skysight-inc/HackerNews huggingface dataset:
> Firefox DoH is snake oil, plain and simple...

Correct me if I'm wrong, but the concern I have about browser-controlled DoH is that it seems like it could make it harder for a tech-savvy user to assert control over their own network. IIRC, most network-level ad-blocking operates at the DNS level. I've also personally blocked telemetry by setting my router's DNS proxy to resolve certain telemetry servers to 0.0.0.0. It's my understanding that DoH would bypass that. Couple that with Google's planned neutering of Chrome's ad-blocking API, and it seems like it will become increasingly hard for end-users to avoid ads.

And the fact that DoH uses HTTP seems like it would make it impractical to block as a protocol.

I think I would have preferred an encrypted DNS protocol that ran on its own port, at least.
That's the point though. The New Yorker (and the memeplex it's a part of) wasn't publishing hysterical articles about advertising's abuse of emotional appeal during the heyday of Madison Avenue, and randomly throwing an extra dimension of targeting by limiting one's concern to when tech does it doesn't make any sense.

It's not enough to say "just because A did it doesn't mean B can" without 1) addressing why the calls for cessation are narrowly targeted at B and 2) understanding why A was never successfully made to stop. 2 can help you understand the pitfalls of what you're trying to do ("manipulating emotions" is a ridiculously ill-defined phrase), and 1 can help you understand whether you're chasing after a red herring instead of what you're actually concerned about.

To use your own framing: perhaps if you'd spent 5 minutes thinking about it instead of 2, you'd realize these dimensions exist and are valid bases for complaint.
I'm not against DOH but there are definitely some downsides. For example, your token does not get reset on network changes. This means your DNS provider can track your DNS requests across networks, including VPNs.

With normal DNS anyone in the request chain can see a stream of DNS requests but there is no context. By the time the request is one or two hops from you it will be interwoven with tens of thousands of other requests making it impossible to know which one came from who.

With DOH the DNS provider will have a unique identifier to correlate requests back to a specific system/user. Google offers one of the most used DNS services, with DOH they will be able to track all DNS requests you make even if you turn on a VPN.
We used J-Link with a J-Flash SPI license. https://www.segger.com/products/debug-probes/j-link/tools/j-...

Any SPI flash programmer should work though. The protocol is simple enough that you could even implement it with an arduino if you really needed too.
>Formerly your browser still "phoned home" to your default DNS provider, using an insecure protocol.

This is kinda painful to read, to the point where I'm not sure if it's intentionally misleading;

DHCP will give you a DNS config, that DNS server can be local, remote, it can support DNSSEC or DNS over TLS (yes, that's a thing[0]). I even have configurations where a local DNS resolver on my machine (DNSMasq/unbound) would query _different_ recursive resolvers based on the domain I'm requesting.

DoH takes away huge amounts of configuration, and the ability to locally host DNS and ensures that a central body gets your DNS requests. The only "opt-out" in the current system is not using DNS at all, which is still an option. (NETBIOS/mDNS/Hosts)

[0]: https://developers.google.com/speed/public-dns/docs/dns-over...
The article's usage seems to drift around somewhat, but in esports I follow "meta" refers specifically to the consensus about which strategies are good or bad, not to strategies themselves or to anything someone does in a given game.

E.g. saying "foo is meta right now" means most players consider foo to be stronger than the alternatives, and if a player uses a strategy other than foo one might say they were playing off-meta, etc. But the term is wholly distinct from strategy itself.
Yep, it's an accessibility argument. If ~7.5% of the population is unbanked, they aren't using a smartphone to pay.
I have some unusual, from the normal browser user perspective, DNS stuff and this just leads to a bunch of questions.

My gateway has a bunch of static DNS entries for internal hosts, which are all in a fake top-level domain. How will resolving these work if the request goes to CloudFlare? CloudFlare obviously doesn't know about my internal domain. Currently my gateway resolves what it knows about and uses my ISP's DNS to resolve what it doesn't.

