Does the news reflect what we die from? - <AUTHOR> https://ourworldindata.org/does-the-news-reflect-what-we-die-from <comment><USER2> Hey HN, I'm the lead person who did the original data collection. We were previously featured when I made the initial site here: [https://news.ycombinator.com/item?id=16840237](https://news.ycombinator.com/item?id=16840237)

Happy to answer more questions people might have about methodology or the analysis in the original study.

<comment><USER3> I know this is perhaps besides the point: but I'm surprised that traffic incident reporting is so low - but then aren't you scraping more intellectual news media than what I would imagine most people would be reading? Not very familiar with the English/American news situation.

<comment><USER4> You can do a low-quality check easily. Read some medium that you suspect will be different from NYT/G for a week and count how many traffic accidents were reported in a particular locale, and how many reports there were for each. Then call the police and ask how many there actually were in that week.

I can guess what you'll find: What's chosen for reporting is news or otherwise noteworthy events. Traffic accidents may be a cause of death, but that doesn't make them either news or noteworthy. Traffic jams and their causes are an everyday occurence, even if the cause involves someone being driven off in an ambulance.

</comment></comment></comment><comment><USER5> The most interesting tidbit for me was how similar the news breakdown was between the two sources: New York Times and The Guardian. The largest deviation was 3.4% for suicide coverage but almost everything was within 1%.

Perhaps these examples are too similar to get a good distribution but if news organizations are all covering basically the same items perhaps there is an opportunity for differentiation. The google search trends shows that what people are interested in knowing doesn't match what media is interested in telling.

<comment><USER6> I wish they had chosen a different, or a third source though. I rate NYT & The Guardian (though both of decent quality) as fairly similar in editorial outlook.

</comment></comment><comment><USER7> The news reflects what we're _interested_ in. Most deaths aren't interesting.

<comment><USER8> This makes me ponder: The human brain is wired to be interested in novel, relatively unusual things. So, almost by definition, this implies humans are wired to be relatively disinterested in truth. :/

<comment><USER9> This has a common term in the news industry: Man Bites Dog

Since 'newsworthy' is synonymous with 'unusual', we end up thinking rare things are actually common, since we only cover rare things in the news.

[https://en.wikipedia.org/wiki/Man_bites_dog_(journalism)](https://en.wikipedia.org/wiki/Man_bites_dog_\(journalism\))

</comment></comment></comment><comment><USER10> This data is based on causes of death defined purely physically. It's a shame that in a world as complex as ours, we still don't attach psychological explanations and categorize them as causes too. Why not: he died of loneliness? He died of a broken heart? Or economic ones: He died because he couldn't afford the healthcare he needed? He died because he couldn't pay the heating bill and they turned it off?

Perhaps then we could get a different handle on the issues that face us, especially that face the elderly, and be more responsive.

<comment><USER11> Considering your first two, loneliness and broken heart, these would probably fall under suicide, which is 1.8%.

So I am not sure you'd be getting a significant new insight into major causes.

<comment><USER10> We don't know, because suicide is the only category on the chart that reflects a psychological factor. If we tracked (more correctly, if we could track) people dying of loneliness but who don't commit suicide, perhaps we'd find the number to be hugely higher. When I look at the sadness of the elderly in large cities, my sense is that number would be a lot higher. But we just don't know.

<comment><USER12> To some extent we do know. We know people who are lonely tend to be less active, and we know people who are less active tend to have worse health.

On the Greek island of Ikaria for example[1], we know that people regularly live to be 90 years old and that even at that age they remain incredibly social and physically active.

[1] [http://www.bbc.com/travel/story/20171116-the-greek-island- wi...](http://www.bbc.com/travel/story/20171116-the-greek-island-with-the-key- to-longevity)

</comment></comment></comment></comment><comment><USER13> I think this is a great article because it yet again shows how news are only there for terrify and manipulate.

Perhaps not always conscious, because they need their jobs and their jobs are to fill a 24 hour cycle with news.

And nobody wants to hear about cancer and heart disease, it bums them out.

<comment><USER7> news is mainly for entertainment.

<comment><USER14> But it's not. Sheeple/masses have been trained into that concept, but Edward Murrow is probably rolling in his grave at the fact. Have you spent time with reporters, specifically TV? The real newsies hate doing the fluff stories, or the must carry by their corporate owners. They want to just do the news. Of course, there are the ones that are just hoping to be the next entertainment star as you have accept news programming to be.

</comment></comment></comment><comment><USER15> Hm. Should the news reflect what we die from...?

Glaring omission is deaths from airplane crashes. I would guess that is the most disproportionately covered of any cause of death.

I'm also skeptical of the data on drug overdoses. Seems like the opioid epidemic is pretty well-covered these days but listed as only .4% of "Media Coverage" and 1.3% of searches.

<comment><USER16> If the news does to proportionally show what we die from, then we all focus on the wrong areas, and vote in politicians who come up with solutions to the wrong areas.

For me, the most likely way I have of dying is a car hitting me. Heart disease is not an issue for me as I exercise every single day and eat, and cancer is not a concern as I do the above and anything else will not affect it significantly.

<comment><USER14> > Heart disease is not an issue for me as I exercise every single day and eat, > and cancer is not a concern as I do the above and anything else will not > affect it significantly.

