You Are Not the Code You Write - <AUTHOR> https://medium.com/@fagnerbrack/you-are-not-the-code-you-write-e54f02876ca3 <comment><USER3> One of the things I liked about Caltech when I was a student there (late 70s, early 80s) is that when someone did or suggested something stupid, people would _tell_ them it was stupid [1]. Everyone recognized that everyone has utterly idiotic ideas now and then, and so being told that an idea of yours was stupid didn't imply that _you_ were any dumber than anyone else there.

A typical conversation would go something like this:

me: [suggests some stupid idea]

friend: that's stupid!

me: Huh? [pause a moment to think about it, realize he is right] Oh, yeah, that was stupid.

...and then we move on. Sometimes the last line bit might instead be

me: Huh? [pause a moment to recheck my idea, and see that it was not stupid] No it isn't!

friend [pauses a moment, realizes that he was hasty] OK, maybe it was not stupid.

...and we then consider my idea.

I find this much nicer than the way it is often done nowadays, where what you have to do is try to get the person to figure out for themselves that it is a bad idea, typically by asking them questions designed to make them think about the area where you have spotted a fatal flaw in the hope that they will eventually see it themselves.

[1] Well, not always. Once someone hacked into my account on the mainframe, found something I was working on that had some stupid bugs...and they fixed them and left. I never found out who did it. On general principle I suspect Walter Bright. :-)

<comment><USER4> Won't you accomplish the same result by asking questions around the suspected fatal flaw? If it's really a flaw, the suggester is made aware of it. If it isn't a flaw, the asker is given evidence that it's not. It just seems like a different approach to these end result.

I also believe that method promotes hashing it out together. Outright rejection of an idea seems to put the onus back solely on the suggester to defend the idea without having been communicated the reason. That said, communicating the reason for rejection goes a long way towards making both process more equivalent.

<comment><USER3> I should have mentioned that a blunt "that was stupid" was generally only for people you knew. If it was someone you didn't know well you would not be so blunt.

The nice thing about working with very smart people is that when they have one of their rare very bad ideas, they are smart enough to see it right away as soon as they see you reject the idea (assuming they think that you are reasonably bright too).

For the more common case of bad ideas that are not super bad, then yeah, there probably needs to be some discussion to work out if they need to be rejected, or if the bad parts can be fixed.

If you can keep your ego disentangled from your ideas and from how people respond to your ideas, a group can move past the occasional really bad ideas very quickly, and spent most of its time on the good ideas, or on the not good ideas that have some good things in them that can be saved.

</comment></comment></comment><comment><USER5> I think this is helpful advice for people who are new to software development. My experience has been that there are essentially an infinite number of things to learn and improve upon, so you will never really do anything perfectly. There is always something to criticize, but it may not be worth the time or money to fix it. To give some examples I've come across:

Critic: Component X could be Y times faster if you did it this way.

What you should ask yourself: Is performance of X actually a problem that your user base cares about or has complained about? If you improved performance of X, would it help your team in the long run?

Critic: Your code for X is hard to read.

What you need to ask yourself: Is this a core component that is going to stick around forever or is it some temporary thing you slapped together that is going to be replaced in the near future? If it is going to stick around, you should definitely refactor to make it readable. Otherwise, not worth the time unless you literally have no other priorities.

Critic: I noticed this new UI component you wrote has a bug.

What you should ask yourself: Is it critical to your company/team's image to have your UI working perfectly or do your users mostly care about other functionality which is higher priority? Does the bug stop anyone from using your software properly or being able to do something they want to do?

<comment><USER6> > Is this a core component that is going to stick around forever or is it some > temporary thing you slapped together that is going to be replaced in the > near future?

In general I'm in total agreement with your points, but in practice this one is really hard to do well. The majority of code that did anything useful tends to stay around for a long time, whether intentionally or not."There is nothing more permanent than a temporary fix."

This is why best practices and established patterns are so important for long term productivity. They help bridge the gap between effort and quality and in general work well. They're not panacea, but the exceptional case is a different issue.

<comment><USER5> Yeah, you're totally right here. Maybe a better way to look at this point is whether the code is in the core or the periphery. Give higher priority to refactoring core stuff since many people will have to digest this, as opposed to some periphery item which is stable and rarely changed (assuming you have readability issues in both core and periphery code). A lot of judgements going on as to which code is most important so probably best to have this discussion with multiple team members.

Regardless, my hope was to offer some rebuttals for bad code critics. Getting defensive at every criticism is not productive. Giving in and trying to fix everything is not a smart way to handle criticisms either since you might just be wasting time and money.

</comment></comment></comment><comment><USER7> One way that my team practices this is we don't allow the use of the word 'you' in Code Reviews. Because ultimately you are not talking about the person who wrote it but an artifact of their work. For example: "Can you explain why you did it this way?" vs "This code is hard to follow.". It's a simple rule we do that helps remove some of the personal nature of critiquing someone's work.

</comment><comment><USER8> While it is a mistake to interpret criticism of code as criticism of yourself, sometimes people _intend_ to criticize you personally. "Only an idiot would do it this way" is meant to condemn you as well as the code. Yes, people who write such comments are jerks. Usually the best thing to do is ignore the personal part. OTOH, if the pattern continues, somebody somewhere needs to offer some counter-criticism so the behavior can be corrected.

</comment><comment><USER9> Always followed this rule, 100% pure and simple, since the 70's when it all began for me.

Of course, I failed at various degree's in actuality, but I also had major wins with my 'code is not an identity' general policy.

One of those wins involving the realisation that in fact, code is not me, I am not code, but what code really is, _is for the User_. If the user can't identify with what the code is doing, it is in fact bad code. But only when the user is involved can one really determine good/bad on any kind of scale ..

tl;dr s/code/user/

</comment><comment><USER10> The corollary to this, which took me a few more years to shake off, was that building a code edifice may not effect any useful change to the world or produce anything worthy of reuse. It's all very sensitive to the context you wrote it in, the design the code serves, and so on. A lot of value is built on simple automations that you could describe with a few lines of script - <USER2> those cases, an already existing design is doing the thing you wanted. The heavy lifting happens only after you need a new design.

</comment><comment><USER11> > You Are Not the Code You Write

Unless you're really passionate about your work. Take this from developers and programming will become just a job.

All the things the author mentioned in this article is just a bunch of statements probably based on their personal experience.

<comment><USER12> I think the gist of his argument is to not be ashamed of your work in the face of criticism. He's not advocating a lack of passion, just to not let the critics get you down.

<comment><AUTHOR> That's correct.

</comment></comment></comment><comment><USER13> I am all the code that I wrote, all the code I will write and many things that has nothing to do with the code.</comment>


Facebook board member Peter Thiel met with white nationalist - <AUTHOR> https://www.businessinsider.com/facebook-board-member-peter-thiel-met-with-white-nationalist-report-2020-9 <comment><USER2> I feel like sensationalist news like this doesn't belong here? Or at least the conversation that stems from it will ultimately be uninteresting/ sheerly bitter argument? (I'm hoping I prove myself wrong here)

<comment><USER3> I share the expectation of the outcome, but it is vitally important that HN types address the absolutely monumental amount of political effect that tech is having, and the internal policies and biases that are driving it.</comment></comment>


Room Temperature Conversion of CO2 to Coal - <AUTHOR> https://www.nature.com/articles/s41467-019-08824-8 <comment><USER2> Not sure if anyones really considered this, but it bugs me to see future nascent industrial applications that want to pull CO2 out of the air for products. We could very well get ourselves into an even worse situation with too little CO2.

Off the top of my head, if levels were to drop below 120 ppm, we would see mass plant die off. Pre-industrial levels were already around 180 to 200 ppm. So even if we can stabilize right now around 400 ppm with renewables, AND start to sequester back to pre-industrial levels, we would need to also make sure we can turn that sequestration OFF at some point. And what is that point exactly? Optimal ppm CO2 level is actually very debatable. The dirty secret is that plant growth is most optimal around 1200 - 1500 ppm CO2. Likely because plants evolved in epochs of much higher levels. Stabilizing at todays 400 ppm is probably optimal.

We could very well get into a situation in the future where we are begging industry to STOP pulling CO2 out of the atmosphere for fear or crop failure, instead of pumping it out. Industry in China and India that might be outside of our sovereignty. It may take 1000 years, but levels will come down naturally if we can stabilize at 400 ppm. That stability will only come from technological advances like electric cars, planes, trucks and lab grown meats.

<comment><USER3> > We could very well get ourselves into an even worse situation with too > little CO2.

Given the state of the world right now, this just seems like a very unlikely scenario _relative to_ the reverse of too much carbon.

I'm not saying we shouldn't consider it per se, but let's prioritize our energy where it matters.

</comment></comment><comment><USER4> Another technology with several uses:

      - Remove CO2 using less energy than other methods
      - Change it into C and CO
      - Make best-class supercapacitors for energy storage from C.

I think more such breakthroughs no one thought of will appear in future, likefamous problem of horse dung on streets of NY ([https://www.historic- uk.com/HistoryUK/HistoryofBritain/Great...](https://www.historic- uk.com/HistoryUK/HistoryofBritain/Great-Horse-Manure-Crisis-of-1894/))

<comment><USER5> Such breakthroughs will undoubtedly occur. But we cannot rely on breakthroughs for any particular problem.

In the case of the horse→car substitution in NY in the late 19th century, the optimal situation was that noone worries too much, and the car is invented, and all is well.

But they could not have known that it was a horse substitute which would be invented. Imagine if 19th century Londoners, faced with a bulging, over- capacity sewerage system, had rested easy in the knowledge that a breakthrough would sooner or later come along to save them.

It would have been catastrophic. No such breakthrough occurred and they _did_ need to worry. In reality, they worried enough that they build a whole new system and there was never a crisis.

We should not make the mistake of hoping that the right technology will come along to fix Global warming.

Technological process is almost assured. But in any given area we have no idea how much will occur, and how soon.

<comment><USER4> > We should not make the mistake of hoping that the right technology will come > along to fix Global warming.

