This CEO is out for blood - <AUTHOR> http://www.fortune.com/2014/06/12/theranos-blood-holmes/ <comment><USER2> > "I realized that I could have just as well been looking into the eyes of a > Steve Jobs or a Bill Gates."

> Though Theranos is largely unknown even in Silicon Valley, that is about to > change.

> Precisely how Theranos accomplishes all these amazing feats is a trade > secret.

> The analyzers look like large desktop computer towers. Holmes declines to > explain how they work, or even allow them to be photographed, citing the > need to protect trade secrets. The company manufactures them at an unmarked > facility I toured in a research park across the South Bay from Palo Alto, in > Newark, Calif.

> the single most accomplished board in U.S. corporate history. It includes > former U.S. Secretary of State, Treasury, and Labor George Shultz; former > Secretary of Defense Bill Perry; former Secretary of State and National > Security Adviser Henry Kissinger; and former U.S. Senators Sam Nunn and Bill > Frist

> In a rare if not unprecedented rout this past March, the patent holders > unconditionally surrendered midtrial, stipulating to the invalidity of their > own patent. As a kicker they agreed–though the presiding judge would have > been powerless to order such a thing himself–to bring no additional patent > suits against Theranos for five years.

> retired U.S. Marine Corps Gen. James Mattis, explaining why he signed up > last fall as another of Theranos's strikingly illustrious outside directors. > Mattis had stepped down just months earlier as commander of the U.S. Central > Command–the chief of U.S. military operations in the Middle East and Central > Asia

... zombie ... apocalypse

<comment><USER3> I skimmed through the first part, but based on your comment I went back and read the article.

> As a bonus, board meetings are also attended by the company's de facto legal > adviser at large, trial lawyer David Boies.

Boies represented the DOJ in the Microsoft antitrust proceedings and Al Gore in Bush v. Gore.

What an odd cast for a startup board. I wonder what connects all these people, other than all being high-profile.

<comment><USER4> Seems rather sad state of our Patent system here in the US where a 19 year old with no prior technical background, who was a Chemical Engineering student, a sophomore no less (meaning barely finished or finishing General Ed. requirements and just starting Major courses), can write and file for a highly-technical patent involving radios, sensors, embedded devices, and the like.

> And we could put a cellphone chip on it, and it could telemeter out to the > doctor or the patient what was going on.

It's very doubtful she understood how any of that works, or would work in her product/patent.

Underlying story seems it's absurd this was patent-able.

<comment><USER5> I think you're underestimating her intelligence and capabilities. Clearly she had the background and the initiative. There are super smart and dedicated people out there. She sounds like one of them.

Beyond that, I'm not sure if the patent is absurd or not...but I definitely don't think its absurd for a 19 year old woman to write up and be awarded a patent.

<comment><USER4> No, I was meaning I find it highly unlikely she understood or could actually implement the technology behind her patent.

A 19 year old, no matter how smart, is not likely to have a thorough enough background to understand all of the related technologies involved in this patent. This is a medical device, and has to be "done right", or people can be injured or worse. I don't expect even a top-tier CS student could pull it off.

I'm not attempting to discredit her intelligence, just pointing out she seems to have been/is an "idea guy". We've all run into "idea guys", they'll pitch a great idea with all this elaborate stuff, but then can't execute on it without outside help. Perhaps she got help, who knows?

A patent is, more-or-less, a mere idea (which is absurd in it's own right, ideas should not be patentable imho). So, you are right, it's not "absurd for a 19 year old [gender-is-regardless] to write up and be awarded a patent", it's absurd it was patentable in the first place.

<comment><USER6> Back in 1963, I was tutored in calculus by a 15-year old who won that year's Science Talent Search for his research in nuclear magnetic resonance. He had completed essentially all of undergrad math and physics. I think you have a badly warped view of what is possible for smart people, whatever age.

<comment><USER7> No, I think there's a reason she recruited a professor in that industry who had well over 30 years of experience.

That doesn't detract from her intelligence, but I think it's safe to say she would have simply done it herself if she could have.

I think simply describing her as an "idea person" is also missing the mark, but so are you. She isn't a magician, she's just a person.

And considering she was 19 and in a normal college curriculum, it's very likely her talent is not in being super smart, but in being able to come at a problem sideways.

<comment><USER8> Or in being rich and well-connected.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> _Holmes had then just spent the summer working in a lab at the Genome Institute in Singapore, a post she had been able to fill thanks to having learned Mandarin in her spare hours as a Houston teenager._

Everyone knows that English is spoken in Singapore, right? I'm not saying Mandarin wouldn't look good on a resume, but _very few_ Singaporeans with the education to work in that facility would not also be fluent in the international language of science. Even if her work took place in community clinics, Mandarin wouldn't have been as helpful as e.g. Hokkien.

EDIT: Since it's kind of lame that such a nitpick is still at the top, I'd like to address this also:

 _Its advances relate to "optimizing the chemistry" and "leveraging software" to permit those conventional methods to work with tiny sample volumes._

IANABiochemist, but they're talking about statistical methods here, right? My intuition is that a particular test performed at "nano"-scale might not be very accurate, but that a series of such tests could be as accurate as required.

<comment><USER10> I immediately picked up on that as well. Along with the whole "selling C++ compilers to Chinese universities in the late 90s" thing, it makes the article seem rather poorly researched and overly adulatory.

</comment></comment><comment><USER11> Can someone help me on the technical aspects of the blood tests they've developed?

The premise appears to be that they take extremely small samples ("25 to 50 microliters") and run lots of tests ("as many as 70 different tests from a single draw") using "the same fundamental chemical methods".

This compares with standard blood tests which require 2 orders of magnitude more blood ("numerous tubes of blood, each containing 3,000- to 5,000-microliter samples").

How does one produce reliable output with the same sensitivity/specificity using the same chemistry with so much less blood? I find it hard to believe that the existing lab procedures left that much efficiency on the table...

<comment><USER12> _Can someone help me on the technical aspects of the blood tests they 've developed?_

On the specifics, I'm afraid nobody can for now. They have refused to peer- review their protocols and validation data, so their assays are essentially a black box. So far, incredibly, they have managed to get away with this thanks to a glaring regulatory loophole (as the article explains); but sooner or later they'll have to open up if they want their assays to be taken seriously by the medical community.

In broader terms, however, there's been _a lot_ of recent work in the well- established microfluidics [1] literature on whole-blood assays [2], so that can give you a good guess about how they go about their implementation: most likely some form of "lab-on-a-disk" centrifugation for plasma separation and subsequent transport to separate microfluidic optical chambers preloaded with colorimetric reagents for readout, using perhaps a digital camera and some non-kosher/black-boxy form of curve-fitting DSP to increase "sensitivity".

In all I'm very skeptical until they open up and provide peer-reviewed validation data for their assays. There are already several companies doing patented blood microfluidics like Abaxis [3] with peer-reviewed validation, and the enabling technologies have been out in the open in the literature for years, if not decades; so the whole "we are doing a super duper secret awesome thing we can't tell you anything about" sounds rather D-Wavey and fishy to me.

[1] [http://en.wikipedia.org/wiki/Microfluidics](http://en.wikipedia.org/wiki/Microfluidics)

[2] [http://mams.rmit.edu.au/vtkd17xbz90ez.pdf](http://mams.rmit.edu.au/vtkd17xbz90ez.pdf)

[3] [http://www.piccoloxpress.com](http://www.piccoloxpress.com)

<comment><USER13> Wouldn't it be fairly easy to determine their FP/FN figures just by sending them lots of blood samples with known composition? If it's a black box, use black-box testing methods.

<comment><USER12> Like some form of "mystery lab-testing". Brilliant.

</comment></comment></comment></comment><comment><USER14> > she started her first business while still in high school, selling C++ > compilers to Chinese universities.

Along with the rest of the weirdness being mentioned by others, some of this really doesn't begin to make sense to me. o_O

Custom compilers have been a thing a few times in the past, but in the late 90s, what possible reason could there be for this?

<comment><USER15> The only thing I can think of was that the Chinese had some new architecture with no compiler out there for it. But if they had their own architecture they could surely build their own compiler..

Sounds fishy tbh

<comment><USER10> And I bet if you showed this article to someone with a background in the diagnostics industries Theranos is trying to disrupt, they would find all kinds of fishy aspects to those parts of the story as well.

</comment></comment></comment><comment><USER16> So no one has mentioned this yet, but this article is actually the Fortune cover story.

And I think very much deserved, not for most of the details mentioned in the article, but because of their pricing page: [http://www.theranos.com/test- menu](http://www.theranos.com/test-menu) \-- it's freaking cheap.

<comment><USER17> It's almost absurdly cheap. If your health insurance doesn't cover your lab tests, then it's probably cheaper to travel to their testing centers in Arizona, get tested and go back home than go to a medical lab near you and pay out of pocket.

On another note, I wonder why all except one of their testing centers are in and around Phoenix?

<comment><USER18> Phoenix is the Wild West. There is very little regulation or oversight, generally.

</comment></comment></comment><comment><USER17> The link isn't working for me - Chrome on Windows. Edit: nevermind, Ghostery blocked everything except the navbar.

In any case, I'm pulling for Theranos to be successful. I've had to have a lot of blood work done recently and I've been underwhelmed by every medical lab so far. If Theranos can use a smaller blood sample AND run more tests with it, then I can't wait to be a customer.

