adam-p

Psiphon | iOS / Flutter Developer | Toronto (Hybrid) | Full-time

Psiphon is a VPN app used by millions of people to access the open internet in regions where it's restricted. Small team, software that matters.

We're building the next-gen client app in Flutter (iOS, Android, macOS, Windows) and need someone who can work across both iOS native and Flutter. Split is roughly 65% Flutter, 35% iOS native (Swift, StoreKit, entitlements, network extensions). You'll have mentorship from a senior iOS specialist for the deeper networking work.

Day to day: Feature development in Flutter, iOS platform integration (subscriptions, permissions, App Store), and occasionally going deep into network extensions and packet tunnel providers. Small team (~3-4 core devs), high ownership, low ceremony.

Looking for: Strong Swift experience beyond just UIKit/SwiftUI app dev, comfort with the iOS ecosystem (App Store process, provisioning, StoreKit), and willingness to context-switch between Swift and Dart in the same day. Flutter experience is a strong plus but not required if you pick up frameworks quickly.

Contact: hr@psiphon.ca

Psiphon | iOS / Flutter Developer | Toronto (Hybrid) | Full-time

Psiphon is a VPN app used by millions of people to access the open internet in regions where it's restricted. Small team, software that matters.

We're building the next-gen client app in Flutter (iOS, Android, macOS, Windows) and need someone who can work across both iOS native and Flutter. Split is roughly 65% Flutter, 35% iOS native (Swift, StoreKit, entitlements, network extensions). You'll have mentorship from a senior iOS specialist for the deeper networking work.

Day to day: Feature development in Flutter, iOS platform integration (subscriptions, permissions, App Store), and occasionally going deep into network extensions and packet tunnel providers. Small team (~3-4 core devs), high ownership, low ceremony.

Looking for: Strong Swift experience beyond just UIKit/SwiftUI app dev, comfort with the iOS ecosystem (App Store process, provisioning, StoreKit), and willingness to context-switch between Swift and Dart in the same day. Flutter experience is a strong plus but not required if you pick up frameworks quickly.

Contact: jobs@psiphon.ca

Mine is mostly a (sporadically updated) blog: https://adam-p.ca/

State censorship circumvention is exactly what Psiphon is for! So yes, try it.

(Disclaimer: I work there.)

I added a section with brief discussion of rejection, truncation, and the perils therein.

https://adam-p.ca/blog/2025/04/string-length/#what-to-do-whe...

The article is somewhat wrong when it says Unicode may "change character normalization rules"; new combining characters may be added (which affects the class sort above) but new precombined ones cannot.

That's fair. I updated the wording in the post.

Thanks for the display info. It's cool and horrible and out of scope for my post.

If you can get away with that, that's great. But I feel like there are still plenty of cases where you want to limit the lengths of particular fields (and communicate to the user which lengths were exceeded).

Valid question, and I think you're right in the abstract and most of the time. But I also think you end up with a mismatch.

What's the concrete spec for the limit if you've only got 10x storage per grapheme cluster?

Probably you end providing the limit in bytes. That's fine, but it's no longer the "hybrid counting" thing anymore.

I don't get into truncation much, but I do mention the risk of:

a) failing to truncate on a code point sequence boundary (a bug React Native iOS used to have)[1], and

b) failing to truncate on a grapheme cluster boundary (a bug React Native Android seems to still have)[2]

[1] https://adam-p.ca/blog/2025/04/string-length/#utf-16-code-un...

[2] https://adam-p.ca/blog/2025/04/string-length/#unicode-code-p...

@dang Can the title be changed? It should be "The best – but not good – way to limit string length". Thanks.

Except that TOTP codes are MitM phishable. U2F with its URL-checking (via browser cooperation) is needed.

If you want another example of difficulty with the AMO review process: https://github.com/adam-p/markdown-here/issues/21

And that's just one of the examples; another resulted in me having to add a preprocessor that removes code at build-time, which was annoying. I like Firefox, but it wasn't always easy to justify the effort.

I also used Google Sheets as a datastore backend: https://github.com/adam-p/danforth-east

It's a community association membership management thing, and I wanted the (non-technical) association board members to be able to easily inspect the data and do something useful with it if I moved away. It has mostly been successful, except that sometimes someone will manually edit the sheet and break something.

Here are Google's related Email Sender Guidelines: https://support.google.com/mail/answer/81126

Note that these take effect in two weeks.

There are a couple of shortcomings that I think I see:

1. If the clock moves backwards (and an "older" record gets created), it doesn't help.

2. If a duplicate timestamp is created with an id that sorts earlier than one of the other dups (and a user has already synced to the first dup).

In both of those cases, the user won't receive the new record. (Yes, neither is probable, but neither is impossible.)

Nice. That's a good general rule to follow.

That's a good point. I'll add a note to the post.

