Piracy and the Four Currencies - <AUTHOR> http://www.gamasutra.com/blogs/LarsDoucet/20120222/9501/Piracy_and_the_four_currencies.php <comment><USER2> I think this is just a different way of expressing the idea that piracy exists only because the pirate user experience is better than the non-pirate user experience. So if the non-pirate experience, for example, does not require that you have the disk in your dvd drive in order to play (since all the assets are copied to your hard drive at install time), then the pirate experience is better. And so on.

so the trick is to make the non-pirate experience better and the piracy problem goes away. The only people pirating are the ones who would not buy your software/game anyway, so free advertisement/word of mouth should be welcome anyway.

The industry's problem is that it's hard to make a better experience, existing cash cows being existing cash cows and all. It's easier to protect them than to innovate.

But the point is well-taken.

<comment><USER3> "so the trick is to make the non-pirate experience better and the piracy problem goes away. The only people pirating are the ones who would not buy your software/game anyway, so free advertisement/word of mouth should be welcome anyway."

There are a couple of problems with this line of thinking.

First, the Louis CK $5 comedy show is a good example of this not working. Even though it has no protection and is very cheap, it's all over the torrent sites. Why would piracy continue in such massive numbers of the end user is getting everything they could possibly want?

Second, Yes, those people may not purchase your stuff. But, the bigger problem is that if everyone knows they can just download your stuff for free (and you don't care and there are basically no consequences), they will not pay you. They will get it from their friends or download it for free. I've seen this happen time and time again. Since software isn't a physical good, its value is almost like currency: it's only what people are willing to pay.

Piracy is also much worse than theft because if a TV is stolen, you just lose that TV. Over time, piracy can ruin an entire product line. Not just that one copy.

"The industry's problem is that it's hard to make a better experience, existing cash cows being existing cash cows and all. It's easier to protect them than to innovate."

Piracy has actually stifled innovation. Under normal circumstances, if I'm losing money, I'm going to figure out why, which will result in a better customer experience and product. Instead, since there is mass piracy, I'm just going to try to stop that first (Since it's obvious people like the product, they just aren't paying for it).

<comment><USER2> "Instead, since there is mass piracy, I'm just going to try to stop that first"

I didn't say the _incumbents_ would necessarily innovate; new competition will if they do not.

There are people that say piracy is a symptom of a broken business model. I tend to agree with that.

</comment></comment></comment><comment><USER4> Humble Bundle, Steam, and most app stores solve these problems for gaming.

It's too bad some titles from Steam include some really horrible DRM from their respective publishers, namely Ubisoft. Whenever I somehow lose a connection to Ubisoft servers, my game pauses with a 'Waiting to connect to Ubisoft servers' screen. The only way to get out of this screen is to quit the game. Based on this experience, I will never buy another Ubisoft game again, and yes this is post Ubisoft PR release about lightening up their online connection DRM.

<comment><USER5> _Humble Bundle, Steam, and most app stores solve these problems for gaming._

Still, there's another unit of currency in play that the app stores and subscription services don't offer. It's $VPO or Value of Proud Ownership and it's a currency you get instead of spend. You only get $VPO from buying while these centralized stores are more like renting.

I've written many times that the desire and ability to own something is an inherent motivation to buy it. If I like the band and the album, I buy the cd- or-equivalent because I want to _own it_. And to own means investing in something that belongs to you to the degree that you can resell it. That's my tribute to the creators, because it's human nature to try to liken yourself to what you admire. Owning a copy is flattery. Even owning a pirated copy is flattery because the price isn't a major factor there: owning it is.

I've been playing games in this decade that I bought in the 90's. Granted, I use an emulator and I often download, from abandonware sites, the ports most suitable for my emulator: I might have originally bought the game for Amiga but now I'm playing the PC version under DOSBox. Other games I've salvaged in time from 3.5-inch disks to my hard drive as images. But I still own the games I bought and nobody has taken it away from me.

This is why I'm not into app stores either.

While I might be a hermit retrogamer and certainly not a fan of the bleeding edge releases, and while I realize that for many people services like Steam might be a exact best solution, the underlying fundamentals don't change. There's a significant motivation factor buried in it.

If I really loved a game made this year I would want to buy it, not rent it. If I smelled it's a classic I would want to be able to play it in an emulator in the 2030's or even later. This means I need an "internet-age hardcopy", i.e. something that I can stash somewhere and unpack later for use with an emulator or original hardware. This would not be possible when I can't be sure any of the app stores is online after the next five years. This is the same reason Spotify doesn't speak to me at all.

<comment><USER4> You're pretty rare. I don't know of anyone who would still play ancient games or abandonware. The closest thing that I know of are people who still keep the Dreamcast, and I can count how many times they've played it over the last 10 years: 0. I don't feel that $VPO is a cost for most gamers as long as they can still access their game within at most a 5 year period. I would also argue that with services like Steam, players will be able to access their games for a longer period of time after changing machines.

<comment><USER6> They're not as rare as you might think. More than a few of us know about gog.com, DOSBox and the like...

</comment></comment></comment></comment><comment><USER7> This is why Steam is so good - it's less of a pain, and takes less time, than piracy.

<comment><USER8> But not for someone who's previously had their account locked, someone on usage-capped broadband, someone who doesn't know if their PC is up to scratch and knows that they can't get a refund...

<comment><USER9> I'm not sure how Steam would be worse than piracy for someone on usage-capped broadband. It would be better than BitTorrent, at least. And I think Steam lists system requirements for everything in its inventory, so though the refund situation still sucks, it does address the "Is my PC up to scratch?" question somewhat.

<comment><USER8> With piracy you can download it somewhere else and use a memory stick.

PC system requirements are still notoriously inaccurate. There are too many variables and the wrong combination of CPU, GPU, motherboard, memory bus, OS or drivers can make or break performance of a game. Minimum (or recommended) spec doesn't always mean that playing will be enjoyable.

<comment><USER10> You can actually backup&restore local content on Steam, so you can do the "download elsewhere then copy to memory stick" thing as well.

</comment></comment></comment></comment></comment><comment><USER11> Don't forget silly things like fleecing European customers or region-locking.

<comment><USER12> Sometimes (but not always) the fleecing is being done by European governments. The Value Added Tax in Italy is currently at 21%, with the possibility that it'll rise to 23%! Not to mention various "fees" when importing stuff.

They tried to get me to pay import fees on a birth certificate my dad sent me from the US. It cost him $50 to get it from the state of Oregon, so he declared that as the value (it would have cost him that to replace it, right?), and they tried to make me pay duties on that $50. I asked them what they thought the retail value of a birth certificate with my name on it was, and they backed down, but...sheesh.

<comment><USER3> "The Value Added Tax in Italy is currently at 21%"

Which is hilarious to me. Everyone wants socialized health care and huge government benefits..but then complain when they are forced to pay enormous taxes and take their mis-placed anger out on business owners.

<comment><USER12> That's actually a long and complex discussion, but suffice it to say that, overall, health care costs a lot less in Italy than it does in the US. The "waste" is elsewhere - people retiring at 59/60 and then living through their 90ies.

</comment></comment></comment></comment><comment><USER13> Sort of a Devil's Advocate point here -

This analysis is a great way to frame the discussion, but I think it is worth noting that it really depends on your user makeup by segment. As an example:

HN Reader | Very small % of population | Really good with torrents and pirated software | Higher Average Income | More likely to sleep better after not pirating

Non HN Reader | Really big % of population | Really bad with torrents and pirated software (on avg) | Lower Average Income than HN user | Less care about programmer well being

Obviously things would be easier without DRM, but some programs may (or may not) benefit from DRM for profit maximization because they derive far more revenue from the latter group. A non DRM product can easily be shared by the mainstream where a DRM product is still fairly hard to share for the mainstream.

<comment><USER14> Even if I did not care about programmer well-being, I would be reluctant to use torrents and pirate sites because of the threat of malware.

But then I have one Windows PC that I use for both games and online banking. Maybe that's rare among HN readers.

<comment><USER15> I stick with TV-series, and I've never seen an infected file. If I had been downloading software, sure, I would have been slightly more worried, but even so most sites have comments and ratingsystems. Looking at them probably helps you find out if a torrent is malicious or not.

TL;DR-version: In my experience, with some sense, your risk of running into malware in torrents is slim.

<comment><USER16> That's because you're knowledgeable enough to not click on the misleading ads yelling "download here". Average users might not be.

Offering a safe easy medium does have an appeal to many users, as shown by the success of Steam.

</comment></comment></comment></comment><comment><USER14> "Integrity dollars" are not like the other three.

1\. There is no limit to how many you can spend in a lifetime.

2\. They are non-linear: the more you spend, the lower the integrity cost of everything you do in the future.

3\. The effect of #2 is localized - if I still have a rack full of pirated CDs (both music and games) from my student days, I am less reluctant to pirate music, but that will not necessarily make me more likely to pirate movies or business software.

<comment><USER6> They can also go "negative" in a way, in that people who _want_ to support someone will spend more than is reasonable. Just look at some of those recent Kickstarter drives if you want an example of that. People are willing to spend more real dollars because there are so many "negative" integrity dollars that the price is still "cheap" to them.

</comment></comment><comment><USER17> Steam and the Mac App Store are good examples of how all of these different factors can work if applied right. Why can't these companies understand that I WANT TO PAY THEM. If you treat me like a criminal with a purchased copy of the game but I can get one without all the DRM from a torrent then it's really tempting to just go with the torrent. I don't pirate however there have been times that I felt so abused by the DRM that I can understand why people do.

<comment><USER18> The author mentions this a little in the article, but I feel like they probably could have expanded on that point - the "$I" cost of piracy can change depending on the seller's track record. As noted recently in the Oatmeal comic about pirating Game Of Thrones (and Andy Ihnatko's response), the state of piracy is such that, effectively, _all efforts to make piracy harder, make piracy more appealing._

I wonder how much pain these various industries will need to endure before they realize that the solution is to stop punching themselves in the face.

