Why would Google not pay as little tax as possible? - <AUTHOR> http://eu.techcrunch.com/2009/12/21/why-would-google-not-pay-as-little-tax-as-possible/

<comment><USER3> Well, if Google paid tax in the European country where they have the largest presence, they would pay it in ... Ireland. Just like they do now.

</comment><comment><USER4> _"And yet the UK press and politicians, yesterday and today, have been up in arms that Google's theoretical UK tax bill could have built hospitals and purchased helicopters for troops in Afganistan."_

Theoretically, they could. But in the current economic situation they would more likely be spent on cash infusions or EU transfer payments to keep the Irish economy from collapsing. So, in the end, it doesn't make that much of a difference.

<comment><USER5> In some respects, the Irish economy is collapsing anyway. It would arguably be worse without the presence of multinationals attracted by the low corporation tax, but the sad fact is that having a multinational in your country doesn't necessarily mean all the best jobs they have to offer are going to be available to the workforce. In some cases they'll just up and go somewhere else when it becomes more economically attractive, as Dell did.

Being Irish myself, I have very mixed feelings about the country's corporate tax policy. It looked terribly smart a few years ago, but so did a lot of other fiscal and economic policies that seem pretty foolish in hindsight. The low-tax regime has come at the expense of higher and higher rates of personal income tax coupled with crippling unemployment.

<comment><USER6> This is why Ireland has always voted against EU expansion. It doesn't want to see all the money go to Eastern Europe.

It's funny, driving around Western Ireland, say Dingle, there are immaculate roads with EU flags on the signposts, then the money runs out and it's abruptly back to the crumbling ashphalt there was before (which is normal considering how sparsely populated and lightly traficked the area is... It just doesn't make economic sense to plough a lot of money into the roads there).

</comment></comment></comment><comment><USER7> When I learned of Nash Equilibriums, it changed the way I saw a variety of fields - government, business, advertising, and so on.

<http://en.wikipedia.org/wiki/Nash_equilibrium>

> In game theory, Nash equilibrium (named after John Forbes Nash, who proposed > it) is a solution concept of a game involving two or more players, in which > each player is assumed to know the equilibrium strategies of the other > players, and no player has anything to gain by changing only his or her own > strategy unilaterally.

It's fascinating stuff. Nash equilibriums are regarded as "stable" - no one will change what they do. Things tend to trend towards Nash Equilibriums and settle there until there's new technology.

Government legislation, including higher taxes, frequently breaks equilibrium. The new best solution for large players might be to divert earnings or leave the area they were doing business. Frequently, this results in the legislators getting angry and legislating more solutions.

One that immediately springs to mind is North Carolina and Amazon. North Carolina legislators were annoyed that Amazon customers in NC didn't pay sales tax because Amazon didn't have a presence there. They passed a law that made it so Amazon having affiliates there would count as them having a business presence, so Amazon would have to start charging their NC customers sales tax and remitting it to the NC government.

Amazon responded by canceling NC affiliates. This was the start of that email:

> We regret to inform you that the North Carolina state legislature (the > General Assembly) appears ready to enact an unconstitutional tax collection > scheme that would leave Amazon.com little choice but to end its > relationships with North Carolina-based Associates. You are receiving this > e-mail because our records indicate that you are an Amazon Associate and > resident of North Carolina.

Now, that obviously wasn't an NC legislator's intention. But it turned out to be the new stable best solution for Amazon. They must've done some math and decided that not charging sales tax in NC is important than letting affiliates with a NC address continue to participate in earning referral fees.

Too often legislators think people will accept their legislation and things will go according to their planned scenario. They don't stop and think, "How does this change people's incentives? What nasty secondary effects could come from this?" When the nasty secondary effects come, they either try to shame the organization in line (which doesn't usually work), or they pass even harsher legislation. You can see where this leads - it's not pleasant. Disrupt Nash equilibriums if you must, but do it with your eyes open that there could be some really nasty secondary effects to the process.

<comment><USER8> Surely that works both ways? If the government isn't aware that companies are using a loophole to avoid tax or more companies start using loopholes to avoid tax then it isn't a Nash equilibrium either and the government will be pressured to react by introducing new legislation to remove that loophole.

I think by ignoring this and focusing solely on the legislators, you are exposing your biases.

<comment><USER7> > ...government will be pressured to react by introducing new legislation to > remove that loophole.

That's the point right there - doing that would create more secondary effects. Let's say England says that if you have employees there, and make large profits, you have to pay high taxes.

The reason I focus on legislators is because they tend to be ignorant of secondary effects. Let's say they want Google to pay more taxes and want "close the loophole" as you say - how do they do that? There's law, they can't just write a letter to Google demanding taxes. So what will the law read? "The Fair Tax Burden in Cyberspace Act of 2010" - how would that theoretically read?

Well, maybe the first draft says that if you have staff in England over a certain amount, you have to claim corporate taxes there.

Well, maybe Google does the math, and decides it's not worth - and and lays off or transfers its English staff.

So a legislator gets furious, and writes the, "Anti-Cyber Laundering Protection Act of 2011", which mandates that if a website collects revenue from a country, it has to pay taxes, or the website is banned.

Do you see how this goes downhill really fast? Legislators don't consider that the actions they take won't always produce the results they want, and almost always have secondary consequences. Maybe this is much ado about nothing, but we could get another one of those scenarios here.

I will admit a bias though - I think Google does a better job providing for humanity and the people of England than the English government. And I say that despite the fact that I think the English government is one of the more sane and better run governments in the world - Google just does an absolutely incredibly job, they've produced far more amazing stuff in a shorter period of time than just about any government organization.

So yes, I have a bit of a bias in favor of great companies keeping their revenues instead of giving them over to bureaucracies, but that's not even the crux of this here. The crux is that by legislating, you create secondary effects, many of which are not positive, and the world would be better if legislators paid attention to that and thought things through more clearly.

<comment><USER8> I understand you completely, but you're trying to abuse game theory combined with a bunch of conjecture of what would happen to justify your pre-existing opinion where it's simply not applicable. This has nothing to do with Nash's Equilibrium at all.

Let's say a legislator writes a tax law, Google use a loophole to pay very little tax and enter the market, so the legislators amend the law to close the loophole, and Google leave the market.

Now, the way you tell the story, it's the legislators' fault for the secondary effect of amending the law causing Google to leave.

But equally, you could take the view that Google should have never entered the market relying on a tax loophole which was never supposed to be there in the first place that lawmakers were unaware of. This is especially so if legislators have external pressures since they are losing tax income from other businesses through this loophole, and that it's unfair on those businesses who aren't using it. It was Google who changed any equilibrium by using the loophole.

You can espouse the benefits of low taxation and the evils of legislators and bureaucracies and the laws of unintended consequences therein, but I don't see how game theory works in your favour in that argument.

For what it's worth, personally. I think taxation is a careful balance between maximising revenue and encouraging business and work, but this is increasingly difficult to balance with the existence of free trade agreements and the existence a global market. But whatever you think about tax policy, we should be able to agree that tax loopholes have no place in that equation, and that tax policy shouldn't be implemented via the backdoor with the benefits only available to large corporations with sufficiently clever accountants.

N.B. England doesn't have a government - it's the UK Government.

<comment><USER7> I'm thoroughly enjoying this discussion, because it's forcing me to challenge my assumptions and think things through. Before I respond, let me clarify - there's general game theory which I'll mention, and there's my opinions on governance, and I try to keep them largely separate. Your comment mixes your thoughts on both a little bit, but I'm happy to weigh in on both topics. I'll try to note which I'm weighing in on - I mention this because game theory type analysis is less subjective than figuring out what "good governance" is, which is a lot more open to opinion and interpretation. But I enjoy both topics and am happy to weigh in on both.

> Now, the way you tell the story, it's the legislators' fault for the > secondary effect of amending the law causing Google to leave.

I try not to make moral judgments when pointing out consequences - I wouldn't call it "fault", so much as simply saying it happens. I find words like fault/blame, fair/unfair, good/bad, good/evil, and so on cloud a discussion. I'm more interested in finding out what's going to happen in a given scenario first, and then once we have all the data, then come to a decision. So I wouldn't say it's a legislator's "fault", I would simply say it's an unintended consequence of their actions.

> But equally, you could take the view that Google should have never entered > the market relying on a tax loophole which was never supposed to be there in > the first place that lawmakers were unaware of.

Whoa, whoa, whoa - reread and think that through. You want private citizens and organizations to guess what the laws are supposed to read like and act accordingly? You want them to guess what lawmakers were aware of in the laws they wrote? Wow.

> It was Google who changed any equilibrium by using the loophole.

What if they had no operations in Europe? They certainly don't need operations on the ground in Europe. So if they had no ops and no business presence, there's no basis for taxation. What next? Block them at the ISP level China- style unless they pay taxes? And so on.

> You can espouse the benefits of low taxation and the evils of legislators > and bureaucracies and the laws of unintended consequences therein, but I > don't see how game theory works in your favour in that argument.

I'm a huge devotee to the "Never ascribe to malice what can be explained by incompetence" school of thought. I don't think legislators and bureaucracies are evil, trying to drive business out of their countries and hurt people. No, I think they're well-meaning but clumsy.

As for game theory, it handles situations of competition and cooperation - <USER2> covers government/business interactions decently. John Forbes Nash actually won the Nobel Prize for economics by using these ideas in market economics. So I'm both not slinging mud at governments using game theory, yet noting that game theory is very applicable for slinging mud at governments if you so choose ;)

> I think taxation is a careful balance between maximising revenue and > encouraging business and work, but this is increasingly difficult to balance > with the existence of free trade agreements and the existence a global > market. But whatever you think about tax policy, we should be able to agree > that tax loopholes have no place in that equation, and that tax policy > shouldn't be implemented via the backdoor with the benefits only available > to large corporations with sufficiently clever accountants.

I _completely_ disagree. I think it's _awesome_ that governments are being forced to compete with each other for citizens and industry. I think a lot of old world government assumptions are going to fall apart when governments are forced to compete, and we're going to be left with a much better world. But now we're totally straying from game theory and getting into governance.

> N.B. England doesn't have a government - it's the UK Government.

