Joint Statement Regarding the Insolvency of Mt. Gox - <AUTHOR> http://blog.coinbase.com/post/77766809700/joint-statement-regarding-the-insolvency-of-mtgox <comment><USER2> For historical perspective, consider the last great panic to sweep the USA before the Federal Reserve was established:

[http://en.wikipedia.org/wiki/Panic_of_1907](http://en.wikipedia.org/wiki/Panic_of_1907)

What is (so far) missing in the world of Bitcoin is a single actor powerful enough to play the organizing role that Morgan played during that previous crash:

"Morgan summoned the presidents of the city's banks to his office. They started to arrive at 2 p.m.; Morgan informed them that as many as 50 stock exchange houses would fail unless $25 million was raised in 10 minutes. By 2:16 p.m., 14 bank presidents had pledged $23.6 million to keep the stock exchange afloat. The money reached the market at 2:30 p.m., in time to finish the day's trading, and by the 3 o'clock market close, $19 million had been loaned out. Disaster was averted. Morgan usually eschewed the press, but as he left his offices that night he made a statement to reporters: "If people will keep their money in the banks, everything will be all right""

<comment><USER3> If 50%+1 of the Bitcoin miners agree, couldn't they just mint 700000 extra bitcoin to make the depositors at MtGox whole? The confidence it inspires would probably be worth more than the impact of the inflation, and with Bitcoin prices dropping miners need to support the price to stay above break- even.

<comment><USER4> Technically speaking, yes. That would kill Bitcoin, though, because the community depends on it having an (eventually) fixed supply rather than it being having "an eventually fixed supply, except when we have a _really good_ reason to do quantitative easing."

<comment><USER5> Technically speaking, no.

patio11: that is not how the Bitcoin protocol works.

Even if 99% of the Bitcoin miners agree, they cannot create extra bitcoin; it is simply impossible because that is not something that miners control. Every full node (client) on the Bitcoin network verifies the validity of each block. A block that created more bitcoins than allowed by the protocol would be rejected by the clients (and the miners who follow the original rules). The "extra" bitcoins would be on a hard fork and thus invalid to anyone on the main (original) blockchain.

More info: [https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_...](https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_computing_power)

<comment><USER4> You're right, the defecting miners would have to convince people to download a new client, or convince the sites which those people access Bitcoin through to use the new client. Sorry, should have mentioned that, but I thought the thrust of the concern was "Could we just rewrite the rules of Bitcoin to make this retroactively not happen?" And the answer to that is "Yes, but the community would explode."

<comment><USER6> What you are describing has already happened once, with the rollback and the 0.7 -> 0.8 version upgrade.

</comment></comment></comment></comment></comment></comment><comment><USER7> "Acting as a custodian should require a high-bar, including appropriate security safeguards that are independently audited and tested on a regular basis, adequate balance sheets and reserves as commercial entities, transparent and accountable customer disclosures, and clear policies to not use customer assets for proprietary trading or for margin loans in leveraged trading. It does not appear to any of us that MtGox followed any these essential requirements as a financial services provider."

Did I miss the part where Coinbase, Kraken, Bitstamp, BTC China, Blockchain.info, and Circle met those essential requirements?

I guess those things are just essential now, not in the past.

<comment><USER8> So, the Bitcoin community is calling for regulation?

<comment><USER9> It sounds like self-regulation. If exchanges would just prove solvency periodically (which is possible with the blockchain), the whole world could see it. Wouldn't it be nice if you could see the balance sheet of your bank, in a way that accountants couldn't lie about it?

<comment><USER10> > It sounds like self-regulation.

Because that has worked wonders for the other industries -- let's have pharma companies, oil, food producers, just self regulate.

<comment><USER11> There are historical instances of self-regulation working. The movie and video game industries control their own content ratings and before the invention of dynamite, nitroglycerin was commonly used as an explosive in construction. Shipping NG is very dangerous because of its instability and many accidents occurred. They industry eventually developed extensive standards regarding shipping that vastly improved the safety of shipping NG.

<comment><USER12> _> movie and video game industries control their own content ratings_

Not sure you're helping yourself here. The established movie industry uses its content rating system as a bludgeon against independent filmmakers. The video game industry's content controls are largely a joke, assigned arbitrarily by people who never actually play the game.

<comment><USER13> How are movie ratings used as a bludgeon against independent filmmakers?

<comment><USER14> Short version: Most cinemas and other outlets in the US won't carry your movie if it's unrated, so in effect those who control the ratings control which movies can get distributed. Also most cinemas in the US won't show NC17 rated movies so the ratings people can also use that as a way to prevent your movie being shown to a large cinema audience if they want to.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> Wow, so Coinbase just changed the title. It used to read as velcro correctly posted on HN. [http://i.imgur.com/dX8315e.png](http://i.imgur.com/dX8315e.png)

<comment><USER8> Yes, note the URL linked from this page (which now redirects to a new URL) includes "the-insolvency-of-mtgox": [http://blog.coinbase.com/post/77766809700/joint-statement- re...](http://blog.coinbase.com/post/77766809700/joint-statement-regarding- the-insolvency-of-mtgox)

<comment><USER16> I know in this case it is true (I read it while it still had "insolvency" in the title) but for future reference, the only part that matters is the id in the URL, the second part can be made up like so [http://blog.coinbase.com/post/77766809700/i-just-made- this-u...](http://blog.coinbase.com/post/77766809700/i-just-made-this-up)

</comment></comment></comment><comment><USER17> This sort of thing is why finance is a regulated industry.

Although why anyone would have had money in Mt. Gox after they had their stateside accounts frozen is beyond me. It's not like there weren't any warning signs [http://www.techmeme.com/130620/p53#a130620p53](http://www.techmeme.com/130620/p53#a130620p53)

<comment><USER18> You can't have progress without the possibility of failure. I'm glad my local bank is regulated and insured by the government, but I'm also glad that the world of Bitcoin exists for people who want to experiment with digital currencies.

</comment></comment><comment><USER19> This is Coinbase, Kraken et al throwing MtGox under the bus to stop the taint from spreading. Note there is no mention of any help for MtGox or its customers. Just reassurance that they aren't MtGox.

This is the wagons being circled to stop the non MtGox price from tanking further.

<comment><USER20> Why should they help MtGox or its customers?

<comment><USER19> They shouldn't, but there seems to be the expectation that the community will step in and help MtGox out of this mess for the sake of Bitcoin.

It isn't going to happen as MtGox has been a boil that's needed to be lanced for a while now. This is the first step given that MtGox has decided to stay silent.

<comment><USER21> The best thing for the sake of bitcoin is for Gox to be gone. Maybe we could finally have a year where the incompetence of their engineering and management staff doesn't skew the price all about like a merry-go-round.

</comment></comment></comment></comment><comment><USER22> It is pretty entertaining to watch the bitcoin crowd slowly reinvent all the controls that exist in the existing monetary systems as they slowly learn what they are for. One lesson down, how many to go? :)

<comment><USER23> What controls? I see some empty reassurances, but nobody that I see is proposing controls. I doubt controls for existing monetary systems would work for bitcoins anyway as it requires a central organization that has power, like printing money, and enough vested interest to through good money after bad money to save the currency. Bitcoins have neither of these.

<comment><USER13> From the Article:

>Acting as a custodian should require a high-bar, including appropriate security safeguards that are independently audited and tested on a regular basis, adequate balance sheets and reserves as commercial entities, transparent and accountable customer disclosures, and clear policies to not use customer assets for proprietary trading or for margin loans in leveraged trading.

<comment><USER24> I believe that anywhichway hasn't found the names of the "independent[…] audit[ors]" in that document. He's being harsh, but his point is technically true: the text reads 'should' first. Hopefully, a matter of days.

</comment></comment></comment></comment><comment><USER25> > the digital currency industry.

It's like the beanie baby industry, minus the stuffed animals.

<comment><USER26> Or like the collectible card game industry.

<comment><USER27> Do you know any sites to sell and trade TCG and CCG cards?

<comment><USER26> Not yet, but I heard some guy in Japan was thinking of setting up an online exchange for magic the gathering cards.

</comment></comment></comment></comment><comment><USER28> Thinking about this...

 _This tragic violation of the trust of users of Mt.Gox was the result of one company's actions and does not reflect the resilience or value of bitcoin and the digital currency industry._

The best way to build trust in the 'resilience of Bitcoin' would be to leverage the blockchain technology to help document who lost what and monitor if/when any of those coins appear in the future. This is going to cost money as well as development time.

It's one thing wax pious about how and why this happened and to say it must never happen again etc. But the best thing the exchanges could do for their long-term credibility would be to each put up a chunk of cash and engage an expensive law firm to set up a trust and audit the whole affair as completely as possible. That's going to require a collective commitment of of a million dollars, or possibly a few million.

It's either that or get put under the microscope of existing financial regulators on their schedule, which (IMHO) will relegate BTC to the status of a disaffection currency that is only convertible in fringe markets.

</comment><comment><USER29> MtGox failed because they relied upon the correctness of their own implementation of the bitcoin protocol.

This was a huge mistake, one which I am sure will haunt all involved for a long time.

Coinbase is making the exact same mistake.

They rely on their own implementation of the bitcoin protocol.

Their client has been hard forked repeatedly.

Some of these incidents were random, but many were forced; not by attackers but by whitehats trying despirately to show them their error.

The danger of using their own implementation cannot be overstated.

For the love of god move to the reference client.

</comment><comment><USER30> "So, my Coinbase account was hacked, bitcoin stolen, now what?" [https://news.ycombinator.com/item?id=6946832](https://news.ycombinator.com/item?id=6946832)

FYI, after some time, Coinbase followed up with my support ticket and said tough luck, bitcoins lost, better luck next time. No mention was made of any effort to track-down the hacker or fraudulent transaction. They probably didn't even block the hacker's IP address.

And yet, Coinbase declares, "We strongly believe in transparent, thoughtful, and comprehensive consumer protection measures. We pledge to lead the way."

</comment><comment><USER31> [https://www.mtgox.com](https://www.mtgox.com) \-- The site is now blank

<comment><USER32> Wow, watching this thing unfold is like watching a train wreck in slow motion.

<comment><USER31> If you join the MTGOX irc channel its like watching the soviet union collapse.

<comment><USER33> link please. Freenode?

