DNS over HTTPS–What Is It and Why Do People Care? [pdf] - <AUTHOR> https://crsreports.congress.gov/product/pdf/IN/IN11182 <comment><USER2> Encrypted DNS is a good idea, I just wish all of the basic protocols were getting encryption in-place, instead of being reinvented over HTTPS.

First HTTP/3 (nee QUIC) reinvented TCP and ports over HTTPS, now DOH is reinventing DNS over HTTPS... Sigh. Both of these would be better off by evolving and modernizing their respective existing protocols. And HTTP is a client/server protocol with a _heavy_ handshake cost, why are we using it for a quick one-off request like DNS.

<comment><USER3> I don't disagree.

But the problem began decades ago when sysadmins started using firewalls to control what employees could access. During early 2000's I was involved in moving a lot of apps that used a bespoke port to port 80/443 just to make sure our apps and services didn't have any client hiccups due to (rightly so?) belligerent sysadmins.

All this has really done has made sysadmins lives harder bc of packet inspection. So, all app developers and now infrastructure solution devs must run thru 443, otherwise the take up wouldn't happen. The internet is effectively running on one port nowadays.

<comment><USER4> Why not extent the existing protocol and keep it on port 53, which DNS already uses?

<comment><USER5> Because some companies run with an effective

        iptables -t filter -A FORWARD -p udp --dport 53 -j DROP

And prevent anything from their own internal resolvers from accessing outside DNS services, especially now that encrypted SNI is moving more web filtering to the DNS layer.

<comment><USER6> But that one is OK. DNS over HTTPS doesn't exist to circumvent enterprise content filtering (hence why you can hint you don't want it to run with a DNS entry, making it vulnerable to downgrade attacks).

Easier to make the orgs internal recursive resolver "does the right thing" than all clients, too.

<comment><USER7> > DNS over HTTPS doesn't exist to circumvent enterprise content filtering

Replace "enterprise" with "ISP" or "nation state", and that's closer to what the DoH aims are.

</comment></comment></comment></comment></comment></comment><comment><USER8> My only gripe with DNS over HTTPS is that it seems to somehow be coupled with making it harder for me to actually force everything to use a particular DNS at the OS level, so apps can do things like circumvent your pihole regardless of how you configure your device's DNS settings.

<comment><USER9> They could do that already. There is nothing requiring that your app uses the OS set dns server

<comment><USER10> > _They could do that already._

Before Mozilla's drama with DoH, which app(s) did that?

Now that Mozilla has shown people that it's 'okay' to override the OS I'm worried that more things will do that same cockamamie thing.

<comment><USER11> Not an app, but Chromecasts have 22.214.171.124 hard coded.

</comment></comment></comment></comment><comment><USER4> This was very well written. I am pleasantly surprised.

 _Another concern is that DOH will complicate content delivery to users. Today, content delivery networks (CDNs) host multiple instances of web content on geographically dispersed servers. This creates resiliency for web services and helps to deliver content to users more quickly. If ISPs lose the ability to view users' DNS queries, they will still be able to route users to a CDN, but not necessarily the closest or most efficient CDN. Technical measures that may alleviate this concern include sharing some user data (like general geolocation data) and CDN load management tactics._

Is this a real concern? Don't ISPs just route on IP addresses?

 _Other potential implications of DOH implementation involve issues such as international data flow and advertising competition._

What on earth is this referring to?

<comment><USER12> That refers to the fact that DoH gives the same old monopolies on the web (Google, Cloudflare) additional web visit signal data, worsening the already appalling state of the economy on the internet captured by Google and Facebook for more than a decade, with naive nerds cheering in the name of technical progress. It also refers to ad blocking no longer being able to block ads based on domain names and IP addresses.

<comment><USER4> Other providers can provide DNS over HTTPS. It doesn't affect client side ad blocking. You can still point your browser to a regular DNS server (like some kind of DNS-based adblock solution), just the default changed.

<comment><USER13> For how long though? I don't necessarily trust either Chrome or Firefox to quietly accept my "why yes, use normal DNS" choice, so I've just gone ahead and set up DoH at home (since I'm already running DNS at home). But then again, I can.

</comment></comment></comment></comment><comment><USER14> > The Congressional Research Service (CRS), a federal legislative branch > agency located within the Library of Congress, serves as shared staff > exclusively to congressional committees and Members of Congress. CRS experts > assist at every stage of the legislative process — from the early > considerations that precede bill drafting, through committee hearings and > floor debate, to the oversight of enacted laws and various agency > activities.

[https://crsreports.congress.gov/Home/About](https://crsreports.congress.gov/Home/About)

</comment><comment><USER15> By its own definition[1], DOH forbids recursive resolution of queries. The client "MUST NOT use a different [DOH resolver] simply because it was discovered outside of the client's configuration"[2].

The protocol seems to be designed to require clients to send all of their DNS traffic to a single upstream provider. This may be similar to your current DNS configuration, and your network may even be limiting your ability to use the internet with bad policies on broken middleboxen. That's unfortunate for you, but please don't presume everyone has similar limitations.

>> "But we need to overload port 443 to hide our DNS traffic!"

It's unfortunate your ISP or national infrastructure requires such obfuscation. In those situations, the current DOH protocol could be a good workaround.

However, protecting against a malicious upstream server sending bad results is very different than protecting against large institutions being able to eavesdrop on your DNS traffic to build a model of your pattern-of-life. The latter is only stopped by _not giving a single entity_ all of your DNS traffic, which DOH explicitly requires.

If you recursively resolve DNS queries locally - ideally in a future where traffic to authoritative servers is encrypted (DoT?) - only the first request goes to a centralized server. Most traffic goes to the domain's authoritative server, which is probably the same controlled by the same entity you are about to connect to with HTTPS.

[1] [https://news.ycombinator.com/item?id=21110296](https://news.ycombinator.com/item?id=21110296)

[2] [https://tools.ietf.org/html/rfc8484#section-3](https://tools.ietf.org/html/rfc8484#section-3)

</comment><comment><USER16> > Today, DNS queries are generally sent unencrypted. This allows any party > between the browser and the resolver to discover which website users want to > visit. Such parties can already monitor the IP address with which the > browser is communicating, but monitoring DNS queries can identify which > specific website users seek. As more services move to cloud computing > infrastructure, this distinction becomes increasingly important, because > multiple websites may be consolidated under a few IP addresses, rather than > each having a unique IP address.

This is super misleading. Even with DoH, any party on the network can see which websites you're talking to, because their hostnames are sent in the clear via SNI. ESNI fixes this, but it's not clear to me whether the major cloud providers are going to go for that, and if they don't it's not going anywhere.

[https://news.ycombinator.com/item?id=21264814](https://news.ycombinator.com/item?id=21264814) was a good discussion of the actual security benefits of DoH.

</comment><comment><USER17> I wonder if Mozilla will change their rollout plan now that the UK has dropped their porn-filtering plans[0]

0\. [https://www.bbc.com/news/technology-50073102](https://www.bbc.com/news/technology-50073102)

<comment><USER11> They still will want to block piracy sites.

[https://en.wikipedia.org/wiki/List_of_websites_blocked_in_th...](https://en.wikipedia.org/wiki/List_of_websites_blocked_in_the_United_Kingdom#Court_ordered_implementations_targeting_copyright_and_trademark_infringement)

</comment></comment><comment><USER4> DNS is heavily cached. What are the caching implications for encrypting DNS?

<comment><USER18> It's only the traffic that is encrypted. It's still cached on the server and the client.

<comment><USER13> I _wish_ it was cached by Firefox. But it's not. I'm running a DoH setup at home, and from the logs, it looks like Firefox is _NOT_ doing any caching of results it gets.

At least my DNS server is caching the results though.

</comment></comment></comment><comment><USER19> This links directly to a PDF. Reader beware.

<comment><USER20> What's wrong with links to PDFs? A concern with malware?

<comment><USER21> I'm not sure about these days, but I do remember being hesitant about opening PDFs 12+ years ago, before I switched to MacOS (Safari has always had very good PDF display ability via OS X), and before all the major browsers had built-in PDF display (PDFs would often be downloaded as a file, which would trigger the opening of some PDF viewer shareware pre-installed on Windows). Terrible UX back then.

