Big ISPs aren't happy about Google's plans for encrypted DNS - <AUTHOR> https://arstechnica.com/tech-policy/2019/09/isps-worry-a-new-chrome-feature-will-stop-them-from-spying-on-you/ <comment><USER2> While I don't particularly trust Google all that much anymore, the fact that ISPs even have an _opinion_ on this is a smoking gun that they're doing sketchy things with DNS data. There is no actual technical reason why they should care if you use their DNS servers or something else, even a private, encrypted DNS service.

<comment><USER3> They definitely are. I know for a fact that they are running massive Hadoop clusters storing information on DNS records involved in their customer traffic. If I recall correctly they mirror a lot of the traffic to analytics environments.

<comment><USER4> I wonder why someone who knows how to do any of that, would think it is a good idea or go along with implementing that. The shitbirds who actually want to do this type of thing are not smart enough to execute it.

<comment><USER5> To make money on analytics?

<comment><USER6> He is speaking of the developers and engineers who have the technical expertise and should know it's a bad idea but still agree to implement it regardless of their moral compass.

<comment><USER7> Why the implication that devs/engineers who have such technical expertise "know it's a bad idea"? There are _plenty_ of devs and engineers who would have no moral issue with mass data collection and analytics. You don't magically become a paragon of morality just because you got a CS degree. Just ask Zuckerberg.

<comment><USER8> I'm working at a company and they want to do a massive amount of logging from our companies IOS app. Basically log everything in the name of security. I made the statement today what does legal think about the data we would be now storing? It has user locations, gps coordinates, all the other fun stuff you can get from a users phone. They all looked at me like I was crazy for even asking that question. And I don't think a single person in the room the devs included had even though about the personal data we were going to be able to collect. And if we SHOULD be collecting it.

<comment><USER9> If your company does business in the EU, or has users within the EU then the GDPR kicks in.

The legal department would care about that.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I'm fine with encrypted DNS as long as it's from _my_ router to the (encrypted) DNS provider of _MY_ choice.

Interference from browsers with network level operations is my real worry. As far as I'm concerned, as long as the browser speaks HTTPS to my router, and my router speaks HTTPS to the servers, no problem. I'm worried about the "to protect the users we've hijacked their DNS directly via the browser" possibility though.

I know it used to be that using ISP DNS servers gave you access to some of their local caching and such. I don't hear that talked about much in these discussions. Is that no longer a thing, and thus we truly don't need ISP DNS?

<comment><USER11> If you're on a mainstream US ISP, interference from your browser with your ISP's "network level operations" is a privacy necessity. They're passively monitoring DNS to collect data on their customers and hijacking it to send users to advertising sites. ISP DNS is manifestly untrustworthy.

<comment><USER10> Well no, because my router is proxying DNS requests, and it's not to my ISP's DNS servers. (It's also serving a number of custom DNS records for internal/work stuff.)

I don't understand how trading one ISP for another (Cloudflare?) is an improvement long-run. The system itself needs to be resilient, not just depend on the kindness of the upstream gods.

<comment><USER12> DNS requests are transmitted in plaintext through the ISPs connections. Because DNS is not remotely secure there isn't any reason they couldn't simply redirect your selected DNS to their own, or replace "not found" responses with a link to their own advertisements.

So without DoH an ISP knows everything you request, even if you have a different DNS server set, and if they really wanted to they can simply hijack any connection you make.

<comment><USER10> It's a good point, but it is preventable by the network admin. For example, I bypass that by tunneling everything out over a VPN, and the local resolver attempts to use HTTPS to connect to upstream anyway. Obviously not every user is in a position to protect themselves in such a way, so I get why the browser is attempting to protect them.

Just seems very wrong to me to take the control away from the user/network- admin in any way. I mean, if you're gonna do it, go whole-hog. Delete HTTP from the browser entirely, right? I don't think that would go over well either, although it could certainly be justified by the same logic.

Maybe I'm misunderstanding something about the issue, there has been a fair bit of FUD, but I simply don't feel good about the browser taking authority outside it's "please render this code into a webpage" scope.

<comment><USER13> > Delete HTTP from the browser entirely, right?

It's not being _deleted_ , but Chrome at least has been gradually phasing in a warning in the address bar whenever you visit an HTTP site. [1] (Firefox will apparently do the same starting soon.) I wouldn't be surprised if the warning UIs get more aggressive a few years down the line, as HTTPS adoption continues to increase.

[1] [https://blog.chromium.org/2018/05/evolving-chromes- security-...](https://blog.chromium.org/2018/05/evolving-chromes-security- indicators.html)

<comment><USER14> Firefox currently shows a red crossed out padlock for HTTP sites with form elements, but not yet for HTTP sites without form elements which for now get neutral treatment. The rationale is that you definitely shouldn't be using insecure forms, what could you possibly be writing where you really don't care about at least confidentiality (to prevent eavesdroppers from reading it) or integrity (to prevent a MitM from changing it) ?

If you set HSTS and then subsequently remove HTTPS from a site it should (will for Firefox, kind of for Chrome) brick wall you, saying that it isn't able to reach the HTTPS site without offering to let you see the insecure and perhaps compromised HTTP site even if you spell out the HTTP URL.

Unlike HPKP this isn't considered a foot gun because you can fix it by just enabling HTTPS, and why didn't you have HTTPS anyway?

The biggest forward pressure for HTTPS is that newer protocol versions (after HTTP/1.1) do not in practice exist for plain HTTP. The way to do plain HTTP/2 is documented but nobody has plans to implement it, and there isn't even intent to document a plain HTTP/3 because the stuff it's built on is all encrypted from the ground up. From my point of view this is good news.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> I'm usually very skeptical of Google's plan for anything, but if it's pissing off big ISPs then sign me up.

<comment><USER16> Google's plans usually have carefully laid out technical justifications, and are mostly kinda boringly/obviously good, like QUIC/HTTP3. That you're usually skeptical of any plan coming from Google suggests that your skepticism is miscalibrated.

<comment><USER17> Here's a twitter thread worth reading, from the former VP of the Firefox group: [https://twitter.com/johnath/status/1116871238922776576](https://twitter.com/johnath/status/1116871238922776576)

It's easy to make proposals that incrementally increase user security while simultaneously increasing one's own ability to consolidate and exploit user data. Technical appeal needs to be evaluated with a simultaneous critical eye to social impact (QUIC is a perfect example -- it outcompetes TCP on an equivalent link, and falls apart over variable-latency or highly unreliable connections, like those that exist in developing nations -- but of course, Google doesn't care about those audiences).

<comment><USER18> > developing nations -- but of course, Google doesn't care about those > audiences

Do you have a citation for your claims? There is plenty of evidence to the contrary: [https://www.blog.google/technology/next-billion- users/](https://www.blog.google/technology/next-billion-users/) .

</comment></comment></comment></comment><comment><USER19> What I _fear_ will happen in several years is that local ISPs will also begin offering DoH by default (if you can't beat the competition, join them) and continue snooping on your traffic, just like Google or Cloudflare could do now technically, if they wanted to. Ultimately this boils down to which entity you trust more, your ISP or some other provider. Today Google/Cloudflare et al are by far the more trustworthy options for DNS at least. But this may not remain forever this way. The price for privacy/security is eternal vigilance, something end users don't (or can't) want to do.

<comment><USER20> Why would you _fear_ ISPs offering an encrypted service? It's hardly a step backwards?

DoT would be preferable to DoH (no additional metadata / cookies,) but either way ISPs should adopt encrypted DNS.

You are correct it boils down to "who you trust." In my country the ISP wins hands down over a foreign mega-corp so I end up making a different decision to you.

The key thing is that is a choice for users, not something software just does without knowledge of what's going on.

<comment><USER21> Because DoH is supposed to hide the DNS traffic _from ISPs_ (among others). Sending the DNS traffic straight to the ISP defeats the purpose of it. That's like MITM on the first hop.

<comment><USER22> But the default state is to use the dns provided by your isp so nothing really changes.

</comment></comment></comment></comment><comment><USER23> > the company has no plans to switch Chrome users to its own DNS servers.

Meanwhile, the Chromecast inexplicably ignores DHCP/NDP-provided DNS servers and uses 188.8.131.52 for all queries.

<comment><USER24> Even worse - it will disable itself if it cannot connect to 188.8.131.52.

[https://news.ycombinator.com/item?id=19170671](https://news.ycombinator.com/item?id=19170671)

<comment><USER25> I don't think that's true anymore. I've blocked my Chromecasts accessing Google's DNS servers and then just fall back to the ones from DHCP.

</comment></comment></comment><comment><USER26> I may not have the technical expertise to understand this fully but right now I'm doing adblocking by using adguard's DNS IPs in my router (1).

It kinda works everywhere but for some apps like Chromecast I have to null route two IP addresses (18.104.22.168 and 22.214.171.124) otherwise it doesn't work. Those are both Google's IPs afaik.

So my question is: will I be able to keep doing it after this? I am asking because I am extremely suspicious of Google these days and wondering if they have an ulterior motive to prevent users from doing such host based adblocking in future?

(1) [https://adguard.com/en/adguard- dns/overview.html](https://adguard.com/en/adguard-dns/overview.html)

<comment><USER27> Yes, 220.127.116.11 and 126.96.36.199 are Google DNS resolvers. Sounds like your Chromecast has them hard-coded instead of respecting your locally configured DNS.

In comparison to your current position, where you're black-holing the hard- coded addresses and the app is falling back to your configured DNS: yes you will be able to continue doing that, assuming the Chromecast will maintain the same fallback behaviour. The exact addresses you need to block and the protocol/ports you need to block may change (eg. to port 443 tcp instead of port 53 udp).

