Hacker Finds He Can Remotely Kill Car Engines After Breaking into GPS Tracking - <AUTHOR> https://motherboard.vice.com/en_us/article/zmpx4x/hacker-monitor-cars-kill-engine-gps-tracking-apps <comment><USER2> Not surprised. I built automotive test benches for some time. The moment you have something that can remote-access the CAN-bus, you have a problem.

There are typically only a few busses in a car. In many cases, there is a LIN bus for entertainment / radio / lights etc that is physically separated from the main CAN bus. This one is mostly harmless.

But if you can somehow talk to the main bus... There are like 5 critical ECUs that have to communicate "I'm OK" (engine, breaks etc) - otherwise nothing works. Those communicate with some minor encryption, and that communication is somewhat validated (they send counters to each other etc). But it doesn't matter. First of all, the protocols and databases are similar for different models, and known to A LOT of people who had jobs similar to mine. In order to test or build any ECU, you have to simulate the correct communication, otherwise the ECU won't start up.. Second, just sending nonsense with the right identifier could probably shut down the car or at least make it think there is a major problem. Third, there are messages that simulate power- cycling the bus..

<comment><USER3> Hey that's interesting, most of these devices IIRC work via the OBD port with an additional cutoff wiring. I haven't looked but I'm assuming the OBD port is somewhat restricted?

<comment><USER4> Really depends on the vehicle. Some will have broadcast traffic that is easier to spoof, and ride on CAN addresses that aren't reserved for OBD. OBD quite often rides on the main CAN network, and without a gateway any ECU can be queried. The secondary CAN network (if the vehicle has one) is also on the OBD plug but on different pins.

<comment><USER2> Yip. And if you can query any ECU, and know what you are doing/have more information on the system, you can get higher level security access (and that information, is again, not THAT hard to find). This allows you to call functions that modify the parameters and probably restart it as well..

<comment><USER4> Precisely. It's also interesting to see what you can do with vehicles where the broadcast traffic 'leaks' out the OBD port. A lot of makes use the same ECU across models for common parts.

</comment></comment></comment></comment></comment><comment><USER5> There is surprisingly little security when it comes to GPS tracking. Just a couple of examples:

\- Majority of GPS tracking devices use un-encrypted TCP or UDP connection to send location and sensor data

\- There is also no authentication for devices; you can spoof data if you know device identifier (usually IMEI)

Source: working on an open source GPS tracking solution for almost 10 years

</comment><comment><USER6> > By reverse engineering ProTrack and iTrack's Android apps, L&M said he > realized that all customers are given a default password of 123456 when they > sign up.

Pretty much sums it up.

<comment><USER7> Slightly more secure than the password on my luggage!

</comment></comment><comment><USER8> people in this thread have a crazy assumption of in-car network security.

leave this thread with one single knowledge: cars have a single canbus network, with zero security. your radio, turn signal, engine intake computer, are all talking in the open _over a single data wire_.

anything you plug to that network can listen /talk to anything, and instead of security you have a priority bit (or a few of bits, don't remember) that is completely self regulated by each device.

<comment><USER9> Single network? All manufactures i've worked with in recent times have tons of internal networks and buses. Some are more isolated than others, eg connected infotainment and OBD often being behind some kind of secure gateway to not have direct access to engine network. If anyone is aware of manufacturers that don't do this please shout out.

But yeah, otherwise the data buses are kindof assumed to be internal and only contain trusted input, only recently some cars are now also starting to have cryptographically signed packets. It's really not such a big deal until you mix connected ecus with secure ecus or install cheap third party stuff yourself on same network, if someone could physically access the data bus there are other more dangerous things they could do anyway.

<comment><USER10> In other words, the 1990s called, with "everything is now network-exposed, surely it's all secured by something more than wishful thinking. Right?"

</comment></comment></comment><comment><USER11> If an accident took place as a result of something like this would there be any way of finding out during an investigation?

<comment><USER12> Really depends on how throughout the investigation is/what hardware survives the crash.

Depending on the surrounding circumstances of the incident, it would probably not even be considered a possibility because fatal car crashes are so common that "just another accident" is the most probable, and thus most usual answer.

That's also the reason why Michael Hastings death is so controversial to this day [0].

[0] [https://en.wikipedia.org/wiki/Michael_Hastings_(journalist)](https://en.wikipedia.org/wiki/Michael_Hastings_\(journalist\))

<comment><USER13> Do cars have something equivalent to an airplane black box?

<comment><USER2> Nope. ECUs have something called a "fault memory" where the last n detected errors are stored, and that can be recovered. This is actually what workshops use for diagnosing a car.

This can give lots of information about what happened (faults could be "didn't receive message xyz" "sensor xyz gave signal out of tolerance"). But there is definitely no system trace for the communication - too many messages to really store them I guess.

</comment></comment></comment></comment><comment><USER14> Just want confirm that vehicle security is a trash fire.

The CAN bus [1] has no security, you just put packets on it and read packets off it. Like "tell me the speedometer reading" or "activate the brakes" and CAN bus does it. You and I might think, gosh those are radically different things. Well the CAN bus disagrees.

Did I mention that there is no encryption? There isn't. To the CAN bus, the packets from the GPS tracker that say "tell me the speedometer reading" and the packets from the manufacturer created by pressing the brake are treated with the same authority.

Does vehicle electronics firmware use a weird 20 year old non ANSI version of C? Well of course it does. Does it require signed firmware? Hah!

Do most vehicle electronics suppliers not have the top quality security people they need? They do not. Do they have management support for making security conscious decisions? They don't.

Anything that can put packets on the CAN bus can completely control the car. So anything that connects the the CAN bus, through bluetooth, wifi, cell service, or a plug needs to be completely secure.

I'm a little distrustful of On Star and the like, because I don't think GM is security conscious enough to manage it perfectly. I'd be very distrustful of a company that let you keep a default password for your GPS tracker. Instead purchase the GPS tracker that does NOT read info about the vehicle, the only plug should be for power.

Here's a story about hacking Chrysler's Uconnect, with good details.