If only it were that simple. Yes, exercise greatly decreases the risk of certain things as a healthy body is just that much more resilient. However, please get yourself checked at your regular 10k, 20k, 30k miles. Life happens in funny ways. Don't be an edge case. Also, if you live in California, you have to be super careful of all the cancer causing things that are only known to the state of California.

</comment></comment></comment><comment><USER17> Every year in the United States, 225,000 people die iatrogenic deaths.

According to the Journal of the American Medical Association, iatrogenesis is the third largest cause of death in the United States after heart disease and cancer.

Iatrogenic. What is that word? Is it a disease, an accident, or something you get from smoking?

In fact iatrogenic means inadvertent death caused by a doctor or a hospital.

Why don't they just say that? I guess it isn't exactly in medicine's best interests to put it in simple language that anybody can understand.

</comment><comment><USER18> The oddest one are road deaths to me at 4x below cancer, apparently taken for granted at any stage of life, but mostly avoidable with some policy changes.

<comment><USER19> You make it sound very trivial to reduce road deaths. Which policy changes do you have in mind?

<comment><USER20> Crack down harder on DUI. DUI kills more innocents than guns.

<comment><USER21> I'm skeptical that harsher DUI penalties are the appropriate solution. Most states already have significant DUI penalties, and think that increasing them is largely a PR move. Drunk drivers are involved in about 20% of fatal accidents, leaving 80% to other causes[1]. About 30% of fatal accidents involve speeding [2]. Perhaps we should consider similar penalties for speeding as for DUI. Drunk drivers do kill more "innocents" than guns, but also keep in mind that very few gun deaths are innocents. 97% of gun deaths are homicide or suicide [3]

[https://crashstats.nhtsa.dot.gov/Api/Public/ViewPublication/...](https://crashstats.nhtsa.dot.gov/Api/Public/ViewPublication/812630)

[https://www.ntsb.gov/news/events/Documents/2017-DCA15SS002-B...](https://www.ntsb.gov/news/events/Documents/2017-DCA15SS002-BMG- statement-o.pdf)

[https://www.vox.com/future- perfect/2018/12/11/18135976/gun-d...](https://www.vox.com/future- perfect/2018/12/11/18135976/gun-deaths-us-2017-suicide)

<comment><USER22> The deterrence effect is a function of both the severity of the punishment and its certainty. And while the punishment for driving drunk is already substantial (maybe even too high), the risk of getting caught is not that large. An effective (but maybe not efficient) crack-down would therefore aim to increase the risk of getting caught and punished.

<comment><USER23> do you have any ideas for cracking down on drunk driving that wouldn't inconvenience and intimidate law-abiding citizens? the only methods I can think of are checkpoints and large-scale surveillance, both of which I would oppose.

<comment><USER22> I don't. Which is why I called a non-efficient solution. A theoretical solution would be to require ignition interlocks on all new vehicles. Not that I am advocating for that. A more realistic solution should focus more on officers observing and punishing bad driving, including all the effects of driving drunk or with cellphone in hand.

<comment><USER23> I could certainly support cops focusing more on reckless driving (tailgating, weaving, no-signal lane changes). if a cop sees a driver doing something unsafe with their own two eyes, I have no problem with them making a stop. I bet they would actually end up catching a decent number of drunk drivers this way.

</comment></comment></comment></comment></comment></comment></comment></comment><comment> team-o Natural deaths seem less newsworthy to me than unnatural deaths.

<comment><USER24> Agreed. The purpose of the news is to hold our government accountable, and mitigating kidney disease is not a fundamental part of governance.

<comment><USER25> The purpose of news is to inform about current events, not specifically for holding the government accountable.

</comment></comment></comment><comment><USER26> I heard an ICU physician say that here in Australia a cause of death must be put on the death certificate and that the usual choice is "myocardial infarction" (heart attack). Whereas a better choice might be simply "old age", but this is not an acceptable cause. So I guess that this is one of the reasons why "heart attack" is listed as the most common cause of death.

<comment><USER27> Why is "old age" a better choice? Usually there's some kind of a disease that can't be handled by the aging body. Is it because it's not worth it to identify what the disease is?

<comment><USER28> A whole chain of things need to happen for you to die, but they typically culminate in starving the brain of nutrients or oxygen. That usually happens due to organ failure, and that can certainly be the eventual consequence of old age. So tying 'cause of death' to a single factor is almost always a gross oversimplification. There are many causes for every death, and it's only important to look at specific ones should you care to prevent them or assign blame for them.

</comment></comment></comment><comment><USER29> I agree that we cover terrorism too much in the news.

However, if you look at the date ranges for what is arguably the most important graph in the post: [https://ourworldindata.org/uploads/2018/10/Causes-of- death-v...](https://ourworldindata.org/uploads/2018/10/Causes-of-death-vs- media-coverage.png)

They run from 1999-2016 for both the news organizations, and from 2004-2016 for the Google searches. 9/11 happened in 2001, so of course there were going to be lots of articles about that, and less searches if you exclude that time period.

The deaths were selected from 2016 alone, which is maybe reasonable, but then why select articles from a range of years elsewhere? Certainly there were more deaths in 2001 from terrorism than any other year in this range, so excluding it from some things while including it in others seems like an act of Hanlon if nothing else.

