Do binary files contain more 1s or 0s? - <AUTHOR> https://coil.com/p/redacted <comment><USER2> The code ignores leading zero bits in each byte, which is why it gets the surprising result of more ones than zeros.

<comment><USER3> I wonder about fixed format headers and wrappers with a default bias too.

</comment></comment><comment><USER4> "2 / 8 = 0.29"

0.25 according to my calculations

pictures and /dev/random should give 0.5, not 0.57, if not they are not properly compressed and it's not a proper random generation, which I don't really believe. Maybe similar error as what happened with the 0.29?

The mean byte value in decimal should be 127.5.

I guess it may be something about the hexadecimal -> decimal -> binary conversion -> count instances of '0' and '1' in string in the python code that is doing something wrong (it's also inefficient to roundtrip through decimal when the original bytes are already binary in the computer and to involve strings in this at all). Does it remove leading zeros perhaps?

<comment><USER5> Well spoted. And ashaming for the OP

<comment><USER6> Mistakes like this happen to everyone, and are hardly something you need to be ashamed of.

<comment><USER7> Tbh it helps to send articles to friends to look over before you go live and post to HN.

</comment></comment></comment></comment><comment><USER8> The reason you're measuring more 1's than 0's is this line:

      binary = bin(decimal)[2:]

That's because while `bin(0xff)` is indeed "0b11111111", `bin(0x00)` is "0b0". Python omits your leading zeros.

A smaller nit, these lines:

      hexadecimal = binascii.hexlify(byte)
      decimal = int(hexadecimal, 16)

can be just

      decimal = byte[0]

<comment><USER9> D'oh! I swear I had a `.zfill(8)` in there. Looks like the whole thing is wrong. Oh well!

</comment></comment><comment><USER10> This page is devoid of content except for a single "_" character. (I viewed the page in Chrome, Safari, Edge, and Firefox with identical results.) What am I missing?

<comment><USER11> Guessing it was edited after the mistakes were pointed out

</comment></comment><comment><USER12> There are at least two silly things in this code,

One is the hex conversion. Compare:

      >>> bin(int(binascii.hexlify(b"\x05"), 16))[2:]
      '101'

versus just:

      >>> bin(b"\x05"[0])[2:]
      '101'

Secondly, the code should just count the 1 bits; there is no need for a count of zeros.

</comment><comment><USER13> It is of course vitally important that the 1's and the 0's even out, otherwise you might overflow the bit bucket and jam the tubes.

(This is actually a thing, encoding schemes like MFM and RLL in magnetic media ensure there aren't too many sequential 1 bits etc. See also "Grey codes")

<comment><USER14> Also 8b/10b and 64/66b encoding in ethernet:

[https://en.wikipedia.org/wiki/8b/10b_encoding](https://en.wikipedia.org/wiki/8b/10b_encoding)

[https://en.wikipedia.org/wiki/64b/66b_encoding](https://en.wikipedia.org/wiki/64b/66b_encoding)

</comment></comment><comment><USER15> I would assume < 0.5 on average since English strings are pretty common and the top bit is usually 0. Zero padding is fairly common in files too, while 1 padding is relatively rare.

</comment><comment><USER16> > Consider a file which only contains the letter A. It has the following bits: > 10000001

I thought A was 65, not 129?

</comment><comment><USER17> Jesus this is some dumb shit.

In python, the string returned by

        bin(decimal)

drops the leading zeros

        >>> bin(3)
        '0b11'
        >>> bin(513)
        '0b1000000001'
        >>> bin(1024)
        '0b10000000000'

I don't want to turn this into a personal attack or an overly snarky comment but it's really something to try and implement a bit counting algo by hand and then fail to observe the way bin() behaves

<comment><USER18> > I don't want to turn this into a personal attack or an overly snarky comment

That's a fine intention, but then you shouldn't lead with "Jesus this is some dumb shit" or end with "it's really something to try and [...] fail." Doing it that way breaks the site guidelines. Would you mind reviewing them? [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

Note that the leading guideline in the "comments" section is _Be kind._

<comment><USER17> Belated, but, yeah. You're right. I blew my top a bit there...

</comment></comment></comment><comment><USER19> There's a Linux application called "ent" that calculates the entropy of a file. I use it to see if it's worth it to compress a file before I ship it somewhere else.

<comment><USER20> Elegant solution, learned something new today, thanks for posting.

$ ent -bc <filename></comment></comment>


Using SMS is like paying for email, email that isn't very good... - <AUTHOR> http://blog.mycannonball.com/using-sms-is-like-paying-for-email <comment><USER2> I like SMS. It's completely universal, anyone who owns a phone made in the last 10 years can use it. It's great to build applications on top of (Twilio, Voxeo), and it's very efficient-- a little slower than XMPP, but it has the advantage that you can use it anywhere, even if there's no wifi.

Paying to send 160 chars of text is a little annoying, but at $0.01/text it's hard to complain too much about.

<comment><USER3> > _$0.01/text it's hard to complain too much about._

That depends entirely on where you are and whether or not you have a texting plan.

For example, I have very little use for texting, and simply cannot justify the cost of a monthly texting plan for my (non-smart) phone. Since I'm in Canada, and our telecom companies are all complete bastards up here, I pay $0.15 to send a text. I also pay $0.15 to _receive_ a text. It's ridiculous.

<comment><USER4> Unlimited texting plans are about $10 iirc. If you can't justify the cost of a monthly texting plan then you're paying < $10, which is hardly ridiculous.

<comment><USER5> It's ridiculous because if the cell companies can afford to allow you to send 1000s of texts for $10/month, then:

* Why does it cost $0.15/text to send/receive? 1000 texts at that rate is $150.00.

* Why do they charge for incoming text and then make it so hard to block incoming texts?

* There are perverse incentives. The cell carriers have no incentive to block/deter SMS spam on their network. Actually, they are incentivized to _allow_ it.

* In the US, on some carriers, it's ~ $0.25 - $0.35 to send/receive texts without a plan, whereas unlimited is usually ~$10/month.

* The cell carriers want people to pay a standard rate because it makes their accounting calculations/projections easier.

* The cell carriers want people to pay a standard rate because they probably would pay less on a pay-as-you-go plan. (Though if people started taxing the SMS system, they would quickly reverse course and start talking about people being 'SMS hogs.')

<comment><USER6> "* Why does it cost $0.15/text to send/receive? 1000 texts at that rate is $150.00."

Capitalism, dear pyre. Enough people are willing to pay it, so they do.

<comment><USER5> Right, because cell carriers are a completely free market. It's a good thing that we kept the government out of the cell carrier market... oh wait...

</comment></comment></comment></comment></comment></comment><comment><USER7> Everyone I know can get an SMS on their phone. Only a couple of those people can get email on their phone. That means that if I want to contact most of them quickly, but quietly, I have only 1 choice: SMS.

SMS would die quickly if something else came along that became ubiquitous overnight. Since we know that isn't going to happen, there's no point complaining about it.

</comment><comment><USER8> Unfortunately right now the choice is SMS (one app, in my dock standard), or GroupMe for some friends, Kik for some others, a few on Facebook Messenger, four or five who've figured out Huddle, and some other small fragment once iMessage shows up.

Sometimes, I don't mind paying for convenience.

<comment><USER9> What do any of those offer that email doesn't? If you send me an email, it gets pushed to my phone apparently instantly.

<comment><USER8> I don't work in IT/a computer related field. Many people I know do not have smart phones.

</comment></comment></comment><comment><USER10> I would love to see SMS disappear. The two things I think are holding it back:

\- Phone's default ringtones for SMS are much more notable than the email alert. Change the defaults on phones so that it's more obvious when an email arrives and people will be more likely to use it.

