Ask HN: Should I make a lower cost replica of niche software? - <AUTHOR> I've recently been looking into making some software for small to medium sized businesses and someone I know mentioned how there's software used for a part of the real estate world where there's only a single big player and they're quite expensive.
I am hesitant to build software that already exists because it seems sort of pointless in the grand scheme of the universe. And it seems like a tough spot to compete only on price. But it does seem like a pretty safe bet for making some income and the scope of the project is feasible for a single developer over some months.
Any advice or opinions appreciated. <comment><USER2> I don't know if you have just taken a cursory look or you have actually used the software that you're going to compete against. My advice would be just to find someone who is using the other software that would love to work with you in making something that is competitive. That way you can get some continuing advice on the details. having done similar to what you're describing, it is usually the details that can take up the most time. It's easy to get the basics shell up and running but the details can increase the time and cost more than you expected in the beginning.

<comment><USER3> > It's easy to get the basics shell up and running but the details can > increase the time and cost more than you expected in the beginning.

Yes, and I think this is particularly true in the real estate world. It's ripe for disruption in many ways, but there also seem to be a lot of domain- and region-specific issues to work through.

I am not too familiar with the real estate world, I've just been through the process of buying and selling a home a couple times, and I've read a few articles about the role of realtors and realty software in the process.

</comment></comment><comment><USER4> > I am hesitant to build software that already exists because it seems sort of > pointless in the grand scheme of the universe

It's unlikely what you build will be identical unless you intend to make an exact copy. You really should target a niche that is being ignored and have something that differentiates your software from existing competitors.

That said, I don't think competing on cost as your only difference is a good idea at all. If your software is solving a real business problem that brings in big income, why would a business care about saving a (relatively) small amount of money? If you become popular, could the big player wipe you out by offering a cheaper price tier? Is price going to be enough to make businesses take a risk of moving away from the established player? Will your low cost make paid advertising infeasible?

Also, don't underestimate the difference in the time it takes to build a quick prototype that mostly works, and building something robust + user friendly that people will be willing to pay money for.

</comment><comment><USER5> It could be that the price of the software reflects the effort that goes into the sales cycle, or ongoing support. Say you can hack together a competing product in a few months. You still have to go out and win over customers from the 800lb gorilla. That may be harder than you realize. They may also value a more expensive product more than a cheaper one.

<comment><USER6> Larger companies also have economy of scale - they can hire product managers, have a constant recruitment funnel for support, have a proper sales process, etc.

Marketing costs can be significant - I often see sales/marketing take up about 30%-50% of the final price of software.

</comment></comment><comment><USER7> Competing in situations like that can be a lot of fun, and if the market opportunity is actually good then you could make quite a few dollars in the process. I agree with byoung2 though... you need to consider the sales process. I would recommend seeing if you can get someone to pay you to build it.

</comment><comment><USER8> Depends on the niche, but a decade ago I remember talking to someone who worked on TopProducer, which is a Canadian-made business management software suite for RE agents.

It was an absolute junk by this dev's own assessment. Slow, bloated, buggy. Development was disorganized and perpetually behind the schedule. It was also really expensive, but it endured because the industry is really conservative (they like their crappy tools regardless) and the vendor lock-in is a major factor. Lots of hidden complexity too, including the nuances of business flow.

Don't know what niche you have in mind, but do talk to the target clients before making a decision. You may discover that they don't really see a problem where you see one, nor that they are excited to see it fixed and pay you for that privilege.

<comment><USER9> This. I did consulting for a while and sales people don't seem to understand the amount of time, money and effort it costs to switch software suites. Sure, your product does x better and is cheaper, but the current suite is painstakingly shaped to match our needs over the years. To recreate the same situation in a new software suite will take 6-12 months (while running the outgoing suite as well since business has to continue as usual), meaning double workload on the staff involved. And don't even get me started on teaching Jen from accounting how to use the new software because the old software was 'running just fine' and 'she's been using it for decades'...

To most organizations, the cost of a software suite is a factor when they're in the market for something new. But when you're offering an alternative to something they're already using the price isn't really a factor.

</comment></comment><comment><USER10> We were recently asked by a client to build a relatively simple feature - wouldn't have taken us more than a week.

After taking a deeper look at existing services we noted they were all surprisingly expensive - and in the same bracket.

Turned out access to a particular API and ensuring the process and output of the service would be legally inadmissible were the real cost, and we actually wouldn't be able to compete with the existing services.

Not saying don't go for it, just make sure you understand that the cost may not be the problem on the surface.

</comment><comment><USER11> Why not? But do your research first on why there is only one big player and why it's expensive. Especially if the problem looks somehow simple. Check if there are legal requirements, uptime or support promises and so on. Just an example; you may need to compensate a client couple of millions every so often because of some wrong calculation or a 15 mins downtime in some industries.

</comment><comment><USER6> If the problem is big enough, cost isn't a problem. You'll also find that the cheaper clients/users are much worse. In fact, a lot of people even raise prices to cut down on user support and "fire" some troublesome customers.

It's probably easier to do higher quality replicas of niche software as a lot of them are poorly done.

</comment><comment><USER12> How niche? What's the total market size? Whether or not you can make some income is one question... But can you make an income you'll be really happy with? Will you be able to hire a replacement for yourself if you want to go do something different? What's the best case scenario?

</comment><comment><USER13> There is a number of companies that make what's called 'app-scripts'.

One is appdupe.com there are a couple of others.

Basically they take X-like-Y business ideas that demonstrated, nominally, their worth (in either solving a business problem, or attracting investors).

And they just duplicate those models -- uber-like, tinder-like, etsy/ebay- like, and so on.

They generate the source for apps, backend services, etc --- you just give them your twitter handle, name, logo, contact, fb page... whatever.

I also read when researching this, that some of them produce 50 apps per week.

Apparently, again 3rd hand info, that their services start at 10K usd and go up from there....

I have no idea about the quality, may be bad and may be they they will end up charging 10 times more what you though initially...

So imaging that people are not shy of duplicating a business idea and just applying perhaps to something else, or just a different geographical region....

It is definitely not pointless building software that already exists.

I would say go for it...

Either of 3 things will happen

a) you are successful and completion fails

b) they are successful and you fail

c) you are both successful

in all 3 scenarios -- end users seem to be benefit.

</comment><comment><USER14> If it's a big market, there's enough money to go around to support multiple products.

When Google was introduced, the search engine market was packed.

</comment><comment><USER15> Yes. If you do not, someone else will, and you will regret it.

</comment><comment><USER16> In the end, where are you adding value for your end user's lives?</comment>


Policymakers must consider the harms of pandemic policies, not just benefits - <AUTHOR> https://bostonreview.net/science-nature/john-p-ioannidis-totality-evidence <comment><USER2> While the US debates whether we should continue our ill-conceived pandemic policies or just give up and take the hit, multiple other countries have managed to fight the virus effectively and are now opening their economies safely.

Based on their experience, what we should have been doing is:

\- Lock down enough to really get the numbers down, with the understanding that it's temporary, because:

\- While locked down, really beef up the test and trace infrastructure. After the numbers are reasonable, this lets you open up but find and isolate individual cases.

\- Encourage/require mask wearing by anyone in public. Studies have shown that 80% mask wearing reduces the virus by over 90%.[1]

\- Instead of putting money into unemployment, pay businesses to keep people on salary while they're not working. That way the jobs are still there when we open back up. European countries have done this, kept unemployment low, and in some cases spent less per GDP than the US.[2]

The earlier you start, the easier and more effective all this is. If you start early enough and already have good systems in place, you can even skip the lockdown step, aside from localized outbreaks.

[1] [https://www.vanityfair.com/news/2020/05/masks- covid-19-infec...](https://www.vanityfair.com/news/2020/05/masks- covid-19-infections-would-plummet-new-study-says)

[2] [https://www.nytimes.com/2020/05/23/opinion/sunday/coronaviru...](https://www.nytimes.com/2020/05/23/opinion/sunday/coronavirus- economic-response.html)

<comment><USER3> It is indeed quite silly that people are thinking about policies as "quarantine for everyone" vs "let people roam the streets while coughing".

Wearing masks has zero cost in terms of GDP and unemployment. Why the heck aren't we mandating those?? Even in 1918 people were not allowed to step on a tram/metro without a mask.

