CA Comodo used broken OCR and issued certificates to the wrong people - <AUTHOR> https://bugzilla.mozilla.org/show_bug.cgi?id=1311713 <comment><USER2> Relevant mailing list post: [https://www.mail-archive.com/dev-security- email@example.com...](https://www.mail-archive.com/dev-security- email@example.com/msg04654.html)

In this email, Comodo discloses the security issue to Mozilla. The email was sent 26 days after researchers Florian Heinz and Martin Kluge of Vautron Rechenzentrum AG informed them of the bug.

Comodo clearly states that they used OCR for .eu and .be domains because the TLD registrars redacted their port 43 WHOIS data, and only provided an image of an email address on their web WHOIS pages. There was apparently no other way to obtain the email address.

Rather than flag humans to fix OCR in ambiguous situations, they had automated heuristics to correct the OCR, as determined by the security researchers. However, the heuristics chose the wrong output for the domain @a1telekom.at, producing @altelekom.at (an L instead of a one). The researchers registered altelekom.at and obtained a cert for a domain owned by A1 Telekom, a major ISP.

<comment><USER3> There is an accusation in the comment thread of the article that Comodo only disclosed this issue to Mozilla _after_ it was reported publicly by the news media.

> steffen 2016-10-20 08:35:58 PDT

> In fact, the linked incident report refers to the heise article I also > linked. So Comodo chose to "publish" this immediately after it was made > public by others. That would be quite a coincidence. This raises the > question of whether Comodo would've informed Mozilla at all if the media > hadn't picked up on it.

<comment><USER4> A lone security researcher can find a bug and write it and share up a lot more quickly than corporation.

Corp has to write, test, verify, share internally, review and approve before it can be released. Bureaucracy. They also needed to patch their systems too.

Ryan Sleevi (Google) asked the question, and Robin Alden (Comodo) stated a reasonable timeline. There is no conspiracy here.

</comment></comment></comment><comment><USER5> >The OCR has a reproducible bug and has trouble differentiating small l and the number 1. It also has trouble differentiating the number 0 and the small o. Instead of fixing the bug or not using such obviously unsuitable software the software apparently evaluates the following characters - if there is a number after the small l it reads the l as the number 1. Similar issues with o/0.

So what they're saying is y0u can fo0l their servers with 1eetspeak?

<comment><USER6> I mean - these 'fixes' are common as far as I can tell (working in/around OCR). But then again - I'm not issuing certificates.

Quite often you try to eliminate uncertainty by being clever: Sure, OCR engine: Go ahead and recognize O and l and B if you want. If I know that the context of this text is an amount, I'll still replace those chars with 0 and 1 and 8 afterwards.

(Engines usually allow you to configure the allowed character set, but in practice it seems to be easier/more reliable to work like a parser: Lenient in what you accept and strict in what you pass on)

<comment><USER7> I'm always amazed at how many Kindle books you buy have clearly not gone through a simple spell check to catch errors like these.

</comment></comment></comment><comment><USER8> +1 for [https://letsencrypt.org](https://letsencrypt.org)

<comment><USER9> To clarify, Let's Encrypt validates identity by trusting DNS resolution of a domain and then trusting a TCP/IP connection to the IP, correct?

It's good to encrypt things, but I wouldn't be too surprised if it were possible for folks to issue bad certs via them, as well.

<comment><USER10> I don't know why you were down voted. Yes, Let's Encrypt does verification by requiring a site to host a string on port 80. They discover the site via DNS, and they do NOT require DNSSEC. Thus you can absolutely trick Let's Encrypt into issuing a bad cert if you can serve them bad DNS responses.

This OCR issue with Comodo in TFA concerns WHOIS data, which may or may not be more reliable than unsigned DNS data. Regardless your point remains valid.

<comment><USER11> You can also trick practically every other CA using the same techniques.

<comment><USER10> Yes. And remember you only have to trick one of them for them all to be useless :)

</comment></comment></comment></comment></comment><comment><USER12> I am usually not good with donations but one company that I gladly donated to has been letsencrypt. They have made life so simple. Please donate[0] or become a sponsor[1] if you can.

[0] [https://letsencrypt.org/donate/](https://letsencrypt.org/donate/)

[1] [https://letsencrypt.org/become-a- sponsor/](https://letsencrypt.org/become-a-sponsor/)

<comment><USER13> +1. Only nitpick is that LetsEncrypt is a nonprofit, not a company.

<comment><USER14> Nonprofits are still corporations. LetsEncrypt is a service of Internet Security Research Group:

[https://letsencrypt.org/isrg/](https://letsencrypt.org/isrg/)

ISRG is a Secion 501(c)(3) corporation.

</comment></comment></comment><comment><USER15> For the love of God, why has Mozilla not suspended Comodo yet? Too big to fail, my ass -- give a few months of warning before the notBefore cutoff date, and everyone will have plenty of time to switch over to a competent CA.

<comment><USER16> Seriously. How many times has Comodo displayed terrible judgement?

Bugs happen. Stupid bugs happen. Stupid systems with stupid bugs even sometimes happen.

What I don't see is Comodo learning anything from their serial screwups.

</comment></comment><comment><USER17> Comodo should be put out of business. They stole $100 from me for a certificate then gave me the run around for months while I tried to get a refund for a certificate I never received. Still haven't gotten my money back.

<comment><USER18> Chargeback?

<comment><USER19> A chargeback is when you dispute the charge with your credit card company, like if you never received your items.

<comment><USER20> > like if you never received your items.

Like paying for a SSL certificate you never received?

<comment><USER19> Yep, sounds like it would be useful for this case.

Not sure why people are down voting my answer. The other person posted "Chargeback?" \- note the question mark. So I took that as if they were asking what a chargeback is, and was trying to explain it as simplified as possible.

<comment><USER21> You shouldn't be downvoted, but I do believe you misread the intent. Avenger42 was responding to a post which did not mention "chargeback", so it wouldn't make much sense to interpret it as, "What is a chargeback?". Rather, "Why don't you use a chargeback?" would seem to be a better interpretation.

<comment><USER18> Yes, apparently I should have been more specific.

To be fair to Keverw, it's easy to think that I meant to reply to dman's post and was asking what the term meant.

<comment><USER21> Sure. I don't fault Keverw's response; I was just attempting to answer the question.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> The underlying issue here is that WHOIS is still not standardised despite being around for over 30 years, and the registrars do not have any other common interface that can be used to discover domain owners and other metadata. Is there no workable solution to this problem?

<comment><USER22> > the registrars do not have any other common interface that can be used to > discover domain owners and other metadata

There's `.well-known` HTTP resources: [https://tools.ietf.org/html/rfc5785](https://tools.ietf.org/html/rfc5785)

I work for CertSimple and we automatically use `(site)/.well-known/pki- validation` if we see whois privacy, because in practice customers using whois privacy are inevitably uncontactible. We may use `.well-known` by default in future. Our friends at LE/Certbot (ie, ACME) use `(site)/.well-known/acme- challenge`.

Also there is various efforts to replace/standardize whois, eg WEIRD and RDAP [https://tools.ietf.org/html/rfc7483](https://tools.ietf.org/html/rfc7483). However .well-known resources work well enough for the purposes and in practice is more widely used.

<comment><USER23> Why isn't .well-known/pki-validation in the Well-Known URI registry?

[https://www.iana.org/assignments/well-known-uris/well- known-...](https://www.iana.org/assignments/well-known-uris/well-known- uris.xhtml)

<comment><USER24> Probably someone needs to ask IANA to do so. As far as I know (and I'm happy to learn otherwise) the first mention of .well-known/pki-validation was Ballot 169 [https://cabforum.org/2016/08/05/ballot-169-revised- validatio...](https://cabforum.org/2016/08/05/ballot-169-revised-validation- requirements/) to the CA/B forum.

It is possible that the people drafting that ballot didn't feel they ought to approach IANA until after it was voted through, and then they simply forgot.

It is also possible that the subsequent IP fuss (a bunch of CA/B members turn out to have patented some methods listed in Ballot 169) distracted everybody

Finally it's possible IANA just didn't get around to updating the list yet.

</comment></comment></comment></comment><comment><USER25> Universities that are part of InCommon paid to get unlimited Comodo SSL certs. Their API was pretty terrible and we ended up finding quite a few issues.

Every time I hear about these Comodo breaches, I'm not surprised. Supposedly, Iran was able to get them to issue fake certs for some major sites:

[http://www.pcmag.com/article2/0,2817,2382518,00.asp](http://www.pcmag.com/article2/0,2817,2382518,00.asp)

</comment><comment><USER26> Should being part of a CA include having a red team constantly trying to breach things?

<comment><USER27> Or more specifically, do security auditors have red teams authorized as part of their audit?

<comment><USER28> In my limited experience (infosec for a big 4 firm), the answer is no. The audits are done as cheaply and as quickly as possible. I worked alone, in fact, and essentially did process testing (read: document review).

</comment></comment></comment><comment><USER29> Previously from Comodo:

[http://www.pcworld.com/article/2887632/secure-advertising- to...](http://www.pcworld.com/article/2887632/secure-advertising-tool-privdog- compromises-https-security.html)

</comment><comment><USER30> I'd like to know how other CAs perform domain validation for .be and .eu TLDs.

Disclaimer: not associated with Comodo in any way.

<comment><USER31> I work for one of the big CAs out there. For those domains a human actually performs a manual WHOIS query for those TLDs and then manually enters in the email address associated with the domain contact and they are required to include a screenshot of the WHOIS details for verification of the information. A second individual then is required to perform a verification that the email address entered is correct per the attached screenshot.

All of this, plus the querying of the organization's legal registration, business address and contact is all done by trained people and due to internal efficiencies and workflows we can complete that in a matter of minutes from the time a customer places an order.

In the end, even an organizational vetted certificate is still completed just as fast as it takes customers usually to click on the approval email to authorize issuance and submit the CSR for the certificate creation.

<comment><USER30> So it's a matter of cutting costs for Comodo. Thank you.

</comment></comment></comment><comment><USER32> So stupid anti-spam measure — email addresses as image — led (indirectly) to such huge vulnerability.

