> Do I understand it correctly that they are deciding based on SNI/IP whether to let my packets through to the destination server - which provides me with an en

> Do I understand it correctly that they are deciding based on SNI/IP whether to let my packets through to the destination server - which provides me with an encrypted connection and the correct SSL Certificate such that they can not decrypt my data - or, in the case of a blocked site, reroute my packets to the Forti-Blockpage using the Forti Certificate such that I get a warning? So this is in essence completely decoupled from the DoH step, as at least one person commented. I believe this is all correct (I might have been one of the commenters who suggested parts of it). A reason they might use IP address is that it's hard to circumvent (without going through a proxy, tunnel, VPN, etc.). A reason they might use SNI is that it works against CDNs and sites that might change IP address frequently. In terms of the replies, you can log into your account and click the "threads" button at the top to see your own posts on HN and all replies to them. This is a common way to keep conversations going after a story is no longer on the front page. In my experience some HN threads continue to have active discussion for up to a week after they're on the front page, and rarely much beyond that.