Ask HN: The government of my country blocked VPN access. What should I use?

I wrote a web application in an internship, circa 2011. I had no existing platform/framework to work with, no mentorship (the team wasn't really prepared to support an intern), and most importantly, an Apache web server running in Cygwin, with no PHP runtime installed. No one as much as told me what language I'd be writing at this job.

The Web development I'd done up to that point consisted of raw HTML/CSS, with some ASP.NET or PHP running on the backend. I'd never written a line of JavaScript in my life.

It was at this point that I "discovered" a winning combination: HTML, CSS, and JavaScript running in the user's browser. The backend was a set of C# applications which wrote to standard out, which could be invoked directly by Apache's mod_cgi, since C# compiles down to Windows executables. There were countless better other solutions at this point - ASP.NET/PHP (as I'd already used). FastCGI, WSGI, and others were all a thing at this point, but I'd never heard of them.

I outputted a JavaScript object (I had no idea what JSON was at the time, or that I was effectively outputting it) and read it back into the browser using a thin wrapper around XMLHttpRequest. I then iterated over the outputm and transformed the data into tables. JQuery was a thing at that point, but likewise, I'd never heard of it.

Say what you will about the job, the team, the mentorship (or lack theorof) - it took them three months before they realized I'd written C# at a Java shop, and at that point the thing was already being used widely across engineering.

The important takeaway here was, that "winning combination" of some minimal JavaScript and CGI was the perfect ratio of simple, approachable, and powerful, to enable me to finish the task at hand, and in a way that (at least until anybody saw the architecture) everybody was thrilled with. It didn't require a deeper understanding of a framework to bootstrap it from nothing. Write an HTTP response to standard out, formatted as an object, and you were on your way.

lenkite · 39m ago

This architecture is also wonderful for diagnosis and investigation. You have effectively broken down the problem into CLI tools that can be independently tested and invoked with problematic requests.

johnorourke · 2h ago

Brings back memories! I used it in 1996 to build an e-commerce site in Perl v4.

electroglyph · 5h ago

OpenResty + Lua ftw

lemcoe9 · 5h ago

Absolutely. For me, OpenResty combined with a custom Lua script solved an incredibly complicated business problem that I ran into a couple years ago, and now that arrangement serves thousands of complex requests per day. With Nginx and that custom code combined into a single configuration, not requiring a separate backend service, we turned a complicated problem into a very simple one!

lovehashbrowns · 3h ago

I used OpenResty + Lua + Redis to implement a quick blacklist for an ad platform like 10 years ago. It really does make everything so simple and it's pretty fun to work with.

doublerabbit · 6h ago

eBay confused the 17 year old me back in 2007 when their listings were powered by a dll file.

    cgi.ebay.co.uk/ws/eBayISAPI.dll

It wasn't for many years later that I discovered knowledge about CGI.

toast0 · 4h ago

In the beginning, eBay used to run the frontends on Windows, with IIS. When they moved to something else, they kept the urls, because cool urls don't change.

treyd · 6h ago

I never did understand why this path/file structure was exposed.

immibis · 6h ago

Same reason https://foo.example/bar/baz.html exposes it - it tells the web server which file to access. Cool, customized routing wasn't always a thing.

The eBay example, by the way, is ISAPI, not CGI.

anon6362 · 2h ago

IIS, Apache HTTPd, and Nginx have supported rewrite rules with wildcards and regex since forever.

Thus, there's no absolute rule that serving a static state must faithfully map to filesystem representation except convenience. Nor, do dynamic requests need to map to include the details of dynamic handler URIs unless the application cannot change generated links.

Revealing backend state, while somewhat Security Through Obscurity (STO)(TM), it's unwise to volunteer extraneous information without a purpose. Preferably, some other simple, one-way hash external representation should be used.

I played client-side Netscape JS and Apache HTTPd CGI bash shell scripts (not even Perl) to write a toy multiuser chat app in 1996. IIRC, it used a primitive form of long polling where it kept an HTTP/0.9 session open with keepalive commands periodically and then broadcasted the message received to all other users who were also connected.

aeyes · 4h ago

eBay architecture slides from 2006: https://www.cs.cornell.edu/courses/cs330/2007fa/slides/eBayS...

3.3M LoC C++, that must have been quite painful.

toast0 · 4h ago

They replaced it with Java, which was probably worse. :p

nine_k · 3m ago

No. At least, not nearly as many footguns. Also, compiler error messages that actually can be deciphered.

qwertox · 3h ago

That's not really an explanation. Could be named https://foo.example/bar/baz as well.

I also used to ask myself why they would expose the filename of the DLL.

plorkyeran · 3h ago

At the time that would have required that they write a custom proxy that sat in front of IIS and everyone would have been very confused about why you even wanted to do that. IIS (and every other web server in 1996) just took the URL, converted it to a path, and ran that, with no transformations applied. This was three years into the web and many things that are simple and obvious now were not back then.

flomo · 2h ago

Yeah, IIS didn't have any sort .htaccess type thing for url routing IIRC. Even later on, we had to dig under the hood of asp.net because we didn't want .aspx in our paths.

Ask HN: The government of my country blocked VPN access. What should I use?

Ask HN: What to learn for math for modeling?

Cloudflare confirms downtime on August 23rd, silently posts it on status page

Ask HN: Best self-hosted wiki solution in 2025? Mediawiki or something else?

Ask HN: Why hasn't x86 caught up with Apple M series?

Ask HN: Panhandling Engineer?

Ask HN: What options do I have for self-hosted end to end encrypted group chat?

Ask HN: Should we stop worrying that AI will replace developer jobs?

Ask HN: Daily/weekly/monthly technical rituals?

Ask HN: How can I recover and run my old mobile game from the 2010s?

Ask HN: What to do when you suspect your interview is with a state operative?

Ask HN: Theory That Economic Growth Stagnates in a Civilization

Tired of Broken .onion Links? I Built a Real-Time Tor SE That Works

Ask HN: Redis V8 vs. competition? (Valkey, Dragonfly, etc.)

Apple App Store Review Mess

Ask HN: Anyone working on bringing software back from US clouds?

Ask HN: Where can I see a live octopus in Maine?

Best up-to-date guides on Vibe Coding

Ask HN: Did modern AI's coding abilities make you lose interest in programming?

Open source alternative to Lovable, Bolt and v0

Ask HN: What to Do with Old iPads?

Staying up to date on the best AI dev workflow?

Ask HN: How much better can the LLMs become assuming no AGI

Ask HN: Best codebases to study to learn software design?

Ask HN: What are the best Google alternatives in 2025?

Ask HN: Services for Shutting Down a Startup?

Ask HN: Avoiding AI slop in music services

Ask HN: GitHub Copilot down?

CompactifAI Inference API

Ask HN: Is there a temp phone number like temp email?

Ask HN: Does sentience put stress on the brain?

Stop squashing your commits. You're squashing your AI too

Ask HN: Why are so many services rejecting Google Voice numbers for signups?

Ask HN: Are AI filters becoming stricter than society itself?

Petition to stop Google from restricting sideloading and FOSS apps

Ask HN: How to teach a 4 year old to code?

Nginx-CGI brings support for CGI to Nginx and angie

Comments (19)