If everyone hopes for such technology and no one tries to invent it, as you say, it won't come along.</comment></comment></comment>


What not to do at interviews - <AUTHOR> http://posterous.com/#spaces/shenglong/posts/75353598

<comment><USER2> You... might wanna check that link out

Here is the actual link to his post, for anyone curious:

<http://shenglong.posterous.com/at-interviews-dont></comment>


New York City Subway Ridership Jumps - <AUTHOR> http://www.wsj.com/articles/new-york-city-subway-ridership-jumps-1429554995

<comment><USER2> It is infuriating to have the life blood of one of the greatest cities in history so utterly ignored by Andrew Cuomo, the person who is actually responsible for funding it. The best and most practical plan for funding the unfunded capital plan is Move NY [0], which is a form of congestion pricing.

[0] [http://iheartmoveny.org/](http://iheartmoveny.org/)

<comment><USER3> That looks pretty good. However, I don't think it's really reasonable in a city the size of NYC for people to be commuting by car. I'd honestly rather see the following:

1\. Bridge tolls raised to make things even rather than reducing some to make them even. 2\. Exception for trucks which transport stuff that can't be transported by train. 3\. Use the money to expand parking at suburban entry points to the rail system and improve the rail system.

The way I see it, bridges are for trucks transporting goods, not for people driving to work.

<comment><USER4> You may not find driving across bridges palatable for the environment or congestion, but there are many situations in which it makes sense. For example, there are people with disabilities who can't take trains. There are workers who live in areas of Queens or Brooklyn not covered well by the Subway. There are tourists who want to drive into the city from neighboring states.

I speak from personal experience. I personally hate driving into the city but I'm aware of many people/situations who for all practical purposes must.

<comment><USER5> * Access-a-ride exists for disabled people

* We should be building more subways in Brooklyn and Queens.

* Tourists can park in NJ or north of the city and hop on the trains.

Your thinking is either transit-centric, or it buys into car culture.

<comment><USER6> WRT more subways — I'm all for this, but it's _sort of_ expensive and takes a lot of time. MTA is not exactly the fastest builder (see 2nd avenue line, PATH).

Tourists driving onto Manhattan are probably a minor traffic problem. I'd rather have them pick some "tourist pass" at designated locations on roads in NJ than have them leave their car and hop onto a PATH train with all their tourist gear (possibly not very light) or take a taxi to avoid a high bridge toll.

Having lived in Jersey City for some time, I can sympathize with people who'd rather take a car when they need a guarantee to get to NYC, because PATH can be canceled "due to a signal problem" unpredictably at any moment.

<comment> T-hawk The PATH is not the MTA, it's the Port Authority.

And the PATH is reliable just fine. It doesn't get "canceled due to a signal problem". I've lived in Jersey City or Hoboken and commuted on the PATH for over ten years, with maybe five instances of any difficulty at all aside from Sandy or blackouts. It's enormously reliable compared to the construction messes that occur on the MTA subways, where entire lines shut down for entire weekends.

And the PATH is only touristy on weekends, there isn't competition between tourists and weekday commuters. Overall, NJ within PATH range is one of the best options to live affordably with a short NYC commute.

</comment></comment></comment></comment></comment></comment><comment><USER7> Best thing I did for my mental sanity this year has been purchasing a bike. I ride it door-to-door from my apartment in Greenpoint to my office in Manhattan. I haven't taken the subway in almost 4 weeks. I am noticeably happier and more positive.

<comment><USER8> You're lucky your bike commute is so calm. I ride my bike to work 3/4 days a week year round from the UWS to wall street, and the dedicated bike lanes are filled with people walking in large groups, roller bladers, joggers, bikers who don't know what they're doing, etc.

<comment><USER9> What you need is still: less complaining, more bikes. When the flow of bikes is steady, the groups and joggers realise that this space is not meant for them.

</comment></comment></comment><comment><USER10> 1.75 billion customers last year which is a 2.6% increase. It would be helpful to have the context of how much of the city's population has used the system over time. A quick google search makes me think this increase is far outpacing the population increases in the city.

<comment><USER11> That does seem to be outpacing growth in both the City and metro area. The City is now at approximately 8.5MM people [1], the metro area has approximately 20.1MM people.

The City had 8.17MM people in 2010[2], so just a hair under 5% growth since 2010, maybe 1% per year?

[1] [http://www.census.gov/newsroom/press- releases/2015/cb15-56.h...](http://www.census.gov/newsroom/press- releases/2015/cb15-56.html)

[2] [http://quickfacts.census.gov/qfd/states/36/3651000.html](http://quickfacts.census.gov/qfd/states/36/3651000.html)

<comment><USER12> The population growth analysis would require further breakdown. The eastern half of Queens doesn't have a subway network. And what about Staten Island?

<comment><USER11> I couldn't find any sub-regional breakdowns for this year's census data yet. I assume they'll appear at the second link eventually.

Speculating but based on living here: much of the population growth has been in Brooklyn and "inner" Queens. The Bronx and Manhattan have also had growth but at slower rates. Outer Queens lacks subway but the LIRR (commuter rail) has multiple lines hitting those neighborhoods. Not at all the same as rapid transit but they're not totally lacking transit options, and typically connect into key subway junctions.

SI lacks rapid transit to the core business centers in Manhattan and Brooklyn. You can take express buses, drive, or the SI Ferry to lower Manhattan but then you still (typically) have an additional commute.

Several of the NJ cities immediately west of Manhattan have also had decent growth but aren't counted in the NYC stats.

</comment></comment></comment></comment><comment><USER13> I find it interesting that the Howard Beach stop (where one gets off to go to JFK airport) dropped by 42% since 2013, while the Aqueduct Racetrack stop - which is the immediately prior stop - increased by nearly 200%.

Was the Howard Beach stop closed down for repairs during that time or something?

<comment><USER14> Beach was damaged severely by Sandy and I believe parts of it were closed in 2013. Racetrack increased due to ResortWorld probably.

<comment><USER13> Oh, good call.

</comment></comment></comment><comment><USER15> Fares just went up 10%. Does that make sense?

</comment><comment><USER8> There's so much bullshit in the NYC transportation situation, it's ridiculous. Traffic cops spend all their time ticketing parked cars(usually for remaining parked during the twice a week street cleaning, or not having paid the meter), because it is the easiest source of revenue. Meanwhile, on the main avenues of NY during rush hour, trucks double park and take up a half or a third of the available traffic lanes, and very rarely get tickets.</comment>


Richard Branson on the Right Way to Multitask - <AUTHOR> http://www.entrepreneur.com/article/235460 <comment><USER2> So what is the relationship between the 1984 film described in this interview and the one that was released (with the same stars)? Is it the identical film?</comment>


Ask HN: iOS 9 is out with its ad-blocker support. How do you feel about that? - <AUTHOR> I find it weird that an app like Crystal doesn't have whitelist support. I still am not comfortable giving someone money for an ad-blocker app either. I got Crystal while it was free, though - but it's annoying that something as basic - and minimally ethical? - as a whitelist was not included at launch.
I'd hoped to install an ad-blocker on my mom's iPad 3G, but apparently ad-blockers aren't supported by it for some reason.
Ad-blocking feels a lot like the piracy discussion. I like to think of it in terms of "honest downloading" vs "dishonest downloading". Sometimes, people just come up with excuses posing as arguments to cover for their laziness and selfishness - but there are also perfectly valid arguments to be made. But those arguments may not have anything to do with some people's actual motivation.
Thoughts? Experiences? Practical as well as ethical. I have a pretty good idea of how the general opinion will sway, but it'd be interesting to see some people think out loud about it - especially when they don't have an ... unfortunate ... conflict of interest like a Marco Arment.
Will you be installing ad-blockers on your folks' devices, when you visit them for Thanksgiving? Why? <comment><USER2> I was looking forward to it actually, but very disappointed that it's not supported on my iPhone or iPad. Update: just installed BlockParty on both via XCode and very pleased.

[https://github.com/krishkumar/BlockParty](https://github.com/krishkumar/BlockParty)</comment>


The Crystal Goblet (1955) - <AUTHOR> https://web.archive.org/web/20181115190438/http://gmunch.home.pipeline.com/typo-L/misc/ward.htm <comment><USER2> Matthew Butterick disagrees strongly with the Crystal Goblet[1]. His argument that it's impossible _not_ to communicate with typographical choices convinced me to doubt the contents of the text "The Crystal Goblet".

[1] [https://practicaltypography.com/drowning-the-crystal- goblet....](https://practicaltypography.com/drowning-the-crystal-goblet.html)

<comment><USER3> I do everything I can to make typography invisible to me. I do this by converting it all to the same style. I don't allow websites to chose their own fonts. I use Firefox's Reader View whenever possible. I remove all formatting from ebooks and apply my own CSS in Calibre. I'm convinced that the most legible typography is the one you're most familiar with, and if you consistently read the same typography it will become the metaphorical crystal. The actual design of the type matters very little.

<comment><USER4> I might do that myself, that sounds really cool. I've never imagined doing that before.

</comment></comment></comment><comment><USER5> When designing HyperStudio in 1988 and beyond, I had a similar philosophy, that the software tool should strive to be invisible to the tool. There was an occasion when we asked a user how they thought the interface could be improved, and they responded "what interface?". I don't presume that we were exceptional in achieving our goal, but we did try, and this article is an interesting support of that goal. I'm also reminded of what I read about Japanese art, what are the fewest lines needed to create the image and story?

</comment><comment><USER6> Ironically, because of the very small font and the wide paragraphs (on my phone; Firefox on Android), I found reading this to be very difficult, as I had to scroll sideways a lot after I zoomed to the point where I could read it.</comment>


The Warlock Hunt: The "#MeToo" moment has now morphed into a moral panic - <AUTHOR> https://www.the-american-interest.com/2017/12/06/the-warlock-hunt/ <comment><USER2> I personally think this is a transition period. We're transitioning into a world where it is not okay to bring sex into the workplace, and to a world where you ask for consent instead of "just going for it".