Pi-Hole is presents a similar problem.

Finally, if DoH is the future, how do I run my own DoH server which can resolve internal hosts? Does such software even exist yet? How do I point Firefox at this DoH server? The relevant Wikipedia article[0] points to a list of public DoH servers I can use, but offers no insight as to what software I'd use to run one for my own use.

[0] https://en.wikipedia.org/wiki/DNS_over_HTTPS
You'll excuse me if I don't take this very seriously given that on previous threads people have --- not making this up --- made cases for logout CSRFs having high value on the black market. After all: the competitors to the vulnerable service could have used logout CSRFs to drive customers away!

Vulnerabilities are worth money in markets when they fit into pre-existing business/operational models. That's why clientside RCE in popular clients is valuable: multiple competing buyers have whole operational frameworks where new RCEs are drop-in compatible. Nobody speculatively builds new business models around the prospect of a random serverside vulnerability.

Maybe a vulnerability like this has value --- we don't know what it is, or how much interaction is required, or how quickly it could have been killed --- if it directly produces cash every time it's applied. But that's still a maybe for a serverside vulnerability with a half-life of epsilon.

Meanwhile: $4400 is a strong bounty for a serverside logic vulnerability. Serious vulnerabilities like stored XSS have bounty values in the hundreds of dollars despite the fact that people on HN seem to think they're worth 6 figures on some hypothetical black market.

I have no opinion about how Paypal handled this vulnerability after paying up for it; I'm exclusively interested in how this story intersects with yesterday's Paypal thread, which was a shitshow.
I just use it when abroad (my high street bank FX is terrible) so I might be one of those casual customers. The crypto and "premium" features don't interest me in the slightest.

I might be just outside the millennial target market though.
Note that elastic has an offering called "Enterprise Search".
So any Tetris 99 training suggestions?
How likely is it that the other browsers will eventually do this?
Sure. Humans are also naturally violent. We naturally get tuberculosis, too. As conscious beings, it's up to us to decide the good and bad in our natural heritage. To amplify the former and mitigate the latter.
The background made me think Flux turned on spontaneously.
If you wanted to read more on the same/expanded topic, I thought this book was pretty good.

Ghost Hunters: William James and the Search for Scientific Proof of Life After Death, by Deborah Blum.

https://www.penguinrandomhouse.com/books/292812/ghost-hunter...
Five-Way Fight for Army’s Future Scout
I read it here on HN coincidentally but I couldnt remember by who, but I felt way better later on that day. I think the best I can do is force myself to sleep though. I'll watch shows on Netflix till my eyes start to shut down nowadays.
Find a few 'influencer' types who are popular at the school. Get them to sell your app by either paying them as an advertiser or tell them for each student they get on the app you will give them x amount of money.

Let them work for you!
Yeah, as in literally Romanian Gangsters.

The irony of this troll's stance is that he's parroting the 'woke slogan spewing twitter user' he's so critical of.

And yes, I did just assume troll's gender.

.

I really should know better than to engage with trolls, but I did find it amusing how keenly he's shooting himself in his feet.
I never use the back button at the top left. I just use it as a visual indicator that you can go back.

Since almost every app on iOS supports swipe to go back, I use that. It's crazy to me that people don't use this...
By "comparatively well" you mean defeated in bulk by deploying sampled netflow with a couple lines of router configuration-- which almost all major ISPs already have deployed for monitoring purposes.
You could do what most people do and have a day job with a long commute :D

Only half joking, it definitely works for waking you up in the morning (unless you like being fired) and going to sleep earlier (because you're tired).

You will likely feel tired until 11am-1pm or all day, but you'll be "normal" in other people's eyes... yay /s
> Waking up early does have a practical advantage: your free time is before you go to work, so then you have energy to do important things.

This doesn't make any sense to me. I have zero energy or drive in the morning, it's a struggle to do anything. My brain turns on at about 11am - I can be active before that, but serious creative work or figuring out something that requires mental effort is going to be much less effective than if I waited until later in the day.

