Fiat Chrysler recalls 1.4M cars after Jeep hack - <AUTHOR> http://www.bbc.com/news/technology-33650491 <comment><USER2> This is a terrible decision. On such a short timescale, they'll only be able to fix the particular bug in their infotainment system. The real problem as everyone has pointed out is that the car control and infotainment should not share channels. There should be a physical gap between them and if really necessary a very tightly controlled message bridge.

The real fix will require much more intervention than just a firmware flash at the garage.

We'll see at Def Con how much Chrysler really screwed up.

<comment><USER3> > This is a terrible decision.

It's the only one available to them. They can't just refit all existing cars with a new design on a short timeline. Hardware has permanence.

With that in mind, how would you fix the issue for existing vehicles?

<comment><USER4> The infotainment system should never have access to the CAN[1] network in the first place... ever. At most, they could have a very simple listener on the can network that could send data (one way only) to the infotainment device via a different channel of sorts. Mixing the two is asking for issues such as just this to happen.

[1] [https://en.wikipedia.org/wiki/CAN_bus](https://en.wikipedia.org/wiki/CAN_bus)

<comment><USER5> > The infotainment system should never have access to the CAN[1] network in > the first place... ever.

The problem is access to the CAN bus is necessary to change various vehicle settings from the infotainment system. I know for a fact that changing the door lock settings in my car requires the infotainment system to access the CAN bus to apply settings to that system.

This is not an unsolvable problem; this is basic software engineering. Processes should be isolated from each other. I imagine everything in the infotainment system effectively runs as "root" because they consider the whole thing a singular black box.

<comment><USER6> I agree with both you and the person above. I think the missing word we're looking for is: "unrestricted" (as in unrestricted access should not be permitted).

Yes, the info system needs SOME access to the CAN network. But it shouldn't be unrestricted access. Instead the info system should be treated as "untrusted" and only specific things should be permissible over a well documented set of APIs.

I'd almost be tempted to say that while the car is moving, ALL access to the CAN network should be disabled. Since let's name some things the info system needs on the CAN network:

\- Reconfigure car (e.g. daylight running lights, auto-locking door, etc).

\- Start car remotely.

\- Set AC remotely.

\- Diagnostics.

The only one on that list which MIGHT be useful to have while the car is in motion is diagnostics. And that could be delivered via a read only interface.

<comment><USER7> Steering wheel audio controls are common and useful in motion.

It's not really about RO v RW, CAN is about sending commands. The head unit could say, it's the brakes, so that has to be protected against.

When there is not a physical layer doing that protection (separate bus, a filter, and so on) there are two other layers. One is the thing sending can reject it from going out, but that takes resources that might not be there. The other the receiver does some sanity checking on it, like "you want me to go in P but I'm going at 65, yeah I don't think so" to even it's gotten common place for messages involving the brakes include a shared code back and forth.

Really I think this boils down to there are untrusted channels (wifi, cellular, DAB) that should be locked down better. I mean the DAB thing, likely it's a buffer over flow in the head unit. Even if that has a cpu that is running FW that is making sure the CAN messages it is sending are sane, the exploit just makes it stop doing that. There's such a pressure to save cost and so many OEMs involved that ease of integration motivates the rest.

Yeah it sucks, but it is what it is.

<comment><USER8> > Steering wheel audio controls are common and useful in motion.

But wouldn't those likely be one-way commands TO the infotainment system? They would still work even if it was receive only.

<comment><USER7> My goodness this is really not going well for me.

Basically there is no notion of to or from really. When you push the vol+ button on the steering wheel there is a controller that sends a message trying over and over again until there is no collision. That message has an ID in it early on. In this case it will be like I dunno $412 okay. That means audio controls or something. A bit later is some length and then the data, say the data is $C.

The infotainment unit is listening to everything just as the controller for the steering wheel controls is and everything else on the bus (it has to, because of how collision detection works). When the controller in the steering wheel sees that $412 ... $C it goes, well isn't that nice, me or someone else sent the vol+ message out finally, cool, I'll stop sending that now. When the radio sees that message with an ID of $412 it goes, oh that's an audio control message command, I should pay attention to that. Then it looks at the length and data and sees $C. It goes oh that means someone pressed vol+, I'll make it louder.

But here's the thing, there might be a knob too for volume and there really is just one board doing the infotainment. It's not like the old days where it's a potentiometer, it's not even wired directly into the board that handles infotainment. All the IO pins that board has are already used-up handling the screen, CAN bus, and other things. When you twist it, it also sends the same $412 ... $C over CAN from it's controller! The radio did not know what sent it, and that's by design in CAN bus.

There might be mobile phone integration, it can do CAN too, say also a $412 with with a different payload (and possibly length) that might mute on call. Also there may be a touch screen, but that will not do a thing over CAN if you press the vol+ there, just do it's normal IO from screen to SoC on the board.

Am I doing a better job of explaining? The take away is lots of things can send the same message and lots of things might be interested in that message and that is how it is intended. To some extent you can mitigate this in hardware. You can make long runs or some shorter star shaped topologies as long as you get the termination right. For the star shaped topologies you can stick gateways in there. The controllers can be setup to filter on certain conditions and the bus is the limit for filtering if you are using a programmable part. What I mean by bus is the limit is things like there is no notion of to and from.

That's what you get in CAN bus cause that's how it works. You can thank Bosch for that.

<comment><USER9> That looks like an absurd amount of complexity/overengineering just to save some wire. I suppose "put everything on one bus" could be turning into some sort of anti-pattern.

<comment><USER10> Consider how much wire would be required to route every button directly. There would be tens of pounds of extra metal, plus impossible bundles of hundreds of wires to route around the car.

CAN is great for its purpose, but handling untrusted actors is not part of that purpose.

What _should_ happen is a non-CAN hardware gateway that only passes valid commands to CAN buses.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> > The company added that hacking its vehicles was a "criminal action".

I don't think that's the case, but I still commend them for doing a recall this quick.

Shooting the messenger seems to still be quite a strong reflex for corporations faced with bad news. The way to look at it should be that these guys did Fiat-Chrysler a service. After all, it's not only security researchers that have the ability to write code and that have prolonged access to a vehicle to test.

They seem to be mistaken about the time to write the code, after all, you can write the code and test it on a different vehicle than the one you intend to crash.

Law enforcement typically won't analyze the firmware of all the computers in a car after a single vehicle accident (and it would probably be quite possible to erase the evidence once the car has been given a command sufficient to kill the occupants).

<comment><USER12> I would add that shipping cars with such vulnerabilities should be a criminal action, if it isn't. It's certainly negligent (however unintentionally) and unsafe for consumers.

<comment><USER11> Given the complexity of the software components in a modern car I think it would be a safe assumption that all of them are shipping with such vulnerabilities. If there is one area where we could benefit from some openness it is the embedded world, these are life critical systems in every sense of the world and what I've seen of such code bases does not inspire confidence at all (rather the opposite).

<comment><USER13> The issue isn't vulnerabilities, it's connecting those vulnerabilities to the net. This isn't about software quality in general.

<comment><USER11> But that's exactly how these things happen. People program insecure stuff thinking 'well, at least this isn't connected to the internet', then one day someone else takes the blackbox the original guy (long departed) put together, hacks up a TCP/IP interface or does something else without looking through the codebase and _boom_ you're wide open.

You can replay this story 10's of times over the next couple of years and lets hope it's only the nice guys finding them.

<comment><USER12> See also: SCADA

<comment><USER11> Don't get me started on that one, yes, it's probably even worse than automotive because these are 100's of thousands of legacy systems quite often without any security at all connected to the net. Obscurity is the only thing that keeps these systems working.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> I see a lot of people thoughtlessly applying computer-security mindset here to vehicle-safety. They're really not the same thing, because they are handling very different risk models. Vehicle safety is about "how will this system perform under typical conditions when something goes wrong?". Computer security is about "how will this system perform if a smart asshole tries to abuse it?". Vehicle safety _generally_ doesn't concern itself with deliberate sabotage. You won't see a product recall for a car because "under some circumstances, a criminal might cut the brake cables". What Chrysler are doing here is, though, effectively that, and _why_ they have to do that for a computer security issue is interesting.

We're all used to the idea that if you put a computer on the internet, it will come under attack. People will try to snoop on the data it handles, or subvert it to use it for their own purposes. So why do we then move on to assume that, if such a system is attached to something safety critical, that those same people who will attack the computer to get at its data or processing power will now move on to attacking the brakes, or the engine, and try to kill people?

Most vehicular crime isn't homicide, it's acquisitive - people will attack vehicle security systems to steal the car, or get access to valuable contents. Sabotaging the vehicle to kill the driver is way down the list.

As a society we tend to assume that physical security is not the only thing that stops random strangers from trying to kill us. We do not all drive around in armored cars in case someone decides to shoot at us from an overpass. We don't all sweep under our car with a mirror for bombs before we get in and start the engine.

And it's certainly not a failing of Chrysler's engineers to adequately consider customer safety that they sell Jeeps which are not bulletproof and which have exposed frameworks on the underside where bombs can be attached.

So why is it that we're so quick to assume that because a safety-critical computer system is exposed to the internet, that this is the _worst thing ever_?

Is it that as far as physical security of your Jeep goes you only have to trust the people in your neighborhood, but for internet security we have to trust the whole world?

<comment><USER15> > So why is it that we're so quick to assume that because a safety-critical > computer system is exposed to the internet, that this is the worst thing > ever?

Because of the Greater Internet Fuckwad Theory (or, more nicely put, the "online disinhibition effect"[1]).

We don't worry as much about random strangers harming us in person because most people are generally well-behaved when they are face to face with someone in real physical space.

On the Internet, where all you see is a screen and all you do is click your mouse, "reality" gets a lot more tenuous. In that environment, people act worse.

If you were walking over an overpass and saw someone left a cinder block up there with a note attached saying "Throw me!" how likely would you be to lumber it up off the ground, carry it to the edge, and heave it over onto to a car you can see passing below, whose occupants are visible to you?

Now imagine you stumble onto a random web page with a button labeled "Click to drop cinder block off overpass". Tempting?