<comment><USER30> Worth checking out their data on terrorism:

[https://ourworldindata.org/terrorism](https://ourworldindata.org/terrorism)

Particularly outside North America:

[https://ourworldindata.org/grapher/number-of-terrorism- fatal...](https://ourworldindata.org/grapher/number-of-terrorism-fatalities- by-region)

</comment></comment><comment><USER31> A pattern I noticed is that media coverage is biased towards the things that kill us that we don't have as much control over.

I imagine people know heart disease is a huge killer but they also know they can make lifestyle changes to prevent it and they know what those changes need to be.

<comment><USER32> > biased towards the things that kill us that we don't have as much control > over.

It's not about what we have control over, but what we have information about. Informed consent is the bedrock of western society, from the enlightenment period. I suspect fear mongering (and terrorism) is effective precisely because westerners are trained to define unknowns and mitigate danger.

Some go so far as to be outraged that someone hasn't preternaturally predicted how an unknown could have been dealt with.

</comment></comment><comment><USER33> This entire analysis is predicated on ignoring tail risk. Most causes of death are pretty normal events; if we took no measures to prevent any of them then chances are most of them would increase by very small amounts; maybe doubling for the most dramatic cases.

Terrorism is especially terrifying in this regard because if left unrestrained, I think it is pretty intuitively obvious that there is no realistic bound on the amount of deaths that it would cause. The lack of deaths is not a function of desire on the part of terrorists to cause death, but just their ability to do so.

In some ways this is similar to the reaction to nuclear power -- even though practically speaking it is very safe, if it were to go wrong, it could got wrong on a scale that is not really possible for almost any other source of energy. Regulations and safety practices can go a long way towards mitigating this, but the tail risk remains a huge unknown, not in the probability sense, but in the negative impact sense.

<comment><USER34> >Terrorism is especially terrifying in this regard because if left unrestrained, I think it is pretty intuitively obvious that there is no realistic bound on the amount of deaths that it would cause.

I think you rebut this one yourself - terrorism has a natural limit in the ability of terrorists to launch attacks. Not a hard limit, a statistical limit, but important none the less.

It is important to recognize the order of magnitude of the probability of the risk. At CERN they don't publicize that there is a long-tail risk of causing the destruction of the world because the probability, though non-zero, is exceedingly tiny (and people freak out, unable to think about tiny probabilities.)

<comment><USER35> If a terrorist acquires a nuclear weapon and detonates it in NYC, what happens to the death rate? The point about tail risk is that probabilities that seem rare, aren't as rare and defined as you'd hope.

See: Black Swan/Antifragile

<comment><USER36> If terrorist detonates a nuke, then it's around a million by some estimates [1], so even then there is a relatively low ceiling.

But creating and operating a bomb requires expertise, that all terrorist lack.

[1][http://nymag.com/intelligencer/2018/06/what-a-nuclear- attack...](http://nymag.com/intelligencer/2018/06/what-a-nuclear-attack-in- new-york-would-look-like.html)

<comment><USER37> A gun style nuclear bomb isn't that complicated. If terrorists were able to get enriched uranium, then they could probably make one. If there were no counter-terrorism efforts at all, then there is a reasonable chance that they would be able to get enriched uranium.

</comment></comment></comment></comment></comment><comment><USER38> The problem that I have with Our World in Data is the how the counting is so biased AF

As an example

[https://www.cdc.gov/healthequity/lcod/men/2015/white/index](https://www.cdc.gov/healthequity/lcod/men/2015/white/index)

VS

[https://www.cdc.gov/healthequity/lcod/men/2015/black/index.h...](https://www.cdc.gov/healthequity/lcod/men/2015/black/index.htm)

That is, if you are a Black Male in the US between 15 and 35, yes homicide is how you are more likely to go. And that news becomes very important to Black mothers, fathers, grandparents. The real — as in US government stats — on infant and maternal mortality are also worse than many Caribbean countries.

My takeaway is that there are different "world"s within countries — especially for marginalized groups where the country doesn't have the will or resources for a safety net.

</comment><comment><USER39> > "What's interesting is that Americans search on Google is a much closer > reflection of what kills us than what is presented in the media..."

This is because the key driver of what the mainstream media reports is how well a given topic will increase the bottomline.

Pardon the editorial, but this is what passes for journalism currently. Sadly the media drinks their own Kool Aid, believes their own press releases, and continues to trumpet its own importance, even when the data/evidence consistently tells otherwise.

<comment><USER40> > This is because the key driver of what the mainstream media reports is how > well a given topic will increase the bottomline.

Counterpoint: there are news sources that don't have a profit motive, e.g. BBC News. They still do this same kind of reporting. For them, it's not about their bottom line. So... what _is_ it about?

<comment><USER41> I'm sure BBC News still has some sort of metrics that it presents to people for budgeting/promotions.

<comment><USER40> Yes, but the question is, why are these metrics chosen in a way that incentivizes BBC News reporters to follow exactly the same kind of sensationalist stories as for-profit news sources?

</comment></comment></comment></comment><comment><USER42> Should media coverage accurately reflect what we die from? I don't think so. Cause of death is not the only reason to be interested in terrorism, homicide, and suicide. These charts are eye-candy, and while I respect the work that went into producing them, I believe they are simply trying to spin a story instead of addressing the title's topic.

<comment><USER43> > Should media coverage accurately reflect what we die from?

People need to be aware that media coverage is disproportionately focused on certain causes of death.

</comment></comment><comment><USER44> This is fascinating, but I am greatly disappointed that Foxnews wasn't included. I would love to see their stacked bar...

