Ask HN: How startups cover health insurance - <AUTHOR> with health insurance premium is rising, I wonder how startup who raised 500K with 3-10 employee cover health insurance; or in other words, what is the best insurance provider for a small startup <comment><USER2> If you're in CA, it makes sense to just pay your employees a little more cash and let them get an individual policy. Honestly, that was always the best even before the ACA. And that way you never have to worry about losing it if you change jobs.

My individual policy when I first started was really cheap—$171/month (with a reasonably high deductible, $5k I think). It's now $350—something. So yeah, it's doubled. But it covers more things under the ACA and honestly the price seems fair to me. Just pay employees an extra $5k a year and then they have non-revocable, transferable insurance.

I honestly wish employer health insurance would go away. Like, make it illegal and just have everyone get an individual policy. Yes, companies would have to pay employees an extra $5-10k cash, but I feel like tax incentives could be created on both sides to make this possible and beneficial for everyone.

<comment><USER3> This seems really inefficient - group plans are cheaper than individual plans, and the premiums are tax-deductible, unlike individual plans. I suspect you're also driving away older workers, since the ACA allows insurance companies to charge older customers up to 3 times as much as younger ones. Maybe it would be ideal for everyone to be on the individual market and for group plans not to exist, but that's not the world we live in.

</comment></comment><comment><USER4> In California it's very hard for a small company (under 50 at least) to get a decent plan. It's mostly better to just let your emps get ACA coverage (Covered California). Unfortunately the tax system doesn't allow that to be a business reimbursement so you have to just gross it up (to cover taxes) and run through payroll.

At about a dozen you can get insurance that doesn't completely suck, and cover a huge percentage (like 80%) for your staff.

Don't cover 100% -- that way people whose spouses have better coverage won't cost you anything. But it can surprise you: e.g. Stanford faculty have crummy plans these days.

<comment><USER5> >Don't cover 100% -- that way people whose spouses have better coverage won't cost you anything.

That's a surprisingly and annoyingly bad incentive. Like, it punishes companies for providing excellent medical coverage by basically making a cash transfer to companies providing shittier coverage to their employees' family members. There's some countering incentives for very high-value employees, where they really really care about medical coverage because their spouse is stuck with shitty coverage, but overall it pretty well sucks.

<comment><USER4> I don't know a better way to manage this incentive (I mean on a global, society level I mean). Any ideas?

In the case of smaller companies, there really isn't any choice: we don't get the good group plans. If it were free of course everyone would sign up, and then the company would be paying a large premium to the ins co for something the emp wouldn't use -- and for the emp, if they filed a claim they'd have a real problem because each insurance company would claim the _other_ should cover the expense (I know this from experience).

The trick is to make a bigger group. Someone like YC could probably get all their portfolio companies into a single group. Individuals can join IEEE which makes a group, but you can't enroll your company in that.

<comment><USER5> It's fairly straightforward to fix - single payer. That's not easy to, like, actually do, since there's established interests in the current system. But it is simple to describe.

</comment></comment></comment></comment><comment><USER6> We let our employees choose any health plan they want through the marketplace, or whereever, and reimburse them for it.

</comment><comment><USER7> I used to process accident claims. I have a certificate from a technical college that entitled me to the spiffy title of "Certified life and health insurance specialist."

If you can find a local Direct Primary Care provider, that is a "legal" option under the ACA when combined with a high deductible plan (or possible a health savings account). I have some info here:

[http://micheleincalifornia.blogspot.com/2015/12/how-to- fix-a...](http://micheleincalifornia.blogspot.com/2015/12/how-to-fix-americas- financial.html)

From what I have read, DPC reduces costs while improving care. Part of how it brings down costs is a) better maintainance care so health issues don't spiral out of control and b) cutting out the middle man of insurance. Costs are lower in part because you pay the clinic directly.

</comment><comment><AUTHOR> I'm in California, thanks for the great answers, but should I expect 5-6K per employee per year to cover insurance?

in case I let the employee get their own insurance, how about the mandated law that forces each small business to give coverage to all employee? I get a waiver letter from the employee in that case?

<comment><USER8> > but should I expect 5-6K per employee per year to cover insurance?

That's about right. I've seen startups cover anywhere between $250-500/month in health insurance premiums, with the rest on the employee.

<comment><USER9> If you have solely single employees that might work.

The total cost for "gold" plan for an employee with a family can be easily $1500-$2000+ a _month_.

<comment><USER8> I have never seen a startup offer gold plans or contribute towards family premiums (just individual). Large enterprises/Fortune 500|50s, but never a startup.

<comment><USER10> > I have never seen a startup offer gold plans or contribute towards family > premiums (just individual). Large enterprises/Fortune 500|50s, but never a > startup.

Wouldn't that rule out employing anybody that isn't single?

</comment></comment></comment></comment></comment><comment><USER11> Probably depends on the state you're in, but here in Ohio we have COSE that provides a number of benefits for small businesses, one of which is programs for insurance.

</comment><comment><USER12> Say hi to my friends over at limelighthealth.com

They are a startup built and started by health insurance brokers. If you are a startup with under 50 employees, go to the founders there. They all still hold their brokerages, and they are startup founders themselves. I can't speak for them, but I am sure they'll know how to help you make the best decisions for insuring your employees.

After-all, they get it.

<comment><USER12> I use to work there before I started my tech company.</comment></comment>


Ask HN: What are your most compellingly useful Bash examples? - <AUTHOR> I'm presenting an introduction to Bash and the Linux command line to my co-workers and I'm looking for some examples that will make them say "oh WOW I really could've used that last week!" and generally give them an idea of how and when Bash can be useful.<p>Solutions to specific or one-off problems are great as long as the problem is not too arcane. Feel free to show off! <comment><USER2> && time cat</comment>


The "security.txt" proposal reached last step in the IETF process - <AUTHOR> https://mailarchive.ietf.org/arch/msg/ietf-announce/OFuiGlVv6WgvEEABaGmnYi120yU <comment><USER2> For the uninitiated: [https://securitytxt.org/](https://securitytxt.org/)

Original HN thread: [https://news.ycombinator.com/item?id=15416198](https://news.ycombinator.com/item?id=15416198)

<comment><USER3> At one point in time I believe there was also a discussion on why somebody was removing it from their site. I'm having a hard time finding it currently and remember it being for excessive contacts from people using automated tools to scan their site.

Edit: Found it, [https://news.ycombinator.com/item?id=19152145](https://news.ycombinator.com/item?id=19152145)

<comment><USER4> there is a draft (from November 27, 2019) that makes the presence of a disclosure policy (using security.txt) mandatory on gov domains:

 _" Binding Operational Directive 20-01 Develop and Publish a Vulnerability Disclosure Policy"_ [https://cyber.dhs.gov/bod/20-01/](https://cyber.dhs.gov/bod/20-01/)

 _> Create a security.txt15 file at the "/.well-known/" path16 of the agency's primary .gov domain. This file must include the Policy and Contact fields, as specified in the Internet-Draft.17_

</comment></comment></comment><comment><USER5> I know Google, Facebook, and Github now have this, though Apple, Microsoft, Amazon, Stripe, and Square do not (to rattle off the other tech companies with huge security teams.)

But I don't really get it. Why is this a good idea?

As 'DyslexicAtheist related, if you put this page on your site, people will crawl for it and find you, and then kick off horrible automated scanners that generate bogus bugs on every site they check, and then submit bounty requests for them.

Meanwhile: what serious tester would be impeded by not having this page to refer to, if you have a /security page on your main site, which you have to have anyways for this to work? Recall that most of the fields in security.txt are themselves just URL pointers.

I also think the RFC itself is kind of funny. Do not rely on security.txt as authorization to test a site! it says, as if an RFC really had the authority to establish that, rather than an expensive court case in which both sides of the argument will have competing claims about whether testing was allowed or (the US default) not.

<comment><USER6> Bogus reports are an issue security.txt or not. The single and only thing the file provides is a trivially discoverable way to get the contact/submission information for security issues, should they matter for whoever posted the file. That's it. Why make people search for 10min when they can be at a standardized location.

