'Instantly rechargeable' battery could change the future of electric automobiles - <AUTHOR> https://www.purdue.edu/newsroom/releases/2017/Q2/instantly-rechargeable-battery-could-change-the-future-of-electric-and-hybrid-automobiles.html <comment><USER2> > The greatest hurdle for drivers is the time commitment to keeping their cars > fully charged.

For a large percentage of common use cases this is not an issue. EV drivers by and large do other valuable things while their vehicles charge, like work and sleep.

> Current electric cars need convenient locations built for charging ports.

This is only true for apartment dwellers (for now). People who live in houses typically charge at home.

> Designing and building enough of these recharging stations requires massive > infrastructure development, which means the energy distribution and storage > system is being rebuilt at tremendous cost to accommodate the need for > continual local battery recharge

> Users would be able to drop off the spent electrolytes at gas stations, > which would then be sent in bulk to solar farms, wind turbine installations > or hydroelectric plants for reconstitution or re-charging into the viable > electrolyte and reused many times.

How is this fueling and distribution system cheaper or more efficient than the grid plus a bunch of 240v/60a outlets, most of which are already available in home garages. If instant refueling is a really a dire need for someone, they can just get a plugin hybrid (i.e. Chevy Volt) and no new infrastructure needed at all.

Edit: removed snarky words

<comment><USER3> It's just ridiculous to claim that recharging time is not a huge downside to EVs. If I have to drive more than the range of the car, I've now added hours to my trip instead of the minutes a liquid fuel refill takes.

I often drive more than the range of a Tesla and certainly more than the range of something like a Leaf, which is why I have not considered buying one.

<comment><USER4> It takes hours to supercharge a Tesla?

<comment><USER5> According to Tesla it takes 1h15m for a full charge. If you don't happen to be around a supercharger and have to use a 240v outlet you're looking at 9.5h for a full charge.

<comment><USER6> What's especially cool about this is that most homes in the U.S. have a 240v outlet in or near the garage, meaning it's easy to recharge while visiting friends or family.

<comment><USER7> Is that really true? What for?

I'm remodeling a house and putting in 240 just for the dryer an an unusual French range. Why would I need that in the garage? I certainly won't have that long an extension cord.

<comment><USER8> For your lathe and vertical mill :-)

<comment><USER9> I'd rather have 208V (three phase) for that. Makes it easier to set up a variable frequency drive.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Quick summary: It's a flow battery[1]. Replace the liquid with fresh liquid and you are recharged.

This one is different by not having a membrane.

[1] [https://en.wikipedia.org/wiki/Flow_battery](https://en.wikipedia.org/wiki/Flow_battery)

<comment><USER11> Yes, and this bit might make you pause : _" 'We are at a stage in the company's growth that we are looking for additional financing to build large- scale prototypes and subsequently manufacturing partners,' Cushman said."_

The whole "Breakthrough! Just add money!" thing is really tiresome not because it would be wonderful if it was as simple as just adding money, but because so very many people have abused it when they really had no idea at all about what the issues were with their technology.

I like the concept of flow batteries, and have read a number of interesting papers over the years on them. They solve a number of problems if you can get them to work and the instant recharge is perhaps the best one.

That said, a very good flow battery demonstrator project would be a set of solar panels (cheap these days), continually pumping electrolyte from a reservoir and 'charging' it (inverting its oxidation reaction). Coupled to a flow battery and a constant load.

If you can't build that, and show that by putting 'nX' load of solar cells in the loop, and continually run the base load 24x7, then you've got the basis for an actual breakthrough. Even doing it for a small "meaningless" load like 50 watts (1.2kWh / day), you will have demonstrated not only that your battery works but that it can be combined in a system that currently requires "previous generation" batteries.

And from that demonstrator you can make educated guesses about how much maintenance would be required for a larger scale system, how well the system performs 24x7, how to maintain it while it is operating, Etc.

 _Then_ you can say, for $X we estimate we could run a typical house off grid. For $Y we estimate we could provide Z MWhr of base load. If you can't build the 50W system though, it is unlikely you can build any system yet.

<comment><USER12> It sounds like their 0.5 watt system at least works:

[https://whova.com/embedded/subsession/icpma_201705/177114/17...](https://whova.com/embedded/subsession/icpma_201705/177114/177119/)

<comment><USER11> Perfect, Vanadium is only $28/kg[1]. 500W of solar cells is less than $1,000 these days. Saltwater and Methanol are also pretty cheap. Well you can charge it, so if the charge rate is .1C you hook your solar panels to 1000 cells that are charging ("charging" cells) and their electrolyte is then pumped into the 100 "load" cells for delivering load. But that only keeps you even, so 10,000 cells charging and filling the reservoir while 100 cells providing load. Damn the laws of thermodynamics!

Still I would love to read how Dr. Cushman sees it working out.

[1] [http://www.reuters.com/article/metals-vanadium-prices- idUSL4...](http://www.reuters.com/article/metals-vanadium-prices- idUSL4N1II3WY)

</comment></comment></comment></comment><comment><USER13> So maybe this is a biased perspective because I have an existing relationship with Purdue...

Purdue, as with MIT, tends to oversell their research a little bit (a lot). The difference is that MIT's overselling is believable whereas Purdue's wreaks of insecurity and overstating as posturing. As others have noted on a technical level...take it with a grain of salt. The current president (and ex- Republicant governor) Mitch Daniels has been pushing a really hard narrative of privatizing the university and its resources for corporate gain. He neeeeeeds this type of thing, whether or not it pans out.

</comment><comment><USER14> Unless I'm misunderstanding how it works, some questions about this idea:

      * Presumably, you have to fully empty and then fill your tank?
        Over twice as long to refill as for gasoline/diesel.  (Still:
        not terrible.)

      * How do you get refunded for your partially used "fuel"?
        I generally refuel around a quarter of a tank.  In this case,
        that means I'm sending back 25% unused fuel.
        (Pump it out, analyze the mixture, provide credit?  Seems seriously game-able.)

      * Is the power output constant regardless of charge?  Can I get 20kW
        of output at 25% charge?

<comment><USER15> Extracting the fluid is already going to be an interesting task (it seems like it'd probably be uneconomical to suck it out with a vacuum). I can see the cars having separate input and output holes. With a clever design in the car you could probably start refilling while you finish emptying.

A recharge should be pretty cheap. The national average cost for electricity is ~13¢/kWh, so refilling a 100 kWh battery would only be $13 of energy. Other costs - storage, maintenance, labor, land, etc - add to that, but you still aren't out that much. It's possible that you just pay full price regardless, since they are giving you totally fresh solution.

One of the most important things about flow batteries is that they're basically invariant with charge and scale, so almost certainly (until you really hit the dregs - you probably lose voltage at 4%).

</comment></comment><comment><USER16> This sounds interesting. It got me thinking about some other ideas.

What about solar panels on the roof? I found this article [1], and Elon Musk has said they'll "probably offer it as an option" [2].

I wonder how many extra miles you could get with that. If nothing else, it would be nice to know that you could slowly recharge your battery if you get stuck in the middle of nowhere.

Another idea - highways where you could drive while recharging. Maybe something similar to train tracks, or an overhead wire. Or wireless power transfer through the wheels, if that would be possible? (I don't think it is.)

[1] [https://thinkprogress.org/prius-solar-roof- breakthrough-2b92...](https://thinkprogress.org/prius-solar-roof- breakthrough-2b929f467061/)

[2] [https://twitter.com/elonmusk/status/794575003446480896](https://twitter.com/elonmusk/status/794575003446480896)

<comment><USER17> Solar panels charge really slowly compared to how much energy is needed to move a car.

I'm probably totally wrong here, but if the whole car was solar panels I would expect 600 watt to be generated. An electric car would need that for 0.8hrs or so to move one mile (0.44 kWh/mile?) plus acceleration.

<comment><USER18> Still seems worth it for a slight efficiency gain plus the ability to gain charge just by waiting if you run out of juice in the middle of nowhere.

<comment><USER19> Another issue is that most people prefer to have a sunroof on their car. (Ideally a large, panoramic one, as Teslas have.) Can't really do that with solar panels.

</comment></comment></comment></comment><comment><USER20> This is pretty cool. The general idea is that a gas station dispenses a water and ethanol solution that acts as the electrolyte and provides energy for the battery. And then recharging is done by reprocessing the electrolyte with renewable energies. If this turns out to be a technology that can work well on large scales, it could really be a game changer.

<comment><USER21> Can you also recharge it in the battery with electricity, or do you have to go to a special station? The ability to "fill up" at home is one of the great advantages of EVs, although I realize a lot of people can't do that.

<comment><USER22> when it comes to traveling its a big drawback. You need quick charging stations and tesla even admits the lines are getting long.

<comment><USER4> You're confusing the worst case with the average case -- maybe you should instead ask Tesla owners if they're happy with long distance travel? The overwhelming answer is "yes".

<comment><USER5> Duh? The limitations of EVs are known before you buy the car. The people who still choose to buy them is a strict subset of people who are okay with the downsides.

Tesla owners are distinctly _not_ representative of the average person's situation.

<comment><USER23> mikeash was asking, can you _also_ charge it at home. It's a fair question, since most of the time the overnight home charge is all you need, and even more convenient than going to a gas station. So an EV that can do both is great, an EV that _must_ be filled at a gas station only, that's actually a tricky trade-off, and reasonable to assume a large number of current EV owners would not make that trade-off.

In otherwords, if you're adaptable to home charging, then you _really want_ home charging. Makes perfect sense to also observe all current EV owners are adaptable to home charging, by definition.

So strictly speaking adding it expands the market to different kinds of EV owners who would treat it like a gas car, just with no direct emissions. If you can add this feature without sacrificing anything else, I'd say that's a very big deal.

I assume that in reality this tech is a decade of hard work away from even being usable in an EV, so we'll never see it made.

</comment></comment></comment></comment></comment></comment><comment> Paul-ish I am not very knowledgeable about battery technologies. How could you ditch the membrane in a system that is expected to be moving and shaking? (eg a car) Is it not important for the fluids to be separate?

</comment><comment><USER24> The problems that I see with this:

* Refueling requires hooking up and exchanging hazardous materials (fluids).

* This assumes that there's a single universal electrolyte fluid.

* Variability in fluid quality / consistency (across areas and batches) / return materials fraud are problems.

* The less sealed nature of the batteries is probably a safety hazard (increased crash/fire risk, etc).

I think that the public would be better served by standardizing on a few /types/ of battery packs as physical interfaces, and having rapid 'tank replacement' stations (robots) and leased battery packs.