<comment><USER45> It probably wouldn't differ that much from the NY Times. I would also expect MSNBC to be about the same. Its the angle that is the difference and not so much the subject. The big networks pretty much fall in line on topics. I think there was a study posted a long while back here on HN, but it had something to do with the NYT.

</comment></comment><comment><USER46> No. It reflects what we are _worried about_ dying from.

Instead of

<likelihood of thing being in the news> = f(<probability of dying from thing>)

It's more like:

<likelihood of thing being in the news> = f(<probability of dying from thing>) * g(<scariness of dying from thing>)

<comment><USER16> But our worries are influenced by what we see on the news.

<comment><USER46> Yep. Capitalism-induced feedback loop. That said, more people are going to pay attention to a newscast about terrorism than one about, say, how the yellow dye used in legal pads is poisonous.

If you think about it, I'm actually more likely to accidentally ingest a legal pad.

</comment></comment></comment><comment><USER3> There are two parts to terrorism: doing something terrible, and spreading the word to upset and frighten lots of people.

It's one of the oddities of modern Western societies that you can end up in jail for donating to what you think is a liberation movement in another country, but when the New York Times and The Guardian are making money by doing the second part of terrorism in their home countries, nothing happens.

</comment><comment><USER47> Allow me to guess: no. With the simple addition "why would they?"

</comment><comment><USER48> meh... \- "Are car reviews watched proportional to car sales?" Seems Ferrari has really bad sales reps... \- "Do food-related articles reflect what we eat?" My pasta-with-a-canned-sauce is still waiting to make it to the cover of Saveur.

</comment><comment><USER49> Betteridge's law wins: No.

</comment><comment><USER50> The corollary is people self-censoring news that does pertain to facts rather than over-sensationalism. Cf. [https://news.ycombinator.com/item?id=20029519](https://news.ycombinator.com/item?id=20029519) | [https://news.ycombinator.com/item?id=20052590](https://news.ycombinator.com/item?id=20052590)

</comment><comment><USER51> I haven't clicked the OP's link but I can already answer with confidence: No.

1-Don't write a headline as a question 2-Don't write a headline with a question that can be answered "no".</comment>


Checking PVS-Studio with Clang - <AUTHOR> http://www.viva64.com/en/b/0270/

<comment><USER2> The author's attitude towards UB is wrongheaded and dangerous. He argues:

> The Get() function can initialize the variables A and B. Whether or not it > has done so is marked in the variables getA and getB. Regardless of whether > or not the variables A and B are initialized, their values are copied into > TmpA and TmpB correspondingly....Formally, as far as I understand, undefined > behavior occurs. In practice, however, just some garbage will be copied.

This "in practice" is assuming a naive compiler that dutifully outputs a copy instruction. But the reality is compilers _exploit_ undefined behavior for optimization opportunities.

A likely outcome here is that the compiler will see UB if getA is false, and therefore optimize getA to just always be true. Not what the author intended at all!

Chris Lattner explains it beautifully: [http://blog.llvm.org/2011/05/what- every-c-programmer-should-...](http://blog.llvm.org/2011/05/what-every-c- programmer-should-know.html)

<comment><USER3> I post this guy's somewhat-related rant in response to any post I see in support of the modern approach to undefined behaviour: [http://robertoconcerto.blogspot.co.uk/2010/10/strict- aliasin...](http://robertoconcerto.blogspot.co.uk/2010/10/strict- aliasing.html)

(So, no matter which side of this argument you prefer, don't worry: you are not alone.)

<comment><USER4> This is another one on the same side: [http://blog.metaobject.com/2014/04/cc- osmartass.html](http://blog.metaobject.com/2014/04/cc-osmartass.html)

I should point out the C standard explicitly says that "Possible undefined behavior ranges from ignoring the situation completely with unpredictable results, to _behaving during translation or program execution in a documented manner characteristic of the environment_ (with or without the issuance of a diagnostic message), to terminating a translation or execution (with the issuance of a diagnostic message)." The second choice is what programmers expect.

UB should not be taken literally as "you can do anything". To take this to an extreme, a compiler that deletes any source files that contain UB could be compliant, but would also be one that no one ever wants. Much of the utility of C comes from its use as a "portable high-level assembler", meaning that its constructs are supposed to intuitively map almost directly to machine instructions. Aggressively optimising compilers that exploit UB violate this, so they are not in the spirit of the language: UB is either unintentional (a bug), in which case the compiler should issue a warning; or it is intentional, in which case the compiler should translate it with the intention the programmer had in mind. Making assumptions that "UB will never occur" and using that for optimisation is "wrongheaded and dangerous"; C's reputation for performance and efficiency comes from its simple low-level nature, not from overly aggressive compiler optimisation. Any optimising by the compiler should be at the instruction-selection level, and higher-level optimisation done with assumptions that are "characteristic of the environment". It's also worth mentioning that the "UB = optimisation" advocates seem to be mostly academics with an intense interest in replacing C with "safer" languages... and there's no better way to further their own agenda than to "legally" disparage C and make it a worse language than it should be.

<comment><USER5> _" UB should not be taken literally as "you can do anything". To take this to an extreme, a compiler that deletes any source files that contain UB could be compliant, but would also be one that no one ever wants."_

While I would agree it should not be taken as "you _should_ do anything", I disagree with the notion that it should not be taken as "you _can_ do anything".