</comment></comment><comment><USER15> I would be prepared to pay all the $M the media industry wants today as long as they reduced the other three currencies considerably. My main reason for piracy is availability. I can't even buy the things I want where I live.

My dream scenario is a 1080p, DRM-free film, available worldwide behind a pay- link. I want to be able to download it, to feel that I own it. And that my money doesn't go to suppressing human rights and suing file-sharers. Pull that off, and you'll get my $M.

</comment><comment><USER19> The author doesn't mention that buying from companies¹ perceived as evil incurs an $I cost. In the same fashion one wants to support indie devs, there's resistance to feeding the beast responsible for bad market direction. It's basically a boycott; one still consumes the product, but without supporting the publisher.

For example, think back to when Spore was pirated: [http://torrentfreak.com/spore-most-pirated-game-ever- thanks-...](http://torrentfreak.com/spore-most-pirated-game-ever-thanks-to- drm-080913/). That's an example of a negative $I cost: even people with no interest in the game were getting on board, to send a message to EA.

¹Companies with dodgy user-experience track records, intrusive DRM, or who are perceived as having a negative effect on industry or the direction game design is going. Examples: Ubisoft, due to the forced-online connection even for single-player games, EA for Origins and banning policy, etc.

</comment><comment><AUTHOR> I thought this was a good analysis, though the author seemed to think the 'Integrity Dollars' were constant. In reality, they seem to be different per person.

Also he did not mention Value-Added bucks, which would be a benefit you get for playing the real version that you can't get with the pirated version.

<comment><USER20> The time is different per person too, depending on tech-savvy-ness. Pain-in- the-butt-ness also is dependent from person to person. Even price is not a constant if you consider coupons, discounts and price drops.

<comment><AUTHOR> True enough. After all, I like the features provided for me by Steam (cataloging, cloud, achievements, friends, etc.), so what some would consider a cost (in terms of DRM) I would consider a benefit.

</comment></comment></comment><comment><USER21> that's so freakonomics, awesome</comment>


A Warning About JQuery 3 - <AUTHOR> http://blog.bugsnag.com/a-warning-about-jquery-3 <comment><USER2> It's good to see this was recognised as a bug and quickly fixed. Meanwhile in spec-adhering Promise land, a similar problem still exists [1], which is why I recently banished es6-promise, and in turn fetch/fetch-polynomial from my codebases.

[1] [http://requirebin.com/?gist=8f13d5147c1c252ab1691115bfa8b7c5](http://requirebin.com/?gist=8f13d5147c1c252ab1691115bfa8b7c5)

</comment><comment><USER3> Wouldn't catch instead of fail be more compliant with es6 promises?</comment>


High Altitude Rocket Launch (aka Lunar Rocket for 5K) - <AUTHOR> http://www.kickstarter.com/projects/717162578/lunar-rocket-for-5k

<comment><USER2> Just asked them how serious this whole thing is. I'm familiar with people using weather balloons to get payloads to 'the edge of space' but have always been under the impression that getting anything into, or beyond, orbit required a very large and expensive rocket.

Can anyone with relevant knowledge comment on this?

<comment><USER3> Thanks you. Please post here if you get an answer from them.

</comment></comment><comment><AUTHOR> I'm really curious hear from those familiar with the subject -- does what these guys say make sense? It _sounds_ plausible, but the devil's in the details.

</comment><comment><USER3> I can't find a group called 'Lunar Robotics' that joined the Google XPrice <http://www.googlelunarxprize.org/teams></comment>


Bay Area tech company caught paying imported workers $1.21 per hour - <AUTHOR> http://www.engadget.com/2014/10/23/efi-underpaying-workers/? <comment><USER2> Hey, I've seen this article maybe 5 times on HN in the last couple days.

This one was from three days ago with 84 comments. You should search for this comment thread and add your thoughts to it!

Bay Area tech company caught paying imported workers $1.21 per hour (engadget.com) 101 points by akerl_ 2 days ago | flag | 84 comments

<comment><USER3> [https://news.ycombinator.com/item?id=8498341](https://news.ycombinator.com/item?id=8498341)</comment></comment>


Steve Yegge's predictions from 2004 - <AUTHOR> http://steve.yegge.googlepages.com/ten-predictions <comment><USER2> You guys seem to be saying he was wrong on most of them. I strongly disagree. Sure, he didn't nail every one exactly, because he's not psychic, but for all of them, he correctly saw the trend, and he's very in the ballpark.

1\. This is happening, just not as quickly as he thought, and with JSON. _(XML Databases)_

2\. If you actually read what he wrote, this is obviously happening. EC2, Github, Heroku. _(Open Source Hosting)_

3\. Using processes instead of threads is absolutely rising in popularity.

4\. Off on the timing, but we are in the middle of an explosion of other JVM languages. The JVM has clearly established itself as the best way to launch a new language.

5\. Off on the timing, possibly off completely. Clojure is gaining in popularity, which ties in with #4. _(Lisp in the Top 10)_

6\. Facebook. This one was easy. _(Community Hangout)_

7\. He was actually late on this one. iPhone obviously. _(Mobile Computing 5 Years Out)_

8\. Google Apps. _(I'll Pay Google)_

9\. Wrong literally, but if you take out netbooks, which weren't around, Apple sells the large majority of $1000+ laptops, and they obviously sell a ton of iPhones, which are just small computing devices. _(Apple Selling Laptops)_

<comment><USER3> In summary, he _nailed it_ as far as where the the wind is blowing but was wrong on timing; on all accounts except the last one. This is no bad feat as nailing both the direction and timing is nearly impossible.

Compare with, for instance, Bill Gates, who has been claiming that speech recognition as a primary means to control computers is just five years away, for over twenty-five years now.

<comment> Tuna-Fish Sorry, but there's a saying in investing: "Right but early is wrong. Right but late is wrong."

Any fool can make a very long list of predictions that will all turn out to be correct, even in the stock market, as long as he doesn't have to give them a timeline. Plenty of people saw the housing crash, for example, and plenty of them understood that certain banks were underwater, and regardless of their actions, they were going to go under. However, just knowing that isn't actually worth anything -- a short position carries a heavy premium in interest, and in the famous words of Keynes: "The markets can remain irrational longer than you can remain solvent."

<comment><USER4> In your 'sayings' early and late are ambiguous. As far as investing is concerned being right in a prediction means you profited, so the early-late error bar is defined by the time in which you could profit by your prediction. Applying this same rationale here the early-late error bar is harder to define, since profit is not clear and somewhat subjective. So taking some liberties with early-late and right-wrong is I feel appropriate.

Taking into consideration that these predictions are 5+ years old I think they are pretty good. He clearly spotted several trends whose future significance was at the time not obvious. If someone started a business believing one of these trends had promise it is possible that the business would have been successful. I do feel that for what he was trying to accomplish being early or late by a couple of years or off on a detail but correct in spirit is not significant.

Also, I think it is important to add that making predictions like these is very important becuase the future develops from our perceptions of what it will be.

</comment></comment></comment></comment><comment><USER5> I used to be a 'wizard' (player admin) for Yegge's GMUD, Wyvern (he mentions it occasionally in his newer world-facing blog; it can be found at www.cabochon.com). He doesn't just make predictions like this, he actually bets on them.

For example, he bet that people would want to play a game with deep and intriguing gameplay regardless of the graphics. Then he bet that people would want to play it on a handheld device (specifically, he targeted the Sharp Zaurus, but the game is compatible with some other palmtops of the same era). I think he's right on the first count, but too early on the second (targeting the iPhone, for instance, would probably have been more successful).

There are a number of other reasons the game didn't take off, but the point is that he's not an armchair pundit, shouting that we should all listen to him and take action based on his foresight. If anything, he's taking action, and just logging the predictions that prompted him.

<comment><USER6> Wyvern on an iPhone. That's exactly what I want to see, and what the other games I've been playing don't quite match up to. It has a low demand on the graphics and network side of things, but has a rich and rewarding game play experience. For me, obviously.

I haven't played that for a few years. I'm going to have to start again.

<comment><USER5> I don't know exactly what it was, but the game lost a lot of magic for me at some point. Now the aesthetic is totally different, and I just can't get back into it.

</comment></comment></comment><comment><USER7> TL;DR:

Prediction #1: XML databases will surpass relational databases in popularity by 2011.

Prediction #2: Someone will make a lot of money by hosting open-source web applications.

Prediction #3: Multi-threaded programming will fall out of favor by 2012.

Prediction #4: Java's "market share" on the JVM will drop below 50% by 2010.

Prediction #5: Lisp will be in the top 10 most popular programming languages by 2010.

Prediction #6: A new internet community-hangout will appear. One that you and I will frequent.

Prediction #7: The mobile/wireless/handheld market is still at least 5 years out.

Prediction #8: Someday I will voluntarily pay Google for one of their services.

Prediction #9: Apple's laptop sales will exceed those of HP/Compaq, IBM, Dell and Gateway combined by 2010.

Prediction #10: In five years' time, most programmers will still be average.

<comment><USER8> #1 is kinda sorta like the NoSQL movement (hierarchical versus relational modeling, do away with much of the O-R impedance mismatch).

#2 Github?

#3 The evils of threads, and how to replace them with something else to use multi-cores, is very high on the list of blogged about programming topics. Several new languages have staked their claim to fame largely on how they handle concurrency. So, yes, this one was understated, if anything.

#4 Not there yet, but might be on that trajectory if there is some "tipping point" of Java programmers en masse getting fed up with Java's limitations. There are certainly enough alternative JVM languages to choose from.