<comment><USER33> I think that is a great anti-spam measure. Most web scrapers are not gonna run OCR on the images of your contact page and you save yourself huge pains and loads of spam. Tell me, what is a better way? Using obscured JavaScript code to inject the address into the page? CSS hacks? HTML comments inbetween parts of the address?

<comment><USER34> I have my email address open on most websites I've designed and programmed for decades now, and I don't receive more spam at these address than on at those addresses which aren't public. Spammer harvest for years now using many channels: buying addresses, hacking databases, using viruses stealing complete address books from people.

Using images as anti-spam measure really gives you a lot more problems than benefits (except you'd use random single-usage addresses).

Don't obfuscate, but fix your spam filters or switch your email provider. What helps a lot is server-side moving of detected spam emails to your junk folder and looking through this folder from time to time.

</comment></comment></comment><comment><USER35> Web security based on PKI model based on 100's of "trusted" authorities is just broken. And yet, the "security industry" continues doubling down on "moar TLS" "moar green locks" model instead of coming up with a better model.

The tragedy is, that most of the internet access is now happening from mobile devices and majority of _that_ is coming from native apps. The apps need neither the same trust model nor have any "green locks". But PKI/TLS based orthodoxy has such a death grip on the industry that people continue to use this broken model for native apps where it makes even less sense than it does for browsers.

<comment><USER36> Well, unless apps authors are writing their HTTPS clients from scratch, I suppose major mobile OSes provided HTTP client API functions do actually check certificates?

<comment><USER37> I think chetanahuja is saying apps don't have to rely on CAs. They can distribute a single trusted certificate, only trust a single CA or use key pinning.

</comment></comment></comment><comment><USER38> Did Comodo admit to using OCR for this, and that it wasn't a human transcription mistake (humans mistake 1's and l's too)

It just seems odd for them to use an image of a web page to transcribe information from a web lookup when they could just scrape the text off the web page directly without using the intermediate image and OCR.

However, I could see them using a human in the chain to look up the whois information, it just seems strange to come up with a complicated OCR solution (and if they did, that they couldn't find a font that makes 1's and l's look more distinct, like [http://forum.high- logic.com/viewtopic.php?t=4004](http://forum.high- logic.com/viewtopic.php?t=4004))

<comment><USER39> >when they could just scrape the text off the web page directly without using the intermediate image and OCR

Try looking up whois info on google.eu. Most tools will simply output `NOT DISCLOSED! Visit www.eurid.eu for webbased whois.`. Now you can search [https://whois.eurid.eu](https://whois.eurid.eu) for the whois information of google.eu. You will find that the email address is only available as an image.

That's exactly the situation Comodo tried to solve.

Given that it's a simple font with no obfuscation, a small pattern-matching python programm should give you near 100% accuracy. Apparently Comodo used some off-the-shelf software instead, and that software seems to make assumptions it shouldn't make.

<comment><USER38> Ahh interesting, so it's a case of the cure being worse than the disease -- spammers know how to use OCR too and they don't care about transcription errors.

So it seems like there's little point in deliberately obscuring the email address in an image, and certainly no reason to do it with a font that doesn't more clearly distinguish between letters and numbers.

</comment></comment></comment><comment><USER20> Isnt this is the same company that produced a 'secure' browser that disabled CORS?

Doesn't surprise me.

<comment><USER40> They also make the best free application firewall software for Windows. Its unrivalled for features in this space.

Nothing exists like this for linux (however [https://github.com/subgraph/fw- daemon](https://github.com/subgraph/fw-daemon) is getting close).

The quality of the software both good and bad doesnt' apply here.

<comment><USER20> Is this sarcastic? I can't tell. How is it unrivalled, and why would you trust it coming from a company with an abysmal track record of security? Just Google 'Comodo Project Zero' for a taste. Or read this[1], one of the bad ones.

Also whats wrong with ufw? Github is down so I can't view that link.

> The quality of the software both good and bad doesnt' apply here.

Well I clearly does, because this post is about how their software did some crazy roundabout stuff to validate domains that didn't work.

1\. [https://bugs.chromium.org/p/project- zero/issues/detail?id=76...](https://bugs.chromium.org/p/project- zero/issues/detail?id=769)

<comment><USER40> ufw, and by extension iptables, lacks features such as per process rules. You have to do hacks like assign rules to users, and run the processes under different users. Tails does this to isolate the Tor Browser process.

When you check out the link, see that nothing like this exists on linux. The closest thing on OSX would be little snitch.

github isnt down, flush your dns, its left over cached NXDOMAINS from this mornings outage.

you can also clear your browser dns cache with chrome://net-internals/#dns

I think my original meaning is there is lots of teams and not all of them are bad :-)

<comment><USER20> > ufw, and by extension iptables, lacks features such as per process rules.

iptables --pid-owner[1]

> I think my original meaning is there is lots of teams and not all of them > are bad :-)

Sure, you find diamonds in the rough, but when their AV and their certificate teams are trash does that inspire confidence? When their antivirus software bundles a 'secure browser' that __disables CORS __(!!!) and infects you only by scanning a file then why is it safe to assume that they know what the fuck they are doing as a company?

That's like assuming it's safe for a doctor to operate on your kidney, despite killing all their patients when operating on other organs, because you know, it's different.

The firewall might work and have the slickest interface but if it's full of buffer overflows and written by an idiot then it's not the best, is it.

1\. [https://linux.die.net/man/8/iptables](https://linux.die.net/man/8/iptables)

<comment><USER41> > iptables --pid-owner[1]

Thats broken (only matches the exact PID, no child processes and according to the documentation does not work on SMP systems). It also got removed at some point. There is a cgroup match which may be usable instead, also network namespaces may be a good solution in some cases.

<comment><USER40> true. but the cgroup match and namespaces require apriori configuration. I want something that will warn me when a new process is trying to dial out.

</comment></comment></comment></comment></comment></comment></comment><comment><USER42> And yet somehow browsers have decided that self-signed certificates are less valuable that purchased ones. Seriously?

<comment><USER43> If the browser adopts a trust-on-first-use policy with self signed certificates and the certificate is replaced (possibly because it has expired), how do you know whether it's MiTM or benign?

<comment><USER44> I recall a website with a self-signed cert, but they had a non-https page that had a their TLS cert fingerprint signed with their GPG key; which effectively moved the trust from the centralized CA system to the PGP web of trust.

I think it would be cool to have a standard URL (/.well-known/certificate or something) that explains why you should trust their self-signed certificate, and have the browser show that as part of the view when you encounter a self- signed cert.

<comment><USER40> Then you have leaked material over http or some other cleartext protocol. If you try to add encryption to that you just have turtles or move the key exchange somewhere else.

The current PKI system allows you to make an unsolicited encrypted connections to an internet origin over an untrusted connection with strong server authentication.

Self signed can not provide this. We do not want the web to be like SSH.

</comment></comment></comment></comment><comment><USER45> Have CAs always been this sloppy or are we just hearing about it more nowadays?

<comment><USER46> As the system grows I think there are more and more players, competing for market share, trying to get low prices and high profits, and more shit happens as a result. On top of that, since it's getting more and more important, we also hear about it more.

</comment></comment><comment><USER47> More worrying than some OCR silliness is that Comodo is issuing certificates based solely on WHOIS data. I don't think it is intended for such security critical use.

<comment><USER40> If you read the report linked from the bugzilla, you will read:

One of the methods that Comodo uses to validate that a certificate applicant owns or controls a domain to be included in the subjectAlternativeName of a server authentication certificate is set out in the CA/B Forum's Baseline Requirements document [2] at section 22.214.171.124.2.

That method may be summarized as the sending of an email to an email address (and obtaining a confirming response) where the email is identified as belonging to the Domain Name Registrant, technical contact, or administrative contract as listed in the WHOIS record of the domain.

So the Browser (Google Mozilla Microsoft) and the CA (Comodo Symantec LE) industry working group agreed that was acceptable.

<comment><USER47> Maybe it is time to review that policy. As far as I can tell, WHOIS protocol and data are both completely unauthenticated, and as such relatively easily manipulated by mitm.

<comment><USER40> RDAP over https should be fine

<comment><USER47> And if RDAP or whatev would have been used here then the whole problem would have never occurred. But it wasn't, due not being required to. Ergo sum, the requirements should be reviewed to avoid repeating this sort of thing.

</comment></comment></comment></comment></comment><comment><USER48> Comodo is awful. I remember loving their original products, but it's been downhill ever since they started trying to monetize so heavily.

</comment><comment><USER49> pranjalv123 called it: [https://news.ycombinator.com/item?id=6620467](https://news.ycombinator.com/item?id=6620467)

</comment><comment><USER50> How people still think the PKI system is actually delivering security is beyond me.

We have _zero_ idea how many bad certs like this may be out there (the nefarious people won't publish their results, after all), and yet a browser will still treat a Comodo cert as better than a self-signed one (it's identical to a self-signed cert, since Comodo is a known bad actor now). It's better than plaintext, of course, but that's not saying much.

<comment><USER40> "Dont throw the baby out with the bathwater." We have certificate transparency, the browsers are more responsive and reporting, we have HPKP and other browser countermeasures. Its not perfect but with enough eyeballs it can get close.

It provides meaningful security. CA signed clearly not the same as self- signed; Maybe you misunderstand what this means?

<comment><USER50> _CA signed clearly not the same as self-signed_

How is a certificate from Comodo any different from an self-signed certificate? There is _actual evidence_ that they gave a certificate to a third party. That means you should treat any certificate from them as self- signed, because you cannot trust Comodo to do their jobs.

<comment><USER40> Assuming you understand the structural difference between a self signed and a CA signed certificate (ie: subject pubkey sig vs issuer pubkey sig respectively) the difference is clear.

You cannot determine provenance of a self-signed certificate. The sig matches the subject. With a CA signed, the hold of the CA private key is the only source (with high probability), so it is attributable.

If you trust the company or not -- play with you trust store. Otherwise this is apples and oranges.

The only time when this comparison would be apt would be the compromise of the Comodo Private Key. This would allow anyone to issue Comodo certificates, thus removing their provenance. Of course then their cert would be revoked and we wouldn't have this conversation.