</comment><comment><USER19> Why I'm excited about this, and you should be too: Tracking of biomarkers over time.

""The movie goal is absolutely core to what we're working to do,"... We're building an early-detection system,"

</comment><comment><USER20> As a fellow health-tech entrepreneur, it's refreshing to see the business press reporting on something more than just "Yo." I hope this kind of publicity continues. The industry needs it.

</comment><comment><USER21> So what happened to the original idea? The patch that takes blood measurements while administering a drug? I can see how the current business is an extension of that original idea, but the article never states what became of the original. Did it die in the FDA approval process?

</comment><comment><USER22> There have been hints and whispers of Theranos here at HN for a while, here at least is more information about it, puff piece or no.

The board is quite impressive; I suspect they have gotten at least some DoD money, i.e. DARPA, through which perhaps some of those connections were made...

<comment><USER23> The CEO is definitely out for blood, and her employees apparently aren't exempt...

Here's some more information about Theranos... I interviewed with these guys recently. One of the things the interviewer stressed is that the programmers there typically work 60-hour weeks, and would I be okay with that. He said he was very proud of the fact that they used to work 80-hour weeks but had gotten it down to about 60. I passed on them just for this one reason...

The interview coding challenges were fairly well-designed and somewhat fun to do, though.

<comment><USER24> I was somewhat recently contacted for an interview, and the interviewer mentioned 45-55 hour work weeks, but other than that, the company seemed like it would be a decent company to work for. The screening process is somewhat more hardcore than others, but that can be a good thing.

</comment></comment></comment><comment><USER25> Impressive to note that after raising $400 million, she still holds over 50% equity in the company.

</comment><comment><USER26> What an amazing story. Best read of the entire week. It's 20 minutes well spent.

A look at their website (and the profiles they're hiring for) gives a clear idea of where she is going. You don't need iOS/Android developers, or ASIC/FPGA designers, or hardware and mechanical engineers, to support Walgreen's Wellness centers.

She's clearly going after the last mile. Blood tests for the masses. In your phone. No need for prescriptions, or visits to Walgreens.

This is way bigger than a $90 billion dollars blood test industry.

<comment><USER27> Here's another company going after the last mile, i.e. blood testing at home: [https://cue.me/](https://cue.me/)

</comment></comment><comment><USER28> What the company does sounds great. Maybe I skimmed through it too quickly but it starts out talking a lot about patches that measure the response to drugs. But then the company seems to just be doing blood tests quickly and cheaply. There was a pivot in there somewhere, right? Hard to tell with all the fluff around it.

The article also mentions how they do it is trade secret but I'm curious what the innovations are here. They throw some things out there though, like bypassing FDA hurdles and shrinking equipment and blood sample size down. It sounds like they're just streamlining a sleepy, well entrenched industry? A noble endeavor but the juicy details would be nice if we could get them.

Some day I hope that we can get these tests small and cheap enough that they could be purchased OTC and run easily and frequently at home. Collect a few hundred samples points while you check your weight in the morning and ship the data off to Amazon for data mining. It would wipe out surprise "I've had diabetes for the last 10 years and didn't realize it" diagnosis and that's a huge, huge win. Not to mention what the QS crowd would do with it.

Not sure what to make of that bit about the restaurant. If she's really testing her blood after every meal, then I don't see how she could miss the impact her veggie, carb, low-protein, no-fat diet.

</comment><comment><USER29> Well, cheaper and easier testing is great for everyone, particular in environments that can't run expensive fully equipped pathology laboratories eg rural areas, developing nations, refugee camps etc.

But at the end of the day, we need better tests, not better ways of testing. Looking through their test menu, it's the same old diagnostic blood tests we've been using for the last 30 or even 50 years. Hopefully there is something revolutionary behind the hype. I don't think it will be consumerization - none of those listed tests is going to help early detection of anything by getting yourself tested at Walgreens while you're buying toothpaste. Similarly, most of the tests are only useful when applied in a well fleshed out diagnostic process that involves collecting data about symptoms and medical history to generate a prior probability of the disease. Otherwise the false positive rate is high, and the false negative rate difficult to deal with. The utility of serial monitoring as a marker of health is also far from proven, but is an interesting idea. At the moment though, if you go to your doctor and say your homocysteine levels are fluctuating strangely, they won't have a clue what to do about it...

I would also add that proving that a test can be used to detect a disease early, and that early detection leads to a measurable improvement in disease outcomes takes a very long time, a lot of patients and a lot of money. So if they have made some great advance in microfluidic chemoproteomics that can actually detect the early traces of a disease process then that would be amazing, but one must remain skeptical.

</comment><comment><USER30> Wow, what a story. They sound like they're killing it, the founder's motivation is admirable, and she's making a positive dent in the world. I hope they succeed.

Inspiring.

</comment><comment><USER31> Theranos is nearing completion of a large new facility (corp hq?) in PA at the corner of Page Mill & Porter.

</comment><comment><AUTHOR> Loved this quote from her professor: "To me, I wish I wasn't 70 years old. I wish I was her age and could be in on this. Because this is going to be a long, exciting, fascinating, exhilarating ride."

</comment><comment><USER32> I had to delete the header to be able to read the article. The constantly changing/flashing text just a couple of cm higher to where my eyes are focusing to read the article is very annoying.

<comment><USER33> Same here. Thank God for being able to inspect and delete distracting page elements. I do feel sorry for readers not versed in html editing though.

</comment></comment><comment><USER34> > Her father, Christian Holmes IV, has devoted most of his life to public- > minded government service–disaster relief in Africa, international > development projects in China, environmental work in this country–and is > currently the global water coordinator for the U.S. Agency for International > Development. He met Elizabeth's mother, Noel, on Capitol Hill, where she > worked as a congressional committee staffer.

she definitely learnt a lot from her parents. At least how to navigate politically charged [mine]fields

</comment><comment><USER35> And now we wait to see their connection with Apple's new health initiative...

</comment><comment><USER36> Anyone know a link to the patent in question at the beginning?

some people have been decrying it as an "here is an idea" style with no substance, would help to have the thing available.

<comment><USER37> Posted elsewhere in the thread:

[https://www.google.com/patents/WO2005025413A3?cl=en&dq=ininv...](https://www.google.com/patents/WO2005025413A3?cl=en&dq=ininventor:%22Elizabeth+A.+Holmes%22&hl=en&sa=X&ei=nu- sU8uqI46VyASChIDQAg&ved=0CBwQ6AEwAA)

</comment></comment><comment><USER38> What a crap fortune.com is. The article is nice though.

edit: can't print it, does not work with ghostery/adblock, loads different articles after scrolling, ...

<comment><USER39> It works just fine with ABP

</comment></comment><comment><USER40> _Robertson recounts. "And I kind of kicked myself. I'd consulted in this area for 30 years, but I'd never said, here we make all these gizmos that measure, and all these systems that deliver, but I never brought the two together."_

Really?

I hope this CEO chose the right partner... :-)

</comment><comment><USER41> Awesome!</comment>


One Line of Code That Compromises Your Server - <AUTHOR> https://martinfowler.com/articles/session-secret.html <comment><USER2> This is why I prefer not to pass session information to the client in the first place. Have the session key be just an opaque, cryptographically random token that is then associated with data on the server (via a keystore of some sort). Then the cookie becomes nothing more than a bearer token.

There are some use cases this does not cover, such as authentication across multiple systems, where one or more may not have access to the authentication source, but even in that case it'd be preferable to have a separate, internal, private microservice that exchanges tokens for session information.

None of this will stop an attacker that has network access, but that's not what the article is considering, and if somebody is inside your network you might have bigger problems than session hijacking.

<comment><USER3> The reason is that, at scale, all the little things matter. Having to query your database for _every_ user request, to convert their session token into the server-side underlying data, gets expensive and slow. And it's a centralizing force in the architecture, requiring your session management database to be accessible by all your user facing servers.

So they store the data with the client, who can pass it back to the server with every request. One less DB query.

There are various rebuttals to that approach, even at scale, etc, etc. I'm certainly not advocating for it. But that's what some big applications landed on. Big apps drive most of the development of free tools, libraries, and frameworks. So it's no surprise that a lot of free tools handle this use case, even by default.

In the majority of cases, the not at scale cases, of course it doesn't make sense. Most all the hot new tools don't make sense. But again, that's just an artifact of software economics. The majority of the money is made by the big apps, so most tools are built for the big apps.

It's just a shame that new developers get caught up in these hip tools and base their understanding of the ecosystem on them.

<comment><USER4> > One less DB query.

This trait constantly appears in threads about JWT. But then how do you handle token invalidation?

I wonder how big IT companies (Google, Microsoft, Amazon) are really doing it...

<comment><USER5> Most of the big companies to my knowledge generally don't depend on client side storage of session state (they might in a few isolated cases, but in general avoid it).

<comment><USER4> Thanks.

Google uses interesting approach to handling service accounts: JWT is used as user credential once to get the access token (session credentials) that is reused between requests.

[https://developers.google.com/identity/protocols/OAuth2Servi...](https://developers.google.com/identity/protocols/OAuth2ServiceAccount)

</comment></comment></comment></comment></comment><comment><USER6> Good article and callout for those projects (and mine). I am doing an express alternative[1] with something that is not secure as a temporary session secret[2] formed with `secret: 'secret-' \+ parseInt(1000000 * Math.random())` so I'll modify it to use a real random key from a crypto library or display a prominent warning. Then I am also documenting it in a small _production security_ guide [3]. Also, if the key in the documentation is used there's a warning[4] similar to how Dropbox stops you from using 'correct-horse-battery- stapler' as a password.