The big thing that DoH will prevent is something that you aren't currently doing, which is: instead of null-routing 126.96.36.199, you could be _intercepting_ DNS requests to 22.214.171.124 and responding to them yourself. You would need to do this if the chromecast didn't fall back to using your proper DNS server. DoH will prevent this kind of interception, so your only choices are to allow it through or block it. And if the Chromecast then refuses to fall back, then blocking it will make the device not work, with no viable workaround short of replacing the firmware.

The goal of DoH is ultimately to prevent your ISP doing the exact same thing to you, ie. intercepting (or just listening in on) your DNS requests even when you want them to go elsewhere. Unfortunately, there's no way to prevent the same protections from extending to a malicious local device trying to circumvent you on your local network.

<comment><USER28> The reason for 8^4 being used for "can I connect to the internet" is valid since the DHCP DNS might be an internal router that's up even when the internet is unreachable; why it's being used for all DNS queries is less defensible. How long till it uses DoH to [https://dns.google](https://dns.google) ?

</comment></comment></comment><comment><USER29> Haha Big ISPs...there's absolutely no reason why regular HTTP requests/responses should be TLS encrypted while DNS queries should not...they go hand in hand for maintaining end-user privacy and YOUR integrity.

<comment><USER30> "Going blind" is a term I've heard recently when talking with operators. Where as "going dark" referred to the DOJ/FBI's term for ubiquitous encipherment of the content, "going blind" refers to the metadata (DNS in this case).

My view is pretty basic: If I can see your DNS, I can pretty much guess on a very short list what kind of [browsing] behavior you are engaging in.

<comment><USER31> You don't have to guess. You can actually see it.

What you can infer is why and who. Which is the real danger. I would trust google to protect sensitive data like sexual preferences before I trust my ISP.

<comment><USER30> It all depends how much is abstracted behind a common host (eg name based virtual hosting). I can see you are going to Google. But I don't know what within Google you are really accessing or using in most cases.

</comment></comment></comment></comment><comment><USER32> It's pretty clear that the ISPs drafted their letter before Google made it clear that they would not be forcing the transition to their own DNS servers. The complaints are entirely about centralization.

Google has attempted to allay some of these concerns, but their initial blog post [1] makes it lear that only certain whitelisted DNS providers would be permitted to participate. That does imply a degree of centralization regardless of Google's assurances to the contrary.

[1] [https://blog.chromium.org/2019/09/experimenting-with-same- pr...](https://blog.chromium.org/2019/09/experimenting-with-same-provider- dns.html)

</comment><comment><USER33> If this prevents ISPs from making even a penny on data mined from DNS queries of their users, even in an aggregated and anonymized manner then so be it because ISPs are supposed to be dumb pipes. And there is nothing creepier than someone mining what I search for. Just fulfill the contract of giving me the internet for my 75USD a month.

</comment><comment><USER34> Is there a way to set up a big list of round-robin DNS servers in Linux, to at least minimize the amount of navigation history any one DNS provider knows about you?

<comment><USER35> Unbound can be configured as a local caching forwarder that round-robins to your list of resolvers.

[https://gist.github.com/MatthewVance/5051bf45cfed6e4a2a2ed9b...](https://gist.github.com/MatthewVance/5051bf45cfed6e4a2a2ed9bb014bcd72)

</comment></comment><comment><USER36> With the statement "could interfere on a mass scale with critical Internet functions, as well as raise data-competition issues" they are actually lying and misrepresenting the issue. In reality there is not much "to interfere" \- especially not so much, that you would need to contact the Congress...

</comment><comment><USER37> I guess this means no more DNS based ad blocking for devices like the Chromecast which ignore the DNS info provided by DHCP and are instead hard coded to use Google's server?

</comment><comment><USER38> How exactly encrypted DNS will reduce spying? ISPs will still be able to observe IP addresses users connect to and even particular host names in SSL handshakes.

<comment><USER39> Due to shared hosting you can't map every IP to a hostname, and encrypted SNI is a thing.

<comment><USER40> But the ISP can likely map most of the IPs to hostnames, as one would expect shared hosting to only be used for smaller sites.

</comment></comment></comment><comment><USER41> Death to big ISPs.

<comment><USER42> Death to PiHole and every other DNS-based ad block and security system. At least, by Mozilla's plan.

<comment><USER43> PiHole supports DoH [0], via the cloudflared daemon. This won't change anything.

[0] [https://docs.pi-hole.net/guides/dns-over-https/](https://docs.pi- hole.net/guides/dns-over-https/)

<comment><USER44> This is incorrect. Mozilla is ignoring your os/dhcp configured server and using Cloudflare. Your PiHole no longer sees the traffic.

There is a way to configure your network to make Firefox not do this, so that's good. But it's not the default.

<comment><USER45> Thats also false.

Mozilla added a canary domain (use-application-dns.net) that if blocked will default to the local dns resolver. There are several threads in the pihole community about blocking it by default so I expect that will be done before mozilla turns int on for the masses.

<comment><USER44> > There is a way to configure your network to make Firefox not do this, so > that's good. But it's not the default.

That's what I'm referring to.

</comment></comment></comment></comment></comment></comment><comment><USER46> There have been several articles in the past few days whinging about both mozilla and chrome incorporating DNS over TLS. Someone seems to be REALLY unhappy about this and those people seem to be trying to use the press as a microphone.

It seems like it's touching a nerve and advertisers and governments are really sweating losing their ability do low effort snooping.

</comment><comment><USER47> Google defaulting to ignore system settings and use Google DNS server is an issue.

But it's cute how ISPs are trying to mash deploying of DoH support and default to Google server into one issue.

The last paragraph absolutely seems like fearmongering:

 _Moreover, the centralized control of encrypted DNS threatens to harm consumers by interfering with a wide range of services provided by ISPs (both enterprise and public-facing) and others. Over the last several decades, DNS has been used to build other critical internet features and functionality including: (a) the provision of parental controls and IoT management for end users; (b) connecting end users to the nearest content delivery networks, thus ensuring the delivery of content in the fastest, cheapest, and most reliable manner; and (c) assisting rights holders' and law enforcement's efforts in enforcing judicial orders in combatting online piracy, as well as law enforcement's efforts in enforcing judicial orders in combatting the exploitation of minors. Google's centralization of DNS would bypass these critical features, undermining important consumer services and protections, and likely resulting in confusion because consumers will not understand why these features are no longer working. This centralization also raises serious cybersecurity risks and creates a single point of failure for global Internet services that is fundamentally at odds with the decentralized architecture of the internet. By limiting the ability to spot network threat indicators, it would also undermine federal government and private sector efforts to use DNS information to mitigate cybersecurity risks._

I don't see how IoT management is going to be affected by DNS resolution made by a browser. CDN's DNS server in any case sits upstream and should be able to perform needed optimization. Google's or any other US DNS provider is not exempt from complying with the US law and court orders.

</comment><comment><USER48> Something I've wondered: It isn't quite clear from the various articles how they're doing this monitoring. I can totally see how they could monitor their own caching resolvers. They might even passively monitor popular internet resolvers (22.214.171.124, 126.96.36.199). But if I run my own caching resolver at home, is that data being mined? I am aware it's unencrypted and possible to do so, but is it actually happening? DoH sounds nice, but it brings me back to using a shared caching resolver which I'm not a huge fan of.

<comment><USER49> Your resolver still makes DNS requests that the ISPs snoop. Unless that connection is encrypted, they have the same info as if you used the ISP's servers.

</comment></comment><comment><USER50> I am a bit stuck here. I know it is a bit insane, but I run a simple system at home because I think, so if I drop dead tomorrow how is my wife going to sort this. If I am dead, internet still needs to work so my kid can do her home work. So despite my geek love, I do not run my own DNS, etc. the other part is I use unblock-us so iPlayer (BBC) works here in the US. I would love to set everything up so everything is encrypted but ... yah. Sorry depressive.

<comment> zupa-hu That sounds backwards. You sure that will be their biggest concern if you drop dead? They can always throw out your weird techy stuff and buy some cheap commodity solution and get them installed.

Your reasoning sounds like, I'm not going to do breakfast for my family, because, ya know, if I drop dead, they will miss the breakfasts.

<comment><USER51> > You sure that will be their biggest concern if you drop dead?

That it's not their biggest concern doesn't mean that it won't be _a_ concern, nor did it mean that it's not something he can avoid becoming a concern.

<comment><USER50> Correct. We have life insurance. We have a trust. All the normal stuff you do. What I am looking at is what are the things that I do / maintain for the family and how will that be handled if something happens? Having an overly complex technical setup is one of the areas on that list. My death would of course have the normal emotional impact it would have for any family. I am trying to make sure that everything else around it that I can sort, I do. My daughter works hard everyday at her schooling because she is determined to be a doctor. My job as a parent is to give her everything I can to make sure she is happy and successfully in her life for as long as I can. The is the promise I made when we had her.

Some of the comments here are taking the piss...let see how you feel when you hold your baby for the first time.

Btw, for context, in the last 3 years I have had perfectly heathy friend that was in perfect shape drop dead from unexpected heart issues at 38. He had 3 kids. Another friend with 2 kids was killing in a car wreak at 44. Looking at the things their family's have had to deal with is the reason why I am thinking about this.

<comment> zupa-hu Sorry to hear.

Look, I did not want to insult, sorry if it came across like that. I just wanted to point out that _in this specific instance_ you may exaggerate the cost of switching from your weird techy stuff to a commodity solution.

That doesn't say anything about your general principle - which is totally reasonable.