The way our behavior differs in these two circumstances is a big part of why Internet security is so different from physical security. (The other big difference is how data can be replicated for free. It takes 50x as much effort to steal 50 cars. It often takes no more effort to apply the same have 50, or a million times.)

[1]: [https://en.wikipedia.org/wiki/Online_disinhibition_effect](https://en.wikipedia.org/wiki/Online_disinhibition_effect)

<comment><USER16> In addition to this, there are differing scales at work. In real life, by your analogy, you might find a cinder block with a "throw me" note. With the internet, you might find a button that says "throw 1.4M cinder blocks." One maniac can cause much more trouble that way.

</comment></comment></comment><comment><USER17> One got to love bright minds who ever thought connecting any relevant part of a cars control mechanisms to the internet was a good idea.

<comment><USER18> Doesn't Tesla send over-the-air updates for critical systems to its cars? From my understanding, that means there is a way for a similar attack with a fake- firmware. Am I wrong?

<comment><USER2> Yes, but I don't think skimmas is fully right. Updating firmware over the internet is not a terrible idea. Public key decryption is well established technology and simple enough for even big corporations to get right.

Of course.. there's some room for them to screw up, but I would argue that that's set off by the risk of having buggy vehicle control firmware killing people. Especially with a new vehicle like the Tesla.

<comment><USER19> There's also such thing as "key stealing". I imagine it would be quite a valuable target.

<comment><USER6> When you're signing a binary blob, protecting the private key is actually pretty easy since it can be air-gapped/offline. Or heck you can buy appliances where they'll perform specific functions using the private key but won't expose it themselves without physical intervention.

</comment></comment></comment></comment></comment><comment><USER20> Just an FYI for everyone on the "segregated systems" bandwagon:

If a compromised device can talk on the CAN bus it's game over since (pretty much) everything listens on that bus so you can't (without a lot of time and effort, implement a way to) pick and choose systems to segregate while maintaining wireless connectivity to those critical system.

Vehicle manufactures get a huge data set sent back to them by vehicles. They use this for stuff like correlating part failures to operational conditions, determining which intermittent wiper setting people use as well as improving the logic for the operation of critical systems (e.g. if my last inputs were $stuff then don't upshift). I wouldn't be surprised if they sold the data as well. McDonalds would love to know where and when people start looking for food. insurance companies would love to have more variables to correlate to risk trivial (e.g. $color cars with $trivial_feature get in accident that cost $really_small_percent $more_or_less than $other_color

To segregate systems you need to be able to pitch to the bean-counters that the cost/benefit of whatever degree of segregation you're proposing beats the cost/benefit of whatever plan the next guy is proposing. These data sets are incredibly valuable to many different parts of the company. The people doing marketing and customer facing stuff would be at a severe competitive disadvantage if they had to wait months (first oil change) o get real world data on feature usage after a re-design.

Sure you could download it at service time..."but we already have a system that does it in near real time, can't we just secure that?"...

TL;DR: Segregating systems involves more than having the engineers wait a few months to figure out if their new tune solved the problem.

<comment><USER21> Which costs less in the long run, a potential class action lawsuit and loss of consumer confidence, or better system security?

If necessary, consider that security is a feature you can sell, when your competitors are following the path of least resistance and paying out their settlements.

<comment><USER20> Depends on the lawsuit. How much effort would you go through to secure software that runs on a decade old vehicle with a very particular set of options if the exploit requires a very particular set of conditions?

You might fix it just to have a similarly obscure zero day be discovered (unknown to you) and exploited in a different place. Then not only were all those resources spent in vain, but you've got to deal with the opportunity cost of not having thrown those resources behind current of future safety and security tech.

People accept the risk of driving vehicles with legacy safety equipment, why should software be any different from hardware or legacy software in non- embedded applications. At some point you have to let stuff go. Just ask Microsoft.

<comment><USER21> Depends on how much effort it would have taken to get it right the first time, which is what I'm suggesting be done.

And in this case, these vehicles were manufactured pretty recently, so even conceding your point, I don't think we've passed the 'let stuff go' point in this case.

</comment></comment></comment></comment><comment><USER22> From the press release: [http://www.media.chrysler.com/newsrelease.do?id=16849&mid=1](http://www.media.chrysler.com/newsrelease.do?id=16849&mid=1)

"No defect has been found. FCA US is conducting this campaign out of an abundance of caution."

What the hell?

<comment><USER23> Defect appears to have a particular meaning in relation to vehicle safety. I'm just basing that on the way it is used here:

[http://www-odi.nhtsa.dot.gov/recalls/recallprocess.cfm](http://www- odi.nhtsa.dot.gov/recalls/recallprocess.cfm)

I guess it isn't that big a stretch to use such defensive language, there are a lot of things that can be tampered with on a vehicle that arise out of engineering trade offs.

I don't mean to dismiss the problem at hand, but it is only an issue if someone makes an effort to tamper with a vehicle, which is different than a critical part failing prematurely or whatever.

<comment><USER22> Unfortunately your argument makes sense.

</comment></comment></comment><comment><USER24> The good that comes out if this is that somewhere in the management chain people will feel justified to increase security investment by saying, "remember the Fiat Chrysler recall?"

</comment><comment><USER25> _The recall aligns with an ongoing software distribution that insulates connected vehicles from remote manipulation, which, if unauthorized, constitutes criminal action._

The WIRED story's hackers presumably _were_ authorized by the vehicle's owner or operator, so the demo did not "constitute criminal action."

<comment><USER26> > The WIRED story's hackers presumably were authorized by the vehicle's owner > or operator, so the demo did not "constitute criminal action."

They were probably authorized by the driver, but car companies have argued that the driver does not "own" the software in the car, so I assume their claim of unauthorized access is predicated on the assumption that the car company still owns the software and that the car company did not authorize the access.

I do not agree with the car company's stance on ownership, but that may be the origin of their claim.

<comment><USER25> WIRED has another story about this question,

[http://www.wired.com/2015/04/dmca-ownership-john- deere/](http://www.wired.com/2015/04/dmca-ownership-john-deere/)

Supposedly the US Copyright Office will decide this month.

</comment></comment></comment><comment><USER27> If you missed it, this is related: [http://www.wired.com/2015/07/hackers- remotely-kill-jeep-high...](http://www.wired.com/2015/07/hackers-remotely- kill-jeep-highway/)

<comment><USER23> Discussed here:

[https://news.ycombinator.com/item?id=9921557](https://news.ycombinator.com/item?id=9921557)

Also related:

[https://news.ycombinator.com/item?id=9929177](https://news.ycombinator.com/item?id=9929177)

</comment></comment><comment><USER28> If researchers _really_ want to underscore a point: hang out outside the IIHS testing facility, and when they're testing the vehicle in question, _then_ mess with the systems.

Maybe IIHS needs to include "remote hackability" as a criterion in their testing?

<comment><USER20> IIHS uses cars that aren't running and don't have fluids in them. They don't want to clean up that mess (or have the car destroyed by fire). They do test fuel system integrity though. I'm not sure if they use some other fluid (water + dye) or something like pressurized air or leakdown test after the fact.

I guess you could engage in other antics but none of them would be all that effective since the car is towed by a cable until it's a few feet from whatever it's hitting.

<comment><USER28> Actually, you are right. I was thinking of NHTSA, which does braking tests on an actual track.

</comment></comment></comment><comment><USER29> Wow connecting cars to the internet? Sounds insanely dangerous. Not everything should be connected to the internet or "smart".

</comment><comment><USER30> Auto companies' lax attitudes towards systems security will change when insurance companies start considering such security vulnerabilities as safety issues and adjust their existing safety ratings appropriately.

<comment><USER31> Insurance companies already do. Insurance rates are actuarily based on actual accident frequency. Outlier risks are covered by reinsurance. Not only are insurance companies well funded, they employ smart people and work in an information network with a lot of depth.

<comment><USER32> Yeah, right. The only way insurance companies are competitive and pricing risk correctly is if there's a magic responsibility fairy that bestows wisdom and driving ability upon all at midnight on their 25th birthday.

<comment><USER31> If the band is 20-25, they charge everyone based on age 20, otherwise they would be subsidizing high risk drivers instead of generating more profit on 21-24 year olds. Actuaries are applied mathematicians, and typically of above average intelligence compared to the general populace.

<comment><USER32> Why would the band have to be 20-25 for every insurance company in the country? Why not be innovative and create an accurately priced 24-25 band and undercut your competition?

I'll tell you why: because insurance companies are a rent-seeking oligopoly with an enormous barrier to entry. They just sit there and make a fortune doing jack shit.

</comment></comment></comment></comment></comment><comment><USER33> Based upon my own experience (in another industry), I have no doubt that there were knowledgeable people internally who warned them of this -- if they were not fully cowed by the bureaucracy.

I have zero sympathy for the manufacturers. I only hope that, if they decide to go on a witch hunt, they actually seek and punish the morons in power who, most likely for self-serving purposes, let this slide.

This also should raise a ringing cry to rein in DMCA et al. uses that seek to outlaw such research. In this case, the manufacturer has obviated their authority in the matter.

</comment><comment><USER34> > The company added that hacking its vehicles was a "criminal action".

screw that attitude.

I hope government will make the equivalent of whistleblower protection for security researchers that report exploitable flaws, because it's the only way to increase security over time.

i.e. I'm scared as hell that planes are allegedly hackable but researchers aren't really talking about it nor testing it properly because fear of lawsuits.

</comment><comment><USER35> In other news Apple just hired Doug Betts, former FCA 'quality' boss

[http://blog.caranddriver.com/fiat-chrysler-quality-chief- res...](http://blog.caranddriver.com/fiat-chrysler-quality-chief-resigns-one- day-after-terrible-consumer-reports-rankings/)

[http://www.autonews.com/article/20141028/OEM02/141029851/bet...](http://www.autonews.com/article/20141028/OEM02/141029851/betts- leaves-chrysler-after-another-poor-quality-showing)

[http://www.techtimes.com/articles/70582/20150721/apple- hires...](http://www.techtimes.com/articles/70582/20150721/apple-hires-fiat- chrysler-executive-doug-betts-beep-beep-beep-icar-coming.htm)

because nothing screams quality like a 'decided to leave one day after yet another drop in Consumer Report rankings' and 1.4m car recall!