Innovation in storage tech and/or picking a pack sized for the expected use would allow for improvements and competition as well as changes in technology.

<comment><USER25> For 3/4 of your concerns, kinda like gasoline?

<comment><USER24> Gasoline is mostly just flammable (and the vapor /slightly/ explosive).

We'd need to know more about what type of chemicals are used in this battery, but glancing at what's involved for 'flow batteries' I'd make a /slightly/ educated guess that these would all be considered 'industrial' materials. You might see a public bus using them, but I doubt it would be safe to allow the average driver to self-refuel.

<comment><USER26> > Gasoline is mostly just flammable (and the vapor /slightly/ explosive).

Gasoline is incredibly toxic, we are just accustom to it so we don't give it much though.

<comment><USER27> I wouldn't say 'incredibly' toxic. You can touch it for a while with no negative effects, and you shouldn't ingest it.

</comment></comment></comment></comment></comment><comment><USER28> I fully understand how such a team might run out of money -- it's not an easy work after all, and takes time.

But honestly, for the last 10 or so years, I can't remember even ONE time that I've heard about "revolutionary new battery technology" and it arriving on the market soon after. Or ever.

Honestly, what happens to ALL those people? From genius 13-15 year old school students to established scientists -- did anyone try to contact them, say, one year later?

I am tempted to think that inventing a possible new revolutionary battery technology is closely correlated to suddenly teleporting far away from Earth.

 _(Not sorry for sarcasm)_

<comment><USER29> Some of them put their product on the market, but quietly.

One company I've been watching closely which at the same time has been secretive to say the least: [http://www.amprius.com/](http://www.amprius.com/) Their product is a li-ion battery with a silicon anode and apparently it works, because they put it into an actual device: [http://www.imei.info/phonedatabase/79823-bluboo-x550/](http://www.imei.info/phonedatabase/79823-bluboo-x550/) (Note the massive 5Ah battery)

These guys generated quite a buzz back in the day: [https://oxisenergy.com/](https://oxisenergy.com/) For now their product is sort of disappointing, but the lone fact that they harnessed this new chemistry is notable.

Last but not least IMO the most promising company among them all: [https://www.eosenergystorage.com/](https://www.eosenergystorage.com/) I remember when they were promising 6MWh/1MW stacks and 10k cycles instead of the 4MWh/1MW stacks with a lifespan of 5k cycles they are offering now, but the key thing is they are deploying them as we speak - actually, their total production for 2017 was sold out at the start of this year.

These 1MWh stacks are made from 12kWh modules, which sooner or later will be offered to individual customers.

<comment><USER28> Your knowledge is impressive. I am thankful for your sharing it!

From I gather from the websites, it seems these companies move to bigger batteries and stuff like making more reliable power supplies for machinery -- maybe partially-off-the-grid homes as well?

Does that mean they had no luck in minituarizing their tech to make it viable for smartphones, smartwatches, Bluetooth headsets or car audio systems -- generally a small consumer-grade battery?

I very clearly remember at least two separate cases of teenage Indian school students that managed to demonstrate a prototype of a very quick-charging battery that can hold 1000+ mAh, somewhere in the last 5 years. I am absolutely sure I've read such news.

However, last I heard about them, some corporation gave them free scholarship in an elite university... and after that, full radio-silence. Really makes me suspicous, you know. What the hell happens to these people? Don't they still want to revolutionize the world as they claimed they wanted to when they were teenagers?

<comment><USER29> > Does that mean they had no luck in minituarizing their tech to make it > viable for smartphones, smartwatches, Bluetooth headsets or car audio > systems -- generally a small consumer-grade battery?

In the case of OXIS their battery has pretty poor volumetric energy density, so while it's light(about as dense as water) it takes too much space.

On the other hand the Eos's battery has great volumetric/gravimetric parameters, but poor power density - to the point where if you short-circuit it it's just going to seep current for four hours.

They were planning on putting these batteries in cars, but for that they would need at least a 100kWh unit which would still require a small li-ion buffer for short power bursts.

> However, last I heard about them, some corporation gave them free > scholarship in an elite university... and after that, full radio-silence. > Really makes me suspicous, you know. What the hell happens to these people? > Don't they still want to revolutionize the world as they claimed they wanted > to when they were teenagers?

Sometimes the research simply goes nowhere. Take for example the case of Sakti3 and Dyson. Dyson bought their business, because it looked promising, but after over a year of silence abandoned the patents that came with it. Apparently the chemistry simply wasn't viable for commercial use.

</comment></comment></comment></comment><comment><USER30> What is the energy density of a flow battery like this? It's hard to imagine it is anywhere near gasoline or a lithium ion battery.

<comment><USER24> Read the (currently) top post by Ars linking to the Wikipedia page.

There's a table of the currently known public chemistries near the bottom.

There are applications with better power density than Lithium based batteries (at the electrodes), but I don't know about how an overall solution would compare to a gasoline setup.

I think the only fair comparison in such a case would be to have a roughly standard car design and compare complete solutions (currently common petrol / diesel depending on vehicle size, hybrid (electric), full electric (batteries / 'flow batteries' of different types)).

</comment></comment><comment><USER31> meh, I care less about "instantly rechargable" as much as I do about "instantly recyclable"

* what is lifecycle of batt?

* cost (not $ cost, resource cost?)

* slave-made?

how much trans-national exploitation occurs to produce one such batt?

</comment><comment><USER32> They should run an ICO, get funded in minutes.

</comment><comment><USER33> Too bad the nifty techno-in-a-can synth diddling in the video drowns out the inventor talking about his technology.

</comment><comment><USER34> Oh look, another revolutionary battery technology.

<comment><USER35> Right. This is a flow battery/fuel cell; you change the liquids rather than recharging it in place. The new feature is that this doesn't use a membrane to separate the two liquids. They're immiscible and one is denser, so they stay separate, in layers. Why this doesn't short out at the liquid interface isn't clear.

There are commercial flow batteries that use membranes.[1] One uses zinc-iron. The energy storage capacity is limited only by tank capacity, so you can fill big tanks using solar power or wind and draw it out later. Typical system is 288 kW/960 kWh, and occupies 6 shipping containers.

[1] [https://www.viznenergy.com/product- gs200/](https://www.viznenergy.com/product-gs200/)

<comment><USER36> So they are pumped into the system in suspension and then settle into two layers?

I'm having visions of the battery liquid sloshing around while driving.

This seems neat, though I think often academics solve one problem in a lab and then imagine a whole string of other problems will easily be solved to get their product to market.

The guy said the biggest problem is "man power". I'm skeptical of this claim.

They haven't built anything other than a table top demo -- I'd of liked to see them build a unit that could power something significant. Stick one in a golf cart at least.

But neat and inspiring nonetheless.</comment></comment></comment>


Weak passwords brute forced - <AUTHOR> https://github.com/blog/1698-weak-passwords-brute-forced <comment><USER2> Considering that the code in a GitHub organization or in a repo with collaborators is only as safe as the weakest link in the chain of users that have access to it, it would be nice if the admin of that org/repo could set a policy that all members need to have 2-factor authentication activated before they get full access to the codebase. Enforcing strong and unique passwords is hard, but enforcing 2-factor is easy and the bump in added security is high. At least I would sleep better knowing that, for an attacker to access the codebase, brute forcing would not be possible.

<comment><USER3> Enforcing unique and strong passwords is not hard. We do it.

<comment><USER4> Unique across all other services the user has accounts at? If you did that it would be both creepy _and_ impressive. :)

<comment><USER3> We try to make sure it is by enforcing password expiry, no password reuse and complex passwords. We also have a massive shitlist of passwords from various leaks.

<comment><USER5> Because of which, your users probably write their password down on a post-it note stuck to their monitor...

<comment><USER6> That's a lot safer than using a weak password. I don't have a citation handy but security researchers often support writing down passwords to encourage using stronger and more frequently changed passwords.

<comment><USER5> That depends, if it's on a system that's accessible internally only, then it's likely not safer.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Good reminder to add 2FA via [https://github.com/settings/two_factor_authentication/config...](https://github.com/settings/two_factor_authentication/configure)

<comment><USER8> I think two-factor auth should be the new basic auth. Every site should provide it, either directly or through an integration with a trusted OAuth provider.

I'm waiting for the day that the security people work out a solid federated single-sign-on system that gains widespread adoption.

<comment><USER9> Shameless plug: to get alot of sites using 2FA in a standardized manor is exactly why I made GAuthify ([https://www.gauthify.com](https://www.gauthify.com))

</comment></comment></comment><comment><USER10> How is this possible? I would expect repeated failed login attempts would force a timer making a brute force attack impossible? Or at least more difficult. Is that not the case or am I missing a key piece of info? (Serious question, not trying to troll or be smug.)

<comment><USER11> From the blog post:

"While we aggressively rate-limit login attempts and passwords are stored properly, this incident has involved the use of nearly 40K unique IP addresses. These addresses were used to slowly brute force weak passwords or passwords used on multiple sites. We are working on additional rate-limiting measures to address this. "

<comment><USER12> Seems a bit excessive for a open source repo site.

<comment><USER13> Actually not. I'm the maintainer of a popular Open Source project that is hosted on Github. If someone stole my credentials, they could replace the current release with a binary containing a Trojan.

Looking at the security history page I see a lot of failed login attempts. Makes me glad I enabled 2-factor-authentication!

<comment><USER14> You put compiled files on github?

<comment><USER13> Github recently introduced a "Releases" section where you can tag releases and provide binaries: [https://github.com/PostgresApp/PostgresApp/releases](https://github.com/PostgresApp/PostgresApp/releases)

It's a great way to distribute Open Source software. (Previously Mattt hosted it on a personal Amazon S3 account which he paid out of his own pocket; now bandwidth is generously paid for by Github)

</comment></comment></comment></comment></comment></comment><comment><USER15> Interesting, my account's Security History shows a few failed login attempts in the last 3 days from Eastern Europe and Southeast Asia, and my account is not even popular.

<comment><USER16> A friend and I both showed 6 login attempts from unique IPs and neither one of us are very active. Seems like they hit a lot of people.

<comment><USER17> I've seen a small amount of suspicious activity (possibly 3 failed logins that weren't mine); I'm wondering how relevant various attributes of the username are. I'm starting to move to unique usernames for various services: not anything vastly secure, but something that's at least harder to automatically cross-reference. Does anyone know if using much longer usernames is a worthwhile investment?