\- Less spam. People are generally confident that SMS messages are sent from someone they know, so they check them immediately. If email had less spam, people would be more interested when email arrives.

Fix these two things and I think there will be broader appeal to email as a replacement to SMS.

</comment><comment><USER11> $0.01 per 160 characters for reduced number of spam messages. Good deal. Especially since I am still using an old-world phone which can't run SMS.app (i.e no spam catcher).

If I had to delete 50 spam sms a day using my tiny mobile phone buttons....

</comment><comment><USER12> One more thing about SMS. It's less power consuming and works without GPRS and UMTS.

</comment><comment><USER13> I use SMS because it has the best integration with my phone. I can set up quick reply so I don't even have to leave the app I am in to reply to someone.

I only use the google voice app when I have little service but still on wifi.

</comment><comment><USER14> Unfortunately, SMS has a much stronger network effect than AOL did.

</comment><comment><USER15> Sending data by SMS is several times more expensive than receiving data from the Hubble space telescope (~$10/Mb). 'Nuff said.

</comment><comment><USER16> SMS is more secure than email. I would not send my credit card details over email. Would it be so bad to send credit card details using SMS?

<comment><USER17> SMS is arguably less secure than email over an SSL connection. Why would you even consider sending credit card details over SMS? Not only can SMS messages be sniffed and you have no idea if carriers are encrypting it or unencrypting it, but your SMS messages are stored unprotected on both the sending and receiving phones. These could get lost, stolen, or hacked. News Corp cell phone hacking scandal? Celebrity cell phone hackig scandals? If you have an smart phone and sync back up to a computer it copies over your SMS history in plain text. If a police officer pulls you over he has a device that can copy over the entire contents of your cell phone. Common criminals or anyone else aren't far behind.

The best way to exchange credit card information safely is when every step is certified to be PCI compliant which has very strict rules for how credit card information is transmitted, handled, and stored and who can handle them.

I would sooner speak my credit card number to a trusted vendor's call center employee than SMS it anywhere. I have yet to give out my credit card over the phone and I'd never email it.</comment></comment>


Identity thieves take aim at Facebook users - <AUTHOR> http://blogs.zdnet.com/security/?p=3276

<comment><AUTHOR> I encountered this one in the wild today. I thought I could trust links mentioned by my friends on Facebook, but I guess not. My trust for Facebook is diminishing rapidly.

No, I didn't supply my log-in to the page phishing for that, but that app never should have been on Facebook's network to begin with.

See links at

<http://news.google.com/news?q=%22Facebook+phishing%22>

for more press on this event.</comment>


'Extreme poverty' to fall below 10% of world population for first time - <AUTHOR> http://www.theguardian.com/society/2015/oct/05/world-bank-extreme-poverty-to-fall-below-10-of-world-population-for-first-time <comment><USER2> This is an issue where there is widespread misunderstanding. Here is a great opinion piece about how the way news is reported contributes to this chronic misinformation:

[http://www.nytimes.com/2015/10/01/opinion/nicholas- kristof-t...](http://www.nytimes.com/2015/10/01/opinion/nicholas-kristof-the- most-important-thing-and-its-almost-a-secret.html)

"One survey found that two-thirds of Americans believed that the proportion of the world population living in extreme poverty has almost doubled over the last 20 years. Another 29 percent believed that the proportion had remained roughly the same.

"That's 95 percent of Americans — who are utterly wrong. In fact, the proportion of the world's population living in extreme poverty hasn't doubled or remained the same. It has fallen by more than half..."

<comment><USER3> That's because the experience for the American middle class has during this same period been wage stagnation coupled with inflation in food, energy, housing, medicine, and tuition. The American middle class finds it difficult to believe things are getting better around the world because for them it's been getting worse since about 1970.

<comment><USER4> > wage stagnation coupled with inflation in food, energy, housing, medicine, > and tuition

Is that wage stagnation not adjusted for inflation?

<comment><USER3> The numbers I've seen are adjusted for inflation and show that _real_ wages have been largely stagnant since the early 70s. There have been periods of modest gain, usually when the economy is absolutely roaring like the late 90s, but the general trend has been flat to downward. The lower you are on the totem pole the worse it's been: the upper middle has seen some gain, the middle none, and the lower middle has lost ground.

I'm also not sure that I fully believe the inflation numbers. It's not necessarily that I think they're fraudulent, but I don't think the methodology for calculating inflation has caught up with reality. The models I've seen assume inflation to be consistent across the economy, which may have been largely true in the 20th century but is true no longer.

The problem is that inflation since the early 2000s has been extremely uneven. We've had massive deflation in some areas, like manufactured goods. But necessities -- especially real estate, health care, and college tuition -- have almost hyper-inflated.

You can go without gadgets and toys but not without food and a place to live. We've had near-hyperinflation in necessities but it doesn't show in the stats because the stats average those numbers in with the deflationary numbers you get if you look at TV sets, appliances, and computers.

Real estate is utterly insane. I cannot even comprehend how it can possibly be so high. How can you have a market for real estate at these prices? Who's buying it and what parallel universe of limitless wealth do they come from?

I'm not talking about areas like the Bay Area, which has peculiar circumstances at work, or always-hot areas like Manhattan. There will always be "bubbles" of high prices vs. the rest of the market. If you look across the average of the market, real estate is crazy when compared to wages. I suppose it may be a function of historically cheap money causing larger home loans and jacking up prices, but it's essentially locked anyone out who isn't rich or willing to sign up for a crazy mortgage.

<comment><USER5> Some real estate is a positional good, which has the price set by how much money the richest people have.

There is no way around this. If everyone wants to live as close to (say) Times Square as possible, that land will be expensive.

But you don't have to enter that zero-sum rat race. There are lots of places to live that aren't the only places the very rich want to live. They still enjoy decent schools and low crime.

Some college education is positional, too. If you want "Ivy League Education" for your kid, well, there are just about as many slots as there were 30 years, but a lot more rich people, so the price will get bid up to infinity. Here the real shame is that the non-gold-star educational system is still getting more and more expensive, for many many reasons.

<comment><USER6> Interestingly, most of the Ivy League has incredibly generous financial aid packages, enough that most middle-income people pay _zero_. When I went to college, having had 2/3 of my tuition paid for by the college, I remarked that higher ed in elite universities was basically socialism subsidized by a very capitalist minority that was willing to pay any amount. Not a bad system, but it unfortunately only works at those institutions where rich people will enroll their kids at virtually any price.

</comment></comment></comment></comment></comment></comment><comment><USER7> "More and more analysts, though, are pointing out that this claim is little more than an accounting trick: UN officials have massaged the numbers to make it seem as though poverty has been reduced, when in fact it has increased." [http://ssir.org/articles/entry/using_design_thinking_to_erad...](http://ssir.org/articles/entry/using_design_thinking_to_eradicate_poverty_creation)

<comment><USER8> That article is highlighting deeply misleading facts. For example: "between 1990 and 2010 there was an increase of 371 million people living on less than $5 a day". But during the same time period, the world added 1.6 billion people, and even using your source's own data, that implies that the fraction of people living on less than $5 a day dropped from 75% to 60%.

In short, the claim that poverty is getting worse is utter bullshit. It requires either climate-change-denialist levels of willful ignorance, or a xenophobic definition of "poverty" that only counts people living in your own much-richer-than-global-average country.

<comment><USER9> "...or a xenophobic definition of "poverty" that only counts people living in your own much-richer-than-global-average country."

In which case you are no longer measuring poverty. You are measuring inequality.

<comment><USER10> Agan it probably depends how you define poverty. If you live somewhere where the land provides enough food for your needs every day, you probably don't need $2 per day.

If you define poverty as never knowing if you will have enough for the next meal then the $2 cutoff is again probably fairly irrelevant.