</comment><comment><USER36> I've been spending a bit of time over the last couple of months reading up on CAN, OBD2, system architectures for automotive systems, attack vectors, various forms of CAN-attacks, building stuff that interfaces with CAN buses, writing software, figuring out how things work etc. And I have to say that many of the comments in this thread are frighteningly uninformed.

I know this is supposed to be The Magic Kingdom where people are only supposed to say positive things and eat happy pills all day, but would it kill people to at least try to read up about the things they so willingly share their "insights" on before posting here?

At the very least, try to understand how CAN works before spouting nonsense grounded in uninformed assumption. Uninformed opinions are not helpful. They just pollute the discussion.

</comment><comment><USER37> At RSA I was at a car hacking session, and the big take away I got is how some of these systems have none upgradable firmware, and today's designs sent for manufacturing now aren't due for 2017-2018 model year cars. So some of these vulns could be baked in, in a way that have expensive work arounds because the car manufacturers have been so feature driven rather than security conscious. It's the car equivalent of bloat/crap ware on phones. Features that drive up selling the customer. The cars that have OTA firmware updates (BMW was one example) are able to push out fixes faster, and with more complete coverage than recalls so it seems sane to me to make it mandatory such "smart cars" can be OTA updated.

</comment><comment><USER38> Do we really need our vehicles to have so much technology?

I know I'll get down voted, but it has to be asked.

<comment><USER39> Short answer, no.

But, consumers expect a infotainment user experience at least as good as hanging an iPad in the car, and if your car doesn't provide that, they will rate it poorly in surveys.

Source / Disclaimer - I work for GM.

</comment></comment><comment><USER40> So despite the huge uproar at [https://news.ycombinator.com/item?id=9921557](https://news.ycombinator.com/item?id=9921557), it turns out the end did justify the means.

<comment><USER41> That only holds if there were no better means that could have achieved the same ends.

<comment><USER40> It's possible, but can you cite another example of when a news article caused a recall to be issued a couple days later? It seems unlikely - usually takes months if anything happens at all.

<comment><USER42> Do you really think this article would be less successful if the driver was on a test track?

<comment><USER43> Yes I think that. This was on local news early in the morning, just to cite one source from which I rarely get hacking stories. Normally they just talk about weather and how the elderly are getting scammed. This test occurring on a public road created an effective visual, that pushed the story into many more media channels.

<comment><USER44> I think 'hackers turned off the breaks on a car with a reporter in it at 70mph' would have made headlines even if it took place on a test track. It's a juicy story with plenty of 'it could happen to you' scare factor built in.

</comment></comment></comment></comment></comment></comment><comment><USER45> Auto makers will have to make sure that they can update their software remotely or this going to become really expensive very soon.

<comment><USER7> What's to say this wasn't precisely that? Maybe at the talk we will learn that accidentally uconnect was listening to the update FW messages from the sprint network.

Often the board that handles the radio acts like a bridge in modern cars. It tends to be the beefiest computer hardware in the vehicle. So it is on the high speed CAN bus and a node on the more star shaped low speed bus.

When they updated the FW, they removed the bit of code that prevented dangerous messages IDs from leaving the controllers on the radio board and possibly added code that could put arbitrary CAN bus messages on the buses as relay from the sprint network.

I am very eagerly awaiting the talk.

</comment></comment><comment><USER46> They claim that only US cars are affected. Is this because liability costs are much higher in the US or is there really a different software used in the rest of the world?

<comment><USER23> It could also be related to the cell network used.

<comment><USER46> Good point. I guess there could also be some other service involved that's US only, something like OnStar.

</comment></comment></comment><comment><USER47> > _" I wonder what is cheaper, designing secure cars or doing recalls?"_

Ever the enduring question

</comment><comment><USER48> If you have to update software in person, you shouldn't be in the software business.

</comment><comment><USER49> Why does Jeep in particular have so much issue with quality assurance? The most memorable is the SUV rolling over in a simple test a couple years ago which have been fixed but it's quite worrying.

[https://www.youtube.com/watch?v=zaYFLb8WMGM](https://www.youtube.com/watch?v=zaYFLb8WMGM)

<comment><USER20> First off that test is somewhat of a joke for SUVs since it basically rewards car-ish handling which is at odds with the truck-ish performance that is demanded of larger SUVs

In terms of comparing two different vehicles...

If the $year base model $carA has a suspension system closer in performance to the sport model of $year $carB but for $year+1 they put a much softer suspension in the base model of $carA in response to customer feedback then the results go out the window. Alternatively, if the OE tires are particularly expensive then you can bet that most owners will replace them with cheaper one. Additionally, particular trims are often incredibly rare or almost always have a particular option added. So testing a $trim without $package will be of little meaning when the vast majority of $trim that make it to dealer lots will have $package. In either case the results go out the window because there's a handful of large variables that are uncontrolled for. It's little better than the comparisons you see in car commercials.

If you actually want to grill Jeep over something I suggest you read up on 90s XJ gas tank fires.</comment></comment>


Microsoft open sources Trill to deliver insights on a trillion events a day - <AUTHOR> https://azure.microsoft.com/en-us/blog/microsoft-open-sources-trill-to-deliver-insights-on-a-trillion-events-a-day/ <comment><AUTHOR> Research paper: [https://www.microsoft.com/en-us/research/wp- content/uploads/...](https://www.microsoft.com/en-us/research/wp- content/uploads/2016/02/trill-vldb2015.pdf)</comment>


Ask HN: Email service for sending personal emails? - <AUTHOR> I run a webapp and I'd like to send a bunch of emails to my users at different times in their journey, such as an email asking to schedule a meeting to see if they need help after they signed up. Another instance, I'd like to send monthly emails to ask for feedback with surveys. But I want the emails to be as personal as they can. Which email provider can I use to make my emails personal? <comment><USER2> Pretty much all of them support template and custom fields. The harder part will be the personalization values.

What does a personal email look like to you?

<comment><AUTHOR> 1\. The from address needs to be my personal email.

2\. Email content should be plain text.

3\. Email should not end up as promotional/spam</comment></comment>


100 Years Ago, a Telephone Tower in Stockholm Connected 5000 Phone Lines (2014) - <AUTHOR> https://twistedsifter.com/2014/08/stockholm-telephone-tower-connects-5000-lines/ <comment><USER2> Being not aware of this type of thing anywhere else ( except maybe those overloaded street corner phone poles you see in Asia) it would seem either this was extremely early and advanced and in a very affluent, high density city that could justify and capitalise on its benefits very early or that in other places they realised it didn't scale and went with street poles and pits and exchanges and benefited from later adoption. Where was London or New York or Paris in terms of telephone subscriber adoption at the time?

<comment><USER3> >either this was extremely early and advanced and in a very affluent, high density city that could justify and capitalise on its benefits...

People visiting Stockholm nowadays - or even people _living_ there, for that matter - have little idea how poor and slum-ridden the city was just fifty years ago: the town center was full of small and cramped apartments housing whole families in single rooms, lacking bathrooms and toilets (everyone shared a row of earth toilets in the yard, and washed once a week in communal baths).

So, based on the high-tech and affluent Stockholm you see now, it's easy to jump to the conclusion that this was an "early and advanced" technical solution, when actually it's simply a product of the very small scale of the town. The area 'inomtullarna' (which comprises the entire city center, excluding the dormitory suburbs), could easily fit inside the single London borough of Camden, for instance.

<comment><USER4> Yes as a native I have heard if this, but Sweden was also a relatively rich and technologically advanced country at the time despite all the slums of Stockholm so I assume there must have been wealthy parts too.

</comment></comment></comment><comment><USER5> The switchboard room inside that building is also pretty fancy looking:

[https://sv.wikipedia.org/wiki/Allmänna_Telefonaktiebolagets_...](https://sv.wikipedia.org/wiki/Allmänna_Telefonaktiebolagets_hus#/media/Fil:Allmänna_Telefonaktiebolagets_första_telefonsal.jpg)

Even more photos here: [https://www.flickr.com/photos/tekniskamuseet- telehistoriska/...](https://www.flickr.com/photos/tekniskamuseet- telehistoriska/albums/72157626273929661)

</comment><comment><USER6> Nice photos. Extra info about "telefontornet" can be found in [https://www.ericsson.com/en/blog/2014/10/when-the- telephone-...](https://www.ericsson.com/en/blog/2014/10/when-the-telephone- lines-darkened-the-sun-in-stockholm)

</comment><comment><USER7> A thread from 2014: [https://news.ycombinator.com/item?id=7546715](https://news.ycombinator.com/item?id=7546715)

I feel like there have been others. Anybody find one?

</comment><comment><USER8> From the article, the tower had been decommissioned over a century before the article was published a few years ago. This is Victorian-era tech; steampunk but real. This was not high tech post-WWI, as the headline would indicate.

</comment><comment><USER9> Ah, so that's what it means to be connected to the cloud?

I think this is a suitable example for the "Clean Code" book, the chapter about refactoring.

And also: Do you think they've built a mock somewhere with 5000 phones as a test rig?

</comment><comment><USER10> That's awesome how the could align the coords like that. Reminds me of Osaka where I could look up and see phone lines everywhere. It was beautiful in a chaotic and nostalgic kind of way.

<comment><USER11> There's something incredibly reassuring about seeing your 1Gbit line physically enter your house from the street pole.

It also makes the city seems like cyberpunk central, which is pretty cool.

</comment></comment><comment><USER12> Then they redid everything in Erlang.

</comment><comment><USER13> The central switch near this tower was the subject of mass surveillance during WWII. They basically employed a massive amount of women who were just listening in on phone calls trying to find criminal activity and national security concerns.

Source: W. Agrell, Vem kan man lita på?, ISBN 9789175452395

<comment><USER14> Just like room 641A, Folsum St, San Francisco.

Fascinating how technology changes but humans don't.

</comment></comment><comment><USER15> Small Village solution implemented in large scale. They also tried one big switchboard, but finally ended up with some 50 operators with common trunk lines. Last time I saw Telephone Tower was in Suomenlinna 1950's with 30 lines and it was already a rats' nest.