Cheers for that - Clumsy American that I am, I slightly tweaked a few Englishmen by calling them "British" instead of "English" when I spent time in London, so I probably go a little too far in calling everything "English" now just to be on the safe side. For anyone that knows, what's the appropriate adjective for the UK government? British government? Or would you just say UK government every time? Cheers for pointing that out, and thanks for the discussion.

<comment><USER9> > Whoa, whoa, whoa - reread and think that through. You want private citizens > and organizations to guess what the laws are supposed to read like and act > accordingly? You want them to guess what lawmakers were aware of in the laws > they wrote? Wow.

This is commonly referred to as the "spirit" of the law and would seem to me to be an integral part of "Common Law" systems where the "spirit" may often be clarified by the building up of case law. <http://en.wikipedia.org/wiki/Letter_and_spirit_of_the_law>

</comment></comment></comment></comment></comment></comment><comment><USER10> The Economist is up in arms with the new Britain "let's tax the rich too" , for instance -out of many articles- [http://www.economist.com/opinion/displaystory.cfm?story_id=1...](http://www.economist.com/opinion/displaystory.cfm?story_id=15127107)

<comment><USER11> The rich should be taxed. After all, when the top 20% are taking over 80% of the money, they should be paying 80% of any nation's taxes too. If they're not, the system is unfairly biased to keeping the rich rich.

If you can pay $1 million in income tax in a single year, I figure you're doing fucking amazing out of life and it's where any entrepreneur should want to be in life.

<comment><USER12> "when the top 20% are taking over 80% of the money" Who exactly are the rich "taking" money from in general? Creating wealth is not a zero-sum game. If you insert the word "earning" in the above phrase, the argument you present loses some luster.

<comment><USER13> If I "earn" a dollar, where did that dollar come from?

If my company paid me, they are poorer by $1.

If the government paid me, the aggregate citizenry is poorer by $1.

If the government printed it, the total value of US dollars in circulation has decreased by $1.

Technically, activities like mining precious metals or gems could count as creating wealth, but obviously basing an economy on an arbitrarily-priced material as silver or gold is a bad idea. Anybody who believes gold isn't a fiat currency is mad.

The most successful way that governments seem to have found to tax the wealthy is inflation, which is a "tax" on liquid currency. But there's ways for the wealthy to avoid inflation which aren't available to the working class, such as buying various foreign currencies. A direct tax, rather than "stealth" taxes, is a healthier and more sustainable choice.

<comment><USER14> I'm sorry but this is terribly thoughtless. When you are given something the giver may be impoverished (ignoring any pleasure they get from giving) but when you provide a service or sell something both sides are happy. One receives the money they want more than the good/service and the other receives the good/service they want more than the money. Both are enriched. Without understanding this miracle you cannot understand many things about the world. This is why we don't still live in caves and spend all our time gathering food.

Gold is not wealth. It is only because it can be exchanged for a good or service that can be consumed that it has any value.

</comment></comment></comment></comment></comment><comment><USER15> International tax law begs to be hacked. It doesn't feel very rational due to the conflict of national interests.

<comment><USER16> I don't understand what you mean by this. There is no "international tax law", just national tax law. Britain's tax law happens to allow exactly what Google is doing.

The EU does have something that might be described as international tax law, but it's really EU tax law, where the EU is something very similar to a federalist nation.

<comment><USER9> It was clear to me. He means laws regarding tax issues that cross national boundaries, for example "transfer pricing". He is saying that it is easy to exploit such laws. (Whether it is intentionally easy or not)

<comment><USER15> Thanks for the clarification crc32 while I was away</comment></comment></comment></comment>


How Exercise May Help the Memory Grow Stronger - <AUTHOR> https://www.nytimes.com/2018/02/21/well/move/how-exercise-may-help-the-memory-grow-stronger.html <comment><USER2> For anyone here interested I can't recommend [https://stronglifts.com](https://stronglifts.com) enough. I sleep much better since starting it (and wake up feeling great rather than groggy) and there is loads of information on how to get started lifting weights. It's all free apart from some extra features on the app which is a £9.99 one off fee. My mind is much clearer and it's very quick to do... it's _much_ more enjoyable than dragging myself around the park.

<comment><USER3> I've noticed that "lifting weight" seems to be the most popular physical activity on HN. I wonder if this is an American bias.

I can see the appeal and the convenience but I personally dislike gyms. Loud music, A/C, TVs everywhere, little social interaction etc... and lifting weight is very artificial.

I much prefer practicing sport outside and/or with other people. There are a lot of fun sports, such as boxing, climbing, hiking, swimming, running, martial arts, dancing, skiing... I see a lot of people who want to start exercising going straight to a gym because they are unaware of other options.

<comment><USER4> > lifting weight is very artificial.

Please explain

Have you tried group classes?

A lot of the activity that you mentioned can be done in a gym but at the same time I would like to say there is no match to being outdoor. Short on time then hit a gym otherwise outdoors are worth it.

Weight lifting also makes you stronger and less prone to injuries.

<comment><USER5> One thing to make clear here (which I think you intend but don't make explicit) is the difference between free weights and machines. Lifting free weights engages large groups of muscles and their coordination in balance and stabilization through the movements, which contributes greatly to injury prevention. Machines tend to isolate muscles and provide stabilization and restriction, so you don't get these benefits.

<comment><USER4> Agree. Working out with machines is similar to sitting on a chair :-). For newbies, machines are great to improve their form

<comment><USER5> > _" For newbies, machines are great to improve their form"_

Well, there we _do_ disagree ;) The activation patterns which are crucial to balance and stabilization don't get developed when using machines, and you can build up muscles much more quickly than connective tissue (tendons and ligaments). It's all too easy to into a situation where you're strong enough to lift weight that you can't stabilize under stress, and that's when injury is likely to occur. Weak tendons and ligaments coupled with poor stabilization activation patterns is a recipe for injuries. Better to start off with lighter free weight and good form for long term health and strength.

I don't have it at hand, but I recall a trainer encouraging a progression that went along the lines of "Form, then Speed, then Weight". If this jogs anyone's memory and has a reference (perhaps with a correction or expansion), I'd appreciate it.

</comment></comment></comment></comment></comment></comment><comment><USER6> If you're the type to not want to go to the gym (anxiety, or it's too far), I've had immense benefits from cycling, both indoors and outdoors. I can think more clearly about programming when I'm chilling on the bike, so many ideas and bug fixes have come while just pedalling along.

<comment> Z-Widwil Do you have any recommendations for indoor bikes/trainer that you've used?

I agree that it is extremely beneficial. Though my cycling is only done to and from work. I've thought about getting a cycling machine with a reading/laptop platform for indoor use, but it's hard to identify what I'm actually looking for since they're a bit different from bikes and I've never used one.

<comment><USER7> Instead of spending lot of money on cycling machine, look for "Magnet Steel Bike Bicycle Indoor Exercise Trainer" on amazon. Decent stand to use your bike indoors for $50-$60

<comment> Z-Widwil Thanks for the recommendation. I've looked at trainers like that and some look solid. I might just have to go for one. It's just hard to gauge quality versus something like a Kickr Snap.

</comment></comment></comment></comment><comment><USER8> Nytimes article title: >Memory Grow Stronger

Actual study: >mitigates the negative consequences of chronic stress

This is like saying that not pooping makes you gain weight, when the study is on how much you eat affects the weight of your poop.

Noncongruent.

<comment><USER9> Not really. The abstract of the study specifically lists improved memory as one of the effects the mice experienced. There are obviously lots of caveats you could list (e.g. it's only shown to help mice with chronic stress, not people or even mice in general), but it doesn't seem incongruous the way you're describing.

</comment></comment><comment><USER10> This article should probably be titled "Exercise may prevent memory degradation under stressful conditions". The study, as reported, doesn't imply that exercising improves memory, only that it cushions you against stress which might make you forget things (or cause you difficulty to store things in the first place).

<comment><USER11> There's also some evidence [1] that exercise promotes hippocampus neurogenesis in adults, which could improve your memory in more permanent way, not just remedying stress effects.

[1] [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5281566/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5281566/)

</comment></comment><comment><USER12> In Sweden Anders Hansen, a well known psychiatrist and researcher, is pushing for people to exercise to improve all parts of well-being.

One introduction to his work in english is the TEDxUmeå talk below.

Why the Brain is Built for Movement | Anders Hansen | TEDxUmeå [https://youtu.be/a9p3Z7L0f0U](https://youtu.be/a9p3Z7L0f0U)

</comment><comment><USER13> Mind body connection is real, who knew.

</comment><comment><USER14> (in healthy, male mice)

</comment><comment><USER15> Not sure about others but I have noticed increase in the number of articles published on nytimes.com on the front page on HN. And because I am not a paid user for them, I hardly get to read these articles(it seems they have limit of free articles/month).

Just curious, as these articles are on the front page(one nytimes article almost every day), most of the HN community pay for their subscription? Or there is something else going on e.g. voting ring with paid subscription to promote and increase their sign up rates?

<comment><USER16> I think they just tend to be well written and well researched, so people upvote them. That being said, if you want to get around the paywall, just open the link in a private browsing window.

<comment><USER17> Or, you know, subscribe.

<comment><USER18> Why would you pay for what is essentially sophisticated blog spam? The quality of 95% their 'journalism' is abysmal.

<comment><USER19> I keep seeing comments like this about NYT and I truly don't understand where they're coming from. And I don't mean that in a dismissive way, I'm genuinely curious. Yes, the Economist and the New Yorker often have better writing, but their authors also have far laxer deadlines. What is the better alternative to the journalism of the likes of NYT that I am apparently missing? (I'm referring to English-language dailies here, but it doesn't have to be US based).

<comment><USER20> There is only so much trump news one can read.

> What is the better alternative to the journalism of the likes of NYT

I think HN is a good alternative to any online news site.</comment></comment></comment></comment></comment></comment>


Almost Every Kind of Wild Fish Is Infected with Worms (2016) - <AUTHOR> https://munchies.vice.com/en_us/article/almost-every-kind-of-wild-fish-is-infected-with-worms <comment><USER2> As with almost all Vice articles, this is heavy on the ick factor, light on useful information. This "journalist"'s only source was someone who literally just sold infected fish.