<comment><USER4> Judging from people's reaction to the "end of the lockdown" here, I think Costco's leading the charge and making it OK for other businesses to require masks and enforce distancing has been, effectively, better public health policy than what we're getting out of our state government. Outside those places there's a clear "well guess the danger's over, let's all get really close and spit on each other and all touch the same stuff" attitude and pattern of behavior. It's insane—now's the time to be _more_ cautious when out and about, than during the lockdown! Especially seeing how people are acting, it's gonna get worse before it gets better. I reckon my odds of catching it in a given store outing now are _significantly_ higher than during the lockdown, but people aren't acting that way.

<comment><USER5> Part of what was so effective about changing american minds about smoking were the public ads that decried it.

If we want to change peoples minds about wearing a mask we need to campaign to change minds which goes all over. It's not about losing your freedom it's about being safe. I don't think legal requirements will do it. It'll just stir up the anti-government people. Whereas if we make it about looking dumb if you don't wear a mask then we'll be better off.

Also as a side benefit, making masks more acceptable in public may help us thwart facial recognition software in stores which I'm game for.

<comment><USER6> I don't buy the freedom argument. I can't wander around outside naked nor can I wander around with an open container of alcohol (some communities allow this - most don't and mine is in the most category) - yet few people are seriously complaining about that yet those behaviors have far less of an impact on my health than people wandering around without face masks. No, there's a belligerence at play here and there's a certain high-ranking federal officer encouraging that belligerence in part by famously _refusing_ to wear a face mask. Face mask wearing has now become a gang sign: if you're wearing a face mask then you're one of _them._ That's how insane things have become in the United States and we're suffering badly as a result.

<comment><USER5> I'm not making the freedom argument. I'm suggest we sidestep the freedom argument by working to convince people it's a good idea to wear masks rather than telling them they have to wear masks.

Also, all legal requirements are backed up by some sort of punishment. A regulation put in place to wear a mask might affect different groups more than others. If you can't afford to get a mask because the supply is low, then you get fined or go to jail. I don't like regulation where I think a campaign would be much more effective.

</comment></comment></comment></comment></comment></comment><comment><USER7> Ioannidis was celebrated in the past when he called out how scientists published nonsense in prior peer-reviewed papers

Why Most Published Research Findings Are False John P. A. Ioannidis

[https://journals.plos.org/plosmedicine/article?id=10.1371/jo...](https://journals.plos.org/plosmedicine/article?id=10.1371/journal.pmed.0020124)

Now that he calls out the ongoing groupthink that leads to counterproductive recommendations and practices he is ... shall we say ... less than positively looked upon.

it will take ten years for us to say, I guess Ioannidis was right after all

people always say you have to think outside the box, what they don't tell you that there may be a big price to pay for that.

<comment><USER8> >it will take ten years for us to say, I guess Ioannidis was right after all

Sadly I doubt that more and more. Locking down is a win-win if what you care about is not admitting a costly mistake. Its principal claim that it will save far more lives than it costs is essentially unfalsifiable to people who aren't willing to trust statistics, because lives lost to COVID are immediate and easily countable^, whereas someone dying of cancer in May 2021 because they did not get a diagnostic test in April 2020 but instead had to wait till July can just as easily be spun as being "death due to the virus" as "death due to the lockdown".

Pointy-headed epidemiologists will publish some papers a few years from now and tease out whether the lockdown made sense (or rather, where it made sense and for how long) using mortality statistics and measures like Disability Adjusted Life Years (which make impressionable people uncomfortable due to the implicit suggestion that we should weigh a lost life by how many years of life were left to live). Will politicians admit failure as a result, if the studies suggest they locked down far too aggressively and for far too long? Never gonna happen.

^ or so the media thinks, i.e. is death with COVID = death from COVID?

</comment></comment><comment><USER9> I don't have a firm opinion on whether the lockdowns were good or bad, but: it bothers me more that no one seemed to even _consider_ alternative options, opportunity costs, or second-and-third-order consequences.

It feels like the powers that be are playing whack-a-mole, incapable of seeing beyond the immediate problem. It doesn't bode well for a potential future (hopefully avoidable) pandemic that has far higher death rates. The Black Death, for example, is 'estimated to have killed 30% to 60% of Europe's population.'

<comment><USER10> I'd venture to say that our initial reaction to lock down early-on was prudent. The scant evidence available at the time indicated the possibility of a _much_ worse outcome than we have now.

I think the problem is a lack of constant re-evaluation. Politics has solidified the desire of many people to make the "correct" decision and stick to it. Why can't we be comfortable with making a decision with partial information and treating it like a ship that needs occasional course- correction?

<comment><USER11> The problem is that we cannot agree with which way we should sail the ship. Our navigator showed us a map that said "there be dragons" and told us to steer far off course putting us into a perilous situation of being adrift and lost at sea. Now we cannot agree which direction looks less stormy and whether we should try to head back to land or continue to starve at sea.

<comment><USER10> Most definitely. To further the analogy...picking the heading is a democratic election. The remaining 3/4 years of an election cycle are spent undermining the choice of heading.

</comment></comment></comment></comment><comment><USER12> There are both good and bad arguments for ending the lockdown.

The better arguments tend to focus, as this one does, on the fact that a lockdown does not come without its own harmful ramifications: delaying health interventions, increases in spousal/child abuse, increase in depression/suicide, loss of income/insurance, loss of financial stability, etc. I'm not necessarily saying that these arguments are or are not persuasive, but they're looking at the right things.

The worse arguments tend to focus on the lockdowns depriving Americans of their God-given freedom to attend pool parties and political conventions, regardless of the epidemiological data.

Unfortunately, many of the people who are really motivated by the latter tend to use the former as cover. (This doesn't just pertain to COVID-19, but to a lot of controversial issues.)

Generally, when you can reasonable predict that your argument may invite some unwanted bedfellows, it's nice to toss out a disclaimer -- something like, "Now I know some people will seize on my argument to advance X, which I reject, so let's talk about the limits and bounds of what I'm arguing." That way you can make it clear that you're not willing to let your remarks be used in ways that you don't intend.

<comment><USER8> The arguments made should stand on their own, regardless of motivations. If I'm a selfish prick who wants to attend pool parties but I'm giving valid reasons for ending the lockdown, it does not follow in any way that the lockdown is justified. So, who cares what my motivations are?

The bedfellows argument can be made about both sides of the equation and we can just go ahead and consider it implied, to dispense with legaleze-like formalities and focus on what truly matters, which, to put it crudely is: will the lockdown save more people than will die as its consequence? The answer is far from obvious to me.

<comment><USER13> Suppose you are the world's best rhetorician, and can create convincing arguments to support any conclusion. To exercise this skill, each day you pick a topic, roll a die to determine what position to support, and argue for that position. These arguments are clear, concise, self-consistent, grounded in concrete observations, and emotionally persuasive. However, you could have created similarly effective arguments for another side of the debate, had the die roll gone a different way this morning.

Examining somebody's motives is a way of having a meta-debate. The quantity and quality of arguments on different sides of a topic is a function not only of the correctness of one side, but also of the time invested into coming up with those arguments. If somebody has an ulterior motive to their arguments, then they may be arguing in bad faith, attempting to persuade with arguments they know to be false, in order to gain support.

</comment></comment></comment><comment><USER14> Lockdowns have to be executed differently next time. It's fine to require people to work from home if they can and close schools. But you cannot decide that only food is essential and shut down everything else. That leads to a lot of problems. They key is not having many people gathering in one place. There are many ways to ensure that without shutting down everything.

<comment><USER15> Why should we even allow our government to tell us ever again what products are "essential" and what are not? Not only was that distinction pointless, but it was actively harmful.

Another example, a ban on plant nursery right at the time people should be planting their own food.

Large stores, allowed to stay open, will be gobbling up smaller, closed competitors for pennies on the dollar. Private practice hospitals will never be the same again.

[https://www.forbes.com/sites/nicksibilla/2020/04/27/michigan...](https://www.forbes.com/sites/nicksibilla/2020/04/27/michigan- reverses-ban-lets-garden-centers-greenhouses-reopen/#236c18e358f3)

<comment><USER16> > Why should we even allow our government to tell us ever again what products > are "essential" and what are not?

Because, on average, the calculation for each individual does not line up with the calculation for society as a whole and people are going to make decisions that harm others.

Yes, _you_ going to your dentist is not likely to make a difference. _Everyone_ going to their dentist, hair dresser, etc as if it's business as usual will, and the negative impacts of your actions will not only be felt by you.