<comment><USER7> Because then the automated scanners find it too, and send automated reports?

It is just like spam - cheap to send, expensive to read - except you cannot throw it out right away because it may contain actual vulnerability.

<comment><USER6> Are you saying automated scanners can't find your other pages? You can also put a submission URL with a captcha in the security.txt file.

<comment><USER8> If I'm understanding correctly, when "automated scanners" is mentioned here, what's meant is tools that someone runs directly, which scan the software/device and generate loads of red flags. Having a security.txt file makes it that much easier for the tool (or the user) to report the issue, valid or not.

<comment><USER6> You are correct, but only finding the contact details is easier, submission can still have a high difficulty, methods against spam.

</comment></comment></comment></comment></comment></comment><comment><USER9> A list of all official .well-known files and paths:

[https://www.iana.org/assignments/well-known-uris/well- known-...](https://www.iana.org/assignments/well-known-uris/well-known- uris.xhtml)

Wikipedia knows some less official ones too:

[https://en.wikipedia.org/wiki/List_of_/.well- known/_services...](https://en.wikipedia.org/wiki/List_of_/.well- known/_services_offered_by_webservers)

<comment><USER10> EST is a new one to me, and yikes!

</comment></comment><comment><USER11> If you're looking for an example security.txt, you can have a look at [https://www.google.com/.well- known/security.txt](https://www.google.com/.well-known/security.txt).

There is also this site which lets you create create a security.txt file by filling out some fields: [https://securitytxt.org/](https://securitytxt.org/)

</comment><comment><USER12> I think it is great that this proposal is almost done getting through the process.

I also think there should be a similar file for the regular expression that expresses a site's allowable passwords.

<comment><USER13> Wouldn't this just make password crackers easier? If there's a Regex of what passwords are okay, it lowers the search space.

To save (potentially rate limited) requests, the ripper software could compare the regex against a candidate password and skip it altogether.

It's like expressing in machine-readable form how many/which characters they can skip.

<comment><USER14> _Wouldn 't this just make password crackers easier? If there's a Regex of what passwords are okay, it lowers the search space._

If knowing the rules for acceptable passwords makes it significantly easier to brute force passwords, that sounds like more of an argument to not have those rules in the first place since it wouldn't take an attacker long to figure them out himself even if they aren't published. Hiding the password policy is a very weak form of security through obscurity.

I guess it would make it easier to programmatically determine which websites have insecure passoword policies (like an alphanumeric passsword no more than 8 characters long), but the problem here is the password policy, not publishing the rules.

Even the NIST recommends that sites stop requiring these arbitrary password rules as they don't actually improve password security: [https://www.alvaka.net/new-password-guidelines-us-federal- go...](https://www.alvaka.net/new-password-guidelines-us-federal-government- via-nist/)

<comment><USER15> You're probably right theoretically, but people tend to choose really weak password if they can choose _anything_.

Maybe passwords should always just be auto-generated and people should be told to write them down in a... actually, nevermind that. Passwords should be a thing that's integrated in your browser/computer experience... this is something that can and should be handled by computers. You should only ever have to log into your computer and be secure from then on.

This whole insanity of point-to-point invention of secrets needs to die.

<comment><USER16> _> Passwords should be a thing that's integrated in your browser/computer experience... this is something that can and should be handled by computers._

I had this crazy idea, whereby computers could themselves come up with very long, random sequences of bits.

They would then use these openers (couldn't think of a better word) to authenticate to each other, secured by mathematical operations, in place of passwords.

Sadly, I've never seen it used on websites, so it must not be a good idea. /s

<comment><USER17> Certificate auth for http with TLS and Kerberos auth for http is specified, supported by all (major desktop) browsers.

However: The UX on the browser side is shitty as hell. Certificates display weird nagscreens, without being able to specify proper defaults like "use this cert for that site and don't bother me again". Certificate enrollment has been broken (not that the form element was ever great) by all major browsers, to be replaced by "do something in Javascript maybe, if we get around to implementing a new API some time". Oh, and no logout...

Kerberos needs a parameter at browser start or an about:config setting, is incompatible with using multiple TGTs let alone automatically selecting the right one or _gasp_ getting a new TGT for the user from the proper KDC. The only thing that kinda works mostly is using the standard company login TGT. Oh, and logging out doesn't work...

Oh, and of course most mobile systems are broken or just unsupported.

The sorry state of browser auth is 100% on browser vendors dragging their feet on those problems that have been known for around 20 years or so. And no, webauth won't save us, it'll just be another shitshow most likely.

<comment><USER16> This is the reply I was honestly hoping to get.

I always felt like one of the UX blockers for key exchange was the assumption that people couldn't be expected to learn the basics, because it's too complicated.

And every attempt to ignore or hide it has just made the entire thing more complicated or confusing.

You can shoot yourself in the foot with a gun or crash your car into a wall, and yet most people manage not to do so on a daily basis.

Sometimes simplicity is a false virtue.

</comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> Comments should be directed to the IETF last-call list via email: last- email@example.com

List info: [https://www.ietf.org/mailman/listinfo/last- call](https://www.ietf.org/mailman/listinfo/last-call)

Guidance on the last call process: [https://ietf.org/about/groups/iesg/statements/last-call- guid...](https://ietf.org/about/groups/iesg/statements/last-call-guidance/)

Archive of comments so far: [https://mailarchive.ietf.org/arch/msg/last- call/aDZq1M-m4du-...](https://mailarchive.ietf.org/arch/msg/last- call/aDZq1M-m4du-wN5b58puSQ_7y2M)

</comment><comment><USER18> An interesting attack for any website that allows customers to choose their own string for use in the url would be to choose the name ".well-known" \- I'm sure I've seen sites that take user input and create a folder based on that name. Similar to reddit.com/r/.well-known except as a top-level folder but I can't find a good example right now.

Once that happens, they could put up a malicious security.txt file and get free security reports sent to an email of their choice.

<comment><USER19> But as you hint, r/.well-known does NOT in fact exist and you can't make it

The /.well-known/ paths were reserved by RFC specifically because this doesn't really happen. You could _make_ a site with the defect you imagine on purpose and perhaps somewhere in the vast galaxy of sites there's already one that can be abused to do this, but they're vanishingly rare. To the point where I don't know of one even though I went looking.

One reason this prefix would be expected to be especially rare is that dot directories are both illegal in Windows (though the NT kernel has no problem with them) and special in Unix systems (they're legal but they're treated differently because it was convenient) and so any developer or administrator working with file paths for their web server is likely to disable names starting with dot at about the same time they disable names starting with slash and other shenanigans which blow stuff up.

Now of course a URL doesn't have to reflect a path on disk, but as soon as it doesn't we're talking about a slightly more clued in developer, maybe someone who has heard about security and thinks it might be a good idea.

<comment><USER20> And for anyone who doesn't know why .files are treated differently:

In every Unix folder there are two special files, named '.' and '..' \- the first is a link to the current folder, the second to the parent.

It was annoying to see these two files listed every time you wanted to see what was in a folder (using ls) so `ls` learnt to not show these files by default. The way that was coded was (erroneously) to not show any file whose name started with a '.'

People eventually realised that this had the unintended side effect of hiding files that start with '.' and found it useful, so the bug became a feature.

<comment><USER21> Thats super interesting! Thanks for sharing.

</comment></comment></comment></comment><comment><USER22> I actually think this is a great proposal. I may start implementing it regardless.

</comment><comment><USER23> I think this is nice but having this in and a lot of other meta data in a machine readable form would be nicer. You could also think of things like licenses a and copyrights.

Technically, the problem this specification solves is making it easier to find security related metadata for projects that typically have this information already but just not an easy to find place. So, the next logical step would be making this machine readable so IDEs, project hosting websites, and other tools, can do the right things instead of having to parse files intended for humans with no consistently used syntax.

<comment><USER24> Looks pretty machine readable to me? This _is_ the consistent syntax to be used.