</comment></comment></comment></comment><comment><USER11> For all the discussion (i.e.: heated biased arguing) about poverty, seems nobody has addressed an objective definition of what constitutes "poor". Why is the world poverty line at $1.25/day, but the US poverty line is 20x that? We need a quantitative analysis, starting with basic caloric/nutritional/BTU/water/power/data/etc needs (independent of arbitrary numbers imputed by fiat/floating currencies) for cost of bare sustenance, then work from there recognizing that varying geography, demographics, et al adjusts that cost, then admitting that different cultures further adjust those basic costs.

Without such objective analysis of basic sustenance, fudging numbers is trivial.

<comment><USER12> Yes, exactly. The numbers I would like to see measured would be:

\- percent of people who can afford 2,500 calories of food and 60 grams of animal protein a day (where afford has some standard definition, such as can pay for the consumption using less than half of their income).

\- percent of people who have access to clean water

\- percent of people with indoor plumbing

\- percent of people with access to electricity in the home.

\- percent of people who can access and afford 500MB of internet data a month

It is impossible to know what "$2 a day" actually means. The number gets adjusted for purchasing power, but there is an infinite amount of room in that calculation for governments to fudge the data. Many people in the third world can afford a cell phone, but not afford enough protein in their diet, does that mean they are richer or poorer than someone one hundred years ago without a cell phone but who can afford meat? There is no objective way to answer that question. Since I do not know all the subjective decisions made in doing the purchasing power adjustment, the ultimate number tells me nothing.

<comment><USER13> Honestly, I would take out the internet requirement. All the others can significantly improve quality of life in a home, but I can't truely say the same about internet access.

I'd love to hear the counterpoints, but I just can't imagine a farmer needing internet access to live a comfortable lifestyle, as opposed to clean water and electricity, which is necessary.

<comment><USER14> Internet access could certainly help, for example, a farmer, as it could give access to information on better farming techniques, where to source better value fertilisers, where to get the best price for produce etc.

But I certainly agree that it doesn't play any part in the definition of 'extreme poverty'.

<comment><USER15> I was going to make a similar comment, but this boils down to information asymmetry. For how cheap it is to deliver reasonable Internet access to everyone, I put it up there with the same importance as most utilities. If you're building out electricity to a farmer, you can certainly add Internet infrastructure onto that for very little relative cost.

Why should giant corporations buying the farmers products have access to nearly limitless amounts of information, while the farmer is relegated to maybe an industry periodical and the local cafe gossip. That worked before the 1900's, but these days information moves too quickly.

So yes, I think Internet is probably not quite _yet_ essentially a basic need to participate in the economy and society - but it's pretty damn close. And it's only going to continue to get more important as "old world" services are turned off in favor of those on-line. In my lifetime I will see the DMV close it's last in-person renewal desk. And the private world is already there in requiring online-only transactions to do certain forms of business.

</comment></comment></comment></comment></comment><comment><USER16> I think a per-capita statistic is a bit flawed in this case, although I understand why they use it -- the math is very simple.

The problem with per-capita measurement of income for very poor people is that what you really care about is per-family income because of the economies of scale involved in so many of the goods they consume -- cooking fuel, etc.

In places where poverty like this exists, a family of 8 living on $8/day ($1 per capita) is often better-off than a family of 4 living on $5/day ($1.25 per capita).

Regardless of whatever methodological flaws exist in various metrics, this is a positive trend that is (hopefully) only going to get better as technology increases the efficiency of various systems of distributing goods and services.

</comment><comment><USER17> It's incredibly exciting to think that an end to global poverty could be in sight.

Shameless plug: GiveWell [0] and Giving What We Can [1] are non-profits that evaluate the effectiveness of development and global poverty charities. Some are hundreds or thousands of times as effective as others when it comes to saving and extending lives.

Those groups help you decide where your money should go to maximise your impact.

[0]: [http://www.givewell.org/](http://www.givewell.org/)

[1]: [http://givingwhatwecan.org/](http://givingwhatwecan.org/)

</comment><comment><USER18> Thank you globalization.

<comment><USER19> I don't think globalisation plays that big a role in preventing poverty. Big causes are wars and mismanagement by unjust governments.

<comment><USER11> Nay, a huge role. People who were far outside major economic activity can now participate in global markets, improving their ability to sell goods & services (and obtain tools & connections).

A few days ago I ordered & received a cheap scarf via mail. US$0.95 - delivered! from _China_! obviously whoever was involved didn't make much off the transaction, yet they WERE able to make & sell & deliver something to an idiot on the other side of the planet. Where there was no market before, Amazon & USPS & other businesses have pursued "globalization" to the point that a manufacturer & buyer a world apart could engage in profitable transactions.

The way out of poverty is capitalism, sellers & buyers making mutually profitable agreements, and globalization eliminating barriers of distance & borders.

</comment></comment></comment><comment><USER20> Two days ago we had an article about this topic, maybe the same article?

This article claims they just changed the baseline poverty rate. I think they changed other numbers, but can't prove it.

Two days ago, I went to the world bank calculator and the poverty calculations were based on $1.25. I and other HN'ers noticed the calculator didn't seem to account for inflation.

Two days ago I played around with the calculator and used $1.90 and $2.00 as a "the input for the poverty line". I was getting final poverty levels that were doubling. With my numbers the poverty level was not below 10%.

I did the same experiment today, and someone updated all the numbers, or just changed them? Or, I my memory is wrong. (I have not confirmed this on The wayback machine.)

My point is two days ago at $1.90 the poverty rate was close to 20%? Today, my calculations are not close to what they were two days ago?

[http://iresearch.worldbank.org/PovcalNet/index.htm?1](http://iresearch.worldbank.org/PovcalNet/index.htm?1)

</comment><comment><USER21> I'm always wary of the numbers that are put out. There has been long history of fudging numbers to fit a narrative. The unemployment numbers in the US comes to mind as such an example.

So, the question is how realistic is the extreme poverty line. And this doesn't help it much:

      The World Bank first introduced a global poverty line in 1990,
      setting it at $1 a day.
      It was adjusted last in 2008, when the group raised it to $1.25 a day.

$1 seems like such a convenient number to pick!

An interesting graph will be to plot the extreme poverty threshold against inflation _in_emerging_countries_.

With the falling emerging market currencies and extreme inflation (hyper- inflation perhaps), I don't think that $1.90 a day cuts it.

<comment><USER22> Your point about the semi-arbitrary nature of the poverty line is good, but the figure is already inflation-adjusted. There is a general confusion on HN when it comes to real vs. nominal statistics. [1]

I find it's generally safe to assume that most of the well-respected development organizations are made up of smart people that know what they are doing and will not overlook something so fundamental as inflation, even if they do use statistics to advance their agendas from time to time.

[1] [https://news.ycombinator.com/item?id=10335838](https://news.ycombinator.com/item?id=10335838)

<comment><USER21> I'm not questioning their intelligence just their approach.

      well-respected development organizations are made up of smart people
      that know what they are doing

Well, that was the thought about the financial industry, FCC, S&P etc before 2007.

<comment><USER23> Would the incentives of people working in well-respected development organisations be equally twisted to those of S&P etc before 2007? I don't think so.

</comment></comment></comment></comment><comment><USER24> Thats a good measure, but I am pessimistic about poverty ever being rooted out completely (absent of a technological invention that creates abundant energy for very cheap, e.g. fusion, antimatter later on).

The reality is, poverty can be cultural. In the west a saying like "they can pay me little but I'll work even less" would be considered absurd. In certain countries - its a folk tradition.

Another problem is a self-inflicted brain drain. Smart people with potential don't want to live in festering shitholes where property rights are not respected, rule of law unexistant and hence economic opportunity absent.