</comment><comment><USER16> When this was built, was it assumed that this would be a temporary structure? Was there any long-term thinking at all, or just an immediate need?

Also, this thing looks like a fabulous lightning distribution network during thunderstorms.

</comment><comment><USER17> Related: There is a whole sub reddit cableporn in which people compete who makes the neatest cable wirings.

Https://Reddit/r/cableporn

</comment><comment><USER18> Insulation was a big problem before plastics. Varnished cloth, mostly. Hence so much open wire.

</comment><comment><USER19> I suspect this is effectively a an aerial copper cross connect / distribution location</comment>


Introduction to Computer Organization: ARM Assembly Language on the Raspberry Pi - <AUTHOR> http://bob.cs.sonoma.edu/IntroCompOrg-RPi/intro-co-rpi.html <comment><USER2> Awesome! Personally, I think that ARM assembly has a TON of potential for teaching people how to code and/or work with electronics hardware from a state of almost no background knowledge.

\- They teach the concept of a computer program as a bunch of single small logical 'steps'.

\- They make it easier to keep new students interested without plying them with pages and pages of 'magic code' \- not only can you make a zero- dependencies program (in the case of simple mobile chips), your 'hello world' is actually in the physical world. An LED, a motor, what-have-you.

\- The core instruction set for a Cortex-M0+ processor has what, 60 instructions? It's not very complicated.

On the con side of things, the whole idea of registers controlling hardware peripherals can be a little weird, and you have to get people comfortable with command-line debugging utilities. The _concepts_ are simple, but GDB isn't. And many of the available IDEs aren't very cross-platform.

And I guess application processors also probably introduce their own extra complexities, compared to a Cortex-M line which is more comparable to an Arduino than a RasPi or Chromebook. But hey, there's also less hardware available with the sort of support that a Raspberry Pi has; the closest you'd probably get is a cheap generic $3-5 STM32F103C8 dev board.

If anyone else is interested in this sort of thing, the reference manuals provided by ARM are also very readable, for example: [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0484c/DD...](http://infocenter.arm.com/help/topic/com.arm.doc.ddi0484c/DDI0484C_cortex_m0p_r0p1_trm.pdf)

<comment><USER3> Maybe it's just me, but I don't think basing a whole book on a sparsely- documented SoC from a notoriously proprietary company is a great idea at all. There are plenty of other ARM processors with far more documentation available, and if your goal is to teach how computers work from the hardware up, also plenty of other much simpler and equally well-documented microcontrollers.

<comment><USER4> I also don't like that the Pi is not fully open, but it is also extremely available and cheap, so an ideal system for people starting out. And ARM assembly is a much nicer first assembly language than x86. A microcontroller is a possibility, but has its own barriers to entry (not a standalone computer in itself, can't be attached easily to display, etc.).

Maybe someday the lowrisc project will become a reality, and they can use that, and teach RISC-V instead.

<comment><USER5> 6502s are cheap (though probably not as widely available as a complete system) and have an even simpler assembly language.

</comment></comment></comment></comment><comment><USER6> Very clearly written. Thanks for posting. Would recommend to anyone wishing to dive deep into architectures. And I love that you are teaching undergrads with the RP3 ;)

Anyone wanting more, the MIT Computational Structures courses are always available via EDX:

[https://www.edx.org/course/computation- structures-3-computer...](https://www.edx.org/course/computation- structures-3-computer-mitx-6-004-3x-0)

</comment><comment><USER7> Wow, this is absolutely amazing. I'm just starting out and this is actually pretty inspirational, especially as I have a few Pi's already.

I hear stories about the 'good old days' when everyone was hacking on some amazing open hardware and earning their chops knee deep in assembler etc etc.

This kind of feels like I might get a little taste of that by following this book.

Awesome!

PS - Is there a hardcopy or pdf available too?

</comment><comment><USER8> I've had a quick look through and I really like this. Bookmarked for future reading.

As a security person, I have just one request - in 2.9 you explain/recall how functions look in C, then you explain printf, then the first C statement you execute is

printf("Enter an unsigned decimal integer: ");

Please, please can this kind of thing be printf("%s", "Enter an unsigned decimal integer: ");

I know this string is a compile-time constant, so it's not going to hurt anyone, but you're teaching people the old myth that printf(string) is the way to print a string and at some point they'll try this with a user-supplied string.

In my opinion, a printf with only one argument is always a code smell.

EDIT: also, the solutions to exercises 1 and 2 in 2.16 are vulnerable to buffer overflows.

<comment><USER9> > I know this string is a compile-time constant, so it's not going to hurt > anyone, but you're teaching people the old myth that printf(string) is the > way to print a string and at some point they'll try this with a user- > supplied string.

I am also very security-conscious in my programming, but the rule that I apply is

       printf(string);

is the way to use if string is some compile-time constant that visibly contains no '%' character and

      printf("%s", string);

is the way to go otherwise. In this sense I consider the rule

> In my opinion, a printf with only one argument is always a code smell.

as cargo-cult coding.

<comment><USER8> Your answer is correct, secure and has fewer false positives than mine. But I interpret cargo cult to mean doing something with no unserstanding why it should work (and in the original example, ending up with "it doesn't work"). That's not the case here.

"Code smell" to me means code that should make you feel bad when reading/writing it, as opposed to code that's wrong - a psychological device to make code that often is wrong, always look wrong. The classic example is if(a = b) which is sometimes really what you want - but I'd write this if((a = b)) in this case to make it clear it's deliberate. printf("%s", str) is the same kind of thing, and it means when I'm reviewing code I don't have to go and check whether str really is a compile-time constant or not. Better still, it's also a sign to the human reader that there's no fancy formatting going on here - you're really just printing a string.

"Always use 2+ arguments to printf" is a rule for humans that has the advantage of being really easy to follow and to teach and avoids the most common version of the vulnerability. I don't mind people who know what they're doing breaking this rule (sometimes breaking a rule when you know it's ok is pretty much a definition of being an expert) but I do include the rule whenever I'm teaching printf to beginners.

<comment><USER10> From a security perspective I would be more concerned with using printf at all when puts/fputs would have been fine and less susceptible to possible run-time errors. If you're not really using a formatting template for anything meaningful, you shouldn't be using a string formatting function. So the point that you should "always use 2+ arguments to printf" holds, but the solution isn't to make the first argument "%s".

<comment><USER9> I accept your reasoning, but I am a little bit divided on this advice. On the one hand your reasoning is sound. On the other hand, in particular in an embedded or security field one wants to keep the code footprint really small if possible (fewer lines of code mean fewer lines of code that might contain a bug - of course under the assumption that the bug rate is constant in both code bases). So if one does not even have puts/fputs in the codebase, there trivially cannot be any obscure corner case bug in the used puts/fputs implementation.

<comment><USER10> From a security standpoint, if your standard I/O implementation has a bug in its `fputs`, it is broken on such a fundamental level that you should print it, delete it and burn the printed copy. Better to find this out with something relatively trivial with a minimal surface for errors like puts than through an obscure format string.

`printf` gives the caller more opportunities to accidentally cause bugs. The difference in LOC when comparing for example FreeBSD `puts` to `printf` variants is so great that if you had any reason to doubt the implementation of the standard library you would be better off writing your own formatting functions and print everything with puts/putc because that would likely be easier to test and verify than identifying all the edge cases in `printf` flag parsing.

Personally, I think either way to do it is fine, but since we're seemingly all in the mood to be picky about code smell, security and such, I thought I'd join in. In reality the examples mentioned are not production code, and they are likely to be used with GNU libc, not Cheap Chip Factory libc 0.0.1 alpha. In most cases, the standard library is well exercised because its use is ubiquitous. If that can not be assumed, and you're somehow stuck with a broken standard library, I'd rather go ahead and verify puts, and let _you_ dig into the `vsprintf` parser and make sure it works in all the cases it gives the caller an opportunity to create :)

</comment></comment></comment></comment></comment></comment><comment><USER11> Massive upvote, the standard text book for Computer Organization is Patterson and Hennesy's "Computer Organization and Design: The Hardware/Software Interface"

Its a lovely book, but its hard to get hold of MIPS processors these days. Hopefully this creates a new generation of devs which can tinker with real hardware and are armed with proper education behind how it all works.

Super happy, wish I had this during mys schooling. :)

<comment><USER12> There are now ARMv8 and RISC-V editions of COAD. I'm sort of waiting for the second edition of the ARMv8 version. However at this point I prefer COAD to CAAQA which is bloated with IMHO non CA stuff.

</comment></comment><comment><USER13> Back in the 8/16 bit days, ARM assembly was said to be one of the best features of Acorns — even compared with 68k asm. Maybe it's finally time to look at this...

<comment><USER14> Yes, although the new instruction set in ARMv8 removes several of the things that made programming in 'classic' ARM assembly such fun on the Acorn, such as the free barrel shifter on most arithmetic ops, conditional execution on all instructions and fast multiple loads/stores with groups of registers. These have gone for various reasons; the fully-flexible barrel shifter is awkward at high frequencies with deep pipelines, the conditional execution flags became a waste of opcode space as branch prediction improved and the load/store multiples required microcode on modern implementations and so increased complexity.

</comment></comment><comment><USER15> Superb. This is so neatly and thoughtfully organized. Presented in simple terms and covers a lot of ground. Great stuff to build upon.

</comment><comment><USER16> This looks like a superbly designed curriculum.

</comment><comment><USER17> Thanks for posting!</comment>


The Inhumanity of Homeless Sweeps - <AUTHOR> https://48hills.org/2019/03/the-inhumanity-of-homeless-sweeps/ <comment><USER2> The proposal/ask and the end of the article (allowing the homeless to build their own housing) is interesting. Is there any evidence that this works or doesn't work?

<comment><USER3> Look into the history of the San Jose homeless encampment known as "The Jungle", in the Guadalupe River watershed.</comment></comment>


How People Share Content On The Web - <AUTHOR> http://www.businessinsider.com/chart-of-the-day-social-networking-sites-dominate-sharing-2009-7 <comment><USER2> Twitter is bigger than Yahoo and MSN combined? you gotta be kidding me.