<comment><USER22> Yeah that was true back then. Opening a PDF link on windows 2000 or XP always a pain in the ass. I think those days are mostly over now though.

</comment></comment></comment></comment><comment><USER23> FYI: South Korea uses SNI to block porn sites.

<comment><USER9> Encrypted SNI is on the way. Alternatively, if the site is on a CDN or hosting platform you can usually send any SNI you want and it still resolves to the correct site.

<comment><USER16> Major cloud providers started blocking domain fronting last year.

</comment></comment></comment><comment><USER24> Disclaimer: This will be a wildly unpopular opinion.

I do not believe that DoH was created first and foremost to protect the privacy of people. I believe that it was created to use the frog in boiling water methodology of silently pushing millions of people into centralized logged DNS that can be used for whatever purpose those companies see appropriate, in my personal opinion.

I do not believe this opinion is far fetched. No company is going to just provide a large amount of infrastructure out of the kindness of their hearts. I am not saying that philanthropists do not exist. They do, but not here. This is a data grab first and foremost, in my opinion.

Another factor in my opinion is the lack of support for a corporate infrastructure. Some companies may manage some facets of user settings in Chrome and Firefox via AD policies, but I believe that is the exception rather than the norm. Companies will be leaking even more internal infrastructure topology than they do today. It isn't like ISP's manage browser settings, nor would they want to.

Nation states? DoH will not affect them at all. They will simply null route all of the DoH hosts like they do with existing proxies and VPN providers. This is what I had to do in my home network so that I could maintain control of my DNS.

<comment><USER25> I think you're arguing against the wrong thing here. You want decentralization of DNS. I don't see DoH really impacting this issue in any clear direction.

On one hand, you have centralized DNS (based on your ISP). DoH gives you some choice over that now through your browser. On the other, you have only a handful of DNS providers to choose from. DoH is just a technology, there's nothing preventing ISPs from still providing their DNS services over HTTPS.

<comment><USER15> > I don't see DoH really impacting this issue in any clear direction.

See my other posts[1][2] about why DoH explicitly requires centralization.

> you have centralized DNS (based on your ISP)

You might, I don't, because DNS doesn't require that the client delegate recursive resolution to an upstream server.

[1] [https://news.ycombinator.com/item?id=21110296](https://news.ycombinator.com/item?id=21110296)

[2] [https://news.ycombinator.com/item?id=21309811](https://news.ycombinator.com/item?id=21309811)

<comment><USER25> This is a strange definition of decentralization. I suppose it gives you redundancy. But aren't you broadcasting information about your request to multiple parties if you're doing recursive resolution from different providers?

But I agree that this should be a choice on the client-side.

<comment><USER15> (sorry for the late response!)

> This is a strange definition of decentralization.

DNS is - by definition[1] - a distributed database.

        Name servers store a distributed database consisting of the
        structure of the domain name space, the resource sets associated
        with domain names, [...]

> I suppose it gives you redundancy.

The distributed database is about administrative boundaries[2].

        Authority is vested in name servers.  A name server has
        authority over all of its domain until it delegates authority
        for a subdomain to some other name server.

Redundancy in the DNS system is provided by a requirement that at least two authoritative nameservers must be listed when delegating authority to a subdomain.

> But aren't you broadcasting information about your request to multiple > parties

Recursive resolution only involves multiple parties when the authoritative nameserver for a DNS zone[3] isn't known and again when the TTL (time-to-live) for the zone's NS record expires. Once the NS records are cached locally, queries only involve one party. DNS is a very flexible system that is designed to allow queries at any level and easy caching.

Also, consider that TTL for different record types is often very different. The only record that necessarily must be requested from the 2nd-level domain (".com") or other central server (like 220.127.116.11) are the NS records for a zone. Using the IETF's rfc server in [1] as an example, to lookup the A record for "tools.ietf.org", we first (unfortunately) leak information to .org (or 18.104.22.168, etc) to discover the domain's authoritative servers:

        ;; SERVER: 126.96.36.199#53
        ;; QUESTION SECTION:
        ;tools.ietf.org.                        IN      NS

        ;; ANSWER SECTION:
        tools.ietf.org.         1209600 IN      NS      heroldrebe.levkowetz.com.
        tools.ietf.org.         1209600 IN      NS      zinfandel.levkowetz.com.
        tools.ietf.org.         1209600 IN      NS      dechaunac.levkowetz.com.
        tools.ietf.org.         1209600 IN      NS      dunkelfelder.levkowetz.com.
        tools.ietf.org.         1209600 IN      NS      durif.levkowetz.com.

We then cache that locally for 1209600 seconds (14 _days!_ ). While this does leak the fact that you asked about _something_ in the " _.ietf.org " zone to a central server, two (apx) of these requests _per month* doesn't reveal much about your _pattern-of-life_.

The TTLs of A (and AAAA) records tend to be much shorter, sometimes unnecessarily short for better surveillance resolution. In this case, IETF is using a fairly standard 10 minutes:

        ;; SERVER: 126.96.36.199#53 (durif.levkowetz.com)
        ;; QUESTION SECTION:
        ;tools.ietf.org.                        IN      A

        ;; ANSWER SECTION:
        tools.ietf.org.         600     IN      A       22.214.171.124
        tools.ietf.org.         600     IN      A       18.104.22.168
        tools.ietf.org.         600     IN      A       126.96.36.199

For comparison, the A record for graph.facebook.com (their big "analytics"/spyware ingress server) seems to have a random TTL between ~5 and 59 seconds. Thy are effectively forcing a DNS query on every analytics event. That's insane, but my point is that doing the recursive resolution locally means that almost all of those DNS queries are sent to dns.facebook.com _only_. The upstream DNS at the ISP or 22.214.171.124 only gets ~two UDP packets per month. With DoH, all of that still happens, but it has to be routed though Cloudflare first!

[1] RFC 882, page 13, "NAME SERVERS" [https://tools.ietf.org/html/rfc882#page-13](https://tools.ietf.org/html/rfc882#page-13)

[2] RFC 882, page 14, "Authority and administrative control of domains" [https://tools.ietf.org/html/rfc882#page-14](https://tools.ietf.org/html/rfc882#page-14)

[3] From [1], "In general, a name server will be an authority for all or part of a particular domain. The region covered by this authority is called a zone."</comment></comment></comment></comment></comment>


Let's Build a Simple Interpreter, Part 3 - <AUTHOR> http://ruslanspivak.com/lsbasi-part3/

<comment><USER2> It's going to be interesting how this series will expand to more complex concepts of interpreter design, such as grammars, AST's etc. To be honest, right now I'm thinking the approach taken to teach the basics of parsers and interpreters is detrimental to understanding how these things work in the real world.

IMO, it's important to learn about concepts such as regular expressions/finite state machines for lexers, grammars, lookahead, recursive descent, etc. for parsers first, before diving into code and writing a ghetto-lexer and a linear parser with hard-coded rules and trying to build from there. At some point when you really want to parse and interpret Pascal (which is what the first article in the series mentions as the ultimate goal), you will have to forget about everything the naive code did, and throw away all the code, because you're not going to be parsing any 'real' Pascal code the way the toy examples work right now.

Not saying this to talk down the author's effort, because it's an interesting topic and I assume all these things will be addressed in later posts. I just wanted to point out to people who want to learn about parsers and interpreters, that the approach the toy interpreter in its current form will not scale to a real interpreter that can parse something like Pascal code.

<comment><USER3> The hardest part for most people is understanding how these things even work in the first place. Use simple methods to teach the concepts. Sure you throw away those simple methods, but by understanding the core concepts, the learner can grasp the more advanced methods.

</comment></comment><comment><USER4> Recursive descent is a very elegant and simple algorithm, which is quite easy to understand even without going deep into language theory. Deriving precedence climbing from it is also not difficult:

[https://www.engr.mun.ca/~theo/Misc/exp_parsing.htm#more_clim...](https://www.engr.mun.ca/~theo/Misc/exp_parsing.htm#more_climbing)

Precedence climbing is an even more elegant and simpler solution to multiple precedence levels, allowing things like this:

[https://news.ycombinator.com/item?id=8558822](https://news.ycombinator.com/item?id=8558822)

</comment><comment><USER5> I'm reading "Programming: Principles and Practice Using C++" and one of the first programs illustrated is actually a calculator. Being new to parsers in general, I love to see how two different approaches work: in the book the author implements the code by creating a formal (BNF-like) grammar first whereas in this articles the author draws diagrams first.