<comment><USER50> _You cannot determine providence of a self-signed certificate._

Exactly, though I think you meant "provenance". It's _exactly_ like how we now know we can't determine the provenance of a Comodo certificate, agreed?

<comment><USER40> No.

I think I understand why you are not following what I am saying.

You prove that the certificate came from comodo, and only comodo. It can't have come from anyone else. This isnt trust -- its public key crypto. Only the issuer could sign it. If you trust it or not, its irrelevant, only that it could only have possibly originated from there.

If you believe that the public key is truly owned by the subject because the issuer said so -- this is trust.

<comment><USER50> OK, but that's only helpful here in the sense that I _could_ remove Comodo from my trust store, but nobody's going to do that. Not even me, and I'm the one complaining about this. What I can't do is have any confidence in the provenance of a CSR they signed: did it actually come from the organization that controls that domain? (That was what I meant by "provenance")

</comment></comment></comment></comment></comment></comment></comment><comment><USER51> How even whois verification works? It don't contains email of domain registrar, not registrant?

</comment><comment><USER52> Yet another in the long line of fuckups.

</comment><comment><USER53> Not surprised, they seem like a shady outfit.</comment>


Domestic cats (Felis catus) discriminate their names from other words [pdf] - <AUTHOR> https://www.nature.com/articles/s41598-019-40616-4.pdf <comment><USER2> Hah, Obviously Nature owns no cats!. My cats get lots of love and name repeats and can be called on my way home and they come running from 200-300 yards out (varies with noise level) I feel a surge of happiness when I call them and one or other pokes their head out of the fence and comes running, and rolling over for a ruffled belly, often both arrive. It only fails when they are on a pawsabout somewhere in the outback...</comment>


A Machine Learning Guide to Hierarchical Temporal Memory - <AUTHOR> https://numenta.com/blog/2019/10/24/machine-learning-guide-to-htm <comment><USER2> Hawkins was on Lex Fridmans podcast a while back. Seems like he's got some controversial ideas based on what I saw in the comments, and he definitely doesn't suffer from lack of confidence, but the hierarchical reference frame concept makes a lot of sense and kind of maps to what i feel like is going on in my head when I go about my day.

<comment><USER3> Does Lex Fridman show have a community/comment section somewhere? Or just on Twitter?

I don't work with AI but that's a must-listen to podcast these days.

<comment><USER4> There's a fairly active Slack attached to his Self Driving cars MIT course which covers his podcast too.

I'm not going to link directly, but Googling will find the invitation link.

</comment></comment></comment><comment><USER5> Looks like they have been cranking on a pytorch implementation: [https://github.com/numenta/nupic.torch](https://github.com/numenta/nupic.torch)</comment>


Kraken.js: Enterprise-grade Node.js web application framework - <AUTHOR> http://krakenjs.com/ <comment><USER2> Kraken is an offshoot from work at Paypal and just a few lines above this on the HN frontpage is a post about a Node memory leak post mortem from Wal-Mart. Over the next few years will we see Node become as commonplace in the enterprise as Java and .NET?

<comment><USER3> Enterprises don't need high-load web sites. Enterprises benefit from non-buggy strong static languages with automated refactoring.

<comment><USER4> I'd say Walmart needs a high-load solution, as does paypal and LinkedIn who are both using node. Static vs dynamic languages both have merits and are almost completely subjective, but I'd say it comes down to team quality. Don't use the sharp tools if you have undiciplined or inexperienced devs who will fail to design correctly and write tests. Walmart has Eran Hammer, so I don't think they need to worry about that.

<comment><USER3> I meant the majority of enterprises, not stand out mega-stars such as Walmart who can afford to have an own lab full of experts. PayPal and LinkedIn are web technology companies relying on high-load public-facing web-sites. All three could afford to even build their own tech from scratch. Let's talk about the other 95% of enterprise - do they typically have high-load public websites?

<comment><USER5> They are going to have high load services in any case. Check "Internet of things" and "systems of engagement". Your traditional enterprise application is probably not the future of enterprise. It will continue to exist, but its importance will keep getting down.

</comment></comment></comment></comment></comment><comment><USER6> I find it hard to believe it's Enterprise-grade when the documentation link points at a GitHub README.

<comment><USER7> Sounds like a distinct improvement on most of the enterprise documentation I've seen (that's all of our documentation but if you need more specific help we've got some great consultants :).

</comment></comment><comment><USER8> If you haven't seen Bill Scott's talk on Kraken.js, check it out:

[http://www.youtube.com/watch?v=V5yk5SZxWX4](http://www.youtube.com/watch?v=V5yk5SZxWX4)

<comment><USER9> Very interesting talk, thanks for sharing. I confess the cynical side of me thinks the majority of the hand waving about why it worked is summed in a single line of the last slide "ensure the best developers are on the initial work". That is, would Java truly be so bad if you were able to ensure that idea, as well?

Still, though, I am more interested in node having watched this.

</comment></comment><comment><USER10> How does this compare with Sails.js?

</comment><comment><USER11> When I read "Kraken.js" for a second I thought it's a JS client for Asana's Kraken project: [https://github.com/Asana/kraken](https://github.com/Asana/kraken)

Are we running out of names for open source projects?

</comment><comment><USER12> You keep using that word. I don't think it means what you think it means.

</comment><comment><USER13> Am I missing something here? All I can find is a bunch of middleware and grunt. I'm starting to get sick of open source projects leading with a shiny marketing site...

<comment><USER14> I agree.

This looks too awkward to use, to accumulate middlewares only for a specific route,... Routes loading is just ridiculous actually, so much unneeded code in the example...

</comment></comment><comment><USER15> I saw this on paypal post. Looking forward to release the kraken on some projects.

</comment><comment><USER16> This looks very very promising!

</comment><comment><USER17> daddy like...</comment>


Ask HN: Who is hiring fall interns? (Fall 2016) - <AUTHOR> Please lead with the location of the position. A one-sentence summary of your interview process would be helpful.
Submitters: please only post if you personally are part of the hiring company—no recruiting firms or job boards.
Readers: please only email submitters if you personally are interested in the job—no recruiters or sales calls.
You can also use kristopolous' console script to search the thread: https://news.ycombinator.com/item?id=10313519. <comment><USER2> Mixmax | On-site San Francisco | [https://mixmax.com](https://mixmax.com)

We're a growing, fast-moving, internationally distributed team looking for a full-stack intern to join us!

Mixmax's mission is to reinvent the way professionals communicate for work. We're building the impossible: a rich communications platform that brings the power of the web to everyday communication. This includes easily scheduling meetings, completing surveys, making purchases, signing documents, and even interacting with apps. We're fully integrated with Gmail and Google Inbox, and just released an Electron-based native desktop application. Already, we're seeing phenomenal growth, with customers from Uber, Airbnb, and tens of thousands of more businesses depending on us for their daily communications.

We're well-funded with an A++ list of investors who previously backed companies like Twitter, Heroku, Lyft, and Square. We have big plans ahead. Come do the impossible with us.

Our stack: Node, Express, Redis, Elasticsearch, Mongo, AWS, Meteor, Electron.

Email email@example.com and let's chat! Also check out our eng blog at mixmax.com/engineering.

<comment><USER3> Note that the OP of this thread also works for MixMax.</comment></comment>


Useful Web design element collections. - <AUTHOR> http://patterntap.com/collections/

<comment><USER2> very cool, I've been wanting to find something like this for a while</comment>


Ask HN: How does a non-senior dev find tiny startups to join? - <AUTHOR>

I am a competent, middle-level developer with 2 heavy years of ruby/js/general startup language and frameworks knowledge and I really want to find a tiny startup to join where I can have a tangible impact on the company.
Trouble is that every ad/posting I've seen for smaller startups are always looking for senior devs. I don't trust going through a recruiter, because their payday comes from any placement, not for the placement I specifically want (and I have had a bad experience with recruiters).
Is there any value for a mid-level developer outside the bigger companies? <comment><USER2> Look at the HN Who's Hiring thread and pick one to apply. There are plenty of Ruby jobs out there. Join them as a developer, forget about the title.

</comment><comment><USER3> First step, stop calling yourself a mid-level developer. Startups want you to dive in, not second guess yourself.

If you can pass muster, it doesn't matter what you think of yourself. Change your point of view, give it a shot, and just see what happens. OK, if you can't get hired, then maybe you prove your own thesis, but it's worth a try.

The other option is to just start your own startup.

</comment><comment><USER4> As per your concerns, I'd stick to my day job and build things on the side.

If you live in a place like SV and you're well connected, good things will come your way.

If you're like everyone else, you have to work hard, hustle, build up your own networks and provide a great product/service.

If you're looking to network, we could discuss things/get to know each other.

</comment><comment><USER5> [http://www.mycareercity.com/defaultC.aspx](http://www.mycareercity.com/defaultC.aspx) is launching pretty soon (i.e. within a week). They're aimed at more junior- level developers I think.

</comment><comment><USER6> Good way to start finding startups near you - find the the incubators, see which of their classes got funded.

[https://angel.co/incubators](https://angel.co/incubators)

</comment><comment><USER7> We're hiring somebody that roughly fits your profile right about now (good traction, still small dev team). No promises, but if you email me at email@example.com, we can see if you're a good match.

</comment><comment><USER8> It's a seller's market for developers on FounderDating, i.e., far more people with a startup idea than developers to implement it.

<comment><USER4> That's because the ideas guys don't realize how 'valuable' their ideas are.

Also, they should start printing the "fine print" in a supersized ARIAL 64 FONT that clarifies whether you are working for sweat equity (most of the time) or the other guy will actually pay you.

</comment></comment><comment><USER9> How tiny? If you need a decent salary it may be harder to find a startup that is still very small.</comment>


DOD VIDEO SHOWS UNKNOWN OBJECT INTERCEPTED BY NAVY and WE HAVE NO IDEA WHAT IT WAS - <AUTHOR> https://theaviationist.com/2017/12/17/u-s-department-of-defense-video-shows-unknown-object-intercepted-by-u-s-navy-super-hornet-and-we-have-no-idea-what-it-was/ <comment><USER2> Mundane description of this anyone?