</comment></comment></comment></comment></comment><comment><USER52> Does this mean that ad-blocking HW/SW that uses DNS to filter remote sites (Pi-Hole?) will stop working?

That's the only reason I see Google will try a move like that.

</comment><comment><USER53> Strange these isps seem to have entirely ignored pihole, which for me is blocking around 30% of my DNS queries and overrides ISP DNS servers entirely.

<comment><USER54> Your ISP, by virtue of supplying the pipe to the internet, can (and very likely does) still snoop on any old-fashioned plaintext DNS requests you make across it, even when you're not using their servers.

<comment><USER55> I might have misread the GP, but I kinda felt that it also brought up the issue that a pihole (or similar solutions) might cease to work in a "DoH / I automatically pick the best resolver if I deem yours not good enough" world.

DNS privacy is awesome. Filtering malicious and annoying (read: ads) content at the DNS level is mandatory for me..

<comment><USER56> I don't think how that would cease to work. At least in the case of Mozilla they try to detect if you have a custom DNS server. When found, they won't use DoH for fear of breaking many intranets in enterprises.

</comment></comment></comment></comment><comment><USER57> It sounds a lot like a non issue.

If providers want to keep vacuuming personal data they can provide DNS over HTTPS and they'll capture the same amount of data.

</comment><comment><USER58> At the request from some less technical friends I cooked up a solution for using encrypted DNS and Pi-hole together nicely wrapped in a docker-compose config that supports both x86_64 and ARM (RaspberryPi) deployments.

[https://github.com/benke/docker-dnscyrpt- pihole](https://github.com/benke/docker-dnscyrpt-pihole)

</comment><comment><USER59> > DNS over HTTPS means ISPs can't spy on their users

The ISP can still do a reverse look up of the IP address to see where the traffic is going.

<comment><USER53> reverse lookups for things like AWS hosted or cloudflare hosted sites would be a miserably futile effort.

</comment></comment><comment><USER60> Frankly the ISPs can go fuck themselves. They're a bit too comfortable in the role of bullying gatekeeper to the Internet.

</comment><comment><USER61> >Firefox[...]whether or not their existing DNS provider supports it.

Wait what? Hows that gonna play with my existing pihole setup?

<comment><USER28> As I understand it, you'll have to manually opt-out in firefox

</comment></comment><comment><USER62> I work for a large retailer ecommerce office and over the years found the business purchase huge lists of subscriber names plus domains from ISP customer browsing. Att and Verizon selling that I know about, maybe more that I dont know. With the amount of money involved that Im sure they aren't happy.

</comment><comment><USER61> >Big ISPs aren't happy

As my mom said - if you cry enough to fill a tank I'll buy you a goldfish.

</comment><comment><USER63> Google probably isn't happy I won't be using their encrypted DNS, either.

<comment><USER64> no, but the ISPs and your government are very happy about your decision.

</comment></comment><comment><USER65> Yandex Browser has been supporting encrypted DNS since 2016....

</comment><comment><USER66> I guess everyone who cares about privacy should run his own DNS server/cache somewhere on the internet. Same as mail, really.

<comment><USER67> How does that help at all? You're upstream DNS requests would still be unencrypted when they are forwarded to the root servers.

<comment><USER66> The upstream DNS requests to the authorative DNS servers are unavoidable at the moment so you achieve a minimum of privacy invasion.

</comment></comment></comment><comment><USER68> "data competition". lol. the ISPs are literally complaining that google will now have the DNS data, _and they won't_.

<comment><USER69> > google will now have the DNS data

It wont necessarily be Google... From what I understood from the article, if you're currently using OpenDNS, Cloudflare DNS, etc., after the change you'll still continue to use them, only the protocol used to access them will change...

</comment></comment><comment><USER70> Although it's going to spark an ISP anti-privacy arms race, this demonstrates why encrypted DNS is necessary.

</comment><comment><USER71> Thankfully, ISPs being upset about it is a really good way to determine if it's a good thing.

</comment><comment><USER72> If ISPs are against it I am for it. I've worked in the SP market for 15 of the last 20 years.

</comment><comment><USER73> All we ever wanted was a dumb fat pipe. All we ever got was triple play. No pity.

</comment><comment><USER74> In the land where GDPR exists, I can see why ISPs are a little annoyed.

Directing users to local CDN instances has now got harder, which means its going to cost more for things like netflix

In the US, yes, that means that ISP can't mine youre data, however, you are handing more information to google.

</comment><comment><USER75> I see news about DNS every single day now!

</comment><comment><USER76> This is a boon for Indians.

</comment><comment><USER77> In many economies, ISPs have legal immunity from acts done by users (customers) because of laws associated with 'common carrier' status.

But that status is fragile. The ISP has to act like it knows its obligations in law, and there are things ISPs have been doing to work with LEA for a long long time, which they won't be able to do as simply, or as well, or in some cases at all.

As a customer its easy to assume the _only_ answer is "good" but in fact, its more complex. Society depends on law, and the application of law around what people do online is not trivial, and does not reduce down to 'all snooping is always bad all the time' -Warrants exist to do things, and warrant canaries are a reaction to them but not one which says warrants don't exist: they say silent warrants should not be obligated on the receiver of the interception: They're a position on secret law, not a position on law in itself.

TL;DR DoH and DoT are challenging established law in telecoms and big ISPs who have common-carrier defence depend on interception in DNS and DPI and the like, to perform their role facing LEA demands from the state _which in many cases are entirely normal and justified_

Not all DoH and DoT stories are good stories for society at large.

Please don't reduce this to a libertarian vs everyone else debate, I would invite you to think about what an ISP is, and what we want from ISPs as a whole, not just as customers seeking pirate bay, but as a society investing in a telecommunications-rich future.

The first casualty of war is the truth. The second (in WWI and WWII) was the deep sea telecommunications cables.

<comment><USER78> DoH and DoT are just new delivery technologies. You've always been able to securely tunnel your traffic out of the country and you always will as it's trivial. DoT changing the resolver from one public company in the to another public company of the will not prevent the government from issuing warrants, particularly since they already issue warrants to these companies as it is.

Common carrier defence is not going to be lost from encrypting URLs, the same FUD was spread about encrypted banking then the encryption of most websites. The only thing that has resulted from the increase in encryption is the decrease of ISP injected ads and the decrease of customer tracking information being sold.

<comment><USER77> There is a volume of ability north of 95% which could be lost, and the ISP has a mechanism to act (block DoT) but in DoH, its less simple. Hence, the liaison between Mozilla and Google, and state authorities.

Why do you think Mozilla turns this on selectively?

</comment></comment></comment><comment><USER79> From Google's perspective being able to block ads with your hosts file is a bug, not a feature.

<comment><USER80> Perhaps. I personally would still setup DoH at the router level. ISPs begone.

<comment><USER81> Would a local DoH server making going between different networks a little clunky? I have unbound handling dns at home but the old way lets the network define where to get dns information and/or allow for multiple options. Seems like Firefox doesn't have that flexibility yet.

</comment></comment></comment><comment><USER82> Google wants the whole internet to go through them. Starting with the bloody DNS ... nice plan ... probably needs quite a bit lobbying and bad-mouthing other actors to succeed though ...

Absolutely. You can find a dishonest ISP. The difference is that there are thousands of them. And not just one big opaque entity.

<comment><USER83> They're not moving anybody to Google's own DNS servers. If your current DNS provider offers encrypted service, they'll begin using that.

 _Starting with version 78, Chrome will begin experimenting with the new DoH feature. Under the experiment, Chrome will "check if the user's current DNS provider is among a list of DoH-compatible providers, and upgrade to the equivalent DoH service from the same provider," Google wrote. "If the DNS provider isn't in the list, Chrome will continue to operate as it does today."_</comment></comment>


Intro to Icons by MDS - <AUTHOR> http://introtoicons.com/ <comment><USER2> Thanks for posting, David!</comment>


Ask HN: Is there a space in the tech scene for the not numerically-inclined? - <AUTHOR> As I was going through a brain teaser today, I realized that I just may not have the numerically-inclined type of brain.<p>I've never been good at math. I do well with languages and can write up a storm, however. Is there space in the tech scene for someone like me? I am interested in everything data, but it seems that that field requires a numerical brain. Is the analytical part of your brain something you can build and improve? <comment><USER2> First, it depends on what you mean by these terms "math" / "numeric" / "analytical".

The vast majority of software development and even computer science relies mostly on logic rather than "numeric" math (some sub-disciplines aside).

I initially ignored CS because I hated math in high school and thought it would be "too much math". Turns out I am really good at CS even though I sucked at things like calculus.

So my first point would be to make sure you try some actual programming before you get scared away about any "math"-related concerns.

Secondly:

> Is the analytical part of your brain something you can build and improve?

Absolutely. It is just like a muscle. The more you practice, the easier it will become. To be able to build powerful software you have to learn new patterns of thinking, which takes time. But it is definitely doable, provided you enjoy it enough to push through the tedium. But it's not everyone's cup of tea.

</comment><comment><USER3> For the idea of building and improving the analytical part of your brain, I highly recommend the Coursera course _Learning How to Learn_ by Dr. Barbara Oakley. [0] An excerpt from her Wikipedia page[1]:

 _After her Army duties ended, Oakley decided to challenge herself and see if her brain, more used to the study of languages, could be 'retooled' to study mathematical subjects. She chose to study engineering, in order to better understand the communications equipment she had been working with in the Army._

[0]: [https://www.coursera.org/learn/learning-how-to- learn](https://www.coursera.org/learn/learning-how-to-learn) [1]: [https://en.wikipedia.org/wiki/Barbara_Oakley](https://en.wikipedia.org/wiki/Barbara_Oakley)

</comment><comment><USER4> A random internet stranger really can't answer this for you. I suggest you start a file and start collecting articles and other snippets that have meaningful information for you.