</comment><comment><USER25> According to this article what's the extreme poverty threshold for World Bank, after all? It says first:

"Extreme poverty has long been defined as living on or below $1.25 a day, but the World Bank's adjustment now sets the poverty line at $1.90 a day."

And then, at the end:

"The World Bank first introduced a global poverty line in 1990, setting it at $1 a day. It was adjusted last in 2008, when the group raised it to $1.25 a day."

Got a bit confused.

<comment><USER25> More info about it (and clearer) here: [http://data.worldbank.org/news/extreme-poverty-rates- continu...](http://data.worldbank.org/news/extreme-poverty-rates-continue-to- fall)

</comment></comment><comment><USER26> Their definition of poverty is earning below a certain dollar amount ($1.90/day).

Their measure of poverty has nothing to do with the access to quality water, quality food, land, quality of life, freedom, personal autonomy, health, safety, etc.

Many indigenous people lived on $0.00/day yet had a higher quality of life; before outside influences (i.e. civilization, imperial, western) disrupted their ecosystems & way of life.

<comment><USER27> Still, this is a relative improvement. There are many other indications (such as infant death ratio) supporting this.

<comment><USER26> As some of the quantitative metrics improve, many of the metrics (particularly of qualitative nature) degrade. Think ecosystems, our usage of resources, quality of life for the average person, etc.

> There are many other indications (such as infant death ratio) supporting > this.

This is one of the many metrics that matter; much more than the percentage of people making > $1.90/day.

<comment><USER28> I'm not so sure about infant deaths - this might be a "fail early" mechanism evolved in nature.

<comment><USER29> Not really, if you look at the statistics of people who have had difficult births they're not much more likely to grow up to be disabled. Especially if you exclude certain categories.

</comment></comment></comment></comment></comment><comment><USER30> Very skeptical of this idea. Were more than 10% of humans were in "extreme poverty" when we lived as hunter-gatherers? Were all humans in "extreme poverty" at that time?

"Extreme poverty" is caused when capitalism invades an area, appropriates all assets, and then the people basically either have to sell themselves into extremely-low-paid labor or starve.

<comment><USER31> Agreed! First time below 10% since mankind's creation of poverty. I can't comment on the causality of capitalism, but I agree with Mandela that poverty is manmade.

<comment><USER32> Are you one of those people who believes in the biblical history where people lived to be 200 years old and such?

At what point in the past was the average person better off than they are now?

<comment><USER31> Before you posted this comment :)

In all seriousness, I'm interpreting poverty as lacking the basic capacity to participate in society. In that sense, the average score of something like the human development index is not relevant to whether or not systemic exclusion of classes of people in society is prevalent. The organization of resource- controlling groups in industry and government are generally what determines the social and economic mobility of a population. Before some point in civilized history, these constructs did not exist to create such vast disparity in human dignity and wealth. In other words, neither the cause nor the existence of poverty is measurable by the average standard of living.

</comment></comment></comment></comment><comment><USER33> While the statistics are updated, the definition of "extreme poverty" just fails to keep up. The moment people have food, they want lots of food, then they want delicious food, then they want more exclusive food, and so on. There'd be no problem if the supply of food (resources) can keep up with human's greed, which never happens.

</comment><comment><USER34> A lot of numbers in this article, but how much would it cost us to solve poverty? And for different values of the poverty line?

<comment><USER35> you solve property by having governments that respect citizen's property rights, having good rule of law, and a sound money policy usually with freedom of exchange. government managed economies tend to only benefit those in power or already well off.

in other words, you create an environment where entrepreneurs can successfully operate as people tend to strive more when they see their efforts pay off and those pay offs are not subject to the whims of others

<comment><USER34> Obviously, yes, this is the preferred long-term solution. This doesn't buy anything for the people suffering at this very instant. Also, if you are struggling to survive, how are you going to even think about getting education?

<comment><USER36> Give a man a fish, he becomes dependant on your fish. Yes, teaching him to fish takes longer, but it's better.

> how are you going to even think about getting education? You start with an > education on how to survive better. You don't need to start with an advanced > education.

<comment><USER37> You can teach people how to pull yourself up by your bootstraps, but some of them have no boots, so it's not entirely fair.

<comment><USER38> life's not fair ... but expecting someone to pull themselves up by their bootstraps when they have no boots is cruel and denies the advantage that "you" (the teacher) most likely started with a pair of boots, at least.

</comment></comment></comment></comment></comment></comment><comment><USER39> Does the "Amish" fit into the poor or Extreme poverty category? (by US standard)

I believe they are happier than most of the population. Gov might not like them too much as their contribution to gdp/Tax might be less than the "normal" folks. On the other hand, their demand on "gov service" should be a lot less too.

<comment><USER40> What makes you think that Amish are poor? Many of them are quite wealthy.

<comment><USER41> I don't think the GP was saying the Amish are poor per se.

I think the GP's point is that, from the perspective of the survey, the Amish's income and/or expenditures might look the same as someone in poverty, even though their quality of life is much better.

<comment><USER42> The line they use isn't "what percentage of people can't afford a TV". It's more along the lines of "what percentage of people can afford adequate food and clean water".

</comment></comment></comment></comment><comment><USER43> I hate to sound cynical here, but is it possible that "extreme poverty" is expected to drop below 10% because many of those unfortunately in such a bracket have low life expectancy due to poor diet and living conditions? I hope not.

<comment><USER44> I was thinking the same. Maybe poors are dying faster than before.

Or maybe the world bank is simply wrong.

"The number of people in extreme powerty could be greatly underestimated": [http://www.theguardian.com/global- development/datablog/2015/...](http://www.theguardian.com/global- development/datablog/2015/apr/21/number-people-extreme-poverty-overseas- development-institute-report-could-be-greatly-underestimated)

</comment></comment><comment><USER45> Have any groups outside of the World Bank confirmed this statistic?

</comment><comment><USER46> that's terrible. 10% is far too high

</comment><comment><USER47> While the middle class is being gutted, pushing more people into "just barely poverty".

<comment><USER48> That's the thing though: in the US, inequality between rich and poor is widening, but globally, it is narrowing. There are more global middle class now than ever before. It's hard to have this both ways until we approach closer to a post scarcity economy.

<comment><USER11> The problem with "wealth inequality" complaints is "poor" has an absolute brick-wall bottom value ($0/yr), but there is no upper limit (short of $WorldGDP/yr). This isn't a zero-sum game, so the fact that one person is financially far above others doesn't necessarily mean things must be worse for others.

<comment><USER48> I completely agree but some (most?) people tend to look at their quality of life on a relative basis. How much better or worse off they are than others they see. So despite the fact that there's probably never been a better time to be poor in the US, there is increasing political pressure to narrow the wealth gap. Someone told me once that he'd rather have pride than money and pride was what being on the wrong side of a large inequality gap slowly destroyed.

</comment></comment></comment></comment><comment><USER49> Thank you automation.

</comment><comment><USER50> Is it because they all died?

</comment><comment><USER51> You could set an arbitrary dollar amount and simply wait for inflation to bring that number into range. How much of this is real improvement?

<comment><USER52> It's inflation adjusted kind of.

</comment></comment><comment><USER53> >Extreme poverty has long been defined as living on or below $1.25 a day, but the World Bank's adjustment now sets the poverty line at $1.90 a day.

That is intentionally misleading.

How about "extreme poverty" = "still suffering malnutrition" \+ "still lacking even basic education" \+ "still lacking any access to healthcare"

The $1.90 tells nothing and it is also dependant on purchasing power. If somebody was making $200/month in the US that would also be extreme poverty.

<comment><USER54> The poverty and extreme poverty line are adjusted in each country according to purchasing power.

You are right that somebody making $200/month in the US would be classified as extreme poor (and someone in India would not be considered extreme poor if he earns $200/month). I don't see the problem with this.