If you have any other tip/recommendation I'd be really thankful.

BTW, doesn't SSL/TLS mitigate this a lot? Like, if the user is using SSL then only with physical access to a decrypted device would an attacker be able to impersonate the user, limiting greatly the possible attacks. And if someone has access to your decrypted device then you have bigger problems. Though devs who don't change 'super secret' are probably probably less likely to set up https...

Edit: I almost didn't include the _BTW_ comment because I agree that it _is_ an important part of security, so I didn't want to make it sound less severe, but I am curious about attack possibilities with https enabled.

[1] [https://serverjs.io/](https://serverjs.io/)

[2] [https://github.com/franciscop/server/blob/master/src/config/...](https://github.com/franciscop/server/blob/master/src/config/defaults.js#L8)

[3] [https://github.com/franciscop/server/issues/3](https://github.com/franciscop/server/issues/3)

[4] [https://github.com/franciscop/server/blob/master/src/config/...](https://github.com/franciscop/server/blob/master/src/config/index.js#L45)

<comment><USER7> SSL doesn't protect you from a malicious user who is trying to crack the key used on the cookie you gave him. It just means that no one else will eavesdrop on the malicious user's connection.

<comment><USER6> But then it also means the malicious user cannot eavesdrop on other users, so other users will be secure, right?

<comment><USER7> The attack in the article isn't about a malicious user eavesdropping and obtaining someone else's cookie directly. It's about a user who gets a cookie from the server, brute-forces to determine the key used to sign the cookie, and then uses that key to generate cookies that authenticate them as other users (or that execute code during deserialization, etc).

<comment><USER8> @AgentME -- correct

@franciscop -- keep an eye out for the rest of the article (it's already written and will be released soon). I go over the impacts of an attacker knowing the secret in much more detail. I also have sections on prevention for both application developers and library/framework authors that I think you'll find interesting!

<comment><USER6> I'll wait for it, because I don't fully understand @AgentME's comment "to generate cookies that authenticate them as other users". Those auth cookies would have a hashed token per user that must be created and validated in the back-end (besides the encryption). So just storing 'user-ID' _should not_ be enough, you'd have to be able to decrypt a real user's cookie to know this token hash (and for this reason just guessing numbers/users ID would not be enough as well).

<comment><USER7> The cookie that the user gets might be something like userid + ":" \+ HMAC(server secret, userid). The user who gets that cookie can brute-force HMAC(x, userid) with different values of x until they get a match for the string in their cookie, at which point they know the server secret. Then with the server secret, they can generate a valid cookie for any userid.

<comment><USER6> That is exactly what I mean, you are _not_ supposed to save the user id (hashed, encrypted or otherwise) in the cookie. You are supposed to save a random secure token that will be associated to that user's device/login. If you save the user id it'd be as an index, not for auth as the token is for that. See [http://stackoverflow.com/a/32218069/938236](http://stackoverflow.com/a/32218069/938236)

Of course then it depends on the developer, so statistically speaking there will be a % who do what you suggested and making it secure from the library/framework side would help some users, so I'm all in for it.

<comment><USER7> That strategy is often called sessions or a stateful-cookie. It requires all of the servers that accept that cookie to be able to share their session state (or for a strategy like sticky sessions to be used). The strategy I described is stateless: the servers only need to share the secret in order to verify the cookie. It's a popular strategy but it does have some trade-offs, such as being vulnerable to anyone who knows the secret.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> _Jack Singleton is a developer and security specialist at ThoughtWorks._

What a splendid example of an aptronym! [0]

[0] [https://en.wikipedia.org/wiki/Aptronym](https://en.wikipedia.org/wiki/Aptronym)

<comment><USER10> Max Venturi, a test driver at Ferrari, is my favorite one.

<comment><USER11> Mine is Staff Sergeant Max Fightmaster, US Army.

I'm also found of Rick Wagoner, former CEO of GM, and I often daydream of US Senator Sheldon Whitehouse becoming President.

<comment><USER12> Richie Rich and Bob Diamond - Bank executives is my favourite.

<comment><USER13> Rich Fairbank, CEO of Capital One. Doesn't get much better than that, folks.

</comment></comment></comment></comment></comment><comment><USER14> The cookies spec really should be incorporated into the SSL/TLS layer. Right now it's basically performing two encryption/signing steps immediately after each other, one at the web server, and another for the applications server. This is a pain-in-the-ass for the web server framework and adds several milliseconds of redundant latency.

The cookie data should be signed with the web server's private key.

<comment><USER4> Token Binding achieves something simular to what you propose. See [http://www.browserauth.net/token-binding](http://www.browserauth.net/token- binding)

</comment></comment><comment><USER15> While we are at it here is another individual line that will "compromise your server".

[https://github.com/rack/rack/blob/master/lib/rack/session/co...](https://github.com/rack/rack/blob/master/lib/rack/session/cookie.rb#L180)

[https://rdist.root.org/2009/05/28/timing-attack-in-google- ke...](https://rdist.root.org/2009/05/28/timing-attack-in-google-keyczar- library/amp/)

Of course folks are much more likely to misuse their cookie secret than purposefully break a library function. That said you can look at the history of most projects that use HMAC to authenticate data and they did it wrong.

(e.g. [https://github.com/rack/rack/commit/0cd7e9aa397f8ebb3b8481d6...](https://github.com/rack/rack/commit/0cd7e9aa397f8ebb3b8481d67dbac8b4863a7f07))

</comment><comment><USER16> What do people here use to store password for servers ? Plain text configuration files ? I have pwd of DB in config files and found no way to put it elsewhere.

<comment><USER17> Plain text can work, assuming that it is access controlled in a secure environment. Often times, during the build process, a secure secret management system or process will handle the combining of the code with configuration. For example, your developer (with no secret access) could commit code and Jenkins can fetch the configuration file from a secure and access-controlled service. Then the built code has the secrets and the developer does not. There are a lot of approaches to doing it at scale. See [https://gist.github.com/maxvt/bb49a6c7243163b8120625fc8ae3f3...](https://gist.github.com/maxvt/bb49a6c7243163b8120625fc8ae3f3cd) for a good overview.

<comment><USER16> Thanks ! very nice overview.

</comment></comment></comment><comment><USER18> I write most of my web apps using Sinatra (as per the article example), but do it using the Padrino [1] framework. Padrino by default sets the Sinatra session secrets to a long hash, which negates the developer from having to remember to do all this housekeeping later to tighten security on the app.

[1] - [https://www.padrinorb.com](https://www.padrinorb.com)

<comment><USER19> Padrino sets the session secret to a random value on startup if you don't set it yourself. This means that:

1) you can only run a single instance. Multiple instances will generate different secrets and not accept each others' cookies

2) restarting an instance (for instance doing a deploy) generates a new secret and invalidates all previous cookies

Neither of these are desirable, and to avoid it the docs recommend [1] you set the session secret yourself via:

        set :session_secret, 'super secret'

which gives you the exact problem the blog post is addressing, so it does not seem that Padrino does any better here.

[1] - [http://padrinorb.com/guides/controllers/sessions/](http://padrinorb.com/guides/controllers/sessions/)

</comment></comment><comment><USER20> I don't know why anyone would ever do this since there is no cost to SECRET_KEY = os.urandom... or even just hammering on the keyboard. It is not like you are ever going to be challenged for that password? You could even say here is another line of code that will compromise your server:

rm -rf /*

brb off to search github for SECRET_KEY =

<comment><USER21> > there is no cost to SECRET_KEY = os.urandom

Only if you generate the key up front and use the same value everywhere.

If you just call os.urandom in your app, then the cost is every restart (and every separate server instance) invalidates the cookies.

Probably not what you want.

</comment></comment><comment><USER11> How long would it have taken to crack the secret on that same setup if HMAC- SHA256 had been used instead?

What's the recommended minimum number of bytes for an HMAC secret when using SHA1? SHA256?

</comment><comment><USER22> I think any sane framework should generate a random secret each time an app is generated.

<comment><USER23> No; Django does that, and the result is that people check that random secret into source control. The correct solution is to not have the secret in code at all, but to read it at initialization time out of some kind of secrets management system (traditionally via environment variables). Unfortunately, frameworks generally can't do this in a hosting-setup-agnostic way; you have to understand the specific facilities that your PaaS or deployment system offers for this, and some (looking at you, Google App Engine Standard Environment) don't offer adequate ones.

<comment><USER24> I THOUGHT Django generated a random secret! What's MF on about?

<comment><USER8> ah I can see how that sidebar is confusing now. the point was just to highlight the configuration names across different frameworks. as @ameliaquining points out, a randomly generated secret that's been leaked to github has much the same effect as one that is easily guessed.

I'll think about ways to make it more clear! Thanks

</comment></comment></comment></comment><comment><USER25> The equivalent of leaving the default password set. Coders are not immune.

<comment><USER26> Default passwords are a problem with the system being configured; not with the configuration. Insecure-by-default systems should not be deployed anywhere.

</comment></comment><comment><USER27> Compromise your server with this one weird line of code!

