Firms That Promised Ransomware Decryption Almost Always Just Pay the Hackers - jkao-propublica https://features.propublica.org/ransomware/ransomware-attack-data-recovery-firms-paying-hackers/ <comment> jkao-propublica Hey HN, I'm a reporter at the non-profit newsroom ProPublica. I used to be a software engineer in the Bay Area, but now I work primarily with data and code for news investigations.

We published a story today that found that a lot of the firms touting their ransomware decryption services actually end up paying the hackers (often behind the client's back) and then tacking on a fee.

Though you all would find it interesting. A great tidbit that my reporting partner Renee uncovered: a former deputy FBI director was paid to promote MonsterCloud, _while knowing_ that they paid bitcoin to cybercriminals.

He's also a former TSA director. So of course, he partnered with their CEO on a side biz to put massage chairs in airports. ¯\\_(ツ)_/¯

Anyway, thought this would be a story that HN would enjoy. Would love to hear y'all's thoughts since this is the community with the expertise & experience to comment. If you have things (ransomware or otherwise) you think we should look into, would love to hear as well. :-)

<comment><USER2> >a former deputy FBI director >He's also a former TSA director.

That narrows it down a bit. With a name like that you'd hope he was more of a straight shooter.

<comment><USER3> Well we're talking about the TSA here.

<comment><USER4> Thousands Standing Around, now with added massage chairs.

</comment></comment></comment></comment><comment><USER5> I feel this is actually a decent service for a few reasons:

\- Many average users don't want to understand cryptocurrencies, how to safely and securely buy and use it is a challenge in and of itself.

\- They're on the hook and the client pays nothing if the ransomer fails to provide a working key.

\- They'll also manage the ransom decryption software - if there's problems with it there are 3rd party tools that can often do a better job of decryption than the original decryption tool, again, this is something that's going to be complicated for average users to deal with.

\- For some ransomware there are decryption processes available without the need to pay the ransom, figuring out which of these applies can be challenging

\- Certain institutions may be unable or unwilling to work with the attacker directly - introducing a middle man to broker can help solve this.

Overall the piece seems somewhat hyperbolic.

<comment><USER6> Yeah, seems like a great service to a certain degree. But it's not the service they're selling and they're lying to their customers. Their service incentivizes ransomware authors, so this absolutely needs transparency. I assume most people go to them because they want the problem solved but they feel they shouldn't be paying the hostage takers. "we don't negotiate with terrorists" comes to mind. So if this service is doing exactly this and making the situation worse for everybody else, this is something that needs to be consciously weighed off and decided by the people considering their services.

<comment><USER7> I wonder how many of these "white hat middlemen" are also the ransomware owners...

Obviously the two companies collaborating would give benefits to eachother, and it might just be a convenient way to seperate the illegal from the legal...

<comment><USER8> This was my first thought as well. What's the biggest risk when you're paying the ransom? That the thief will run off with the bitcoin without providing the key. The easiest way to mitigate that risk is to either collaborate with the thieves or become the thieves.

</comment></comment></comment></comment><comment><USER9> I'd never heard of this historical precedent:

> The father of ransomware was Harvard-educated anthropologist Joseph L. Popp > Jr. While researching the theory that AIDS originated in green monkeys in > East Africa, Popp in 1989 mailed more than 20,000 floppy disks about AIDS > education to people interested in public health. When recipients ran the > disk, their computers froze, and a message on the screen instructed them to > send up to $378 to a post office box in Panama for a second disk that would > restore their access.

<comment> john-radio Holy crap, that message:

> ATTENTION I have been elected to inform you that throughout your process of > collecting and executing files, you have accdientally ¶HÜ¢KΣ► yourself over: > again, that's PHUCKED yourself over. No, it cannot be; YES, it CAN be, a > √ìτûs has infected your system. Now what do you have to say about that? > HAHAHAHAHA. Have ¶HÜÑ with this one and remember, there is NO cure for AIDS.

<comment><USER10> This isn't the AIDS malware in question. You are looking for Aids Info Disk/PC Cyborg Trojan.

</comment></comment></comment><comment><USER11> > Although bitcoin transactions are intended to be anonymous and difficult to > track, ProPublica was able to trace four of the payments.

I didn't think Bitcoin transactions were intended to be anonymous and difficult to track, why would Bitcoin use a public ledger if that was the intention? I was under the impression other cryptocurrencies are trying to solve for "anonymous and difficult to track."

<comment><USER12> The term is pseudonymous - the list of all transactions is available for anyone to look at but in theory you can't link bitcoin addresses to people.

However, in practice, most people buy bitcoins via a method that requires ID, which links their ID to one of their addresses. Multiple addresses can then be linked together by cluster analysis based on usage patterns

</comment></comment><comment> paid-themselves So...

How do we know that they (MonsterCloud) weren't _also_ the criminals on the other side of the bitcoin transaction?

Is it possible this was all a giant payola/extortion ring?

I mean, the criminals were just _that_ reliable, organized and scrupulous about unlocking their victims?

<comment> yoz-y If it became known that ransomware criminals never actually decrypt your data they would lose their "business", so it is in their interest to actually do it.

It certainly is not impossible that the decrypting company would be so scummy but it is in the same vein as accusing a home security company financing burglars to go on rampage.

<comment><USER13> > If it became known that ransomware criminals never actually decrypt your > data they would lose their "business", so it is in their interest to > actually do it.

This opens up one of those weird moral dilemmas akin to asking whether it's moral to hack someone's exposed device to patch a security hole: Would it actually be a net positive to create a ransomware variant that had no decryption key, but acted like it did?

<comment><USER5> There've been a few cases where the ransomware was not decryptable - <AUTHOR> like BleepingComputer frequently discuss which ransomware have been cracked by researchers, which are currently actively run and will provide keys and which are undecryptable and you shouldn't pay in any circumstances. Basically it just makes things more complicated, but people are still willing to pay if they can in their specific case and the one they're infected with is reported as regularly providing good keys.

</comment></comment></comment></comment><comment><USER14> quote 1 : "The reason we have such a high recovery rate is that we know who these attackers are and their typical methods of operation," he said. "Those victims of attacks should never make contact themselves and pay the ransom because they don't know who they are dealing with."

quote 2: " It stopped dealing with the SamSam hackers after the U.S. government identified them as Iranian and took action against them, he said. Until then, he said, the company did not know they were affiliated with Iran. "

There you have it, the way of the managers, lie lie and more lies, as long as $$$ can be made.

<comment><USER14> Also this. Quote: "Witherspoon was especially impressed by his primary contact at MonsterCloud, Zack Green. "Zack's title, dear God, it's a mile long title. He seems to know a lot." Green's titles on his email signature include "Ransomware Recovery Expert," "Cyber Counterterrorism Expert," "Cyber Crime Prevention Expert" and "Cyber Intelligence Threat Specialist." We called MonsterCloud asking for Green but were told he was in a meeting."

In my experience on dealing with US managers, the longer the titles they have, the dumber the person is.

<comment><USER15> Sounds more like a bullshit artist than an idiot.. otherwise they wouldn't be getting enough jobs to stay a profitable enterprise.

</comment></comment></comment><comment><USER16> I guess the only surprising part to me was paying behind the clients back and charging a little more.

Because on the surface, of course you pay the ransom! I specifically selected insurance that stated up front they would pay a ransom if they had to. I think this has to be fairly common knowledge outside of infosec.

Perhaps some CTO/CIO/CFO types would rather the peace of mind or the idea that they aren't helping these ransom-entrepreneurs out by paying them.

</comment><comment><USER17> MonsterCloud quote: "Our goal is to restore the data and help the customer. If we need to walk to the moon on broken glass, we will. We don't care how, what, where, whatever. Our goal is to get the data out." Sounds like if they don't care how, paying the criminals is a viable option for them.

</comment><comment><USER18> I love propublica and donate monthly. Good to see it getting some great tech coverage. Thanks for your reporting!

<comment><USER19> Thanks for the reminder to donate, they really do fine work. AC Thompson is an acquaintance and his coverage of fringe extremists is thorough and anxiety inducing, but his investigations have led to bad guys going to jail many times over.

</comment></comment><comment><USER20> Buying discounted receivables is one of the oldest businesses around. That it happens to be for a criminal ransomware organization is new.

The instinct to contact ransomers and say, "hey, I see you have some uncertainty in how much money you are going to collect. Do you want a guaranteed amount now, or a risk adjusted figure later? If now, I can offer you $x for a key I can use on as many customers as I can..."

Ethics aside, that's really impressive deal making.

</comment><comment><USER21> Let's be honest. There's only one way this ends. You have vigilante ransomware dudes who promise to decrypt the ransomed stuff and then abscond with the money. Poison the well and people will just assume they've lost the data.

<comment><USER22> That actually would probably work... especially if the vigilantes masqueraded as the "genuine" hackers convincingly. Then you (or the companies covered in TFA) would just have no way of knowing whether there is any chance of recovering the data for real.

As the probability of recovery goes down, the likelihood of being willing to pay the ransom also goes down.

Though in a way this feels a bit like going around _actually shooting_ people in order to "poison the well" for a group that goes around _threatening to shoot_ people, but not actually shooting them if they pay up.

<comment><USER23> Yes, and also with the guys not actually shooting if you pay working hard on establishing a brand everyone can "trust". They could for instance sign their releases of malware so it couldn't easily be spoofed by the proposed vigilantes.