I have a strong-ish math background, but language is more my forte. I've picked up some HTML, CSS and I have a certificate in GIS. I'm currently the very part-time webmaster for a local nonprofit, though I'm not actually a programmer.

I also homeschooled my 2e kids and did pro bono professional work for an education oriented voluntary health and welfare organization. My son has difficulties with numbers, but I was able to teach him the concepts. You can always use a calculator or spreadsheet to crunch numbers for you, but not everyone gets the concepts, which turns into a case of garbage in, garbage out. He's gotten good at finding the math errors -- or logic errors in using math -- in games he plays.

So even if you really are terrible with numbers per se, that doesn't mean you can't learn important math concepts for purposes of analysis. You may just need to look for the right materials that present it in a way that works well for you.

But the best thing you can do to develop a career path is pick up a book like "What color is your parachute?", do the exercises and some informational interviews and sort this yourself. You are the person most qualified to recognize if some role fits your criteria for being _in tech_ and also something you could comfortably do.

</comment><comment><USER5> The vast majority of coding these days doesn't involve anything mathematical. (Behind the scenes yes, but for application development that you will likely be coding no.)

<comment><USER6> This is technically true, but what typically makes a person good at math is the ability to think logically, critically, and understand systems at a high level of abstraction. The correlation is probably not 1:1, but I have yet to meet a good dev who is terrible at math. That doesn't mean they remember all of the details from school, but they can understand it.

</comment></comment><comment><USER7> I will say that most web/iOS/android/similar developers rarely have to do anything more than simple division, multiplication, modulo etc when it comes to math.

Yes, many developers are good at math but I'd say that's mostly correlation, not causation.

NOTE: This is my personal, anecdotal experience.

</comment><comment><USER8> If you had enough experience in tech such that you were actually building things, then this question would have answered itself on the basis that you can build things, which extrapolates to things that you can get paid to build.

But since you don't have that experience apparently (despite whatever "write up a storm" means), then you have no clue what might be preventing you from entering the tech scene as it may (and is far more likely to) be related to any of the other things that keep people out of tech, like tenuous interest in the subject at all.

</comment><comment><USER9> Tech companies employ non-stem skills all the time. Communication, marketing, branding, design, hr, so many more.

I know an old lady who wrote history books who now works for a major financial company editing quarterly tech briefs for their high profile publications. She knows more about the workings and impact of bitcoin than I do by editing. She literally did bootstrap her knowledge at the age of 60.

It takes all kinds and the maths-only stereotype needs to die. Anyone can help.

</comment><comment><USER10> Years (going on decades) ago, I would have said the same thing about myself - I'm just not that "good with" numbers, but I'm good with coding and problem solving. And I actually did just fine - but one day I came across an interesting problem on Usenet about drawing a block arrow that could orient itself in any direction. Out of curiosity, I started trying to implement it and I realized I needed to recall the algebra that I remembered just enough of to pass the test when I was an undergraduate. Suddenly, in context, it became interesting, and I started re-learning all of the "number stuff" that I dreaded when I was younger. Not only did it start to make more and more sense, but I found myself becoming a better programmer incidentally: solving these simple, ready-made problems (that happened to involve manipulating numbers) sharpened my ability to concentrate and focus on bigger, fuzzier problems. I don't think anybody - or maybe only very few - people are "naturally" numerically inclined; it's something you have to work at, but I also think it's something that anybody can master if they really put their mind to it.

</comment><comment><USER11> Back in grade school a lot of the educators believed that in order to do programming (BASIC) kids needed first to understand algebra in order to grok the concept of variables and such...

I myself wasn't all that good at algebra but while programming I was able to grasp math concepts in application trying to figure out how can I get x to equal y etc. For me my math application skills improved vastly by learning software development. Even now I can get frustrated by purely algebraic problem solving puzzles, just not my thing.

I can see if you are good at such things it is a great benefit to know some of the concepts where I had to do a lot more research, trial and error to get some results. But also, if that's all you are good at you probably aren't coming up with the next flappy bird.

You don't really need a numerical brain but you do need to be determined solve problems, have good memory. And I think as you work with it you will exercise those abilities.

I would find some computing aspect you like and research that, find some easy language/platform (or open source project already in progress) to play on and see where it gets you.

<comment><USER12> Same here. Never really had the motivation in my mathematics courses at uni, too much theory. But with a concrete goal and visual feedback I was able to solve quite some problems.

Example, I didn't do well in my linear algebra course, but afterwards I made a (simple and slow) physics simulator with the very same concepts. Each thing I discovered, length between vectors, dot product, projection made a whooole lot of sense once I could actually draw the lines on a screen.

[https://www.youtube.com/watch?v=ud8NirjyLAA](https://www.youtube.com/watch?v=ud8NirjyLAA)

</comment></comment><comment><USER13> A lot of programming is more linguistic than mathematical. If you stay away from hard core algorithms, graphics, scientific computing, AI, and similar things, you're likely to be able to get by with high school math and algebra.

One big area is UI/UX, which usually requires little math but does require design skills and good intuition about what makes a convenient intuitive user interface. Unless you are coding a rendering engine from scratch the math you'll hit in UI/UX coding will be arithmetic, basic bit manipulation (AND/OR/XOR), and maybe a little algebra.

</comment><comment><USER14> Check out UI/UX design and development. Web development in particular. It isn't quite mathematically charged like data science is but it's a great way to build tools to visualize data!

<comment> reason-mr This. UX designer with implementation skills - not numerically oriented at all; designers with implementation skills are not in great supply.

</comment></comment><comment><USER15> You could be a business analyst or product owner at a tech company.

Basically, your job would be to translate what the client wants into pieces of work that your development team can do.

It's not coding but it's still a very interesting position.

<comment><USER16> As someone who has done both, in enterprise internal tech rather than a tech firm—at times simultaneously, on different projects—business/system/domain analysis tends, IME, to be no less numerical/analytical than coding on the same system.

</comment></comment><comment><USER17> UX / product manager / business analyst ( non financial / math domain ) / sctummaster / project manager / training / sales

</comment><comment><USER18> It's all about messaging.

quoting: Soon we will have chips with thousands of cores with high-bandwidth interconnect. Such chips will power the next generation of Intelligent Applications.

Since message passing between Actors is the standard method to communicate, languages like Erlang are highly relevant.</comment>


Show HN: Online C to WebAssembly compiler - <AUTHOR> https://github.com/maierfelix/momo <comment><USER2> Is good having C into WebAssembly, but is there a compiler to compile WebAssembly into C?</comment>


Turing Learning breakthrough: Computers can now learn from pure observation - <AUTHOR> https://www.extremetech.com/extreme/234669-turing-learning-breakthrough-computers-can-now-learn-from-pure-observation <comment><AUTHOR> As the paper notes, this is a different perspective on generative adversarial networks:

      Goodfellow et al. (2014) proposed generative adversarial nets
      (GANs). GANs, while independently invented, are essentially
      based on the same idea as Turing Learning.</comment>


How we use Backbone.js to build Codiqa – Part 1: API - <AUTHOR> http://blog.codiqa.com/2012/05/how-we-use-backbone-js-to-build-codiqa-part-1-api/

<comment><USER2> Excellent article. Did you run into any major pain points when ramping up with Backbone? Any resources you used that you would recommend to a newcomer?

<comment><AUTHOR> Thanks! Yes, I had some issues with dealing with collections, and also tying collections in with views. Really it was more of a mismatch between what I expected and what I _should_ have expected. Additionally, making the mistake of assigning data on the prototype of an object rather than the instance itself was an initial mistake I was making but I that's just a JS gotcha.

Really the best resource I found was just googling for examples. I didn't find the Todo example very helpful because it's not network oriented, but it does help for views.

</comment></comment><comment><USER3> +1 for wrapping your back-end resources as a Backbone.js model

</comment><comment><USER4> So, how would this compare to Ember?

<comment><USER5> [http://www.quora.com/What-are-the-key-differences-between- Em...](http://www.quora.com/What-are-the-key-differences-between-Ember-js- formerly-SproutCore-2-0-and-Backbone-js)

<http://news.ycombinator.com/item?id=3460632>

[http://www.reddit.com/r/rails/comments/q6vvu/spinejs_vs_back...](http://www.reddit.com/r/rails/comments/q6vvu/spinejs_vs_backbonejs_vs_emberjs/)

[http://stackoverflow.com/questions/10099059/whats-are-the- ke...](http://stackoverflow.com/questions/10099059/whats-are-the-key- differences-between-meteor-ember-js-and-backbone-js)

etc...</comment></comment>


Twitter Is Bringing Back the Reverse Chronological Timeline - <AUTHOR> https://twitter.com/TwitterSupport/status/1041838957896450048 <comment><USER2> Best news from them in months. I wish Instagram would do the same. The "smart" ordering of tweets and photos just makes my experience with both the apps worse.</comment>


How I Pitched TechCrunch And How To Get Press When You Launch Your Startup - <AUTHOR> http://jasonlbaptiste.com/featured-articles/how-i-pitched-techcrunch-and-13-ways-to-get-press-when-you-launch-your-startup/

<comment><USER2> The true value in this post is that you gave your unedited email to TC. The world of information in general needs more of this. I'm tired of blog posts about how to do things - everybody wants to reveal what they think worked (e.g. the Secret Sauce) without showing how they acted on that advice (e.g. the meal and its recipe). I don't want a template of your advice, I want to see what YOU did.

Thanks for being strong and bold enough to provide a REAL example!

