The Great Career Debate: Google Versus Goldman - <AUTHOR> http://www.inc.com/kimberly-weisul/the-great-career-debate-google-versus-goldman.html <comment><USER2> "Would you rather have your children engineering the financial system creating more problems for us, or having a chance of saving the world?"

Yep the financial system has a whole host of problems that everyone knows but "saving the world" is just meaningless marketing mumbo jumbo for SV - lets be clear that Google is not saving the world nor is any other SV company. We by and large push ads in exchange for information - its a valuable business model but lets get over ourselves.

<comment><USER3> Perhaps it is a bit exaggerated but I don't think anyone would argue with a straight face that GS does more good in the world than Google.

To me this is a question not of intelligence, IQ, or ability but rather morals and soul. There are so many great individuals who propelled the world forward into a better state because they make a conscious decision to use their gifts for the betterment of fellow human beings.

Goldman Sachs' culture does NOT encourage that. In fact, if you have even a tiny amount of that within you, it will crush it with the power of a thousand black holes.

<comment><USER4> Not Google, but I did move from Apple to GS. At Apple I felt like I was making toys for first world adults. Nothing I did really did much to improve the situation of anyone unless they were interested in renting movies on iTunes.

Whereas at GS, I was writing software to sell municipal and corporate bonds. Companies and city infrastructure were funded more cheaply as a direct consequence of my work.

There was simply no comparison between the two, my work for GS was far better for society.

<comment><USER3> You may find the work more rewarding personally but I seriously doubt that GS is due any credit for it. If any good comes from work done by GS it is certainly a by-product that simply can't be helped.

</comment></comment></comment></comment><comment><USER5> > Wadhwa began by launching into the myriad recent sins of the financial > industry: credit default swaps, a housing bubble, and widespread economic > meltdown, for starters.

The "financial industry" may not be a brotherhood of saints, but someone who is going to claim that CDS is inherently bad and the housing bubble and economic meltdown were the sole product of the "financial industry" clearly hasn't done his or her research.

> Gregory Ferenstein, a writer for TechCrunch and one of the moderators, then > asked if there was any good in the great majority of the finance industry. > Wadhwa answered a flat no.

Given that so much of the wealth in Silicon Valley derives from the ability of founders and employees to turn equity into cash, this is an ironic position. I mean, is Wadhwa completely oblivious to the fact that GOOG $1,000 gives Google an even greater ability to recruit and retain the best and the brightest?

> He also claimed that the costs of starting a company have become so low that > investment bankers are hardly needed to support them.

Starting a company is one thing, but growing a company is another. Look at the amounts that were (and are being) poured into companies like Twitter, Pinterest and DropBox in their later rounds. It's no surprise that names like Goldman Sachs, Fidelity and Allen & Company are on the investor rosters.

<comment><USER6> > _Wadhwa began by launching into the myriad recent sins of the financial > industry: credit default swaps, a housing bubble, and widespread economic > meltdown, for starters. The "financial industry" may not be a brotherhood of > saints, but someone who is going to claim that CDS is inherently bad and the > housing bubble and economic meltdown were the sole product of the "financial > industry" clearly hasn't done his or her research._

Sorry, but I see that as entirely true. When they say _the industry_ I understand, the industry's giants along with smaller players. And the Industry Giants were the ones that gave Triple A to Lehman Brothers (Moodys, Fitch, S&P). Lehman was owning on toxic assets, Goldman Sachs made a hostile take over with the help of the US Gov, who choose to go against all sorts of neo- liberal preaching to save GS because _it 's too big to fail_. I see that industry as inherently bad for the USA and our planet!

And GS might be the worst example of corporate bullying, unethical acting and government infiltration (by far), but European banks are acting with the same disregard about anyone else except themselves.

So I don't think it's not far-fetched to say that: _The financial industry is the root of today 's world trouble_.

</comment></comment><comment><USER6> I firmly believe that Google "is Evil". But not _that-evil_. Nowhere near Goldman Sachs[2]. GS is the Master of Puppets[1].

Quotes like " _Finance is the place you can make your mark on the world. It has to be a personal commitment, because you won't get credit for it. . . But you will know inside that you have made things happen on a bigger scale than you could at Google._ " are plain ridiculous. I can think of several _good things_ done by Google. Maybe not for the good of man-kind or some other honorable cause, but I can't recall a single finance giant acting for the good of ANY community.

Stiglitz and Krugman wrote many articles (and books) describing how wall street is heavily flawed, praising arrogance and malpractices by paying huge totally undeserved bonuses to people who never did any _real work_ in their lifespan.

Working in finance, is like saying that you create money out of thin air, because that's what you do actually. The better you are at convincing people that shit is gold, the better you are, the more money you make and so on...

[1]: [http://www.youtube.com/watch?v=WEL6_SuQCu8](http://www.youtube.com/watch?v=WEL6_SuQCu8) [2]: [http://www.rollingstone.com/politics/news/the-great- american...](http://www.rollingstone.com/politics/news/the-great-american- bubble-machine-20100405)

<comment><USER7> _but I can 't recall a single finance giant acting for the good of ANY community._

Consider another interpretation. I don't think Shiller is saying that finance acts altruistically. I think that Shiller is claiming that finance does add intrinsic value to world.

personally, I think that most banking professionals can't clearly articulate the value of finance. But there is clearly huge value to society of having skilled financial professionals.

The trouble is its usually intangible. The invisible hand and all.

To think up one hypothetical example ... say we had ethical and talented bankers who foresaw the housing bubble and therefore steered their banks away from financing home development in the Nevada desert. That could be immensely valuable and could have saved society billions of dollars that was wasted on homes no one wants.

</comment></comment><comment><USER4> I guess I'm uniquely qualified to comment on this, having moved from Apple to Goldman Sachs.

At Apple I made toys for rich people. The only people I helped where those who rented a movie on iTunes.

At GS I wrote software to help sell corporate and municipal bonds. My work at GS directly made corporate expansion and city infrastructure cheaper to fund.

Without a doubt, my work for GS was far better for society.

<comment> Link- [Edited] You mean, you helped make rich people richer ..

<comment><USER8> As well as financing the construction of municipal infrastructure. Get over yourself.

</comment></comment></comment><comment><USER9> I think it is sad that our some of our brightest minds are hard at work trying to get people to click on advertising links.

<comment><USER10> For most of human history, the brightest minds were hard at work coming up with new ways to kill people. (No, I'm not trolling you. For every brilliant mind in science, there were scores in warfare.) Advertising and finance are progress.

I agree that it would be better if those people were working on clean energy and cancer research, but I don't think the situation is that bad, compared to the historical norm.

</comment></comment><comment><USER11> One good point made on the finance side is that you have a huge impact because of the size of the deals involved. The scale is much bigger than Google.

It also takes a certain viewpoint on free markets that most people lack, to see the good that finance does. For example, buying a company with a low share price and liquidating it would be a net plus, but seeing this relies on rejecting common falsehoods, eg that jobs are an externality.

The best argument I saw for working in tech came from a promotional video for an investment bank! One analyst is being interviewed, and she says how she spends all her time analyzing companies, but it would feel more "honest" to be actually doing the work that these companies do. While finance does add value to the economy, being so far removed from the coalface may feel less rewarding.

</comment><comment><USER12> Both Google and Goldman are corporates. How about adding Pfizer to the mix? The result doesn't change. It doesn't matter what they do, their priority is not saving the world, even as a side effect. If you want to save the world, you are on your own. Non-profits? Maybe. Or a tiny company where you can have influence on the company's direction. But, not in a corporate, unless you drink your Kool-Aid everyday, then it is a different story.

<comment><USER13> I'm glad you threw Drug companies in the mix. I used to think that was the one industry that followed scientific principals--boy was I wrong.

</comment></comment><comment><USER14> Quants are a small fraction of the overall finance jobs landscape. At a finance feeder school, like the LSE, there's not much overlap between those who could work at Google and those who could work at a bulge bracket investment bank. Most simply don't have the technical skills for the former.

</comment><comment><USER15> Most people here disdain finance. However, it seems to me finance is still a pretty vital industry. It's not only about making money out of "thin air" or a game of greedy shallow minds equipped with social capital. I will defend for it that it's also a means of the society to distribute the limited resource to where it sees the most promising future and payback. It's the people in finance decide that if a billion dollars will be invested in a luxury hotel or DNA sequencing research. Why do you want to leave these vital decisions to those greedy and ignorant people instead of those brightest students who may make a change with their knowledge and make wiser decisions for the society?

</comment><comment><USER16> I may be biased (being a Google engineer in the New York office) but if you actually want to contribute something-- _anything_ \--to the world, if you want to enjoy your job, then Google wins hands down.

I have a finance background and previously worked for UBS and in retail and wholesale stockbroking. I fully understand the role of, say, market makers in the financial system (ie providing liquidity).

I hear those same arguments being used for HFT but honestly they don't really stack up (IMHO). I don't really see HFT doing anything harmful however so ultimately I don't really care. I can see the appeal from a technical background of being a quant. It must be a challenge and I'm sure you can make a lot of money, which is fine, but it doesn't really contribute anything to the financial system.

