Hacker News Reader

adam-pon Ask HN: Who is hiring? (June 2026)

Psiphon | iOS / Flutter Developer | Toronto (Hybrid) | Full-time

Psiphon is a VPN app used by millions of people to access the open internet in regions where it's restricted. Small team, software that matters.

We're building the next-gen client app in Flutter (iOS, Android, macOS, Windows) and need someone who can work across both iOS native and Flutter. Split is roughly 65% Flutter, 35% iOS native (Swift, StoreKit, entitlements, network extensions). You'll have mentorship from a senior iOS specialist for the deeper networking work.

Day to day: Feature development in Flutter, iOS platform integration (subscriptions, permissions, App Store), and occasionally going deep into network extensions and packet tunnel providers. Small team (~3-4 core devs), high ownership, low ceremony.

Looking for: Strong Swift experience beyond just UIKit/SwiftUI app dev, comfort with the iOS ecosystem (App Store process, provisioning, StoreKit), and willingness to context-switch between Swift and Dart in the same day. Flutter experience is a strong plus but not required if you pick up frameworks quickly.

Contact: hr@psiphon.ca

adam-pon Ask HN: Who is hiring? (May 2026)

Psiphon | iOS / Flutter Developer | Toronto (Hybrid) | Full-time

Psiphon is a VPN app used by millions of people to access the open internet in regions where it's restricted. Small team, software that matters.

We're building the next-gen client app in Flutter (iOS, Android, macOS, Windows) and need someone who can work across both iOS native and Flutter. Split is roughly 65% Flutter, 35% iOS native (Swift, StoreKit, entitlements, network extensions). You'll have mentorship from a senior iOS specialist for the deeper networking work.

Day to day: Feature development in Flutter, iOS platform integration (subscriptions, permissions, App Store), and occasionally going deep into network extensions and packet tunnel providers. Small team (~3-4 core devs), high ownership, low ceremony.

Looking for: Strong Swift experience beyond just UIKit/SwiftUI app dev, comfort with the iOS ecosystem (App Store process, provisioning, StoreKit), and willingness to context-switch between Swift and Dart in the same day. Flutter experience is a strong plus but not required if you pick up frameworks quickly.

Contact: jobs@psiphon.ca

adam-pon Ask HN: Share your personal website

Mine is mostly a (sporadically updated) blog: https://adam-p.ca/

adam-pon Ask HN: The government of my country blocked VPN access. What should I use?

State censorship circumvention is exactly what Psiphon is for! So yes, try it.

(Disclaimer: I work there.)

adam-pon The best – but not good – way to limit string length

I added a section with brief discussion of rejection, truncation, and the perils therein.

https://adam-p.ca/blog/2025/04/string-length/#what-to-do-whe...

adam-pon The best – but not good – way to limit string length

> The article is somewhat wrong when it says Unicode may "change character normalization rules"; new combining characters may be added (which affects the class sort above) but new precombined ones cannot.

That's fair. I updated the wording in the post.

Thanks for the display info. It's cool and horrible and out of scope for my post.

adam-pon The best – but not good – way to limit string length

If you can get away with that, that's great. But I feel like there are still plenty of cases where you want to limit the lengths of particular fields (and communicate to the user which lengths were exceeded).

adam-pon The best – but not good – way to limit string length

Valid question, and I think you're right in the abstract and most of the time. But I also think you end up with a mismatch.

What's the concrete spec for the limit if you've only got 10x storage per grapheme cluster?

Probably you end providing the limit in bytes. That's fine, but it's no longer the "hybrid counting" thing anymore.

adam-pon The best – but not good – way to limit string length

I don't get into truncation much, but I do mention the risk of:

a) failing to truncate on a code point sequence boundary (a bug React Native iOS used to have)[1], and

b) failing to truncate on a grapheme cluster boundary (a bug React Native Android seems to still have)[2]

[1]: https://adam-p.ca/blog/2025/04/string-length/#utf-16-code-un...

[2]: https://adam-p.ca/blog/2025/04/string-length/#unicode-code-p...

adam-pon The best – but not good – way to limit string length

@dang Can the title be changed? It should be "The best – but not good – way to limit string length". Thanks.

adam-pon A Tour of WebAuthn

Except that TOTP codes are MitM phishable. U2F with its URL-checking (via browser cooperation) is needed.

adam-pon Gorhill pulls uBlock Origin Lite from Firefox store

If you want another example of difficulty with the AMO review process: https://github.com/adam-p/markdown-here/issues/21

And that's just one of the examples; another resulted in me having to add a preprocessor that removes code at build-time, which was annoying. I like Firefox, but it wasn't always easy to justify the effort.

adam-pon Show HN: Using Google Sheets as the back end/APIs of your app

I also used Google Sheets as a datastore backend: https://github.com/adam-p/danforth-east

It's a community association membership management thing, and I wanted the (non-technical) association board members to be able to easily inspect the data and do something useful with it if I moved away. It has mostly been successful, except that sometimes someone will manually edit the sheet and break something.

adam-pon More Secure, Less Spam: Enforcing Email Standards for a Better Experience

Here are Google's related Email Sender Guidelines: https://support.google.com/mail/answer/81126

Note that these take effect in two weeks.

adam-pon Bug story: Sorting by timestamp

There are a couple of shortcomings that I think I see:

1. If the clock moves backwards (and an "older" record gets created), it doesn't help.

2. If a duplicate timestamp is created with an id that sorts earlier than one of the other dups (and a user has already synced to the first dup).