</comment><comment><USER28> I've seen one character compromising the server</comment>


Ask HN: What's the worst that could happen? - <AUTHOR>

With this trend of sharing private data, say Facebook won the social network / identity war, what is the worst that can happen if they continue to share my data with websites? Ads, is one thing I can envision, but that isn't too bad is it? More relevant ads are alright. Less than honest employees snooping around in their databases and blackmailing their users? Possible, but long shot.
I'm aware that the government can track me with much more confidence, but with server / ISP logs, I think they're much more "dangerous" than some background FB personalization.
Other than people being offended by FB not asking them about sharing data, are there any real downsides to it? <comment><USER3> What's the worst thing that can happen? Insurance companies would love to have access to your social network data -- there is already strong research data showing a correlation between your friends and various risk factors. We can assume that governments already have access to the data, but there is a gradual drift to making this available to other corporate entities. We have the most to fear from commercial entities here.

Now, one could argue that through financial records and other online records, anyone from a private investigator on up would be able to determine everything about me given enough time. I grant this is probably true. The downside by sharing is that every large entity will know everything about me, with minimal effort.

I won't agree to share my information merely to gain a convenient service, in return for the data being mined. This sharing lowers the bar required for corporations to intrude into our identities, into who we are. And it's being performed en masse. In a sense, we're merely data points.

<comment><AUTHOR> True, I can see Variable insurance premiums based on your likes / friends, it _is_ a scary prospect. I guess a similar problem applies to any form of insurance. I don't know if it's wrong to do that though, if it leads to lower insurance premiums to the rest of the world. Insurance companies already tend to do a real world equivalent of what you talk about, but at a much lower level.

For (2) and (3), Agreed again, but what does it matter if you're just a data point to Big Corp A? Do you really expect them to treat you as an individual even if they don't have any of your data?

</comment></comment><comment><USER4> Facebook taking control of the world is not really that bad. It's only uncomfortable.

It's similar to the Microsoft empire from a few years back. Windows knew everything about you and you were completely locked-in not being able to stop using it because you had all your apps there.

Now you have all your friends there.

From application developer point of view this is actually a good thing - <USER2> have a common platform to code for. And it triggers innovation as we don't have to reinvent the wheel - there is the default social network already, so let's build on top of it!

Of course it would be great to have a free, distributed, open source social network anyone would join and leave at any time (think: Diaspora). Just as it would have been so much better if it was Linux or BSD who gained the monopoly on desktops, not Windows.

But we survived then and we'll survive now.

And if Facebook starts being RELALY nasty, people will finally leave it for something more friendly, cooler or maybe just new.</comment>


Ask HN: I need a business co-founder with MBA - <AUTHOR> I am working on a chatbot startup.
I need an MBA business cofounder, preferably from top school.
My second question... would that make a difference in the team qualifications for the fundraising? Or at least someone with a corporate background? <comment><USER2> What makes an MBA specifically important?

</comment><comment><USER3> No it won't.</comment>


IntersectionObserver in WebKit - <AUTHOR> https://webkit.org/blog/8582/intersectionobserver-in-webkit/ <comment><USER2> Surma's blog on the topic back when it first shipped in Chrome: [https://developers.google.com/web/updates/2016/04/intersecti...](https://developers.google.com/web/updates/2016/04/intersectionobserver)

</comment><comment><USER3> Super useful. The question is when this Api will be implemented in Chrome and Firefox?

<comment><USER4> I think they already support it: [https://caniuse.com/#feat=intersectionobserver](https://caniuse.com/#feat=intersectionobserver)

</comment></comment><comment><USER5> Really good article. Thanks for the author</comment>


The Space Shuttle's Military Threat - <AUTHOR> https://youzicha.tumblr.com/post/181657051514/my-favorite-part-about-the-economically-dubious <comment><USER2> My understanding is Shuttle launch preparations had to begin ages in advance, have good weather conditions, etc. So it's a first strike weapon the Soviets would have ample advance warning about (i.e. they'd see the thing crawling out to the pad at 1 mile/hr). Even if the Americans somehow managed to meticulously disguise the mission as a science one, it would only be useful as a very premeditated first strike, not as a rapid response to an imminent geopolitical threat.

The laser satellite stuff is interesting. I was under the impression the massive payload capability (which necessitated the external tank and SRB's) was dictated in part by the military, which lends some credence to those concerns.

<comment><USER3> You miss the point completely. The real issue is how much heads up you get before you get destroyed. This heads up time is what regulated cold war and kept both sides in check.

Effectively, each shuttle launch gives Russians a little heart attack and the culmination is basically each orbit that goes over Russia because SST is supposed to have capability to alter the course, dip in the atmosphere, drop the bomb and go back into orbit and they only get about 2 minutes of warning at best.

This warning time is crucial because that's all you got to decide whether you are under attack or not. For ballistic missiles launched from enemy territory you get half an hour and it means a bunch of people can gather data and figure out if it's real or fluke and make informed decision. You can't make informed decision in 2 minutes and it is extremely dangerous because it does not give you any capability to verify anything or ask anybody.

<comment><USER4> » This warning time is crucial because that's all you got to decide whether you are under attack or not. For ballistic missiles launched from enemy territory you get half an hour and it means a bunch of people can gather data and figure out if it's real or fluke and make informed decision. You can't make informed decision in 2 minutes and it is extremely dangerous because it does not give you any capability to verify anything or ask anybody.

I apologise in advance for the naivety and the insensitivity but what kind of an idiot would give a go ahead for a strike like this knowing that an unprovoked strike on a major civilian population center in Russia will almost assuredly lead to a response from multiple Russian ICBM locations that we keep worrying about the North Koreans.

If there was a fleet of a dozen or more space shuttles either "permanently" in the air or ready to fly at a moment's notice, I can see how that would change the equation but one space shuttle can't just dip, deliver a payload, climb up to rinse and repeat on five or more cities, can it?

<comment><USER5> I can't recall the source during the moment, but I read that during the cold war it was decided that targeting major population centers was more ethical than targeting nuke-capable military installations. This is counter-intuitive until you consider that population centers are worthless targets if you're planning on launching a decapitating first strike, therefore targeting major population centers signals to the opponent that you are poised for a retaliation strike, not a first strike. This is more ethical because it makes a nuclear war less likely to occur.

<comment><USER3> I like you pointed it out.

Cold War has its own, counter-intuitive logic. It is governed by game theory.

If war is bad then why US invests so much in war machine? Well, probably because investing nothing is historically bad way of maintaining peace. You are just inviting a bully to come and take your toys.

Looking from this point of view isn't it strange that so many people treat Russia as villanous because it invests so much in their military (or it has been investing)? I really wonder why people think it is ok for US to militarize itself but for USSR or Russia to do that it is somehow bad. I, of course, intentionally omit what the country is doing with its power, it is one thing to have military and the other thing what are you using it for.

Now, if US sends its troops abroad to subject some country, is it so difficult to think that USSR may feel threathened? If the way to keep peace is to keep parity and one party is trying to upset the parity the other has no other choice than to respond.

This game has many paradoxes and I feel people have not enough willingness to look at some geo-political events through the lens of a longer game.

We may say we want to bring democracy to Venezuela but what Russia is seeing is their power slipping. Right now they have precious little friendly land close to mainland US and they have no prospects of gainging more. At the same time, US is expanding NATO with more and more countries close to Russia border. Why is it so difficult to figure out this makes them very uneasy? Wouldn't some kind of response be expected? Why would US be surprised by it?

Up until now the game was to keep parity and now the parity is slowly eroding away. This absolutely must cause a response from Russia because the theory says they have to fill the void some way. Electronic warfare? Hacking? Meddling in elections?

Each side wants, understandabl, to mobilize its population in this struggle and there is no better way than to paint the enemy as a villain. I just wish we keep healthy amount of population on all sides capable of seing through cheap propaganda.

<comment><USER6> The calculus becomes a bit different if you are one of the countries Russia considers its buffer. You might have some aspirations of your own, but of course Russia has its own plan for you. The opposing superpower follows the same playbook, but you don't care since they aren't invading you, and so you'll happily join their defense pact.

</comment></comment></comment></comment></comment></comment><comment><USER7> > Let's build a copy now, and find out what it is good for later!

It's pretty smart in its own way. At a very superficial level the mimicry has a prospective effect, a potentially advantage-tipping energy. And military- style decisiveness almost always has to draw on things with such a superficial character by necessity. Seen as a start toward refinement of inner character (of a shuttle-like craft) from the outside-in, Buran makes much more sense.

<comment><USER8> Absolutely. USSR, at that stage in the cold war was living everyday with an existential crisis. It would not be uncommon for them to be so paranoid. And, it's a smart move. The amount of scientific and technological know-how generated from such a project would be tremendous. And the USSR military leaders would have surely known that.

Also, having honed in onto a very serious threat, spreading the information of that threat among it's scientists and pushing them towards a goal is an incredible motivation building tool. You can't make a scientist work effectively under threat of punishment. But tell him that his work will save his motherland, and you are on.

<comment><USER9> Not to defend the Soviets, but their paranoia was kind of justified - from the earliest days of the Soviet regime they faced foreign interventions, through to the Nazi invasion then Cold War era threats from the US and its allies.

Of course this all nearly backfired on everyone with Operation RYAN and Able Archer 83 when the paranoia of the Soviet leadership was at such a crazed level that they thought the West was planning a first strike so they thought their only option was to strike first.

