The momentum of Steve Jobs - <AUTHOR> http://craigmod.com/satellite/steve_jobs_momentum/

<comment><USER2> "I'll remember how he chose to pursue ideas that inspired a man staring down death."

I've always been leery of people who are obsessed with work to this extent. If work is your only metric, then yeah, its great. I sure would love my employees to have a 'work till you die' attitude. But life != work. Or rather, life > work.

For me, Steve was an interesting curiosity. Not an example to emulate.

I live in the neighborhood. I love so many aspects of silicon valley culture. But when I hear that train late at night, I'm not thinking "alone on my journey, on the edge of chaos, exploding into the future". Hell no.

Steve authorized his biography so that his kids would know him. Inspirational? For me, it sounds like a nightmare.

Water is necessary for life, but if you drink too much water you will die. Positive traits like creativity/focus/passion are crucial, but unchecked they can become destructive.

Live in balance.

<comment><USER3> _I've always been leery of people who are obsessed with work to this extent. If work is your only metric, then yeah, its great. I sure would love my employees to have a 'work till you die' attitude. But life != work. Or rather, life > work._

It takes all kinds to make up a society. Some of us want a balanced life; we want to be reasonably good at everything. Some others want to be the best at a certain thing and are willing to sacrifice almost everything else to achieve that goal. To a very crude approximation, those from the former group keep society going while those from the latter push human society forward.

 _For me, Steve was an interesting curiosity. Not an example to emulate._

On the face of it, there's nothing wrong with being either type, but it does seem like each type cannot fathom why the other behaves the way it does.

<comment><USER4> A human being should be able to change a diaper, plan an invasion, butcher a hog, conn a ship, design a building, write a sonnet, balance accounts, build a wall, set a bone, comfort the dying, take orders, give orders, cooperate, act alone, solve equations, analyze a new problem, pitch manure, program a computer, cook a tasty meal, fight efficiently, die gallantly. Specialization is for insects. -- Heinlein

<comment><USER5> Careful with that word "should". Using it on others opens the Pandora's Box. It will try to destroy your sense of self.

</comment></comment></comment></comment><comment><USER6> I had a similar experience upon moving to Palo Alto last June. Living, working, and walking in places where "the greats" work changes your perspective immensely. Yes, it humanizes them, but it also emphasizes that you could just as well create something yourself as tremendous, valuable, and worthwhile. You don't have to be a god. They weren't.

<comment><USER7> Great point.

</comment></comment><comment><USER8> What a fantastic humanisation of a legend. He was a human being like all of us. He is a legend unlike any of us. Thank you for sharing these thoughts.

</comment><comment><USER9> A very well-written piece. Warranted many pauses to think

</comment><comment><USER7> I wonder if Steve Jobs did or Bill Gates does get the same joy out of cleaning one's ears with a q-tip after getting out of the shower.</comment>


What Do Real Thugs Think of The Wire? - <AUTHOR> http://freakonomics.blogs.nytimes.com/2008/01/09/what-do-real-thugs-think-of-the-wire/

<comment><USER2> Full list of links to the story.

1: [http://freakonomics.blogs.nytimes.com/2008/01/09/what-do- rea...](http://freakonomics.blogs.nytimes.com/2008/01/09/what-do-real-thugs- think-of-the-wire/)

2: [http://freakonomics.blogs.nytimes.com/2008/01/18/what-do- rea...](http://freakonomics.blogs.nytimes.com/2008/01/18/what-do-real-thugs- think-of-the-wire-part-two/)

3: [http://freakonomics.blogs.nytimes.com/2008/01/25/what-do- rea...](http://freakonomics.blogs.nytimes.com/2008/01/25/what-do-real-thugs- think-of-the-wire-part-three/)

4: [http://freakonomics.blogs.nytimes.com/2008/01/31/what-do- rea...](http://freakonomics.blogs.nytimes.com/2008/01/31/what-do-real-thugs- think-of-the-wire-part-four/)

5: [http://freakonomics.blogs.nytimes.com/2008/02/07/what-do- rea...](http://freakonomics.blogs.nytimes.com/2008/02/07/what-do-real-thugs- think-of-the-wire-part-five/)

6: [http://freakonomics.blogs.nytimes.com/2008/02/12/what-do- rea...](http://freakonomics.blogs.nytimes.com/2008/02/12/what-do-real-thugs- think-of-the-wire-part-six/)

7: [http://freakonomics.blogs.nytimes.com/2008/02/22/what-do- rea...](http://freakonomics.blogs.nytimes.com/2008/02/22/what-do-real-thugs- think-of-the-wire-part-seven/)

8: [http://freakonomics.blogs.nytimes.com/2008/02/28/what-do- rea...](http://freakonomics.blogs.nytimes.com/2008/02/28/what-do-real-thugs- think-of-the-wire-part-eight/)

9: [http://freakonomics.blogs.nytimes.com/2008/03/10/what-do- rea...](http://freakonomics.blogs.nytimes.com/2008/03/10/what-do-real-thugs- think-of-the-wire-part-nine/)

(This is worse than multi-page stories. =( )

<comment><USER3> > This is worse than multi-page stories. =(

But I bet dead simple to write. I mean, sure, getting in touch with these people and getting them to speak honestly to you is hard, and keeping them coming back probably isn't easy either, but... you go hang out with them, write down what they say, and type it out.

<comment><USER2> Ah, I was merely commenting on the format of the story. It wasn't HARD to get this list, but it was non-trivial.

</comment></comment></comment><comment><USER4> The Wire is, in my opinion, the best show in the history of television (or at least of what I've seen). The Wire seems to have received a lot of critical acclaim and a cult following, especially after its end. Too bad it never got the popularity it deserved when comparing it to The Sopranos. Although I like The Sopranos, I think The Wire brought a lot more to the table in terms of writing, gritty realism, and pure entertainment.

<comment><USER5> One thing that can be both a quality and a problem, is that The Wire is very demanding. A lot of what happens is implicit or not directly seen on camera. Also, episodes are not as self-contained as, for instance Mad Men, where you can watch one stand-alone, without needing too much background on who's who, and what happened before.

<comment><USER4> Exactly, especially when story arcs last a complete season and sometimes longer. You find that many people can't commit to it. It's not Law & Order..

</comment></comment></comment><comment><USER6> On a related note, a video game journalist gets Yakuza bosses to play and review Sega's "Yakuza 3":

<http://boingboing.net/2010/08/10/yakuza-3-review.html>

<comment><USER7> Cool. Have to admit I'm surprised they sought anonymity. I remember Dave Barry writing

> The _yakuza_ are about as clandestine as the National Football League. > Everybody knows who they are. Many of them get large tattoos and chop of > finger joints to demonstrate loyalty or some other important gangster > quality. Also they're the only people in Japan who wear double-breasted > suits, white ties, and sunglasses. "Hi!" their outfits shout. "We're > gangsters!"

<comment><USER8> Everyone knows who is a yakuza, but they don't necessarily broadcast their individual identities.

</comment></comment></comment><comment><USER9> As I see a few Wire fans replying here, I'd like to recommend two related books that will give more insight and provoke some thought (if you haven't done so already):

Homicide (a year on the killing streets), David Simon [http://en.wikipedia.org/wiki/Homicide:_A_Year_on_the_Killing...](http://en.wikipedia.org/wiki/Homicide:_A_Year_on_the_Killing_Streets)

The Corner: A Year in the Life of an Inner-City Neighborhood, David Simon and Ed Burns [http://en.wikipedia.org/wiki/The_Corner:_A_Year_in_the_Life_...](http://en.wikipedia.org/wiki/The_Corner:_A_Year_in_the_Life_of_an_Inner- City_Neighborhood)

</comment><comment><USER10> Spoiler alert for the first point.

</comment><comment><USER11> Apparently this reporter is capable of actually doing real research on thug life, rather than the Harvard professors who use "The Wire" as a lazy alternative to studying reality.

</comment><comment><USER12> They got some things right, as I recall:

"Shine proposed that Marlo would kill Prop Joe; the youngest attendee, the 29-year-old Flavor, placed $2,500 on Clay Davis escaping indictment"

<comment><USER13> In the Netflix era, spoilers son, spoilers!

I would have been interested to get their take on Omar.

<comment><USER14> I suspect it would require some heavy editing to be suitable for the Times.</comment></comment></comment>


Istanbul, zkRollup, and Ethereum throughput limits: an analysis - <AUTHOR> https://iden3.io/post/istanbul-zkrollup-ethereum-throughput-limits-analysis <comment><AUTHOR> Solana[1] with another approach proof-of-history) is achieving 50k tps in tests.

[1] [https://solana.com/](https://solana.com/)</comment>


Ask HN: Use Packer in Production? - <AUTHOR> Anyone has experience on using packer in production? Could you share your use cases for using Packer? And any drawbacks that you experience using that tool?<p>Thanks <comment><USER2> We use packer to reproducibly create VM images for our aws deployments. Going on 3+ years and multiple clients now. The biggest pain point for me has been having multiple small bash lines in the json spec packer uses.

<comment><AUTHOR> Interesting. Thanks for the sharing, Sevii!

1\. For your AWS deployment, could I know why you didn't use docker image for your deployment?

Because essentially you can use docker for building the image instead of packer. Furthermore, Docker also has caching mechanism which make the build much faster. I'm not sure packer also has capabilities for caching.

Any reason you choose packer over docker?

<comment><USER3> Not OP, but we dont use docker because legacy. We developed our infrastructure before containerization was popularized.

<comment><AUTHOR> Gotcha.

Ah also one thing that I wonder in Packer is versioning. Since in docker we can tag every release of the image, we can somehow do versioning on that.