</comment></comment></comment><comment><USER16> I wonder why Github didn't publicly post the details behind the attack -- namely, that is was an attempt to game a Ripple _(cryptocurrency)_ giveaway. They mentioned it in their "heads up Github user, your account was compromised" emails, apparently: [https://news.ycombinator.com/item?id=6766293](https://news.ycombinator.com/item?id=6766293)

<comment><USER18> That wasn't in my email.

</comment></comment><comment><USER18> The attack must have been done over Tor. My account was flagged and locked but it's not reasonable to say the password was cracked. However, I do my day-to- day browsing over Tor and the matching IP addresses caused a false positive.

Its worth mentioning, though, that the rate limiting is at the account level and not the IP level. When I was trying to get access to my account before the email was sent out, my account was locked and remained locked even after developing a new Tor circuit. How were the attackers able to circumvent the aggressive rate limiting? Three password attempts a minute is a generous estimate and it would take longer than the expected life of the universe to crack even a moderately secure password at that rate (my old password had 704 decillion permutations.) Perhaps some part of GitHub isn't being rate limited?

<comment><USER19> >> The attack must have been done over Tor.

Nope, none of the failed attempts on my account originate from a tor exit node.

<comment><USER18> I only have Tor logins recorded and nothing indicates that my account was compromised, so one of the exit nodes I used must also have been used by the attackers. I guess it doesn't necessarily mean that the entire attack was done over Tor. Perhaps a zombie in the botnet was running it. :)

</comment></comment></comment><comment><USER20> If these attackers had tried targeted brute-force on some limited accounts, they might have been successful without tripping over the GitHub security team. Nonetheless, kudos to GitHub for handling this perfectly.

</comment><comment><USER16> Wow, ~40,000 unique IP addresses were used to circumvent rate-limiting.

Thankfully that even with that many unique IPs and presumably a few tries per IP, you still only have enough tries to crack _weak_ passwords.

</comment><comment><USER21> I'd love to know just how weak "weak" is. Something like [A-Za-z0-9]+ and <= 6 characters, or [a-z]+ and <= 8 characters?

<comment><USER22> Here, it is weak as in "password", "qwerty" or "{your Lifehacker leaked password}"

<comment><USER23> my password was \w{6}\d{2} and it was compromised.

<comment> mh- was the \w{6} _github_?

<comment><USER23> LOL, luckily it was not. It wasn't a dictionary word.

</comment></comment></comment></comment></comment><comment><USER24> I'm very impressed by GitHub's response - what a prime example of how you should handle an intrusion attempt! 11/10 for style from an IT governance and disclosure point of view. They've successfully: identified the nature of the attack, notified customers in a polite manner, publicly disclosed the goings on, and exercised added paranoia (which in this case == security) by disabling related accounts. Kudos! The only thing they missed is disclosing that they're working with local law enforcement - something I'd presume they're doing.

More interesting is the attempt. I frequently scan customer systems on their behalf, by spinning up clouds of resources to hammer their login APIs. By using Digital Ocean $0.05/hour boxes, and massive threading, tests tend to cost me ~$50/hour (yes, that's 1000 boxes orchestrated).

Given the real world cost of cloud computing, and the ease of libraries such as libCloud (or ruby's: FOG), the cost of doing this in terms of time and real money has dropped dramatically.

</comment><comment><USER25> I wish the weak password blacklist was public, so we can all implement password check like this easily, and maybe get rid of them forever (even if banning "chicken" as password is only a way to have "egg" popping up).

</comment><comment><USER26> Looking at my security log, it looks like they gained access over two weeks ago. No failed login attempts, just a successful login. No brute-forcing about it.

oauth_access.create: GitHub XRP Giveaway - 16 days ago

user.login: Originated from 22.214.171.124 - 16 days ago

</comment><comment><USER27> _Only allow logins from country /continent: X_

With a feature like that, if an IP address from country C attempts to log in to accounts of users in separate countries A and B, they are quickly spotted.

<comment><USER28> Gmail does something a bit more sophisticated than this but it's a real pain trying to check your mail from the airport in another country when your phone doesn't work either to confirm that way. Also annoying for VPN users who may appear to be in another country.

</comment></comment><comment><USER16> What was the purpose? Were the repositories private? Was the attack targeted toward known accounts working on new projects -- i.e., industrial espionage?

<comment><USER29> I'm going to guess it was simple spray-and-pray. (My account took its fair share of compromise attempts, too, probably because I use the same username everywhere so it's going to be in many modern dev-heavy password dumps.)

Github is, for better or worse, a high-value target these days. Compromise of a Github account will often get you credentials which you can use to compromise high-value targets, for example production machines.

(Example from the Rails world: if someone gets read access to your git repository, expect them to figure out your secret token which you use for HMACing sessions to prevent forgery. If an attacker can forge sessions, they have remote code execution on your production servers. You can assume they will go directly from code execution to root on those servers, and from root on those servers to a systemic compromise of your entire network (if they want to do that).)

Use your imagination on what a mass compromise of accounts gets you. The simplest possible example is grepping for /bitcoin/, finding the full source code and credentials for a Bitcoin exchange, and rooting them then emptying the hot wallet. That results in fairly obvious economic advantage, right? You could also use scriptable attacks to root thousands of big-n-beefy production machines on fairly trusted IP addresses, then add them to a botnet, which you'd use for spamming or various other nefarious activities.

Then, even farther down the list, you have a dedicated adversary actually go through every repository they got access to and look for something uniquely fun to do with that particular target.

If you were looking to do industrial espionage on a particular target, you'd probably pick a way that was less likely to be detected and cause a company- level security response. (Use passive recon to identify one or a few likely target email addresses, find one or a few likely passwords for them, and try them first. Heads you win, tails you just left evidence in a log of _perfectly normal user behavior_. You might follow up this perfectly normal user behavior with a social engineering attack.)

<comment><USER30> Is there a setting I can change to turn off this "session -> code execution" feature?

<comment><USER29> You could, hypothetically, move from CookieStore to a different session store, but I am not positive that this will mitigate the vulnerability (by making it more difficult for the attacker to get write access to the session, not by making it more difficult to turn a session into code execution), and do not have a few hours to reacquaint myself with the code to give you a firmer answer there.

I am weakly confident, on the basis of some spelunking in the Rails internals in February, that if you get attacker chosen data into the session you're uniformly hosed on (at least) Rails 2 and Rails 3.

<comment><USER31> _if you get attacker chosen data into the session you 're uniformly hosed on (at least) Rails 2 and Rails 3._

I wonder if you could expand on this? I'm not too knowledgeable about Rails or security, so I'd wonder how that works?

<comment><USER29> Long story short: If a cookie is valid (HMAC signature matches what you'd expect given the cookie contents and your secret key), Rails (Rails 2) or Rack middleware (Rails 3) will attempt to use Marshal.load(txt) on the cookie contents to populate your session hash. You might naively assume that this creates a map of strings into other strings, but surprise, Marshal.load(txt) can create arbitrary object payloads and, through a code path which the margins of this comment are just slightly too thin to contain, allow you to do remote code execution.

See: [http://www.exploit-db.com/exploits/27527/](http://www.exploit- db.com/exploits/27527/)

This can be done in an entirely automated fashion and requires no knowledge of the application other than the session's secret key.

</comment></comment></comment></comment></comment></comment><comment><USER32> This reminds me the #1 tip of web development: Never trust the user. I can't imagine there is a person out there who has all the time in the world to brute force accounts with common phrases with 40,000 proxies (or whatever). Seriously, is there anything worth gaining if you get hold of even say 100s of accounts.

<comment><USER16> Well, first of all, it's very likely they used a botnet and some automated attack software. Secondly, there was a financial incentive[1] -- my back-of- the-napkin calculation was ~$15-25 per compromised account. That of course is ignoring secondary values like API keys, reused passwords allowing access to accounts on other sites, etc.

[1]: [https://news.ycombinator.com/item?id=6766293](https://news.ycombinator.com/item?id=6766293)

</comment></comment><comment><USER33> > This is a security log of important events involving your account.

> 18 hours ago user.failed_login: Originated from 220.127.116.11 (Istanbul)

> 3 days ago user.failed_login: Originated from 18.104.22.168 (Indonesia)

> 3 days ago user.failed_login: Originated from 18.104.22.168 (China)

Is this a distributed brute force attack against my account?

<comment><USER34> I see similar a thing; I'd guess that they just tried a few common passwords against millions of accounts, rather than targeting some specific accounts.

</comment></comment><comment><USER35> Had five attempts over the last 2 days, four from Venezuela and one from Bangladesh. All unique IPs.

<comment><USER36> Same here. 5 attempts over the last 2 days all from unique IPs. Four from Venezuela and one from Beijing.

</comment></comment><comment><USER37> Along with 2-factor auth, what about the option to block all IPs from outside of a certain country (if you live/work in the US, only allow US logins).

This obviously won't work for everyone, but might prevent a decent amount of brute force successes.

<comment><USER38> Facebook detects this when you move countries and makes you do a quiz about your friends pictures - though it can be pretty annoying [though I haven't seen it recently so maybe they've stopped].

<comment><USER39> I just dealt with this today with my own account using a proxy, quite a clever security approach IMHO

</comment></comment></comment><comment><USER40> Logging into my account, I can see quite a few failed attempts from a variety of IP addresses. All of them are from the same ISP in Venezuela. Quite scary, but my password is 40+ characters long and I have 2FA enabled. How weird!

</comment><comment><USER41> Single failed login attempt from china. Though could this be any way related to the adobe leak? If you have the list of emails and password, you could try a bunch of commonly used services and see if that works.

<comment><USER42> GitHub do say in their post:

> _These addresses were used to slowly brute force weak passwords or passwords > used on multiple sites._

..."multiple sites" could possibly refer to a compromised list, like Adobe? Of course, it doesn't have to be Adobe - Macrumors was compromised recently, etc etc.

</comment></comment><comment><USER43> Can Fail2ban [http://www.fail2ban.org](http://www.fail2ban.org) help in this case?

<comment><USER44> Not really. Some ISP provide same external IP to multiple users and you have to take that into account. I think otherwise a good part of github's users would never be able to access it.

</comment></comment><comment><USER45> Just show captcha randomly on login, with the frequency proportional to login failure rate for an account.

</comment><comment><USER46> ripple.. you bastard,.

<comment><USER16> It wasn't Ripple, it was someone trying to game their giveaway: [https://news.ycombinator.com/item?id=6766293](https://news.ycombinator.com/item?id=6766293)</comment></comment>


SpaceX Webcast of Falcon 9 DSCOVR Launch - <AUTHOR> http://www.spacex.com/webcast/?dscovr <comment><USER2> Elon Musk tweet: [https://twitter.com/elonmusk/status/564562686478807043](https://twitter.com/elonmusk/status/564562686478807043)

"Air Force tracking radar went down. Launch postponed to same time tomorrow."