If government's role is to protect us from each other, then this is well in line with what they should be doing.

I'd agree that specifically how they've done it in the US is... not good. But I don't see the general concept as being without merit.

<comment><USER15> > _Because, on average, the calculation for each individual does not line up > with the calculation for society as a whole and people are going to make > decisions that harm others._

Absolutely. But that's the problem with these thoughts. They're aren't wrong, but using them as a foundation for limiting a population can have an outsized negative impact worse than the thing they're trying to prevent.

In this case with hindsight we can now say it wasn't wise, as some states dramatically limited what items a person could buy, and some didn't. In some place you had "critical personnel" driving across state lines just to buy work boots.

</comment></comment></comment></comment><comment><USER17> The lock-down has never been about saving lives. It's about preventing the chaos that would occur if we did nothing and let the health care system crash.

People in charge get this, sure saving lives is nice, but it's about maintaining the order of things.

You really think if this went out of control people would not pull a gun in a hospital to get their relative help? Or groups of people would not be targeted, even more than they are now, as scapegoats?

Even now it's acknowledged that many more are going to get it, many more will die, but at least things will not spiral out of control and we will be able to manage the hospitalization rates.

</comment><comment><USER18> Moderators, the title on HN is editorialized (i.e. wrong as per HN practice) at the moment. The actual is "The Totality of the Evidence."

Also, independently of that, per Wikipedia

[https://en.wikipedia.org/wiki/John_Ioannidis](https://en.wikipedia.org/wiki/John_Ioannidis)

" _The neutrality of the authors and Ioannidis ' overall stance on the pandemic was further called into question_ given that the often-cited study he co-authored in April 2020 was preceded by his op-eds in March, calling the pandemic a fiasco. It was also later reported that said _study was financed by JetBlue 's Founder;[30] presenting a serious conflict of interest_ authors had failed to disclose."

30) [https://www.buzzfeednews.com/article/stephaniemlee/stanford-...](https://www.buzzfeednews.com/article/stephaniemlee/stanford- coronavirus-neeleman-ioannidis-whistleblower)

\-----

Edit: RE title:

Note: at the moment I wrote that it was not the current one. It already changed more than once, at the moment it's at least the third I see, and it is probably at least the third one the one wyattpeak refers to.

<comment><USER19> The title is a pretty neutral and accurate description of the article. The actual title is uninformative, and changing uninformative titles is standard practice.

</comment></comment><comment><USER20> There's several arguments to be made in favor of fewer restrictions. This article makes the worst ones...

\- The projections were wrong

\- The fatality rate is lower than feared

\- Other diseases kill people too

\- This isn't as bad as the Spanish Flu

\- Lockdowns can harm people too

The only good argument I've heard against lockdowns is that we have mounting evidence that less onerous restrictions are sufficient to keep the transmission rate low. This article doesn't touch on that at all.

<comment><USER21> \- The projections were wrong

\+ some of the projections were correct

\- The fatality rate is lower than feared

\+ higher in some countries

\- Other diseases kill people too

\+ like smallpox and ebola

\- This isn't as bad as the Spanish Flu

\+ it's only just started

\- Lockdowns can harm people too

\+ less than killing and permanently injuring people

<comment><USER22> " + less than killing and permanently injuring people"

False. That is one of the effects of lockdown. We need to try compare the level, but people _are_ being injured and dying because of the lockdown.

</comment></comment></comment><comment><USER23> The article assumes that the policymakers (and public) AREN'T considering the drawbacks. I disagree with that.

Many non-US countries have acted to minimize those drawbacks, so it is misleading to act as if those drawbacks are unavoidable and the lockdown is illogical.

</comment><comment><USER24> let's not get sidelined on the same minutiae over and over again. lockdowns could have, and should have, been replaced with 2 simple rules:

1\. either physically distance _or_ wear a mask around groups of strangers, particularly inside.

2\. if you get sick, self-quarantine (and go see a doctor).

that would have been 99.9% of the reduction in transmission risk for 0.1% of the cost of lockdown, with a bonus of providing time for medical workers and epidemiologists to provide care, mitigations, and develop containment strategies (like tracing).

the reasons we haven't boil down to news-fueled panic/anxiety crossed with political calculation, with a bonus of shifting the losses to the disadvantaged.

<comment><USER25> Exactly this. These are _facts_ that have _never changed_ and were known from _day one:_

1\. Because the virus is spread mainly through droplets, the risk goes down if you keep your distance from other people.

2\. Because the virus is spread mainly through droplets, the risk goes down even more if everyone (especially those with symptoms) wears a mask.

Since day one, since before the disease had even left China, the WHO was clear on all these points, the CDC followed shortly after, with one partial exception, which was the mask recommendation. (On masks, the WHO said from day one that anyone who was _potentially infected_ should wear a mask; they initially advised against population-wide mask wearing _due to supply._ )

Masks and distancing could have and should have been rolled out the day the first COVID-19 case washed up on American shores. Both could have been enforced through stiff penalties on noncompliant businesses (no masks, no distancing, you get shut down for 30 days). They were already in use in South Korea which did a great job of getting the disease under control.

The Korean strategy worked better than the American strategy. Less death, less economic damage. Why did America screw up so badly? Pure hubris and incompetence on the part of Americans, starting with American leaders on both sides of the aisle. The war on COVID-19 was being waged and it was being beaten on the other side of the world, but myopic Americans were too preoccupied with themselves to watch and learn. It's as simple as that. Poor leadership, panic and nationwide myopia.

</comment></comment><comment><USER26> > Besides massacring nursing homes, and having the potential to infect many > vulnerable patients and providers in hospitals, it painfully emerges as yet > another disease of inequality

</comment><comment><USER15> It's very sad to me to see us destroying ourselves over covid19 without asking ourselves critically and honestly "are these steps and precautions worth it?"

I can see shelter-at-home related suicide, which disproportionately affects the young, overtaking covid19 deaths in some places. Not to mention the dramatic and permanent change to our way of life. Here's a commonly circulating story about doctors saying they're seeing more suicide and suicide attempts in 4 weeks than they usually see in a year[1]. When will it stop with 25% on unemployment?

How many people right now are quietly becoming alcoholics alone in their own homes?

Unfortunately the stay-at-home order has become yet another flashpoint in the modern day culture wars, with people using an opinion on it to signal tribe membership and so on. This blinds us from our duty to think critically on the steps we're taking.

[https://abc7news.com/suicide-covid-19-coronavirus-rates- duri...](https://abc7news.com/suicide-covid-19-coronavirus-rates-during- pandemic-death-by/6201962/)

<comment><USER27> > are these steps and precautions worth it?

What I find most concerning is that, even if you allow that the answer might be yes, just asking the question in the first place ends up in immediate dismissal.

<comment><USER28> I noticed this too.

People in favor of lockdowns keep saying they're following science. But once someone dares to ask questions, so many act as if their religious feelings were insulted.

To be fair, from what I've seen on HN, the community here is quite open to reasonable discussion.

<comment><USER29> Lockdown is a draconian political mandate justified and defended on the basis of virtue. It really hasn't been a matter of science because so far it couldn't be: there's far too many unknowns and inaccuracies in the measurements we're making, they're changing all the time.

From the beginning, authorities have been scrambling to appear competent and failing catastrophically.

There are major political ramifications of lockdown and other actions of leaders. They will not readily admit failure and neither will those convinced of the virtue of these measures - it's a matter of political identity now.

</comment></comment></comment></comment><comment><USER30> Ioannidis is willing to take a temporary hit to his personal reputation by making pointed remarks. The data is slowly erring towards his (low) estimates , but this is going to be a tortuous progress. The bigger issue here is that all this science has been politicized, especially in US & UK where leaders appeared alongside seasoned scientists as if they know their shit - they don't (and have proved it).

Plenty of other countries took a cautious approach, admitting that they are venturing into the unknown, and many of them are now cautiously opening up or planning to open. Uniquely in US and UK people are doubling down on any scientific evidence as if it's political, and this becomes a self-fulfilling prophecy. Now even molecules are partisan. What's more bizarre is that the citizens at large are siding with these "displays of leadership" from either side and often scoring politics points sems to take precedence to science. And then, after displaying such despotic devotion to their politics, they are also accusing asian governments (which have been largely successful) for despoticism. We 're probably witnessing a globalization of values in a disappointing way

<comment><USER31> > The data is slowly erring towards his (low) estimates

I'm not sure what you mean by this. Two months ago he estimated[1] that the total death count in the U.S. would be 10,000, and we're already 10x that.