In both of those cases, the user won't receive the new record. (Yes, neither is probable, but neither is impossible.)

adam-pon Bug story: Sorting by timestamp

Nice. That's a good general rule to follow.

adam-pon Bug story: Sorting by timestamp

That's a good point. I'll add a note to the post.

adam-pon Ask HN: Who is hiring? (November 2022)

Psiphon Inc. is looking for experienced software developers to join our Toronto team.

= What we do =

We develop and operate Psiphon, an Internet anti-censorship network that helps millions of people in freedom-restricted countries access uncensored Internet every day. We work at the leading edge of circumvention technology, where the latest network protocol and endpoint obfuscation research is rapidly deployed into production around the world.

Our tasks include censorship technology research, server and client software development, and operation of a dynamic, global network of thousands of proxy servers.

We’re a small team looking for skilled and enthusiastic people to join us. We offer great compensation and benefits and flexible work arrangements.

= Tech stack =

Much of our system is open source, check it out at https://github.com/Psiphon-Inc/psiphon/ and https://github.com/Psiphon-Labs/psiphon-tunnel-core

We use Java (Android app), Obj-C and Swift (iOS app), C++ (Windows app), Go (cross-platform core client and server), Python/JavaScript/C/shell script (server-side stack), ElasticSearch/Logstash/Kibana (stats), and more.

= Contact =

info+hn@psiphon.ca

adam-pon Ask HN: Who is hiring? (October 2022)

Psiphon Inc. is looking for experienced software developers to join our Toronto team.

= What we do =

We develop and operate Psiphon, an Internet anti-censorship network that helps millions of people in freedom-restricted countries access uncensored Internet every day. We work at the leading edge of circumvention technology, where the latest network protocol and endpoint obfuscation research is rapidly deployed into production around the world.

Our tasks include censorship technology research, server and client software development, and operation of a dynamic, global network of thousands of proxy servers.

We’re a small team looking for skilled and enthusiastic people to join us. We offer great compensation and benefits and flexible work arrangements.

= Tech stack =

Much of our system is open source, check it out at https://github.com/Psiphon-Inc/psiphon/ and https://github.com/Psiphon-Labs/psiphon-tunnel-core

We use Java (Android app), Obj-C and Swift (iOS app), C++ (Windows app), Go (cross-platform core client and server), Python/JavaScript/C/shell script (server-side stack), ElasticSearch/Logstash/Kibana (stats), and more.

= Contact =

info+hn@psiphon.ca

adam-pon Ask HN: Who is hiring? (September 2022)

Psiphon Inc. is looking for experienced software developers to join our Toronto team.

= What we do =

We develop and operate Psiphon, an Internet anti-censorship network that helps millions of people in freedom-restricted countries access uncensored Internet every day. We work at the leading edge of circumvention technology, where the latest network protocol and endpoint obfuscation research is rapidly deployed into production around the world.

Our tasks include censorship technology research, server and client software development, and operation of a dynamic, global network of thousands of proxy servers.

We’re a small team looking for skilled and enthusiastic people to join us. We offer great compensation and benefits and flexible work arrangements.

= Tech stack =

Much of our system is open source, check it out at https://github.com/Psiphon-Inc/psiphon/ and https://github.com/Psiphon-Labs/psiphon-tunnel-core

We use Java (Android app), Obj-C and Swift (iOS app), C++ (Windows app), Go (cross-platform core client and server), Python/JavaScript/C/shell script (server-side stack), ElasticSearch/Logstash/Kibana (stats), and more.

= Contact =

info+hn@psiphon.ca

adam-pon Ask HN: Who is hiring? (August 2022)

Psiphon Inc. is looking for experienced software developers to join our Toronto team.

= What we do =

We develop and operate Psiphon, an Internet anti-censorship network that helps millions of people in freedom-restricted countries access uncensored Internet every day. We work at the leading edge of circumvention technology, where the latest network protocol and endpoint obfuscation research is rapidly deployed into production around the world.

Our tasks include censorship technology research, server and client software development, and operation of a dynamic, global network of thousands of proxy servers.

We’re a small team looking for skilled and enthusiastic people to join us. We offer great compensation and benefits and flexible work arrangements.

= Tech stack =

Much of our system is open source, check it out at https://github.com/Psiphon-Inc/psiphon/ and https://github.com/Psiphon-Labs/psiphon-tunnel-core

We use Java (Android app), Obj-C and Swift (iOS app), C++ (Windows app), Go (cross-platform core client and server), Python/JavaScript/C/shell script (server-side stack), ElasticSearch/Logstash/Kibana (stats), and more.

