Cloudflare, Mozilla, Fastly, and Apple Working on Encrypted SNI - sahin-boydas https://twitter.com/grittygrease/status/1018566026320019457 <comment><AUTHOR> Related/relevant question.

A number of months ago I decided to finally begin researching a project I've had on the backburner for ages: a simple domain+IP bandwidth throughput counter for everything within my LAN. Basically I wanted to make a dashboard saying "you exchanged this much data with this many IPs within the last 24h; here's the per-IP and per-domain breakdown; here are the domains each IP served", that sort of thing.

Part of the motivation for this was to track down the headscratch-generating mysterious small amount of "unmetered data" my ISP reports each month (I don't watch TV over the internet and cannot think of what else would be it), and the other part of the motivation was to satisfy idle curiosity and observe domain<->IP cohesion/fragmentation over time.

At the exact point I began my research TLS 1.3 had just been approved, and I rapidly realized my nice little idea was going to get majorly stomped on: the inspiration for the project, years ago, was the SNI field itself (hah).

5-10 years ago, I would have been able to route all my traffic through a gateway box, and passively watch/trace (slightly behind realtime) everything via tcpdump or similar, catching DNS lookups and sniffing SNI fields. That would have handled everything.

Now, with encrypted SNI, and the upcoming DNS-over-HTTPS (seems I need to think ahead :/), it looks like my (now irritatingly stupid-seeming) project will require me to generate a local cert, install it on all my devices, and get a machine beefy enough to keep line-rate speed while doing MITM cert- resigning.

And then, for the fraction of traffic my system reports as "not signed by local cert", I'm just going to have to let that go, or I'll break everything that uses cert pinning.

...which I wouldn't be surprised if some programs eventually use with DoH lookups (using pinned certs fished out of DNSSEC for DoH makes sense).

I'm very very interested to know if there are any alternatives I can use. I realize, for now, that I can sniff for and collect DNS lookup results and associate these with IPs, but when will this break?(!)

Honestly HTTPS and security in general just seems like a gigantic mess. I say this not as a disrespect of the architecture, but more as a "wow, this is just so hard to get right".

<comment><USER2> You will still be able to measure how much data goes to and from particular IPs, since that can't be screened.

TLS 1.3 approval doesn't stomp on SNI; on the contrary, for the first time it actually makes SNI mandatory - in previous versions it was optional, leading to some HTTP implementations still not working with SNI late in the 21st century. I had a corporate Python system I was responsible for that couldn't do SNI even earlier this year.

You probably shouldn't attempt your idea of proxying everything. Proxies are very fragile, and this will probably inadvertently worsen your security, while also introducing weird non-security misbehaviour that's hard to track down. For example Firefox will go "Oh, a MITM proxy :(" and it will switch off all the safety measures built up over years for the public Internet because this isn't the public Internet. In principle if your MITM proxy is enforcing the same or tougher rules, this wouldn't be worse, but let's face it, you're going to cobble together the minimum possible to make it work.

Every time somebody tries to get fancy and _think_ about the bits inside the packets their network is supposed to be moving they screw up. That's the most cynical reason why there's an impetus to encrypt everything. If the bits are all encrypted gibberish the temptation to meddle with them goes away.

<comment><USER3> And yet a number of recent privacy breaches where apps were collecting and transmitting data they had no business in were discovered by sniffing the traffic.

> _Every time somebody tries to get fancy and _think_ about the bits inside > the packets their network is supposed to be moving they screw up._

How do you propose we do security otherwise? (Apart from delegating it to other parties so _they_ think about the bits)

<comment><USER4> >How do you propose we do security otherwise? (Apart from delegating it to other parties so they think about the bits)

The clear and obvious solution is to make developers, managers, executives, and major investors personally responsible for the damage their products do. If Google is going to encrypt everything using pinned certificates, making it impossible for me to implement security features/boundaries of my choice, then they should be 100% liable for all damages that come from the use of their products. Additionally, if an analysis of the problem shows that is is related to aspects of the product that do not directly related to what the end user believes the purpose of the product to be, then there should also be criminal liabilities for all parties as well.

<comment><USER5> > _The clear and obvious solution is to make developers, managers, executives, > and major investors personally responsible for the damage their products do_

I struggle to understand how this is a "clear and obvious" solution. How would you go about executing this? Legislation? The big famous piece of recent tech legislation, GDPR, is, by most opinions, far and away "clear and obvious". And given the US's current political environment, I'd struggle to believe any sort of legislation could be passed that is "clear and obvious".

There has to be a better solution that "coordinate the interests, incentives and motivations for millions of users, developers, managers, and executives to pass some legislation that makes the latter group responsible."

</comment></comment></comment></comment></comment><comment><USER6> This is amazing work, can't wait for this to be finished and deployed on the internet. Together with encrypted DNS (DoT and DoH) we finally get fully confidential connections to a server without leaking anything other than Remote IP.

<comment><USER7> The Remote IP is almost as sensitive as SNI right?

<comment><USER8> Not always, see domain fronting: [https://en.m.wikipedia.org/wiki/Domain_fronting](https://en.m.wikipedia.org/wiki/Domain_fronting)

<comment><USER9> Or services which use subdomains for individual users, e.g. #.github.io, #.tumblr.com, #.blogspot.tld and so on.

<comment><USER10> This. Currently, the difference between accessing github.com/blattimwind and blattimwind.github.io is that, in the second case, which username you're accessing is visible to all. Encrypted SNI will also protect that part of the URL.

</comment></comment></comment></comment></comment><comment><USER11> It's great seeing more and more work being done to increase privacy and anonymity online, especially things like this which are about plugging smaller, less obvious holes. Nothing is perfect, but the harder it is for the snoops and spooks, the better.

<comment><USER12> NTP over TLS next please.

<comment><USER13> [https://tools.ietf.org/html/draft-ietf-ntp-using-nts-for- ntp...](https://tools.ietf.org/html/draft-ietf-ntp-using-nts-for-ntp-12)

Which should be in ntpsec eventually.

[https://www.ntpsec.org/plans.html](https://www.ntpsec.org/plans.html)

</comment></comment></comment><comment><USER14> Am I understanding this correctly, they propose a _esni TXT record for a domain containing a public key, which is used to encrypt SNI?

Who does this protect from?

ISPs that don't want to give up spying obviously are monopolies, have enough power and can block DNS-over-HTTPS/TLS and all 3rd party resolvers. So can censors. State actors can intercept DNS traffic even easier, since DoH/DoT make it more centralized. IP address itself leaks so much information, that cleartext SNI might not be even needed after all (meaning you can still pinpoint a domain with high probability just by IP address).

Maybe this can help make collateral freedom a bit easier. But it's already possible to achieve that with generated not known ahead throwaway domains, they are cheap compared to CDN/cloud costs. And collateral freedom doesn't really work against censorship all that well on its own, as centralization makes it easy to pressure CDNs and clouds to deny service to dissidents. Not enough collateral damage.

<comment><USER15> "ISPs that don't want to give up spying obviously are monopolies, have enough power and can block DNS-over-HTTPS/TLS and all 3rd party resolvers."

Too many big players are behind it for ISPs to be able to get away with that strategy. If a battle started then Google, Cloudflare, and others could simply start hosting DNSoHTTPS directly alongside all of their major services. To most customers 90% of "the internet" is the services from these providers.

"So can censors. State actors..." There is never going to be surefire way to subvert a large government that controls the infrastructure you are trying to sneak through. Even if there was the government would still be in control of data at any companies that operate inside the country. It's not "outsmart China or bust".

Rather than dismissing the solution as useless because it doesn't provide the ultimate privacy maybe it's more worthwhile to look at what it can do and how other changes to TLS and other protocols can continue to make things harder to snoop.

<comment><USER16> > It's not "outsmart China or bust".

While we're at it: what prevents, say, a cartel of the world's transit providers to cut China off from the Internet until they don't censor it any more? And why haven't they done so? After all, there are only two outcomes: the Chinese government goes fully intranet, but their economy tanks as a result or the Chinese government backs down, with their economy (and civil rights) profiting. Same goes for Russia or Iran.

It's about time that Western companies take a stance when it comes to civil rights. So much technical and social progress is kept back out of the fear the censorship creates, it must be profitable by now to simply force their hands.

Oh, and while we're at it, why are there still companies doing business with our very own guilty parties in espionage terms? Why do they have bank accounts? Why is anyone renting them office spaces, selling computers and whatever else?

The same companies from USA, Germany, Israel and I believe also Italy do not only supply our own governments (which is bad enough in itself) but also dictators who use these tools to repress their own citizens.