[1]: [https://www.statnews.com/2020/03/17/a-fiasco-in-the- making-a...](https://www.statnews.com/2020/03/17/a-fiasco-in-the-making-as- the-coronavirus-pandemic-takes-hold-we-are-making-decisions-without-reliable- data/)

<comment><USER30> that is a thought experiment not an estimate:

> If we assume that case fatality rate among individuals infected by SARS- > CoV-2 is 0.3% in the general population — a mid-range guess from my Diamond > Princess analysis — and that 1% of the U.S. population gets infected (about > 3.3 million people), this would translate to about 10,000 deaths.

his own estimate is

> reasonable estimates for the case fatality ratio in the general U.S. > population vary from 0.05% to 1%.

The Gamgelt study for example estimates IFR at 0.28%. he has recently published a meta review of those studies [https://www.medrxiv.org/content/10.1101/2020.05.13.20101253v...](https://www.medrxiv.org/content/10.1101/2020.05.13.20101253v1)

<comment><USER31> Though he doesn't come out and say it, it's clearly framed as a reasonable estimate of the ultimate death count: 'This sounds like a huge number, but it is buried within the noise of the estimate of deaths from "influenza-like illness." If we had not known about a new virus out there, and had not checked individuals with PCR tests, the number of total deaths due to "influenza-like illness" would not seem unusual this year. At most, we might have casually noted that flu this season seems to be a bit worse than average. The media coverage would have been less than for an NBA game between the two most indifferent teams.'

None of that commentary makes sense except under the assumption that the author thinks the U.S. death total will be 10,000ish, and would have been unnoticeable without the availability of PCR testing.

<comment><USER32> It's probably too late to be noticed, but I feel compelled to say that I think you are wrong here. I've read enough of Ioannidis' work (and that of other statisticians) to know that this is just an example of how the math would work out if those assumptions were true. Later in the piece, he uses the different numbers of 60% infection with a 1% death rate. Neither is a projection, or a claim that the assumptions are true.

His actual belief, which he states several times in the piece is that we don't yet know how many people are going to be infected or what the death rate is, and that our priority should be gathering more information: "The most valuable piece of information for answering those questions would be to know the current prevalence of the infection in a random sample of a population and to repeat this exercise at regular time intervals to estimate the incidence of new infections. Sadly, that's information we don't have."

Different people have different styles of argument. From what you say, presumably if you used the example that Ioannidis did, this would imply that you believed this estimate was correct. Others have different styles, and you should not assume that they are making an assumption just because they happen to use numbers for an example.

</comment></comment></comment></comment></comment><comment><USER33> No mention of A/B testing on randomized regions. When you lack data make some. The problem with policies are people. They don't behave the way the policy expected. I'm not saying all out extreme A/B but finding the right pparameter values in parallel rather in multiple-week series'.

</comment><comment><USER34> I don't know if I necessarily buy some of this articles arguments. It mentions the effects of stay at home, such as increases in deaths of despair. Wouldn't that also have gone up because many of those might've been caregivers or breadwinners of a family? And for the domestic abuse (which imo is the worst), a lot of those victims were already undergoing mental abuse since that's largely a precursor to physical and these reports already should've been happening because imo mental abuse is equal to physical, it's just that people are less likely to report this behavior. It just has such long lasting effects. I can't back up either of those claims, so maybe I'm being dumb, but those two takes seem a bit strange. The stats on cancer or heart related treatment seems to be backed up though, so I can't comment on that.

The real issue with all of this is that the Trump administration is incompetent and American government in general is reactionary and only promotes policies that are selfish. Its been known for years that people have no safety net, just put on NPR and like once a week this comes up, and it's always been known that small businesses really aren't racking in the cash to stay afloat for a long time without money. The government just needs to step up and support people, with health care for all, with long term financial assistance, and they need to increase taxes to do this. They are sort of doing it now with checks, but that's going to go away once the pandemic is over and everybody who is not in tech or generally upper middle class will go back to being on edge because one disaster will eff to their lives.

You also can't blame this on epidimiologists. They provide their assessment and policy makers have to weigh those options with all the other ones and come up with a strategy. That'd be like be like blaming the person who came up with the hail marry when it is a coach's decision to use it every play.

</comment><comment><USER35> As Taleb recently put it, better to over-react and have to ease off than to under-react and have to play catch-up. See New York.

</comment><comment><USER36> > We know that prolonged lockdown of the entire population has delayed cancer > treatments and has made people with serious disease like heart attacks avoid > going to the hospital. It is leading hospital systems to furlough and lay > off personnel, it is devastating mental health, it is increasing domestic > violence and child abuse, and it has added at least 36.5 million new people > to the ranks of the unemployed in the United States alone. Many of these > people will lose health insurance, putting them at further risk of declining > health and economic distress. Prolonged unemployment is estimated to lead to > an extra 75,000 deaths of despair in the United States alone over the coming > decade. At a global level, disruption has increased the number of people at > risk of starvation to more than a billion, suspension of mass vaccination > campaigns is posing a threat of resurgence of infectious diseases that kill > children, modeling suggests an excess of 1.4 million deaths from > tuberculosis by 2025, and a doubling of the death toll from malaria in 2020 > is expected compared with 2018.

I am not an expert, but it seems to me that most of those problems would have occurred _without_ the lockdown, due to the effects of the virus spreading unchecked.

In other words, economies were always going to take a massive hit one way or another, but with the lockdown we get some control over the form it takes.

</comment><comment><USER37> ironically, the people in the US against universal health care because of a fear of death panels are the same ones demanding a death panel now.

<comment><USER38> Ironically, abstinence is now be advocated by the other group of people.

</comment></comment><comment><USER39> One hospital is reporting from that they've been seeing more deaths from suicide than COVID-19, and in increase in deaths from suicide.

See: [https://abc7news.com/health/suicides-on-the-rise-amid- stay-a...](https://abc7news.com/health/suicides-on-the-rise-amid-stay-at-home- order-bay-area-doctors-say/6201962/)

<comment><USER40> That's one report from one hospital, in a county with 33 deaths from coronavirus as of a couple days ago.</comment></comment>


Google Chrome Keystone is modifying /var symlink on non SIP Macs causing k-panic - <AUTHOR> https://mrmacintosh.com/google-chrome-keystone-is-modifying-var-symlink-on-non-sip-macs-causing-boot-issues/ <comment><USER2> I've always hated that "service" (more like malware given this news) like everything else that installs itself into the autolaunch sequence without permission, and remove* it whenever I notice/remember it, but it keeps coming back whenever I touch Google Chrome, which I prefer not to use in favor of Safari/FireFox because of reasons like this.

Things like these (including secretly signing you into Search when you sign into YouTube† or refusing to support PiP on iPadOS/macOS) just solidify Google's image in my mind as a forever scummy, intrusive company that I wish I could leave behind like I did Microsoft, but sadly Google Search and YouTube still don't have good enough alternatives yet.

* (startup items usually reside in the LaunchAgents/ and LaunchDaemons/ folders in your user ~/Library/, the root /Library/ and /System/Library/)

† (you can fix this by deleting all Google cookies after signing into YouTube, on any OS)

<comment><USER3> The trends that Google has spearheaded have had a real effect on me over the years.

I feel alienated from my computer. Subtle things will just change. If I really dig I might be able to find out why, but I don't have the time, so I just accept it.

Usually very small things that are barely noticeable. My Chromecast extension disappeared and was integrated into the browser. My brain could not help but notice this benign change, which caused a hard to place sense of unease.

Or when Google decided to remove rotation from the home screen on Android 2.3 -- it wasn't a huge problem, but I could have sworn that something changed. Users were conflicted, many convincing themselves that the homescreen never rotated at all.

It has made me not trust my computer. I second guess myself much more. If some option no longer exists, I wonder if it was just my imagination or if it was quietly deprecated while I wasn't looking. Does it even matter?

I think that we are being trained to see devices as ephemeral, and not to get too attached to them.

<comment><USER4> You feel alienated from your computer because there has been a conscious decision to take away options and user control in modern software. And I get why that decision has been made, even if I hate it as much as you and every other computer enthusiast.

For 90% of people, they have always "felt alienated" from their computers. They didn't understand what was happening or why things changed either, and it was easy to get yourself into trouble if you didn't know what you were doing and were trying to figure out how to fix something.