Most parasites in fish can't adapt to humans, most can be safely digested, and commercially frozen fish will only have dead ones. So sushi or cooked dishes made from commercially frozen fish is basically fine. Worst case: a dead animal is in your food, which is already a dead animal. Less than 40 cases of humans infected with fish parasites are found in the USA each year. Wild freshwater and semi-freshwater (like Salmon) are the most likely infected fish.

If you find wriggly worms in your take-out, you can actually remove the worms (yes, even if they are alive) and then cook the fish to an internal temperature of 145F for 15 seconds, and everything (larva + remaining worms) will be either dead or safe enough to eat. However, if this is takeout, and the worms are alive, you probably already ate live worms/parasites.

It's funny that Vice didn't even include the really gross parts. Some people report feeling a tingling sensation when they eat raw or undercooked fish. This is the worms moving around. Often you can remove the worms from your mouth or esophagus, or vomit, to prevent infection.

<comment><USER3> The ick factor is really turning me off of fish and I love fish.

It might be safe but something about worms and parasites gives me the creeps. On top of that, it seems that many times the fish you order might not be the fish you receive _. For someone that cares, I 'm starting to find it confusing to keep up with what fish I want to avoid, and whether I should seek fresh or farmed, frozen, etc...

_[http://sanfrancisco.cbslocal.com/2017/04/27/testing-shows- ma...](http://sanfrancisco.cbslocal.com/2017/04/27/testing-shows-many-bay- area-restaurants-mislabeling-fish/)

<comment><USER2> Refer to the Monterey Bay Aqauarium's Consumer Guides for the most ecologically responsible choices of fish. From those, cross reference with a list of "healthy fish" such as [https://www.rodalesorganiclife.com/food/healthy- fish](https://www.rodalesorganiclife.com/food/healthy-fish) . As for "honest labeling", I just don't pay lots of money for fish. Culinary skill is more likely to make it taste great than exotic variety.

I think you really shouldn't consider it so much, though. A lot of work is put into minimizing how "unsightly" our food is and it results in a lot of waste. Fruit and veggies have more parasites than fish, for example, and consumer- facing fish gets a lot of prep work before you ever get to see it.

</comment></comment></comment><comment><USER4> > Still, this may be an issue that's more about squeamishness than safety. Of > the 20,000 cases of nematode infection from eating fish reported globally, > over 90 percent of them are in Japan.

Unless you're susceptible to infection this is really about perception rather than health risks.

</comment><comment><USER5> 60 cases a year in the US, out of (quick Google) "In 2009 Americans consumed a total of 4.8 billion pounds of seafood." Sweet Mary!

This is like the viral report of the kid who overdosed on caffeine a few weeks ago. And as someone said in the HN comments there: "this isn't a new silent killer."

</comment><comment><USER6> Similarly, almost all kale is infested with grubs or their eggs. Even if you triple wash it, it's almost impossible to get them all out of the nooks and crannies on the underside of the leaf. Look closely next time you buy some -- particularly organic.

Just like the dead fish parasites, though, it's not harmful.

<comment><USER7> humorously; google for "kale grub eggs" \-- and it returns nothing but recipes!

<comment><USER6> They look like this. I guess I should have said "aphids":

[https://www.bbbseed.com/blog%20images/Aphids%20Kale%20Judy%2...](https://www.bbbseed.com/blog%20images/Aphids%20Kale%20Judy%20Sedbrook.jpg)

</comment></comment></comment><comment><AUTHOR> > some wild species of fish—like hake, herring, and mackerel—had an infection > rate over 90 percent, but the study found no farmed fish to be infected with > nematodes..

Did not expect to see the rate this high.

<comment><USER8> Is true that farmed saltwater fish do not have Anisakidae nematodes _normally_ , because they aren't feed with live bait normally and the life cycle of _this_ nematode is not direct and can't be completed.

On the other hand, I will take the flashing 90% infection rate with a grain of salt, for some reasons.

First because this rate is not useful if we count together fishes with a 500 worms load, and fishes hosting one single tiny 1mm long worm.

Second, because infection rate is heavily seasonal.

Third, because parasite distribution is patched. If we speak of a single type of roundworm some stocks could be heavily affected, but most of them aren't.

Mixing saltwater with freshwater and speaking of all parasites together the percent should be closer to 100%.

</comment></comment><comment><USER8> Animals have parasites, welcome to the planet earth.

<comment><USER9> Even the parasites have parasites.

</comment></comment><comment><USER10> No shit. If you've ever gone deep sea fishing on the New England coast, and taken home some cod or pollock or haddock or hake filets, then when you skin them, you've doubtless noticed some litle round reddish worms under the flesh. You just pick them out with your filet knife when you clean the filet up.

</comment><comment><USER11> Worms and plastic in sea salt:

[https://arstechnica.com/science/2017/05/sullied-seasoning- se...](https://arstechnica.com/science/2017/05/sullied-seasoning-seas-salts- come-with-a-dash-of-microplastics/)

A Kale sandwich (with a few grubs) is looking kinda good.

</comment><comment><USER12> Wow. You're supposed to cook fish at 130F? That's 54C! You could practically achieve that by leaving it on the dashboard of a parked car in summer. Not only won't it kill worms but it won't kill bacteria either. I would call it raw fish at that temperature.

<comment><USER13> According to the USDA, not only won't it kill bacteria, it'll incubate them. Anything less that 140F is in the "danger zone" for rapid bacterial growth and food poisoning, and recommend a cooking temp of 145F for fish.

I initially suspected some Celsius-Fahrenheit confusion, but other sources corroborate these temperatures. Color me perplexed.

For what it's worth, I had fish last night. Cooked it 20 minutes at 180C. Was not shrunken or dry. Guess I'm doing it wrong?

<comment><USER2> If your fish was commercially frozen, you don't need to cook it at all, much less to that high a degree. And if you thaw, prepare and serve it properly, potentially harmful bacterial growth is minimal and safe. The FDA even has guidelines to follow in the preparation of sushi which results in a fairly safe dish.

In one study it was shown that refrigerated or frozen sushi had less aerobic mesophilic bacteria than freshly prepared sushi, and that the preparation varies between restaurants/chefs. But more people get bacterial infections from produce and rice than from fish.

On the culinary side of things, it can be easy to overcook certain fish, and other fish are much more lenient. Some of the most delicious tasting fish should be served raw or in-between raw and fully cooked. This way both delicate flavors and firm tissues don't break down completely.

For a typical salmon steak, 145C for 20 minutes is about right. The idea is to get it up to temperature, then remove it and cover it and let the residual heat keep cooking the fish for 10 minutes, allowing juices to settle back in (much like other meats). Alternately you can cook at a higher temperature for shorter time and apply a sear after. But in general, once the meat turns opaque all the way through, it's at the perfect state just a couple minutes later.

</comment></comment></comment><comment><USER14> So why in US you can't buy anthelmintic drugs over the counter, without prescription. Or can you?

</comment><comment><USER15> Eh.

</comment><comment><USER16>
       This challenges the conventional foodie wisdom that wild
       is good and farmed is bad. But the science is clear, and
       food regulators recognize this. Both the Food and Drug
       Administration's recommendations and Oregon's food
       regulations allow an exception for eating raw, never-
       frozen farmed fish. In other words, it says that all raw
       fish served in restaurants must be previosly frozen
       unless aquacultured.

So.... what's the problem, exactly? If the fish came from a farm, it's (apparently, according to the article) safe.

Mindlessly downvoting is not a valid answer.

</comment><comment><USER17> Not the main part of the article but why would anyone go to a Sushi restaurant if the owner isn't Japanese? Especially if they don't eat the food they serve?

"I talked to Ryan Roadhouse, chef-owner of the lauded Japanese restaurant Nodoguro and former sushi chef at Masu, about the incident with the worms. "My wife isn't from the United States," he said. "She's from Russia. The only way they trust fish, even frozen, is [if it's] salt-cured.""

<comment><USER18> Because being Japanese doesn't bestow any magical ability to make sushi well.</comment></comment>


Ask HN: What sites have a list of programming interview questions? - <AUTHOR>

I saw a few over my years of lurking, but now I can't find them again. <comment><USER2> <http://geeksforgeeks.org/> <http://codeeval.com/>

</comment><comment><USER3> <http://www.interviewstreet.com>

</comment><comment><USER4> www.careercup.com, www.glassdoor.com.</comment>


Show HN: CLI minesweeper - <AUTHOR> https://noazark.github.io/minesweeper/ <comment><AUTHOR> Hey y'all! OP here, this is a nifty little minesweeper game where the user has to use a CLI to play the game. Source code can be found here: [https://github.com/noazark/minesweeper/tree/master/src](https://github.com/noazark/minesweeper/tree/master/src)

Let me know if you have any questions!</comment>


The Failures of "Intro to TDD" - <AUTHOR> http://blog.testdouble.com/posts/2014-01-25-the-failures-of-intro-to-tdd.html <comment><USER2> Totally agree about the dissonance with TDD and it always surprised me it wasn't discussed more when TDD was going through the hard sell stage.

I guess my core problem is TDD only drives your design if you write quite granular tests but they then become barriers to further refactoring/redesign. However my current preferred approach (for anything non-trivial) is different to the authors. As he does I start out with outer-level acceptance-y tests, however those integration tests are then combined with extensive refactoring to drive the design, so I don't do the dreaming up of collaborators he does in step 4.

My reason for not thinking of collaborators early is although I think that approach has legs I found it didn't necessarily always the simplest/most elegant design you could come up with. I ended up encoding my first understanding of how to solve the problem into the interactions, even though I knew that my understanding of the problem at that point was much less than it would be once I dug a bit deeper.

Anyway with my current approach if I extract additional classes/whatever I might then test them directly, or use further tests to drive their design further (incl test doubles as appropriate). So I'll have one or a few tests of the extracted behavior at the outer level, and maybe more thorough testing at the lower level because quite often testing all the combinations and edge cases is easier at this level.

</comment><comment><USER3> I've found the authors proposed approach at the end of the article to be a very useful one, even if you're not using TDD. A very regular piece of advice I give to new developers is "breadth-first not depth-first" \- i.e. write a whole function at a consistent level of abstraction before you dive into writing the other classes etc. you need to support those few lines of high level code.