[https://www.wired.com/2015/07/hackers-remotely-kill-jeep- hig...](https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/)

If you are writing software/firmware that will control a vehicle, you should hard code the packets it can write and never include dangerous ones. Even though it might seem cool to be able to "stop the vehicle" in an "emergency". If you want to use dangerous commands, you need to level up your security org to google/facebook levels. If you are talking to management that means spending $50 million a year just on security.

These are not attacks that require state level NSA/Chinese/Russian attackers. This is well within the reach of an advanced individual. It is very lucky indeed that there is no monetary or other advantage to this, if actuating brakes in cars produced social security numbers we'd have hundreds of excess deaths a year.

[1] [https://en.wikipedia.org/wiki/CAN_bus](https://en.wikipedia.org/wiki/CAN_bus)

<comment><USER2> Yeah, firmware is another issue. You read and flash firmware or parameters often directly over that CAN bus. There is nothing to validate that, for one manufacturer, I needed passwords (casually handed out to every supplier, the same for every unit), for one, the "encryption" was a XOR with the same number that had been used for every model for years. I didn't know why they even bothered. One of the manufacturers at least stopped you from flashing new software to an ECU more than 3 times.

Did I mention that we had incredibly high fluctuation (at least production line test benches - brutal deadlines and 2am deployments, working in loud production halls, lots of travel, no technical innovation,..). We basically hired anyone who was alive and somewhat skilled. I don't think anybody ever talked to me about security - ever.

What these articles are showing, is amateurs' work. I'm terrified by the idea of what a disgruntled / crazy / .. person with experience in the field could do.

</comment></comment><comment><USER15> Sounds like another 'Boeing software bug' is likely to hit the smart cars business.

From working with military computer security I know that nothing directly connected to the Internet should be considered safe. Sounds like a bad design decision

</comment><comment><USER16> If the device is correctly installed it should not kill the engine but prevent it from starting, just like smart keys.

<comment><USER17> Correct; usually the installer instructions will say to wire the hardware so it disables the starter motor. This means that the engine won't stop, but rather be prevented from starting.

Some of the cheaper (AliExpress) hardware installation instructions say that the relay should be wired to the fuel pump.

I wonder if the starter vs. fuel pump is a regional difference? Perhaps in countries where vehicle theft is more prevalent/violent installers would lean towards cutting the fuel pump?

<comment><USER18> On a car with a manual transmission, killing the starter doesn't do much as you can bump start the car (get the engine spinning by driving the engine via the transmission rather than the starter).

</comment></comment></comment><comment><USER19> Unless my car can drive itself, I will always disconnect any of this "IoT writ large" bullshit. I have my phone for navigation. My car does not need a cellular transceiver or a GPS antenna and I will happily rip both of them out by the wires.

<comment><USER20> You can only go so far with it. Fundamentally it scares me that I no longer have a mechanical connection between myself and the brakes, or other drivetrain components.

<comment><USER21> You should be able to pump the breaks with a pedal in the case of a power breaking failure. That doesn't mean the car can engage the break via other means.

What gets me is electronic parking breaks, as that feels like it goes against the while purpose of the parking break.

<comment><USER20> [https://en.m.wikipedia.org/wiki/Brake-by- wire](https://en.m.wikipedia.org/wiki/Brake-by-wire)

</comment></comment></comment></comment><comment><USER22> Vaguely related, and would recommend: [https://www.goodreads.com/book/show/40718386-the- passengers](https://www.goodreads.com/book/show/40718386-the-passengers)

</comment><comment><USER23> Well, what a complete and total surprise that adding this kind of functionality to an automobile would result in it being so insecure that it can be hacked into.

<comment><USER24> Because a GPS signal gives coordinates to your navigation screen.

Your radio has 0 control over an Engine. Or at least, shouldn't.

Source: Connected Car is my day job.

<comment><USER25> You're completely wrong.

First of all, many manufacturers market remote engine kill as a subscription service.

Second, many cars use CAN busses and connect the radio to it. That makes it very easy for the radio to interfere with crucial functions, like braking.

The CAN bus uses realtime time multiplexing for congestion control, so it is very easy to target traffic from a particular device subsystem, even accidentally.

Sources: search for "can bus vulnerabilities". Also, a ~2012 GMC I used to own had a bug in the radio firmware that caused the ABS system to stay on when the engine was off, which ran down the battery overnight.

On my current Dodge, there is a recall where the head unit firmware leads to confusing semantics around "park" on the transmission, and a separate firmware update where it refuses to disengage cruise control.

On recent Ford mustangs, the radio can display all sorts of engine statistics, and tune the engine in real time.

European luxury cars are even more integrated on this front, and have sport modes where the radio changes the response curves for the engine, steering, transmission and suspension.

The first generation Prius had the engine control computer physically inside the radio.

That covers the major car manufacturers across three continents.

<comment><USER26> > and a separate firmware update where it refuses to disengage cruise control.

Wow, that's a bad one.

</comment></comment></comment></comment><comment><USER27> Wasn't this article debunked as fake?

<comment><USER28> I tried searching for keywords on Google and Twitter and couldn't find anything to suggest this was the case. Do you have a source that you can suggest for this?</comment></comment>


Files will shed light on a JFK shooting conspiracy – but not the one you think - <AUTHOR> https://www.theguardian.com/us-news/2017/oct/26/john-f-kennedy-asssassination-documents-national-archives <comment><AUTHOR> Please note that the article is primarily about historiography - not politics, per se.

And so hopefully won't be flagged.

<comment><USER2> I think that this article might fall into the bucket of "pre-announcement announcement". I agree it's somewhat interesting in describing what to look for _when the documents become available_ , but that's just it, they're not available yet. I'm not sure there's a lot of use in rehashing theories on what might be in the document dump when we can just wait and see what's actually in the document dump as it becomes available over the course of the next couple of days or weeks.</comment></comment>


Study finds average swimming pool can have up to 75 litres of urine - <AUTHOR> http://www.cbc.ca/news/canada/calgary/study-urine-amount-swimming-pool-1.4005570 <comment> gingerbread-man I really wish I hadn't read this.