For the situations I use C and C++ in:

1) I'm simply not willing to pay the price to catch all potentially dangerous UB at build time. My build times are bad enough as is without forcing a full static analysis pass during every iteration, and those still have holes and false positives. The laws of physics prevent us from paying some currently unimplemented O(N^crazy) checks that would certainly catch some bugs... and O(N^3) is bad enough, from what I hear.

2) I'm simply not willing to pay the price to mitigate all potentially dangerous UB at run time. I already spend more time optimizing than I'm happy with - making the compiler do less means I'll have to do more, which has an opportunity cost: I'll have less time to hunt down non-UB dangerous code. As such, I'm happy to have ASLR and NX bits, but I won't be turning off my optimizer nor enabling the more paranoid compiler-generated bounds checking.

If this means a malicious attacker manages "rm -f /home/user/project/all-my- undefined-code.c" through a buffer overflow rather than unsanitized input strings, so be it.

 _" It's also worth mentioning that the "UB = optimisation" advocates seem to be mostly academics with an intense interest in replacing C with "safer" languages... and there's no better way to further their own agenda than to "legally" disparage C and make it a worse language than it should be."_

I have an interest in replacing C with "safer" languages - specifically the kind that can better do safety and speed simultaneously. I feel that neither C nor C++ can be twisted much further towards those goals efficiently, without fundamentally redesigning those languages to the point where they're... well, no longer C nor C++.

<comment><USER6> "I'm simply not willing to pay the price to catch all potentially dangerous UB at build time. "

Huh? The point is the opposite: that UB is apparently explicitly (or maybe implicitly) recognized and _exploited_ for non-sensical "optimizations". So it's not that the compiler should do extra work to catch dangerous UB. It's that it shouldn't do this extra work to then do unexpected stupid stuff. Either not doing the extra work at all or doing something sensible would be OK.

<comment><USER5> _" that UB is apparently explicitly (or maybe implicitly) recognized"_

 _Potential_ UB is identified, but that's absolutely not the same as identifying _certain_ or even _likely_ UB.

For the cases where it's certain or likely as determinable by the compiler: Yes, please turn these into errors and warnings. As I've said, "I would agree it should not be taken as "you should do anything"". But that's as little as I address _certain_ UB, the majority of my post then talks about _potential_ UB in general.

I want the optimizer to have free reign to let "anything" happen, by ignoring scenarios which would cause UB, if those scenarios are sufficiently unlikely. Even if that means occasionally backfiring as "unexpected stupid stuff" when statistics catch up to me. I suspect I have a higher tolerance for weirdness in the name of performance than the topic article's author.

The majority of my post (including what you quote) then centers on justifying this higher tolerance.

</comment></comment></comment></comment></comment></comment><comment><USER7> According to [http://stackoverflow.com/questions/6793262/why- dereferencing...](http://stackoverflow.com/questions/6793262/why- dereferencing-a-null-pointer-is-undefined-behaviour) dereferencing a null pointer is undefined behaviour. Thus the example in the unit test where this occurs is IMHO a serious bug.

<comment><USER8> Note that in this case, what's actually happening is a null reference is being created; while this is very ugly (C++ references should never be null), if the reference isn't used, as the author asserts, a null dereference never happens (otherwise, there would almost inevitably be a crash). Behind the scenes it's just a NULL pointer being passed to the function that apparently ignores it.

<comment><USER9> But either way, the code is not well-formed. A null reference should never exist in a well-formed program.

[http://stackoverflow.com/questions/4364536/c-null- reference](http://stackoverflow.com/questions/4364536/c-null-reference)</comment></comment></comment>


Similarities between employment and romantic relationships - <AUTHOR> https://www.econlib.org/firing-and-the-left/ <comment><USER2> I pity the authors romantic partners.</comment>


Realtime messaging with no phone nr, email, sign up required. Dikalo is here - <AUTHOR> https://www.dklo.co <comment><USER2> I'm getting a certificate error when trying to go to the site on my phone.

<comment><AUTHOR> Not working on phones yet. Only desktops for now. Native mobile apps will come mid January.</comment></comment>


Java 6 exploit found in the wild - <AUTHOR> http://www.theinquirer.net/inquirer/news/2291040/java-6-exploit-found-in-the-wild? <comment><USER2> My cynical self would say that this is the perfect training for when XP runs out of support next April. Just because their vendor dropped support doesn't mean that usage will suddenly stop nor does it mean that no exploits are going to be found and used.

Right now it's "just" Java 6 which isn't installed on every machine out there (but still on a huge part of all Java capable machines). Next year it will be Windows XP which still has between 40% and 80% usage.

Me personally, I'm really interested how this is going to turn out. Will we see unofficial patches? Will we see anti virus vendors step up and provide semi-official patches? Will vendors have to cave and continue issuing patches? Will the malware issue just be ignored? What kind of damage does need to happen before something changes?

<comment><USER3> I'm in healthcare. We have a number of clinical applications that are only officially supported on J6 (and sometimes they even go so far as specifying specific _updates_ that are supported). They actually work just fine on J7, it just requires tweaking a couple of security settings. But getting that across to non-technical managers that have had "You _must_ be running J6u17" beat into their heads by idiot vendors is a bit of a nightmare.

<comment><USER4> Guy...

the non-technical managers understand that the FDA only approved the J6 version of the app. If you want to use J7, you have to resubmit to the approval process.