<comment><USER10> Well, in the late 40s, the US was not so subtly threatening to nuke the Soviets. Some even argue that they nuked Hiroshima and Nagasaki primarily as a threat to the Soviets.[0]

0) [https://www.newscientist.com/article/dn7706-hiroshima- bomb-m...](https://www.newscientist.com/article/dn7706-hiroshima-bomb-may- have-carried-hidden-agenda/)

<comment><USER9> Curtis LeMay _wanted_ to attack the Soviets - from this perspective there was a grim logic to this - he (correctly) realised that at some point the Soviets would reach parity in strategic weapons with the US and he (incorrectly) thought that a conflict was inevitable - so he wanted to destroy the Soviet Union while the US could do it without any direct impact on the US.

Thankfully, he didn't get his way.

<comment><USER10> Yes, that's what I was thinking of. But I'd forgotten LeMay's name :( And I also vaguely remember something about an attack plan by George C. Marshall.

<comment><USER11> If memory serves, Patton was a huge advocate for continuing past Berlin to Moscow.

<comment><USER9> Not sure that would have been a good idea - the Soviet Red Army was _immensely_ strong and had just done most of the work in defeating the Nazis and the US didn't have man (any?) atom bombs left at the end of the war.

<comment><USER12> They didn't have any to start with in May '45, the Trinity test was in July

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Couldn't help but think of the Buran covered in bird feces while reading this article about how the Soviets thought the US-Americans were smarter than they were.

[https://www.boredpanda.com/abandoned-soviet-space-shuttle- pr...](https://www.boredpanda.com/abandoned-soviet-space-shuttle-program- buran-baikonur-cosmodrome-kazakhstan-ralph-mirebs/)

<comment><USER14> Haha yes we sure trolled them with our overly-politicized space exploration! Totally on purpose. Deep state.

</comment></comment><comment><USER10> > "The studies … showed that the Space Shuttle could carry out a return > maneuver from a half or single orbit … , approach Moscow and Leningrad from > the south, and then, performing … a "dive", drop in this region a nuclear > charge, and in combination with other means paralyze the military command > system of the Soviet Union."

Well, now we have ICBMs with hypersonic warheads. Doing the atmospheric skip thing.

</comment><comment><USER15> It seems like the Russians believed the shuttle would certainly be used for weapons delivery while the US intended it for espionage purposes.

I wonder why the Russians wouldn't consider such a possibility.

<comment><USER16> Manned orbital reconnaissance was an outdated concept then, abandoned with Project MOL/Gemini B and Almaz. I guess, it would have been rather counterintuitive to suspect such a role for the shuttle, with the systems dedicatedly developed for this lying around unused. And then there was still this huge payload capacity, which wouldn't fit the purpose…

(PS: While Gemini B did an empty shell test flight only, Almaz actually flew a few missions. So the Soviets actually won – widely unbeknownst – this military space race. However, at the time the US had already switched to their recon satellite program. We may assume that the two parallel projects had shaped pretty much the idea of the profile of such a mission and that the shuttle would have been an odd fit.)

<comment><USER17> I assume what iaw means by "espionage purposes" is that the Space Shuttle had a bunch of size/performance requirements set by the National Reconnaissance Office [1].

There's a certain amount of conjecture here, as spy stuff is classified. It's pretty well established that NRO needs impacted the payload size and 'cross range capability' (i.e. ability to land from polar orbit) [2] which may well have driven the delta-wing design and the piggyback-booster design [3]. And of course without the piggyback design, the Columbia disaster might not have happened.

[1] [http://www.thespacereview.com/article/1960/1](http://www.thespacereview.com/article/1960/1) [2] [http://www.jamesoberg.com/sts-3A_B- DRM.PDF](http://www.jamesoberg.com/sts-3A_B-DRM.PDF) [3] [https://history.nasa.gov/sts1/pages/scota.html](https://history.nasa.gov/sts1/pages/scota.html)

</comment></comment></comment><comment><USER18> The article doesn't mention it but surely the fears disappeared post- Challenger with the abandonmnent of thoughts to use Vandenberg as a high inclination launch site and the refusal to ever again fly with the Centaur upper stage in the cargo bay.

As an aside my first boss in the computer industry retired USAF detested Shuttle because it wasn't fulfilling a military mission that he thought it ought to fulfill. Strange times. Was great living in Indialantic and viewing the launches.

<comment><USER19> The Shuttle really taught some lessons to the space industry. We progressed in how to keep people alive in space but we also learned that making a multipurpose vehicle just isn't the best idea. All it takes is for one of the roles to be deprecated because of reasons and suddenly your expensive multi- tool starts to not be so attractive in terms of cost. Any time someone comes up with some complex plan to save money, it probably isn't going to save any money and will most likely end up costing you more than if you just continued on doing what you did before. Expendable vehicles aren't exactly cheap but they get the job done pretty reliably and without the risk of people dying.

<comment><USER12> >that making a multipurpose vehicle just isn't the best idea

Could you possibly CC the Pentagon on this?

</comment></comment></comment><comment><USER20> This is interesting, but I don't understand why the Soviet's conclusion would be that they also needed a shuttle. Wouldn't they invest in an alternate means to defeat the "dive-bombing" shuttle attacking Moscow such as developing high performance anti-aircraft (spacecraft?) missiles?

<comment><USER21> A missile that's re-entering at orbital velocities is incredibly difficult to defend against. You can't really shoot it down.

The threat profile of a Shuttle carrying nuclear bombs is that it combines the unstoppable nature of an ICBM with the potential for a surprise attack.

A surprise ICBM launch gives you 10-15 minutes between detection and mushroom clouds over your cities. An overflying Shuttle gives you 2-3 minutes.

</comment></comment><comment><USER22> Does anyone know of a book that has information like this (about technical aspects of the Cold War)?

<comment><USER23> Blind Man's Bluff is pretty awesome, but focuses on submarines and naval espionage

</comment></comment><comment><USER24> So basically, the Shuttle was simply a mistake as we now know, but the Soviets never accepted the very idea that such a massive mistake by a nation they deemed so advanced was possible, which resulted in an even bigger mistake on their own by reproducing it.

Much like in 1941, Soviets never accepted the possibility of Nazis invading just because every rational estimate resulted in suicidal nature of such an invasion by Hitler, which turned out correct, so they never prepared properly believing that Hitler is a military genius and will never commit such a stupid mistake.

</comment><comment><USER25> It looks like Tumblr is trying get away with a more elaborate cookie confirmation popup instead of proper GDPR implementation and I am not willing to play this game.

Is there a transcript somewhere?

<comment><USER26> Amp rendering maybe? [https://youzicha.tumblr.com/post/181657051514/my- favorite-pa...](https://youzicha.tumblr.com/post/181657051514/my-favorite- part-about-the-economically-dubious/amp)</comment></comment>


Moving to a provenance-aware memory object model for C: proposal for C2x - <AUTHOR> https://hal.inria.fr/hal-02089889/ <comment><USER2> Can anyone summarise?

<comment><USER3> The "n2362+appendix" pdf is only 7 pages if you ignore the appendix which is "changes to the actual C standard to implement the proposal", so it's not that long to read, and it starts with a description of the basic idea. The short summary is that it's trying to formalize an existing idea (which has been discussed by the committee and used by compiler implementations but not really nailed down in the standards text) about when the compiler can assume two pointers don't alias. Intuitively, if you create a pointer by dubious arithmetic means (eg by adding 1 to the address of a local variable) the compiler shouldn't have to assume that that might alias with other local variables, or it would generate terrible code out of paranoia. But you do want common operations where a legitimate pointer is arithmetically manipulated to work. The paper proposes a formalization that accommodates reasonable things but rules some implausible/weird stuff as UB to accommodate both those desires.

<comment><USER4> It's interesting work but I really wonder if it's desirable. What real-world problems is this supposed to solve exactly? Making the compiler extra-clever about detecting aliasing seems like a good recipe for having broken code appear to work correctly until it doesn't or getting strange behavior that's a pain to debug. Current aliasing rules are already a significant pain point in the C standard IMO, I personally don't want them to become even more complicated.

The only concrete example given in the paper (having two contiguous objects and referencing the 2nd one through a pointer on the first one) is frankly contrived and I'm not sure how that can be considered reasonable or good code. The only time I could see myself writing code like that is when dealing with memory-mapped hardware registers at fixed addresses which would let me do funky pointer arithmetic, but in this scenario the pointer is usually tagged as volatile and sometimes accompanied by a memory barrier to make sure the compiler does the right thing.

Note that if the programmers _really_ wanted the code given in the paper to work correctly (i.e. changing y through an offset pointer from x) they could do it by adding a memory barrier such as

        asm volatile("": : :"memory");

after the *p = 11;. Is it elegant? Arguably not, but it seems like such a niche use to me that it seems like a fair compromise. It's also not standard C but if you're making such pointer gymnastics chances are you're already making assumptions about your environment that go beyond the standard.

I much prefer Rust's approach of "mutable references never alias" and if the programmer really needs to share a reference they have to manually do the work by wrapping. Of course integrating that into C in a backward-compatible fashion doesn't seem very practical.

<comment><USER5> >I much prefer Rust's approach of "mutable references never alias"

This rules out a vast majority of fundamental algorithms. Jumping through hoops for getting simple logic working doesn't sound very desirable.