So companies decided to make their software have fewer options, and do more things automatically, without asking the user to have to make a choice. They don't give the users an option to customize, so they don't have to worry about those customizations causing breakage.

For advanced users this is crippling, but there are a lot more of them than there are of us, so they are going to be catered to.

<comment><USER5> Ironically despite there being less choices in an effort to make it easier for that "90%", the amount of tech support friends and family request from me has only increased in the past years.

Personally I don't buy the whole "removing choices to stop users from hurting themselves" excuse. To me it seems like over zealous designers trimming far more than necessary to make things look nicer at the cost of usability. But what do I know?

<comment><USER6> Regarding the increase, I would argue that is less about increased device complexity but more about the increase in the amount of people who are using these devices on a daily basis. More they use, the more problems they encounter; I think the intersection between complexity and usage is determined moreso by the latter.

<comment><USER7> I doubt the number of people using smartphones and computers has increased significantly in developed/first-world countries, especially when it comes to one's family and friends.

As anecdotal as it may be, my friends and family have used computers and smartphones for years, but I've experienced the same increase in requests for tech support as the parent comment.

Further, no one said there's increased complexity. The argument is that the oversimplification, the removal of features, and overzealous design assumptions have made UX go in the wrong direction. It's also an argument I agree with.

A lot of UX design today fails to recognize the _spectrum_ of "tech literacy" and it should, ideally, accommodate all within that spectrum, rather than pander to the least "tech literate" end. It's not always possible, but it should be strived towards. Instead, we have UX trending towards attempting to be so "intuitive" that it becomes counterproductive.

<comment><USER3> I had an interesting incident recently, where I was with some relatives and we were trying to plan the next leg of our trip; what restaurants to go to and what directions to take, etc.

Anyway, we had to start using a paper notepad and pens to keep track of the information! Even for people who just want to paste an address from a text message to look up in maps, and especially if you want to do anything with the calendar.

I just remember 15 years ago on my Treo 650 never needing to do that, and having no problem copying text between different apps seamlessly, between calendar, email, text, maps, and other apps. Same with Blackberry. Using modern Android is as awkward as driving a car with a mouse.

But I think there was an intentional push to minimize options for users, to make fewer pathways for things to go wrong. Forcing people to use pen and paper when they have a smartphone next to them is a UX success for them, because they don't have to improve handling text.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Hey. Google Keystone tech lead here. We are aware of the issue, and we've stopped the release. We're building a replacement that fixes the problem. In the meantime, to fix affected machines:

      sudo rm -rf /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle
      sudo ln -F /private/var /var

This deletes the affected version of Keystone and reinstates the damaged /var symlink.

The version of Keystone packaged with Chrome is not affected by this bug, so allowing it to reinstall Keystone will not recreate the issue.

<comment><USER9> You're missing the word "sorry" from your response.

My wife's a primary school headteacher (or K-12 as you say in the States). Her MacBook was disabled by this. Yes, she takes weekly backups, but schools don't have free money to spend on spare laptops for a few days' work, nor on unnecessary technician time to fix it. Fortunately I spotted this posting (thanks, HN poster!) on blearily checking HN this morning and instantly recognised this was what's happening.

Have some decency for the people whose lives you've just affected and apologise to them.

<comment><USER10> I understand the frustration, but please don't attack someone like this when they come to HN to supply information. It creates a hostile environment and disincentivizes people who have inside knowledge about a situation from showing up here. That makes HN a strictly worse place. It also breaks the site guidelines, which ask us all to _Be kind_ , regardless of how strong and justified one's feelings are.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER9> Not intended personally to @norberg, but corporately to Google.

<comment><USER10> OK, but norberg is the person you blasted, and intent unfortunately doesn't express itself on the internet.

<comment><USER11> A truth stated passionately doesn't become false. A falsehood stated calmly doesn't become true. This is at the heart of why appeals to emotion are almost always logical fallacies.

<comment> squeaky-clean I don't think dang is saying that the commenter was making false claims or anything. Just that it's very unlikely an upset comment will cause an overhaul in the google auto-update system. But it is very likely an upset comment will scare developers away from commenting on future situations like these. It just affects the health of HN negatively while not affecting Google. There's probably a reason norberg chose to register and comment on HN and not somewhere else like Reddit.

<comment><USER11> Content is wrong or it isn't. Tone is a logical fallacy.

Your true statement that tone will often matter is an interesting discusson on society and education. That it is also relevent on a site otherwise dedicated to intelligent discourse was the nugget I was hoping people would think about.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Reminds me of the Steam bug back in 2015 [1] where on Linux, if you tried to move where Steam stored downloaded games, it would wipe your hard drive by running "rm -rf "$STEAMROOT/"*" with $STEAMROOT being null.

[1] [https://github.com/valvesoftware/steam-for- linux/issues/3671...](https://github.com/valvesoftware/steam-for- linux/issues/3671#issuecomment-70021818)

<comment><USER13> I start bash scripts, by setting the holy trinity: set -eou

That prevents end-of-the-world scenario like the one above, if the script derails.

<comment><USER14> Maybe also add "pipefail" to the end of that?

<comment><USER15> Haha right, I feel like these should always be popularized as `set -eu` and `set -o pipefail` rather than making it look like you an `set pipefail`. I wonder if that chap has been uselessly printing options at the beginning of scripts for a while now.

</comment></comment></comment></comment><comment><USER16> I've been wary of Gatekeeper and SIP as moving Macs towards an iOS-style walled garden, but this is a perfect case of SIP protecting the user from bad software.

<comment><USER17> On the contrary, I think that sort of protection just hides problems --- like this one. As a general rule, bugs with the highest impact are also the ones which are most likely to be fixed quickly. If you tested with SIP on, it'd try to remove /var but wouldn't succeed, and you'd think everything is OK when the application's logic is actually faulty.

<comment> yjftsjthsd-h If SIP blocks program from accessing system files, shouldn't it alert or something?

<comment><USER18> There's plenty of bad code that fails to check for errors so the OS may well have flagged something here and the program just didn't know/care.

It seems even more likely that the result of unlink() would be ignored (right up there with ignoring printf()), not because it's the right thing to do but because lazy programmers will assume that failures are incredibly unlikely or unimportant. For example, if the code is a cleanup phase that just wants to remove a list of files, what are the odds that the program dutifully checks that the files actually went away?

<comment><USER17> _For example, if the code is a cleanup phase that just wants to remove a list of files, what are the odds that the program dutifully checks that the files actually went away?_

Or, as the reason for the omission of such checks is more likely to be, what to do if something that shouldn't fail, fails? And if whatever you decide to do to handle the error itself _also_ fails? Repeat ad infinitum. To even try to go down that rabbithole is simply a waste of effort and does nothing but introduce unnecessary complexity, to put it bluntly.

</comment></comment></comment></comment></comment><comment><USER19> So this caused me to have to reinstall the OS yesterday. Glad to know what the issue was.

And if anyone wants to know, I have to disable SIP because Apple won't let me use an eGPU on my Macbook with TB2.

<comment><USER20> Have you tried going into System Preferences, Security, Advanced (I think it's "advanced", it's at the bottom right of the screen.) There you'll find a list of drivers, or something, that you can enable. I can't be more specific than that since my mac here is under IT control, and the feature is disabled.

<comment><USER14> I believe those are the instructions for kernel extensions that are "approved" but distributed by third-parties.

<comment><USER21> Someone here suggested that you could do `csrutil enable --without kext` to load untrusted kernel extension without disabling SIP entirely.

</comment></comment></comment></comment><comment><USER22> This is also affecting Hackintosh users. A fix for them is listed here:

[https://www.reddit.com/r/hackintosh/comments/d8tm8z/psa_goog...](https://www.reddit.com/r/hackintosh/comments/d8tm8z/psa_google_chrome_updaterkeystone_rendering/)

I wonder what role Apple's aversion to working with Nvidia played in all those Avid users having SIP turned off.

<comment><USER23> Hackintosh or not isn't relevant because it's a macOS + Google update service issue.

PS: Written on a Hackintosh

</comment></comment><comment><USER24> Google, please tell me how to update Chrome without keystone.

Found non-functional system update engine. Please reinstall Google Software Update from [https://dl.google.com/mac/install/googlesoftwareupdate.dmg](https://dl.google.com/mac/install/googlesoftwareupdate.dmg) KSUpdateEngine no ticket to update for the specified product ID.