</comment></comment><comment><USER7> The Hypocrisy of 'Helping' the Poor [http://www.nytimes.com/2015/10/04/opinion/sunday/the- hypocri...](http://www.nytimes.com/2015/10/04/opinion/sunday/the-hypocrisy-of- helping-the-poor.html?_r=0)

<comment><USER52> That's kind of on a different thing - rich americans giving a bit to charity after outsourcing US jobs.

<comment><USER55> That article paints rich Americans as pretty awesome people. First they lift millions of Chinese out of poverty and reduce inequality by shipping jobs in China. Then they donate some of the profits to less valuable causes like reducing relative poverty in the US.

The author of that article is kind of clueless, though - US-style "poverty" is not remotely like Zimbabwe poverty.

<comment><USER7> Actually it is. Having worked with NGOs in Africa as well as in Baltimore now - it's pretty much the same. Life expectancy, purchasing power and income inequality. Sad to say!

<comment><USER55> In Zimbabwe, 33% of the country has a flush toilet and over 10% of the country does open defecation. 75% have access to clean water. (Stats from the first hit on google.)

Are you asserting that Baltimore has less than 99% flush toilet usage or 99% clean water access?

[http://www.urbangateway.org/news/more-million-people- without...](http://www.urbangateway.org/news/more-million-people-without- toilets-zimbabwe)

</comment></comment></comment></comment></comment><comment><USER56> That's crazy. Inflation is enourmous (and inflation is not the same as GDP variations). Any criteria that uses dollars cannot have any value in a historical series.

If you get a chart of how many people live with less than $2 per month you'll probably see a continuous steady decline. Why? Inflation.

<comment><USER57> The World Bank periodically adjusts the threshold upwards for this reason. In 1990, they used $1/day. In 2008, they adjusted it to $1.25/day. Now they are adjusting it to $1.90/day.

<comment><USER56> And you imagine that in 25 year the total inflation was only of 90%?

<comment><USER58> I tend to think that the World Bank adjusts this amount in an appropriate manner. If you think their methodology is wrong, you should explain why.

<comment><USER56> Why shouldn't be you explaning why do you believe in their methodology? That's crazy. You don't even know what methodology they use and you are taking your time to defend them here.

<comment><USER59> Because the World Bank is a large organization with many paid staff tasked with devising and implementing their methodology.

You're two random people on the Internet.

I'm siding with the World Bank, not with the internet commenter who demands another internet commenter defend experts.

You're the one making the extraordinary claim here.</comment></comment></comment></comment></comment></comment>


Women in tech, from a man in tech - <AUTHOR> http://www.drydenwilliams.co.uk/tech/2016/05/15/women-in-tech/ <comment><USER2> While I agree with some of the comments he makes, I think he's making some extreme assumptions.

I didn't get into CS because I am anti-social. I got in because it's the awesomest thing ever. Why? If I trace back, I remember thinking it's super cool to be a "hacker" (Not in the diluted sense people use the term nowadays but actually people who would pull off things most people thought were impossible). And having many friends actually helps in this case because the more friends think I'm cool the more I will put my effort into it.

If you think deeper about why this is the case, I think it was because most of my friends also thought it was the coolest thing ever. It is very cool to be able to do things that other people are unable to do. This is probably because guys tend to have more guy friends than girl friends. If I had more girl friends, I probably may have grew up valuing different things.

Which means, I think the core reason why there aren't enough girls in tech is NOT because the industry treats them badly (Not saying that's not true, but just saying that's not the most important reason), but because of the difference in social environment girls and boys grow up in.

Basically if you're a girl in elementary school who want to become a hacker, probably very few of your friends will think you're the coolest person ever. What happens then? Then you don't feel as motivated to learn to program as if you were a boy.

At this stage these girls and boys couldn't care less about if Tech companies will pay them more or not in a decade. They just want to do things that are considered cool by their peers. For boys hacking tends to be relatively higher up (probably lower than sports though), while for girls it's pretty much at the bottom.

That's why I think all this "gender equality in tech" issue is something that you can't solve by hiring more women and stuff. It won't work if it doesn't naturally happen since everything was determined during our youth.

<comment><AUTHOR> Hi galistoca, Thanks for your comment, I think you nailed what I was trying to say with "social environment girls and boys grow up in" and "They just want to do things that are considered cool by their peers. For boys hacking tends to be relatively higher up (probably lower than sports though), while for girls it's pretty much at the bottom."

</comment></comment><comment><USER3> Given that the final paragraph is an un-ironic "#notallmen", it's not clear that the author actually read any of those """so many tweets and blog post titled "We need to make diversity second nature" and "Tech industry stereotypes are hindering equality" and many other such thought provoking title's [sic]""".</comment>


Can I drop a pacemaker 0day? - <AUTHOR> http://blog.erratasec.com/2014/05/can-i-drop-pacemaker-0day.html <comment><USER2> Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now _kill your grandmother_ just by walking past her on the street."

Watch how long it takes them to fix it then, and watch how reactive they become to responsible disclosure next time.

Also, short their stock before you go on TV. A little something for your troubles.

<comment><USER3> Terrible advice to pull a media stunt.

First, you have no idea what the manufacturer needs to do to fix the problem, alert customers, do recalls and recertifications, and the like.

Second, you put yourself directly in the line of fire unnecessarily and for all the wrong reasons. You could find yourself on the end of all kinds of legal trouble, and on top of that you would be morally culpable for any harm.

Do it the right way: get a lawyer. The lawyer will know how to contact the vendors, the regulatory agencies, media if necessary, and customers if necessary.

<comment><USER4> > _get a lawyer_

Because this is the world we should want to live in? Where you must pay a member of the protection racket to mediate publishing knowledge of someone else's extreme wrongdoing?

 _That_ is terrible advice. Its road ends with TORified disclosures of weaponized automated exploits, because as pure info sec has shown, that's the only way the message ever gets across when you give people the insulation to not listen.

Publicly demonstrating these exploits to an amicable media is the best idea I've heard yet, as they have straightforward real-world effects that can be easily illustrated. If certain manufacturers choose to send goons after you rather than fix their buggy products, then the community-accepted custom for them can change to psuedonymous press releases accompanied by a video with a (mock) live human subject.

<comment><USER5> Can you elaborate on how lawyers are "member[s] of the protection racket"?

<comment><USER4> The oft-recommended prudence of having a lawyer's advice for most any action in the public realm indicates a de facto protection racket.

Specifically, the above comment references having a lawyer handle (and moderate) what should be open technical communication with the manufacturer and regulatory agencies, the implication being that simply disclosing facts put you at grave risk from an endlessly complex legal system.

<comment><USER6> 1) You really shouldn't have an _open_ conversation about knowledge that can easily kill people.

2) I'm pretty sure that communication isn't the problem, the problem is that he want's to __pressure __them into fixing their mess, and that is exactly the point where things get messy from a legal perspective. I can hardly imagine a legal system in which a situation like this would be unproblematic.

<comment><USER7> > 1) You really shouldn't have an open conversation about knowledge that can > easily kill people.

You mean like guns, toxins, and martial arts?

<comment><USER6> _sigh_. This will get boring quite fast because a sizable portion of people participating in threads like that find the idea revolting that actions can have, you know, _consequences_ , but what the heck...

If you would find a recipe for a toxin that is deadly, untraceable and can be mixed together from common household items by a talented 14 year old, it's probably a bad fucking idea to post that to 4chan. The same goes for hypothetical weapon blue prints or martial arts techniques that would allow to kill with a microscopic risk.

<comment><USER8> >If you would find a recipe for a toxin that is deadly, untraceable and can be mixed together from common household items by a talented 14 year old, it's probably a bad fucking idea to post that to 4chan.

