Vote by Mail: Ballot Fraud Risk, State Laws and Trump's Claims - <AUTHOR> https://www.npr.org/2020/06/04/864899178/why-is-voting-by-mail-suddenly-controversial-heres-what-you-need-to-know <comment><USER2> People complaining about voter fraud shouldn't be taken seriously. If you cared about the integrity of US elections, voter fraud isn't where you'd start. It's a fraction of a percent compared to the election rigging that happens in the open.

Campaign finance makes a mockery of the campaign process. Voter id laws disenfranchise more people than fraudulently vote. Gerrymandering creates unfair advantages with malicious boundaries. Regular closing of the polls disenfranchises more people than vote fraudulently.

Voter fraud might be a problem, but it's minuscule compared to fraud of the elections themselves.

<comment><USER3> I did some analysis of vote data in Florida and found some fraud: [https://enki.org/2018/12/07/finding-unusual- voters/](https://enki.org/2018/12/07/finding-unusual-voters/)

I'm not convinced it is large scale enough to sway an election. It's mostly just a failure of the counties to coordinate with each other to prevent double votes.

Florida has had unrestricted absentee ballot voting by mail since 2002. Over 2.5 million Florida voters used it in the last two elections, so I think the recent noise about voting by mail is just a distraction.

I do think we need better coordination across the states. I am convinced that there are people with residences in multiple states getting more than one vote. Unfortunately, not all of the states are as transparent as Florida is with the vote data.

<comment><USER4> at best, you possibly found evidence, not fraud. leave the determination to judges and juries. intent matters and due process shouldn't be circumvented.

<comment><USER3> I agree with you that I should not have used the word fraud. I was careful in writing the original post and careless with this comment on HN.

</comment></comment></comment></comment><comment><USER5> Does anyone understand the security model of mail-in-ballots or have a good article about it?

This article suggests there is some security-through-obscurity with each county having its own ballot version, changed each election year.

They also mention matching voter registrations and signatures, but doesn't this defeat the principle of anonymous voting by putting your signature and name in the same envelope as your vote?

<comment><USER6> In Germany, you have two envelopes, outer and inner. The inner envelope contains your anonymous voting slip. I think it's basically the same one you get when voting in person. (Haven't been there for a long time.) It's what goes into the voting box.

The outer envelope contains the sealed (invalid otherwise) inner envelope and an affidavit where you declare that the vote was your own blah blah. This also doubles as your voting registration (dunno how to precisely translate it, it's a paper your receive that allows you to vote wherever or via mail).

So the security is that it's perjury if you're not voting properly. The anonymity is because the inner envelope is only opened when counting. The outer envelope is gone by then.

<comment><USER7> This would be fine in America. But that's not what we'd do. Instead, someone would file a lawsuit to count the "invalid" envelopes that were discarded because the outer envelope wasn't sealed properly. And they'd do it only in Democratic-leaning counties, where the Democrat could expect to get more votes from counting the invalid envelopes than the Republican.

(This is, in fact, almost exactly the trick Gore tried to pull in 2000, except it was counting invalid paper ballots only in counties that had gone in his favor.)

</comment></comment></comment><comment><USER8> We vote by mail in Switzerland every few months, for decades already. No major issues... [https://en.wikipedia.org/wiki/Voting_in_Switzerland#Mail- in_...](https://en.wikipedia.org/wiki/Voting_in_Switzerland#Mail-in_ballots)

</comment><comment><USER9> HN is usually pretty good at detecting insecure implementations and obvious attempts at subversion.

I wonder whats wrong in this case?

<comment><USER10> The crux is whether mail delivery of the ballot can be executed securely and verifiably, and whether failures can be corrected in a timely manner.

A few examples of where this can go wrong:

* Introducing third party ballot collectors risks bad actors manipulating the ballot pipeline, for example what we saw in 2018 in North Carolina's 9th district.

* The US mail is mostly reliable, but lost mail (in my experience) is still fairly common. While this would be a random occurrence, every election cycle involves several tight races, and a lost ballot can flip the results.

* In the event errors in ballot transmission occur, you need to correct them in a timely manner. This requires someone to put in the effort to proactively watch out for missing ballots. Individuals are lazy, and it might not be in the interests of partisan officials to try.

The severity of these and other issues largely depends on the volume of mail voting; the more mail voting the more incentive to try to subvert it. As with any security issue, the defenses against them need to be strong enough to make the attacks too expensive to execute. Just because we don't see fraud yet doesn't mean mail voting won't be targeted in the future.

<comment><USER8> This underlines how the actual bipartisan system winner-takes-all much too sensitive to minor (postal or otherwise) hiccups. In a proportional system wouldn't matter much if the difference between the lead positions was plusminus 1%... but okay, it is how it is.

</comment></comment></comment><comment><USER11> "The things they had in there were crazy. They had levels of voting, that if you ever agreed to it you'd never have a Republican elected in this country again." \- trump

<comment><USER12> If making it easier to vote hurts the Republican Party, then presumably it's on the Republican Party to make itself more appealing to people.

Incidentally, this is a VERY common argument against extending the franchise, and extremely self-serving. And also typically incorrect; the Tory party in the UK was terrified of letting all men vote, and then of letting all people vote; a century later, they're still getting elected (though of course they have a somewhat different character now that they have to appeal to people who aren't even male landowners...)

<comment> _-david-_ >If making it easier to vote hurts the Republican Party, then presumably it's on the Republican Party to make itself more appealing to people.

You could turn this around since its possibly that people who wouldn't normally vote but would vote if they could do a mail in ballot are probably less informed. The Republican Party is afraid that people who are less informed are more likely to vote for the Democratic Party.