<comment><AUTHOR> Me too, but I wonder how valid the science is. (Clutching at straws)

</comment></comment><comment><USER2> This really pisses me off.</comment>


Out Of The Blue, Instacolor Forced To Change Name By The "True" Color - <AUTHOR> http://techcrunch.com/2011/07/22/out-of-the-blue-instacolor-forced-to-change-name-by-the-true-color/

<comment><USER2> Hm, yeah, that makes sense. They copied functionality and the name, and they were asked not to. They complied.

... Slow news day?

</comment><comment><USER3> Does TC have any shares in Color Labs?

</comment><comment><USER4> good for instalook, at least they got some press. Now, that app, Color, what does it do?

<comment><USER5> Crashes, mostly.</comment></comment>


Are You Ready to Feel Your Computer Graphics? - <AUTHOR> http://www.technewsworld.com/story/Computer-Graphics-Get-a-Feel-for-Real-61756.html

<comment><USER2> At this very minute, they're getting calls from someone in the porn industry.</comment>


Cooking for the Pope - <AUTHOR> https://www.theparisreview.org/blog/2017/03/03/sensory-delights/ <comment><USER2> Good article. Shame he isn't necessarily considered to be part of the 'canon' of historical cooks and mentioned in the same way as Carème, Escoffier, La Varanne or even Taillevent.

I also love how elaborately seasoned dishes were from that time period. A lot of people view cuisine as something static, and they see French, Italian, Russian cuisine as something frozen in time, with only 'indigenous' ingredients. Never mind the fact that all these cuisines retain ingredients from the new world, the silk road, and techniques from abroad.

It's also an interesting historical anecdote about the excesses of the Catholic Church during that period.

<comment><USER3> I'm afraid historically speaking his contribution to the cooking field hasn't been that big of a deal. Which technique did he popularize? Which dish do we still eat today that were his invention?

Carême was the first chef ever to pipe meringue. Escoffier created the brigade as we know it today. La Varenne introduced béchamel sauce, popularized (or some say invented the use of roux), first one to make use of what is called a "fond" (stock). Taillevent... well I think his contribution was accidental. His greatest work might not even be his.

I question in all of this how important Scappi's contribution was. He served important people... meh...

<comment><USER2> You mean they were the ones to codify these things. Stocks and sauces have existed ever since it was possible to create cookware that can simultaneously hold liquid and be heated, the 'brigade' is a basic concept of organisation of human labour, Escoffier just codified it, and milk based sauces, or sauces thickened with starch (often crushed bread or grains), go back a long, long time as well.

I mean, I know the real reasons Carême and Escoffier are considered so important (they codified the canon of French cuisine which had its heyday in the generations after WWII and became global 'fine' cuisine), but that style of cuisine is on it's way out, even in places such as Paris. Nowadays global fusion is the standard cuisine, and brigades are getting smaller and less rigid due to economic circumstances.

Anyhow, I came up through the industry in rigid brigades headed by a French chef. I know all the terms, techniques, etc... Nowadays though, a successful restaurant is just as likely to be headed by some hipster doing Chinese- Italian cuisine, with techniques that would make my old chefs cringe. But it doesn't matter. Tastes are becoming more cosmopolitan, and all that matters is what's on the plate nowadays. I just came back from a culinary tour of another city, visiting acquaintances in the industry, and the 'top' restaurants are all tiny, loud and have very eclectic menus.

I personally think Scappi could be quite relevant in today's culinary atmosphere.

<comment><USER4> Bread sauce (still popular in British cuisine) has a very different texture to Béchamel sauce. And unlike bread sauce, making Béchamel sauce is not at all obvious. If you gave somebody who'd never heard of it some flour, butter and milk, and told them to combine them into a smooth sauce, they would probably fail. Béchamel sauce was a real innovation.

</comment></comment></comment></comment><comment><USER5> > Just as every Scappi banquet had jokes woven into each course, so the Opera > contains one bitterly ironic gag: this gourmandizing epic was dedicated to > Pius V, nemesis of the mouthwatering.

With a sense of humor like that, it sounds like he'd get along just fine with most of the cooks I've met!

<comment><USER2> You need a sense of humour when your art is something that takes hours/days to prepare, and disappears in an instant.

</comment></comment><comment><USER6> I wonder if the Pope has any dietary restrictions or follows a program such as the Imperial Diet.

<comment><USER7> The modern Pope? No, nothing beyond what ordinary Catholics have to follow. He may self-impose fasting or abstinence but that's optional.

</comment></comment><comment><USER8> 'Cooking for the Pope' would be an excellent name for a band.</comment>


81 Year Old Commodore Amiga Artist – Samia Halaby [video] - <AUTHOR> https://www.youtube.com/watch?v=sDfIkXf3uzA <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=16521099](https://news.ycombinator.com/item?id=16521099), which posted it first. We're experimenting a bit with ways to reward first submitters.</comment>


Japanese Government Workers Wary of My Number Cards as ID - <AUTHOR> http://the-japan-news.com/news/article/0002532635 <comment><USER2> > "There should be no worries about personal information being leaked,"

This always makes me _more_ worried about personal information being leaked, as it implies they haven't considered the possibility carefully enough.

<comment><USER3> " The government plans to provide special holders for the cards that would hide sensitive information, leaving only the person's face and name visible. " The article implies that the there are no worries about info leaks because of the special card carrier that obscures personal details.

</comment></comment><comment><USER4> Foreigners have had to carry "residence cards" (formerly alien registration cards) which are basically these for years.

Having said that, the My Number system is bullshit and will hurt the economy because it will hit people who spend the most money (working cash jobs, side business at home...) disproportionately.

<comment><USER5> It seems like the foreigner residence cards are only superficially similar. For example, the ID number on the residence card is not a permanent identifier over your lifetime (your number will change when you renew your card). In general, that number is also not directly connected to many other things, not in the way that the government is planning for the My Number system.

</comment></comment><comment><USER6> Seems strikingly similar the US Real ID Act.