<comment><USER3> Yes. He shows a very good example of a short pitch, to the point, catchy without being misleading.

I'd like to see the initial response he got. I know the TC folks, did he get more than "send me more?"

<comment><AUTHOR> Here's how it played out:

-Mike emailed back, asking Alexia to check it out.

-She called me about 30 minutes after.

-Went through vision, pitch, answered questions.

-She needed screenshots in a demo fashion, so we cooked them up in <45.

-Resulting article: [http://techcrunch.com/2010/07/27/turn-your-blog-into-an-ipad...](http://techcrunch.com/2010/07/27/turn-your-blog-into-an-ipad-native-with-padpressed/)

I'm sure it doesn't always go like this. This is just one data point / use- case.

<comment><USER4> Looks great, Jason. Congratulations!

And +1 for the Zero7 track (although I'm not sure how appropriate it is for the product :-P).

</comment></comment></comment></comment><comment><USER5> The fact that the email came from someone that's pretty well known and respected (Jason) may have also helped in this case. Regardless, good read.

<comment><USER6> It probably did a little more than help. By my estimations, having a reputation is far more important than having a product, especially when pitching to TC.

</comment></comment><comment><USER7> It was a valuable read like the others. Would you mind sharing how you created the product demo video? It would be another nice read if you covered this as a process.

<comment><AUTHOR> Doing a new one now actually. Literally spent a lot of today scripting, online at bestbuy waiting to get better tripod. Will write an article up.

</comment></comment><comment><USER8> Fwiw, I find PadPressed an awful iPad experience. It is difficult to navigate the site, navigation between pages is slow, the body text font is not properly antialiased and is difficult to read, and from the front of the site, it wasn't clear I had to swipe to open the site. It's obviously trying to make a site feel like Flipboard, but no thanks.

<comment><AUTHOR> It's the prototype. Were getting there and have lots of work to do. The direct link pages ie- what you see from here on an iPad needs work/ isn't like most others.

<comment><USER8> Okay. I went to the front of your site though and still found it a sub-optimal web-experience. If it's any consolation, I also hate the iPad optimized version of gmail. The iPad has a full browser, give me the full web.

</comment></comment></comment><comment><USER9> Typo: I think you meant "Stunts are an unsustainable way to do press" instead of "Stunts are a sustainable way to do press"

<comment><AUTHOR> thank you. Someone else pointed that out too. Going to stop being lazy and fix now.

</comment></comment><comment><USER10> I actually have a draft of a similar post (except for TUAW, LikeHacker, Mashable, and the like in addition to TC). It should be up today, look out for it. :)

EDIT: posted, check it out at <http://news.ycombinator.com/item?id=1805510>

</comment><comment><USER11> did you send the email to tips@techcrunch or directly to mike?

</comment><comment><USER12> The real question is, did it pay off? Did going exclusively to TC generate the traffic and buzz you were looking for? Would love to hear more about the results.

<comment><AUTHOR> So PadPressed has somewhere close to 200 customers total. Not a ton in the grand scheme of things, but for an alpha version we're really happy.

I know I sit and preach multiple customer acquisition methods and distribution, but honest truth is, we haven't done any of that over the past 90 days except for the TC coverage. Our shit has been GHETTO. Literally, I left spelling mistakes, unoptimized funnels, analytics,etc. just to see at the worst case scenario how we'd do.

We launched, got the TC coverage, had an influx of customer support (supporting your startup is so overlooked) from customers, and then a trickle down effect of press. Some say the TC bump doesn't do much, but in our case it paid off. We're doing a real release, the new design is breathtaking, and planning real distribution channels/partnerships.

</comment></comment><comment><USER13> Given all of that optimization, I think that the last line of the email is a little superfluous:

"You Should Check Out JasonLBaptiste.com"

<comment><AUTHOR> that's part of my signature. if you've ever emailed with me before that's there.</comment></comment>


You Can Always Find an Anonymous Former Employee to Trash the Founder - <AUTHOR> http://hunterwalk.com/2015/12/26/you-can-always-find-an-anonymous-former-employee-to-trash-the-founder/ <comment><USER2> Ok, so are there any posts by Hunter publicly trashing someone? If not, it must be because he's had uniformly wonderful experiences with everyone with whom he's interacted in the valley!

He also completely ignores power differentials between (often, but not always) connected and/or well-off founders and their (often, but not always) less well-off, less connected, less known reports. For those of us who aren't as plugged in as he is, the stuff that trickles out to the industry news is helpful. eg founders that have a history of treating dev teams like shit, or founders that have walked away with millions while their employees walked away with zero (Kevin Rose, etc.)

<comment><USER3> hi! my problem is with situationally granting anonymity in press articles, not with criticism overall. Although I generally believe people should stand publicly behind their opinions when making specific accusations about other people, pseudonymous systems are very important/valuable for a variety of reasons.

Also, while now, later in my career, I'm certainly better connected than I was when I started out, I'd like to think I've behaved consistently in this belief.

<comment><USER4> That doesn't really address GP's comments directly. It's never a good career move to trash someone publicly, and it's not fair to call out anonymous sources for protecting themselves from a backlash.

As for your complaint, it's certainly true that almost any angle can be supported by a single source. Good journalists can solve this by finding other sources before publishing or verifying in other ways (viewing email histories, for example).

</comment></comment></comment><comment><USER5> _For members of the tech community I believe it's quite cowardly to give opinions, for print, without willing to be named as a source._

I take the other angle -- it's quite cowardly (and shitty) for junior "founders" to take advantage of, or otherwise make life miserable for early employees in the ways they are prone to doing: bait-and-switch games with regard to compensation, equity, or verbal agreements; plain old harassment in sexual or other forms; or just sheer incompetence[1] -- and then expect these employees to not only take their lumps financially and emotionally, but to keep forever silent about it -- on fear of appearing "embittered" or "vindictive."

So to those feel they need to keep their anonymity, in order to prevent the damage and humiliation they suffered from living on any further -- as long as they are being truthful, they have my understanding and support.

That is to say: in the right circumstances, there's nothing shameful about preferring to stay anonymous for the sake one's sanity and financial health. And in some cases, it may be downright prudent and necessary -- and for the better good of us all.

[1] "We're sorry things were kind of rough here for you at the beginning. Management was 23 years old, and very inexperienced" was what was told to a friend of mine after moving across country to join a startup that promptly went bust, 6 weeks later -- sans severance, of course.</comment>


U.S. Orders Deep Pay Cuts at Companies Who Received Bail-Out Funds - <AUTHOR> http://www.cnbc.com/id/33417281 <comment><USER2> We all get a great sense of schadenfreude when formerly profligate corporations get their comeuppance in this way but the pay czar role (whether in the form of an individual or a political committee) is in reality fraught with problems for taxpayers.

If the government is to be anything than a long-term host for parasitical companies, the idea is to have the companies turn around. Yet who worth his salt will remain at such companies if the compensation needed to keep them competitive with otherwise similarly situated companies is not there - or, worse, was there but was cut by a "pay czar' for who knows what reasons (especially bad if people have their pay cut in order to appease popular prejudices)?

Yet what "pay czar" worth his salt will _not_ want to scrutinize all salaries closely for companies that have been feasting at the public trough? Of course, that is his job and he must do it to be responsible.

Sometimes such cuts will be more than warranted; other times, they will be arbitrary. There really is no good measure for determining which is which. Hence, it can all become political or not and only the bureaucrats and politicians will ever know - of course, those directly affected will also know and they will not likely stick around for more if they are indeed working hard only to have political factors wind up hurting them economically with no recourse but to have to suck it up.

And so the whole system is calculated to do anything _but_ help the companies turn around, at least as this might happen through having competitively paid and motivated individuals in positions of ultimate responsibility.

I do not say this out of sympathy for the corporations. Most of them richly deserve all that they are getting right now. But the poor taxpayer is not well-served either, as a losing approach goes from bad to worse in all likelihood, with the taxpayer perpetually on the hook for more.

</comment><comment><USER3> This is hardly the first time the US government has bailed out private corporations. Was compensation a major issue when we bailed out the railroads?</comment>


Firefox Addon: Bitbucket PR Name Filter - <AUTHOR> https://addons.mozilla.org/en-US/firefox/addon/bitbucket-pr-filterer/ <comment><AUTHOR> This is my first firfox add on and chrome extension built out of frustration of stash not iterating fast enough. My job has a lot of open PRs and it's impossible to filter them and this is just a tool I built for myself that I felt others might find usefu

<comment><AUTHOR> Any recommendations to improve it would be appreciated, please shoot me an email @ firstname.lastname@example.com</comment></comment>


The Apple Store is down - <AUTHOR> http://www.apple.com/shop/ <comment><USER2> I wonder if this is just some marketing trick where this message is somehow more profitable for them than just having the store open during this time or that their store backend is just so crappy that they actually need this much time to add a few new products.

<comment><USER3> Well, I could easily see how someone who ordered a product seconds before it's successor rolls out would feel shafted, so this might just be good marketing.

</comment></comment><comment><USER4> This isn't titled correctly, the store isn't 'down' as the title suggests in a way in which it crashed or there is some big problem.

The chances are this is just a part of the process of a regular mid-term product refresh which aligns both with physical products and some site design / marketing.

It's not a big deal unless you're at the point where you're about to purchase a product but are holding off as there may be a refresh occurring - in which case it's likely this is good for you and will just be updated versions of the existing products.

This kind of hype is not created by the company / marketing, it's created by people speculating.

Remember - just chill, it might be a nice product refresh, which will either mean the old models will drop in price (new or second hand) and the new models might be what you want, OR the new refreshed models don't peak your interest / needs and you don't feel like you want to purchase it for any reason, but prices of the previous models will drop a little which is nice also.