</comment></comment></comment><comment><USER24> Why am I not surprised?

They just provide plausible deniability to clients, who may not be able to pay the ransom for legal reasons.

<comment><USER25> Or their clients are naive I don't recognize that they're being charged more to "decrypt" than the cost of the ransom, or (plausibly) the client is intentionally not paying the ransom because they (incorrectly) believe it means they aren't giving money to criminals.

<comment><USER26> Or they maintain back channels to the groups and negotiate discounted rates on the basis of reliability of pay outs.

<comment><USER25> I was actually wondering about that - or alternatively ye olde protection racket type thing: they being the original authors of the attack.

Of course it's much more plausible that they're just scumbags looking to make an "honest" profit of a criminal act.

<comment><USER27> We aren't being presented any evidence that they are playing both sides of the table that brazenly. However, I can't see a situation where if the firm were in a position to stop the ransomware globally that they would actually do so.

Maybe an altruistic individual within the company, but not as a directed managerial effort.

<comment><USER28> I believe they would because the press will be worth it for future business. Not all ransomware but certain strains.

<comment><USER27> If they are a UK company with a prominent young leader it seems just as likely to get you investigated or indicted.

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> As much as I want to appreciate this story, it's lines like this that reflect poorly on it's authenticity:

> In a video posted online touting MonsterCloud's services, Pinhasi wears a > dark suit and tie and rimless glasses. At lunch, the 43-year-old sported a > white long-sleeve T-shirt emblazoned with the logo of teen retailer > Abercrombie & Fitch.

<comment><USER30> why?

<comment><USER29> It is a clear ad hominem attack on Pinhasi. It adds nothing to the story, especially without context. This piece masquerades as a serious discussion about the ethics of ransomware services but goes out of it's way to equate their personal habits with that of their business.

</comment></comment></comment><comment><USER31> Outsourcing the "we don't negotiate with terrorists" problem...

</comment><comment><USER32> Unless you've got tools on the level of what the CIA or NSA has, you're probably not cracking the encryption, but I agree it's bad to mislead your clients (and also creates some conflict of interest concerns). It kind of reminds me of when a family member is having computer problems and asks me to fix things. They think I have some sort of deep knowledge of how the computer works and can pinpoint their exact problem to fix it, when in reality I just back up their files and reinstall windows without really knowing why things were messed up.

</comment><comment><USER33> This must be a result of pure ignorance of the victims.

As far as I understand, ransomware simply applies RSA on the victim's data. If the victims understood what that meant, they would understand that it is entirely unrecoverable. The data is simply gone without the private key.

If the data were recoverable that would mean RSA had been broken, and the entire world would know about that. Normal people would understand because the global financial system would need to stop entirely while they switched to a new algorithm.

<comment><USER34> There are implementation details that could make the data recoverable even when RSA is used. The data itself is typically encrypted using a symmetric cipher (e.g. AES) and the key used for it would be encrypted using RSA. However, if the key for the symmetric algorithm was generated in a predictable way (e.g. using a pseudo-RNG initialized from the system time), it could be possible to bruteforce it in reasonable time.

</comment></comment><comment><USER35> Sortof Off Topic: If your data is important, back it up to something that automation, daemons and users can't tamper with. i.e. Immutable after ${n} minutes or hours. Replicate that data to multiple places and ensure it is also immutable in that location. I think everyone knows this, but make excuses not to do it. i.e. cost, laziness, indifference, risk takers, etc.

</comment><comment><USER36> Don't the hackers almost always just take you money and demand more without actually decrypting anything?

<comment><USER37> No, that is counter to their making money. The way to make money through ransoming something on a regular basis is to always ensure you follow through.

There are actual cases in history of ransomers attacking fellow ransomers who _don 't_ follow through for hurting the shared business model.

<comment><USER38> I think that time has passed. I've heard of too many cases of "ransomware" that just wipes your disks and asks for money that I wouldn't pay up.

"True" ransomware requires a key management infrastructure with a capacity for delivering a service. Setting up a bitcoin recipient takes next to no resources. If you were criminally minded, what would you do?

It would harm the ransomware-maker's reputation? Just pick a new name every week.

<comment><USER39> At least one ransomware program gives you the option to pick one file to decrypt for free, to prove that the files can be recovered.

<comment><USER38> Fine, I won't really delete the files, but move them all into a hidden ZIP file. When the user picks the one file to rescue, the code will pull that file out then delete the ZIP. You've got an hour to make your choice before the ZIP gets deleted anyway.

Remember, ransomware-makers aren't providing a service anyone wants. They have inserted themselves into the system and only care about getting their victim's money.

</comment></comment></comment></comment></comment><comment><USER40> Of course they pay them, who actually believes these firms are capable of breaking the encryption? This is digital hostage taking, you pay the hostage takers, you don't try and fight them.

</comment><comment><USER41> I think there's a case to be made for making ransom payments illegal. Allowing such payments only encourages the development of newer, more sophisticated ransomware.

</comment><comment><USER42> There needs to be more accountability for Bitcoin, solve btc and you solve a lot of these hacks...

<comment><USER25> The lack of accountability in btc is considered a feature. The fact that funds can be tracked at all is considered a bug, hence monero and zerocoin etc.

<comment><USER43> Not just a feature, it's the reason for bitcoins existence.

<comment><USER44> One of maaaaany.

</comment></comment></comment></comment><comment><USER45> Is this legal?

<comment><USER46> K&R insurance is legal, so why not?

<comment><USER47> K&R == kidnap & ransom</comment></comment></comment>


Ask HN: My fb fan page has over 700k likes, what should I do with it? - <AUTHOR>

It's been pretty inactive for 2 years.  What would you do with it?  Anyone know what's within fb guidelines re: advertising, etc? <comment><USER2> I'd love to talk about monetizing it. Link or email me firstname.lastname@example.com? I know a few people that have been able to do this in the page.

</comment><comment><USER3> Ask users to like facebook.com/CortopassiConsulting. What? You asked what _I_ would do with it :p

Seriously though, that's a pretty big captive audience. Do you have any product to promote? Are they fairly engaged? I myself would love to know how you got to that number.

</comment><comment><USER4> First of all you have to tell us what kind of public you have.

</comment><comment><USER5> How did you get so many?

</comment><comment><USER6> Link to fan page?</comment>


Things I learned about systemd - <AUTHOR> https://nelsonslog.wordpress.com/2016/04/30/things-i-learned-about-systemd/ <comment><USER2> The discussion was already made a thousand times about pratically all the points, from why there is no issue to udev being an external project and not supporting exclusively systemd (with an additional "fuck you gentoo developers" in the ML), to extreme appetite to fagocitate everything as fast as humanly possible, to pretty big bugs ("oh sorry, journald is not fast enough to write your gigabyte-sized core dump, let me cut it in half using this constant I randomly decided was good enough!" left alone for _years_ ) and to all the problems of the design of systemd [1]. Maybe it is my impression, but this blog post cheapens it - a lot.

Sure, it was pushed hard by RH (inspired by Sun's SMF), it had some (quick) wins, it solved (some) issues for distro mantainers - though they have to remember to patch some components to not use defaults that make no sense, like google NTP servers - and the DEs jumped on it because it simplified mantaining their code (making them not portable in the process, but who cares!). It seems it "won"... Like HAL did win, a lot of time ago, in a similar way (IIRC).

We'll see. It's not that heavily deployed in production yet.

[1] [http://blog.darknedgy.net/technology/2015/10/11/0/](http://blog.darknedgy.net/technology/2015/10/11/0/)</comment>


Weekly publication an answer for newspapers? - <AUTHOR> http://www.guardian.co.uk/technology/2009/apr/08/not-safe-for-work-newspapers

<comment><AUTHOR> (I submitted this story). Much as I don't like the tone of the piece, I think the point about the traditional media focusing on competing on accuracy and not speed is valid. The question in my mind is, is there a large audience for slow, albeit thoughtful and accurate, journalism?

<comment><USER3> I hear a lot of people pointing to the Economist as the example of what newspapers should do. That's fine, I agree that would be a good thing.

But please don't point to Newsweek. The traditional U.S. news-weekly is dying almost as quickly as metro newspapers.

What's the difference between Newsweek and the Economist?

Point of view and voice. That's really what this is about. The Economist has a point of view and takes sides on the issues it covers. It will always side with open markets and capitalism. That's its POV.

What does Newsweek stand for? U.S. News and World Report? Time?

So yes, weekly could be a good approach, but really, the problem is a lack of voice and POV.

Also, I used to buy the line that while the big dailies were struggling, the weekly neighborhood papers in U.S. cities were doing ok. That's been said by a lot of people with access to good data.

And yet here in Chicago the family-owned business that published 5 weekly neighborhood papers recently folded one and sold off two for a song to a husband-wife business that's turning them into newsletters. So there's some struggling going on there, too.

<comment><AUTHOR> The local paper is a serious, though different problem. I read a very touching article last week about the collapse of the local press in the UK, with old people quoted as saying there was no newspaper left to publish their obituary in.

Back to monetising serious journalism in the national (or even international this day) press - I have a different view of the problem, which is I _want_ to pay money but the sites are not asking for it. Rather than subscribe to a single paper, what I want is to make a micro-payment for an article that I read that interested me. For example that long piece on Dubai that was posted here a few days ago, or the piece on newspaper ownnership posted today - <USER2> were from newspapers that I do not regularly read or visit. I read the articles, I enjoyed them, they were long serious pieces of work and I would have pressed in an instant a button that said "If you liked this story click here to donate $0.10" in order to reward the person who paid the journalist to write the story. In fact I am many, _many_ times more likely to give 10 cents that to click (or even notice) an advertisement on the same page.