<comment><USER17> Money. Sadly morals and convictions get quickly tossed out the window for money and power. It is China's problem, why should Western companies damage extremely profitable business relations? I agree with you that they should cut off such countries, but modern morality is a lot more fluid and money is king. Typical FYGM mentality.

</comment></comment></comment></comment><comment><USER18> Lots of people here seem to focus on how this could prevent censorship and spying by governments. It might raise the bar, and make such measures infeasible for small countries, while also making it more visible.

But what we really should focus on is the added security everywhere else. Even when I trust my ISP, that is no reason not to have defense in depth.

Someday WiFi or 4G network will have a horrible security flaw. And then this will be another bolt in the next layer of security.

If security is important, we need multiple layers!

Focusing on what authoritarian governments might or might not do is pretty much besides the point.

<comment><USER3> > _Even when I trust my ISP, that is no reason not to have defense in depth._

But if this is the method we are following, we will also need to think about the costs-vs-benefits of different security measures.

If patching known exploits or threat-models, the cost-vs-benefit generally allows for very strong security measures because you know the risks if you don't implement it and you know when the measure is implemented and you are done.

However, with "defense-in-depth" you could always add another layer of encryption, add another sandbox layer or make a system less general-purpose. If security is your only priority, there is no point where you would stop.

<comment><USER19> > If security is your only priority, there is no point where you would stop.

in a secure system, adding defensive layers is constrained by the amount of code required to implement them. at a certain point, these layers can become an attack surface, and therefore a liability.

</comment></comment></comment><comment><USER20> One thing my team is working on and "waiting" for is the ALT SVC SNI extension to be adopted.

If you haven't read the spec it's pretty fascinating.

[https://tools.ietf.org/id/draft-bishop-httpbis-sni- altsvc-02...](https://tools.ietf.org/id/draft-bishop-httpbis-sni- altsvc-02.html)

Working with ALT SVC's and being able to set the SNI which piggybacks on some of the OP encrypted SNI is pretty cool tech. It's all early, hard to get working, not supported by most browsers, but it's going to allow for some interesting future security and trust options.

</comment><comment><USER21> Would it not be simpler to issue an SSL certificate for the IP address for the outer connection (kind of like how EAP works with inner and outer identities) instead of relying on a DNS RR?

</comment><comment><USER22> Just curious, would it enable Signal and other tools trying to avoid censorship by doing domain fronting without the cloud provider (e.g AWS Cloudfront) noticing.

e.g. [https://news.ycombinator.com/item?id=16970199](https://news.ycombinator.com/item?id=16970199)

[https://news.ycombinator.com/item?id=16868564](https://news.ycombinator.com/item?id=16868564)

<comment><USER23> Arguably it's no longer domain fronting, it's just connecting to a server that serves both sites without saying which one you want. So it's better, because it doesn't break any rules. That requires AWS et all to support SNI encryption, though.

What I wonder is about downgrade attacks. Browsers will probably have to support clear-text SNI for a long time - could censors abuse this by making it seem that no server supports encrypted SNI? Or is there a digitally-signed way for servers to prove that they support it, before the browser sends the host?

<comment><USER2> The intent is that you'd be using a secured DNS channel such as DoH or DoT to obtain your DNS results - so an adversary can't rewrite the DNS records.

This proposal supposes that when we've decided to talk to example.com we may as well ask a DNS query that requests not only 'A' and 'AAAA' records (IPv4 and IPv6 address) but also an encrypted SNI key. If such a key is available we can use it to prove to the server (which set that key) which name we wanted, while eavesdroppers are none the wiser.

If the adversary can eavesdrop DNS they can already speculate from our query which host we wanted to talk to, but securing DNS is a problem for which there are known solutions.

<comment><USER23> So censors can stop this by preventing the use of (non-controlled) DoH and DoT servers?

<comment><USER24> No, the owner can sign the dns records and also sign the absence of a record, and if the censor tries to tell the browser that there is no SNI key, without being able to produce the signature to prove that, the browser can just treat this as an MITM attack. This only work on signed DNS entries though.

<comment><USER23> But they just want to block it, so if the browser and/or app treats it as a MITM attack, that's fine from the censor's POV.

<comment><USER24> There is a difference between inciting end point devices to drop down to less secure protocols, and alerting the user that you are running an active attack.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> Does anyone know Google's position on this? I tried finding a relevant Chromium issue but failed.

<comment><USER2> "Google's position" includes a lot more than just some Chromium developers, and even Chrome is big enough for there to be internal tension between teams focused on end-user security (e.g. encrypting SNI) and real world performance.

Google is a cloud operator these days, and as such if something like this is to be of much use they'll have to eat the consequences at the other end, which means their product (Cloud servers) working less well for uncontroversial services than it might if they let censors do as they please. Basically for a cloud operator or CDN choosing to actually implement a working encrypted SNI solution (whatever it is) means now all your uncontroversial sites are obliged to tell censors "I'm Spartacus" and reap the consequences. If the censor is a single place of business or a micro-state maybe you can just suck it up. If it's Russia then you've just decided you want to annoy all your paying customers on a point of principle. I believe the word for that in Yes, Minister was "Brave".

Ultimately, for this to be deliver much value (and if it doesn't why bother at all?) it needs to be something every major cloud provider and CDN does for all the sites they host. Which means from somewhere they're all going to need to find a lot more backbone than is needed for, say, TLS 1.3 itself.

I hope it works, but I fear it will not.

<comment><USER26> Google and AWS are each large enough to make blocking them a very expensive proposition.

I also get the sense that Google is pretty good at prioritizing long-term goals such as a fast and secure internet over any short-term considerations.

</comment></comment></comment><comment><USER27> Can we do something about the certs? There are DPI that can block websites by cert CN/SAN.

<comment><USER6> This is sorta it. SNI is the only unecrypted part that leaks the server hostname. CN/SAN blocking usually has a middlebox that decrypts the connections so there is nothing to be done here.

If somebody can MitM your encrypted connection to both server and DNS, encrypted SNI stops working to my understanding.

<comment><USER27> IIRC after ServerHello the cert was given to client in clear text.

<comment><USER28> This changed in TLS 1.3. The server cert is now encrypted.

<comment><USER27> That's cool. Is it possible to force google.com use TLS1.3?

<comment><USER2> If you insist upon talking TLS 1.3 draft 23, which is the last substantive change before the draft went to the RFC queue, google.com is perfectly happy to talk TLS 1.3 draft 23.

TLS 1.3 has downgrade detection, so if a middlebox tries to downgrade you (e.g. to TLS 1.2) without proxying the entire connection the TLS 1.3 implementation in your client will spot that and reject the connection.

Proxying is possible (including with a downgrade) if you trust the proxy. So, don't.

If you have a recent-ish version of Chrome or Firefox you are already using all this.

</comment></comment></comment></comment></comment></comment><comment><USER29> SNI is key to https virtual hosting. If encrypted how will the server know where to go? More importantly, why not just use the "Host" header inside https if you need SNI?

I mean, if SNI is encrypted then we don't need SNI at all, just use the Host field inside https header which is encrypted already and carries all the info you need know. Am I missing something?

Yes SNI could be encrypted outside of the SSL handshake in client-hello, but why? will it be useful to defend domain fronting, don't think so.

<comment><USER2> The purpose of SNI is to allow the server to pick the right proof of identity (usually an X.509 certificate) for the site the client actually wants to access. This needs to happen before the HTTP session starts, so we can't wait for a Host: header.

Yes, the intent is exactly to encrypt SNI during the initial ClientHello, in particular the public key used will be found in DNS alongside the server's IP address(es).

The key used will be the same for some set (perhaps all) of names hosted on this IP address, so yes it achieves the same goal as "domain fronting" but without tricks.

</comment></comment><comment><USER30> This doesn't make much sense to me, I wonder if the senior management at these firms understand what the engineers are doing.

You could already do something approximating encrypted SNI using domain fronting. Connect to boring domain A via SSL, then send an HTTP request with a Host header set to your actual target domain B. Load balancing HTTP reverse proxies in the clouds would happily use the encrypted domain in the Host header, ignoring SNI in the TLS headers. This started being widely used to evade censorship and build "unblockable" services, because to block them you'd have to block all of Cloudflare or Akamai or Google.

These firms all, as one, banned domain fronting. Turns out the bosses wanted access to big markets more than they wanted censorship resistance.

So why do these developers think it'll work out any differently this time, with slightly different packet formats? First company to enable encrypted SNI will get blocked at the national level and will blink. The others will look at it and probably never try.

If they're serious about making sites unblockable by domain, the first step is to re-activate support for domain fronting and make a public commitment to keep it.

<comment><USER31> > This doesn't make much sense to me, I wonder if the senior management at > these firms understand what the engineers are doing.