</comment><comment><USER5> quick everyone speculate on what it could be! Apple Cars! Apple TVs Apple Goggles Apple Visors Apple Fruit

<comment><USER6> Apple Eraser

</comment></comment><comment><USER7> [https://www.macrumors.com/2017/03/13/apple-new-products- as-s...](https://www.macrumors.com/2017/03/13/apple-new-products-as-soon-as- next-week/)

New iPad pros, supposedly.

</comment><comment><USER8> I must say, as the inventors of the Retina Display, they're doing goof by serving waiting message assets at 1x.

Hopefully, it's just me — but I'm running it on Safari on OS X...

<comment><USER9> It's an animated gif, weighing in at 4MB, which is already massive, do if they doubled the resolution that would be very large for a very subtle visual difference for that particular graphic. The file name includes 1x, so I believe it's intentional for performance reasons.

<comment><USER8> Good point — but why would they do that, when they're so set on the UX benefits of retina assets? They seem to manage it everywhere else on their site...

Couldn't they lazily-load a 2x gif, or use CSS transitions?

</comment></comment></comment><comment><USER10> Looks like this 'downtime' is just a smart marketing trick.

<comment><USER9> Interesting where do you see that confirmation? I would be beyond surprised if they used their "Something special in store" for regular maintenance, versus their' We'll be back. Or if you mean yes, they are going to be adding new products but you consider that smart marketing to do versus having a more typical event, then yes, I agree it's smart marketing.

<comment><USER10> I mean that this does not look like regular maintenance. Clearly though not being able to sell your products for a few hours is a bummer, but the hype you create offsets the revenue loss.

</comment></comment></comment><comment><USER11> Maintenance was announced. We should know in a little over an hour.

<comment><USER11> Back up. iPhone in Red. Hurray (?)

[http://www.apple.com/shop/buy-iphone/special-edition- iphone-...](http://www.apple.com/shop/buy-iphone/special-edition-iphone-7)

iPad 9.7 (non-Pro)

[http://www.apple.com/ipad-9.7/](http://www.apple.com/ipad-9.7/)

No pencil or keyboard support. $329 for 32GB or $429 for 128G

<comment><USER12> The Nintendo Way of revenue generation: vary the size and color of your gadget every 3 months, and you can print money.

This worked for Nintendo for a very, very long time with the different versions of DS. Until it didn't.

</comment></comment></comment><comment><USER13> what a way to make a new product announcement! cannot help admiring the way they market stuff.

</comment><comment><USER14> So are my pants

</comment><comment><USER15> Oh--the drama. Yea, I get it. These days we need some healthy excitement. The iPad Pro is the one product I might buy; if I wasen't so poor, and didn't have a slowly dying iPad 2.</comment>


GitLab 11 released - <AUTHOR> https://about.gitlab.com/2018/06/22/gitlab-11-0-released/ <comment><USER2> Another release, another whole slew of project management features that I don't know who asked for, while things that I consider basic for a code repo manager is still nowhere to be seen:

\- batch review (seriously, will this ever be done?) ([https://gitlab.com/gitlab-org/gitlab- ee/issues/1984](https://gitlab.com/gitlab-org/gitlab-ee/issues/1984))

\- configurable tab width ([https://gitlab.com/gitlab-org/gitlab- ce/issues/2479](https://gitlab.com/gitlab-org/gitlab-ce/issues/2479))

\- consecutive git blame for current revision ([https://gitlab.com/gitlab- org/gitlab-ce/issues/37135](https://gitlab.com/gitlab-org/gitlab- ce/issues/37135))

\- rebase and merge in one single step ([https://gitlab.com/gitlab-org/gitlab- ee/issues/895](https://gitlab.com/gitlab-org/gitlab-ee/issues/895))

\- unable to view diff for any file that is slightly large ([https://gitlab.com/gitlab-org/gitlab- ce/issues/30061](https://gitlab.com/gitlab-org/gitlab-ce/issues/30061))

GitLab seems to be trying too hard to replace project management tools like JIRA and CI tools like Jenkins that it's neglecting its core feature set that is code repo management.

<comment><USER3> Paying customers.

Specifically, the person who signs off on Gitlab at a company is generally some kind of project manager so they value project management features.

<comment><USER4> All the extra features is the main selling point of GitLab. It's the reason you use it over GitHub because GitLab is more than just repo hosting and issue tracking.

<comment><USER5> That, and the fact that you can self-host

<comment><USER6> You can self-host GitHub, too: [https://enterprise.github.com/home](https://enterprise.github.com/home)

<comment><USER5> You can, at entreprise prices indeed. Which is out of reach for most SMEs out there. This is IMHO a llarg part of what made Gitlab successful.

<comment><USER6> The price is roughly $21 per user per month, which isn't really all that enterprisey, given you have at least 10 users, that is.

I don't know exactly how GitHub Enterprise and the GitLab Community Edition compare in that regard but aspects such as usability, maintainability and updatability are much more important than saving $21 per user per month.

So, yes if your company has a lot fewer than 10 Git users GitLab probably is the best option. In every other case, it depends and the pricing advantage becomes less pronounced.

<comment><USER5> Sure, Github definitely has worth. I use both myself.

But for a petty price, Gitlab comes with a Kanban board, a release management system, a (free) CI tool, and all of the newer features I don't have experience with ( the whole Kubernetes integration lately? ). (So no need for paid travis, Asana, Jira, ....).

Adding to that that most cloud providers offer ready to use images with Gitlab installed, I understand what it becomes such a 'default choice' for new installs lately.

<comment><USER7> Compare apples to apples, at least. The paid GutLab plans are as expensive or more than GitHub. And they keep raising their prices too cuz they aren't making enough money to survive. The big difference for us (Apple) is performance and reliability. GitLab isn't reliable and GitHub Enterprise is rock solid with whatever we throw at it. That's better than a bunch of features (to my team, at least).

<comment><USER8> > _The big difference for us (---) is performance and reliability._

If that's the name of your employer, bear in mind that you can get into massive hot water for using it to endorse third-party products without authorization.

<comment><USER9> Ive read about them using both systems. Seems like teams have flexibility to choose what they want. As they should. And some prefer GitLab.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> >GitLab has memory leaks. These memory leaks manifest themselves in long- running processes, such as Unicorn workers. (The Unicorn master process is not known to leak memory, probably because it does not handle user requests.)

>To make these memory leaks manageable, GitLab comes with the unicorn-worker- killer gem. This gem monkey-patches the Unicorn workers to do a memory self- check after every 16 requests. If the memory of the Unicorn worker exceeds a pre-set limit then the worker process exits. *

I know this is a Rails issue, but I cannot believe this is still a problem. I remember when the RoR folks blamed the Rails memory leaks on Zed, and Mongrel, more than a decade ago. They were obviously incorrect. Did the community simply give up on fixing the problem?

* [https://docs.gitlab.com/ee/administration/operations/unicorn...](https://docs.gitlab.com/ee/administration/operations/unicorn.html#unicorn-worker-killer)

<comment><USER11> Were you under the impression that Rails has a functioning dev community?

I am very familiar with the rubyverse, and boy do I got news for you.

Rails is to Ruby as the Big Dig is to Boston.

But it's hard to get Rails devs to admit it. They know it, of course. They live it. They breathe bad code, they exist as extensions of a philosophy that has failed it's way to the top.

I used to think Zed was a dramatic weenie. Then I got a bit deeper in Rails to learn how to pursue better exploits. And deeper. And deeper. And finally I just hit a point where I just wasn't willing to work on RoR-related gigs.

Convention over configuration is one of those ideas that goes great on paper. And then you start in on some buzzwords and fancy lingo, it's the bread and butter of selling to project managers. But there is a point where CoC breaks down at a technical level, and that point is _literally the first moment you come across something difficult to express_

Rails is weak in doing things ANY other way than the Rails way, and what developers do (and it's not their fault) is using their creativity and ingenuity to solve the problem. I believe this is why metaprogramming in Ruby has such a vocal backing, because there are millions of shims holding up millions of Rails' shitty choices that depend on method_missing fuckery or string-based define_method gadgets. In the spirit of what it means to solve hacker-ish problems, it's great fun to program like that for a while, and then a year or two down the line you look at that shit and it can really break you down. Good developers mistake themselves for bad developers because of this, to be honest.

Zed's probably had the idea to write an entire book of how insanely FUCKED Rails actually is, but to make the book plausibly thorough would mean a human being being exposed to far more stupidity than modern science can safely treat for. It'd be dangerous to have that much stupid intake just for a book.

That unicorn-worker-killer gem is a perfect caricature of the kinda problem- solving you run into with Rails. Let it die a horrible death, restart that shit with some logic to let it keep dying predictably.

That technique, multiplied by every component in the system, multiplied by every developer on the team, multiplied by MVC requiring developers to have to know too broadly the system they're working on, multiplied by however many years and Rails versions the project has somehow survived, you approach something I can only imagine is quite similar to what hell must be.

<comment><USER12> I love Rails for certain projects, but it's definitely true that at a certain point things start to break down. Maintaining a large complex application with Rails is not fun at all. ActiveRecord is amazing, until it's not.

IMO, you can still learn tons of great practices with Rails, and for certain projects I still think it's a great choice... But you have to know when to drop it and move on to more robust solutions.

Like most engineering tools, it makes certain tradeoffs, and you have to know how to pick the right one for your job.

<comment><USER13> At certain point everything starts to break down no matter the stack.