The search engine and other type of aggregators (such as HN type sites) then become a clear boon to the primary content provider because they are not diluting page views or anything like that - they are just delivering a potential paying customer straight to something they are likely to pay for.

Why is nobody asking me for my money?

</comment></comment></comment><comment><USER4> 1) For newspapers, the paid model doesn't work - [http://www.niemanlab.org/2009/04/paying-for-online-news- sorr...](http://www.niemanlab.org/2009/04/paying-for-online-news-sorry-but- the-math-just-doesnt-work/) [http://opinionator.blogs.nytimes.com/2009/02/06/micropayment...](http://opinionator.blogs.nytimes.com/2009/02/06/micropayments- not/) The basic idea is that people will find the news for free. Newspapers can wall the content behind subscriptions all they want, but that will only result in bloggers/aggregators getting subscriptions, rewording and summarising the articles and posting them on their own sites without any attribution whatsoever. The WSJ is the perfect example - their subscriptions are going down primarily because readers are getting the same news from other sources, who are most probably rehashing the WSJ after getting a subscription. Entire teams will spring up EXPRESSLY to make sure they dodge copyright infringements. It can't be stopped.

2) The quality vs speed argument doesn't work either. "The blogs have speed, you have quality and, given what they've had to put up with all week, that's something your readers will be more than willing to pay for" - that's a monstrously large assumption. If anything, it's becoming more and more evident that people care a lot more about getting bite sized 'gists' of breaking stories rather than in-depth page long columns. True, there are a small chunk of people who would be willing to pay for this but it's most certainly nowhere near the number it would take for the papers to earn as much as they make today. The perfect example is the Economist - it's profitable BECAUSE of it's small size. The NYTimes is simply too big to follow their model, since they would need multiple magnitudes of order higher in the number of subscribers to turn the same rate of profit. If the NYTimes is willing to cut down to the size of the Economist, then they MAY make a profit.

3) Weekly news updates - if the questions is whether newspapers should adopt a subscription policy, I don't see why they can't stay as dailies. The speed at which they publish currently doesn't really sacrifice their accuracy all that much.

When it comes to monetization, webapps like xobni and basecamp can charge monthly subscriptions. But news outlets can't. If they have news that's exclusive, then yes, they can charge monthly fees. But with the evolution of the internet as it is, nothing stays exclusive for more than 14 seconds. It'd be far better for them to stay open and enable other sites to send them free traffic. This way, they can focus their energies towards making ad revenue from the increase in traffic.

The equation is simple: more traffic = more revenue. The problem right now is they don't have enough traffic. They could be doing MUCH better. The question is - how?

I propose a 'Site Network' solution. Brands like Techcrunch and Gawker have proven that a NETWORK of sites, alongwith a dedicated effort to push the headlines in front of readers (via search engines, social media etc) is the way to raise ad revenue. I have always wondered why the NYTimes would be boneheaded enough to publish everything on ONE site. Any succcessful site (success here measured in terms of ad profit) will show you that content belongs in its own niche.

Here's an experiment, step by step -

1) the NYTimes breaks into 100 sites (or blogs), each with a specific name and topic, from tech startups to cooking to sports etc. Journalists will now see their articles on their respective sites. For example, the freakonomics section on NYTimes will now be a website called freakonomics.com. (All the individual sites will carry a NYTimes 'brand')

2) Instead of all articles being published on subsections within ONE site (like they are now), the same exact news is published across 100 different sites, in their respective niches. For example, freakonomics articles will be published on freakonomics.com instead of <http://freakonomics.blogs.nytimes.com/> . The news is the same - it's just the format that changes.

3) Dedicated SEO/SMO teams whose sole job is to constantly drive eyeballs to these 100 sites. The key is assigning teams PER site whose sole job is the growth of that individual site - ranking in google SERPs, maintaining popular twitter/facebook profiles, getting readers to blog, reblog, tweet, retweet and ultimately direct traffic to the site.

4) The individual sites will serve as cross-promoters to each other and serve a symbiotic network.

5) The NYTimes homepage can host the stories urgent enough to be on the homepage, but more importantly, it'll serve as the portal which directs viewers to these 100 sites.

6) At the same time, strict guidelines on what is acceptable for 'quoted content' should be established, followed and enforced.

7) Monetize the increase in traffic.

The fundamental problem with subscriptions is this - people won't pay. Correction, not ENOUGH people will pay. The idea of walling off content so that people will be forced to pay is a fallacy. This will only fuel the free sites' drive to replace the newspapers by ripping off those very same newspapers. I dread that day.

P.S. I mentioned this idea to Paul on his blog and he raised a concern - "I guess my main worry would be that by creating sites so explicitly to allow SEO, the balance between editorial and advertising (which is to say journalists being encouraged to write about certain topics, or use keywords) could be slowly eroded." My contention is that as long as a newspaper's current policy of separating journalists from the website is continued, there's no problem. As of now, besides submitting their articles, journalists have no input on the site's look, feel, ads, links, fonts etc. The new sites will simply continue this this policy. Journalists would write and submit their articles and from there onwards, it's the job of the 'online teams' to publish and push the headlines in front of as many people as possible. Finally, it's the job of the editor to make sure that the qualities of investigative journalism aren't compromised for ad dollars.

Whew! That was a mouthful.</comment>


Using Mechanical Turk to hide a surgeon's domestic violence charge - <AUTHOR> https://twitter.com/swodinsky/status/1143583269730082816 <comment><USER2> It's just "blackhat" SEO. Reminds me of a scheme in China where a company sold fake medicines and astro-turfed their way into appearing as a major supplier. So long as our view of the internet is governed by opaque algorithms with no oversight, gaming them will be profitable.

<comment><USER3> And if they weren't opaque, gaming them would be even easier.

<comment><USER4> Security by obscurity ain't security, though. If they weren't opaque, at least we as a society would be better equipped to keep up with the algorithmic exploitation arms race.

<comment><USER5> I think, unfortunately, that is naive. While security through obscurity ain't security, there is something to be said for obfuscation of a system that people are trying to game.

<comment><USER4> That's the point, though: if a system is so fragile that anyone with knowledge of its inner workings can game it or otherwise exploit it, then it is not and was never secure (nor can it ever be while it continues to be opaque).

I say this enough to be a broken record, but transparency is a dependency of trust.

<comment><USER5> This isn't a trusted system though. The data it consumes and indexes, the people who use it, etc. are not trusted.

You are effectively saying poker would be better if everyone's cards were face up.

<comment><USER4> > This isn't a trusted system though.

Well yeah, obviously, given that it ain't transparent.

> You are effectively saying poker would be better if everyone's cards were > face up.

You are effectively saying that an ideal system is one that we'd have to treat like a poker game.

Even assuming the premise here holds true (that a transparent system will be more easily gamed by more people), that'd ultimately be better than the opaque case. The more people who are able to game a system, the less one individual can effectively game it for one's own individual benefit at the expense of everyone else in that system.

<comment><USER5> I thought of a better way to express this that might make sense to you.

In security, total transparency isn't effective. You want as much transparency as possible, but you need secrets for the system to work (usually passwords/certs/passphrases).

Now, there isn't a password/certs/passphrase in this context, so the secrecy is instead in the model.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Title is incorrect. This is not on Mechanical Turk. Tasks like this are not allowed on MTurk as per TOS. The original tweet author says so on the thread.

<comment><USER7> I didn't read it as being part of MTurk. "Mechanical turk" was a thing for hundreds of years before Amazon named it's service.

<comment><USER8> > "Mechanical turk" was a thing for hundreds of years before Amazon named it's > service.

In the context of crowdsourced labor, it absolutely implies Amazon.

</comment></comment></comment><comment><USER9> That will be insanely effective.

Doing that just ~10 times (with independant users/profiles) will probably eliminate those results when the ML model is next trained. Assuming this Dr isn't a celebrity, he probably doesn't get more than a few searches per month, so 10 in the same day will be a massive signal.

Note to person behind this: It will have even more impact if each turker is instructed to click _only one_ of the desired links. Clicking "back" to a google search result is a strong signal that the page you clicked didn't answer your query.

</comment><comment><USER10> Does this really work? I would assume Google would detect this repeated pattern pretty easily.

<comment><AUTHOR> I think so, at least to some degree. Someone's certainly bet money on the theory that it works.

When I first saw this tweet, a search for "Dr. Paul Drago" (in an incognito window) consistently returned a glowing blog post first and the domestic violence article second. Hours later, those results are consistently reversed. Could be random, could be that people who saw this tweet are intentionally clicking the news article he's trying to bury.

<comment><USER11> or could be google took manual action

</comment></comment></comment><comment><USER12> [https://www.greenvilleonline.com/story/news/crime/2018/11/26...](https://www.greenvilleonline.com/story/news/crime/2018/11/26/greenville- physician-charged-domestic-violence/74809748/)

Should a person be banned from working because they physically assaulted someone. Seems to be that lots of people think so, despite that fact that many more people than are convicted commit these sorts of crimes. Didn't take much more than to type the name into Google News and click on the link on the page.