1\. How is the versioning in Packer?

2\. Also, do you have plan to adopt docker image/ other containerization pattern even if you already used packer for 3+ years? Maybe you have different use cases for adopting docker?

<comment><USER3> 1\. We just commit packerfile to repo and version through git 2\. We've talked about it. The problem is we have some stateful processes we can't trust to container- like database stuff/etc. So its really a matter of separating what is safe to containerize or not.</comment></comment></comment></comment></comment>


Amazon threatens to suspend Signal's AWS account over censorship circumvention - <AUTHOR> https://signal.org/blog/looking-back-on-the-front/ <comment><USER2> They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries".

And

>The idea behind domain fronting was that to block a single site, you'd have to block the rest of the internet as well. In the end, the rest of the internet didn't like that plan.

That they interpret AWS and Google as "the rest of the Internet" is pretty sad, too.

<comment><USER3> > "They're spoofing identity"

That's the entire point. By making it impossible for censors to distinguish Signal traffic from other web traffic going to AWS, domain fronting forces the government censors to either 1) stop censoring, or 2) censor many important websites that people rely upon. The associated economic cost has the tendency to discourage censors, and as shown by Signal, is actually quite an effective deterrent against many oppressive regimes. This concept is known as collateral freedom.[1]

Instead of shutting this down, Amazon could have let Signal continue. In fact, all companies should collaborate to make censorship as expensive as possible. Someone here at HN pointed out that it is very difficult for someone under an oppressive regimes to speak out; this makes it all the more important for those of us who can to assist dissidents and support freedom of expression.

[1] [https://en.wikipedia.org/wiki/Collateral_freedom](https://en.wikipedia.org/wiki/Collateral_freedom)

<comment><USER4> My first thought is "How is it in the interest of Amazon's stockholders to prevent censorship in countries ruled by dictatorial regimes?" and secondly, "How does consenting to being a front for services that are strictly forbidden in certain countries benefit our company?"

<comment><USER5> Shareholders still come first if they do the right thing here. Letting reputable people do good with your product rises the tide for the ecosystem. Good for the Internet is good for AWS.

<comment><USER6> What if souq.com is blocked instead ? How is that good for AWS or the internet ?

</comment></comment></comment></comment></comment><comment><USER7> Sorry, I'm not on board with using an Amazon owned domain for this. That's got the potential to get Amazon itself blacklisted in some places, so they're absolutely not going to be okay with it.

<comment><USER8> Or it forces oppressive regimes to realize that they are being an oppressive regime.

Want to censor the internet, fine, send your citizens back to the dark ages; see how long it is until they protest or move.

<comment><USER9> I'm guessing you haven't spent much time looking into how oppressive regimes work.

They aren't going "to realize that they are being an oppressive regime" and have an epiphany where they realize, "Hey maybe I'm an evil dictator?"

If you are up for reading, I highly recommend Michael Malice's book, _Dear Reader: The Unauthorized Autobiography of Kim Jong Il_ . After reading that you will completely understand why "see how long it is until they protest or move" is a silly thing to say.

[1] [https://smile.amazon.com/Dear-Reader-Unauthorized- Autobiogra...](https://smile.amazon.com/Dear-Reader-Unauthorized- Autobiography-Jong/dp/1495283259)

<comment><USER10> There is a difference when people have never had access to things and when you take away access.

A difference would be like America and North Korea and taking away the internet. The vast majority of Americans use the internet and it is an integral part to their lives. You take it away and they would riot in a heartbeat. On the other hand if you have a regime where the majority of people never had access to the internet (or any whatever), taking it away does not cause a riot. The small groups of people that had access won't have the critical mass needed to cause such a riot.

The point is not to make a dictator to realize "Hey, maybe I'm the baddie" but "If I take this away then someone will stage a coup." Dictatorships tend not to be very stable regimes. It is hard to balance the line of power and being overthrown.

TLDR: People care much more when you remove something that is already integral to their life. Not so much if it isn't.

<comment><USER11> > You take it away and they would riot in a heartbeat.

I'm not certain that this is true.

No American Dictator would just outright ban the internet, no they'd say they were protecting children and blocking terrorists, and require internet providers to block that content.

Anyone arguing that this is censorship would be branded as a supporter of child pornography and terrorists.

A few more steps along that line and what you have is no longer the internet as we know it, but PatriotNet(tm) (insert waving flag, anthem, etc).

Do it enough subtle steps and they'd get away with it without anything more than a few grumpy "libtards" complaining on TV.

<comment><USER10> You're right in that it can be done through a long process. But as freedomben notes (in response to my reply), Egypt is an example of what I'm talking about.

</comment></comment></comment></comment></comment></comment><comment><USER12> Telegram has some pretty interesting ideas wrt censorship circumvention. I.e. you can still use Amazon, Google, Microsoft as an unblockable side channel to deliver proxy settings, same way domain fronting relies on them. And you can sponsor other people to setup proxies, making it hard to detect and suspend accounts used for censorship circumvention on Amazon and other hosting companies.

As a side channel dns over https still works even with tls to google.com and then putting Host: dns.google.com into the header. Frequent updates to applications and push notifications can be used as side channels too. You can also register a bunch of domain names ahead of time using hash of a current day, month, year and then let the app generate domains names to query on the fly and query them over normal dns. The censor would need to reverse engineer the app to figure out the domain generation algorithm.

To make proxies hard to enumerate you can shard the mapping of ids/phone_numbers to proxies in a such way, that each id receives multiple proxies using multiple different sharding schemes. This not only makes it harder to enumerate, but also lowers the chances of someone else obtaining the same set of proxies as the censor and rendering the app unusable. Changing IPs then forces the censor to chase you, but never really catch you to censor the app.

But I do think building peer-to-peer network instead of proxies is a better idea for circumvetion.

<comment><USER13> Given its an open source app, it should be reasonably easy for the censor to reverse engineer the algorithmically generated domains. Frequent tiny updates would be an interesting solution though. Now that most mobile apps can deliver just deltas to save bandwidth it'd be viable.

<comment><USER12> I realize now, that it's possible to even dynamically deliver a bytecode of a domain generating algorithm itself or pretty much any circumvention logic by embedding a tiny interpreter into the app.

<comment><USER14> You don't need to deliver bytecode, just a new seed for the algorithm. Even 64 bits is more than sufficient to ensure that they can't enumerate all possible seeds.

<comment><USER12> Seeds don't impose human costs of reverse engineering though. Which could be important in some cases, since we are up against state actors.

But yeah, having seeds sharded per id/phone_number same way I proposed above could make it pretty much unblockable.

</comment></comment></comment></comment></comment><comment><USER15> This is nothing to do with censorship. AWS has many clients and does not want its network to be blocked because of a single customer. Tough for Signal but that's how it is when dealing with businesses (especially one that so many others rely on).

The same thing just happened with Telegram in Russia which explains the preemptive messages: [https://arstechnica.com/information- technology/2018/04/in-ef...](https://arstechnica.com/information- technology/2018/04/in-effort-to-shut-down-telegram-russia-blocks-amazon- google-network-addresses/)

<comment><USER16> Capitulating to foreign censors for business reasons has _something_ to do with censorship.

<comment><USER17> Amazon has a _ton_ of customers, at least a few of which like [https://preemptivelove.org/](https://preemptivelove.org/) are also doing good things in these countries. It's not just Amazon that suffers, but Amazon's customers and everyone else downstream.

<comment><USER18> I'm sure Amazon will be ok. They'll probably have enough money even with the loss to run the servers for that site I think.

<comment><USER17> The point is that Signal isn't the only app being used for good in such countries. Amazon's bottom line will be ok, but the customers & users who live in the censored countries will no longer be able to access other important sites hosted by Amazon.

</comment></comment></comment></comment></comment><comment><USER19> Misleading headline?

> Signal plans to make its traffic look like traffic from another site, > (popularly known as "domain fronting") by using a domain owned by Amazon -- > Souq.com

<comment><USER20> The part you're missing is:

      ... to third parties.

They aren't spoofing the domain, they are just making sure that outside parties to an SSL connection will have a difficult time determining where that SSL connection is going. The two parties _creating_ the SSL connection are not lying to each other, though.

<comment><USER21> But they are. With SNI you are literally lying to the Amazon load balancer, which is one of the two parties of your encrypted communications.

<comment><USER22> Are you? It looks like the Amazon load balancers don't actually care what your SNI domain is when routing traffic. They terminate your TLS connection, and then use the domain in your actual HTTP request to route it, which is not Amazon's domain. Amazon's ability to allow these two domains to differ, and to mostly ignore the former, is the crux of this whole trick.

<comment><USER23> Does this mean that Cloudfront does not actually require (correct) SNI?

Example: Sending HTTP request for signal.org over TLS to Cloudfront IP address with SNI as "allergan.com" returns signal.org web page, not allergan.com web page.

<comment><USER24> Yes, this is the premise of domain fronting.

</comment></comment></comment></comment></comment></comment><comment><USER25> I really dislike the way they put it in the title of this post. What they are doing is simply abusing the name/size of a totally unrelated company to mask signal traffic.

While I am totally in favor of signal, simply using a domain name you dont own in the SNI header just because it is terminated at the same service as you want to use is something you cannot do.

They could have simply have sent the question to the owner of the domains (google and amazon) explaining what they wanted to do, and only think about implementing it when the owner agreed.

And last but not least to answer those: 'why would they even care, the traffic goes to cloudfront anyways?' ... It will seriously mess up the stats (and billing, yes, amazon owned companies pay internal bills to aws for usage, it's a very normal way of doing business and get your taxes right).

