.txt -c 50 -C yahoo.com
      server      avg(ms)     min(ms)     max(ms)     stddev(ms)  lost(%)  ttl        flags
      </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>----
      22.214.171.124     31.857      31.278      33.416      0.434       %0       1332       QR -- -- RD RA -- --
      188.8.131.52     31.865      31.361      32.872      0.336       %0       1330       QR -- -- RD RA -- --
      22.214.171.124     93.703      92.797      95.362      0.586       %0       1391       QR -- -- RD RA -- --

From Iran:

      # ./dnseval.py -f google-vs-quad9.txt -c 50 -C yahoo.com
      server      avg(ms)     min(ms)     max(ms)     stddev(ms)  lost(%)  ttl        flags
      </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>----
      220.127.116.11     105.093     90.046      130.871     9.749       %0       3590       QR -- -- RD RA -- --
      18.104.22.168     99.458      84.472      133.375     11.308      %0       3585       QR -- -- RD RA -- --
      220.127.116.11     96.231      83.957      134.709     9.503       %0       3595       QR -- -- RD RA -- --

Tests are performed using dnsdiag tools: [https://github.com/farrokhi/dnsdiag](https://github.com/farrokhi/dnsdiag)

</comment><comment><USER31>
            $ ping 184.108.40.206
    	PING 184.108.40.206 (188.8.131.52): 56 data bytes
    	64 bytes from 220.127.116.11: icmp_seq=0 ttl=53 time=98.011 ms
    	64 bytes from 184.108.40.206: icmp_seq=1 ttl=53 time=96.444 ms
    	64 bytes from 18.104.22.168: icmp_seq=2 ttl=53 time=96.556 ms
    	64 bytes from 188.8.131.52: icmp_seq=3 ttl=53 time=96.769 ms
    	64 bytes from 126.96.36.199: icmp_seq=4 ttl=53 time=104.274 ms
    	64 bytes from 126.96.36.199: icmp_seq=5 ttl=53 time=102.235 ms
    	64 bytes from 18.104.22.168: icmp_seq=6 ttl=53 time=97.185 ms

    	$ ping 220.127.116.11
    	PING 184.108.40.206 (22.214.171.124): 56 data bytes
    	64 bytes from 126.96.36.199: icmp_seq=0 ttl=45 time=54.808 ms
    	64 bytes from 220.127.116.11: icmp_seq=1 ttl=45 time=54.407 ms
    	64 bytes from 184.108.40.206: icmp_seq=2 ttl=45 time=55.173 ms
    	64 bytes from 220.127.116.11: icmp_seq=3 ttl=45 time=55.058 ms
    	64 bytes from 220.127.116.11: icmp_seq=4 ttl=45 time=54.583 ms
    	64 bytes from 184.108.40.206: icmp_seq=5 ttl=45 time=54.589 ms
    	64 bytes from 22.214.171.124: icmp_seq=6 ttl=45 time=54.645 ms

</comment><comment><USER32> It's also interesting that they have a public "insecure" DNS server on 22.214.171.124 with none of the additional threat protections - [https://www.quad9.net/#/faq#is-there-a-service-that- quad9-of...](https://www.quad9.net/#/faq#is-there-a-service-that-quad9-offers- that-does-not-have-the-blocklist-or-other-security)

</comment><comment><USER8> Ironically, the page takes _forever_ to load for me.

If they cannot handle the HN hug of death, I am not so sure if they can ward off a serious attack.

The idea - Realtime blacklisting via DNS - is not bad. But if the first impression I get is a page that loads very slowly, I am doubtful if they can implement it well.

<comment><USER11> The problem is all the hugs of death. :(

Website is being worked, dns infrastructure is solid and working well. Sorry for brief response, a bit busy ;)

<comment><USER8> I see. ;-)

I hope you succeed. Filtering out bad actors via DNS is a good idea, you will have to be very careful about false positives, though. ;-)

I think a similar approach is already being used for mail servers to detect spam... but I am short on details, because the only mail server I have ever taken care of is the Exchange server at work, and Exchange is not all that proactive when it comes to spam.

<comment><USER33> DNSBLs [0] are _very_ popular. Pretty much anyone running a mail server that accepts connectiona from the public Internet use them -- you have to! I manage several mail servers and I use many different DNSBLs, including one of my own.