[Edit:

This is according to AddToAny, makers of a website widget that publishers can put on their sites to allow visitors to share the content with their friends.

What are the odds that sites that have this widget are run by Web 2.0 hipster twitterati, and their readers are of their kind?

P.S. I do all my link sharing via Skype, IRC, and various IM services.]</comment>


Nobody F***ing Cares - <AUTHOR> http://techcrunch.com/2013/06/12/nfc/

<comment><USER2> Wow, haven't seen such blatant fanboy(girl)-ism in quite a while. Apple doesn't do something so nobody cares? it's articles like these that convince me that the 'Fruity Cargo Cult' is real.

</comment><comment><USER3> The article being mainly about Apple and their non-implementation seems justifiable, given the Apple just, ya know.

<comment><USER3> *that</comment></comment>


If Lee had not won the Battle of Gettysburg - <AUTHOR> https://www.winstonchurchill.org/publications/finest-hour-extras/qif-lee-had-not-won-the-battle-of-gettysburgq/ <comment><USER2> A fun read, though quite fanciful. I'll defer to posts about this on Civil War forums ( [https://civilwartalk.com/threads/winston-churchill-if-lee- ha...](https://civilwartalk.com/threads/winston-churchill-if-lee-had-won- gettysburg-he-would-have-freed-the-slaves.98318/) ) where forumgoers find the idea that Lee would have ever been in a position to free the slaves somewhat ludicrous.

<comment><USER3> Wouldn't Lee have fought for the North if his state didn't secede? So Lee might have, but if the South was likely to do so, they wouldn't have seceded in the first place.

I'm also curious as to what exactly Churchill imagined for the southern slaves. He's a bit coy about it but certainly votes don't seem to be part of the plan.

</comment></comment><comment><USER4> I don't get it. Was he trying to predict an alternate future? Cause no way in heck was Lee freeing the slaves.</comment>


Is prediabetes a medical condition that needs attention? - <AUTHOR> https://medicalxpress.com/news/2019-03-prediabetes-medical-condition-attention.html <comment><AUTHOR> > _Charles Piller, a contributing correspondent for Science, has published a > news article in the journal questioning the medical soundness of referring > to prediabetes as a condition that needs treatment. In his article, he > points out that there is little to no scientific evidence linking > prediabetes to diabetes. He also notes that prediabetes has not been found > to cause health problems in people who have been so diagnosed._

> _Piller also suggests another problem. The ADA is a nonprofit organization > and relies on donations to survive. Much of those funds, he found, come from > pharmaceutical companies that sell drugs such as metformin, which have been > developed to reduce the damage that diabetes does to the body. He concludes > by suggesting that coinage of the term has led to classifying many healthy > people as having an illness, which has led to negative consequences for them > such as financial losses due to having to pay for care, and unnecessary > anxiety._</comment>


Show HN: ReelSurfer Mobile Watch Page - <AUTHOR> http://reelsurfer.com/watch/reel_entry/4627

<comment><USER2> HTC One X using Chrome on ICS.

1.) The video just does not load up for me both on cellular data and WiFi. 2.) The Create submenu is cut off. I see "Create a Ree".

<comment><AUTHOR> Thanks! Do regular youtube videos play for you?

</comment></comment><comment><AUTHOR> Hello HN, we would love your feedback / any glitches you might see on different devices</comment>


Cloudera files to raise $200M in IPO - <AUTHOR> https://venturebeat.com/2017/03/31/cloudera-files-to-raise-200-million-in-ipo/ <comment><USER2> With passages like

"We have incurred net losses since our founding in 2008, including net losses of $135.4 million , $203.1 million and $187.3 million for the years ended January 31, 2015 , 2016 and 2017 , respectively, and expect to continue to incur net losses for the foreseeable future. As a result, we had an accumulated deficit of $676.0 million at January 31, 2017 . "

in their S-1, seems like it'd be a brave investor who wants involved here.

<comment><USER3> This isn't unique. From Snap, which had a net operating loss in 2016 of $515 million, compared with a net loss of $373 million a year earlier:

"We have incurred operating losses in the past, expect to incur operating losses in the future, and may never achieve or maintain profitability"</comment></comment>


No Country for Slow Broadband - <AUTHOR> http://www.nytimes.com/2013/06/16/opinion/sunday/no-country-for-slow-broadband.html?_r=0 <comment><USER2> Where I live (Eastern europe) I pay 18 euro/month for 100Mbit download and 50 upload with no crap TV or phone subscription attached. And no traffic limits - you can move 10TB in downloading and seeding "linux isos" and nobody minds.

Quick price check says that comparable speeds in US cost few times that except for Google Fiber where the pricing is sane. Go google.

Until the general public in the States pays lower than that can the author shut up and try to bring real low cost, high speed, high reliability broadband to the masses.

</comment><comment><USER3> "The major causes for low subscribership, as extensive survey research shows, are low interest in the Internet and minimal digital literacy."

I'd really like to see these surveys</comment>


Most Popular "Show HN" Posts Of All Time (Ranked By Points) - <AUTHOR> http://www.panabee.com/show-hn?time=best-of

<comment><USER2> Doing a search for "Show HN" will give you pretty much the exact same list.

[https://hn.algolia.com/?q="Show+HN"](https://hn.algolia.com/?q="Show+HN")</comment>


Google tech talk on Node.js - <AUTHOR> http://www.youtube.com/watch?v=F6k8lTrAE2g

<comment><USER2> I think this says a lot about Google, from the intro:

 _"The first time I heard about Node.js I thought, What a crazy guy he's trying to put JavaScript on the server when everybody is trying to put Java on the client"_

Personally, I stopped trying to put Java on client in the mid-90s.

<comment><USER3> I think the comment was very Google specific. A couple of example projects there are GWT, which compiles Java into JavaScript, and Android, which uses the Java language compiled into Dalvik byte-code. In both cases, the Java language is being used although they aren't attempting to place or use Java (tm) VMs on the client site.

</comment></comment><comment><USER4> Node looks so promising. Every time I hear something about it I hit Google hoping that by now there's a Rails or Django for Node, but there always just seems to be a mass of 200-line projects, none of which I would be comfortable starting a project on.

EDIT: Look what I found: <http://geddyjs.org/>

<comment><USER5> I really don't see the point of using frameworks (libraries are fine). You should write your own. It's a lot easier than you think and you get full understanding and control of your request/response cycle. Learning and mastering somebody else's framework usually takes longer, and it may not solve your specific use case all the time.

<comment><USER6> I really don't see the point of using cars (parts are fine). You should build your own. It's a lot easier than you think and you get full understand and control of your vehicle. Learning and mastering someone else's vehicle usually takes longer and it may not solve your specific transportation needs all the time.

Besides it being flat-out wrong that mastering a framework takes longer than building one (you _will_ have to support it), the typical framework is a lot larger than the code of the applications built on top of them.

Building a framework is a bit like writing a DSL, a good framework abstracts out the work that would otherwise be duplicated many times over and will help to standardise the codebases of various projects and will help to allow integration of bits and pieces from different projects in a re-usable way.

There is a reason why rails, django, drupal and a bunch of others are wildly popular, they save people oodles of time.

<comment><USER7> Both the framework and no framework approaches have merit.

Choosing a framework limits your choices. If I'm using Django, it won't work (or work well) with a non-rel backend. If I'm using jQuery and I need to update one of the libraries (say jQuery UI) I might have to update jQuery as well, etc.

What you think saves oodles of times doesn't always. The odd bug, the odd crash etc that keeps popping up may have roots in the framework that you chose and that you're using without having knowledge of its internals. The framework might make your app much slower and cost you in terms of hardware.

Not using a framework is harder work initially, but with the right libraries it isn't that big of a leap. Picking up a smaller framework with libraries can be a surprisingly easy and a lot more flexible when your needs end up being different from what the framework intended.

Ofcourse, there is a flip side to it all and I understand your point :) Micro- frameworks are the best IMO, not the beasts that Rails/Django are.

</comment></comment></comment></comment><comment><USER8> This is awesome. There's also a great virtual panel on some of the most popular Node.js projects on GitHub. Here's the link: <http://www.infoq.com/articles/nodejs-frameworks>

<comment><USER9> The InfoQ panel gives a great overview. Thanks.

</comment></comment><comment><USER6> I'm all for the wild explosion of new tech, that said when the time rolls around to pick a toolset for building a new application I'll invariably do a step back and I'll pick something that has been around for a couple of years.

The reason is fairly simple, new stuff usually contains tons of bugs and it remains to be seen if it is still going to be around a few years down the road.

I'm a coward that way, but when my income is on the line I don't want to be beta testing someone else's code without having a very good chance that the problem I'm trying to find is mine and not some bug in underlying code.

For hobby stuff and learning I love to play around with new things, as soon as it is 'business' I'm a lot more conservative.

<comment><USER10> I'm somewhat involved in the development of Node. It's a fast-moving project, with the occasional bug and an API that is still in flux. You might not want to build your billion dollar enterprise on it and one could hardly blame you.

That being said, Node has a strong community and a lot of momentum. There are some big name companies like Yahoo and Plurk that use Node today to build stuff that matters.

<comment><USER6> Ok, I'll take it for a test drive.</comment></comment></comment>


Ask HN: What am I missing about this FCC order? - <AUTHOR> Considering that almost 60% of us now use a web browser specifically owned / designed by the world's biggest advertising company (1) that leaks privacy even in "incognito" mode (2) I feel like we're not having an intellectually honest discussion about this FCC order.
Google - in fact - originally opposed this framework when Obama wrote it into action (1) in the first place!
The new FCC Chairman - Ajit Pai - has stated he endorsed this primarily to re-level the playing field for ISPs vs Facebook / Google / and the less visible ad tracking / ad profiling agencies.
And he's further stated that he's going to use this opportunity, of resetting the playing field, to create a framework that applies for EVERYTHING digital.
I am not going to pretend that I am optimistic that the FCC is going to build a consumer framework that we can all live with, but I am confused how Google / FB / etc are getting away with murder on the privacy / profiling side, and the entire issue has been shifted to focus @ the ISP level?
If we're going to fight for our privacy, Google / Facebook should be at the top of the list to enact "opt-in" only profiling on, in addition to the ISPs.
(1) https://ecfsapi.fcc.gov/file/100319291940/2016-10-03%20Google%20Letter%20(WC%2016-106).pdf
(2) https://www.netmarketshare.com/browser-market-share.aspx?qprid=0&qpcustomd=0
(3) https://www.quora.com/Does-Google-track-what-happens-in-the-incognito-window <comment><USER2> I don't use Google or Facebook since I have a choice. I can use Firefox, DuckDuckGo, and Telegram. However, I don't have a choice on the internet itself. There is no alternative to the internet.