When a bunch of well respected people decide to do something which you don't understand, maybe next time your first instinct should be to ask what you don't know rather than assuming they're participating in an IETG process which will be shut down?

In this case, you might start by questioning whether there's any other explanation for not supporting domain fronting in the past other than support for censorship (hint: Google gave it at the time), and whether those sound engineering reasons might in fact have lead to something like this as an official supported alternative.

<comment><USER30> Google did not give any engineering reasons at the time. That's misleading. Here's what they said:

 _" Domain fronting has never been a supported feature at Google, but until recently it worked because of a quirk of our software stack," a Google spokesperson explained in a statement emailed to The Register. "We're constantly evolving our network, and as part of a planned software update, domain fronting no longer works. We don't have any plans to offer it as a feature."_

This might superficially sound like domain fronting stopped working accidentally, as part of other changes, but notice how carefully it's phrased. They made an update. It stopped working. Nothing in this phrasing would be false if they made a business decision to kill it and did so.

I find this explanation extremely likely for several reasons:

1\. It happened just when fronting was being adopted by Signal, a high profile app that would have caught attention.

2\. All the other big players made the same change, again, prompted by specific events related to anti-censorship.

[https://www.bamsoftware.com/papers/fronting/](https://www.bamsoftware.com/papers/fronting/)

 _GreatFire speculated that the attacks were precipitated by the publication of an article in the Wall Street Journal that described in detail domain fronting and other "collateral freedom" techniques. The interview associated with the article also caused CloudFlare to begin matching SNI and Host header, in an apparent attempt to thwart domain fronting._

This explanation turned out to be correct. CloudFlare said:

 _Among other network service providers, it 's clear domain fronting could be awkward. "Cloudflare does not support domain fronting," a Cloudflare spokesperson said in an email to The Register. "Doing so would put our traditional customers at risk as it would mask banned traffic behind their domains."_

Note that their explanation of why they killed it would also apply to encrypted SNI.

3\. I worked at Google for a long time and am very familiar with their serving infrastructure. I remember noticing that resolved hostname and host header didn't have to match a decade or more ago. This ability lasted a _very_ long time, right up until the moment people started using it in ways that upset governments. Then it went poof.

I can believe that these particular 4 players might have had a change of heart. Mozilla doesn't run any CDN or third party web services of note, and has nothing to lose from implementing this. Nor does Apple. Cloudflare and Fastly are both small firms who might have genuinely changed their minds, although if they have they should state explicitly that they are newly willing to let their "traditional customers mask banned traffic".

But I'm also not naive: it's possible some people are thinking, better ask for forgiveness than permission.

<comment><USER32> > "Doing so would put our traditional customers at risk as it would mask > banned traffic behind their domains."

> Note that their explanation of why they killed it would also apply to > encrypted SNI.

I'd say that's an interesting interpretation. What they likely meant is that if govs/orgs want to block X and X starts using domain fronting via domain Y, there's a chance Y starts getting blocked. (basic SNI/DNS filtering) The same idea does not apply to the encrypted SNI - there's no damage to a random domain, unless the whole provider range gets blocked.

<comment><USER30> But the circumvention can use any domain and switch repeatedly, or dump lots of them using various techniques and randomly select. It doesn't need to be the case that domain Y is static.

In particular, note that encrypted SNI could just be blocked at the network level, thus forcing fallback to regular old TLS. But domain fronting can't be blocked like that.

<comment><USER32> > It doesn't need to be the case that domain Y is static.

That's true, but I don't think it's relevant to what the providers want to prevent. Even if the domain changes based on some pool, if Y is used at some point, Y could be blocked as a collateral damage.

Since Y pays the provider, the provider cares about them not being blocked because of a functionality they enable.

</comment></comment></comment></comment></comment></comment><comment><USER33> I think it's worth pointing out the repercussions of this and DNS-over-HTTPS.

Every corporation which does SNI scanning for web filtering will require every user to insert the company's CA cert in every client they use. This then also forces them to make a choice between requiring all apps in all networks to do this, or whitelist certain parts of the network. Not only does this reduce their security, but it limits how apps can work on their networks.

Authoritarian governments will also start requiring this. I could even see federal agencies for non-authoritarian governments making a stink over it on law enforcement grounds. They already hate encryption. If they can't force you to expose what sites you are visiting, they may force new legislation to require all web service providers to provide logs to law enforcement, which is a much worse privacy violation than just seeing what domain you were hitting.

I think the better solution to this would have been to improve server-side support for VPNs and Tor. Tech does not exist in a bubble, and rights can be taken away when they conflict with the interests of authority.

<comment><USER34> Forcing the installation of a root CA isn't a viable option for all but the largest authoritarian governments (China and Russia).

Kazakhstan attempted [1], but abandoned the idea, likely since it was unrealistic to expect widespread adoption of the certificate.

[1] [https://news.ycombinator.com/item?id=10663843](https://news.ycombinator.com/item?id=10663843)

<comment><USER33> A much easier solution is for the government to circumvent PKI entirely. Basically you issue a National Security Letter to some cert provider and require them to give you their keys. Now you can generate valid certs as that provider. You use this in combination with a MITM tool to auto-generate certs for any requested domain, and those certs are implicitly trusted by all clients because they trust that CA's keys. So the state can now MITM and listen to all secured connections, and the only giveaway is that the cert is not in the certificate transparency log, or if the CA used does not match the domain's CAA record (when it exists).

<comment><USER10> > So the state can now MITM and listen to all secured connections, and the > only giveaway is that the cert is not in the certificate transparency log, > or if the CA used does not match the domain's CAA record (when it exists).

Or when the domain uses HPKP to pin its certificate to a different CA. When the MITM CA has been added manually to the browser's root key store, most browsers allow HPKP bypass by that CA unless configured otherwise; but if the MITM is done by compromising one of the browser's default CAs, the browser won't allow a bypass.

Or if the certificate was supposed to be an EV certificate, which can only be issued by a limited number of CAs, and the compromised CA is not one of these. And even if an EV CA is compromised, AFAIK some browsers require the certificate to be in a Certificate Transparency log, and they also require that the certificate carry proof of its submission to the CT logs.

<comment><USER33> 1) HPKP is dead, Chrome 67 removes support. 2) No client will flag an error if the new cert is non-EV. EV is completely useless as a security feature. 3) AFAIK no browser checks the cert transparency log.

</comment></comment></comment></comment></comment><comment><USER35> Is this really done by these companies or just by developers from these companies in their spare time?

<comment><USER36> This has 100% support from the most senior quarters at Cloudflare. Can't speak for the others.

</comment></comment><comment><USER37> What do you think the time frames are for something like this to make it into all the major browsers?

<comment><USER38> You'd need to get it into all servers too, which is probably a very long time frame.

<comment><USER39> This design only requires the hosting server (e.g. Cloudflare, CDN, ...) to support encrypted SNI. It can be entirely transparent to user deployed servers. So it might well be here much sooner than you think!

</comment></comment></comment><comment><USER40> Is this a way for the ad-industry to evade pi-hole or similar technology?

<comment><USER23> They would spend more money developing this than they would gain. Nobody, in a statistically-relevant sense of the word, uses pi-hole.

<comment><USER40> What do you mean, not use pi-hole?

<comment><USER23> I very few people use it, to the point that the ad companies don't really losing anything from it.

</comment></comment></comment></comment><comment><USER41> Direct link to the tweet thread

[https://twitter.com/grittygrease/status/1018566026320019457](https://twitter.com/grittygrease/status/1018566026320019457)

Link to the RFC draft-00 "Encrypted Server Name Indication for TLS 1.3" on which the work is based

[https://tools.ietf.org/html/draft-rescorla-tls- esni-00](https://tools.ietf.org/html/draft-rescorla-tls-esni-00)

<comment><USER42> Thanks, the UI of this Stackshare website is not that great.

<comment><USER25> I just get an almost blank page.

<comment><USER43> Me too. It has a lot of javascript that I'm blocking.</comment></comment></comment></comment>


Ask HN: Why do hackers work for suits? - <AUTHOR>

Why do engineers and hackers work for non-tech people instead of the other way around? Sure this is changing a little, but why do hackers tolerate working for people who don't know jack about technology? <comment><USER2> It's because you'll eventually run into a suit if you go high enough in an established company. A company run by all tech people will not last as long nor be successful as one that at least has some semblance of a corporate structure.

The clue as a geek to find a place where your superiors are if not as technically adept as you are, at least trust you and your opinions and decisions.

<comment><AUTHOR> But why can't tech people _be_ the top management? Google has never had a suit as CEO. Don't think their VPs are suits either. But it's true for most of the business world.