There's nothing harmful about this. No reason to be afraid. The easiest way to think about this is: What if you were a man, and were alone with another man in a room? What is it okay for you to do/say? Would you show any physical affection in any way that could be construed as sexual? Would you make lewd jokes, or lewd comments about that man (or other men)? Of course not.

You'd work together, get the job done, and move on. Treat women the same way you would men, and life will be just fine.</comment>


What I do with data at 37signals - <AUTHOR> http://37signals.com/svn/posts/2767-what-i-do-with-data-at-37signals I've always been a fan of having information about many aspects of how your business is running. Not having detailed information feels like driving blind. <comment><USER2> "Answer those "I wonder" questions- one of my favorite parts of working at 37signals is watching products develop every day in Campfire and on Basecamp. While doing that, people occasionally start a sentence with "I wonder…". I get to move from wondering to knowing, and that's loads of fun to do."

Wait, what? He's rifling through people's live projects all day? Does that strike anyone else as unsettling?

<comment><USER3> I think you're misreading that: 37Signals _own products_ are developed with extensive use of Campfire/Basecamp, and while watching that conversation their _own workers_ will say things like "I wonder if customers who pay us more money are less likely to send in support requests", and this is a question answerable with data, so yay for the data guy.

</comment></comment><comment><USER4> _What would you say you do here?_

+1 for the (extremely subtle) "Office Space" reference.

</comment><comment><USER5> I am deeply curious why 15 people up-arrowed this. Was there something in it that I missed?

<comment><USER6> Apparently 15 people found it useful and/or interesting. If you don't, flag it or move on.

<comment><USER5> There is no way that 15 people found it useful and/or interesting. It's someone giving a brief resume and then, in a nutshell, saying "Gonna be doing stuff with data".

So my question stands. Do people just see 37 signals and data and imagine that it's interesting, so they up-arrow? Are there bots at work? Etc. I am deeply curious.

<comment><USER6> Bots? Maybe?

37 Signals is a pretty popular company so I imagine people get excited for any kind of inside information on their inner workings.

<comment><USER7> Also, the upvote is a good way to bookmark something to read later (ie. upvote => saved stories). That has to account for some of it.

</comment></comment></comment></comment></comment><comment><USER8> This guy should work on ending their practice of storing passwords in plain text.

<comment><USER9> While hardly on-topic, I was surprised to find that, according to [http://blog.jgc.org/2009/05/can-you-trust-37signals-with- you...](http://blog.jgc.org/2009/05/can-you-trust-37signals-with-your.html), they really do store passwords in plain text.

<comment><USER8> They definitely still do as of a few days ago; I got an unrequested email from them the other day with my password in plain text and was pissed.</comment></comment></comment>


Show HN: My Implementation of "Quick, Draw", a Game Developed by Google - <AUTHOR> https://github.com/vietnguyen91/QuickDraw <comment><USER2> "Live drawing". Very cool and plenty of possibilities here. Shared whiteboards for one. But does anyone remember the flash game "I'm in Like With You" from around 2007? You compete in a chat room with 8 other players. First one who guesses the picture being drawn wins. Usually with funny words such as "Squidward". Kind of a web based charades ;)

<comment><USER3> Do you mean something like [https://skribbl.io/](https://skribbl.io/) ?

</comment></comment><comment><USER4> My head was spinning for a bit because I thought this was referring to the ancient classic Macintosh graphics API:

[https://en.wikipedia.org/wiki/QuickDraw](https://en.wikipedia.org/wiki/QuickDraw)

Edit: the original title had "QuickDraw" which has since been updated to "Quick, Draw."

</comment><comment><USER5> That wasn't the QuickDraw that came to my mind

<comment><USER6> Because Google's is named "Quick, Draw!"

<comment><USER7> Ok, we've put in some punctuation above.

<comment><USER6> Thanks dang!

</comment></comment></comment></comment><comment><USER8> That demo is awesome! I wonder what real world uses this could be applied to.

By the way, your animated GIF is over 80 MB. You might want to put the video on YouTube or use an animated PNG.

<comment><USER9> There is this file: [https://raw.githubusercontent.com/vietnguyen91/QuickDraw/mas...](https://raw.githubusercontent.com/vietnguyen91/QuickDraw/master/demo/quickdraw.mp4) (4.5 MB) but github won't preview it.

</comment></comment><comment><USER10> Very cool. Is there a writeup somewhere?</comment>


Extract Shading [video] - <AUTHOR> https://www.youtube.com/watch?v=xLHRBRIzjXc <comment><USER2> Damned. That is fantastic. But wtf is "Ron Swanson" doing there?</comment>


Bring Back the Draft - <AUTHOR> https://medium.com/editors-picks/28dae9ecf872

<comment><USER2> First off... when did medium.com become the source for 60% of HN front page news? Either most of us are failing badly at taking a broad view of the news or these guys have an obscene amount of spam accounts building karma. Either way, we are losing.

Regarding the article... there is no consideration given to lessening our nation's commitment to all its various wars. There is no discussion of whether we should continue to send troops. There is not even the suggestion that -- holy shit -- maybe we should reconsider our current engagements and decide where our existing, and substantial, resources would be better spent.

I'm anti-war, but I'm not anti-military. And anti-war is a ridiculous stance that ignores all of human reality, so it's not something I can honestly take seriously and argue in favor of.

This ridiculous diatribe ignores both the causes of our current situation and the potential results of sending everyone in the damn nation out to fight, or support, regardless of their skills. Yes, by all means, let's inflate the military and support ranks! Not only will it burgeon all sorts of military posts, _it will drain all the service industries those people previously occupied._

Another silver bullet with a lead lining, shot straight into the heart of our economy. The author fails as an economist, a strategist, and even a nationalist.

Might be a strong contender for President.

</comment><comment><USER3> Coming from a county where there was a "draft" until 2011 (Germany), I have to say that his view points is very romantic, at least when it comes to the "nation-building" part.

First of all, military service for a small time is a big cost factor: this leads to the military trying to avoid spending, by making less people eligible. In Germany, it happened to multiple of my friends that just before they had to start their service, the military decided not to "pull" them because they made their categories non-eligible for military service. This severly damages the fairness of the service. Had there not been the option of civil service as a replacement, that unfairness would have been even worse: the modern military just doesn't have enough resources to have a whole generation in service all the time.

Second, I feel as connected to my generation/nation before or after my service. I consciously did civil service[1] and liked it, though.

What I _liked_ about the service was that it forces you to do something non- proitable for a while. Even though I had my eyes on doing something in IT and my "straight" career path would have direcly led me to university, I was caring for mentally disabled people for a year. It is an experience I don't want to miss and gave me a lot of insight into and respect the whole "social support" branch of society, which I still hold in very high regard. It is also an experience I would have skipped if I had the choice.

[1]: By which I mean: I did civil service because I saw it more fit for me, not because I absolutely wanted to avoid military.

</comment><comment><USER4> So, the government already takes half of my earnings. Now, this author is proposing the government gets years of slave labor out of me, to kill members of foreign cultures the government deems bad. Somehow, I have a problem with this.

I have a better solution. Let's only use our military for defense of our country and stop being the world's policeman.

</comment><comment><USER5> How about instead your generation just dies and the rest of us will attempt to change the fact that warfare has become a standard of modern human society passed on from primitive generations.

Yea, I know that's harsh, but it's late and that article just rubbed me the wrong way.

<comment><USER6> Kudos, I've never read something so harsh and yet so genuinely hopeful.

I really hope our generation (you refer to the rest of us, so I'm assuming you're younger than a Baby Boomer (as am I)) finally breaks this cycle of big wars. With the world becoming more interconnected, and the economic playing field beginning to level (read: America can't afford big wars anymore) we just might be able to move on as a species.

Another world is possible, right?

</comment></comment><comment><USER7>
        Granted, my cohort is too old for combat. No amount of training could put us in the kind of physical shape needed for that job. But we're not too old to do many of the other jobs the military needs done. Military effectiveness is more than ever about brains than brawn

The draft has always been about brawn, not brain. The brain in the military has always been career military, the fact that military effectiveness is more about brains than brawn played a non-trivial role in ending the draft.

</comment><comment><USER8> I'm sure that if the military had a requirement for a few thousand middle aged bloggers to swell their ranks; they would put up recruitment posters.

</comment><comment><USER9> >Bring Back the Draft

>And start with people my age

...

> if my number came up in a truly level draft — a draft that didn't > distinguish by age or financial station — I'd willingly go to Afghanistan

Make up your mind!

</comment><comment><USER10> Get your gun out of my face. And stop advocating the needless killing of Americans and the destruction of billions of dollars of wealth coercively taken from Americans.

</comment><comment><USER11> I can't tell if this is satirical or not. This reads like a Swiftian condemnation of the needless wars we're fighting.</comment>


The HTTPS-Only Standard - <AUTHOR> https://https.cio.gov <comment><USER2> There's something about their favicon being the default green lock ( [https://https.cio.gov/assets/favicon.ico](https://https.cio.gov/assets/favicon.ico) ) that unsettles me. It feels like a social engineering trick.

<comment><AUTHOR> That's an interesting point. I'll be straight, it's lifted right from [https://istlsfastyet.com](https://istlsfastyet.com). And cio.gov is in the HSTS preload list [1] so (once the list makes it into stable channels) the chances of the domain being downgraded to plaintext are pretty low. But I had not thought of that angle. Hmm.

[1] [https://18f.gsa.gov/2015/02/09/the-first-gov-domains- hardcod...](https://18f.gsa.gov/2015/02/09/the-first-gov-domains-hardcoded- into-your-browser-as-all-https/)

<comment><USER2> ..and people complain about transparency :)

I wasn't calling it a social engineering trick, more that it just felt like one. To the average person they wouldn't second guess the icon. To those who believe in HTTPSAllTheThings, we question anything out of the ordinary.. and that little padlock shouldn't appear in the tab.

As I said, it just felt weird, sort of the same feeling you get when you go to Apple or YouTube and there's a warning on the lock icon. You just want to hit the back button almost instantly fearing something dodgy is happening.

<comment><USER3> You were absolutely right in calling it a trick. Browsers explicitly[0] stopped putting the favicon there as sites started to trick users like this.