Does this count as a straw man argument? Wouldn't the actual scenario would be more like disseminating the information that a deadly toxin that is deadly, untraceable, and can be mixed together from common ingredients exists, not the recipe itself.

<comment><USER9> Well, that depends on whether he dropped the actual exploit, or just talked about it. Which was the original question.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> This is _the_ most important problem that the internet of things faces. How can we network everything while maintaining at least some scrap of security, especially in the long term? How can we convince people that their toaster is worth patching, and, more importantly, how to we convince vendors that toasters are worth releasing patches for? What if appliance makers go bankrupt and your dishwasher no longer receives patches? How will devices be updated if another Heartbleed-esque situation occurs? It's easier for a user to protect themselves from a 0-day in an app they use, for example, compared to vital home appliances such as dishwashers, refrigerators or washing machines, which cannot merely be uninstalled.

This is a very real threat, most notably Belkin [0] has suffered critical security breaches, and this issue won't be going away any time soon. How can security researchers get CVE's patched, and how can we prevent them from occuring in the first place? This should be priority #1 for any company trying to bring internet-connected appliances to the mainstream.

[0]: [http://arstechnica.com/security/2014/02/password-leak-in- wem...](http://arstechnica.com/security/2014/02/password-leak-in-wemo-devices- makes-home-appliances-susceptible-to-hijacks/)

<comment><USER11> > How can we network everything while maintaining at least some scrap of > security, especially in the long term?

Another question that we should be asking more is _should_ we network everything that could be?

As for a pacemaker, personally I think the answer is a definite NO. It has only one function, to keep someone alive, and any extra functionality only represents an increased risk of malfunction. If there is any firmware in it then that firmware should be as simple as it can be. Preferably open-source and subject to being reviewed/corrected by many, _before_ it gets permanently embedded in a device.

> how can we prevent them from occuring in the first place?

The obvious way is by doing it right the first time. Sadly, this is something that seems to have fallen out of fashion, as the prevalent mentality is more like "we can always issue an update, so it doesn't matter that much". A dangerous mentality indeed, when it's in truly safety-critical applications. Companies are increasingly pushing for "smartness" in their products, espousing all the ostensible advantages, while not giving much exposure to the possible downsides too.

<comment><USER12> I imagine there's some value in being able to update the firmware on a pacemaker. Maybe a new pacemaking algorithm can save 1% more lives or something. Or it could automatically call an ambulance when you have a heart attack, etc.

<comment><USER13> Implanted medical devices do seem like the ideal situation for wireless access, albeit you probably don't want to overburden the thing with features either.

</comment></comment></comment></comment><comment><USER3> Absolutely _NOT_ because this could kill people.

If you truly have a pacemaker 0day, contact me (joelparkerhenderson) on most major service and I will connect you with my healthcare policy lawyer. She can rapidly open the doors to the vendors who have the risk.

<comment><USER14> Do most medical device manufacturers carry insurance against lawsuits? If so, historically, how high has the bar been before the insurers pay out? If there is a strong relationship between a device manufacturer getting sued and an insurer losing money then this could be a great contact to try.

<comment><USER15> Yes, but more importantly, medical device makers have broad immunity when their devices go through the PMA process (the most stringent type of FDA approval). Basically, the argument is "hey, the FDA said it was safe".

<comment><USER16> Then this is where the pressure needs to be applied - at the certification process. It needs to be made a legal requirement to attain certification (if not already), and the certifiers need to follow best practices for vulnerability detection. And it needs to be an ongoing, open process.

<comment><USER17> Yes, the FDA certification should include something along the lines of "Manufacturer has an ongoing process to evaluate new vulnerabilities and push updates to affected individuals."

<comment><USER15> It does, at least for new approvals post ~2012. Doesn't help existing devices in the field though.

</comment></comment></comment></comment></comment></comment><comment><USER18> Here's an idea:

1.) Responsible disclosure to vendor. Allow reasonable amount of time for a fix to be created and deployed.

2.) (If fix is deployed, release details)

3.) If no fix is deployed in a reasonable amount of time _and_ the vendor is unresponsive, release a PoC that demonstrates exploitability without giving away details. eg: "Here is a pacemaker. Look, I did magic and it stopped!" This is the same idea as releasing the actual vulnerability/exploit, but doesn't put lives at risk. People that could fuzz for any type of a vulnerability would be able to find it on their own anyway.

I agree that ICS and health-sensitive vulnerability disclosure is a trickier field than most. Medical devices, cars, and power plants are _much_ more sensitive than a random kid's iPhone; that's why groups like _I Am The Cavalry_ are trying to address the issue industry-wide.

However, to answer the original question: don't drop a pacemaker 0day at DEF CON. Find a way to fix the problem with the vendor instead. At the very "worst," demo without vulnerability or exploit details.

<comment><USER19> What does 'fix deployed' mean? How do you actually update pacemaker software? Are you going to wait for 100% of the deployed pacemakers are fixed? What is an acceptable fix rate before you release the exploit?

<comment><USER20> Pacemaker firmware can almost always be updated using inductive or rf telemetry. In most cases it still requires an appointment with a cardiologist or similar physician though.

<comment><USER21> Anyone who uses a pacemaker will need to have it checked at least a couple of times a year anyway.

</comment></comment></comment></comment><comment><USER22> \- Contact the FDA, or other regulatory bodies.

\- Contact the customers. They'll likely have standing to sue (they were sold a defective product).

\- Class-action attorneys may be interested for this reason.

\- Did you know you can pay a very, very modest amount of money to file a press release saying anything you want?

\- Contact some investors. Short sellers will have a vested interest in making sure the information gets widely publicised.

<comment><USER23> What is legality regarding the investors shorting?

<comment><USER24> Since it's on HN you could technically argue that it is now publicly known. If you short the stock past this point you may well be in the clear.

<comment><USER22> There's no requirement for information to be "publicly known" to trade on it. You have to be an "insider" for it to be insider trading - ie, there has to be some relationship of trust (eg an employee or officer, or in some circumstances people they "tip off").

</comment></comment></comment></comment><comment><USER25> This sort of 0-day has been known in the academic literature for some time[1].

Disclosure of critical vulnerabilities in implantable devices is far more fraught than your normal critical software 0-day. These devices require surgery for replacement, and a small number of those surgeries will have possibly fatal complications. The cost of immediately replacing all existing vulnerable devices could literally be measured in lives. (And that's even assuming that the device manufacturer fixed the problem!)

Implantable software is already a very tricky area, and there's no signs that it'll get any easier.

[1] Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses, [http://www.secure- medicine.org/public/publications/icd-study...](http://www.secure- medicine.org/public/publications/icd-study.pdf)

</comment><comment><USER26> It's not quite "this could kill people" but rather "this could be used to kill someone." But there are a lot of things that one person could use against another person to kill them, ethically, what does adding this thing to the list change?

If you discovered / disclosed a particular way the unit could malfunction and kill someone it seems like that's put in a different class; in that case you're a hero saving lives. But if you report on a technique someone could use to _cause_ the device to malfunction, it's treated completely differently.

I think a related and important message is that pacemaker "malfunctions" should be treated as possibly suspicious.

<comment><USER27> This is a way to kill someone at a distance, with no obvious trace leading to you, and using nothing but an off the shelf laptop or phone. It's significantly more dangerous than any of the other known methods of murder because of the reduced risk to the murderer.

<comment><USER26> My understanding is that pacemakers, insulin pumps, and such have only limited short-range wireless capability. It's not exactly a 3G connection with a public facing IP address.

As long as you still need proximity and individual targeting, I think it's not a paradigm shift in murder.

<comment><USER28> The short range is to do with the antenna in the device which is (obviously) limited to a certain size.