<comment><USER31> irc.freenode.net ##mtgox-chat

<comment><USER34> _#mtgox-chat Cannot join channel (+i) - you must be invited_

:(

<comment><USER35> Two #s, that was not a typo

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> Anyone else getting the sense that a lot of people on HN have a large investment in MtGox?

Not usually this much nay-saying (denial?) on here.

<comment><USER37> A lot of people _everywhere_ have a large investment in MtGox.

<comment><USER38> Um, no. The vast majority of people even among wealthy/high-tech countries have absolutely nothing to do with MtGox, and people in the rest of the world are even more distant from it. It might loom large on the horizon for you and for a significant percentage of HN users, but let's not completely lose perspective here.

<comment><USER39> If the other post is to believed, they have around 740,000 BTC. There are roughly 12,400,000 coins total at the moment. That pegs Mt. Gox's share at 6%.

<comment><USER21> I'm sure a lot more than 6% of all total bitcoins are lost to dead wallets and such already, though. Only drives up the scarcity of the rest of em.

I highly doubt Gox's coins are "gone" though. Someone has those wallets and almost certainly is going to make a pretty penny fucking over the customer base, but caveat emptor.

</comment></comment></comment></comment></comment><comment><USER40> Wow, reading the comments about ways to solve this above and I'm speechless... let's follow demands for regulation/self-regulation/FDIC-style insurance to its logical conclusion - it seems to me that everything will eventually come full circle and every financial institution and mechanism that people do not like today which moves them towards Bitcoin will ultimately be recreated by this new wave.

Bitcoin is not a revolution, it is not a movement, it's an iteration, and a significant one.

The same thing for the internet, today vs 1996, all the same huge media companies as before dominate the web with some new ones mixed in that jumped in early.

</comment><comment><USER41> Also:

[http://www.circle.com/2014/02/24/joint-statement- regarding-i...](http://www.circle.com/2014/02/24/joint-statement-regarding- insolvency-mt-gox/)

[http://blog.blockchain.info/2014/02/25/joint- statement/](http://blog.blockchain.info/2014/02/25/joint-statement/)

[https://vip.btcchina.com/page/notice20140225](https://vip.btcchina.com/page/notice20140225)

[http://www.reddit.com/r/Kraken/comments/1yux6n/joint_stateme...](http://www.reddit.com/r/Kraken/comments/1yux6n/joint_statement_regarding_mt_gox/)

<comment><USER8> Whoa, I just noticed the CEO of Circle is one of the creators of ColdFusion.

<comment><USER42> Not sure. The JJ Allaire mentioned here : [http://www.rstudio.com/about/](http://www.rstudio.com/about/) is probably different from the Jeremy Allaire mentioned here : [http://www.circle.com/about/](http://www.circle.com/about/)?

<comment><USER43> If Wikipedia can be believed [0], JJ Allaire [1] and Jeremy Allaire are brothers [2].

[0] I mean no slight against Wikipedia, I only mention this since the statement "He now runs a bitcoin start up in Boston" is supported by no citation (as of 2014-02-24).

[1] [http://en.wikipedia.org/wiki/Joseph_J._Allaire](http://en.wikipedia.org/wiki/Joseph_J._Allaire)

[2] [http://en.wikipedia.org/wiki/Jeremy_Allaire](http://en.wikipedia.org/wiki/Jeremy_Allaire)

<comment><USER40> Yes indeed they are brothers. Homesite/Dreamweaver/CFML forever baby, that's how I got my start coding. ColdFusion so, so, so far ahead of it's time.

</comment></comment></comment></comment></comment><comment><USER44> Although we shed a tear for not being included in this Industry Leading announcement, I think we can all make a group announcement on top of this joint announcement that announces that Mt.Gox is pretty crappy.

Travis Skweres - Cofounder, CoinMKT

<comment><USER38> Classy.

</comment></comment><comment><USER45> > We strongly believe in transparent, thoughtful, and comprehensive consumer > protection measures. We pledge to lead the way.

Words are cheap.

</comment><comment><USER46> Since a Hacker News participant first told me about Bitcoin Ticker[1] (back when a regulatory action in China caused a sharp drop in Bitcoin prices in U.S. dollars), the Bitcoin price has dropped still more. That's not the kind of volatility I look for in an investment.

[1] [http://bitcointicker.co/](http://bitcointicker.co/)

<comment><USER47> > That's not the kind of volatility I look for in an investment.

Are you aware that any investment that produces nothing other than a rising market price is pretty much guaranteed to have very high volatility?

</comment></comment><comment><USER48> So the story goes:

The new Russian President found a note in the desk of the old Russian President, "To my successor: When you find yourself in a hopeless situation which you cannot escape, open the first letter, and it will save you. Later, when you again find yourself in a hopeless situation from which you cannot escape, open the second letter."

A few months later, there was a massive problem. The new Russian President opened the first letter, which said, "Blame it all on me." He did. It worked great.

A little bit later, there was another massive problem. The new Russian President opened the second letter, which said, "Sit down, and write two letters."

I feel like this is the Bitcoin community collectively blaming the old Russian President. (Never mind the inherent flaws in the system.)

</comment><comment><USER49> This was signed by:

Jesse Powell — CEO of Kraken

Nejc Kodrič — CEO of Bitstamp.net

Bobby Lee — CEO of BTC China

Nicolas Cary — CEO of Blockchain.info

Jeremy Allaire — CEO of Circle

Fred Ehrsam — Co-founder of Coinbase

but NOT:

Brian Armstrong - CEO of CoinBase?

<comment><USER50> Maybe he's on a flight? Its not really necessary that it be signed by everyone at each company.

</comment></comment><comment><USER51> Hold on... which exchanges were using customer funds for margin loans?!? Was Mt. Gox doing this?

</comment><comment><USER52> Interesting to see these companies assume that the report is real. I wonder if they had contact with the owners of MtGox or if they simply wanted to get a jump on what is sure to be a major downswing in BTC prices.

<comment><USER49> This is coordinated. Which means they've known long enough to coordinate every exchange.

<comment><USER52> That is an interesting point. How long would it actually take to coordinate between those exchanges though? Its been a big day in BTC news and I'm sure everyone with some skin in the game is watching the news like a hawk.

<comment><USER49> Probably not very long. But I'd wager they've known since at least this morning. Given last night's resignation of Mt. Gox from the Foundation, I'd say since last night.

</comment></comment></comment></comment><comment><USER53> Wow! I can see a misguided politician already saying something like "Maybe all bitcoin exchanges/wallets/etc need money transmitter licenses or FDIC insurance"

</comment><comment><USER54> I think it would be cool to hear what the creator of Bitcoin thinks about all this. Is it annoying? Or is it the beauty of a new technology that's still cutting its teeth.

<comment><USER55> Good luck finding Satoshi Nakamoto. Also this wasn't a bitcoin issue, it was an exchange issue.

<comment><USER54> I know it's not a bit coin problem, but I'd like to hear his (or her) thoughts on how people are implementing the technology, how these sorts of problems are being handled and what he sees as the major lessons learned (other than don't trust some non-insured entity with your cash).

</comment></comment></comment><comment><USER56> My response:

[http://www.aarongreenspan.com/writing/essay.html?id=100](http://www.aarongreenspan.com/writing/essay.html?id=100)

</comment><comment><USER57> So it seems, in essence, that the fundamental issue is that MtGox became "Too big to fail," and this is what the repercussions on a currency market of the failure of a large and trusted institution look like.

It's an interesting object lesson for armchair economists, and I'm sure some hay will be made drawing comparisons to the US housing market crash and the value of the dollar.

</comment><comment><USER58> I think there should be some discussion about setting up a SIPC equivalent for Bitcoin exchanges. Each exchange/operator contributes dues that provide a fund for compensating losses in the event of a member's insolvency. That would also provide a strong incentive to for members cry fowl about bad practices, self- audit, etc.

</comment><comment><USER59> After the first rumblings of problems at MtGox, I moved my BTC over to a local wallet. Best decision I made all last year!

</comment><comment><USER60> Is it possible to fine the bit coins that were stolen and then effectively devalue them? One thing the miners should be able to do is refuse to verify transactions with the stolen BTC.

<comment><USER61> There is always that option. But what if you got some bitcoins today that turned out to have been stolen two months ago?

It might be a good idea, but it's antithetical to the community.

</comment></comment><comment><USER62> isn't the bitcoin scene beginning to resemble a modern government in recession? carefully crafted statements, avoiding to say much, but very reassuring... markets be praised!

the leaked "Crisis Strategy Draft" slideshow seems like it was actually authored by these companies, not MtGox.

</comment><comment><USER63> "In order to re-establish the trust squandered by the failings of Mt. Gox, responsible bitcoin exchanges are working together and are committed to the future of bitcoin and the security of all customer funds."

As someone with funds stuck in gox, I optimistically hope that "all customer funds" includes gox customers, in the form of some sort of industry-led bailout.

<comment><USER28> Nothing personal (I don't know you at all)but I find it ironic that you want bitcoin users on other exchanges to pick up the tab for your poor investment decision. _Cavest investor_ , and all that. The irony of a bitcoin bailout is pretty damn thick.

<comment><USER63> Before the news of gox's massive 740k BTC loss, I had considered the possibility that a competing exchange would buy out MtGox, cover the small hole in customer balances (10-50k BTC) and gain a larger customer base while also boosting the confidence of the bitcoin community.

A "bailout" could have been mutually beneficial. 740k BTC is way too much.

<comment><USER28> Yeah, I should have added that by bailout I meant financed by other industry participants rather than via some notional hit on everyone's BTC holdings - but ultimately the cost would have to be passed back to the users in the form of increased transaction costs.

</comment></comment></comment></comment><comment><USER64> This feels like taking advantage of Gox's demise.

<comment><USER51> Mt Gox were pretty pathetic, I can't really blame them. But then again, they are worried about how it will affect bitcoin as a whole.

<comment><USER64> For all they did wrong, known for a very long time, they were the lead chargers in bitcoin and all these exchanges got "real investors" and after Mtgox was successful. If Mtgox were trading magic cards, the story would have been probably different for most exchanges. They deserve to shut down, and stop business. They dont deserve to get ridiculed because they didnt measure up to the expectancy created around an instrument they dealt with when it was worth nothing.

<comment><USER51> They took a lot of money and mismanaged it. They absolutely deserve the ridicule. They had _a lot_ of time to get their act together.