Seems like an odd choice of UI chrome that browsers decided to keep.

0: [http://www.wired.co.uk/news/archive/2012-04/25/firefox- fires...](http://www.wired.co.uk/news/archive/2012-04/25/firefox-fires- favicon)

</comment></comment></comment></comment><comment><USER4> Hey gov, how about promoting a transparent decentralized system for certificate signing that doesn't require paying a vig every year to a corporation that can easily be leaned on by not-so-well-meaning authorities?

Oh wait, nevermind... I just realized something.

<comment><USER5> > how about promoting a transparent decentralized system for certificate > signing

Honest question: with a decentralized system for certificate signing, what would be the trust root?

The current system has the browser makers as the root of trust; this trust is delegated to a set of certificate authorities through the list of root certificates which comes with the browser; these certificate authorities then delegate to their intermediates, which finally certify a server as trusted for a fully-qualified domain name.

Without a root of trust, anyone could say "I'm example.gov, this is my certificate", and present "proof" of that. A trust root is necessary to prevent this.

So far, the only working proposals I've seen for decentralized trust (which don't do away with the human readability side of Zooko's triangle) are based in distributed proof-of-work systems like Bitcoin's, where the trust root is the distributed "chain". Has anyone ever tried to apply a system like that for certificate signing for TLS?

<comment><USER6> The problem with achieving real adoption of crypto had historically been made a _lot_ harder than it should be because too many problems are trying to be solved at the same time.

Separate the problems! It is much easier to find realistic solutions when the requirements are narrower. The remaining needs can be solved later on. Once _some_ usable infrastructure has been established, it might be possible to leverage that infrastructure to add back in some of the missing features.

For HTTPS, a good start would be PHK's suggestion of simply auto-generating self-signed certs in apache _by default_ , as a replacement for plaintext. Authenticating those certs can happen later.

After keys are everywhere, a potential solution might be t o allow _both_ PKI authorities and some sort of web-of-trust (or other methods? blockchain? something new?), and _exposing the source of trust to the user_ in way they can manage.

There is no one-size-fits-all solution to the trust problem, so let the user decide because they know what their requirements are. If I'm browsing to some bank, a well-known PKI root might be a good trust source. If I'm chatting on some local forum, a web-of-trust auth might be better (it's a local forum, so fingerprints can be exchanged manually, friend-to-friend).

<comment><USER7> Encryption is not separable from authentication.

<comment><USER8> It _so_ is. A plain old Diffie Hellman key exchange will give you encryption without authentication.

All you need for encryption is to be able to share a secret - this in no way requires authentication.

<comment><USER9> Without authentication your connection is susceptible to undetectable man-in- the-middle attacks that DHE does nothing to prevent. That they're separable is superficially true, but not interesting, as encryption alone doesn't stop people from reading your traffic, which is the whole point.

<comment><USER6> This argument comes up so regularly, one might speculate that some people are _trying_ to keep the internet in plaintext[1].

Yet again, encryption is a replacement for _plantext_ , which is the only thing it should be compared to. Of course you can MitM attack it, but that's not something that is easily done in bulk.

Simple encryption _raises the cost_ of an attack from "trivial wiretaps, DPI optional" to the time, money, and effort required to do a targeted MitM attack. Additionally, while it is generally impossible to detect wiretaps, MitM can leak information that betrays the presence of an attack.

Remember, this isn't intended to stop all types of attacks. It is simply a _very_ easy to implement feature that lets you replace plaintext with something resistant (not proof) to eavesdropping in general, and proof against some types of bulk surveillance.

Note: I haven't said _anything_ about presenting this type of non- authenticated communication to the user as "secure".

[1] see PHK's "Operation Orchestra" talk

<comment><USER10> It doesn't raise the bar high enough that the people who are _currently snarfing internet traffic wholesale_ would bat an eye at.

It doesn't matter how secure the phone line is when you have no idea who you're actually talking to. Especially when there are people with money, means and access to make sure that you're always talking to them.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> The most important line in this standard:

> All browsing activity should be considered private and sensitive.

<comment><USER12> Clearly this government office isn't talking to some of the other ones, right?

<comment><USER13> The Fed employs 2.7M people. I don't really understand the people who imagine it's one great big well-oiled machine with everybody in agreement, on the same page of the same playbook.

</comment></comment></comment><comment><USER14> The HTTPS-only folks mean well, and I support it as a stopgap solution, but it is useful only in that it can probably be implemented more quickly than IPSec- everywhere (or, if IPSec proves to be unsuitable, then some successor standard with the same goal of encrypting all traffic).

The latter, however, should be preferred as a permanent solution. The Web is by no means the only part of the Internet that needs to be secured.

<comment><USER5> IPSEC and HTTPS work at different levels. With IPSEC, your computer can be sure it's talking to the computer at 198.51.100.1 and not to any other computer. With HTTPS, your browser can be sure it's talking to www.example.gov and not to any other web server. Both work equally well against passive eavesdroppers, but they authenticate different things and so will work differently against active attackers.

<comment><USER15> In other words, IPSEC is useless without DNSSEC, and that isn't getting universal adoption anytime soon.

<comment><USER5> Oh, no, it's useful for what it's designed for: to protect communication between two computers. If I have IPSEC protecting the connection between my desktop and my internal DNS server, and between my desktop and my database server, I know that connection to my database server is protected by IPSEC.

It doesn't protect the mapping between a computer name and a IP address, but that's not its job.

</comment></comment></comment></comment><comment><USER16> Outstanding! This is wonderful news. I've heard people ask whether a given site or protocol really _needs_ to be secure but I hold the opposite opinion: everything should be encrypted unless there's a specific and compelling reason otherwise. I'm thrilled that major organizations are coming to the same conclusion.

</comment><comment><USER17> [https://istlsfastyet.com/](https://istlsfastyet.com/)

This is a step in the right direction. Worldwide HTTPS adoption makes the Internet a safer place for everyone.

</comment><comment><USER18> Great. When that is done, then do email with is frankly a far more retractable problem in general (and a field where there is almost zero innovation or improvement, thanks to Microsoft (Exchange/Outlook/Outlook.com), Apple (Mail), and Google (Gmail)).

<comment><USER19> What's wrong with email? It's a 40 year old standard that still works great.

<comment><USER18> It is insecure in so many ways...

<comment><USER20> One thing that amazes me is that I get a huge volume of spam emails that claim to be from financial institutions. I use gmail for two reasons: (i) deliverability to mailing lists I need to be on and (2) other mail programs don't filter that junk out.

In 2015 it should be impossible to send a fake email from chase.com

<comment><USER19> If chase.com uses dkim and spf records and if your mail server is properly configured then it is indeed impossible.

<comment><USER21> and, of course, DMARC -- so rejection policies can be set.

PGP FTW!

Now if only STEED would be implemented... [http://g10code.com/docs/steed- usable-e2ee.pdf](http://g10code.com/docs/steed-usable-e2ee.pdf)

But, unfortunately, even mail from a properly configured mail server on properly protected domain will still end up in gmail users' spam boxes by default. Domain and server rep systems are a bear to work with.

</comment></comment></comment></comment></comment></comment><comment><USER20> I guess this means you'll visit a government web site and 2 times out of 10 gets a popup that says the certificate is out of date.

</comment><comment><USER22> They also use a pretty strong TLS conf [https://gist.github.com/jvehent/98fdfef139b6237f7bf5](https://gist.github.com/jvehent/98fdfef139b6237f7bf5)

What strikes me is that their conf is inaccessible to old client (no sslv3, no sha-1 cert). Honest question: does the government think it's ok to break website access from ancient clients (XPSP2 IE6)? Or will they be forced to enable legacy ciphers when the first citizens complain? I'm genuinely interested, because the topic of TLS modernity is a hard problem to solve. If that was easy, google.com wouldn't be using RC4-MD5 and a sha-1 cert...

<comment><USER23> With the number of attacks against SSLv3 and/or RC4, I think it's a good idea. Especially given that it's a government website. With a target that large, it's a safe bet that, at any given moment, someone is trying something against that site. And really, who's going to access cio.gov from an XP box? Heh.

</comment></comment><comment><USER24>
        > "the financial cost of procuring a certificate"

Doesn't the government have a few of its own CAs installed in every browser? Can't they procure their own certificates for free?

</comment><comment><USER25> I want to select who my browser should trust. Kinda like how I choose which NTP server to get my time sync from. Make it a popup the first time a browser starts.

</comment><comment><USER26> Nice! They even go in to detail about cipher and protocol choices

</comment><comment><USER27> An HTTPS only standard is not going to mitigate MITM attacks which is invariably the biggest issue regardless of perpetrators although this is clearly a step in the right direction.

<comment><USER28> Proper HTTPS is secure at MITM attacks. HTTPS can be MITMed if the certs or local systems have been breached. But the MITM is just a byproduct of a different failure. Absolutely any secure communication protocol has to be honored by both parties for it to be secure.

<comment><USER27> I think preventing MITMs when you don't have control of the local systems or network architecture is important.

<comment><USER28> But it's impossible. If I'm logging your keystrokes, game over. Unless you add some firmware to do dsa encryption in your brain, and become very fast at typing cyphertext.</comment></comment></comment></comment>


Talk About Your Startup Idea with Paul Graham - <AUTHOR> http://www.stanford.edu/dept/bingschool/giving_harvestmoon_2012.html

<comment><USER2> I love how it lists that a lunch with pg has an estimated value of $500. I'm sure that many in our community would gladly pay 10x+ for an hour of his advice.

<comment><USER3> If Paul offered lunches everyday for $500 he could probably have his time filled everyday.

</comment></comment><comment><USER4> I wonder how long it'll take for someone to port PG to AIML?

([http://alicebot.blogspot.co.uk/2012/08/chatbot-battles- post-...](http://alicebot.blogspot.co.uk/2012/08/chatbot-battles-post-match- analysis.html))

<comment><USER5> previously : <http://news.ycombinator.com/item?id=2598026>

<https://github.com/mindcrime/pgbot>

<comment><USER6> There's not enough "hummm"

</comment></comment></comment><comment><USER7> (Guests must be less than 300 pounds to ride airship.)

