New security issue at Dropbox - <AUTHOR> http://pastebin.com/yBKwDY6T <comment><USER3> A slight tangent...

I recently looked into password managers myself after the MtGox leak. I tried 1Password and LastPass. While both do what they say--I found them cumbersome to use.

I settled on a scheme like this:

E-mail: Very strong, completely unique. 2-factor auth. If you have my e-mail, it's game over.

Bank: Very strong, completely unique.

The rest of the passwords I've broken down into tiers. I've memorized a password for each tier combined with a hashing algorithm stored in my head.

The theory here being if an entire tier gets compromised (someone figures out my hashing scheme), at the very worst I lose the entire tier.

This does keep me safe from automated attacks, but not if someone singled me out individually. Which in that case, I've got other problems.

This isn't perfect, but it gives me a couple of things I really value:

\- Keep all passwords in my head

\- Unique passwords on each site

\- Tiered passwords so if someone figures out my hashing scheme, they only get that tier

I like the idea of password managers, but in practice they were too much hassle for me.

<comment><USER4> The MtGox breach inspired me to switch to LastPass. I used to do what you did, and MtGox was part of my "medium security" tier.

Now, I've decided that there is no real effective solution other than randomly generated passwords unique to each site.

I also turned on 2-factor auth for Gmail a couple months ago - their SMS system is really effective.

I do have to credit Google for being extremely awesome when it comes to security... They noticed a few "your password has been changed" emails incoming to my inbox yesterday and immediately put a security flag on my account, requiring me to re-auth with 2-factor and change my password. Google is really proactive when it comes to security. The fact that they can recognize a high number of password change emails arriving as an indicator of possibly account hijacking is just amazing.

I think LastPass is probably as good of a solution as any. They only store your encrypted password database in the cloud. With a strong enough master password and optional 2-factor authentication with Yubikey, it seems quite secure.

<comment><USER5> My reason for not using LastPass is because it is proprietary. In fact, there has been an XSS attack on them in the past which was somewhat successful. I use KeePassX because it allows me to avoid laying trust on any proprietary entity. At present if LastPass were to have another security flaw (and hey, security flaws on web-facing servers are all too common) you'd be out of luck. With KeePassX security is local. The worst case for me is someone stealing my database and trying to bruteforce the password (hah, like that'll happen). This requires them to have physical access to my computer. Anyone can take a guess at your password because it's a web based service.

<comment><USER4> KeePassX is still vulnerable to a keylogger on your local machine.

LastPass with 2-factor auth should be more secure than KeePassX, however, your point about it being proprietary is well taken.

I also think LastPass has a very good reputation for full disclosure - <USER2> the salted hashes of master passwords were compromised in 2010 it was very refreshing to see the CEO come forward and give immediate full disclosure to the public about the implications, and why you should change your master password.

I also find it refreshing that if you have a strong master password, even someone compromising their entire database should not give you reason to worry - it would be similar to someone getting a copy of your KeePassX database - it's still encrypted with high-grade encryption.

</comment></comment></comment></comment><comment><USER6> It's 2011. Why are people still surprised when some blatant hole is found in a site? Does everyone just delude themselves into thinking "oh, they HAVE to be secure"? That old cliche 'nothing is totally secure' is almost right: the reality is, everything is mostly-not secure.

Tips on never getting caught with your pants down by a 3rd party service:

1\. Never ever rely on a service maintained by a 3rd party to remain secure. Just assume they will be compromised in the near future (including your password).

2\. Make your password strong but don't reuse it; save it in your browser password cache or keyring. Use a memorized really-freaking-difficult master password for the browser cache/keyring.

3\. Use NoScript and updated browsers to help prevent XSS and other simple attacks from compromising your cached cookies.

4\. Encrypt all sensitive stored information yourself using a well-vetted tool such as gpg, openssl, etc and store the encrypted files on the 3rd party service.

5\. Keep hard copies of your secure files, keys, etc in a secure location. 'The Cloud' is not a backup, it's a trap.

<comment><USER7> > That old cliche 'nothing is totally secure' is almost right: the reality is, > everything is mostly-not secure.

A security hole is one thing, but something like being able to log into anyone's account with whatever you'd like as the password? Or changing a digit in a URL and accessing someone else's account? Come on, that's like the guards at Fort Knox leaving all of the doors open directly to the gold, or the Secret Service collectively going out for a smoke break during a presidential parade.

<comment><USER6> If you're relying on a cloud-hosted startup to secure gold or the president, you're doing it very, very, very wrong.

The level of complexity of an attack and the ridiculousness of a hole are almost completely arbitrary in terms of compromising the security of a service. The biggest attacks of the past 6 months were performed either using social engineered credentials or extremely common web application vulnerabilities (so common that probably every hole used is on OWASP's Top 10 security holes).

The only reason Fort Knox or the Secret Service works is because it relies on humans spending 100% of their time actively focusing on security, 24 hours a day, every day. No web service I have ever heard of has that level of security.

As far as this particular hole: it's probably a bug somebody left in some code by accident and nobody foresaw the consequences. There are bugs like this in every system. The only reason you don't see more of these holes is because either nobody's looking for them or somebody found it and is keeping it very secret.

</comment></comment></comment><comment><USER8> " _there was a very brief glitch and this should never happen/be possible again. thanks for the email._ "

Yikes

</comment><comment> mike-cardwell Dropbox _owes_ their customers a public explanation.

<comment><USER9> Yes, I agree. But until I don't hear a confirmation from Dropbox I am going and assume that all this never really happened and it's just a prank. It seems too big and too weird to be true. edit: This is the guy who reported the "glitch" <https://twitter.com/#!/csoghoian> seems legit. I am shocked.

<comment><USER10> "But until I don't hear a confirmation from Dropbox I am going and assume that all this never really happened and it's just a prank."

Various big-name dropbox people are likely aware of this thread now based on their quick responses to previous threads here at HN. The fact that they've said nothing here is virtually an admission that there was a problem. It only takes a few seconds to bang out a 'this claim has no merit' post if it indeed does have no merit.

The question is, are they working on some sort of official statement to make (which would have to be exactly worded and thus I can understand the lag time) or are they ducking down and hoping this will just blow over?

IMO they absolutely need to address this very soon, and not just as a one line email that promises it'll never happen again.

<comment><USER9> Yes, I agree with all you write now. It just seemed such a weird issue though. Hard to imagine how something like this can happen accidentally.

</comment></comment></comment></comment><comment><USER11> People have been slamming Dropbox quite a bit, and it's not all entirely unwarranted.

I think that part of this is how Dropbox is handling things, and the fact they appear to be growing faster than they can code.

I'd love to see them offer something like a free lifetime 50GB account for anyone the submits a high security reproducible bug like this. Sure, they may end up giving out a couple of terabytes of free space, but the intense QA they would get for free would likely be worthwhile.

</comment><comment><USER12> Well, this definitely cinches it. I had stuck with Dropbox thru the whole "your files aren't THAT encrypted" debacle because I have nothing worth hiding. But, this complete incompetence has convinced me that it isn't worth the risk!

I'm not as highly paid as the Dropbox guys are, I'm sure, but even _I_ know to test authentication with automated tests. Oh, and not to let things that fail tests through to production!

What if I had archived my bank records there and someone go ahold of them? Thankfully I'm still just a little too paranoid for that.

I'm moving to Wuala or rsync.net; before I try the latter I want to test Wuala.

<comment><USER7> > I have nothing worth hiding.

Mind putting up a mirror of your Dropbox folder?

<comment><USER12> Heh, that'd take maybe 60 seconds. I've only got a few articles that I've saved, a few screen shots, and one tiny demo project.

As I said, it wasn't worth worrying about.

</comment></comment></comment><comment> mike-cardwell <https://www.dropbox.com/help/27>

"Your files are backed-up, stored securely, and password-protected."

Except, apparently, you don't even need to know the password to get access to the unencrypted files.

I wish somebody would clone exactly what Dropbox does, but get the encryption/security right so that it is _impossible_ for anyone other than the account owner to access their files. Dropbox will _never_ get security right.

<comment><USER13> _Dropbox will never get security right_

I fail to see how you conclude that. Yes, they did have several glitches in the past, and no, they did not always respond as they should have.

But there are some pretty smart people working at Dropbox. What makes you think they do not have the capacity to solve security issues?

<comment> mike-cardwell They should have made it so files can only be encrypted/decrypted client side. They sacrificed this security so that they could do two extra things.

      1.) De-duplication
      2.) Web access to the files.

They also sacrificed the security of the mobile clients by disabling SSL, in exchange for a small speed increase.

Those are the main reasons I have come to this conclusion.

<comment><USER14> From what I can see the mobile clients _do_ use SSL:

<http://forums.dropbox.com/topic.php?id=24507>

<comment><USER15> They do _now_.

Here is a forum post where they admit that mobile SSL was impossible.