<comment><USER6> >>I much prefer Rust's approach of "mutable references never alias"

>This rules out a vast majority of fundamental algorithms.

To be more precise, in Rust:

\- '&mut T' (a mutable reference to T) can never alias.

\- ' _(asterix)_ mut T' (a mutable pointer to T) can alias.

The advantage is that you can write most production code with a mix of '&T' and '&mut T', which allows the compiler to assume no mutable aliases anywhere. But if you're building a doubly-linked list, then you can explicitly choose ' _(asterix)_ mut T'. (For other options, see [https://rust- unofficial.github.io/too-many-lists/.](https://rust-unofficial.github.io/too- many-lists/.))

In practice, it depends a lot on the code you're writing. I've written tens of thousands of lines of production Rust without needing shared mutability. But if I were writing a traditional game or GUI toolkit, then I might miss shared mutability a lot more.

<comment><USER7> The & semantics sound like fortran's semantics.

How does the rust compiler know if two references passed in from calling code can alias or not? (I.e., what if I get the type annotations wrong?).

In general, determining if two pointers can alias is equivalent to the halting problem.

The default C way is "assume aliasing unless you can prove otherwise". This seems safer and like less work to me.

<comment> Ar-Curunir The compiler ensures that you can only take one &mut reference at a time. You can have as many immutable `&` references as you want, because you can't change anything through those references (unless you do some unsafe trickery)

<comment><USER8> > you can only take one &mut reference at a time. You can have as many > immutable `&` references as you want

There's another small detail: these two cases are mutually exclusive. You can either have one &mut reference, or as many & references as you want. This means that code receiving a & reference can be sure the object won't change, and that code receiving a &mut reference knows the object can be modified safely since nothing else could be looking at it. (Assuming the object doesn't contain a Cell, the rules are a bit different when a Cell is involved.)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Wow, what a horribly designed website.

Here's the direct link to the pdf: [https://hal.inria.fr/hal-02089889/document](https://hal.inria.fr/hal-02089889/document)

<comment><USER10> Its a HAL website, the french equivalent of arxiv. Most french research institute have one to publish openly.

[https://en.wikipedia.org/wiki/Hyper_Articles_en_Ligne](https://en.wikipedia.org/wiki/Hyper_Articles_en_Ligne)

<comment><USER11> It's still a horribly-designed website.

</comment></comment></comment><comment><USER12> Sorry for my ignorance, but my impression was that in the native spaces the consesus is that Rust is the only reasonable choice for any new code. So I don't understand why people are still working on a C2x standard - shouldn't the native community work on a roadmap to migrate the existing legacy C/C++ codebases to Rust instead? Am I missing something here?

<comment><USER13> > Sorry for my ignorance, but my impression was that in the native spaces the > consesus is that Rust is the only reasonable choice for any new code.

Please tell that to the many millions of C/C++ programmers writing new code every day, who are only vaguely familiar with Rust if at all. If by consensus you mean "consensus amongst the vanguard of Hacker News" then yes. If you mean "consensus" as in the "consensus of the software development industry" then absolutely not.

<comment><USER14> If you program but don't post about it on HN, are you really programming?

<comment><USER15> Not really, no.

Also, Perl does not exist and is actually an urban legend from the '90s.</comment></comment></comment></comment>


Amazon S3 Reduced Redundancy Storage (RRS) - <AUTHOR> http://aws.typepad.com/aws/2010/05/new-amazon-s3-reduced-redundancy-storage-rrs.html

<comment><USER2> Useful, methinks. Go from 99.999999999% reliable storage to 99.99%, and pay 1/3 less (10 cents / GB / Month).

Personally, I'd feel better if they'd tack on another 9, but that's not a bad deal for an _enormous_ amount of uses out there.

</comment><comment><USER3> This is perfect for a project I'm working on. One component downloads zip files (10s to 100s of MB) from websites for indexing, and I archive them on S3 because it's just easier/faster to deal with them from there on EC2 instances that do the processing.

I don't need super redundancy, because I can always download the files again, and so RRS would make the S3 bill even cheaper.</comment>


CopFind - collaborative project to log speed traps - <AUTHOR> http://copfind.com/

<comment><USER2> Why do I have to register to use?

<comment><USER3> This is spam. Take a look at where their 404 pages redirect: <http://copfind.com/asdf>

goes to:

<http://myspacegateway.com/>

I wouldn't register... seems really sketchy.

</comment></comment><comment><USER4> How do you (or whoever runs this site) deal with constantly changing locations? How do you deal with time component?

</comment><comment><USER5> Does this pass the "do no evil", or the "improve users' lives" tests? Unknown speed traps are arguably good for us.

<comment><USER6> Arguable how?

To my mind they are nothing but revenue generation.

A visible speed trap is far more defensible. Not vague warnings but highly visible specific identification.

Even better put these speed traps where they are most likely to save lives not in locations were they are most likely to catch excess speed. e.g. put them outside schools not on the freeway, put them at the entrance to towns not a mile outside.

The speed trap should ticket everyone in excess of the limit. Currently the police use them and discard enormous amount of minor infringements concentrating on the relatively few high speed infringements. This is masking the true nature of the data i.e. the speed limit is too low. Teh correct course of action is to raise the speed limits in certain areas e.g. freeways and rural.

Lastly, tickets by camera should not be part of a police forces performance reviews, they should be noted but not used to justify or discredit anything about the forces performance.

<comment><USER5> Of the traffic tickets I and my friends have received, _most_ were useful in actually reminding us to drive more carefully. Occasionally you hear of someone getting an unfair ticket: I think that's the exception rather than the rule.

I hate getting tickets as much as anyone else, and I've gotten my share of them. But I still don't use radar detectors, and won't use this service.

"A visible speed trap is far more defensible." As long as the speed limit is clearly visible, why should the trap itself be visible?

<comment><USER6> If you are happy with the posted speed limits and see the police as only law enforcement then nothing I have to say will make a difference.

<comment><USER5> Yes looks like we disagree on that, hence our differing conclusions. I believe the speed traps do more good than harm.

You have to admit that this service's tag line "find cops before they find you" does make the user sound like a criminal :). They've gotta change that.

</comment></comment></comment></comment></comment><comment> daniel-cussen Startups are getting pretty marginal.

</comment><comment><USER7> Good idea, Bad technology, Bad implementation. For this to add value it must me something totaly mobile. It has to be a small GPS app that user can have on their phone, that detects their proximity to one of these spot and send them a text message or gives them a call.

<comment><USER8> Or what if you could tell it routes you normally take and at what times, and it will email or text message you if there is cop activity. Maybe you could just subscribe to a road or a location?

<comment><USER9> Even better: your phone will check for cops on your way, using GPS. When you locate a cop, you can report him in real time, and someone driving 200m behind you, using the same site, will get an alert.

<comment><USER8> Phones don't really have GPS though, right? And there's no easy way to write software that uses it even if it is there.

<comment><USER9> The phone network can locate your phone - so your phone can also know its location even without GPS. If your phone knows your location, and is connected to the web, it can work.

<comment><USER8> If you can tell me how to do this using only a website (no phone specific programming) it would dovetail nicely into a startup idea I'm considering.

I figured it would require getting users to install my software on their phone somehow, dealing with phone companies, and learning something called "Symbian".

</comment></comment></comment></comment></comment></comment><comment><USER10> quis custodiet ipsos custodes?</comment>


Show HN: A Managed platform to replace log shippers,aggregators and stream buses - <AUTHOR> https://www.trink.io/ <comment><AUTHOR> Hi everyone, i'm the creator of Trink.io - the first managed log collection platform.

I've created Trink.io because my team and I spent endless hours on something that was suppose to be simple like shipping logs. I knew that it shouldn't be this way, and when we focused on the process as a whole we realized that current setups can be improved in almost all aspects, like cost, performance, agility, scalability and visibility.

Our goal is to offer a single solution that connects to all popular sources (e.g AWS, K8s) and ships them to a destination of your choice (Datadog, Logz etc) in minutes instead of days.

You can try it for free for up to 10/GB per day. We'd really appreciate your feedback!

<comment><USER2> Is this similar to Cribl?

<comment><AUTHOR> Hi,

I think that both we and the creators of Cribl shared the same difficulties but chose different approaches to solve it.

There are great log monitoring and analysis tools out there, our goal is to help you utilize them at the best performing and cost efficient way. We are mastering log shipping by increasing reliability and visibility while reducing resources consumption everywhere we can.</comment></comment></comment>


Make a Duke Fan Cry (as a Service) - <AUTHOR> http://www.makedukefanscry.com/

<comment><USER2> the glitter bomb spin-offs are still a thing so it seems</comment>


Hackers, some advice on finding a co-founder that knows business - <AUTHOR> http://shelfmade.wordpress.com/2007/10/14/finding-non-tech-founders/

<comment><USER2> Well, part of what I get from PG's writing is that "business" is something a hacker can figure out, and that perhaps it's better to get technical people on your team, and figure out the business stuff as you go, rather than try and find someone who "knows business".

<comment><USER3> I agree. However, I would suspect that having at least one hacker who _enjoys_ the business of startups is important. If all of the hackers hate dealing with business, I could see that being a potential problem.