The question simply becomes one of, do we truly need a card to identify ourselves to any government or private agency? Currently many places require multiple proofs, so how hard is it to fake/corrupt a singular one? Honestly how is a chip going to protect from someone stealing your card and using before you can alert authorities? Are they PIN protected?

</comment><comment><USER7> How is this different from practically every kind of ID card? Don't they all usually have

1\. Your name

2\. Your picture

3\. Your date and place of birth

4\. Date and place of issue

5\. Validity date

6\. Some sort of number or alphanumeric code unique to your card

7\. Anti-forgery measures like holograms etc.

You shouldn't leave something like that dangling from your neck, of course.

<comment><USER8> Most of the controversy is because they've never had a mandatory identification number before, and there's always going to be fear and resistance against introducing that kind of thing. I think Japan is a highly privacy-conscientious society, for instance it's still very cash-based.

The less populistic and more informed resistance is, as I see it, based on the fact that the My Number is designed to be a "secret" number you're only supposed to share with the authorities (as in, high risk of identity theft if the number is leaked) similar to the US SSN. But in order to try to increase popularity (and adoption), they're trying moves such as adding a grocery tax- refund scheme, which necessitates showing the ID card with the number prominently printed to minimum wage cashiers, etc. They've tried to placate fears with comments such as "but it's illegal for the cashiers to look at the number" and "you can have a new number issued 3 times!".

I'm from another country with a personal ID number. I find it very handy. But there it's not assumed to be secret (even some online shopping sites will accept it as entry to auto-populate your address from the population register), so there's some extra e.g. ID checks when you use it, lowering the risk of identity theft.

<comment><USER9> Population register? That sounds like a database I'd like to query millions of times. Which country are you from?

<comment><USER10> Sweden, I assume. The personnummer (personal number) consists of the following:

\- The birth date, e.g. 640823 (YYMMDD)

\- The birth number, three digits. Last digit is odd for men and even for women.

\- A check digit, calculated by the Luhn algorithm.

A full example: 640823-3234 -- a male born on August 23, 1964.

<comment><USER11> Or Norway. Very similar except five digits after the birthdate. But no id card here; although my driving license is a de facto id card.

</comment></comment></comment></comment></comment><comment><USER12> A decent test would be to require all government ministers to wear the badges while in the chamber, in particular for all televised sessions.

</comment><comment><USER13> At least they're practicing "eat your own dog food". Luckily this will get shot down after too many govt workers get impacted, before it reaches the general population.

</comment><comment><USER14> >"It's been decided by the government as a whole, so our job is just to go ahead with it," said an official at the personnel affairs division.

This sentiment makes me feel ill...

<comment><USER15> You'll find that the Japanese relate to government (and indeed most forms of group dynamics) quite differently from Westerners. I think there's a cultural element you and I are missing, here.

<comment><USER16> It's not correct to lump all westerners into one group like that. Although this attitude is probably quite foreign to Americans, I see it quite often among Swedes and Danes.

<comment><USER15> >It's not correct to lump all westerners into one group like that.

You're nitpicking. Sweedes, Danes, Russians and really everybody in the Western hemisphere is miles more individualist than the Japanese.

The irony is that you seem to be mistaking me for an American while having no real counterpoint; the fact remains that we're probably missing a cultural element.

<comment><USER17> > Russians

Let me doubt this. There are a lot of individualist (esp. in large cities like Moscow and St.Petersburg), but they seem to be somewhat outnumbered by an awfully large number of Russians who consider government as having ultimate authority. I think we can well try to compete with many eastern countries in this regard.

<comment><USER15> Perhaps, although having Russian family and having spent a few months in Kyoto, my impressions are quite different. To be clear: Russians are much more collectivist than, say, the French. There's no doubt about that.

Either way, this entire thread of conversation remains a pedantic derailment of an original point that still stands.</comment></comment></comment></comment></comment></comment>


Tokyo Tyrant: Is it Durable? - <AUTHOR> http://www.mysqlperformanceblog.com/2009/11/10/tokyo-tyrant-the-extras-part-i-is-it-durable/

<comment><USER2> This is a great post. The author explains his methodology for testing this behavior (including a wrong turn at the beginning, which was instructive); does thorough research; demonstrates striking performance graphs; and provides a simple and effective solution to the problem.

</comment><comment><USER3> I'm not convinced I like the methodology, but I do like the question.

I've done some similar testing of my own to see what the performance impact of using libraries' mechanisms for flushing writes to disk and found I could get pretty decent performance results.

However, I think this type of testing can prove that something isn't durable, but not being able to prove something isn't durable by observation doesn't imply that it _is_ durable.

The only answer I'd really trust would be something along the lines of SQLite's testing strategy. Those guys get it right.

<comment><USER4> What is the SQLite testing strategy?

<comment><USER3> They've done tech talks and the like on it, but I'd strongly recommend anyone intending to write software to read this: <http://www.sqlite.org/testing.html>

This topic is mostly section 3.3, but there's a lot to test.

</comment></comment></comment><comment><USER5> Judged on my experience, by storing millions of keys in Tyrant, I would say it's very durable. While this is a great blog post, I think the author misses stating that Tyrant supports master-master replication and "hot" backups - which makes Tyrant _much_ more durable. Making fallback code is also pretty easy for a master-master systems (much easier than doing it for master-slave systems like MySQL is - - which for most parts require manual work, while fallback code for a master-master system can be automated _).

_ It should be stated that there are tools for MySQL that enable "automatic" fallback for MySQL: <http://code.google.com/p/mysql-master-master/>

</comment><comment><USER6> Would the result still hold for single threaded applications? If so, it is related to something other than locking during sync. It would be reasonable to think that you should get better throughput by batch syncing, as the disk head would trash less.

</comment><comment><USER7> Keyword colon flamebait question: a reliable tool for getting links?

<comment><USER8> Cynical comment about the title: an easy way to convince other members of the site that you're smart?</comment></comment>


A New Aristocracy: Yale Law School Commencement Address (2015) [pdf] - <AUTHOR> https://law.yale.edu/sites/default/files/area/department/studentaffairs/document/markovitscommencementrev.pdf <comment><USER2> My school and work experience span working class coal power plant techs (a friend used to climb through exhaust channels) to Ivy League educated lawyers and founders.