Let me put this another way: are hackers inherently not suitable for top- management jobs, and there will always be suits managing them?

<comment><USER2> The difference is, hackers aren't inherently not suitable, but they're not inherently suitable either.

A good CEO can be a good CEO everywhere, but a good hacker isn't necessarily a good CEO anywhere.

</comment></comment></comment><comment><USER3> I work for money, not people. The less they know about technology, the more they're willing to pay.

<comment><AUTHOR> So exploit them while you can? Interesting philosophy. I personally would hate working for a dumb boss.

<comment><USER3> Is there an amount of money that a 'suit' could pay you that you wouldn't hate it?

</comment></comment></comment><comment><USER4> hackers, suits... not sure what these mean.

I work with people who have complimentary skills. Yes, some excel at some things more than others, but we're all people focused on a common goal.

Seems myopic to reduce people down to stereotypes.

Lots of founders have been great "hackers" and ok "suits" and also lots of founders who have been ok "hackers" and great "suits."</comment>


Ask HN: 30 yr old+ Startup Founders - <AUTHOR>

Any successful 30+ startup founders out there? I'm 33 (considered a dinosaur by most startups) and just dipping my toe into the startup space, but am straddled with a fulltime job, mortgage, bills and a wife, so I'm finding it difficult to pursue my passion while balancing life and keeping the lights on. I realize that being in your 30s really isn't any different that any other time, but I assuming that byt then you have additional responsibilities that limit the amount of risk one can take on. I can't simply stop what I'm doing and put all of my eggs in one basket, and while I could pursue consulting work to free me from my job, it seems as getting that going would take up time, if not more than my current job. I'm looking for honest advice, tips, wisdom on how to make it work.  Thanks in advance! <comment><USER2> Genghis Khan went on to reign one of (the?) largest empires in history in his mid to late forties.

Not exactly what you are looking for, I know, but I hope I hope it gives you some encouragement.

</comment><comment><USER3> I'm 52 - a real dinosaur, but I've been hooked on startups since the late 80s - and with few exceptions have never stopped. The drag for me is that when I was 30 they said I was too young - now I get the looks that I may be too old. All BS of course, because being a start up founder is all about commitment, risk, passion and flexibility. You have to have 1000% commitment not just for yourself but from your loved ones - if they're not on board with belt tightening and living off credit cards at times, with you working 18 hours a day - 7 days a week, with the inevitable ups and downs, high probability of failure and willing to hang in there in the bad moments ( because a great start up founder must maintain a positive and optimistic perspective to their team - translation: you're family will bear the brunt of pent up angst). Then this isn't for you. On the other hand, it's thrilling to be in the middle of a hot space, building your dream, exchanging ideas with bright people, understanding a market better than anyone else, most importantly the joy of learning new stuff and doing new stuff every day and of expanding your skills beyond what you thought you could do then do it. Notice I never mentioned money - if that's what you want, then stick with your job because it'll provide what you need. Jobs, Gates, Zuckerberg, etc, never ever mention that they do it for the money - it's never about the money.

</comment><comment><USER4> I know sorta how you feel... albeit not exactly. I'm over 30 (38, actually), but I'm still single with no wife, kids or mortgage. So I can be a little more cavalier in my approach to things, since no one is depending on me.

That said, I think you can still make a startup work if you want it bad enough, and depending on your (and your family's) appetite for risk. But if your SO isn't on-board with the required sacrifice and with the risk, it might not be such a great idea. Tough call, best of luck to ya!

</comment><comment><USER5> First, the age thing is just a number - let's get that out of the way. I'm up there too (I'm 'cough' 30+, too), wife, 3 kids, mortgage, etc. There is something to be said about wisdom - calculated risk vs 'reckless abandoment- type risk (this is not to imply that all 20+ startups are like this). I believe that added responsibilities in your 30's make you better at assessing risk in your personal life. Take that knowledge and intuition into your startup. How to make it work? Good question. Start with an understanding wife and kids.and finding a balance between your personal, work, and startup. It'd be nice to have longer days or not have to sleep so much. But, that's life...startups are never easy. But if your startup is worth it...go for it. It really boils down to time management. And, when you get to that stage where the startup has achieved momentum (cusp of getting funding, going public, or whatever that requires more of your time) re-assess your situation again because it's going to get harder not easier. If your startup has potential and you believe in it, fall back on that to drive yourself forward during those 'downtimes' when you question yourself about why you're doing this. In my case, I plug away at my startup for 3 reasons - my kids. Did I mention you have to have an understanding wife? Good luck.

</comment><comment><USER6> I was almost exactly where you are four years ago. 32, married, with two kids and one on the way, when I started my company four years ago. One of the most important things I did before making the jump was sit down with my wife, explain why I felt I needed to start the business (pursuit of a passion, happiness in career, etc...), and then we discussed at length the potential impact it would have on our lives together. This doesn't make it any easier, but it does help to set expectations and ensure you are going in it together with eyes wide-open.

Along the way, you are going to have to work your butt off to ensure the success of the business (no one else will care more about it than you), but its important to remember that starting your own business also creates some amount of freedom. No boss to ask for an hour or two off here and there. Pick your kids up from school, have a random lunch with your wife, work remotely while taking the family on vacation. If family is important, than a startup is actually a means to create more freedom in your life and spend quality time with them.

YMWV, but you need to find a way to make it work to pursue your passion. If you don't, you nor your family will end up happy :)

Good luck!

<comment><USER7> This is awesome. It's hard when working a full time job and attempting a startup to think that at the point where your business is your full time gig, that the freedom will allow for opportunities you can't have with a 9 - 5. May I ask what business you started?

</comment></comment><comment><USER8> If you spend a disproportionate amount of time on HN, you can easily be led to believe the "typical" startup founder is an early-20's hoodie-wearing recent grad.

The reality is that starting a company in your 30's is probably the most common first-time startup founder age-range. It partly depends on market and business idea though. I wouldn't want to be a 38 year old guy pitching an idea for a social viral bar-games scoring app. But, for the sorts of ideas that tend to require bigger money and a more refined approach, I think I'd rather pitch that at 35 vs. 25 in today's market space.

Also think about hiring good talent in general (assuming you want to build a "business" and not an "app"), many people would rather work for an experienced CEO in their 30's, but the mid/early 20's set seems to have an edge on very refined "apps" (be it Android/iOS or small webapp) type of businesses, where 4 or 6 people may be able to makeup the core of the company for a significant amount of time.

Just my opinion, as a late-30's guy who has been rolling through various startups (my own and working for others) for about 18 years. YMMV.

</comment><comment><USER9> This really hits home.

I'm 33, wife, son, well paying job. I'm also passionate about food and have 'just' launched a recipe scrapbook web application. It's been tough. Last night at 2am I was writing e-mails, and coding, while trying to rock our newborn son to sleep.

You mentioned risk. That's interesting. I'm by no means successful in my venture (yet!), but I've been able to get this far on about $100 and amazing support from my wife. So my risk has been on the extreme low side. Now I'm trying to drum up some interest, and marketing is new for me. So where do I go from here? Find a foodie co-founder who is awesome at hustling? Stay the course, try my best, and see where this goes? Quit my job and just go for it?! Not sure yet.

So I guess I'm just saying, go for it! Don't quite your job yet, get your wife on board, give yourself 6 months, and see what you can do! It's going to be TOUGH! But your passion should carry you through.

<comment><USER3> Depending on what your business idea you should find folks that you mesh well with and who bring skills that you lack - you can't be everything to everyone so find experts that share your vision. If you need a sales or marketing guy, you can find them too - but be sure that's what you need. Know your market, know your product and then figure out how you'll make your business work - only then will you have a better idea of the sort of marketing, and sales folks you'll need. Start by reaching out to friends and trusted folks to leverage their smarts, reach out to their networks for help and build on that. Good luck - I love foodie stuff - sounds like a cool idea.

<comment><USER9> Thanks sebandr.

I didn't want to give a link to the site in my first comment, as it didn't seem appropriate. But if you're a fellow foodie, I'd love it if you could have a look and give me your thoughts.

mylifethroughfood.com

<comment><USER3> I'll be happy to- I'll do it today - and I assume you have contact info on the site.

<comment><USER9> Right on the home page at the bottom. Thanks in advance!

</comment></comment></comment></comment></comment><comment><USER7> I wish I could offer you advice, however I am here to see what advice others offer :) I am 31 and am in the same boat. While I have heard it is true that most founders are in their 30s, I have not heard is how many of those founders have a wife, children etc. I would love to hear advice/stories from individuals in that situation.

</comment><comment><USER10> Same here, 32, two kids, wife, mortgage, foodie (although that's not my occupation. Strange. There's a lot of foodies round here...).

