▲ 75 points
back
60 comments
> I am a completely blind back-end programmer
So not only does he have to deal with the ridiculously hostile environment being a programmer in Iran. He's also blind. That truly gives some perspective on things.
Haha yes. Though being a blind programmer is not that bad; being in Iran is why I am trying to find a job in another country and relocate.
I sincerely wish you the best of luck!
His blog is exceptionally clean.
I don't know if that should be expected (cruft would be harder for assistive devices to read) or unexpected (he can't see; how can he keep it clean?)
I had a colleague build my blog for me. I love his work because he created a clean theme, and it's very easy for me to navigate. I hadn't thought that it'd also be easier to read for sighted people. That's great to know!
It boils my blood when a harmless fellow developer faces trouble due to political mess created by dumb people.
Have to piggy-back off this and wish the guy best of luck in his endeavors. It's moments like these you understand that most of your problems are meaningless compared to what other people face.
Isn't that so very true.
Thank you a lot for your well wishes.
I don't think it's that simple.
Let's perform a gedankenexperiment. There is a country A that "misbehaves" — e.g. threatens its neighbourhoods and promises to hit them with nuclear weapons ASAP (in other words, promises nuclear offense). Quick note: in this context "country A" means "government of country A". There is also a country (or an alliance) B that is overwhelmingly more wealthy than A, has more military might and political power. What do you think B should do? Here are the options:
1) ignore A until it directly threatens B;
2) use B's military, crush A's government, help A's people to rebuild the country;
3) apply political and economical pressure to A, which in practice means "make A citizens' life miserable so they deal with A's government themselves". It's sometimes possible to apply the pressure selectively (e.g. to A's elites).
I agree with you that it's a morally ambivalent situation. However, I strongly believe that an embargo (including "digital" one) causes less casualties than "boots on the ground". Moreover, democracies don't fight each other, so in this scenario A is (most likely) a dictatorship. Dictatorships are bad and I believe that wealthy countries should care about long-term wellbeing of citizens of other countries, at least for their own self-interest. Your opinions may differ, but it would be wrong to brush off the whole issue with "political mess created by dumb people".
As someone growing up in a country that was under an embargo (born in '75 in Yugoslavia, spent my teenage years in 90's Serbia, under Milošević rule) and having seen it firsthand I can tell you that it never hits the ruling class and politicians - it only hits the common people - the more poorer you are the more you will feel it. Politicians and the rich people around them find the way to bypass it.
During those times my both parents were having small private firms and were trying to make end's meet which were difficult enough with the collapsing economy and inflation and having no political connections with the ruling class (they despised the serbian nationalism and were being active in the then-opposition parties) sure didn't help them.
The one occasion I will never forget is when my parents decided to go to Hungary to try to buy some glazes for my mother's pottery shop. They would've bought some 20-30 kilos, smuggled it in our car and that would've been enough for a next few months. When the shopkeeper in the Hungary heard they are from Serbia he decided that he wouldn't want to sell them anything because "embargo and war and stuff" and so my parents came home empty handed. They came to the shop as private individuals and must have mentioned briefly where they would be taking the merchandise (they both spoke hungarian) but the shopkeeper kept looking at them as if they were personally responsible for all the things that were going in the Bosnia at the time. We didn't have to close the shop, a few weeks later they found another supplier and bought from there but it really left a bitter taste in their mouths.
(shameless plug: this is now my brother's pottery shop who inherited it from our mother who passed away 6 years ago, this is a small promo video he did some time ago)
> democracies don't fight each other
The US & UK overthrew Iran's parliamentary democracy, and installed the Shah. (https://en.wikipedia.org/wiki/1953_Iranian_coup_d'%C3%A9tat)
The US is the world's most hyperviolent bully. (Just compare its capacity and use of violence to any other entity.) Bullies generally don't admit they're bullies, despite all evidence, and swear they're justified when smashing their victims.
I think the relevant question is whether embargoes accomplish the goal of making the citizens deal with their government. It could be that they're actually counterproductive (for example, it's often said that mutual trade increases the costs of a war, by making countries dependent on each other for resources).
If embargoes are pursued after decades with no evidence that they are beneficial, then calling them "dumb" is not so unjustified.
'Censorship' is the wrong word: Docker isn't censoring information, but rather refusing to do business with Syria, Cuba, North Korea & Iran. I expected this article to be about Docker censoring items it serves.
Yes. I'm sorry for the confusing title. This has been pointed out to me and I agree. The reason it hasn't been changed is because it would change the permalink.
Sorry for not giving you the information you were looking for.