Psiphon | Software Engineer | https://psiphon.ca | Toronto, Canada | Full-time | REMOTE for now, REMOTE/ONSITE hybrid later

Psiphon Inc. is looking for experienced software developers to join our Toronto team.

= What we do =

We develop and operate Psiphon, an Internet anti-censorship network that helps millions of people in freedom-restricted countries access uncensored Internet every day. We work at the leading edge of circumvention technology, where the latest network protocol and endpoint obfuscation research is rapidly deployed into production around the world.

Our tasks include censorship technology research, server and client software development, and operation of a dynamic, global network of thousands of proxy servers.

We’re a small team looking for skilled and enthusiastic people to join us. We offer great compensation and benefits and flexible work arrangements.

= Tech stack =

Much of our system is open source, check it out at https://github.com/Psiphon-Inc/psiphon/ and https://github.com/Psiphon-Labs/psiphon-tunnel-core

We use Java (Android app), Obj-C and Swift (iOS app), C++ (Windows app), Go (cross-platform core client and server), Python/JavaScript/C/shell script (server-side stack), ElasticSearch/Logstash/Kibana (stats), and more.

= Contact =

info+hn@psiphon.ca

Psiphon | Software Engineer | https://psiphon.ca | Toronto, Canada | Full-time | REMOTE for now, REMOTE/ONSITE hybrid later

Psiphon Inc. is looking for experienced software developers to join our Toronto team.

= What we do =

We develop and operate Psiphon, an Internet anti-censorship network that helps millions of people in freedom-restricted countries access uncensored Internet every day. We work at the leading edge of circumvention technology, where the latest network protocol and endpoint obfuscation research is rapidly deployed into production around the world.

Our tasks include censorship technology research, server and client software development, and operation of a dynamic, global network of thousands of proxy servers.

We’re a small team looking for skilled and enthusiastic people to join us. We offer great compensation and benefits and flexible work arrangements.

= Tech stack =

Much of our system is open source, check it out at https://github.com/Psiphon-Inc/psiphon/ and https://github.com/Psiphon-Labs/psiphon-tunnel-core

We use Java (Android app), Obj-C and Swift (iOS app), C++ (Windows app), Go (cross-platform core client and server), Python/JavaScript/C/shell script (server-side stack), ElasticSearch/Logstash/Kibana (stats), and more.

= Contact =

info+hn@psiphon.ca

Psiphon | Software Engineer | https://psiphon.ca | Toronto, Canada | Full-time | REMOTE for now, REMOTE/ONSITE hybrid later

Psiphon Inc. is looking for experienced software developers to join our Toronto team.

= What we do =

We develop and operate Psiphon, an Internet anti-censorship network that helps millions of people in freedom-restricted countries access uncensored Internet every day. We work at the leading edge of circumvention technology, where the latest network protocol and endpoint obfuscation research is rapidly deployed into production around the world.

Our tasks include censorship technology research, server and client software development, and operation of a dynamic, global network of thousands of proxy servers.

We’re a small team looking for skilled and enthusiastic people to join us. We offer great compensation and benefits and flexible work arrangements.

= Tech stack =

Much of our system is open source, check it out at https://github.com/Psiphon-Inc/psiphon/ and https://github.com/Psiphon-Labs/psiphon-tunnel-core

We use Java (Android app), Obj-C and Swift (iOS app), C++ (Windows app), Go (cross-platform core client and server), Python/JavaScript/C/shell script (server-side stack), ElasticSearch/Logstash/Kibana (stats), and more.

= Contact =

info+hn@psiphon.ca

Psiphon | Software Engineer | https://psiphon.ca | Toronto, Canada | Full-time | REMOTE for now, REMOTE/ONSITE hybrid later

Psiphon Inc. is looking for experienced software developers to join our Toronto team.

= What we do =

We develop and operate Psiphon, an Internet anti-censorship network that helps millions of people in freedom-restricted countries access uncensored Internet every day. We work at the leading edge of circumvention technology, where the latest network protocol and endpoint obfuscation research is rapidly deployed into production around the world.

Our tasks include censorship technology research, server and client software development, and operation of a dynamic, global network of thousands of proxy servers.

We’re a small team looking for skilled and enthusiastic people to join us. We offer great compensation and benefits and flexible work arrangements.

= Tech stack =

Much of our system is open source, check it out at https://github.com/Psiphon-Inc/psiphon/ and https://github.com/Psiphon-Labs/psiphon-tunnel-core

We use Java (Android app), Obj-C and Swift (iOS app), C++ (Windows app), Go (cross-platform core client and server), Python/JavaScript/C/shell script (server-side stack), ElasticSearch/Logstash/Kibana (stats), and more.

= Contact =

info+hn@psiphon.ca

Psiphon is helping almost 2.5 million Russians per day access the rest of the internet. (Which is just what we do.)

https://psix.ca/d/nyi8gE6Zk/regional-overview?orgId=2&var-re...