<comment><USER23> Was expecting something like a yaml or json file to be a good standard for this. It's nearly 2020, we should not be improvising text file formats in standards anymore. .txt screams intended for humans.

<comment><USER24> You're thinking too short term. .txt far predates, and will far outlast, any standard _du jour_. I bet you wouldn't be so gung ho about security.xml.

I really don't see the issue. robots.txt works just fine, and this is simply following in its highly successful footsteps. What you suggest is change for change's sake.

</comment></comment></comment></comment><comment><USER25> What's wrong with emailing email@example.com?

<comment><USER26> Where does that go? To whom? What do they do with it?

In a lot of companies, any generic name email address probably goes to the trash, some group like customer service, an auto-responder that says "Sorry no" and sometimes to marketing. None of these help you. On rare occasion webmaster@ might get to someone who is useful and technical, but it might also be in a folder with thousands of other junk messages.

A better guess would be security@ . But still, wouldn't it just be easier to have a standard place to lookup who or where to go to contact someone for security issues? oh yea... security.txt

<comment><USER27> Both "webmaster" and "security" are standardized in RFC 2142, so one should be able to contact those easily. It's indeed not what happens in practice most of the time, but not sure if throwing more standards at it is a good solution: if/when most of the online services will follow those, they'd probably follow different ones.

</comment></comment></comment><comment><USER28> For people discussing automated tools and noise, prediction: we will start seeing automated tools flagging "missing security.txt" as some sort of vulnerability and I will end up implementing it just to stop the noise. It feels like a lose-lose situation.

</comment><comment><USER29> From a liability point of view, this only has downsides for a "target" company.

</comment><comment><USER30> Okay. I implemented it on my main domain for kicks. I wonder how long until bots begin looking for it.

</comment><comment><USER31> This seems like a really poorly thought out proposal.

From the draft's [1] intro, which provides motivation for the proposal:

> When security vulnerabilities are discovered by independent security > researchers, they often lack the channels to report them properly [...]

Occam's Razor: they lack the channel to report those vulnerabilities because the company doesn't give a damn about security, not because of some hitherto unsolved technical difficulty.

Companies that give a damn about security already have either a "catch-all" contact for security related things displayed on their contacts page, or have dedicated pages detailing what the hell you are supposed to do to report a vulnerability. Companies that don't give a damn will continue to not give a damn and will ignore your document, and will continue to suck at security until someone starts punishing them - monetarily - for such appalling behavior.

But let's leave that aside for a moment. Researchers spot vulnerabilities. Need a way to report them. So what's the solution?

Apparently, a text file with only one mandatory field...

> 3.5.3. Contact

> This directive indicates an address that researchers should use for > reporting security vulnerabilities. The value MAY be an email address, a > phone number and/or a web page with contact information.

...which contains... er... a catch-all contact for security related things and or a link to a contacts page detailing exactly what the hell you are supposed to do to report a vulnerability? sigh...

But the real kicker is that that the standard doesn't even require that the contact information is up to date or valid:

> 6.2. Incorrect or Stale Information

> [...] Organizations SHOULD ensure that information in this file and any > referenced resources such as web pages, email addresses and telephone > numbers are kept current, are accessible, controlled by the organization, > and are kept secure.

In case the meaning of "SHOULD" is in question see RFC 2119 [2], but basically, they "strongly recommend" that you keep your contact information up to day - instead of, I dunno, REQUIRING it, since having a channel to properly report security vulnerabilities is the ENTIRE POINT of this exercise?

/facepalm

Are we really supposed to take this seriously? This is simply security theater.

[1] [https://tools.ietf.org/html/draft-foudil- securitytxt-08](https://tools.ietf.org/html/draft-foudil-securitytxt-08)

[2] [https://www.ietf.org/rfc/rfc2119.txt](https://www.ietf.org/rfc/rfc2119.txt)

<comment><USER32> Isn't this part of why postmaster and abuse addresses exist? Perhaps a WHOIS entry that was specifically for security issues?

</comment></comment><comment><USER33> My first thought was "XKCD 463"</comment>


Lektor Static Content Management System Version 2.0 Released - <AUTHOR> https://www.getlektor.com/blog/2016/4/lektor-2-released/ <comment><USER2> Congratulations. FYI: If anyone is interested in all things static site builders / generators - I've started the Static Times (@statictimes) news channel covering Lektor, Jekyll, Middleman, Hugo, Metallsmith and friends -> [https://twitter.com/statictimes](https://twitter.com/statictimes) Cheers.

<comment><USER2> FYI: One more thing - I've also started Awesome Static - a collection of awesome static site builder / generator tools, directories, showcases, books n more -> [https://github.com/statictimes/awesome- static](https://github.com/statictimes/awesome-static) Cheers. PS: Maybe someone starts Awesome Lektor so I can add it the list ;-)

</comment></comment><comment><USER3> I've just started using Lektor (v1) for a new blog. So far it's been a real pleasure to work with. I've been particularly impressed with the documentation, which is very good for such a young project. Virtually all my questions were answered in docs, including some of the less-common things like how to extend Jinja2 with a custom filter. There was a clear example to do exactly that, which I could trivially adapt.

</comment><comment><USER4> Is it possible to important a jupyter notebook as a page? Pelican had a plugin for doing this, which is why I'm using it currently. However the in-browser editor for posts is pretty nice.

</comment><comment><USER5> How is the template ecosystem going for Lektor?

<comment><USER6> It uses Jinja2 for templates, so that is pretty much its ecosystem.

<comment><USER5> Yes, I'm aware it uses Jinja2. I'm talking about templates like jekyll has to change how the blog looks.

<comment><USER3> I'm currently building a blog with Lektor. I've found it very straightforward (as someone who's done front end work, but not for a few years) to take a static template from html5up.net and adapt it to Lektor.

<comment><USER5> Thanks for posting about html5up.net. Didn't know it existed.

</comment></comment></comment></comment></comment><comment><USER7> @the_mitsuhiko - sorry to hijack this thread, but hope you release some clarification on the way ahead for Flask. I noticed that you created the Pallets org for that (yay.. finally!!)... but its been fairly opaque.

would love to hear about how you see Flask evolving in the future, your involvement with Flask/Pallets and 1.0 release

</comment><comment><USER8> If you're looking for a place to host your static site, my friend and I built Static Hosting ([http://www.statichosting.co/](http://www.statichosting.co/)). You can upload via zip file or we have a command line tool. Also, we are doing free SSL via LetsEncrypt, though it's not fully automated so we are setting that up by hand for new users. It's $5/month per site, so it's less than the cost of a combo meal at McDonalds. If you're interested or have any questions, drop a comment here or email me directly email@example.com.

<comment><USER9> Great business idea, but you have a lot of catching up to do with [https://www.netlify.com/](https://www.netlify.com/)

[https://news.ycombinator.com/item?id=9297316](https://news.ycombinator.com/item?id=9297316)</comment></comment>


Optimizing Tail Call Recursion - <AUTHOR> https://spin.atomicobject.com/2014/11/05/tail-call-recursion-optimization/#

<comment><USER2> I like the visualizations of the stack behaviour.

</comment><comment><USER3> This is cool! Nitpick about examples 2 and 3 - the code should return something in the else case.</comment>


HP expects to cut 58,000 jobs by end of fiscal 2015 - <AUTHOR> https://twitter.com/RANsquawk/status/570346838487736320

<comment><AUTHOR> 44,000 already fired, and all this to continue to fund its now exponential surge in stock buybacks, which in the just concluded quarter was a record $1.6 billion, an increase of 178% from a year ago.</comment>


Longest Straight Line Paths on Water or Land on the Earth - <AUTHOR> https://arxiv.org/abs/1804.07389 <comment><USER2> This is the paper linked from the article being discussed over here:

[https://news.ycombinator.com/item?id=16965650](https://news.ycombinator.com/item?id=16965650)</comment>


1500 New Inventions per Year: The Nasa You Never Hear About - <AUTHOR> https://theamericanscholar.org/the-nasa-you-never-hear-about/#.XPaODNNKjm1 <comment><USER2> In an ideal world these inventions would be licenced freely, on a non- exclusive basis. In fact they are tied up in exclusive licences to gougers and patent trolls. For shame NASA

<comment><USER3> Never heard of this before... Links, facts, examples perhaps?