Censorship sounds like an inadequate term here.
Agree.
Digital embargo is more appropriate IMHO.
Great suggestion. I'm debating whether to actually change it, but it'd end up not matching the permalink. Hmm.
Isn't this to comply with US law? Why blame Docker for that?
I apologize. The article title has created a misunderstanding for a lot of people. I'm not blaming Docker in the article content (as quoted by others).
From the article:
> You shouldn’t really hate them (Docker) because they are doing what they have to do.
He didn't blame docker
The title is 'Docker's censorship', which is misleading. It's not Docker's censorship, it's US state censorship.
Can someone not get in touch with this gentleman and just offer him a job already? Beyond his obvious technical knowledge and analytical approach to things, read through the comments here and you'll see a person who is levelheaded, humble, and seems genuinely happy to foster discussion with likeminded people. I wish I were a hiring manager at my company, but someone out there has to be. Snap this guy up before someone else does.
Sure, but does he want to emigrate and do you want to go to the trouble of getting him a visa?
> Sure, but does he want to emigrate?
I'd love to. This is a dream that I'm striving for.
> do you want to go to the trouble of getting him a visa?
Now, that'd be a tough one for anyone to answer.
Yeah, I very carefully didn't assume that he wanted to emigrate to the west to "enrich his life" or rescue him from blah blah White Man's Burden. He mentioned that (paraphrasing) he was trying to better himself in emerging technologies so he could get a job abroad.
And as someone in Austin who has seen how insanely hard it is to find a good culture fit despite a large pool of "talent," yes, I'd jump through hoops to find someone as humble and self-motivated. Unfortunately, I'm just not in a position to do so at my current place.
And then the company that does hire him will be vilified here for hiring H1B workers.
Erm, "someone out there has to be" in a position to hire him. I realize that it sounds like I meant that someone on HN was a hiring manager at my company. More coffee before commenting next time.
I've been using Freedome[0] for a few months now and I am really liking it. While I don't use it to escape censorship and digital embargos it's adequate for such purposes too. You can pick from exit IPs all over the world and easily switch it.
I run all my traffic through Finland usually because they have fairly strong data protection laws, especially compared to the UK where I live.
It's also a nice way to get around traffic shaping and other invasive measures from your ISP. During peak hours I have better speeds for Netflix and the likes through Finland than without VPN.
Wow, so many awesome software. You'd think that as someone who has used VPNs since the day he first connected to the Internet, I'd know all about these things! :-)
Thanks a lot! I'll definitely try this one out!
I have found using ShadowSocks [0] to work best for me here in China. VPNs create one connection for all traffic (which is easier for China's GFW to detect/block/slow down). ShadowSocks creates a new TCP/UDP connection for each connection that it proxies.
My setup:
Cheap VPS server in Hong Kong [1] (5USD/month, 512 RAM, 2Mbit port) running the ShadowSocks server (libev version). I have upgrade the port to 20Mbits for an extra 10USD/month. The port could be upgrade to 50Mbits for 25USD/month.
For DNS I use ChinaDNS [2] to automatically filter out bad DNS results from China's censorship. It works by sending DNS queries to all multiple DNS server at the same time (give it a few local DNS servers and foreign DNS servers). The foreign DNS connections are tunneled through ShadowSocks.
ShadowSocks can work as a Socks5 proxy, tunnel or transparent proxy [3]. Socks5 is the easiest to use and can even do DNS lookups on the server. I use the transparent proxy [3] option, since it allows selecting which traffic should go over the proxy.
The socks5 option will try to proxy localhost & lan conections to the proxy server.
An optimized list of subnets can be generated using bestroutetb [4]. I load the subnets for China (can private LAN) into an ipset hash and use iptables rules to exclude those subnets from going over the proxy.
ChinaDNS [2] and bestroutetb [4] could be used for VPNs too. This could be used when trying to access different services (US, UK, etc..) that don't allow access from outside their country. Use one VPN for US and another for UK, then use bestroutetb [4] to build subnet lists for each country route traffic over the correct VPN.
2. https://github.com/shadowsocks/ChinaDNS
3. https://github.com/shadowsocks/shadowsocks-libev/blob/master...
4. https://github.com/ashi009/bestroutetb
edit: fix formatting and port prices.
As someone who is pretty much oblivious to how the censorship works in China: Why do you use such a slow and expensive VPS, and why Hong Kong?
I'll take my best shot at guessing his answers. The Great Firewall employs many techniques for censorship. The simplest block sites and poison your dns cache. Http packets are inspected to deterministically decide whether are block a connection.