I don't want a "System update engine"... This is baked into Apple's AppStore. It works very well. Use that. You don't need access to my system.

<comment><USER25> > Google, please tell me how to update Chrome without keystone.

That's easy, just regularly download a new Chrome. The difficulty is managing to stop keystone from reinstalling and re-enabling itself.

> This is baked into Apple's AppStore. It works very well. Use that.

I hate keystone with a passion, but TBF getting a modern browser into the appstore is not possible, even ignoring all the limitations the store puts upon its software, there's no way you can actually get a _browser_ (as opposed to a shell UI around the platform webkit) in the appstore by its rules.

</comment></comment><comment><USER26> Can somebody explain in simple terms what Keystone is, what was it trying to do, which caused /var unlinking, and why does it cause MacOS to panic?

<comment><USER27> Keystone is Google's auto-updater program. It updates not only Chrome but also Earth and other Google programs. It's a notorious resource hog and it tries _very hard_ not to let you ever turn it off. If you manage to uninstall it, it will try even harder to reinstall itself the next time you run a Google app.

Keystone is malware made by Google. The incident this week was the first time it contained an actual destructive payload, but it's been malware for years.

<comment><USER28> Where can I find a manual on how to uninstall Keystone, Chrome etc. on Mac properly? Has anyone done it?

</comment></comment></comment><comment><USER29> There are a few legitimate reasons to disable SIP, but too often I see people turning it _entirely_ off, rather than just disabling the parts that are in the way:

        csrutil enable --without kext
        csrutil enable --without fs
        csrutil enable --without debug
        csrutil enable --without dtrace
        csrutil enable --without nvram

If you want to load some untrusted kernel extension, the first one will let you do so, but still keep all the other SIP protections on. If you want to use DTrace, use the corresponding flag. Etc. You can mix and match flags.

<comment><USER21> Thanks for sharing.

Is it documented anywhere? man page didn't help.

<comment><USER29> I do not think that they are documented officially. The only "supported" configurations are all on/all off.

</comment></comment></comment><comment><USER30> Why do userland installers need root again?

<comment><USER31> In the case of Chrome it's because some of the sandboxing can't be done by a regular user.

Same with both Linux and windows.

Bit of a design flaw with the OS - in all cases a process should be allowed to restrict itself to have fewer permissions and access to fewer API's without being root, but sadly that isn't universally the case.

<comment><USER32> > Same with both Linux and windows.

Could you clarify how this is the case on Windows? I thought Google Chrome installs and runs just fine without admin privileges. I'm not aware of any security downsides for doing so.

<comment><USER33> Maybe it's possible but the current installer has windows pop up a UAC prompt before it continues.

<comment><USER32> That's just because it wants to install machine-wide if possible. You can just tell it to continue without admin permissions and it tells you explicitly that it can be installed without that.

Note that Windows doesn't work like Linux with setuid bits and whatnot. The permissions a file is installed with don't dictate what permissions the program that executes it has. That's entirely a function of the program's security context. Hence, for a machine-wide installation to actually make a difference security-wise, Google would actually have to install e.g. a high- privilege service that would run when you try to start Chrome. I don't think it does such a thing.

So I think Windows is already designed correctly in this regard and hence I don't think this is an issue on Windows as claimed.

</comment></comment></comment></comment></comment><comment><USER10> Related thread: [https://news.ycombinator.com/item?id=21057157](https://news.ycombinator.com/item?id=21057157)

</comment><comment><USER34> Looks like the issue has been reported here: [https://bugs.chromium.org/p/chromium/issues/detail?id=100735...](https://bugs.chromium.org/p/chromium/issues/detail?id=1007358)

</comment><comment><USER35> Chrome hasn't been present on my desktops for a couple of years, and I don't miss it.

</comment><comment><USER36> Ok, for those who don't use Chrome (unless absolutely necessary):

* what the heck is keystone?

* why is it running any time Chrome isn't?

* why is a browser installing a root service?

* why is a piece of software changing root level symlinks in the first place? Clearly it doesn't need to because SIP prevents that nonsense

* Finally: is this enough to explain why SIP/rootless is a good feature?

<comment><USER14> > what the heck is keystone?

Keystone is Google's updater service for their software.

> why is it running any time Chrome isn't?

It runs updates in the background, so it needs to run when Chrome doesn't.

> why is a browser installing a root service?

¯\\_(ツ)_/¯

> why is a piece of software changing root level symlinks in the first place? > Clearly it doesn't need to because SIP prevents that nonsense

Probably a bug.

> Finally: is this enough to explain why SIP/rootless is a good feature?

Well, a number of people decided that SIP was hindering them enough to turn it off, so I'm not sure…

<comment><USER36> > > why is it running any time Chrome isn't? > It runs updates in the > background, so it needs to run when Chrome doesn't.

Gnah

> > why is a browser installing a root service? > ¯\\_(ツ)_/¯

Ok so it needs to replace the bundle - I feel Apple should add support for replacing binary A with binary B if A and B has the same signing key, although obviously there are a bunch of fun issues involved, I think that case shouldn't necessitate an update service running as root :-/

> > why is a piece of software changing root level symlinks in the first > place? Clearly it doesn't need to because SIP prevents that nonsense > > Probably a bug.

Wah wah

> > Finally: is this enough to explain why SIP/rootless is a good feature? > > Well, a number of people decided that SIP was hindering them enough to turn > it off, so I'm not sure…

The general problem is that it's still easier for developers to say "disable SIP by doing ..." without saying "we haven't written our [drivers/application/whatever] properly", rather than just writing the software properly. Which you know is possible because even in kernel driver land you hardly ever see driver's claiming that it's necessary.

e.g. its necessary from an end-user PoV but only because companies don't want to pay devs to put effort into working with SIP enabled when there's a much cheaper "tell the user to disable security" option available.

<comment><USER14> Actually, the issue is that Apple won't sign drivers for eGPUs that film professionals use.

</comment></comment></comment></comment><comment><USER37> Holy crap, that's what's happening?

It took me hours to figure out that the failed boot was caused by the `/var` symlink being removed. I was literally a minute away from reinstalling the OS when I saw a post from 2014 that had a passing reference to the `/var` symlink.

Then I went through and disabled every conceivable startup program, and even created a bash script to fix `/var` when it randomly disappeared. I didn't even consider that it could be Chrome causing it.

This all happened with SIP enabled, btw.

<comment><USER28> How come SIP didn't catch it? Is Chrome asking for a root access during installation?

<comment><USER37> I have no idea. After I fixed the issue, I even tried disabling SIP, then enabling it again. It's still randomly removing the symlink. (well, as of last night around 10pm. I haven't opened the computer since then)

That computer has been through a lot, though. So it's totally possible that I did something stupid to permafuck SIP.

<comment><USER38> When you recreated the symlink, did you add the SIP flags to it? [https://news.ycombinator.com/item?id=21066472](https://news.ycombinator.com/item?id=21066472)

</comment></comment></comment></comment><comment><USER39> To sum up most of the comments here: Google is the new Microsoft. Fascinating, how a company can go from "we will not do evil" to "fuck you all" in just 5 years.

<comment><USER40> I thought they started to get kinda crappy back in '08 or '09, it just took until recently for the consensus to catch up.

<comment><USER41> Agreed. That's around the time I started using some weird setup where my google searches would go through Tor and I was blocking their cookies. It was overboard, probably unnecessary and probably didn't accomplish much, but it was the result of getting a creepy vibe from google. Once I discovered DDG, I switched and never looked back. It took a little while to get used to it, but the results are good enough that I keep using it. I run maybe a few google searches a year if I can't find what I need on DDG and I usually don't find it there either. I don't think google is significantly better, although it is noticeably faster. There's nothing about it that's appealing enough that I want to accept the bad things that also come with it.

</comment></comment></comment><comment><USER14> I have SIP disabled and Chrome installed…will my /var be broken by sometime tomorrow when Keystone runs? Can I just disable the launch agent to fix this?

<comment><USER8> We have stopped pushing the affected version of Keystone, so if your computer has not been broken yet, it won't be.

If it has been broken but not rebooted:

      sudo rm -rf /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle
      sudo ln /private/var /var

should fix it. That deletes Keystone and fixes the symlink. If it has been rebooted, these commands at a recovery console should repair the computer.

Chrome will subsequently ask for admin credentials to reinstall the updater next time you run it. This will not re-break the computer; the version of Keystone bundled with Chrome is older, and we have stopped serving the version affected by this issue.