<comment><USER2> Many of the Government labs do this. LLNL is notorious for exclusive licences. NASA as well. [https://techportal.eere.energy.gov/lab/LLNL](https://techportal.eere.energy.gov/lab/LLNL) [https://www.nasa.gov/ames- partnerships/opportunities/licensi...](https://www.nasa.gov/ames- partnerships/opportunities/licensing)

Major partners will only sign the exclusive licences. Small players the lesser ones. The government prefers the major players</comment></comment></comment>


Physarum Polycephalum - <AUTHOR> https://en.wikipedia.org/wiki/Physarum_polycephalum <comment><USER2> Had to look up a less jargon-loaded description and found this video: [https://youtu.be/7YWbY7kWesI](https://youtu.be/7YWbY7kWesI)

For french speaking: [https://youtu.be/47qiwqKRef0](https://youtu.be/47qiwqKRef0)

Fascinating.</comment>


Important Security Notification from Mandrill - <AUTHOR> http://us7.campaign-archive1.com/?u=7dbb128e376c99ba527a9146e&id=daa104c98f&e=755b670c11

<comment><AUTHOR> "Parts of Mandrill's infrastructure are hosted with Amazon Web Services (AWS), and we use EC2 Security Groups to control access." then "As a result, a cluster of servers hosting Mandrill's internal application logs was made publicly accessible instead of allowing internal-only access."

Does this mean that security groups (ie. firewalls) are the only line of defense between _the internet_ and customer data?

</comment><comment><USER2> Leaving aside the time from incident to post, this is an excellent example of incident disclosure. Technical detail, complete list of mitigation actions, specific info on what may have been compromised, and what they're doing to ensure it doesn't happen again. They don't need to use the old "we take your privacy seriously" cliché; their disclosure and actions prove it.</comment>


Mailchimp by the numbers, 2013 - <AUTHOR> http://mailchimp.com/2013

<comment><AUTHOR> What's going on between Mailchimp and Beyonce?</comment>


Australia's coronavirus tracing app's data storage contract goes offshore to AWS - <AUTHOR> https://www.abc.net.au/news/2020-04-24/amazon-to-provide-cloud-services-for-coronavirus-tracing-app/12176682 <comment><USER2> Seems really unlikely that it would not be stored in the Sydney Region (ap- southeast-2) and encrypted at rest. AU gov has a preferred supplier agreement in place, none of this is very controversial.

There is a lot of confusion because none of the politicians can even word the technology correctly.</comment>


Hackers went undetected in Citrix's internal network for six months - <AUTHOR> https://techcrunch.com/2019/04/30/citrix-internal-network-breach/ <comment><USER2> > Citrix said in a later update on April 4 that the attack was likely a result > of password spraying, which attackers use to breach accounts by brute- > forcing from a list of commonly used passwords that aren't protected with > two-factor authentication.

How did Citrix not have 2FA in place?

<comment><USER3> Haven't read the article, don't know anything about their network. Assuming they use a Windows domain for their corp infrastructure.

Lower level Windows authentication mechanisms can't be configured for 2FA. If your active directory domain is functional at all then at the very least your systems need to be able to talk via SMB and ldap to a domain controller. With sufficient privileges you're able to execute code on other machines via either protocol.

You only need an infected machine, not even user credentials, to be able to perform password spraying or kerberoasting attacks.

<comment><USER4> Not sure what you meant by lower level mechanisms, but you can protect console logins and RDP with 2FA: [https://duo.com/docs/rdp](https://duo.com/docs/rdp)

[https://help.duo.com/s/article/1084?language=en_US](https://help.duo.com/s/article/1084?language=en_US)

<comment><USER5> net commands, kerberos tickets, etc. You can really only 2FA web interfaces, VPNs, RDP and interactive console logons. You can 2FA LDAP, but it's a real pain to do so (I've seen it done).

Just think of any backend protocol that the system uses. The vast majority of those can't be 2FA'ed. This is not Windows specific either. The same is true for most all protocols.

This is why most companies buy firewalls and VPNs and only 2FA the VPN. That meets most compliance requirements and is simple to do. Is it secure? Probably not, but it checks the box (makes audit happy), so buy compromise insurance and move on.

<comment><USER6> You can firewall the backend services and use 2fa to temporarily open them for a specific workstation.

</comment></comment></comment></comment></comment><comment><USER7> I fully assume there are more hacks we don't hear about that ones we do. Not only because of cover ups but it can't be that hard to cover your tracks if you know what you are doing.

<comment><USER8> Its an interesting question. If someone unauthorized was on your network exfiltrating data how would you know?

<comment><USER9> Even more interesting is how the FBI knew they'd been infiltrated before they themselves did? (There's the obvious conspiracy style accusation in that they were already in there poking around... but that doesn't seem to ring true in this regard)

<comment><USER10> Same way any criminal investigator uncovers stolen goods.

</comment></comment></comment></comment><comment><USER11> Security is hard. On the upside, every breach is a chance to learn for everyone else. I hope they release more details on how it happened.

Is there any blog or news that summarizes such post-mortem lessons? Could be a nice project to collect that.

<comment><USER12> There's always [https://catless.ncl.ac.uk/Risks/](https://catless.ncl.ac.uk/Risks/)

<comment><USER11> Subscribed. Also found [https://securereading.com/category/news/latest- hacks/](https://securereading.com/category/news/latest-hacks/)

</comment></comment></comment><comment><USER13> Has anyone gotten that kind of call from the FBI and can shed light on how the process works? Would be fascinating for a outsider and provide a guide on what next steps look like for those poor souls that receive the call in the future.

<comment><USER14> I've been on this call (both sides of it) probably a dozen times by now. Gov agencies are decent at doing research so it's pretty unlikely that the FBI just called their 1800 number or whatever.

Most small start ups don't get to the level where anyone that "big" is looking at them but in the event that something does get flagged the agency will go find their CEO/CTO/counsel on LinkedIn and either message them there or email them. I've never seen an actual vulnerability disclosed in email, if it's a potential legal issue (hello SEC and fintech) they may ask that your lawyer responds to them in writing but more often it's just "this is Agent XYZ with ABC. I have information about your company, please call me immediately."

For someone bigger (like Citrix) the company is _hopefully_ big enough to have a team that is connected to the agencies in someway. Either the agency knows someone who knows them, or they have a designated Security and Compliance team that can handle these inquires.

The real problems come when you're in the middle of sizes - too big to have eyes on every email but too small to have a real security team.

About 5 years I was working for a SaaS company and one of our clients accidentally discovered a pretty serious hole in another company's product. This client wasn't overly tech savy and was basically like "hey is this how this is supposed to work?" when it very much was not... so we killed the API connection and told the client we'd take care of it. It's about 7pm ET by the time we figure out what's going on so we call and email the other company but couldn't find anyone. In the end we got the home phone number of their CTO and had our CTO call him at around 10pm. He thought it was a prank call but once our CTO convinced him this was a problem he was able to get their on call eng to patch it within hours.

Nowadays almost any company involved in security work either has a direct line to FBI/DHS or has a vendor who does. ie if I'm some medium consumer platform I probably don't get to talk to the FBI directly, but if I called up Crowdstrike or any security consulting firm they could do that. In the event that my medium consumer platform was infiltrated by Fancy Bear (and the government decided to tell me, sometimes they don't) an FBI agent would email/call the most likely point of contact for the fastest resolution without causing panic. Lots of time the damage is already done, two vs four hours on a response won't make a big difference in the long term so no need to email info@ or anything.