A larger aerial on the attacking device will allow for communication over a greater range.

The paradigm shift is when you can sit 6 rows back at a baseball stadium and take out someone or walk through their subway car and kill them.

There is no trace evidence and done in a crowd at rush hour essentially no chance of getting caught, heart attacks happen all the damn time.

</comment></comment></comment></comment><comment><USER29> How about releasing the vulnerability in stages? The author jumps from unresponsive vendor to releasing exploit code. What if you add steps between the two?

For example:

\- Announcing a vulnerability has been found and identifying the unresponsive vendor.

\- Announcing what the disclosure timeline will be.

\- Detailing the product lines known to be affected by the vulnerability.

\- Publishing communication with the vendor so far with any details about the vulnerability redacted.

\- Private disclosure to professionals (doctors & journalists) to have them independently verify that the vulnerability exists and help with raising awareness.

\- Full details about the vulnerability, but no exploit code.

<comment><USER30> This just sounds like responsible disclosure to me. With added steps because the "responsible" part requires you act differently due to the possible risk involved. This is likely the best way to go, and I'd expect to see some legal advice back it up were it to actually happen such an exploit existed.

</comment></comment><comment><USER31> What pacemaker communicates via blue tooth? Last I checked they all used induction telemetry (which requires the telemetry wand to be within several inches of the device) or MICS band radio for distance telemetry. I think some Boston Scientific devices used 900MHz at one time, but how many of those are still in the wild?

The only instances of "hacking" a pacemaker (or ICD) have been when researchers used a programmer from the manufacturer to "hack" the device.

So it seems super unlikely you know a blue tooth zero day for a pacer.

<comment><USER32> > _The only instances of "hacking" a pacemaker_ [...] //

Someone has linked a PDF of an "ICD study" upthread that shows your contention to be at least partially false.

<comment><USER31> I assume you mean this one:

[http://www.secure-medicine.org/public/publications/icd- study...](http://www.secure-medicine.org/public/publications/icd-study.pdf)

You would need to be specific about which one of the linked documents you meant, there were several. All the hacking attempts started off with a manufacturer's programmer and worked back from there. In the example using a software radio, the researchers were able to replay sniffed commands to the device after it had been activated by the programmer.

Which of the reports talked about a device being compromised without using a manufacturers programmer?

<comment><USER32> Yes. I've not pored over it but they said:

>"We implemented several active [replay] attacks using [only] the USRP and a BasicTX daughterboard to transmit on the 175 kHz band." //

Yes, they used a programmer for reverse engineering purposes but from my - admittedly brief - look at the paper it seemed they performed active attacks (page 8(A) onwards) without using the programmer.

So they previously used a programmer but the attacks were performed without one. Assumed true it seems a reasonable PoC that contradicts the essence of your statement which seemed to say all "hacks" needed a manufacturers programmer to perform.

</comment></comment></comment></comment><comment><USER33> What do you expect them to do? Even assuming they were 100% concerned with security and did everything right and there was still a bug that allowed a pacemaker to be compromised. Do you expect them to cut open a person and replace the buggy pacemaker?

I don't pretend to be an expert in this area but getting medical equipment approved is a huge undertaking and I don't know what the ramifications of changing anything would be. Say they take your 0day and fix it. Then they have to go through the entire re-certification process again and after however many months or years, NEW patients get the fixed pacemaker. But what about all the old patients?

While I sympathize, the only realistic approach here is to make the consequences for killing someone via a 0day for the "lulz" so drastic that it would certainly legally bleed over into the disclosure. I realize this is the approach we do tend to take here in the US.

<comment><USER34> Someone made a comment above stating that people with pacemakers typically have to go in once or twice a year to get it checked, and the devices can be updated using 'inductive or rf telemetry'. Presumably doctors could update the devices when patients come in.

</comment></comment><comment><USER35> In the case of medical devices, this is squarely in the FDA's wheelhouse in the USA. The FDA likely lacks the people with appropriate expertise to evaluate these kinds of safety issues because their traditional focus has been on the more typical kinds of medical device risk. A concerted effort at dialog with them could turn that around. Particularly if it were done through a series of academic workshops with key people.

</comment><comment><USER36> Make a YouTube video of the hack actually working on a pacemaker (preferably one that is not in a person). Show how it can be executed from a smart phone while walking down the street or sitting at Starbucks.

Send that to the company and the media. You are best off also showing documentation that you told the offending company multiple times.

Show don't tell.

</comment><comment><USER37> "The problem is that dropping a pacemaker 0day is so horrific that most people would readily agree it should be outlawed. But, at the same time, without the threat of 0day, vendors will ignore the problem."

If this is the case, then wouldn't the same most-people (if made aware of the issue) also agree that it should be illegal for a company's management to ignore life-threatening software flaws in their products after being notified?

I mean illegal as in reckless endangerment or manslaughter, not illegal as in lawsuits and golden parachutes.

</comment><comment><USER38> And so it begins. I was wondering when we'd finally start seeing the InfoSec guys get to this. The more recent stuff branching into CAN on cars and before that SCADA systems seemed to be the last sort of stepping stone from a traditional PC network to the internet of things networks.

I'm sort of glad, in a twisted way, that this has finally happened. Better the light get cast on this now than in a few years once the criminal(/nation- state...) equivalents have had time to go through it themselves.

</comment><comment><USER39> I remember reading that Cheney had them remove all wireless functionality from his pacemaker because they were afraid of the potential of someone using it for assassination.[1]

[1][http://abcnews.go.com/US/vice-president-dick-cheney- feared-p...](http://abcnews.go.com/US/vice-president-dick-cheney-feared- pacemaker-hacking/story?id=20621434)

EDIT: Also, no you shouldn't release a pacemaker 0day. As others have said, expose it without releasing details. Makes for a nice demo.

</comment><comment><USER40> I think that there are a lot of ways to approach this. The Heartbleed disclosure was very well done and has a lot of lessons, perhaps there's something to learn from that.

Personally, I think it's completely unacceptable the way many technologies critical to keeping people alive are so vulnerable. Especially if the vulnerabilities are as widespread as the article suggests (30%!), find a list of 10-20 that vary in importance. List all the products, and list the consequences of each vulnerability.

Then start dropping 0-days one at a time until the industry realizes you are serious. Start with the less severe ones, but if the pacemaker vulnerability hasn't been addressed after a few months of weekly vulnerability releases, don't hold back. The more publicity you can get the more likely a company is to patch vulnerabilities.

If _teenagers_ are capable finding vulnerabilities that can end lives using a script they downloaded online, then we need to be ready to take drastic action. The industry is in a terrible state and we aren't safe, and decreasingly so as these gaping holes continue to sit there and be discovered.

</comment><comment><USER41> This is an incredibly sensational piece. All of the sane suggestions are dismissed as "doesn't work" by giving one example where it didn't work. It's not that easy - going to the media won't solve the problem 100% of the time but it sure as hell would if it were a life and death 0day and wasn't fixed with urgency.

Don't even get me started about the Nazi analogy...

</comment><comment><USER42> If it's an obvious vulnerability, is there value in withholding the details? There is a strong case to be made for the argument that the people who would be willing to use such a 0day maliciously (sociopaths) would find it anyway.

It could potentially also depend on how easily the vulnerability can be patched—one that can be patched remotely can be dealt with much more rapidly than one that will require surgery to replace the device. If one assumes that full disclosure will lead to the fixing of the issue, the first class is probably closer to being judged "responsible" than the second.

It is certainly a difficult dilemma. The correct answer can only be known with the benefit of hindsight…

</comment><comment><USER43> When there is a flaw in a car seat or child's toy everyone flips shit and recalls start happening. It's covered on the local news and all that. Why doesn't that happen for pace makers? Isn't this a problem for the Consumer Product Safety Commission or the FDA?