The real problem I have with Goldman (and their ilk) is the serious crises they've instigated all the while banging the drum of contributing to the financial system.

This includes the subprime crisis [1] [2]. Goldman wasn't as guilty as some but its hands weren't clean either. You'll often see the "don't hate the player, hate the game" defense here. Sorry, no sale. You're accountable for your actions regardless of the incentives.

More disturbing is that Goldman (and their ilk) is _killing_ people in the name of profit [3] [4]. Sorry, but that's morally reprehensible no matter how you look at it.

Now US regulators have made at least five mistakes (IMHO) when it comes to financial regulation:

1\. 30+ years ago allowing investment banks, once partnerships with unlimited liability, to incorporate and have limited liability for their actions;

2\. Not allowing investment banks to fail ("too big to fail" like Merrill Lynch). Bailouts of investment banks could reasonably be described as welfare for investment bankers;

3\. Allowing banks to take positions as well as operate as market makers. There really should be strict separation here;

4\. The carried interest tax treatment of hedge funds that mean executives pay less tax (as a percentage) than most of the population. Congress really has been bought and paid for here, most notably Sen. Chuck Schumer (D-NY) who has steadfastly broken with party ranks to resist carried interest reform [5]; and

5\. Strict regulation on commodities market to separate speculators from hedgers. Driving up food prices causing untold misery even death should result in criminal liability for the organization and key personnel.

So work for Google. Don't work for Google. Whatever floats your boat. Ultimately (IMHO) I think Google has a net positive effect on the world.

Whatever you do, as an engineer, I strongly believe you should stay away from investment banks and hedge funds as you're actively contributing to misery in the world at this point.

[1]: [http://dealbook.nytimes.com/2013/08/12/in-one-bundle-of- mort...](http://dealbook.nytimes.com/2013/08/12/in-one-bundle-of-mortgages- the-subprime-crisis-reverberates/)

[2]: [http://money.cnn.com/2010/04/24/news/companies/Goldman_Senat...](http://money.cnn.com/2010/04/24/news/companies/Goldman_Senate_documents/)

[3]: [http://www.theguardian.com/commentisfree/2013/may/23/goldman...](http://www.theguardian.com/commentisfree/2013/may/23/goldman- sachs-agm-drive-food-prices-up)

[4]: [http://www.fool.com/investing/general/2013/07/23/how-big- ban...](http://www.fool.com/investing/general/2013/07/23/how-big-banks-are- driving-up-the-prices-of-practic.aspx)

[5]: [http://www.nytimes.com/2007/07/30/washington/30schumer.html?...](http://www.nytimes.com/2007/07/30/washington/30schumer.html?pagewanted=all)

<comment><USER17> > I have a finance background and previously worked for UBS and in retail and > wholesale stockbroking. I fully understand the role of, say, market makers > in the financial system (ie providing liquidity).

> I hear those same arguments being used for HFT but honestly they don't > really stack up (IMHO). <snip> It must be a challenge and I'm sure you can > make a lot of money, which is fine, but it doesn't really contribute > anything to the financial system.

These two statements stand in direct contrast. If you understand the role of market makers then you should understand that the most popular HFT strategy is to be an electronic market maker. It's about competition for liquidity provision which tightens spreads which reduce the cost of trading for everyone.

> 2\. Not allowing investment banks to fail ("too big to fail" like Merrill > Lynch). Bailouts of investment banks could reasonably be described as > welfare for investment bankers;

This would have caused the collapse of the global economy. Google would have suffered mightily from the following depression. Companies like ML might "deserve" to be punished and that process is now working it's way through the courts, but that bailout cost a lot less than 25% unemployment.

> 3\. Allowing banks to take positions as well as operate as market makers. > There really should be strict separation here;

By it's very definition, a market maker must take proprietary positions.

> 5\. Strict regulation on commodities market to separate speculators from > hedgers. Driving up food prices causing untold misery even death should > result in criminal liability for the organization and key personnel.

Hyperbole. There's never been any evidence that speculation on commodities is "driving up food prices" let alone causing "misery event death".

</comment></comment><comment><USER18> This Apple iPad Air commercial is timely. (Yes, I'm lumping Google and Apple and all engineering companies together.) [http://www.youtube.com/watch?v=o9gLqh8tmPA](http://www.youtube.com/watch?v=o9gLqh8tmPA)

Somebody should juxtapose this quote with this ad right after.

</comment><comment><USER13> I had a girlfriend in college who couldn't wait to put on the pants suit and become a money manager. Whenever I get nostalgic I check out her corporate picture, and cringe. She used to say if she was a man, "people would encourage my desire to rise to the Top!" Yes dear, but don't expect me to be hang around. On the other hand at least she didn't wear emo glasses and hide behind some phony non-profit. Yes--how you make your wad does matter. Just because it's legal doesn't make it copacetic.

<comment><USER11> What was your point?

</comment></comment><comment><USER19> False Dichotomy.

Bright people should start their own companies.

<comment><USER10> _Bright people should start their own companies._

Yeah, I'm a real fan of that search fund made available to everyone with a 140+ IQ at age 23. I would have taken part, but I was too busy shitting golden unicorns that weekend.

</comment></comment><comment><USER20> Interestingly, the largest employer of mathematicians in the world isn't Google or Goldman Sachs.

It's the NSA.

</comment><comment><USER21> I'd rather they become politicians and create a new order of technicrats.

</comment><comment><USER22> I suggest googling "Goldman Sachs starvation".

</comment><comment><USER23> Why not go meta?

Sure, a company like Google directly does more good than Goldman. (Although, trivially, you could argue a taco stand does something arguably more important than inverse-indexed search) Non-trivially, though, in order for a company like Google to get financed, it needs to have investors. Now, you'd be right that this doesn't necessarily require bankers, but it does present an interesting problem.

When an investor makes an investment, she wants to make more money than she put in. Else, why do it? Ok, so the simplest possible way to get more money than you put in would be to just let the invested business produce cash from profits and receive distributions over time. Ok, great, but what if that takes 20 years and you need the cash sooner?

The other option is to sell the stake to someone else. But the second you do that, in fact, the second you even offer to do that, the person on the buying end has the same worry. The only possible way for this to work is for there to be a bunch of other people who are willing to buy or sell at a certain amount at a certain price. That, my friends, is a market.

But what if there's no one out there to buy or sell your stake? Or what if there's very few? You need a market but there is none. Well, what if a person could somehow _make_ a market for you? Someone, who, because of their deep knowledge of your company, companies like yours, the way markets work generally, and a view of the future state of markets could come in and say, "Hey, listen, I know there's not a lot of people out there right now who are willing to buy or sell, but I'm willing to buy X shares of your company at Y amount and sell X shares of your company at Y + Z amount." You, as the investor, are loving it since you don't have to tell someone upfront, "Hey, I'm saying my entire stake, what's the price?" Because that would be extreme adverse selection and would lower your price. And further, you don't have to say, "I'd like to double my share," thereby hinting you know something and the price should be higher. A market is made: there's a standing price to sell at X, and a standing price to buy at Y.

This actually happens all over the place. Facebook, amazon, google, et al. make money by being platforms for other people to create content. Facebook as a platform is obvious. For google, they are really the platform for the internet itself. No matter what firm w're talking about, the only way for content-creators to be willing to share is if there are enough people to consume/listen. And for there to be enough people to listen, there has to be someone who aggregates. And for someone to aggregate it necessitates a huge amount of upfront investment. Meaning, for example, that Facebook had to build itself before a billion people used it. Yes, this was in stages. But at each stage, it required a huge amount of risk _before_ other people were there to use it. The same with google. Same with amazon. You see, these firms are _underwriting_ the act of sharing content. Their knowledge of the eventual payoff allows them to buy the time, commitment, etc before there is an obvious customer. They have made a market.

Now, while Google, Amazon, and Facebook are doing this for things on the internet. Goldman is doing it for the Googles, Amazons, and Facebooks _themselves_. Goldman is providing a platform for the businesses _in general_. And, not only that, for anything that has substantial future cash flows!

It might seem that anybody could do this. Like why not Tim Ferriss on Angellist-Underwrite? That isn't so clear. The only reason Goldman can afford to post a bid and offer (i.e. make a market in cash-flows generally) is to have a better idea of the value of that something than whomever they are transacting with. Goldman has to think, "Ok, we'll buy/sell at x/y price because we know the real price that is z and so we can make money by offering the spread x - y." And guess what? In order to know that, they have to spend what seems like a life-wasting amount of time getting into the minutiae of esoteric financial knowledge. Because, remember, it's not that the market- maker is just connecting buyers and sellers. The market-maker is actually fronting the money--bearing the risk, by posting a bid and offer--in order for there to be a guarantee of the market. So the stakes are huge.

Now, in the future, it _will_ be Tim Ferriss on AngelList-Underwrite. But he will hire 10 guys/gals to help him analyze markets. And then will he will get a lot of software to help aggregate information. And then he will want to be near the action, so he'll get an office in SF. And before you know it, he will be Goldman Sachs in jeans.