<http://forums.dropbox.com/topic.php?id=10669>

<comment><USER14> That is pretty bad! :-(

</comment></comment></comment></comment></comment></comment><comment><USER16> For the record, Arash isn't some random support guy, he's the CTO.

That means the support team properly escalated this way up the food chain very quickly, and I'd be extremely surprised if we didn't see a response from Dropbox later today.

</comment><comment><USER9> Other people noticed this on the dropbox forum: <http://forums.dropbox.com/topic.php?id=40113>

</comment><comment><USER17> There's a blog post addressing this incident now on the dropbox blog:

<http://blog.dropbox.com/?p=821>

It is very light on details of how exactly the problem occured other than saying it was due to a bug in a code update.

<comment><USER18> They say that less than 1% of all of their users logged in during the vulnerable time frame. I suspect those are weasel words to downgrade the apparent severity of the problem. A more useful metric would be # user logins during vulnerable timeframe / # user logins per day.

</comment></comment><comment><USER19> This is the sort of thing where the submitter (at pastebin in this case) should be absolutly sure that the bug is fixed from Dropbox' side before telling the hole world about it.

This way everyone is happy, and not to mention safe.

I'm so tired of seeing all these username/password leaks lately. It is not doing anyone anything good, except from teenagers and thieves which thinks it is funny to empty Amazon accounts or upload nude pictures on Facebook (etc. etc.)

So, in all fairness, the submitter did actually contact Dropbox first (which is great), but please wait until they definitely have fixed before telling the world about it. Or at least, that is my humble opinion.

<comment><USER20> The poster _did_ contact Dropbox and was told, essentially, "it's a glitch, don't worry about it."

The poster was not told any details about "the glitch" -- we don't know if it was a one-time issue, or if it represents a deeper architectural issue. In this case, full disclosure is _absolutely_ warranted.

Applying the most optimistic reading, Dropbox fixed the problem, so disclosure is fine. The most pessimistic would say that the problem still exists, and that disclosure will cause exposure, but will also prompt further scrutiny to the issue.

</comment></comment><comment><AUTHOR> I haven't tried to reproduce this yet, but if it's true, it's quite serious.

<comment><USER21> I just tried, and failed to reproduce.

So, at the moment, there's nothing to see here.

<comment><USER22> Still. MY god this is worrisome.

</comment></comment></comment><comment><USER23> I cannot reproduce.

<comment><USER24> Read the complete correspondence. It was fixed.

<comment><USER25> Or was never an issue in the first place.

</comment></comment></comment><comment><USER26> Doesn't work.

</comment><comment><USER15> Last time the Dropbox security thing was in the news, regardless of your personal preference on what encryption keys dropbox should have been using, the issue and more importantly the way they handled it made me question their abilities. Then they sent a DMCA takedown notification notification to someone they were just trying to censor, and now they temporarily set their auth method to "allow any password".

They are showing us that they are technologically incompetent at managing their own systems. I don't know why anyone continues to do buisness with them for files they want any sort of privacy over.

I've moved to rsync.net. Its uglier, but at least they know what the fuck they're doing.

<comment><USER27> > I've moved to rsync.net. Its uglier, but at least they know what the fuck > they're doing.

How do you know? Could it just be that the only reason Dropbox has publicized exploits and rsync.net doesn't is because Dropbox has many, many more users? And thus more people trying to exploit it and more publicity when an exploit is found?

<comment><USER15> >How do you know?

Pubkey auth connecting to openssh on freebsd to hippa- pci- sox- and sas 70- compliant storage with a warrant canary and you can give them a call to talk to the engineers (I have). Looking back dropbox feels like a fly by night in comparison.</comment></comment></comment>


Eating Healthily for $3 a Day - <AUTHOR> http://www.miketuritzin.com/writing/eating-healthily-for-3-a-day/ <comment><USER3> My wife and I tried to do this recently on $1.70 per person per day. We didn't last our intended 28 days. A few observations we found:

Meat and organic food was too expensive.

Fruit is crazy expensive so we bought OJ from concentrate with no additives as a cheap source of Vitamin C.

Eggs were are very expensive, but we needed the protein and nutrients, so rationed ourselves to 3 each per week.

We had to remove all sugar to save on cost and sugar crashed badly.

We decided that Costco was cheating due to the $70 membership fee and so we alternated between Safeway and Walmart.

You quickly learn the difference between broccoli florets and stems. [Stems are cheaper]

Baking your own bread is incredibly cheap and if you're using a sourdough starter you just need flour, salt and water. It's a great staple and adds taste to the meal. I scraped the unused flour off the work bench and dumped it back in the sourdough starter to save on cost.

Lentils are the most complete non-meat protein source.

Combining beans and rice give you a complete protein.

Cheese is too expensive and you can't make cheese from regular organic off- the-shelf homogenized ultra-pasteurized milk. It just doesn't set when you add the rennet.

You can buy coffee for $1 for a months worth of ground coffee at walmart. It's called Master Chef and it tastes like a used catbox.

Before we did our experiment we found a few "living on a dollar a day" blogs, but every single one bought in bulk and then calculated the cost of each scoop they took out of the bin. They also didn't care about nutritional completeness and basically starved themselves for the period.

After trying to do this on $1.70 and failing, I think Mike's budget of $3 is probably a realistic per person budget if you're going to stay healthy.

<comment><USER4> if you want to save on coffee, buy green beans and roast. I pay around $30 for 5lbs of green beans that are extremely high quality. you can do far cheaper than that though.

<comment><USER5> Where do you buy those beans at? Online or a local coffee joint?

<comment><USER6> I get mine at <http://www.sweetmarias.com> \- they have info on roasting using a popcorn popper and other cool things.

<comment><USER5> Oh wow, this is awesome, they're right down the street from me. Thanks!

</comment></comment></comment></comment></comment><comment><USER7> I've thought about putting together a brief founders' cookbook with a dozen or so of the recipes for things that I survived on in the lean days that you can make for about a buck or two and in about 20 minutes.

The real trick is not buying prepared foods at all. Things like flour, rice, eggs, beans, pasta, potatoes, fresh fruit and vegetables, milk, yogurt, cheese, ground beef, fish filets and chicken breasts are all reasonably cheap and you can have a lot of variety with a relatively small set of ingredients on hand. With some practice you get to where you know how to parallelize the cooking steps so that you can get everything done and even cleaned up faster than you could run out for fast-food.

Secretly I want our next office to have a full kitchen since one of the things I miss when I'm at our office is being able to cook in the middle of the day.

<comment><USER8> Have you tried the stonesoup cookbook? Premise: 5 ingredients, 10 minutes cooking time per dish. I've tried a couple, and they seem brilliant so far.

<http://thestonesoup.com/blog/2010/06/a-free-e-cookbook/>

<comment><USER7> I have looked at it actually, and it's pretty neat, but for the way that I do things it has a fatal flaw: the ingredients are exotic (i.e. where I live they're expensive and you'd need to go to a specialty shop for some of them) and don't overlap much between recipes.

From the looks of things, he's a much better cook than me. The stuff I make is far more ghetto, but revolves around like 15 ingredients or so that I basically buy every time I go to the grocery store. That keeps me from having to actually plan meals. I usually cook in the opposite direction -- I look at what I have on hand and figure out what I can make from that.

My gut sense is that that would be more approachable for folks that are transitioning from fast-food and frozen pizzas.

<comment><USER9> _the ingredients are exotic (i.e. where I live they're expensive and you'd need to go to a specialty shop for some of them) and don't overlap much between recipes._

I had a housemate who kept a copy of the Wycliffe International Cookbook. It was originally meant for overseas missionaries, written with the expectation that the user would have trouble getting access to the wide variety of ingredients specified by most cookbooks (which also made it useful for a college student kitchen).

</comment></comment></comment></comment><comment><USER10> I'm sorry, but I really disagree with any sort of dieting advice articles appearing on Hacker News for multiple reasons. Reading this thread only backs up my own thoughts and reasons why I dislike these articles.

First of all, everyone has their own idea of healthy.

Second, there are so many different diets, fads, foods, etc to eat or follow that's it ridiculous to even argue one way or another. Some eat lots of protein, some eat lots of fat, some eat low fat and high carbohydrates and everyone believes their method or means of eating is healthy. I'm sure no matter which way anyone argues there is a book, article, pubmed article to back up your ways. Making statements such as that can't be healthy, or you need to eat vegetables, fats, a certain amount of calories, and other similar statements is only someone else's opinion or belief and everyone is different.

Go with what makes you feel good. The best diet is the one you can follow. Listen to your body.

I would down vote this, but I can't down vote yet.

I'll probably get down voted for all this text, but I feel that strongly about this.

Frankly, what else bothers me is that almost any time someone expresses disagreement, they get down voted. Thus, people who disagree often times probably end up never posting.