</comment><comment><USER3> Partly because people have short memories. Google's tracking is old news but the FCC stuff is news.

Partly people want to retain any privacy gain they can get, however small.

Some reports say that ISP, browser, and Web site privacy will be regulated by the FTC in the future so it would be interesting to hear what their policy is going to be.

</comment><comment><USER4> Not an expert, but one difference I see often mentioned is the ISPs have a monopoly. Don't like google tracking you then use DuckDuckGo. You don't have that choice with ISPs. I'm in Worcester (second "most populous" city in NE) I can pick Charter or Verison DSL</comment>


Sundar Pichai explains why Trump comes up when you image search for 'idiot' - <AUTHOR> https://www.businessinsider.com/google-ceo-explains-why-trump-photo-shows-up-under-idiot-2018-12 <comment><USER2> The people who think google has control over their algorithm like that are idiots too

</comment><comment><USER3> is it the same reason Mitch McConnell's face comes up when I search for:

senator turtle</comment>


Raging Bulls: How Wall Street Got Addicted to Light-Speed Trading - <AUTHOR> http://www.wired.com/business/2012/08/ff_wallstreet_trading/all/1?viewall=true <comment><USER3> Disclaimer: I am a developer in the HFT space.

This is utter crap.

As long as there has been a transfer of money, there has always been a market for faster access to information and faster use of that information. Its only in the last ten years that the speed is so fast it has to be done electronically.

There's a autobiography of a stock trader written in the early 1900s called Reminiscence of a Stock Operator where, in 1907/1908, the author is complaining that the time to execute a trade is too long. Specifically, he would notice a price movement on the tape, tell his runner to go (for example) buy 100 at $60, but by the time the runner was actually able to execute, the price was at $80, hence he's getting a worse price. The solution back then was faster runners, then faster communication (such as hand signals), then computers, etc.

Wall Street is not just HFT. Different firms have different ways of trying to make money. Some are speculators, some are value investors, some are arbitrageurs, some are market makers. Some companies trade to hedge risk in, for example, commodities that they expect to buy in the future. Others trade to hedge currency risk against countries they do business with.

To claim that Wall Street used to bet on companies that build things but now only bet on companies that make money is terrible mass-market journalism at best.

<comment><USER4> I know a lot of people at major investment firms and not one of them trades HFT. I'd assume HFT is an extremely small percentage of the overall market in terms of average position size.

<comment><USER5> If they are trading any stocks at all, they will be using essentially the same systems as HF traders. Any big broker-dealer ('big' in terms of quantity of orders processed) will be a high frequency trader by definition, because they aggregate large quantities of customer order flow, process it rapidly, and send the orders out in rapid succession.

</comment></comment></comment><comment><USER6> I'm going to go ahead and qualify this next statement by saying that I know little to nothing about high frequency trading and little about finance in general, but when Wired covers technology subjects I do have in depth knowledge about it's riddled with sloppy reporting and sensationalism. This has happened enough times that I usually skip their coverage entirely and when I do read their stories I do so with a very skeptical eye.

This piece may be different, but I would have know way to know since it's outside my field. It just makes me sad that I can no longer give them the benefit of the doubt. I used to love Wired. However, as I've become more and more knowledgeable about web technology and marketing over the course of my career, the more I see them as one more sensationalistic rag doing bad science and technology reporting for the mainstream.

</comment><comment><USER7> The problem isn't trading fast, it's trading unfairly. Not following regulations. Heaping the costs of speed on others, while reaping the benefits. We have documented hundreds of examples of clear rule violations. <http://www.nanex.net/aqck/aqckIndex.html>

Did you know that in 1999, during the internet bull market, the system processed just 1000 quotes/second, and today it's 1.5 million/second? Guess who pays for that? Guess who benefits? <http://www.nanex.net/aqck2/3528.html>

Did you know that your orders to ETrade and other retail brokers are tagged as "dumb" and sold to the highest bidder like Knight, UBS, Citadel, who then internally match your order (it never goes to the exchange, except during the flash crash). They give you the price from the slower system, but buy/sell from the faster one. The incentive to skew the two is irresistible. <http://www.nanex.net/aqck2/3519.html>

When you get a price-improvement of a penny on a 100 share $60,000 apple trade, they steal 99 cents - and front run some other investor, who's order is left hanging (sometimes forever). It happens in Apple more than 2,000 times a day. <http://www.nanex.net/aqck2/3520.html>

When you offer to buy something at a price, then yank that price before the other party can see it (speed of light), is that fair? It happens millions of times a day. <http://www.nanex.net/Research/bloodbot/bloodbot.html>

I could go on and on.

<comment><USER8> Great to have nanex here. I am very interested in hearing why you (and surprising number of other vendors) support windows, but not unix. I don't mean that in an accusatory sense, I'm genuinely curious if there are that many people who run automated trading models on a windows machine.

Regarding the topic on hand. When e-trade sells their order flow, aren't they obligated to provide 'best execution?' You are speaking of rebate for liquidity, correct? If NITE and BATS are both quoting the same price, then e-trade has the choice of sending to either, but if NITE has better price, they e-trade has no choice but to route the order to NITE, correct?

<comment><USER7> Rebate for liquidity is entirely different. So is retail price improvement (aka sub-penny pricing).

Retail order flow is sold to a wholesaler like Nite who matches it internally. They are allowed (best execution) to give you the price at the NBBO during a 1 second window. For less active stocks, the NBBO price can change 1,000/second or more. For all stocks, the NBBO price will be slower than the direct feed price. This latency and differential makes it a risk free trade (so long as you don't accidentally release your test code into production: see <http://www.nanex.net/aqck2/3525.html>)

There is no way to prove what prices existed on all markets at the time your trade was executed, meaning it's on the honor system. So this depends on your trust in Wall Street to give you the best deal.

BTW, we recently added support for linux.

</comment></comment></comment><comment><USER9> One of the dirty little secrets is that a lot of all the easy money was made a while ago. The media's just kinda catching up now. The increased cost of playing this game means fewer and fewer firms are able to chase fewer and fewer dollars.

They're squeezing themselves out of the market. It's like any other thing in the market: as people see profits they get into a market and accept a lower profit target until the market stabilizes on the marginal cost to produce the good. In this case the good is liquidity for the market.

Just give it time to play out. The "problem", if there is one, is kind of taking care of itself. If you want to direct your energy at a real problem, focus on the old-boys-network of getting stuff done in banking: commoditize the crap out of the financial sector's business by breaking down the moats and walls that allow high finance to run scams like the dotcom bubble, the housing bubble, and manipulating the LIBOR.

</comment><comment><USER10> Note that Knight has clarified that it lost closer to $270 million rather than the $440 million it originally estimated [1].

[1] [http://www.bloomberg.com/news/2012-08-08/joyce-tells- clients...](http://www.bloomberg.com/news/2012-08-08/joyce-tells-clients- knight-in-good-standing-with-clearing-firms.html)

<comment><USER11> It still was a $440M pre-tax loss. The $270M figures is post-tax.

</comment></comment><comment><USER12> Wall Street firms are not "addicted" to faster trading: they NEED faster trading to keep up with the competition. That's not news. For as long as financial markets have existed, market players have been in a never-ending technological arms race, constantly seeking to get information and execute trades faster, hopefully gaining a temporary advantage until the competition catches up.

Leaving aside the hyped-up nature of this Wired article, there is a legitimate debate, ongoing, as to whether automated high-frequency trading is beneficial or detrimental to society. On one side of the debate, there are economists, regulators, and market participants who sincerely believe markets normally are, or otherwise tend toward, equilibrium, so allowing more trading motivated by profit, regardless of whether it's automated or not, makes markets more efficient and stable, which in their view is beneficial to society.

On the other side of the debate, there are many critics (e.g., the late Benoit Mandlebrot, Nassim Nicholas Taleb, economist Steve Keen, Keynes biographer Lord Skidlesky, etc.) who believe markets are never in equilibrium, and can unexpectedly 'spin out of control' just like other highly complex, dynamic systems, so it's a _terrible idea_ to have market stability relying on the second-to-second behavior of automated trading systems that can make decisions and act on them much, much faster than humans could ever react to a market debacle.

In my view, the second group is right, but if anyone here disagrees, I'd love to hear their thoughts.

<comment><USER13> I do not agree with either view.

Crashes happened in 1929, when everything was done on paper, and even long before that, when transactions took even longer to complete. Everything is faster these days, but it is not qualitatively different.

"Benefit to society" is not, and never was, an optimization criterion to how markets are being run. Forget the rose tinted economics text books. The way markets have been run in the last 200 years or so (at least) is to benefit the big players. There are some benefits to society, such as a standardized way of raising money by companies that lets the investors remain liquid, as well as some standard forms of insurance (all derivatives are, one way or another, a form of insurance and COMPLETELY EQUIVALENTLY, a gamble, depending on how you view life).

The problem is that it's a wild west now. There are a lot of laws on the books that are not being observed, or are being observed only against some players, but not others.

There's a regulation that says any order you put into the market must have behind it the intention to execute. Now, please tell me how 10,000 order/cancel/order/cancel events per second (often with the same price but different quantities) can satisfy that regulation? I had been in algo trading for 7 years, and I'm not aware of a single plausible explanation, let alone one that would work for 50 firms, 250 days a year, 4 hours a day.