It's sad that tricks like these are being considered/needed to have access to internet services in some parts of the world, but simply doing it without all parties involved knowing about it and agreeing on it is _NOT_ the way to do it.

<comment><USER26> > simply using a domain name you dont own in the SNI header just because it is > terminated at the same service as you want to use is something you cannot do

Why not out of curiosity? I'm not disputing Amazon's right to disallow this (it's their service after all), but before that I don't see any objective reason why this is something they they "cannot" or even "should not" do. Also, unless Amazon put in a technical barrier (which they are in the process of doing), then they can't stop a third party from doing it anyway (i.e. me personally sending a different domain in the SNI header than the one I actually end up communicating with), and on that level (ie me rather than Amazon's customer) I see no reason why I wouldn't do exactly that if my ISP was blocking the target domain.

<comment><USER25> > Why not out of curiosity?

Because you are lying about what domain you want to access. This is against the TOS, and simply something you should not do. I know it helps signal to get around censorship and blocks, and it's technically working, but one should not do that.

<comment><USER27> You are only pretending to contact a certain address during the (short) unencrypted phase of the request. As soon as encryption is present you reveal the real address you want to talk to.

The only ones getting spoofed are the censors.

<comment><USER25> Correct. But still it's something one should not do and is against the TOS of AWS Cloudfront.

</comment></comment></comment></comment></comment><comment><USER28> Surely better to get an at-least-vaguely-friendly warning pre-implementation rather than a post-implementation block?

I would much prefer censorship circumvention to be possible, but I have some sympathy for platform providers not wanting their customers and their platform to be conflated so easily.

</comment><comment><USER29> The HN post that alerted Amazon: [https://news.ycombinator.com/item?id=16868564](https://news.ycombinator.com/item?id=16868564)

<comment><USER30> Thanks, HN!

</comment></comment><comment><USER31> Is this something that CloudFlare could help with? They tend to have an idealistic bend, and they serve content for enough sites that they could conceivably disguise traffic in the crowd for altruistic purposes. I could be misunderstanding the mechanism in question, though.

</comment><comment><USER32> Their AWS wasn't threatened, only their ability to use CloudFront.

      We will immediately suspend your use of CloudFront if you use third party domains without their permission to
      masquerade as that third party.

<comment><USER33> Please don't use code formatting for quotes, it makes the content unreadable on mobile

<comment><USER34> Last I checked scrolling is possible on mobile. As is landscape.

</comment></comment></comment><comment><USER35> I posted on the signal community forums in significantly more detail (e.g. how to configure nginx exactly with test connections), but it's relatively easy to use AWS infrastructure only for pass through and configure nginx to accept specific public SNI headers while connecting to domains you are authoritative for (e.g. google.com, amazon.com, yahoo.com, yandex.ru). You can do this by using the ssl_preread nginx module to proxy based on the SNI header (e.g. amazon.com -> 127.0.0.1:444, google.com -> 127.0.0.1:445, yahoo.com -> 127.0.0.1:446). This effectively means that you are not having AWS or GAE do anything other than directly proxy encrypted content, which I would argue is an important distinction.

The downside is that no one is providing the DNS redirect in an encrypted transaction.

</comment><comment><USER36> "If you put a spoonful of wine in a barrel of sewage, you get sewage. If you put a spoonful of sewage in a barrel of wine, you get sewage." \-- Schopenhauer

Unencrypted server name indication is sewage.

<comment><USER37> In the past, the alternatives was a static IP, which are easier to block. i can't think of a solution that doesn't just pass the buck to another third party (like a CA) which would be sucseptible to the same attacks.

</comment></comment><comment><USER38> Clearly they need to create a free iPhone/Android game that becomes wildly popular in these countries so that they can use their own domain to front their 'secret' packets.

<comment><USER39> Censors are not stupid, they will ban domain with no problem.

See Russia banning millions of AWS and Azure IPs to block Telegram, damaging a lot innocent applications by the way.

<comment><USER40> Some censor are very stupid. I visited a country in south east Asia about ten years ago that was blocking Google. On http. But not on https.

</comment></comment></comment><comment><USER41> I feel like Amazon has a moral obligation to name the country that is forcing them to do this under penalty of having their entire IP block black-holed.

I assume Amazon would not take this step unless that was going to happen otherwise, or at least I don't see why they would.

They don't need to make a political statement about it, just say they did it to comply with law / order of 'X'. <cough>Russia<cough>

<comment><USER42> Why wouldn't they do this on their own? Keeping their reputation good with all countries(even the oppressive one's) is an important part of business. After all, amazon has stakeholders to answer to.

<comment><USER41> I don't see how it hurts their reputation to allow Signal to anonymize. They could even block domain fronting in general to block bad actors, and quietly whitelist Signal.

<comment><USER42> It's not about anonymizing, it's about hiding under the mask of some other entity, without their(other entity's) permission. AWS's other customers and various governments won't be happy about aws allowing Signal to do so.

While they could white list Signal, I don't see why they would want to go through this trouble. It's not like any of these public companies care any more about supporting people under oppressive rules, than profit.

</comment></comment></comment></comment><comment><USER43> Google did the same to Telegram:

[https://www.theverge.com/2018/4/18/17253784/google-domain- fr...](https://www.theverge.com/2018/4/18/17253784/google-domain-fronting- discontinued-signal-tor-vpn)

Tech companies being "on users side" (if they ever were) is now officially over.

Hopefully they don't expect users to be on _their_ side when the regulations are coming.

</comment><comment><USER44> It's pretty clear Amazon is in the right here. Actually I'd say it's a positive that they made an effort at human outreach.

</comment><comment><USER45> Can't we just fix TLS to not have this plaintext negotiation component? It clearly isn't necessary, or domain "fronting" couldn't even work.

<comment><USER46> It is still nessecary , it only works because both domains are serviced by the same CDN servers which ignores the plain text version once the packet reaches them.

If the plain text component is not there none of the intermediary parties will know where to route the packet as they cannot decrypt the header.

</comment></comment><comment><USER47> So they're basically asking for forgiveness instead of permission, fronting other sites until they are told to stop?

<comment><USER48> You can't really stop someone from domain fronting on any CDN. This is like "maybe you should have not talked about this on HN". :)

<comment><USER21> Fixing domain fronting is easy. You just match the certificate SANs (or SNI requested domain) to the request Host header.

The only problem is it breaks a subset of users who are domain fronting by accident (Think a mobile app that connects to www.app.com but sends api.app.com).

<comment><USER48> I've used every major CDN on the market and none of them do this.

Some don't even check that the Host header host is a customer and just proxy it anyway.

<comment><USER21> I said the fix was easy, not that people were actually fixing it. :/

</comment></comment></comment></comment></comment><comment><USER49> Demonstrating that these companies are willing to sell the values of the societies, and many of the people, who created them, down the road. Free and open speech, interaction, and association. Privacy.

For most of us, this is "somewhere else", right now. But it will be "coming to a theater near you", real soon now.

</comment><comment><USER50> It seems centralized solutions (Telegram, Signal) are under fire recently. I wonder what would happen if federated protocols (Matrix, XMPP, etc.) were more popular and, thus, also in spotlight.

<comment><USER51> They say it doesn't solve the problem

\- "Would adding federation to Signal help with users behind country-wide blocks? Seems like a distributed service would be harder to censor than a centralized one."

\- "It's trivial to block several distributed hosts simultaneously. An aspiring censor would simply find the most common federated endpoints for a given service and block all of them. Only the users of that software would be affected. There wouldn't be any collateral damage. If the censors somehow didn't hit every single worthwhile federated endpoint, users would still be left wondering why they couldn't communicate with most of their friends. Moving between federated hosts would also necessitate an entirely new identifier, so users would need to rebuild their social graph again.

In addition to being ineffective against censorship, there are several other properties and trade-offs that make federation a difficult proposition for an application like Signal: [https://signal.org/blog/the-ecosystem-is- moving/"](https://signal.org/blog/the-ecosystem-is-moving/")

src: [https://news.ycombinator.com/item?id=16868564](https://news.ycombinator.com/item?id=16868564)

<comment><USER52> I think it may depend on how well distributed would a service be: having several big servers would not help but if every family and company had their own mini server, located in a non-censoring country then the censors would be unable to do anything easily. These servers, in turn, would be able to easily connect to the broader network. Of course that wouldn't be as easy to setup as a simple installation of the Signal app.

<comment><USER53> An aspiring censor could also "easily connect to the broader network" and masquerade as a federated server in order to discover others. This process could even be automated.

Federated services also require an identifier, and this identifier usually indicates where the user's account is located and how to connect with them (e.g. firstname.lastname@example.com). As people share these identifiers, the aspiring censor can just keep adding new entries to the blacklist.

<comment><USER54> At least in case of XMPP, the client doesn't need to be able to connect to other domains, so as long as you can connect to your own server outside of the censorship's reach (which could be accessible for c2s connections in a completely different way than for s2s), you should be fine.

<comment> Paul-ish How do you ensure the censor doesn't block the major c2s connections? I suspect most techniques are too technical for your average user.

<comment><USER52> Modern clients can connect via port 443. There is also support for XMPP via WebSockets, that looks like regular HTTPS traffic.

<comment><USER55> Sure, but they can just block the IP.

<comment><USER52> Yes, but it's always possible to block IP (targeted attack). Federated with a big amount of small servers make it hard to automate. You can block several hosts but the rest of the network would work fine. And because of how federation in XMPP works you just need a one client to server connection to reach the entire network.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER56> Haven't these guys solved this problem: [https://zencash.com/](https://zencash.com/)

They're paying over 12,000 people in zencash, to host 'securenodes' with domain names and ssl certificates for domain fronting, rather than using domain names without permission.