<comment><USER11> > First of all, everyone has their own idea of healthy.

> Second, there are so many different diets, fads, foods, etc to eat or follow > that's it ridiculous to even argue one way or another...

> Go with what makes you feel good. The best diet is the one you can follow. > Listen to your body.

Don't mistake the presence of disagreement as evidence for there being no fact of the matter. It's of course difficult to make strong claims about complex machines like people without large, expensive randomized studies, leaving the door open for people to argue for whatever preconceived ideas they have. But that doesn't mean there is no answer, nor that you should just do whatever makes you feel good.

That said, yes, these threads are largely useless.

> I would down vote this, but I can't down vote yet.

I don't think anyone can downvote posts (aka articles, links). (At least I can't with 1.6k of karma.) It's just comments you can downvote after you get <s>200</s> 500 karma or so.

(Edited in response to BoppreH's comment.)

<comment><USER10> Thanks for replying. I figured people wouldn't read into it like that, but what I have learned is that one has to state very explicitly on Hacker News.

I agree with you and I was hesitant to state what I did about that.

Off Topic: I really wish one could not up or down vote anything without requiring a comment in reply stating your reasoning. I think it could lead to much more active and interesting discussions breaking out.

Maybe I was a little harsh stating I would down vote the submission.

Edit: Spelling and grammar stuff.

</comment></comment></comment><comment><USER12> As a vegan on a limited budget, this approximates many of my meals (though I could stand to eat more nuts and seeds and fewer grains), and I can attest that any day I eat roughly this mix of foods is a day I feel superbly healthy.

I would suggest replacing the low-fat dairy milk with a non-dairy alternative such as soy or almond milk. Although this would up the cost to $3.50ish/day, non-dairy milks are usually fortified with more calcium than dairy milk contains naturally, and are often fortified with B12 as well.

<comment><USER13> If one can afford to invest in a soy milk maker, or persuade family to buy it as a present, making soy milk is extremely cheap. Also, what comes out of a soy milk maker is massively better than what you can get in a box.

I use a combination of soaked soy beans and ground coconut, for a grand total of about 15 cents a quart, including a bit of salt, vanilla, and a tablespoon of sugar (optional). It's a major dietary staple for me. I use the Joyoung CTS1048, reviewed here: <http://www.kk.org/cooltools/archives/004154.php>

Such a device pays for itself in a month or two, if one is a regular soy/nut milk aficionado.

<comment><USER14> * That isn't fortified with calcium + B12 (and all the other stuff like vitamin A and D) like the store-bought stuff.

* If you really want to be simple, you can make cashew milk in a blender with: 1 cup cashews + 3 cups water. (Works better than making almond milk as there is no pulp to strain out)

</comment></comment></comment><comment><USER15> Wow, the amount of protein in this diet is really low. And all those carbs may not be for everyone. This diet may be cheap, but not healthy.

If you are the type of person who puts on weight easily (like me), than I would suggest doing 50% to 60%+ of your calories from protein and 20% or less from carbs. The easiest source of protein are white eggs (in a carton), chicken (pre-cooked), beans (get low sodium), and protein shakes (whey during the day and casein at night). All these foods can be prepared with just the microwave.

Eating carbs is the easiest way to gain extra pounds. Removing carbs also removes any food coma you may experience after eating a meal, allowing you to be more productive.

I lost like 30 lbs without trying that hard by eliminating carbs and focusing on protein. The degree to which I'm in shape one day is correlated to how much carbs I have avoided in the previous few days.

And of course, take vitamin supplements. Throwing in some veggies for the fiber, or take fiber supplements.

<comment><USER16> Back when our diet was 54% carbs and 12.6% fats & oils, we were a lot thinner than today (43% carbs, 24% fats & oils).

[https://docs.google.com/viewer?url=http%3A%2F%2Fwww.cnpp.usd...](https://docs.google.com/viewer?url=http%3A%2F%2Fwww.cnpp.usda.gov%2Fpublications%2Ffoodsupply%2Ffoodsupply1909-2004report.pdf)

<comment><USER17> _Back when our diet was 54% carbs and 12.6% fats & oils, we were a lot thinner than today (43% carbs, 24% fats & oils)._

I'd say there's too much fixation on "carbs" and "fats" and too little on the source. Would you agree that eating a fresh apple gives a different effect compared on eating a couple of teaspoonfuls of white sugar, even if the carb and caloric content is equal? I wish there was a breakdown for the source of micronutrients somewhere.

And of course, the total amount of calories and sedentary lifestyles contribute greatly to people being overweight.

But what does contribute to the growth in rates of cancer, diabetes, heart diseas and other "diseases of civilisation"? This is not so easily answered by just breaking down the food by carbs/fats/protein.

</comment></comment></comment><comment><USER18> Can I ask: What is the motivation of trying to limit the cost of your food to such a low (for first-world) amount? I am really weirded out by the number of me-too responses, the philosophy of such extreme saving on food is alien to me.

For me, delicious food is near the top of my priority list. I really do not stint at all, my grocery bill is abt $40/day for 2 people... that is $15k/yr, such a bargain considering: rent+utilities on my modest apt is $35k/yr, 2 cars (Subaru+Toyota... not fancy) abt $20k/yr all up (I live in Australia).

Good food is such a bargain.

<comment><USER19> A few things.

1\. Perhaps they have substantially less spending money than you do. (I never understood cutting back on food expenses until my wife and I went through some tough financial times.)

2\. Perhaps they don't value food as much as you do. I enjoy good food, but I'd never say that it is near the top of my priority list. I'd much rather have cheap food and a better broadband connection than the reverse.

3\. Perhaps they are trying to scrape together every bit of money they can to put towards their startup. There is a reason that PG uses the phrase "ramen profitable."

<comment><USER20> I'm scraping together every bit of money towards my startup... but not skimping on food at all. Perhaps that's because it's a food startup and I'd feel hypocritical eating ramen everyday! But, really, it's more because I think there are better things to skimp on than food.. i.e. the fuel that makes us who we are and sustains us _everyday_.

Besides I've got 3 years of data to show that it's possible to eat cheaply and still get great food.. you just have to do a few things:

1\. buy in volume 2\. cook for yourself/others, don't eat out 3\. cut back on meat 4\. waste as little as possible!

The startup is foodia, btw. More to come soon...

</comment></comment></comment><comment><USER21> Broccoli crowns are on sale this week at Lucky (in the Bay Area) for $0.57 / lb. This should allow the OP to shave at least $0.50 per day from his food budget. :-)

<http://www.anyleaf.com/product/broccoli-crowns>

As the co-founder of AnyLeaf, I talk to lots of people about saving on food and groceries. Some people "trade down" to save money, e.g., by replacing meat with beans. My personal strategy is to determine the diet I'd like to eat and that I consider healthy (the Paleo Diet, in my case) and then plan my shopping around the weekly sales offered by grocery stores. The variation in the price of a given item at a given store throughout the year is huge. Almost everything goes on sale for at least 50% off at one time or another. Also, every week there's almost always a good sale being offered on some product in every category (meat, seafood, fruit, vegetables, etc). A typical meal for me is meat or seafood with some vegetable and some fruit for dessert. If there's a great sale on chicken breast, I'll have chicken breast. If the sale is on ground turkey, I'll have ground turkey. Likewise with fruit and vegetable choices. Shopping this way is a low-effort (if you use AnyLeaf) way to save substantially without trading down and compromising your nutritional goals.

</comment><comment><USER22> He follows (old) USDA dietary recommendations, which stipulate no saturated fat, and 60% carbs. That is really, really bad. The ultimate reference is "Good Calories, Bad Calories" by Gary Taubes - it is meticulously researched and referenced, and is likely 40 years more up-to-date than your nutrition or medical professional.

<comment><USER23> Gary Taubes is a journalist, not an expert in nutrition. He also has a track record of questionable academic honesty. He's an excellent writer who has cashed in fabulously on fad diets, particularly the Atkins craze 10 years ago. Follow his advice at your own risk.

<http://reason.com/archives/2003/03/01/big-fat-fake>

<comment><USER22> I've started reading this hit piece, and saw, e.g.

> "One can lose weight on a low-calorie diet if it is primarily composed of > fat calories or carbohydrate calories or protein calories. It makes no > difference!"

Quoted from one of the "experts" refuting taubes. And yet, research by Robert Israel and Michel Cabanac (full list of references in Roberts' "What Makes Food Fattening" bibliography) shows that this is completely untrue - <USER2> flavor makes a huge difference, let alone "caloric intake". (BTW, if anyone can point me to any peer reviewed paper that validates "calories in-calories out" theory, I would be thankful. It appears to be an argument of faith, not of science, as far as I can tell).

Good Calories Bad Calories is meticulously referenced. You may disagree with the content, but as far as science writing goes, it doesn't get any better or more rigorous.