The best anti-spam advice I could give WRT your Exchange box (I've managed those too) is to put another box in front of it to handle the spam filtering (Postfix + SpamAssassin + friends in my case, but you have many options), though IIRC even Exchange can directly use these blacklists nowadays.

[0]: [https://en.wikipedia.org/wiki/DNSBL](https://en.wikipedia.org/wiki/DNSBL)

</comment></comment></comment></comment><comment><USER34> That's quite a vanity IP. Wonder if they already had it or bought the address block from someone.

<comment><USER35> IBM owns 22.214.171.124/8

<comment><USER36> Baller.

</comment></comment></comment><comment><USER37> Does anyone have an example query that would be blocked? Trying to see what the reply looks like.

<comment><USER38> dieutribenhkhop.com (which resolves to 127.0.0.1) works on 188.8.131.52 but not 220.127.116.11, and quad9.net reports it as "blocked"

<comment><USER39> presumably 1) public domains resolving local is a threat, 2) that domain has bad reputation and previously hosted nasties

</comment></comment></comment><comment><USER40> fm malaysia: Pinging 126.96.36.199 with 32 bytes of data: Reply from 188.8.131.52: bytes=32 time=17ms TTL=54 Reply from 184.108.40.206: bytes=32 time=12ms TTL=54 Reply from 126.96.36.199: bytes=32 time=32ms TTL=54 Reply from 22.214.171.124: bytes=32 time=11ms TTL=54

Ping statistics for 18.104.22.168: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 11ms, Maximum = 32ms, Average = 18ms And Pinging 184.108.40.206 with 32 bytes of data: Reply from 126.96.36.199: bytes=32 time=20ms TTL=54 Reply from 18.104.22.168: bytes=32 time=17ms TTL=54 Reply from 220.127.116.11: bytes=32 time=18ms TTL=54 Reply from 220.127.116.11: bytes=32 time=17ms TTL=54

Ping statistics for 22.214.171.124: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 17ms, Maximum = 20ms, Average = 18ms

</comment><comment><USER41> I hope one of those planned locations will be somewhere in Eastern Europe. At the moment I measure a 44ms ping, which is just 1ms slower than 18.104.22.168, and 2ms faster than OpenDNS for this location.

</comment><comment><USER42> It's like Herman Cain's tax plan, but one 9 better.

Joking aside, shouldn't they have an alternative DNS server, too, like Google does with 126.96.36.199? Maybe 22.214.171.124 or 22.214.171.124?

<comment><USER12> We do have another IP tied to the anycast cloud on a different /8.

126.96.36.199 - blocking, no edns (same setup/config as 22.214.171.124)

I will see about adding this to the list of things to add to documentation. (thanks for the feedback guys!)

</comment></comment><comment><USER43> Wow, 30k blocks per day? That's 0.25% of the entire address space every year. In 400 years they'll have blocked every IPv4 address!

<comment><USER44> Here's to another 400 years of stagnant IPv6 adoption!

<comment><USER28> Is there IPv6 support for Quad9?

Yes. Quad9 operates identical services on a set of IPv6 addresses, which are on the same infrastructure as the 18.104.22.168 systems.

Secure IPv6: 2620:fe::fe Blocklist, DNSSEC, No EDNS Client-Subnet

Unsecure IPv6: 2620:fe::10 No blocklist, no DNSSEC, send EDNS Client-Subnet

</comment></comment></comment><comment><USER45> Hey, you support Ed25519! Only some of the time -- I'd bet your PowerDNS resolvers support it but your Unbound ones don't -- but you might be the first public recursive DNS provider to support Ed25519 at all.

(Recent versions of Unbound do support it, but you might be running an older version or missing the right dependency.)

(Example zone: ed25519.nl.)

</comment><comment><USER46> I know this has been mentioned already, to much lament... but if companies like google and ibm were really serious about hosting a DNS service to promote privacy and securit they should host a dnscrypt interface to it.

I'm sure people in the dnscrypt community would rather trust privately hosted servers but I really don't see the difference in risk.