Most people's career trajectory will be set by the time they are in high school, so the importance of secondary school education and resources of your parents is paramount.

Also, wealth from family of origin allows risk taking, funding for law or medical degrees, which for lower income students represent a huge risk so they go to safer less lucrative fields.

<comment><USER3> I agree but I am not convinced wealth plays a big role. In France, higher education is pretty much free, and you see probably an even larger lack of social diversity than the US in the most ellitist programs (medecine, engineering, business). In the US there are always ways to finance education if you are a good student.

I think family culture, peer pressure and the school pushing you to go the hard path is by far the most important factor (for equivalent skills).

<comment><USER4> As a European from a poor-ish lower middle class background, I can tell you that even free university doesn't cut it economically.

The thing is, every year you stay at school is a year that you're a financial drain to your family and a year that you're not being an active money earner. For many, it's simply not affordable to be in their formative years until they are 22 (likely even longer if studies take more than 4 years, they in practice need a masters/phd in their field to succeed, or if they fail and have to retake some subjects).

At least in my country, the system is simply not made in a way that can support a person studying and working at the same time, for a variety of reasons (lack of part time, weekend or flexible jobs, amount of work that one has to do at home, uni schedules that don't account for job-study balance, etc).

On top of that, there's the apparently less important, but in practice enormous psychological pressure of not having an actual adult paycheck until well in your adult years.

A life where your friends that went through a fastest route to the job market are living with their SO, spending money in life experiences and traveling while you're 24 and still have to ask your parents for money to have a beer, eat at mcdonalds or go to the movies (knowing they can't afford much on top of that), or where you can't take a girl to your house because you still live with your parents... it's basically assuming that you'll have to live like a teenager until you're almost 30.

<comment> saiya-jin Whoa, you _don 't_ need to drain your parents for 100% of the costs when on university. I was never very good student because it took me long time to memorize things compared to most peers, but even lame partying me was able to get a part time side job, was able to go to work&travel programme to US during long summer break etc.

It might be hard to finance all your university expenses by yourself, but you can definitely cover a lot without any real impact on your studies. Just be more effective with your free time, which is an invaluable lesson for rest of the life on its own.

<comment><USER4> I was not talking about my current situation, mind you. I made a career as a software developer, which is one of the few professions that allow for flexible schedules and working before completing your formal education.

Europe is quite diverse, so your experience might be very different, but here part time jobs are really scarce, and as I said even if you find one it is quite likely that you won't be able to fit it with your uni schedule.

Most degrees have a schedule where theory is taught in the morning and practical classes in the evening or the other way around: For chemistry students for example that would be theoretical classes and laboratories, but an ill-conceived attempt at uniformity made it so that even for fully theoretical degrees like math you still have those "practical laboratories" where you'd basically just be going through exercises. Attendance is mandatory for everything.

> It might be hard to finance all your university expenses by yourself, but > you can definitely cover a lot without any real impact on your studies. Just > be more effective with your free time

While you are right that you can ease the load (summer break jobs are certainly doable), even if you're able to do that, for many people just taking care of part of the cost (or even all) isn't enough. It's not only about higher education having a cost, it's also about the cost of opportunity, since their potential income is _needed_ at home. A year studying might be a year that the family can't afford turning the heating on in winter, or mom being unable to go to the dentist, or your sister not having new clothes. The student sees that every single day while knowing that if they just forget about uni and get a job wherever, they can start solving those problems straight away. It's clearly not the best long term decision financially, but the humane factor is crucial and hard to explain unless you've been there.

<comment><USER5> >even for fully theoretical degrees like math you still have those "practical laboratories" where you'd basically just be going through exercises. Attendance is mandatory for everything.

That's nuts.

</comment></comment></comment></comment></comment></comment><comment><USER6> There is a lot of commentary in this thread about the speech being self- congratulatory in nature, but I think the actual overall tone for it is much darker. The speaker is essentially congratulating all of the graduates for working extremely hard for their entire lives, and that, despite all that hard work, they and everyone else around them will continue to work extremely hard with no end in sight. This is especially true for any of the graduates that want to earn lots of money or that want to make big changes to the system. All-the-while the speaker says that everyone else - the 99% - have essentially already lost the rat-race, and lost it before they were born. The rich are stuck in a laborious 'gilded cage' of their own creation, and everyone else is struggling to pay rent.

I highly recommend you read the entire article. It presents a lot of very good points that are relevant with regard to the macro-structure of the new American economy.

</comment><comment><USER7> FWIW, the issue with life experience anecdotes is that they don't control for genetic confounding. Most rich kids have both the environment their parent created for them, as well as the genes their parents gave them. So it's impossible to tell which is more important in determining the life outcomes we see.

There is a whole discipline called behavioral genetics that uses twin and adoption studies and, increasingly, genome wide association studies (GWAS) to tease these things apart. Most of these studies seem to point to most outcomes being about half genetic and half random (that is, something other than the environment created by the parents).

<comment><USER8> I think this line of thinking can take you dangerously close to the realm of eugenics and social darwinism. I recommend Taleb's take on IQ as some food for thought: [https://medium.com/incerto/iq-is-largely-a- pseudoscientific-...](https://medium.com/incerto/iq-is-largely-a- pseudoscientific-swindle-f131c101ba39)

<comment><USER7> A) facts don't somehow become invalidated because a subgroup of people wants to use the facts to push an agenda.

B) Taleb is the exact embodiment of the "intelligent, yet idiot" description that he so loves to level against others. He is ridiculed by pretty much every intelligence researcher and behavioral geneticist who is aware of his take on IQ. Recently I witnessed him arguing on Twitter that the Justinian plague was not the Black Death. They're both caused by the same bacteria, yersinia pestis. Find a better intellectual hero.