Modern trading is a wild west casino. Regulators have been long ago captured, and the few that weren't appear to be either powerless, incompetent, corrupt or worse. (see: madoff w.r.t markopolos, the total lack of action against mfg/corzine - there are hundreds of examples; read zerohedge or denninger for new examples daily)

<comment><USER12> beagle3: you make several great points, all of which, AFAICT, are in agreement with the second view: financial markets are inherently unstable -- and yes, regulatory capture, rampant fraud, and 'wild west casino' behavior are all factors contributing to instability -- _speed just magnifies their impact._ Many of the people in the second camp have made the same points as you in their calls for increased regulatory supervision and enforcement.

Note that the years preceding the Crash of 1929, commonly referred to as the "Roaring 20's," were also years of 'wild west' behavior. Consider that the CEO of Chase National Bank, one Albert Wiggin, was caught secretly selling short his bank's stock in 1929, at the same time he was committing his bank's money to buying the bank's shares, and he did this through a Canadian shell company to avoid US taxes.[1] Or consider that the Chairman of the NY Stock Exchange, one Richard Whitney, was sent to jail at Sing-Sing for embezzlement in 1938.[2]

The forced separation of commercial and investment banks by Glass-Steagall in 1933, the creation of the SEC in 1934, and the enactment of many investor- and market-protection laws and regulations via the Investment Company act of 1940, were all a response to the Crash of 1929 and the resulting Great Depression. The underlying assumption behind all these efforts was that Wall Street could not be left to its own devices.

The country subsequently had decades of relative financial market stability: there were no crashes like 1929 until the regulatory apparatus was dismantled in the 1980's and 1990's, leading to the crisis of 2008.

\--

[1] <http://en.wikipedia.org/wiki/Albert_Wiggin>

[2] <http://en.wikipedia.org/wiki/Richard_Whitney_%28financier%29>

<comment><USER13> > all of which, AFAICT, are in agreement with the second view:

As you presented it, the speed is an important factor in the second view - <USER2> disagree. Proper regulations (assuming they are observed and diligently enforced) should be time-scale independent.

Glass Steagall kept the system-as-a-whole safe -- e.g., it would have greatly reduced the effect of the "subprime" crisis (though sadly, blame lays just as much with the Clinton administration, which means GlassSteagall might not have helped). But is mostly unrelated to HFT - e.g. Knight Capital, which lost $440M million in the course of 45 minutes last week, would not have been subject to Glass Steagall.

The fact that everything seemed stable does not indicate everything was indeed stable - e.g. Madoff was doing his thing for the last 17 years, and things blew up only because many people wanted to get their money back in the same time (as a result of their losses in other places).

There is an interesting result from complex system theory, which is that when such a system breaks down, it always looks like there is a specific culprit / event, but the truth is that any one of hundreds of qualitatively different events would have started the ball rolling.

All of the big banks (and most governments, including the US, Japan, UK) are bankrupt - or at least would be, if they were run like a business, no one dares admit it (although greece and ireland were already forced to, spain italy and portugal will need to admit that sooner than later).

We will hopefully know the truth about this crisis in the future. It is unlikely that we will have a reasonable idea before 20 more years have passed (and especially the statute of criminal violations....), though.

<comment><USER12> beagle3: yes, in an ideal world, regulations should be time-scale independent, and they should be observed and diligently enforced. The problem is that _human judgment -- which is still necessary for enforcing regulations in the face of market participants who're constantly trying to game them -- is not time-scale independent._

As I presented it in my first comment above, the second side believes "it's a terrible idea to have market stability relying on the second-to-second behavior of automated trading systems that can make decisions and act on them _much, much faster than humans could ever react to a market debacle._ " (Emphasis added.)

As I see it, we're largely in agreement.

</comment></comment></comment></comment></comment><comment><USER14> Very interesting animated chart showing what HFT has done to the different markets <http://imgur.com/DxWer>

</comment><comment><USER15> Here, let me save the HFT apologists from their post:

liquidity market-makers benefits retail investors handwave handwave march of technology fat guy in a suit waving his fingers around liquidity liquidity liquidity paying 1/8 of a cent for a trade obviously harms the retail investor more than the entire market crashing when algorithms fight with each other handwave handwave market making you don't understand the importance of liquidity market maker liquidity liquidity no fat guys in suits.

</comment><comment><USER16> There's nothing intrinsic about markets that says they have to move towards faster and faster trading. For example, markets could decide that they now want to clear every second, on the second. That's larger than the RTT around the globe and so global markets could remain in sync.

The spread would increase marginally but the upside is that PhDs could focus on making their algorithms smarter, not just faster.

</comment><comment><USER17> This article is bad on so many levels. I am about to vote for leaving out wired from HN.

<comment><USER18> As someone who knows just about nothing about HFT(theoretically this article's target market) I don't see anything wrong with it. Care to elaborate about why its "bad on so many levels"?

<comment><USER17> They conflate algo trading with high frequency trading among other things.

This post <http://www.chrisstucchio.com/blog/2012/hft_apology.html> will explain it better than I can.

</comment></comment></comment><comment><USER19> tl;dr: We missed out on Facebook because of regulation. regulation lowers market efficiency, markets have always evolved, HFT improves pricing and order fulfillment

Like seemingly everything wired writes these days this article is nonsense, written from the perspective of an agenda. Wired regularly comes out with these neo-luddite articles. The reality is, software bugs cause money. Knight was punished for their "sins".

Meanwhile I profit because HFT makes the market more efficient for me. I know this with certainty because I trade derivatives (options spreads) and I've done so in areas where there is no HFT and where there is a lot of HFT. My orders go better at closer prices when there's HFT going on. I've experienced the additional market liquidity first hand, and the underlying is shockingly stable for the nature of the business, so I don't think anyone could say that HFT is destabilizing the stock price.

At this point people might be tempted to shout "anecdote" but the thing is, economics and reason also support this view. Thinly traded markets are simply less price efficient because there are less people analyzing price and thus willing to buy or sell at a little better price. Computers are efficient at this (I know almost all the counter parties to my trades are computers, it is really easy to see because they react instantaneously to my actions.)

Finally let me point something out. Facebooks IPO has been pretty poor, while Google's was great. Google was able to go public when it was still in its high growth phase. This meant that the public was able to invest in google and make very high returns. Facebook, however, grew up in a different regulatory environment, especially after 2008 (Which was itself a result of regulation in the first place, though for political reasons we're fed a constant stream of lies to the contrary) ... in this regulatory environment going public is much more difficult.

Thus, instead of you and me profiting from buying facebook stock in 2006, where we would be up 100-fold by now, only venture capitalists and large companies were allowed to participate in that. This is really a shame. In the 1990s a company like facebook would have gone public much earlier. People seem to think that because there was a bubble (again government created) and some companies went bust that somehow magically "regulation" will "protect" people. It doesn't, it just hurts people. We all missed out on Facebook, and now facebook was forced into a situation where its stock is going to suck wind for awhile-- hurting the entire startup sector.

But it always starts with articles like this-- nonsense to scare people about HFT, this creates the political support for legislation (which always favors certain interests, not the least of which are the politicians who wouldn't do it otherwise) at the expense of society.

<comment><USER20> >Meanwhile I profit because HFT makes the market more efficient for me.

High frequency trading does not increase liquidity in a way that directly benefits anyone but high frequency traders. Being able to liquidate assets in a fraction of a second less does not benefit the normal investor. Not even getting into the volatility it adds.</comment></comment>


Confessions of a Paleo Diet Pioneer - <AUTHOR> http://www.wsj.com/articles/an-evolutionary-guide-revised-on-what-to-eat-1453306447?tesla=y <comment><USER2> The evidence for plant-based, low-fat vegan diets seems more convincing to me. Is there a paleo version of [http://nutritionfacts.org](http://nutritionfacts.org) \- complete with direct links or citations to research supporting the proposed way to eat? I'm not trying to be snarky, but rather genuinely curious what scientific basis this diet really has. The article says we're wise to limit saturated fat intake and increase fibre intake, but isn't that antithetical to eating meat and animal products?

<comment><USER3> If you like nutritionfacts.org, you may be interested to know Greger wrote a book which is well referenced:

[http://www.amazon.com/How-Not-Die-Discover- Scientifically/dp...](http://www.amazon.com/How-Not-Die-Discover- Scientifically/dp/1250066115/)

Also, there was a recent article on Vox talking about why nutrition research is so hard to do:

[http://www.vox.com/2016/1/14/10760622/nutrition-science- comp...](http://www.vox.com/2016/1/14/10760622/nutrition-science-complicated)

<comment><USER4> And if you have an Android phone, I created an app for the section of the book about the Daily Dozen foods you should be eating every day. Here is a link if you are interested: [https://play.google.com/store/apps/details?id=org.slavick.da...](https://play.google.com/store/apps/details?id=org.slavick.dailydozen)

</comment></comment></comment><comment><USER5> > Recent data on these issues make me more comfortable today saying what not > to eat. Our ancestors had no ...

Isn't that yet another fallacy? Just because our ancestors didn't have it, doesn't automatically mean it's bad for us. If we can learn anything at all from our ancestors, then it's that the human body is pretty adoptable to different food sources. So if we want to know what's bad for us we should simply do studies today. It's not that I disagree with the recommendations, but I find the way of reasoning flawed.

<comment><USER6> In the case of refined carbohydrates, there is abundant evidence that they are bad for us.

</comment></comment><comment><USER7> > Most humans have to avoid dairy; many must avoid wheat. Find out if you're > one of them.

And how do I find out if I have to avoid dairy or wheat ? Last year I stopped eating them for a couple of months but didn't see a notable difference in my general well being.

<comment><USER8> If you noticed no difference, that seems like a good sign it might be alright for you. That said, based on people I know, those who should not be eating dairy or wheat get various levels of intestinal distress if they do; it's pretty obvious.

But most importantly, consult a doctor or other medical professional if you need more information.

<comment><USER9> _it 's pretty obvious_

this is what I don't get: author says _most_ should avoid dairy, you (and others) say it's easy to recognize problems with eating it. Yet the vast majority of all people I know have no problems with dairy whatsoever. So is the author wrong, does he mean something else, do I live with people who can't recognize problems originating from dairy use or do I live with a special subgroup of people who all happen to have no problem with dairy?