It doesn't even really matter when I wake up. I can wake up at 6am and be a zombie for 5 hours, or wake up at 10:30am, shower, and be ready to go for the day. Sufficient application of caffeine helps a bit if I need to be fully on before that, but the quantity necessary to do so is not sustainable.
The only problem with total transparency is the American public is not ready to face its own driving record. A really large fraction of drivers _should_ _be_ uninsurable, including the 20% of American adults with a history of DUIs, anyone over 70, etc.
> ... after having done a lot of React development recently ... All this prompted me to finally give react-native a try. In under 15 minutes I had a working example.

The fact that you, a React developer with lots of experience with React were able to come up to speed vastly quicker on React Native shouldn't be surprising, that's a feature of the platform. You are the exact sort of person React Native was designed to make productive.

Of course you struggled, to pick up Swift UI, you needed to learn a new, vastly different language, and a new DSL that sits atop that language.

Even with good documentation and years of community expertise built up, this would have been an uphill comparison, but SwiftUI is relatively new—essentially in beta—there is very community around it and as you noticed, very little documentation... all of these last issues are pretty well known. All of them take time to overcome.

I'm not sure if SwiftUI is going to be the next big thing or not, but your comparison is a bit lopsided here.
I'm sure some of the support was by people who genuinely believed the lies they were told, but they were lies, and they were told intentionally.
> Think about it: a Firefox DoH user could get different DNS answers than other apps get on the same machine using standard DNS on port 53, if Google or Cloudflare wanted to, because they’re essentially talking to different versions of the internet.

How is that different than existing DNS servers?
Didn't we all at some point :)
Offhand, recently I've used NumPy, telnetlib, openpyxl, TkInter. I haven't used Lisp for a very long time, because of my (perhaps faulty) perception that some of these things (and the next one I will need) might not be there, or might be less usable than their Python counterparts.
It's a balance. Do you want your plaintext DNS request sent to starbucks or your local unsecured public wifi, or do you want it sent encrypted to your DoH server of choice?
It could but Rust already solves the issues this is aiming to solve but with fewer steps. I don't know what Mozilla's policy is on adding Rust vs C++ for new features.
I don't think this is going to put a dent in cases of existing copyright holders making claims against people coming up with similar sounding works.

Firstly, there's an enormous corpus of music out there that precedes this effort, and those copyright holders can still make claims.

Secondly, and perhaps more importantly, how would someone prove that a musician copied the work from this algorithmically generated collection? These haven't been number one hits or in widely available collections. Someone could not conceivably argue that a musician derived their work from this due to familiarity with the melody.

I wish the copyright problem would go away. But I really don't see this as a solution.

A large number of musicians and software designers need to collaborate on a project that is much more permissive with regard to sampling, covers, arrangements, adaptions, etc, all the while preserving the rights of songwriters who just happen to write a number one hit song to get paid for their work.

The whole thing needs to be lucrative enough that composers, performers and the tech companies involved can afford to flip the middle finger to anyone exhibiting corporate greed.
I worked with quite a few overseas developers over the last decade.

In our case we worked with two outsourcing firms in Russia, EPAM and Distillery. Our relationship worked very well but we had to approach it correctly.

In our case we treated the outsourcing firms mostly as recruiting firms. They pre-screened candidates and then we interviewed them just as if we were interviewing and on-site employee.

Now, people are people and are imperfect, But the reality was that from both EPAM and Distillery, The candidates that they brought to us were always the highest quality. Something about how they work internally makes it a lot easier to hire through them instead of the normal American way of hiring a software developer.

One more thing: I was part of the team that chose EPAM over some of the other contracting firms. we basically interviewed one of their engineers as if he was going to be a new hire, and we did the same for other firms. The reason why our relationship was so successful was because we we're methodical and carefully chose who we used for outsourcing.

IMO, most of the complaints about outsourcing come from people who didn't screen their contractors very well.
> I cannot control what domains are being looked up by devices and applications on my network.