I find that most new developers instinct is to do exactly the opposite - i.e. write the first line of their main function, then realise it needs, say, an argument-parsing class, so start writing that, then realise that needs a logging class, so start writing that, etc. which means you have to keep much more stuff in your head at once, you end up writing much more code in each commit than you should, and the distinction between bits of code at different levels of abstraction often ends up much blurrier which leads to messier design.

This seems to be quite easily countered though - just pointing out to people the difference between breadth-first and depth-first styles can have quite an immediate effect

<comment><USER4> Is "top down" vs. "bottom up" programming/design really not a set of terms and concepts that is still taught in nearly every introductory programming course such that people mentoring "new developers" need to introduce the concepts and invent new terminology for them?

<comment><USER5> It definitely is. The problem, I think, is that people forget these fundamental concepts when they're shoved into a giant legacy code base that clearly didn't follow that process. They seem to get overwhelmed by the spaghetti and forget their entire undergrad curriculum.

As a side note, I find it helpful to think of what the high level business objects will be at the beginning, but build a bunch of utility functions from the bottom up, working towards a DSL of sorts at the various abstraction levels. As you explore the solution, the end location of those functions usually becomes abundantly clear.

<comment><USER2> > As a side note, I find it helpful to think of what the high level business > objects will be at the beginning, but build a bunch of utility functions > from the bottom up

Yeah I think this is a reasonable approach, especially as if you do end up completing this, and get to a design you are happy with, it will probably be very different (and hopefully infinitely superior) to your original high level design.

You've probably already heard of it but the mikado method can also be useful in some of these situations.

<comment><USER5> I had not heard of this before. I will have to investigate. I found an InfoQ[0] talk on it that I will watch after work.

[0] [http://www.infoq.com/interviews/mikado-method- restrurcture-s...](http://www.infoq.com/interviews/mikado-method-restrurcture- software-ola-ellnstam)

</comment></comment></comment></comment></comment><comment><USER6> This article sums up the problems I've seen with TDD first hand. I've never seen a team end up with a better design than they would have using the old maxim: "Think hard. Then code.". I'm sure they exist, but adopting TDD does not automatically lead to better design, that much seems certain.

Another issue with TDD is that it is incredibly difficult to reason about. In many groups, there are at least one developer sold on the concept, and when I voice my concerns with the methodology they immediately demand an explanation why I "hate testing", or alternatively preach about all the goodness of unit testing. Which of course isn't the issue at all. Many developers seem to confuse TDD and unit tests, and the supposed benefits of the former is very hard to quantify.

<comment><USER7> TDD is hard. You need to work up a skill, and you probably need someone experienced to guide you at first.

<comment><USER8> Unfortunately, it stays hard no matter how much deliberate practice you sink into it. I didn't understand what DHH was saying about design damage inflicted by testing until I started seriously confronting questions like "which parts of this API should I mock and which parts should I just use integration tests for?"

Eventually you spend more time thinking about testing than you do actually getting shit done. You have to because otherwise you find yourself rewriting tests every time you refactor. You rationalize this time under the guise of "it's making me think more clearly about my design." Once it starts wearing thin disillusionment takes root. The first step towards my own enlightenment was when I realized that I needed tests to help me ensure that my test framework was working. What's testing those tests? Tests are code, and code needs to be tested. Where does it end?

I wrote my own toy test framework as an exercise. I was trying to * really * wrap my head around meta-programming, so I meta-programmed my test suite to test the heavily meta-programmed data classes. It solidified into a grotesque mush and I scrapped the whole thing. Now I'm solving the original problem with boring old Rails and sanity has been restored.

Now when I start a project I do it knowing that my code is going to suck and I'm going to refactor it over time. The truth is, when there's no tests I only have to refactor one code base and not two. I don't need to learn two frameworks. I don't need to understand two domains. The amount of time I've spent maintaining code has sharply diminished after I stopped being so religious about testing. If I don't know what it's doing, the REPL is my best friend. Backtraces rule.

If your code is Serious Business, like, say, SQLite which is used everywhere, a robust test suite is a very nice tool to have and maintain. For everyone else, it's another step on the road to mastery.

Also if you're using a dangerously unsafe language like C, tests can alert you to brewing problems. If you're using a safe language solving not-so-hard problems, a test framework is just adding complexity to paper over your lack of experience.

</comment></comment></comment><comment><USER9> Methodologies aren't a substitute for creativity or intelligence.

At best they can give a person with good judgement a different angle to look at their problems with.

At worst they are thought-stopping slogans that turn a gullible novice into a crippled novice.

<comment><USER10> If only management understood this. Actually, I think good managers do understand this, and do it anyway, because if you take the general case and look at it from above, methodologies do improve upon chaos.

<comment><USER11> As a manager, the trick is to find the sweet spot between chaos and blind adherence to rules. The uncomfortable truth is that there isn't one sweet spot for all cases.

I've run teams where a very agile approach made sense (usually where the dev and users where small in number and very close) and others where a more formal phased approach made sense (usually where we need co-ordination across companies).

The simple fact is that trying to run these types of programme the same way is an exercise in futility. That's not to say that one can't extract common practices that make projects generally better e.g. it's generally preferable to get code into the wild sooner rather than later if you can do it safely, it's just that the "one true path" idea is a marketing concept not an engineering one.

</comment></comment></comment><comment><USER12> Hexagonal architettures combined with a command processing pipeline help in defining test boundaries and entry points. Those entry points are your public interfaces, everything beneath shouldn't need any test. The entirety of the core application behaviour is testable in isolation by design. You basically end up writing mini acceptance tests for your domain logic.

I think that's a preferable approach for complex systems, the "redundant tests" issue is not a problem and end to end tests are reduced to just a few proving everything is hooked up.

</comment><comment><USER13> His steps 4 through 6 seem to completely violate the principle of YAGNI. It also seems way too much like big-bang releasing. You write all this code for a very long time and don't have any way to objectively say the design is correct (in that it actually performs the business case from start to finish) until the very end.

I've designed systems in this way before (strangely, they always seem to be some sort of document validation), and they always turn into complete hairballs of code that eventually gets thrown away and something much simpler substituted.

Now, I just stick to DRY, YAGNI, and "Compression-Driven Development" [http://mollyrocket.com/casey/stream_0019.html](http://mollyrocket.com/casey/stream_0019.html)

<comment><USER14> That's why I thought this article was honestly the case against TDD. Because the upfront "this method has major problems" stuff rang very true, but then the "this is the correct way to do it" made me wince hard, with its Java-esque upfront complexity.

</comment></comment><comment><USER15> I wish I had time to write a decent post. Lacking time, I'll try to be concise. If you want to really understand the benefits of TDD, the best book I know on the subject is actually Michael Feathers, "Working Effectively with Legacy Code". It is rather dense and getting a bit dated, but by showing you what you need to do to improve legacy code in a methodical fashion, he provides the basis for learning how to do good TDD.

<comment><USER2> Its a good book but from my memory it doesn't really address solutions to whats being discussed in the post, and I'm presuming the author is familiar with the book because he discusses characterization tests.

</comment></comment><comment><USER16> I can't detect any difference between his proposed approach and Harlan Mills's Top Down System Development. Basically, he's going to take this 'traditional' team and introduce them to the hot new development methodology of 1970, all while showing no awareness that he has done so. What's that saying about people who don't understand history?

At least they won't have to change the acronym.

</comment><comment><USER17> BDD got it right. Write your tests to prove the features are working, not to prove that the code written to implement the features does what it does.

</comment><comment><USER18> I've found the way TDD has been "sold" to me as quite odd, and probably what's turned me off from it the most (cure of all ills). At the same time, I find the religious pushes for and against to be both understandable and bizarre. I've been thinking about this for some time now, but don't think I've ever really written it down.

As a very general statement, I'd say any developer should try their hardest covers the basic tenets of TDD while working. Let me back that up, since I'm sure that's probably rubbed people up the wrong way.

1\. I know what the system is currently doing

2\. I know what the system _should_ be doing

3\. These things are different, and I know how to check

4\. I change the system

5\. I check that the system is now doing what it should be doing

That all seems pretty uncontroversial, I hope.

1\. If you don't know what the system is doing now, you can't tell if there's anything to do at all.

2\. If you don't know what it should be doing, there's no way of implementing it.

3\. If you can't check that if it's doing the right thing (even manually) then you're fairly screwed (although we've all ended up in a case where the "check" is "ask the customer afterwards if it's fixed").

4\. You obviously need to actually do something to change the system.

5\. Finally you should check your work actually, well, works.

The idea that you have an automated check for 3 seems like a fairly good idea, as long as it's not too onerous. Then suggesting that it's implemented and run before 4 makes sense, it's unlikely to be much harder to do it before rather than afterwards and it gives me some confidence that the test checks what I think it does.

Personally, while I quite like the workflow presented, I'd do most of that on paper / whiteboard / in my head. Take the task and break it down into smaller things it needs to do. Don't rush into creating the right structure, just actually understand what it is this thing will need to do. Then I can consider general designs, where the edges will be, types of failures and errors that are likely to pop up and I can write something (as always, discovering more as it's written and having to change things). It's very useful to then start on the bits I'm less sure about, or the ones that will have the most impact if I have to change things. I think that gets easier the more you code though.

<comment><USER19> I agree this seems reasonable and sane.

However there are types of programs which aren't well covered by a test (demo) or set there of.

Sometimes the program is being written to learn a value which is unknown, or for which a simplified example having success insufficiently tests the validity or scalability of the software.

Tests in those cases may work at a unit level, but still provide insufficient insight in to the soundness of the overall results.

</comment></comment><comment><USER20> The tl;dr of this article - some programmers _really_ need to get exposed to a Systems Engineering course.

<comment><USER21> Here here to this. I never continue to be surprised by the number of people who don't realize that engineering is the practice of breaking big and confusing things into small things you understand.

<comment><USER22> It's "hear, hear."

</comment></comment></comment><comment><USER23> The article ends with a diagram showing a bunch of classes whose names end with "er". In my experience, that's usually a strong indicator of confusing design. Objects that have a single method and no real state should just be functions.