<comment><USER8> ...ok, Wikipedia it is:

1\. [https://en.wikipedia.org/wiki/Intelligence_quotient#Criticis...](https://en.wikipedia.org/wiki/Intelligence_quotient#Criticism_and_views)

2\. [https://en.wikipedia.org/wiki/The_Bell_Curve#Criticisms](https://en.wikipedia.org/wiki/The_Bell_Curve#Criticisms)

3\. You can also find various comments on ideas of intellectual superiority in Jared Diamond's Guns, Germs and Steel.

My bottom line is that I see no reason to believe humans can diverge in terms of intelligence over the span of a few generations. Social darwinism is a ridiculous pseudo-scientific idea that gets traction only with people that think they fall on the right side of the IQ divide.

Btw, could you give some examples of researchers that treat IQ seriously and consider it has a strong genetic component?

<comment><USER7> "Twin studies of adult individuals have found a heritability of IQ between 57% and 73%[6] with the most recent studies showing heritability for IQ as high as 80%[7] and 86%.[8]. IQ goes from being weakly correlated with genetics, for children, to being strongly correlated with genetics for late teens and adults. The heritability of IQ increases with age and reaches an asymptote at 18–20 years of age and continues at that level well into adulthood. This phenomenon is known as the Wilson Effect.[9] Recent studies suggest that family and parenting characteristics are not significant contributors to variation in IQ scores;[10] however, poor prenatal environment, malnutrition and disease can have deleterious effects."

From [https://en.wikipedia.org/wiki/Heritability_of_IQ](https://en.wikipedia.org/wiki/Heritability_of_IQ)

This is not "some researchers" who hold the opinion that IQ has a strong component, it is literally the entire field of behavioral genetics (basically the only field that seriously studies the genetic basis of human behavior and psychology).

Regarding how long it takes for significant evolution to occur: human generations have historically been about 20 years long, which makes 1000 years about 50 generations. As a point of reference, humans have created entire new breeds of domesticated animals in as short as 50 years (a similar number of generations). Darwin has several examples in The Origin of Species and a Russian scientist bred tame foxes in about the same amount of time. The speed of evolution is dependent on a lot of factors, but on its face, the idea that groups of humans facing different selection pressures would not somehow differentiate is silly (and they clearly have; that's why you can look at someone and have a pretty good idea of what part of the world their ancestors come from). But for a more concrete example of a shorter time period, the Han Chinese have been rice farmers for several thousand years, whereas African pygmies have been foragers and hunter-gatherers during that same time. Both groups would face significantly different selection pressures. Hunting and foraging skills would be essentially useless to rice farmers and a propensity toward uncontrolled violence would likely get them killed by a local ruler trying to maintain peace among his tax base. Hunter-gatherers would have no use for the ability to keep accounting records or a class of women made economically unproductive via the practice of foot binding.

</comment></comment></comment></comment></comment><comment><USER9> If you prefer to listen the speech: [https://www.youtube.com/watch?v=XCfe8VrCX4E](https://www.youtube.com/watch?v=XCfe8VrCX4E)

</comment><comment><USER10> Are my biases deceiving me, or has the Overton window on criticizing "meritocracy" shifted? A few years ago (including in 2015 when I missed this speech) I believe it would have been unthinkable in my social circles.

I've become convinced that meritocracy as the Yale Law elites would know it has utterly failed 99% of Americans.

<comment><USER11> Apropos of the theme, when "meritocracy" was coined it was a warning; something damaging to society that was to be avoided. At some point, the term was hijacked and pushed as a force for good (I suspect, but cannot prove, mostly by those who were benefitting from it) and now we seem to be coming back around the circle.

Meritocracies are insidious. We can see it in some societies; "this is a meritocracy" therefore rich powerful people deserve their wealth and power and the poor and powerless have only themselves to blame and deserve no help. A positive feedback cycle through the generations that leads to a stratified society of nobility and peasantry.

<comment><USER12> The original context always struck me as regressive and it is no wonder it fell flat.

While meant to criticize the tri-tracked educational system as a potential given that the dystopia was a replacement for the class system even if bad it fails to make a case for it being worse than literal nobility and connections to posh schools and old money.

It falls utterly flat like calling Oliver Cromwell the first military dictator in England while ignoring the kings.

Self perpetuating in negative ways is certainly a problem (there is a vast difference between being ahead because your family taught you and being aheas because competing with you is illegal) but it needs to be taken in the context of the now. What is the alternative is the real question of importance.

</comment></comment></comment><comment><USER13> This was a really inspiring speech. The entire speech is very valuable to read, but to give a TLDR: the new aristocracy is defined as the elite that gains their wealth through their labour rather than their assets. It's new because 50 years ago, the elite was more based on capital than their own work. It points out that you can exploit your capital without damage to yourself, but you can't exploit your own capacity to work as then you use yourself up, but that's precisely the trend as work amount expectations for elite lawyers have doubled in recent decades. The consequence of this situation is pointed out this way:

> To live in this way is, quite literally, to use oneself up. Such a life > proceeds under a pervasive shadow: at its worst, it squanders the capacity > to set and pursue authentically embraced, intrinsically valued, goals; even > at its best, this life invites deep alienation.

With alienation they probably mean something like not seeing your parents, friends, family, etc for years. The proposed solution to this dilemma is then presented in the key paragraph:

> The new aristocracy promotes human flourishing for no one: certainly not for > the excluded rest; nor even for the ensnared rich. We are trained to think > of economic inequality as presenting a zero sum game: to suppose that > redistribution to benefit the bottom must burden the top. But this is not > such a case: reforms that democratize training and talent would benefit > _everybody_. Such democratic reforms would restore the bulk of Americans to > full participation in an economic and social order from which they have > been, for several decades now, increasingly excluded. And democratic reforms > invite the elite—you all—to accept an almost costless diminution in wealth > and status in exchange for a massive, precious increase in leisure and > liberty, a reclaiming of your authentic selves.

<comment><USER8> The speech also points out that most people who achieve meritocratically do so because they have access to enormous amounts of resources, since birth. In essence the rich used to just hand their wealth to their children (and most still do that too), but now some actually dedicate part of their wealth to training their children to excel in a process that is often nothing more than a dog and pony show.