[https://securenodes.na.zensystem.io/nodes/all](https://securenodes.na.zensystem.io/nodes/all)

<comment><USER57> That second link you provided lists every single one of the IP addresses and hostnames associated with the service.

It would be trivial for censors to just block every single one of them.

<comment><USER56> Good point, in it's current form it's a little weak. I'm hoping they get rid of that list eventually.

</comment></comment></comment><comment><USER58> The title is a bit clickbaity. It makes complete sense why Amazon will not be happy with domain fronting.

Side note, Not sure what the point of [Redacted] is as it's trivial to get name from > General Manager, Amazon CloudFront

<comment><USER59> To focus the attention on the role rather than the person, who is clearly just representing the company. It softens it.

</comment></comment><comment><USER60> I took away two important messages:

1\. Amazon is paying more attention to the TLS handshake than I thought.

2\. Censorship-bypassing software is getting popular enough that it's hitting the news.

<comment><USER61> What? Surely:

0\. _Amazon is paying more attention to HackerNews than I thought._

I mean: _Yesterday AWS became aware of your Github and Hacker News /ycombinator posts [ ... ] General Manager, Amazon CloudFront_

<comment><USER62> All the big tech companies are pretty well represented here - it is most likely an employee spotted and flagged the issue whilst having a wee browse over their morning coffee.

</comment></comment></comment><comment><USER23> "Unfortunately, a TLS handshake fully exposes the target hostname in plaintext, since the hostname is included in the SNI header in the clear. This remains the case even in TLS 1.3, and it gives a censor all they need."

Does this mean that endpoints that require SNI are potentially contributing to censorship?

Facts: SNI is optional. Not all websites require it. For example, [https://signal.org](https://signal.org) does not require SNI; clients that do not send SNI can be used to fetch this blog post, without exposing the hostname.

<comment><USER63> The process listening to IPs that resolve as signal.org must not have alternative hosts on it, since the web server can't choose a certificate based on anything but IP. Now the censor can just block your IP.

</comment></comment><comment><USER46> Why is fully decentralized option like WebRTC not considered ?, there is no real need for message apps to be centralized especially on mobile.

Loss of message queuing can be mitigated easily when both end points are more or less always running and messages sent only when both parties are on online.

TURN relays could still be a problem and potential censorship blocks. However the protocol is standard it is not very difficult to setup one even behind NAT. You could even bundle lightweight version with app and make all the clients relays too making it very hard to crackdown on

</comment><comment><USER64> Could they use http instead, with random (generated) domains? And then encrypt the payload?

For extra credit encrypt the payload as html tags (i.e. build valid html where the tags correspond to the bytes in the payload.)

<comment><USER46> All of the domains still would need to point to cloudfront. Only CF was ignoring the outer header, which aws is changing it and this hack won't work in the future

</comment></comment><comment><USER65> This doesn't seem like a good solution from any angle. Do we need to change TCP/IP/whatever to actually allow network traffic to be secure again?

<comment><USER66> AFAIK There was some effort to make this TLS 1.3 SNI header encrypted but some influential groups blocked that (I think I read something about ability to route and control traffic easily). Really sad :(

<comment><USER67> What do you encrypt the header _to_? Options include:

\- Start an encrypted unauthenticated conversation with the server first: that adds at least one extra round-trip, so most people won't do it, so it's easy to block all connections that do

\- Encrypt it to a key you have from the previous connection: doesn't help the initial connection and you already have session resumption for the rest

\- Encrypt it to a well-known "private" key: doesn't help at all

The actual proposal for TLS 1.3 SNI seems to involve ... domain fronting. [https://tools.ietf.org/html/draft-ietf-tls-sni- encryption-02](https://tools.ietf.org/html/draft-ietf-tls-sni-encryption-02) (I assume that's so that it avoids the "it's easy to block" problem)

<comment><USER68> _that adds at least one extra round-trip, so most people won 't do it_

Eh, people will do whatever the TLS libraries have as default. Optimizing for an extra RT is way above what most app developers do.

<comment><USER67> Most app developers, sure, but most web server developers are definitely going to optimize for it - the cost of an extra round-trip is immediately noticeable in benchmarks. And most app developers are running a pre-existing web server to proxy to their code (whether via HTTP to localhost / within the firewall, or something else like WSGI or FCGI), not linking TLS libraries themselves.

</comment></comment></comment></comment></comment><comment><USER69> wouldn't it be possible to actually allow "signal" customers create an appengine account via the signal app? i.e. every customer can just add their google account as a setup to setup an appengine proxy to signal. this would mean that iran would either need to block appengine or they would need to find out all customers. it could be even implemented with a shuffle so that you can shuffle your app id.

</comment><comment><USER70> If TLS incorporated a feature by which clients can send the server name after the TLS handshake which would cause renegotiation of encryption keys with the requested server (if available) then wouldn't that solve the problem at hand?

That way there would be no nees for an unencrypted SNI.

Is there already a TLS extension for this? If not,would have been nice if 1.3 incorporated this.

</comment><comment><USER7> Note that this was about to break in any case: [https://aws.amazon.com/blogs/security/enhanced-domain- protec...](https://aws.amazon.com/blogs/security/enhanced-domain-protections- for-amazon-cloudfront-requests/)

</comment><comment><USER71> It's frustrating because I can see both sides having valid concerns, however, while Signal's position may be the right one ethically, AWS/Google are in the right practically.

Should these countries kick up a stink about a private business acting from their perspective to undermine the laws of their country, it could very well blow up into an international incident. From the point of view of AWS/Google, allowing this to happen or turning a blind eye makes them just a culpable if this were to turn into an incident.

That's not to say I don't support what Signal is trying to achieve, in fact, I very much do, however, given that in essence they forced Google/AWS into this situation without much thought makes me less sympathetic to their plight.

</comment><comment><USER72> It's a strange choice to use Souq.com as the target here. They could have used any AWS customer but chose to use one owned by Amazon. It probably is genuinely one of the biggest Middle East customers on AWS but going this way would really have forced Amazon's hand.

<comment><USER73> It needs to be big enough so you can try and rationalise the morality of the DNS call cost (even being a few dollars, you're still being a bad actor in this scenario), a site known and well classified by traffic monitors that they won't get blocked on their own.

I guess also that hitting an Amazon domain means the logical recourse is to get AWS restrictions (such as we have here), rather than having an aggressive this party company outright trying to sue.

</comment></comment><comment><USER74> Couldn't Signal use popular domains to host IP addresses as a rudimentary DNS server of sorts? For example, host a text file containing Signal server IPs on Google App engine (using the app.google.com address), Azure Blob Storage (using blob.azure.com endpoint), GitHub (raw.githubusercontent.com), S3 (s3.amazonaws.com), etc. There are hundreds of possibilities on some really popular hosting services. Then, when the app starts, it queries in them in series, gets a list of IPs used by Signal, and tries them directly. Signal can then push new IPs (preferably ones in the AWS address space) to the list as often as needed to avoid blocking. Need a new IP? Just grab another from AWS elastic IP service, update the text file, etc.

<comment><USER75> And then the censors can very conveniently block all those IPs too, can't they?

<comment><USER74> That's the point, it'd be a never ending game of cat and mouse, resulting in them blocking thousands of Amazon IPs. You don't have to plaintext the text files either, you could require some kind of shared secret from the app or user login to prevent the censors from just pulling the file in plaintext.

</comment></comment></comment><comment><USER76> Why can't they use raw HTTP vs HTTPS and use an encrypted payload? That handles the SNI front as they outlined as the detection mechanism hindering them. I'm sure there's more to it because this seems pretty basic, but curious the reason why this was ruled out.

<comment><USER77> That occurred to me too. But HTTP/1.1 requires a Host: header. It also brings a problem of key distribution.

The other technique that might be useful to register lots and lots of obscure domain names and rotate them regularly. Might cost a bit in SSL certs.

<comment><USER76> > That occurred to me too. But HTTP/1.1 requires a Host: header.

Yes, but that's easily forgeable as long as the servers in between allow it.

> It also brings a problem of key distribution.

Not really, you can still do chain of trust SSL validation on a payload in the body of HTTP as you could to encrypt the entire HTTP connection as in the case of HTTPS.

> Might cost a bit in SSL certs.

LetsEncrypt could help there.

</comment></comment></comment><comment><USER78> I still don't understand why would Google or Amazon care about this, and why it's against their ToS. Do they think that some of those states may block all kind of access to their IP blocks just because of some people using Signal?

<comment><USER79> I can imagine why someone cares if someone else pretend being that someone....

<comment><USER68> No, the trick works the other way around; they pretend they want to talk to someone, but then talk to someone else. They never pretend to _be_ someone else.

<comment><USER79> Right. Even so, don't you see problem in that too? Pretending doing one but in fact doing other?

Just imagine using that for a non noble cause....

<comment><USER68> I actually can't :) I mean, I can see why one would oppose it because of how it affects Amazon, but I can't see how it could be used for a non-noble cause.

</comment></comment></comment></comment></comment><comment><USER80> "If you'd like to help, we're hiring." Sure but none of the open jobs are related to the problem the post is describing ... unless designers started to have super powers or Android developers are the new Avengers

</comment><comment><USER67> Why can you not run load-balancers on AWS using randomly-selected subject names of other certificates on other AWS machines?

Or just design your protocol so it looks like TLS session resumption and no SNI hostname is in the clear at all?

<comment><USER63> The load balancers will have to have a public IP address, controlled by Signal, which is trivial to block.