<comment><USER6> In case you didn't know yet, a BNF grammar always is a graph. So the diagram is just a different way of depicting the same thing.

For example, the (E)BNF¹ for the graph in the article is:

      expr = term { ("+" | "-") term }

where the accolades indicate zero-or-more repetition.

This actually is important because if your grammar can be written down as a graph it means it is a _context-free_ grammar².

Parsing is a wonderful subject to study thanks to the depth of the subject and the breath of texts available explaining it. Have fun!

¹) [https://en.wikipedia.org/wiki/Extended_Backus%E2%80%93Naur_F...](https://en.wikipedia.org/wiki/Extended_Backus%E2%80%93Naur_Form)

²) [https://en.wikipedia.org/wiki/Context- free_grammar](https://en.wikipedia.org/wiki/Context-free_grammar)

<comment><USER5> I honestly didn't know! Thanks for the pointers!

</comment></comment></comment><comment><USER7> Lisp / CLOS version of the code:

[https://gist.github.com/lispm/cb1e1c9fc75ad34624ed](https://gist.github.com/lispm/cb1e1c9fc75ad34624ed)

        CL-USER 72 > (calc)

        calc> 3+3+9
        15
        calc> 3*3

        Error: parse error getting next token
          1 (abort) calc toplevel
          2 Return to level 0.
          3 Return to top loop level 0.

        Type :b for backtrace or :c <option number> to proceed.
        Type :bug-form "<subject>" for a bug report template or :? for other options.

        CL-USER 73 : 1 > :c 1

        calc> 10
        10
        calc>
        NIL

</comment><comment><USER8> It's of course a bit far fetched, but it would not be particularly hard to convert the interpreter to RPython and get performance/JIT for free</comment>


Seeking alpha testers for Group Communications platform - <AUTHOR>

I'm a solo developer who often uses group chat tools.  Frustrated by the limitations of products from other startups in this space, I've come up with my ideal group communications platform.
Fluid interaction with multiple groups, both public and private along with a simple person to person messaging system makes this one of the easiest to use messaging systems.
As with most others in this space; historical data, search functionality, image/file uploading, and audible notifications are included.
The website is functional, however there is still some tweaking that needs to be completed.  I'm at a very early alpha stage on the iPhone app with it only running on my personal phone.
I'd also like to hear from any designers interested in joining the project.
My gripe on others in this space:
Yammer:
  1. only communications in same url domain - fatal flaw
  2. very slow, using the iPhone app, the website, and the Air app it would take up to 2 minutes to get a new message - this is not usable in a chat situation
  3. no location service
GroupMe:
  1. required sms signup (at least from iPhone app)
  2. no group search or historical data
  3. limited functionality on the website version, really not suited for a team working together on a project
  4. no stream, no feed, less than ideal for many groups
Beluga:
  1. no group search or historical data
  2. limited functionality on the website version, really not suited for a team working together on a project
  3. no stream, no feed, less than ideal for many groups
Campfire:
  1. $COST
  2. no stream, no feed, less than ideal for many groups
  3. no public groups
  4. no location service
As such, my feature list beyond the basics became:
1. no $cost, free service 2. no sms requirements 3. website and mobile apps fully functional 4. a feed for all messages 5. public and private groups 6. direct user to user chat 7. smart notification system that gets a users attention when he or she is offline and a user is trying to contact them 8. ability to share location with friends
One exciting conclusion I drew from this is that with public groups you can actually have public value.  This is a major hurdle for other startups in this space providing a free product.  If all communications are private, any value derived from the overall knowledge of your userbase is effectively worthless.
You may ask what purpose a public group would serve, my best response would be that of IRC for any developers.  Join Freenode #mongodb and you'll find a room full of experts ready to help.  Now imagine this in Twitter like fashion, along with being publicly searchable simply from a website or api.
Groups don't have to be just for nerds!  There's no reason you wouldn't see a public group pop up for the local farmers market.
Another important part is the social aspect, once again with private groups and data you lose a real value of social... social sharing.  I've built in friendships and recommendations based on common groups.  If you aren't in a public group that 10 of your friends are, you should know about it!
Easily share interesting groups via email, twitter, fb and so on.  Find your friends from other services that are also users.  The service automatically builds an address book of your friends so you can chat with them in the future.
So take any group chat app, add the feature list I just laid out, then tack on a public groups feature and a social layer.
I'm looking for alpha testers, I've got this built and fully operational on AWS w/ mongodb & php.  What would be spectacular is to find a few groups of people with the need to chat regularly!
If you're interested, please send me an email: andrewhodel_at_gmail.com
I'll get you setup with an account on the service. <comment><AUTHOR> One thing I'd like to mention, keep in mind this is ALPHA. Things change every day as I'm working on it.

I work on this project at least 5-6 hours a day and I'm online on the service all the time. I look forward to chatting live on the service with any testers as we improve the product!

Thanks

</comment><comment><USER2> I am interested in testing the app. Is it somewhere on the web? A link to the service with self registration would be helpful.Anyway,I am sending you an e-mail.

<comment><AUTHOR> Got your email and replied with your login information, thanks!

<comment><USER2> Thanks. Tested your application and posting my suggestions here :

1\. On accepting your friend request, it it displaying an error - "user doesn't exist". 2\. The header of upload file box with a + sign creates confusion that it is the button to upload file. I guess the + sign should be removed and height of header should be small. 3\. The timestamp in the messages are too small to read. 4\. The messages aren't sorted according to time. 5\. Design needs much improvement. Right now it is just barebones kinda design. Proper colour scheme and typography will do wonders to the sight appeal. 6\. The image when uploaded appears blurred and resized. 7\. Use only one button for upload(like gmail attachments)

<comment><AUTHOR> Thanks for the response, all except #5 have been resolved. I'll still be looking for a designer to help with that.

Thanks Again.</comment></comment></comment></comment>


WeChat confirms it makes all private user data available to Chinese government - <AUTHOR> http://www.moneycontrol.com/news/business/companies/wechat-confirms-that-it-makes-all-private-user-data-available-to-the-chinese-government-2391847.html <comment><USER2> The Chinese government would not allow WeChat to exist if this weren't the case. They already have a difficult job managing Tencent, which is arguably China's second in command after the Party. You don't get that big without some serious concessions.

I use WeChat every day, but I hesitate momentarily before writing anything negative about the Chinese Govt... just in case.

I suppose they've done their job.

<comment><USER3> Indeed. They don't need to restrict speech or monitor much, when they've convinced people to censor themselves. If I lived in an area that was repressive, I'd probably make sure I never said anything bad about the government.

One of the things I like about my country is that I can call my government out when they make bad choices and I can even organize a protest to show my displeasure.

<comment><USER2> As an Aussie, I don't necessarily want to overthrow my government (what's a circus without the clowns), but I do like the fact I can safely voice my displeasure if and when I feel it's useful.

Having moved to Taiwan after spending many years in Beijing, the feeling of a weight being lifted off is palpable. I don't miss those towering windowless soviet-style government building one bit.

<comment><USER3> I have traveled a great deal and seen some pretty oppressed people. I can live most anywhere and one of the reasons I choose to live here is because I am not oppressed here.

Like you, I have no desire to overthrow my government. I do like to complain about then, however.

As for living somewhere oppressive, I don't think I'd do well in a place where I was hopeless. I'd probably end up being a dead revolutionary, just because I would have wanted to feel hope.

</comment></comment></comment></comment><comment><USER4> Here is the Amnesty International study mentioned in article - [https://www.amnesty.org/en/latest/campaigns/2016/10/which- me...](https://www.amnesty.org/en/latest/campaigns/2016/10/which-messaging- apps-best-protect-your-privacy/) Also posted here [https://news.ycombinator.com/item?id=15314670](https://news.ycombinator.com/item?id=15314670)

Tencent WeChat QQ 0/100\. Hopeless.