Https is an improvement, but they still use machine learning to make estimates on encrypted contents of packets. If packets going to and from a location (i.e. Your vpn server) meet some criteria with some confidence, they perform attacks on that connection and subsequent connections To the same endpoint. I'm not sure on the specifics, but these attacks will cause ~90% of that connection's traffic to drop. The system is dynamic, so your countermeasures have to be as well.
I'm guessing HK because it's physically and politically close. It's considered Chinese territory, but not under China's GFW. I've heard from friends that GFW censorship is more aggressive around sensitive times (i.e. Tiananmen square anniversary) and news.
If any of this is wrong or inaccurate, someone please correct me. I'd love to have a better mental model of the GFW so that I could better work remotely from there.
I don't need a lot of server resources for the proxy. So the cheapest server is more then enough. The real issue is getting good latency & bandwidth to sites outside of China.
What I am paying for good latency & bandwidth on that server is cheap compared to other providers.
Hong Kong is very close to me (Guangzhou), so latency is low (around 9-10ms).
Here is the latency I am seeing right now:
1. Ping to DigitalOcean VPS server in San Franciso: 270ms
2. Ping to 36cloud.com VPS server: 10ms
3. Ping from 36cloud VPS to DigitalOcean VPS: 160ms
4. Proxy running on DigitalOcean VPS server in San Franciso: 274ms, DL: 3Mbits, UL: 4Mbits
5. Proxy running on 36cloud.com VPS server: 178ms, DL: 8Mbits, UL: 5Mbits
The last two are from using speedtest.net with the same speedtest server in SF. So the VPS in HK save me almost 100ms of latency. which greatly improves browsing speed.
I generally use VPN Gate [1] for all my IP-spoofing needs. The actual VPN servers are hosted by volunteers around the world.
The client and server software VPN Gate uses is the open source SoftEther VPN [2], which I also use to host and connect to my own VPN. It's pretty great.
Awesome, thanks! I'll definitely try these out!
If you're up for going the VPS route, there's an awesome project called Streisand on github that automates the entire process that sets up the server with multiple VPN protocols as well as TOR bridges:
https://github.com/jlund/streisand
Good luck!
I did this because I live in another country where the U.S. has sanctioned me from seeing a variety of things I could pay for if I lived in the U.S. - Australia. I'm just not under a regime that will kill you if they catch you...
Works great for websites, but can SOCKS5 transparently redirect DNS traffic? In the end I setup an OpenVPN server and setup port redirecting for DNS.
Well, I'm not doing anything political, so no one will catch me and kill me. I'm using it for exactly the same reasons as you, namely that the United States won't let me view some content, listen to some music and stuff. Even though I have to pay illegally to access this content (which is when I use my Canadian IP), I still am paying for them and must be able to use them.
How do you pay? Credit cards are normally issued from a geographic region and you need ID to get one in another country due to AML measures...
> A few days ago I got a call from a lady that is studying her Masters degree in computer science (can you believe it?)
This comment is not ok.
Hi Dan,
If you're the person who contacted me through an email, I just replied to you! If not, I'll paste my response here:
----------
Hi Dan! You won’t believe how glad i am that you decided to contact me regarding this, rather than making a decision about me in your mind and not speaking about it. Thank you. Your email made me realize that I had made a mistake there that we developers often do, namely forgetting to explain the context and thinking that the reader already knows it. In Iran, we don’t have many women who go as far as a Masters degree in computer science. Even if they do, they don’t usually enter the workforce as a DevOps or software engineer. This was what I meant with “can you believe it?” — the fact that this lady had gotten so far is unbelievable. I know where you’re coming from, though. Whenever I reveal on the web that I’m a blind programmer, many people talk between themselves and say, “he’s a blind programmer! Can you believe it?” A lot of people in those circles raise an objection about this choice of words, saying that, “Why do you think it’s incredulous for him to code?” So, yes, I should have seen this misunderstanding coming. You’re awesome. I’ll go and change it immediately. Thanks again. Best, Parham
I guess he was probably surprised since ladies doing computer science masters in Iran must not be that common I guess. I understood it this way.
Exactly. I changed the article to better reflect these though. I'd personally get offended if someone actually meant to say something like this, and since I don't want people to think I'm making such a ridiculous statement, I edited the text to clarify.
Consider the ways in which this comment could be interpreted in a way that doesn't insult women, which is how I assume you read it.
There are ways.
IMO here we have again an example of how attempted PC actually makes lives worse.
Take notice.
Why is it not ok?
In Iran, it's certainly surprising.