The whole reason this hack works is because CloudFront is the one terminating the TLS connection with a misleading SNI header. Blocking CloudFront means nobody can use CloudFront for any purpose.

</comment></comment><comment><USER81> Can someone explain how does one serve content on a domain they don't own, like in this case Souq.com? Do they shove their content to something like product reviews or what?

EDIT: I realized they use souqcdn.com. Does this mean it works because their clients use "souqcdn.com" to resolve to CloudFront CDN's IP address and then they craft a different Host header (like "Host: api.signal.org").

Also how can they possibly use CDN for this? As far as I know, CDN works only with GET requests, so how are they doing a chat app on this?

<comment><USER82> They aren't serving content on that domain. They just make requests look like they are going to that domain in the outer layer (by using it as the TLS server name), but the actual request inside the encryption is for a different domain they own. The load-balancer in front of the cloud service accepts the connection for souq.com (since it is responsible for that too it has the matching server certificate), decrypts the request, sees in the request that its for "signal.org" or whatever and delivers it there.

<comment><USER81> Oh so this works because of TLA SNI?

<comment><USER82> yes.

</comment></comment></comment></comment><comment><USER83> You want to use the resources and influence of a large corporation to acheive your organizations goals. They don't have to be on board with your mission, and it's arrogant to think so IMO. Why should they let you do it, when they won't allow it for others? Seems like you feel entitled because you think by default people should support what you're trying to do.

The flipside of free speech you're ignoring is that people get to abstain from using their voice in addition to using it.

<comment><USER68> What part of the post shows they feel entitled to it?

<comment><USER83> The fact that they posted the e-mail from Amazon, so readers could direct the blame at them. You can't read that blog post and say it's the most unbiased and objective way they could have presented this, especially if they want to remain on good terms with Amazon, who has done nothing wrong at all.

<comment><USER68> One can have an opinion and disagree with Amazon without feeling entitled to anything from them.

I'm not objective; it's my subjective opinion that you're wrong. That doesn't mean I feel entitled to have you change your mind.

<comment><USER83> "One can have an opinion and disagree with Amazon without feeling entitled to anything from them."

That's a straw man. In this case, they don't only disagree, they also feel entitled; _that 's_ what I'm saying.

<comment><USER68> I understand; but you're saying you can tell they feel entitled by the fact that they're not objective or unbiased. And what I'm saying is that not being objective doesn't show they feel entitled.

Maybe they feel entitled, but I don't think there's anything in the blog post showing that. All I see is (fairly mild) disagreement with Amazon's actions.

</comment></comment></comment></comment></comment></comment><comment><USER84> _> >Direct access to Signal has been censored in Egypt, Oman, Qatar, and UAE for the past 1.5 years._

Yeah but Amazon alone, should not bear the cost of making Signal accessible to these countries--especially without their consent. People underestimate dictators, they will block God's channel to ensure their own survival. How many times has Youtube been blocked by countries? Plenty of time. So Amazon cannot risk being blocked completely because of this.

</comment><comment><USER85> Couldn't they ask people to donate their AWS instances or a portion of their webserver (or domain) resources to running a small outward facing webserver as a dummy, making the domain look like its a real website (eCommerce etc) and then passing Signal data through a Shadowsocks (or something similar) proxy? Couldn't they develop an AMI that they hold the keys to that people could deploy with ease?

<comment><USER86> Those who wish to suppress Signal would just play whack-a-mole. They'd login to Signal, find what domains it was connecting to and then block those. To update Signal with new addresses constantly, you'd need a server hosting those updates- which would in turn be blocked immediately.

The idea of using Souq.com or Google.com as the domain name in the TLS header was that even oppressive regimes won't block Google or Souq for their entire country.

<comment><USER87> >The idea of using Souq.com or Google.com as the domain name in the TLS header was that even oppressive regimes won't block Google or Souq for their entire country.

Which, at least in the case of Russia, seems to be false.

</comment></comment></comment><comment><USER88> Wouldn't it be nice if Facebook, Apple, Amazon, Netflix and Google all gave Signal certificates as part of their anti-censorship support?

</comment><comment><USER89> Why should we in the United States coerce (or sneak into) countries whose Governments don't want us there? Are these folks really "idealists" who think that access to tools like "Signal" will usher in a new spring! (See how well that worked in Egypt and Syria?)

Let these Nations enjoy their sovereign right to protect their borders--even their digital ones--as they see fit.

<comment><USER90> A nation != its current government

Citizens under oppressive governments often don't like their governments. The feeling's usually mutual. Some people in such countries - I actually think "most" but I'll remain conservative here - appreciate such tools and its creators. Not necessarily to do anything so ambitious as "ushering in new springs", but often simply to talk to relatives or make online friends or learn new things or exchange ideas online. In case you didn't realize it, lack of freedom and powerlessness really brings down one's mood, and anything to brighten it up is welcome.

</comment></comment><comment><USER91> I'm thinking of a legislative, not technological solution to this, which seems to be pretty straightforward: make it unlawful for US companies to refuse service simply for Domain fronting. That way, none of the big companies could lawfully refuse service to Signal; neither could they be faulted by these other regimes for "letting Signal use their domain".

<comment><USER92> No, the solution is to solve the technical problem of leaking metadata during the TLS handshake.

Should it also be unlawful to refuse service to someone who pretends to be you when they resell your widgets to the mob because they fear retaliation if the mob isn't happy with the goods?

<comment><USER92> Re: Your deleted

The fact that in Signal's case, the client and the server are fully aware of who each other are is immaterial (thus not part of the analogy).

What the analogy demonstrates is that there exists a potentially-retaliatory party that sees the server identify itself as someone else. That someone else (in this case, the cloud provider) has the right to protest the use of their identity in a way that makes it a target for the retaliatory party.

Have a great day.

</comment></comment></comment><comment><USER93> Amazon isn't targeting Signal, this is their new policy based on (mostly) abusers (though I doubt Signal was intentionally trying to abuse the system for malicious reasons). Hopefully this doesn't get spun out of control, but the title of this post seems to be spinning it.

</comment><comment><USER94> Wouldn't it make more sense to build TOR or something like it into signal for these use cases?

<comment><USER68> Tor was actually using the same trick to avoid censorship: [https://blog.torproject.org/how-use-meek-pluggable- transport](https://blog.torproject.org/how-use-meek-pluggable-transport)

 _meek-amazon makes it look like you are talking to an Amazon Web Services server (when you are actually talking to a Tor bridge), and meek-google makes it look like you are talking to the Google search page (when you are actually talking to a Tor bridge)._

</comment></comment><comment><USER95> Maybe someone (ICANN) could start a donation register for domains which tells applications they allow using there domain name in domain fronting for censorship circumventing purposes?

Since Amazon's TOS _does_ allow domain fronting when the domain's owner allows it.

</comment><comment><USER96> Kinda a misleading headline. Amazon is stating the don't want their domain name used as a circumvention measure. I think that's reasonable. Signal is the one hijacking it and Amazon is taking the risk if it gets blocked.

<comment><USER24> No, the fact that Amazon owns the souq.com domain is irrelevant here.

<comment><USER96> Can you elaborate? I'm not sure I understand why.

</comment></comment></comment><comment><USER97> The title is misleading they are pretending to be Amazon. The title, Amazon threatening to suspend Singnal's AWS acoount over censorship circumvention, is more vague, less accurate and potentially harmful.

</comment><comment><USER98> Wouldn't a federated system be much more robust where you would only need to access one of the nodes and this would send it through a chain of nodes to the receiver?

</comment><comment><USER99> This might be a good time to switch to Threema, which generates less metadata than Signal b/c it doesn't use phone numbers as identifiers.

</comment><comment><USER100> Yeah the problem must be with Amazon, not that Mr Marlinspike refuses to allow federation of the signal protocol for no good reason whatsoever.

<comment><USER101> How would federation help in this use case?

</comment></comment><comment><USER102> What was it that convinced Google and Amazon to no longer allow this particular censorship evasion?

<comment><USER29> Russia made it clear that they would block AWS and Google Cloud if domain fronting was allowed to continue.

[https://arstechnica.com/information-technology/2018/04/in- ef...](https://arstechnica.com/information-technology/2018/04/in-effort-to- shut-down-telegram-russia-blocks-amazon-google-network-addresses/)

As moxie says in the blog post

>The idea behind domain fronting was that to block a single site, you'd have to block the rest of the internet as well. In the end, the rest of the internet didn't like that plan.

<comment><USER3> AWS and Google Cloud should have refused to cooperate. Let Russia block them and bear the economic costs of censorship.

<comment><USER103> Plays into Russia's hands, actually. Russia has been pushing for a nationalist approach to messaging, rather than having its citizens use Telegram (ironically, developed by the Russian who created VKontakte.)

Nations that lean authoritarian are teching up their sovereign walled gardens, banning external/ungovernable services as soon as it's feasible.

The long play is to knuckle under and defer to local governments, as Amazon, Google and Facebook have shown.

</comment></comment></comment></comment><comment><USER104> This is why we have built stealthy.im on a decentralized and censorship resistant platform.

<comment><USER39> If censor can enumerate nodes of P2P network, it can ban it.

</comment></comment><comment><USER105> This is why any centralised service is doomed. Hint: federation.

</comment><comment><USER106> It's like Robin Hood running from King John's guards and barging through other people's homes. Some would definitely be pissed.

</comment><comment><USER107> According to the founder of matrix, him and Moxie had a meeting a few years ago to discuss federation where Moxie debated that it wasn't ideal to create a federated protocol, that somehow it would create too many problems. Now that Signal is unable to service everyone without federation, does Moxie still hold reservations on federated protocols?