This is kinda the point. For devices you own you have that control by the virtue of being the device admin. Other people's devices are a different story. You are free to have an acceptable use policy on your own network and require traffic to flow through a proxy or whatever but if you do it without their knowledge or consent you're the bad guy.

How pissed would you be if Xfinity just up and blocked random sites like this?

(sibebar: Just from a politeness perspective why would you give your guests anything other than a clean path to the public internet ?)

> That's like saying that me stopping guests taking photos of my daily activities

Having a rule that applies to your guests -- totally cool. Silently disabling their camera without their consent once they come through your door -- not cool.

> Am I a malicious network operator for stopping that garbage being sent off?

I mean you're modifying the traffic coming off of someone else's device without their knowledge or consent. I would be pissed if by husband did something like this without asking -- leaving me to debug why some sites are mysteriously broken.
Fantastic discussion, may I throw another title into the mix here: John Dewey's The Quest for Certainty. The book carves up the idea that math is such a thing into a thousand pieces, classing the inclination to believe it so as the same repressive drive that gave us religion. Because we were so unwilling to bear the pain of doubt. (Voltaire: 'Doubt is painful, certainty ridiculous.')
Marketers using hardcoded private servers are the easiest thing to defend against: just block those servers. That fact is one of the big reasons why marketers and other spies don't do that -- they use DNS lookups to find the mother ship.

However, now marketers can use DoH, combined with public servers that would cause disruption to block, to be able to engage in lookups without a means of detecting or blocking them short of doing a MITM setup.

> do you actually do that on your network right now?

Yes, I installed it months ago to defend myself against DoH. I MITM all HTTPS connections, detect DoH lookups, and block them.
Yes, sorry if I wasn't clear, I think the idea that DoH is just as filterable as DoT is silly.
Pretty much. I'll wake up because I need to go to work. But I'm always tired :/

Sometimes I wish I could work nights, but I did work from home like that and sleeping during the day is also pretty bad. Especially during winter, not seeing much daylight can mess you up.

Going to sleep at 2-3am and waking up at 10-11am seems like it would be great.
You Can Securitize People Now
You posted all that, and didn't link to any audio of what you made? Come on, man, we can never have enough DX-7.
Funny, we all thought computers were fast. Turns out its nowhere what we need.
ISPs can and do sell your information, and can also be served a warrant or NSL. Cloudflare, by contract, is prohibited from doing the former, which is a net improvement even if they're still subject to the latter.

It's an incremental improvement, but a positive one.

I would certainly love to see an even better protocol for Internet name resolution that prevents anyone from having name-lookup information, but in the meantime, DoH seems like a huge step forward in ensuring that no unencrypted traffic is visible to the ISP or local network.
MIDI has the limitation of only having a maximum of 7 bit resolution of continuous control of a parameter.

Not only that, but it's not trivial to combine with DAWs because of jitter.
I was, and still am, a night owl - if there are no constraints.

However, there often are constraints that require me to be up earlier (yes, a kid is among them), and I found the following helps maintain reasonable focus and relative ease of waking up early:

1. About 10,000 IU of vitamin D (at 190lbs), taken before 10am - as a replacement for significant sun exposure which I don’t have. This is significantly higher than the RDA, though still below the toxic levels (50,000 IU/day or so at my weight). The timing is important - vitamin D is apparently part of the body’s sunlight clock PLL. Gwern has some n=1 experiments and references.

2. Sufficient protein intake (between 0.5gr and 1gr per lbs of body weight - low end for sedantry, high end for very active). Don’t know the mechanism - discovered by trial and error - but makes a huge difference for me. If I don’t have enough protein, I can’t fall asleep before 3am regardless of how tired I am. (Well, except when I do a multi day fast and everything goes berserk, but that’s for another post).

Even with those, at times I am not constrained I will naturally nightowl.