<comment><USER14> You're absolutely right, you're just completely ignoring context. Some things break down a lot sooner. Eating or drinking too much of anything can kill you, even water. But drinking acid will get you there a whole lot faster. Rails is the acid of the programming world.

</comment></comment></comment></comment></comment><comment><USER15> I feel they're making it harder to review a merge request with multiple commits. It used to be able to click on a commit and get succinct view of the actual commit with title and message. Now days after clicking on a commit, you have to scroll down and skip a lot of irrelevant information to find the actual commit content - and gitlab by default hides the commmit message! This makes it very cumbersome to review a MR with many commits, and also harder to train new developers to learn the advantages of making good commits.

Being able to review per commit in a merge request was a major reason for my company to choose gitlab back in the day. A merge request consists of a series of commits, each doing a single change (basically the same way linux's patch series works: [https://www.kernel.org/doc/html/v4.16/process/submitting- pat...](https://www.kernel.org/doc/html/v4.16/process/submitting- patches.html#separate-your-changes)).

I'm hoping gitlab will improve the experience in the future for us that want patch series style merge requests, but I'm worried that gerrit style development is winning where the result of each merge request is supposed to be just a single squashed commit.

<comment><USER16> Thanks for the feedback gorset. I'm curious to dig a little deeper.

With the irrelevant information, you mean the top part of the merge requests (ie description, CI status, etc)?

And as far as I can see, in the current version, we only hide the body part of the commit message.

I think we can make the experience better by autoscrolling down once you click on a commit in a merge request. I've made an issue [0].

I'm not sure about showing the full commit message. Many would argue that only the first line summary is crucial to show, which is what we do now. But I'm happy to discuss.

[0]: [https://gitlab.com/gitlab-org/gitlab- ce/issues/48328](https://gitlab.com/gitlab-org/gitlab-ce/issues/48328)

<comment><USER15> Thanks for the quick follow-up!

This might be a difference in expectations, where we are talking about two styles of merge requests. I believe they can be both supported well by gitlab (in fact, I consider gitlab to be the best review tool out there because it has support for both styles).

## Gerrit style MR

Mostly a merge request with a single commit. All relevant information is placed in MR title/description. If there are more than one commits, they are usually added to review the first commit based on review feedback or problems detected by CI. The commits are often squashed before merge to master, so the individual commit messages are secondary to the MR title/description.

## Patch series style MR

A merge requests with multiple commits, each containing a single logical change. The MR title/description only contains high level information/summary - more detailed description is found in the commits.

If serious problems are found either by CI or reviewer, the developer often amends the commits rather than push new commits on top. The reason why is that each commit should be as complete as possible, which helps reviewing, git bisect and keeping a good git log history.

This style requires more upfront work by the developer, but the advantage is that reviewing becomes easier. Instead of reviewing a large diff with many different changes, the reviewer can look at a single commit at a time. Some types of changes such as refactor, reformat can quickly be verified and reviewed because they are not making any semantics changes. A commit containing a bug fix is much quicker to review if there are no refactoring, reformating or other semantic changes in the same diff.

Good commits should also have good commit messages, which describes what, why and why like /this/. Just as important, this information should be easily available when reviewing the merge request. It should be easy to iterate through all the commits in a merge request, reviewing both the commit message and the commit diff for each commit.

With the latest changes of gitlab, I feel it's being optimized for Gerrit style merge requests, in which case your comment make sense that you're not sure about showing the full commit message. However, for me this is a major step back since we do patch series style merge requests where each commit is often reviewed individually.

<comment><USER16> Thanks gorset for the great response and the new insight you gave me into this. I now understand what you mean and see how the changes have negatively affect patch-series style MRs.

I created an issue on this and I encourage you to contribute there as well: [https://gitlab.com/gitlab-org/gitlab- ce/issues/48334](https://gitlab.com/gitlab-org/gitlab-ce/issues/48334)

We're not fans of adding additional configuration, but I can imagine we store e.g. what the last state was that you left commit message in, as to not have to unfold it every time. I'm sure you have further thoughts on improvements that can be made.

</comment></comment></comment></comment><comment><USER17> We've been paying for GitLab for about a year now, and it's mostly been a good experience. There have been three things that seem to come up weekly for us:

1\. Lack of traceability/auditability. We're in healthcare, and have a regulatory burden that requires versioning of basically everything. GitLab does this for code and wikis (thanks to git itself) but not for issues, merge requests, comments, etc. I've ended up building a service that just ingests the webhooks for these to store them away, which feels ridiculous. Since the webhooks for comments doesn't get triggered on update, I even have a TRIGGER shimmed into GitLab's postgres DB. Ech.

2\. There's no concept of a bot user, so every integration we want to do is against a single account/identity, in part because...

3\. The pricing of Ultimate feels ridiculous, and that's the only way to get something as fundamental as epics. $1000+ a year for every employee?

[edit] $1000/mo -> $1000/yr. (per month would have been even more way cray)

<comment><USER18> > $1000 a month for every employee?

Typo? Pricing page [1] lists it at $99/mo

[1] [https://about.gitlab.com/pricing/](https://about.gitlab.com/pricing/)

<comment><USER17> Thanks, edited!

</comment></comment></comment><comment><USER19> I haven't checked out v11 yet, but since it's not yet mentioned I assume the admin UX hasn't been addressed. Of all the tools I have admin on, Gitlab's admin UI (spread out across multiple sections) is perhaps the most sprawling and confusing. For example, there are two "repository" sections in each repo (one top level, one under settings) - in one you can perform repository admin such as branch management, and in another you can configure things like deploy keys. The groups/users/repo setup is another example of a clunky workflow - functional, but too many steps, and stitched together CRUD UIs. I get the feeling no product manager has sat down to address admin cohesively for a number of years, but rather that it has just grown organically.

My other big wish for the product is better CI. Gitlab certainly makes Travis unnecessary, but it doesn't scratch the surface of the functionality that Jenkins provides via the plugin ecosystem. Yes Jenkins is janky (although can be made to look nice enough via themes) - but Gitlab doesn't even address parsing xunit results and displaying trends in a project centric reporting location ([https://gitlab.com/gitlab-org/gitlab- ce/issues/17081](https://gitlab.com/gitlab-org/gitlab-ce/issues/17081)), instead steering you towards build centric "pages". Get the reporting built out (and also allow it to natively consume/parse/understand output from major testing & static analysis frameworks), and it would be a more compelling alternative. Nobody wants to look at hundreds or thousands of lines of build/test output - the CI tool should summarize the reasons for success or failure.

Finally, we're having to run our self-hosted Gitlab on an absurdly large EC2 instance (8 cores, 32GBs). Occasionally we'll have a dozen people converge on a single important PR for review, and before upgrading to our current server this type of event would often bring our instance to its knees. Language choice may be a significant contributor to this -- rewriting major parts of the backend in Go or some JVM language would probably be a good product goal.

<comment><USER20> You're right. The UX in GitLab's admin settings has lots of room for improvement. The good news here is that we now have a product manager devoted to this area, and have a number of improvements scheduled here that should help. A few I'm excited for that we're hoping to schedule for 11.2:

\- Splitting the admin settings into multiple sub-pages to make it easier to visually parse ([https://gitlab.com/gitlab-org/gitlab- ce/issues/44998](https://gitlab.com/gitlab-org/gitlab-ce/issues/44998))

\- Adding search for settings pages ([https://gitlab.com/gitlab-org/gitlab- ce/issues/41112](https://gitlab.com/gitlab-org/gitlab-ce/issues/41112))

\- Prioritizing content on settings pages ([https://gitlab.com/gitlab- org/gitlab-ce/issues/47405](https://gitlab.com/gitlab-org/gitlab- ce/issues/47405))

The UX team has an epic on these improvements ([https://gitlab.com/groups/gitlab- org/-/epics/203](https://gitlab.com/groups/gitlab-org/-/epics/203)), grateful for any feedback on specific issues. Thanks for pushing us here to improve.

<comment><USER19> Great! Thank you for the response. I'm glad to see the momentum you have.

<comment><USER21> Thank you for the feedback! Keep it coming as we improve the admin area :)

</comment></comment></comment></comment><comment><USER22> It might be interesting to someone that GitLab is not seem to be compliant with current European data regulations (GDPR), it is worth reading their terms and privacy statements [1][2]. E.g. even self hosted GitLab phones home in opt-out fashion.

 _GitLab collects information about usage from each self-hosted GitLab instance (Community Edition and Enterprise Edition) through a usage ping. The usage ping sends a payload containing data such as total number of projects and pipelines, as well as license information and hostname to GitLab._

...

 _The information from the usage ping is not anonymous, it is linked to the hostname of the instance_ [3]

...

The documentation is a merge request [4]

 _This MR loads the EE usage ping asynchronously on the admin application settings page and now includes the counts of the following items:

Comments Groups Users Projects Issues Labels CI builds Snippets Milestones Todos Pushes Merge requests Environments Triggers Deploy keys Pages Project Services Issue Boards CI Runners Deployments Geo Nodes LDAP Groups LDAP Keys LDAP Users LFS objects Protected branches Releases Remote mirrors Web hooks_

[1][https://about.gitlab.com/privacy/](https://about.gitlab.com/privacy/) [2][https://about.gitlab.com/terms/](https://about.gitlab.com/terms/) [3][https://docs.gitlab.com/ee/user/admin_area/settings/usage_st...](https://docs.gitlab.com/ee/user/admin_area/settings/usage_statistics.html) [4][https://gitlab.com/gitlab-org/gitlab- ee/merge_requests/735](https://gitlab.com/gitlab-org/gitlab- ee/merge_requests/735)

<comment><USER23> Remember that the GDPR only applies to personal data. That is defined rather broadly, but it still might not apply to all the information you've mentioned.