On another tangent; the Host Identity Protocol would resolve this (and countless other) security issue by simply rendering all traffic impossible to analyze in such a way. Why a big tech company like google hasn't put their men on the idea is beyond words, especially since it also elegantly solves mobility.

</comment><comment><USER108> Once all speech has moved to privately owned platforms, having the right to free speech will be effectively useless.

<comment><USER109> You have the right to read the linked article, why don't you exercise it?

</comment></comment><comment><USER110> Well, this is what happens when countless startups go to a couple of web hosters in the name of outsourcing unsexy stuff like racking and stacking servers.

<comment><USER111> If they were self-hosted, it would be even easier for Iran to block them.

<comment><USER110> If they hosted on VMs they would simply hop from one place to the other. The problem is that all of this stuff is "difficult" and no one would be writing stories about how great signal is if it could switch between thousands of companies that provide VMs to masses.

We do not have these thousands of companies because AWS/GCS/Azure are the go to. Well, guess what? That means that objectively there are three kings of the world and the lieutenants of those kings get to decide what is and is not allowed.

<comment><USER112> > If they hosted on VMs they would simply hop from one place to the other.

No, that isn't a good enough solution. Signal needs to be _reliable_ , or it's not worth having at all. The fundamental problem is node discovery: allowing the users to discover the IP address of the mothership (or, if you prefer, other members of the P2P network, but Signal is a centralized network) without the oppressive regime finding those IP addresses. Domain fronting was supposed to be a "cut the knot" solution, but CDN providers are shutting it down.

Tor's approach has been to use a La Resistance approach, where Dave in the US runs an obfsproxy node for Yasim and his twelve trusted friends, that's how node discovery works, and as long as Dave is a good sysadmin and nobody squeals it's reliable. Personally, I think that's the only sustainable solution, but it's not very user-friendly, because you need to have trusted confidants on the other side of the firewall that your government doesn't know about. Signal can't be that trusted confidant, though I imagine Signal works over Tor just fine if you set it up.

</comment></comment></comment></comment><comment><USER113> I don't like this. The last few services taking privacy seriously are under attack all over the world. Telegram vs. Russia, Signal vs. Amazon, WhatsApp Encryption vs. Facebook...

</comment><comment><USER79> Based on the story Amazon has no problem with you circumventing censorship, it is not the subject of the topic at all, do not lie please because you only hurt your own reputation and trustfulness - which in a highly sensitive area that you are working in is paramount!

<comment><USER53> The technique that Signal was using to circumvent censorship (domain fronting) will no longer be possible on Amazon:

[https://aws.amazon.com/blogs/security/enhanced-domain- protec...](https://aws.amazon.com/blogs/security/enhanced-domain-protections- for-amazon-cloudfront-requests/)

<comment><USER79> This is not waht's in the title of the article! The title says the account is threatened to be closed on the grounds of circumventing censorship! Big fat lie!

The account suspension threat is based on using something that is not permitted! Knowingly not permitted, illegitimate use!

</comment></comment></comment><comment><USER114> You should be using your own servers. Guess the lesson is learned now?

<comment><USER20> How do you propose that they implement domain-fronting to circumvent censorship from their own servers?

<comment><USER110> Boatload of VMs with constantly migrating IP addresses.

<comment><USER115> Which then has the problem of how do users find them (if by DNS, you can block the DNS record).

<comment><USER110> Service discovery is an actual interesting problem to solve when you don't outsource it to k8s, huh?</comment></comment></comment></comment></comment>


The growth of the European startup scene - <AUTHOR> https://thenextweb.com/eu/2017/05/22/europe-isnt-the-new-silicon-valley-its-better/ <comment><USER2> The US has one thing that Europeans cannot compete with:

One language spoken by close to all 320M Americans as a native language and spoken by More than a billion worldwide as first or second language and which also happens to be the language most technology uses, incl in documentation and tutorials.

Would Google have reached global fame if it had been in French to begin with? Of course not. What about if Facebook started at Bocconi and in Italian? No way Americans would have adopted it (let alone Spanish or Dutch).

Bureaucracy, taxes and other obstacles are possibly worse in the US than in most European countries (I lived both there and in three different European countries). We have very little to learn from the US in that respect. But without a common language it's difficult for Europeans. It's not a coincidence that most good startups in Europe are in countries where English is a first or very strong second language (UK, NL, Scandinavia etc).

<comment><USER3> Due to the high number of regional languages, most startups simply start with the English version of their product (if the product is not primarily aimed at their home country). So Google in France would have been in English first and French second.

<comment><USER4> AFAIK, and IANAL, in France, you'd still need to support 2 versions from day one:

[https://en.wikipedia.org/wiki/Toubon_Law](https://en.wikipedia.org/wiki/Toubon_Law)

I just internationalised a UK startup to enter other EU markets, since doing so it has been a non-trivial amount of extra work just to keep it up. Not immense, but definitely a drag. There's all sorts of little extra cognitive overhead once a product supports two languages. Button widths, text lengths, layouts, email layouts, normalised date formats, even icons (for example we'd used a £ icon to indicate paid). We use SendWithUs templates, and now we have to upload all the translations too as part of a deploy. And that's not even counting the extra time to do the translation, upload it, etc.

Silly little things that a lot of programmers use without thinking, like basic date formatting like "ddd HH:mm", you simply can't do that any more. You need to agree shared formats and they don't always fit as you'd like them to, or quite convey the info you want them to. For example recently I'd have loved to say "Today 9:15", "Tomorrow 12:15", "Thu 14:15" or "Next Week", just for one specific place. But then you need to create a function to perform l10n on that and suddenly you're adding a big bit of extra functionality and you end up falling back on the shared .ToL10nDateTime() even though it's objectively worse at conveying the info you need to convey.

We've got a bunch of work in Alpha at the moment that's English only because we were under such time pressure to deliver it for one client. The time to insert all the place holders and do the client-side i18n meant we've parked it all to get the functionality out of the door for that client. Even though it will take more time in the long run.

As I understand it, a hypothetical French startup equivalent would be breaking the law by doing that.

</comment></comment></comment><comment><USER5> Living in Paris, I can feel a strong momentum of entrepreneurship and startups. ex: Recent "Station F" incubator from Xavier Niel is opening in 2018 and will be one of the largest startup campus in the World. Macron is strongly pro-startup. there are a LOT of options for funding (quite crazy when I saw how much we can get with my startup (Banque publique d'investissement, crédit impôt recherche...). It is really easy to start a startup, not much paperwork (surprisingly).

Contrary to 10 years ago, best students coming from "les grandes ecoles" want to be entrepreneur or join a startup. This is a radical change to the mindset from the past when the best opportunity would be in big companies. PhD start to be recognised as they should in private sector and more PhD are leaving academic to private (which I did).

Now, I think that comparing Europe to SV is too premature, (A change in culture is yet to come). But the dynamic is here.

In Paris, salaries in tech startups are high (for what I saw: ~42K junior, ~60 senior (5y)) compared to the cost of living (in France healthcare and education are free), rent is high. So yeah, I am confident for the future of Europe :)

edit: and from what I saw, most startups' products have english language available (interface/doc). Most of them have international expansion in mind.

<comment><USER6> > salaries in tech startups are high (for what I saw: ~42K junior, ~60 senior > (5y))

Are the salaries at the big corps lower than that in France? In Germany, I get about the same working at a big software company in a developer/architect role.

<comment><USER5> I gave an average, in big companies it depends on which company you are working for, which "Grande ecole" you come from, and what position you have. I would say that the variance is quite high.

</comment></comment></comment><comment><USER7> The article is the usual PR piece on startup sectors in the EU.

Unfortunately, writing hype articles like that do not make things better. From my personal observation, there is a huge difference in funding/regulatory/technology adoption and available workforce.

</comment><comment><USER8> If Europe is better than Silicon Valley, where is the output? They have been silent compared to Silicon Valley in most markets.

<comment><USER9> To name a few --

Payments: Adyen, Transferwise, and (arguably) Stripe

Music: Spotify, Soundcloud. Shazam

Travel: Booking.com, SkyScanner

Fashion: Zalando

Telecommunications: Skype

Gaming: Rovio (Angry Birds), King (Candy Crush), Supercell (a.o. Clash of Clans)

<comment><USER10> yet Europe has a population more than twice the US.

<comment><USER11> But a much more segmented market, what is your point? Europe is not a country.

<comment><USER10> The parent lists a handful of European startups. Just incase that list was being presented as an example of Europe's startup prowess, I just wanted to temper any enthusiasm by pointing out that on a per-capita basis, the density of startups is much lower in Europe.

</comment></comment></comment></comment></comment><comment><USER12> Hiring people from abroad is also easier in Europe.

</comment><comment><USER13> Wishful thinking, and hilarious that I had to clear a cookie notification just to read the first part of the article. It's that kind of forward thinking web bureaucracy that has allowed SV to flourish.

<comment><USER14> I didn't understand your comment.

1) Do you think cookie notifications are a bad thing ?

2) Do you think it is web bureaucracy ? If so, laws protecting every european citizen with digital neutrality are also bureaucratic ?

<comment><USER15> There's a difference between protecting citizens and overloading them with meaningless warnings that just end up desensitizing them.

<comment><USER16> Indeed. Fortunately there is a filter-list [0] for my ad blocker with the sole purpose of blocking these EU cookie warnings :-)

[0] List homepage: [http://prebake.eu/](http://prebake.eu/)

</comment></comment></comment></comment><comment><USER17> This is a dupe of a recent posting:

[https://news.ycombinator.com/item?id=14432977](https://news.ycombinator.com/item?id=14432977)

</comment><comment><USER18> What did this statement mean: "It's very difficult for American startups to relocate post-Trump."