</comment><comment><USER5> What about the Kik messenger that has a large investment from Tencent, the creator of WeChat?

[https://en.m.wikipedia.org/wiki/Kik_Messenger](https://en.m.wikipedia.org/wiki/Kik_Messenger)

 _Company CEO Ted Livingston stated Kik 's aspirations to become "the WeChat of the West" and said that attracting younger users was an important part of the company's strategy_

<comment><USER6> It's very unlikely that the Chinese government can force Kik to share data through a minority investment from Tencent. Their power is limited to behind their great firewall.

I also find it inconceivable that Ted @ Kik would do this. Disclosure: I've known him for years

</comment></comment><comment><USER7> Working link:

[http://www.moneycontrol.com/news/business/companies/wechat-c...](http://www.moneycontrol.com/news/business/companies/wechat- confirms-that-it-makes-all-private-user-data-available-to-the-chinese- government-2391847.html)

<comment><USER8> Thanks, we've updated the link from [http://www.moneycontrol.com/news/business/companies/wechat-c...](http://www.moneycontrol.com/news/business/companies/wechat- confirms-that-it-makes-all-private-user-data-available-to-the-chinese- government-2391847.html/).

</comment></comment><comment><USER9> Some time ago, I wechat messaged a link to a domain I just registered. I had the Apache access log open by chance and could see that along with my friend visiting the link, there were numerous other devices accessing it. From the IP, I could tell they were mobile phones from the same city I was in and a big city nearby (in China).

Could be interesting to make a more "controlled experiment".

<comment><USER10> All links sent through Wx are crawled by a communist program looking for reactionary sentiments

<comment><USER9> Yes, I imagine they are. The devices visiting the link were mobile phones however (I remember seeing a Samsung phone specifically). Maybe the crawler is posing as random device models.

</comment></comment></comment><comment> EZ-E The police HAS direct access. The group chats in particular are monitored. One recent story is that a man criticized police for, doing random alcohol tests on car drivers. Got arrested along with the group chat admin

</comment><comment><USER11> Wonder how their surveillance infrastructure works. Do they duplicate all data and pipe it into some government datacenter? Or do they have some surveillance boxes installed on-site that just scan the data for certain keywords (like the NSA supposedly often did it)? Maybe the latter seems more likely since filtering the data first makes the overhead more manageable.

<comment><USER12> Probably the same way Facebook makes data available to LEOs. There's a portal for that. They upload the warrant, they then get access to stuff.

WeChat simply skips the warrant checking and request scoping.

<comment><USER13> It is worse in that any random local official has full access. There was a huge scandal a while back where a Hainan local official was paid off to make negative comments go away for a bunch of private businesses.

</comment></comment></comment><comment><USER14> Is this surprising? I've known for a long time that WeChat chats and data could be read by the Chinese government, given that they censor the chats in real time and the close ties between Tencent and Beijing. I guess it's nice to be confirmed but it was already a given considering it's a Chinese company.

<comment><USER15> > given that they censor the chats in real time

I've never used WeChat, that's interesting to me. How does the real-time censorship work exactly? If I attempt to discuss the Tiananmen Square massacre, would that chat message be instantly 'deleted' after sent (in however much time it takes for them to screen the message that is), something akin to that?

<comment><USER16> I'd assume it's keyword based.

<comment><USER13> Ya, one major part of Chinese internet culture is making up new words to describe things whose normal words are harmonized (censored).

</comment></comment></comment></comment><comment><USER17> I had to install WeChat for work. What bothered me more was all the permissions it required to function. As I recall, it wanted access to my contacts, pictures, location. At each request, I tried saying no, and the app exited.

I assume the Chinese government got access to all my contacts, pictures, etc.

I really wish that apps were required to function in gracefully degraded modes when denied access to permissions they want. And I wish they had to explain each request.

<comment><USER18> > At each request, I tried saying no, and the app exited.

That's not true for the iOS version.

</comment></comment><comment><USER19> Governments like these should be destroyed, completely and immediately, forever.

<comment><USER20> They've anticipated that sentiment by, you know, holding all the guns, bombs and stuff.

</comment></comment><comment><USER21> Looks like this isn't new, actually:

[http://technode.com/2017/09/19/now-its-official-wechat-is- wa...](http://technode.com/2017/09/19/now-its-official-wechat-is-watching- you-1/)

Apparently the mainland China version of the app lets you continue using it without providing certain info; this is now in its privacy policy (technode translation):

"Unless it's required by relevant laws, your objection in providing this information will block the feature concerned, but will not influence the usage of other features."

</comment><comment><USER22> This has been known for some time. Some of my best friends on WeChat are Chinese government officials.

</comment><comment><USER23> This highlights why US-based companies, while not perfect, are far more preferable to Chinese companies for storing your personal data.

<comment><USER24> If you're American that is. If you're a foreigner US companies are not far from Chinese.

</comment></comment><comment><USER25> I'm glad we cleared the air on that. Now we can go back to using the service without all the stupid conspiracy theories that they do this. Surveillance is the norm in China. They do the same thing with IP from foreign firms [1].

1 - [http://money.cnn.com/2017/08/14/news/economy/trump-china- tra...](http://money.cnn.com/2017/08/14/news/economy/trump-china-trade- intellectual-property/index.html)

<comment><USER26> Lenovo is a Chinese company. I'm typing this from a Thinkpad. Would it also be the norm for Lenovo to collect/share information from my laptop with the Chinese government?

<comment><USER27> Isn't lenovo the one that got caught putting spyware in the bios?

<comment><USER28> Not really spyware in bios, more like acpi data, that when detected by windows, gets auto executed by windows

</comment></comment></comment></comment><comment><USER29> Link is broken.

</comment><comment><USER30> I thought that it was talking about WeeChat (the irc client) for a moment.</comment>


Freakonomics: Quantifying Teacher Effectiveness? - <AUTHOR> http://freakonomics.blogs.nytimes.com/2010/01/08/quantifying-teacher-effectiveness/

<comment><USER2> Interesting and lively HN thread on the actual Atlantic article:

<http://news.ycombinator.com/item?id=1036509>

</comment><comment><USER3> Great video on how a pretty good teacher (as conventionally measured) learned how to _really_ teach.

<http://www.youtube.com/watch?v=WwslBPj8GgI>

titled: Confessions of a converted lecturer.

</comment><comment><USER4> Honestly, the really big factor in teaching effectiveness is the parents. If a kid is living in a household with dysfunctional or drug-addicted parents who don't give a damn about school, then with rare exceptions it doesn't matter how good the teachers are.

<comment><USER5> [citation needed]

<comment><USER4> [http://www.hfrp.org/publications-resources/browse-our- public...](http://www.hfrp.org/publications-resources/browse-our- publications/family-involvement-makes-a-difference-in-school-success)

<comment><USER5> _Family involvement helps children get ready to enter school, promotes their school success, and prepares youth for college._

That's a very different thing from what you claimed (which is that family involvement is the end-all of education). Clearly families make a difference, but they're far from the _only_ factor, and the summary there certainly doesn't support the claim that it's impossible to succeed without good familial support. Education is a complicated thing where a lot of things matter.

</comment></comment></comment></comment><comment><USER6> The interesting part isn't what makes a great teacher, which is largely intuitive. The part I want to know about is how to produce and reward those effective teachers systematically.</comment>


EC investigates Germany's 'vectoring' copper-network plans as uncompetitive - <AUTHOR> https://thestack.com/world/2016/05/10/european-commission-deutsche-telekom-investigation/ <comment><USER2> The technology seems interesting, but I can't find any more or less technical information about it (nothing more than a few lines introductory lines). Links, anyone?

<comment><USER3> I think it's this technique [http://www.broadband- forum.org/marketing/download/mktgdocs/M...](http://www.broadband- forum.org/marketing/download/mktgdocs/MR-257.pdf) The full specification should be this [http://www.itu.int/rec/T-REC-G.993.5/en](http://www.itu.int/rec/T-REC-G.993.5/en)</comment></comment>


Securing the Internet with DNSSEC - <AUTHOR> http://www.cyveillanceblog.com/general-cyberintel/dnssec

<comment><USER2> It would be nice if dns would tell us when the dns routing has been tampered with and or censored. We won't be able to stop governments from routing legitimate requests to dev/null, maybe we can at least deliver a report to the requester: "this request was blocked by government xyz, here is the traceroute and details on the cancerous growth in the tubes."