(And that's less of a compliment to Taubes, and more an indication of the sad, sad state of science writing).

Taubes is a scientist and a journalist. The fact that nutrition is not his original field doesn't change much.

<comment><USER24> You're saying one can't lose weight on low-calorie diets that are primarily composed of carbs?

In that case, we should send a single rice grain to all starving persons to serve as their only nutrition.

I imagine you have a more nuanced point, but the statement you quoted is clearly true taken for what it actually is saying.

<comment><USER22> > I imagine you have a more nuanced point, but the statement you quoted is > clearly true taken for what it actually is saying.

You are right, of course. Without quantifying (how low is "low calorie"?) these statements are useless.

There was an experiment in Mass General some 15 years ago, in which they were able to get people with similar lifestyle/activity on 1500 cal/day diet. About one third lost weight, one third stayed the same weight, and one third gained weight, depending on how exactly the diet was composed.

Yes, you will lose weight, regardless of diet composition, on less than 800 kcal/day. Is that "low calorie"? "too low calorie"? "moderate"?.

No, you will not necessarily lose weight on more than 800 kcal/day. You probably will if your diet was not specially crafted to make you keep your weight on 800 kcal. When you get up to the 1200-1500 range, there is a non- negligible probability of "accidentally" gaining weight (or at least not lose it) by randomly stumbling on a bad diet composition.

One of Cabanac's (If I'm not mistaken) experiment was able to make rats gain weight for 3 weeks on a diet of water+chalk (caloric value 0) for a while, by feeding them water+sugar+chalk for a while, and then dropping the sugar. Sure, it was water gain - but the calories in - calories out theory fails so miserably in this case (and countless others) that it cannot be taken seriously. (For only 3 weeks for a rat; it might not hold for a human for a few months in similar conditions).

The calorie accounting is an approximation at best, which possibly takes several months to a year to average out reasonably, whereas a lot of the research focuses on results over 3 months or less.

<comment><USER25> I'd bet a fair amount that your Mass General study used self reported calorie intake.

800kcals a day is typically enough for a 100 lb person to lose nearly a half a pound of fat a week. That's low calorie by most people's measure. Certainly mine at 200lbs

When most people are talking about 'losing weight' they mean losing fat. At least losing actual body tissue. Anyone can gain or lose 10% of their body weight in a few days by controlling for carbs. But its just water.

Try to ignore rat studies if you possibly can. Their metabolism, particularly their capacity for denovo lipogenisis is very very different than that of human beings.

<comment><USER22> > I'd bet a fair amount that your Mass General study used self reported > calorie intake.

99% of nutrition studies are, but this one wasn't. I can't find the reference now, though.

Personally, I've been on a ~1200kcal/day diet for years (for some of that time, I did very detailed tracking), and stayed at my 220lbs. Which, of course, makes no sense, and it didn't to my girlfriend at the time who was an MD - so she decided she'd show me how wrong I am by eating the same as me. She lost weight quickly and started blacking out (apparently some form of malnutrition) within a few days, and stopped after a week with a SEP field resolution ("Contradicts everything I know, so I'm just going to ignore it").

Then, 12 month ago, on essentially the same diet, I started gaining weight - slowly but surely. And then I decided to cut away wheat, and lost 30 pounds within a month. (In retrospect, I also noticed that my gain weight coincided with going from pure-egg protein powder to egg-and-wheat protein powder).

There are about a thousand more variables than calories, and the body can change its efficiency.

Ignore the rat studies if you like, but cabanac has similar experiments with humans -- basically, people fed through a nose tube lose weight almost independently of the amount of calories you put in their stomach. Body just doesn't use the food unless proper signaling (apparently, scent related) happens.

<comment><USER25> So, for the uninformed peanut gallery, beagle3 is just plain wrong. Probably not intentionally, he's likely also fooling himself. But you locked him in a room and measured his food for him and _really_ only fed him 1200kcals per day, even at a fairly sedentary level of exercise, a 220lb man would lose a lot of fat mass over several weeks. And no beagle3, human bodies tend to be very greedy with calories and do a good job absorbing them regardless of what you smell.

What likely happened is that reducing carbs reduced beagle3's appetite and he ate less. Unless...

...unless beagle3 has a magic body that has never once been seen in any controlled experiment. But he probably does, since every dieter who has problems believes they have a special body that science can't explain. So they buy a book and a program from someone who tells them what they want to hear. And if their guru is on their game they sell very very expensive supplements.

Because its a well known scientific fact that the first law of thermodynamics applies to everything in the universe except a disgruntled dieter.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> > 6\. Keeps saturated fat to a minimum

In case anyone's interested, this recommendation is long outdated.

You should be keeping trans fats to a minimum and trying to increase your polyunsaturated fats, but saturated fat is neither here nor there.

<comment><USER27> Bingo. We all must point out this saturated fat fallacy when it shows up in society since it is so dominant and the belief in it leads to so many bad choices and outcomes.

<comment><USER26> It's not true, but I don't think it's disastrous or anything like that. Saturated fat is practically impossible to cut out completely, and our body can produce it anyway. The more dangerous belief IMO is that fat in general is bad.

</comment></comment></comment><comment><USER28> > Maintains the standard caloric ratios: 20-30% of calories from fat, about > 10% from protein, and the rest from carbohydrates

This is the weirdest breakdown I've ever seen.

If you are at all concerned about lean muscle mass, and you should be if you want to be even the slighest bit athletic, then the minimum amount of protien you'd want is a half gram per pound of body weight.

Most people who work out or play sports try for closer to a 1 to 1 ratio.

This diet is severly messed up.

<comment><USER29> Yes, but the blogger is right: that's the accepted medical and dietarian wisdom, and it is backed by government programs like the one from Michelle Obama.

No wonder why so many people has weight issues.

<comment><USER28> > Yes, but the blogger is right: that's the accepted medical and dietarian > wisdom

I'd disagree with this statement.

you can go look and find pretty much any percentage from an accepted medical expert.

Saying there is one accepted answer is just plain wrong:)

</comment></comment></comment><comment><USER30> I've mentioned it before, but anyone serious about this type of thing should get familiar with quinoa. It might be more expensive than rice, but it also contains a balanced set of essential amino acids - which is pretty rare for a plant. Most meals that call for rice can generally use quinoa instead, and you'll be much better off.

<comment><USER31> I tried quinoa for the exact reasons you mentioned, but didn't find it nearly as palatable as more "traditional" staples. Compared to rice I found it didn't gel together when cooked, had a stronger (slightly unpleasant) flavour and a gritty texture.

In the end I couldn't justify the cost to eat something I just didn't enjoy. More power to those who enjoy it.

<comment><USER32> If you still want to give it a shot, it's great in soups. An easy Chicken Quinoa soup with carrots and celery, and a healthy dose of lime and pepper, is healthy, flavorful and fairly easy to make.

<comment><USER33> If you don't like the mostly dry quinoa that's so popular in the US, try it in a soup. That's how the Peruvians make it, and it's a world of difference!

</comment></comment></comment></comment><comment><USER34> The post doesn't explicitly mention this, but this $3/day diet is also a vegetarian diet (with milk being the only non-vegan item in it).

<comment><USER35> But that's because the limit is too low. Meat is relatively expensive, but it's not necessarily unhealthy. If the limit was, say, $5/day then he would probably have included meat.

</comment></comment><comment><USER36> Back in Bulgaria we used to have a farm (almost anyone had) at the "village" - e.g. the house that most city people would had at certain near rural place.

Mushrooms, chickens, tomatoes, cucumbers, etc. Now can't be certain how much it cost supporting, and also water, transport, etc. - but salaries were (and still are) very little compared to US. Granted some things are ten times cheaper, but then others reach the price of US (absolute prices, not average salary relative).

Homebrew alcohol (wine, liquior), preserved tomatoes, salads, fruits, etc. Homemade ketchup kind of like stuff was (and I guess still is) very popular.

Some people even made cheese from milk (for feta you need bulgaricus bacilicus, for cheese I think not). And off course milk from the cow.

</comment><comment><USER37> If you live in Mountain View (or the bay area for that matter) go to 99 Ranch. It's an asian supermarket that smells like fish due to their huge live seafood section. If you can get past the smell you will be able to buy fruits and vegetables for extremely low prices. I can't believe how low their prices are some times. It is by far cheaper than Costco, Farmers markets, Safeway, and Nob Hill (from my experience).

<comment><USER38> A lot of asian markets have great deals and are worth going out of your way for deals if there is one near you. Everyone else is talking about fruit being expensive, but I go to Korean markets in LA that currently sell 5-10lbs of oranges for 99 cents and pineapples for $2 on weekends, just to start things off. $2/lb sliced ribeye, 20 cents for a small bunch of scallions, $4.99 box of mango...you get the idea. It's entirely feasible to eat tons of fresh fruit and even meats and pricier veggies on a tight budget if you know where to shop.