Psiphon | Senior Software Engineer | https://psiphon.ca | Toronto, Canada | Full-time | REMOTE for now, REMOTE/ONSITE hybrid later

Psiphon Inc. is looking for experienced software developers to join our Toronto team.

= What we do =

We develop and operate Psiphon, an Internet anti-censorship network that helps millions of people in freedom-restricted countries access uncensored Internet every day. We work at the leading edge of circumvention technology, where the latest network protocol and endpoint obfuscation research is rapidly deployed into production around the world.

Our tasks include censorship technology research, server and client software development, and operation of a dynamic, global network of thousands of proxy servers.

We’re a small team looking for skilled and enthusiastic people to join us. We offer great compensation and benefits and flexible work arrangements.

= Tech stack =

Much of our system is open source, check it out at https://github.com/Psiphon-Inc/psiphon/ and https://github.com/Psiphon-Labs/psiphon-tunnel-core

We use Java (Android app), Obj-C and Swift (iOS app), C++ (Windows app), Go (cross-platform core client and server), Python/JavaScript/C/shell script (server-side stack), ElasticSearch/Logstash/Kibana (stats), and more.

= Contact =

info+hn@psiphon.ca

I killed a Yubikey in my pocket (without washing) after four years. Get two and keep the backup safe. https://adam-p.ca/blog/2021/06/backup-yubikey/

Psiphon | Senior Software Engineer | https://psiphon.ca | Toronto, Canada | Full-time | REMOTE for now, REMOTE/ONSITE hybrid later

Psiphon Inc. is looking for experienced software developers to join our Toronto team.

= What we do =

We develop and operate Psiphon, an Internet anti-censorship network that helps millions of people in freedom-restricted countries access uncensored Internet every day. We work at the leading edge of circumvention technology, where the latest network protocol and endpoint obfuscation research is rapidly deployed into production around the world.

Our tasks include censorship technology research, server and client software development, and operation of a dynamic, global network of thousands of proxy servers.

We’re a small team looking for skilled and enthusiastic people to join us. We offer great compensation and benefits and flexible work arrangements.

= Tech stack =

Much of our system is open source, check it out at https://github.com/Psiphon-Inc/psiphon/ and https://github.com/Psiphon-Labs/psiphon-tunnel-core

We use Java (Android app), Obj-C and Swift (iOS app), C++ (Windows app), Go (cross-platform core client and server), Python/JavaScript/C/shell script (server-side stack), ElasticSearch/Logstash/Kibana (stats), and more.

= Contact =

info+hn@psiphon.ca

https://adam-p.ca/

Built with Hugo (starting with no theme, because I wanted understanding, not magic). Uses Bootstrap. Hosted with GitHub Pages.

Psiphon | Senior Software Engineer | https://psiphon.ca | Toronto, Canada | Full-time | REMOTE for now, REMOTE/ONSITE hybrid later

Psiphon Inc. is looking for experienced software developers to join our Toronto team.

= What we do =

We develop and operate Psiphon, an Internet anti-censorship network that helps millions of people in freedom-restricted countries access uncensored Internet every day. We work at the leading edge of circumvention technology, where the latest network protocol and endpoint obfuscation research is rapidly deployed into production around the world.

Our tasks include censorship technology research, server and client software development, and operation of a dynamic, global network of thousands of proxy servers.

We’re a small team looking for skilled and enthusiastic people to join us. We offer great compensation and benefits and flexible work arrangements.

= Tech stack =

Much of our system is open source, check it out at https://github.com/Psiphon-Inc/psiphon/ and https://github.com/Psiphon-Labs/psiphon-tunnel-core

We use Java (Android app), Obj-C and Swift (iOS app), C++ (Windows app), Go (cross-platform core client and server), Python/JavaScript/C/shell script (server-side stack), ElasticSearch/Logstash/Kibana (stats), and more.

= Contact =

info+hn@psiphon.ca

This is my favourite TL;DR so far.

I agree. However, you need to be _really_ careful about using the IP provided by your CDN, etc. For example, Akamai sets `True-Client-IP`... but doesn't overwrite it if it's present. By default, Fastly does the same with `Fastly-Client-IP`. (Yes, Azure is better, but make sure you pick the _right_ special header.)

Minefields within minefields.

Setting up an application server behind a reverse proxy to use the "real" client IP is unfortunately very typically just a trial-and-error based process

This is very true, and I narrowly missed getting burned myself by thinking, "looks good to me!" after seeing my own IP.

However... I take a dig in the conclusions at the implementers of security-related libraries. I don't think it's okay for them to stop at "seems to work". They should be taking the time to fully understand the problem space.

highly recommended to just override the entire XFF header with a single value at the appropriate point in your stack, if at all possible

I agree, and probably should have emphasized that approach. (And maybe will, and will definitely add a note at the end.) I didn't really give any/enough attention to configuring your first proxy with a custom single-IP header. (Partly because I was writing more for people who are trying to use what's available.)