I code in the nighttime when the kids (and wife) are asleep. For some reason, the progress I see actually gives me energy, it's the drag of going to work everyday that saps it. I'm lucky to have a wife that supports me in my ideas, I think it's paramount to discuss everything you do to her.

As of October 1, I lost my job due to the economy. This creates a lot of stress, but fortunately I get a reasonable severance pay from the government (I'm dutch). Although money is goint to be a bit tighter than we're used to, it could actually prove to be a blessing since I'll have a lot more time on my hands.

</comment><comment><USER11> Real Answer: the majority of startup founders.

</comment><comment><AUTHOR> Thanks everyone, encouraging so far. I'll be honest, one of the frustrations/fears is not being able to currently commit 100% of my time to my idea, which inevitably leads to it taking substantially longer (months) to get something out the door...in the mean time, I look on Techcrunch or HN and others has developed something similar in a matter of weeks and raised $$. If there is one thing I've learned, is that hard work does pay off...onward and upward.

<comment><USER3> True - but unless your extremely lucky or well connected the probability of success is super low. Throwing together and app to find a sandwich shop is one thing - building a viable business plan and launching a business is entirely different and requires a lot of time to think, understand, research and evaluate to improve your chances for success. Use this time to do the research, talk to your prospective customers, observe and learn from potential competitors, it'll help you understand your market ( or if there even is one ) and find your niche. Once you have all this - at least you'll be better informed to make a decision to pull the trigger or not - at a minimum you'll be able to make a case for yourself to friends, family and potential investors. good luck

</comment></comment><comment><USER12> hey SABmore, so my experience is very much the same as yours. Granted I was a little younger when I started (28) I was in the same boat, mortgage, wife and great job I didn't want to give up for nothing. So I decided I would make it work. At this point I should note I have been blessed with an amazing understanding wife who has been very patient over the years. My strategy was simple, dedication in the evenings and unlike many startups by a younger founder where fly by the seat of your pants, I made a very clear plan first which took over 2 months in the evenings. This way when I was ready to start development my work was very concentrated based on the plan I had developed. In addition this proved to be very beneficial when I brought on another developer. They could be working during the day without having to call me.

One thing I will say... do it, work your butt off and it will pay off in the end!

<comment><USER7> Mind if I ask how successful you were? Were you able to go full time on your venture?</comment></comment>


Sherloq: A tool to stop hate speech - <AUTHOR> http://hatespeech.sherloq.io/ <comment><USER2> An awesome tool you have created... I typed in a few things that I [normally would never] said about "groups of people" and it came up with almost 100% hatefulness.

"I hate people." 0%

"I hate you." 92%

"I hate the world." 0%

"I hate my job." 0%

"I dislike John Smith." 5%

"I hate John Smith." 0%

"I hate you, John Smith." 92%

"I hate my life." 1%

"I hate my wife." 0%

"You suck." 92%

"Everyone sucks." 16%

"John Smith sucks." 70%

"If I hate everyone, than does that mean I hate myself?" 0%

"I don't like olives." 0%

"I don't like Antarctica." 0%

I see the system is also analyzing swear words and adds a few % points.

It does take into account words like "Jews" (99%) and "Muslims" (95%) and "Catholics" (12%) [why do certain groups get a bigger percentage rating than others?].

But it also fails on other groups of people like "Christians", "Baptists", "Atheists", "Methodists", "Lutherans", "Indians", "Canadians", etc.

So.. there is always room for improvement!

The UI is gorgeous, by the way, and mobile friendly!

I'm sure the system can (and should) learn from user input as people enter more phrases and words into the system? Can you add the capability of adding custom phrases or words to the admin? I didn't see this feature, only the ability to add "criteria" but it doesn't let me actually type anything in.

It would also be nice to see something that allows for "levels" of toleration as well. Something like "Relaxed" "Moderate" or "Strict".

This is a tool I've bookmarked and will be looking into using as I develop more web apps. But I'd like to see a way to add my own phrases and words that I would personally deem offensive.

Thank you for sharing!

<comment><USER3> Hello mattbgates, I'm one of the engineers working on the project. Thanks a lot for taking the time to play around with the tool and writing this feedback. We're going to add a feature for giving feedback to moderation (whether the moderated text is actually hate speech or not) to learn from users input.

We're actively working on improving the model so hopefully next time you try it you'll see the improvements!

</comment></comment><comment><USER4> This writing experiment/demo is pretty fun.

      All immigrants should be deported.
      All boy bands should be executed.

Both got me a 0%.

      All Germans are evil rats.

1%.

All my (self)hate wasn't sufficient to trigger this algorithm.

<comment><USER3> Hello fwn, interesting examples you have there. We're still working on further improvements to the model at this stage, aiming to detect even more sophisticated examples. Thanks for your feedback and hope you try it again and see improvements soon.

</comment></comment><comment><USER5> Given this example from the page `diversity is white genocide forced on us by the libtard elite` I decided to test for liberal bias.

"Fuck liberals." 97%

"Fuck conservatives." 0%

Uh-huh.

</comment><comment><USER6> I copied the text from the following and pasted it into the engine via your web site:

[https://www.goodreads.com/quotes/tag/freedom-of- speech](https://www.goodreads.com/quotes/tag/freedom-of-speech)

I then deleted sections randomly (mostly from the tail) to see what effect this would have on the rating. The rankings seem to shift radically with what would seem like insignificant edits to a body of text. The following text ranks as 92% "hatefulness". Then, removing only the text "HomeMy Books Browse Community Sign" (which I would think are not 'hateful' in any way) the ranking of "hatefulness" drops to 39%.

I realize the technical challenges that must be involved so I'm not really surprised at the behavior. But I will say that I question the merits of attempting to detect "hate speech" in the first place. Assume that this tool were to eventually reach a state where it could detect "hate" with absolute precision. Then what? What purposes shall it be used for? I can not imagine a single purpose that I personally would endorse. The notion of subjectively ranking the free speech of any other individual for any purposes whatsoever is repugnant to me.

[ __* BEGIN SAMPLE __ _] HomeMy Books Browse Community Sign

Get quotes daily Join Goodreads Quotes About Freedom Of Speech Quotes tagged as "freedom-of-speech" (showing 1-30 of 250) "I disapprove of what you say, but I will defend to the death your right to say it." ― S.G. Tallentyre, The Friends of Voltaire tags: disagreement, evelyn-beatrice-hall, freedom-of- speech, freedom-of-thought, misattributed-to-voltaire

Oscar Wilde "I may not agree with you, but I will defend to the death your right to make an ass of yourself." ― Oscar Wilde tags: freedom-of-speech, paraphrased, self-expression 1124 likes Like

Henry Louis Gates Jr. "Censorship is to art as lynching is to justice." ― Henry Louis Gates Jr. tags: african-american, american, censorship, freedom- of-speech, freedom-of-thought, freedom-to-read, literary 1067 likes Like

Theodore Roosevelt "To announce that there must be no criticism of the President, or that we are to stand by the President, right or wrong, is not only unpatriotic and servile, but is morally treasonable to the American public." ― Theodore Roosevelt tags: dissent, freedom-of-speech, truth-telling 644 likes Like

George Washington "If freedom of speech is taken away, then dumb and silent we may be led, like sheep to the slaughter." ― George Washington

Harry Truman "Once a government is committed to the principle of silencing the voice of opposition, it has only one way to go, and that is down the path of increasingly repressive measures, until it becomes a source of terror to all its citizens and creates a country where everyone lives in fear."

[Special Message to the Congress on the Internal Security of the United States, August 8, 1950]" ― Harry Truman

Christopher Hitchens "My own opinion is enough for me, and I claim the right to have it defended against any consensus, any majority, anywhere, any place, any time. And anyone who disagrees with this can pick a number, get in line, and kiss my ass." ― Christopher Hitchens

Jess C. Scott "Hypocrites get offended by the truth." ― Jess C. Scott, Bad Romance: Seven Deadly Sins Anthology [_ __END SAMPLE __*]

<comment><AUTHOR> there are several use cases for a product like this. Lots of social media companies like twitter, facebook, reddit / etc have huge problems because of hate speech. In addition, as sirfz mentioned, child abuse and harassment can also be applied in this case.

Online gaming is another area where hate speech is big problem and a tool like this would encourage participation and possibly detect toxic players that don't help to grow communities.