</comment></comment><comment><USER4> as somebody who exercises a great deal (and consumes over 3000cal a day), I can't recommend egg whites enough. for $4 (canadian) you can get almost a liter at costco. construct your menu right, and you can easily consume a great deal of healthy food for very little.

another tip: while YMMV, stay away from most beans other than black or chickpeas. those are the ones that tend to cause the least disturbance in the force.

<comment><USER39> Just curious: why do a lot people recommend only the white of the egg, and not the whole thing?

<comment><USER40> Nearly all the fat and cholesterol in an egg is in the yolk. Egg white is pretty much just protein.

<comment><USER41> All the B12 is in the yolk.

</comment></comment></comment></comment><comment><USER42> My wife and I lived off $2.80AUD a day while she was finishing her last year of Uni. It was really rough and Lucy end up developing iron deficiencies.

<comment><USER43> Where where you living at the time?

I am from Sydney, and I have been told by friends from other states that the food prices here are much higher than anywhere else: even Melbourne (for non- aussies: a similarly sized city - 4 mil inhabitants vs 4.5 mil in Sydney).

<comment><USER44> I don't know about other states, but food is crazily expensive here (Sydney) compared to the UK.

For some reason, eating out or takeaways is relatively cheap though.

<comment><USER26> Food and Agriculture in Australia and New Zealand isn't as heavily subsidised as it is in Europe and America. That's one possible reason.

<comment><USER44> It does interest me as to why this is. I think it's this and maybe the geography/population making the mega supermarkets less viable.

I sometimes play with the idea of a food co-op to bring prices down, but haven't got far.

<comment><USER26> I think there is also some concern that the Coles/Woolworths duopoly is driving prices up. I usually avoid big supermarkets, but I haven't noticed any significant difference in price when I have visited them.

</comment></comment></comment></comment></comment></comment><comment><USER45> _Golden Produce, a local shop_

A few doors down from Golden Produce is El Castillito, the source of my staple food: the super carne asada burrito. At just over $8 it sounds more expensive, but OP doesn't mention how long his staple meal takes to prepare.

Preparation time is definitely a cost if you'd rather be doing something else. Like taking a walk to buy a burrito. So I don't think the $3 figure is entirely accurate.

This does make me curious about how my meal stacks up in terms of carbs/fat/protien/calories.

<comment><AUTHOR> Funny - I (the OP) go to El Castillito a lot, actually, because my co-founder and I work a couple minutes walk away from there.

You are right about preparation time, though you can cut down on prep time a lot if you cook a bunch of food at once and then reheat it when hungry over the next few days. That can actually be even faster than walking to get a burrito on the days you reheat.

<comment><USER46> It can be quicker, but does it taste better & is the total time invested lower in the long run? You do have to spend a good portion of time planning out what meal you're going to make, go shopping for the ingredients then prepare & package the meal properly so it's ready to reheat later. Also things like diced fresh veggies do not hold up well in the fridge, freezer or microwave.

<comment><AUTHOR> True. I think it's all about how important saving money is to you. Everyone has a price-effort curve that depends on their financial situation and how frugal they are.

</comment></comment></comment></comment><comment><USER47> The real problem with this diet is it doesn't contain any fruits (Avocados, Cucumbers, Olives, Bananas, Grapes, Berries, etc). Our ancestors lived primarily on raw fruits so they are definitely the healthiest natural/uncooked foods for humans.

<comment><USER48> Fruits cost more than $3.

I think the real problem, though, is that the whole "sugar is poison" has gone to everyone's head, and it's now socially unacceptable to recommend anything containing sugar.

The problem is that fruits have a lot of fiber wrapped around that sugar, while soda does not. Have a cup of blueberries with breakfast, an avacado and some tomatoes at lunch, and strawberries for desert. A few servings a day of healthy sugars is not going to make you fat.

<comment><USER49> It only works if thin, if slightly overweight or overweight one has to reduce all sugar intake and carbohydrates to re-adjust the body's insulin trigger levels.

Simple test ..consume some carbohydrates..if one-half to one hour later you get sleepy to the point of napping you should have your health checked..

<comment><USER48> Reduce, yes. That doesn't mean "don't have blueberries on your cereal". It means "don't have a slice of cake and wash it down with a coke".

</comment></comment></comment></comment><comment><USER50> I feel like this might be a good time to plug my project: <http://swole.me/>

It's a diet generator I made over the past few weeks that promotes adhering to certain proportions of macronutrients. I'll probably make a full post about it when I add some more features/food choices, but so far it's been a great way to learn to program. If you use it, let me know if you have any feedback!

<comment><USER51> I bookmarked it. This seems like a great resource, when it will get more foods (even though the list now looked good, and gave me a good overview of what I should expect of my upcoming workout / diet phase.).

One thing I noticed is that the checkboxes overflow the text in "Customize food choices" (Tofu is on the text below it, mangling everything). I'm using firefox 3.6.

<comment><USER50> I'm glad that you think it's useful! I'm going to try to rework the foods box in the next few days to have a bunch more foods. I thought I fixed the spillover, but hopefully changing the whole thing will take care of it.

</comment></comment></comment><comment><USER52> This quote struck me as funny and sad:

"I'd rather buy the cheapest grains and vegetables than buy the cheapest meat. Bargain basement meat is likely produced in atrocious factory farming conditions and pumped up with hormones."

What gave him the idea that bargain basement vegetables are produced in any better conditions… or that they produce any better product (nutritionally speaking)?

</comment><comment><USER53> No omega-3 oils. No greens. No fruit.

That can't be healthy...

<comment><USER49> over loading on fructose, sucrose, etc in combination with high fat high carbohydrates diets are not healthy.\

The beans have a low glysemic index(spelling) compared to other carbohydrates.

As far as greens, maybe romaine lettuce as lettuce wrap dishes..such as mix beans, tofu, low amount of lean meat, and herbs to taste..

<comment><USER53> Greens like spinach, salads, kale, cabbage. Leafy greens. Have low carbs but lots of nutrients and fiber. You think they can be absent in a healthy diet?

Fruit - who said overloading? Maybe a few every few days. Our ancestors did eat then when they could find them.

Omega3s - I never heard anything bad about them.

</comment></comment></comment><comment><USER54> That's about what I eat: home cooked beans, brown rice, random vegetables, some bread, nuts, olive oil, occasional cheese and milk, plus a vitamin.

</comment><comment><USER55> This reminds me slightly of Tim Ferris' "The 4 Hour Body". Has anyone had any real experience with his suggested diets? I find eating consistent and similar meals is cheaper and healthier.

<comment><USER56> I followed the 4HB diet for a month and it definitely does work to lose weight. The problem is that it has no variety, and you will get extremely sick of eating the same meal continuously over and over again.

There are many ways to eat slow carb without strictly following the 4HB diet. For example, Tim Ferris says to stay away from anything that is "white, or can be made to be white." He's talking mostly about wheat, flour, and pasta, but also includes brown rice. Brown rice is an excellent slow carb so it shouldn't be excluded. There are a lot of great grains that are slow carbs like buckwheat, quinoa, wild rice, steel cut oats, etc, that won't make you gain weight and are good balanced carbs.

My experience is that you can do the 4HB diet for a month or two and lose some weight, but think about it - do you want to eat beans every meal for the rest of your life? It's not a sustainable diet that you can stick with for a long time, and that's what matters. In the end, you need a healthy diet that you can stick with for an extended period of time, or you're just going to gain the weight back.

Stick with slow carbs (all the ones I mentioned above), nuts, fruits, vegetables, eggs, and lean meats, and you'll be fine. Stay away from fast carbs, sugars, and foods with a high glycemic index and get some variety in your diet. Eat breakfast every day with protein in it.

Another thing that doesn't work with Tim Ferris' diet is the "no fruit" rule. Fruit is not that bad. Most fruit has a low glycemic index, although some like watermelon is not that good for you (high GI). Completely excluding any fruit from your diet is probably not healthy long term.

<comment><USER55> I agree with fruit, he seemed to contradict himself since he praises foods with low GI, but ostracizes fruit.

His counter argument for the lack of sustainability for this diet is the "cheat day" but I haven't found that to be effective at all with sustaining the diet.

<comment><USER57> His argument against fruit isn't the GI index, it's fructose and its extremely efficient ability to be converted to fat as compared to other sugars.

[http://www.quora.com/What-does-Tim-Ferriss-mean-by-Dont- eat-...](http://www.quora.com/What-does-Tim-Ferriss-mean-by-Dont-eat-fruit)

<comment><USER58> Except there's evidence that the soluble fiber in fruit helps moderate the fructose absorption in your gut (this is completely separate from the GI index, which is about how it affects your blood sugar levels). Unfortunately a lot of studies only look at macronutrients in isolation and ignore the (for example, vitamin C help calcium absorption).