The law is there for a reason.

SOME apps it won't matter... like maybe some billing or hospital transportation apps or something... but certainly anything diagnostic in nature cannot be run in a manner in which it was not approved.

<comment><USER3> > but certainly anything diagnostic in nature cannot be run in a manner in > which it was not approved.

Which is why biomedical engineering and IT are different departments. IT doesn't touch anything that directly touches a patient.

</comment></comment></comment></comment><comment><USER5> It's worth noting that OpenJDK has had this fixed for a couple of months now: [https://access.redhat.com/security/cve/CVE-2013-2463](https://access.redhat.com/security/cve/CVE-2013-2463)

AFAIK, Oracle Java 1.6.0 is EOL, and thus does not receive patches in a timely manner (if at all).

<comment><USER6> The freely available updates have ceased, you have to buy Java for business[1] to continue to receive updates.

1: [http://www.oracle.com/technetwork/java/javase/training/index...](http://www.oracle.com/technetwork/java/javase/training/index- jsp-138092.html)

<comment><USER7> Yea, until recently they even continued to provide updates for 1.4.2 if you pay.

</comment></comment></comment><comment><USER8> How is it that the service with the noisiest, most obnoxious updater on my machine still manages to suck at staying up-to-date?

<comment><USER9> If you're talking about the Java windows updater, IME it gives up really easily and then doesn't remember to update until the next patch goes out. Also, aborts if any other installer is running.

OTOH, the Linux openjdk package stays pretty up to date and doesn't install the Ask toolbar ;-).

<comment><USER8> I've seen some machines where it tries to update with every release, and every release it fails with some cryptic error message, leaving the user on the old version. That can't be good for security.

<comment><USER10> Perhaps there's a reported bug for this, you could add a comment describing what you saw. If we report bugs in software then we're contributing to better software.

<comment><USER11> Ironically, the people reporting the bugs won't be able to automatically update to the new versions with the bug fix.

</comment></comment></comment></comment></comment><comment><USER12> Just kill the fucking applet already, no one uses it. All it does now is give the JVM an undeserved bad name.

<comment><USER13> Do you mean the Java browser plugin? If so, I agree with you, but this is still a serious issue even if you just have Java installed for desktop applications.

EDIT: To elaborate on jokc's reply (who appears to be shadowbanned), it seems that this exploit is only a problem for applications that use Java's sandboxing features, and the browser plugin is the best example of this -- but desktop applications can use these features too.

<comment><USER12> No other desktop apps are commonly sandboxed, so that's a minor issue, if an issue at all.

<comment><USER14> If they aren't sandboxes you don't need the vulnerability. Then the only question is if you can run untrusted code. Which is going to depend on the application.

<comment><USER15> If you're downloading an application and running it, it's pretty much immaterial whether it's Java-based or not; there's no vulnerability required to trash your computer at that point.

Sandboxes only apply in the browser, as far as I can think of -- Java code all executes in the context of a security manager, but does anyone actually set a custom security manager for running untrusted Java applications? (Maybe I'm just missing an example you know of...)

</comment></comment></comment></comment></comment><comment><USER9> To get the best of both worlds (in Firefox, but I know Chrome has something similar):

* Go to: about:config

* Search "plugins.click_to_play"

* Enable.

<comment><USER16> You'll also have to go to the Add-ons page, the Plugin tab and then select which plugins you want to be click to play

<comment><USER9> Ah, very true. Why they make it harder than necessary, I don't know.

</comment></comment></comment><comment><USER17> _/ Unspecified/_ vulnerability in the Java Runtime Environment (JRE). Fucking great

[http://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2013-2463](http://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2013-2463)

[https://access.redhat.com/security/cve/CVE-2013-2463](https://access.redhat.com/security/cve/CVE-2013-2463)

[http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b79d56eee...](http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b79d56eee18e) \-- 4 month old fix

</comment><comment><USER18> Can someone explain to me the current title? From the CVE:

> Unspecified vulnerability in the Java Runtime Environment (JRE) component in > Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 > Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect > confidentiality, integrity, and availability via unknown vectors related to > 2D.

Doesn't that say Java SE 7 Update 21, as well as OpenJDK 7? Or is that new info since the title was written? HN should update accordingly?

<comment><USER19> Yes, it affects all versions, but the article is emphasizing Java 6 because it is no longer being updated.

</comment></comment><comment><USER20> The best part is my Java Update Checker says I have the most recent version... _sigh_

Edit: I'm on 1.6

<comment><USER2> Java 6 (1.6) is EOL. You won't get an update unless you update to 7

</comment></comment><comment><USER21> Question:

Why does Java have so many security holes? Is it really worse than any other language, or is it just so ubiquitous that it presents itself as a good target?

<comment><USER5> I don't think the Java Sandbox has had significantly more security holes than other similar sandboxes (eg, Flash).

Most of these vulnerabilities are only applicable to environments which are required to run untrusted code.

</comment></comment><comment><USER22> From [http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-246...](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2463)

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."

</comment><comment><USER23> To nit-pick, calling a bug that has been patched in a different version of Java for two months and exploited in this version at least a week ago a "zero- day" is quite a stretch of the term!

</comment><comment><USER24> It would have been nice if they had mentioned specifically what the problem was. To the layman, this article makes it seem like just having Java 6 installed on your computer puts you at risk.