</comment><comment><USER3> The next possible launch window is three minutes earlier tomorrow. (6:07 PM ET)

EDIT: The big problem was the air forces radar going down, a transmitter went down as well, but if I understand Musk correctly that was not needed.

</comment><comment><USER4> Reddit discussion thread: [https://www.reddit.com/r/spacex/comments/2uuskl/rspacex_dsco...](https://www.reddit.com/r/spacex/comments/2uuskl/rspacex_dscovr_official_launch_discussion_updates/)

</comment><comment><USER5> Via the live stream: There's an instantaneous launch window they have to meet which only happens once per day. This is necessary for the satellite to reach its destination at the L1 point[1]. They could try again this time tomorrow, though weather doesn't look as good, and then Tuesday or Wednesday.

[1] [http://en.wikipedia.org/wiki/Lagrangian_point#mediaviewer/Fi...](http://en.wikipedia.org/wiki/Lagrangian_point#mediaviewer/File:Lagrange_points2.svg)

<comment><USER4> After Wednesday, Feb. 20th is the next window available.

</comment></comment><comment><USER6> Aborted on avionics problems. :(

</comment><comment><USER7> Aborted due to range radar issues and stage 1 avi issues.

</comment><comment><USER8> Does anyone here work for SpaceX? What's it like?

<comment><USER9> I have a buddy that works there. It seems pretty grueling, but also crazy awesome. He's recently worked a few 14+ hour days and is occasionally up at 2AM for work. But when he's up at 2AM it's to go launch a rocket. So there's that.</comment></comment>


A Complete Formal Semantics of x86-64 User-Level Instruction Set Architecture - <AUTHOR> http://fsl.cs.illinois.edu/index.php/A_Complete_Formal_Semantics_of_x86-64_User-Level_Instruction_Set_Architecture <comment><USER2> > Like closely related previous work [33, 37], we omit the relaxed memory > model of x86-64 and thus the concurrency- related operations.

Bummer

<comment><USER3> For the memory model you can take a look at some of the best research in the subfield:

[https://www.cl.cam.ac.uk/~pes20/weakmemory/index3.html](https://www.cl.cam.ac.uk/~pes20/weakmemory/index3.html)

</comment></comment><comment><USER4> Does anybody know what .k files are? I see them in the repo but haven't seen them before.

And for reference (from the page), their repo is here... but their file names contain colons, and hence can't be checked out on Windows: [https://github.com/sdasgup3/binary- decompilation](https://github.com/sdasgup3/binary-decompilation)

<comment><USER5> They're specifications in the K Framework, developed by the same group of folks: [http://www.kframework.org/index.php/Main_Page](http://www.kframework.org/index.php/Main_Page)

<comment><USER4> Thank you!

</comment></comment></comment><comment><USER6> I wonder if these formalism can be machine-translated into a form that Valgrind can use. IIRC, Valgrind is currently limited to pretty old x86 ISAs.

<comment><USER7> Valgrind does add support for newer instruction set extensions (for instance the latest release two weeks ago added the RDRAND and F16C instruction set extensions). It would probably be less work to just directly add Valgrind support for anything that's still missing, rather than try to implement a converter from this formalism. That might make sense if this was an official Intel thing and you could reasonably expect updates for future instruction set extensions (so effort now could be amortized in future), but as a third party academic thing that seems less likely to happen. You'd also need to clarify the licensing -- I couldn't see any license notice in a quick pass over the github repo. Last but not least, Valgrind cares about performance, and an automatic translation of a formal spec is going to be a lot slower than a hand-written implementation, especially for SIMD instructions (where V tries to use SIMD insns in its output generated code for SIMD input code, AIUI).

</comment></comment><comment><USER8> It would be interesting to compare this to "A Formal Description of System/360" by Falkoff and Iverson[1], using APL as the notation language, from 1964.

Sadly it is pay-walled by the IEEE.

[https://ieeexplore.ieee.org/document/5388512](https://ieeexplore.ieee.org/document/5388512)

<comment><USER9> The 360 ISA is a lot smaller than x86_64.

[https://www.cs.trinity.edu/~jhowland/class.files.cs2321.html...](https://www.cs.trinity.edu/~jhowland/class.files.cs2321.html/falkoff.pdf)

<comment><USER8> Oh! That's the IBM Journal article! Hah, suck on that, IEEE.

Also, note, the formal description is claimed to be executable code (by an APL interpreter).

</comment></comment></comment><comment><USER10> It's weird that the user manual isn't this to begin with.

<comment><USER9> Not really.

The 3439 page _Intel® 64 and IA-32 Architectures Software Developer's Manual_ is a _specification_. It just isn't a _formal specification_ suitable for use in proving properties of programs. ARM on the other hand, released a machine readable architecture specification for ARMv8 but that architecture isn't as old or as large as x86_64. Nor is Intel/AMD in the business of selling architecture licenses where having a machine readable architecture specification would be useful for verifying implementations and proving properties. Indeed they're kind of in the business of preventing that from happening.

[https://alastairreid.github.io/ARM-v8a-xml- release/](https://alastairreid.github.io/ARM-v8a-xml-release/)

<comment><USER11> Also, if the specification is _too formal_ , no one besides academics would understand it and thus it would pretty useless as practical documentation.

<comment><USER12> Right.

Also, sometimes you want to leave things undefined. This killed the attempt to create a formal specification for ECMAScript 4 back in the day. For example, it was hard to formally specify things like "Array.sort calls the sorting order callback in such a way as to make the array sorted" without mandating a particular sorting algorithm.

<comment><USER13> Maybe formal specification could have been done for the language but not for the standard library.

Note that formal specification of ECMAScript 5 does exist (JSCert), although it is not de jure and it does not handle the standard library.

</comment></comment></comment></comment></comment><comment><USER14> Can this be compiled into an emulator?

<comment><USER13> The semantics is executable but for an emulator you probably want something more efficient. I don't know whether K semantics can be "compiled", so to speak. It probably can with enough effort?

<comment><USER15> They can; Grigore was my advisor in college and I've seen him demo exactly that.

</comment></comment></comment><comment><USER16> That's some work! How can it get used? Verifying compilers? OSs?

<comment><USER13> As the title says this is user-level, so can't be used to verify OS.

<comment><USER16> Almost all of the code in an os are the same instructions we use everywhere else. That can be verified to function as intended.</comment></comment></comment>


Hives and What They Mean - <AUTHOR> https://medium.com/@arjunsethi/the-hive-is-the-new-network-260b432a6720 <comment><USER2> This is interesting. Ty

<comment><AUTHOR> I enjoyed the article. Your welcome friend.</comment></comment>


A Sparkline Map of Covid-19 - <AUTHOR> https://datagistips.hypotheses.org/488 <comment><AUTHOR> I was thinking that spark lines could give an idea of the increase in Covid19 cases per country in the Wikipedia overview.

Which countries have increasing numbers of cases, which are static, but I found this rather imaginative visualisation for France.

Has anyone found, or made, use of sparklines to embed timeseries information?

<comment><USER2> Check out the table here: [https://ecnmst.gitlab.io/covid19](https://ecnmst.gitlab.io/covid19)

<comment><AUTHOR> Thanks, that's just the thing.</comment></comment></comment>


One more employee from Foxconn falls off building and dies - <AUTHOR> http://news.xinhuanet.com/english2010/china/2010-05/15/c_13295848.htm

<comment><USER2> To be fair, Foxconn employs over 300,000 workers in Shenzen. Yes, really -- they are the world's largest electronics manufacturer. To put that in perspective, that's more than two Shenzen Foxconn employees for every living MIT alumnus. Three hundred thousand. That's a _lot_ of people.

What has made these stories news is the suicide last July of a Foxconn employee who lost a prototype iPhone. However, suicides since then have not all been further results of product security breaches. Again, it's not entirely unexpected when you're talking about _three hundred thousand people_ in close quarters that there will be some suicide, drama, criminality and perhaps even murder within that population. It's probably doing better by many measures than most cities of that size in the region.

<comment><USER3> In 1999 the suicide rate in China was 13 per 100,000 so my suspicion is that this story has only been up-voted for mud-slinging purposes. I'm a bit disappointed to see it on the front page — it doesn't strike me as being Hacker News.

<comment><USER4> Without these 2 pieces of data from zach and you (which were not present in the article), it does look like news.

</comment></comment></comment><comment><USER5> This is a baby step away from Onion level.

"In the employee's pocket was a short suicide note with the wrong date. It read 'I am so sad I decided to jump off the building. Oh and I may or may not have decided to cut myself with a knife, too. Goodbye cruel world.'

Mysteriously, the employee spelled his own name wrong in the note.

Police are still investigating if this was a suicide."

<comment><USER6> If working conditions have improved since the suicides started making the news, other employees may have manufactured another suicide hoping that conditions will improve further.

</comment></comment><comment><USER7> A few weeks ago I heard a live presentation by IT workers in Mexiko building smart phones, and what they told was not really nice. Employers paying sublegal salaries, harassment etc. Consumers should care about that but they (I also - mostly because of missing information) don't. It's not helping that an electronic product has hundred of different components in it, and all end manufacturers share the same few manufacturers. The current "solution" is to advise cities, governments and companies about fair(er) products so that these can put more pressure on the end vendor to control the manufacturing work conditions. We've still a long way to go.

</comment><comment><USER8> they need to fix that roof

<comment><AUTHOR> sure looks like it:

"It is the ninth fall by Foxconn employees in five months."

<comment><USER9> Add to that

 _A blood-stained dagger was found with Liang and his body sustained several knife cuts._

So he stabbed himself and then threw his body off the ledge?

<comment><USER10> They didn't say what kind of cuts, and the "dagger" might be an awkward translation. Maybe they just meant he cut his wrists.

Unlikely, but not impossible.

</comment></comment></comment></comment><comment><USER11> _"Foxconn felt sorry over the death," he said._

Is it just me or is there very little emotion translated over with this quote?

<comment><USER12> This confuses me. What are they supposed to be saying? As a non-native speaker, I have no idea what you mean.

Do you criticize the writing of the article (ie it not being colorful enough)?

<comment><USER13> In English, that would be the wrong way to express one's sorrow over the death. but it's a translation, so our cultural details are irrelevant.

<comment><USER12> What would be the right way to say it in English?