<comment><USER13> If you click the second image:

\- "Accused doctor wasn't certified in plastic surgery"[0]

\- "11 women say plastic surgeon botched jobs"[1]

\- "Plastic surgeon - Paul Drago - Plastic surgery from hell"[2]

I'd say the accusations here are more than just DV.

[0] [https://www.wcnc.com/article/news/local/accused-doctor- wasnt...](https://www.wcnc.com/article/news/local/accused-doctor-wasnt- certified-in-plastic-surgery/374891066)

[1] [https://www.courthousenews.com/11-women-say-plastic- surgeon-...](https://www.courthousenews.com/11-women-say-plastic-surgeon- botched-jobs/)

[2] [https://www.lipstickalley.com/threads/plastic-surgeon- paul-d...](https://www.lipstickalley.com/threads/plastic-surgeon-paul-drago- plastic-surgery-from-hell.177514/)

<comment><USER14> > _11 women say plastic surgeon botched jobs_

If I told you that the 3M Company had 2192 lawsuits[1] of all types filed against them in the the last 4 years, what does that tell you? Are they a terrible company getting sued at lot or a incredibly nice company that barely ever gets sued for a company that large?

Plastic surgeons are among the most sued professions. To know whether 11 lawsuits are significant, you'd have to know the rate at which plastic surgeons are sued, how many surgeries this guy did, what period those 11 surgeries represent, and possibly even weight it with the difficulty of the surgeries (because if he's taking on high risk surgeries that other doctors decline, he'll have more failures). _Maybe_ 11 lawsuits in a 4-year period is an excellent track record for someone doing thousands of high-risk surgeries in an ultra-litigious medical specialty.

[1] Completely made up that number.

<comment><USER13> The first link says the North Carolina Medical Board just pulled his license. And a "nationally recognized and board certified plastic surgeon" said the doctor had no training to perform plastic surgery (only general surgery as all doctors receive).

So I'm not sure why you're trying to make some artificial point in isolation about lawsuits being meaningless, other doctors clearly think badly of his practice of medicine, to the point that they've stopped him doing so.

</comment></comment></comment></comment><comment><USER15> In the past, Google claimed to not use clickstream data because of how easy it is to manipulate. Have they changed their tune or are they just targeting Bing?

</comment><comment><USER16> It's probably worth noting this guy has a very unique name, therefore negative news stories about him are much more likely to go to the front page of results, since few other people with the same name would get any publicity.

</comment><comment><USER17> It seems to have worked. Googling the Dr. Paul Drago doesn't show any of these articles unless you use keywords mentioned in the Do-Not-Click titles.

I made sure to click on them.

<comment><USER18> I did it a few times. When I google Dr. Paul Drago. I do seem some of the articles. That may be because I've click a few of the links and have done the search a few times. Also The [https://www.lipstickalley.com/threads/plastic- surgeon-paul-d...](https://www.lipstickalley.com/threads/plastic-surgeon-paul- drago-plastic-surgery-from-hell.177514/) link also appears on the second page now.

</comment></comment><comment><USER19> whats the point of doing this if a simple record check could reveal his court records?(assuming these charges are real)

<comment><USER20> Is that something you usually do when picking a new Dr.?

<comment><USER21> Honest question: how should someone's domestic violence charge affect your choice of surgeon?

<comment><USER22> Are you kidding? Someone who can't control their anger isn't someone you want poking around your insides with a scalpel. If such a person makes an error during an operation, do you really think they'll be transparent about it?

<comment><USER21> > Someone who can't control their anger isn't someone you want poking around > your insides with a scalpel.

If the surgeon is prone to violence fits as you claim he might be, wouldn't it show on his track record as a surgeon?

</comment></comment></comment></comment></comment><comment><USER23> am I the only one who searched for dr paul drago and clicked on the greenville doctor article to redress the balance?

</comment><comment><USER24> Is this astroturfing? I thought the term referred to fake grass roots movements (Astro Turf being the brand name for that fake grass you sometimes see).

As a previous commenter said, this is more like grey/blackhat SEO.

<comment><USER25> No, the term predates fake grass roots movements. It comes from using fake grass to cover up an ugly yard.

So creating fake or useless media attention to distract or cover up something you don't want people to see.

<comment><USER26> Googling around I can't find anything that agrees with this but I see an overwhelming number of sites referring to the origin as related to the grass roots meaning with the popular origin from Lloyd Bentsen in 1985.

Not that it couldn't have just been overrun since that time I just couldn't find anything to support your claim.

</comment></comment></comment><comment><USER27> I, for one, welcome our new Machine Learning Overlords.

<comment><USER28> Mechanical turk is the opposite of machine learning

<comment><USER29> Here, though, it's being used to provide fake signals to a true machine- learning algorithm – Google's clicktrail-influenced ranking. So more of a 'complement' than an 'opposite'.

</comment></comment></comment><comment><USER30> Um, the fact that his medical license has already been suspended by one state is much more problematic than his domestic violence charge, thanks.

Let's be outraged about the correct problem, please ...

<comment><USER31> I'm not outraged about the specifics, i'm intrigued about the astroturfing. If this worked, it could and probably is being applied to all kinds of things...</comment></comment>


London-Based Dribble Launches Daily Fantasy Soccer App - <AUTHOR> http://techcrunch.com/2016/02/23/dribble <comment><USER2> One of the founders here! Excited to have Dribble exclusively launch today TechCrunch. Let me know if any questions or feedback on the product.

Exciting to see Daily fantasy football start to grab traction in the UK. Great thing is...it's 100% legal.</comment>


Reflecting on Susan Fowler's Reflections - <AUTHOR> https://medium.com/@hadrad1000/reflecting-on-susan-fowlers-reflections-e2dccb374b47#.iiun8cyer <comment><USER2> I have a lot of mixed feelings about this. I think sexism is a problem. I think Uber probably is much worse. I like that she discussed this. I recognize this as a problem generally, but I don't understand the:

We thought it was hilarious and joked about it for weeks.

This was disgusting.

Obviously, it was super unprofessional, careless and stupid of a manager to hang out and drink w/ under aged interns. Given she wasn't an employee and it was mostly verbal harassment, I think it was sloppy and rude. However, getting hammered is sloppy.

I guess on balance, I have a higher tolerance for this stuff in society but I can _understand_ the author's points as she is much more reasonable than most. Fowler as well.

The only thing I can't grep is retroactively doing a 180 on the sentiment of an event. Sure, maybe after a short period, like that manager probably did when he woke up thinking wtf have I done. But it doesn't sound particularly vile or threatening if it was a joke for everyone involved.

Either way, Uber has some culture issues. Tech does as well, and Uber sounds like a tough place to be a femsle

<comment><USER3> He was older and in a position of power. She was young and an intern. What initially seemed funny changed after some time because she got older and got some context and understood why it was inappropriate and unacceptable. The manager that overheard the jokes understood the context and what could have happened, which is what a manager should do.

Is it really so surprising that someone can over time process an event and see it for what it actually was, rather than how they first reacted to it?

</comment></comment><comment><USER4> The most damning part of Fowler's statement is how unlike her experience is to that of the author:

1\. The sexual incident was verbally communicated, took place off site and after hours versus using corporate communication at work during work hours.

2\. The corporate standards for behavior were higher and independent of what a particular woman might or might not find out of line.

3\. Human resources uncovered and acted upon the violation of behavioral standards without the women filing a complaint.</comment>


Saving the manuals: It is Done - <AUTHOR> http://ascii.textfiles.com/archives/04728

<comment><USER2> This really is a heart-warming story. It would have been tragic for all of that information to have been discarded, some of it potentially lost forever. Now, at least this stuff has a fighting chance.

If, by some chance, it ultimately turns out that all this stuff can be digitized and placed online, that would be an incredible accomplishment. I'll be keeping my fingers crossed.

</comment><comment><AUTHOR> Submitted here first, but it died on the New queue before getting, I felt, a fair chance: [https://news.ycombinator.com/item?id=10097296](https://news.ycombinator.com/item?id=10097296)

dang, feel free to transfer my karma from this submission over to kryptiskt.</comment>


Square COO Keith Rabois Departs Company - <AUTHOR> http://allthingsd.com/20130124/square-coo-keith-rabois-departs-company/

<comment><USER2> already discussed here if you want : <http://news.ycombinator.com/item?id=5114314></comment>


Caching and Processing 2TB Mozilla Crash Reports in memory with Hazelcast - <AUTHOR> http://highscalability.com/blog/2011/4/12/caching-and-processing-2tb-mozilla-crash-reports-in-memory-w.html <comment><USER2> > Mozilla processes TB's of Firefox crash reports daily

Why? Likely because most of them are duplicates? Could they not be a little bit more clever about it and do something like generate a "signature" for each crash report and compare it against the server and only submit unique ones?

Or are they really getting TBs worth of unique crashes everyday? In that case sounds like they have a bigger problem.</comment>


3 In 10 Americans Will Not Knowingly Buy Chinese-Owned Brands - <AUTHOR> https://www.hdtradeservices.com/blog/Three+In+10+Americans+Will+Not+Knowingly+Buy+Chinese+Brands

<comment><USER2> 3 In 10 Americans _claim_ they Will Not Knowingly Buy Chinese-Owned Brands

I suspect the reality is wildly different to the survey result - after all, "made in China" is hardly a secret.

<comment><USER3> There's a difference between a Chinese-owned brand and a Chinese-made product.