</comment></comment></comment></comment><comment><USER65> And now coinbase.com is down. Not a good sign...

</comment><comment><USER66> Note that the "industry leaders" who "stand by this statement" have published slightly different variations of it.

See, for example, Circle's statement[1], which styles itself as a joint statement regarding "the Insolvency of Mt.Gox", and describes Mt Gox's actions as "abhorrent". At the end of Circle's statement, after listing some of the high standards to which Bitcoin custodians should be held, the author(s) make this observation: "It does not appear to any of us that MtGox followed any these essential requirements as a financial services provider."

The statements of Kraken[2], BTC China[3] and Blockchain.info[4] also describe Mt Gox's actions as "abhorrent" and make the same observation about Mt Gox in relation to its compliance with appropriate standards.

Coinbase's statement[5], on the other hand, does not use "abhorrent" and does not express any view on whether Mt Gox complied with the "essential requirements" of a Bitcoin custodian. But the Coinbase statement does include this sentence: "Mtgox has confirmed its issues in private discussions with other members of the bitcoin community". That sentence is conspicuously absent from the other statements.

Finally, the Bitstamp.net[6] statement is completely different. It says that the "known losses" of fiat currency and Bitcoin "are limited to those balances that were in MtGox's care", and that Mt Gox "can best explain how this happened".

The names of the industry leaders appear at the bottom of each statement. Have they signed off on all of them?

Did some leaders edit the "joint" statement to avoid potentially defaming Mt Gox?

Or do some of them know something we don't?

\---

[1] Circle: [http://www.circle.com/2014/02/24/joint-statement- regarding-i...](http://www.circle.com/2014/02/24/joint-statement-regarding- insolvency-mt-gox/)

[2] Kraken: [http://www.reddit.com/r/Kraken/comments/1yux6n/joint_stateme...](http://www.reddit.com/r/Kraken/comments/1yux6n/joint_statement_regarding_mt_gox/)

[3] BTC China: [https://vip.btcchina.com/page/notice20140225](https://vip.btcchina.com/page/notice20140225)

[4] Blockchain.info: [http://blog.blockchain.info/2014/02/25/joint- statement/](http://blog.blockchain.info/2014/02/25/joint-statement/)

[5] Coinbase: [http://blog.coinbase.com/post/77766809700/joint-statement- re...](http://blog.coinbase.com/post/77766809700/joint-statement-regarding- the-insolvency-of-mtgox)

[6] Bitstamp.net: [https://www.bitstamp.net/article/Statement-by-Bitstamp- regar...](https://www.bitstamp.net/article/Statement-by-Bitstamp-regarding- MtGox-insolv/)</comment>


Could Mushrooms Take the Place of Styrofoam? - <AUTHOR> http://www.treehugger.com/files/2010/10/could-mushrooms-take-the-place-of-styrofoam.php?campaign=th_rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+treehuggersite+%28Treehugger%29 <comment><USER2> It would be interesting to find out what the energy costs of the pasteurization and inoculation phase of the process are.

Five day turn-around for production seems like a reasonable period of time, I'm sure the Styrofoam equivalent is assembled at a faster rate, but this looks like it could be scaled horizontally quite easily.

</comment><comment><USER3> From what I know, starch based packing peanuts are pretty common in the US already. How this would look without corn subsidies, I don't know…

ObJoke: "Thank you Mario! But our coffee machine is in another box!"</comment>


Show HN: Identity proof in six handshakes – starting with Why - <AUTHOR> https://medium.com/swlh/identity-proof-with-six-handshakes-starting-with-why-b90a6ddb67c1 <comment><AUTHOR> Hey, Hacker News! I'm developing a new blockchain project. It is an identity proof system based on the idea of six degrees of separation.

I have a vision, but I don't know how to get there yet. So I decided to start showing my thoughts online. I'm writing a series of posts, which I'll then transform into whitepaper. This way I hope to learn best (by explaining) and maybe get some help in brainstorming.

This is my first post. It is about personal motivation. In short: "My mission is to move the world towards peace and I believe it is possible by uniting the whole world in six handshakes".

If you have any project that come to your mind or any people involved in a project like this, or other interesting bits of information please let me know. I would be very happy to hear from you.</comment>


Oxford University admissions interview questions and answers revealed - <AUTHOR> http://www.theguardian.com/education/2015/oct/12/oxford-university-admissions-interview-questions-and-answers-revealed <comment><USER2> > Each person has to choose a number between 0 and 100 and the prize goes to > the person whose number is closest to two thirds of the average of all of > the numbers chosen. What number will you choose, and why?

A link for anybody who wants to know more about this question - but I do encourage you to spend a minute or two thinking about it before you click: [https://en.wikipedia.org/wiki/Guess_2/3_of_the_average](https://en.wikipedia.org/wiki/Guess_2/3_of_the_average)

<comment><USER3> Hm. People (at least I do) have a bias towards small numbers. Given the choice, I'd probably choose something below 20. I don't know how representative I am of the general population, but I'd guess the average to be around 15 and choose 10.

\--- SPOILER BELOW

EDIT: I tested myself on [http://twothirdsofaverage.creativitygames.net/](http://twothirdsofaverage.creativitygames.net/) (linked from the wikipedia article) and entered 9. The actual average was 14.

</comment></comment><comment><USER4> Interesting that the questions and the "right" answers select for a particular political perspective, notably the question about banking. It's particularly pertinent but also very politically charged and any answer will be controversial. I like the idea of having open-ended thoughtful questions like this in an admissions process instead of uninformative bland standardized tests which say nothing but they come with their own pitfalls -- it's very hard to avoid discriminating based on political affiliation, culture, etc. Knowing the political attitude of the reader of your answer would give you a huge edge in the admissions process and I think that's not ideal.

<comment><USER5> "the "right" answers select for a particular political perspective, notably the question about banking."

No they don't. The article gave two nuanced answers from different perspectives:

"A simple answer might be ... just the outcome of a competitive labour market...."

"An alternative story is that the banking industry is not competitive ..."

My Oxford interview (>20 years ago, mind) had a mixture of technical-ish questions (calculate the equilibrium point of these two demand/supply curves) and more open-ended ones (is inflation good or bad, and why?).

<comment><USER4> They gave two simplistic answers from the same perspective, and I think you have to share their perspective to think there's a difference between them. And neither actually answered the question, which was "On the question of bankers' pay, and whether the government should do something to limit how much they get" \-- it's clearly a question about where and when and why government interference in economic matters is appropriate, and whether or not this situation warrants it -- an ethical/philosophical question not simply an economic one.

Though I may be misunderstanding since I don't know the Oxford process very well -- from the way you're describing it, correct me if I'm wrong, applicants to Oxford are already very specialized and the question would be asked in a very specific economics-only context, in which case they've already filtered out anyone with a different perspective and the question is entirely appropriate.

<comment><USER5> Of course, those aren't the _only_ two good answers to the question but, remember, they're trying to make a distinction between 17-year-olds. They're not looking for a particularly perspective, but for some instinct to go deeper than gut feel.

I'm sure they'd be impressed with someone who thought about it from a philosophical perspective, talking about ethics etc., as long as there was some structure/foundation to the answer. My interview was with two people (at the same time), one specialising in philosophy and the other in economics.

Regarding the questions being specialised, I don't expect this is generally the case. At the time of my interview, I was studying Economics, Maths and Further Maths. So, the questions were challenging whilst still being within reach, given only things I had already studied at school. (e.g. in Economics I'd been introduced to supply and demand curves; in maths I'd been introduced to calculus; answering the question was simply a matter of seeing the link and putting the two together.)

</comment></comment></comment></comment><comment><USER6> The distillation is that they (and other similar institutions, actually) select for "interesting" answers, rather than "correct" ones, and ideally interesting answers that comport with their favored ideological framework.

<comment><USER7> How does that work with science / maths / engineering interviews? When asked to solve non-trivial calculus questions in an interview do you think they are more likely to admit students who give "interesting" answers or the ones who give correct answers?

</comment></comment><comment><USER8> If this link-bait? Did I miss something? I cant find any questions/answers in this article. Even the link to " sample selection released annually" only shows one question.

If not perhaps this should be flagged and the header updated to say "Oxford University expect to release admissions interview questions and answers"</comment>


Musical Fractal - <AUTHOR> https://www.youtube.com/watch?v=mq0z-sxjNlo <comment><AUTHOR> This is not about mapping a fractal to a sound which is what I see more often discussed. Instead this video is about zooming into a piece of music and finding self-similarity as you zoom in.</comment>


The Quest to Make Massive Gaming Worlds Realistically Complex - <AUTHOR> http://motherboard.vice.com/read/the-quest-to-make-massive-gaming-worlds-realistically-complex <comment><USER2> The article is not good.

It is true that games tend to be overly simplistic in this way, but it is really a design problem, not a technical problem.

Technically, we can litter the ground with stuff and have plenty of permanent- world changes. Design-wise, it is usually unclear how to make that a playable game. Using someone's middleware is not going to help this.

The premise of this article is another example of what Frank Lantz calls the Immersive Fallacy: [https://www.youtube.com/watch?v=6JzNt1bSk_U](https://www.youtube.com/watch?v=6JzNt1bSk_U)

<comment><USER3> Right. Such a world would need huge numbers of semi-intelligent NPCs cleaning up after the players.

In GTA, after you bashed a car or knocked over a sign, tow trucks, ambulances, fire trucks, and repair crews would show up. NPC firefighters and EMTs would extracted injured drivers from the wrecked cars and put them in ambulances, which then drive away to hospitals. Tow trucks tow away the damaged cars to impound lots or scrapyards. Repair crews show up and replace poles, restring wires, replace signs. Damage to buildings brings out owners, then insurance adjusters, then contractors, then construction crews with all their equipment. Like Sim City, but with more detail.

Running the world where nobody's watching uses a lot of compute power. Game design has traditionally avoided that. It might be affordable today.

Once the NPCs get good enough at running realistic simulated worlds, they can start taking jobs in the real world.

<comment><USER4> >Running the world where nobody's watching uses a lot of compute power.

That should not be true with proper design. The game would just store "car accident of type X and severity Y at time Z" until someone comes to watch. Then it would show the appropriate cleanup efforts that the watcher would witness.