#5 Does Clojure make the top 10? Certainly not in number of users, but maybe in most popular to blog about.

#6 Facebook.

#7 iPhone was released June, 2007, beating his prediction by a couple of years.

#8 Maybe if you buy an Android phone from them?

#9 Apple laptops are immensely popular, but the scale of this prediction was a little ridiculous. Between iPhone and iPod, it's possible that there are more people who own an Apple product than own a product from all those companies combined.

#10 Now that's just insulting. Who's he calling average?

<comment><USER9> _#10 Now that's just insulting. Who's he calling average?_

The average programmer.

<comment><USER10> As if that weren't bad enough, at least half of them are still _below_ average.

<comment><USER11> Only if it's a standard distribution (eg bell curve). It's quite possible with a non-standard distribution to have much more than half above average as well. Now _median_ on the other hand, by definition, separates the distribution in half... </pedantic>

<comment><USER12> Or perhaps much more than half below average.

</comment></comment></comment></comment></comment></comment><comment><USER13> #1: XML DB has nothing to do with NoSQL. Even if there is some external similarity with document stores actually the main point of the author is that people don't want to perform conversions. This was not the reason NoSQL started at all and not our main problem with SQL in the latest years.

#2: This has nothing to do with Github or hosting of _source code_. Here the author was referring to sell the service of _running_ a web application for you, like a forum or a wiki, and so forth. something like vanilla forums or wordpress.org are doing indeed. IMHO this prediction was more or less totally wrong, as the latest five years showed us that web applications are a big business but companies will try to rewrite from scratch the product they are offering in order to take it closed source, to offer more in terms of usability, and probably even for scalability concerns.

Actually the reverse happened, for instance Reddit instead to use a Digg clone wrote the code, and later released it as open source.

</comment><comment><USER14> The important thing to remember when grading predictions is that most predictions are about trends. So the important thing isn't whether "The Year of MobilePhone Computing" was 2008 or 2009 or 2010, the important thing is that it was still a few years off from 2004. It's the same thing as the "Singularity" guy's predictions. When you're predicting things 6 months in advance, you should get graded on a lot harder of a curve than predicting things 6 years in advance or 16 years in advance.

</comment><comment><USER15> I think he nailed it with prediction #7. Many of you are saying he was late because the iPhone was released in 2007. Well, the iPhone SDK wasn't released until 2008 and the industry didn't step up to the game until 2009 when a bunch of Android handsets started to come out.

I do think he was wrong on most of the others, though.

</comment><comment><USER16> It sucks he didn't put a date on that post. Kind of an egregious oversite, right.

<comment><USER17> Not sure if you're being sarcastic, but the date is right at the bottom of the post: "(Published Nov 10th, 2004)"

</comment></comment><comment><USER18> I think #10 is pretty much a truism (but still important to remember!).

</comment><comment><USER19> So basically he didn't get anything but #6 (facebook) and #10 (which is more of an insider joke than a prediction) right. Remember this next time you read Yegge's rants.

<comment><USER20> _Remember this next time you read Yegge's rants._

Well, even deep understanding doesn't imply the ability to predict, unless chance plays little role -- a stipulation which is manifestly not the case, here.

Edit: grammar

<comment><USER19> Deep understanding should discourage one from making predictions, though.

<comment><USER20> Depends on your goal. If your goal is to avoid making statements that are wrong, then sure. If your goal is to be interesting and say provocative things, maybe not so much. :)</comment></comment></comment></comment>


In China, tattoos border on illegal – and they're his life's work - <AUTHOR> https://www.latimes.com/world/la-fg-china-tattoos-20190416-story.html <comment><USER2> Tattoos are generally stigmatized in most of East Asia: China, Korea, Japan and cultures affected by these countries.

Although there are some ties to the past with tattoos predominantly being used by outlaws, criminals, prisoners, slaves (prisoners and slaves were branded with tattoos on the face to ensure people knew who they were and was also considered a punishment of its own) or soldiers (in certain periods of history, soldiers weren't respected in China and considered a lowly job as there was a high chance of death and they often were involved in pillaging in the more chaotic times), modern-day stigma is from criminals and gangsters who would use tattoos to differentiate themselves and show themselves as "hard and not to be messed with" or to inspire courage within themselves.

Nowadays its a bit more relaxed but even now people will hide tattoos in job interviews because it can mean an automatic rejection.

<comment><USER3> Note that despite the fact that tattoos are rather normalized in the West, the default stance is still to hide them during job interviews, with varying degrees of leniency depending on industry and region (e.g. Microsoft probably doesn't care if its programmers are tattooed, though it will for its corporate salespeople).

<comment><USER4> To be fair, the default stance on interview attire for men is a suit, which covers like 95% of a persons body.

<comment><USER5> It's probably not the default? I'd guess that most men _don 't_ wear suits to interviews. I didn't wear a suit when I was applying to be a baker. Or when I worked at Costco. Or any of the software jobs I've had. Or even when applying to be a manager.

A button down and a decent pair of jeans, maybe. But I can think of 0 times I've worn a suit to an interview.

<comment><USER6> Regional? A suit is the norm in DC for most industries, including software. I've only interviewed one candidate (in DC) who dressed casually. Two or three in suits w/out a tie or a blazer and dress pants. The rest were in a standard suit with a tie.

Bangalore was the opposite end of the spectrum. Not only casual attire but a casual attitude to the interview in general (cell phone on the bus, in the park, etc). I don't know if that would hold for local, in-person interviews, but was true for video interviews (development team is split 50/50 between DC metro and Bangalore, with managers in both locations).

At my employer, arm or neck tattoos would be noticed, but probably not impact a developers job prospects. Management might be a different story.

My wife is in banking and a suit is 100% expected at interviews. And tattoos covered. And piercings anywhere but the ear removed. A face or neck tattoo would likely be an immediate disqualifier for a job at HQ and probably also in their call centers or branches. Of course, they also dress true business casual every day (no jeans, men wear jackets, etc).

<comment><USER7> ...huh. Interviewing in VA/MD, only once had a candidate wear a suit. Nice shirt and blazer with jeans/slacks seems to be the norm. I wonder if it's micro-regional to DC? Or something about the specific software industry you are in?

<comment><USER8> My understanding has been that most large companies, especially those older than like 15-20 years, in the east coast follow suit-culture for white-collar work; the minimum being business casual for daily work (not eg meetings with execs).

This difference being the quintessential culture shift compared to california (aka silicon valley) dress code, with shorts and shirt being a _very direct_ reaction to it

But this is based on hearsay and history; I'm not old enough to experience it myself ;)

<comment><USER6> That certainly fits both my employer and my wife's.

Both are large and old.

When I meet with clients in any sort of sales capacity, I wear a suit. Daily wear is nice casual (jeans, button down shirt). Conventions or site visits are pants and a jacket, no tie.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Look guys I don't know what's going on with all these China news but as a european who's lived in china several years, a lot of it seems wrong. I was in south China for a year recently and many people had visible tattoos, just as many as west europeans. And nobody cared. At all.

<comment><USER10> A bit of a mirror version of people's assumption that southerners in the United States all talk with a drawl and wear cowboy hats.

</comment></comment><comment><USER11> I don't understand tattoo, it's like wearing the same cloth (i.e. a T-shirt) every day, for the rest of your life.

I do think there's market for more colorful, longer lasting temporary tattoos. (Might be a startup idea for ya)

<comment><USER12> If using that line of logic, Do you also complain that you can't change your face?

Tattoos are an extension of your identity that you get to customize to your liking. The art is an expression of who you are and your body is the canvas. Of course you might think it not necessary or pleasent but to quote The Dude: "Yeah, well, you know, that's just, like, your opinion, man."

Personally I don't have any but If I did they would tell a story about me. And that story is my identity, my brand. You can then experiment with clothing that reveals different things if you like. I have a few friends that get deep into the art and fashion they use to accentuate them. It does have an appeal and to some looks attractive. YMMV, etc.

</comment></comment><comment><USER13> Before reading the article, I was thinking that many Triads tattoo women in their family with large dragon tattoos (I dated one of these girls when her family moved to Los Angeles). It was weirdly explained to me that if a man tried to hurt her and saw those tattoos he would be afraid of the Triad and leave her alone. I found the entire concept a bit repulsive, but it isn't my culture.

The article's claim that tattoos are associated with gangsters lines up with this.

<comment> duncan-donuts The history of tattooing is vast, as with any subculture. There's a lot of history with bikers, gangs, tribes, artists, healers, etc. You should read about the history of Russian prison tattoos[1]. I'm biased because I am a tattooed person. All that being said tattooing isn't just for gangsters. Humans have a long history of marking their bodies permanently[2].

1) [https://www.vice.com/en_us/article/9bzvbp/russian- criminal-t...](https://www.vice.com/en_us/article/9bzvbp/russian-criminal- tattoo-fuel-damon-murray-interview-876) 2) [https://www.smithsonianmag.com/history/tattoos-144038580/](https://www.smithsonianmag.com/history/tattoos-144038580/)

</comment></comment><comment><USER14> In South Korea, tattoos _are_ illegal, but it hasn't stopped artists from creating - and creating some truly beautiful work. Tattoos have become relatively mainstream and millennials (though I hate the term) have widely adopted tattoos as commonplace. It's striking to see the cultural differences between East Asia and the western world, perception around tattoos being just one of them. Tattoos are particularly interesting because of the influence Asian artists have had on the culture and ethos of the art despite the widespread suppression of it. I'd love to hear a perspective on why it's evolved to be so different - and I do suspect it has to do with organized crime playing a large part (i.e. the Yakuza and the Triads).

<comment><USER15> Tattoos are not illegal in South Korea, neither having them or making them is illegal.

It is simply classified as a form of acupuncture and regulated accordingly.