I think most Americans are fine buying Chinese-made goods but Chinese brands are seen as being of inferior quality.

<comment><USER4> As if Chinese made goods are not perceived as inferior. Claims are just claims after all.

<comment><USER5> In China, Chinese brands are considered inferior to western ones, even if everything is made here. They compete on price alone mostly.

</comment></comment></comment></comment><comment><USER6> I sort of avoid food from China. Oddly, chemicals from China are ok, but I rationalize because they're in milligram quantities, so impurities are also relatively small, and they get GC/MS'd.

I also avoid software/security products from China and Chinese-controlled entities. To some extent, I'd like to include hardware, but that's essentially impossible. I avoid Huawei and ZTE at least, but I still buy Apple, Lenovo, etc.

I would probably not trust security software written by a Chinese citizen in the US who had extensive ongoing personal/family connections to China. I would use a game, and probably general purpose stuff. It makes me sad that this position is justified by the threat environment. I tend to feel the same way about most of Eastern Europe/Russia, too, although perhaps less acutely.

The horrible thing about all of this is that Chinese and fUSSR developers are some of the smartest/best in the world.

<comment><USER7>
        It makes me sad that this position is justified by the threat environment.

No it is not. It is a reactionary position. Unless you have some evidence to back up your behaviours, you are just being paranoid.

</comment></comment><comment><USER8> There are some things I will not buy if they're made in some countries, of which China is just one. There are other things that I don't care where in the world they were produced.

There's a definite relationship between the length of time I expect to own or use a product, the country's reputation for products of that type, and which of the two categories it falls in.

<comment><USER9> _> There's a definite relationship between the length of time I expect to own or use a product, the country's reputation for products of that type, and which of the two categories it falls in._

Same.

How I intend to use (entertainment vs work) the product and the implications of its failure (annoyance vs injury) factor as well.

</comment></comment><comment><USER10> "Knowingly" seems to be the key word here: if you surveyed most Americans (or consumers elsewhere, for that matter) on how many of them know the country of origin for most brands, the results would be very hit or miss. I don't think too many people realize or remember that Samsung is Korean, nor that Nokia is Finnish. And to a concrete example of a Chinese company, I think hardly anyone knows Lenovo's origins.

The article even points out as much: in many cases, the Chinese brands go out of their way to do nothing that would reveal themselves to be Chinese brands. And by the time the brand is successful in a country, I'd suspect that brand's origin will matter very little.

<comment><USER11> Yes, but is this really relevant? You can't actively do or not do something at all unless you do so "knowingly." Of course it's an important part of the question, but even there it's redundant, and belaboring it seems pointless.

</comment></comment><comment><USER12> Yeah, but... actually export products already have much better quality control than domestic-oriented products we ordinary chinese consume everyday, except our great leaders who have special farms around the countries producing organic "特供品"s for them) , We envy you Americans!

At the outskirt of my city there's a special farming zone producing high quality vegetables for Japan, I always wonder what dose that taste like, must be very delicious.

There're many merchants/stores here selling defective items (B品/外單) western companies rejected. It's very popular among young people, especially clothes.

</comment><comment><USER13> Ownership doesn't bother me as much as quality control. Cheap stuff often compromises quality regardless of source. As much as possible I try not to buy food sourced from outside Australia or New Zealand as I don't trust the regulatory environments elsewhere and don't want to be eating European mystery meat or Chinese melamine. I don't really care about source so much if it is a phone or tv.

</comment><comment><USER14> A journalist tried to go for a year without buying anything from China. It was challenging.

 _A Year Without "Made in China": One Family's True Life Adventure in the Global Economy_

[http://www.amazon.com/Year-Without-Made-China- Adventure/dp/0...](http://www.amazon.com/Year-Without-Made-China- Adventure/dp/0470379200/)

</comment><comment><USER15> Given the US's annual trade deficit with China is more than a quarter of a trillion dollars and growing every year by some $20 billion (i.e. an extra month's worth of trade balance per annum), surveys of this kind are not worth the pixels they are printed on.

</comment><comment><USER16> One day at home we played a game where we all reached for some random thing within arms reach and I think it was 8 out of 10 had 'Made in China' on them somewhere.

</comment><comment><USER17> I guess it's a good thing for them that's almost entirely impossible then...so I guess they'll just have to enjoy ignorance.

</comment><comment><USER18> This is why Chinese companies buy older American brands. GE and RCA come to mind.

</comment><comment><USER19> I don't care what country owns the brand as long as it is dependable and well made. Chinese products have a big stigma of being cheaply made. There are also a lot of reports of products from China containing unhealthy levels of lead. It would be great if most of the products being sold are made in your home country, but until prices are matched, it would be a while until that happens.

<comment><USER20> _It would be great if most of the products being sold are made in your home country_

Why?

<comment><USER21> Because I'd rather support the economy of Wisconsin than the economy of Chengdu. I like people in Wisconsin, can't really relate to people in Chengdu, and then there is the whole militarily adverse repressive communist regime thing.

Beyond that, I have no desire to contribute to the externalization of pollution, health and safety risks, etc, that come from exporting production overseas.

I think globalization is utterly ridiculous when countries are allowed to engage in a "race to the bottom" as China has by destroying its environment and poisoning its people to be more competitive against Western nations that aren't willing to do those things.

I'm happy to pay a little more: [http://www.nytimes.com/2004/05/29/business/29shoe.html?ei=50...](http://www.nytimes.com/2004/05/29/business/29shoe.html?ei=5007&en=dbec2f2df332295f&ex=1401163200&partner=USERLAND&pagewanted=all&position=).

<comment><USER22> > I like people in Wisconsin, can't really relate to people in Chengdu,

?? They're just people.

<comment><USER21> Sure, but let's make no mistake: the people in Chengdu don't buy into this silly idea that they should care as much about the people in Wisconsin as they do about their neighbors just because "everyone is just people."

<comment><USER22> And yet I've met people from Xinjiang and Sichuan who share my feelings about other people and view things through the lens of international solidarity on a personal, human level. What's your point? That the risk of 'white guilt' is a reason not to discard indefensible perspectives like xenophobia and othering?

</comment></comment></comment></comment></comment></comment><comment><USER23> "This survey was commissioned by HDTS and conducted by Survata, _a web-based survey company._ "

Yeah, we all know how reliable those are.

<comment><USER24> [http://www.nytimes.com/2012/11/12/us/politics/the- techniques...](http://www.nytimes.com/2012/11/12/us/politics/the-techniques- behind-the-most-accurate-polls.html)</comment></comment>


X17 Particle - <AUTHOR> https://en.wikipedia.org/wiki/X17_particle <comment><USER2> There is some skepticism around this to say the least[1]. The core of it is that this group has found new bosons twice before:

 _The Atomki group has produced three previous papers on their beryllium-8 experiments — conference proceedings in 2008, 2012 and 2015. The first paper claimed evidence of a new boson of mass 12 MeV, and the second described an anomaly corresponding to a 13.45-MeV boson. (The third was a preliminary version of the Physical Review Letters paper.) The first two bumps have disappeared in the latest data, collected with an improved experimental setup. "The new claim now is [a] boson with a mass of 16.7 MeV," Naviliat-Cuncic said. "But they don't say anything about what went wrong in their previous claims and why we should not take those claims seriously."_

[1] [https://www.quantamagazine.org/new-boson-claim-faces- scrutin...](https://www.quantamagazine.org/new-boson-claim-faces- scrutiny-20160607/)

<comment><USER3> Here is another highly critical article:

[https://www.science20.com/tommaso_dorigo/the_17_mev_anomaly_...](https://www.science20.com/tommaso_dorigo/the_17_mev_anomaly_that_would_not_die-243528)

</comment></comment><comment><USER4> It's important to keep in mind that there are _always_ plenty of outstanding experimental anomalies in physics. At the moment, this is one of ~40 roughly equally credible hints towards new physics, and it's more likely than not that all of those hints will fade away over time. That isn't anybody's fault either: it has always been like this, and it happens because experiments are difficult and subtle.

Personally, I still find this extremely exciting, even though history tells us it has less than a 1% chance of panning out. A 1% chance of revolution is still meaningful. But don't be too surprised if we land in the 99%.

<comment><USER5> Any chance you know of a list of such anomalies?

<comment><USER6> One of my favorite "anomalies" is dark matter. Not much explanation for it so far. One of my favorite quips on HN put it thusly:

 _GR only matches observation because you added in 20x more stuff that is undetectable other than as a deviation from the predictions of GR._

[https://news.ycombinator.com/item?id=19537192](https://news.ycombinator.com/item?id=19537192)

<comment><USER4> That's a witty quip, but it's witty because it's unfair.

We don't grade theories based on what fraction of the stuff is obviously visible. If that were true, even electromagnetism would be a terrible theory because the vast majority of the spectrum we consider is invisible to human eyes. What always matters is how well the theory predicts given how simple its assumptions are, and dark matter is great at that.

<comment><USER7> Dark matter is a fudge factor.

<comment><USER8> Isn't the cosmological constant the OG fudge factor in GR?

AFAIK we need dark matter to explain any theory of gravity, the observations don't match what we would expect form classical mechanics either which is still the go to theory for things like galaxies.

MOND was introduced initially to fix the observations mostly in regards to how we understand Newtonian mechanics, the relativistic versions of MOND can be used as an alternative to GR but these have been more or less debunked with the observations of gravitational waves since afaik all the versions of MOND have "instant gravity" just like Newtonian mechanics.