<comment><USER3> That's what games do now. Switching between levels of detail like that tends to create artifacts, and requires lots of special casing.

</comment></comment></comment></comment><comment><USER5> I'm not getting any useful info out of that press release. It sounds like a work distribution system to improve scaling, but what has this to do with fetch quests? The 'boring' quests in MMOs are not designed that way because of technical restrictions, but game design restrictions to keep the game world under control despite thousands of players exploiting the game mechanics (that's the actual 'game play' in MMOs, trying to 'gamble the game rules'.

Simple linear quest lines, unlimited resources, limiting interaction between players (trading, etc...) help to keep the game world balanced for all players, and most importantly, enable the game to provide an interesting 'hero-story' to each player instead of just being a simple 'pawn'.

Older MMOs like Ultima Online provided much more freedom (and power) to players then current MMOs which are much more 'dumbed down'. I think the current state of MMO monoculture can be traced back to WoW's success. WoW was simple, linear, accessible, and extremely successful. Obviously this is what players wanted instead of the complicated and unforgiving Ultima Online, and everyone wanted to create a WoW killer.

May be the wheel of reincarnation is now turning again, there seems to be a small revival of 'sandbox MMOs' which are less about individual story and more about player interactions.

</comment><comment><USER6> Minecraft flips this on its head. It has permanence, massive world scaling, and endless potential for per-player experiences thanks to its purely open- ended nature.

</comment><comment><USER7> Back in the 90s when I wanted to be a game developer I thought that the perfect game engine would be a scaled up particle emulator - making every "object" just a complex of particles. In effect emulating the way the world is built with stable elements.

Having finally come back to development 2 decades later and doing work with virtual worlds I definitely think this is the right approach. It's basically what is already being built with nuclear simulation models and the like so I think there is definitely room to work between game engines, doing it at a more abstract level and the supercomputers doing it at the particle level.

<comment><USER8> Why do you think emulating our real world so closely would make the perfect game engine? How would you approach (semi-)abstract games in such engine?

</comment></comment><comment><USER9> Oh, so worlds will no longer cater to the magic teenage suburban fantasy that everything magically fixes itself in the background after they mess it up and leave the room?

</comment><comment><USER10> Sounds like they're abstracting away the backed for MMOs with some interesting defaults and ideas.

I'm sure it might be huge for MMO devs, but as a person that occasionally plays games, unless someone comes up with a way to have thousands of players in close proximity, in a FPS-complex world all served under 100ms I'm not really excited. That's pushing the frontier gaming-wise IMO.

I don't see this tech producing fundamentally better gaming experiences. It just might level the playing field for MMO ppl.

EDIT: they actually don't seem gaming focused, so perhaps it's just the article

</comment><comment><USER11> What this curated press release reminds me of, is when OpenCyc was released. Defining an ontology it contains detail and rules, which model things from materials and processes, to projectile weapons and of course swords and what not.

In theory, something like this should provide a technical resource of standard things, which designers could then employ and build on. And which programmers, could generate a more immersive world to build gameplay on. In practice OpenCyc is a resource hog, and the details and rules it contains are when examined found to be very limited.

</comment><comment><USER12> I'm surprised that neither the article, nor the people here have mentioned [http://www.wurmonline.com](http://www.wurmonline.com) as the probably most successful implementation of the sandbox concept, where one player's actions affect the virtual world for everyone else.

</comment><comment><USER13> Sounds to me like they're using actors to build MMOs.</comment>


Men's and women's brains are the same, says scientist - <AUTHOR> http://news.cnet.com/8301-17852_3-57620088-71/mens-and-womens-brains-are-the-same-says-scientist/ <comment><USER2> That's a terrible pair of photos to start the article with.

</comment><comment><USER3> Linking to the original Telegraph article would have been better, as it provides details of the talk given.

I'm not sure that a corollary of the Coca Cola - Pepsi visual test is a particularly informative thing to do. Didn't learn much.

</comment><comment><USER4> Yeah, they're the same, but different.

</comment><comment><USER5> This is really really really hard to believe, unless man and woman play the same role in the process of evolution. Think in this way: if evolution made man and woman physically different, how come it made man and woman mentally same?

Read: Who is Against Evolution?

[http://daviddfriedman.blogspot.com/2008/08/who-is-against- ev...](http://daviddfriedman.blogspot.com/2008/08/who-is-against- evolution.html)

Read: Is There Anything Good About Men?

[http://denisdutton.com/baumeister.htm](http://denisdutton.com/baumeister.htm)

<comment><USER6> This is an ideological position, not a scientific one. For many years it was the default position, the null hypothesis, that masculinity and femininity were mere social constructs, and that the human brain, being completely plastic, was shaped by 'patriarchal' social conditioning into male and female forms, making the female subordinate. It was Marxist class theory crudely forced on to biology,

Contrary evidence has piled up over the years against this null hypothesis, until now it is quite untenable.</comment></comment>


Web Design Trends for 2017: RWD, UX, and Mobile First - <AUTHOR> http://www.orphicpixel.com/web-design-trends-for-2017/ <comment><USER2> Nice share! Here are few my points to add on: [https://www.softprodigy.com/top-graphic-design-trends- every-...](https://www.softprodigy.com/top-graphic-design-trends-every- business-should-follow-in-2017/)</comment>


Ask YC: How many of the finalists will be funded? - <AUTHOR>

As pg indicated that about 80 teams will be interviewed this month, I'm sure all of us are wondering the same thing: How many teams will be given the opportunity of joining the summer 2010 cohort?<p>I can't imagine that the number will affect anyone's plans, but it's a salient question nonetheless. Best of luck to everyone! <comment><USER2> We don't have a set number that we decide in advance. We accept everyone who seems good enough. We wouldn't turn down a group that we thought had a big enough chance of succeeding.

</comment><comment><USER3> Summer 2009 was 26 funded start-ups.

So, given that the 80 was indicated to be a 'bumper crop' the actual number becomes constrained by how many start-ups YC can handle per cycle, I figure they get more good ones than they can fund already, so now it comes down to distinguishing between 'good' and 'best'. Figure a few more than 26, but not many.

One more reason not to take a YC rejection too heavy.

</comment><comment><USER4> Congratulations to all those who made it to the interview.

</comment><comment><USER5> As far as I have read in the past they don't have a set quota and will assess each team being interviewed on it's own merits when deciding whether to fund it.

<comment><USER6> That has always been my understanding as well.

</comment></comment><comment><USER7> Anybody else interested in a meetup before or after the interviews?

<comment><AUTHOR> Sounds agreeable, but HN is hardly the place to organize such an event... Twitter is! Think up a catchy hashtag and we'll see you there.</comment></comment>


On Brubeck's Life So Far - <AUTHOR> http://j2labs.tumblr.com/post/9880605227/on-brubecks-life-so-far

<comment><USER2> As somebody who's been quite happily building a system around Brubeck for the better part of two months now, it's nice to see the background story pieced together into a cogent storyline.

What's more interesting, I think, is the insight into the thought process and background that goes into building something that is exquisitely elegant in its simplicity and at the same time incredibly powerful and flexible.

Working with Brubeck has been a delight since the very beginning. Granted I've had experience building MVC type systems before, including in Python, but I think Brubeck's ease-of-use is quite significant compared to other frameworks.</comment>


Apple awarded patent for touchscreen slide-to-unlock gesture - <AUTHOR> http://www.appleinsider.com/articles/11/10/26/apple_awarded_patent_for_touchscreen_slide_to_unlock_gesture.html

<comment><AUTHOR> How is something that seems so obvious and trivial patentable? In the physical world this seems like patenting doorknobs that rotate to the left versus the ones that rotate to the right that everyone was already using.

<comment><USER2> If it was obvious, other phones must have already implemented it before the iPhone came out, right?

</comment></comment><comment><USER3> prior art? <http://goo.gl/Wvv6l></comment>


Sunlight on laser-etched metal purifies contaminated H2O w over 100% efficiency - <AUTHOR> https://scitechdaily.com/laser-etched-metal-purifies-contaminated-water-using-sunlight-with-greater-than-100-efficiency/ <comment><USER2> Pretty cool use of lasers:

> Prior to creating the water attracting and repellent metals, Guo and his > assistant, Anatoliy Vorobyev, demonstrated the use of femto-second laser > pulses to turn almost any metal pitch black. The surface structures created > on the metal were incredibly effective at capturing incoming radiation, such > as light. But they also captured light over a broad range of wavelengths.

> Subsequently, his team used a similar process to change the color of a range > of metals to various colors, such as blue, gold, and gray. The applications > could include making color filters and optical spectral devices, using a > single laser in a car factory to produce cars of different colors; or > proposing with a gold engagement ring that matches the color of your > fiancee's blue eyes.

> The lab also used the initial black and colored metal technique to create a > unique array of nano- and micro-scale structures on the surface of a regular > tungsten filament, enabling a light bulb to glow more brightly at the same > energy usage.

</comment><comment><AUTHOR> >Solar-trackable super-wicking black metal panel for photothermal water sanitation

[https://www.nature.com/articles/s41893-020-0566-x](https://www.nature.com/articles/s41893-020-0566-x)</comment>


Ask HS: Why are game updates so large? - <AUTHOR> I'm an casual player. Every time I want to play I have to download 55GB. The game does not change from my perspective. What is in those downloads? <comment><USER2> Most likely an absurd amount of high resolution audio/video files, 3D models, and textures. Most of the work that occurs in games these days is based on art rather than programming and has evolved to whatever "normal SSD" can be expected to hold

<comment><USER3> Sure, but if I'm thinking along the same lines as the OP, is all of the content truly new or different? Or is there a lot of redundant data in those updates?

<comment><USER2> Ohhhh yeah it's possible they're extremely lazy and just pushing the entire new build to you and not the "diff".

If the game is 55GB, and the update is 55GB, and the game remains 55GB after the update.... ^.^

But if it's a 600GB game? Well then dunno. But I don't think any game has reached there yet... CoD is getting closer though</comment></comment></comment>


New Stripe Website - <AUTHOR> https://stripe.com/ <comment><USER2> Gives a more corporate/big company vibe to me. The background rainbow thing is also distracting, and makes the title and nav hard to read at times. Also is the Stripe blue gone?

</comment><comment><USER3> In general I like it, but definitely not a fan of the trippy rainbow in the hero section. Which is strange, because I did a similar effect in the last site I built.