<comment><USER3> dod video shows unknown object intercepted by navy.</comment></comment>


MintyJS: track your Node app variable state and scope through its run (in alpha) - <AUTHOR> https://github.com/lumpy-turnips/minty <comment><AUTHOR> Minty an npm module that can help with debugging by tracking the state and scope of variables in your app throughout execution. (We were inspired by pythontutor, can you tell?)

To use, just require the module and wrap any function or file you want to trace in our function. The function or file will still execute and return, so your whole app will execute normally.

Minty is in alpha, and definitely has some big bugs, but we've been getting some positive feedback and wanted to get the larger community to break things and provide feedback on how to make Minty useful. Thanks for your time!</comment>


Founders: The involved vs. the committed - <AUTHOR> http://onstartups.com/home/tabid/3339/bid/1204/Startup-Founders-The-Involved-vs-The-Committed.aspx <comment><USER2> You can master your choice of ideas, technology, location. But stuff up the soft side of tech-startups (founder commitment) and you are doomed. The article has an interesting take on working out the dividing line between founders that are *involved* VS those who are *committed*. But is this a good enough test? I found out recently the distinction between 'involved' & 'committed' when a co-founder ditched out prefering to do a Phd (in the exact same area of the product) rather go the hard yards, build a product then sell it. Why? I can only guess. The Phd route could be perceived as less risky, higher prestige over the entrepreneurial route. Maybe because all the "chicks dig Phd's in CompSci" ? Using the above test the co-founder would pass. So how do you, "evaluate if a co-founder is committed over the entire product development timeline before any perceived payback" ? The article fails to answer this question.

</comment><comment><USER3> Sometimes it's not extremely expensive to get started, but it very time consuming. Does that mean you're more/less committed than another entrepreneur who has spent a ton of money getting a company rolling? I think a person's answer to these questions can tell what they value more. Additionally, I always have a hard time considering someone to be uncommitted to a startup if they are working a separate full time job to support their family. Whenever I come across that argument, I can't help but think: Just imagine what I'll be able to do when I'm working 100 hours/week for my company rather than 60 for my company and 40 for another

</comment><comment><USER4> Good article and informative comments. They underline my own current concerns - working on a startup while working full-time to support a family... I know chances for success are slim because most would say I'm not "committed". But I have faith in my idea, and I keep working toward my goals. I get discouraged when I see other startups with similar ideas, but that also shows me that I'm on the right track and the market is ripe.</comment>


Jacob Appelbaum detained at U.S. border, questioned about Wikileaks - <AUTHOR> http://news.cnet.com/8301-27080_3-20012253-245.html <comment><USER2> _> [...] when he was pulled aside by customs and border protection agents who told him he was randomly selected for a security search

> [...] Receipts from his bag were photocopied and his laptop was inspected > but it's not clear in what manner, the sources said. Officials from the > Immigration and Customs Enforcement and the U.S. Army then told him he was > not under arrest but was being detained, the sources said. They asked > questions about Wikileaks, asked for his opinions about the wars in Iraq and > Afghanistan and asked where Wikileaks founder Julian Assange is, but he > declined to comment without a lawyer present, according to the sources. He > was not permitted to make a phone call, they said._

What's more worrisome to me is that doublespeak like nonrandom "random searches" and "not arrested but detained" — not to mention state officials imprisoning citizens and holding them up to some political litmus test over their opinions of our foreign wars while searching through their documents and confiscating their equipment without a warrant — has apparently become such a norm in the USA that even more open-minded news sources like Wired don't bother to question it.

<comment><USER3> Immigration and Customs officials don't need a warrant to detain you (temporarily), search you, ask your questions or seize some or all of your luggage. This has always been the established norm as it is on the (controlled) borders of just about any country.

<comment><USER2> Even to the extent that this is currently the norm, why is it _OK_?

Why should state officials ever be allowed to interrogate U.S. citizens' political opinions, regardless of whether those citizens happen to be standing in an airport?

It makes perfect sense that Customs be allowed to inspect physical items passengers bring through the airport, but what rationale says they should look through your computer files, especially in a post-Internet world? (I.e., there's no sense in claiming that you'll stop child pornography or other hot- topic illegal data entering the U.S. in an age where the Internet exists.)

<comment><USER3> Why is what OK? For law-enforcement personnel to ask you questions? Or search you? Both of these are established and legal and common. Saying they shouldn't be able to search your laptop because of the Internet is like suggesting police shouldn't check suspects in violent crimes for knives because of the availability of guns. Instead of making more vague regulations about what you can and can't be asked at the border, there is a very simple remedy for government agents asking you questions you don't want to answer - simply not answering. That's a legal right Jacob Appelbaum had no trouble taking advantage of.

</comment></comment></comment></comment><comment><USER4> I wonder if this is part of a policy to try and debase wikileaks by making it clear that if you affiliate with them or support them that life will be made hard for you.

I know Jake. I was a member of Noisebridge. I feel the work that Wikileaks is doing is incredibly important, and I know he's got the fortitude to deal with the bullshit and continue fighting the good fight.

<comment><USER5> Wikileaks may be important, but they should really think of the consequences of their actions:

[http://www.telegraph.co.uk/news/worldnews/asia/afghanistan/7...](http://www.telegraph.co.uk/news/worldnews/asia/afghanistan/7917955/Wikileaks- Afghanistan-Taliban-hunting-down-informants.html)

If any death results from this "leak", Jake should be held accountable.

<comment><AUTHOR> Who has the moral authority to hold Jake accountable? He exposed the truth. By contrast, Bush, Cheney & Rumsfeld gave us Gulf of Tonkin II, the meretricious congressmen gave the executive branch all the power it wanted, we know that we invaded a country based on lies, 100,000s have died, and noone has been held accountable. What's the rule here? You kill 1 it's a tragegy, but if you kill 1,000,000 it's a statistic?

<comment><USER5> "Who has the moral authority to hold Jake accountable? He exposed the truth. By contrast, Bush, Cheney & Rumsfeld gave us Gulf of Tonkin II, the meretricious congressmen gave the executive branch all the power it wanted, we know that we invaded a country based on lies, 100,000s have died, and noone has been held accountable. What's the rule here? You kill 1 it's a tragegy, but if you kill 1,000,000 it's a statistic?"

So you claim nobody has the "moral authority" to hold the people from wikileaks accountable, yet you want to hold Bush, Cheney, and Rumsfeld accountable (it's interesting you would use only republicans as examples btw) for their actions?

If I intentionally gave out your address to criminals and told them when you wouldn't be home (and they robbed your house), would you hold me accountable? I'm just "exposing the truth"

This information has the possibility of getting thousands killed. On a side note, I'm hoping I can get jake's full address and phone number so I can give it out to some people. I'm sure he won't mind. I'm just "exposing the truth"

<comment><USER5> "Perhaps I'm just out of touch, but I normally would put most of the responsibility for these things on the warring parties. Blaming a third party that doesn't have an army, a militia, or guns seems self-serving or disingenuous, depending on who's doing it."

I'm not blaming Wikileaks for those things. As you say, they don't have an army. What they do have is a very large audience. Just like with a militia (or owning a gun), you need to be responsible. Giving out the names of potential informants and spies is not being responsible.

If there was even a chance that people could die as a result of this information, they shouldn't have gone public. Because they did, it leads me to believe that they are being driven by an anti-war political agenda.

To me, the information given is not worth the number of lives that will be lost as a result.

<comment><USER6> "To me, the information given is not worth the number of lives that will be lost as a result."

Fair enough; that's an honest disagreement. My perspective on the matter is simply that whatever the number of deaths that Wikileaks will hypothetically be responsible for, the American government and Taliban are each responsible for a hundred times as many. I do a little introspection and realized that I'm not all that outraged about the actions of the American government with respect to Afghanistan and Iraq[0], so I can't bring myself to be upset about something that is a drop in the bucket (not to mention indirect, rather than direct, responsibility) in comparison.

Clarification: I am not suggesting that you either disagree or agree with the position I present here. I'm just presenting it.

[0] To spell it out: Afghanistan started their war by knowingly allowing al Qaeda to plan and train for the September 11 attacks in Afghanistan. The American invasion is therefore a retaliation, and not a war of aggression, so fair enough. My feelings on the war in Iraq are that it was a waste of time, effort, lives, and money, and was driven by the American and British governments knowingly and intentionally deceiving their publics. If the country I live in had tagged along for the ride, I would be rather upset about the situation, but if some foreign government wants to self-harm it's not my problem.

<comment><AUTHOR> _"I do a little introspection and realized that I'm not all that outraged about the actions of the American government with respect to Afghanistan and Iraq."_

If you don't live in Russia nor China, what makes you think that the U.S. won't converge towards tyranny at some point in the future and start using their fantastic military machine to invade countries at will, building an empire that neither Napoleon nor Hitler could even dream of? If that sounds impossible, let us not forget that Germany in the 1920s was quite different from Germany in the 1930s.

I remember the huge demonstrations against the invasion of Iraq in Europe in early 2003. Hundreds of thousands of people protesting in Barcelona. The biggest protests since Vietnam. And, then, one year later, the Madrid metro bombings "forcefully" convince the vastly anti-war Spanish electorare that it was intolerable to have a handful of troops in Iraq. Just because you don't live in the U.S. nor the U.K. do not rule out the possibility that you might suffer the consequences of the reckless invasion of Iraq.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> It would be a good thing if more prominent people became associated with Wikileaks and diluted the one-man-show aspect. It's the principles that matter.

Interesting that FBI agents at Defcon said they wanted to know if "human rights" were being "trampled". Is that a clumsy way of establishing rapport with the subject, or are there actually FBI agents who think like that?

<comment><USER8> One of the best parts of Defcon is the opportunity to party with feds all night long. You discover they're just like you.

<comment><USER9> Can any individual government agent in such a capacity ever really be "just like me"? I don't take orders from anyone. They do. In that respect, they are nothing like me at all.

A large part of what makes tales of government harassment like this one so troubling is how similar, reasonable, and even pleasant the agents are. If they are just like us, then why is there so much injustice?

<comment><USER10> > If they are just like us, then why is there so much injustice?

Politics.

</comment></comment></comment></comment><comment><USER5> I hope that when there are discussions about the "drug war" in the US in the future, that people blame the cartels for murders and not the fact that drugs are illegal.