</comment><comment><USER25> Despite its origin as a "web language", it looks like just about the last place you want to use Java is in the browser.</comment>


Please Participate in Research on Hackers (7 minute survey) - <AUTHOR> http://southampton.ac.uk/~js7e11/research/

<comment><USER2> This is a repeat posting of a survey with serious methodological flaws, not least of which is a failure to define its terms. "Hacker" can and does mean nearly anything.</comment>


The White House is planning to let more foreign entrepreneurs work in the U.S - <AUTHOR> http://www.recode.net/2016/8/26/12652892/white-house-startup-visa <comment><USER2> Great, we can all look forward to lower salaries as a result.</comment>


A coder paradise in the mountains of Panama - <AUTHOR> https://medium.com/@calvinfroedge/a-coders-paradise-in-the-mountains-of-boquete-panama-3ddd7bca0e6f <comment><USER2> Since my wife is from Panama (I am Australian) I have long considered doing something like this. That part of Panama Chiriquí is particularly pretty and the climate is indeed fantastic.

In light of the AABill and the NBN perhaps I should consider it more.

<comment><AUTHOR> I have a good friend who lives right down the road and is also Australian, works for Microsoft research

<comment><USER2> Assuming I could get a job there I probably would seriously consider moving. The getting something is the main issue for me sadly.

<comment><AUTHOR> Remote work! Codementor, Toptal, Upwork, etc. A programming job in Panama pays like a few thousand a month at best.

<comment><USER2> I think I would be better off selling small things like books and training courses to be honest. Assuming I could get several hundred a month it would cover my expenses long enough till I could ramp that up.

</comment></comment></comment></comment></comment><comment><USER3> I hope you get lots of high quality inquiries! This is interesting but not at this particular point in my life.

<comment><AUTHOR> Thanks =)</comment></comment>


Advice for finding an IP Lawyer - <AUTHOR> How do I find a good IP/Employment lawyer that represents software engineers.  I have some outstanding issues with a former employer that owes me wages for my work and refuses to pay. I built a lot of great software and technology that I would like to get paid for or lay claim to.<p>Any suggestions/advice? <comment><USER2> What pitaa said. I'd add that George Grellas is a regular HN commenter: [http://www.grellas.com/george-grellas.html](http://www.grellas.com/george- grellas.html). He or his firm may not be able to do the work, but he may know someone.

That said, I'd start with pitaa's idea; salaries for W-2 employees are fairly close to sacred. Completely different story if you were 1099.

</comment><comment><USER3> If you're in the US, you were actually an employee (not a contractor), and this is about unpaid wages, you might be better off contacting your state "workforce services" or whatever whatever agency handles employee-rights violations. Obviously this is going to depend on the state, but they are typically pretty aggressive about going after employers that try to pull shit.</comment>


Sam Harris deletes patreon account after platform boots conservatives - <AUTHOR> https://www.businessinsider.com/sam-harris-deletes-patreon-account-after-platform-boots-conservatives-2018-12 <comment><USER2> Me, I will not miss him, or them.

What was he on there for, anyway? Or them? Isn't that for supporting artists?

<comment><USER3> He's one of the alt-light grifters like SoA and JbP. Can't blame them for milking the credulous for all they can.

<comment><USER4> I wonder if you've even consumed much or any of his works because Sam Harris has released plenty of literary and audio works of various kind where he espouses enlightenment values of liberty, tolerance, not lying, etc.

He has on more than one occasion talked or written about buddhism and how that line of thinking is far more beneficial to mankind than say islamic or christian fundamentalism.

He seems to be also ferociously anti trump for what it's worth. He doesn't seem to be anywhere near right wing in almost any political issue as far as I can tell. He seems to be against authoritarianism, religious fundamentalism, theocracy, political correctness, extremism left or right, etc, etc.

Alas, he seems to be often smeared by (radical) leftist types because, I'm not actually sure why. Perhaps his critics just can't process what is being said by the author and are always looking at angles and motivations that just aren't there or have decided that they know the motivation better than the author.

Spoilers: I gave him a dollar on his website, once, to get the exclusive content in perpetuity.

</comment></comment></comment><comment><USER5> Is this Chinese Chick conservative? [https://youtu.be/FETt5JzufY4](https://youtu.be/FETt5JzufY4)

Or collateral damage in the glorious Social Justice War?

<comment><USER6> She has been deliberately and systematically targeted by SJWs and NYT racist "journalists," who don't like the way she dresses.

<comment><AUTHOR> How does this stuff make any business sense to Patreon? Who are they beholden to?

<comment><USER6> It clearly doesn't, because it is biting them in the ass now.

I suspect that the social justice enforcement officers at Patreon are calling the shots, and the people making decisions about the business are powerless to oppose because their jobs are on the line.

It's all about virtue signalling. They're signalling the wrong virtues though. If they don't fix their internal culture they'll run themselves into the ground soon enough.

<comment><AUTHOR> Jeez, just asking about this leads to down votes. What insanity is possessing people.

<comment><USER7> The censors control a surprisingly large amount of downvotes here on HN.

edit: also note top comment in this thread is flagged, whatever that means in these days.

<comment><AUTHOR> What the hell. How can the tech community have become hostage to these nut jobs?