They're implementation isn't working with the text, particularly when the background goes to the darkest red behind the text.

Turning off the opacity, makes the statement much clearer, and I think stronger at the same time.

</comment><comment><USER4> So much of Stripe's UI seems to have been influential on other company landing pages: the animated dropdown on the navbar, the slashed background shapes, having interactive code editors and displaying devices on white backgrounds

Was Stripe the originator of this style or did they just make it famous?

</comment><comment><USER5> This is gorgeous! The "Designed for developers" section is brilliant and shows off the new[1] Stripe CLI

[1] [https://twitter.com/stripe/status/1191772393523400704](https://twitter.com/stripe/status/1191772393523400704)

</comment><comment><USER6> Try clicking and dragging on the globe.

(disclaimer: I work for Stripe, but no one there told me about that feature)

<comment><USER7> Awesome effect! It would be great to have a more detailed explanation or tutorial or whatever about this.

</comment></comment><comment><USER8> Looks great, except the overlay effect makes the text unreadable for certain hues (like red). Can't wait to see how many other SaaS websites copy this trend.

</comment><comment><USER9> Am I the only one who finds the text overlay on the background slightly trippy. Other than that fire as usual

</comment><comment><USER10> I'm in Australia. Looks like we're still on the old site.

<comment><USER11> We're rolling out more broadly (and in more languages) in the coming days! For now, [https://stripe.com/us](https://stripe.com/us) should do the trick :)

</comment></comment><comment><USER12> Since there seems to be some stripe employees here, is it true you've already set a foot in Argentina?

<comment><USER13> Hi, no plans to share at the moment, but please sign up for updates here: [https://stripe.com/global#AR](https://stripe.com/global#AR)

</comment></comment><comment><USER14> Type in Up, Up, Down, Down, Left, Right, Left, Right, B, A, Start for a surprise

</comment><comment><USER15> Nice VIM reference. ;)</comment>


Show HN: HistoryGraph a  library for private data synchronisation with CRDTs - <AUTHOR> https://historygraph.io <comment><USER2> I don't understand. This page doesn't seem to actually explain how the "merge nodes" actually works to, well, _merge_ divergent histories.

Does it rely on some application-level logic implemented by the user? If so, how is this useful? Existing tools like y.js seem to be vastly superior in terms of usability.

<comment><AUTHOR> No all the logic is in the library. They are merge edges (not nodes). Merge edges help us to establish the order in which users make changes to the data. Conflicts (divergence) are fixed by the algorithm looking for edges that might conflict. Determining the winner of the conflicts and then replaying the graph

<comment><USER2> The term "merge node" appears at least five times in the page. Please fix it if that is not what you meant.

How does it "determine the winner"? This is the hard part of CRDTs, and you still have not provided any actual details.</comment></comment></comment>


What We Lose When the World Moves on from Email - <AUTHOR> https://mobile.nytimes.com/2017/07/12/technology/what-we-lose-when-the-world-moves-on-from-email.html?referer=https://t.co/5CDRaP5SHw?amp=1 <comment><USER2> The rumours of email's death have been greatly exaggerated. To the author: please take your own advice and step away from the keyboard.

<comment><USER3> I always laugh when some wannabe entrepreneur declares "email is broken!!1"

Email is hardly broken. It's actually an amazing system that works really well.

<comment><USER4> E-mail is broken (spam, and now centralization in Gmail). What is amazing is that it works so well _despite being broken_.</comment></comment></comment>


SOA is Dead; Long Live Services - <AUTHOR> http://apsblog.burtongroup.com/2009/01/soa-is-dead-long-live-services.html <comment><AUTHOR> The article is basically BS, referring to a few (unnamed) organizations that have been radically transformed by SOA. Basically she's saying SOA is still a great idea but people refuse to do it correctly and now their budget is gone.

I always equated SOA with Dependency Oriented Architecture. As it was usually implemented, it makes an "enterprise" into a set of highly interdependent systems, where problems spread quickly, every decision has to be negotiated, and no one can do anything on their own. People that just implemented services as Remote Procedure Calls (as opposed to asynchronous messaging based approaches) just get "CORBA with angle brackets".</comment>


Exchange (Office 365) has a major compliance issue with SMTP submission - <AUTHOR> Mails sent using SMTP submission in Office 365 are not logged anywhere: retention, in-place hold, or litigation hold. There is no way to know anything about these emails, you can only trace them in Exchange (within 90 days window) - you only know they were sent. But content compliance? Nope.
Also, there is no way to stop SMTP submission (in cases you do not need it).
Spent two months with Office 365 support, but they are not helpful at all.
1) Does anyone knows how to hold/retent SMTP submitted messages?
2) In cases customer has no need for SMTP submission, does anyone knows how to block SMTP submission? <comment><AUTHOR> To clarify further: your employee, as an example, can log into his private Gmail account using corporate credentials, and can send business emails "on behalf of" his corporation, without administrator / HR / CEO knowing anything... And that can wreck havoc in your life. Gmail would use Office SMTP servers, so mails are legit (because SMTP sumbission is legit for itself)...</comment>


Startup Blogs To Make You a Better Entrepreneur - <AUTHOR> http://www.mattmazur.com/2010/12/17-startup-blogs-to-make-you-a-better-entrepreneur/

<comment><USER2> I've noticed that HN readers all tend to think about startups in a similar way - thus the list of blogs here was no surprise.

What contrarian blogs have you found that take entrepreneurship from a different angle, viciously cutting through what many HN readers "know to be true"?

<comment><AUTHOR> That's a great point. None, I suppose. What would you recommend?

<comment><USER2> Hmmm... well I don't always agree with him, but Mark Cuban often has interesting contrarian views on the technology business. He's certainly outspoken: <http://blogmaverick.com/>

<comment><USER3> cuban is great. he loves to stir the pot. whether or not he can make a difference in the college football playoff system, when he tosses his thoughts out there on controversial subjects, people pay attention.

</comment></comment></comment></comment><comment><USER4> Great list. Thanks for putting it together. I've added the ones that were missing, to my Google Reader.

<comment><AUTHOR> I added your blog as well as Jacques Mattheij's to the list--how could I forget? Let me know if I missed any others.

<comment><USER4> Hmm, I can't see my blog in the list, just in the comments... but no worries :-)

<comment><AUTHOR> Daniel -- forgot to hit Update :)

</comment></comment></comment></comment><comment><USER5> I created a Google Reader bundle for all the listed blogs.. Let me know if I'm missing any.

Here's the link:

[http://www.google.com/reader/bundle/user%2F03694670582608661...](http://www.google.com/reader/bundle/user%2F03694670582608661313%2Fbundle%2FStartups%2BEntrepreneurship)

</comment><comment><USER6> Startup Blogs To Make You a Better Entrepreneur

<comment><AUTHOR> You're right -- fixed.

(It was _17 Startup Blogs To Make You a Better Entrepreneur_ )

</comment></comment><comment><USER7> Also worth mentioning: <http://www.quicksprout.com> and <http://roachpost.com/>

</comment><comment><USER8> in my RSS is also Mark Suster <http://www.bothsidesofthetable.com/> who has some great post blogs around startup

</comment><comment><USER9> Great list but where are the women?</comment>


A step closer to quantum computation with Quantum Error Correction - <AUTHOR> https://plus.google.com/+ResearchatGoogle/posts/JbF1cc5jZNC

<comment><USER2> Cool paper, but the linked page just links to [http://googleresearch.blogspot.com/2015/03/a-step-closer- to-...](http://googleresearch.blogspot.com/2015/03/a-step-closer-to-quantum- computation.html)</comment>


How Free Heroku really works and how to get maximum from it? - <AUTHOR> https://medium.com/@AndreyAzimov/how-free-heroku-really-works-and-how-to-get-maximum-from-it-daa53f2b3c57 <comment><AUTHOR> Recently I've got a problem that Heroku stopped my sites (I've got 6) because I've had used all free dyno 1000 hours/month

It was very confusing for me WTF does this free dyno hours mean?

I couldn't figure out it from the docs so after speaking for a couple of hours with the support I finally got it and want to share how to get maximum from Free Heroku accounts.</comment>


Ask HN: How bad is it to use a self-signed SSL certificate? - <AUTHOR> I have a few "information only" (i.e., no customer data stored, no user logins) for almost 20 years that I just added HTTPS support for.
I did this after reading the EFF's "Join us on June 5th to Reset the Net" article and the two linked articles at the bottom of the page.
If any accesses my sites with HTTPS, they have to look at my certificate and OK it. A pain.
Ask HN: How bad is it to use a self signed SSL certificate?
Also, suggestions for the cheapest/easiest ways to get signed certificates?
BTW, I used this article for configuring nginx for SSL: https://www.digitalocean.com/community/articles/how-to-set-up-multiple-ssl-certificates-on-one-ip-with-nginx-on-ubuntu-12-04 <comment><USER2> If you are careful when generating your certificate (that is, careful to generate a subject certificate, and not a CA certificate) and _can reliably distribute your certificate to all clients you are interested in_ , then self- signed certificates are usually _much better than the public CA system_.

But actually achieving the pre-distribution step is pretty hard, and basically impossible over the internet. You can achieve it pretty well in a business setting, where you can push your certificates to all the clients through AD, MDM, or similar.

Sidenote: You should also take this opportunity to appreciate how dismally mis-designed web transport security is:

* Cleartext, unauthenticated: just works, no warnings.

* Encrypted, unauthenticated: THE SKY IS FALLING.

* Encrypted, authenticated: little padlock.

<comment><USER3> A site claiming to offer cryptographic security when it is in fact not is, in reality, worse than a site that simply doesn't offer cryptographic security. Both those sites --- the SSL site and the non-SSL site --- aren't offering security. But only one of them is also being deceptive about it.

However, you'll get no argument from me if you constrain your argument about dismal mis-design to browser UI/UX. The browser UX design for TLS security hasn't meaningfully changed since Netscape.

<comment><USER4> Unauthenticated SSL does provide security against _passive attackers_ , which is what mass surveillance in developed countries is. If the NSA ever insists on widespread MITM of connections, we have much bigger problems.

I agree the UI needs to be properly worked out so that eg a bank can't be downgraded to an unauthenticated certificate.

<comment><USER5> I don't understand why they don't just use different colors for self-signed SSL connections.