<comment><USER16> While tattooing is technically illegal in South Korea... [0]

[0] [https://en.m.wikipedia.org/wiki/Tattooing_in_South_Korea](https://en.m.wikipedia.org/wiki/Tattooing_in_South_Korea)

</comment></comment></comment><comment><USER17> My husband used to work at one of the top lobbying firms in Washington DC. He told me they had a standing rule that if they saw a tattoo on someone, unless they were a former member of Congress or some very high ranking staff person, they wouldn't hire them. Not even for the internship program. There was paranoia that the wrong tattoo could scare off a potential client.

<comment><USER18> You mean to tell me that lobbyists aren't cool and easy-going?

</comment></comment><comment><USER19> Lived in Shanghai for a long time. There are more and more people getting visible tattoos.

> "Even now, it is rare to see tattoos in the street or public life."

Maybe in smaller towns but it's pretty prevalent in Shanghai, Beijing etc.

</comment><comment><USER20> Fix that title</comment>


Ask HN: How does a n00b get started on open source projects? - no-go-mojo

My fellow hackers,
I just started messing with Rails, but in a big way. That does not mean I've done anything great, I just have been learning from every source I could. I think I'm ready to stand my own two feet now (or at least try).
How do I start looking at, and messing with, simple open source projects? I'd prefer projects that are well documented / have tons of comments, are small, standalone, and simple.
For example, a good initial project might be a simple form, that lets users sign up, and store data in a db, and be able to call it (kind of like bare-bones Wufu). Another might be just creating multiple relational dbs and messing with them.
Also anything that teaches good jQuery integration, CSS etc. Also, if anyone would like, I don't mind putting up my crap work somewhere for you to dissect. :-)
Always grateful. <comment><AUTHOR> I'm an amateurish PHP dev; so I can't suggest specific projects to get into. BUT I've found the best way to go about getting into any open source project probably would be:

\- Choose a project you've used if you can. (I went with WordPress for example)

\- Decide whether you want to try helping out with the core project or you would prefer to make an add on

\- Make sure you follow the docs, get the build for the project ready -- or at least try to following what the project's docs tell you to. Do your personal best to get a hang of the source--particularly the area where you're aiming at. Try your hand at writing some code.

\- _Now_ reach out to the core developers and the community (IRC, mailing lists, forums)-- discuss any problems you faced getting your dev set up ready, writing/testing code or any concepts you didn't understand (don't ask stuff that can be answered with a lmgtfy), your idea. Ask for a simple bug to fix if you haven't managed to find anything.

\- Develop it further -- get feedback from devs and end users -- release/submit a patch. Based on feedback, iterate and release the next version/new patch. Repeat!

[edit] Corrected formatting

</comment><comment><USER2> Spend time reading interesting source code. Follow a forum. Pour over APIs. Read, read, read.

After awhile, you'll grow impatient and want to stop reading and actually do something based on some ideas you got from what you read. Give in to that urge. Start off with something simple and small. Don't be ashamed to share it with others and ask what they think of it.

Above all, have fun and be humble. Personally, I can tell you I got a lot further faster when I started taking myself less seriously. Besides that, it'll make the surprise all the sweeter when someone offers you those first open source commit rights or offers you a sweet job.

</comment><comment><USER3> If you have your own project in mind, you can get started on your own. You will bump into a lot of open source add-ons like gems that you'll want to use. When the gem doesn't do what you want, you can always modify it as needed and submit a pull request.

</comment><comment><USER4> hey there, I m not a really experienced developer probably at the same level as you but with Python. Anyways, I ve been told that one of the best ways is through GitHub.Fork a project, then work on it. YOu could ask developers's advice since people can follow you and you can follow them. It s an awesome tool!</comment>


Should I study towards a MD/PhD in light of advances in AI/robotics/automation? - <AUTHOR>

I'm considering becoming a radiation oncologist. Specifically, I would like to do a BSc in Electrical Engineering plus pre-med, followed by a joint MD/PhD (EE) degree. A BSc takes four years, and MD/PhD programs take an average of 7-8 years. On top of that there is a one year internship and a residency requirement of at least five years. All in all, it would take me 18 years to get to my dream job; even if I did away with the PhD and only went for a regular MD, it would still take 14 years to become an oncologist.
My question is twofold:
(1) Will AI/robotics/automation have made most health care jobs redundant (or at least reduced their financial viability) by then, making such an investment (nearly two decades of opportunity cost) futile?
(2) Provided physicians are still needed in the future, is it at all possible to start a healthcare technology company on the side to make use of my technical knowledge while working as a doctor part-time? Would hospitals or private practices be prepared to accommodate me? Would it be financially feasible?
Thank you. <comment><USER2> I'm an MD-PhD student with the type of background you are interested in developing. Radiation oncology is going to be a dying field in the future, but that is the subject of a different conversation.

I think you want to go into MD-PhD, but I would suggest against it if you are more interested in the technology than what is best for patients. A lot of technologists are having problems conceptualizing this because they don't understand the limitations of current technology and what dealing with patients entails. Instead of trying to be a leader in this type of field you should focus more on potential problems technology can solve much better for patients by improving outcomes and decreasing costs. The biggest problem in medicine right now are the insurance companies and healthcare administration practices which are quite costly and provide little patient benefit.

1.) Technology is only going to have as big of a impact on medicine as doctors and patients allow. If you want to make an impact on healthcare focus on developing technology where you can convince doctors that outcomes and costs are better. If you look at past clinical research done, a lot of technology did not produce the beneficial outcomes perceived by the inventors. Clinicians are skeptical of technology without proper evidence suggesting its usefulness. Your technology will have to navigate this system.

2) MD-PhD gives you a lot of flexibility with doing this type of thing, but I would suggest that you focus more on helping patients than building a business. Likewise, I would suggest trying to become more involved at an academic hospital that could support your intellectual property pursuits, give you access to the patients your technology can help, and help find the resources you need for new developments. Neurosurgeons with engineering backgrounds are probably the most successful in this respect.

You have a long ways to go and the journey is not easy by any means. Good luck. Questions are welcomed.

<comment><AUTHOR> Thanks for your input. Regarding insurance companies and healthcare administration, I don't think those are problems to be solved by MDs or even PhDs but rather issues to be solved by already existing tech automation companies in coordination with legal experts. You mentioned radiation oncology is a dying field. Could you elaborate on the future of the various specialties (maybe top/bottom 3) as far as you can tell?

<comment><USER2> I think radiation oncology is going to be displaced by emerging disciplines in medicine. I would pay close attention to what is happening in the field of immunotherapy since there are a lot of recent success in difficult cancers, autoimmune diseases, and infections. Recently several specialists have supported immunotherapy's potential in cancer treatment ([http://www.nature.com/nature/outlook/cancer- immunotherapy/](http://www.nature.com/nature/outlook/cancer-immunotherapy/)). Unfortunately, training in radiation oncology will most likely be different than the training required to perform this type of medicine. Likewise, the potential for automation/technology/AI in this particular field is quite limited.

It's important to think about why medicine might be moving away from radiological therapies. They are poorly tolerated by patients and expensive ([http://www.cancer.gov/cancertopics/coping/radiation- therapy-...](http://www.cancer.gov/cancertopics/coping/radiation-therapy-and- you/page6)). It's difficult to say what will happen in the next couple of years, but radiology in general is taking a hit since hospitals are trying to limit the use of expensive and unnecessary imaging often at the expense of radiology professionals ([http://www.auntminnie.com/index.aspx?sec=ser&sub=def&pag=dis...](http://www.auntminnie.com/index.aspx?sec=ser&sub=def&pag=dis&ItemID=100261)). Choosing a career path in medicine should be more about how you like interacting with patients.

<comment><AUTHOR> Can you expand on potential future medical disciplines and what specialties you think are going to be replaced?

</comment></comment></comment></comment><comment><USER3> Hi! I'm an MD/PhD student, in my final PhD year (6+2, Netherlands). I'm working on computer navigation in orthopedic oncology, basically objective navigation in the OR. This, together with some small sidesteps into 3d printing and computer supported diagnostic imaging. The combination of medicine and technology is an awesome field to be in. There are so many projects that you can work on.

As Xaa has written, most doctors are not focused on technology. They will use it, understand it but especially the older ones do not embrace the possibilities automation or innovation can offer. That coupled with slow development and access to the market makes us lag behind other high-tech/high- impact industries (for example aviation).

Do not underestimate how hard it is for automation to completely take over a doctors job. In 50 years we will still need radiologist. The tools you will develop will support your and others workflows, making healthcare better. And if it replaces a certain task, others will arise, as for example radio frequency ablation has a growing role in oncology. (and is often done by a radiologist!)

Furthermore there are legal implications. Surgery will not be completely automated (fire and forget)in the next decades, simply because of this. A surgeon always has to be present. For example: the most chosen approach for robotics in orthopedics is assisted surgery, where you move the tool and the robot blocks you from making bad moves.

So, as an MD/PhD you will be a bridge between two completely different cultures. I sometimes joke that the engineers we talk to have a solution for a non-existing problem and doctors no technical solution for an existing problem. It's actually really hard to understand each others fields. So in this you are valuable!

You seem very motivated! I can only draw conclusions on my choice, but I can recommend it! If you have any questions ask away.

<comment><USER3> Forgot to answer the questions directly and editing does not work:

1) No, definitely not.

2) Yes, lot's of research minded doctors/phd's already do. From producing transplant transfusion fluids to pedicle screw insertion simulators or acetabular cup reconstruction prosthesis after hemipelvectomies. During residency its almost impossible though.

</comment></comment><comment><USER4> I'm a PhD in biomedical sciences (biochem/bioinformatics), so I don't know directly about the MD side, although I work with MDs frequently.