<comment><USER8> We aren't but you all acting like snowflakes over DVs is absurd, and you're replying to a 25-day old account. I don't give a shit at all about this drama; my preference is that you contain your meltdowns to reddit.</comment></comment></comment></comment></comment></comment></comment></comment>


ClojureScript and optimized C [video] - <AUTHOR> https://www.youtube.com/watch?v=LopU-kMpe8I <comment><USER2> I think the problem is that it's using doubles, which JavaScript VMs feel free to optimise to ints. If I change the C code to long, I get the following:

       marcel@sarek[tmp]cc -Os sumints.c && ./a.out
       49999995000000
        Elapsed time: 0.000031 millis

The original:

       marcel@sarek[tmp]cc -Os orig.c && ./a.out
       49999995000000
       Elapsed time: 8.276664 millis

That's a factor 266989 difference, if anyone cares :)

<comment><USER3> Can you post your code, compiler, and the disassembly from main()? The only way I believe these numbers is if your compiler optimized the loop away to a constant.

<comment><USER2> That's exactly what it (clang) did.

<comment><USER3> You should update your YouTube comment too :)

</comment></comment></comment></comment><comment><USER4> Correct me if I'm wrong, but this is basically just timing how fast we can read and write to a single CPU register, so it's eliding all the memory bottlenecks that actually surface performance differences between native hotloops and JITed code.

</comment><comment><USER5> Clojure on JVM is about 80x slower than ClojureScript in this scenario, by the way.

<comment><USER6> So Javascript compilers are faster than Java now?

<comment><USER7> Not really.

The code in question:

        (apply + (range 1e7))

is just summing a bunch of numbers. That's it. It's very easy to optimize for the sake of benchmarks.

It's way too trivial to use for any kind of meaningful real-world comparison.

</comment></comment></comment><comment><USER8> On my machine (2 yo MacBookPro), I get ~7 msec for the C version, 10 ms for PyPy, 35ms for CLJS, 240ms for Python 3.5, 300 ms for Python 2.7.

</comment><comment><USER9> Nice comparison. Do you have a text version of the same benchmark?

[PS: Next time remember to submit the youtube.com version instead of the youtu.be, because youtu.be is autokilled.]

<comment><USER10> Here is the source: [https://gist.github.com/mfikes/c531a4801a84e2c06af11588ce290...](https://gist.github.com/mfikes/c531a4801a84e2c06af11588ce29068e)

</comment></comment><comment><USER8> The more I run the CLJS script, the longer it takes:

[https://gist.github.com/sfermigier/9f60f01d1b4e8508a3a56bc42...](https://gist.github.com/sfermigier/9f60f01d1b4e8508a3a56bc423c068ec)

Any idea why ?

<comment><USER11> Probably just the parser getting tired.

In seriousness -- does this behaviour persist if you drop the computation into a `for` loop for a number of iterations instead of calling it manually every time?</comment></comment>


Ask HN: What are your tech-related New Year's resolutions? - <AUTHOR> <comment><USER2> Spend time to work on personal projects, a few listed in particular.

Clean up digital storage and finally start backing stuff up.

Chose services that protect privacy.

</comment><comment><USER3> No "New Year's Resolutions" exactly, but I have a couple of lists to try and whittle down. There's the generic "stuff to learn" list, a "stuff to build" (personal projects, experiments, random stuff I'm interested in, etc.) list, and then product specific TODO lists.

But the closest thing to a traditional "New Year's Resolution" would just be that I'm dedicating this phrase as my mantra for 2018:

"Ship It"

That's it.. just fucking SHIP stuff. 2017 was a good year in terms of getting a lot of stuff _almost_ done, now 2018 is the year to actually ship stuff.

<comment><USER4> Great!! What is your model for fogbeam. How will you be profitable or earn money as these tools are open source. May I know?

<comment><USER3> _How will you be profitable or earn money as these tools are open source. May I know?_

It's two-fold. One, we'll be offering hosted versions of our projects as SaaS applications. For customers who want to deploy on-premise or in a private cloud environment, we'll offer subscriptions - similar to the way Red Hat sell RHEL.

</comment></comment></comment><comment><USER5> Working on [https://www.cryptoground.com/](https://www.cryptoground.com/) and take it to next level.

We have got good traction on trade simulator in 2017. Now target is to make it 10x in the coming year.

</comment><comment><USER6> To ditch Comcast broadband for a provider that supports net neutrality.

</comment><comment><USER7> I would like to break the intercooler.js dependency on jquery.

</comment><comment><USER8> I'm not writing any more code on my own time.

<comment><USER9> agreed. that's the equivalent of doing work for free when it should be a business transaction. so, tech-related new years resolution number one: learn to say no in as diplomatic a way as possible.

</comment></comment><comment><USER10> I only write software for myself from now on.</comment>


The German Far Right Finds Friends Through Facebook (2017) - <AUTHOR> https://www.bloomberg.com/news/articles/2017-09-29/the-german-far-right-finds-friends-through-facebook <comment><USER2> Whereas the German left and center -- and every other political party in the world, for that matter?

<comment><USER3> It reminds me of an old French skit about hunters. The (fake) journalist asks them: "What's the difference between a good hunter and a bad hunter?" So they reply: "A bad hunter, for sure, as soon as he hears something, will immediately fire. You can be certain of that! Whereas a good hunter... Well... He hears something... Sure, he fires too. But he's a good hunter!"

</comment></comment><comment><USER4> Doesn't every party do that?</comment>