<comment><AUTHOR> Providing that kind of assurance of integrity is precisely what DNSSEC is designed to do. With the signatures and "chain of trust" a DNSSEC-validating DNS resolver could determine whether the DNS info has been tampered with and provide that feedback back to an application. Now, how the application might choose to present that info is a different question... and could, in fact, offer creative error messages like the one you wrote.

<comment><AUTHOR> On that topic of the user experience, you might also be interested in the post I wrote about that question:

[http://www.internetsociety.org/deploy360/blog/2012/01/what-i...](http://www.internetsociety.org/deploy360/blog/2012/01/what- is-the-correct-user-experience-for-dnssec-in-a-web-browser/)

which did get some discussion here on HN:

<http://news.ycombinator.com/item?id=3435143></comment></comment></comment>


Create a knowledge base out of your work email easily - <AUTHOR>

Our tool http://grexit.com lets Google Apps users create a knowledge base out of their day-to-day email communication.
Why GrexIt?
You have lots of email discussions at your workplace. A good number of those might be of a lot of relevance to people who were not a part of the email discussion. Some quick examples:
-  You posted a question to a few of your colleagues. You got some responses, and after a few emails on the thread, you got your answer. This answer might be of relevance to many other people at your workplace who might have the same question that you had.
-  You are working on a project and using email heavily to discuss key matters on the project. A new member joins the team, and needs to have access to all these email threads.
-  You found a link on the internet that you think your colleagues can use. You forward this to your immediate peers over email, but do not want to send it to everyone as they might not need it immediately, and might consider the email to be spam.
All this is useful knowledge hidden in your inbox, which can not be useful to others, and might probably die in your inbox. GrexIt solves this problem by letting you add content from your inbox to an online shared repository, which anyone from your workplace in need of information can access. You can do this using our very intuitive and easy to use browser plugin. Effectively, GrexIt is a very simple tool to let out knowledge that might be trapped inside your email inbox, and open it up to a wider audience which might need it.
Would love it if you could try GrexIt out and let me know what you think about the tool. <comment><USER2> Clickable: <http://grexit.com>

<comment><AUTHOR> Thanks :)

</comment></comment><comment><USER3> Why is this not on the Apps Marketplace? <http://www.google.com/enterprise/marketplace/>

<comment><AUTHOR> We're working on a contextual gadget. It would be up on the marketplace in around 2-2.5 weeks.

We built the DOM scraping+manipulation version first, as it gives us more flexibility with the placement of the "Send to GrexIt" and the search area.

Hope you try it out.</comment></comment>


My poor use of golang's defer woke me up - <AUTHOR> http://blog.daemonl.com/2014/06/my-poor-use-of-golang-defer-woke-me-up.html <comment><USER2> Never delete code. This is why you have git or svn, or whatever your tool of choice is. Never, ever delete code. You may think it's dumb, you may think it's crap, or useless or whatever, but in 2 years, you'll think. "Damn, I remember doing this already, don't I have some code in somewhere?" And you will.

You may look at it and rewrite huge chunks because you're a far better programmer now, but trust me, re-writing code is _way_ easier than writing it from scratch

<comment><AUTHOR> Yep. I know. I even deleted the github repo. I'm seriously not sure what I was doing. Remove all traces of a bad idea?

<comment><USER3> Ouch, why on earth...

Anyway, good blog post.

</comment></comment></comment><comment><USER4> > [...] sudo less /var/log/upstart/app.log, 99999... oh, this log ACTUALLY has > 99999 lines. Waiting, Waiting (note to self: google the command to jump to > the end, there must be one).

G (as in shift-g) jumps to the end of the file in less. Or use tail instead.

<comment><USER5> If things are configured correctly the 'end' key on the keyboard will do that too.

Also, less has build in help if you press 'h'.

</comment></comment><comment><USER6> I've been bitten by similar complexities around indirectly managing the database connection pool in Go, too. There might be a little too much magic in the library (such as successfully iterating to the end of a resultset implicitly releasing the results).

<comment><AUTHOR> That one I'm still not clear on. I _THINK_ I should be closing that particular rows set already, the SQL is LIMIT 1 and I check if !rows.Next(){return ...}, yet... here we are :-)

</comment></comment><comment><USER7> > In my haste, I'd not noticed, I'm queueing up all of my rows close > statements for the function end, which happens after the for loop, which > opens way more than the allowed connection limit (about 100 in this case).

Here I thought this was going to be about defer and how it is error-prone compared to RAII and how it is a modern-day alloca with the same type of scope problems, like being unsafe to use in loops, and how it has a weird order of execution with arguments being evaluated immediately and statement evaluated later on.

Instead it's just about having poor project management. A missed opportunity I guess.

<comment><AUTHOR> Or... lack of project management.

There is definitely something to be written on that, but - well I'm not the guy. Yet.

</comment></comment><comment><USER8> There are a couple of good resources you can use here, the first is just about the best reference for using Go with a RDBMS:

[http://go-database-sql.org/](http://go-database-sql.org/)

The second speaks of database connections:

[http://jmoiron.net/blog/gos-database-sql/](http://jmoiron.net/blog/gos- database-sql/)

The general approach:

1\. Use a single DB connection, it will pool automatically

2\. Use this pattern for all single row queries:

        err = db.QueryRow(`...`, ...).Scan(&...)
        if err == sql.ErrNoRows {
        	// Handle no rows
        } else if err != nil {
        	// Handle actual error
        }
        // All fine

3\. Use this pattern for all multi-row queries where you want to return a slice of structs containing the row values. Note that it is fine to call rows.Close() as soon as possible in addition to deferring it, defer takes care of handling it whenever something goes wrong and the explicit call returns the connection as soon as possible:

        rows, err := db.Query(`...`, ...)
        if err != nil {
        	// Handle connection or statement error
        }
        defer rows.Close()

        things := []rowStruct{}
        for rows.Next() {
        	thing := rowStruct{}
        	err = rows.Scan(
        		&thing.id,
        		&thing.value,
        	)
        	if err != nil {
        		// Handle row parsing error
        	}

        	things = append(things, thing)
        }
        err = rows.Err()
        if err != nil {
        	// Handle any errors within rows
        }
        rows.Close()

4\. Use transactions as serial things, if you need to call another query whilst in a loop where you can't rows.Close(), then read the rows into a slice and range over the slice. You must _never_ have two queries running in the same transaction... so code to do one thing before you do another, and be mindful of this if you are passing the transaction to other funcs.

An extra bit of info:

5\. defer doesn't just have to be used to call rows.Close(), if you want to know when things happen you can wrap the defer and log:

        rows, err := db.Query(`...`,...)
        if err != nil {
        	// Handle connection or statement error
        }
        defer func() {
        	log.Println(`Closing rows`)
        	rows.Close()
        }()

On which point, beware there are some theoretically uncaught errors, for example tx.Rollback() can return an error [http://golang.org/pkg/database/sql/#Tx.Rollback](http://golang.org/pkg/database/sql/#Tx.Rollback) but if you have called it using defer tx.Rollback() after creating a transaction you'll never know. I _hope_ that the only reason that might error is that something has already ended the transaction, but there is definitely scope for deferred finalisation within a func to cause errors that you might miss and it's worth considering the pattern above if you have any mysterious behaviour going on.

<comment><AUTHOR> That's really detailed feedback, thanks for that!

I'm actually fighting with some interesting things now with error handling, I wan't aware I had to do my own retry on deadlocks.

Ugh, it's just one of those days I feel like I'm not as good at this as I thought I was.

<comment><USER8> If you know where the deadlocks are likely to occur, consider turning to a sync.Mutex and wrapping the statement in a lock. It will cause other goroutines to wait until the lock is free.

It all depends where the deadlocks are though, you can easily achieve them in the Go code as well as the database queries.