</comment></comment></comment></comment></comment><comment><USER59> more people should write posts like this so the myth of "eating healthy is more expensive". And it doesn't need to be boring food like in this post. Italian peasants have been spending much less than $3 a meal for centuries and have one of the healthiest diets around.

<comment><USER46> No, because it's not a myth. Eating healthy actually does requires a lot of energy & in many cases does cost more. If it doesn't cost more it's because you're going to be taking a lot out of the flavor department & you're going to be investing a lot of time shopping, preparing, storing & tracking costs. There is savings to be had in volume, but volume is hard to achieve when you're cooking for just 1 or 2 people.

Stating that "Italian peasants have been spending much less than $3 a meal for centuries" is silly on many counts. First this article is about $3 a day, not per meal($3/meal x 3 x 30 = $270 per person per month which seems more realistic). Second, you ignore currency inflation & the negatives of being a peasant. It's similar to saying it must be great to be a Chinese peasant because they can get rice for really cheap. Third, Italy is a small country that has a long history of quality food production, there is less focus on quality in the US & more on quantity. The US is a big country and the environment varies greatly from place to place. You might have a great farming community & your city might support farmers markets, but that doesn't mean that everyone has those facilities or even if they do that the products produced are actually cheap.

Part of the problem is that quality food has been relegated into a "gourmet" category which demands a higher price & profit margins than industrialized foods & even those industrialized foods aren't cheap in low volume. You will often see higher quality tomatoes on a Burger King burger than what's at your local supermarket going for $2.99/lb.

This is just a blog article, with one bland meal. I don't know how it even makes a scuff as far as destroying this "myth".

</comment></comment><comment><USER60> As someone who has suffered from pernicious anaemia, I heavily recommend against this diet. Vitamin B12 is extremely important and is not necessarily well absorbed through supplements (if you went to a doctor for B12 deficiency, you would be given either supplements or injections well beyond the 100% RDA amount). Eat food with it in instead, or even better, consult with a doctor or other relevant medical person before taking such risks with your health.

</comment><comment><USER61> Doenjang and cheonggukjang (Korean fermented soybean products) are reputed to contain B12 and other B vitamins. They might be price-competitive with eggs, and they'd certainly add some welcome taste and variety. Unfortunately, I can't find any source for nutrition information. One would think they would be similar to natto, which has very impressive stats:

[http://nutritiondata.self.com/facts/legumes-and-legume- produ...](http://nutritiondata.self.com/facts/legumes-and-legume- products/4380/2)

However, natto apparently doesn't contain much B12. Natto would be harder to find anyway (and harder to find _cheap_ ) since most large cities have Korean grocery stores that cater to budget-conscious customers. If you're looking for cheap, nutritious food, a trip to your local Korean store would be worthwhile for the chance to buy cheap rice and check out the nutrition information on the plastic tubs of doenjang. The cheonggukjang I've bought has not had nutrition information on the label, but it ought to be similar to doenjang or maybe natto.

</comment><comment><USER62> Anyone recommend a site that can build a week's menu/grocery list based on approx budget etc.? I'd definitely use that product.

<comment><USER63> I have been wanting the same thing but have too many projects going on right now to try to do it myself.

<comment><USER46> Where would one start on something like that? Getting local updated pricing information would seem to be a big missing link. Perhaps crowd sourcing? That would need a critical mass to make it useful. Maybe trying to focus on specific cities first might make it easier.

<comment><USER62> I think general approximation could work. I'm not looking for something that can get me to $3 exactly... Really if someone could make an application that gave me a list of menus (that I could swap out) for the week and the corresponding grocery list, I'd use that all the time.

<comment><USER62> I've decided that on my next available weekend I will build this. (aka probs not until the fall).

<comment><USER63> General approximation is what I was going to use. I don't care if it's exactly some set price. Reasonably close is good enough for me.

A bit of magic in the system would be nice, as well. For example: I'm picking the menu(s) the items that I would like to eat next week. While "chicken burrito" may not normally cost me too much, it just so happens that none of the ingredients for the chicken burrito are shared amongst the ingredients for the other 5 or 6 days. This may push my week's allowance too high. Finding things with like/shared-staple ingredients would be nice. Obviously, we wouldn't want a Taco Bell scenario where everything uses the same five or six ingredients, but watching your overall supply/intake could help.

I suppose, additionally, being able to specify some things that you have on hand could help with the process.

I've thought about this off and on enough that I fear I may be over complicating it at this point.

Anyway, if you get around to working on this sometime this fall then feel free to hit me up as I hope to have some free time by then.

</comment></comment></comment></comment></comment></comment><comment><USER64> This is extremely awesome.

For those who feel hesitant about this (ie - not getting enough taste), I would recommend trying this for, say, breakfast and gradually increasing the frequency.

</comment><comment><USER65> Very interesting, almost makes me want to try it. But I'd like to see a version that _isn't_ focused on price, but just on the 'healthiness' part. When it comes to eating right, money is no object.

</comment><comment><USER66> I'd really like to see someone do an analysis like this, but including meat. I'm a meat lover, but would like to get an idea of just how cheaply I could eat healthily.

<comment><USER26> I live on ~9AUD per day, AUD being roughly equivalent to the USD.

$3 of that goes towards a coffee, $3 goes towards meat, and the other $3 goes towards vegetables and other foodstuff (rough estimates).

The only issue I have is that most of the meat I buy is cheap - frozen chicken pieces, ground beef/pork, sausages, chuck steak, etc. - and cheap meat can be pretty horrible until you know how to cook it properly. You'll find yourself doing a lot of pot roasts, goulashes, ragùs, etc.

<comment><USER67> You spend 33% of your food budget just for coffee? Have you thought about doing something about your caffeine addiction?

<comment><USER68> 33% of a food budget sounds like a lot.

33% of $9 hardly does...

<comment><USER67> And yet, if 9$ is your food budget, they are the same.

<comment><USER68> The point is that when you realize that the food budget is equivalent to $9, the only way you can make the coffee expenditure seem unrealistic is to conveniently not mention that fact and say something like "You spend 33% of your food budget just for coffee?".

Accusing someone of having a caffeine addiction for spending a mere $3 a day on it is just silly.

</comment></comment></comment></comment></comment></comment><comment><USER69> Most Adventists live on this kind of diet, they are the healthiest individuals around the nation and they live the longest, just google Seventh Day Diet.

</comment><comment><USER70> Paleo > Legumes.

</comment><comment><USER71> Random tangential thought:

There are many areas in the world where you can eat a lot more than this for $3 a day. I lived on $2/day in India for a year (was working in microfinance and wanted to live like my borrowers). I got full vegetarian meals made for me in a major city (Ahmedabad) at that price.

Something to consider.

<comment><USER72> This metric isn't really useful unless you can account for the different buying power of the dollar in a country like India vs. US.

<comment><USER72> It looks like the average software developer makes about 7400 USD a year in India [1]. Assuming a reasonable average is 60k in USA, that's about an 8x salary difference, meaning spending $2/day on food in India is something like $16/day in USA.

1: <http://www.payscale.com/research/IN/Country=India/Salary>, 328,379 rupees is approx = 7400 USD

</comment></comment></comment><comment><USER73> I am surprised the author did not mention eggs. A good source of protein, cheap, and they have a pretty good shelf life.

</comment><comment><USER74> Protein fail

<comment><USER75> I'd agree it's low on overall grams of protein (for a male, at least) but he did manage to get the amino acids that non-meat diets usually lack... so it's not a total fail.

<comment><USER76> The grams of protein are within his dietary needs. Nobody, male or female, needs more protein than 10% of their daily calories.

Most vegetarian diets do not lack sufficient amino acids. Protein needs are greatly exaggerated by "pop science". Iron and B12 are of greater concern than protein in non-meat diets.

<comment><USER13> Meat is overrated as a source of iron, unless we're talking liver or blood sausage.

Most contemporary diets are low in iron because people don't eat their dark leafy greens, which are, far and away, the best source of bioavailable iron. The OP diet, which is heavy on broccoli, neatly avoids this.</comment></comment></comment></comment>


Stanford students recreated a 5,000-year-old Chinese beer - <AUTHOR> https://www.engadget.com/2017/02/07/stanford-students-recreated-a-5-000-year-old-chinese-beer/ <comment><USER2> But an hour later, they were thirsty again.</comment>


Dropbox to add native G Suite integration in new partnership with Google - <AUTHOR> https://techcrunch.com/2018/03/01/dropbox-to-add-native-g-suite-integration-in-new-partnership-with-google/?ncid=rss <comment><USER2> Dupe: [https://news.ycombinator.com/item?id=16493903](https://news.ycombinator.com/item?id=16493903)

<comment><USER3> Thanks, we've moved the comments there.</comment></comment>


Patterns in Python - <AUTHOR> http://www.suttoncourtenay.org.uk/duncan/accu/pythonpatterns.html

<comment><USER2> If you're a Python (or Ruby) dev, and this stuff is interesting to you, that's a symptom of a problem. The problem is that you haven't read this:

<http://norvig.com/design-patterns/>

<comment><USER3> If your point is that design patterns only exist because of insufficiently powerful languages, I disagree. Iterator and Strategy, for instance, are useful concepts to be able to talk about in any language, no matter whether they're first-class or not, or how simple the implementation is. If you've got a bunch of lambdas that define alternative ways to accomplish the same end, then why the hell _not_ call them Strategies?