</comment></comment><comment><USER14> I found the link on archive: [https://web.archive.org/web/20191023044540/https://law.yale....](https://web.archive.org/web/20191023044540/https://law.yale.edu/sites/default/files/area/department/studentaffairs/document/markovitscommencementrev.pdf)

If one is to feel good about meritocracy, it is that the ambitious, talented and hardworking have the greatest chance of changing the system for everyone's shared benefit.

<comment><USER15> If only there was evidence to support that assertion.

<comment><USER16> The opposite of that is the stereotypical Soviet style, shoemaker working as a mason, carpenter working as the prime minister. There's a room in between for something sane, but anything sane will also be discriminatory with respect to skills.

It seems to me that this pileup against meritocracy is primarily about personal rewards, and not about utility to society.

</comment></comment></comment><comment><AUTHOR> Markovits came to my attention when he was a guest on Ezra Klein's show:

[https://www.stitcher.com/podcast/vox/the-ezra-klein- show/e/6...](https://www.stitcher.com/podcast/vox/the-ezra-klein- show/e/64086855)

He's also now published a book, The Meritocracy Trap:

[https://www.vox.com/policy-and- politics/2019/10/24/20919030/...](https://www.vox.com/policy-and- politics/2019/10/24/20919030/meritocracy-book-daniel-markovits-inequality- rich)

</comment><comment><USER17> I think that was the best speech I have ever read.

</comment><comment><USER18> Graduating from Yale Law sounds like it's for suckers. Let the elites have their crazy working hours and stressful hoop jumping--I'm not envious.

<comment><USER19> Their cohort effectively sets the vision for American legislation and justice. You may not be interested in them, but they're interested in you.

<comment><USER20> Do they really set the vision, though? Did they start the #MeToo movement and bring down Harvey Weinstein and other powerful men? Are they leading the push for transgender acceptance? Are they the reason why reparations and universal healthcare are now mainstream policy proposals in the Democrat party?

It certainly makes _sense_ for the wealthy, elite lawyers of a society to set the course of policy. But I'm not sure what the empirical evidence from 2019 America says. I think a lot of these Yale graduates end up becoming cogs in the existing system without actually changing it, and I think other forces might be equally as or more impactful in terms of shaping political currents.

<comment><USER19> I mean, go look at the professors leading these policy pushes, the journalists writing about metoo, and the policy wonks pushing for healthcare or trans changes. You're going to see a lot of JDs from top schools -- a lot of Yale. You won't see any self-taught coders or mathematicians from CalTech, you know?

</comment></comment></comment></comment><comment><USER21> Sounds very posh to me. Giving top government position to people like that will not lead to any good.

</comment><comment><USER22> There was a dead comment in this thread that I can't respond to now. It came from legitimate grievances but embodied what I think is a dangerous and now popular sentiment.

It seemed to have been mocking the language of the speech when there really isn't anything objectively wrong with the speech. The speech was in a high register but I thought it was very concise. The parody in the comment on the other hand seems to try to immitate religious language, and didn't attack the speech but the speakers and their values. It's as if the commenter perceives the academic register used in the speech as marking its contents unworthy of engaging with, the ivory tower ramblings of the elites as nonsensical and contemptible as religious rhetoric. This sort of contempt for everything associated with the upper class leads to the kind of cultural destruction we saw in Communist revolutions.

Hate the elite all you want but the culture they embody is also your culture; don't cut off your nose to spite your face.</comment>


Obama: U.S. will take military action against Syria, pending Congress's approval - <AUTHOR> http://www.washingtonpost.com/world/national-security/obama-set-to-speak-on-syria-in-rose-garden/2013/08/31/65aea210-125b-11e3-85b6-d27422650fd5_story.html

<comment><USER2> does this really belong here?

<comment><USER3> Clearly does not belong here.</comment></comment>


StratPlan - <AUTHOR> https://www.globalbusinessconsultants.com.au <comment><AUTHOR> Would small business use strategic planning (that includes task management) software to improve the chances of survival and ultimately grow?

</comment><comment><AUTHOR> StratPlan is simple small business strategic planning software</comment>


Perl 5.12.3 released - <AUTHOR> http://dev.perl.org/perl5/

<comment><USER2> Several years ago I would be raving about it. I attended several YAPC's established the first perlmongers group in my country.

When I went to see the state of perl a few months back I noticed the language is maturing, CPAN is still strong.

I think they have a PR problem.

<comment><USER3> It's not a PR problem. People have been trying to fix the "PR problem" for at least half a decade. If that were the issue they would have made headway by now.

The real issue is that a new programming language can be quite an investment. Some people learn lots of languages but many people actually stick with _just one_. Perl has nothing compelling over the other languages. You don't really lose anything buy picking e.g. Python or Ruby instead. So people tend to pick a language based on what cool new thing is written in it and that cool new thing is never in perl. Perl always rushes in later with a "me too" copy but it's never where a new breakthrough happens.

<comment><USER4> Not only that, but the threat of a non-backwards compatible upgrade being just around the corner is a major point against picking up Perl at this time, and the uncertain release time frame of Perl 6 makes that not exactly an attractive choice for a language to learn.

<comment><USER5> perl6 is a separate language designed by some of the same people.

I'm a perl5 hacker at heart and intend to continue to be.

The latest version of perl5 is version 12.3, released rather recently.

The websites for both languages now make this clear, but we'll probably need to rename them both to "-something- perl" for people to stop being confused by the names. Maybe in the next year or so.

<comment><USER6> The Zope community experienced similar (self inflicted) branding damage with Zope 3. The goal of Zope 3 was to build a next-generation rapid app development toolkit, incorporating lessons learned over the life of Zope 2. This is perfectly laudable goal, but developers heard "zope" and thought they could leverage existing knowledge, best practices, and tools. Then they learned that "zope 2" products wouldn't work under zope 3. Then they learned how much they would have to unlearn from one project to the other. Then they gnashed their terrible teeth, and roared their terrible roars, and finally the zope 3 developers got the message and renamed their framework "Bluebream." ( <http://en.wikipedia.org/wiki/BlueBream> )

As someone who worked at a shop that migrated from python/Zope to java/hibernate/GWT during the "zope 3 WTF?" days, I can attest that the confusion created by poor naming choices, and the lack of clarity in product roadmaps, was indeed a factor in deciding to migrate entirely away from Zope.