<comment><USER24> Conversely, objects should have a single responsibility [1] and so functions that are unrelated should go on different objects. An InvoiceFetcher is definitely unrelated to a PaymentApplier, unless one takes the argument that "Its about money", in which case you have to argue for a single giant class.

[1] [http://c2.com/cgi/wiki?PrinciplesOfObjectOrientedDesign](http://c2.com/cgi/wiki?PrinciplesOfObjectOrientedDesign)

<comment><USER23> I dunno, I always thought objects were about managing state. If an object does nothing except provide a method, why can't the method just be a free function instead?

        InvoiceFetcher.FetchInvoice()
        PaymentApplier.ApplyPayment()

just seems terrible.

<comment><USER24> Because Java. At least I can use an interface to define the function's specification, and then use that in mocks. On the one hand, it seems very different to what I learned about OOP twenty odd years ago, but on the other, it makes for extremely well designed and easy to understand code.

</comment></comment></comment></comment><comment><USER25> Any discussion about TDD requires a link to Rich Hickey's Hammock-Driven Development talk: [https://www.youtube.com/watch?v=f84n5oFoZBct](https://www.youtube.com/watch?v=f84n5oFoZBct)

The important thing that TDD or any other software design methodology is trying to accomplish is getting you to think about the design of your programs. However you want to accomplish that is fine as long as you take some time before you open your editor and think before you start writing code. It doesn't necessarily have to be TDD.

<comment><USER26> Funny thing.

I think that thinking about the design of my programs is easier once I have some amount of working code.

There's a minimum organization needed for starting to code, but every time I decide to think any further when solving a problem I'm not used to (optimally that would be always), I end up optimizing for the wrong problems and have to restructure it all later anyway.

<comment><USER25> That's a great point! I've certainly had times where spiking a bit of code and then thinking was valuable. There are no maxims in program design so I'm glad you took the time and _thought_ about that :)

</comment></comment></comment><comment><USER27> Here's a recent post I wrote about reasons for and approaches towards TDD. Generally, I love it. I find an API evolves though as you build it, so for me, it's a bit more about "tests at the same time" and "tests as the primary and first way of exercising the code". Also, that tests do better when they test use cases at a higher level, and that unit tests (I do agree with the article in some ways here) are often written at a level which penalizes refactoring, when they could be instead automated tests at a higher level.

[http://michaeldehaan.net/post/120522567217/the-case-for- test...](http://michaeldehaan.net/post/120522567217/the-case-for-test-driven- development)

</comment><comment><USER28> A better description of the audience you were teaching to would be super helpful, because how you teach needs to be tailored to the crowd. Making a generic statement like you will never start with TDD anymore doesn't make sense.

To be frank, when you said the audience was 'typical enterprise java developers', it seems that you are already describing a group of developers who are sort of 'stuck' in their ways, who maybe haven't heard of other things like TDD and WOULD necessarily miss the point of a lot of it.

Just sayin - it could be helpful to avoid broad statements like "never start with TDD" that may be more audience specific.

</comment><comment><USER29> This sounds a lot like "Think first, then code". I like the approach, and have more or less been applying it unknowingly since I read Martin Fowler's Agile book during Uni. Nice article!

</comment><comment><USER24> I've been doing TDD for nearly 10 years and this article describes my experience in a way I have not been able to distinguish myself. Thank you.

</comment><comment><USER30> I have just come onto a project that has tests up to the armpits, mocked everything, and the test lead wielding an almost evangelical bent across the developers. And the codebase and system is still shit. Why? Because the team though loads of tdd and bdd equals a great system. Wrong. They can help, when used sparingly, but to make them your design methodology, praying at the church of testing dogma is insane. So, no tests bad. Worse, over testing. When I see fourteen tests to one code unit, I know now to run away.

<comment><USER31> The real limitation in any system is this:

Can you make the code say what you mean?

TDD is just really efficient at demonstrating your inadequacy at achieving this goal. It's a really uncomfortable experience, and to get comfortable with that feeling takes a certain acceptance of the human condition that reads like something straight out of eastern philosophy.

Tl;dr to err is human. To really fuck up requires the aid of a machine.

<comment><USER30> A good point. I think the bigger learning exercise for this team in particular would be: do we need this test and why? To make them examine a bit more about what they are trying to achieve and not just succumb to testing by numbers. Ultimately, the large battery of tests passes, but when the system is still borked, the disconnect is great.</comment></comment></comment>


Maryland's Rain Tax - Droning it's way into your pocket - <AUTHOR> http://www.theblaze.com/stories/2013/04/11/heres-whats-included-in-marylands-controversial-rain-tax-its-exactly-what-it-sounds-like/

<comment><USER2> That's not a rain tax: that's a flood tax.

But a good example of framing the debate.</comment>


Leaked audio from Uber's all-hands - <AUTHOR> https://www.yahoo.com/amphtml/finance/news/inside-ubers-hands-meeting-travis-194232221.html <comment><USER2> At 6:40, Bonderman (a male board member) makes a sexist joke about women leading to "more talking" on boards [0]. Seems like the leadership team's cultural issues go beyond Travis.

[0] [https://twitter.com/SallyPancakes/status/874720682822828032](https://twitter.com/SallyPancakes/status/874720682822828032)

<comment><USER3> Why is it sexist to say there would be more talking if there was more than one women on board?

<comment><USER4> I think because it's insinuating women talk too much? I didn't listen though, so who knows how it was said</comment></comment></comment>


Learn Git one commit at a time - <AUTHOR> http://gitready.com/

<comment><USER2> Duplicate of a recent post (14 days ago).

<http://news.ycombinator.com/item?id=512421>

<comment><USER3> I hate dupes as much as you, but I missed this one the first time around, so I guess I should stop griping!

</comment></comment><comment><USER3> What a lovely little site, it's now in my top bookmarks. Every open source app needs a page like this.

</comment><comment><USER4> very pretty</comment>


Intel says it will build a fleet of 100 fully autonomous vehicles - <AUTHOR> https://www.theverge.com/platform/amp/2017/8/9/16119000/intel-mobileye-self-driving-cars-level-4 <comment><USER2> It is a bit funny how Intel always jumps onto _every single_ computing trend, and then never ever makes any money from these bets in the end.

How long has this been going on? At least since the mid 90s.</comment>


U.S. to Pursue Snowden After He Departs Hong Kong - <AUTHOR> http://online.wsj.com/article/SB10001424127887323683504578562852310273818.html?mod=e2tw

<comment><USER2> Doesn't seem particularly surprising, and afaict the article doesn't have any actual new information about the "pursuing" angle. Some U.S. officials are just confirming that the U.S. hasn't changed its mind about wanting to extradite him, which pretty much nobody expected it would.</comment>


DARPA: U.S. Geek Shortage Is National Security Risk - <AUTHOR> http://www.wired.com/dangerroom/2010/01/darpa-us-geek-shortage-is-a-national-security-risk/#ixzz0cjjwvDR5

<comment><USER2> >The Pentagon's far-out research arm Darpa is soliciting >proposals for initiatives that would attract teens to >careers in science, technology, engineering and math >(STEM), with an emphasis on computing.

_Teaching_ these subjects to teens would probably be a good start.

I'm being serious. The junk that is taught in most schools (and I'm Canadian: our education system is supposedly better than the US) and absurdly labeled these subjects is a huge part of the problem.

Math is taught like magic. Experiments have been banned from the science classroom. Computer science classes teach typing.

I'm exaggerating a little: math occasionally gets explanations, science may occasionally have a very simple experiment, computer science students may learn some programing. But those are the exception, not the rule.

It's utterly broken.

<comment><USER3> Complaining is easy, but how do we fix it? Alan Kay has some ideas: <http://vpri.org/html/work/tlpiese.htm>

In essence, he believes the power of computers is as a medium for experimentation. If you make it easy for kids to simulate models from axioms, they'll be able to think better. One might call that "programming", but it's really quite a bit more than what people do now.

<comment><USER4> _Complaining is easy, but how do we fix it?_

Um.. in this case fixing is also pretty easy.Just start with making a curriculum which is more inclined towards experimentation and research. Tell students to find things out by them selves instead of spoon feeding them. Tell them the syntax of the language and then keep lab _open_ (open as in anyone can come in and do programming) so that they can work on interesting things. And above all, GRADE them on these experiments. Start off with keeping them as extra credit and graduate that to making it a part of curriculum.

PS:May be one day I would have money and will open up something like "South Harmon Institute of Technology" from the movie "Accepted". Where mind is allowed to stroll freely in the depths of thoughts not drown in books and formulas.

<comment><USER3> Aren't you simplifying this just a little too much?

</comment></comment></comment></comment><comment><USER5> Maybe this has something to do with "National Security Risk"?

"Students were evacuated from Millennial Tech Magnet Middle School in the Chollas View neighborhood Friday afternoon after an 11-year-old student brought a personal science project that he had been making at home to school ..." [http://www.signonsandiego.com/news/2010/jan/15/students- evac...](http://www.signonsandiego.com/news/2010/jan/15/students-evacuated- school-chollas-view/)

Found via <http://news.ycombinator.com/item?id=1056904>

</comment><comment><USER6> If there's a geek shortage, why are there so many unemployed and underemployed geeks?

<comment><USER7> Because there's a difference between a geek and an employable geek.

There, I said it, it's not going to be a popular opinion, especially since I'm a Canadian expat in the USA "stealing your jerbs". I know _many_ others like me, who are being well above average rates to work in this country, whose very employment carries steep legal and bureaucratic overhead for our employers. Yet Canadians, Indians, Europeans, etc etc, are still being imported by the planeloads. I know for a fact that our HR department scours American schools for qualified graduates constantly, yet we can't fill spaces quick enough.

I've thought about this some, and my conclusion is that a lot of American geeks just don't work very hard - you have the people who hang out on Digg/Reddit all day. Yeah, they're geeks, but how many languages do they know? Can they build a site from back to front? Do they know their algorithms? People on HN need to realize that they're a vanishingly small minority of the set of all geeks, and that as a crew are in general much more ambitious and capable than most. There's a long way between "I like computers" and "I'm willing to pour ungodly amounts of time into learning computers". For every geek who takes the time to learn all the toolkits and languages to get employed, there are 500 others who couldn't be bothered, and will complain endlessly about undeserving foreigners stealing jobs rightfully theirs.