I'd also take issue with the implication that Python is powerful enough for the common patterns to disappear completely. it doesn't have macros, for a start, so implementing coupled Strategies of any complexity means you're back in class FooStrategy() land.

Recognising when you are or should be implementing a recognised pattern means that you can rely on a lot of analysis of that pattern, largely without paying attention to the environment in which that analysis was performed. That's potentially a big win.

I guess what I'm getting at is that throwing away patterns means throwing away a decent lingua franca for talking about the anatomy of your code. Given that, as someone far smarter than me once said, code is primarily for humans to read and only incidentally for computers to execute, that seems like a poor decision.

<comment><USER2> While recognizing the validity of your argument I am having a hard time resisting the urge to point out that we are commenting on code that uses the "Observer pattern" to construct a class hierarchy with accessors for "second", "minute", and "hour" to implement a "digital clock".

The code in this article confirms the suspicion of pattern skeptics that GoF- style patterns lead to code constructed out of pick-and-mix patterns instead of actual sensible code.

<comment><USER3> You're right, of course. It's all about operating at a suitable level of abstraction; any technique can be misapplied.

</comment></comment></comment></comment><comment><USER4> I'm really glad the article includes a warning against trying not to overuse design patterns. I sometimes wonder if teaching design patterns causes people to rely on pattern matching as a crutch, and hampers the development of creative thinking skills required to solve new engineering problems.

<comment><USER5> I used to be of a similar mindset, that tools/ideas/practices should possibly be avoided as they can sometimes have a negative affect on people who don't fully comprehend them (such as using design patterns when they're not applicable or where an alternative design would prove to be a better fit).

However, I've since come to believe that it's not the ideas that are harmful, it's the people that use them without comprehending them. If this is the case, avoiding a concept that would provide benefit is limiting yourself without any benefit as the people that would misuse them will probably find something else to screw up anyway.

Or, to put it more succinctly: "You can write Fortran in any language"

</comment></comment><comment><USER6> At the very bottom:

View document source. Generated on: 2003-02-28 11:59 UTC.

I was thinking I'd seen this before -- a long time ago. How much still applies?

<comment><AUTHOR> I was wondering the same thing, given python 2.6 and 3.1, and leafing through the GoF book lately. Exploring that line of inquiry would make for a good article (or two, or more).

</comment></comment><comment><USER7> These are patterns from the GoF book. Learning to use these patterns in Python is like learning Esperanto so you can pray. Python doesn't need these patterns any more than God needs you to speak Esperanto.

<comment><AUTHOR> Well yes, arguably learning Esperanto and speaking it for any purpose is already a sincere form of prayer. :)

Python may not "need" these patterns, but python programmers might. At the minimum, I find it useful to know how design patterns from Java, Smalltalk, etc. are done in Python, especially if it gives me bragging rights that a pattern can be implemented in a fraction of the LoC needed for those other languages.

</comment></comment><comment><USER8> Interesting. I sort of assumed Python had singletons natively, because I'm so used to using them in Ruby.

This guy doesn't do it here, but you can make singletons relatively painless in Python by using decorators.

<comment><USER6> Looks like decorators were after the article was written:

<http://www.python.org/dev/peps/pep-0318/>

E.g. 2/28/2003 vs 6/5/2003

<comment><USER8> Yeah, it wasn't meant as a criticism of the article. More of a "Python can do nice things too" shout out to other Rubyists. I don't know about them, but I find myself translating code between Ruby and Python for various reasons and it is nice to learn the parallels in idioms and such.

So, upvoted.</comment></comment></comment>


Ask HN: Want to join a startup, only have Fortune 500 experience - <AUTHOR>

I am a developer with nearly 15 years of experience, and I'd like to join a startup.
The problem is that all my experience is in "uninteresting" problem domains, mostly banking. On top of that, all of my recent professional experience is with .Net (since 2000).
I live in the Midwest right now, and would like to move to a more startup friendly city to join a company working on interesting problems.
The problem is that I don't really have a network in any startup hubs.
I have done a little Ruby on the side, and am trying to learn Scala right now. There isn't really a startup community in the city I'm in, so I don't think it's possible for me to try to join one here.
What should I be doing to improve my chances of joining a startup that's working on interesting problems? I feel like I can pick up other languages reasonably well, but I'm not sure which language stack is predominant in startup hubs right now. Besides technology decisions, I'm not sure how else I can help improve my chances. <comment><USER2> Ruby/Rails is predominant in the startup world now. Regardless of the language you're probably going to want to build something for show and tell as soon as you can.

You can host on Heroku and of course having viewable code on GitHub is important, too (how about a simple finance-related library culled from your experience?).

There was discussion earlier this year about the Great Chicago Ruby Developer Shortage, so that may be an option (and of course SF if you're really willing to move).

Sometimes I think startups undervalue experience while over-emphasizing open source contributions; however the flip side is they're more likely to give someone with less experience a chance if they can see some code, especially in big cities with the most demand.

Good luck!

</comment><comment><USER3> I feel that am sort of a younger version of you, on the other side of planet. 6 years with an Indian IT major (in a product unit, a million dollar banking product). Though I don't find my experience to be in "uninteresting" problem domains; as throughout my stay, I have been in the most technically intensive track within. Worked on a lot of code generators, internal tools and some system level stuff.

However, I find it very apprehensive and intimidating interviewing/applying for a startup. Few startups rejected my application simply because I am from a BigCo.

Thanks for the post, few of the responses here might help me too!

</comment><comment><USER4> I think there is a lot of money to be made by startups that take on some of those uninteresting banking/financial domains - look for one of them. Also, take a look at Advent Software [1] if you are at all interested in moving to San Francisco. They are not a startup but they have some things going for them and they use .Net pretty extensively these days. A move like that could get you half way and you can then begin to develop your network.

[1] <http://www.advent.com>

</comment><comment><USER5> Do you have any open source contributions? If not, are there any projects you could contribute to? There are many .net open source projects that could use a hand.

At the very least, it will give people a chance to see what sort of work you do if they want to see more than what's on your resume.

</comment><comment><USER6> if you're worried about the startup community in your city, you can always try telecommuting

</comment><comment><USER7> > The problem is that I don't really have a network in any startup hubs.

My company is located in Boston, and we recently hired a guy out of Chicago based on a posting he made in a Scala forum and a half day of interviews with the team. It's very competitive out there right now, so a person with fifteen years experience, eleven in .Net and an interest in learning new technologies is going to be in high demand. Don't box yourself in as we also do [some] C, C++, Java and even PHP. They key to being an asset to a startup is having domain expertise but also being readily adaptable to providing solutions for the myriad of cases that arise when you're chasing business.

If you're worried about people not giving you your due because you don't subscribe to a particular language or framework, then you're better off not working with them as that's a warning sign of entrenchment.

You're at a point where you can basically target the companies where you'd want to work versus taking whatever is available. Go forth and do likewise. Good luck!

<comment><USER8> This.</comment></comment>


Nginx v1.10.0 Stable Version Released - <AUTHOR> http://nginx.org/en/download.html <comment><USER2> I have a love-hate relationship with nginx. I love that it's fast and rock solid. But recently I keep on getting tripped up when the directive I'm trying to configure is only available in the paid plan, the pricing of which puts it out of (my) reach.

Also, there really should be separate docs for the open source vs paid plan.

That said, I do plan on kicking the tires on the HTTP/2 support.

<comment><USER3> > the directive I'm trying to configure is only available in the paid plan

Sadly, this is how the developers of nginx can earn and continue to make good software. Some of the new features in this release has been directly supported by the commercial edition, and some has been open sourced after being made for the commercial edition because clients demanded them.

Also, the nginx team is open to a feature being sponsored by a third-party, non-client in order to add it to the open source edition. Some of the significant features in nginx have been built this way (http/2, spdy, websocket support etc.)

If nothing, even patching or writing modules for nginx is not that hard (assuming you know how to develop, and in C). It is one of the more well- designed codebases. (Some others are: Redis, Postgres, Git).

> there really should be separate docs for the open source vs paid plan

I thought nginx.org contained only open-source info, save for an occasional ad about the paid offering. Is there any documentation on nginx.org that doesn't apply to the open source edition?