Over the past 6-8 years the corporation on public/private cyber investigations has definitely changed as red tape has decreased in sharing of info has increased - even more the last 4ish years since the DNC email hacks. I've had a clients get a casual "just a heads up, you should check this out" from the government without no paperwork and no follow up, something that would have been virtually unheard of 8 years ago.

DHS gets a lot of shit in the media (lots of which is deserved) but they've done a pretty good job just opening basic lines of communication and training other agencies that spending 20 minutes looking at a random tip, and following up if needed, is actually a pretty good use of time.

<comment><USER13> Thanks for going to the trouble of creating a new account just to reply, appreciate it!

</comment></comment></comment><comment><USER15> If you'd like a full perspective of the Citrix hack three security people from Detroit discussed it on a recent episode of their show, How they got hacked:

[https://www.youtube.com/watch?v=fMgdrq0xMLk](https://www.youtube.com/watch?v=fMgdrq0xMLk)

<comment><USER16> Did you watch that? They mentioned that they don't know any more than is publicly disclosed how the attack occurred and that they were speculating. That was literally their first sentence about the attack.

</comment></comment><comment><USER17> Having worked with Citrix, I'm shocked. Shocked that they detected it at all...

<comment><USER18> I was going to say the same thing, but it sounds like it was the FBI that noticed it:

 _> [T]he hackers had "intermittent access" to its internal network from October 13, 2018 until March 8, 2019, two days after the FBI alerted the company to the breach._

<comment><USER19> This is extremely common. 6 months is not that long, even among competent companies that have good security. You usually hear about it from the FBI. I think the FBI forwards tips from agencies like the NSA, but they don't tend to give much information.

<comment><USER17> It may be common, but I'll disagree it's common for companies with "good security." Password spraying doesn't work with good 2FA, nor sane login limits. I set off a flag anytime logging in from a new IP, for example.

<comment><USER20> 2FA and login limits alone aren't likely to stand in the way of state- sponsored hackers.

Lots of companies still haven't upgraded to zero trust / BeyondCorp AuthN, and lots of companies don't have reproducible signed build artifacts from CI/CD with automatic policy enforcement regarding the properties that those build artifacts must have before they can be deployed.

High-profile companies that think VPNs and networking rules are a security solution have probably already been hacked and just don't know it yet.

</comment></comment></comment></comment></comment><comment><USER21> If you have anything of value, I absolutely guarantee you that there are hackers in your network right now.

One thing that frustrates me more than anything else is people assuming that their corporate network is safe. Your firewall and your vpc or whatever is a speed bump at best. You have to assume that you have an attacker on the desk right next to you, because you will eventually.

<comment><USER22> That's a really defeatist attitude. There are different levels of "value" and different levels of protection. Not everything is internet facing. Not everything is managed like a corp where turnover requires lots of access changes. Not everything allows you persistence in the network. And not all access is "access".

I really wish we moved past the "everybody's owned" idea. Your defence should be proportional to the value you can lose. You can monitor for the rest. And you can't guarantee the are hackers in my network. (Unless you're saying you're guilty of breaking in? ;-) )

<comment><USER23> I don't think the grandparent says that everyone is owned, but that if your data is interesting enough, your threat model must include employees that are willingly exhilarating data, sometimes for nation states. That your first barriers are therefore assumed to be breached to those attackers.

This of course does not apply if you are not holding on to anything interesting, but it's very easy to become interesting at a certain size, or if you have interesting customers. Still, not everybody.

<comment><USER24> Your threat exposure is not just your network. It's all of your customers and all of your vendors as well.

Recall that the Target POS hack back in 2014 happened because someone hacked the largest refrigeration contractor in western Pennsylvania, then bounced from there onto the Target Partners Online portal with legitimate credentials, and then from there in unspecified ways got onto the POS system. Obviously going from TPO to POS is a failure of Target's network security, but their network perimeter was much larger than just Target computers.

</comment></comment></comment></comment><comment><USER25> You need network sniffer and pattern recognition. Otherwise basically you hope some of the unusual activities will affect ids/ips (or touch internet). However if it is normal account you need some sort of intelligence to recognise and alert.

Not many software can do this.

<comment><USER26> Throwaway, worked at Citrix. The unfortunate thing about this comment is that they sell Citrix Cloud as having the intelligence to detect anomalies exactly like this in your network.

<comment><USER27> Ouch. This page [0] hurts a little bit to read now. Feel free to grab their free ebook though! You'll learn how advanced analytics can help IT identify user behaviors, determine risk profiles, and assess and address potential threats

[0] [https://www.citrix.com/analytics/prevent-security- breaches.h...](https://www.citrix.com/analytics/prevent-security- breaches.html)

</comment></comment></comment><comment><USER28> This might not be the right place for this, but where should one get started with security research?

<comment><USER29> I feel like an answer to this would depend largely on your age, background, and what you are looking to learn.

</comment></comment><comment><USER30> average is 206 days

<comment><USER31> According to whom? That's significantly above what fireeye says (71 until internally discovered):

[https://content.fireeye.com/m-trends](https://content.fireeye.com/m-trends)

<comment><USER30> According to Google search snippet I am totally ready to trust that FireEye estimate is much more accurate

</comment></comment></comment><comment><USER32> >Citrix said in a later update on April 4 that the attack was likely a result of password spraying, which attackers use to breach accounts by brute-forcing from a list of commonly used passwords that aren't protected with two-factor authentication.

Wow. This simply reinforces the fact that humans cannot, and should not, be trusted with actively maintaining security of a system especially if there could be significant economic consequences.

Would a password manager help in this? I don't know.

Probably a hardware token which controls all and any access to a system.

*Removed some ambiguous sentences.

<comment><USER31> I was with you up until the last paragraph, but no. That's not 2fa, that's switching one factor for another.

People should use a password manager with an rng to generate and store passwords. IT departments should run password spraying attacks themselves as well as blacklisting known-compromised passwords. There's really good tooling for this (likely the same tooling this adversary used!)

Separately from this, people should use hardware 2fa tokens whose weakest link isn't the cell phone company support.

Edited for clarity.

<comment><USER33> > People should use a password manager with an rng to generate and store > passwords.

[...]

> Separately from this, people should use hardware 2fa tokens whose weakest > link isn't the cell phone company support.

What would be better is to support certificate based authentication in combination with a username and password. Then you have 2FA without having to share the private key. You can even get 3FA if the private key requires a passphrase to decrypt it.

Using SMS or email based 2FA is not secure (or is only as secure as the email or cell phone account as you already pointed out). Using TOTP requires sharing a secret between the device and the server.

<comment><USER16> A passphrase doesn't make it 3FA, since that is an already used factor class, what you know. 3FA is one from each category of what you know, what you have, and what you are. Depending on the implementation, what you describe may only be 1.5 factor auth.

<comment><USER33> I believe we can agree that just using a username/password for authentication is 1FA (single factor authentication). If we add a one-time token sent via SMS or email, or generated via TOTP, that's generally considered 2FA (with the username/password considered what you know and the one time token being what you have, I believe).

What I proposed was using a client-side TLS certificate in combination with the username/password for authentication. If the private key corresponding to that certificate requires a passphrase to decrypt, then it should be more than 2FA. What you know is the username/password, what you have is the private key. Whether the passphrase for that private key is considered what you know vs what you are is debatable (since, unlike the username/password or one-time token, the secret isn't shared by transmitting it over the network).

<comment><USER16> Many security people will discount everything that someone says once they see that person misapply marketing-phrases to describe security technology.

2FA does not become 3FA when adding a new passphrase to a system that already had a knowledge based entry.

A password for a private key is _never_ considered what you are. You are severely misusing security terms and will mislead people to believe that a proposed solution has greater strength than it really possesses.

<comment><USER33> > [You] will mislead people to believe that a proposed solution has greater > strength than it really possesses.

Then explain how authentication via a username and password validated server side, a client-side TLS certificate validated during the negotiation of a TLS connection between the client and server, and a passphrase validated locally on the client's device is not a better solution compared to typical 2FA implementations using email, SMS, or TOTP.