<comment><USER42> Please don't run that command as stated. It deletes /var (because HN merged adjacent lines)

Edit: It has since been fixed.

<comment><USER14> I won't, don't worry ;) That code should probably be indented two spaces, like this:

      sudo rm -rf /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle
      sudo ln /private/var /var

<comment><USER8> yikes! thanks, fixed.

<comment><USER43> I see a pattern here...

<comment><USER44> I doubt Hacker News automatically merging 2 lines into 1 line was the cause of the original bug.

<comment><USER37> You don't run your code through HN as a post-commit hook?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER45> [https://web.archive.org/web/20190924204425/https://mrmacinto...](https://web.archive.org/web/20190924204425/https://mrmacintosh.com/google- chrome-keystone-is-modifying-var-symlink-on-non-sip-macs-causing-boot-issues/)

</comment><comment><USER46> The "fix" looks more like a virus removal job. It includes

        rm -rf /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle

and doesn't replace it with anything.

</comment><comment><USER31> What's the link with AVID?

<comment><USER47> It's coincidental: the first widespread reports of this were from Hollywood editing shops: [https://variety.com/2019/digital/news/avid-mac-pro- corrupted...](https://variety.com/2019/digital/news/avid-mac-pro-corrupted- hollywood-1203347033/). This lead to the initial presumption that it was a being caused by a bug in AVID.

The reason the AVID community popped it first seems to come down to the fact that this is their busy season, so a lot of their machines were active last night as this Keystone update was rolling out, editors for whatever reason (technical issues or superstition) reboot their workstations fairly often, and, crucially, a lot of editing workstations are using third-party GPUs that require them to disable SIP (whether this is particular to AVID or just an intrinsic property of using the Mac Pros with third-party GPUs, I don't know).

<comment><USER48> > (whether this is particular to AVID or just an intrinsic property of using > the Mac Pros with third-party GPUs, I don't know)

Definitely more the latter.

</comment></comment></comment><comment><USER49> Since this is a thread where men can talk about their feelings, I'd like to say that I feel angry and frustrated! If I wanted a machine for browsing web and watching youtube videos while always been safely signed into my google account, I'd bought a f@©4!n9 Chromebook.

</comment><comment><USER50> It's funny how Google Chrome even needs this in the first place, to be honest. This is another great reason to move to Firefox, with the rest of us :p

</comment><comment><USER24> This is the same shit Adobe is doing.

</comment><comment><USER51> Does Chromium also install keystone?

</comment><comment><USER52> Switch to Linux or stop using Chrome, unfortunately.

</comment><comment><USER24> Does chromium suffer the same malware?

</comment><comment><USER53> Why does the Mac OS allow this?

<comment><USER54> Modern MacOS in default configuration does not.

<comment><USER53> So did all these Hollywood people change the "default configuration" or did the standard AVID installer disable it?

<comment><USER55> Some people wanted to use video cards with unsigned drivers. The hardware Mfr said "disable this malware blocking security feature in order to use our hardware". As it happens most people with exotic video cards are avid users.

They disabled the malware protection and got killed by the malware.

<comment><USER53> On other platforms, those cards aren't "Exotic" (I run Premiere Pro on Windows 10 with a pair of 2080Ti cards for rendering. Premiere and After Effcts _fly_!

One problem is that Apple abandoned the Pro market, but some users are very loyal.

<comment><USER55> They're exotic in that their manufacturers can't be bothered signing their drivers. But at least there are drivers.

They're also exotic in the sense that only a very small proportion of the overall user base cares/requires them.

There are supported video cards / TB3 video systems that are natively supported but at the moment they are possibly even more exotic in the sense of shipping in low volume (per your second point). I really don't like "apple abandoned the XXX market, which I am in and wish they had just the right product for _ME_ " statements but in this case, I think your comment is unfortunately correct.</comment></comment></comment></comment></comment></comment>


Ask HN: Why do the majority of JS developers prefer spaces over tabs? - <AUTHOR> I know this is a hotly debated topic, but I have to ask. Why is it that specifically for Javascript, 4 in 5 developers prefer to use spaces instead of tabs[1]? I've decided to switch from using tabs to 2 spaces because I'd rather convenience other developers than burden them, but I still don't understand the reason. Tabs take up less space in terms of bytes, and are dynamic width allowing the user to set the width to their personal preference. Sounds like a perfect solution to developers agreeing on a specific number of times to hit the space key. So why are spaces so popular?<p>[1] http://sideeffect.kr/popularconvention/#javascript <comment><USER2> Because spaces are rendered the same everywhere. Suppose I write this code, indenting using spaces.

        im_a_long_method(argument_no_1,
                         set_indentation_true(...),
                         no_string_cutoff,
                         whatever)

Now suppose I used tabs to indent and my editors tab width is 4 spaces while your is 8 spaces, then the above would look like:

        im_a_long_method(argument_no_1,
                                          set_indentation_true(...),
                                          no_string_cutoff,
                                          whatever)

Since not every editor agrees on how wide a tab character is, you get crappy alignments. Therefore use spaces.

<comment><USER3> > Because spaces are rendered the same everywhere. Suppose I write this code, > indenting using spaces.

Then it'll look wrong in a proportional font; indenting and aligning with non- indented text are different things. Either spaces or tabs _indent_ consistently when used consistently in a source file. Alignment cannot be acheived consistently (with spaces or tabs) unless you also assume a monospaced font, or (with tabs) have elastic tabstops.

<comment><USER4> I really don't get the point of tabs for visual layout in any kind of document be it plain text, source code, or a word processor document. They never seemed to work right for me.

I remember using the tab key to enter tabs back in school to make something like an informal, 2-or3-column table (or whatever I was actually doing). This would have been in Word. Things would line up pretty until I wanted to change some text. If I made it longer I would need to add another tab because the tab had shrunk to nothing. If I made it shorter the tab would jump into the previous section and no longer line up with the other lines.

As far as I can see, the same will happen with this source example if it were using tabs and a proportional font.

<comment><USER3> Elastic tabstops are so named because the width adjusts based on the content, avoiding that problem. [http://nickgravgaard.com/elastictabstops/](http://nickgravgaard.com/elastictabstops/)

</comment></comment></comment></comment><comment><USER5> In days gone by (pre git) a lot of devs used to share files via FTP; and the FTP clients back then were garbage; if you were sending files from a unix-like computer to a windows one and back and forth, your tabs might get converted to spaces by the client. Developers would end up with slightly different copies of the same file.

Many people decided to standardize various things (like the use of spaces for indentation) to compensate for this.

These days not a huge deal.

</comment><comment><USER3> > Tabs take up less space in terms of bytes

Optimizing for size in the primary format for editing isn't that important. For deployment, sure, but you're going to minify for that anyway, right? So spaces vs. tabs makes no difference for that.

</comment><comment><USER6> I think the fact that tabs take up fewer bytes is basically irrelevant. For anything that matters, the JS will be minified anyway, removing the whitespace.

</comment><comment><USER7> I decided to use spaces instead of tabs and convert a tab to two spaces because while typing I sometimes alternate between using the space bar and the tab while indenting something or editing code. So it is much easier for me to be consistent as an individual dev with spaces.

</comment><comment><USER8> I prefer spaces (4 spaces to be precise), because I can write like this:

var abc = something,

        xyz = somethingElse,

        stringOfAbc = abc.toString();

the variable names are neatly aligned on the left side!

</comment><comment><USER9> I remember once I got an error in an python script, and had to convert all tabs to space. Btw I am JS developer.

<comment><USER10> This experience is more common than most people realize. A Python program mysteriously stops working, especially after being transferred to a new platform, and the most experienced hands will suspect a mixture of tabs and spaces, and/or tabs being treated differently than expected.

</comment></comment><comment><USER10> > Why do the majority of JS developers prefer spaces over tabs?

Because, with a fixed-pitch font such as is used in programming, the meaning of a space is unambiguous (unlike tabs). Also, having two indistinguishable whitespace characters is bad, and mixing them in a single file is worse. So one chooses the least problematic of the two.

</comment><comment><USER11> I'm a Python dev, and it's the same in Python world. I prefer spaces, and so do most other Python devs. This is in line with one of the Python community's core beliefs - "Explicit is better than implicit"

<comment><USER12> > "Explicit is better than implicit"

Seems like a strong argument for sticking with strongly typed languages.