\- best line

<comment><USER8> Came here to say this

</comment></comment><comment><USER9> I think this will go for well over $500.

</comment><comment><USER10> I can guarantee it will go for more than $500. If not to me for what I bid, then it will go even higher than what I bid... which is a secret. So no one bid $502, okay.

<comment><USER11> too late =)

</comment></comment><comment><USER12> The other item: Galapagos Adventure for Two (Item # 425, Donated by: The Altamirano Family, Hyre Family, Lau/Palihapitiya Family, Sandi Gedeon Ganjavi, Jennifer Winters, Est. Item Value: $3800) looks pretty fun, too, but probably less useful to a startup.

</comment><comment><USER11> What would make more money: Paul Graham lunches everyday for a month at a lower price or limiting supply to 1 Paul Graham lunch at the coming auction price?

</comment><comment><USER13> My prediction: $50K to $100K

I hope I am right. It's a good cause.

Here's an idea: PG, how about offering a lunch meeting to the HN member who makes the closest prediction to the winning bid? They would have to post it on HN and FB or something like that. This serves the purpose of helping advertise this worthy cause.

<comment><USER14> And since you're the only one to make a prediction so far, obviously it's in your best interest as well ;)</comment></comment>


Fairbnb.coop launches, offering help for social projects - <AUTHOR> https://www.theguardian.com/travel/2019/nov/13/fairbnbcoop-holiday-rental-website-launches-help-social-projects <comment><USER2> For a "fair" company their cookie opt-out should be more user friendly.</comment>


An engineering approach to shape neuronal connections - <AUTHOR> https://news.harvard.edu/gazette/story/2020/06/researchers-restore-neural-connections-in-zebra-fish/ <comment><USER2> Zebrafish study:

The researchers introduce a fusion protein into the cell which combines two proteins: (i) protein responsible for axon growth and (ii) photoactivatable (Rac1) protein that is responsible for sensing light (found in plants). By giving a light stimulus, they could make the axon follow the path illuminated by light. This was also shown to work for regenrating axons that were genetically defective. This could potentially allow study of long range projections of axons in a non-invasive manner.

Orignal paper: [https://www.cell.com/developmental- cell/fulltext/S1534-5807(...](https://www.cell.com/developmental- cell/fulltext/S1534-5807\(20\)30398-1)</comment>


Startup X – Slack chat for Australian startups - <AUTHOR> We (usecanary.com) setup a Slack chat for the Aussie startup community and we've had about 60 people sign up in the last few days. We set it up to help local startups work together.<p>If you're interested fill out this form and I'll send you an invite. http://bit.ly/1K0tOQO <comment><USER2> How do we know who you are? I am of course interested, but I don't sign up for unknown services offered by unknown people. Any reason you have not hosted this form on usecanary?

<comment><AUTHOR> Hey, thanks for sharing that. We used to have a team section on our site but I forgot that we don't anymore!

This is me btw :) [redacted]

To answer your other question, we really wanted to create a useful community and were concerned it would look like a lead generation tool.

We're in the process of creating a dedicated landing page but for now the form is what we've got!

<comment><USER2> Thanks Alex.

By the way are the prices on your website in A$ or US$? If they are in A$ given the way our dollar has gone down it might be worth pointing this out.

<comment><AUTHOR> Great feedback. Our prices are in AUD so we'll add that for sure.</comment></comment></comment></comment>


Inside Sellafield's death zone with the nuclear clean-up robots - <AUTHOR> https://www.bbc.co.uk/news/business-46301596 <comment><USER2> > The environment group Greenpeace, which bitterly opposed the opening of > Thorp, is enthusiastic about decommissioning.

I feel like the Greenpeace position is anachronistic and still on the wrong side of common sense. They might have missed an opportunity to slow climate change. We've had nuclear generation for 64 years now and harm to the environment is minimal. Three major (to us) accidents and a bunch of lesser material releases have had minimal impact to the earth in the big scheme of things.

Of far greater harm is our extraction and burning of fossil. The California methane leak, all of the various oil spills, and now shale drilling all have substantial, long term harm we can measure in the climate and the local ecologies.

Obviously we'd prefer greener power if possible, but nuclear power appears by far the lesser evil than all the fossil activity.

<comment><USER3> > wrong side of common sense

I fear such a complex issue such as energy production for billions of people is not really something which can be rated by 'common sense'.

> nuclear generation for 64 years now

and still no path for insurance/storage/reprocessing etc. Sellafield is one of the prime examples what can go wrong even in industrialized countries: it's a toxic and costly mix of military and commercial nuclear industry waste.

In the Western countries nuclear is mostly dead and investments are allocated only mostly for longer lifetimes of existing reactors. And this is not because of 'Greenpeace'. You need to find an answer why there is so little acceptance, why the industry is in such bad shape (examples: lack of reactor safety culture in the Japanese nuclear industry, lack of financial health in the French nuclear industry, Sellafield, ...) and why its only thriving with full- government support/finance (see China with its authoritarian structure or smaller countries who are keen to get nuclear technology to then also build up nuclear weapon technology/material like Iran).

<comment><USER4> >and still no path for insurance/storage/reprocessing etc.

Exactly the same argument applies to carbon waste. Every closed nuclear plant or nuclear plant not built means there is more carbon waste.

Edit: Can someone explain the downvotes? By carbon waste I mean CO2 emissions. We look set to destroy our civilization in the next few decades due to their elevated level.

Nuclear waste is tangible, CO2 is abstract, but other than that I don't see the difference between them.

No one has insurance for the damage caused by excess CO2, we don't have good ways of storing most of it, and we have only limited, tentative efforts to reprocess it from the atmosphere.

Instead of nuclear waste, we chose carbon waste by building more power sources that use carbon.

<comment><USER5> I didn't downvote, but I expect you got downvoted for a misleading bifurcation. You might well be interpreted as saying "the alternative to nuclear power is more coal" which sounds sort of plausible until you think about it. Or "every time we close a nuclear plant we need to open a new coal- fired electricity plant to replace it". New coal plants isn't what's replacing the nuclear plants that are being closed, so your bifurcation is just misleading rhetoric.

<comment><USER4> Oh I guess I didn't make that explicit.

1\. Before the current solar boom, virtually the only alternative was carbon. Referring to the last 5 decadesbn

2\. Even now, my impression was generally that when nuke plants close, carbon is used as the replacement, due to its ability as a baseload supply.

For instance, in Germany new coal plants are set to open as part of the 2005 nuclear phase out: [https://www.forbes.com/sites/jamesconca/2016/03/21/the- littl...](https://www.forbes.com/sites/jamesconca/2016/03/21/the-little- reactor-that-could-germanys-grohnde-nuclear-plant/#2a18d8b821a4)

Likewise, Japan has boosted coal output in the wake of Fukushima, reversing an earlier trend: [https://www.sciencemag.org/news/2018/05/bucking-global- trend...](https://www.sciencemag.org/news/2018/05/bucking-global-trends-japan- again-embraces-coal-power)

I had thought this was common knowledge. If not, I can see why my comment was downvoted and needed to be expanded on.

(On other words, at present and in recent decades I think there _was_ a bifurcation between carbon and nuclear)

<comment><USER5> You may confuse short-term and long-term actions.

I don't know about Japan, but I live in Germany, and what's happening here isn't a shift back to carbon, it's short-term contracts. The operators of some carbon plants get short-term contracts, so existing plants can be operated at a higher percentage of capacity than they would if nuclear weren't being phased out. But follow the money: Noone's investing in new plants. The current contracts aren't encouraging enough to invest in new plants. And even the operators of some old plants are complaining about underuse.

There's a carbon-based plant near where I live that has never been permitted to produce power. It was one of the last carbon power plants built nearby, and eight years after being connected to the grid, it still hasn't produced power. They turn it on for a few hours now and then to test, that's all. Its neighbour ceased production five years ago, after only two years of production.

The key here is that the new power plants being built are wind and sun. Your wording could be interpreted as saying said that the shift is was _only_ from nuclear to carbon, and when _none_ of the new plants being built are carbon- fired, then you might well get downvoted for that.

<comment><USER4> Do you have stats on that? I'm not German, so perhaps I'm ill informed, but this report indicates that actual new coal plants have opened up in the past decade.

[https://www.energycentral.com/c/ec/why-germanys-nuclear- phas...](https://www.energycentral.com/c/ec/why-germanys-nuclear-phase-out- leading-more-coal-burning)

<comment><USER5> Don't need stats, the wikipedians have a complete list: [https://de.wikipedia.org/wiki/Liste_geplanter_Kohlekraftwerk...](https://de.wikipedia.org/wiki/Liste_geplanter_Kohlekraftwerke_in_Deutschland)

Both extensions and new coal plants are there. I'll translate the key column: "plans declared invalid", "planning paused", "application submitted", "planning stopped", "being planned, blocked on (a kind of lawsuit)" and finally "being planned, building uncertain due to questions about profit".

The most interesting one is perhaps the first, which is an extension that started construction in 2007. It still isn't done and its license to operate is dependent on two lawsuits. From the public documents it's somewhat uncertain to me whether the license to operate is real. It might be a true yes, or it might be a complicated no: "you may use the new plant, but it has to emit less mercury than you possibly can achieve." I'm not sure. Either way, the owners don't seem to have spent much money on completing the building in the past year. They clearly have a license to build it and are spending money on lawyers and on removing some things that were leakily built, but AFAICT they aren't spending real money on progressing the building.

The wikipedia article on that links to [https://www.theguardian.com/environment/2017/oct/16/world- go...](https://www.theguardian.com/environment/2017/oct/16/world-going-slow- coal-misinformation-distorting-facts) which you may find interesting.