In other words, for every geek who knows Python inside and out, is up to date on all the latest web technologies, has experience building large scalable systems, etc etc... there are 500 others who can only write VB, and will endlessly complain that they're not employed, or that they're not being paid enough. Unfortunately no "geek employment" number will ever be able to separate the two.

<comment><USER8> "a lot of American geeks just don't work very hard"

Another perspective could be that (most) Americans who work hard don't become geeks, because the rewards aren't commensurate with other professions.

If you're interested in reading some support for this position, you might check out a recent RAND study that concluded that "cience and technology performance, but said the slow growth of U.S.-born technical workers "will change when the earnings and attractiveness of S&E (science and engineering) careers improve."

A summary is available here:

[http://www.usatoday.com/tech/science/2009-07-08-science- engi...](http://www.usatoday.com/tech/science/2009-07-08-science-engineer- jobs_N.htm)

The full RAND study is at:

<http://www.rand.org/pubs/issue_papers/IP241/>

</comment></comment></comment><comment><USER9> Does this mean that if we're ever in a shooting war, the military's first priority will be to get all the geeks out of harm's way?

</comment><comment><USER10> Hmm,

When I read this, it seemed like there was a disconnect between the out- sourcing trend and this desire for more computer geeks.

Interestingly, when I recently read BLS website on programmer jobs prospects, they projected a decrease. You can find a reference to this projection here: [http://education- portal.com/articles/Mastercam_Programmer_Jo...](http://education- portal.com/articles/Mastercam_Programmer_Job_Outlook_and_Info_About_Starting_a_Career_as_a_Mastercam_Programmer.html)

But now, the very recently updated BLS website paints a rosy picture.

<http://www.bls.gov/oco/ocos303.htm>

Woo, spooky. Maybe the BLS is listening to darpa at least... WTF!

<comment><USER10> Weird, reading more carefully, the BLS projects more software engineers but fewer programmers. Fooled me since personnel directors are the only people I've heard distinguish the two job types.

<comment><USER11> I think software engineers are generally jobs that require a B.S. Programmers might simply be someone with an A.S. or no college doing non-complex programming tasks. Much of this work is being outsourced.

<comment><USER9> I've heard the distinction as "software engineering is a creative profession, requiring professionals to exercise a large degree of judgment in building working systems from ambiguous requirements. Programmers take an existing spec and then translate that into code."

I'm not sure how useful this distinction is, as every job I've held had highly ambiguous requirements and a lot of trade-offs involved in building a working system from them. It kinda makes me wonder though - a colleague who'd been a PM at both Google and Microsoft said the difference was "Microsoft expects PMs to produce a spec that's thrown over the wall to engineers, who throw it back if there's any ambiguity. Google expects their engineers to have opinions about the product and to resolve most of the details themselves, only consulting the PM if there's something big where they need additional data." I wonder if Microsoft hires programmers and Google hires software engineers?

<comment><USER12> I've always hated this attempted separating of the roles of programmer and software engineer. You are taking people best suited to programming and giving them the job of creating a specification which is then given to lower paid code monkeys proficient in Java to churn it out.

I'd kind of cheapens the craft when people look at it in this way, my AI lecturer last year was describing the different roles in creating an AI system and saying that that the job you want is a knowledge engineer is the position you want and the programmer is just a nobody who translates it all into code.

<comment><USER9> I think that you don't often find _both_ software engineers and programmers in the same organization, if that organization subscribes to this distinction. Either you have _only_ software engineers, or you have programmers + software architects.

</comment></comment></comment></comment></comment></comment><comment><USER4> Correct me if I am wrong but dont they mean a computer science nerd rather than a geek? I mean geek is someone eccentric with a single minded approach to anything from comics to radios. But a nerd is a obsessive personality with a single minded approach towards his field.</comment>


Everything you ever wanted to know about terminals - <AUTHOR> http://xn--rpa.cc/essays/term <comment><USER3> Sorry, unfortunately hardcoding escape sequences still won't work.

The smcup this uses is the one for st and kitty, and it's not valid for xterm, iterm, konsole, vte (e.g. gnome-terminal),....

That means it's not just "obscure dumb terminals from 1983". It's the majority of your userbase!

Which means you _need_ some kind of authoritative database of escape sequences, and you need to query that instead of building the strings yourself. Whether that database is terminfo or something new to replace it is up for debate - there's room for improvement over both it and ncurses - <USER2> that makes most of this irrelevant.

<comment><USER4> Most of these escape sequences have been standardized for ages in ECMA 48 (1976), ANSI X3.64 (1979), and ISO/IEC 6429 (early 1980s?) [1].

According to [1], the code for smcup given in the article, ESC[?1049h, or 'Enable alternative screen buffer', is a 'popular private sequence' so I suppose it is not guaranteed to work everywhere. But most of the content in the original article is still valid.

[1] [https://en.wikipedia.org/wiki/ANSI_escape_code](https://en.wikipedia.org/wiki/ANSI_escape_code)

<comment><USER3> > But most of the content in the original article is still valid.

Well.. I mean sure, you can program the things this article says that way.

But my point is that once you move even slightly beyond basic color, like the alternative buffer, or e.g. input, hard-coding escapes is going to bite you.

That means that if you recommend that, you are doing a disservice to people who don't know better.

And that means that "most of the content", line-by-line wise, is valid. But the sentiment behind that, the idea that "terminfo is a fucking joke" is invalid.

I'm also disputing that all this juggling of weird strings is in any way less work than using ncurses, so why not just use curses and have it "all" work? (Except for the stuff that curses doesn't handle or is slow to incorporate - 24-bit color has "just" gotten in)

<comment><USER4> Well OK, but that Wikipedia article warns, "Many programs, including text editors such as vi and GNU Emacs, still use termcap or terminfo, or use libraries such as curses that use termcap or terminfo, and thus in theory support non-ANSI terminals, but this is so rarely tested nowadays that they are unlikely to work with those terminals."</comment></comment></comment></comment>


International Lisp Conference 2009 - <AUTHOR> http://www.international-lisp-conference.org/2009/index

<comment><USER2> This one looks really important for webapps: " Unification of Geospatial Reasoning, Temporal Logic, and Social Network Analysis in Event-Based Systems, Jans Aasman and Gary King" I just saw a webinar on this using AllegoGraph - amazing power. I'd love to go, but I don't know if my schedule supports it yet.

</comment><comment><AUTHOR> Is anyone from HN going?

<comment><USER3> I am. I understand that they should have registration open by February.

</comment></comment><comment><USER4> I'm going and looking forward to meeting everyone who's worked on SBCL there. What an excellent system!</comment>


DNS over HTTPS - <AUTHOR> https://github.com/curl/curl/wiki/DNS-over-HTTPS <comment><USER2> > for privacy, performance and security.

I understand the privacy and security aspects. But I am wondering - how can DNS over HTTPS be more performant in the case of curl commands? A browser could probably persist the connection to the resolver and issue several requests together, but with a single curl command surely there's the overhead of initiating the first DNS resolve, the HTTPS connection, the second DNS resolve. There must be some delay compared to regular DNS.

Side note - I just learned that performant is not a recognized word ([https://english.stackexchange.com/questions/38945/what-is- wr...](https://english.stackexchange.com/questions/38945/what-is-wrong-with- the-word-performant))

<comment><USER3> "Performant" is a word in German. It translates to exact what "perfomant" would mean in english if it were an english word. The funny thing is, google translate, translates the german word "performant" to the english word "performant". [https://translate.google.com/?hl=de#de/en/per%C2%ADfor%C2%AD...](https://translate.google.com/?hl=de#de/en/per%C2%ADfor%C2%ADmant)

<comment><USER4> It is not actually translating anything since performant is not considered a real word in English, although I commonly see it used in the tech world.

<comment><USER5> > performant is not considered a real word in English, although I commonly see > it used...

This is close to being a contradiction in terms. The purpose of words is to communicate, and if a word is being successfully used to communicate -- which clearly it is -- what exactly does it mean to say that isn't "considered a real word"?

Also, "Considered" by whom? The dictionary? Dictionaries are descriptivist -- they record usage, they don't prescribe it [0]. If it isn't in the dictionary yet, that's only because the usage hasn't been used widely and/or for long enough that it meets the inclusion criteria [1].

(As it happens, "performant" is at the stage where it is starting to pass those thresholds, and is now in the OED [2])

[0] [http://englishplus.com/news/news1100.htm](http://englishplus.com/news/news1100.htm)

[1] [http://public.oed.com/about/frequently-asked- questions/#qual...](http://public.oed.com/about/frequently-asked- questions/#qualify)

[2] [https://en.oxforddictionaries.com/definition/performant](https://en.oxforddictionaries.com/definition/performant)

<comment><USER6> > (As it happens, "performant" is at the stage where it is starting to pass > those thresholds, and is now in the OED [2])

Strictly speaking, I don't believe your [2] is the OED. It's "Oxford _Living_ Dictionaries", which I assume tries to be more current/dynamic, but might be regarded as less authoritative.

Interestingly, the word "performant" _is_ in the OED itself, with the earliest citation being from 1809 -- but it is listed only as a noun, meaning "A person who performs a duty, ceremony, etc., a performer", not the adjectival usage under discussion here.

[http://www.oed.com/view/Entry/262085?redirectedFrom=performa...](http://www.oed.com/view/Entry/262085?redirectedFrom=performant) (requires login)

<comment><USER7> Would you prefer the dictionary from Cambridge University Press as a source?

[https://dictionary.cambridge.org/dictionary/english/performa...](https://dictionary.cambridge.org/dictionary/english/performant)

</comment></comment></comment></comment></comment></comment><comment><USER8> You can also do http(s) over DNS: [http://code.kryo.se/iodine/](http://code.kryo.se/iodine/) . Nice way to avoid paying captive portals, although probably not legal.

<comment><USER9> Why not?

<comment><USER10> In USA and UK at least unauthorised access or use of a computer is criminalised. On some situations you can argue for assumed consent, the law doesn't operate on "if I can do it then it's authorised". Unless you can show you have permission then it's not authorised, ergo not legal.