Don’t trust me. Do your own research and n=1 experiments.
Very likely. IIRC, it's working its way into Chromium, and once it's there it will be everywhere.

https://www.chromium.org/developers/dns-over-https
Jif peanut butter weighs in on GIF pronunciation debate
That's one thing, sure, but that doesn't affect the majority of sites. CF's DNS POPs are likely more dense than the great majority of service providers POPs. So using the subnet of the resolver is about as good (if not better) than having ECS info for practical purposes. (Because the client is normally going to hit the closest DNS POP to them in BGP network distance.)

I'm not a CF fanboi, in fact I think they are evil. But let's not make weak arguments. That said, yeah suppression of ECS info is a deliberate anti-competitive choice by CF. They probably have convinced themselves its about privacy, but it isn't.

The real benefit to them is, as the CDN, they get the benefit of even lower latency and even better control. With a penalty to everyone else.

It's a disgusting arrangement, and a net loss in privacy. Your ISP already knows what websites you visit, they don't need the DNS because they see the actual traffic.

I'd find it more palatable if these so-called TRR providers were required to be DNS-only. Maybe DNS + registrar.
Intercepting HTTPS is possible, but not easy. It just requires configuring your browser to use a known key pair for client authentication so that you can MITM yourself from a local or network proxy.

On the consideration of trade-offs, I think HTTPS-Everywhere is completely worth it. It may be more complex to intercept your own traffic, but since you are in control of one of the endpoints and the ISPs (which in the US are openly trying to market your browsing data) are not, I still consider it an overall win for privacy.
How does this work with hosts that are not resolvable outside your own network? If I tell firefox to go to internalsite.mycompany.com - which resolves internally, but not outside our network - how is firefox going to resolve it, if it's not using our DNS servers?
This seems to use this: https://cloudvyzor.com/downloads.html
Is it only on Windows?
Even iOS programming communities will admit you're brave for using SwiftUI right now. It's brand new, has a lot of issues like being completely unable to show you a coherent type-error message (like if you have an error inside a ForEach view).

It's just cutting edge tech.
He didn't single them out. He mentioned actually mentioned drug addicts first (which are most likely English) and then the Romanian Gangstars. I would imagine they either stood out in his mind or he happened to be in the same wing of the prison. If I met a Romanian Gangstar it would definitely stand out in my mind.

Also labelling criminals from Romania as Romanian is simply a statement of fact. If they were Japanese Yakuza or Chinese Triads I would expect him to call them Japanese and Chinese respectively.
What's wrong with hierarchies?
That's actually about a different sleep book, Why We Sleep
If you use the nextdns DoH provider in Firefox you can actually configure your own adblocking domains even when you're moving around across networks. Just FYI
The neighborhood listserv often enough has pictures of people stealing from porches or cars. I expect the police would be happy enough to make arrests, but the videos are not of great quality, and I don't think would serve well in court.
The business model already exists: order videogame consoles or luxury purses or some other high-value good that is easily fungible with cash (Craigslist) and then either porch pirate the package when it arrives, or if you're brazen enough just order it right to yourself.

This is something that is routinely done already with credit card fraud. This is how thieves "cash out" the cards they steal with skimmers at gas pumps and stores.

The angle here is that they no longer need to steal your digits with a skimmer, they can just use your contactless payment wallet, because Paypal didn't lock them down properly. Or so the researchers allege (they don't give the exact details of the vuln for obvious reasons).
> Tunneling the analog control signal into digital packets would be easy

Yeah, but at that point, you're already giving up the "analog purity" that analog synth fans love so much. Might as well just use midi; and then you might as well just use soft-synths; and then you might as well just use Propellerhead Reason, so you can have all the flexibility of gate/CV fully virtualized.
We had recent migration from AWS to Hetzner. We used combined clusters with ondemand + spot instances. After migration to Hetzner we doubled capacity and still saved around half. AWS is very good for flexible work loads, but if load and process is constant and well defined, bare metal hosting much more effective. And there are a lot of well known bare metal hosting providers on the market.
Lessons Learned from Running Debezium with PostgreSQL on Amazon RDS