<comment><USER31> Key-logger on the box your soft cert is on. Soft cert is comprised immediately, fully, and permanently. And you might never know. With email/sms, at least it's possible for you to realize they're compromised, and with TOTP the underlying keymat is likely not on the device so the attacker has to repeatedly win the race.

More importantly, this is also a false dichotomy, as the correct answer here is hardware protection of the private key, e.g. yubikey.

<comment><USER33> > Key-logger on the box your soft cert is on. Soft cert is comprised > immediately, fully, and permanently.

That essentially means the entire machine is compromised and logging into any service would allow the adversary to access them. That would compromise the email and SMS routes. If they have root access to my phone (or whatever I use to store the TOTP secret), that would allow them to generate the correct one time token to log into any service that I use TOTP 2FA with.

> With email/sms, at least it's possible for you to realize they're > compromised

That's assuming I check carefully and often enough. If someone brute-forces my password over IMAP, then they could read my messages without me ever knowing. But I could always check the process list on my computer to determine if a keylogger is installed.

> and with TOTP the underlying keymat is likely not on the device so the > attacker has to repeatedly win the race.

It depends on the application. If someone got access to my phone, they could easily get the TOTP secret out of my GAuth app.

> the correct answer here is hardware protection of the private key, e.g. > yubikey.

Except that it's not universally supported. It's not going to work with my email client nor will it work with my IRC client.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN: Is there a tool to find domain names that form words with the tld - <AUTHOR> I haven't had any luck searching.
Most of the domain name generators or searches are not really what I want because they require me to know the word I want.
I am more interested in knowing if there is a more efficient way of finding domains that: (do not go to these if they exist, they are for example purposes) 1. form a word, like sc.one, a.live, teleph.one, tele.com cyb.org 2. form a phrase or something like it, like chosen.one, code.ninja, onthe.rocks 3. other... I feel like there could be other examples.
I am sure that there would be some that infringe on trademarks but setting that aside.
I was hoping someone might have created something like this but it might be too silly for anybody to have really done. Might just be my keywords aren't lining up to get me good search results. <comment><USER2> First Google result for "domain hacks" : [http://xona.com/domainhacks/](http://xona.com/domainhacks/)

</comment><comment><USER3> Give domai.nr a try

<comment><USER4> I was surprised it takes your search literally. For example a search for "domainer" does not turn up "domai.nr"

I expected it to translate/shorten "ner" to "nr" for this purpose

<comment><USER3> I'm not associated with it but that's a good point- It might be able to find more combinations if it could interpret what's being entered a little more.</comment></comment></comment>


A Course in Machine Learning - <AUTHOR> http://ciml.info/ <comment><USER2> For those who might not know, Hal Daumé III is a highly respected researcher in machine learning, spending a lot of time working in Natural Language Processing (NLP). He also contributes his knowledge to many interesting open source projects. After creating an algorithm called SEARN for solving hard structured prediction problems, Daumé et al. went and created a practical and open implementation of the algorithm in Vowpal Wabbit, an online machine learning library built for speed and used at Yahoo and Microsoft Research amongst other places. He's the sort of academic who contributes not just to theory, but also to practice. Browsing through his publications gives an idea of his contributions[1].

Given all that, I'm looking forward to his take on machine learning and for another valuable resource to be available to everyone.

[1]: [http://www.umiacs.umd.edu/~hal/publications.html](http://www.umiacs.umd.edu/~hal/publications.html)

<comment><USER3> Nice. He was a fellow PhD student at USC/ISI, I remember him being the dude who always walked around barefoot.

Seems like he's done really well since, I will definitely take a look at this.

</comment></comment><comment><USER4> Hal uses this as the textbook for his undergrad machine learning course. Having recently taken that course (in the spring 2013 semester), I feel justified saying that this book needs a _lot_ of work before it's usable as a textbook or even a learning tool. Most of the time this text served primarily as an initial "dereference" of ideas yielding not concrete information, but a series of other pointers that I'd need to chase on Google before getting anything usable.

He clearly has high hopes for CIML, based on all the infoboxes and chapters that are still incomplete; it's a shame he'll likely need to get tenure before finishing it.

(This should in no way be taken as a slight on Hal's teaching; his class was the best sort of challenging in that it required a large amount of work, and yielded a correspondingly large amount of insight. He's also a fantastic lecturer and a fair grader.)

<comment><USER5> > "... it's a shame he'll likely need to get tenure before finishing it."

Judging by his homepage [1] he is at least on the tenure track. Unless the notion of an Assistant Professor is different over in the states. I agree about the sentiment about the book, at least the chapter on Neural Networks needs some serious work (I believe there are errors in there, maybe I should mail Hal). As a person and researcher I only have good things to say about him, do check out it his blog if you are into ML and NLP [2] and let's hope he will find the time to continue polishing on this freely available book (I do like his writing).

[1]: [http://www.umiacs.umd.edu/~hal/](http://www.umiacs.umd.edu/~hal/)

[2]: [http://nlpers.blogspot.com/](http://nlpers.blogspot.com/)

</comment></comment><comment><USER6> I wish more people followed what Hal writes in here :

> A second goal of this book is to provide a view of machine learning that > focuses on ideas and models, not on math. It is not possible (or even > advisable) to avoid math. But math should be there to aid understanding, not > hinder it.

No book (yes not even PRML - Bishop), follows this diligently.

<comment><USER7> This is a harder problem than it sounds, and something I've given a lot of thought to. I think the underlying issue is that all machine learning was discovered through a combination of applied math and intuitive ideas/models. Without the intuitive model no one would have thought to discover the method, and without the math the intuitive idea would be a pipe dream. Both are fundamentally linked, and it's a bad idea to separate them.

For example, one of the most basic and oldest statistical methods is linear regression. The first thing anyone will tell you when they are teaching it is the basic "idea and model" \- finding a line that fits a scatter plot (and then extending that idea). But this doesn't give you a real understanding of linear regression: where does that line come from, and why does a clean, algorithmic solution exist? Why does the standard solution often lead to numerical errors, and why is regularization a valid solution?

These questions require an increasing amount of math, but they are essential to really understanding linear regression. I agree that some textbooks just throw you a wall of math, but many actually do a solid job of explaining what is going on as they do so.

If you don't want to know the details of machine learning methods, which are inherently mathematical, you might as well as just remember the names of libraries that implement the solutions for you.

<comment><USER8> Completely agree. However one thing that I think is missing in most books with a lot of math is the opportunity to use programming to help teach and communicate the math in question.

A great example of a book that communicates abstract mathematical concepts via algorithms is the Little Schemer. Ironically, it doesn't even set out to communicate the math, but actually just uses the math to communicate other programming ideas like recursion. That, however, doesn't diminish the fact that it demonstrates ways to teach math through programming and algorithms.

Another book which also does a good job at using programming to demonstrate more concrete math is Allen Downey's "Think Stats" book. All through the book, you learn the mathematical concepts of statistics through hands on programming activities.

There definitely is a chicken and egg problem in areas like machine learning because unlike the above resources which have only one layer of abstraction to cross, machine learning presents two layers of programming<->math abstractions to cross for most people who decide to learn it. To really understand and apply machine learning you need to understand the math and models behind it. However the math and models are presented in pure form that makes it difficult to grok unless you arrived at the resource with a classically-trained mathematical background. I would hope that given that the target market for such learning resources it not mathematicians but programmers, that such learning resources would present content to help you arrive at the math from a programmer's point of view.

</comment></comment></comment><comment><USER9> Edx is also offering the caltech ML course in mooc format: [https://www.edx.org/course/caltechx/cs1156x/learning- data/11...](https://www.edx.org/course/caltechx/cs1156x/learning-data/1120)

<comment><USER10> Note that this is not a watered-down course! It's the same course as the students at Caltech are taking, and in fact they will have the option not to attend the lectures and watch them online instead. The homework assignments will be the same ones as well (AFAIK).

</comment></comment><comment><USER11> If you are interested in this you might want to also look at Andrew Ng's (Stanford) Machine Learning course that is starting soon on Coursera.