Here are some articles related to the problem:

[https://www.bloomberg.com/politics/articles/2017-03-14/germa...](https://www.bloomberg.com/politics/articles/2017-03-14/germany- threatens-53-million-fine-in-facebook-hate-speech-bill)

[http://www.dw.com/en/germany-to-force-facebook-twitter-to- de...](http://www.dw.com/en/germany-to-force-facebook-twitter-to-delete-hate- speech/a-37927085)

[https://www.nytimes.com/2016/07/20/movies/leslie-jones- star-...](https://www.nytimes.com/2016/07/20/movies/leslie-jones-star-of- ghostbusters-becomes-a-target-of-online-trolls.html)

[https://nobullying.com/six-unforgettable-cyber-bullying- case...](https://nobullying.com/six-unforgettable-cyber-bullying-cases/)</comment></comment>


The Cuban CDN - <AUTHOR> https://blog.cloudflare.com/the-cuban-cdn/ <comment><USER2> So pretty much what we did, when we didn't have fast internet. One bloke downloads the stuff (like I downloaded a pirated game from a BBS split over 3 nights) and then hands it out to his buddies.

<comment><USER3> Sure, but I think the impressive part here is the scale on which this operation is being carried out.</comment></comment>


The Cost of Avoiding Sensitive Questions - <AUTHOR> https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3437468 <comment><USER2> My wife was* one of those rare people who just went ahead and asked people whatever was on her mind. This had a curious effect as I often internally winced and thought "you did not just say that". Sometimes I had the impulse to apologize for her or put in a joke to soften the blow. However, curiously, generally people didn't seem to mind or sometimes registered very mild embarrassment. In very rare cases they just avoided answering the question and she wouldn't press them.

But the great thing about it was that one could have really interesting deep conversations with near strangers, because one would skip over all the smalltalk and immediately discuss something everyone cared deeply about. In comparison I would have shyly still been discussing the weather whereas she would be already talking theology.

* She does it less now. Perhaps my bad influence or having kids?

<comment><USER3> That's a great story and I'm like your wife in that aspect, but just intentionally. Either way you're lucky to have someone like that around, it can teach you a lot.

I've experienced very deep, fulfilling connections with strangers (friend of a friend level) and still haven't found anyone being embarrassed by these questions, but of course nobody else needs to be around as it can quickly be embarrassing. It can also be softened with an honest "if you don't want to answer I can totally understand" and move on with something else but almost always received a somewhat interesting response. In return, deep/very personal questions are sent my way and I've answered them all with the best of my knowledge.

I can see how many people are afraid of having real talk (specially introverts, as I was) because it can show your weaknesses, suffering and your potentially "wrong" ideas/thoughts. Truth is, everybody has their fair share of bs going on and being over polite and wasting time in meaningless small talk doesn't IMHO benefit anybody, and you miss very interesting mindsets and experiences that can make your life much better.

<comment><USER4> I honestly don't know what a "deep" question sounds like. Is there a list of topics that fall into that category somewhere?

<comment><USER3> There may be a generic list somewhere but I find them to come naturally from curiosity. Things like:

\- Do you like what you do?

\- Do you regret this or that?

\- Did you study what you always wanted?

\- How believing in X helped you?

\- What's the worst memory/event you went through?

\- Do you love your parents?

\- What's the best/worst your kids gave to you (emotionally speaking)?

\- Do you think you need this or is it a distraction from the important stuff (whatever that is for you)?

Those questions I just came up for nobody in particular (for a close friend those would be pretty normal) and depending of your background, customs, etc they might be deep or might not. They're not inquisitive and I'm definitely not judging or trying to convince about anything. They do make you think a bit before answering and you learn a lot from those, even from the most superficial people. You need to be very open and accept very harsh and contrary visions from your own in order to benefit from it though, and that's a long process.

<comment><USER5>
      - Are you happy?

is a good one.

</comment></comment></comment></comment></comment><comment><USER6> The author misses the point. People are avoiding sensitive questions not because it impacts opinion on average, but because of the rare outliers that ruin it for everybody.

It takes just a single asshole reporting you to HR to ruin your life.

<comment><USER7> Yep -- a classic "Expected Value is not the only thing that matters, but also one's Risk of Ruin" situation.

The counter-argument is this: do we _still_ overestimate our true risk of ruin when it comes to asking sensitive questions? Are we _actually_ going to get _fired_ (or whatever horrendous thing) for not asking that question? I bet the answer is that we still overrate our true probability of ruin when it comes to these things.

<comment><USER8> > Are we actually going to get fired (or whatever horrendous thing) for not > asking that question?

What's worse than being fired is to be stuck on a job where the environment/culture has gone bad. Not everyone has the economic and social mobility to change jobs on the fly.

<comment><USER9> Or where you're effectively in a dead end job because that incident with HR causes you to get passed up for any promotions or lateral shifts.

</comment></comment></comment></comment><comment><USER10> Hmm, in my head, I model conversation as a game of who can get the mine the most "intimacy", if you will, while revealing the least about oneself. So risque topics are, as the adjective suggests, high risk, but also high reward. Correspondingly, small talk is a lot of low risk, low reward back-and-forth. You don't have to be intimate with a stranger, but you need to stick your neck out if you want to progress beyond pleasantries.

Here's a longer piece about the whole topic of conversations that I wrote a while back: [https://zrkrlc.wordpress.com/2018/11/27/a-long-guide-to- conv...](https://zrkrlc.wordpress.com/2018/11/27/a-long-guide-to- conversations/)

<comment><USER11> Some personal advice: stop viewing your interactions in this transactional way and just be yourself. Stop giving a shit who reveals what and the perceived balance or imbalance of the same. Be kind and be generous.

<comment><USER12> If I were to "just be myself" at work, I would be fired very quickly -- because my self is outside the narrow little band of what is "approved of" in my workplace.

Every conversation of a sensitive nature is an opportunity for disaster if not treated with the utmost care not to be "found out"

<comment><USER13> Doesn't this depend on decency of the people?

<comment><USER14> No. Being an asshole -- regardless of reason -- is terrible for the team, no matter how decent they are.

Making an effort to conform to social norms of politeness goes a long, long way.

Don't get me wrong; feel free to upset people, but they should be upset about the factual content of the message, not the delivery!

<comment><USER15> I don't know why you assume _being an asshole_ is the trait your GP doesn't want to reveal. Any number of innocuous interests could hurt your reputation in different circles: hunting, being gay, watching anime, practicing (a different/any/no) religion.

"What did you do this weekend" is a loaded question if you're a cultural outlier at your workplace. Even decent people often have personal biases that lead to awkwardness and friction.

<comment><USER12> Thanks for being the only person to assume that I am an outlier in some way other than by being an asshole!

I don't know why everyone assumes that "different" has to be "asshole"

If anything, "asshole-ish" would be a part of "self" that is allowed to be expressed at work, so long as it is in limited doses

<comment><USER16> Sure, readers don't have to interpret what you said as "being himself must mean being an asshole," but when you say that being yourself would get you fired, some flavor of "asshole" is probably high any anyone's list for the type of attitude/personality that would cause such an extreme reaction. Can you expand on what sort of being-your-self attributes are not professionally disruptive, but would still get you fired?

I mean, I can think of plenty of hobbies/cultural differences/etc., that could make things awkward between colleagues, but not much that would get you fired. "Wow, Bob likes to go Skiing in a Furry costume while voting Republican and being an Atheist. We can't have that, let's fire Bob." doesn't seem all that likely of a reaction.

<comment><USER17> He's Republican / Libertarian and his worldview is grounded in economic and biological realities, which will absolutely get you run out of many (perhaps most) SV tech companies... for example, James Damore.

<comment><USER16> Again, you describe things that might be awkward, and even then it's only awkward if the people make them so. It's not at all fraught with "you're fired" potential if everyone remains calm and professional about such differences. Not only that, but you're think it ng entirely too narrow if "being yourself" only means expressing political and cultural beliefs.

Otherwise, I work in an environment in an industry that is much further "to the left" than SV Tech: academe. You may not believe it, but despite the cliche ostracism of "OMG that's a ::hushed tones:: conservative", it is quite easy to be one without self censoring. You simply refrain from injecting situations with those views when they're not called for, and if they are or you decide to do so during non-work times (breaks or side conversations) you be respectful of the other opinion. In short, don't be an asshole.

I get along with plenty of people all along the political spectrum at work, because we have an environment of respect and professionalism.

<comment><USER17> >You simply refrain from injecting situations with those views when they're not called for

In other words, you tend to avoid sensitive topics at certain times.

<comment><USER16> That isn't "not being yourself" unless you refrain from discussing those topics even when it might be called for. In my roughly two decades of experience working in academe, I have not suffered negative consequences for speaking unpopular opinions when they are relevant, nor have I ever seen someone suffer the same.

But, if in every meeting I attended I went on a rant about how 4-year colleges inflate student debt for marginal gain and future earning potential (yes, the issue is more complex than that) then I would be labelled some flavor of asshole, unprofessional, etc.