<comment><USER12> We currently support DNS over TLS, and are looking at other options in the space. So if folks want dnscrypt I can take that feedback back to the team and see what we can do for you guys. From my perspective the calculation on private encrypted dns server over something like our service comes down to your threat model. We are trying our best to be as transparent as we can on what we do, how we do it etc so we can earn trust. That being said, trusting any thing you dont 100% control and 100% monitor every little thing on starts to erode absolute security/privacy/control. The one thing that sets us aside from a private server is the infrastructure we use, it is a growing anycast cloud spread across the globe, that with usage (helllooo hot cache's!) should provide better performance then a single locale/remote recursive server (or chain of servers).

<comment><USER46> I'm pleasantly surprised that you support DNS over TLS but I barely know how to use that. Dnsmasq doesn't support it yet for example and that's the forwarder I use at home.

To clarify, I have a dnsmasq but I also have a dnscrypt forwarder. Dnsmasq only resolves LAN names and forwards the rest to dnscrypt.

So I'd have to forward to a service that supports DNS over TLS to use quad9.

Edit: Unbound does this.

<comment><USER47> DNS-over-TLS with Quad9 how-to: [https://medium.com/@alexander_band/privacy- using-dns-over-tl...](https://medium.com/@alexander_band/privacy-using-dns- over-tls-with-the-new-quad9-dns-service-1ff2d2b687c5)

</comment></comment></comment></comment><comment><USER48> Their attention to detail inspires confidence: "It's like and immunization for your computer"

<comment><USER49> Also: "setup", used all over the front page, is not a verb, yet is used as one.

</comment></comment><comment><USER50> It seems like a cool idea, but I'm worried about the practical implementation, and that it is just another service to monitor (like Safe Browsing) where you could get blocked incorrectly.

</comment><comment><USER51> Looks like a competitor to Comodo's free Secure DNS service.

[https://www.comodo.com/secure-dns/](https://www.comodo.com/secure-dns/)

126.96.36.199

22.214.171.124

<comment><USER21> Interestingly, your link didn't work for me because comodo.com was blocked by Quad9 :)

<comment><USER51> Wut?

Sounds like a pretty good reason not to use Quad9 then.

</comment></comment></comment><comment><USER40> Fm Malaysia, quad and google performed almost identical over last two days

</comment><comment><USER52> pi-hole was also the first thing that came to my mind. They should setup a feature version on 22.214.171.124 with the same blacklists as a pi-hole :)

</comment><comment><USER53> is this hosted on Softlayer/Bluemix? if so hit me up if you need help getting more servers in different locations or have any network or load balancer performance related questions (I am a net. eng. for Bluemix infrastructure)

</comment><comment><USER54> Sooo they are running RPZ and calling it a product....?

<comment><USER11> We dont run rpz on the resolver nodes, hopefully when we clear the backlog of things we want to fix/tweak/finish we can get around to dropping some docs on the cool stuff we built/did, and why. #todolist

<comment><USER54> I look forward to reading that as a fellow DNS Engineer that works at large scale and has a passion for security.

</comment></comment></comment><comment><USER55> Fitting that the site looks like it's down.

</comment><comment><USER56> "When a Quad9 user clicks on a website link or types an address into a web browser, Quad9 checks the site against IBM X-Force's threat intelligence database of more than 40 billion analysed web pages and images. The service also taps feeds from 18 further threat intelligence partners, including Abuse.ch, the Anti-Phishing Working Group, Bambenek Consulting, F-Secure, mnemonic, 360Netlab, Hybrid Analysis GmbH, Proofpoint, RiskIQ and ThreatSTOP."

Why not share the database with the public? This is meant to be a free service, isn't it?

"Quad9 is designed to provide these protections without affecting the speed that users expect when accessing websites and services."

Very careful choice of words. It does not say it will not affect the speed. It says it will not affect the "speed which user expect". What speed is that?

I already check domains against a database of ones I want to block. I do this locally using djbdns, without needing to send DNS queries over the internet. The speed is better than any third party DNS service, including 18.104.22.168 or 184.108.40.206. IMO, there is no need to send personal, private DNS queries to "18 further threat intelligence providers".

"Telemetry data on blocked domains from Quad9 will be shared with threat intelligence partners to improve their threat intelligence responses for their customers and Quad9."

Telemetry. So they are collecting data about users' DNS queries. This would explain how the service is "free".

When a user tries to access a blacklisted domain, a host of "threat intelligence partners" are notified.

"PCH, which provides Quad9's network infrastructure; and IBM, which provides IBM X-Force threat intelligence and the easily memorable IP address (184.108.40.206)."