<comment><USER10> For the situation at hand, probably something like "It is with regret that we learn about the passing of Mr. Liang. We will keep his family and associates in our thoughts." Add "and prayers" if in USA.

It means the same thing, it just sounds slightly more appropriate for a corporation in 2010.

Disclaimer: I'm not quite native either.

</comment></comment></comment></comment></comment><comment><USER14> I'm more interested in the 'blood stained dagger'

Hopefully it is just a bad translation</comment>


Amsterdam Introduces Contactless Payment Jackets for Beggars - <AUTHOR> http://www.odditycentral.com/news/amsterdam-introduces-contactless-payment-jackets-for-beggars.html <comment><USER2> Are beggars more polite in Amsterdam? I would have a hard time willingly taking out a card and holding it right next to a homeless person. It's just asking to get swiped.

Infact, one of the main reasons I hear against giving money is that people are afraid that their wallet will get stolen when they are getting a dollar out.

<comment><AUTHOR> I was thinking the same thing. This 'cashless society' is going a little too far, if you ask me.</comment></comment>


In which I resurrect a 13 yo 3.5" floppy disk and reprint my doctoral thesis  - <AUTHOR> http://www.jgc.org/blog/2009/08/in-which-i-resurrect-13-year-old-35.html

<comment><USER2> I recently was compiling my old stories (I've written fiction since I was 7), to go in a book. Some of the stories were typed or printed in a courier font, and I either used OCR software or typed it in by hand.

Some were on a hard drive backup (from a 286 PC with Wordperfect 5.1) from 1996.

The most bizarre thing, though, was stories I'd sent to friends over email, and then lost the original files somehow. I was able to run a search and find 4 (!) stories like this, in my email archive.

Sadly, in 1999 I broke a C64 disk which contained a few little bits of stories, so in this case, the paper outlasted the magnetic.

But now I have a 794-page hardback book (acid-free paper I think) of stories to put somewhere safe.

<comment><USER3> I appreciate this is off-topic, but I've thought of doing the same thing for the same reason. May I ask where you found that was willing to do a high- quality one-off hard-bound print? I know of several storefronts that do either large runs, or only do paperback; just not one-off hard-bound editions.

<comment><USER2> Lulu.com. A one-off 794 page volume costs £20 a copy and postage (though irrelevant when ordering in bulk) is about £6. It scales in that 794 pages costs little more than 250, except the limit is 800 (a paperback's limit is I think 500)

The hardback has a colour dust jacket which goes right round the book and with inside flaps, and quite classy: there is gold lettering on the hardback itself! It looks like a 'real' book.

As for acid-free, I'm not 100% sure, but a book I printed a year ago isn't going brown.

</comment></comment></comment><comment><USER4> In 20 years: "In which I attempt to remember my Google Docs account and reprint my doctoral thesis"

<comment><USER5> I wonder if Google Docs will still be around & accessible in 20 years.

</comment></comment><comment><USER6> Congratulations! :)

I was wondering how it turned out. No problems at all then. Did you verify the whole floppy or just those files ?

Nearer the hub they tend to get harder to read.

<comment><USER7> I'd guess everything worked fine, as he was able to unzip the single zip file on the floppy.

<comment><AUTHOR> Yes, the ZIP file was perfectly intact and there was nothing else on the floppy. It's worth noting the size of the ZIP file: it took up almost the entire disk.

<comment><USER8> I'm just curious, but what did the README files contain? You seem to be really organized!

<comment><AUTHOR> If you look at the screenshot in the blog post you can see a couple of them. The top level one described briefly what the ZIP file contained and then further down there were files given information about the subdirectories and things like the file extensions used.

In one directory there was a file describing how I had compressed the SunOS file names into 8.5 DOS names. Pretty important because the LaTeX files referenced the long names.

There was also an interesting file called MACROS. It contained a note saying that it was meant to be a symlink to a different directory (also called MACROS) but since DOS didn't support symlinks...

</comment></comment></comment></comment></comment><comment><USER9> I've done this with 20 year old C64 floppies, and most of them worked fine. There were some intermittent errors, but it's hard to say if that was the floppies or the notoriously finicky floppy drives.

</comment><comment><USER10> So you think you found a good reason to show us your cv and your thesis ....</comment>


Introducing smap.js, a forward polyfill for ES6 Maps - <AUTHOR> http://www.eriwen.com/javascript/introducing-smap-dot-js/

<comment><USER2> I have quite a few questions about this implementation, but here are two bigger ones:

1\. Why are constructed Maps here having delete, get, has, set, size, keys, values, and iterate added outside of the prototype? I guess I don't see why you wouldn't just put these on the prototype. That said, .call seems to be unnecessary in a lot of this code.

2\. Why isn't there any attempt to make lookups for primitives faster. It's all O(n).

</comment><comment><USER3> For anyone confused, like me, about what a _forward polyfill_ is, here's an explanation:

<http://www.jonathantneal.com/blog/polyfills-and-prototypes/>

</comment><comment><USER4>
        var NULL = null, TRUE = true, FALSE = false

I'm not sure I understand this. Why assign these to variables?

<comment><USER5> I think the reason for these is for js minification. With these assignments a simple minifier will replace those three variables with a line like this:

        var a=null,b=true,c=false;

Then your minified js will be smaller because all other instances of true, false and null will be one character. Whether or not this is a reasonable optimization is debatable but in terms of pure code size it would be a win.

<comment><USER6> Couldn't you build it into the minifier rather than polluting the original source?

<comment><USER7> Yes, stuff like this shouldn't be in the source. UglifyJS and Closure compiler make this optimization, but I've used other js minifiers that did not.</comment></comment></comment></comment>


Ask HN: My 19 year old friend has cancer. How can I help him?  - <AUTHOR> Hello HN,
Very unfortunately my friend and neighbour who is just 19 years old has colorectal cancer. He was undergoing radiation therapy but his chance of survival has dropped from 90% to 35% after his tumors got infected. His doctors (in the Netherlands) say that they will try more radiation and chemotherapy but with the 35% chance of survival that his doctors told him recently he seems to have lost some hope. I was wondering if there are any options that we are not looking at.
He is a very bright kid who has the potential to be a great hacker :) HN, tell me how we can hack his chances of survival. <comment><USER2> I'm sorry to hear about your friend.

I had a bone marrow transplant as a teenager, currently 26 years post op. Those days, BMTs were still very early research. Mortality was 90%.

My primary oncologist at the time told me: People are not statistics.

Your first job as friend, patient advocate, care giver, or whatever other role you wish, is to leave your issues at the door. Your friend needs all their energy towards staying alive. They don't need anyone else's problems, issues, negativity, doubts, whatever.

Your second job is to not take away hope. No matter what the situation. It's the doctor's job to deliver the bad news. Your job is to suspend disbelief and always be supportive.

After my treatment, I volunteered for many years, visiting patients, helping out, etc. I've also had patients live with me while they're in town for treatment. Nothing as extreme or taxing as hospice care, but also not a cake walk. And I don't volunteer when my head's not straight, knowing I'm not able to do the two jobs above.

Lastly, sometimes your job is to help the family, more than the patient. Sometimes the patient has accepted their fate, is in a ICU/coma/whatever, and they're doing fine mentally and emotionally whereas the family now has to struggle with their grief.

Best wishes. You're a good friend to your neighbor.

<comment><AUTHOR> Thanks a lot :)

</comment></comment><comment><USER3> My father died a couple of years ago from an upper GI cancer that went metastatic. Three things he said to me:

1\. Write down your worries and regrets and fix them. If you lose, it's good. If you win, it's awesome.

2\. Don't trust any non-medical woo. Science and medicine is your best shot at this.

3\. Get outside as much as possible. He said this helped him live another 3 months

That was about it. He didn't discuss percentages, hope, religion or any of that stuff.

<comment><USER4> Regarding "get outside": take a look at the abstract for the study "Beneficial effects of sun exposure on cancer mortality". It starts with "For more than 50 years, there has been documentation in the medical literature suggesting that regular sun exposure is associated with substantial decreases in death rates from certain cancers and a decrease in overall cancer death rates". [http://www.ncbi.nlm.nih.gov/pubmed/8475009](http://www.ncbi.nlm.nih.gov/pubmed/8475009)

<comment><USER5> thanks for the link. Do you know how much exposure is too much, in terms of developing skin cancer?

<comment><USER6> I have a friend doing research on this. I should caution that you should in no way take this as medical advice, as there are not yet any results, but the current hypothesis is that one's risk of getting melanoma (the main skin cancer that is truly dangerous) is actually less related to how long you stay in the sun and instead more related to whether your sun exposure is consistent (each day) or intermittent (you only go out in the sun a couple of non- consecutive days a week). If this hypothesis is correct, consistent sun exposure is significantly safer than intermittent sun exposure.

If you would like, I can provide links to papers that support this hypothesis.

<comment><USER5> I asked because I just started supplementing with vitamin D and forcing myself to get 15 minutes of direct sun exposure every morning since I started working/exercising indoors at home and rarely venturing outside during the work week.

That is something I would like to look into and appreciate a link if not a hassle. That hypothesis could change how I go about my daily exposure. How much exposure do you get if you don't mind me asking?

</comment></comment></comment></comment></comment><comment><USER7> Sorry nodemaker. This reminds me of a blog post I have that's a long time coming. (kinda painful to face).

My Dad passed away a year and a few weeks ago of Lung Cancer. I am furious that his pain doc didn't warn us that the day he started taking the heavy drugs, might be the last lucid day in his life.

We never got a chance to find out his final wishes.

35% is much better chance than my Dad was given, so I hope he pulls through and it's super important that he embraces the 35% like it's 100%.

But if it goes downhill, make sure before the pain meds are given, that last wishes are discussed. It's difficult to discuss, but don't be shy about it. Discuss it as a "just in case" scenario.

Also, @bananas' Dad was very wise. Listen to his advice.

<comment><AUTHOR> Thanks! Yeah I will make sure we get the last wishes down in case it goes downhill.

</comment></comment><comment><USER8> Radiation oncologist here. It's impossible for me to say much, but his drop in estimated survival rate is probably not strictly related to his tumor being infected. However, he probably has some sort of genetic predisposition to have cancer at such a young age, which can also have an impact on survival. That being said, a few things to keep in mind: survival estimates are notoriously bad. Moreover, oncologists tend to do a poor job of communicating those estimates. 35% chances of being alive in 2 years? in 5 years? alive but living with "active" cancer? Very important points.