The energycentral page says new plants are needed and will be built, but it doesn't name any. [https://de.wikipedia.org/wiki/Liste_von_fossil- thermischen_K...](https://de.wikipedia.org/wiki/Liste_von_fossil- thermischen_Kraftwerken_in_Deutschland) names them. The list is a bit difficult to read. Following up on the recent ones, it seems that only one of the <10yo coal plants is both operating and planned to continue operating as a coal plant. I might have overlooked a detail or two, but not a trend.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I believe this to be the biggest problem of nuclear power, not the risks of an accident. So while we have cheap energy today, the cost of containment will be paid throughout thousands of years. This doesn't make any sense from the economic perspective.

<comment><USER7> I'm not an expert, but I think nuclear "waste" that's radioactive enough to be dangerous can be recycled to generate more electricity.

<comment><USER8> > I think nuclear "waste" that's radioactive enough to be dangerous can be > recycled to generate more electricity.

That was the whole point of this plant, to reprocess spend fuel so it could be used again.

None of the countries that tried nuclear reprocessing have made it work, and now that it is shut down, this plant needs a complicated, multi billion $ cleanup.

So no, the nuclear waste does not get recycled, and we should figure out how to deal with it.

<comment><USER9> Some anecdotal data to support your assertion about nobody having made reprocessing work: there are also significant amounts of highly radioactive waste stranded at the former reprocessing plant in Karlsruhe, Germany. I used to work in the greater facility.

</comment></comment></comment></comment><comment><USER10> I visited there on a school trip and we all took the tour, I probably didn't get as much out of it as I would now but I still remember it 25+ years later so I guess it was worth it. The school also took us to see Electric Mountain which has been on HN once or twice too IIRC. I guess it was a pretty science loving school. Seeing these things first hand helped in putting extremist views on the subject into context in later years.

</comment><comment><USER11> The article doesn't mention it but Sellafield used to be known as Windscale [https://en.m.wikipedia.org/wiki/Windscale_fire](https://en.m.wikipedia.org/wiki/Windscale_fire)

<comment><USER12> Calder Hall -> Windscale -> Sellafield

Calder Hall fire 1957: I was in the womb 100 miles downwind at that time and have reasons to be grateful for 'Cockroft's folly' [1]

Windscale Enquiry 1978: I was 20 then and THORP was bitterly opposed by environmental organisations, the Manx government and quite a few engineers, the latter on the grounds that it would never be viable [2, 3]

Nuclear power, especially with reactors that require heavily enriched fuel, in a small densely populated country, is always going to be problematic.

[1] [https://www.khl.com/news/final-cockcroft-folly-is- demolished...](https://www.khl.com/news/final-cockcroft-folly-is- demolished/103263.article)

[2] [http://www.worldcat.orgwww.worldcat.org/title/windscale- inqu...](http://www.worldcat.orgwww.worldcat.org/title/windscale-inquiry- report/oclc/004641156)

[3] [https://api.parliament.uk/historic- hansard/commons/1978/mar/...](https://api.parliament.uk/historic- hansard/commons/1978/mar/22/windscale-inquiry-report)

</comment></comment><comment> gene-h Many of these approaches for cleaning up nuclear waste from legacy nuclear sites may also be useful for fusion reactors. I talked with one of the people working on building robots for Sellafield and one of their other projects was building a robot to refurbish parts for ITER. Nuclear fusion reactors like ITER will need to go down periodically for maintenance. The amount of time the reactor spends offline is lost money, so maintenance needs to be done as fast as possible. So one of the robots they were working on would go into a pipe, cut it into pieces, put in a new pipe and reweld it within 30 seconds.

Another interesting challenge for robots in ITER is that some may be exposed to such high levels of radiation that the: "designers can forget all the advances in electronics we have witnessed since the 1960s: only a few discrete transistors can be employed, with integrated circuits being forbidden for their sensitivity to radiation."[0]

[0][https://mappingignorance.org/2014/01/29/iter-engineering- cha...](https://mappingignorance.org/2014/01/29/iter-engineering-challenges- ofputting-the-sun-into-a-box-part-3/)

</comment><comment><USER13> The article says THORP "Generated revenues of £9bn", and cost £1.8bn to build (1994 pounds?).

Decommissioning is forecast to cost £4bn. Presumably at least £4bn, given the rest of the project's costs.

Subtract operating costs, which I can't find, and I wonder what the overall loss to British taxpayers is.

<comment><USER14> It looks like nuclear didn't grow as much as they were hoping. So Sellafield's parent company could take their earnings and dump the tax payer with the clean up cost. I won't be surprised if they put Sellafield into liquidation before they finish clean up.

It seems quite suspect to me.

<comment><USER15> Sellafield's owner is the NDA. Liquidating Sellafield would likely only end up with it being handed to... the NDA.

</comment></comment></comment><comment><USER16> Does the intense radiation not interfere with communications to the drones/robots?

<comment><USER17> Radiation can affect the electronics themselves (by corrupting data, or by slow physical degradation of the physical hardware) but other than that, I don't think it has any particularly noticeable effect on communications.

The "radiation" from a reactor core mostly consists of highly energetic particles and gamma rays. It's not going to directly interfere with anything in the radio spectrum, or induce significant voltages on cables.

<comment><USER18> I'd think it's much less of a concern than in space. For one, space robots are far enough away that there's a big time delay to Earth communications, these robots will have control stations <1km away. So the only electronics on board the actual robot should be fairly rugged motor drivers and wireless comms. Add in an extra redundant copy or two of all the IC's (and possibly enough motors to give redundant degrees of freedom), and a policy of pulling out and rebuilding the robot when a certain number of non-function-impairing radiation damage events occur, and it's a non-issue.

Radiation causes huge headaches in space because there's no way to pull it out or send in a replacement, and comms have seconds - minutes of lag. These don't apply to Earth based robots, even in super hazardous environments like this.

<comment><USER19> Also they won't need to lift the robot's mass into space (which costs on the order of $5000/kg), so for most of the 'bots, they will be able to easily add additional shielding around critical electronics. Robots which are intended to fit into very small spaces might not have this option, but also hopefully will be cheaper than their larger brothers.

I wonder how many robots will become part of the contaminated decommissioning waste. Perhaps they will develop robots to disassemble and store the damaged and contaminated robots, filling a function like decomposers in nature.

</comment></comment></comment></comment><comment><USER20> I think of the music band Kraftwerks songs as somehow being ahead of its time.

-Song names: We are the robots and Radioactivity, The song Radioactivity names Sellafield in the lyrics.

<comment><USER13> The original English lyrics of "Radioactivity" ("Radioactivität") are "Radioactivity / is in the air for you and me" [1].

The version with "Chernobyl – Harrisburg – Sellafield – Hiroshima / Stop radioactivity ... / chain reaction and mutation / contaminated population" [2] is a later rewrite. In live performances, "Hiroshima" is now replaced with "Fukushima". The music is also darker than the original.

[1] [https://www.youtube.com/watch?v=MjCxJ8ErpYg](https://www.youtube.com/watch?v=MjCxJ8ErpYg)

[2] [https://www.youtube.com/watch?v=0EBTn_3DBYo](https://www.youtube.com/watch?v=0EBTn_3DBYo)

</comment></comment><comment><USER21> Mox fuel based nuclear reactors never really took off. Thus producing mox fuel by reprocessing used nuclear fuel rods never turned out to address a big market.

Cleaning this up is probably a similar challenge compared the Hanford plutonium reprocessing plant in the US. I hope they do a much better job this time around.

</comment><comment><USER22> tldr: Site of a 1957 uranium fire at Windscale.

"Safe, clean, too cheap to meter." => "The estimated lifetime undiscounted cost of dealing with the Sellafield site increased to £67.5 billion." \- WP

Not found anywhere: total, worldwide taxpayer funds spent or committed to subsidize and decommission.</comment>


GreenTunnel: anti-censorship utility designed to bypass deep packet inspection - <AUTHOR> https://github.com/SadeghHayeri/GreenTunnel <comment><USER2> This is a nice workaround for those stuck under censorship regimes such as the UK, South Korea, Turkey, India or China.

Now, Encrypted DNS (thanks to DNS over TLS/HTTPS) and HTTPS (thanks to Let's Encrypt and HSTS) are getting deployed somewhat widely.

The next step is encrypted SNI[0], and it'll get this much harder to do any meaningful DPI, for censorship or else.

[0]: [https://en.wikipedia.org/wiki/Server_Name_Indication#Securit...](https://en.wikipedia.org/wiki/Server_Name_Indication#Security_implications_\(ESNI\))

<comment><USER3> there are two edges to this sword.

DoH also means breaking stuff like pihole and other ad filtering. It means you trust companies like google who base their revenue off ads, or cloudflare who have censored content numerous times in the past, to serve you DNS.

its also kind of pointless if the state knows youre using it outside of a tunnel...they can just watch your _next_ packets to see where you decided to go.

<comment><USER4> > cloudflare who have censored content numerous times in the past

Besides Stormfront[0], what else did they censor?

[0] [https://en.wikipedia.org/wiki/Stormfront_%28website%29](https://en.wikipedia.org/wiki/Stormfront_%28website%29)

<comment><USER5> I wouldn't call that censoring either. They just rejected to provide any services for them.

<comment><USER6> Indeed, "deplatforming" isn't equivalent to "censoring".

</comment></comment></comment></comment></comment><comment><USER7> Why hasn't this become the modern Right to Bear Arms? The root of the second amendment was trying to ensure that one class of citizenry did not have tools at their hands to force another class of citizenry to comply. It maintained a balance. The right to encrypt and keep your data private should be a modern equivalent of the right to bear arms.

<comment><USER8> Bear in mind that as a non American, invoking a right to bear arms actively turns me off whatever you're trying to sell me. Too much damage has been done to my home country by violent groups who took up arms against the state and each other.

<comment><USER9> Just look at the past 100 years of human history and the damage that has been done because citizens had NO arms to defend their rights against a despotic government. The deaths are counted in millions.

Insurgent groups will buy 5 dollar AK-47 regardless of legality. This is about lawful citizens being able to defend their rights against unlawful governments. Or at least to raise the costs an armed group has to pay for an attempt to take power.

As another non American, I am still undecided on the issue, but I tend to be in favor of that 2nd amendment.

</comment></comment></comment><comment><USER10> It is working perfectly for Turkcell Superonline, Turkey. Unfortunately, anti- censorship tools are very crucial for us these days. Thank you for your work.