It's a product that has a flaw. Seems like it qualifies for a public recall.

</comment><comment><USER44> I don't understand why there is such a debate here. I would _absolutely_ disclose the 0-day if the manufacturer was unresponsive (given sufficient warning, of course). Moreover, if anyone died, I wouldn't feel the least bit guilty about that - the guilt rests firmly on the manufacturer and the individuals who choose to use the exploit.

After all, black-market exploits will come, and people will die, whether you disclose the vulnerability or not. At least with disclosure, the innocent have a chance to protect themselves.

You must weigh the lives lost to silence against the lives lost to disclosure. We practice disclosure in all other areas of computer security because we have seen the cost of silence too many times. There is no reason it should be different here.

Disclosure saves lives.

</comment><comment><USER45> This is clearly something where a regulatory agency that can and will apply penalties to manufacturers that do not fix bugs that are physically possible to fix without ill effect in a timely manner is appropriate. You simply report to that agency.

These problems are serious enough that failing fast and hard is not a good way to go about it. This is software meets physical reality. In software land, we've developed radically different approaches to engineering problems because of the incredibly cheap costs. This is one place where we have to borrow from other disciplines that have more experience with safety issues.

</comment><comment><USER46> Solution I find is relatively simple from a moral standpoint. Exhaust all options. Instead of saying 'ah it won't work', just do it anyway, contact anyone and everyone , privately related to this, about this and do everything you possibly can before press exposure. With the press you can demonstrate but not release the actual steps to how it's done. If it is still denied as fake or ignored despite all of that, release it if you feel the moral obligation to do so. 'You must do what you think is right, of course'.

</comment><comment><USER47> Of course, don't publicize it.

But consider a though experiment: From a security perspective, does it really increase risk? There are many ways to kill someone that are much simpler than figuring out what pacemaker they have, finding a 0day, designing an attack and implementing it. This vulnerability doesn't necessarily increase the risk that someone will be murdered.

EDIT: Or if you want to attack the pacemaker, use radiation from microwaves or similar devices. At least according to signs posted in many places, they are dangerous to users of pacemakers.

</comment><comment><USER48> There seems to be this idea embedded in human minds that there is a group of people who are just waiting to kill someone, and the fact that they have not yet found a way of doing it is the only thing preventing them from doing so. As soon as you show them that you can do it by hacking a pacemaker, they will go ahead and do it.

There is no shortage of methods of killing someone or inflicting bodily harm. As far as moral culpability, showing how a 0day exploit can be used to kill a person is akin to saying that you can use arsenic to kill grandma.

</comment><comment><USER49> relevant: "It's Insanely Easy to Hack Hospital Equipment" (wired.com)

[article]: [http://www.wired.com/2014/04/hospital-equipment- vulnerable/](http://www.wired.com/2014/04/hospital-equipment-vulnerable/)

[hn thread]: [https://news.ycombinator.com/item?id=7684291](https://news.ycombinator.com/item?id=7684291)

</comment><comment><USER50> Of course you can. Executing this type of attack would be more technically complex then executing a plain old murder, with say a simple gun.

<comment><USER51> But also significantly less traceable back to the murderer.

</comment></comment><comment><USER52> Notify the manufacturer's products liability insurer through a respectable and concerned PI lawyer. Action will be swift.

</comment><comment><USER53> Ideally, there would be some way to disclose this kind of info to whatever government regulatory agency is responsible for approving these things. In your situation, you have to worry that whoever you disclose this to is going to act irrationally, and governments exist to mediate between irrational actors for the benefit of the public.

</comment><comment><USER54> Wasn't Barnaby Jack going to unveil a Pace Maker 0day last year before he [mysteriously] died?

<comment><USER55> He didn't mysteriously die. There are several people on HN that knew him personally, and there's been a lot of creepy not-even-wrong speculation about what happened to him. None of his friends appreciate it.

<comment><USER54> I was referring to the timing of things. But yes, I don't disagree. He did some very brilliant work.

</comment></comment></comment><comment><USER56> Drop the 0day. I'd say Anonymously, but not necessarily. If its an obvious bug, this isn't a moral issue at all. Had it been a multi stage, complicated exploit (hard to find and implement), I would suggest otherwise. In this case its a no brainer IMHO.

</comment><comment><USER57> @fiatmoney's comment seems like very good advice. Here's a link since it's very far below the fold:

[https://news.ycombinator.com/item?id=7849734](https://news.ycombinator.com/item?id=7849734)

</comment><comment><USER58> I think that unless you want to carry the burden of possible assassinations that you could have stopped, you have to disclose the vulnerability ASAP. In order to avoid legal vendettas, I recommend to do it anonymously.

</comment><comment><USER59> Pacemakers have a remote exploit bug ? If you can get this close to my heart, you might as well stick a knife in it. The only difference is the one will look like a failed pacemaker and the other will look like murder.

</comment><comment><USER11> I suppose Heartbreak Bug would be an awfully appropriate name for one.

</comment><comment><USER60> Write a script for CSI or one of these police procedural shows.

</comment><comment><USER61> Warn the CDC of an impending health issue and include very specific details or the at risk group and the transmission vector.

</comment><comment><USER62> Anonymously do what you think is right.

It would be interesting if someone created a payload that patches exploited device.

</comment><comment><USER63> The ONLY people who need to know about this is the manufacturer and their regulatory body FDA, etc.

The company can then pull all the inventory that is in and out of the patients and apply fixes or facilitate replacements.

If this could kill people, I'd hope the above ideas would be obvious...but well I know they won't be to everyone.

<comment><USER64> Correct, it's not obvious to me. If there is a flare in my medical device, I want you to tell me about it...

It's amazing to me that you think I'm not entitled to know there's a problem. Do you also believe I shouldn't be informed if the lock on my door doesn't work? You must hate those consumer watchdog shows!

If someone is capable and willing to kill Mr with a pacemaker bug, they likely already have the skills to find the bug. Not telling me just withholds the opportunity for me to protect myself (stay indoors? Contact doctor, etc).

<comment><USER65> You should definitely be informed there is a serious issue. Whether you (and everyone else) should be given instructions how to duplicate that issue is a different matter.

</comment></comment></comment><comment><USER66> Is there any secure way to update a pacemaker's software without surgery?

</comment><comment><USER67> Contact the surgeons who implant them and demonstrate to them.

</comment><comment><USER68> was really sketchy when it happened on homeland

[http://vimeo.com/63176830](http://vimeo.com/63176830)

</comment><comment><USER69> Where is the landing page and scary logo ?

</comment><comment><USER70> You can play moral white hat hacker when you are disclosing vulns in some shitty Chinese router, or participating in one of bug bounty programs, but NOT when you play against big boys (AT&T, MBTA, Juniper, Adobe, etc). You will get crushed, jailed and humiliated.

Disclose fully, but anonymously.

</comment><comment><USER71> I call BS.

How does an ECM (or anti-lock brake controller) "slam on the brakes"?

<comment><USER72> All cars produced for US sale after 2011 have mandatory traction control systems that work by modulating the brakes on a corner by corner basis. It's not inconceivable that this could be hacked.

<comment><USER71> OK.

[http://cfr.regstoday.com/49cfr571.aspx#49_CFR_571p126](http://cfr.regstoday.com/49cfr571.aspx#49_CFR_571p126)

</comment></comment></comment><comment><USER73> I would snap insta do it for the fame and future business opportunities alone.</comment>


Show HN: Free Private GitHub Repositories - <AUTHOR> https://github.com/awalGarg/free-private-gh <comment><USER2> Hmm. You don't even need a script for this, just a willing donor who has a paying account.

I wonder how Github will plug this hole. Is it as simple as disallowing forks of private repositories?</comment>