</comment></comment></comment></comment></comment><comment><USER7> The poem posted with the announcement is below. Come join us on the mountain top.

\--

I saw a huge steam roller, It blotted out the sun. The people all lay down, lay down; They did not try to run. My love and I, we looked amazed Upon the gory mystery. 'Lie down, lie down!' the people cried. 'The great machine is history!' My love and I, we ran away, The engine did not find us. We ran up to a mountain top, Left history far behind us. Perhaps we should have stayed and died, But somehow we don't think so. We went to see where history'd been, And my, the dead did stink so.

Howard W. Campbell, Jr. "Reflections on Not Participating in Current Events"

<comment><USER8> But isn't Perl the one we all left behind?

<comment><USER9> I wouldn't say that.

Perl 5 is quite an amazing language once you get used to the syntax and begin to grok it. I say this as a Python programmer who has only recently begun to seriously learn Perl as my day job demands it. Earlier, I had used Perl only off and on for small scripts. I was always put off by Perl syntax and contexts. However, once I got over that and started using it seriously, it does have a lot of neat features.

One example, I recently got to know about attributes[1] (which probably people using Perl for some time may know already) and its neat uses. I can use attributes to do what I would do with a Python decorator[2]. IIUC, this feature has been in Perl since 5.6 (2003). Yes, I still like Python and I continue to believe that its easier to write bad code in Perl than in Python but I have a lot more respect, liking and understanding of Perl than I did a month ago. IMO Perl 5 is well positioned for meeting enterprise needs as it stands today. I understand this now after I spend the last 3 months debating and discussing with the architecture board of my employer to introduce Python as an officially approved language for our IT applications (I work for a large corporation so we have a lot of policies ;)).

As a language, I like Perl 6 even more based on what I have read[3]. I hope to spend some time playing with Rakudo sometime soon and eagerly await a production ready package.

[1] <http://perldoc.perl.org/attributes.html>

[2] <http://www.perl.com/pub/2007/04/12/lightning-four.html>

[3] <http://perlcabal.org/syn/>

</comment></comment></comment><comment><USER10> Currently, the .pod delta for 5.12.3 actually seems to be the content of 5.12.0 -> 5.12.1, except for the title.

edit: this appears to be proper delta: [http://search.cpan.org/dist/perl-5.12.3/pod/perl5123delta.po...](http://search.cpan.org/dist/perl-5.12.3/pod/perl5123delta.pod)

<comment><USER11> I told Ricardo Signes, hopefully it'll be fixed soon.

</comment></comment><comment><USER12> Perl 5.12.3 represents approximately four months of development since Perl 5.12.2 and contains approximately 2500 lines of changes across 54 files from 16 authors.

Perl continues to flourish into its third decade thanks to a vibrant community of users and developers. The following people are known to have contributed the improvements that became Perl 5.12.3:

[...], Father Chrysostomos, [...] !!!

Good to see Father Chrysostomos cranking out the code in between delivering presents around the world with his team of flying reindeer. Um. Seems like there's at least one Joycean nerd Perl hacker out there, I seem to remember that this is a coinage from near the beginning of Ulysses and it translates from ancient greek into modern English as Golden Mouth?

<comment><USER13> Actually, while he may be a closet Joycean, I think he's indeed an Orthodox religious figure. I've shared some mailing lists with him, and got this impression although I don't recall it being directly discussed. I could be wrong, but your reindeer comments might be more impolite than you intended.

<comment><USER12> Of course I didn't mean to impolite, apologies if I caused any offense. Hey - different cultural background, please no more down-votes, thanks!

From Wikipedia: James Joyce's novel Ulysses includes a character named Mulligan who brings 'Chrysostomos' into another character's mind because Mulligan's gold-stopped teeth and his gift of the gab earn him the title which St. John Chrysostom's preaching earned him, 'golden-mouthed':[45] Chrysostomos also refers to Stephen, the independent and exiled genius: "He peered sideways up and gave a long low whistle of call, then paused awhile in rapt attention, his even white teeth glistening here and there with gold points. Chrysostomos."

The original John Chrysostom died in 407 apparently. <http://en.wikipedia.org/wiki/John_Chrysostom>

</comment></comment></comment><comment><USER14> I teach a course that uses perl. I really wish we used something else. Perl on Windows is a clusterfuck; including core modules that ship broken. I don't really use Windows, except helping my students get stuff running, so maybe programming in general is a clusterfuck on Windows?

<comment><USER15> Try Strawberry Perl: <http://www.strawberryperl.com/>

</comment></comment><comment><USER16> What's new?

<comment><USER17> Yea.. Can someone explain what's new in simple terms.. Lazy to dig into the delta documentations..

<comment><USER15> Perl 5.12.3 has a handful of bugfixes over 5.12.2. It's a very small change. Anything interesting is in the delta between 5.10.1 and 5.12.0.</comment></comment></comment>


Ask HN: What theme is used on these blogs? - <AUTHOR>

They are both the same themes, does anyone have any idea what theme/template is used on both these blogs?<p>http://www.minimallyminimal.com/ http://kimburgess.info/ <comment><USER2> They're both using the Square Space platform, so I imagine it's one of the themes available there <http://www.squarespace.com/templates/>

<comment><AUTHOR> Thank you very much really appreciate it</comment></comment>


How I watched a Brooklyn startup sellout: The downfall of MakerBot from inside - <AUTHOR> http://brokelyn.com/makerbot-sells-out-as-seen-from-the-inside/ <comment><USER2> I guess the value of printing plastic do-dads was over-hyped.</comment>


Bash that JSON (with jq) - <AUTHOR> http://blog.librato.com/posts/jq-json <comment><USER2> For actually processing JSON data, App::RecordStream is much better.

[https://metacpan.org/pod/App::RecordStream](https://metacpan.org/pod/App::RecordStream)</comment>