[https://www.coursera.org/course/ml](https://www.coursera.org/course/ml)

<comment><USER12> Is this worth going through over picking up a textbook or two? I've found that Coursera courses are actually quite bloated. Lots and lots of empty talking, and very little substance.

<comment><USER13> I've taken the Coursera ML class. It's very easy if you have the adequate math background. And it's not very comprehensive, there are lots of machine learning methods that are not covered. So it's more like an introductory course to machine learning.

But it's absolutely commendable how Andrew Ng takes the topic to such an understandable level that a clever high schooler who knows a little about programming could take the course. There's even extra videos serving as a crash-course to linear algebra and octave programming in the first week.

So he really manages to make the topic accessible to a very large audience.

<comment><USER14> >adequate math background

Do you know what kind of math is needed other than linear algebra.

<comment><USER13> Basic vector and matrix operations. The first half of a typical freshman linear algebra course is more than enough. But like I said, there is a matrix review in the beginning, so if you're willing to study those extra lectures, then almost no prior knowledge is needed.

Also being able to take derivatives helps in a couple of places, but is not necessary.

<comment><USER15> Thats linear algebra.

</comment></comment></comment></comment></comment></comment><comment><USER16> Just wanted to add another textbook option that's of comparable breadth and quality, but easier to read than bishop. There are pre-print pdfs probably available online with a little searching. The exercises and accompanying data are really fun imo. [http://www.cs.ubc.ca/~murphyk/MLbook/index.html](http://www.cs.ubc.ca/~murphyk/MLbook/index.html)

<comment><USER17> It's an excellent book, good balance of rigor and code/graphs/visuals to develop intuition, but pls see errata before buying

[http://www.cs.ubc.ca/~murphyk/MLbook/errata.html](http://www.cs.ubc.ca/~murphyk/MLbook/errata.html)

(and the freely available content books by Barber, McKay and Hastie/Tibshirani/Friedman (ESL) are all worth close reads

</comment></comment><comment> UK-AL I think he needs to re-run latex a couple times before releasing that pdf. Fair few ?? in there...

<comment><USER18> The lines are not properly justified, so it appears that the output is not generated using TeX. I fail to see why would anyone choose left flushed alignment (with hyphenation!) when using TeX?

</comment></comment><comment><USER19> The book seams accessible.

This subject is difficult and requires a lot of time to understand and put something useful into practice. AI books appear frequently these days. I feel that most of books and tutorials fail to deliver good practical examples and meta-code, focusing more on mathematical proofs.

I am struggling to understand Peter Abeel's aprenticeship learning: [http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.74....](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.74.1035&rep=rep1&type=pdf)

He can resume the thing in a couple of slides. It seams short and simple (!?) but I think I am still away from truly understand it. Maybe next year.

</comment><comment><USER20> The pages are watermarked, "Draft. Do not distribute". I wouldn't rely so much on these lectures unless they stabilize.

<comment><USER21> Doesn't make them any less worth reading.

<comment><USER22> If the content is wrong or suboptimal it makes them less worth reading. If the guy hasn't spent time thinking about the content of his slides it might be a confused and confusing jumble of nonsense: sometimes the best researchers are the worst teachers.

</comment></comment></comment><comment><USER23> please change the logo! I'm not trying to be jerky, it's always remarkable that someone wants to share his knowledge and I know probably it's not your priority, but the book and website will be better off without it.

also why do you have the topics "introduction to machine learning" and "decision trees" in the same chapter?

</comment><comment><USER24> this looks like a pleasant introduction to machine learning</comment>


23andMe for $99 - <AUTHOR> https://www.23andme.com/

<comment><USER2> "*Requires a recurring Personal Genome Service subscription at $5/month. 1 year contract required. Order for $499 with no subscription commitment."

So it's really $159, with another $60 paid every subsequent year as long as you want access to the data (and any new things which they might provide). If you're expecting to subscribe for longer than the next 80 months (six years and eight months), then it might be better to get the normal $499 version. Although, on the page about what the PGS subscription gives you, it mentions discounts on future things, like moving from genotyping to full sequencing, so perhaps it would be worth it. Not quite enough information to say, really.

That said, I'm all for lowering the barriers to people knowing about their DNA, and $5 a month is pretty small compared to many other things (phone contracts, for instance, or getting coffee every morning).

<comment><USER3> > with another $60 paid every subsequent year as long as you want access to > the data

Can you clarify? Are they going to let me get the raw data, or are they holding it hostage and just telling me higher level results from it?

<comment><USER4> Being a current member, I believe you do have access to the raw data though I haven't downloaded mine yet.

<comment><USER5> You do. I have done it. There are programs that can parse this information and correlate it to other information sources such as snpedia.

</comment></comment></comment></comment><comment><USER6> For those concerned about privacy, it's buried on their How It Works page. I'd strongly suggest to the company that such info might be worth placing on the front page.

According to the site, the Genetics Information Nondiscrimination Act covers the data provided and ensures you can't be discriminated against in employment or health insurance matters. Though I don't know anything about the GINA beyond the information they provide, this seems to leave out issues of end of life care (IE, can a family member use legal discovery mechanisms to get at info about potential up-coming medical problems in later life as a means to halt usage of a ventilator should you become comatose?) and probably some other things.

<comment><USER7> GINA could be repealed. It was legal for gay couples to marry once and now it isn't. _(at state level here in CA, admittedly - but laws can be repealed at any level)_

Given that the health and the insurance industries have some of the most powerful lobby groups around, I'd be concerned that GINA isn't a guaranteed law for the rest of the life of this data.

If I do this _(I'm considering it)_ then I would do it as John Doe with my PO Box, freshly created email address, etc. Getting kinda OT but there is a similar chain of thought when you get STD/HIV testing that you should do it as a John Doe for similar reasons.

</comment></comment><comment><AUTHOR> Note that there's a new $5/month subscription fee, with a 1 year minimum commitment.

<comment><USER8> Definitely noted. Also, still prohibitive for international users due to high shipping cost.

<comment><USER9> To give you guys a reference point:

It's $62.95 for shipping it to Germany. Ouch.

<comment><USER10> This includes a prepaid Fedex envelope to return the sample though, so it amounts to €23 each way which isn't that unusual. Last time this offer was on (without the $5/month recurring payment mind), I noticed on Ebay a while later that some smarts were selling the kits $300. The $5 puts me off doing that though. I wonder if they'd sell as easily.

<comment><USER11> If you order more than one, you even get an enveloppe for every kit to send them back seperatly. You get another free kit if they can't read your sample. The shipment fee doesn't increase with the number of kits you order.

</comment></comment></comment></comment></comment><comment><USER12> The State of Maryland has blocked 23andme from providing services here. See [http://www.genealogyreviewsonline.com/genealogy_reviews_onli...](http://www.genealogyreviewsonline.com/genealogy_reviews_online/2008/10/23andme ---gen-1.html)

I'm curious whether folks who have used this service found it valuable? This customer didn't seem to think so; she compared it to a horoscope reading: [http://subtlenuances.wordpress.com/2010/08/08/getting- person...](http://subtlenuances.wordpress.com/2010/08/08/getting-personal- genetic-testing-for-health-disease-ancestry-dna-test-23andme/)

</comment><comment><USER13> I'm more than happy to have a conversation here about genetic testing (hey, Carbocation!) - but this is just an advertisement.

<comment><AUTHOR> An advertisement that a lot of HNers want to see. Last time it was $99 many people on this site were pleased to know: <http://news.ycombinator.com/item?id=1288125>

<comment><USER14> Such is the fickle contradictory nature of some geeks.

Down with advertising! Adblock for all! ooo! a pretty advert for geek fortune telling! Count me in.

<comment><USER15> Rather that is contradictory nature of advertisement.

</comment></comment></comment></comment><comment><USER16> Weird request. I really wanted to do this for the longest time, but waited hoping that the price will one day go down. This is exactly in my budget range, but I don't get paid (and have to deposit to my online usage only bank account) till the first week of December. Can any nice guy trust a fellow HN- er till the first week of December?