CA-signed: Green lockpad

Self-signed: Yellow lockpad, with question mark superimposed over it

Regular HTTP: Orange, no lockpad (insecure)

Invalid or revoked cert: Red, "stay away" displayed within <blink> tags.

The current UI that most browsers present implies that self-signed certificates are _worse_ ("scarier") than regular HTTP, which is not true.

<comment><USER4> Well, it's not really a continuum. 'There should be only one mode, secure' and all that - asking users to make ad-hoc security assessments is generally a bad idea. In an ideal world, plaintext HTTP wouldn't exist and everyone would have a key delegated by their domain registrar.

No lock would suffice for unauthenticated https; those that find the distinction meaningful can investigate the URL. But then you still risk someone bookmarking [https://example.com](https://example.com) and suffering a downgrade attack from not paying attention to color changes.

The best way forward is probably the creation of a new protocol designator (httpz or something) that is SSL using the SSH key model. But there's no impetus to do this as it's easy enough to pay the CA tax and be on your way with unquestioned "full security".

</comment></comment></comment></comment></comment><comment><USER6> Depends what you want, if you want trust that you can only grant yourself, then go for self signed, especially internal projects.

If you want exposure of your certificates to common browsers and don't want to raise warnings in them, go for cert authorities.

But remember Snowden, certificate authorities are less trustfull than you can trust yourself.

<comment><USER7> This is the right answer and it's too bad it was way down the page (I upvoted).

For your situation, mark_I_watson, probably get a cert from a CA, the cheap "domain only" variety where you can verify your site to the CA simply by putting a file in the web root directory.

I say this assuming the content is whatever you were already displaying to the world without encryption - therefore low-security. The cert allows you to put meaningful authentication on your site (otherwise passwords go in plaintext, for example).

For a medium security level, sufficient for online money transactions, you would have to get a higher-assurance type of cert - this requires more money, sending business and personal ID documents to verify your business to the CA, etc..

For really secret communications - getting into a degree of NSA-proofing - among other things you have to avoid involving a CA, and preferably make browser certificates for trusted clients, to spare them the warnings that browsers throw up on non-CA server certificates. This is unsuitable for (legal) commerce (commercial payment processors would reject your business), and still vulnerable to metadata collection (unless you put it on TOR or equivalent), and still vulnerable to state coercion of private keys or forced code-trojaning.

Note that the third solution requires that your clients have a means of verifying that the site is yours rather than an imposter - you avoid a CA having the power to enable some other site to impersonate yours, but trusted users must have a basis for trust by a "side channel" such as knowing you personally, you being their employer, or reputation of your digital signature over time.

<comment><USER8> Could you elaborate on what you find meaningful about the authentication a CA provides?

Another neat trick is creating your own CA, and putting your root into the local trust stores of client nodes that you care about. (Be sure to permanently airgap your root key, and create intermediate signers.)

<comment><USER7> I meant that sending logon + password is somewhat pointless if it's plaintext over the internet, while if you have some encryption going on, someone intercepting the data in transit would have a harder time using it to trick the client or the server. In that sense authentication is more meaningful with a certificate -- even though using a CA still allows interception by a government actor. It narrows the range of those who can "break" the attempted security.

<comment><USER8> Well, a self-signed certificate still offers that encryption.

None of my arguments about X.509 / CAs are about government actors in particular, though. There are enough root CAs trusted by the major browser vendors that breaches can (and have) happened with minimal resource expenditure.

</comment></comment></comment></comment></comment><comment><USER9> [https://www.startssl.com/](https://www.startssl.com/) gives out free SSL certificates. Just don't expect much on their part, given it's free. For example, they refused to reissue certificates for free after Heartbleed. Also you can't use them on commercial sites.

otherwise [https://www.gogetssl.com/](https://www.gogetssl.com/) is probably as cheap as it gets.

<comment><USER10> If you read startssl'a justification on the free cert, you'll see that they charge in relation to the time they need to spend. A low level 1 year cert involves no human time. They don't have fully automated systems for revokes/reissues, so it's pretty lame for people to complain about them charging for it.

<comment><USER11> That's perfectly fair and reasonable from a commercial perspective.

From a security perspective, however, I think you need to meet some minimum standards to remain credible as a CA, and I think at least being willing to revoke certificates that may have been compromised for free and very quickly is one of those standards.

I find it difficult to support retaining StartSSL certificates as trusted-by- default in browsers given their response to Heartbleed and the consequent relatively high probability that any certificate ultimately depending on them has been compromised.

<comment><USER10> That's understandable and probably a good reason for startssl to build an automated revoke tool, for the sake of keeping their name healthy. However, I would be way more concerned about a company unwilling to pay a trivial amount of money to revoke a cert that was compromises due to their own choice in how they used it. The best CA in the world won't fix bad security incident handling of another company.

Sure, most of the complaining was due to the entitlement, but I'd be interested in a list of all the companies that complained about this and/or failed to pay for a revoke.

<comment><USER12> I'm surprised it's not a requirement of being a CA. Further speaks to the apparently weak standards the browsers have.

</comment></comment></comment></comment></comment><comment><USER13> If your zones are signed with DNSSEC, just add a TLSA record for the self- signed certificates to the zones. Clients with DANE [1] support will then recognize that the self-signed certificates are valid.

Of course, very few clients support DANE as of yet. Nevertheless, that is the most modern solution and you'll spur adoption of DNSSEC and DANE if you offer it to clients.

[1] [https://tools.ietf.org/html/rfc6698](https://tools.ietf.org/html/rfc6698)

<comment><USER14> Off-topic, but speaking of spurring adoption of DNSSEC: does anyone know of any good (dumbed-down) guides on setting up DNSSEC on personal domains / using dnssec-keygen? I keep seeing it mentioned in HN threads as a Good Thing, and I know my registrar supports it, but they have a big warning:

"It is strongly recommended that you do not enable this option unless you have a good understanding of what it is and does: you could easily make your domain name inoperative."

which doesn't exactly inspire confidence, especially since most small website owners (such as myself) really don't have a good understanding of it!

<comment><USER5> > I keep seeing it mentioned in HN threads as a Good Thing,

Opinions on DNSSEC are... mixed, to say the least: [https://news.ycombinator.com/item?id=5571937](https://news.ycombinator.com/item?id=5571937)

As a small website owner, are you using TLS? That's the biggest single thing you should be doing - don't worry about DNSSEC.

This depends on what you mean by "small", but IMHO, you don't need DNSSEC. Depending on how small/important your website is, you probably don't even need to bother with DNSCurve either, though you might like to for the fun of it.

<comment><USER14> Thanks for the link; that's actually very informative. My interest in DNSSEC came from reading that it provided a mechanism to securely transmit SSH host key fingerprints, though I'm not sure if there's a better way of doing that.

> As a small website owner, are you using TLS?

Yes, but I don't require it. Just a free certificate from StartSSL.

</comment></comment></comment></comment><comment><USER15> One thing that always confuses me is the plethora of options for buying SSL certificates.

I understand the difference between a single domain and wildcard SSL. But, as an example, what's the difference between Positive SSL and Essential SSL (2 types of SSL certs sold by Namecheap) - Essential being about 3x the price.

<comment><USER16> I think at some point I contacted support about that. It generally comes down to one of a few issues:

compatibility (mobile, different browsers, etc)

steps taken to verify (via phone, email, fax, proof of business registration, etc)

insurance (they'll offer various amounts of payment in liability insurance)

</comment></comment><comment><USER17> It's terrible, because Man-In-The-Middle attacks are trivial and automatable.

namecheap.com sells PositiveSSL certs for $9/year -- that's pretty cheap and easy.

<comment><AUTHOR> Thanks. I needed some encouragement. I will buy two PositiveSSL certificates today.

<comment><USER18> You might be able to use StartSSL's free one: [https://www.startssl.com/](https://www.startssl.com/)

<comment><USER19> Just keep in mind that Class 1 (free) certificates are for non-commercial sites only.

<comment><USER20> Also, StartSSL's certs don't work on android (you get cert not trusted error) for some reason.

<comment><USER8> I haven't checked any recent Android trust stores, but this _might_ be due to a lack of an intermediate certificate.

The vast majority of modern browsers know how to find intermediate certificates online. Android's browser doesn't, for whatever reason. You have to bundle it on your web server.

<comment><USER20> That was the problem. Works well on my android now. Thanks!

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> TLS means Transport Layer Security, and people would do good to remember it was not invented to be used in the HTTPs browser webserver configuration exclusively. For that particular application though, it doesn't make sense to use a self-signed certificate as you can't control the client side and modern browsers will raise hell.

There are however many applications where a self-signed certificate (chain) is perfectly fine and even preferred. Think of mobile apps where you have control over how certificate validation is done on the client-side.

</comment><comment><USER22> Self-signed cert is probably a bad idea in pretty much all cases. But implementing your own CA is a different story. And the answer to your question for your own CA is the usual - "it depends" :)

For an external web application/web service/API/... it is pretty bad. Users will run into certificate errors with their browsers or the code. Some will be smart enough but many will be scared away. Not good for your growth plans :)

For an enterprise web apps it is a completely different game. Pretty much you MUST setup your own CA (for example, it would allow you to spy on your employees - if you are paranoid about leaking secrets to competitors or press). The usability issue is not a problem since the laptop/desktop will be configured by the IT team anyway and they can setup the trusted certs along the way.

Lastly, for your internal mid-tier services (you are following SOA, right?) having your own CA would allow you to create as many certs as needed fast and "for free". Thus, you can easily implement cert based authentication and separate roles for different mid-tier/backend services. By implementing the usual security measures to protect private keys (including root CA keys), you actually get a much better security than using one "real" cert for everything. Again, configuration should not be a big deal since you are controlling internal services and network anyway.

</comment><comment><USER23> Anyone interested in how certificates work in "the real world" should install Certificate Patrol (I think it's only for Firefox).

You will quickly learn that certificates are 99% noise. Here are some observations:

1) ad sites present certificates, constantly changing. I don't care about them, but at the moment there is no way to tell Certificate Patrol to completely ignore certificates from a domain. The vast majority of certificates presented to a browser are from ad sites.

2) major websites use a plethora of constantly changing certificates. Quite often even the root signing certificate changes. Certificates change in days or weeks, not months or years as might be expected by simply looking at validity dates.