From what I have seen, physicians are generally not tech-savvy and are fairly behind-the-curve when it comes to automation. Even many of the things that are currently possible to automate, like EMRs and some aspects of diagnosis, aren't. Since any technology that replaces what a physician does has to be approved by the FDA, it moves very slowly. I think it is a long time before large numbers of physicians are put out of work by technology. Especially since the quantity of MDs is artificially limited.

That said, radiology is probably one of the first specialties that will be automated. Already, some image recognition algorithms have been shown to outperform trained radiologists at recognizing, e.g., cancer. So, if you're purely after job security, it might not be the best specialty to choose.

But with a tech-heavy background like an EE, you have plenty of options. MD/PhD + tech background is a perfect preparation for research, if you're into that. Or you can help develop systems to automate various aspects of medicine. Although it will put people out of work, in my opinion automation in medicine is a very good thing for society because algorithms don't make mistakes (other than the inherent limitations of the algorithm), don't get tired, and you don't have to pay them, so automation should lower soaring health care costs. You can always go into a biotech firm as well.

To answer 2), yes, physicians (at many places) have good flexibility with their hours. The only thing you might have to worry about is who owns IP, especially if you work for a university health care system.

<comment><AUTHOR> Thank you for your reply. Would you be so kind to elaborate on what you do for a living as well as in what capacity you work with MDs? Frey and Osborne (2013) published a paper that indicates how likely certain professions are to computerization. You can find it here:

[http://www.oxfordmartin.ox.ac.uk/downloads/academic/The_Futu...](http://www.oxfordmartin.ox.ac.uk/downloads/academic/The_Future_of_Employment.pdf).

However they didn't elaborate on the various medical specialties. Do you happen to have any information on that?

From what I hear MD/PhDs do research about 10-20% of their time, while they spend the remainder on treating patients. I'm afraid very few hospitals/practices would be willing to let me work only 3 days a week so I can work on a tech company on the side. I'd think maybe I could do some consulting but that's it; I don't think there would be time to pursue outright entrepreneurship.

<comment><USER4> I am a researcher at a nonprofit research institution that does both basic and clinical research. When I work with MDs (or MD/PhDs), it is usually to analyze clinical and/or genomic data that they have collected from patients. Sometimes I am roped into building web applications either for data analysis or patient questionnaires. Once in a while, I develop prototype algorithms to aid in diagnosis from e.g., histology images.

The ratio of research to clinical practice for MD(/PhD)s is basically whatever you want it to be. At my institution, it seems more like 70% research / 30% clinical on average, but that's because it's a research institution with a clinic, not a clinic that does some research. Several of the MDs I work with have dropped clinical practice altogether for full-time research as well.

Also at my institution there are researchers and/or clinicians who spend most of their time on building a business. The administration very much encourages this because they get a cut of the IP royalties. In academia, your value is basically proportional to the money you bring in, so these people are actually treated like gods.

Basically, there are a LOT of jobs out there; if you are qualified and productive, you can easily find one that suits your preferences.

(I have no hard data on what specialties are more or less likely to automate. I would expect GPs/family practitioners to be the least likely, but who knows.)

<comment><AUTHOR> That sound pretty good to me! Can you tell me about the salary range of those MD/PhDs doing research and about the cut such an institution gets? I'm asking I'm guessing the hours that your institution are sane (read: 9-5ish)? Thanks a bunch.

<comment><USER4> I live in an inexpensive part of the country, so salaries obviously vary based on that. $80-150K is the normal range for a PI here, but the sky's the limit if you can pull in a lot of grants/royalties.

There are no set hours. You work when and where you want. (I usually roll in around 11-noon). They don't really care how you spend your time, as long as you publish and get grants. Patents are just icing. Obviously clinical hours are in the 9-5 timeframe though.

I don't really know the normal IP cut in detail. I believe it is roughly 50% of the patent royalties, negotiable depending on how much pull you have. But if you are the actual owner of the business as well as the patent creator, then you get both the royalty cut and the business profit, whereas if you just sell the patent you get only the royalties (but obviously that is a lot less work).

EDIT: I feel compelled to point out that it's not all roses. The flip side of the freedom is that you are judged solely on your results. If you can't produce, for whatever reason, you're going to have a hard time. There's little job security. And so forth.

</comment></comment></comment></comment></comment><comment><USER5> Do the BSc + premed and evaluate the medical thing more deeply in your third year--or graduate, work for a couple years, and then decide. Work can provide a lot of perspective that's difficult to get otherwise (assuming you're still in high school). It's tough to plan your life that far in advance; you might develop more specific interests as time goes on (plus expectations of what the industry will look like may change over the next few years too). Even if your plans change considerably, EE + premed is a solid background, so transitioning to a different field wouldn't be a huge pain.

1\. Automation will have a big impact on medicine, but it will be an ongoing process, not something that happens overnight. If you're doing a joint MD/PhD(EE) program, then you'll presumably at least have some technical qualifications that would make you more appealing to a company that is working towards the automation of healthcare.

2\. You might be able to start a business on the side, but not as a resident unless residencies become immensely less stressful and time-consuming. Part- time work as an oncologist may be hard to negotiate early in your medical career, but I am not a doctor (though I did investigate similar questions a few years back, and this was the impression I got from speaking with doctors and MD/PhDs). Financial feasibility... as an MD/PhD, you shouldn't have much in the way of personal debt (since the PhD covers the MD tuition as well), and I wouldn't expect you to be dipping too close to the poverty line.

Realistically, it depends a lot on whether you have a specific business idea in mind and what your drive looks like. Those aren't things that you can plan very well 20 years in advance.

</comment><comment><USER6> Yes get the MD/Ph.D With an EE degree you can build the next generation devices.

<comment><USER7> do NOT get an md degree. it is useless. in this era of corporate driven health care that is mass produced, physicians are glorified trades workers. Real impact in the tech of health care is done by engineers. Being a physician does not allow you to implement anything in the current medicolegal climate. And understanding the reality of health care delivery does not require an md degree. Witness all the lawyers pursuing suits for many of the tech advancements of yesteryear-artificial hips, slings, implants-not to mention medications.

Future development of health tech will get hamstrung by the same sort of thing except it will be driven by cyber failures and privacy violations. Physicians will remain the fall guy for any product failure. Better to get a phd in a product that has major health implications-for example, develop a sensor for blood sugar that is non invasive, develop an algorithm and an app that predicts MI and cardiac disease for an individual. etc.

We are currently importing our physicians because other countries produce them so cheaply (just like software engineers). And we pay them a fraction of what medical school tuition accumulates to.</comment></comment>


Ask HN: What is the most novel program you saw? - <AUTHOR> i am talking about the source code of course, not what the program does <comment><USER2> Define "novel" please?

Unless the code is i an unusual language, i can't quite think of anything that would fit the common definition of that word.

<comment><AUTHOR> i mean the solution itself is like an art</comment></comment>


The Chrome Assault: IE's Walls Are Crumbling - <AUTHOR> http://www.conceivablytech.com/3836/business/the-chrome-assault-ies-walls-are-crumbling/

<comment><USER2> The article doesn't mention mobile, the area where I would expect Chrome to be gaining (and IE isn't a player).

<comment><USER3> Mobile is completely dominated by WebKit. Chrome's process model, JS engine and, well _chrome_ , are really the only things that separate it from Safari, meaning that Chrome's gains on mobile are fairly moot, since the engine's used in iOS, Android, and Symbian.</comment></comment>


The Value of a 70-Year-Old Software Engineer - <AUTHOR> http://www.freakonomics.com/2011/05/31/the-value-of-a-70-year-old-software-engineer/

<comment><USER2> The 70ish programmer I work with is fabulously valuable and he's not even directly leveraging his hard-to-find COBOL skills (he works as a SQL DBA, we have other COBOL programmers on staff).

His main value to me is that he can immediately and measurably improve any design we bring to him.

When I'm designing a new system or process I always run it by him and he'll give me a few thoughtful suggestions that make my design more robust, auditable, and maintainable. This "unconscious competence" [1] borne of decades in the trenches can't be taught.

[1] <http://en.wikipedia.org/wiki/Four_stages_of_competence>

</comment><comment><USER3> The article stated "Being technically obsolete gives him an advantage." AND "...there are so few other programmers left who can deal with the old technology!

So...what are good examples of "old technology" that might be interesting and offer opportunity if mastered to fill a niche for the next decade?

The article mentioned COBOL. Any thoughts about FORTRAN or particular technical hardware such as old CNC machine tools, etc.?</comment>


Low vitamin D linked to heart disease, death - <AUTHOR> http://www.reuters.com/article/2011/11/26/us-vitamind-heartdisease-idUSTRE7AO1UM20111126

<comment><USER2> While the headline is also true, the significance of this study (as the article explains) is showing that supplementation can reduce mortality. It was previously known that low blood levels of Vitamin D were linked to negative outcomes, but it was much less well agreed whether supplementing with Vitamin D would improve outcomes.

It's an obvious hypothesis, of course (low X associated with negative outcomes, so increasing X will improve outcomes), but not necessarily guaranteed: the low Vitamin D levels could've been symptoms of a different problem that isn't fixed by just supplementing with Vitamin D; or the supplements might've failed in various ways to be taken up or activate the right mechanisms.

<comment><USER3> An example of a similar obvious hypothesis that appears to be flawed: raising "good cholestrol" with niacin supplements appears not to lower risk of heart attacks as was widely assumed

[http://www.npr.org/blogs/health/2011/05/28/136678665/study-b...](http://www.npr.org/blogs/health/2011/05/28/136678665/study- boosting-good-cholesterol-with-niacin-did-not-cut-heart-risks)

</comment></comment><comment><AUTHOR> The interesting thing about this study is the finding on a classic "hard endpoint," namely all-cause mortality. And what is worthwhile about this news story is that it doesn't just regurgitate a press release, but points out what issues haven't been resolved by the study. Those issues are always important to keep in mind.