In the end, the only way for a platform to exist of any type is for someone somewhere to bear the initial risk on an unconditional (not knowing if a person is buying or selling) basis. It doesn't matter if it's a Facebook, a taco stand, the Hoover Dam or asset-backed securities. Goldman (and the other mega dealer-banks) are facilitating a platform for the entire world to unload cash-flows: the platforms' platform. And if you pick Finance as a career, it will be thankless, often boring, hard and people will likely not understand what you do and will demonize you for it. But _you_ will know that you are doing something special: you are building the platform for everything.

</comment><comment><USER10> The OP is more about which is socially more useful. Fuck that. It's not an individually relevant discussion. It's for people who are comfortable, and that's not our generation, not yet. People in their early 20s need to concentrate on things like getting paid, making contacts, what they'll learn, and building the credibility necessary to do what you really want to do, as soon as you can get there. If you're not at the point of being able to change the world for real and on your terms, then don't settle for the indirect substitute of working for a macroscopically "world-changing" company (but likely in a subordinate role). Instead, go and get what's right for you. No one should feel ashamed just because he works in finance-- this is especially true for the young, who have no real influence anyway.

Who wins between Google and Goldman? If you're coming into Google without any contacts or a pre-established national reputation, you better head to Mt. View. Anything else is like working in Goldman's Atlanta office (if they have one). Also, get your project allocation _before_ you sign the offer letter. If you land on the right project-- one with new development (not legacy maintenance) and interesting work where promo every 2 years (up to Staff) is common-- then Google's a pretty good option for people who know they want to be in tech. It will set you up very well to have 4-5 years at Google with good projects and promotions.

On the whole, though-- taking this discussion away from company specifics-- I'd advise young people to go with finance if they can get it, at least in their early 20s. Why? If you do tech, you only gain credibility if you work on the interesting projects. If you do bottom-half crap work in technology, you're a nobody, and after 10 years, you'll be shat out. On the other hand, if you have Goldman or RenTech on your resume, you have a credibility that can't be taken away. (In New York, at least, most startup founders did their 20s in finance.) If you got assigned crap work, you can say "that's why they pay so well." You aren't seen as a loser if you were assigned crap work in finance, because you can blame the industry; whereas if you worked at a software firm and were assigned junk-pile work and never got beyond a junior role after 4 years, you're cooked. Relatedly, everyone will assume you made a lot more money than you actually did.

Working in finance builds credibility, and that's really fucking important when you're starting out.

<comment><USER24> > if you have Goldman or RenTech on your resume

RenTech is in a completely different league from Google and Goldman. I've never met a single person to even get an interview there.</comment></comment>


Persistence of Long-Term Memory in Vitrified and Revived C. elegans worms - <AUTHOR> http://online.liebertpub.com/doi/pdf/10.1089/rej.2014.1636 <comment><USER3> Cryonics is the low-temperature preservation of the deceased in order to grant them a chance at a renewed life when technologies for restoration are developed. One of the big outstanding questions is the degree to which a well- conducted cryopreservation successfully preserves the fine structure of the brain and thus the data of the mind. The fact that cold water drowning victims can live again after an hour or more of brain death tells us that memory is encoded in physical structures, with the current consensus (not undisputed) suggesting it is located in synaptic connections between neurons.

Scanning technologies have been used to show that cryopreservation via vitrification of cryoprotectant-infused tissue does indeed preserve the fine structure of brain cell connections. E.g.:

[http://www.brainpreservation.org/content/competitors](http://www.brainpreservation.org/content/competitors)

So it seems reasonable to move forward with initiatives based on the theory that yes, cryonics is going to preserve the mind. Certainly all too many people are left with no other viable option for a shot at a longer life in the future. There is always the need for more and better proof, however. At the present time studies involving restoration of vitrified individuals must be carried out in lower animals, unfortunately, as researchers are still far from the point at which they can safely restore vitrified mammals. That said, restoration of a vitrified mammalian organs has been demonstrated, though even that is very early stage work in the grand scheme of things.

<comment><USER4> > cold water drowning victims can live again after an hour or more of brain > death

They don't reach brain death. The cold causes a drop in the oxygen requirements, but the brain keeps on living.

<comment><USER5> Indeed. If by "brain death" you mean "massive ischemic damage", then cryopreservation under good circumstances also takes place before brain death.

</comment></comment></comment><comment><USER6> Take this with a huge block of salt.

This PDF is of a paper recently accepted by an unremarkable journal. Further, the research is sponsored by a company that performs cryonics. If this is true, it may be exciting but we should wait for others to replicate these findings.

<comment><AUTHOR> I don't see why we should be skeptical. It seems to lack the usual warning signs like small samples or questionable statistics, and, for all the skepticism most laymen have ('but how do we know vitrification does preserve memory even if it preserves everything else?!') this is what one should have expected, if only from related instances like comas and drownings - <USER2> memory is physically encoded as, exactly, it's clearly not ultra-evanescent.

<comment><USER6> I think there are a few causes for concern regarding this paper:

1\. Rejuvenation Research isn't a widely-recognized biology journal. If this is the first time memories have been recovered from a cryopreserved organism, this should be in a top journal as it's great news.

2\. The article was accepted on the day it was received[ref 1]. This doesn't inspire confidence in the strength of the associated peer review as such minimal review is unusual in biology. Indeed, the average review time for the journal is about 4 weeks[ref 2] (which itself is a short time).

3\. This is pretty concerning - the key protocol used in the paper hasn't been published (see reference 14 in the PDF). While it's described in passing in this paper, there's no way to assess the full protocol.

4\. There's a juxtaposition between the authors' new technique and an established protocol for freezing _C. elegans_. However, the authors only freeze _C. elegans_ for 30 minutes in their protocol whereas they freeze organisms in the established protocol testing group for 2 weeks. There seem to be appropriate controls but this difference in protocol is stated very unclearly.

 _References_

1\. [http://online.liebertpub.com/doi/10.1089/rej.2014.1636](http://online.liebertpub.com/doi/10.1089/rej.2014.1636)

2\. [http://www.liebertpub.com/DContent/Files/FastFacts/FastFacts...](http://www.liebertpub.com/DContent/Files/FastFacts/FastFacts_RejuvenationResearch.pdf)

<comment><AUTHOR> > If this is the first time memories have been recovered from a cryopreserved > organism, this should be in a top journal as it's great news.

Cryonics related research never gets published in top journals no matter its quality, so this is what you would expect. There is a long-standing war by cryobiologists on anything to do with cryonics - the old canards like the exploding lysosomes o' death may have been refuted but last I heard, they were still explicitly banning from membership any cryonicists.

> 2\. The article was accepted on the day it was received[ref 1].

Look up the journal policies and note the dates: it was posted the day it was received, as part of Liebert Instant Online/LION [http://www.liebertpub.com/forauthors/rejuvenation- research/1...](http://www.liebertpub.com/forauthors/rejuvenation- research/127/) but that doesn't mean it was reviewed or accepted in a day:

> To enable the release of new scientific findings as quickly as possible, the > Journal has a policy of pre-publishing all manuscripts in their unedited > format upon acceptance. The papers will have undergone full peer review but > will not yet have been copyedited, typeset, or proofread/corrected by the > authors. All accepted papers appear online within 72 hours of acceptance as > a part of Liebert Instant Online (LION).

Given the editing gap is at least October 2014 - April 2015...

> 3\. This is pretty concerning - the key protocol used in the paper hasn't > been published

Reference 14 is to the SafeSpeed cryopreservation protocol, not to vitrification in general. They _also_ tested out traditional vitrification. If you distrust SafeSpeed, you can throw out that entire part of the paper and the results are exactly the same: preservation of olfactory memory. (This was covered on pg3, I don't know how you missed it if you could look up the reference number...)

> However, the authors only freeze C. elegans for 30 minutes in their protocol > whereas they freeze organisms in the established protocol testing group for > 2 weeks.

? The 30 minutes refers to the traditional vitrification itself (this is why it's 'slow') where they're immersed in Ln2, but then they were all stored in some more regular freezers at -80 celsius (much warmer than LN2) for several weeks (pg11-12).

<comment><USER6> > There is a long-standing war by cryobiologists on anything to do with > cryonics - the old canards like the exploding lysosomes o' death may have > been refuted but last I heard, they were still explicitly banning from > membership any cryonicists

I'm not sure what to say here - politics definitely plays into biology publication but there are multiple well-respected journals to send 'small results', of which I don't believe Rejuvenation Research is one.

> Look up the journal policies and note the dates

I did exactly this. Unless Rejuvenation Research has an unusual application of the terms 'Received' and 'Accepted' (see ref. 1), I'm more inclined to believe the information on the article page than a general journal policy.

Weirdly enough, all the articles in the most recently published edition of Rejuvenation Research ([http://online.liebertpub.com/toc/rej/18/2](http://online.liebertpub.com/toc/rej/18/2)) had at least some gap between receipt and acceptance. I'm even more inclined to think something unusual has started to happen with the current batch of online-before-publication papers. This could, of course, be a bug with the journal's content management system.