A reasonable thing to do would be to ask his oncologist "if there are any other options he could think of". It's simple, but usually it forces us to reconsider the problem from scratch. I must warn you though that in a 19 y.o., we (oncologists) usually think very hard and rarely leave any stone unturned.

From experience, the best a friend can do is simply be there and "act normal" ie don't overdo it. No need to do anything special.

Good luck -- sometimes luck is all it takes

<comment><AUTHOR> Yes he does have a genetic condition called Lynch Syndrome that makes him predisposed to colorectal cancer. Thanks I will tell him to ask (or ask myself if possible) the oncologist for any possible options.

</comment></comment><comment><USER9> 1) Just sit with him. Listen. That is a tremendous gift.

2) Tell him to pay no attention to "chances of survival."

3) Ask him to work closely with physician(s). Have him write down his questions before he goes in for his visits. Get answers to his questions. Don't be afraid to get second and third opinions.

4) Don't worry alone.

5) Ask about enrollment in clinical trials. His current treatment can often continue and he may be eligible for new treatments. The field is moving very quickly at this time.

<comment><USER2> _Have him write down his questions before he goes in for his visits. Get answers to his questions._

Excellent advice.

From my reading and personal experience, having a patient advocate significantly improves patient outcomes.

When I'm volunteering, and the patient wants my help, I first capture all the questions, I act as secretary during the doctor's visit (making sure every question is asked, capturing all the answers), and then I review the notes with the patient afterwards.

Doctors visits are extremely stressful for most patients. And they're medicated. So lots of details would otherwise get lost.

</comment></comment><comment><USER10> If he's of a scientific or mathematical bent, he might find this an interesting read: [http://www.nytimes.com/2014/01/25/opinion/sunday/how-long- ha...](http://www.nytimes.com/2014/01/25/opinion/sunday/how-long-have-i-got- left.html?_r=1) .

It could also be worth pointing out to him that although survival probabilities are useful measures when applied to large or even moderately- sized populations, they aren't necessarily that useful in trying to predict the outcome of a single event. "90% probability of survival" didn't mean that your friend was going to live, and "35% chance of survival" doesn't mean that he is going to die. What is certain, however, is that he is not done yet.

<comment><AUTHOR> Thanks :) I will send him the article.

</comment></comment><comment><USER11> maybe he'd just like being made to laugh, somehow? i mean - be nice to him, love him.

when you are ill, there are times when you are angry and want to fight. and then a friend with ideas on what else to try is useful. but there are also times when you're just tired of the whole shitty thing, when you just want a break, and then a different kind of friendship is needed.

good luck to both of you.

<comment><AUTHOR> Yes sometimes I forget this in trying to get him to try new things but I will keep this in mind. Thanks!

</comment></comment><comment><USER12> As a friend, you can't do much to affect his chances of survival. You will have to leave that to the doctors. But you can make the rest of his life happier. Spend lots of time with him and take the initiative to start activities. Make him feel loved.

</comment><comment><USER13> Given that cancer cells are fueled by glucose (i.e., sugar metabolism), you might read up a bit on carb-restricted diets:

[http://www.proteinpower.com/drmike/ketones-and- ketosis/carbo...](http://www.proteinpower.com/drmike/ketones-and- ketosis/carbohydrates-are-addictive/)

"Since cancers can't really get nourishment from anything but glucose, it stands to reason that cutting off this supply would, at the very least, slow down tumor growth, especially in aggressive, fast-growing cancers requiring a lot of glucose to fuel their rapid growth. Thomas Seyfried [showed] that ketogenic diets in animals and humans can stop malignant brain tumors."

<comment><USER14> Please, please do not suggest treatments for your friend, especially those suggested by people on the internet.

People on the internet may mean well and show you interesting things, but your friend's medical care is best managed by his oncologist/primary care physician. Interfering with their work will likely do more harm than good.

Definitely encourage your friend to ask any and all questions about his care; communication between doctors and patients is helpful for everyone involved.

Self-medication, whether by diet or drugs, is a terrible idea. People die doing this.

<comment><USER8> agree with spartango. Cancer is extremely complex and any simplistic approach is BS (or a money grab). Staying away from the internet and asking questions directly to the oncologist is usually the best thing to do.

</comment></comment></comment><comment><USER15> I don't know if there's anything you can do, except for giving him comfort and maybe pointing him to resources.

As a cancer patient myself (although my prognosis was way better than his and I seem to be recovering just fine after 2 years in remission) I'd tell him to be careful about the way he reads the '35% survival' number. In most cancer studies the groups are defined by the _stage_ of the cancer, which means all patients with, say, 'testicular cancer, non-seminoma stage IIIc (bulky)' will get put together in the same group, independent of age, physical condition, access to excellence centers, psychological conditions, etc. But obviously a healthy 19 year old with a supportive family, access to good doctors and a strong will to live will fare much better than a 60 year old with a compromised immune system and a late diagnosis. That's not even accounting for selection bias (certain cancers happen mostly to people in a certain age range, say 45-60, or 15-30 in the case of testicular cancer) so the average survival rate is _even more_ skewed.

In other words, if he was healthy before the cancer and keeps his morale up, he's got a _great_ chance to be in the 35%! Tell him not to despair. Chemo is a bitch, getting an infection while neutropenic is no joke (I got two pneumonias in a period of 3 months, _worst pain ever_ ) and there's every reason to feel like shit. But once it's over, it's like having a new chance at life and it gives you a completely different perspective.

Please feel free to PM me.

</comment><comment><USER16> Try and contact Prof. Zaenker at Witten/Herdecke University. [http://www.uni- wh.de/university/staff/details/show/Employee/...](http://www.uni- wh.de/university/staff/details/show/Employee/zaenker/) He is one of the world's foremost immunologists and spent decades in experimental oncology. He was most helpful for me in the past and at least is very outspoken when it comes to the chances of a recovery.

<comment><AUTHOR> Thanks a lot! I will send him an email. Could I by any chance use your reference?

<comment><USER16> You certainly can, he may not remember me though. Last time we were in touch is 15 years ago. I was in London and asked his advice for 2 year old twins with Leukemia. They have since recovered and are both healthy.

</comment></comment></comment><comment><USER17> [http://c.gg/anita](http://c.gg/anita)

She went into coma after 4 year long battle with cancer as her body started to shutdown. She stayed in coma for more than a day. Then she woke up from coma and completely healed herself within weeks, leaving no traces of cancer in her body.

She understood the true causes of her cancer and how true healing occurs. She explains it all in her interviews.

Hopefully it will help to get a new perspective.

</comment><comment><USER18> For whatever it's worth... both myself and wife are cancer survivors. We are both cancer free past the most likely period of recurrence. Basically the best outcome one can hope for in these situations.

My advice to your friend and you: find things to take back control. The helplessness and lack of control as a patient are the tip of a downward spiral that is hard to escape.

To that end I recommend these two books that have helped me personally:

[http://www.amazon.com/Foods-Fight-Cancer-Essential- prevent/d...](http://www.amazon.com/Foods-Fight-Cancer-Essential- prevent/dp/0756628679/ref=sr_1_1?s=books&ie=UTF8&qid=1394500880&sr=1-1&keywords=foods+that+fight+cancer)

[http://www.amazon.com/Anticancer-A-New-Way- Life/dp/067002164...](http://www.amazon.com/Anticancer-A-New-Way- Life/dp/0670021644)

Oh and ignore the stats. Mine were very good, my wife's were really poor. Cancer is a very individualistic disease and battle. No two cases are exactly alike. We are both alive, don't let him lose hope.

</comment><comment><USER19> I don't know how to hack his chances of survival but i would start to make the time he has left really nice and good. If he has programming skills why not start a project/hackathon maybe some ctf's or a game so you can just hang out and brainstorm on an idea. How about a little lan party with his best friends. Or start some tv show e.g Lost. Good luck.

</comment><comment><USER20> One thing I learned from the experience of losing a family member to cancer is that doctors aren't all that smart or careful oftentimes. I encourage you and your friend to learn as much as possible, and get a variety of opinions. Stay away from pseudoscience, but don't assume doctors have thought of everything or are up to date on the science. Wikipedia and Google Scholar are good places to start.

</comment><comment><USER21> Do some research on intermittent fasting. There have been studies that suggest that it can improve the effectiveness of chemo and other therapies.

</comment><comment><USER22> Recent cancer research has shown that cancer is more or less an immuno problem. Regarding this, new treatments are available utilizing high doses of vitamin C given intravenously. The results look really promising. You might want to suggest this as a possibility of alternate treatment if chemo treatments don't seem to be working.

<comment><USER23> What? [http://www.sciencebasedmedicine.org/high-dose-vitamin-c- and-...](http://www.sciencebasedmedicine.org/high-dose-vitamin-c-and-cancer- has-linus-pauling-been-vindicated/)

</comment></comment><comment><USER24> Look up laetrile. Found in apricot seeds. Not an FAD cure, but might help. I've heard of good stories. Or THC oil has been known to have effects as well. Radiation itself is a carcinogen and chemotherapy is poisoning the entire body along with the cancer, and destroys the immune system. Look it up. Plenty to google here.

<comment><USER23> "Available scientific evidence does not support claims that Laetrile or amygdalin is effective in treating cancer or any other disease. Both contain a small amount of a substance that can be converted to cyanide in the body, and several cases of cyanide poisoning have been linked to the use of Laetrile. The U.S. Food and Drug Administration (FDA) has not approved Laetrile as a medical treatment in the United States."

[http://www.cancer.org/treatment/treatmentsandsideeffects/com...](http://www.cancer.org/treatment/treatmentsandsideeffects/complementaryandalternativemedicine/pharmacologicalandbiologicaltreatment/laetrile)

</comment></comment><comment><USER25> Forget the Netherlands doctors. Flew him on a plane as soon as possible to German:

Visit this site: immune-therapy.net

There's even more news about this on HN: [http://www.sciencedaily.com/releases/2014/02/140219142556.ht...](http://www.sciencedaily.com/releases/2014/02/140219142556.htm)

</comment><comment><USER26> You and your friend should read this article.

[http://robbwolf.com/2013/09/19/origin- cancer/](http://robbwolf.com/2013/09/19/origin-cancer/)

</comment><comment><USER27> I lack the required medical education to make any type of suggestion, and if you and yours trusted blind suggestions from the Internet, you'd probably be in a lot more trouble than you already are. With the needed disclaimer made, I'll share the links I've collected over the last year. They may or may not turn out to be useful, but they are some of the leading edges of cancer treatment research as far as I'm aware.