<comment><USER4> [http://nginx.org/en/docs/http/ngx_http_upstream_module.html](http://nginx.org/en/docs/http/ngx_http_upstream_module.html)

"Dynamically configurable group, available as part of our commercial subscription:"

"Additionally, the following parameters are available as part of our commercial subscription:"

"This directive is available as part of our commercial subscription."

</comment></comment></comment><comment><USER5> _Note that accepting HTTP /2 connections over TLS requires the "Application- Layer Protocol Negotiation" (ALPN) TLS extension support, which is available only since OpenSSL version 1.0.2. Using the "Next Protocol Negotiation" (NPN) TLS extension for this purpose (available since OpenSSL version 1.0.1) is not guaranteed._

[http://nginx.org/en/docs/http/ngx_http_v2_module.html](http://nginx.org/en/docs/http/ngx_http_v2_module.html)

Hmm, so Ubuntu 14.04 LTS won't support it (ships OpenSSL 1.0.1f), need to upgrade to 16.04.

<comment><USER3> Nor Debian Stable's version of OpenSSL. At work, we use Debian stable with openssl picked specifically from unstable. apt-pinning FTW!

<comment><USER6> > apt-pinning FTW!

You should take look at OpenSuSE's zypper.

\- 3 sat solver for dependencies (not just greedy algorithm; If there are conflicts it can propose you possible solutions that include uninstalling upgrading/downgrading packages)

\- packages stick by default to the repositories they were installed from

\- patches (i.e. sets of updated packages to address specific issue) it tells you what was fixed. You can for example only install patches that fix specific security issue, by using --cve opetion.

\- zypper ps tells you which processes need to be restarted after upgrade to make changes effective

\- OBS (Open Build System), basically it's like a github for packages. You upload spec files and it generates packages for you. You can fork someone's definitions and make customizations etc. The repo is searchable from [http://software.opensuse.org](http://software.opensuse.org). This actually supports other distributions and packaging systems, but unfortunately most packages there are for SuSE.

<comment><USER3> Wow, that reads like features a modern package manager should have!

Now I am torn three-ways on the question of the next distro/package manager I should try out: nix is a strong attraction because it also does a lot of cool stuff (especially the multiple versions thing, which I think is a better solution than 3-sat solving), and Ubuntu's snap{d,craft,-whatever} because it is a better real-world solution for third-party packaging needs.

</comment></comment></comment></comment><comment><USER7> Nginx is annoyingly complicated in a microservices environment.

IP addresses of upstream servers change, and sometimes DNS doesn't resolve until another service is brought up. Nginx does not work well in such an environment unless you (1) have ugly configuration hacks, (2) add OpenResty/LUA to your configuration, (3) add a watchdog process, or (4) buy their nginx Plus version and keep track of how many instances of nginx you have.

I want simple. If you need a webserver that can use DNS, Nginx is a lot of extra work.

<comment><USER8> I use it just fine in my Kubernetes deployment. Nginx resolves via DNS to the microservices I run, without having to do complicated configuration hacks.

Would something like that work for you?

<comment><USER7> Depending on how you are using it, Kubernetes may be hiding the problem for you via Kubernetes-managed load balancers.

If the IP address of the microservice nginx depends on changes, in a standard nginx config, nginx will not be updated. A Kubernetes health check could also hide this issue.

</comment></comment></comment><comment><USER3> My favourite bits in this release:

1\. Fix of the repeated-tries of non-idempotent requests bug.

2\. Dynamic modules.

3\. HTTP/2!!

4\. reuseport in listen.

5\. SSLv3 disabled by default.

6\. UDP Load Balancing.

<comment><USER6> > UDP Load Blancing

Isn't that just a feature creep?

Doesn't look like anything that would be useful in a web server and load balancing of UDP is different than TCP. Layer 3 load balancing (e.g. LVS) would probably be more suitable.

<comment><USER3> Nginx is not a web server. Nginx is a reverse-proxy.

Nginx's sees a massive share of its usage as a web server, sure, but – from the very beginning – it was always intended to be a good reverse-proxy.

Apart from http, nginx also supports mail (imap, pop3, smtp), stream sockets (tcp and unix), and few third-party ones too (like rtmp). And now, UDP as well.

One of most needed features expected of a good reverse-proxy is load- balancing. Nginx is already quite good at it, but lacked UDP load balancing (like HAproxy – another reverse-proxy – does). That is no longer the case, and I'm sure the people that have asked HAproxy to support UDP will be pleased that nginx does it now.

<comment><USER9> As a reverse proxy though, it is hardly the best, either in performance or compliance. As far as in creating an (unjustified) reputation for itself, it is superior.

www.slideshare.net/bryan_call/choosing-a-proxy-server-apachecon-2014

www.slideshare.net/AllThingsOpen/battle-of-the-stacks

<comment><USER10> Just for the information: Jim Jagielski, the director of Apache Foundation, who won't miss any opportunity to say how he hates nginx, and how bad nginx is. Well done!

<comment><USER9> It's called "Battling FUD" :-)

</comment></comment></comment></comment></comment></comment><comment><USER11> UDP loadbalancing is huge, since HAProxy can't do it you had to do it with LVS.

<comment><USER6> Feels like feature creep. What would you use UDP load balancing for? Layer 3 load balancing is probably the best approach for load balancing UDP traffic.

Edit: If you have to downvote, go ahead, but at least state why you don't agree, so I can know why I'm wrong and can revise my opinion.

<comment><USER12> I'll upvote you b/c I have the same question.</comment></comment></comment>


The Terrible Beauty of Brain Surgery - <AUTHOR> http://www.nytimes.com/2016/01/03/magazine/karl-ove-knausgaard-on-the-terrible-beauty-of-brain-surgery.html?rref=collection%2Fsectioncollection%2Fscience&action=click&contentCollection=science&region=stream&module=stream_unit&version=latest&contentPlacement=1&pgtype=sectionfront&_r=0 <comment><USER2> The article is so beautifully written, it changed the way I observe my surroundings.

Brain surgeries always terrify me, specially the part that you should be awake with opened skull while surgeons go through your brain.

</comment><comment><USER3> I wanted to read that article but the NY Times website was so broken on my phone and littered with ads that I couldn't make it halfway through</comment>


Milestone for wi-fi with 'T-rays' - <AUTHOR> http://www.bbc.co.uk/news/science-environment-18072618

<comment><USER2> > ...terahertz waves penetrate many materials as effectively as X-rays but > deposit far less energy and therefore cause less damage.

 _Less_ damage? How about "no damage at all"? Terahertz radiation is on the opposite side of visible light from the ionizing frequencies.

And where the hell are they getting this "penetrate materials as effectively as X-Rays" business? It penetrates roughly the same materials as existing microwave systems, and lacks the single most commonly-known feature of X-rays, since it only penetrates a couple of millimeters into human flesh. IIRC terahertz radiation is worse at penetration than microwaves, but I'm not too certain of that.

At least they have decent numbers for the range and they mention the increased channel capacity. I'll bet they got those numbers from the research paper and tried to bullshit a description of what THz radiation is.

 __edit __: I just reread that and I feel like it comes off as more harsh than I intended and more certain than I am of most of those facts. I was bothered by the conflation of ionizing and non-ionizing radiation.</comment>


Regulate Facebook Like AIM - <AUTHOR> https://motherboard.vice.com/en_us/article/mb7n7v/aim-aol-instant-messenger-regulation-facebook-ending <comment><USER2> > The FCC's decision freed other companies to build new, better instant- > messaging apps without AOL standing in their way. And frankly, AIM wasn't > able to keep up with them.

What am I missing here? The only other service I recall AIM having interoperability with was ICQ. I recall MSN Messgenger tried to integrate at one point but was blocked. What are these other better instant messaing apps that thrived? I seem to have missed them.

</comment><comment><USER3> Does the author realize that Facebook already has a public API?

<comment><USER4> The Facebook API is primarily for putting things into Facebook, not taking them out of it. For instance, you cannot (AFAIK) create a messenger client using the public APIs.

<comment><USER3> [https://developers.facebook.com/docs/messenger- platform/webh...](https://developers.facebook.com/docs/messenger- platform/webhook) and [https://developers.facebook.com/docs/messenger- platform/refe...](https://developers.facebook.com/docs/messenger- platform/reference/send-api) have everything you need to make a messenger client, and there's a ton of more functionality you can add.

<comment><USER4> All the documentation for that API refers to Messenger bots, not end users, and the quick start page discusses attaching your bot to a Facebook Page.

Maybe I'm reading it wrong but this does not seem to be an API for creating alternative chat clients.

A messages API definitely did exist years ago, but I'm pretty sure Facebook phased it out, along with many other APIs for user data. EDIT: here it is, deprecated:

[https://developers.facebook.com/docs/graph- api/reference/v2....](https://developers.facebook.com/docs/graph- api/reference/v2.10/user/inbox)</comment></comment></comment></comment>