> Reference 14 is to the SafeSpeed cryopreservation protocol

Publishing a reference to an non-peer-reviewed protocol is unusual, irrespective of the details. This is even more unusual when the protocol forms the core of the paper.

To be a bit more precise (using details from the paper):

Vitrification and slow-freezing are distinct methodologies for preserving specimen. The authors _only_ use two methodologies for preservation, which they explain in the methods section:

        The cryopreservation methods included worms that were trained and cryopreserved by vitrification and worms that were trained and cryopreserved by slow freezing

> If you distrust SafeSpeed, you can throw out that entire part of the paper > and the results are exactly the same: preservation of olfactory memory

I think this is part of why my original comment said we should wait for replication and be skeptical. Trust in science is a difficult thing to gain and an easy thing to lose. The choice of journal and the very-unclear description of the cryopreservation protocols make me a bit more skeptical of the results.

The SafeSpeed protocol seems to be under review at Nature Methods. If it's accepted there, the authors will likely need to supply supporting data which will only bolster the claims they made here.

Further, the slow-freezing result is a fairly cheap one to replicate; we're likely to see many people try it and they'll likely cite Alcor's work.

> The 30 minutes refers to the traditional vitrification itself

I think the authors were intentionally vague in comparing the two preservation methods, especially given how clear the rest of the report is.

First, note that only _one_ vitrification technique was used, SafeSpeed. Additionally, only _one_ slow-freezing technique was used, a standard approach that one of your sibling commenters references in passing.

The SafeSpeed-vitrified animals were stored in liquid nitrogen (LN2) for 30 minutes and then recovered. This is stated (unclearly) in the methods section (pg 8) and alluded to in the discussion.

> 30 minutes refers to the traditional vitrification itself (this is why it's > 'slow')

This is counter to what the authors state - they explain that the SafeSpeed method is actually slower than 'slow-freezing'. See page 11.

 _Conclusion_

I think that this will be exciting if SafeSpeed gets published somewhere more reputable. As you alluded to earlier, if there is a physical correlate to benzaldehyde training that isn't damaged upon freezing, we'd definitely expect it to be recovered after freezing.

This paper just isn't compelling enough to say that we've seen this occur definitively.

 _References_

1\. [http://online.liebertpub.com/doi/10.1089/rej.2014.1636](http://online.liebertpub.com/doi/10.1089/rej.2014.1636)

        'Received' usually indicates receipt of a manuscript;
        'Accepted' usually indicates the end of scientific edits.
        Often, articles are held up (i.e., not published online) to coordinate
        publishing with other labs/projects within a lab.

<comment><AUTHOR> > I'm not sure what to say here - politics definitely plays into biology > publication

This is well beyond regular scientific politics; the attacks are now older than a lot of people working in the field. I don't know why you would expect random journals to be unaffected (where do you get cryobiologist reviewers who are unaffected or fearless?).

> I'm more inclined to believe the information on the article page than a > general journal policy.

The journal policy which explains what the dates mean?

> Weirdly enough, all the articles in the most recently published edition of > Rejuvenation Research > ([http://online.liebertpub.com/toc/rej/18/2](http://online.liebertpub.com/toc/rej/18/2)) > had at least some gap between receipt and acceptance.

So are you even objecting to anything besides a software bug?

> The authors only use two methodologies for preservation, which they explain > in the methods section:

I don't understand your objection here. OK, so one protocol is still upcoming. I don't think this is that unusual since I see plenty of references to publications in press in papers I read - econ papers spend years as preprints, I regularly comment on drafts, fast moving areas often do this, work which has been turned into multiple publications does this all the time because different journals move at different rates etc. I don't think this is a big problem but _even if it was_ , they _also_ tested out the standard well- understood procedure you cannot possibly have any objection to, so what's with this 'only' business? That's the method one wants them to test - and they did. And it worked the same for preserving memories. Which is the point.

> Further, the slow-freezing result is a fairly cheap one to replicate; we're > likely to see many people try it and they'll likely cite Alcor's work.

That seems unlikely. No one wants to go near cryonics for the political reasons I mentioned and there's no funding for it. I have been saying for at least 5 years now that I really hoped someone would run exactly this experiment with seeing if training survived, and it took that long for any study to be done - despite always being cheap to run. Sometimes being cheap to replicate doesn't matter.

> This is counter to what the authors state - they explain that the SafeSpeed > method is actually slower than 'slow-freezing'. See page 11.

I don't see any such claim. I think you are again confusing different stages of storage and revival.

> This paper just isn't compelling enough to say that we've seen this occur > definitively.

I find it compelling. None of your arguments goes to the root, and most are tangential: it's not a prominent journal because of the very well known politics involved, the dates are due to quirks of the website or acceptance process, the new protocol is not well-described but seems to work as well as the older methods and the older methods suffice to prove the point, and some confusion about the details doesn't obviate the core claim either. The worms were trained, were frozen, were revived, and remembered. Which of your criticisms defeats this? This isn't some mushy social psychology paper with n=15 and the authors could have tried a thousand different analyses to pull out a p<0.05; the worms either remembered or they didn't, there's not many ways to slice the data.

<comment><USER6> I don't think we're going to agree on the quality of this paper, which is perfectly fine and a normal part of science.

Two things:

> I don't think this is that unusual since I see plenty of references to > publications in press in papers I read - econ papers spend years as > preprints

This isn't normal in biology. It's a stance that researchers are trying to change (see [http://biorxiv.org/](http://biorxiv.org/), notably), however.

> I don't see any such claim. I think you are again confusing different stages > of storage and revival.

At a molecular level, the two processes may work differently (we don't, of course, have the SafeSpeed protocol). However, the article states:

"During this time, it is necessary to allow 30-45 minutes for vitrification processes, 15-30 minutes for slow freezing processes, and 24 hours for all processes to safely recover and verify the survival of the worms"

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Not directly related, but it reminded me of this: [http://everything2.com/title/The+ability+of+planarian+worms+...](http://everything2.com/title/The+ability+of+planarian+worms+to+run+a+maze+more+successfully+after+being+fed+the+remains+of+a+successful+worm)

</comment><comment><USER8> well, today we can restore information - sound - from a photo of the gramophone recording media ([https://mediapreservation.wordpress.com/2012/06/20/extractin...](https://mediapreservation.wordpress.com/2012/06/20/extracting- audio-from-pictures/)). Tomorrow - from a frozen brain.

So, i wonder, if i had enough money - may be instead of whole body or head cryonics, i should go for sub-micron thick slicing of my brain and making photo and various other wavelength scans of it and storing this digitized info somewhere (like Glacier :) Or may be i should just start a start-up offering just such a service to make money for my future cryonics :)

<comment><AUTHOR> This is a good question. There's a lot of active research into chemical fixation and then doing brain scanning on thin slices to reconstruct the connectome and other features, with regular progress like "High-resolution whole-brain staining for electron microscopic circuit reconstruction", Mikula & Denk 2015 [http://connectomes.org/pdf/mikula2015_.pdf](http://connectomes.org/pdf/mikula2015_.pdf) . I have some more links in [http://www.gwern.net/plastination](http://www.gwern.net/plastination)

The upsides to chemical fixation or plastination is that you avoid issues with temporary interruptions in cooling (as far as we know, Alcor and CI have a nearly perfect record in maintaining LN2 coldness, but one could wonder how well that will work for the next century) since a fixated brain will be stable at room temperature, and you can have a much more quantifiable idea how much progress has been made in fixation and scanning through things like the BPF's prizes ([http://www.brainpreservation.org/](http://www.brainpreservation.org/)). So that makes this attractive.

The downside is that there is no infrastructure setup (there's no one you can go to and say "here's $10k, please wait by my bedside and as soon as I'm declared legally dead, dunk my head in osmium"), and the concerns about cryonics being too slow are magnified massively - people are worried about vitrification taking several hours and cryonics possibly being too late, but the current fixation solutions take more on the order of a _month_ and don't necessarily fixate the entire brain volume. So you may get a great preservation which can be easily stored and imaged at high quality without any concerns about how to heat it back up... but what will you be imaging?

If I died tomorrow, I would go with regular cryonics hands-down no contest. But in 30 years? If Mikula, Hayworth, the BPF, Seung, etc keep on pushing forward this area, maybe then plastination will be equal or superior.

</comment></comment><comment><USER9> Frogs can do this too (and more in fact), so I wouldn't be surprised if it was true. That said it's a bit of a (ok, not such a bit) stretch to extrapolate from being able to freeze a worm which has absolutely minimal nervous tissue to how this finding will apply to the non-science of cryonics, though I can see why those with a stake in the game would want to make such connections as strongly as possible.

Not only are there differences in scale between frogs, worms and humans, there are also differences in complexity and structure.

</comment><comment><USER10> Also [https://news.ycombinator.com/item?id=9593988](https://news.ycombinator.com/item?id=9593988).

</comment><comment><USER11> The viability (or not) (and the incentives of different parties in) the field of cryonics was previously discussed here:

[https://news.ycombinator.com/item?id=8241374](https://news.ycombinator.com/item?id=8241374)

</comment><comment><USER12> Cryonics is fascinating because it's the closest thing to a technological religion so far. (Scientology does not count, it's more like a pulp sci-fi religion.)