On these lines, an interesting hypothetical question is what would Apple have become if founded by 2 Wozniak's? Woz loved to hack, but strongly disliked the idea of starting a business. I think it took a Woz + Jobs to make things happen, personally.</comment></comment>


Show HN: PickHealthInsurance.com - <AUTHOR> http://www.pickhealthinsurance.com <comment><USER2> This is very pretty and I'm sure it's to some extent useful.

However, I also find it misleading. As someone who has been through the process of buying private insurance before: there are a number of sites like this (though none of them as elegant and spare). All of them will give you comparative rate charts. But those rates don't mean anything.

After you select a provider, you have to fill out their application, which is onerous. They then do whatever record pulling they do in their backend and come back to you with an answer, which you can expect to take the form of "we can insure two of you for $JACKED_RATE, and we can't insure the other two at all", at which point you get to spend weeks in their appeals process figuring out which 15 minute doctor visit from 4 years ago put your wife or daughter on a "do-not-cover" list.

I'm not just complaining about the (horrible) US insurance system here. I'm saying that sites like this don't work. No web developer has access to the real information this app purports to have, which is "what can I expect to pay for coverage from providers in my area".

Note also that there are plenty of agents who will do this kind of legwork for you; they're often compensated by affiliate fees from insurers.

(For what it's worth, the identical problem exists with comparative car insurance shopping; you can get rate charts all over the Internet, but it's not until you fill out the application for a specific provider _and_ wait a week that you'll find out how much higher _your_ rate is than the advertised minimum.)

What would be _very_ valuable would be a crowdsourced version of these charts.

<comment><USER3> To offer a different perspective... I'm younger than you, and was shopping for individual insurance.

In my case, the hardest part was trying to compare plans from the companies in my area. All of them have slightly different ways of making it profitable for them. One could have Rx copays, but a special deductible for ER and urgent care visits. Another company may have only Rx reimbursement and office visit copays. So on and so forth. I actually had a spreadsheet with about a dozen columns to try to figure out, based on how I've used healthcare in the last few years, what plan is likely to be best for me.

Anything to simplify it would be great.

Moreover, the companies I've worked with on this, Blue Cross of Florida and United Healthcare (GoldenRule), in my own experience, the rates they quoted me online after filling out their survey were correct.

Healthcare costs and complexity surely go up as we all get older, so that, plus difference in state laws, probably explain the differences in value we see in this app.

<comment><USER2> I'm 34 now, but my last tussle with private insurance happened when I was 28.

Did you fill out complete applications for Blue Cross and United? Were you presented with a sign-on-the-dotted-line contract with a rate on it?

Were you applying solely for yourself?

Again, if you're in your 20s, healthy, male, and alone, you are very easy to insure, because you cost epsilon for Blue Cross to insure.

<comment><USER3> Yeah, I'm currently insured by United and was previously insured by Blue Cross.

I think your point is correct that the site is a (now cliched?) "leaky abstraction." But the good news is that it works for at least some segment of the market (those like myself).

I was 25 when I did the Blue Cross app and 27 when I did United.

</comment></comment></comment></comment><comment><AUTHOR> I'm releasing the first version of PickHealthInsurance today. It helps you compare health insurance plans (individual, not group) in the US.

I put this together over a few weekends. My COBRA is about to run out and I found it exceptionally difficult to compare plans and prices with the existing sites. This is the third time I've had to buy individual insurance and I finally decided to do something about it.

Things crystallized for me when I almost bought a plan that claimed to cover maternity, only to discover late in the game that it had a separate $20,000 maternity deductible! What a mess!

I have a few goals with PickHealthInsurance:

\- start showing approximate rates almost immediately, don't pester me with a bunch of questions

\- explain confusing terms like "coinsurance" and point out the difference between a PPO and a POS.

\- show plan stats up front, not buried deep within the bowels of the application process

\- make it easy to use and blazingly fast

Built with:

\- Rails 3.1 (HAML, Sass, Coffeescript)

\- Twitter Bootstrap CSS

\- Deployed on Heroku/MongoHQ

What do you think?

<comment><USER4> This looks fantastic. Seriously, really good.

I'd love to be able to specify the number of children I'd be putting on my plan (maybe not on that first page, but on an internal "refine" page?).

Also, it'd be great to have checkboxes allowing me to select two or three plans, to then compare them head-to-head.

But, again, this is an excellent first version. I look forward to seeing where it goes.

<comment><USER5> I suppose some states may have different regulations effecting the system, but every plan I've ever seen doesn't differentiate based on the number of dependents you have. Rates are effectively tiered to single, married, or family.

<comment><USER6> This varies significantly from state-to-state, by insurer, and even by plan. In places that do price based on actually composition for family plans, there's rarely a particularly linear correlation between family size and rates. (Also, good luck getting an insurer to tell you your actual rate on an online tool :/)

</comment></comment></comment></comment><comment><USER7> Cool site, needs some visual work but the idea is there.

I have the same question as other people - how are you pulling this data?

One thing you definitely need on the front page is gender selection. Gender instantly changes the price of insurance significantly and is a simple binary question.

I hate dealing with health insurance so much so I very much hope this site evolves and becomes a success for you. Well done.

Edit: Now you need to monetize this. The obvious way to do that is to do lead gen if they offer it.

<comment><USER8> I'm curious what "visual work" you feel is necessary? I quite like the simple and clear visual design and wish more web sites would do the same.

</comment></comment><comment><USER9> Very cool. I wish I had this when shopping for insurance a year ago.

A "total annual cost" column would be helpful for making sense of the deductible/premium/co-pay relationship. Think of it as the "Price+Shipping+Tax" on shopping websites.

Ask the user how much he expects his doctors to charge him ("Annual Medical Bill") in the next twelve months, then calculate how much he would pay to the doctors and to the insurance company. Last time I bought health insurance I had to make a spreadsheet to calculate this. I would rather not repeat that mundane task again.

It might also be useful to have multiple predefined Annual Med Bills ($0, $1,000, $5,000, $20,000, etc). Displaying the output on a graph might make sense (AnnMedBill vs TotalAnnCost, with a curve for each plan). You should customize these to the user's age (a 23 year old may not go to the doctor for years at a time, but even a healthy 50yo will definitely go several times per year for checkups and *oscopies).

Mapping costs to life events (no doctor visits, a few visits, broken arm, healthy pregnancy, etc) would make it even more useful, but researching the necessary assumptions will take considerable work so just implement predefined dollar amounts as a version 1.

Keep up the good work, this idea has value!

<comment><AUTHOR> I've toyed with adding some elaborate calculators. Last time I went through this exercise I built a rube-goldberg spreadsheet that let me plug in doctor's visits, major illness, deductible, premium, etc. and spat out a yearly number.

It was just too complicated, though. Most people don't even understand what "coinsurance" is. I might add some pretty calculators later if the site gets some traffic.

<comment><USER9> >> Most people don't even understand what "coinsurance" is.

That's exactly why you should add a calculator, so people can see how the variables interact.

</comment></comment></comment><comment><USER10> Great site, I especially like the explanations for the different terms.

How did you get all the insurance rates and terms, just from the companies' sites?

When I tried evaluating the health care plans my company offered me a few month ago I had a terribly hard time getting information about the different plans that are out there. (But then again, I'm not from the US and the whole health care system keeps confusing me.)

</comment><comment><USER11> Very nice. I just went through the process of picking a health insurance plan using ehealthinsurance.com, and it was a bit of a pain.

The one thing that would have made things a lot easier for me is being able to sort by out-of-pocket maximum. I wanted a high-deductible, HSA-compatible plan, and so having a low out of pocket maximum was my number one criteria.

I wonder how many people actually know what they want in a health insurance plan? There are a huge number of options, and it's hard to know what's important. The guidance I found on the web tended to be generic, rather than targeted at the type of plan I wanted (major medical).

Perhaps you could outline a few broad plan types, explain the advantages, and allow users to pick one?

For example, I would have picked a "major medical plan", and it would have shown me plans that have solid out-of-pocket maximums that aren't much higher than the deductible. The data displayed for each plan would highlight differences between those plans (e.g. HSA-eligible) that might not be so important to a another plan type (e.g. full service plans).

</comment><comment><USER12> The rates your app returned were vastly different than running the same rate on numerous carrier websites. Your site showed rates that were sometimes less than half what the carrier site reported.

How do you generate your rates? Your math seems dangerously wrong in a lot of places, especially when requesting family rates.

(This is verifiable by running a rate on this website, and then going to one of the carriers websites and generating the same quote)

Disclaimer: I work in the health insurance industry, so many of these rates were obviously wrong as soon as I saw them.

<comment><USER13> >> Disclaimer: I work in the health insurance industry...

Recommendation: Get your employer to build _this_ and not the stuff that's on most health insurance sites. Note especially that you don't have to enter your name or email to get a rate and plan information. Kudos to you if your company has already done this!

<comment><USER2> Just know that without considerably more information than your name, you're not getting a real rate anyways.

<comment><USER13> Obviously. But even after submitting a completed application, I still don't have a real rate until the carrier completes underwriting/medical records check etc. We're talking about the first 10 minutes of the process here.

</comment></comment></comment></comment><comment><USER14> Looks great, but returns 0 plan that includes maternity coverage in my area. I don't know if it's an issue with the app, or just the sad state of health insurance in the US... probably a bit of both.