<http://norvig.com/experiment-design.html>

The first author

<http://www2.kumc.edu/internalmedicine/cv/jvacek.html>

and his lab

<http://www2.kumc.edu/internalmedicine/cv/publications.html>

appear to have some relevant experience and previous peer-reviewed publications. A finding of this nature must, of course, be replicated by other researchers.

Here is a link to the abstract of the e-publication ahead of print of the underlying study in the American Journal of Cardiology:

<http://www.ncbi.nlm.nih.gov/pubmed/22071212>

<comment><USER4> It must be replicated. In the meantime, it's probably a good idea for people in Northern areas to take 1-2k IUs/day.

<comment><USER5> Get your levels measured and dose accordingly. Most people are deficient in a number of areas, and you can get screened for them all at once.

In the absence of that, if you're just making a qualified guess, you should probably dose significantly more than 1,000-2,000 IUs/day. The daily intake required for toxicity to be an issue are very high (sustained total intake of around 20,000 IUs/day). It's also generally recommended that D3 supplements are taken alongside a K2 supplement.

<comment><USER6> "Most people are deficient in a number of areas, and you can get screened for them all at once."

May I double-click on that? What do you mean? Who do you go to, and what exactly do you say to them? Which areas are you referring to?

<comment><USER5> Talk to your doctor. They can take a blood test and send it off to analysis. It can be somewhat expensive. When I said "all at once" I didn't mean that a simple biochemical test can reveal all deficiencies, obviously, but that a single blood test can be sent off to have many different tests done. I'm not yet sure exactly how it works in the US, sorry.

The kind of deficiencies I had in mind would be vitamin (e.g. D, K), mineral (e.g. iron, calcium) and electolytic (e.g. magnesium, potassium).

</comment></comment></comment></comment></comment><comment><USER7> About two years ago CBC news had a great segment on vitamin D and cancer rates.

Anyone in northern (far south) climate isn't exposed to enough sunlight after early Fall.

Even if you were outside naked all day you'd never get enough sunlight to make enough vitamin D. It's even worse if you have a naturally dark complexion .

</comment><comment><USER8> I have personally found vitamin D supplementation to help with my mood and energy level, at least in winter.

If you get a lot of sun on a summer day, your body can make as much as 10kIU. So supplementing at the level of around 1kIU/day, which is what I do, seems reasonable.

<comment><USER9> A friend on mine who has Multiple Sclerosis mentioned to me that it gets much worse for him in the winter, and then gets better heading into the spring and summer. IIRC low vitamin D is believed to make MS worse. He was going to try tanning beds this winter to see if it helps (usually tanning beds are bad news due to cancer risk, but in his medical case his doctor recommended it). Disclaimer: All anecdotical.

\</comment></comment><comment></comment><comment></comment><comment>--

Vitamin D is synthesized by your skin from sunlight using UVB rays. This is interesting to note, indicating that being far from the equator does not mean you cannot get enough UVB rays from sunlight during the winter:

 _The assumption that vitamin D levels in the population follow a latitude gradient is especially questionable in view of surveys which have shown that UVB penetrating to the earth's surface over 24 hours during the summer months in northern Canada equals or exceeds UVB penetration at the equator. Accordingly, there is sufficient opportunity during the spring, summer, and fall months at high latitude for humans to form and store vitamin D3._

\- [http://en.wikipedia.org/wiki/Vitamin_D#Production_in_the_ski...](http://en.wikipedia.org/wiki/Vitamin_D#Production_in_the_skin) \- [http://www.nap.edu/openbook.php?record_id=13050&page=104](http://www.nap.edu/openbook.php?record_id=13050&page=104)

Perhaps if true, that means when it's cold out people stay indoors and wear lots of clothing when outside, effectively limiting sunlight exposure, meaning less vitamin D production in the winter...

<comment><USER10> Living in the southern hemisphere (the one with the bigger ozone hole) and being an import from dark cold places I turn into a lobster with moderate sun exposure. It doesn't always get better heading away from the equator here due to ozone depletion.

Adding computers, air conditioned comfort and a complete disinterest in outdoor activities to the mix and I doubt if I get enough vitamin D to last me through the winter. Skin cancer avoidance is well understood here and drilled into kids from pre-school age but lifestyle changes may be putting some people into other risk areas.

Curiously, I have a skin condition that is treatable by UV exposure, topical vitamin D analogues and generally improves in summer yet as far as I know there is no clinical evidence that vitamin D supplements have any benefit.

</comment></comment><comment><USER11> Wasn't too much vitamin D recently linked to heart problems as well?

[http://www.msnbc.msn.com/id/45325473/ns/health- diet_and_nutr...](http://www.msnbc.msn.com/id/45325473/ns/health- diet_and_nutrition/t/vitamin-d-warning-too-much-can-harm-your-heart/)

</comment><comment><USER12> _D-deficiency also nearly doubled a person's likelihood of dying, whereas correcting the deficiency with supplements lowered their risk of death by 60 percent._

Damn, and I thought that risk was at around 100%...

<comment><USER13> 6% of all humans have never died.

</comment></comment><comment><USER14> Best natural source of Vitamin D is Fermented Cod Liver Oil. It is truly an ancient super food!

<comment><USER15> I thought this too but it turns out that the massive dose of vitamin A could be inhibiting D absorption as well as just being generally bad.

[http://www.drweil.com/drw/u/QAA400033/Cod-Liver-Oil-for- Vita...](http://www.drweil.com/drw/u/QAA400033/Cod-Liver-Oil-for- Vitamin-D.html)

</comment></comment><comment><USER16> If you take supplements, make sure you take gelcaps and not dry tablets. Vitamin D is fat-soluble, so it is absorbed much better in gelcap format.

Personally, I take 6000 IU/day during winter and 4000 IU/day during summer (in Canada).

<comment><USER17> Wow, you're really taking 10x the recommended dosage [0]. You're in fact, very close to overdosing or according to some studies, already overdosing.

[0] <https://en.wikipedia.org/wiki/Vitamin_D#Recommendations>

<comment><USER16> The studies I've seen have shown have very different numbers, and show that our bodies are very good at dealing with lots of Vitamin D but very bad at dealing with too little. From what I know, there is no known negative side effects under about 14,000 UI a day, and based on blood tests, Dr. William Davis, a cardiologist, has been recommending amounts in the range of what I take (even a bit higher). The official recommendations have been too low for a long time.

</comment></comment></comment><comment><USER18> Are there any good startup ideas around testing and improving stuff like this?

Some ideas:

[http://ideashower.posterous.com/idea-bodyhacking-blood- work-...](http://ideashower.posterous.com/idea-bodyhacking-blood-work- community)

[http://ideashower.posterous.com/site-idea-informal- science-e...](http://ideashower.posterous.com/site-idea-informal-science- experiments-commun)

Or maybe CureTogether is already doing this?

<comment><USER19> Is there an OTC kit for testing vitamin D levels? ("Serum concentration of 25(OH)D is the best indicator of vitamin D")

Can someone make one of those nifty little bio-chip things (do those exist?) that is connected to a little needle thing like electronic insulin monitors?

<comment><USER2> There are companies that sell kits where you collect a blood sample at home, and then mail it in for analysis (except in NY, which apparently bans medical tests by mail).

Two examples:

<http://www.zrtlab.com/vitamindcouncil/>

[http://www.amazon.com/gp/product/B004BYURTU/ref=as_li_ss_tl?...](http://www.amazon.com/gp/product/B004BYURTU/ref=as_li_ss_tl?ie=UTF8&tag=abxxm-20&linkCode=as2&camp=217145&creative=399373&creativeASIN=B004BYURTU)

Not aware of the actual analysis equipment being available in a consumer-level product, though.

</comment></comment></comment><comment><USER20> Is it just me or do these headlines essentially seem to read: "Living liked to <X> disease, death"?

</comment><comment><USER21> Not to be the correlation/causation asshole, but I wonder if possibly low vitamin D is to some extent a proxy for being a low income sedentary shut-in, all things that on their own are tied to disease.

As the article points out Vitamin D supplementation is not very effective vice working up a tan a couple times a year. So in modern America we can surmise the individual with low vitamin D levels is someone who sits inside watching TV all year. And can't afford a winter vacation to somewhere sunny.

Is the problem low vitamin D, or is it being sedentary inside all year? It's probably actually the vitamin D.

</comment><comment><USER19> Weird question: say you were only awake at night and therefore had very low blood serum levels of Vitamin D. Would drinking a healthy person's blood improve your own Vitamin D levels?

Just wondering.

<comment><USER22> All my friends who live like that have a rather sour disposition, so I'm guessing not.

<comment><USER19> You have friends who drink human blood?

<comment><USER23> not for long!</comment></comment></comment></comment>


A picture got my PostgreSQL database to start mining Monero - <AUTHOR> https://www.imperva.com/blog/2018/03/deep-dive-database-attacks-scarlett-johanssons-picture-used-for-crypto-mining-on-postgre-database/ <comment><USER2> The short story of this is:

\- Gain access to the database itself

\- And the Postgres database should be vulnerable to various remote code execution

\- Once they're able to execute code remotely, they then download an image which has binary data tacked onto it

\- They then parse out the executable part of the image using dd

\- Then they're able to execute and mine away

While an interesting read the shortest takeaway is:

1\. Don't leave your Postgres open to the public internet and

2\. Ensure to upgrade when security releases come out.

If you're unsure if the version your on has security patches available or other reasons to upgrade consider checking out [https://why- upgrade.depesz.com/](https://why-upgrade.depesz.com/)

Edit: Looks like the user that gained access had ability to execute pl/c. Which has to run as superuser. You won't find things like pl/c, pl/python generally supported on most Postgres services like Heroku, RDS, Citus because of just this reason. So in this case database access with pl/c was enabled, suspect could have been done equally via other vectors (once database access was achieved).