St. Paul eloquently described the upcoming Singularity and the raising of the vitrified minds:

 _" Listen, I tell you a mystery: We will not all sleep, but we will all be changed -- in a flash, in the twinkling of an eye, at the last trumpet. For the trumpet will sound, the dead will be raised imperishable, and we will be changed."_

<comment><USER13> I often hear the "cryonics is a religion" claim, but a closer examination refutes this. Unlike religions, cryonics is not exclusive. A person can practice Christianity or Islam and be signed up for cryo. Cryonics makes no claims about morality or politics. There's no dogma about how to live one's life, or the origins of the cosmos, or what happens to consciousness after the brain is destroyed.

The most important difference between cryonics and religions is that religious people are typically convinced of the afterlife. In contrast, cryonicists rarely assign high probability to being revived. Most think of it like an experimental cancer treatment: Unlikely to work, but better than the alternative.

And like experimental treatments, research is ongoing. Since cryonics organizations were first founded, there have been many improvements to preservation protocols. Modern cryopreservation methods allow a rabbit kidney to function after thawing, albeit with some damage.[1] This is very promising, as parts of the kidney have poor vasculature. Brains are much easier to saturate with cryoprotectants.

1\. [http://www.21cmpublications.com/PubFiles/11/12FahyORG5-3[1]....](http://www.21cmpublications.com/PubFiles/11/12FahyORG5-3\[1\].pdf)

<comment><USER14> I will eschew Wittgenstein's advice and take the bait- I don't think the techno-religion claim is too far off the mark. Of course, the entirety of our argument is over the definition of religion.

| Unlike religions, cryonics is not exclusive.

I think we'd both agree that exclusivity isn't the principle quality of religion, though many religions are exclusive.

Religions typically have some core set of beliefs - some of which may be untestable, ceremony, dress, and often attempt to explain the mysteries of the universe. I'd also throw in the quality that religions advocate their followers either do something they wouldn't otherwise do or abstain from something they would otherwise enjoy. Its possible some religion lacks proscriptions for life, but I certainly haven't met it.

Cyronics certainly has a core set of beliefs (faith!?) that lead to action. I very much doubt that even if we were to develop sufficient technology to unfreeze all those heads, future humans would do so. Perhaps we'd unfreeze some heads for science and then a few more for the novelty. We both agree cyronics is unlikely to work and that there is no way to run this experiment within our lifetime - cryonics requires faith (by any other name) in humanity and technology.

|In contrast, cryonicists rarely assign high probability to being revived. Most think of it like an experimental cancer treatment: Unlikely to work, but better than the alternative.

I know Christians that would describe their experience in similar terms.

| The most important difference between cryonics and religions is that religious people are typically convinced of the afterlife.

Christians believe in an afterlife, but not all religions do, or even weigh in on the matter - Judaism immediately comes to mind. Apropos, cryonics proposes its own cycle of rebirth! Well, possible rebirth until the great robot wars, the sun explodes, or the heat death of our local cluster.

As for the other attributes I mentioned - dress, ceremony, and the like, cryonics offers bracelets, (non)ceremonial decapitation with ensuing vitrification, and requires its devotees to die somewhere convenient! OK, I agree, this doesn't exactly fit the bill.

Precisely defining religion and faith is tricky. At the very least, I would say cyronics is uncomfortably close to a religion.

<comment><USER15> > Cyronics certainly has a core set of beliefs (faith!?) that lead to action.

You could describe basically every mundane activity as having a core set of beliefs that lead to action, but ok.

> I very much doubt that even if we were to develop sufficient technology to > unfreeze all those heads, future humans would do so. Perhaps we'd unfreeze > some heads for science and then a few more for the novelty.

Not reviving cryopreserved people is equivalent to leaving them to die... Unless you're counting on future society to be completely 100% morally bankrupt, I would bet on there being eventually at least one person with both enough of a conscience and enough money to fund the revival of people in suspended animation (as the cost of revival should decrease over time with advancing technology). Not that this really seems relevant to any connection to religion.

> Apropos, cryonics proposes its own cycle of rebirth! Well, possible rebirth > until the great robot wars, the sun explodes, or the heat death of our local > cluster.

FWIW, unlike religion, cryonics does not really claim you can come back from death. Legal death, yes, but legal death is merely a convenient criterion that captures "the point at which we give up on treating a person with current technology". If you set a cryonicist on fire and destroy their brain's information, they are permanently dead, just like anyone else.

(ETA: Since physics is reversible, destroying information is technically impossible, but capturing and calculating reversal of the trajectories of smoke, soot, air and photons back into a whole brain seems thermodynamically infeasible, even for a civilization with Big Angelic Powers.)

<comment><USER16> iirc physics is non-reversible. Something to do with entrophy and possibly quantum physics.

<comment><USER17> Quantum Physics is reversible; see [http://en.wikipedia.org/wiki/Delayed_choice_quantum_eraser](http://en.wikipedia.org/wiki/Delayed_choice_quantum_eraser) . (Warning: amateur, may be misunderstanding.) You do have to be able to capture the complete environment of the quantum process, which is why decoherence is usually considered one-way.

</comment></comment></comment></comment></comment></comment><comment><USER18> Cold storage</comment>


Ask HN: How to avoid arguing over trivialities? - <AUTHOR>

I work on a team with 8 or 9 people who all have different specialties, but from time to time we experience a lot of overlap, especially when it comes to crunch time on a big project.  Invariably we end up making a big deal over some small issue, be it version control conventions, variable naming schemes, or tabs vs. spaces.  In other words, we're at loggerheads over some issue where reaching an agreement is more important than whatever the agreement is.<p>What do you do speed things along without pissing off your coworkers?  We have non-technical but otherwise awesome management, and no official technical leadership.  We like it that way.  I think we all have an appreciation for the egalitarianism within the group, but sometimes it can be an impediment. <comment><USER2> Have coding standards. This way, you only have to argue about these kinds of tedious issues once.

<comment><AUTHOR> I see where my examples were largely limited to coding conventions, but the point was that when we are free to work on our own we all have our preferences for everything. And we all do our own thing when it only involves only ourselves. Here is another for instance that is somewhat less trivial (I'm a C++ guy):

"Why should I have to use use this boost::shared_ptr for everything? This class clearly has ownership of this data. I'll take care of everything in the destructor. If you need a copy, make a _copy_. I'll write you a deep copy function if you want."

"But I don't want to make a copy. It's inefficient and I find it unnecessary. Just use boost::shared_ptr for everything and it will all be ok"

... for code that will probably not be used anywhere in a performance-critical section of the code but it's hard to know in advance.

<comment><USER3> Just have a method. Any method. Democracy is nice. If more people agree on something than the rest, it's the way it'll be done.

And somedays you have to tell people to suck it up. "Oh, two spaces indentation in Python is how Google does it? Well, it's not how we're doing here".

When it's allowed to break the rules? When the method you choose allows it. For example, breaking code convention is a no-no under whatever. But boost::shared_ptr? What everyone else on the team thinks? What does your "method" says? That performance is more important than readbility?

If you have a prima donna developer who doesn't accept his peer decisions, then you have a bigger problem than just silly arguments. You've built the wrong team :p

Smart people love being corrected, most of the time. They're in it for the learning, not to display their awesomeness.</comment></comment></comment>


Redefining Success: A Game Developer's Perspective - <AUTHOR> https://officehours.io/streams/article/SKRjHxQSmMji6hDeA <comment><USER2> Why would I bother with a site which tells me nothing and forces me to sign up?

<comment><AUTHOR> Seems like it's only the direct links that are causing a problem. If you go to the main streams page, you can read this article there: [https://officehours.io/streams](https://officehours.io/streams)</comment></comment>


Show HN: We've created a visual live-programming environment for .NET - <AUTHOR> https://visualprogramming.net/ <comment><AUTHOR> helo HN, joreg here, one of the devvvvs team of 5. After more than 7 years in R&D we've just released the second major release of our visual live programming environment vvvv, titled "vvvv gamma". It uses our language "VL" which compiles to C# using roslyn and it is using state hot-reload to allow you to modify programs while they are running.

It combines metaphors known from dataflow programming with others known from OOP and functional programming, but all visual. Still if you want you can extend it with C# code easily and even consume any .NET library from nuget.org directly without the need to write any plugin-wrapper boilerplate code.

From previous HN discussions we know you all have an opinion on visual programming, so please try vvvv, we hope it to be different to what you expect. It is free for non-commercial use without any restrictions, no registration required. Windows only for now.

Looking forward to your feedback and please let us know if this is something that could be useful for you!

<comment><USER3> This looks incredible and I can't wait to try it out.

One thing that is confusing me as a newcomer: why does the project have 2 very different websites (visualprogramming.net and vvvv.org)?

<comment><USER4> Also why the name "vvvv"?