AIUI; not legal advice.

<comment><USER9> But the premise was to circumvent crap such as captive portals. Doing that on your own computer (mostly in a public wlan), I don't see any reason against it.

<comment><USER11> You're still circumventing security measures to use somebody else's hardware in a way they clearly don't want you to. That's illegal in most cases.

<comment><USER9> Who is the "someone else" in your case? Where does the someone else's hardware come from? OP mentioned this to get rid off e.g captive portals.

Iodine requires a client and a server. Both belong to you, what is the problem here? That I use a network to transmit packets? We are not talking about installing iodine on someone else's computer!

<comment><USER12> Not sure if you're trolling, but the network is being accessed by bypassing the captive portal. The network is being accessed in a way that isn't permitted.

<comment><USER9> And how should I know that there is a captive portal? I connect (connection is established after receiving IP address!) and use iodine (or similar).

<comment><USER13> I'm sure the jury will be delighted to hear your explanation.

<comment> loup-vaillant "I used iodine all the time, so I can't even notice the presence of a captive portal, if any."

"My son handles the computer stuff for me, I don't even know about that logging page you're talking about."

"I thought restricted networks had a WPA-2 password? That's what they use at my workplace."

<comment><USER10> "The door to the house was open, move of the stuff was tied down, how could i be expected to know I wasn't authorised to use it??"

Judges just aren't that stupid.

<comment> loup-vaillant Here's the thing: I _never_ give my real name to captive portals. I don't even give a real email address.

Who can tell me with a straight face that this is criminal behaviour

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> We prototyped this as an intern project at OpenDNS, too: [https://github.com/opendns/OpenResolve](https://github.com/opendns/OpenResolve)

We mostly built it because it sounded cool, but one use case that I though was important was being able to boot these images in different data centers to collect telemetry on DNS differences geographically (eg for hijacking or anycast).

<comment><USER15> Nice project!

We at DNSFilter are able to collect that same telemetry just by having resolvers at each of the anycast locations -- between the different locations, and passing along eDNS Client Subnet information, many responses will be (legitimately) different. A little hard to see a hijack in that noise.

</comment></comment><comment><USER16> I can see how DNS over HTTPS addresses security, but I do not see how it helps with privacy. After resolving the IP address over secure connection HTTPS still sends the host name unencrypted, so one can just eavesdrop on that. And if encrypted DNS becomes widespread, I suspect that various state-imposed firewalls like one Russia will just look for HTTPS connection header to block a particular site.

<comment><USER17> > After resolving the IP address over secure connection HTTPS still sends the > host name unencrypted

Correct me if I'm wrong, but I'm pretty sure the host name is generally only sent in an HTTP header, which should be encrypted over HTTPS.

[https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Ho...](https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Host)

<comment><USER18> No, in order to multi-host SSL sites the host name has to be sent first in order for the correct certificate to be presented.

[https://en.wikipedia.org/wiki/Server_Name_Indication](https://en.wikipedia.org/wiki/Server_Name_Indication)

<comment><USER19> You don't even need SNI; the initial Server Hello, which contains the server's certificate (which contains the DNS name the certificate is issued for) is sent in the clear.

<comment><USER20> No longer true in TLS 1.3 as I understand it

The ServerHello starts out by finishing key agreement and then (in the same message) it assumes its peer now knows the session key and encrypts the rest of the message, including Certificate.

<comment><USER19> Interesting; do you have a reference? In particular, how does it complete key agreement without the certificate? The first thing that comes to my mind is that in order to build the encrypted connection, you need to know _who_ you're building it with, i.e., you need the certificate. You _could_ build an encrypted connection with just whoever is on the other end, and then exchange the cert, but I would wonder then how you would prevent a MitM from just building two connections and forwarding the content across. (Though that would defeat a passive listener, at least.)

(Essentially, the problem is that prior to requesting the certificate for X.com, you need to know that you're talking to X.com; a sort of authentication chicken and egg.)

<comment><USER20> The TLS 1.3 drafts (and given they're in Last Call, presumably the RFC itself once published) use different types of brackets to indicate whether and how things are encrypted in the ASCII art diagrams. The curly braces {} are used for the Certificate structure, meaning it is encrypted using the session keys but it is NOT authenticated application data yet. We'll see why in a moment.

So, firstly I'm going to say, go read the drafts for yourself [https://tools.ietf.org/html/draft-ietf-tls- tls13-23](https://tools.ietf.org/html/draft-ietf-tls-tls13-23) because I am pretty sure that's the most snarky response and also hey, it's right there, if I'm wrong that's a great place to start in proving so.

But then I'll answer your substantive question, because the answer is pretty interesting (and quite unlike earlier versions of TLS).

So, you are correct that we can (and TLS does) do DH without knowing who we're talking to, and that our problem is that although our session is encrypted and can't be eavesdropped, this seems useless because we don't know who the heck we're talking to, surely we can be subject to a Man in the Middle attack.

However, TLS 1.3 has a trick here, after sending Certificate the server sends CertificateVerify. CertificateVerify signs the entire key agreement (which we just did) with the identity from the Certificate. So, a client receiving CertificateVerify either gets a matching signature (the party we did our DH key agreement with _was_ the owner of the Certificate - good) or they don't (we're being MitM'd the phone call is coming from inside the house - get out!)

Once the client has checked CertificateVerify (and presuming they're happy with whatever was inside Certificate) they're truly secure and Application Data can begin to be processed.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> "...for privacy..." and "Google runs one..."

Strikes me as funny. Interesting concept apart from this detail though. Are there any servers that aren't owned by advertisers and the like?

<comment><USER22> [https://stat.ripe.net/data/dns- chain/data.json?resource=exam...](https://stat.ripe.net/data/dns- chain/data.json?resource=example.net)

[https://dns-lg.sidnlabs.nl/example.com/A](https://dns- lg.sidnlabs.nl/example.com/A)

</comment></comment><comment><USER23> I really hope this doesn't catch on widely. It should be a tool for use where censorship issues can't be solved politically.

Otherwise, why even have protocols at all? Just say the only protocol is HTTP. IP, etc. are just an HTTP implementation detail.

<comment><USER24> I would love this to catch on wildly! DNS through TLS means it's all end-to- end encrypted, DNS reflection attacks are harder, etc. The "why even have protocols" doesn't make sense. Protocol can be layered just fine (HTTP itself is a good example). DNS as it exists now is another random special snowflake that vendors need corresponding snowflake implementations for.

<comment><USER23> >DNS through TLS means it's all end-to-end encrypted

I didn't say I'm against DNS being encrypted, even with TLS. I just hate that instead of doing the right thing (e.g. political battle with the government, opening a port on a firewall) people choose the laziest way: just tunnel it over HTTP.

>Protocol can be layered just fine (HTTP itself is a good example)

They can, but why do it? Just figure out a way to make your server be yet- another-"REST"-service and pat yourself on the back for cleverness.

>DNS as it exists now is another random special snowflake that vendors need corresponding snowflake implementations for.

As is: SMTP, POP, IMAP, SSH, AMQP, FIX, SWIFT, LDAP, ODBC and a host of other protocols. Why do you use negative language like "random special snowflake that vendors need corresponding snowflake implementations for"? These are seperate protocols, which serve seperate specific needs. This is how IP was designed to work.

<comment><USER25> Political battles are hard to do, and take time, sometimes very very long times they take.

<comment><USER23> I don't disagree at all. But I don't find this sufficient justification to engage in poor engineering practices.

DNS has a different set of use cases than HTTP so, while it can be made to work with enough effort (anything can), HTTP can never be as good at DNS as an actual protocol designed to do DNS can.

</comment></comment></comment></comment></comment><comment><USER26> Anyone has good pointers on DNS over DTLS (draft RFC 8094) vs DNS over TLS (RFC 7858) vs DNS over HTTPS (this draft) ? And if you could throw in DNSSEC in the mix, that would be helpful.

<comment><USER15> With pleasure - (CTO of DNSFilter, this is my world)

DNS over DTLS (RFC 8094) speaks only to UDP This could be compared with DNSCrypt's implementation

DNS over TLS (RFC 7858) is TCP focused

DNS over HTTPs is focused on... you guessed it, HTTPs

So all the same thing, all trying to add security and privacy, just over different transport mechanisms.

While we're at it -- you did not mention DNS over QUIC: [https://tools.ietf.org/id/draft-huitema-quic- dnsoquic-00.htm...](https://tools.ietf.org/id/draft-huitema-quic- dnsoquic-00.html)

Some factors which start to come in to play with the various options are: Compatibility with firewalls and proxies (DNS over HTTPs wins, others over port 853 have a disadvantage, even if you put them on port 443, they may get stopped by deep packet inspection)

TLS Improvement knobs: 0-RTT, TCP Fast Open, etc. (You can find a summary of these here: [https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Implement...](https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Implementation+Status) )

And closely related, performance. It's tough to beat a lossy protocol with minimal overhead (UDP), but there have been a lot of improvements with Keep alive, eDNS0, pipelining, etc.

We're currently doing a lot of testing around this, as we are working to offer useragents and LAN proxies implementing DNS over TLS, compared with DNSCrypt.

Finally: DNSSEC. It lives in a different part of the 'security' spectrum here... The purpose of DNSSEC is to be able to authenticate the validity of an answer when traveling through untrusted parties (say you're using a third- party resolver, or do you trust your ISP's DNS to not mangle with responses). It does not encrypt request/responses. It does not provide privacy. It answers the question: "Can I trust this response I received for example.org to be the one that example.org intended me to receive?"

<comment><USER26> Thanks, that's great!

I didn't even know about dns-over-QUIC, but considering QUIC is still a draft itself… (I've been excited about it for quite a while though).

Regarding middleboxes, I forgot about those, and it's very sad that they keep hindering progress this way.

</comment></comment></comment><comment><USER27> I've been pushing all my DNS traffic over a VPN, transparently, for the whole house, for years now (by setting the VPN remote IP as the upstream resolver on my router).

It seems the only advantage of DNS-over-HTTPS is that it does DNS over TLS on port 443, which is harder for militant netadmins to block.