However, consider the context of admissions standards and policy for the institution. It would not be inappropriate to discuss aspects of that idea. How some segment of our population may not be good fits for the institution or 4 year college in general, that they would be better served by some other path of advanced education and job training, and how it is part of our job to set students on a good path rather than chase tuition dollars that put the student in debt for no likely tangible benefit. That would be appropriate to do, and in fact I do this on a somewhat regular basis, backed up by rigorous data analysis (my own area of work) from both my own institution and national data, when we are setting enrollment goals and other related benchmarks.

It's also been perfectly fine for me to discuss other controversial/unpopular opinions with colleagues outside of meetings during non-work related breaks or side conversations so long as I do so respectfully. Roughly two decades of steady career advancement would indicate that none of this has hurt me professionally: I have literally never failed to be awarded a promotion I was seeking, and quite contrary to negative consequences I have developed a reputation of speaking honest, unvarnished opinion backed by solid evidence.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Be careful about stuff like this.

There's an evolutionary reason for why it's default human behavior to avoid sensitive questions.

In general there's sort of a trend with psychology nowadays in how it identifies and teaches us how to deal with our own biases. While I think it's good to understand the origins of our biases it is not completely wise to ignore them because they are their for a reason.

</comment><comment><USER19> I'm feeling this hard at my place of work. We can't ask probing questions about people's real behaviors and actions, so while projects are running far behind we're not asking why. We're great at keeping a calm head and working towards a solution for today's problem. We have zero capability to reflect on how people's specific actions get us into these problems.

<comment><USER20> The one thing that you miss the most after leaving Google is the postmortem culture - the fact that anything that goes wrong will be picked apart for lessons to learn, and said lessons WILL be learned. Trying to get a large org to buy into that idea is just... impossible.

</comment></comment><comment><USER21> Anyone interested in this topic might find a search for the phrase 'preference falsification' interesting. For a great resource in book form, I highly recommend "Private Truths, Public Lies: The Social Consequences of Preference Falsification" by Timur Kuran. He was recently in The Portal podcast for an even shorter intro.

</comment><comment><USER22> The greatest conversational challenges I encounter are not immediately due to sensitivity but indirectly so due to customs, assumptions, and culture. I find many people are deeply fearful of originality and criticality and group defiance when it comes to their operating habits, perceptions, and executing behaviors.

In short many people will take drastic steps to irrationally preserve their operating habits as cognitive decisions even in defiance of direct evidence and at risk of eminent failure. Conversations about this are supremely challenging.

In my experience the reason why this is so challenging is not due to sensitivity, though sensitivity is certainly present. Instead I find many people are challenged by objectivity as a deeply instilled personality trait. The degree of objectivity acceptance by person is variable and varies further in group dynamics. This is a measurable quality of some behavior analysis tests.

</comment><comment><USER23> I wonder what would be a more personal (and interesting) question than:

\- Describe your relationship with your mother

\- Describe your relationship with your father

Completely open-ended, yet, is universal to everyone. Being candid in that area can provide a lot of foundational underpinning to understand someone.

But - would people find it awkward? Would they take offense? Feel pain thinking about the answer?

As for someone's political opinion in a specific area, I'm worried self- presentation pressures and social environment crafts us to more heated (or passive, to not make a stir) for us to conform. In fact, on that subject, Wikipedia's page on this area is amazing: [https://en.wikipedia.org/wiki/Conformity](https://en.wikipedia.org/wiki/Conformity)

The thing is - isn't the interesting thing someone's true hardships, needs, dreams, interpretations of life events, and desires, rather than something stemming from an idealized image they want to portray others, to be "good"? When social pressures of trying to say things the "right way", it's not a good read. Sure, they may be lashing out at others in outrage. Perhaps its very righteous and personal (most of the time?)

But what if, paradoxically, they're doing it out of pressure to be apart of the herd so they themselves are not ostracized? [https://en.wikipedia.org/wiki/Self- monitoring](https://en.wikipedia.org/wiki/Self-monitoring)

So I worry that even if we ask sensitive questions, there will be so much splitting, and so many people who are coy on their responses so as to avoid the people who really make a fuss of stuff. Maybe we'd find people are scared to validate their true feelings and needs. What if environment and fear of being an outcast/ridiculed for showing candor has them in a compliance state?

And that'd take us back to psychoanalysts in the 1940's and 50's :) [https://en.wikipedia.org/wiki/Karen_Horney#Theory_of_neurosi...](https://en.wikipedia.org/wiki/Karen_Horney#Theory_of_neurosis), [https://en.wikipedia.org/wiki/Character_orientation](https://en.wikipedia.org/wiki/Character_orientation). It's hard to come up with a new idea in this space.

<comment><USER24> Yes, sharing anything about my relationship with my parents would cause a certain amount of pain. I wouldn't feel like going through that for just anyone who decides to ask about it.

<comment><USER25> The act of refusing to answer this question is already giving plenty info that the person was seeking by asking it. As long as they don't push it after the refusal, the question has served its purpose, and it is all in good spirit imo.

I am absolutely fine with receiving those kinds of sensitive questions, as long as the person asking those is cool about it after hearing "no".

</comment></comment></comment><comment><USER26> People prefer to quit a job or fire an employee before having a difficult conversation.

<comment><USER27> Quitting/firing is a difficult conversation to have.

<comment><USER28> Hardly anyone gets fired that way. Instead they go in the spreadsheet for the next round of layoffs, which are mechanical and depersonalized.

<comment><USER29> >Instead they go in the spreadsheet for the next round of layoffs, which are mechanical and depersonalized.

I've never worked at a company where anyone was fired that way

</comment></comment></comment></comment><comment><USER30> I've gotten a long ways in my technical career from being able to ask sensitive questions. (In the business environment, I've focused more on them being "critical questions".) It has been really great for me, and I've tried to make it as painless as possible for others. It started simply enough.

For real business reasons, there are things that I either needed to know, or I needed to be confident that the other person either had the answer to or were were putting some serious thought to. I wasn't asking sensitive questions just to embarrass them. I expected them to give me an honest answer (and I helped make that easier if an honest answer wasn't forthcoming on its own). I learned that I could trust my team not to take any of my questions out of context, and they learned that I would never try to take their answers out of context either.

Here are the big takeaways as best as I've been able to pin them down: it is all about trust, personal motivation, and intention. These complications are multiplied by the number of participants (even in situations where one person is asking a question and one person is answering the question, but multiple people may be listening). The process is quick and painless when the trust between the participants is high, the personal motivation (at the cost of others) is low, the level of trust between everyone is high, and there are just the two people. (Can it get better than that? Surprisingly, yes. Consider when one of the participants is a benevolent all-seeing and all-powerful diety.)

I have to admit, I haven't read the full article. I'd be curious what dimensions of trust they recorded and how well it coordinated with their results.

If you've developed all those factors between all the participants, you can ask just about anything with the minimum of time wasted. As one or more of these factors break down, the more complicated the conversation becomes. Or the more process you need to introduce to smooth over the wrinkles. "Hey, I don't mean to embarrass you, but on the Johnson account it is more important to get an accurate documentation than to show any kind of regular process. See? Here is where we've been capturing this for everyone, and this is what's done with the information." (So then you see how something like transparency comes into play.)

I think it makes sense when you look at it in those terms. You also need to be asking questions work asking, and sometimes you're going to be asking questions that you don't want or need the answer to yourself. You might be asking to build up trust within a group of people, or you might be asking because you know that several people really would benefit from knowing something that they're too conditioned to do on their own. (This is where I started. And the key is that even if a question is confrontational, you must never ask in a confrontational tone. The tone of your voice and the content of your words have to reflect that you're asking because you need to know. Nothing personal, just business.)

Even still, I hardly consider myself the master. I've never written anything down on this, but this is the 10,000ft view of what I picked up up over the years. If you've spotted something along these lines in a book or an article somewhere, let me know. I'd like to compare notes.

<comment><USER13> You can ask, prod, show, but still managers and decisionmakers will go ahead and cargo cult, ie. "Agile" and "SAFe". So depends if you are Director or not. This time it'll be different..

</comment></comment><comment><USER31> What is a sensitive question? Not the examples provided. Here's an alternative.

Former Secretary of Defense for two presidents Donald Rumsfeld once framed (brilliantly actually) the possible things we know.

 _... there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns - the ones we don 't know we don't know_ [1]

A while after someone (which I can't trace back) made an interesting (and equally brilliant) observation - there is a fourth option - unknown knowns - that is, things we don't know we know. In most cases, that person pointed out, the category contains, things we actually know, but prefer to pretend that we don't.