<comment><USER15> I found 6 plans with maternity coverage in my area (Kansas City). I'm sure they all have 2 year waiting periods, but that's not gurgeous' fault :-)

</comment></comment><comment><USER16> Looks like your price sorting is by string and not integer so $1,491 (most expensive) then $199 (least expensive) were the top two results after sorting.

<comment><USER17> Also, it would be nice if you could use stable sort (see <http://en.wikipedia.org/wiki/Stable_sort#Stability>). This would allow to sort first by premium, then by deductible, then by insurance. This would allow me to see the $0/0% plans by increasing price.

</comment></comment><comment><USER18> Excellent site.

On general note, this site really emphasizes how fucked up is health system in US. There is complete lack of correlation how much a plan costs and how much benefits you get.

There should be version: WhyHealthInsuranceinUSSucks.com

<comment><USER19> In part that's because, unfortunately, there is not that great a correlation between these advertised rates and how much they'll charge you once you actually go through the application process and have them pull your medical records, either.

</comment></comment><comment><USER20> Could you have the insurance companies' names in plain text? I could not locate "Aetna" using my browser's Find… function, but instead had to scan the "Company" column. I appreciate that it's sortable, but I might want to sort by price, then jump to each row using "Find Again" to see the variety offered by a particular company.

</comment><comment><USER21> This is incredibly helpful. I run a small OSS/music nonprofit and as you'd imagine there's not a lot of money in that. Having just gone through the process of looking around for insurance for my family I can say that is was an amazing contrast to the overwhelming and unpleasant experience of using insurance provider sites.

I'm notoriously cheap, but would happily shell out a commission or even a one time fee for the service — keep it this simple and straightforward and you'll not only have a compelling business but a tool that really helps people.

</comment><comment><USER22> Great idea! But you need at a minimum to add one more question: desired deductible.

I ended up with 79 plans and that is a bit much to sort through. Perhaps you could have a slider on the results that let you manually set the minimum deductible.

Also I assume the charge listed was monthly but you didn't state that.

</comment><comment><USER23> I hope this is your full time gig. Picking a health insurance is one of the hardest problems ever. I do not know the business and I fear I am going to get screwed.

If I had launched such a nice service I would try to charge the end user. I would be willing to pay money to an independent third party.

</comment><comment><USER24> Have you used an agent before? Their whole business is about helping individuals and businesses pick plans. My agent has shown me some good data sheets that get close to giving you apples to apples comparisons. I bet you could borrow a lot from their business models.

</comment><comment><USER25> Very interesting. Where is your data coming from?

</comment><comment><USER24> It would be cool if I could see my existing plan on there and be able to compare apples to apples. They keep raising my premium, it would be nice to know if there was something else out there that had a lower premium.

</comment><comment><USER26> I work for a company that makes millions a year providing health care plan comparison sites to major plan carriers.

I hate it because the industry is years behind. 90% of our clients demand IE6 support because their companies still use them. We constantly have to integrate with legacy systems and people don't understand how to consume our web services. It's very stable, but boring.... It's a bad place.

Nice to see competent tech people getting into the market. I wouldn't mind starting/joining a health startup but I signed a pretty damning non-compete.

</comment><comment><USER27> Considering I'm currently without health insurance, this is extremely helpful. Love how simple the interface is and how it gives you an easy to understand list of providers. Excellent work.

</comment><comment><USER28> Is there a theme or framework that you used to make this site? It has the exact same UI as <https://www.bitcoinica.com/>

<comment><AUTHOR> Twitter Bootstrap - highly recommended!

<comment><USER29> <http://twitter.github.com/bootstrap/> for anyone who hasn't heard of it. It looks fantastic, and now I want to rewrite my current pet project templates to use this instead of what I already have...

</comment></comment></comment><comment><USER30> It gives me an inaccurate rate and just sends me to ehealthinsurance.com where they ask for just a tiny bit more info (ages of all enrollees) and gives me a different, more accurate rate. So why do I go to pickhealthinsurance.com again? All it does is give a wrong answer and refer me to a competitor (at least I am perceiving you as trying to compete with the likes of ehealthinsurance.com) who gives me a correct answer.

</comment><comment><USER31> Under "Plan Types" you've used a checkbox when the actual behavior is a radio button.

Plan Types HMO (15) PPO (79)

What was the reasoning behind that? Are there other options that aren't mutually exclusive that sometimes show up dynamically? Was it a visual choice?

The checkboxes underneath act like checkboxes.

If it's a visual choice, why not use some actual style? <http://jqueryui.com/themeroller/> (see "buttons")

</comment><comment><USER32> Nice work and very useful! It's great to see the Twitter Bootstrap CSS being used as well. I've been using it as a starting point for my projects now.

Maybe a next step would be for users to be able to save their plan name/type and then they can come back for comparisons. If you do that they maybe allow people to opt in for emails if a similar plan comes up as their saved plan but has a lower cost. Keep up the good work.

</comment><comment><USER33> As a software developer, I love this. You're doing exactly what this era of cheap technology has enabled us to do - aggregate information into a one easy to read, easy to understand interface. As others have mentioned, there's some fixes here & there, but you're definitely going down the right path.

As a Canadian, I'm bewildered that this has to even exist.

</comment><comment><USER34> Your site lists the same companies as every other site out there - the problem is, it's missing so many other companies out there. It's basically a list of the same four or five companies over and over and over again with different plans.

Where are all my local companies? Where's BlueCross BlueShield?

</comment><comment><USER35> Someone mentioned the Mass. HealthConnecter. Here is another established tool the developer should know about: <https://calpers2011.chooser2.pbgh.org/Default.aspx>

PickHealthInsurance looks nice and clean. Good job!

</comment><comment><USER36> Well, for one, we're Parishes in Louisiana, not Counties, but that's mostly a pedantic thing.

There's another site that I've seen that does something similar: <http://www.prodigyhealthinsurance.com/>

</comment><comment><USER37> Had some long discussions with colleagues about this and it just makes you wonder how "sophisticated" the algorithms behind health insurers are when the basic inputs are: postcode, smoker, age and gender.

</comment><comment><USER38> Can't you claim a commission much like how brokers work? ..and if so, I wonder how you would do that.

or,

just become broker yourself and keep the leads, then pass them off to the Insurance company with leveraged commissions.

Very cool site.

</comment><comment><USER39> Sorting by price sorts alphabetically, not numerically.

I put in some details from when I was living in the US and I'm shocked—I can't find a plan that isn't 50% copay on brand name drugs?

</comment><comment><USER40> Very nice! Your sorting by deductible doesn't work correctly.

</comment><comment><USER41> HHS operates a really good site to find public and private insurance options:

<http://finder.healthcare.gov/>

</comment><comment><USER42> A really important factor is reputation. Some of the firms you have listed at the top of the list for me are cheap but have jet-black records.

</comment><comment><USER43> I like what you've done with it so far!! I love your launch page UI, it's very clear and obvious what I am supposed to do. Good luck!

</comment><comment><USER44> sweet! serendipitously just what i need this week picking insurance and all the information more quickly and better organized than sites like ehealthinsurance.com et al. wants:

\- side-by-side comparison (check several, show all)

\- easy print-out of plans and side-by-sides, or PDF-gen

\- tool-tips for filters at left. nice tool-tips on terms in rows already

\- filter by deductible, co-pay, premium amnts (eg <$500)?

</comment><comment><USER45> I've either broke it with my postal code or this website isn't supported in Canada. I'm guessing it's the latter.

</comment><comment><USER46> This is timely - we were just looking for this an hour ago and wondering why it didn't exist! Thanks HN.

</comment><comment><USER47> FYI your stylesheet is being served with html at the end (an error page) which is causing it to fail.

</comment><comment><USER48> Great work, this is a great piece of tech that does some real good. Keep up the work!

</comment><comment><USER8> Nit: the sort by premium should be a numeric sort so that 1,000 is greater than 999.

</comment><comment><USER49> Great job, much easier than ehealthisurance.com when I used it a couple years ago.

</comment><comment><USER50> I don't see BCBS in my results, and I have a BCBS plan.

</comment><comment><USER51> Looks great, Clean UI and fast. Give option to compare plans side by side.

</comment><comment><USER52> Everyone seems to comment on how great the UI looks, but it means nothing ultimately if the data is inaccurate.</comment>


Ask HN: Does Mac OS X Yosemite Get Rid of Dashboard? - <AUTHOR>

I'm very curious to know if there's any way of finding out if dashboard has finally disappeared from OSX, or more like merged with the new notification center. The latter would be my guess, considering they did refer to "widgets" that can be put there. It has been rumored that Apple will get rid of dashboard for awhile, but has that come to fruition? <comment><USER2> From what I can tell, Apple doesn't usually announce when they get rid of something. It just kind of fades out gradually and disappears one day (remember Sherlock?). Apple hasn't talked about the dashboard in quite a while.

It appears that Apple is adding widgets to the notifications bar in both iOS and OS X. Given that the two OSes are converging, and there is no iOS analog for the Dashboard, I'm guessing that the Dashboard is going away.

</comment><comment><USER3> It still exists. [1] Unfortunately its the same and looks out of place.

[1] [http://www.superb.info/review-screenshots-os-x- yosemite/](http://www.superb.info/review-screenshots-os-x-yosemite/)

</comment><comment><USER4> It's disabled by default but can be turned on in System Preferences

</comment><comment><USER5> i clicked the dashboard icon in launchpad and it got enabled and it looks exactly the same as mavericks</comment>