Quad9 suggests IP addresses can be memorized. I will rememeber that.

"The personal information protections and selectable DNS encryption, DNSSEC, and blocklist that are in place show that this project is in line with PCH's values," he said. "Quad9 will inspire trust in both individuals and businesses who understand the importance of securing their private browsing data."

If someone digitally signs a document, does anyone believe the document is hence "encrypted"?

When DNSSEC is used, does anyone believe that DNS is hence "encrypted"?

A less misleading description might be something like "DNS record signing".

Using DNSSEC does not mean the DNS packets are encrypted. Anyone sniffing the network can read them.

DNSSEC also makes DDOS easier for malfeasants.

Have those providing the DNSSEC signed records and those providing DNSSEC enabled third party DNS service solved this problem yet?

I am not implying that this "service" could not be useful for users who _must_ use third party DNS service. The question is whether users who really care about security issues _must_ use third party DNS services.

source: [http://www.computerweekly.com/news/450430188/Free- Quad9-inte...](http://www.computerweekly.com/news/450430188/Free- Quad9-internet-threat-protection-launched)

"HQ

1442 A Walnut Street

Suite 501

Berkeley CA 94709"

source: [https://www.quad9.net](https://www.quad9.net)

Is this an office of IBM?

</comment><comment><USER57> The lady from that video presentation sounds like she's using a fake British accent.

</comment><comment><USER58> Doesn't work

<comment><USER12> I am assuming you are talking about the website?

We should be working on that front right now.

</comment></comment><comment><USER59> This just sounds like an advertisement for a partial virus checker software, most virus checkers now have browser plugins that do something like this. Why this gets 120 upvotes here is not obvious to me.</comment>


What's Really Going Inside the Big Co. You Are Trying to Sell to - <AUTHOR> http://smartstartup.typepad.com/my_weblog/2008/01/business-books.html Read this book to understand what's really going on inside and how they make buying decisions. <comment><USER2> Those are good points. Thanks.</comment>


Ask HN: If you had to restart with Comp Sci/Programming after years - <AUTHOR> ..of programming professionally, how would you do it differently?
What material would you follow?
What books would you read?
What Math would you go into?
What would you do differently? <comment> andrew-lucker I would go to a better school and join a fraternity. Craft mastery is overrated.

<comment><AUTHOR> Would it be practical to go back to school after, let's say, 10 years of workmanship? With family and all. I don't know, just curious.

<comment> andrew-lucker Sorry for the snark in the last comment. Going back to school at any time can be very rewarding. Lot's of big companies have programs to help you do it too.</comment></comment></comment>


Perspective: Facebook Is Now 5th Most Valuable U.S. Internet Company - <AUTHOR> http://www.techcrunch.com/2007/10/25/perspective-facebook-is-now-5th-most-valuable-us-internet-company/ <comment><USER2> "...and a massive stock valuation. They can make acquisitions of key technology and talent without spending much."

I don't agree with this. There's no liquidity in the stock, and just because MSFT thinks the company should be valued at $15B, I don't see why I should, or should expect anyone else to.

Wouldn't a $15B valuation make their (newly-issued) stock options _less_ attractive to new employees, since they would only be in-the-money if Facebook IPO'd with a (kinda high) $15B valuation _by the public markets_?

It's a bit of a different question for acquisitions, in which they can trade stock outright. Still, to do a deal, it seems they'll have to buy at very high valuations, giving their own highly-valued stock out in return. So it should still cost them (about) the same %age of FB to acquire a company post- and pre-investment.

It's certainly not _bad_ to raise a quarter-billion dollars in exchange for 1.6% of the company, but I don't see how this makes their stock much more valuable to an independent observer; without liquidity, it's still anyone's guess. Granted, people will probably guess higher now, but I still don't see that valuation as a free ride to low expenses.

</comment><comment><USER3> I don't think it makes sense to apply "total_valuation = microsoft_price / microsoft_stake". There are a load of wishy-washy things Microsoft could be looking to get out of this - a seat on the board, knowledge, position, credibility, yada yada... I doubt they're in it to make a direct return on their $240 million investment. You could probably add or subtract $100,000,000 or 1% from the figures involved and it wouldn't affect whatever Microsoft's trying to do.</comment>