<comment><USER9> "The relativistic versions of MOND" are just adding fields to General Relativity. Thus making them _relativistic_ theories.

Famaey and McGaugh §7. [https://arxiv.org/abs/1112.3960](https://arxiv.org/abs/1112.3960)

Consequently the rest of your last paragraph is incorrect.

"we need dark matter to explain any theory of gravity"

No. MOND _is_ a theory of gravitation, but it's not relativistic, and it does not work at scales larger than that of galaxies (it is notably wrong with respect to the peculiar motions of galaxies in massive clusters, and a residual mass term must be added _ibid._ §6.6.4 : essentially, MOND still needs dark matter at galaxy cluster scales, even if it were to correctly describe all the individual galaxies in the massive cluster).

Additionally, General Relativity does not require dark matter any more than Newton's F=ma requires dark matter. The issue is that General Relativity's G=T like F=ma does not tell you about the initial trajectories, you plug those in by hand. If you start with the trajectories learned by observing galaxies (as Vera Rubin did), you can work out a stress-energy tensor that satisfies those trajectories -- and the majority of it has to be electromagnetically- uncharged, interacting very weakly or even only gravitationally (i.e., they can't clump or diffuse on the scales of mere millions of years), and slow- moving. If neutrinos weren't so inclined to zip around at speeds very close to that of light, they'd fit nearly perfectly; unfortunately, we're left trying to find the microscopic details of the unknown parts of the stress-energy tensor. Milgrom's MONDian approach to Rubin's discoveries that the orbits of "surface" stars are non-Keplerian was to turn "a" in F=ma into a function that depends on the radial distance from a galaxy's core; the function was found empirically, comparable to how the stress-energy distribution was found. However, it's the dependence on a _coordinate_ distance that makes this approach non-relativistic.

(For terseness, in the paragraph above I've discarded some factors, set the constants c and G to unity, and omitted the greek-letter indices on the stress-energy and Einstein tensors (T resp. G). In the MOND context, F=ma is more appropriately written as in the first paragraph of §6 of Famaey & McGaugh.)

<comment><USER8> I'm not sure if I've either explained myself too simplistic or that you haven't understood my post.

My points were:

1) DM isn't a fudge factor for GR or Newtonian Mechanics, (Classical) Newtonian Mechanics doesn't have one, PPR does but PPR isn't a theory. GR has a fudge factor built-in into the theory - the Cosmological Constant that gives you a variable that can adjust the predictions to match observations as it wasn't known at the time if the universe is static or not. It's not a perfect fudge factor since it can't deal with accelerated expansion easily but it's a fudge factor nonetheless.

2) MOND was based on classical mechanics and as such isn't a replacement for GR, I'm not sure if I agree with the assertion that TeVeS is an extension of GR. And yes all theories of gravity need "Dark Matter".

Dark Matter isn't a fudge factor it's a placeholder for missing mass needed to align predictions with observations doesn't matter if those predictions are derived from GR or Classical Mechanics or as you've mentioned even MOND.

And yes MOND still requires "Dark Matter" or to be exact some additional mass however it requires much less of it and it requires it to be concentrated in the center of galaxies which means it can be much more easily explained for through known mechanisms and forms of matter (e.g. the black holes in the center of a galaxy are more massive, higher density of interstellar medium and gas etc.), hence it can be described as a theory that "solves" the problem of Dark Matter, because it doesn't implicitly require new forms of matter or complex explanations for missing mass.

However like you've mentioned MOND is a flawed theory, it doesn't even work on galaxies that well since while it can describe their movement today, it has difficulties aligning with observations of various clusters and more importantly it doesn't work well when you start to wind back the arrow of time, and you don't even have to go as far back as to the formation of galaxies (which aren't possible under vanilla MOND) rather it can fail as quickly as by rewinding the clock half a billion years in some cases.

<comment><USER9> 1/ I was restricting my comments to dark matter, sorry if you read a comment about dark energy into my reply; probably I should have made it explicit that I wasn't touching your "fudge factor" comment. Coincidentally, Sabine Hossenfelder has just published this in the past day or so: [http://backreaction.blogspot.com/2019/11/what-is-dark- energy...](http://backreaction.blogspot.com/2019/11/what-is-dark-energy.html) and you might want to take your comment about "fudge factor" there, although I'd bet a doughnut without looking that at least two other assiduous commentators there have already done so. Hopefully someone in there will discuss Jeans instability and the Raychadhuri focusing theorem if it gets sufficiently technical: the latter was a later discovery which (if he had been aware of it) would have led Einstein (and practically everyone else) more quickly away from a steady-state cosmology and towards something like Einstein-deSitter or Einstein-Friedmann as a way of solving the problems arising in the former. One should also bear in mind that until 1922 M31 (then the "Great Andromeda Nebula") was not known to be comparable in size to the Milky Way nor at distances of more than a few thousand light years (as opposed to the modern figure of ~2.5 million), and that it wasn't until several years later that it became known that there are lots of galaxies in the sky -- this was all after the cosmological constant was introduced by Einstein in 1917.

2/ I will restrict myself to just:

"I'm not sure if I agree with the assertion that TeVeS is an extension of GR."

Bekenstein's tensor-vector-scalar gravitation (TeVeS) is a theory of gravitation, like MOND and GR. You're right that as originally formulated it's not laying a field on top of GR, but like numerous theories of gravitation it was found to be inconsistent with observation. In particular TeVeS does not allow for long-lived stars, and those appear in our sky in abundance. We also have lots of Einstein lensing data that conflicts strongly with TeVeS predictions. Amusingly one fix proposed for TeVeS for the "cosmic shear" weak gravitational lensing is to add a hidden mass term in galaxy clusters, with a specific proposal for a WIMP. (This doesn't fix TeVeS's other difficulties).

This is dealt with in Famaey & McGaugh §7.4 (wherein there is a delightful summary of a generalization of TeVeS: "... a tensor-vector-scalar theory with an Einstein-like metric, an Einstein-Aether-like unit-norm vector field, and a k-essence-like scalar field", which is close to saying it's "just GR with two extra fields that you are free to place on either side of the Einstein Field Equations" as you'll likely read from such non-particle-DM academics), and on textbook treatments of the Paramaterized Post-Newtonian (PPN) formalism (a convenient table is here [https://en.wikipedia.org/wiki/Alternatives_to_general_relati...](https://en.wikipedia.org/wiki/Alternatives_to_general_relativity#PPN_parameters_for_a_range_of_theories) and surrounding text). Many of the PPN parameters are chosen so that they can be individually tested; hackernews user ISL does that for a living!

2(b)/ restricting to "the black holes in the center of a galaxy are more massive, higher density of interstellar medium and gas"

The work of [http://www.astro.ucla.edu/~ghezgroup/gc/](http://www.astro.ucla.edu/~ghezgroup/gc/) and others put strong limits on the stress-energy in the central parsec, and more broadly in the core: your approach does not work in the Milky Way at all, and yet observations are increasingly consistent with a dark matter halo (see [https://en.wikipedia.org/wiki/Dark_matter_halo#cite_note-32](https://en.wikipedia.org/wiki/Dark_matter_halo#cite_note-32) and cite note 33 ibid., which review the Milky Way's rotation curve)

2(c)/ "you've mentioned MOND is a flawed theory". The theory itself is fine, it's just not a good match for extragalactic observations. I have zero problem in using pure Milgromian MOND in studies of the doppler shifts of molecular gas clouds in LSB elliptical galaxis, for instance. But it doesn't work at all in cosmology, and is grossly wrong in the solar system and in mergers of massive compact objects, and "fixes" for those regimes are even more unwieldy than the GR-based linearizations and other GR-based post-Newtonian expansion techniques already in use.

Finally,

"wind back the arrow of time"

What does that mean?

From context I think you are just saying that large scale structure formation is not adequately explained by theories that lack some form of dark matter, but "the arrow of time" means something to cosmologists (and physicists generally).

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Find it really hard to believe they find something at 17 MeV that was never seen at Tevatron, RHIC, CEBAF, HERA, LEP, SLAC, etc.

<comment><USER11> You also need a beryllium nuclei. It comes a nuclear physics experiment.

</comment></comment><comment><USER12> I find the E8 lattice incredibly interesting, if for no other reason to find out if it's truly representative of particle physics. It predicts more particles we haven't observed yet.

[0] [https://en.wikipedia.org/wiki/An_Exceptionally_Simple_Theory...](https://en.wikipedia.org/wiki/An_Exceptionally_Simple_Theory_of_Everything) [1] [https://science.howstuffworks.com/science-vs- myth/everyday-m...](https://science.howstuffworks.com/science-vs- myth/everyday-myths/theory-of-everything2.htm)

<comment><USER13> Honestly, even if the E8 lattice is nothing but imagination, it's so beautiful that we need to make a para-verse like that someday. You know, when we've mastered creating universes and stuff, at least when we're able to live in virtual fluff. The beings in such a simulated universe would be so in awe of 'everything' as they uncover the theory thereof.

<comment><USER14> If you haven't yet, you should read some of Greg Egan's books.

<comment><USER15> Greg Egan is indeed a goldmine for this kind of material. For this particular topic I would highly recommend his book Diaspora.