<comment><USER11> Going voting is crucial.

</comment></comment><comment><USER12> > _GET / HTTP/1.0_

> _Host: www.youtube.com_

> _We send it in 2 parts: first comes GET / HTTP/1.0 \n Host: www.you and > second sends as tube.com \n .... In this example, ISP cannot find blocked > word YouTube in packets and you can bypass it!_

If you talk to anyone from China that _this_ is how you bypass (HTTP) "deep packet inspection", it would sound incrediblely naive. I'm not criticizing here, thanks for developing an anti-censorship tool, but my point is, any DPI that can be bypassed in this way is simply too outdated, it's far from the state-of-art threats we are facing worldwide.

What China does today is what your ISP/government is going to do tomorrow, when they upgrade the equipment. Learning a history lesson from China, can help providing insights for developers in other countries to know where this cat-and-mouse game is heading to...

> paulryanrogers: So basically it just does two things: carefully chunking > HTTP header packets and encrypted DNS? Not sure this will work for very > long.

Of course it will not. I'll explain why.

\---

Literally, the same technique was used in China during the early days of Great Firewall, around 2007. At that time, the "censorship stack" was simple, basically, it had...

* A brute-force IP blocking list

This is a constantly updated list of IP addresses of "unwanted" web servers, such as YouTube or Facebook. They are distributed via the BGP protocol, just like how normal routing information is distributed. Once your server enters this blacklist, nothing can be done. Not all unwanted websites enter the list due to its computational/storage costs.

* A DNS poisoning infrastructure

A list of "unwanted" domain names are maintained. These domain names are entered to the national DNS root server as records with bogus IP addresses. It was used more widely than the IP blocklist, since it has zero cost to operate, but it can only block websites in the list and it takes time for the censor to be aware of a target's existence.

* A naive keyword filtering system.

All outgoing international traffic is mirrored for inspection. A keyword inspection system attempts to match the URLs in HTTP requests against a blacklist of unwanted keywords. Rumors said the string matching was performed by hardware in ASIC/FPGA, allowing enormous throughput.

* A TCP reset attack system

Once an unwanted TCP connection is identified by the keyword inspection system, the TCP Reset attack system fires a bogus RST packet to your computer, fooled by the packet, your operating system will voluntarily work against you and terminate the connection, saving the censors' CPU time. The keyword filtering system paired with reset attack was the preferred way to carry out censorship.

That's all. The principle of operation was simple and easy to understand. So what were the options for bypassing it? There were a lot. To begin with, the blocked IP addresses were blocked, you could do nothing about it. But in the earliest day, accessing them was as simple as finding a random HTTP proxy server. Later, the inspection system was upgraded to match HTTP proxy requests. Then, you could simply play some magic tricks with your HTTP requests, like the example in the beginning, so that your request wouldn't trigger a match. Around the same time, in-browser web proxy tools became popular, they were PHP scripts running on a web server that fetched pages. However, they became useless when the keyword matching system was upgraded to match the content of the entire page, not simply the requests (remember, few sites had HTTPS). At this point, all plaintext proxy techniques and HTTP request "massaging" techniques were all officially dead.

Some naive rot13-like techniques were later implemented to some web proxies, HTTPS web proxies were also a thing, but they saw limited use.

* New: A complete keyword filtering system - Inspect all HTML pages (Was: A naive keyword filtering system)

Another target to attack was the DNS poisoning system, sometimes all you needed was a correct IP address, since not all IPs were included in the blocklist due to the costs. Initially, all one needed to do was modifying one nameserver to 220.127.116.11. However, countermeasures were quickly deployed. A simple countermeasure was rerouting 22.214.171.124 to the ISP's nameserver, continued feeding the same bogus records to you. Nevertheless, there were always alternative resolvers to use. So the system was upgraded to provide a DNS spoofing infrastructure - at the instant an outgoing DNS packet is detected, the spoofing system would immediately answer with a bogus packet. The real packet would arrive at a hundred milliseconds later, but it would be too late, your OS had already accepted the bogus result.

And ironically, even if DNSSEC was widely supported (it was not), it couldn't do anything but returning an SERVFAIL, since DNSSEC can only check whether the result was true, dropping the bogus packet and accepting the true one was outside the capabilities of a standard DNSSEC implementation.

* New: A Real-time DNS Spoofing System

Better tools were developed later, that acted like a transparent resolver between the upstream resolver and your computer, that identified the bogus results to drop them, but the use was limited. Also, at this point, the IP blocklist has been greatly expanded. Even if a correct IP could be obtained, it was still inaccessible. Around 2008 or so, a special open source project was launched by developers in China - /etc/hosts list, whenever someone found a Facebook IP address that was not in the blocklist yet, one sent patches to the project. There were also shell scripts to keep your list up-to-date.

However, a /etc/hosts list was useful but its usefulness was limited. First, it was a matter of time before a new IP address was blocked. Also, a working IP address still was restricted by the same keyword filtering system.

* New: Expanded IP Blocklist.

Some people also realized that the firewall was only able to terminate a connection by fooling the operating system. Soon, iptables rules for blocking RST packets appeared in technical blogs. By ignoring all RST packets, one essentially gained immunity at the expense of network stability, as legitimate RSTs were also ignored. Soon, the censorship responded by upgrading the reset attack system, so that RST packets were sent to both directions - even if you ignored RST, the server on the other side would still terminate it. Also, RST was now "latched-on" for a limited time, when the first RST was triggered, the target remained inaccessible in several minutes.

* New: Bidirectional TCP Reset Attack

* New: "Latched-On" Reset Attack

When HTTPS was enabled, it was impossible to perform keyword inspection in the HTML pages - at this time, censor sometimes still wished to allow partial access, only triggering the block when detected a match. This strategy cannot be applied to HTTPS, since the content was all encrypted. Some people realized some popular websites supported HTTPS but not enabled it by default, such as Wikipedia. The Great Firewall responded by implementing a HTTPS certificate matching subsystem in the keyword matching system, when a particular certificate was matched, you were greeted by a TCP RST packet (this system has been removed later when HTTPS saw widespread use).

* New: Certificate-Based HTTPS Blocking System

At this point, around 2010, the only reliable way to browse the web was using a fully-encrypted proxy, such as SSH dynamic port forwarding or a VPN, which required purchasing a VPS from a hosting provider. SSH was more popular due to its ease of use - all one needed was finding a SSH server and ran "ssh -D 1337", so that port 1337 would be a SOCKS5 proxy provided by OpenSSH. OpenVPN was reserved for heavy web users, since it's more difficult to setup, but had better performance.

From the beginning to the 2010s, anyone who was using VPN or SSH can enjoy reliable web browsing (only be disturbed from time to time due to the overloaded international bandwidth). However, the good days came to an end when the Great Firewall implemented a real-time traffic classifier, it was first applied to SSH. It observed the SSH packets in real-time and attempted to identify whether an overlay proxy traffic was carried on top of it. The blocking mechanism was enhanced as well, now it was able to dynamically inserting null route entries when it decided that the communication with a server was unwanted. The IP blocking system was also improved, now it was able to collect unwanted IP addresses at a faster rate with help of the traffic classifier. If you used SSH as a proxy, after a while the connection would be identified, with all packets dropped, repeated offenses would earn you a permanent IP block. For VPNs, the firewall implemented a real-time classifier to detect OpenVPN's TLS handshakes. When handshakes were detected, a RST packet is sent (or if you use UDP, all packets are dropped). Repeated offenses would earn you a permanent IP block as well.

New: Real-Time Traffic Classifier

New: Real-Time IP Blocking

New: Actively Updated IP Blocklist using Classifiers as Feedback

Traffic classifiers would later be expanded to cover HTTPS-in-HTTPS as well, so a naive HTTPS proxy wouldn't work, and possibly have other features, it's a mystery.

BTW, after Google exited from China, the HTTPS version was immediately blocked, and for HTTP, a ridiculous keyword blocklist was enforced and it generated huge amount of false-positive RSTs for harmless words, apparently a deliberate decision, preferring false-positive over false-negative. Eventually, all Google services had been permanently blocked. The IP block became extensive, major websites have been completely blocked, the unblocked sites were only exceptions. For most people, the arrival of widely-used HTTPS was too late and useless, since IPs were blocked. And as mentioned, SSH and VPNs were classified and blocked as well.

This was when a new generation of proxy tools started to gain popularity,

<comment><USER12> Shadowsocks being the most well-known example. From a cryptographic perspective, it was a big step backwards. Since Diffie-Hellman handshakes were subjected to traffic classifiers, these tools only used symmetric encryption with fixed keys. Their encryption protocols were ad-hoc, and not cryptographically robust. While it was a matter of fact that nobody could break a simple AES-CBC encryption, nobody would trust these tools for one's confidential data as well (for example, AEAD was unsupported for many years). But since the goal was bypassing censorship, not secrecy, they became extremely popular. It was not seen as an major issue, since the widespread use of HTTPS offered robust secrecy. DNS encryption was still essential (usually the SOCKS-5 interface was provided by these tools, SOCKS-5 can be configured to pass the original domain name to the proxy, the proxy can resolve the names inside its encrypted connection), but became less useful when used on its own, since the IP blocklist was huge by the time.

The landscape of the Internet has changed dramatically since 2013 as well. The universal adoption of HTTPS eventually rendered all keyword-based inspection useless. A few sites were considered too large to block, including Amazon AWS and GitHub. One side of the battle started becoming a mutual assured destruction game - either allowing people to exploit a large platform to publish uncensored material, or blocking the platform altogether and creating economic damages. I am confident that the MAD game will continue to play out, however, Russia's response to AWS domain fronting showed this strategy could fail if major platforms don't want to cooperate, it was a bit worrying, at least. But anyway, encrypting SNIs should be the next step.