After all, the government isn't the one doing the shooting. This seems to be the defense of the Wikileaks guys.</comment>


Combining CSS or JavaScript Files on the Fly with PHP - <AUTHOR> http://www.thewebshop.ca/blog/2009/11/combining-css-or-javascript-files-on-the-fly-with-php/ <comment><USER2> > /combine.php?test1&test2

that's a pretty hideous URL. I'd want to alias that using mod rewrite or something. I'd also probably want to do this as part of a build script and just let the web server serve the static files. Then you'd probably just run the dynamic one on your dev server to save you having to build.</comment>


How Duplicate Content Is Hurting Your SEO Performance - <AUTHOR> https://www.contentkingapp.com/academy/duplicate-content/ <comment><USER2> Thanks for sharing, that's a good resource. Would you say duplicate content is an issue for very small sites (think: less than 25 pages) too?</comment>


Best Free  Advanced Math Textbook..covers Everything [pdf] - <AUTHOR> http://www3.nd.edu/~powers/ame.60611/M.pdf <comment><USER2> I was on a slow connection, so it took some time to download. This appears to be a draft of a Mathematical Methods for Engineers textbook. Its 502 pages start out with multivariable calculus, then go through lots of linear algebra, and end with dynamical systems.</comment>


U.S. Web Design Standards 1.0 - <AUTHOR> https://standards.usa.gov/whats-new/releases/#version-1-0-0 <comment><USER2> Great! Even if you disagree, just the existence of a Gov standard will:

1) Create a minimal common language for all sites that the citizens are forced to use. Now we can all can use these patterns in our sites knowing that more users will know them. Remember that software isn't intuitive, but familiar: [http://www.asktog.com/papers/raskinintuit.html](http://www.asktog.com/papers/raskinintuit.html)

2) Force software developers for public services to put up a minimal decent interface, instead of just a list of features.

The best page is their Design Principles: [https://standards.usa.gov/design- principles/](https://standards.usa.gov/design-principles/)

<comment><USER2> It is even better. They also have code guidelines. Easing the choosing of technologies (open source!) and configuration.

Less opportunities for that crazy developer who wants to implement your costumer facing site in Common Lisp.

<comment><USER3> _> Less opportunities for that crazy developer who wants to implement your costumer facing site in Common Lisp._

Somewhere, an LM-2 who has been faithfully serving requests since 1981 just cried a single, perfectly simulated electronic tear.

<comment><USER4> Surely this very system (HN) shed a tear somewhere between brackets as well.

</comment></comment></comment></comment><comment><USER5> I'm really surprised all the typography options require downloadable fonts (Source Sans Pro and/or Merriweather).

I'm on a 1mbit throttled connection right now, and it's really noticeable, even on these pages, the font loading takes a while and suddenly the whole page jumps around and re-renders.

Though apart from that It's a great guideline.

Really glad they put so many color choices in there and taking care of showing how to combine typography with color. Many guidelines I've seen have two accent colors and when you come to implementing the site, you straight away must deviate from the guideline and invent new things.

<comment><USER6> It does suck especially if agencies rehost the fonts and you end up downloading the same ones over and over. Hashed font caching solves this problem pretty well and that seems like the answer instead of forcing everyone to use a common set of fonts.

<comment><USER5> Maybe there could be room for innovation here? Signed font sets with known hashes (maybe piggyback on HTTP ETag?), so over time your browser has a cache of "well known fonts".

Things like Source Sans Pro are not unusual.

<comment><USER7> Why not modify the CSS syntax? For example, what now is

        src: url("path/my.otf") format("opentype");

can become

        src: url("path/my.otf") format("opentype");
        src: url-hash("path/my.otf", "md5:86fb269d190d2c85f6e0468ceca42a20") format("opentype");

This way, due to the double declaration, older browsers can opt to download the file as usual while a modern browser detects the hash and can look up the file from its cache. Note I chose md5 here as an example, it may very well be possible to use any hashing scheme here.

<comment><USER8> Obligatory: [https://hillbrad.github.io/sri-addressable-caching/sri- addre...](https://hillbrad.github.io/sri-addressable-caching/sri-addressable- caching.html)

(List of problems you need to solve to introduce hash-addressable caching to Web)

<comment> angry-hacker What if major operating systems would include the popular fonts on Google library with update(s)?

<comment><USER8> Then you can use them:

       src: local('Font Name'),

<comment><USER7> Please not. People e.g. download questionable fonts from the net, which e.g. have been stripped of everything non-alphanumeric, and then complain to you "your website looks bad", or they have official, but fossilized versions of fonts... I always strip local-sources when embedding webfonts for this reason.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Been using this on a govt. site Ive been redesigning for 2 years and could be doing so for another year or more.

We've went from one govt. design standard to another and I'm not sure if the site will ever get redesigned or finished as it has to get signed off by a 100 govt. VP types. I'm burnt out by the bureaucracy and they need someone to get this thing approved vs. what do you think and what do you think and oh what do you think ... each person having a different opinion and nothing getting done but revise it again. What version are we on now .. oh number 599.

Keeps me gainfully employed thankfully, but redesigning a website should not take 3 years or more.

</comment><comment><USER6> This is great at this point because it's short and simple, but I could imagine this becoming terrifying in a few years if it does not remain in good hands. The natural thing to do is point out what could be added and pretty soon it could become a massive burden to make sure you're compliant with the standards. Long term I suspect this could increase the weight (cost and time of delivery) of government software projects. If only we could have some predefined limit set of how long and complex it can become. My libertarian side is coming out here, but the government is really good at adding cool things, not so good at taking them away, decreasing them, or even maintaining them.

<comment><USER10> I really wish libertarians would – from time to time - point at actually unambiguously government overreach. All I ever see is "seat belts are great, but making them mandatory is a nanny-state gone wild, and soon you won't be allowed to leave the house".

I think the myth of regulatory strangulation is just some fantasy of people who see a stack of paper more than an inch thick and for their lives cannot imagine why it would require so many words to make air travel (etc.) safe.

<comment><USER11> There is a fantastic overview of this by Matt Levine at Bloomberg.[1] (The following is all quoted text):

I am working on a tentative theory of regulation. It goes like this:

1) There are two kinds of regulations: custom regulations and bulk regulations.

2) A custom regulation is designed to accomplish a particular goal. You want people to do something, so you write a rule mandating that they do it and punishing them if they don't. For instance, if you want U.S. companies to keep jobs in the U.S., you might write a rule to mandate that, and to "impose a 'very major' border tax on companies that move jobs outside the U.S." That is an example of a custom regulation, and it is good because it keeps jobs in the U.S.

3) Bulk regulations are the kind that you buy by the yard, ones that you measure by quantity rather than purpose. They don't have a purpose, really; they are just generic "red tape." These are the regulations that presidents frequently announce they will cut in half, or freeze with an executive order. They're the regulations that come not from a reasoned desire to achieve a particular goal, but from a pure impulse to regulate. Bulk regulations are bad because they prevent businesses from doing business-y things without accomplishing anything good.

4) All regulations are custom regulations.

5) All discussion of "regulation" is about bulk regulations, which do not exist.

[1]: [https://www.bloomberg.com/view/articles/2017-01-24/metrics-f...](https://www.bloomberg.com/view/articles/2017-01-24/metrics- fees-and-regulations)

<comment><USER12> I love Matt Levine, but he's wrong that "Bulk Regulations" don't exist. They are called licenses, and you have to have them do operate many types of businesses. See hair salon licenses, landscaping licenses, etc. There is zero reason for licenses in many low-skill sectors, but they exist and are regularly codified into state or federal laws as a requirement of doing business. These licenses are enforced by rent-seeking gatekeepers, who effectively drive out competition and raise prices on consumers. This is very much "bulk regulation", and is terrible for everyone.

<comment><USER13> How do you enforce uniform education about say, hygiene without a license?

You say there are zero reasons but I think there had to be at least one once, and probably still.

<comment><USER12> Do you need 1000 days of training to properly dress hair? Because that's the average training required to acquire the license.

<comment><USER14> Cosmetology licensure requirements usually specify hours, not days.

Even still, cosmetology is a surprisingly complex practice which really does require a lot of hands-on training to become proficient. You should talk with a licensed cosmetologist sometime to get the ins and outs of their education.

<comment><USER15> Or talk to someone who actually uses a cosmetologist's services regularly. It's very easy to gloss over the depth and complexity of a field when you don't even need its services.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> >18F specifically does not recommend using Bootstrap for production work because:

>It is difficult to adapt its opinionated styles to bespoke design work, and

They have a tool on their website to generate a theme (Bourbon and PureCSS do not), and Sass functions and mixins for customizing elements. Bourbon and PureCSS's components are just as opinionated (and there are less of them).

>Its CSS style places semantic layout instructions directly in HTML classes.

Sure, but you can just use the Sass mixins instead, allowing you to use the grid system without adding a single class to HTML.

Seems they knew this about Bourbon:

>Bourbon is a Sass mixin library that has extensions for a robust semantic grid (Neat)

The same is true of Bootstrap, so they recommend against it?

It sounds like the author wasn't familiar with Bootstrap.

<comment><USER17> I imagine you're right. There's so much hissing and booing and the mention of bootstrap that a lot of otherwise good developers never touch it.

Despite the fact that, you know, bootstrap is just fine.

</comment></comment><comment><USER18> Their wonderful tag line at the bottom of the page footer:

 _We're from the government, and we're here to help._

<comment><USER19> The full original quote being: "The most terrifying words in the English language are: I'm from the government and I'm here to help."

[0] [https://en.wikiquote.org/wiki/Ronald_Reagan](https://en.wikiquote.org/wiki/Ronald_Reagan)

</comment></comment><comment><USER20> I love this:

> The UI components are built on a solid HTML foundation, progressively > enhanced to provide core experiences across browsers. All users will have > access to the same critical information and experiences regardless of what > browser they use, although those experiences will render better in newer > browsers. If JavaScript fails, users will still get a robust HTML > foundation.

I guess it remains to be seen just how robust this really is, but it's a fantastic goal to see explicitly embraced for modern websites. I skimmed some things in Lynx and w3m (elinks failed with an SSL error; rumor has it that it doesn't support SNI), and it honestly looks better than I remember a lot of sites looking in Lynx ~20 years ago, let alone the average modern site. Sure, part of that is imagemaps and frames going out of style, but modern sites haven't necessarily replaced them with more graceful constructs.