</comment></comment></comment></comment><comment><USER16> Related thread: [https://news.ycombinator.com/item?id=21616381](https://news.ycombinator.com/item?id=21616381)

</comment><comment><USER17> Someone knowledgeable, please tell us why this is just runaway science journalism before we get too excited!

This is potentially the most groundbreaking stuff in decades, right?

<comment><USER18> We're going to need an independent experiment to see this "X17" before anyone truly believes it's a new particle. Some example major particle discoveries over the last few decades (and the independent experiments which observed them): Higgs (ATLAS & CMS at CERN); Top quark (CDF & D0 Fermilab); W & Z Bosons (UA1 and UA2 at CERN); J/Psi (Richter's team at SLAC & Ting's team at MIT). Some other fundamental particles were observed by a single experiment (the bottom quark, for example) and the community believed it, but in those cases it's always because a theory has already predicted the particle, and we've always been able to study them with future experiments anyway. So this won't gain traction unless another experiment can observe it.

</comment></comment><comment> mo-1 What, you say>

Nobody should argue that advancements haven't been made since 1988, but nobody's manufacturing organic human organs yet --- chemical pieces of: probably.

</comment><comment><USER19> could someone explain something--

I have a faint understanding of the "Standard Model" of physics, which lays out a pattern of particles and forces that has so far held up to experimentation i.e. the Higgs boson fit neatly into the model, exactly where the model predicted it would go.

The standard model predicted the Higgs, and the Higgs was found exactly how the model predicted, right? But I've never heard of this X17 particle before. Is this something the standard model has predicted? Does it go against the standard model, strengthen it, or neither?

<comment><USER20> _> Is this something the standard model has predicted?_

No.

 _> Does it go against the standard model, strengthen it, or neither?_

I would say neither.

</comment></comment><comment><USER21> this is extremely exciting. makes me hope that we will see a unified theory of physics in our lifetime

<comment><USER22> Usually discovering new fundamental forces will move us away from unification, not towards it.

<comment><USER23> Discovering new physics doesn't move us away from a unified theory, it just means we were wrong about how much farther we have to go.</comment></comment></comment>


Financial Autonomy in Marriage - <AUTHOR> http://messymatters.com/autonomy/ <comment><AUTHOR> My wife is the author of this. Here's maybe my favorite excerpt:

"With separate money we've got a whole new class of conflict resolution. We still debate, negotiate, argue, ... but any decision has a fallback resolution method as definitive as voting would be if there were an odd number of us. That's right, we use auction-based decision-making in our family. Where's my nerdcrown?"</comment>


A Colleague Drank My Breast Milk and Other Wall Street Tales - <AUTHOR> http://www.nytimes.com/2016/01/24/opinion/a-colleague-drank-my-breast-milk-and-other-wall-street-tales.html?ribbon-ad-idx=15&rref=opinion&module=Ribbon&version=origin&region=Header&action=click&contentCollection=Opinion&pgtype=article <comment><USER2> There was a real suggestion buried in this piece. Ban mandatory arbitration. I'm most interested in knowing what HN thinks about that piece, since I have no informed opinion of working conditions on Wall Street.

Mandatory arbitration seems like a generally bad idea that employees should be protected from. Does anyone have a good argument counter?

<comment><USER3> Mandatory arbitration reduces the cost of resolving disputes (i.e. lawyer's fees). There are many arbitrators available who are comparable to the courts in outcome, but much speedier, more predictable, and cheaper. In cases where the parties are interested in good low cost dispute resolution, they may be willing to choose one of these arbitrators to reduce uncertainty and transaction costs. In other cases, one party may pay the other extra to 'buy' biased arbitration, or a specific arbitrator (or set of rules) may be selected as a way of shifting risk from one party to another, much like buying insurance; I do not see why this should be disallowed.

There is also a signalling aspect to this, which we usually do not account for. By allowing the other party to select the arbitrator, you may be showing that you trust them; refusing their pick may be a sign of deeper issues.

<comment><USER4> The thing is, insurance is almost always meant to spread around risk from random events, such as a car accident, unexpected disease, act of nature, or in the most extreme case, an engineering or manufacturing mistake that causes a rocket to blow up. Except in cases of fraud, these situations arise randomly or due to systemic problems that can be quantified within the context of the insured parties. With arbitration, especially when mandated by an employer, the process is easily used to make possible behavior that the legal system would otherwise never allow, by people who fully _intend_ to do so, just like when someone buys insurance with the intent of burning their own house down for the cash payout. Unlike the insurance company, however, the employee has no remaining legal recourse outside of a predetermined (and possibly biased) arbitration process just because it is in the contract.

If an employer is explicitly trying to minimize their risk and costs by mandating arbitration how can you ever trust them to pick an unbiased arbiter? If an agent is trying to maximize their outcomes by forcing arbitration, why would they then chose any arbiter that isn't more likely to side with them?

You can argue that allowing arbitration is a trust signal, but at the same time it can send a signal that the employer is planning on, or at least thinks it a possibility, that they will violate some terms of the contract, whether those terms are explicit or implicit (i.e. due to legislation or court precedent). The problem is that the information assymetry between an employer and employee is so vast such that arbitration is a tool easily used to further exploit workers.

<comment><USER3> > _" The thing is, insurance is almost always meant to spread around risk from > random events..."_

Health 'insurance' covers many predictable issues, such as eye glasses and continuing care issues, but I will grant you that insurance is generally best used to hedge against risk. A number of national US insurance providers offer policies which cover employee suits, so it must be a large, insurable market.[1]

> _" If an employer is explicitly trying to minimize their risk and costs by > mandating arbitration how can you ever trust them to pick an unbiased > arbiter? If an agent is trying to maximize their outcomes by forcing > arbitration, why would they then chose any arbiter that isn't more likely to > side with them?"_

There are many kinds of risk which one might try to minimize; one of these risks might be that of a long, drawn-out civil jury trial which can take a long time to be seen, and have a completely unpredictable outcome. Having an arbitrator decide against you for a reasonable sum might be preferable to devoting time and resources to a trial and investor relations disaster over many years (even if the verdict is in your favor). In addition, having a defined process from the outset may help the damaged party get their issue resolved quickly and easily; as a long civil suit can be ruinous to an individual (even if they win). In short, real people are not risk-tolerant robots.

[1] [https://www.nationwide.com/employment-practices-liability- in...](https://www.nationwide.com/employment-practices-liability- insurance.jsp)

</comment></comment></comment></comment><comment><USER5> While I completely agree that the behaviour described by the author is totally unacceptable and must be rooted out from the workplace, I also find the context ironic: Bear Stearns just before the 2008 financial crisis.

As we aspire to a better society, is this really the goal we want to reach for? Better female representation in a corrupt enterprise that precipitated a global financial crisis which caused hardship for hundreds of millions of people?

I hope the author, a member of senior management, was troubled by more than just sexism at pre-collapse Bear Stearns.

<comment><USER6> Sexism may have been one of the problems that contributed to the problem. The collapse originated in that frat boy echo chamber of insanity. Maybe if Wall Street was a place where responsible adults of both genders thrived, it could have been prevented. Just as many men as women feel alienated by that environment.

<comment><USER7> I usually find arguments about how "underrepresented group X in upper management will somehow make the company better" unconvincing, but the downfall of Bear Sterns is a great and decisively convincing example of how a monoculture with a lack of multiple perspectives and backgrounds created a really corrupt and toxic environment. At the very least, the sexism towards women in the corporate culture should've been seen as warning indicator for their business practices as well.

In this case, I think sexism was as much a symptom as a cause, and the larger cultural problems were very destructive to women, men, and the US economy.

</comment></comment></comment><comment><USER8> I never understood why mandatory arbitration is ever allowed. Someone should be able to decide if they want arbitration _after_ the incident has occurred. The default should be court and arbitration should only happen if both parties agree it is a better course of action.

</comment><comment><USER9> > I thought of the guy known for dropping Band-Aids on women's desks when the > trading floor was cold because he didn't "want to be distracted,"

...I don't understand. Can anyone explain?

<comment><USER8> Since all the other comments here seem to be afraid to fully explain...

Cold makes the skin hard, especially the nipples. This happens on men and women, but it tends to have a bigger effect on women, in part because their nipples are larger and in part because they tend to wear thinner fabrics.

If a woman is going to go out in a thinner fabric and she knows that where she is going might be cold, she'll put band aids on her nipples to help smooth it out under her clothing to prevent them from poking out, which can draw unwanted attention.

The implication here is that the man can not control himself and wants them to cover up because he will stare at their breasts if they don't.

<comment><USER10> This is such a distinctly American(tm) problem that I can't help but chuckle.

Why are we so puritanical about sex, gender, etc?

I'm not absolving the guy doing this really creepy thing, but I sort of understand it.

If you were raised in a society that was very sexually repressed, then it's only natural that you'd develop these strange behaviors around the opposite sex. I can only shudder trying to imagine how warped that individual is.

<comment><USER11> It's highly unlikely that someone would leave bandaids because they were uncomfortable around nipples. It's a power play, a way of signaling.

<comment><USER10> I could understand the power play angle if it was something more mundane, like a slap on the ass.

But this whole band-aid jibe requires a certain amount of premeditated thought. It looks more like sexual deviance to me, rather than simple power play.

<comment><USER11> Even at a bank a slap on the ass will get you in hot water with HR. Bandaids have plausible deniability.

</comment></comment></comment></comment></comment></comment><comment><USER12> > My candidate took the job, and while she was passionate about her work, she > was uncomfortable with the raucous trading floor environment, and lasted > only five years.