= Contact =

info+hn@psiphon.ca

adam-pon Tor is fighting and beating Russian censorship

Psiphon is helping almost 2.5 million Russians per day access the rest of the internet. (Which is just what we do.)

https://psix.ca/d/nyi8gE6Zk/regional-overview?orgId=2&var-re...

adam-pon Ask HN: Who is hiring? (July 2022)

Psiphon Inc. is looking for experienced software developers to join our Toronto team.

= What we do =

We develop and operate Psiphon, an Internet anti-censorship network that helps millions of people in freedom-restricted countries access uncensored Internet every day. We work at the leading edge of circumvention technology, where the latest network protocol and endpoint obfuscation research is rapidly deployed into production around the world.

Our tasks include censorship technology research, server and client software development, and operation of a dynamic, global network of thousands of proxy servers.

We’re a small team looking for skilled and enthusiastic people to join us. We offer great compensation and benefits and flexible work arrangements.

= Tech stack =

Much of our system is open source, check it out at https://github.com/Psiphon-Inc/psiphon/ and https://github.com/Psiphon-Labs/psiphon-tunnel-core

We use Java (Android app), Obj-C and Swift (iOS app), C++ (Windows app), Go (cross-platform core client and server), Python/JavaScript/C/shell script (server-side stack), ElasticSearch/Logstash/Kibana (stats), and more.

= Contact =

info+hn@psiphon.ca

adam-pon Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

I killed a Yubikey in my pocket (without washing) after four years. Get two and keep the backup safe. https://adam-p.ca/blog/2021/06/backup-yubikey/

adam-pon Ask HN: Who is hiring? (May 2022)

Psiphon Inc. is looking for experienced software developers to join our Toronto team.

= What we do =

We develop and operate Psiphon, an Internet anti-censorship network that helps millions of people in freedom-restricted countries access uncensored Internet every day. We work at the leading edge of circumvention technology, where the latest network protocol and endpoint obfuscation research is rapidly deployed into production around the world.

Our tasks include censorship technology research, server and client software development, and operation of a dynamic, global network of thousands of proxy servers.

We’re a small team looking for skilled and enthusiastic people to join us. We offer great compensation and benefits and flexible work arrangements.

= Tech stack =

Much of our system is open source, check it out at https://github.com/Psiphon-Inc/psiphon/ and https://github.com/Psiphon-Labs/psiphon-tunnel-core

We use Java (Android app), Obj-C and Swift (iOS app), C++ (Windows app), Go (cross-platform core client and server), Python/JavaScript/C/shell script (server-side stack), ElasticSearch/Logstash/Kibana (stats), and more.

= Contact =

info+hn@psiphon.ca

adam-pon Ask HN: Share your personal site

https://adam-p.ca/

Built with Hugo (starting with no theme, because I wanted understanding, not magic). Uses Bootstrap. Hosted with GitHub Pages.

adam-pon Ask HN: Who is hiring? (April 2022)

Psiphon Inc. is looking for experienced software developers to join our Toronto team.

= What we do =

We develop and operate Psiphon, an Internet anti-censorship network that helps millions of people in freedom-restricted countries access uncensored Internet every day. We work at the leading edge of circumvention technology, where the latest network protocol and endpoint obfuscation research is rapidly deployed into production around the world.

Our tasks include censorship technology research, server and client software development, and operation of a dynamic, global network of thousands of proxy servers.

We’re a small team looking for skilled and enthusiastic people to join us. We offer great compensation and benefits and flexible work arrangements.

= Tech stack =

Much of our system is open source, check it out at https://github.com/Psiphon-Inc/psiphon/ and https://github.com/Psiphon-Labs/psiphon-tunnel-core

We use Java (Android app), Obj-C and Swift (iOS app), C++ (Windows app), Go (cross-platform core client and server), Python/JavaScript/C/shell script (server-side stack), ElasticSearch/Logstash/Kibana (stats), and more.

= Contact =

info+hn@psiphon.ca

adam-pon The perils of the “real” client IP

This is my favourite TL;DR so far.

adam-pon The perils of the “real” client IP

I agree. However, you need to be _really_ careful about using the IP provided by your CDN, etc. For example, Akamai sets `True-Client-IP`... but doesn't overwrite it if it's present. By default, Fastly does the same with `Fastly-Client-IP`. (Yes, Azure is better, but make sure you pick the _right_ special header.)

Minefields within minefields.

adam-pon The perils of the “real” client IP

> Setting up an application server behind a reverse proxy to use the "real" client IP is unfortunately very typically just a trial-and-error based process

This is very true, and I narrowly missed getting burned myself by thinking, "looks good to me!" after seeing my own IP.

However... I take a dig in the conclusions at the implementers of security-related libraries. I don't think it's okay for them to stop at "seems to work". They should be taking the time to fully understand the problem space.

> highly recommended to just override the entire XFF header with a single value at the appropriate point in your stack, if at all possible

I agree, and probably should have emphasized that approach. (And maybe will, and will definitely add a note at the end.) I didn't really give any/enough attention to configuring your first proxy with a custom single-IP header. (Partly because I was writing more for people who are trying to use what's available.)