I'm not around much today as I'm with a client this morning and lunch, but if you're stuck later I may well be in [https://gophers.slack.com/](https://gophers.slack.com/) . Happy to help out if I can, as I'm sure most others will be.

</comment></comment></comment><comment><USER9> Is there a club for people like us? I, too, do a bunch of work at two startups. I'm in the same exact situation, in fact.

Thanks for sharing.

<comment><AUTHOR> We could start one?

I think that's what HN kind of is...</comment></comment>


Why Every Analyst Should Learn To Code - <AUTHOR> http://www.marginhound.com/why-every-analyst-should-learn-to-code/

<comment><USER2> Better to have every programmer learn to be an analyst. Practically any project could survive if the analyst was fired and the programmer had to pick up the slack, but the reverse is not true.

<comment><USER3> In big corporations the opposit might be true. Programming is outsourced and analysts are driving the decision-making (in the best case). The point with the programming skills stays, though. To me it seems there exists a whole corporate ecosystem with analysts who can't code and the managers around them who do not ask tough questions. It is even hard to get scored there if you can and want to code and generally to dig deeper, because it bothers them.

</comment></comment><comment><AUTHOR> Ah... but I'm trying to lure them _into_ the fold, so they will become... programmers? :)</comment>


Exploring the ClojureScript REPL - <AUTHOR> http://www.alexeberts.com/exploring-the-clojurescript-repl/

<comment><USER2> Along similar lines, I've found the figwheel[1] project to be a huge boon to my productivity.

[1] [https://github.com/bhauman/lein- figwheel](https://github.com/bhauman/lein-figwheel)</comment>


EHow goes to Facebook registration and login only. - <AUTHOR> http://ehow.zendesk.com/entries/404509-if-i-m-not-a-member-of-facebook-can-i-be-an-ehow-com-member

<comment><USER2> If Facebook dies, ehow loses all user logins, smart?

</comment><comment><AUTHOR> Seems that it will bring a lot of spam to fb.

</comment><comment><USER3> In this case I'm going to call it an admission of incompetence. Best to head that bad boy off at the pass.</comment>


Ask HN: Is there a study that proves that older software is more expensive? - <AUTHOR> <comment><USER2> Im not sure how you would prove that

I worked on an old Java system for a few years. They have attempted to replace the system a few times - but each time these projects have failed at great expense, while maintaining the old system is costing a fraction of the cost of replacement

You also see this with the old cobol systems. One thing you find with cobol developers is that they roll their eyes at the next attempt to replace the system as they know it will ultimately fail. Thats why these systems are still around</comment>


Ask HN: Framework for REST - <AUTHOR>

Can anyone recommend a good framework for a simple REST service with JSON? I know PHP, Python, Ruby and JavaScript (not a big fan of Node, though).
What I'm looking for is a framework that is fast and simple and preferably isn't bogged down by a lot of code aimed at outputting HTML, since I'll only need JSON.
I'm going to use the REST service in connection with single-page apps built with AngularJS. <comment><USER2> I've had a lot of luck writing RESTful JSON APIs for mobile Apps with the Slim Framework [PHP]... lightweight and easy to use

<http://www.slimframework.com/>

<comment><AUTHOR> What do you use for database access? It doesn't have a built-in ORM like many of the other frameworks, as far as I can see.

</comment></comment><comment><USER3> Sinatra is great for simple REST APIs. Throw in ActiveRecord (or DataMapper, but I prefer ActiveRecord's migrations), and RABL and it would be perfect for making small APIs for single-page apps.</comment>


Howard Dean: How to Move Beyond the Two-Party System - <AUTHOR> http://www.nytimes.com/2016/10/08/opinion/howard-dean-how-to-move-beyond-the-two-party-system.html <comment><USER2> This would work well....until the Republicans start winning. Then the Democrats will somehow deem it unfair.

It might make it somewhat easier to vote third-party, but the main reason third-party candidates don't win is because they just don't have enough support. Usually because they either don't have enough cash, connections, or have views that are too esoteric.

It's the same reason why Walmart is the most popular, but your favorite, better, local store is always scraping by.

It will also mean that third-party candidates can now be used as a tool to get main candidates elected. They will be controlled.

</comment><comment><USER3> Had to login for this one.

I've seen something remarkable this year and I can't shake it. We have a core fault line between those of means and those of little or no real means.

Money has a grip on our politics too. Many, and I submit a majority, are not OK with that.

However, we have the system we have, and reforming it takes working with that system to improve it. It's not like we can just reset.

This year, a lot of us pooled our money and dropped just south of a quarter billion large on the idea of better politics. And it almost worked!

For sure, it gave us a lot of data on what ideas resonate, where they win, etc... Over 60 percent of that funding came from people who are on a fixed income or who currently are living at poverty level income too. This is notable.

From where I stand, the answer to the two party system may well be to bind along money lines. Say we do that again, and another roughly quarter billion is made available for the mid-term elections.

In rough terms, that is enough money to fund up to a few hundred races for Congress! If those races are run, those who fund them may well win half! A third is very plausible at a minimum.

Perhaps the right answer here is to just compete full on. Post up the dollars, build out infrastructure, organizations ( some in progress now), advocacy / think tank type resources, and centralize things like production, copy, ADS, and other tools.

If it were me, I would definitely point some of that money at a voter contact system that exists apart from the party owned / establishment systems in place today.

I also saw corruption runs very deep and broad in our government. It's more than I realized.

So we run those races, and run on common ideas we know are winning ideas. We know that from the data we have so far. And we win what we win.

From there, we will have secured some real power and leverage that can compete with and participate on a peer basis with the powers that be today.

Say, we extend that just a bit further and keep it running on people money. When our people win, and I'm using "our" here in the general "people who supported Bernie" sense, we continue to fund them, and a part of that is doing the work to secure their own local funding for the longer term.

Have you guys watched John Oliver on Congressional Funding? You should.

[https://youtu.be/Ylomy1Aw9Hk](https://youtu.be/Ylomy1Aw9Hk)

The trick here seems to be to avoid that mess. When our people aren't in that call center, they can be out and among those who elected them, present. This will present a nice contrast to the mess we have today.

And when those people win, they can form a bloc, caucus, or perhaps faction within, or maybe even across the two parties, in essence, presenting as a third with far less risks.

What may come from that is change, and or marginalization and take over of one party, or perhaps both.</comment>


Rook: Opne Source Cloud-Native Storage Orchestration for Kubernetes - <AUTHOR> https://rook.io/ <comment><AUTHOR> Intro to Rook from KubeCon 2018

[https://www.youtube.com/watch?v=pwVsFHy2EdE](https://www.youtube.com/watch?v=pwVsFHy2EdE)</comment>


Let's Take This Offline - Dive Into HTML 5 - <AUTHOR> http://diveintohtml5.org/offline.html <comment><USER2> I can see the possibility of a framework to take away the complexity of the manifest and the online/offline status - but this is most definitely the basis of webOS, or something very similar.

"Downloading an app" is simply going to the web page when you are online initially, and then adding a (possibly automatically) shortcut to the "desktop."

<comment><USER3> > "Downloading an app" is simply going to the web page when you are online > initially, and then adding a (possibly automatically) shortcut to the > "desktop."

FWIW, that's also what you do to pull a web app locally with an iPhone (+ then "Add to Home Screen").

Issue is that _there is no visible indication that a webapp can be used locally_ (as far as I've seen anyway). A nice demo has been glyphboard (<http://mrgan.com/gb/>) which, when locally installed, provides an app with various "rare" unicode characters (☃, ♪ or ☮ for instance) which you can copy/paste into some other application, but when getting on the original page, nothing in the phone's UI itself tells you there is a local component, the site itself has to point it out.

Another thing I'm not too sure about is the updating: according to the dive page, when the browser encounters a manifest of an (locally) existing application, it checks if that manifest is younger than the one it already has. But if what we're opening is the _local_ applications, does it try to check the remote manifest or not? It does seem that the local Glyphboard accesses the original website when I open it (or tries to anyway) according to the iPhone Simulator, but is it how it's supposed to do?

<comment><USER2> These are all technical points that, while perfectly legit, are smaller than the problem at hand.