I'm surprised five years is considered short.. I imagine people in the tech industry don't get treated nearly as badly but we seem to switch jobs way more often.

Why is that?

<comment><USER13> Sounds to me like she lasted only five years in the entire industry. That's short for tech too.

</comment></comment><comment><USER14> Wall Street has a bigger problem, that many financial professionals are able to rationalize doing work that harms others. So let's say we can make the big evil banks a better place for women and other people with real life interests to work. Should we encourage our daughters to go work on Wall St? Or should we discourage them, not b/c they can't do the work, but b/c doing the work is harmful to others?

Yes I know banks are necessary, some do good. But I'm talking about the speculative operations at TBTF institutions that continue to add fragility and risk to our economy. These same institutions also tend to be the worst places to work for women (or anyone who has outside interests other than making money). I don't think that is a coincidence, but rather a consequence of the same underlying worldview.

</comment><comment><USER15> This is what happens when frat boys get jobs. I think one piece of the puzzle is fostering less misogynistic environments in college, before these dudes enter the workforce.

But seriously, how fucking disgusting. This article ruined my morning, I'm pissed off now.

<comment><USER16> > This is what happens when frat boys get jobs

Why do you think it is OK make a massive generalization about a group of people like that? While I wasn't personally involved in Greek life during college, I have very good friends that were upstanding and principled members of fraternities that would certainly abhor the horrific and abusive behavior described in this article.

If you met a nice person today and later found out they were in a fraternity during college, would you immediately make judgements about their morals and conduct just based on that association?

<comment><USER15> Yeah. Yeah i would, honestly. There's always the exception to the rule, but we're talking about systemic issues, not playing the "but not all men..!" game. Refer to my other reply but when you put people who have grown up in a racist and sexist society into a racially and sexually homogeneous group where they spend most of their time, racist and sexist attitudes will be fostered in the absence of accountability. (Which u don't have, because racially and sexually homogeneous.)

<comment><USER17> You know, I've had people assume I was an inferior software developer solely because I was in a social fraternity and therefore must not have spent any time studying for my exams or working on my problem sets. That's not really a nice prior to have about an individual, sort of how it would be considered quite offensive to assume that a woman were an inferior software developer due to her gender.

Additionally, I'm not going to pretend that Greek life is 100% free of douchebaggery. Some people in fraternities do bad things to other people, or harbor bigoted worldviews. I feel that you grossly overestimate the proportion of people who do. To address the racial and sexual homogeneity point, I'm fairly confident that every single fraternity at my alma mater had individuals of color and homosexual individuals. My own certainly did.

I'd also like to point out the obvious blanket statements you've made about the demographics and attitudes of fraternity members. However, I really don't think anyone or anything can budge your opinion.

</comment></comment></comment></comment><comment><USER18> "..you don't believe what's next, bankers hate him!" would make this title complete. I am absolutely full of clickbait fluff. I really hope someone takes on the content filtering space on the internet. I would happily pay xx dollars per month for a service which can accurately filter all the noise coming in and mark or even completely remove all the shit that content creators feed us just so we click on it. Arguably, the technology needed isn't sexy but at least it is a challenge compared to the 1000th CRUD startup. Why isn't anybody battling this problem?

I am sick to the stomach of it.

<comment><USER6> I'm familiar with the type of articles you're complaining about and agree with the complaint, but I don't believe this is one of them. The title was interesting, the article was also, and it contained concrete examples and actionable requests. I thought it was pretty good honestly.</comment></comment>


Coding for the Mobile Web - <AUTHOR> http://arandomurl.com/2011/03/16/coding-for-the-mobile-web.html

<comment><USER2> Your methods on fixing the click delay are interesting. What was your resulting click time?

I'm not an expert on this but you seem to be using a lot of javascript for your UI when most of it can be done with CSS and applying/removing classes. The JS is fine for desktop browsers but it can be really laggy on mobile (even 3GS). I think that's one of the things about jquery mobile—it uses css where possible. That said, it seemed a little unrefined for me too and I've always left it out.

I did much the same stuff (ui-wise) as you very recently, but used -webkit- animation to do most of the work which means you can also use -webkit- animation-fill-mode <-totally awesome: [http://developer.apple.com/library/safari/#documentation/app...](http://developer.apple.com/library/safari/#documentation/appleapplications/reference/SafariCSSRef/Articles/StandardCSSProperties.html)

Also, you should use the 3d versions of translate, scale, rotate like translate3d(x,y,z) because it utilises hardware acceleration (on iOS at least). Makes a massive difference. Put down the javascript stick. :-)

</comment><comment><USER3> Note: I'm a jQuery Mobile team member

Most of the functionality that the author has highlighted (footers, page animations, intelligent click handling) is handled in a much more comprehensive/robust fashion by jQuery Mobile despite its alpha state.

I would encourage readers to look into the phonegap/jqm combination when building mobile applications with html and javascript if only because there are a large number of problem areas with this approach that jqm will handle for you.

[UPDATE]

Just thought I'd highlight that the click/tap support is extremely difficult to get right. Kin Blas, the developer who's working on this in jqm has taken a lot of pains to make sure that the click handling is fast and flexible in all cases.

<comment><AUTHOR> Sure, I checked out jquery mobile before starting with this and would suggest everyone else does the same, actually a bit silly to leave that out of the article.

I decided against using jquerymobile for 2 reasons,

1\. the page loading / transitions are extremely buggy for me, clicking a link can cause 3/4 page flashes for me on the current online demo.

2\. having previously been burned by jquery ui, I love jquery because its a tiny library I add that enforces nothing on me, jquery ui is large and its quite hard to take a little bit out of it that you like, a lot of that is due to its themeing library, jquery mobile felt more like jquery ui to me more than jquery plain.

extracting the click / tap support into a plugin I could use with plain jquery would be a massive win for me.

</comment></comment><comment><USER4> I hope mobile web apps really take off - although Apple provides a fantastic distribution mechanism, the restraints they put on developers are unreasonable. Web apps let you (or your company) dictate the release cycles and determine what is or isn't suitable for your customers.

The HTML5 apis (especially the offline cache manifest stuff - my favourite! [http://www.mrspeaker.net/2011/03/17/generating-cache- manifes...](http://www.mrspeaker.net/2011/03/17/generating-cache-manifest/) ) can let us do some pretty "native-esque" stuff: though it seems like every iOS version something gets broken - multi-touch in 4.2, and the nitro bug in 4.3... Though I'm sure I'm ascribing to malice... ;)

</comment><comment><USER5> This is the only thing that makes sense, I've turned down a couple contracts now for people wanting me to develop and maintain code bases on three different platforms for the same app. Until someone figures out a way around the cross platform legal and technical issues this is the sanest way for indie developers to compete.</comment>


Ask HN: if you get 600 users in 3 weeks, is that good, average or bad? - <AUTHOR>

We have rolled out a team based link sharing tool (teamgum.com) in last week of april at TNW conference in Amsterdam. In 3 weeks, we have got 600 users, 150+ teams signed up. wonder if that is good, bad or average. Also, what other parameters as a marketer you would suggest to monitor? <comment><USER2> Imagine these two scenarios:

We spent $50 million dollars advertising our free app and got 600 users in three weeks. Is that good? No, it's terrible.

We spent $0 in advertising and told one guy who wasn't even in our niche about our app that costs $1000 per month and got 600 users in three weeks. Is that good? It's awesome!

Take a look at your ongoing costs, marketing costs per signup, customer lifetime value, customer feedback and value being generated for your customers.

</comment><comment><USER3> I believe that it is a good start. On an average you're getting 50+ teams a week and 200 users. These numbers suggest that the collaborative tool you're talking about is intuitive easy to learn and most importantly addressing a common need for all the team-members. As a marketer I would recommend you to also track the engagement ratio of your application and install to registration rate. This will let you identify the users specific to an industry and will allow you to customize and design your marketing campaigns and strategies around a specific customer base

<comment><AUTHOR> thanks for your reply. we are tracking engagement ratio aswell, but not sure what is the average engagement ratio like for enterprise link sharing tool. Your 2nd point is very interesting & we have to incorporate that. thanks again.

</comment></comment><comment><USER4> It sounds really good, congrats! But growth is the statistic to focus on. Maybe make your current stat of 600 users be your starting point and make it your goal to increase 10-15% weekly from now on.

Also, reach out to your current users constantly and ask for feedback so you know what to improve on for each iteration. This will come in handy 4 months down the road when you are trying to gain 300 users in a week. Good luck!

</comment><comment><USER5> Depends. 600 users paying $20 a month? Great, there are people who would kill for that. 600 users to whom you display ads? Meh...

<comment><AUTHOR> not paid as of now. we have free plans.

<comment><USER6> Did you do anything aside from TNW to promote it?

<comment><AUTHOR> Nothing apart from TNW. would you recommend any other mediums?

</comment></comment></comment></comment><comment><USER7> If those are the 600 users you'll ever have, it's bad. If in the next 3 weeks you get 600 more users, it's average. If in the next 3 weeks you get 6000 more users, it's good.

</comment><comment><USER8> Measure your growth rate in users every week. 5% is good.

[http://paulgraham.com/growth.html](http://paulgraham.com/growth.html)

</comment><comment><USER9> 600 users in 3 weeks? I'm hoping to attain that in 3 months -_-. So ... good I think.</comment>