It's definitely a solution to a niche problem, but if we really want to encrypt DNS at scale then we could do it easily enough by introducing DNScurve to the SOHO market.

<comment><USER28> When you run DNS requests over VPN, you are sharing your "browsing history" with (at least) 1 other third party: whoever runs the VPN server, and whoever runs the (public) DNS server.

Your ISP can see the IPs you connect to regardless of whether you use your ISPs DNS server or not (unless of course you tunnel ALL traffic of all clients through the vpn as well.)

<comment><USER27> It's low hanging fruit. Logging DNS queries is a lot cheaper for an ISP than filtering out and logging SNI entries in TLS handshakes.

</comment></comment></comment><comment><USER29> dingo - a Google DNS-over-HTTPS caching proxy in Go [https://news.ycombinator.com/item?id=12514170](https://news.ycombinator.com/item?id=12514170)

</comment><comment><USER22> "Do DNS resolves over HTTPS for privacy, performance and security. Also makes it easier to use a name server of your choice _instead of the one configured for your system_."

"A server that is acting both as a normal web server and a DNS API server is in a position to choose which DNS names it forces a client to resolve (through its web service) and also be the one to answer those queries (through its DNS API service)."

[https://tools.ietf.org/html/draft-ietf-doh-dns-over- https-02](https://tools.ietf.org/html/draft-ietf-doh-dns-over-https-02)

How might this affect users who block ads via DNS?

What about users who want the system DNS settings they have configured (e.g. /etc/resolv.conf) to be honoured?

I can clear browser DNS cache with a couple of keystrokes, but I am not using Chrome, Firefox, IE/Edge, Safari, Brave, Opera, etc.

How easy is it for a user to clear the DNS cache in the popular browsers?

The best "privacy, performance and security" _for the user_ is achieved by using /etc/hosts. HOSTS (i.e., no DNS) will beat DNS on all three, every time. "Flexibility" was not mentioned as a criteria.

There is also the issue of "transparency" to consider. It is easy for the user to check their HOSTS file to see what are the current name to address mappings. How easy is it for the user to check what mappings are in the browsers DNS cache?

Fact: Many/most of the names looked up by a user repeatedly every day do not change by the hour, by the day, the week, month or even year.

As a user, I use HOSTS heavily, with appropriate ed scripts for fast automated modification. I use HOSTS for the transparency, control and speed. Any privacy or security benefit is a bonus.

Contrast: [https://en.wikipedia.org/wiki/Fast_flux](https://en.wikipedia.org/wiki/Fast_flux) (need DNS or perhaps "DOH" for this to work)

<comment><USER30> > How might this affect users who block ads via DNS?

They should make sure to use a trusted DNS over HTTPS resolver.

</comment></comment><comment><USER31> Yes, greater for security but still depends upon reliability of certificate authorities and ISPs. ISPs have the ability to issue the client a bogus certificate while they hold the real one in order to decrypt traffic. Why won't browsers allow the certificate's public key to be readable by javascript so that the remote server can verify the client has the correct certificate? This wouldn't be foolproof but it would significantly beef up security.

Similar to how tor hidden services get resolved, distributed hash tables seem like the way to go. Take the ISPs and Cert Authorities out of the equation.

<comment><USER27> Making the public key of the remote available to JS wouldnt help because if you can't trust the identity of the remote server or integrity of the connection then you can't trust the javascript.

Tor hidden services are secure because of the lack of human meaningful names.

See: [https://en.wikipedia.org/wiki/Zooko%27s_triangle](https://en.wikipedia.org/wiki/Zooko%27s_triangle)

<comment><USER31> Yes, since you can't trust the JS, doing this would be an attempt at security through obfuscation. I mostly just think it's strange that these keys aren't accessible. If there were ever a mismatch detected, the server could at least know with certainty that there's a bad actor on the connection.

Thanks for Zooko's Traingle wiki. Hadn't seen that one before.

</comment></comment></comment><comment><USER32> people invented other security things inside of dns protocol to avoid having the added bandwidth. i dont think it's reasonable to say that everyone can handle the increased load nowadays.

However, i've been thinking of this, for enterprise, you could build a dns server which servers over TLS connections, and then put a local dns proxy on clients which receives on 127.0.0.1 and sends out tls to the custom dns server. That way any local network connections would be encrypted to passive listeners on the network.

recursive queries would go onto the internet plaintext to 'normal' dns servers.

<comment><USER33> You can already do this with existing tech. When a DHCP lease is acquired, you also get DNS server information. If you are concerned about the DNS packets being encrypted on your local network, then you can do that already as well by intercepting them with a local firewall and sending them across a tunnel.

IMO, the purpose of DOH is to address semi hostile environments like the free Wifi at the Airport. It is kind of like a VPN for just your DNS traffic.

</comment></comment><comment><USER34> Maybe someone people will "rediscover" dnscurve.

<comment><USER35> Which is completely unrelated

<comment><USER34> It isn't completely unrelated.

DNSCurve secures the link between resolvers and authoritative servers. DNSCrypt (based on DNSCurve) secures the link between clients and resolvers.

</comment></comment></comment><comment><USER36> I am just wondering why would you want DNS over https instead of something like dnscrypt which would be dns over ssl ( I think opendns does this already) ?

<comment><USER37> My guess is meddling corporate firewalls that spy on SSL/TLS traffic (using custom certs installed on the machines) and block unrecognized traffic.

</comment></comment><comment><USER38> Actual DNS servers and clients have supported TLS since the early years of this decade. What's gained by adding HTTP transport overhead?

<comment><USER39> http is not overhead, http is the only transport that can go through middle boxes.

<comment><USER40> if the traffic is encrypted how can you tell whether it's http or plain dns?

<comment><USER35> Because the purpose of middle boxes is to log your traffic no matter what, usually by installing a root certificate on your devices.

</comment></comment></comment></comment><comment><USER35> DoH's great.

I'm planning to write an Nginx module to support it soon.

</comment><comment><USER41> OpenDNS used to offer a secure DNS-tool. I can't find it anymore. Maybe Cisco removed it? Why can't we use something like that?

<comment><USER15> You're thinking of DNSCrypt.

It unfortunately was recently abandoned by the original developer. Some folks have mirrored it here: [https://github.com/DNSCrypt](https://github.com/DNSCrypt)

</comment></comment><comment><USER42> I'm wondering if libcurl supporting custom DNS resolvers could make it easier to explore alternative DNS systems like namecoin.

</comment><comment><USER43> As a mac user, how can I set this up locally to run all my DNS over TLS?

</comment><comment><USER44> So what use does this have?

DNSSEC already gives us validation of the records, and thanks to SNI, this doesn't give us any privacy.

It is more complex, more centralized, and ends up slower than using actual DNS, and doesn't seem to provide any benefits.

Am I missing something?

<comment><USER45> Easier to prevent censoring. DNSSEC doesn't hide the fact that you're making a DNS call, correct? With HTTPS, censors/MITMs can only see the domain you go to. The censor/MITM won't know whether I went to google.com to search or perform DNS query. Plenty of countries have blocked DNS providers they don't like, now that's harder w/out also blocking the site as a whole.

<comment><USER44> Easier to prevent censoring from the ISP, but you're now just reliant on another company's systems.

If you just want a solution for having a remote server execute DNS queries for you, you can just use any of the existing VPN protocols purely for DNS resolution, or even make a better performing version.

All that overhead HTTP adds is wasted for this.

<comment><USER45> > All that overhead HTTP adds is wasted for this.

When you're in an area where your DNS provider is limited by the state, you won't consider it wasted. But if you're not and you do consider it wasted, don't use it. But saying it doesn't seem to provide any benefit is wrong and just telling people to use a VPN for DNS resolution is also wrong (at least until the ergonomics improve).

<comment><USER44> It's more a question why a company like Google would pay several engineers who are paid 6-digit sums to build this when they could build for the same or less much more powerful solutions.

</comment></comment></comment></comment></comment><comment><USER46> I hate the idea of ad networks using this ...

</comment><comment><USER47> Must everything be over HTTPS? Must all diversity really be killed like this? It saddens me.

</comment><comment><USER48> similar - stubby - [https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+...](https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby)

</comment><comment><USER49> To understand DNS, you must first understand DNS.

<comment><USER50> DNS is one of those things I have to reference every time. Definitely feels like this.

</comment></comment><comment><USER51> Isn't this a chicken vs egg problem?

<comment><USER52> You can remember a small set of resolved hosts for this purpose, not unlike remembering DNS servers or CAs to trust. A quick search online also says it's possible to issue a cert to a public IP address, so you can also do HTTPS to a numbered IP instead of a host name.

<comment><USER51> I haven't heard of any respectable CAs that would issue certs for IP addresses...

<comment><USER20> They're rare but they do exist. The CA needs to ensure you really have long term control over the address.

Most people would never need one, but a few people have a real use for them.

</comment></comment></comment></comment><comment><USER53> Where does the privacy advantage come from? Once you resolve a hostname privately, don't you still need to use its IP address publicly for your traffic to be routed there?

<comment><USER54> One case where it might help is shared hosting: you don't know which of the domains hosted on that IP you're accessing. Narrows it down to just a few though, so IMHO not a big improvement.

<comment><USER55> > One case where it might help is shared hosting: you don't know which of the > domains hosted on that IP you're accessing.

That depends on your level of access/monitoring: if it's just a firewall log that shows source/destination IP, then yes - but as soon as you have any kind of packet monitoring, then the domain can be easily sniffed from the SNI header.</comment></comment></comment>


Understanding Apple fans - <AUTHOR> http://radar.oreilly.com/2011/11/android-ios-design-carriers-google.html <comment><USER2> As a long time Windows user, I do appreciate how Apple's products have the "it just works" feel to it. It doesn't wow you per se, but it is characterised by not being frustrating. Perhaps it is because they are able to reduce the scope of a device, so that while their devices have a full computer in them, they are not general computing devices. They only have a narrow range of complementary functions to a full desktop computer.

<comment><USER3> How is a mac not a "general computing device"?

<comment><USER2> The Mac is nice, especially with a good UX where FaceTime just works. Mine sits at home rather unused though. I do enjoy looking at it. It is a beautiful piece of furniture.</comment></comment></comment>