<comment><USER3> Actually, the takeaway is not about updates. Because the problem is actual intended functionality, that is "misused" for other purposes: indirect function calls.

So, the takeaway would be to control, which functionality is needed and which not, then to take action accordingly.

<comment><USER4> Well, for one thing, inserting into pg_catalog tables without DDLs should require privilege and be audited.

Secondly, things like lo_export() should be disabled by default.

<comment><USER5> > Well, for one thing, inserting into pg_catalog tables without DDLs should > require privilege and be audited.

It does require privileges.

> Secondly, things like lo_export() should be disabled by default.

It's superuser only.

</comment></comment></comment></comment><comment><USER6> Creating a C language function is not allowed to regular users by default because "language C" is an untrusted language only superusers can create functions using that. Additionally, regular users don't have the privileges to insert into pg_proc. So unless the attacked application uses a superuser for database access (which is a big security hole to begin with) or uses a superuser account with a weak password and allow superuser access from the outside, I don't see how this could be exploited.

<comment><USER7> Seems to be an intentional honeypot. That said, the storing the binary code on an innocent image host was a nice find that wouldn't have happened had the attack been blocked immediately. Pretty nice win for that image host to learn to strip images and they can stop hosting malware...

</comment></comment><comment><USER8> > This attack's Monero address has done more than 312.5 XMR so far, valued > with more than $90,000 to date.

Wow. IMO buried lede. That is... very impressive.

</comment><comment> kyle-rb I'm going to train a model to detect pictures of Scarlett Johansson to prevent this type of attack in the future.

<comment><USER9> No model needed, detect jpg(image) footers and remove all data after the actual image.

<comment><USER10> joke

your head

</comment></comment></comment><comment><USER11> It's amazing that in 2018 people leave databases publicly exposed.

<comment><USER12> I want to know why exposing databases on the Internet publicly is considered a problem. Is it because a vulnerability found in a database would allow to exploit the database directly?

I ask this because people expose web-apps on the Internet publicly too and an SQL injection vulnerability on the web-app would also be equally catastrophic.

I guess exposing web-apps on the Internet is a risk we need to accept because it has to be available to users of the Internet. But we should not expose anything else that we don't need to? Is that the reason why exposing databases publicly is considered best practice.

I would like to know what experienced professionals think about this.

<comment><USER13> A web app has a connection to a database that can be limited to its exact permission needs, input can be sanitized, database execution can be limited to exactly what the interface has available. Apps can also use connection pools to manage limits of the database.

If the database itself is publicly exposed, even if a read only connection with access to an empty table is provided an attacker could simply max out the connection pool to kill your application. If a vulnerability was published or a password with more access was available they can not only access all of your data but they can corrupt it and/or delete it.

SQL injection has been pretty trivial to stop for a couple of decades now.

</comment></comment></comment><comment><USER14> I thought this was one of those files that are an image and an executable AT THE SAME TIME. Slightly disappointed that it's just catted together

<comment><USER15> Totally unrelated, but I'm always reminded of Spore's (the videogame) save files. Creatures, buildings and such would be saved as .png and you'd get a nice preview screenshot of the creation, but the same file also contained the information for the game to actually load the thing. It was pretty cool

<comment><USER16> Any idea how they did it? Stenography or just catting things together like this example?

<comment><USER15> I don't think so, the images were pretty low res iirc. I did some googling though, and the only thing I found was somebody that said "the game reads the model data out from the file's alpha channel". However, I'd expect the data to just be appended to the end of the file, since PNG works anyway with that.

<comment><USER17> PNG is extensible, so they could totally have defined a PNG "chunk" in the private namespace and shoved the data in that. They didn't though. They treated PNG as just a way to store image data and wrote their extra data into the image, encrypted in an amateurish way.

</comment></comment></comment></comment></comment><comment><USER18> Clickbait headline. Was expecting a weird Postgres buffer overflow or something, instead it's a honeypot and the picture is almost completely irrelevant (just a matter of where the attacker hosted their binary).

</comment><comment><USER19> So how can one protect against an image with a payload?

Would the payload still be there if the image was rebuilt with Imagemagick?

<comment><USER6> Don't access your database with a superuser account from your application.

Don't allow superuser connections from outside of your network.

<comment><USER20> Don't have superuser accounts at all if you can help it.

Run Postgres in a limited user. Something that can't access any file or execute any command (like wget) it doesn't need, can't do chmod +x. Can't run a shell. Don't know if postgres needs that.

<comment><USER5> No, postgres can't work without accessing files or having a working shell (latter kinda works in some limited configurations).

And I don't think it's a reasonable idea to not have a superuser at all. But you can have it password less and only accessible from the local machine and a specific account (eg root).

</comment></comment></comment></comment><comment><USER21> These attacks are not interesting. They require superuser functionality. Can't believe this wasn't mentioned. If someone has superuser access on your database, it's game over.

The real solution is not to go around making DBAs' lives harder by disabling all this stuff. The real solution is to not give attackers on the internet superuser access on your database!!! Why is the database exposed to the public internet to begin with?

</comment><comment><USER22> _Do you see the binary code? It's right below her left elbow!_

It takes someone with astute observation skills to see this.

<comment> s-p-n I know! lol

</comment></comment><comment><USER23> This reminds me of SQL Slammer. Remember that? After that mess, there were Slashdot threads just like we have HN threads right now, and the overwhelming consensus among the sysadmins there was, "Database servers should _never_ be visible to the public Internet. They should always be behind a VPN or application server". And then, as is usual for nerd fora, someone would try to come up with a counterexample, "But what if...", and the sysadmins would just cut them off with, "No. Never ever."

That hasn't changed, folks. If someone on the Internet can talk to your Postgres database, you are Doing It Wrong.

</comment><comment><USER24> How exactly can this be exploited?

Who has to run the Postgres database?

In what kind of way does it has to be accessed to get this happening?

Are we talking about web apps that use Postgres on the back end and run arbitrary queries?

Are we talking about people who somehow extract the Postgres database username and password and it has admin permissions?

I wasn't sure what's happening.

<comment><USER25> at this point, the attacker has already owned the database and found an exploit that allows arbitrary shell execution on the host. i feel like the title is a little bit click-baity, because the attacker could have just hosted their executable payload on any of a thousand shady file hosting sites without needing to hide it in an image.

<comment><USER26> The image has 2 purposes:

\- make it easy to host it on a public, reputable, unblocked web site;

\- have a format AV detect less often.

</comment></comment></comment><comment><USER27> How does the image get executed? I went through the article and in the example the author extracts the executable manually using dd.

But how would an unsuspecting user run the executable? Perhaps I missed this, but is there some image viewer or browser that runs the trailing bytes of images?

<comment><USER28> I was hoping for some sort of image or binary processing exploit too, but the attack just uses a Postgres vulnerability to execute arbitrary shell code. [0][1] The fact that the executed code was buried in an image seems to just be a camouflage step for the attacker.

0\. [https://github.com/nixawk/pentest- wiki/blob/master/2.Vulnera...](https://github.com/nixawk/pentest- wiki/blob/master/2.Vulnerability-Assessment/Database- Assessment/postgresql/postgresql_hacking.md) 1\. [https://www.rapid7.com/db/modules/exploit/linux/postgres/pos...](https://www.rapid7.com/db/modules/exploit/linux/postgres/postgres_payload)

<comment><USER5> There's no exploit here, superusers can do things, that's it.

</comment></comment></comment><comment><USER29> I am studying towards the RHCSA (Red Hat Certified System Administrator) and right now I am learning about SELinux.

I am fairly sure that this could have been prevented by SELinux.

</comment><comment><USER30> Why would you have your (ANY) db directly publicly accessible?

<comment><USER31> * Multi-Cloud - no money for VPN

* AWS RDS + Heroku and not knowing better

* Sharing a database with a customer

There are a lot of reasons. Some are ok, some are not

<comment><USER30> if I were sharing the DB with customer - whitelist IP only - not just leave the ports open to the world. Thats insane.

The only reason I can see is for honeypot.

</comment></comment></comment><comment><USER32> This title makes zero sense.

</comment><comment><USER33> Ironically unavailable due to an "error establishing a database connection".

<comment><USER34> [https://archive.is/KvFHx](https://archive.is/KvFHx)

</comment></comment><comment><USER35> Kind of funny, but klicking the link says the database is down.

"Error establishing a database connection"

<comment><USER36> [https://archive.is/KvFHx](https://archive.is/KvFHx)

From / credit to: [https://news.ycombinator.com/item?id=16618030](https://news.ycombinator.com/item?id=16618030)

</comment></comment><comment><USER37> Postgres, not Postgre.

<comment><USER38> PostgreSQL, not Postgres.

<comment><USER37> Well, it's both: the original name was Postgres, later extended to include SQL in it.

<comment><USER38> It was Postgres for the first ten years since the start in 1985, but it's been "PostgreSQL" for more than twenty years now.

</comment></comment></comment></comment><comment><USER39> The short story of this is:

Cryptocurrencies are run on, by, and for crime. It's immoral to participate in cryptocurrencies. You wouldn't be a member of a club that had people like this owning the club house and everyone on the board, but due to pure greed and wilful ignorance people keep "investing" in this organized crime.

Shame on you all.

<comment><USER40> That's just silly.

This was one currency and bad behavior used to obtain it doesn't even reflect on that.

<comment><USER39> Nothing good has come from cryptocurrencies, and boat loads of bad has, is, and will continue to come out of it.