</comment><comment><USER21> > An official website of the United States government Here's how you know...

> This site is also protected by an SSL certificate that's been signed by the > U.S. government...

Oh really?

DST Root CA X3 \- Let's Encrypt Authority X3 \- standards.usa.gov

Kudos for using Let's Encrypt though!

<comment><USER22> That's being fixed: [https://github.com/18F/web-design- standards/issues/1738](https://github.com/18F/web-design- standards/issues/1738)

</comment></comment><comment><USER23> The main page developers will care about:

[https://pages.18f.gov/frontend/#intro](https://pages.18f.gov/frontend/#intro)

Some things are great, and show a pulse on the industry, but some aren't. For example, Bower is prohibited, but yarn isn't even mentioned or encouraged, much less required.

Though they do give devs the freedom to choose any framework, with a very nice pros/cons lists of the popular ones

[https://pages.18f.gov/frontend/#js- frameworks](https://pages.18f.gov/frontend/#js-frameworks)

<comment><USER22> Issues/PRs welcome! [https://github.com/18F/frontend](https://github.com/18F/frontend)

</comment></comment><comment><USER24> I had a manager once who had a prior career in government. One of their many cynical internal catchphrases was "the conveniences which you have requested are now mandatory".

Anyone with common sense and a knowledge of history knows exactly where this is going. As things continue to move online, internet access and associated technology standards begin to be declared a "public necessity" or some other nonsense along similar rhetorical lines.

You don't even need to look very far for examples. UK accessibility laws (not that they're an unqualified evil, simply a legislative 'gateway drug'), references to 'digital haves and have-nots' from a few US election cycles ago, etc.

I'd really hoped to be closer to retirement before this sort of thing started happening.

Edit for clarity: I'm not saying this is immediately going to turn into some draconian thing, but as a founding member of a standards body[0] with a narrowly-defined intent, I've seen how easy it is for something like this to become a de-facto industry standard that non-experts use to judge things against, even when it's not appropriate.

[0] [http://www.php-fig.org/](http://www.php-fig.org/)

<comment><USER25> Are you saying that legislation to make sure people with disabilities or low incomes still have access to services when all the alternatives are shut down is a _bad_ thing?

<comment><USER26> That's pretty far from the mark, but being made to provide multiple versions of content to accommodate all ranges of accessibility for anything, not just vital or government services, published on the web could be a pretty difficult thing.

Content without captions spurred a lawsuit by the National Association of the Deaf against Netflix a few years ago. What if your personal website hosted some dynamic content where an uncaptioned sound bite appeared, and you ended up being faced with legal action?

What if the scope were broadened so that all websites required content compatibility modes for color blindness or spectrum sensitivity? Would that responsibility be shared by the browser makers as well? Would Google pull ads from businesses whose websites were not in compliance?

And in the Netflix case, the judge found that it would be "irrational to conclude [that] places of public accommodation are limited to actual physical structures."[1] That's quite an interesting interpretation.

[1] [http://www.slate.com/articles/arts/culturebox/2012/07/closed...](http://www.slate.com/articles/arts/culturebox/2012/07/closed_captioning_lawsuit_netflix_faces_legal_charges_for_not_complying_with_ada_requirements_.html)

<comment><USER27> The foundational law has been around for over 25 years. It doesn't require anything of your personal website anymore than it would require your personal home to have wheelchair ramps.

> What if the scope were broadened so that all websites required content > compatibility modes for color blindness or spectrum sensitivity?

The law already requires reasonable measures to provide access to people with disabilities. If a business website's colors prevents a customer from using the site, they could already make it a legal matter. But that doesn't happen often, it's much easier for everyone for a customer to contact the business, explain the problem, and for the business to make a change that corrects the problem (more likely, some number of customers explain and eventually something is done).

But standards and expectations do change over time, what's considered reasonable partially depends on technical possibilities, their general availability, and cost. It's reasonable to expect web sites to work with screen readers because they're readily available on almost all the computers people use; if screen readers didn't exist, it would not be reasonable to expect web sites to provide a purely aural interface for the vision impaired.

> the judge found that it would be "irrational to conclude [that] places of > public accommodation are limited to actual physical structures."[1] That's > quite an interesting interpretation.

It's an interpretation that makes sense. The purpose of the law is to ensure people with disabilities have access to goods and services, it matters not whether such access involves concrete, paper, or ones and zeros.

<comment><USER10> > It doesn't require anything of your personal website anymore than it would > require your personal home to have wheelchair ramps.

The only slippery slope that wheelchair users approve of :)

</comment></comment></comment></comment></comment><comment><USER28> The introduction to the colors section talks about communicating warmth and trustworthiness. How does a mostly blue, grey and white page communicate those feelings. Personally, I have always associated blue and grey with cold and isolation.

</comment><comment><USER29> This is really well done. Code is well laid out, well documented. Will make it easy to use this for training new college hires for sure. Didn't expect something like this out of the government. Nice to be surprised here.

</comment><comment><USER30> This is great. Also worth noting in the UK, accessibility features for web pages are required by law (EQA, DDA). In the US, RAA 1998 is the similar legislation. Most govt agencies and private-sector businesses are required by law to provide accessible web pages, or face lawsuits and/or fines.

TL;DR: all sites of reasonable size (govt and otherwise) should follow WCAG 2.0.

WCAG: [https://www.w3.org/TR/WCAG20/](https://www.w3.org/TR/WCAG20/)

UK - Equality Act 2010 (EQA): [http://www.legislation.gov.uk/ukpga/2010/15/contents](http://www.legislation.gov.uk/ukpga/2010/15/contents)

UK - Disability Discrimination Act 1995 (DDA): [http://www.legislation.gov.uk/ukpga/1995/50/contents](http://www.legislation.gov.uk/ukpga/1995/50/contents)

US - Rehabilitation Act Amendments of 1998 (RAA): [https://www.congress.gov/congressional-report/105th- congress...](https://www.congress.gov/congressional-report/105th- congress/senate-report/166/1)

</comment><comment><USER31> it says on the site: "This site is also protected by an SSL (Secure Sockets Layer) certificate that's been signed by the U.S. government. "

But when you look at the certificate, it is signed by "Issued by: Let's Encrypt Authority X3"

</comment><comment><USER32> From the installation: _Note: Using npm to install the Standards will include jQuery version 2.2.0. Please make sure that you're not including any other version of jQuery on your page._

Isn't that pretty much precisely what peer dependencies are for?

<comment><USER33> peerDependencies were deprecated as of NPM 3.

<comment><USER32> They're not exactly deprecated, they just don't install automatically anymore. As I read it (and use them in npm 3), they're a way to specify "you need this other library installed also" without actually installing it.

In a lot of cases ("we just need some flavor of jQuery 2"), of which I am not sure that this us-web thing is an example, it's handy. The thing you're distributing isn't standalone, it's a thing people will use in an environment that has some installed jquery already, so you're fine.

The way I see it, if you're using a library that you can specify _very permissively_ , peer dependencies are quite handy, and in this particular case seem useful - I'm building some webapp, I need to know that my UI library wants jquery to work, but I have a choice of not necessarily using that part (probably used for DOM manipulation, so if I'm just npm installing it for the CSS, wev), or making sure I meet the dependency with the other stuff I'm using. If not installed by default is a problem, there's an npm-install-peers package that does that.

</comment></comment></comment><comment><USER34> Is this supposed to be used by non-US gov sites? Can any old private site use it? It's public domain in the US, so assuming the answer to that question is yes, would it make sense for a private site to use it?

<comment><USER35> Legally, I'm pretty sure public domain is public domain (it's not just PD 'in the us'). You can do what you want with it without fear of copyright. And it's good style guide, but the US government is a pretty big brand to compete for an identity with - it doesn't really seem like it would be a good idea to just adopt their style guide wholesale.

However, using this as a framework to build your own style guide sounds like a pretty decent plan.

<comment><USER34> Unfortunately, some other jurisdictions don't have a concept of "public domain" works. That's why the page indicates "... this project is in the public domain within the United States." in its license [1].

But you answered the main point of my question, so thanks!

[1] [https://github.com/18F/web-design- standards/blob/develop/LIC...](https://github.com/18F/web-design- standards/blob/develop/LICENSE.md#the-rest-of-this-project-is-in-the- worldwide-public-domain)

</comment></comment></comment><comment><USER36> I have an older Firefox that I'm running and the Web Design Standards page is all borked up. I'm wondering how many people that don't keep the upgrade stream going for their browsers will now have problems.

<comment><USER27> How old? I have a copy of Firefox 3.6.27 from 2012, the main content is below the sidenav, probably because its in an <aside>, support for which wasn't added until Firefox 4. That's okay, it's still usable, the content is still all there and readable.

But there are some other things that are more fundamentally borked, the accordions won't operate. I'm for progressive enhancement and while requiring JavaScript for a site to work well or in some cases work at all is okay, there should still be some provision to "fail safe" so the content is available when the specific JavaScript fails for some reason (I don't think it's because they're using <button>, technically using that outside a form was against old HTML specs but I think browsers still routinely supported them). For accordions, my preference would be to use <details> and <summary> elements and a polyfill to make them work in browsers that don't support them; they'll "fail safe" and display all the content in browsers that don't support them and don't run the polyfill.

<comment><USER36> 24.6 ESR from June 2014. The side navs are now on top of the main content. So the main contend slides under the side nav and is hard to read. I understand that it's a 3 year old browser, but it's on a Win7 machine, like lots of other web users.

<comment><USER27> I realized that Firefox 3.6 not supporting <aside> wouldn't really affect the layout, it's basically a <div> and it's floated left, something 3.6 can handle. The main content has a class containing width: calc(100% - 250px); and Firefox didn't support calc() until 4 but that wouldn't explain it happening to you in 24.6 ESR.

Maybe older Firefox has a bug in calc(), disabling that property in a newer browser is enough to shift the content below the sidenav because it falls back to width: 100%;. I see what you mean about hard to read, if I disable the calc() width, the sidenav stays put but the main content scrolls on top of it. That's a little confusing because the sidenav staying put is due to the property position: sticky; but caniuse.com says Firefox didn't support that until version 26, version 32 without having to enable a flag.