So, what is a sensitive question?

A sensitive question is one for which the answer is an unknown known.

The cost of asking such a question in American society (and, obviously in SV) is dear. Avoiding them is free.

Ask carefully.

[1] [https://youtu.be/REWeBzGuzCc](https://youtu.be/REWeBzGuzCc)

<comment><USER32> The bit about unknown knowns does not make sense to me, also it seems to change the point of reference. It is referencing things from third party perspectives whereas the original ones are referencing from first party.

That is, you are talking other things other entities might not know about me that I know myself which makes them, from my point of reference, known knowns. And in the event that I don't know those things myself they just become unknown unknowns.

If you don't change goalposts and keep the point of reference constant, unknown knowns wouldn't exist.

Personally, if I actually had to define unknown known from the individual entity's point of reference it would most probably refer to derived or calculated values. For example, do I know the product of 171 and 342.45673. Do I know I could calculate it? Yes. But do I know it by head? No. Which means it is eventually a known but right now it's still unknown. But even that is a stretch of a definition.

I am convinced Rumsfeld's initial proposition covers the entire space of knowledge. Maybe you could give actual examples of unknown knowns from the individual's perspective.

<comment><USER33> If your parents are in town and ask where the nearest weed dispensary is, you might pretend not to know, even though you know. That's an unknown known.

<comment><USER34> But you still know it. Pretending not to know doesn't render it unknown knowledge.

To the other person/parents they don't know that you know, but that's looking at knowledge of party a vs. party b, which is mot quite what all this is about. Yo your parents it's still a known unknown (hence why they ask you).

I believe the closest to unknown knowns would be temporary loss of knowledge, where at a given moment you don't manage to make the right connections between the known knowns. So it's a "could know" given the right moment or prerequisite calculation step/thought, but right there you don't so it's an unknown known.

<comment><USER33> Yeah, I think the add-on is more of a cheeky social commentary.

Biases could also be unknown knowns.

</comment></comment></comment></comment></comment><comment><USER35> I'm a regular reader of Ask a Manager ([https://www.askamanager.org/](https://www.askamanager.org/)), and one thing that comes up over and over is how both managers and employees will avoid awkward topics ranging from trivial ("your breath smells") to consequential ("you need to step up or you'll be fired!"), to the point of going to extremes like quitting the job, just to avoid having a genuine conversation with somebody.

And I'm guilty of this too. I used to work with a dude who did not brush his teeth and used to wear the same clothes for a week in a row -- and I don't think anybody ever said a word to him, they just edged away quietly.

<comment><USER36> The worst one for me was the guy who didn't wash his hands after using the restroom. One day, one of my team members told me about this, and I didn't believe him, ha ha, so a few days later I'm in the restroom and this guy comes out of a stall and just walks out the door. So about a week later my guy who'd complained about it had some problem with one of our other systems, and who do they send over to help him out? You guessed it - Mr. Doesn't Wash His Hands. So I watch this guy sit down at my team member's keyboard and work on some stuff with him, then after he leaves my team member gives me this horrified look and gestures at his keyboard. I straight up just walked over to his cube, unplugged his keyboard and threw it in the trash and told him "Go tell IT you need a new keyboard."

It was easier to just throw away the keyboard than to have that conversation with someone. What grown adult needs to be told to wash their hands after they use the toilet? I later learned that almost everyone on the floor knew about this guy and they were all sickened being around him.

<comment><USER37> while the disgust is warranted, I can't help but feel that you've created a toxic culture there.

for example, the Keyboard scene, being horrified because someone touched your keyboard is not logical behaviour. In fact, the keyboard is probably more disgusting than the toilet paper.

The actions of your employee were not rational. But by validating them you create a mob.

"begin sickned/disguested" becomes a behavior of the in-group. Mocking that guy, overreacting is than encouraged by social validation. These are the same dynamics as bullying because it is a form of bullying.

Plus, this is exacerbated by your team member ( and maybe you later, just by asking) going arround bad-mouthing him.

Imagine if everyone started acting hostile towards you and you had no way to know why?

<comment><USER38> You phrased that a lot more gently than I would have. Kudos.

The guy should wash his hands after pooping, but performing a melodrama behind his back based on a pathological fear of unwashed hands seems extremely unprofessional.</comment></comment></comment></comment>


Ask HN: What Should My Little Bro Learn After HTML & CSS? - <AUTHOR>

<comment><USER2> Javascript. jQuery is a good onboarding spot, or jQueryUI. After that, teach him how to modify jQuery itself, thus learning Javascript.

</comment><comment><USER3> Here is what I will suggest :

1\. CSS Preprocessing Language : Any one of LESS or SASS.

2\. Twitter Bootstrap or Zurb Foundation.

3\. Concepts of UI/UX Design.

4\. Let him do some projects and hone his skills. How about making his own website/portfolio or making some HTML templates/themes and try selling it on marketplaces like themeforest?

5\. Once he becomes good at UI/UX Design & Development he can then focus on back-end. I would suggest him to go with Python & Flask. Learning Python language will not only help him in web application development but it will also allow him to explore & play other interesting stuff like Machine Learning, Computer Vision, etc.

</comment><comment><USER4> I went to jQuery after HTML/CSS. It's been extremely useful, and it was pretty simple to pick up.

</comment><comment><USER5> I went HTML then PHP (hadn't discovered CSS yet in 2004), then MySQL, then back to HTML/CSS. Then Javascript, jQuery, Ruby/Rails, since then.

But I would say rails. Ruby/Rails is way easier than Javascript for new devs I feel like.

</comment><comment><USER6> Lisp, so he knows how much fun programming can be before sinking back into the cesspool of more conventional languages.

</comment><comment><AUTHOR> Thank you for all your responses, I'll pass that information onto him :)

</comment><comment><USER7> How to talk to girls.

</comment><comment><USER8> Learn rails. It could be fun.

</comment><comment><USER9> Javascript. Then Rails.

</comment><comment><USER10> \- Depends on what direction he plans on heading. Does he want to stick as a web developer or move onto Mobile & Desktop App development? I'll agree with others and say JavaScript/PHP. It wouldn't hurt him to learn about Java/C++ as well. People talk about Go all the time, but I've never jumped into it.</comment>


Grunt/Gulp are dead - <AUTHOR> https://medium.com/@santini/grunt-gulp-are-dead-615918a5ca33

<comment><USER2> More accurate title: "my personal use-case for grunt/gulp will no longer be necessary once HTTP2 is widely available."

As for my team, we use SASS to add enhanced featuresets to CSS (like variables, functions, and mixins), Typescript to add compile-time typechecking to our rather-large SPA codebase, and yes, we do concatenate+minify our transpiled Typescript.

We use grunt to, in order:

1\. Package our Angular templates as a prebuilt module that populate's Angular's template cache, so we don't have to fetch them over the network at runtime _and_ we're one step less susceptible to browser caching issues.

2\. Compile our SASS to CSS

3\. Compile our Typescript to Javascript

4\. Concatenate and minify the resulting Javascript

5\. Run unit tests

6\. Add version+build numbers as query strings to our script tags (<script src="foo.js?v=1.25.11512"></script>)

The concatenation+minification is the last-step implementation detail. But just having server push (which, by the way, your very short blurb doesn't explain or even mention) gives us only one arguably-smaller piece of our usecase for grunt.

So yeah, not dead. Not even close.

<comment><USER3> Bash scripts can do 2-6 as well, probably #1 as well. Most of these use cases for grunt are one line of bash code. Bash is a pain to write, though so is grunt.

<comment><USER2> And for our Windows developers? My team is mixed: half OSX, half Windows. Should we maintain two separate scripts for each step and have our (repeatable) build process platform-detect and run the correct script?

</comment></comment></comment><comment><USER4> I went from grunt to gulp because of streams, then I went from gulp to make because of Unix. Takes some getting used to, but I'm very happy with it. Got livereload (hot reload) working and everything, and you can always write a Bash/Node/whatever script and run it from make if you need to.

Example Makefile with Babel, nodemon, mocha, webpack, React, and React Hot Loader: [https://github.com/acdlite/flummox-isomorphic- demo/blob/mast...](https://github.com/acdlite/flummox-isomorphic- demo/blob/master/Makefile)

</comment><comment><USER5> But preprocessors shall live long :(</comment>


WatchOut! International Space Station To Crash Into The Pacific After Retirement - <AUTHOR> http://techcrunch.com/2011/07/27/watch-out-international-space-station-to-crash-into-the-pacific-after-2020-retirement/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29&utm_content=Google+Reader

<comment><USER2> The original title is "Watch Out! International Space Station To Crash Into The Pacific After _2020_ Retirement".</comment>