</comment><comment><USER19> I hope not. The pay of developers is horrible compared to silicon valley.

<comment><USER20> The cost of living is also a fraction of the one in silicon valley. I stayed in Silicon Valley for a few months and compared to Munich, the quality of living is complete horse shit, to be honest.

And Munich is the most expensive city in Germany.

<comment><USER21> I bet you don't mean at central locations, because 10-20 miles further to your workplace, as most of Londoners or Berliners can afford to live, you have affordable housing in SV as well.

<comment><USER20> That's an interesting aspect I didn't consider.

Another issue though is traffic during rush hour in Silicon Valley. I can see myself traveling 20 miles in/around Munich in half an hour, while in Silicon Valley, that would probably take me 1.5 hours, because of the pretty much non existent public transportation.

<comment><USER21> London is not much better. E.g. from Hammersmith (a posh, well connected area) to Old Street (aka "Tech City"), this 14km journey is 46 mins from underground station to underground station, both are north to the river. [https://tfl.gov.uk/plan-a- journey/results?IsAsync=true&JpTyp...](https://tfl.gov.uk/plan-a- journey/results?IsAsync=true&JpType=publictransport&InputFrom=Hammersmith%2C+London%2C+United+Kingdom&Modes=bus%2Ctube%2Cnational- rail%2Cdlr%2Coverground%2Ctflrail%2Criver-bus%2Ctram%2Ccable- car%2Ccoach&From=Hammersmith%2C+London%2C+United+Kingdom&FromId=&PreviousFrom=Greenwich&InputTo=Old+Street%2C+Old+Street+Station&To=Old+Street%2C+Old+Street+Station&ToId=1000169&PreviousTo=Old+Street%2C+Old+Street+Station&TimeIs=arriving&Date=20170531&Time=0900&IsMapRequired=False&Mode=bus&Mode=tube&Mode=national- rail&Mode=dlr&Mode=overground&Mode=tflrail&Mode=river- bus&Mode=tram&Mode=cable- car&Mode=coach&CyclePreference=AllTheWay&WalkingSpeedWalking=average&JourneyPreference=leasttime&AccessibilityPreference=norequirements&MaxWalkingMinutes=40&WalkingSpeedTransport=average&InputVia=&Via=&ViaId=&PreviousVia=&NationalSearch=false&WalkingOptimization=false&SavePreferences=false&IsMultipleJourneySelection=False&JourneyType=&IsPastWarning=False) Sure, you can move around to carve down 10 mins, but then you give up to live in realitvely nice, convenient area populated middle class people and yet not as expensive as Chelsea or Chiswick. If you live further, your journey time from station to station is not much longer, but only if you are lucky and there is no delay in the service, which happens almost daily.

</comment></comment></comment></comment></comment><comment><USER22> Silicon Valley has 30bn venture cap. Germany 3bn.

</comment><comment><USER23> I'm very skeptical of that claim. Besides the fact that every week we read an article about X city is the new Silicon Valley, Europeans in general don't seem to have that same drive Americans do to create new products. Which could explain why we haven't seen many large innovative tech companies come out of there in a while.

(Though in countries like the Czech Republic, and to a lesser extent places like Romania and Poland seem to have more drive, and the work ethic to boot.)

Edit: I'm not saying that they haven't achieved say a better work/life balance, but that their culture doesn't seem to produce very many world changing entrepreneurs as evidenced by so few companies being created there and that stay there.

I'm not sure what's going on with the Hacker News culture lately, but it seems to be increasingly hostile to diversity of thought. I get that comparing cultures has come under fire from the extreme political left, but that's no reason we can't have a discussion about it. I would like it if members didn't just downvote me, but engage me instead. Anecdotally, I've been to several European countries, I've engaged with local populations, and the culture is different. And empirically, they're not innovating anywhere near the rate the US is. I'm willing to change my views, I would love to be wrong and that Europe will experience an entrepreneurial renaissance, but I just don't see it. Tell me where I'm wrong.

<comment><USER24> > _Europeans in general don 't seem to have that same drive Americans do to > create new products_

Maybe they don't want to work 70 hour weeks?

<comment><USER23> Exactly. Elon Musk has been working 80 hour work weeks for the past 20 years now. I'm not saying that's anywhere near a balanced lifestyle. But without those sacrifices, it's much harder to produce innovative world changing products or services. The United States creates and draws those character types to it, and for many Europeans countries, they don't.

<comment><USER25> There's a body of research that corroborates the opposite claim, i.e., that past a certain point, working more hours does not correlate with -- or correlates negatively with -- effectiveness. So if Europe is less "innovative", the reasons are not likely related to a simplistic measure like hours worked.

<comment><USER26> On overall, probably not. There's a difference though between average load and peak load. Virtually nobody could sustain a 80 hour work weak for an extended time. A lot of people could do it for a short time, provided the possibility of a large reward.</comment></comment></comment></comment></comment>


Switch Browser – macOS extension to view current page in a different browser - <AUTHOR> https://itunes.apple.com/us/app/switch-browser/id1436685916 <comment><AUTHOR> Being a webdeveloper and having Safari as my main browser i often need to look at my websites not just in different browsers but in a browser with actual DevTools. Looked around, couldn't find anything simple for viewing current page in a different browser so i made my own solution. This is "share menu extension", you can configure which browsers you want to see and it recognizes all the browsers installed in your system.</comment>


Ask HN: Inventors on the same level as Nikola Tesla or above him? - <AUTHOR> I personally feel that Nikola Tesla is a rare breed among inventors and I am inclined to believe there are only few who were on his level or above him in inventiveness.Till now I haven't come across anyone who has impressed me like Tesla.
       I would like to ask the knowledgeable folks here at HN as to who are those other unknown inventors who were at the level above or equal to Nikola Tesla.Please share as much information about them.It will be quite helpful to me and lot others on this forum.
  Thanks in advance. <comment><USER2> There was a Russian inventor, called Genrich Altshuller, Who also worked as a patent examiner. And he invented a method called TRIZ , which is a systematic method of inventing things, based on highly abstract patterns evident in many inventions - a way you can teach every decent engineer to become highly inventive.

It is a highly effective method(mostly for the physical world , less for IT afaik) , used in many large inventive organizations very successfully and behind many inventions.

So in my eyes he is one of the most productive inventors in the world.

Also he was sent to the soviet Gulag , a labor camp deep in frozen sybiria , but still remained hopeful and in good spirit , and in the Gulag he and others create a group that taught each other various fields , like architecture, literature ,science, etc - as a way to keep their humanity and not be broken.</comment>


Matt Groening's Disenchantment lacks magic of Netflix's other animated originals - <AUTHOR> https://www.theverge.com/2018/8/7/17661852/disenchantment-review-netflix-bojack-horseman-big-mouth-animated-originals-comparison <comment><USER2> I watched one the other day called "final space". I don't think it had much magic either.</comment>


Why is it that reading news from 2 decades ago feels productive? - <AUTHOR> https://decades.tech <comment><AUTHOR> As I've been studying news from the last decades I can see certain categories unfolding. Tech that is available now and was predicted pretty precisely — eg. [https://www.nytimes.com/2000/06/11/magazine/tech-2010-24-all...](https://www.nytimes.com/2000/06/11/magazine/tech-2010-24-all- one-land-plenty-watch-that-your-lifeline-world.html)

Ideas that took a lot more time to get implemented — [https://www.nytimes.com/2000/06/11/magazine/tech-2010-14-fee...](https://www.nytimes.com/2000/06/11/magazine/tech-2010-14-feel- secure-the-surveillance-camera-that-picks-out-the-bad-guys.html)

And, essays with ideas that seem even more relevant today — [https://web.archive.org/web/20000815060013/http://www.beyond...](https://web.archive.org/web/20000815060013/http://www.beyond2000.com/news/Jun_00/story_652.html)</comment>


Consumer Reports' Tesla Model S P85D breaks–before testing begins - <AUTHOR> http://www.consumerreports.org/cro/news/2015/05/consumer-reports-tesla-model-s-p85d-breaks-before-testing-begins/index.htm

<comment><USER2> The door handle control module failed (apparently a common fault with the model S). But Tesla sent a technician over the next morning and fixed it in two hours.

Nice.</comment>


Why should you hire a polyglot programmer? - <AUTHOR> http://thoughtworks.github.io/p2/issue08/hire-polyglot/ <comment><USER2> With languages like Python, PHP, JavaScript, Java, or C#, sure -- they're fundamentally very simple languages with a handful of gotchas to learn, they're easy and fairly interchangeable, and your overall programming skill is what really matters.

But there are other technologies or "languages" which, paradoxically, many developers _think_ are trivial to learn, like CSS and SQL, but in which years of experience matter far more than any kind of natural programming aptitude. CSS and SQL are heavily implementation-specific, with edge cases upon edge cases upon edge cases that often wind sucking up the majority of your time. If you want complex queries that are still performed efficiently, or complex layouts that don't take weeks to get working properly in all the different browsers, no astronomical IQ or general programming aptitude is ever going to win against years of experience.

<comment><USER3> Ahh, CSS. The hardest language to master.

<comment><USER4> As a back end developer slowly moving my way into the front end, I am glad to hear other people find it difficult.

<comment><USER3> I am glad to hear other people find it difficult, too. I really am.

<comment><USER5> I can't tell if you mean 'because I find it difficult too', or if you mean 'because it means I have less/easier competition'. Of course, this could have been your intention all along, but if it wasn't could you clarify?