I am also on reddit with the same username. Let me know if anyone can help, my email is pavs.ma (@gmail).

<comment><USER9> Send you an email.

<comment><USER16> Thanks! I just sent you an email looks like I can't do it from NY.

If anyone has any ideas what I can do, here is the email I sent him:

\</comment></comment></comment><comment></comment><comment>-----

Hey Christian,

Thanks for the email and willing to do this for me. I just checked to see if I can pay with paypal, it only gives option to pay by card. If I get money on paypal then I will have to transfer it to my bank account and the process takes about 4-5 days (last time I tried it) by then the deal, which is valid till the 29th, will expire.

To make things worse, in the process of doing the checkout I was informed that they have a legal issue for shipping spit samples to NY. :( <http://i.imgur.com/hYgzw.png>

I might be out of luck for now. But thanks for the offer. I really appreciate it!

Cheers, pavs

\</comment><comment></comment><comment>----

<comment><USER16> Wait... if I send them from NY there is no way for them to verify it right?

<comment><USER17> DON'T! They tell you they don't accept samples mailed from NYS.

Take the PATH to NJ and mail it out from there :)

</comment></comment></comment><comment><USER18> I'd love to do the test to learn about my genetic heritage, but I'm far too afraid of what it might say about disease risk.

Suppose it comes back with a genetic marker for something like Parkinson's. What do you do with that knowledge? You can't just cut down on cholesterol or exercise more - if it's coming, it's coming. All you'd do is spend the rest of your life with a terrible foreboding you can never escape.

<comment><USER7> First off, it can't tell for certain - just that you have a high percentage chance of getting Parkinsons.

Now with that information, you might decide to live more of your life now... You might decide to have children earlier knowing that you will see the grow up before you enter the risky phase in your life when you could develop the condition.

Like Sergey Brin is now doing, you might pay close attention to the research of the condition - perhaps even donating more.

</comment></comment><comment><USER19> Does 23andme allow users to get their data out? I.e., get them in some raw format that one could use to correlate with other studies you might find, or put them into some other service?

<comment><USER20> For now, yes: <https://www.23andme.com/you/download/>

A great resource for that sort of analysis is SNPedia (check out the main page as well): <http://www.snpedia.com/index.php/23andMe>

<comment><USER21> Neat! How is the data presented? How big is the file?

<comment><USER20> The above SNPedia link goes into greater detail, but the data come as a tab- separated file a few megabytes in size. For the older Illumina reports, the data files were about 5MB, but the newer chips may make files closer to 10MB. (550k vs 1m SNPs, respectively)

</comment></comment></comment></comment><comment><USER22> "You'll earn upgrades as we move from genotyping to full sequencing" -- so AFAIK, right now 23andme are comparing your DNA data to the one of the human genome project and providing you with the percentage of how many people from genome project, having similar DNA sequences, had one disease or another. I wonder, once the sequencing advances, will the info provided by 23andme be detailed enough so to take the full advantage of the new methodologies of sequencing? In other words - will the science of genetics improve only in the interpretation of the DNA data, or in collecting more detailed DNA data as well?

</comment><comment><USER14> Isn't this just fortune telling or astrology for geeks?

<comment><USER23> Not if you're planning to have kids and want to see if you have any recessive mutations to look out for, like CF or Tay-Sacs.

They also trace your mitochondrial DNA and Y chromosome so you can see where your maternal and paternal lines originated, if you're interested in that sort of thing.

The part you're referring to is probably the disease risk section, where they show you your comparative risk of various diseases compared to the population. This is simply a better resolution version of your family history of disease, which a doctor will ask you if you ever go to one. Are doctors fortune tellers?

<comment><USER24> To really understand the output of 23andme will take a lot more study and I think that if you're going to let it influence your life's decisions at that level that you should be prepared to spend a substantial amount over and beyond the initial fee here to have the results interpreted by a professional that is able to put them in to the proper perspective.

23andme is expensive infotainment without the required education in both the genetic and the mathematical/statistical background.

<comment><USER25> I couldn't disagree more. Knowing more about your body is _always_ a good thing -- the fact that many people won't know what to do with that information is inconsequential. It may not make sense for many (most) people to buy into 23andMe, there are a lot of people out there that can understand this, or at least find it interesting to be able to peer into their genetic makeup.

<comment><USER14> Surely if the average person is told "There's an X chance you'll die. There's a Y chance you'll lose a leg. There's a Z chance you'll be blown up", they'll worry unduly no matter what X,Y,Z are.

I can see what you're saying, that if you're a qualified doctor, or have studied medicine for years, then 23andme could be useful, but for everyone else, I think it could be very dangerous.

</comment></comment></comment></comment></comment><comment><USER26> There is another interesting startup in similar space from Australia.

<http://mygene.com.au>

Mygene offers reports for budding athletes to understand their gene structure better and provides guidance on tuning your training to fit with your genetic findings.

Disclaimer - my company did entire IT and lab automation work including implementing report creation algorithms.

</comment><comment><USER27> Used to be $99 last year on the DNA day without the required subscription.

</comment><comment><USER21> Does anyone know if 23andMe will be able to patent parts of my gene sequence? (<http://en.wikipedia.org/wiki/Gene_patent>)

Edit: It's genotyping, not sequencing, so the answer is no. Leaving the question here in case someone else wondered.

<comment><USER28> Regardless of how your genome sequence is read (by genotyping or sequencing), there's the potential for gene patents to be filed based on associations that are discovered between certain genetic variants (e.g. SNPs, which are the variants typically read during the genotyping process) and traits of interest, such as diseases. The big question is whether the USPTO will continue to grant such patents--the ACLU is challenging this premise now in a case against Myriad Genetics, [http://www.aclu.org/free-speech-womens-rights/aclu- challenge...](http://www.aclu.org/free-speech-womens-rights/aclu-challenges- patents-breast-cancer-genes-0).

</comment></comment><comment><USER29> It's probably worth getting if you're a woman or have a known family history of a genetic disease. 10% of women end up getting breast cancer, and this is sometimes due to a BRCA1/BRCA2 gene mutation. You can take preventative steps if you know this.

<comment><USER30> It's probably worth getting if you're a MAN or have a known family history of a genetic disease.

Prostate cancer is out there. Quit smoking, eating Red 40 food coloring, and remember...we're here to put a dent in the universe with the time we have!

</comment></comment><comment><USER31> Has anyone used this and found it useful? It seems awesome from a geeky point of view but I'm still having a hard time understanding the value of it.

<comment><USER32> Basically it tells you whether you have the most common mutations of the breast cancer gene and the Parkinson's gene, each of which means an 80% chance of getting that disease. It also tells you whether you have the most common mutations of the diabetes gene, which means that your risk of getting diabetes goes from 20% to 30%. Beyond that everything else just tells you that your risk of some obscure disease has gone from .1% to .15% or from .1% to .08%. So if you find out that you have one of the big three things they test for then there are things you would want to start doing to reduce your chances of actually getting those diseases, but if you've already been tested for those things then it's just for entertainment.

In general though the tests are much less accurate than the ones you would get from a doctor because they only do a couple of the most common mutations, so if you want to use your DNA for making health decisions then you still need to make an appointment with a clinical geneticist who specializes in whatever you think you might have or be at risk for. (E.g. breast cancer, metabolic deficiencies, etc.)

</comment></comment><comment><USER33> Who's figuring out shipping at 23andme... It costs about the same amount to ship the package to Canada as it does to get the tests done.

</comment><comment><USER5> Also note that they have recently approximately doubled the number of SNP's genotyped.

</comment><comment><USER30> Gattaca.

That being said, I ordered one last Wednesday.

</comment><comment><USER34> @sorbus getting a coffee or getting bleeding edge information about my health based on my DNA...it's a no brainer.

<comment><USER35> What is with the @-replies recently? On mailing lists, here… use the reply link.</comment></comment>