Investors ignoring or rationalising all the bad because of their greed is, in my opinion, disgusting.</comment></comment></comment>


"Hitler Tamed by Prison" – The New York Times, December 21, 1924 - <AUTHOR> http://www.abovetopsecret.com/forum/thread1054087/pg1

<comment><USER2> WELL, THAT DIDN'T WORK OUT SO WELL, DID IT</comment>


Microsoft turns on Visual Studio LightSwitch - <AUTHOR> http://arstechnica.com/microsoft/news/2010/08/microsoft-turns-on-visual-studio-lightswitch.ars

<comment><USER2> Yes, because clearly they didn't have enough enough versions of this product already.</comment>


Python & Java: Side by Side Comparison - <AUTHOR> http://www.ferg.org/projects/python_java_side-by-side.html <comment><USER2> You aren't going to be 5-10 times more productive by avoiding the nightmare that is System.out.println(), or any of the other things he mentions. For instance, I can't believe this warrants attention:

      if ( a > b )
      {
          a = b;
          b = c;
      }

      if a > b :
        a = b
        b = c

Why he thinks the Python example is better here I won't speculate upon--why he thinks the Python example would contribute to a 5x or more productivity increase I will attribute to foolishness--but it did give him a chance to gloss over meaningful whitespace, something that should have died with FORTRAN.

 _a number of influential voices in the programming community have been expressing serious doubts about the supposed advantages of static typing._

Ooh, an argument from authority. Well, I'm convinced. I could just as easily say that "IBM supports Java"--well, IBM is full of influencial voices, yes?

 _Each top-level public class must be defined in its own file. If your application has 15 such classes, it has 15 files._

Again, pure foolishness to think that this contributes to productivity. "Woe is me, I have to make another file." At any rate, I'm not sure "top-level" is an important distinction. I can put as many private or public static classes in the same file as I want. Do this enough, and you will find out why it is a bad idea.

 _You discover that F must throw exception SpecialException, and it must be caught by A._

False. To avoid this unmitigated nightmare, simply throw the exception up, or only use RuntimeExceptions.

Java doesn't have first-class functions. That's its biggest problem.

<comment><USER3> _Again, pure foolishness to think that this contributes to productivity._

That aspect of Java can be very painful when you need to refactor your hierarchy if you don't have the appropriate tools. But that is not necessairly a fault of Java. Refactoring class hierarchies too often likely indicates a problem in the requirements, the design or the specific developer team.

</comment></comment><comment><USER4> Ir wouldn't make a difference to most examples, but he could save a few lines by not putting { on a separate line.

</comment><comment><USER5> He never had to debug complex python code. It's a nightmare.</comment>


BufferBloat: What's Wrong with the Internet? (2011) - <AUTHOR> http://queue.acm.org/detail.cfm?id=2076798

<comment><USER2> Old story, the only thing I'd like to know is if a solution has been found. I thought a RED-based algorithm was the way to go, but it has actually been implemented in modern network switches/routers?

<comment><USER3> CoDeL is solution which has come out from all of this: [http://www.bufferbloat.net/projects/codel/wiki](http://www.bufferbloat.net/projects/codel/wiki) \- it can operate without any tuning, as it starts dropping packets when they start spending too much time in the queue.

</comment></comment><comment><USER4> Does anyone have an idea about how this fits in with Cloudflare's new fourth generation servers[0] which up the network card buffers to 16MB from 512KB?

[0]:[http://blog.cloudflare.com/a-tour-inside-cloudflares- latest-...](http://blog.cloudflare.com/a-tour-inside-cloudflares-latest- generation-servers)

<comment><USER5> The cards have two links that do 10Gbps in each direction. The 16MB buffer will hold 7ms at worst (double if the links are unbalanced and the buffers shared), which might be okay for web content. Frankly CloudFlare should focus on making their ddos filter more realtime and get over their fear of dropped packets.

</comment></comment><comment><USER6> Running the Netalyzr tool mentioned in the article on a residential BT Broadband ADSL connection in the UK gives several warnings about unexpected DNS lookups. Checking manually, there is, indeed, some evidence that BT are running a man-in-the-middle attack on DNS requests. Has anyone else noticed this?

      $ dig www.google.com 184.108.40.206

      [snip]

      ;; QUESTION SECTION:
      ;www.google.com.			IN	A

      ;; ANSWER SECTION:
      www.google.com.		2	IN	A	126.96.36.199
      www.google.com.		2	IN	A	22.214.171.124

      [snip]

      ;; Query time: 47 msec
      ;; SERVER: 126.96.36.199#53(126.96.36.199)
      ;; WHEN: Tue Jul 23 14:31:49 2013
      ;; MSG SIZE  rcvd: 160

However the IP range 126.96.36.199 - 18.104.22.168 is owned by "BT Public Internet Service". This strikes me as odd.

18.104.22.168 is Google's public DNS server. Either their servers are resolving www.google.com to a BT owned IP address (perhaps for requests coming from the BT network - which does seem unlikely), or somewhere in between my machine and 184.108.40.206 there's something intercepting the DNS request and spoofing the reply.

If so, I wonder what they're trying to achieve. HTTP traffic to Google redirects to HTTPS by default, and Chrome has HTTPS pinning for the site. If the reports in the newspapers that David Cameron is trying to involve himself in pornographic Google search terms are true then he's not going about it particularly effectively.

<comment><USER7> This is not terribly uncommon (although not widely talked about). It'll almost certainly be a Google Global Cache setup ([https://peering.google.com/about/ggc.html](https://peering.google.com/about/ggc.html)).

You might find it's Google, not BT, that is sending you to a different set of servers depending on your source address (EDIT: likely using EDNS, so you could test this from a non-BT host using a specially crafted DNS query).

</comment></comment><comment><USER8> You can fix the problem in your home network buy using a recent OpenWRT package and installing qos-scripts, and capping your connection to ~10-20% lower than your provisioned speeds, this will enable fq_codel.

You can also change your tc scheduler on linux kernel 3.3 or greater to fq_codel.

<comment><USER9> A TP Link WDR3500, connected to a dedicated cable or DSL modem (HG612 or 2wire 2700), is a cheap way to do this and get decent Atheros dual band wifi.

<comment><USER7> +1 for TP-Link w/ OpenWrt. But if you're going to do it, spend the extra few pounds/euros/dollars and get the WDR3600. It has gigabit ports, whereas the WDR3500 is 100Mbps.

</comment></comment></comment><comment><USER10> I realize that the actual correct solution, in the opinion of those in the discussion, is new algorithms involving dynamic adjustment of buffers and such (over-simplification, I'm sure).

But in the meantime, is there any way a broadband internet customer can somehow manually adjust the buffers on their router?

Using the netalyzer tool they mentioned, it suggests that my buffer is much too high (and I am indeed been having horrible network performance lately). "We estimate your uplink as having 4300 ms of buffering. This is quite high, and you may experience substantial disruption"

<comment><USER11> It's not an end to end perfect solution, but you may be interested in CeroWRT: [http://www.bufferbloat.net/projects/cerowrt](http://www.bufferbloat.net/projects/cerowrt)

I've got a WNDR3800 which I've sadly not had time to flash and play with yet. I was also fortunate enough to go to Jim Getty's talk at the Linux Plumbers Conference in 2012, and you can find a similar video on Youtube fairly easily (I think it's also linked off the previous website).

This is one of those projects where they could also use the help, just in case anyone out there was looking for a project ;)

<comment><USER12> NB: as of "Attitude Adjustment," OpenWRT upstream now supports CoDel as well, so end users need not use cerowrt.

</comment></comment></comment><comment><USER13> Worth reading the associated article: "Bufferbloat: Dark Buffers in the Internet" [https://queue.acm.org/detail.cfm?id=2071893](https://queue.acm.org/detail.cfm?id=2071893)

</comment><comment><USER14> Steve Gibson did a great job explaining this last year on his podcast [http://twit.tv/show/security-now/345](http://twit.tv/show/security-now/345)

<comment><USER15> Darn, you beat me to it! Recommended! It was a good one. I'd like to add that if you want to read the transcripts or get an mp3 of it, the archive page is here:

[https://www.grc.com/securitynow.htm](https://www.grc.com/securitynow.htm)

<comment><USER16> [https://www.grc.com/securitynow.htm#345](https://www.grc.com/securitynow.htm#345)

</comment></comment></comment><comment><USER17> Cringely has great articles on this subject: [http://www.cringely.com/tag/bufferbloat/](http://www.cringely.com/tag/bufferbloat/)

</comment><comment><USER18> "Using token leaky buckets for congestion feedback control in packets switched networks with guaranteed boundedness of buffer queues":

[http://www.nt.ntnu.no/users/skoge/prost/proceedings/ecc03/pd...](http://www.nt.ntnu.no/users/skoge/prost/proceedings/ecc03/pdfs/175.pdf)

</comment><comment><USER19> VJ: "... Yet the economics of the internet tends to ensure..."

This may be the problem. Change the economics, solve the problem. Specifically, do away with the idea of "backbones" for ordinary users. Leave the backbones to research and military networks. That's what they were originally designed for.

Make the (people's) internet more like Baran's original idea. His diagrams did not have backbones. They looked more like "mesh".

A true mesh internet might mean slower speeds for its users, but that design will also reduce latency compared to our current "backboned" internet because there will be fewer "fast to slow" transitions (assuming users all have more or less the same capacity for moving packets).

</comment><comment><USER20> "Van Jacobson, ...[c]onsidered one of the world's leading authorities on TCP, he helped develop the RED (random early detection) queue management algorithm that has been widely credited with allowing the Internet to grow and meet ever-increasing throughput demands over the years."

Huh? Did RED ever see wide deployment?

</comment><comment><USER21> ESR spoke to this problem (rather briefly) at a meeting of the Philly Java User Group in the spring of 2012. Fast forward to the 42:00 mark. [http://youtu.be/1b17ggwkR60](http://youtu.be/1b17ggwkR60)</comment>