<comment><USER13> Python _is_ strongly typed.

Dynamic typing and weak typing are not the same thing.

Python:

        >>>1 + "1"
        Traceback (most recent call last):
        File "<stdin>", line 1, in <module>
        TypeError: unsupported operand type(s) for +: 'int' and 'str'

PHP:

        >1 + "1"
        2</comment></comment></comment>


Why should the best engineers in the world come to Canada - <AUTHOR> https://www.quora.com/Why-should-the-best-engineers-in-the-world-come-to-Canada/answer/Justin-Trudeau?srid=ei&share=7a91ef28 <comment><USER2> They won't until pay is competitive with the US.

</comment><comment><USER3> Tangentially, I did _not_ expect the answer to be written by that guy. His PR team are doing wonders!</comment>


What is "news", and what is "unethical"? - <AUTHOR> http://blogs.tedneward.com/2009/07/15/What+Is+Quotnewsquot+And+What+Is+Quotunethicalquot.aspx

<comment><USER2> Spot-on analysis of what has gone on: journalistic responsibility doesn't apply to this hack -- they haven't stumbled across details of shady dealings or bad treatment of users.

Instead, it seems TechCrunch want to publish the info because a) they find it mildly interesting, and b) a voyeuristic 'scoop' on Twitter is guaranteed to generate a lot of traffic.

<comment><USER3> If they consider themselves a "news organization" then they have an obligation to their readers to publish "news". I don't know how much of the documents they're gonna publish (3 of 400?), but hopefully they'll have reasonable judgement; ie. plans for a Twitter tv show is newsworthy (tell me that wouldn't end up on HN), and disclosing private details of an employee is not.

All these docs are gonna be leaked at some point, then _everyone_ will be "reporting" on it.

<comment><USER2> "Other people will report sensitive info" isn't ethical justification.

IMO TechCrunch should have gone down the honest route of ' _It's interesting, and news-worthy, and we won't publish anything damaging_ ' in their response instead of bringing in this 'journalistic responsibility' spiel.

</comment></comment></comment><comment><USER4> If you know the goods at a certain pawnshop are stolen, but they have the best deals in town, do you buy stuff there?

If you think TechCrunch is wrong in disseminating this information, then you shouldn't click through to their articles. Doing so makes you complicit in their business model.

There is a difference between someone hacking into Twitter, vs. Deep Throat talking to Bob Woodward. I think Deep Throat was doing a public service, and I'm happy to be complicit in his and Bob Woodward's conveyance of "confidential" information to the public.

Was the Twitter hacker doing a public service of any kind? Or was it vendetta, or competition, or just mischief? To the extent that there is no public service, then by reading TechCrunch's posts of that material, you are just buying stolen goods from a pawnshop.

</comment><comment><USER5> Society of Professional Journalists has a pretty well designed Code of Ethics. <http://www.spj.org/ethicscode.asp>

It instructs journalists to "seek truth and report it" but also to "minimize harm." In particular, "Only an overriding public need can justify intrusion into anyone's privacy." And, "Avoid pandering to lurid curiosity."

Most professional news organizations subscribe to some form of SPJ's Code of Ethics. TechCrunch, clearly, does not.

</comment><comment><USER6> In business, "trust" is an incredibly valuable asset. I've seen huge deals made on a handshake (with agreement to draw up contracts) based solely on the mutual trust the parties have earned.

It's also the most slippery of assets. Lose it and it's gone forever.

Regardless of _your_ definition of "ethical", if _I_ think it's unethical, then you've lost my trust and our relationship is over. Was it worth it?

</comment><comment><USER7> I've been pondering what about this whole mess it is that keeps mentally poking me. And the problem I have is the blatant hypocrisy of Arrington et al in the handling of this story.

The first post he made about this attempted to make the case that this was standard operating procedure, and really isn't anything out of line with the way things are normally handled. If that's the case, then why write a story talking about the fact that you've been given stolen documents containing large amounts of previously secret information. Then go on to say you won't post the personal information, and you're only posting the parts you find newsworthy.

If it's so normal, wouldn't you just post the stories, and mention that your source was some leaked documents you'd been given? You only do that if you feel you have something to justify, something to explain. In otherwords, you think you might be wrong.

So instead of handling this like they would any other source, for any other article, they've justified the source _well_ in advance of actually using it. It's hypocritical and proves that all of this was just another stunt to drum up traffic.

Personally I'm done with TechCrunch. I won't follow links there, if I end up there by mistake, I'm closing quickly. I won't support this sort of blatant hypocrisy and grandstanding. It's not professional. It's not needed.

</comment><comment><USER8> I am certainly not in the group of people, who believe revealing the stolen twitter data is good. But articles like this one make it really hard for me, not to argue out of the techcrunch perspective. I've read the comments there, too. And they are saying again and again that no personal data will be shown to public eyes. So I don't know, where's the problem to understand this point and why everybody, every time again, is writing about this point. Maybe there really is nothing morally wrong with everything that techcrunch says, they really want to publish (about strategy and cashflow numbers).

</comment><comment><USER9> It seems to me that once information that any one might care about hits the internet, -someone- is going to publish it.

If you think some site publishing it is not cool, all you can do is vote with your mouse.

Maybe it's surprising to find what you thought was a cool site pulling a dick- move. But it's unlikely that they'll do anything differently in the future.

Sites select their readers with their content. This is clearly the kind of thing they'd publish day-in and day-out if they had it. So all that's left is deciding whether you still want to be in their audience.

</comment><comment><USER10> Nemo plus iuris ad alium transferre potest, quam ipse haberet.

<comment><USER11> No one can transfer to another a right which he himself does not possess.

</comment></comment><comment><USER12> Someone should do the same to Tech Crunch and see how they like it.

<comment><USER6> They'd like the publicity. Better to flag and ignore them.

</comment></comment><comment><USER13> One company's news, is another company's unethical. i.e. here techcrunch doesn't wish to release private info, but for a tabloid, that's all they print

</comment><comment><USER14> Forget about "journalism" and "ethics" and let the _law_ do its job. If publishing this information is illegal, TechCrunch will be in trouble. If it's not, they won't.

Ethics have little use in a group discussion over something so trivial because no-one can agree on the boundaries. Is Fox News's treatment of stories "journalisically ethical"? A popular view is that it's not, but is what they're doing _illegal_? It doesn't seem so - so a lot of people just avoid Fox News. Likewise, if TechCrunch's ethics jar with you, don't read their stuff and just trust the law to deal with any transgressions they make.

Michael Arrington seems like a new, tech equivalent of Kelvin MacKenzie (<http://en.wikipedia.org/wiki/Kelvin_MacKenzie>) to me - a good thing in my book. He might not be loved, but he knows how to be a damn good editor and get people reading - that's what media's all about.

<comment><USER5> IANAL, but it's unlikely that publishing the documents would be illegal. Unethical and sleazy, sure. But what law would they break?

<comment><USER15> If the documents can reasonably be classified as trade secrets, the aggrieved party may be able to seek damages from the "informant" and an injunction against the continued publishing of them by the "press."

Of course, once the cat is out of the bag there's no putting it back in, so there's really not much benefit beyond punishing the party who stole them in the first place.</comment></comment></comment>


Show HN: A tool to calculate whether it's better to rent or buy in ClojureScript - <AUTHOR> https://filipwolanski.com/rent-or-buy/

<comment><USER2> Looks good. Just one point: The calculation of the maximum house price seems to have a bug.

I tried joint incomes of (40k, 80k and 100k) but the maximum house price is always 25k.</comment>


Ask HN: You need a chair. The meeting next door has one. What do you do? - <AUTHOR> Maybe this is a stupid question, but I've heard wildly conflicting answers to this from different people, and I think I'm starting to see a trend...<p>Scenario: You're at a work meeting, and your meeting room is one chair short. There's another meeting happening next door - specifically, a candidate is being interviewed for a job. The meeting room next door has plenty of available chairs. What do you do? <comment><USER2> Knock, and ask if I can take an empty chair.

</comment><comment><USER3> easy , there is a garbage can . Invert that and sit on that.

</comment><comment><USER4> make everyone stand and call it a scrum meeting.</comment>


Being privacy-aware in 2016 - <AUTHOR> https://vox.space/blog/89/being-privacy-aware-in-2016 <comment><USER2> This is a good list to start with but there are a lot of things that can be added/updated. For example, I do not consider using Telegram or Skype as an act privacy cautious people do.</comment>