[http://majetilab.stanford.edu/](http://majetilab.stanford.edu/)

[http://med.stanford.edu/profiles/majeitlab/faculty/Ravindra_...](http://med.stanford.edu/profiles/majeitlab/faculty/Ravindra_Majeti/)

[http://stanmed.stanford.edu/2012summer/article7.html](http://stanmed.stanford.edu/2012summer/article7.html)

[http://www.phillymag.com/articles/carl-june-key-fighting- can...](http://www.phillymag.com/articles/carl-june-key-fighting-cancer/)

[http://unitedwithisrael.org/enlivex-innovation-leads-to- effe...](http://unitedwithisrael.org/enlivex-innovation-leads-to-effective- new-cancer-treatment/)

[http://unitedwithisrael.org/israel-develops-cancer- vaccine/](http://unitedwithisrael.org/israel-develops-cancer-vaccine/)

[http://portal.acs.org/portal/acs/corg/content?_nfpb=true&_pa...](http://portal.acs.org/portal/acs/corg/content?_nfpb=true&_pageLabel=PP_ARTICLEMAIN&node_id=223&content_id=CNBP_029904&use_sec=true&sec_url_var=region1&__uuid=73e92495-afbe-4416-a18c-2e0b4bbc2c79)

[http://www.bbc.co.uk/news/health-14572284](http://www.bbc.co.uk/news/health-14572284)

[http://www.dailymail.co.uk/health/article-2275650/Scientists...](http://www.dailymail.co.uk/health/article-2275650/Scientists- discover-body-destroy-cancerous-tumours--need-drugs.html)

[http://www.eurekalert.org/pub_releases/2013-04/uom- bct040313...](http://www.eurekalert.org/pub_releases/2013-04/uom- bct040313.php)

[http://web.mit.edu/newsoffice/2013/how-melanoma-evades- chemo...](http://web.mit.edu/newsoffice/2013/how-melanoma-evades- chemotherapy-0407.html)

[http://www.atsdr.cdc.gov/risk/cancer/cancer- laboratory.html](http://www.atsdr.cdc.gov/risk/cancer/cancer-laboratory.html)

[http://www.nature.com/nature/journal/v485/n7396/full/485041e...](http://www.nature.com/nature/journal/v485/n7396/full/485041e.html)

[http://metro.co.uk/2013/06/19/naked-mole-rat-may-hold-the- cl...](http://metro.co.uk/2013/06/19/naked-mole-rat-may-hold-the-clue-to- beating-cancer-3848778/)

[http://www.phillymag.com/articles/carl-june-key-fighting- can...](http://www.phillymag.com/articles/carl-june-key-fighting-cancer/)

[https://news.ycombinator.com/item?id=6231876](https://news.ycombinator.com/item?id=6231876)

[https://www.seas.harvard.edu/news/2013/09/cancer-vaccine- beg...](https://www.seas.harvard.edu/news/2013/09/cancer-vaccine-begins-phase- i-clinical-trials)

[http://www.sciencedaily.com/releases/2014/02/140219142556.ht...](http://www.sciencedaily.com/releases/2014/02/140219142556.htm)

[http://www.mskcc.org/pressroom/press/cell-therapy-shows- rema...](http://www.mskcc.org/pressroom/press/cell-therapy-shows-remarkable- ability-eradicate-clinical-study)

[https://news.ycombinator.com/item?id=7371906](https://news.ycombinator.com/item?id=7371906)

I wish you the best!

</comment><comment><USER28> Treat him as a person and as a friend like you did before.

</comment><comment><USER29> This was discussed just today, I suggest you read it: [https://news.ycombinator.com/item?id=7371906](https://news.ycombinator.com/item?id=7371906)</comment>


NHTSA to require backup cameras on all vehicles - <AUTHOR> http://www.usatoday.com/story/money/cars/2014/03/31/nhtsa-rear-view-cameras/7114531/ <comment><USER2> According to Wikipedia there are approximately 254 million passenger vehicles in the USA. [http://en.m.wikipedia.org/wiki/Passenger_vehicles_in_the_Uni...](http://en.m.wikipedia.org/wiki/Passenger_vehicles_in_the_United_Stats)

Also there are approximately 15 million new cars sold per year.

[http://m.nydailynews.com/1.1567645#bmb=1](http://m.nydailynews.com/1.1567645#bmb=1)

At a cost of ~$100 per vehicle for these cameras that means to get the entire passenger fleet compliment with this law will cost 25.4 billion dollars and 1.5 billion per year in additional costs. The article states that they estimate 58-69 lives per year to be saved, round that up to 70. 70/1.5 billion and we are spending over $21.4 million per life saved. That seems absolute crazy to me. How many lives could be saved with that amount of money spent in a more efficent way?

<comment><USER3> The actual cost is lower; Some percentage, probably even a significant one, of existing car sales already have these cameras equipped. If the price drops and the feature is compelling anyway, I can see it being a tenth that in actual cost, which brings it into line with real life-saving programs. Preventing deaths is expensive.

My instinct was along your lines, though, and I'm not entirely certain that the whole idea isn't just a gift to automakers for yet another reason to jack up prices. What used to be a costly extra is now 'required'.

<comment><USER2> I think you are likely correct on the cost. I would honestly like to know what the most cost effective way is to save a life. My guess would be vaccines in 3rd world.

There is something that still bothers me about laws like these. A very vocal minority drives the cost up for everyone, while the effectiveness of the law is questionable. It is of course a tragedy when a young person is killed in an accident but is this really a good use of the government and law? People need to be careful when they are operating a car. Also who is going to argue against saving a toddlers life? That is probably a poor political move. This just seems like another sign of how weak willed our political system is at standing up for what is in the interest of the general public and not a vocal minority.

</comment></comment></comment><comment><USER4> I really wish that, in addition to the camera, they'd include a sort of proximity cone (radar, sonic, something) too. Case in point:

Coworker of mine gets himself a Leaf - loves it to death. So, to partake of his joy, we all take a ride with him to Chipotle to grab lunch. Right next door to the restaurant in the strip mall is one of those UPS Pack-n-Ship places. We didn't pay it a lot of attention when we pulled in but right behind us, backed up to the front of the UPS store, is one of their short-length semi-trailers. Not an issue until we're backing out - dude came withing centimeters of smashing out his back window because he was relying on the camera which only showed the legs of the trailer and not the deck.

This isn't to say that the cameras aren't good, but they do have limitations and can lend a sense of false security.

<comment><USER5> I think I would use the camera to check clear for what it covers, but look over my shoulder for actual backing up. The camera isn't going to show cars and pedestrians coming from either side. I'd probably have trouble steering backward through a camera anyway.

Actually it'd be cool if you could see the display while you were twisted around looking backward.

</comment></comment><comment><USER6> Back over 'accidents' don't happen because you can't see what is behind you. They happen because you are oblivious to your surroundings. People can't handle their own guilt so they try to pawn it off on society. Well guess what, 99+ percent of all vehicles never back over a child. It has nothing to do with the "visibility systems."

<comment><USER7> Why should we believe you over the NHTSA on this question?

<comment><USER8> Because his statement was not loaded with emotion like the one from the NHTSA.

>""We are committed to protecting the most vulnerable victims of back-over accidents — our children and seniors," Transportation Secretary Anthony Foxx said in a statement."

This rule doesn't pass the "sniff" test. There is absolutely nothing backing this except an estimate that several dozen lives might be saved. No cost effectiveness analysis, no comparison to other changes.

<comment><USER7> Actually, his statement was just as loaded with emotion. It was just a different emotion. Instead of "think of the children", it was the typical nerd emotional appeal of "the problem is that people are idiots and if they would just stop being idiots then we wouldn't have to deal with people being idiots."

Regarding your "absolutely nothing backing this" statement, did you read through their documentation before saying this, or did you just assume? It's pretty extensive.

[http://www.nhtsa.gov/staticfiles/rulemaking/pdf/FMVSS-111_Re...](http://www.nhtsa.gov/staticfiles/rulemaking/pdf/FMVSS-111_Rear_Visibility_Final_Rule.pdf)

<comment><USER8> I was talking about their statements, not information buried in a report the public won't read. You think people would approve of this rule if the NHTSA had of worked, "Based on the aforementioned revised estimates for costs and benefits, the net cost per equivalent life saved for rear visibility systems meeting the requirements of today's final rule ranges from $15.9 to $26.3 million.", into their public statement?

If you actually read the report it is clear this has nothing to do with rear- vision camera systems being cost effective and is just about the NHTSA doing what they are told by congress.

>"Throughout this rulemaking process, the agency has been sensitive to the costs of today's rule and has sought to ensure that the requirements adopted impose the least amount of regulatory burden on the economy while still achieving Congress' goal of reducing fatalities and injuries resulting from backover crashes."

And hyperion2010 was right, having a rear-vision system doesn't mean you will use it (where I live it is illegal to use them when actually reversing). The solution to these accidents is education.

Technology is often the answer to human stupidity, but not at $15.9 to $26.3 million per life saved.

<comment><USER7> Sorry, the telepathy lobe of my brain was damaged when I was young, so when I read "There is absolutely nothing backing this" I took that as meaning what it said.

<comment><USER8> Even if you took it that way there is still nothing backing this. Finding the best way to implement a dumb policy does not mean the overall policy is backed by a good argument.

Even if this was the most cost-effective life saving measure the NHTSA could implement, it still doesn't mean it is the most cost-effective life saving measure that government could take.

<comment><USER7> The argument was that these accidents don't happen because of an inability to see, but due to being "oblivious". Cost effectiveness doesn't enter into it. The question _at hand_ is simply whether back up cameras save lives. NHTSA says they do. hyperion2010 says they don't.

I asked hyperion2010 why I should believe him over the NHTSA. You then replied with two completely nonsensical arguments:

1\. That the NHTSA was wrong because their statement was loaded with emotion. This is silly, because emotion doesn't make a statement _wrong_ any more than it makes a statement right. So let's move on to the meat:

2\. That the NHTSA has no evidence for their claim.

And this is just plain wrong. The link I provided shows a reasonably thorough study which illustrates that having a camera _does_ substantially reduce these types of accidents. It is not perfect, because some people really are oblivious. But neither is it useless, because some accidents are not due to simple obliviousness.

Your response to this was that it somehow doesn't count if it's not spelled out in their press release, which is just plain stupid.

If you want to discuss the cost/benefit tradeoff of this decision and whether the money would be better spent elsewhere, go for it. But that was not what we were discussing in this thread, so don't act like statements about cost effectiveness are somehow relevant.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I've driven several cars with a backup camera and never used it, instead I used my eyes. Maybe I'm just not used to them since my main vehicle doesn't have one, but I feel like the one time I need it to work it will have some sort of lag/delay or a blind spot and cause me an accident if I trust it.