<comment><USER10> For dairy in particular, it's the last one. Globally, lactose persistence (the opposite of lactose intolerance) is a minority trait that appears to have arisen in populations that raised domesticated cattle, but not elsewhere. Most African and southeast Asian adults, for example, are lactose intolerant. See [https://en.wikipedia.org/wiki/Lactase_persistence](https://en.wikipedia.org/wiki/Lactase_persistence)

<comment><USER8> I just wanted to point out that African and Asian adults would certainly constitute "most" people, based on population. As I understand it, populations that can consume dairy tend to be centered on Northern Europe, a very small fraction of the global population.

I'll only speak for myself, but I was first thrown off by the "most" part as well, until I realized I had a pretty Euro-centric view of it. "Most people I know have no problem with dairy," I thought to myself. Then I remembered most people I know have European ancestry.

</comment></comment></comment></comment></comment><comment><USER11> Does the below excerpt alleviate the belief that GMO foods are harmful?

        In 1985 scientists believed that few genetic changes had occurred since we were all
        hunting and gathering, say 10,000 years ago. Now we know that lots of genes
        have changed. One fascinating new finding is that within the last few thousand
        years Eskimos evolved genes for enzymes to process the fatty acids in Arctic
        fish.

<comment><USER12> Only if you believe the process followed by GMO engineering is the same as the process of selective breeding

<comment><USER11> So your point is ... the same or not?

<comment><USER12> Well I am careful because I am not a specialist. One would however expect GMO engineers to use techniques that are atypical of the way nature explores the possibility space. It is telling that they call it engineering, which requires intent and goals.

Therefore I don't think knowing that selectively bred organisms have been safe so far says anything about the safety of GMOs.

</comment></comment></comment></comment><comment><USER13> I've always appreciated Michael Pollan's essay (and books) on this subject. His advice can be summed up as "Eat food. Not too much. Mostly plants." [1] In his books he argues strongly against the nutritionist strategy of trying to separate out the healthy components of foods from the foods themselves. For example, I know many nutritionists who take vitamins, but Pollan points out when you take the Vitamin C without the orange we normally get it from, you loose all that dietary fiber. This is what he means by "eat food."

Along these lines, while I have many quibbles with the paleo diet's recommendations, my biggest complain is calling it "paleo." The paleolithic era of human history lasted from 2.5 million years ago to 10,0000 years ago [2], when agriculture took over and we adapted to an entirely new diet. Almost nothing we eat today existed 3,000-10,000 years ago: corn was just grass, tomatoes were berries, lettuce was weeds, and all animal-food sources were free-range, tough to chew, and gamey in flavor. One of the starkest examples of this for me is the peach, which was mostly just a pit with no meat until generations of farmers spent 6,000 years turning it into the meaty succulent fruit we know today [3]. Our paleolithic ancestors spent all day nibbling on seeds, berries, various leaves, and insects trying to just stay alive; our agrarian ancestors transformed the Earth into the relative paradise of bountiful fruits, vegetables, and livestock that theologians would later attribute to gods.

This said, I appreciate that this author is speaking out against the high- carb, high-sugar foodstuffs corporations are pouring into us by adding sugar and salt to EVERYTHING. The key quote in this essay is, "Recent data on these issues make me more comfortable today saying what _not_ to eat." I think we all need to start pushing back as consumers against the sugar, salt, and simple carbohydrates the food manufacturers engineer into everything we eat to addict our brains and keep us coming back for more.

[1] [http://www.nytimes.com/2007/01/28/magazine/28nutritionism.t....](http://www.nytimes.com/2007/01/28/magazine/28nutritionism.t.html?_r=0)

[2] [https://en.wikipedia.org/wiki/Paleolithic](https://en.wikipedia.org/wiki/Paleolithic)

[3] [https://jameskennedymonash.wordpress.com/2014/07/09/artifici...](https://jameskennedymonash.wordpress.com/2014/07/09/artificial- vs-natural-peach/)

<comment><USER14> I've heard mixed things about salt. For example, look at the results in this Google search[1]. "Salt is obviously bad." "It's a myth, salt is probably fine." Etc. My takeaway has been that, as long as you don't have high blood pressure or some specific condition, the typical amount of salt in modern diets is fine.

[1] [https://www.google.com/search?q=salt+in+diet&ie=utf-8&oe=utf...](https://www.google.com/search?q=salt+in+diet&ie=utf-8&oe=utf-8)

<comment><USER2> > My takeaway has been that, as long as you don't have high blood pressure or > some specific condition, the typical amount of salt in modern diets is fine.

But, salt is exactly what raises blood pressure in the first place. Take a look at this - [http://nutritionfacts.org/video/the-evidence-that-salt- raise...](http://nutritionfacts.org/video/the-evidence-that-salt-raises-blood- pressure/)

</comment></comment></comment><comment><USER15> "Clean eating is about feelings, not reality." [https://www.sciencebasedmedicine.org/the-clean-eating- delusi...](https://www.sciencebasedmedicine.org/the-clean-eating-delusion/)

</comment><comment><USER16> I know most of us start a diet just to lose weight (I know I did), but paleo has really become a lifestyle, and a life changing decision for me. Losing weight was just an added bonus, but the true benefits were great for my health in general. I'm using the paleo grub cookbook, you can check it out at [http://lookingupstuff.com/weightloss/2015/04/23/paleo- grubs/](http://lookingupstuff.com/weightloss/2015/04/23/paleo-grubs/)

</comment><comment><USER17> Whoa.. way more vegan hackers than I ever imagined!

</comment><comment><USER18> we know what the current mainstream high-carb diet will lead to: epidemic levels of obesity and type 2 diabetes.

bon appétit.

</comment><comment><USER17> Whole-food plant-based vegan here. Life is good. Energy is high.

<comment><USER19> Okay, so we've got the unrelated vegan comment, there's already an unrelated CrossFit comment, all we need is someone to mention they're an atheist and we've got the trifecta.

It's almost as if nutrition is incredibly complex and different things work for different people.

<comment><USER20> Funny you should mention that.

As a Christian I think you should eat everything there is because if God put it there, He obviously intended us to use it.

<comment><USER17> I thought God mentioned something about humans protecting animals? Then fall of man happened and something changed..

<comment><USER20> You'd think so but as with any religion there are different interpretations. There's a very libertarian (economically speaking, not civil rights) strand of Christianity that can be summarized in what I parodied: because the world was intelligently designed it's our god-given right to subdue nature and make the best use of it.

</comment></comment></comment></comment></comment><comment><USER21> The only person I know who did this diet ended up staying 350 pounds with persisting respitory issues. (Obviously present before the diet) he sat on me the other day and just about crushed my rib cage. But I'm still at a cool 135 lbs just eating whatever I want (which is surprisingly almost entirely organic foods) I'm here to tell you, Paleo probably doesn't do shit besides stroke your fucking ego into thinking you're a caveman or some dumbass shit.

<comment><USER22> One anecdote, one data point.

Paleo isn't magic, but it is consistent with previous advice. High in fruits, veggies, seafoods, nuts, and unprocessed meats. Low in sugars, other processed foods, grains, and dairy.

I'm sure someone could do Paleo and stay 350 pounds, but that would be hard as eating almost 3000 calories a day from fruits, veggies, seafoods, nuts, and unprocessed meats is hard since they're so filling per weight (as opposed to sugar in particular which is not at all filing per weight).

To be honest you can simplify Paleo thusly: Drop sugar from your diet as completely as possible.</comment></comment>


Statistics of Deadly Quarrels (2002) - <AUTHOR> http://www.americanscientist.org/issues/id.3269,y.0,no.,content.true,page.1,css.print/issue.aspx

<comment><USER2> That font is way too small.

<comment><USER3> Try the non-print version: [http://www.americanscientist.org/issues/pub/statistics-of- de...](http://www.americanscientist.org/issues/pub/statistics-of-deadly- quarrels)

It has a font adjustment link (although still pretty small).

</comment></comment><comment><USER4> This was discussed recently at [https://news.ycombinator.com/item?id=8114020](https://news.ycombinator.com/item?id=8114020). Is this article distinct enough not to bury as a dupe?

<comment><AUTHOR> Well, I think it's distinct, but I guess I'm biased. I was reminded of Richardson from the Nautilus link you reference, but I thought this article was a little more accessible. I got interested in Richardson from a chapter of Nate Silver's book "The Signal and the Noise", although it's focussed more on his attempts at predicting weather. Adaptation by Silver here: [http://www.nytimes.com/2012/09/09/magazine/the-weatherman- is...](http://www.nytimes.com/2012/09/09/magazine/the-weatherman-is-not-a- moron.html?pagewanted=all)

I also considered this shorter summary: [http://world.std.com/~jlr/comment/statistics.htm](http://world.std.com/~jlr/comment/statistics.htm)

The Wikipedia article on Richarson: [http://en.wikipedia.org/wiki/Lewis_Fry_Richardson](http://en.wikipedia.org/wiki/Lewis_Fry_Richardson)

This 1957 scholarly piece: [http://deepblue.lib.umich.edu/bitstream/handle/2027.42/67679...](http://deepblue.lib.umich.edu/bitstream/handle/2027.42/67679/10.1?sequence=2)

And this full UC Press book: [http://www.ucpress.edu/op.php?isbn=9780520038295](http://www.ucpress.edu/op.php?isbn=9780520038295)

I only found them now, but a couple chapters by Richardson himself are also online:

Statistics of Deadly Quarrels: [http://www.unz.org/Pub/NewmanJames-1957v02-01254?View=PDF](http://www.unz.org/Pub/NewmanJames-1957v02-01254?View=PDF)

Mathematics of War and Foreign Politics: [http://www.unz.org/Pub/NewmanJames-1957v02-01240?View=PDF](http://www.unz.org/Pub/NewmanJames-1957v02-01240?View=PDF)

Out of those, I thought the link I submitted was most appropriate. But no problem is you want to bury it and keep the discussion focussed on the Nautilus article.</comment></comment>


Apple Is Called Poised to Offer 'Cloud' Music - <AUTHOR> http://www.nytimes.com/2011/05/21/technology/21apple.html

<comment><AUTHOR> posting this, but seems like there is no new source other than the days old TechCrunch article</comment>