But I digressed, back to Shadowsocks, et al, since the state was eliminated (pun intended), all one could see was encrypted raw TCP packets, there was no reliable way for the firewall to classify Shadowsocks-like tools for many years (until recently, possibly by exploiting cryptographic-related issues, but we are not sure how successful it is). But the censorship system started getting weirder and weirder - sometimes, connections break without any apparent reason at all, sometimes data rate was extremely low, sometimes a few IPs were blocked mysteriously, and so on, but life kept going on. There were several possible hypotheses, one was that the traffic classifiers were getting more and more functionalities, and occasionally they could hit something. Another was that the TCP RST was sent in a probabilistic manner to suspected endpoints to degrade reliability. The only thing that could be confirmed was the significantly increased use of QoS by the ISPs, so that all unknown protocols would be classified as "low priority", degrading the reliability of all anti-censorship tools. At this point, bad connectivity and censorship was indistinguishable.

It's safe to say, that at this point, nobody ever understands how the Great Firewall of China work anymore. This is the end of our story.

For simplicity, I skipped many less used techniques, such as Tor's domain fronting, or CDN-based circumvention, or obfsproxy4 that featured Diffie- Hellman keys indistinguishable from random strings, and possibly others. I'm well-aware of them. But it's expected that, unless everything is encrypted and all infoleak is plugged (then, we will start playing the mutual assured destruction game), all these tools are doing is an endless cat-and-mouse game.

Developers of anti-censorship tools need to consider countermeasures based on what China is currently doing. So that when the same techniques used by China are implemented by their own ISPs in the future, they are always prepared to act.

<comment><USER13> Fantastic breakdown on the recent history of censorship in China, thanks for sharing it.

You mentioned that for many of these efforts bypassing censorship trumped secrecy concerns. Is this still the case?

If I were a citizen regularly bypassing censorship of an authoritarian government, I'd be concerned for my safety if it was well documented that I regularly accessed censored material.

<comment><USER14> From what I gather, the regime doesn't really intend to arrest anybody who simply regularly _accesses_ western websites. Some big corps also have their special VPN channels to access foreign websites so that they can do business normally. Hell, even the foreign ministry spokesperson posts regularly on Twitter. What they want is to stop this floodgate of information being opened to the common mass, that's when things could get problematic.

People are arrested for _producing_ things that are deemed potentially destabilizing for the regime/country, but nobody as far as I know ever got arrested for _accessing_ blocked materials.

Of course, if you are also actively producing content it would be much wiser to camouflage your identity much better, if you can. That's when the secrecy becomes a major concern.

</comment></comment></comment></comment><comment><USER15> A simple countermeasure at the ISP level: a buffer to merge 'www.you' to 'tube.com'

A far greater danger is DPI that use statistical analysis to detect possible tunnels. You want your traffic to be as close as possible to normal traffic. There is no perfect solution there. The current best is generating valid images with a hidden data payload (to download), and generating pseudo text posted on public forums or email (to upload) while limiting the download/upload ratio, by downloading random content if necessary as most people download far more than they upload.

It works best when using "known" websites like gmail (draft folder) or facebook (messenger), as all the traffic goes to a whitelisted host and look like regular usage.

<comment><USER16> >A simple countermeasure at the ISP level: a buffer to merge 'www.you' to 'tube.com'

addressed here: [https://news.ycombinator.com/item?id=22656122](https://news.ycombinator.com/item?id=22656122)

>A far greater danger is DPI that use statistical analysis to detect possible tunnels.

That's only an issue if there's a blanket ban on tunneling/proxies. While it's a problem in authoritarian regimes (eg. china, kazakhstan), it's not an issue in most western countries. I haven't heard of any western countries banning VPNs (yet).

>The current best is [...]

The timing information would still be suspicious. Most people aren't constantly checking their gmail/facebook multiple times a second, but normal browsing would generate packets with that frequency. It's really only undetectable if you're sending/receiving messages (eg. IM or email). A better candidate might be multiplayer game traffic. They provide a consistent stream of bits[1] to hide data in. If you're willing to set your tunnel's bandwidth to a few kilobytes a second (throttling if there's too much data, sending decoy packets if there's too little), it'd be very hard to detect any anomalies.

[1] random search: [https://youtu.be/8Kvj5TZNNJ4?t=1080](https://youtu.be/8Kvj5TZNNJ4?t=1080)

<comment><USER15> > Defeating chunking would require additional memory + compute power on the > DPI boxes, which I suspect ISPs don't want to bear.

It depends. ISP may be willing to spend more, if they gain more or are forced by governments to do that.

Even as is, the proposed method is still too easy to defeat, especially with IP bans: if the ISP really doesn't want to let youtube.com work, all the A and AAAA records will be blacklisted

> The timing information would still be suspicious. > It's really only > undetectable if you're sending/receiving messages

Indeed, so the suggestion was to use the draft folder and FB messenger.

A better method would rotate the whitelisted websites- like using mostly gmail for 20 minutes, then facebook for 1h, etc. and of course only "on demand" so that traffic does not occur 24/7

For multiplayer game, the audio channel already provides a very simple method to stream more than a few kb per seconds.

</comment></comment></comment><comment><USER17> So basically it just does two things: carefully chunking HTTP header packets and encrypted DNS?

Not sure this will work for very long.

<comment><USER16> >Not sure this will work for very long.

Maybe if it gets popular. Defeating chunking would require additional memory + compute power on the DPI boxes, which I suspect ISPs don't want to bear.

<comment><USER18> I work in the DPI field and have maintained a few DPI firewalls.

Most DPI that I know of will defeat this bypass technique, I'm not sure the author has even tested if it works.

DPI firewalls already have to support aggregating packets. It's pretty common to need more information beyond the initial packet. It's not really any more memory intensive either, you're just reading byte by byte and keeping what you need.

Heck most DPI firewalls support checking something in the outbound packets is in the inbound packets. ie - checking if a connection is performing IKE.

</comment></comment></comment><comment><USER19> Works with You Broadband, India. Thanks a lot man!

</comment><comment><USER20> This is great if there isn't a blanket ban on VPN's, but unfortunately, it won't work in China. I've had next to zero-luck keeping my own VPN tunnels open for more than a couple of days at a time when behind the great firewall.

<comment><USER21> Check out v2ray. You'll need to have your own domain, server, and a cloudflare account, but in terms of speed it is unmatched. Unfortunately many of the best tutorials are in Chinese.

<comment><USER22> Looks interesting. From [https://www.v2ray.com/en/index.html](https://www.v2ray.com/en/index.html) it seems that it's "just" a VPN protocol / software that can tunnel over TLS. I assume the point of using your own server + Cloudflare is that it breaks IP based blocking of most VPN providers. I guess just your own server without Cloudflare would work fine for a while, but they probably have heuristics for a lot of encrypted traffic sent to a single unknown server?

The remaining question for me is about the TLS part of all this. Does China not have agreements with most external services about stripping TLS such that a lot of TLS traffic would be suspect? Or do they not mandate their citizens to use a Government provided root cert that would allow them to "securely" MITM connections? That would be how I'd do it if I were an authoritarian government.

If not, then what's their plan for the future? I could see a Firewall kind of mostly working for now on a combination of DNS, IP, and SNI filtering, but _all three_ are going away in the near term. DNS with DNS-over-HTTP, SNI with eSNI, and IP blocking has become less plausible already through routine use of proxies like Cloudflare.

<comment><USER23> [https://www.scmp.com/news/china/politics/article/3030563/big...](https://www.scmp.com/news/china/politics/article/3030563/big- data-expert-takes-over-chinas-new-cybersecurity-chief)

They want to make the networks transparent to the government, and apply machine learning for understanding the data and warnings the monitoring system will provide.

You either provide decryption keys, or your traffic will be dropped.

<comment><USER22> Yeah, that's what I figured would happen next. It's honestly very difficult to defend against an adversary that nakedly aggressive. It's like trying to browse the Internet privately on your computer at your desk at the major IT firm you work at.

</comment></comment></comment></comment></comment><comment><USER24> Is that a SOCKS proxy, or just a HTTP proxy? The github readme does not make that clear.

</comment><comment><USER25> Doesn't work against Virgin Media UK

<comment><USER26> Virgin is censoring things now?

<comment><USER27> All the big UK ISPs do. This is targeted at CP but who knows what else gets covered.

<comment><USER26> The Virgin Media list above has some very benign content blocked (movies, sports and even a Nintendo cheats/hacks site).

This is concerning and I'm thankful I left that terrible (for a lot of other reasons) company long ago (my current ISP doesn't seem to be blocking anything from their list).

</comment></comment></comment></comment><comment><USER28> It's really good to see more tools in the privacy space, resulting in more options and fallbacks for the end-user.

I think the author should also try to market this as much as possible outside of the HN crowd, since this seems targeted at non-tech users — I could be wrong but my reasoning is that HN users who care about privacy would prefer a combination of a VPN and DoH to defend against traffic & DNS inspection, respectively.

<comment> yjftsjthsd-h It really depends on your threat model, but if you have a full tunnel VPN, then encrypted DNS is a lot less important.

</comment></comment><comment><USER29> It's working very well against South Korea, KT(ISP)

</comment><comment><USER30> > We send it in 2 parts: first comes GET / HTTP/1.0 \n Host: www.you and > second sends as tube.com

How does this even work? "www.you" won't return a valid HTTP response and "tube.com" won't either. How can you fetch the content at "youtube.com" but splitting the domain name in half? Won't you get two completely wrong responses that don't fit together?

<comment><USER31> It's split across two network packets. It's still one request for the web server.

<comment><USER32> might add another fake packet that confuse DPI.

</comment></comment></comment><comment><USER33> Need some more insights into proper use. I couldn't get to work in mainland China

</comment><comment><USER21> How does this differ from Gigsaw's Outline, Shadowsocks or V2Ray?

</comment><comment><USER34> Any one tested if this tool work in China or not?

</comment><comment><USER35> Why not use Tor?

<comment><USER21> Really depends on your use-case. Tor is great but easily detectable and thus blockable, and though its speed has gotten much better, it isn't as fast as other options. But again, it really depends on what your goal is.

<comment><USER18> Tor has obfuscation options, they work well.

The default endpoint list is usually blocked though as its published to the clients so you have to request an off-list endpoint.</comment></comment></comment>