It doesn't really matter if you know its "online" or "offline", because thats as easy as a status indicator. It doesn't really matter what the manifest logic is from this high of a level - that can be ironed out.

It would be my intuition to say its more important to get a prototype working (ala WebOS/iPhone) for insta-downloaded-web-apps and see what the actual problems are technically, and for the users, before speculating what could slow us down before we even begin.

<comment><USER3> I don't think the UI issue of knowing whether a web application can be locally installed is a small oner no. It is in fact a huge one, especially in the light of most users not being aware this concept is even possible. It's also not very technical at all.

And the issue of update is also an important one, users have been taught that new versions just happen without having to do anything, it's vital that local web applications behave correctly for that as well.

> It doesn't really matter if you know its "online" or "offline"

I don't think I said anything about on/off line, did I?

> It would be my intuition to say its more important to get a prototype > working

What prototypes? Local web applications work right now on all three modern, webkit-based mobile platforms. The problem is very much the first one I pointed out, namely how does the user know that he can _install_ a web application.

</comment></comment></comment></comment><comment><USER4> 45 points and no comments?

I've been playing around with html5 local storage, and it's kind of cool for speeding up some operations by caching data that is frequently used, but like any caching, expiration is still potentially tricky.

Also, the really hard and awesome part for me is syncing/merging online- offline - a standard(s) solution for that would be a real killer app enabler. (Because we all are not online 100% of the time, even if only due to spotty reception or on planes, and it sucks not to be able to access your data).</comment>


Assessing a Company: Questions you need to ask in an Interview - <AUTHOR> http://blog.interviewstreet.com/2011/12/assessing-a-company-questions-you-need-to-ask-in-an-interview/ <comment><USER2> Interviewers do "leak" information to interviewees. I once turned down a lucrative job offer because, during the interview, the interviewer had told me "hilarious" anecdotes about the CEO changing his mind every few days.

Here's a more technically-slanted list of questions I've used during interviews: [http://www.reddit.com/r/programming/comments/apae9/interview...](http://www.reddit.com/r/programming/comments/apae9/interviewing_for_a_programming_job_does_anyone/c0iqgve)

</comment><comment><USER3> I've found a lot of companies don't like giving feedback of negative outcomes for fear of opening themselves up to some sort of liability around discrimination.

Realistically it shouldn't be a problem if they handled the interview correctly, but some prefer not to take the risk.

<comment><USER2> > I've found a lot of companies don't like giving feedback of negative > outcomes for fear of opening themselves up to some sort of liability around > discrimination.

In itself, this is a useful indicator of corporate culture.

<comment><USER4> Very valid point. Whilst it's not necessarily indicative of a 'bad' company as such, anyone who refuses feedback as a matter of course is generally a company driven by compliance. not always a good thing.

</comment></comment></comment><comment><USER5> This is a really good starting point. Questions can obviously go deeper, relative to the particular industry, to learn more about a company. The main point is not only the information you get, but gauging responses to those questions.

If you're being interviewed, turn yourself into the interviewer at this stage. Be prepared -- take notes, bring materials from the website or other content to reference during the conversation, and have your questions planned out thoughtfully ahead of time.

Generally, a recruiter is not the best person to ask questions, though. Try to ask questions to the hiring manager. Strive to learn the organizational/corporate pain points. Ask questions to gain information, but also to get beyond understanding "culture" to understanding biases and preferences. Rarely do interviewers make that clear, in spite of the intentions of their communication.

Last, one general comment about questions: if they can't be answered to your satisfaction, mark it as a red flag. If you, the candidate, can think about something in the short term and a business that's focused on that thing can't or won't respond in a way that's clear, that should be a clear indication of a problem.

</comment><comment><USER6> This is a fantastic guide that I think anyone thinking of working at a startup should read. There is far too much hype, personality and gimmickry it seems around startup hiring much of the time.

We're interviewing lots of folks these days and here are some more questions I think candidates should ask or which we've been asked which I appreciate:

1\. How many months (or years) of cash do you have in the bank?

The founder might not say the exact number of dollars, but they should be willing to give you a # of months/years left esp if they're not revenue generating and are reliant on other people's money (VCs, angels). If it's 3 or 6 months, I'd think twice as there are no guarantees of funding being raised and do you really want to be job-seeking in 3 or 6 months or get laid off cuz of the Last In, First Out principal? There are no guarantees of more money being raised. Plus they might be exaggerating about how much they actually have. If I were a candidate, I'd love to hear 2 years but 1 year at a minimum. 2 years only happens generally if the business is real (making revenues/profits)

Clarification: On the money in bank question, you're looking for real money in the bank now. Not what they expect based on their projections or if they land that big customer they are "on the verge of landing" or the "we have termsheets from investors and will be closing in the next few weeks" -- none of those are money, they are promises/hope. So perhaps the better way to ask this is "If you earned no more revenue or got more financing after today, how long will the money you have in the bank today last the company?" -- Also, this is a question you should only ask of a founder, CEO as they'll prob be in the best position to actually answer it.

2\. What specific projects do you see me working on if I were to join?

This may in all likelihood change by the time you join, but they should have a clearly defined plan for the areas your talents and skills be used. This will help give you a sense for what you'll be doing as well and whether it's interesting. I also think if they articulate some nasty, unpleasant work you'll be doing, that is good as well. Jobs are rarely all rainbows and butterflies so someone who is going to be honest with you about the good, bad and ugly up front is probably better than someone trying to sugarcoat up front with all the amazing stuff you'll be doing every day to "change the world and make people's lives better."

My only comment on the post is the question about "What technologies do you want to be utilizing?"

Technology enables solutions to problems. So whether some company is adopting some new, shiny technology is less relevant than whether they're using technology in a way that is solving a real problem and ideally becoming a real, fast-growing business.

I think the better question is to somehow gauge their receptivity to being flexible about technology if there is a real benefit to doing so. Not sure the right question to test for "technology rigidity" but that is the question I'd ask if I were a candidate talking to us or any startup.

<comment><USER2> > On the money in bank question, you're looking for real money in the bank > now.

Another way to put this: "can I see your current balance sheet and cashflow statement"?

Serves two purposes:

1\. If they say yes, you get to see their actual assets and cash flow, unless they're flat out liars.

2\. Whether they say yes or no, their degree of reluctance or acceptance is informative about managerial culture.

<comment><USER7> For one data point: as an employer, if someone asked me that in a job interview I'd think they were complete mercenaries and highly distrustful/cynical. Would smile, respond with something noncommittal about how the board won't let us share that kind of information, and cut short the interview as soon as possible.

Think about it from our perspective: part of the point of being a non-public company is that you can keep some things close to the vest, like profits and balance sheet. Perhaps 50% of the people we interview don't end up getting a position. What if you take that info and share it with competitors, or plaster it on TechCrunch?

This is particularly true if this was a follow up to a previous question (which is borderline) about how many months of cash were in the bank.

Should you judge the financial health of a company? Sure. Look them up on CrunchBase, observe the surroundings, do some research into market size yourself. But have some tact.

<comment><USER2> > For one data point: as an employer, if someone asked me that in a job > interview I'd think they were complete mercenaries and highly > distrustful/cynical.

Now this is interesting. What triggers that reaction? Is it asking for the particular documents, or is it the request for meaningful information?

> Perhaps 50% of the people we interview don't end up getting a position. What > if you take that info and share it with competitors, or plaster it on > TechCrunch?

Good point, and looking at it from your perspective, sure, I'd be reluctant to open the kimono too. The main thing that stops _me_ , since we're swapping data points, is that it would be the wrong thing to do. Betraying confidences is both unethical and often contrary to the protections of common law.

> This is particularly true if this was a follow up to a previous question > (which is borderline) about how many months of cash were in the bank.

If you then smiled and cut me short, _I'd_ be suspicious. It sounds like we both lost.

<comment><USER7> > Now this is interesting. What triggers that reaction? Is it asking for the > particular documents, or is it the request for meaningful information?

It's sort of like a woman who asks you what car you drive right off the bat, on the first date. It indicates she is only in it for the money. And that she also lacks the social intelligence necessary to gain information without revealing that she's only in it for the money.