3) Some commenter [1] linked to an mitm paper written by Facebook people. It's enlightening. The paper also makes the point that while a certificate identifies a website, it doesn't identify a browser. So, even ignoring all the possible firewall MITM and malware, how can a website be sure that a _user_ is who he says he is? Only half the problem is solved unless the user presents a certificate to the website. Most aren't set up for that.

[1] [https://news.ycombinator.com/item?id=7826420](https://news.ycombinator.com/item?id=7826420)

</comment><comment><USER24> I don't know why you're bothering with SSL at all. Your use case is that your site is informational, it's intended to be open to anyone, there is no personal/customer information on it, and there's no authentication (everyone is anonymous).

All adding HTTPS support will do is make it marginally harder for someone to spoof your site.

And why is NSA surveillance a concern? Your site is wide open for anyone to see, with or without HTTPS.

<comment><USER25> By sending data in plain text, your users are revealing their intent to retrieve the content hosted on the site, even though that content is public.

That in itself may be considered a breach of privacy, as it exposes your users to passive capture and profiling.

Also, accessing the content you are hosting might be considered legal in some countries but illegal in others, regardless of if it is public or not.

<comment><USER24> Good points, but I would argue that HTTPS provides little protection against this kind of access tracking.

Even if the site is HTTPS protected, a surveillance actor on the net would still be able to read the entire site, maybe to determine if the site has content worthy of tracking those who access it.

And, surveillance would still reveal that your IP address is accessing the site, and thus triggering something.

What HTTPS would protect is the specific URL path you are going after on the site, because that's in the HTTP GET which is part of the encrypted data traffic.

I guess you could say that maybe the site has some pages that are more sensitive than others, and revealing the exact URL paths you are accessing might set off a surveillance trigger that would otherwise not be noticed. But, the site in question is probably not like that.

</comment></comment></comment><comment><USER26> As others have said - don't use a self-signed cert. When you do settle on a CA and config your SSL - this tool from SSL labs will really help. I used it today to identify and resolve a chaining issue. It makes sure you've done everything correctly.

[https://www.ssllabs.com/ssltest/analyze.html](https://www.ssllabs.com/ssltest/analyze.html)

</comment><comment><USER27> Certificates not just encrypt communication, they also tell that the site is really the one you think.

In that sense self-signed certificates are mainly useful for small amount of people when you have another way to validate that the certificate is valid (i.e. installing it in person in the intended client devices). Else anyone could just create another certificate with the same human readable info.

There are some free or cheap enough certificates around that are already suggested, and other ways to validate certificates that may be useful even for self-signed ones, like [http://convergence.io/](http://convergence.io/)

</comment><comment><USER28> I'm not a tech savvy person (at least around here) but I used Gandi to purchase my certificate. I paid 12 bucks and it was extremely easy to implement it. To give you an idea, I didn't even know how to enable access to my site without entering "www." in front of my URL. But getting the certificate and implementing it was so easy that I was actually surprised once my SSL was active. I was expecting to run into a couple of problems as I usually do when I deal with these sort of thing.

I'm using SSL for my personal website and it's not a commercial website.

<comment><USER29> I've got a couple at Gandi too, and I was pleased at how easy it was to set up. I used the free first year (included with a domain name purchase) but then went looking for the cheapest I could find. [https://cheapsslsecurity.com/](https://cheapsslsecurity.com/) sold me a simple domain validated cert for $19.96/5 years. That's the lowest I've seen but it looks like they raised their prices slightly since then.

<comment><USER28> Honestly, I don't mind that Gandi isn't offering the cheapest option out there. My domain and my host are from Gandi, so it was a no brainer for me to get my certificate from Gandi. I didn't even check the alternatives. If it was a hefty price, say, like $50/yr instead of $12, I'd have probably looked for other alternatives but I'm happy with them so far and I like to reward companies that serves me well as a customer.

</comment></comment></comment><comment><USER30> We just went through this process at my startup. The gist of it is that if you self sign your certificate the user will get a warning say "do you trust this site? yes or no" \-- this will lead to alot of people leaving. The best option is to get a cheap signed SSL certificate, godaddy has them for like 70$ a year. You can probably shop around a get them for cheaper. Moreover, if your using AWS, consider letting ELB (elastic load balancer) handle the HTTPS.

</comment><comment><USER31> You should quit using them if anyone other than you ever needs to open the page in a browser. The warnings will never be good enough for partial clicking through of them. If a user (even a technical one) gets talked into clicking through an SSL error, it is likely that they have been talked into a bad habit.

</comment><comment><USER32> It used to be pretty easy to install a self-signed certificate from the browser. Now it seems quite a bit harder--e.g., in Chrome you seem to have to export it to a file, I think? And in IE people say they can't even _inspect_ a bad certificate, because the UI hides it entirely.

</comment><comment><USER33> If money is short at the time you can also get a 90-day free SSL from Comodo. Good for testing and getting SSL setup or if you are tight on funds at the time it can get you started until you have the cash on hand to purchase the certificate.

</comment><comment><AUTHOR> I posted this Ask HN earlier today. Thanks for the useful comments.

I have decided to not use a self signed cert.

Another question: any comments on CloudFlare's auto SSL support on paid plans? $20/month does not seem too much for CDN and SSL support.

<comment><AUTHOR> EDIT: I did go with CloudFlare: works great, and my site is loading faster. Seems worth $20/month.

</comment></comment><comment><USER34> They are pretty bad from a user perspective. Some of the browser UIs make it very scary looking to continue, if you can even figure out how.

If, as you say, just an information site, I would get rid of them immediately.

</comment><comment><USER35> It's good, because you have control over the certificate creation, and never have to share your private key.

The one catch is, as you noticed, the key has to be distributed. Depending on your goals, and your audience, this might be impractical, or within the realm of reason.

Here's a link that goes into more detail.

[https://blogs.oracle.com/java-platform- group/entry/self_sign...](https://blogs.oracle.com/java-platform- group/entry/self_signed_certificates_for_a)

<comment><USER36> > It's good, because you have control over the certificate creation, and never > have to share your private key.

You will never have to share your private key when getting a certificate from a proper CA, either.

<comment><USER8> This is true, but you wouldn't believe the system-as-practiced by most large IT departments.

edit: small IT departments, too. nobody really pays attention as long as the lock icon is green.

<comment><USER37> Can't speak to the state of this on Linux, but on Windows/IIS if you "just follow the wizard" and send the generated file to your CA it will not include the key.

<comment><USER8> My remark wasn't about the software tools, it was about the human processes around them. There are major knowledge gaps in every organization I've ever interacted with (hundreds) that use certificates.

For example: How do you get the private key to a _second_ IIS server, if you are doing poor man's DNS load balancing with the same hostname?

</comment></comment></comment></comment></comment><comment><USER38> Is it worth adding HTTPS when you're running an internal app?

</comment><comment><USER39> YOU ARE DESTROYING THE INTERNET

Training users, who have no way to properly asses this risk, to click OK to the SSL error, is like Jim Jones's practice runs drinking the Koolaide.

Firefox had it right when the briefly made it impossible to OK the use of misconfigured SSL.

Most IT people don't understand the risk of self-signed certs. We can't expect users to make good choices here.

<comment><USER40> It's still more secure than plain-text http tho.

<comment><USER12> Since there's no way to distinguish MITM and an unverified certificate, it can make people think they are secure when they are not. That's not "more secure".</comment></comment></comment>


Europe votes for clinical trial transparency - <AUTHOR> http://www.alltrials.net/2014/europe-votes-for-clinical-trial-transparency/ <comment><USER3> Both "Bad Pharma" and "Bad Science" are _excellent_ books - <USER2> recommended:

[http://en.wikipedia.org/wiki/Bad_Pharma](http://en.wikipedia.org/wiki/Bad_Pharma)

[http://en.wikipedia.org/wiki/Bad_Science_%28book%29](http://en.wikipedia.org/wiki/Bad_Science_%28book%29)

I wonder if you can get "I am a Nutritionist!" T-shirts?

[Edit: Thanks for pointing out the T-Shirt pretty much does exist].

<comment><USER4> He sells shirts picturing a rubber ducky with "nutritionist" printed underneath: [http://badscience2.spreadshirt.co.uk/sophisticated-visual- ga...](http://badscience2.spreadshirt.co.uk/sophisticated-visual- gag-A18169393/customize/color/1)

Congrats to ben goldacre and everyone else who worked on this!

</comment></comment><comment><USER5> Getting all the information from all clinical trials will probably spur some great data mining efforts, on a much broader scale than what has been done so far. For example, a former colleague of mine used the correlation of published drug side effects between different drugs [1] to predict potential alternative therapeutic targets.

Getting all the data on drug efficacy, availability, correlate it with chemical structure, combine it with the information on other drugs could potentially help us a lot in predicting better working future drugs and the workings of existing drugs.

Also, transparency. No more picking out those trials that worked and conveniently forgetting about those that did not work.

[1] [https://www.sciencemag.org/content/321/5886/263.abstract](https://www.sciencemag.org/content/321/5886/263.abstract)

</comment><comment><USER6> As far as I know, US laws require that the _`x`_ number of trials demonstrate the effectiveness of the drug and failured dont need to be reported. But this does not make sense to me, and I welcome the European laws. In the US system, even if I have a coin biased badly against coming up heads, if I toss it enough number of times I will get _`x`_ heads. The tosses cost money and that is then used to justify the patent system.

One of the oft repeated justification for the absurd levels of IP protection and patent extensions that pharma enjoys is the huge cost of trials. But if huge development costs are the reason for these protections to exist, guess what, these costs will continue to remain huge. Its just self perpetuating.

Patents are primarily a preemptive measure against a hypothetical scenario. The hypothesis is that unless market pressures are cordoned off, innovation will stop. It is a believable hypothesis but not a quantitative one, and this exactly where we need a quantitative one. How many years exactly does one need to subvert the market so that a satisfactory level of innovation is maintained ? Nobody knows. In these scenario what we need is a feedback system, and pretty much the only scalable and fair apparatus that we have for such feedback on economic affairs is the market.

So rather than subverting the market, market should be explicitly and actively involved to work out this trade-off. How exactly this is to be done needs to be worked out.

There could be a futures market on patents on drugs undergoing testing: competitors can promise to buy the patent to the (drug,usecase) pair at a particular price (even if its a dud) and if the owner decides not to sell the owner pay a particular compensation. Such measures will spread the risk. There should be mechanisms for a company to raise money for testing in lieu of rights over the product.