<comment><USER10> I guess the assumption is that people will be more aware if they can see what's behind them on TV. But is this true? Has this been studied? Or do people back up more safely when rely on their vision and who aren't glued to the TV?

</comment></comment><comment><USER11> Good idea. While they're at it get rid of those passenger side convex mirrors, "objects are closer than they appear." One of the functions of a rear view mirror is to tell you where objects are behind you when you are changing lanes in heavy traffic. You can cover your blind spot by proper adjustment of your side mirror.

<comment><USER12> Don't forget that in some areas of the country, we get snow pretty regularly - in my experience back-up camera lenses get completely covered by road grit in snowy zones pretty quickly - makes it hard to rely on for something critical like highway visibility for a few months a year.

<comment><USER13> It is not an issue at all. It happened 3 times with me during the whole winter, and I quickly wiped and cleaned the lens. The windows and mirrors get dirty too, we often clean them.

<comment><USER14> When you say "it happened three times" this whole winter do you mean "it snowed three times"? I live in Syracuse, NY. We get 100+ inches every year, so I have some experience with the slushy salt+sand mixture that covers everything near a road in the winter. You can clean your car all you want but as soon as you spend 2 minutes driving a lot of the salt+sand+slush is back. How do you clean the lens while driving?

<comment><USER13> I live in NY as well, and it snowed every week most of the winter. My camera lens got dirty or blocked by ice on only three occasions. Mostly, the camera is clear even when windows are dirty.

Is cleaning camera lens for a total of 3 times in a year a big deal? We clean our cars a lot more than that.

<comment><USER14> You are correct 3 times in one winter is not a lot. I am saying that 3 times in one winter is not an accurate estimate of how often I would have to clean the camera. How much snow did you receive in your area of NY? Did you get half the snow Syracuse did?

      City       2013-14     Avg.
      </comment></comment></comment></comment></comment></comment><comment></comment><comment></comment><comment></comment><comment>----
      Syracuse    131.6      123.8
      Buffalo     128.7       94.7
      Rochester   112.3       99.5
      Binghamton   84.4       83.4
      Albany       71.1       59.1

from: [http://goldensnowball.com/](http://goldensnowball.com/)

</comment><comment><USER15> I actually get really nervous driving a car without a backup camera now. This is good news.

<comment><USER16> Your average passenger car has darn near 360 degrees of visibility, with very good mirror coverage.

I can see how a camera would be useful (though I find them difficult to use, as I'm never sure if the image is reversed or not), but it should never be necessary (at least until the point where the driver is no longer necessary).

<comment><USER7> 360 degrees around what axis?

Backup cameras allow you to see low objects directly behind you, which no mirror system does on any passenger car I've ever seen.

</comment></comment></comment><comment><USER17> Sadly, it won't help in the most tragic cases where a toddler is already under the car. (We had friends who had to suffer through such an incident some years back.)

</comment><comment><USER18> Cynical side of me says "hey look! More cameras for TLAs to use!"

Also, unsure about cost/benefit here.

</comment><comment><USER19> Sounds like a huge cost for little gain. Why doesn't the NHTSA require daytime running lights?

</comment><comment><USER20> link to the final rule:

[http://www.nhtsa.gov/staticfiles/rulemaking/pdf/FMVSS-111_Re...](http://www.nhtsa.gov/staticfiles/rulemaking/pdf/FMVSS-111_Rear_Visibility_Final_Rule.pdf)

</comment><comment><USER21> Can anyone comment on value of patent and potential licensing revenues.

I found one patent holder [1] but I assume they are several others that can claim and request licensing fees.

[1] [http://www.google.com/patents/US20060103727](http://www.google.com/patents/US20060103727)

</comment><comment><USER22> If auto makers didn't design huge vehicles from which the drivers can't see the ground behind them for hundreds of feet, this wouldn't be much of an issue.

<comment><USER23> Kind of difficult to design a truck that does not have this problem. The Ford F-series truck is the #1 selling automobile in the US (Chevy Silverado and Dodge Ram, also trucks, are #2 and #3).

<comment><USER24> Or a trunk, for that matter.

It's not at 100 feet behind you that the trouble lies; mirrors are sufficient for that. It's the 1-5 feet behind you that you're completely blind to with mirrors (assuming you don't have transparent rear seats and hatch).</comment></comment></comment>


Arcweave – Fast and visual game and narrative design in the browser - <AUTHOR> https://arcweave.com <comment><AUTHOR> Hi everyone! We built this tool to help game designers have a space to conceptualize, organise and scale their systems, quests and dialogues. You can find some more info on the post we made a few months ago on reddit as well

[https://www.reddit.com/r/gamedev/comments/9vvzjl/new_free_on...](https://www.reddit.com/r/gamedev/comments/9vvzjl/new_free_online_tool_for_game_design_and/)</comment>


White House: "We expect" Hong Kong to comply with Snowden extradition [video] - <AUTHOR> http://www.cbsnews.com/8301-250_162-57590589/white-house-we-expect-hong-kong-to-comply-with-snowden-extradition/

<comment><USER2> I know how they feel. I expected the White House to comply with the Constitution.

<comment><USER3> What made you expect that? It's not like Obama campaigned on the promise of reforming domestic spying or increasing+- transparency in government... _OH WAIT A MINUTE THOSE WERE SOME OF HIS BIGGEST PROMISES_.

<comment><USER4> _SOME OF HIS BIGGEST PROMISES_

They really, really weren't. Domestic surveillance was one of the smallest, least talked about topics in Obama's election. Any, if we're honest about it, will also be in 2016. Hacker News is working itself up into a frenzy about it, but the country at large _does not care_.

<comment><USER3> Really, because there's a lot of video going around of 2007 Obama debating 2013 Obama on domestic spying.

44% of the country cares. Dare not dismiss the a minority opinion just because it's _just_ under the threshold of the majority.

<comment><USER4> A video being popular now does not indicate that it was popular in 2008.

Don't get me wrong, I know Obama talked about the topic. I just think that very, very few people voted on the basis of what he said.

That also applies to the 44% figure. Yes, they care. But come voting time, will they vote on the basis of the NSA or on the economy? I'd place a large wager that it'll be the latter.

</comment></comment></comment></comment></comment><comment><USER5> Sure they do. But are they expecting China to comply with them?

</comment><comment><USER6> > Later Saturday, a senior administration official added an additional > statement: "If Hong Kong doesn't act soon, it will complicate our bilateral > relations and raise questions about Hong Kong's commitment to the rule of > law."

The rule of law can't have any meaning if it only applies when it fits your protocol.

<comment><USER7> faustrecht is a pretty straight forward protocol

</comment></comment><comment><USER8> I expect Hong Kong to tell them f*ck off.

</comment><comment><USER9> I'm glad to see that the US government is being predictably stupid about this. Making public demands and veiled threats is probably the best possible way to ensure that HK and China won't cooperate.

</comment><comment><USER10> Every girl expects to be married to the man who took her virginity. Expectations...

<comment><USER11> What the hell does this misogynist statement have to do with this article?

<comment><USER12> I'm a man and I expected to marry the first woman I had sex with. Not sure how that comment was misogynistic.</comment></comment></comment>


Why the media can't report on a case that has generated huge interest online - <AUTHOR> https://www.smh.com.au/national/victoria/why-the-media-is-unable-to-report-on-a-case-that-has-generated-huge-interest-online-20181212-p50lta.html <comment><USER2> Just gotta say, I'm so happy that "suppressed person" will get at least some of the justice he so sorely deserves.

If there's anyone who deserves to suffer for what they've done, it's him.

And that whole Catholic Church should be stripped of its tax free status because it has _systematically_ acted as a criminal organization to protect the perpetrators of the worst crimes imaginable.

The hide they have to act as if they have such high moral standing just makes it even more repugnant, if that was possible.

I hope this isn't the last one they can pin charges on. The reddit post about this story had comments from _so many_ people who have personally suffered at the hands of these monsters.

Hopefully this success emboldens them to come out against their abusers. I wish them peace and strength.

[https://www.reddit.com/r/worldnews/comments/a5ff63/vatican_n...](https://www.reddit.com/r/worldnews/comments/a5ff63/vatican_no_3_cardinal_george_pell_convicted_on/)

<comment><USER3> This. Basically people have been running businesses with models that rely on the, willingly given and cheap, labour provided by paedophiles: [https://www.independent.co.uk/news/world/americas/us- politic...](https://www.independent.co.uk/news/world/americas/us-politics/boy- scouts-of-america-bankrupt-money-funding-sexual-abuse-lawsuits-misconduct- minors-a8682036.html)</comment></comment>


Release Early or Release Big? - <AUTHOR> http://www.xobni.com/blog/2006/07/23/release-early-or-release-big/ <comment><USER2> The one VC firm I've ever actually worked with was all about "go big or stay home." However, they had the pre-launch checklist that included things like making sure the product was complete and a perfect fit for a specific vertical.

If you have an app that can exist in isolation and plenty of money, you can achieve that product perfection (not really of course, but enough to make some money) by conducting formal user-tests, focus group junk, exclusive invitation-only beta-testing, etc.

If you don't have the money or if your application requires or is fundamentally a social network, releasing early and having the very early adopters is the only way (it seems) to get that product to the ripe stage where you can then "go big."

Another nice thing I see about launching with YC's blessing is you automatically get enough buzz to be visible to the early early adopters.

</comment><comment><AUTHOR> Some lead-in discussion in here: http://news.ycombinator.com/comments?id=3813</comment>


How to Claim Flight Delay Compensation? Step-By-Step Guide - <AUTHOR> https://3flightdelay.com/how-to-claim-flight-delay-compensation-guide/ <comment><USER2> I'm giving this a go. Will report back (probably in a blog post) on the results.

<comment><USER3> !remindme 2 months (would be nice to have this kind of features through a HN extension)

</comment></comment><comment><USER4> Crazy word wrapping

<comment><USER5> Thank goodness for reader mode...

</comment></comment><comment><USER6> Are there any similar protections in the US?</comment>


The Why of Go - <AUTHOR> https://www.infoq.com/presentations/go-concurrency-gc/ <comment><AUTHOR> Despite the title, the thesis statement of this talk is not really about Go.

Carmen first lays out the history of Go to add context to the main thesis - This talk is really about software engineering, also known as programming integrated over time. She recognizes that the big leap forwards is to remove features</comment>