<comment><AUTHOR> [https://vvvv.org/documentation/meaningofvvvv](https://vvvv.org/documentation/meaningofvvvv)

<comment><USER5> Vereniging Van Vlaamse Vliegfissers aka Association of Flemish Fly Fishermen

I wasn't expecting that. ;)

But seriously, I was expecting some kind of explanation or corporate mission statement, but all I got was visual repetitions of VVVV showing up in various designs and architecture.

It's kind of cool.

</comment></comment></comment></comment></comment><comment><USER6> Many years ago I did a just for fun project with vvvv, a virtual graffiti wall.

This involved a webcam that captured the graffiti input in form of infrared beacons and two outputs that were projected onto large projector screens - <USER2> for drawing and one to show the resulting grafitti to spectators.

I've been a text based coder all my life and had no experience with graphical programming before, but the ease of use and stability of vvvv was just incredible.

I would encourage anyone to try it.

</comment><comment><USER7> Id like to share these tutorials ran across [https://m.youtube.com/playlist?list=PLBTgwgsWWcT_VMMrwsy3Ao7...](https://m.youtube.com/playlist?list=PLBTgwgsWWcT_VMMrwsy3Ao7_ubazEGL4s)

</comment><comment><USER8> I normally hate node based programming because I'm basically relearning programming but with nodes and the systems are a lot of times opaque so I can't read it at a glance to see what it does, but with this custom node stuff I could get behind that.

I'm actually a bit excited to try this out.

<comment><USER9> Did you try it already? How was your impression?

</comment></comment><comment><USER10> I have used VVVV in the past and really enjoyed it, and any update to it makes me happy (I stopped using it when I switched to Linux, basically).

However, I can't stop feeling a bit suspicious of the date that this was posted, hahaha.

</comment><comment><USER11> Kudos for using GetTogether instead of Meetup, Matrix/Riot instead of Discord or Slack, Discourse instead of whatever close source alternative. It matters a lot for some of us. Is vvvv open source or libre too?

<comment><AUTHOR> And thanks for pointing this out! I'm afraid the core of vvvv is not open source but all of its libraries are. And also please follow us on mastodon: [https://mastodon.xyz/@vvvv](https://mastodon.xyz/@vvvv)

</comment></comment><comment><USER12> It's looks like a solid product. Now don't add any more features, just concentrate on acquiring and teaching users.

That said, it could probably work well on a touch interface if you removed the need to type/keyboard. And could probably be used by kids if you added more icons. I'm thinking that someone that looks for something like this is probably OK with shapes/visual, while a traditional programmer would prefer text.

</comment><comment><USER13> Any relation to VNOS?

<comment><AUTHOR> Most certainly not. What is it?</comment></comment>


The 2017 Data Professional Salary Survey Results - xlsx file - <AUTHOR> http://14days.brentozar.com.s3.amazonaws.com/2017_Data_Professional_Salary_Survey_Responses_DRAFT.xlsx <comment><USER2> Those are prelim results as they come in. The survey closes Sunday. More details:

[https://www.brentozar.com/archive/2017/01/tell-us- make-2017-...](https://www.brentozar.com/archive/2017/01/tell-us- make-2017-data-professional-salary-survey/)

I wouldn't link directly to the Excel file without context, especially since it'll disappear shortly when the final results come out.</comment>


The secret "anti-languages" you're not supposed to know - <AUTHOR> http://www.bbc.com/future/story/20160211-the-secret-anti-languages-youre-not-supposed-to-know <comment><USER2> This made me wonder: does "homie" (urban US slang used a lot in hip-hop to mean something like "trusted friend") actually come from British gay slang taken from Italian "uomo"?

[http://www.lorem-ipsum.co.uk/pdict.php?letter=H](http://www.lorem- ipsum.co.uk/pdict.php?letter=H)

Transitioning from the now dated "my man" to "my homie" seems very easy, although I'm not sure where the "homo" and "uomo" closeness fits into the theory. Wikipedia mentions the pun with homosexuality, but says "homie" originated with Spanish "hombre" (presumably the same root as uomo?) to "homeboy".</comment>


In Hot Pursuit of Fusion (or Folly) - <AUTHOR> http://www.nytimes.com/2009/05/26/science/26fusi.html?_r=1&8dpc

<comment><USER2> Anyone that suggests this project is capable of being scaled up to produce useful amounts of energy is lying to you. Its goal is to explore how H bomb's work which might be useful but it's got little to do with civilian power.

<comment><AUTHOR> They've been trying to make fusion sexy for 50 years. In my opinion (as an average physicist), it's got about 50 more years before it becomes practical. Maybe.

<comment><USER2> I don't know about practical, but I think an Apollo style investment in tokamak's could have a useful power plant up an running inside of 15 years. However, I have no idea if it would end up being cheaper than spending that much cash on say wind or solar.

JET was close to break even and it's an old and small design. They have steady state tokamak's by not operating at the outer limits of the device. So IMO the only real challenge is building a sufficiently large scale device. And getting a steady supply of Tritium.

So scale it up to 3 or 4 times the size of ITER and build 4 of the things and I expect we would have at least one fusion power plant. Granted, 4 plants at 4 times 6 billion a pop = ~100billion which is stupid amounts of cash, but it would get it done IMO.

PS: The real question is how much less than that can you spend and build a working system.</comment></comment></comment>


Down the Rabbit-Hole - <AUTHOR> https://googleprojectzero.blogspot.com/2019/08/down-rabbit-hole.html <comment><USER2> It looks like it's yet another missed deadline for Microsoft ?

[https://bugs.chromium.org/p/project- zero/issues/detail?id=18...](https://bugs.chromium.org/p/project- zero/issues/detail?id=1859)

 _Edit:_ it's unclear: [https://twitter.com/taviso/status/1161297483139407873](https://twitter.com/taviso/status/1161297483139407873)

I'm not surprised, seeing how deep this reaches and the scope of the issues.

And the toolset Tavis used is also released (linked in the blog):

[https://github.com/taviso/ctftool](https://github.com/taviso/ctftool)

<comment><USER3> I find the culture around 90-day disclosure deadline fascinating.

Is it actually reasonable to disclose this just for missing the deadline given that it has already been exploitable for twenty years? I know nothing about security but I just feel so bad for people who have to scramble to fix this legacy system which they probably had nothing to do with. I don't think I have ever seen a good secure system understood, redesigned and reimplemented in less than a quarter. The exploit author himself seems to have spent months on this without coming up with a fix either.

<comment><USER4> First, you need a hard bright line as a norm. It's the only thing a corporation will understand, and you can see how often they try to abuse or delay it anyway. Disclosing after the deadline is the only thing that gives the deadlines urgency and means that things which _are_ urgent also get handled quickly. If there isn't a working process for handling as serious a vulnerability as this within 90 days, then there probably isn't a working process for handling serious but time-sensitive vulnerabilities within 90 days either. Use it or lose it.

Second, these things are a lot more correlated than you think. Look at Spectre recently: those bugs have been in there in various ways for what, 20+ years? Yet something like 3 different research groups all came across variants of it simultaneously. There are pervasive correlations leading to [https://en.wikipedia.org/wiki/Multiple_discovery](https://en.wikipedia.org/wiki/Multiple_discovery) \- people use similar tools like fuzzers, they follow similar research topics and gossip, certain things become 'obvious' to everyone simultaneously, and so on. OP might not think that anyone else is working along similar lines, but how could they know that? How should anyone interested in Spectre have known that there were (at least) that many other groups finding similar problems?

</comment></comment></comment><comment><USER5> Crazy. So any process can use MSCTF (Text Services Framework) to elevate itself into NT AUTHORITY\SYSTEM through UAC prompts or logon screen, because Microsoft forgot to implement access control!

I wonder whether this can also be used to escape sandboxes, but don't have time right now to analyze that. If so, this will be even more dangerous.

Edit: Yup, can be used for sandbox (AppContainer) escapes. The blog post mentions it, just didn't notice at first scan.

While I respect Google's security team's 90 day vendor response policy in general, I think it is too reckless in this case. This can too easily escalate previous "harmless" contained sandbox compromises into full system wide ones. A lot of people are potentially now on the harm's way.

<comment><USER6> Agreed. This isn't a simple patch, and will require significant re-engineering of a critical Windows component. 90 days is entirely unreasonable in this case. Releasing his ctftool was particularly reckless, this is privilege escalation in a bottle.

<comment><USER7> Reckless by Microsoft or the researcher? Cause we don't know who has been exploiting this already and by providing the tool adds pressure on Microsoft to expedite this and helps people that may have already been effected have some insight into how they were compromised.

<comment><USER8> The righteousness of your post reminds me of the climax of a Disney movie.

Google does this all the time, on purpose, like clockwork. They aren't the only ones out there looking for zero days in their supply chain, but they're the only ones who ignore a vendors disclosure policy and substitute their own.

For example; If Google finds a bug in your product _YOU_ get 90 days before they put you on blast in front of 8 billion people.

But if you find a bug in _GOOGLE 'S_ product and put them on blast _YOU_ will find yourself in court.

Does anyone remember the last time Microsoft or Apple went looking for zero days to drop in public on their blog about Google? They don't. Because they're professional companies with better shit to do than stir the pot.