<comment><USER3> Because I find it difficult too. :) Been using CSS for 7 years and still have some trouble with it, compared to typical programming which tends to be quite easy.

<comment><USER5> Cool! I definitely have trouble using CSS, I depend heavily on CSS frameworks & libraries to lay out anything remotely complex.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> One should hire people who care, and who continuously broaden their own horizons. When it comes to developers, these inevitably happen to also be polyglot programmers in my experience.

<comment><USER7> First sentence is correct. Second sentence, the jury is still out. Plenty polygots fail short in writing high quality idiomatic code due to focus in breadth not depth.

Writing web apps backed by db in Python, Java, and Ruby are considered as breadth repeated 3 times.

</comment></comment><comment><USER8> > _2 years of Ruby, 1 year of Python and 2 years of Java_

She is anybody but a polyglot programmer.

So this thing the author writing about is common misconception. Yeah, if know some mainstream(ish) languages and can do some common tasks you will unlikely have problems doing some common tasks in another ruby-java-python. Now go write me something rock solid in Erlang. Or (oh boy you better forget your java) Haskell.

<comment><USER9> Not to mention that to many rubyists, pythonistas or Javaneze 1 and 2 years of experience, is like saying that you just _learned the language_.

I use ruby ~ 3 years, not professional but more than 5 hours per week and I can say that I don't consider myself a _pro_ or _advanced_ in any way. There are huge parts of the language that eludes me, even in things/frameworks/situations that I have successfully used/implemented.

</comment></comment><comment><USER10> "The person with the second CV could be a better developer on a C# project than your language expert, despite having little or no C# experience."

No. What you're essentially stating is more experience is detrimental. That someone with a few months experience who is writing her first application in a particular language / stack will perform better than a veteran. Knowing the basics is important, but having experience not only with the language but with the libraries, apis, build tools, frameworks etc. is what separates a good programmer from a decent one. _Both_ programmers in this case have the basics but the experienced person has _a lot more_ than the basics. I'm not against hiring a polyglot, even one with no experience in the language/stack that will be used. _Hiring a polyglot does not make up for experience and knowledge, however._

<comment><USER11> "What you're essentially stating is more experience is detrimental."

It's not so simple. Not all experience is equal. Some folks have 10 years of experience developing software. Others have one year of experience, repeated 10 times.

<comment><USER4> Yes, if people have at least learned a second language you can tell they are one step up from the 1 year repeated ten times.

<comment><USER7> They are exactly at the same level of proficiency. Writing a loop in a different dialect does not make you one step better. You're still walking albeit with different rythm.

In the end, they are essentially performing the 11th time.

<comment><USER4> I went from Java to Perl (back when Java was all the rage). That really opened my eyes. Perl is dynamic, and you can program functional / imperative. You could do so much more with it in way less lines. You learn to use hashes / maps / dictionaries (instead of arrays being the obvious way to do things) because hashes are encouraged by the language.

Also, while Perl's standard OOP, is a bit of a hack on top of the language, it helped me really understand what was going on, unlike Java, where a lot of these things are like a black box.

Maybe I should have emphasized learning a second language with a different / multiple paradigms.

(Saying that when I later moved to a job using Visual Basic 6, I didn't feel like I learned much).

<comment><USER7> My experience was the other way around Java => Perl, not liking it. I suppose people have different taste buds.

While there are (small) values that one can get out of Java => Perl, being dynamic and functional, your experience seems seasonal (hashes, maps, etc). I felt that these days if one wants to learn algorithms and data structure, Java Collection libraries and Guava seem to be the defining standard.

I don't disagree if one is learning Erlang to write scalable message queue coming from Rails. But I definitely disagree if one is learning another programming language and ended up coding the basic web-app, which seems to be the case these days.

</comment></comment></comment></comment></comment></comment><comment><USER12> This is, after all, how Thoughtworks make their money - they insert polyglot (read graduates/juniors with a smattering of experience in different languages) into projects and bill for experienced professionals (the "seasoned" developers in this article). This article conflates "varied experience" with "good developer" and "seasoned developer" with "bad developer". In the real world, this is not the case. So whilst I agree with the premise that varied experience contributes to being a good developer and that polyglotism is very healthy and a positive sign, I disagree with the broad conclusions implied by this article.

</comment><comment><USER13> A lot of great points. I've worked with a lot of people that know one language well but are almost willfully ignorant to others... even when the skills are needed on the current projects. I've gotten to where when I interview applicants I worry less if they know the answer to esoteric questions about rarely used features of certain languages and spend more time on architecture, testing/debugging and deployments. It's amazing how many people interview with 15 years of Java but no experience with Continuous Integration and testing techniques beyond JUnit.

<comment><USER14> > but are almost willfully ignorant to others...

sounds like every backend person forced to do javascript, ever.

Well, until node happened.

</comment></comment><comment><USER15> In this case polyglot seems to mean, "has experienced a lot, traveled the world and is primed for stuff." One can get that and still only have Java or Python or C++ on their resume. We don't litter our CVs with all the stuff we dabble in. Exposure and priming matters, but most of these labels, using github as resume all seem like shortcuts to actually interviewing and talking to people. There are no shortcuts, building teams is difficult and shit is always way more complex than we make it out to be.

</comment><comment><USER16> Agreeing with the comments here and the post - I'd like to add that having experience with many different languages also shows that the dev has a drive to learn, and that's a + in my book.

<comment><USER7> How do you know that the dev has a drive to learn? Maybe the dev jump to the bandwaggon of coolness?

Does the dev who prefer to go deep in a specific tech have no desire to learn just because the dev does not look like learning on the surface?

<comment><USER16> I see your point, however for me It's a pretty safe bet that a dev having experience in multiple languages has a drive to learn. Jumping the bandwagon is not necessary always a bad thing (it could be of course), sometimes it's a sign of curiosity and experimentation.

<comment><USER7> I don't disagree with curiosity and experimentation. But it's a very slippery slope with short attention span as well which seems to be the case nowadays (look at various Rails plugins, majority of NPMs, and 10001 Python web framework out there).

When it comes to programming, attention to details matters.

<comment><USER16> Yeah, I absolutely agree!

</comment></comment></comment></comment></comment><comment><USER17> I'm new to this game but I think there's a lot more to programming than "programming". I'd love to be a polyglot but I spend so much time learning the differences between App Store "guidelines"/tools, IDEs, application life cycles and the minimum required to use/design for different OSes. That I don't have time to fully grasp each language I use.

Does it get easier or do new technologies always have differ just enough to require new learning, for them to be useful?

<comment><USER18> You should aim to learn languages that are different. The point of learning very different languages is that you can start generalizing in ways that make mastery of future languages easier.

For example, Python has something called "list comprehensions". These might be interesting to a new programmer, but if you've used a functional programming language before, you have already used something more general (list comprehensions are essentially a syntatic sugar for a couple basic FP functions). Same with many other things like iterators/generators, which are a special case of coroutines. Etc.

So if you're familiar with functional programming, you can instantly understand Python's list comprehensions, whereas someone learning Python as one of their first languages might have trouble with them or might not be aware of the various constructs they can get away with.

So you really should seek out languages that are very different. As a point of comparison, I wouldn't consider Python, Ruby, Lua, Javascript to be very different from each other. You should try harder than that. But it does pay off and it does get easier as a result.

</comment></comment><comment><USER19> All I want right now is a polyglot programmer - firstname.lastname@example.com - remote fine, solving a problem that is killing businesses

</comment><comment><USER20> I think, "programmer" is always polyglot while "coder" could knows only one language.

<comment><USER4> What's "developer" then? "Software engineer"?

I think these terms can be used interchangeably.

</comment></comment><comment><USER21> Offtopic: It's funny that an article about polyglottism has a grammatical error in the title and a misspelling in the first sentence.

<comment><USER3> "Sceptical" is actually the British spelling of the word "skeptical."

<comment><USER21> Interesting. Thanks!</comment></comment></comment>


Trees and Other Hierarchies in MySQL (Relational/hierarchical data overview) - <AUTHOR> http://www.artfulsoftware.com/mysqlbook/sampler/mysqled1ch20.html

<comment><AUTHOR> This is a well done summary that is really appropriate for any RDBMS. More than worthwhile if you deal with hierarchical and relational data.</comment>


Music from the Fibonacci Sequence [video] - <AUTHOR> https://www.youtube.com/watch?v=IGJeGOw8TzQ&feature=youtu.be <comment><USER2> This is awesome! Thank you!</comment>


Pure CSS / SCSS Colored Tooltips - <AUTHOR> http://codepen.io/decorator/pen/pvMwrL <comment><USER2> when I see "code" inside CSS that really turns me off (try to argue that "if" statements aren't code)

by the way, most every diy tooltip I've seen that uses triangles doesn't test said triangles on displays with large fonts and misses the white gap between the triangle and the box - you have to nudge it with -1px for visual consistency

<comment><USER3> Don't have a clue what you're talking about? BTW no one uses IE any more, -1px that's a IE related issue and most of the tips have that issue, look at the bootstrap tips you'll see the same thing. "Triangles" I haven't seen anywhere that it says triangles with large fonts!? However, if you think you can approve it it's codepen, fork it and approve it. ;) If you talk the talk, walk the walk.

<comment><USER4> Ok if "No one uses IE" means "Has 50% market share"

<comment><USER3> In what world is 6.3 % == 50% market share!? [http://www.w3schools.com/browsers/browsers_stats.asp](http://www.w3schools.com/browsers/browsers_stats.asp)

<comment><USER4> Depends upon where you measure it. Extremely modal. I think the general public uses whatever they find lying around. But geek sites see everyone installing something else.</comment></comment></comment></comment></comment>