For a startup to succeed its people need to be a bit irrational. A pure profit maximizing strategy for a good developer is just to do something boring at Google. You aren't joining a startup to do median case profit maximization, you're doing it to (a) do something interesting for a change and (b) have a shot at a big payday.

Now, there's a certain undercurrent here at HN that says "F you, pay me". OK, but this is not the type of personality that is likely to build something great. They are the first ones to bail when things get rough, the first ones to trash their former (or current) employers, the first ones to lay blame.

There is a role for highly skilled mercenaries, just as there is a role for really beautiful golddiggers. But they should gravitate to Google/really rich men, as that's where they'll find a mutually satisfactory exchange.

<comment><USER2> What about the "runway" question?

It's the same thing: I want a sense of the risk I'm taking, but without signalling (incorrectly IMO) that I'm just such a mercenary.

</comment></comment></comment></comment></comment></comment><comment><USER8> Research is something everyone stresses, but it is something I struggle with and I would really like to see more advice on it. Advice on parsing the data I get rather than more data.

Now I've gotten into the habit of only looking at directors statements on their annual reports when I need to research a company. I get so little from the rest of their website, I can spend hours and not understand anything more than the names of their products/services. I have the distinct impression that coding teaches me to only believe what is stated, whereas parsing marketing text is all about reading the lines, which I am terrible at.

</comment><comment><USER9> In addition to the excellent questions here about revenue and runway, if equity is a significant part of your comp (read: if you could make more money elsewhere and you're not taking the pay hit because it's the job of your dreams) there are more things you need to know. I'd want to know total investment, the liquidation preference and if the preferred stock is participating. This will give you a good idea of the exit required for your stock to actually be worth anything. Knowing the makeup of the board is useful too, i.e. how many are VCs compared to common holders.

</comment><comment><USER10> I would love to be able to find the following information without seeming to be afraid of working hard:

"How often do you expect your employees to work extreme hours in order to be competitive in your company?"

If the culture of the company supports 60-80 hour weeks, it may not be apparent in a job interview... and even if it doesn't, asking this question incorrectly may paint you lazy or unwilling to put in time if(hopefully infrequently) necessary

<comment><USER11> If you are unwilling to work 60-80 hour work weeks, what is the point in lying about it? Would you make an exception for some companies?

<comment><USER10> There is a difference between working 60-80 hour weeks all the time vs putting in a week of crunch time that happens rarely. Latter is oftentimes inevitable, whereas the former is a sign of poor time management IMHO.

There was nothing in my question about lying, It just seems that is very tough to emphasise your dislike of constant 60-80hr weeks and still be able to convey the fact that you wont shy away from a late night work when absolutely necessary.

<comment><USER12> That's why the author writes " _How often_ do you expect...". Of course you can choose a different wording if you want to be clearer. Also, note that this happens in a face-to-face conversation, so you can always gauge the reaction of the interviewer, qualify your question, etc. I usually ask "how are your working hours like?", and add that I'm _used_ to working overtime and weekends -- that not only avoids the impression you mention, but also makes the interviewer more likely to be honest in their answer.

By the way, I wouldn't call someone who doesn't want to do overtime "lazy". For instance, just because I'm "used" to working long hours doesn't mean that I'm indifferent to it.

</comment></comment></comment></comment><comment><USER13> _If you left them with an impression you don't agree with, the fact of the matter is you did leave them with that impression so you simply need to figure out how to make the same mistakes next time round._

Or, you know, how to avoid them ;)

Good advice by the way. I have always made a point of asking this my self, and when I have been hiring, I would always try to answer as well and honest as possible, if candidates ask for it.

</comment><comment><USER14> These might be questions to ask after you get the offer, but IMHO you'll likely decrease your chances of getting the job if you ask them early in the interview process.

<comment><USER4> I couldn't disagree more (obviously).

There is nothing in those questions that could lead an employer to think that you wouldn't be suitable. They are intelligent, natural questions and the answers are very relevant to someone applying for a job.

Once an offer has been made, the opportunity to ask detailed questions is gone. If someone posed these questions to me _after_ the offer I'd simply think why didn't they ask during the interview if it was important.

<comment><USER14> Well perhaps you are right.

</comment></comment></comment><comment><USER15> i completely agree with the fact that you should never take a job just solely because of the money...sometimes its hard because if you share your pay with other, they would say, but why?? only you yourself can feel good about it</comment>


Why "variables" in CSS are harmful - <AUTHOR> http://www.w3.org/People/Bos/CSS-variables <comment><USER3> I tried to read the essay but as soon as I saw the page my eyes started burning

<comment><USER4> Also, scrolling this page is surprisingly CPU-intensive. At least on Firefox 2 Ubuntu.

<comment><USER3> I had that problem too, I assumed it was my computer's fault. Anybody know what the page is doing that makes scrolling suffer so badly? Is it just the transparency like pistoriusp mentioned? It was bad on Firefox 2 on Gentoo; it seems to be fine on Firefox 3 on Windows XP

</comment></comment></comment><comment><USER5> It is rare that an essay makes its point in such an unintended fashion.

</comment><comment><USER6> The point that this can be done as a separate, server side processing phase has merit. Too bad it had to be wrapped in a ridiculously long, patronising article, containing such gems as the observation that style-sheets are rarely longer than a hundred lines. Right. And I'm not even going to comment on the choice of background.

<comment><USER7> I feel the server side thing is not a good argument, after all, there is not always a server side. HTML documents can be distributed standalone.

Also, it is much harder to do CGI scripting than to deal with possible constants in CSS.

</comment></comment><comment><USER8> tl;dr - "Because people are stupid and wouldn't understand them."

How patronising.

</comment><comment><USER9> He used reusability as an argument.

So having to retain the same values 100 different places in the stylesheet(s) makes them _more_ reusable and maintainable than having the ability to define constants _once_?

What a joke.

<comment><USER10> If you're using the same values in 100 different places in a stylesheet you're frankly using them wrong. There's actually a decent point there - <USER2> variables will undoubtedly encourage that sort of thinking and create further constant abuse rather than encouraging people to use the cascade and inheritance.

That said, I'm not sure if that potential problem alone justifies its lack of introduction - there are legitimate use cases as well where they will improve clarity, the ability to provide complex CSS as boilerplate and get people to change the constants to suit their needs would be useful (e.g. easy recycling of complex column code) and I think their argument about code reuse is pretty much nonsense too.

<comment><USER9> I'll have to agree _and_ disagree with that statement.

Sometimes your job is to further develop an existing solution with crappy CSS and poor design, leaving 50% or more of the CSS redundant compared to a more optimal solution. In this case, CSS has clearly been applied wrong, but if you want to be able to work with it consistently constants _would_ have been a powerful tool in your toolkit.

Sometimes you want whatever page or site you are working on to work with a defined palette. Maybe the same colour should be used for either foreground or background colour depending on its current state (inactive, selected, hovered) and so on.

In many such cases, depending on complexity, trying to minimize the redundancy in the CSS practically makes the CSS unreadable or unmaintainable since the different attributes and settings for one selector is spread all across your CSS definitions.

In other words: Solving one problem creates a new problem, maybe equally bad or worse.

Some might suggests we should be able to reference selectors _in_ selectors. Like "make this A:hover have the background colour of A:non-hover's colour- attribute". That however would make CSS much more like a programming language than a declarative layout language. It would also run the risk of recursiveness and add confuzion with regard to state-based behaviour.

No matter what syntax is used, I can't imagine this resulting in more natural or readable CSS.

As far as constants go, I can't see them making any more problems or any worse problems than the ones discussed above. Among many evils, I would consider constants one of the smallest.

But who knows... Maybe I just lack imagination.</comment></comment></comment>


Broad Spectrum Anti-viral; DRACO, Fund Organized - <AUTHOR> http://thedracofund.org/

<comment><AUTHOR> To raise money for DRACO research (the broad spectrum antiviral started at MIT), we have created The Draco Fund. We are in the process of filing for non profit status with the IRS and completing the online donations functionality on our web site.

Please visit our site to learn more about DRACO and register so that we can let everyone know when we are ready to accept donations.</comment>