This has _NOTHING_ to do wit supply chain security and _EVERYTHING_ to do with putting heat on their competition. That is why PZ exists. If that weren't true PZ would be looking at non-competing products with large user bases. WordPress comes to mind. But Google doesn't compete with WordPress, so they'll never focus on it.

<comment><USER9> > For example; If Google finds a bug in your product YOU get 90 days before > they put you on blast in front of 8 billion people.

> But if you find a bug in GOOGLE'S product and put them on blast YOU will > find yourself in court.

Reference needed.

<comment><USER8> > For example; If Google finds a bug in your product YOU get 90 days before > they put you on blast in front of 8 billion people.

[https://www.vice.com/en_us/article/7xqdxe/google-project- zer...](https://www.vice.com/en_us/article/7xqdxe/google-project-zero-hacker- iphone-bug-bounty)

[https://www.csoonline.com/article/2867534/microsoft- blasts-g...](https://www.csoonline.com/article/2867534/microsoft-blasts- google-for-vulnerability-disclosure-policy.html)

Here are Google's many contradictory policies about disclosure. Notice the many discrepancies...

[https://googleprojectzero.blogspot.com/p/vulnerability- discl...](https://googleprojectzero.blogspot.com/p/vulnerability-disclosure- faq.html)

[https://security.googleblog.com/2010/07/rebooting- responsibl...](https://security.googleblog.com/2010/07/rebooting-responsible- disclosure-focus.html)

[https://sites.google.com/site/bughunteruniversity/nonvuln](https://sites.google.com/site/bughunteruniversity/nonvuln)

[https://www.google.com/about/appsecurity/reward- program/](https://www.google.com/about/appsecurity/reward-program/)

[https://www.google.com/about/appsecurity/](https://www.google.com/about/appsecurity/)

[https://googleprojectzero.blogspot.com/p/vulnerability- discl...](https://googleprojectzero.blogspot.com/p/vulnerability-disclosure- faq.html)

> But if you find a bug in GOOGLE'S product and put them on blast YOU will > find yourself in court.

Maybe a bit of a dramatization, but the point remains. If Google finds a bug in your product: Your policy is moot. They follow their policy. If you find a bug in their product you are expected to follow their policy.

In the case of Apple their "security professionals" will make jokes about you on Twitter and in the case of Microsoft they just do whatever the fuck they want. "Your patches come out on Tuesday, huh? Well that's 92 days, big-guy! Tough break..."

<comment><USER10> > If you find a bug in their product you are expected to follow their policy.

Is their policy more than 90 days? Yes? Fuck 'em; post everything everywhere.

<comment><USER11> It's not; from parent's own links: "We of course expect to be held to the same standards ourselves."

<comment><USER12> * impolitecough *

Great, then they should start pushing OS security patches out to devices instead of handing them to manufacturers and carriers and washing their hands of them.

<comment><USER13> They have started that. That's why more and more of Android has been moved to Google Play Services.

Coincidentally, that's one of the reasons why being denied use of Android is such an obstacle for Huawei, even though it's "open source".

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> > (GitHub) There are some requirements for this attack to work, as far as I'm > aware it will only work if you have a display language installed that uses > an OoP TIP

There is an IME installed on every Windows 10 installation for at least a year: the emoji IME. You hit WIN + . to invoke it. I'm not sure if it's a OoP TIP.

</comment><comment><USER15> 2002 is calling and wants it's shatter attack back.

"Shatter Attacks - How to break Windows."

[https://web.archive.org/web/20060904080018/http://security.t...](https://web.archive.org/web/20060904080018/http://security.tombom.co.uk/shatter.html)

<comment><USER16> That exploit seems limited to applications that are designed to execute arbitrary commands based on user input (consoles). This exploit goes a step further and finds vulnerabilities in the CTF protocol's implementation so that any process's privileges can be hijacked to run arbitrary code.

<comment><USER9> IIRC shatter attack was exploiting a badly designed general purpose window message protocol that by design quasi-directly allowed arbitrary code execution (especially at the time, with no mitigation).

This one is way more indirect and goes through obscure and less reviewed channels, but the end result is kind of the same, even worse; because the integrity level was supposed to fix that mess, except MS was not lying when they said that this was not a security boundary... only they did explain the full picture properly explain so that we could understand that UAC is _this_ much worthless -- lots of people thought of it as reasonable enough when set on Always notify, turns out it seems just plainly broken -- and because there seems to be no proper design _comprehensively focused_ on that topic, it is very possible that there are other avenues to achieve the same result.

I think I now understand way better why they want so much (and have started since some years) to leverage virtualization for security purposes: it seems impossible for them to evolve their historical crappy design to something sound (without breaking all kind of crazy 3rd party applications) otherwise.

</comment></comment></comment><comment><USER17> > the kernel is creating a new window on behalf of a process

> The kernel forces applications to connect to the ctfmon service when they > start

> the kernel invokes a callback

> the kernel still forces AppContainer processes to join the ctf session

I know next-to-nothing about Windows's architecture, but why does the kernel do all of these things? Seems like something a more purpose-built process should do?

(Aside: my browser does not allow for loading Consolas, and the code snippets don't have a fallback to monospace so they render in a serif font. It'd be nice if they didn't do this.)

<comment><USER18> It's called Windows for a reason ;)

Even in Windows 10, the Windows kernel does a LOT of stuff that's GUI centric. Indeed the entire Windows API is totally GUI centric. The fundamental IPC primitive is window messages, which is a microkernel-esque very fast inter- thread/process context switch tool. Like in seL4 or similar you get to send two numbers this way and not more, and it's optimised heavily. Other IPC systems you'd expect to be GUI independent like DCOM end up using this under the hood.

It used to be that the entire GUI subsystem ran in kernel mode, because context switching was very slow and it made a big difference. In Vista+ large parts of it moved out into a separate privileged process, but the kernel is still involved in IPC, I believe. So when Tavis says "the kernel is creating a new window on behalf of the process" that's not quite correct, I think. Various subsystems get involved in creating windows and mostly not running in kernel mode anymore.

<comment><USER19> > Indeed the entire Windows API is totally GUI centric.

I think this is fundamentally incorrect. Windows certainly allows processes and threads to exist with no GUI. The process doesn't need to have message loop, etc.

I suggest you check your other facts as well. Windows Internals is a good book to start.

<comment><USER9> You are technically correct about processes not _absolutely needing_ to use graphical resources.

But the whole thing is nevertheless backed in and coupled with low layers, including the kernel. There is just a kind of lazy init of GDI resources and the like so that the init is skipped for those processes which don't use them ever. It is fundamentally different from a general purpose OS like Linux which does not care _that much_ (or even at all? I haven't checked) about graphic shits for processes.

<comment><USER19> Your assessment is wildly inaccurate. Windows NT is a general purpose OS like Linux and the lower layers really don't know or care about the GUI.

The Windows NT kernel has been carefully designed like that from the start. In fact, the Windows part of NT is called a Windows subsystem. Windows kernel DOES NOT do windowing. The Executive, Kernel, Device drivers and the HAL are cleanly separated.

In fact, Microsoft provides Windows Nano Server which is a totally headless installation with no GUI components.

<comment><USER9> You are talking about _mostly_ source code organization. Which every sane project does.

So of course it is unlikely there is something that e.g. draws pixels in the scheduler.

But for example there is still some space reserved in the TEB for GDI things. And kernel space code for graphic purposes _related to processes and threads_ \-- a kind of graphic "kernel" if you want. I mean: you just cannot take Windows and change all the low level graphics support code to a kind of WinWayland or WinAndroid. Even just programming raw NT processes is not officially supported IIUC, so you are bound to using e.g. Win32, and there definitively are some pieces of code all over Win32 (and not _just_ in trivially graphic related APIs) which is aware of the existence of graphics related features on the OS.

So while it might be possible to recompile and/or rewrite parts of NT if you work at Microsoft to actually obtain a graphic agnostic OS (which is not even _exactly_ what Nano Server is despite the re-engineering effort, because it is explicitly graphicless, not just graphic agnostic, and actually it now does not even exist anymore in a standalone form but only for containers, so you stick with your regular host kernel), that's not what I had in mind.

</comment></comment></comment></comment></comment></comment><comment><USER20> Thank you team Project Zero, certainly my favorite team inside Google.

</comment><comment><USER21> "I decided it would be worth it to spend a couple of weeks reverse engineering CTF to understand the security properties."

Just, wow, that he gets to spend a couple of weeks on stuff like that.

<comment><USER22> As someone who occasionally reverse engineers things for fun, the fact that he managed to completely RE the whole thing to such a high level of detail in only a couple weeks is mind boggling.

<comment><USER23> I think that was his initial idea, but he kept going when he found stuff. From later in the article: "This was a bigger job than I had anticipated, and after a few weeks [...]".

</comment></comment></comment><comment><USER24> Google just buried Windows. Google came in with what seemed to be a spectacular bouquet of flowers, but left a cactus in MS rear end. This is how Taviso 63 days earlier was being treated by Microsoft.