Anyhow, I do think government guidelines in particular should handle older browsers better than this page is demonstrating. Part of the point of using frameworks for libraries and others is they can maintain and aggregate all the little solutions to problems between browser implementations and between older and newer browsers.

<comment><USER22> This is a really interesting question, given the very long tail of old browsers out there. There's downloadable data about the browsers visiting gov't websites (all anonymized by Google Analytics)[1], but that doesn't solve the "when do you stop supporting" question, particularly for old versions of IE.

[1]: [https://analytics.usa.gov/](https://analytics.usa.gov/)

</comment></comment></comment></comment></comment><comment><USER28> Also notice the very inclusive picture on their landing page template.

</comment><comment><USER18> So the General Services Administration (GSA) forked Bootstrap. =)

</comment><comment><USER37> Why does this standard not fall under the purview of N.I.S.T.?

</comment><comment><USER38> So these are the web design standards the government abides by?

<comment><USER6> What will happen is that adherence to these standards will be embedded in federal government software contracts moving forward. It's a good start and written by a common sense group of people.

</comment></comment><comment><USER39> And so the Hero Unit becomes a US standard.</comment>


Huawei warns China will strike back against new US restrictions - <AUTHOR> https://www.platformexecutive.com/news/mobile-telecoms-infrastructure/huawei-warns-china-will-strike-back-against-new-u-s-restrictions/ <comment><USER2> Blogspam of

[https://www.reuters.com/article/us-huawei-results/huawei- war...](https://www.reuters.com/article/us-huawei-results/huawei-warns-china- will-strike-back-against-new-u-s-restrictions-idUSKBN21I0YS)

</comment><comment><AUTHOR> Whilst its great for governments to support their local businesses, this will not help null the longstanding rumours surrounding the true ownership of the company.</comment>


Google's Fuchsia Adds Emulator for Running Linux Apps - <AUTHOR> https://www.linux.com/blog/2018/6/googles-fuchsia-adds-emulator-running-linux-apps <comment><USER2> Is Fuchsia an experimental project or does Google actually have commercial plans for it?

<comment><AUTHOR> I have no idea, but, in any case, having a Linux compatibility layer is handy.</comment></comment>


The recent major result about psychology – irreproducable results - <AUTHOR>

Lots of stories on HN about this - here are some ... <comment><AUTHOR> [https://news.ycombinator.com/item?id=10131387](https://news.ycombinator.com/item?id=10131387) (33 comments)

        Many Psychology Findings Not as
          Strong as Claimed, Study Says
            (nytimes.com)

[https://news.ycombinator.com/item?id=10131818](https://news.ycombinator.com/item?id=10131818)

        100 psychology experiments repeated,
          less than half successful
            (arstechnica.co.uk)

[https://news.ycombinator.com/item?id=10131891](https://news.ycombinator.com/item?id=10131891)

        Over half of psychology studies fail
          reproducibility test
            (nature.com)

[https://news.ycombinator.com/item?id=10131921](https://news.ycombinator.com/item?id=10131921)

        Experiments in leading psychology journals
          can't be confirmed most of the time
            (ap.org)

[https://news.ycombinator.com/item?id=10131921](https://news.ycombinator.com/item?id=10131921)

        Study: Most Experiments in Leading Psychology
          Journals Can't be Confirmed
            (ap.org)

[https://news.ycombinator.com/item?id=10132251](https://news.ycombinator.com/item?id=10132251)

        Yes, many psychology findings may be "too
          good to be true" -- now what?
            (retractionwatch.com)

[https://news.ycombinator.com/item?id=10135274](https://news.ycombinator.com/item?id=10135274)

        Psychology Research Fails
          (theguardian.com)

[https://news.ycombinator.com/item?id=10135391](https://news.ycombinator.com/item?id=10135391) (5 comments)

        Scientists Replicated 100 Psychology Studies,
          Fewer Than 50% Got the Same Results
            (smithsonianmag.com)

[https://news.ycombinator.com/item?id=10135617](https://news.ycombinator.com/item?id=10135617)

        Many Psychology Findings Not as Strong as
          Claimed, Study Says
            (nytimes.com)

[https://news.ycombinator.com/item?id=10135696](https://news.ycombinator.com/item?id=10135696) (1 comment)

        100 psychology experiments repeated,
          less than half successful
            (arstechnica.com)</comment>


Margaret Hamilton's Apollo code - <AUTHOR> http://news.mit.edu/2016/scene-at-mit-margaret-hamilton-apollo-code-0817 <comment><AUTHOR> It's Margaret's 80th birthday. Love that pic. Inspiration for all and especially up'n'coming girl students out there

</comment><comment><USER2> I enjoyed sharing her story with my 9yr old coding daughter; solid role model.</comment>


3M learned of PFAS food contamination in 2001 - <AUTHOR> https://theintercept.com/2019/06/12/3m-pfas-chemicals-food/ <comment><USER2> This is an incredibley understated problem. This isn't the first time it's cycled through the media, either. I hope that this time it moves the right person or organization to take aggressive action to analyze, diagnose, and develop a solution to this monster.</comment>


Ideas  Startup Garage Bangalore - <AUTHOR> http://startup-garage.com/ideas-startup-garage-bangalore/

<comment><USER2> I think the ideas are pretty lame and have been implemented or at least been thought of by others a thousand times. Or they are just small deviations from their originals. No REAL innovation here.

Still I wish you guys luck. The online store thing seems most interesting to me.</comment>


God's Lonely Programmer (2014) - <AUTHOR> https://motherboard.vice.com/en_us/article/wnj43x/gods-lonely-programmer <comment><USER2> Discussion at the time (883 points, over 300 comments): [https://news.ycombinator.com/item?id=8658283](https://news.ycombinator.com/item?id=8658283)

</comment><comment><USER3> This is my kind of person/challenge</comment>


Findographer - <AUTHOR> http://www.findographer.com <comment><USER2> (I guess this submission will be flagged, and I don't speak Turkish, but anyway ...)

It's very strange that when you click in a category, the images that appear are not related. I think you should try to improve the classification or tag system.

<comment><AUTHOR> Thank you for your feedback, could you please let me know which category did you click? let me check

<comment><USER2> IIRC, all of them. For example, the fist is "bebek" [http://www.findographer.com/search?categoryId=1](http://www.findographer.com/search?categoryId=1)

Form the photography in the front page and how the word looks, I guess it's "baby" (and google translation agree :) ) . If I have to describe the photographs, I'd use 1:building 2:teacup 3:mirrors 4:lady . No baby there.

Also, to get more feedback add "Show HN:" in front of the title. Read the guidelines [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html) "Show HN is for something you've made that other people can play with. HN users can try it out, give you feedback, and ask questions in the thread."

<comment><AUTHOR> Hi again, we updated our site and also we added language selsection so you can check our site in English. thanks</comment></comment></comment></comment>


Evolutionary gene loss may explain why only humans are prone to heart attack - <AUTHOR> https://www.sciencedaily.com/releases/2019/07/190723182255.htm <comment><USER2> Since the driver of the selection against the related gene seems to be malaria, I wonder if this is linked to prevalence of body hair on human ancestors.

Bug bites on hairless skin probably had something to do with dying of disease, and the early homonids that had the gene seem to be the ones hit the hardest.

We also see evolutionary markers related to bed bugs, head lice and body lice. Maybe mosquitos and genes linked to a possible malaria pandemic offer more clues.

<comment><USER3> Malaria is a fascinating one, with the prevalence of sickle cell anemia and G6PD blood deficiency in some populations with high exposure. Both of those cause health issues but they both confer some level of resistance to malaria.

<comment><USER4> Isn't the recessive gene for cystic fibrosis also linked to malaria resistance?

Edit: apparently it might be linked to a resistance to cholera.

<comment><USER5> I was taught (undergraduate genetics) that it was TB, but I see the relevant Wikipedia page also lists cholera, typhoid and diarrhea _shrug_

</comment></comment></comment></comment><comment><USER6> On the other hand, cats -- for example -- are highly prone to kidney failure in a way that humans are not.

<comment><USER7> Cats, being obligate carnivores and lacking a proper mechanism for extracting energy out of fatty acids (e.g. ketogenesis in humans), have actually very efficient kidneys to dispose of all the nitrogen coming from their protein- exclusive metabolism.

Domestic cats are at risk, but that is more a result of domestication and improper feeding (carbohydrate) than evolution or genetics. Unless I am missing something, of course! Care to elaborate?

<comment><USER8> Whenever I see comments blaming carbohydrate intake for large swaths of problems I find it challenging because I agree and then feel that I am seen as a heretic or extremely gullible.

Do you ever feel that way?

<comment><USER7> Yes.

I don't usually express my opinions on nutrition, metabolism and/or health in general in the open, because I know they go against what is currently mainstream and they would be met (as elsewhere in this submission) with extreme resistance. I can't blame the others, though, as I once was in their same position and know how it feels when deeply ingrained ideas are challenged from the outside.

I have learned to live without the need to be "right", or to educate others when they don't want to be. It is enough for me to apply what knowledge and intuition I have gained over the last years for my own health and well-being. If, at some point, someone wants me to share that knowledge, then I will gladly do it.

<comment><USER8> Thank you for this. This is very helpful both practically and emotionally.

I also try not to say a word about my beliefs. That was much easier before having children who are offered carbohydrates constantly.

<comment><USER7> You're very welcome.

Even though I have no children, I can try to imagine what it feels like.

My paternal grandfather died of complications from uncontrolled, insulin- dependent type 2 diabetes. He spent his last years half-blind, unable to move, filled with ulcers and missing several toes.

My father has been hovering around the prediabetic range for many years now, and I live a 5-hour drive away from him. Effectively, he is like a child, with no knowledge of nutrition or metabolism, trying to find his way in a world dominated by a food industry that doesn't have public health anywhere in its objectives.