The initial period of validity of a patent should be short, like 3~6 years, following which the patent is on the market. Entities can bid to bring the patent to public domain. The owner(s) bids to retain it. Whoever wins gets the balance. Of course the "bring it to public domain" bidders will bid less because profitability is less when its in the public domain, but market decides who gets to own it. If the owner(s) think they can still extract lots of profit from the drug, bid high. We should stop handing out blank checks without a feedback loop, that is just bad design.

<comment><USER7> In the US you need two trials showing that a drug is effective, but you can have an unlimited number showing that it's not effective. Also it doesn't need to be shown to be effective against a disease, it can just be effective at reducing some number that correlates with a disease. And you don't need to show that it's effective in the longterm, only for up to 6 weeks - it could make the disease dramatically worse in the longterm, and that's fine even if the drug is meant for longterm use.

There are some rules trying to get all new trials registered, but the rules aren't followed at all and the FDA doesn't enforce them.

<comment><USER8> Wow, there is a long that is incorrect in your comment.

1\. You are right that typically you need two registrational trials for approval and yes you can have many trials that show it doesn't work.

2\. You are incorrect that you don't need to show it works against a disease. _Sometimes_ you can show that you are impacting a biomarker (which I assume is what you mean by "some number"), but there must be evidence that changing the biomarker impacts the disease. Without that evidence you will not get approval.

3\. You are incorrect you only need to show its effective for up to six weeks. If that were true, why would drug companies be running multi-year trials for cholesterol drugs? You typically need to show its effective for however long the drug is taken, but a follow-up period is also required.

<comment><USER7> 2) C.f. statins. There are any number of books that talk about this. Overdosed America comes to mind, but you'd be hard pressed to find any recent book about the pharma industry that doesn't talk about statins.

3) C.f. SSRIs, and Robert Whitaker's book anatomy of an epidemic.

<comment><USER8> 2) You are correct that new drugs can be approved by showing a lowering of LDL (biomarker), but that's only because _the link between LDL lowering and cardiac risk reduction has already been demonstrated._

The best example I can give you right now are the drugs in development to treat Duchenne's muscular dystrophy. These drugs work by increasing the levels of a biomarker called dystrophin. The FDA recently came back and said "nope, not enough evidence that increasing dystrophin will improve patient's conditions, therefore we will not approve your drug".

As for the length of depression trials, it has been established that 6-week trials provide enough evidence to support an improvement in patients. [1]

 _Therefore, a 12-week trial is not necessary for all older patients; rather, the degree of improvement in the first 4 to 6 weeks identifies patients who are highly likely to benefit from continuing antidepressant treatment as well as those who very probably should have their treatment regimen altered at that point._

However, the depression drugs also run trials for long-term use: "Cymbalta is indicated for the treatment of major depressive disorder (MDD). The efficacy of Cymbalta was established in four short-term and one maintenance trial in adults [see Clinical Studies (14.1)]."

[1][http://www.ncbi.nlm.nih.gov/pubmed/16027559](http://www.ncbi.nlm.nih.gov/pubmed/16027559)

</comment></comment></comment></comment></comment><comment><USER9> > • Require that a summary understandable to a lay person of what was found in > the trial is published on the register.

Good luck with that. Explaining complex cellular mechanisms to a lay person without any scientific nor statistical background is a very difficult task. When you consider modern medicine, you need basic knowledge in genetics, biochemistry, biology, proteins, drug formulation, pharmacology, pharmadynamics, toxicity, clinical studies design, to have a proper understanding of what a study means. We're not talking about aspirin class of medicines anymore, and more and more drugs are now in the class of _large molecules_.

<comment><USER10> >> • Require that a summary understandable to a lay person of what was found in the trial is published on the register.

>Good luck with that. Explaining complex cellular mechanisms to a lay person without any scientific nor statistical background is a very difficult task.

I don't think that the cellular mechanisms, or generally speaking the mode of action, are what has to be explained understandable to a lay person. What has to be explained is the _result_ of the trial.

<comment><USER9> Nowadays drugs work in tandem with biomarkers, so how do you explain what a EGFR mutant individual mean to a layman who has no knowledge about genetics and mutations ? You'll end up with "Drug A works better than B for EGFR wild type mutations but no different for other subsets". And? Is the layman supposed to understand what it means like that?

<comment><USER10> > Nowadays drugs work in tandem with biomarkers, so how do you explain what a > EGFR mutant individual mean to a layman who has no knowledge about genetics > and mutations ? You'll end up with "Drug A works better than B for EGFR wild > type mutations but no different for other subsets". And? Is the layman > supposed to understand what it means like that?

Of course the layman is not supposed to understand that, that is no explanation in layman's terms. You can make these sentences understandable by generalizing it: "We already knew before that the effect of these types of drugs is very specific to the specific genetics of a patient. Now in this trial we tried to find out what specific drug works for what specific genetic combination. The result is that Drug A works better than B for a combination that is called XY: Whether or not that applies to you can be found out by <test method>."

<comment><USER9> I see what you are aiming at, but the conclusion of clinical trials is almost never that simple. Drug A works better than B is a matter of statistical significance, of patient selection (history, previous treatments, genetics), and you can still register, nowadays, drugs versus placebo as comparators. So the issue of comparing two drugs together remain where no clinical trial to compare them in parallel exists. So you'll end up in these situations with : "Drug A works better than Placebo on X population" and "Drug B works better than Placebo on Y population", and the poor layman will be left on his own to understand how the X population is different from the Y one, and what to make of the results when it comes to comparing A and B.

In other words, it won't help laymen in the end.

At one point, if you really want to understand the clinical trial results, you need to go in details, and laymen won't be able to do that. So I'm not sure what they are trying to accomplish here.

Plus, you don't need that laymen language in the first place. Isn't that the job of journalists who cover scientific discoveries ? I'm afraid we hit another hurdle here, with the deplorable state of clinical trials results reporting in the general public by the media. That says a lot about what you can expect from laymen in terms of scientific comprehension.

<comment><USER10> > I see what you are aiming at, but the conclusion of clinical trials is > almost never that simple.

Yes, that's the problem with study subjects as complex as humans :) My academic background is in educational science and things are even fuzzier there: there never is a simple treatment->result relation because the persons receiving treatment reflect on that treatment, they are an active part in it.

> In other words, it won't help laymen in the end.

I think I know what you're meaning, but that's the point where I disagree: In my opinion this is no either/or situation but rather a question of relative amount of insight that can be given to laymen: Currently they will usually understand 0% of the scientific abstract. If we assume that a laymen's version of that abstract loses 80% of the information but is 100% understandable, that would still be a win.

> Plus, you don't need that laymen language in the first place. Isn't that the > job of journalists who cover scientific discoveries ?

Absolutely, as journalists are already used to do exactly that. In practice the result will probably be exactly that: the institution will have science journalists who will produce these laymen's abstracts.

</comment></comment></comment></comment></comment></comment><comment><USER11> This is _great_ news - no more pharmaceutical profit projects getting pushed to the forefront, only to discover a few years later that the adverse affects were buried in 'company proprietary confidental' reports .. makes it safer to live in Europe!

<comment><USER8> The EMA should work on discovering the drugs that already have publically reported serious side effects. It took the EMA how long to pull Mediator?

<comment><USER11> Corruption also happens in Europe, friend! Big steps, one step at a time.

</comment></comment></comment><comment><USER12> In the US, this is already present, to some extent, with FDAAA 801 [1], which requires that all clinical trials be registered before they start. Missing things like required publication and the "human-readable" digest, but the absence of data can be factored in by the FDA when considering approval -- that is, studies that terminate without reaching a finding can be considered weak indicators of problems, and in the long run, potentially point to organizations or individuals who might be suppressing negative results.

Even required publication is no cure for this; a result saying "we inadvertently broke the blind" or "the protocol was poorly implemented" is perfectly possible even in good faith.

[1] [http://www.clinicaltrials.gov/ct2/manage- recs/fdaaa](http://www.clinicaltrials.gov/ct2/manage-recs/fdaaa)

</comment><comment><USER13> For God's sake, _another_ article that conflates Europe and the EU! Lazy, lazy journalism.

</comment><comment><USER14> Another popular decision by our MEPS just in advance of the EU parliament elections this summer.

Next comes mom and then apple pie.

<comment><USER15> The EP is actually quite good at producing the right decisions, especially when the public remember that it exists and lobby them over this issue. Unfortunately it's the weakest of the legislating institutions (Parliament/Commission/Council).

<comment><USER16> Yes. I'd like to have EU institutions which look more like "normal" democratic systems, and greater power for the EU parliament. But it's still a lot better since the Lisbon treaty.</comment></comment></comment>


First HN Meetup in Nagoya, Japan - Sat June 22 - <AUTHOR> http://hnnagoya.doorkeeper.jp/events/4225

<comment><USER2> Really looking forward to it! Hopefully it'll be easiest for patio11 to get to than Tokyo</comment>


No one you want cares about the cost of living - <AUTHOR> http://pandodaily.com/2013/06/19/memo-to-non-valley-non-nyc-ecosystems-no-one-you-want-cares-about-the-cost-of-living/

<comment><AUTHOR> Submitted this mostly because I think it's an idiotic way of thinking. As an example, I'm contemplating moving to Austin to springboard what I hope to turn into an industry leading content/media business for several reasons:

-I don't have a developer's, investment banker or lawyer's salary to fall back on while I learn to code and/or fiddle around. Any consulting I do, I'd have to do more of living in SF or NYC, which takes time from building the business. Any savings I have gets eaten up faster in SF or NYC and lessens my runway. That's reality.

-I don't need to look for a developer/technical co-founder in order to get started. My Wordpress instance is up and I just write.

-I don't have a trust fund or a rich uncle to mooch off of to help subsidize a lifestyle in either SF or NYC. My parents live on social security and aren't coming to my rescue.

I can understand the point of it not making sense for an already growing (read: revenue producing) startup to move to a cheaper locale. That I get. But I fail to see how you're not aiming high enough by starting out somewhere cheaper. Once you're making enough to where you aren't worried about where your next meal is coming from, then sure, move to SF or NYC. But the argument for not starting it in a cheaper place is flimsy at best and outright bullshit at worst IMO.</comment>