> They called me and _told me my career would be destroyed._ In one > particularly memorable call they told me that their PR and legal department > only had two settings, "off and destroy" and (in a rather menacing tone) > that they would "air my dirty laundry in public".

[https://news.ycombinator.com/item?id=20171450](https://news.ycombinator.com/item?id=20171450)

This is such an Easter Egg they should send some Bunny suits to those clowns at Microsoft HQ.

<comment><USER25> Maybe I misunderstand your comment, but @taviso was recalling a story that seems to be from 2010.

<comment><USER24> Sounds like the ultimate payback for behavior in 2010 which violated all code of ethics.

</comment></comment></comment><comment><USER26> Any response from Microsoft?

</comment><comment><USER27> Clickbait title. Should be: tracking down an obscure Windows security hole.

<comment><USER17> The original title is what the submitter should have used and should not be the title that the moderators should change it to.</comment></comment>


Google Chrome New Tab now in Material Design - <AUTHOR> https://raindrop.io/other/newtab/landing/index.html

<comment><USER2> Nice! The Web Clipper is really useful BTW.</comment>


Lessons from Failure: Borrowing Tools from Your Neighbors - <AUTHOR> http://entrepreneurship.org/resource-center/lessons-from-failure-borrowing-tools-from-your-neighbors.aspx <comment><USER2> Looks like he's an employee at Pearson now, according to Linkedin.</comment>


Why Summer Vacations--and the Internet--Really Make You More Productive  - <AUTHOR> http://www.theatlantic.com/business/archive/2011/08/why-summer-vacations-and-the-internet-make-you-more-productive/244289/

<comment><USER2> I've often been through stretches where I feel burnt out at work, can't seem to pick up steam on a project, and end up 'wasting' a lot of time looking at my favorite websites and doing other non-work stuff. I've found that these end up being balanced by periods of very high productivity. It's like there is some sort of subconscious self correction mechanism at work. I used to fret about it, but now I just accept it as part of my work habits.

<comment><AUTHOR> They say the same thing about not being able to sleep. Get up, stretch, do something small and deliberate to clear your head (like drinking a glass of water), and then come back after you've self-corrected.

</comment></comment><comment><USER3> They don't cite any research that say vacations improve productivity, whereas breaks and 5-day work weeks appear to have actual research to back them.</comment>


Show HN: Free cross VR/Desktop multiplayer dungeon-crawling game - <AUTHOR> https://gembasher.com/wardens-of-the-amber-cage <comment><AUTHOR> Developper here :

We decided to give away for free our first VR game launched a year ago. It allows cross multiplayer with both VR and non-VR players, was aimed at motion- sickness free VR gamers and weighs less than a GB.

Hope we can lighten an evening or two in those depressing times :)</comment>


OpenBSD removes support for non-UTF8 locales - <AUTHOR> http://marc.info/?l=openbsd-cvs&m=143956261214725&w=2 <comment><USER2> I wonder what the pros and cons weighed in the discussion were.

Clearly not supporting Unicode text in non-UTF-8 locales (except through, like, some kind of compatibility function, like recode or iconv) is the Right Thing. One problem that I have is that current UTF-8 implementations typically are not "8 bit clean", in the sense that GNU and modern Unix tools typically attempt to be; they crash, usually by throwing an exception, if you feed them certain data, or worse, they silently corrupt it.

Markus Kuhn suggested "UTF-8B" as a solution to this problem some years ago. Quoting Eric Tiedemann's libutf8b blurb, "utf-8b is a mapping from byte streams to unicode codepoint streams that provides an exceptionally clean handling of garbage (i.e., non-utf-8) bytes (i.e., bytes that are not part of a utf-8 encoding) in the input stream. They are mapped to 256 different, guaranteed undefined, unicode codepoints." Eric's dead, but you can still get libutf8b from [http://hyperreal.org/~est/libutf8b/](http://hyperreal.org/~est/libutf8b/).

<comment><USER3> I'm willing to bet a large amount that non UTF-8 encoding were broken and nobody cared enough to bother fixing them.

OpenBSD does not hesitate to nuke legacy stuff that gets broken. Which i feel is ultimately for the best, because half-assed support that barely functions is worse than no support at all many times.

<comment><USER4> It was in fact intentionally broken to find out where removing single-byte locales hurts our users most.

We have a hackathon coming up with devs committed to making UTF-8 work in more base utilities. If that works out, and the most sore points of latin1/koi-8/etc users have been adequately addressed, 5.9 will ship with only the UTF-8 locale (and of course the default "C" locale -- ASCII).

If this approach turns out to be wrong because we cannot get regressions fixed, 5.9 will ship like 5.7 and 5.8 (with UTF-8 and single byte locales).

<comment><USER5> My first thought was, what about the "C" locale so good to see that question already answered.

I really wish there was some sort of standard "U" locale that would be the same as "C" but UTF-8, and ISO rather than US format dates.

<comment><USER6> That locale pseudo-exists. It's called "don't call the evil setlocale function, write in C90 as much as possible, do your own UTF-8 encoding and decoding, and implement the exact default date format you want with your own strftime string or whatever."

<comment><USER7> That doesn't exactly help me as a user, and possibly makes things worse as some things respect locale and some don't.

</comment></comment></comment></comment></comment></comment><comment><USER8> As a French-speaking person, I cannot tell you how much the announcement[0] that after 5.8, basic utilities, including mg(1), will be UTF-8 ready pleases me. I'm a huge Emacs fan, but I like to use mg(1) for quick edits and this is very exciting news for me!

[0] [http://undeadly.org/cgi?action=article&sid=20150722182236](http://undeadly.org/cgi?action=article&sid=20150722182236)

<comment><USER9> Funny thing about Emacs and OpenBSD...

...Emacs is the only package in the entire ports tree that can't use ASLR.

<comment><USER10> That can't possibly be true, the Go port also doesn't use ASLR.

<comment><USER9> I'm just quoting what an OpenBSD dev mentioned to me. I guess there could be more.

</comment></comment></comment></comment><comment><USER11> I dream of a world where everything is UTC, UTF-8, and metric.

<comment><USER12> Personally, I wish everyone used the 24:00 clock. Maybe the military has messed me up, but I really prefer seeing something like 18:22 over 6:22pm. It just seems simplier.

<comment><USER13> Yes couldn't agree more with that.

Also dates in numeric order I.e. yyyy/mm/dd you know like all the other numbers we deal with not dd/mm/yyyy or the crazy mm/dd/yy.

<comment><USER14> Use minus instead of slash and you have ISO 8601: yyyy-mm-dd

<comment><USER13> Sold.

<comment><USER15> 8601 also gives you proper week numbering (which Europeans tend to like) + weeks start on Monday, _after_ the weekend.

<comment><USER16> In some countries the weekend isn't Saturday and Sunday though. So the start of the week is kind of arbitrary.

<comment><USER17> Saudi Arabia used to have it's weekend on Thursday & Friday. Recently they've switched to Friday & Saturday.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Heh, I initially read it as "improves", and was wondering why they'd bother. Removing it is surprising, but makes sense.

</comment><comment><USER19> How does locale work on the keyboard side, then? What determines whether text entry is right to left or left to right?

<comment><USER20> Exactly the same as before -- your programs just expect UTF8 codepoints as input.</comment></comment>


New Microsoft commercial: Windows is a generic OS X substitute - <AUTHOR> http://technologizer.com/2009/03/26/microsofts-new-commercial-windows-is-a-generic-equivalent-to-os-x

<comment><USER2> That's the best Windows commercial I've seen...maybe ever.

It takes the one thing that Windows _clearly_ and demonstrably does better than Apple and advertises it. Microsoft has always had a bit of identity crisis...not realizing that Windows-based PCs are like Wal-Mart: a high volume business based on offering a lot of variety at a really low price.

Of course this could, theoretically, backfire. Really cost-conscious buyers might find the <$300 netbooks running Linux to be even more appealing, since they're $50-$100 cheaper than equivalent Windows-based units. $50 isn't much in a $1k lappy, but it's 15-20% of the price on netbooks.

</comment><comment><USER3> It's a very odd ad I think.

If you were to compare Windows vs. Mac OS X on price, Mac OS is cheaper ($129 vs. $199.95 to $319.95). So the ad ends up comparing the hardware, with which Microsoft has not much to do...

Another thing they kind of hint at is that Lauren in the ad looks like she would buy a Mac vs. a PC if they were the same price. So, it's not saying that Windows is better than Mac OS, it's just saying that she can't afford a Mac, thus buys a PC. The fact is you can't buy a PC with Mac OS X, so she has no choice but Windows. (leaving Linux out of the equation here)</comment>


Microsoft launches ambitious blockchain project to help creators get paid - <AUTHOR> https://thenextweb.com/hardfork/2018/06/21/microsoft-and-ey-launch-blockchain-for-copyrights-and-royalties/ <comment><USER2> Editing content. If you can't edit/combine/personalize content and resell it who cares. sounds like a lot of blockchain hype to me.

Figure out a way to compensate the original creator and derivative creator fairly with minimal negotiation and you created something truly unique.</comment>