But it's not just the food industry, although they might have the monopoly of malice in this context. Guess what the diet prescribed by his primary care provider looked like once he was deemed prediabetic. Motherfucking biscuits for breakfast, pasta or rice with lean meat, sugar-laden fruit juice... but counting calories! Exactly the opposite of what I have finally convinced him to eat by chipping away on every holiday visit. He's not exactly following a ketogenic diet, but at least he is starting to figure out what sugar, starch and seed oils do to people, and how the blame was shifted onto the wrong substances (saturated fat and salt, basically). He is even giving intermittent fasting a go!

It's hard when you know that the potential suffering of a loved one is perfectly avoidable with just the right pieces of information.

As you might have guessed, having type 2 diabetes in my immediate ancestry (also in my maternal family) was one of the reasons that led me down the rabbit hole. I now treat nutrition and its effect on health and metabolism sort of like a hobby. I guess there is a component of biohacking in there as well.

</comment></comment></comment></comment></comment></comment><comment><USER9> I have the feeling this has much more to do with our self inflicted lifestyle than genetic factors.

Maybe no other animal is just that stupid.

<comment><USER10> > Maybe no other animal is just that stupid.

Have you ever owned a cat or dog? My experience is that a percentage of them will overeat unless constantly monitored, eat things that are outright dangerous, etc. What is it that makes humans the stupid ones, here?

<comment><USER11> I wonder whether or not we should distinguish between domesticated animals and wild ones

<comment><USER12> It would be an interesting (if difficult) experiment but from what I know wild animals will absolutely gorge themselves if they can.

The difference is that in the wild, this is tends to be quickly followed by a resource crash from a normal cycle (e.g. winter crash after summer glut) and / or population explosion.

I don't know that any organism has had evolutionary-scale periods over which to psychologically integrate an access to essentially unlimited (in time and quantity both) resources.

<comment><USER13> I have seen wild geese eat too much seed from bird feeders and practically lose the ability to fly.

I suspect the correcting mechanism for that is generally predation.

</comment></comment></comment></comment></comment><comment><USER14> I wonder if a gone lost hundreds of years ago is somehow _responsible_, then why heart attack related death mostly occured in last 50 years?

<comment><USER15> It could be that they were not diagnosed as heart attacks before that.

edit: And also maybe general life style differences regarding availability and richness of food, exercise, shorter life spans etc.

<comment><USER16> In the 19th century, a heart attack may have been recorded as "old age", "sudden death", "apoplexy", "stomach cramps", "spasms", or a lot of other things. As long there weren't any suspicious circumstances I don't think they usually looked into it that closely.

<comment><USER17> I mean, this was when amputation and leeches was the pinnacle of medicinal triage. Life expectancy hit 49 in 1900 - for most of the 1800s it was below 40, a fact that still blows my mind today.

<comment><USER18> ...are you aware that most of that low life expectancy was caused by infant and child mortality? Once you lived past 15, you were expected to stick around at least to your 60s, if not more.

So yes, modern medicine is a Herculean effort in many ways. One of them is that it saves so many of our otherwise _very_ frail and helpless children.

<comment><USER17> Thanks for this - I was using life expectancy at birth. Looks like it was around 55->60 from 1850->1900 if you lived to 5 looking at this chart: [https://ourworldindata.org/uploads/2013/05/Life- expectancy-b...](https://ourworldindata.org/uploads/2013/05/Life-expectancy- by-age-in-the-UK-1700-to-2013.png)

</comment></comment></comment></comment></comment></comment><comment><USER19> Interesting, I was always under the impression that chipmunks were susceptible to heart attacks. I can't remember where I read it and I can't find a current source but you are apparently not supposed to harass chipmunks because they can experience stress induced heart attacks when threatened/chased. I've also seen potential evidence for this when my cat chased one around a parking lot only for it to collapse after sprinting around for a solid minute. It was immobile, looked short of breath and eventually died at some point between when I brought my cat in and the next morning.

<comment><USER20> Rabbits, too.

The whole premise behind this headline seems bogus.

<comment><USER21> The headline seems bogus but the article says that "naturally occurring coronary heart attacks _due to atherosclerosis_ are virtually non-existent in other mammals." Atherosclerosis is the cause of only "one-third of deaths worldwide due to cardiovascular disease" so other causes could still apply to other mammals. For example, "chimp heart attacks were due to an as-yet unexplained scarring of the heart muscle."

Of course we can give rabbits atherosclerosis by giving them high cholesterol from a diet they don't eat in the wild. But in humans, "in roughly 15 percent of first-time cardiovascular disease events (CVD) due to atherosclerosis, none of these [risk] factors apply," where risk factors include "blood cholesterol, physical inactivity, age, hypertension, obesity and smoking."

So the study explores a possible reason for that.

<comment><USER22> Elephants that live in savannas in Africa are prone to atherosclerosis, while those living in forest areas are not. [1] discusses that it can be due to food. In savanna elephants are forced to feed on grains and dry grass, while in forest they feed on leaves, which is probably more natural.

[1] Staffan Lindeberg. Food and Western Disease: Health and Nutrition from an Evolutionary Perspective

</comment></comment></comment></comment><comment><USER23> If this turns out to be true, I wonder if this is something CRISPR could fix...

<comment><USER24> I'm not sure that I wish CMAH gene back:

 _> Interestingly, the evolutionary loss of the CMAH gene appears to have produced other significant changes in human physiology, including reduced human fertility and enhanced ability to run long distances._

Reduced fertility doesn't seem for me important, we have a contraception for that. But enhanced ability to run long distances seems very convenient. I can ride a bicycle or walk for hours just for fun of physical exercise, and I'm not going to lose that.

<comment><USER25> I read somewhere that running very long distances is basically the only physical thing humans can do better than any other animal.

<comment><USER24> Pretty close. I heard that humans are second after dogs.

<comment><USER26> Per [https://www.quora.com/What-animals-are-better-long- distance-...](https://www.quora.com/What-animals-are-better-long-distance- runners-than-humans) humans are best in hot arid places, horses are best in cooler temperate zones as the only other sweating animal, and dogs are best in cold climates, where their breathing isn't as badly affected by panting as it would be in hotter climates.

</comment></comment></comment></comment></comment><comment><USER27> It seems that this guys never tried to catch a shrew.

<comment><USER28> I've seen a mouse die in a "humane" trap after being carried a couple blocks – I always understood that was from a heart attack. It seems to happen with birds too – stress them out a bit, then dead.

So in what way are "only humans" prone? Are these not heart attacks?

<comment><USER29> Probably time to agree on what "heart attack" means.

My Dad's heart stopped and he was kept alive by 45 minutes of CPR by burly firefighters - did he have a heart attack? Nope. His heart's pacemaker cells went on the fritz, but it wasn't a myocardial infarction.

A "heart attack" is a myocardial infarction, but many other bad things can happen to your heart.

</comment></comment></comment><comment><USER30> Perhaps we evolved a heart overclocking ability. Sometimes we just push the heart too hard.

</comment><comment><USER7> > Atherosclerosis -- the clogging of arteries with fatty deposits

What a way to start an article in a website with "science" in its name.

Atheroma is an accumulation of white blood cells. White. Blood. Cells. Not fat.

"Meat bad, saturated fat bad, eat your necessarily fortified grains and heart- healthy industrially extracted seed oils."

<comment><USER31> -oma is a suffix that means tumour. E.g. lymphoma.

-sclerosis is a hardening. E.g arthrosclerosis for a hardening of joints.

<comment><USER7> I fail to see what this has to do with my comment.

The hardening in atherosclerosis is caused directly and exclusively by atheroma.

<comment><USER32> Everything I've ever read says fatty deposits. The NHS website calls fatty deposits "atheroma". You can find multiple definitions of atherosclerosis/atheroma in other places describing them the same way. Wikipedia says:

"While the early stages, based on gross appearance, have traditionally been termed fatty streaks by pathologists, they are not composed of fat cells but of accumulations of white blood cells, especially macrophages, that have taken up oxidized low-density lipoprotein (LDL)."

So whilst it may be more accurate to say they are white blood cells that fed on LDL (and presumably contain fatty substances as a result) there is a long tradition of calling them fatty substances, and there is at minimum a connection to fat.

It seems misleading to try to discount the role of the fat to me. They don't sound like they are just normal white blood cells. Is there any doubt that the fat plays a causative role? I know a couple of cardiologists who say it is clear. Do you have some references for the idea that fat is not relevant?

<comment><USER7> What do those cardiologists say? That fat in the blood (triglycerides) causes atherosclerosis? Or dietary fat? Very different things.

Regarding the mechanism of atheroma formation, I don't have a list of references handy, but maybe this is a good start: [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3152836/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3152836/)

Also of interest would be the role of high insulin and/or glucose and the damage they can cause to the arterial walls (inflammation is a necessary condition in the formation of atheroma).

<comment><USER32> The conventional wisdom: fat in the blood is the main thing to worry about (along with genetics) and that lifestyle factors have a big influence on that. So both, really.

Which part of that paper disputes the importance of fat?

</comment></comment></comment></comment></comment></comment><comment><USER33> So now we're including "survival of the unfittest" as part of evolutionary theory? Sorry, this makes zero sense. If humans really did evolve, then we hit the lottery - several times.

<comment><USER34> Fitness doesn't mean what you think it means. As others have noted on this post, this mutation confers some resistance to malaria.

When the options are "malaria with high probability from birth onwards" or "heart attack after multiple decades with high probability if nothing else kills you first", this _is_ fitness.

Besides which, if humans _didn't_ evolve, you need to explain why the creator didn't use a better mechanism to prevent us from getting malaria. For example: not creating malaria when they created us.

</comment></comment><comment><USER35> I like how the headlines explicitly states _humans_.

For yet another study in ... mice.

There are other options like dogs and pigs which are much better models for human biology, so if you really want to make a claim about subtle effects of human genetics you need to be as close to a human model as possible.

This is entirely ignoring the someone generous leap they make that one single gene mutation is responsible for an increased rate of heart disease. It also doesn't touch on what the benefits for that gene were (to spread through the gene pool completely it must have some benefit that outweighs the cost)

<comment><USER36> If this withstands scrutiny a chimpanzee study can't be far off, though.

<comment><USER37> Nah. Primate studies are too expensive, impractical and ethically difficult to justify. Think about the number of subjects you would need for statistical significance ...</comment></comment></comment>