<comment><USER22> In the EU IP alone could be considered PII, it would seem logical that hostnames are too, but I never saw it spelled out. The counters are sent _in combination_ with these identifiers. The summary above is compiled from GitLabs own sources. Most probably don't care but some might.

<comment><USER24> > In the EU IP alone could be considered PII

that statement is wrong. first of all IP Addresses are __only __PII if you store them to identify users, means that if you are user table has an ip_address field, it is, however... if you store all ip 's accessing your service in a database to find malicious logins it isn't. so basically the statement is, it depends. the connection of user to ip makes it PII.

<comment><USER22> I think we agree context is important. However GitLab is collecting IPs in combination with hostnames, not to mention the rest of the traffic that could easily be used to fingerprint users.

</comment></comment></comment></comment></comment><comment><USER25> Is there any timeline for monorepo support? The ticket has been sitting in the backlog and every once and a while I get an email when someone bumps it. I with this feature got some love so service oriented architectues were more manageable

<comment><USER26> Can you link to the issue? We're working on multiple things that might help monorepos.

<comment><USER25> Hey sytse. This is the issue number [0]. There's a few people at the company I'm working at who have been pushing really hard to move away from GitLab to GitHub. One of their main issues, from what I can tell, stem from this issue and getting some integrated support for monorepos. I'm very glad you're working on the features monorepos require.

Aside from monorepos there is one other small issue I have with GitLab. GitLab is perfectly well situated to completely take over the software development planning, warehousing, deployment, and testing. Documentation is really the last front. If GitLab wikis were as powerful as Confluence I would be very happy because I'd never need to use that terrible bloated site ever again. I've been pushing for us to switch to GitLab wikis for a while but 2 coworkers keep saying that "it is not good for long-lived out-of-project documentation, it's not as searchable, you can't drag and drop for graphs, it's not as integrate, and it doesn't have as many features as Confluence".

I hope one day GitLab can be my one-stop-shop for everything.

Thank you very much for making such an amazing product.

[0] - [https://gitlab.com/gitlab-org/gitlab- ce/issues/18157](https://gitlab.com/gitlab-org/gitlab-ce/issues/18157)

<comment><USER26> Thanks for linking the issue. I'll discuss it with our product leaders.

Regarding the documentation we see many people switching to static websites generated with GitLab pages. This allows you to separate the change from the approval. Is this an option for you?

<comment><USER25> Personally I think that works and gives you all of the "edit-locally" benefits (Accessibility, hotkeys, versions, distributed/backed up etc). What that doesn't give you is a few other important features.

My coworkers are concerned with the following:

        - Highlight and right click docs -> new ticket
        - Drag and drop flow chart creation
        - Non-developers can document and plan
        - Full text search
        - "Name spaced"/grouped documentation
        - Third party integration

<comment><USER26> I agree that most of those are not in the wiki nor in GitLab pages.

For non developers you can make it easier to edit by linking the bottom of each page to the reposity. See our website or docs pages for an example of that.

</comment></comment></comment></comment></comment></comment><comment><USER27> When will it be possible to revert commits in non-master branches in the UI?

<comment><USER28> It already is? If I visit a single commit's page, in the Options drop-down on the top right-hand side I can click Revert, and a modal pops up asking me in which branch I want to revert that commit.

<comment><USER27> Yes there is that dropdown. But when you select your feature branch and click submit, some magic happens that does not do what you think it does.

<comment><USER28> Hmm, what magic is that? It appears to create a new branch with the revert, and create a merge request from that branch to the branch I select - which is what I expected. This is of course with "Start a new merge request with these changes" checked. When it's unchecked, I'd expect it to make the revert commit directly on that branch; is that not what happens?

</comment></comment></comment></comment><comment><USER29> linked merge requests would be my killer feature. VERY often we need to change multiple repositories at the same time. Like for example backend+frontend changes that's in different repositories. Having a linkage between them, that would make them be merged together would be awesome. And also prevent merge if one is "wip" or unresolved discussions etc...

<comment><USER20> We're working on this! We've wanted to explore this for some time; we're tentatively calling this a "super" MR and putting some design time into 11.2 to understand how this might work. Lots to think through here. Love to get your thoughts in the discussion so far: [https://gitlab.com/gitlab-org/gitlab- ee/issues/3427](https://gitlab.com/gitlab-org/gitlab-ee/issues/3427)

<comment><USER29> Cool stuff, way more advanced than I thought of. I don't have an account but might create one, on phone right now. But I drop my 2 cents here. I rather see a free version with a simple relationship between MRs. Basically;

      If linked_mr:
        print "warning, merging this will also merge:" + linked_mr

      ...

      Function merge()
        ...
        if linked_mr:
          merge(linked_mr)

Then building a more advanced version for EE.

</comment></comment></comment><comment><USER30> Another attempt at centralizing our data (+). It may be a great piece of software (or not, I don't know), but no thanks.

(+) by data I don't mean the repo itself, but all the data around it (issues, project management stuff, etc).

<comment><USER31> What's wrong with having the issues, project management stuff, CI, etc in one place, as long as you control that place?

<comment><USER32> and as long as you are not forced to is the built-ins if you prefer (or are otherwise already committed/constrained to) something else.

</comment></comment></comment><comment><USER33> Still can't upload more than one file at a time using the web interface.

</comment><comment><USER34> I can never tell what the HN community thinks of GitLab.

Either the entire thread is loves it (for the most part), or the entire thread hates it (for the most part).

 _shrugs_

<comment><USER35> Can you link to a time where the majority of a thread has hated on Gitlab? Maybe the one where they don't pay too much and have a scale based on location, but I might be forgetting the ratio of hating and that wasn't a topic relevant to Gitlab as a software project.

Otherwise it's usually at least some or majority love for Gitlab on HN.

<comment><USER34> I felt like this thread is way more negative than the others.

Most of the time, it is all love.

</comment></comment></comment><comment><USER36> If you are using the Omnibus package on Ubuntu, don't upgrade! It just broke my instance. and can't find out what's wrong. Great features... It was a big mistake to trust GitLab, I already predicted they will have problems.

<comment><USER16> What is the output you get? Consider creating an issue here so we can help you debug: [https://gitlab.com/gitlab-org/omnibus- gitlab/issues](https://gitlab.com/gitlab-org/omnibus-gitlab/issues)

<comment><USER36> Here we go: [https://gitlab.com/gitlab-org/omnibus- gitlab/issues/3615](https://gitlab.com/gitlab-org/omnibus-gitlab/issues/3615)</comment></comment></comment>


Ask HN: What are your arguments in favor of end-to-end encryption? - <AUTHOR> Also, how do you respond when someone brings up concerns of E2EE platforms being used for child sexual abuse imagery or terrorism?<p>Keep in mind that these arguments have to be made to laypersons, who don't usually have a lot of technical knowledge. <comment><USER2> My first argument, is: Fourth Amendment of the U.S. Constitution.

This may help explain some reasons: [https://www.amnestyusa.org/reports/encryption-a-matter-of- hu...](https://www.amnestyusa.org/reports/encryption-a-matter-of-human- rights/)

"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." \-- Benjamin Franklin

</comment><comment><USER3> You cannot defend what you cannot precisely define and threat model. Non- secure platforms cannot be defended nor threat modeled. If you send a military/intelligence critical message to someone then you need E2E encryption. In order to asses correctness you need more people to buy in than those only backing military applications. This is found in technologies like TOR which wouldn't be effective it couldn't be used by non-military agents. If there is no need to include the greater community, than there is no pressure on sponsored developers to pursue mathematical correctness.

</comment><comment><USER4> The very same way I argument against massive surveillance: my country was founded like many other countries by people who rebelled against the oppressor, organised in secret and acted by means of force.

Without those people, I wouldn't be a free citizen today.

Massive surveillance can neutralise every possibility of fighting against oppression and defend liberty.

While I acknowledge that there are bad actors that abuse this freedom, I think it's still worth it.

</comment><comment><USER5> Double submission: [https://news.ycombinator.com/item?id=21156664](https://news.ycombinator.com/item?id=21156664) (3 hours ago with 71 points when this comment is posted).

</comment><comment><USER6> I tell them I don't care. If they bring up terrorism or child porn, they aren't going to respond to facts. They've already been terrorized into believing that the existing surveillance regime is justified.

</comment><comment><USER7> You're being watched, monitored, studied, exploited already.

[https://m.youtube.com/watch?v=tabVaoeNtdk](https://m.youtube.com/watch?v=tabVaoeNtdk)

That's why.</comment>


The kernel connection multiplexer - <AUTHOR> http://lwn.net/Articles/657999/ <comment><USER2> Like a lot of the comments on LWN, I'm having a hard time understanding why this should go in the kernel, instead of just being a simple userspace library. There doesn't even seem to be a performance argument for it, since any userspace library can use iovecs to combine headers and messages to avoid multiple system calls.

<comment><USER3> At a glance, it seems like delivering a message to one of a pool of waiting processes would be difficult to do in a library. If the process reads a large swath of data it may get multiple messages and a fragment. If it reads a fraction of a message then another process might steal the next few bytes. You'd either end up with a reader lock and small reads to not read past the first message, or introducing a demuxing process and doubling your work.

In the single process case there is also a potential performance win by not waking processes to deliver a partial message only to have the process block awaiting the rest.

</comment></comment><comment><USER4> That sounds way over-engineered: Custom protocol-aware BPFs... why???

Why not just use the TCP "push" flag that is added exactly once per application-level message on sender side; and on receiver side, buffer in- kernel until "push" is encountered?</comment>