<comment><USER13> Voter turnout is extremely correlated with income ([https://econofact.org/voting-and-income](https://econofact.org/voting-and- income)). The more likely explanation is that the Republican party is afraid that more poor people who currently can't afford to vote will suddenly have the resources to do so.

<comment> _-david-_ People who are poor are more likely to be working multiple jobs and would have less time to read / watch the news and as such I would be less informed about politics.

Because of that I would say my point would still stand.

<comment><USER14> People who exclusively watch Fox News have been shown to be less informed about politics than people who watch no news. Guess which party's loyalists watch exclusively Fox News?

Education correlates with increases in Democratic votes. Christianity with Republican ones.

It's not about information, it's about income.

<comment> _-david-_ >People who exclusively watch Fox News have been shown to be less informed about politics than people who watch no news.

There is a few issues.

1\. That study was from 2012. Things have quite possibly changed since then.

2\. The study did not take a look at age. The average Fox News viewer is older than most news shows. Older people have worse memory. A study should look at the various age groups to make sure that it is not just old people not knowing stuff. I am guessing young people who watch Fox are more informed than old people who watch Fox.

3\. What is the correlation between Fox News viewers and voters? Its possible that most Fox News people don't actually vote and as such bringing up Fox news is irrelevant to the conversation.

4\. What is the correlation between poor people and Fox New views? Since we are talking about poor people it seems like you should have included this.

>Guess which party's loyalists watch exclusively Fox News?

There have been studies that show the majority of Fox News viewers watch news from multiple news sources.

>Education correlates with increases in Democratic votes.

Being educated does not mean informed about politics. Having a bachelors in biology doesn't mean somebody knows anything about various policies.

>Christianity with Republican ones.

In 2014 it was estimated that 84% of democrats believed in God to varying levels. Christianity is common throughout both parties.

>It's not about information, it's about income.

I agree that there is a difference in voting based on income but that does not mean it is because of income.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> This isn't a debate. Many states have had mail in ballots for decades and some use them exclusively. This is established practice and we know that suspected fraud cases occur extremely rarely. Just because our idiot president and his even dumber followers think something stupid is an issue doesn't make it so.

</comment><comment><USER16> > _The opposition to mail voting is anchored by Republicans in states that don > 't offer wide access to mail voting already.

The president has made it clear that despite voting by mail himself multiple times, he does not support wide expansion of the practice._

Occam's Razor apllies here.

<comment><USER17> >The president has made it clear that despite voting by mail himself multiple times, he does not support wide expansion of the practice.

If we take off our hate-goggles here, this really isn't the gotchya that journalists want you to think it is. One can be qualified to legally vote by mail and do so while also claiming that overall the system is broken.

<comment><USER16> Did you read the very next paragraph in the article after what I quoted? The claims were based on bogus evidence.

Not everyone who disagrees with you has "hate" in them.

</comment></comment></comment><comment><USER18> There are over 3000 counties or equivalents in the US and each one has their own particular take on the mail-in process. This isn't where I would start if I wanted to influence the tallies beyond a strictly local level...

</comment><comment><USER19> I've been voting by mail in Colorado for at least three years of memory, and I've seen zero reports of any systemic issues. Utah and Oregon are the same from what I know. Both Germany and Switzerland have mail voting, and there isn't any strong statistical data showing an abundance of voter fraud.

However, this doesn't stop my rural farming parents from screaming about rampant voter fraud and "The Dumb-o-crats" trying to take advantage of the system. Yes, they also live in Colorado and vote by mail.

The propaganda works, even on decent people. We have a HUGE misinformation issue to solve in this country before any complex issue like our voting system can ever be talked about seriously.

Those of us that put real work effort into being properly informed, know the real issue is turn-out and how voting by mail enables polling to have MUCH MUCH higher turn-out. This is a problem for one of those parties that have been able to hang onto power through less than ethical means of manipulation and reducing voter turn-out from population bases they look down their nose at.

This isn't my opinion, its fact. It's strategically brilliant by them and their playbook is exceptionally effective. And THIS IS WHERE THE PROBLEM IS.

People like my folks are good, decent people. But they're intellectually lazy and are victims to the propaganda machine that runs across their televisions every day. If vetted information was presented in an easy-to-relate way, they would see what I see. But somehow Trump and the right have figured out a single childish label for complex societal issues chanted over and over again, mentally over-powers the thousands of hours living a life of the exact opposite.

It's shocking how well the right has dialed in their messaging. My parents work in the trees and fields, under the hot sun, nearly every day in the summer next to the same people they'll later chant are ruining their "American Prosperity." They nearly bankrupted themselves, keeping these same workers paid during COVID, because they weren't going to let them go hungry or lose their homes. But they'll talk about the rampant welfare state and the need to gut it over dinner.

Somehow, they don't relate what they see in politics with what they're living every day. It's like it's two different worlds for them, and I'm dumbfounded by how the propaganda has created that reality within them.

Voting issues, welfare, and/or any single issue directive won't overpower this reality we live in now. We HAVE to solve this information issue first.

</comment><comment><USER20> John Oliver summed this up pretty well.

[https://m.youtube.com/watch?v=l-nEHkgm_Gk](https://m.youtube.com/watch?v=l-nEHkgm_Gk)

It looks like the age of Independent candidates is upon US. The existing burdens/obligations prevent the existing parties from seeing the future.

<comment><USER20> Whoops! Shouldn't have mentioned Independant.

The defenition of puppet is someone else dictating the words and actions, so if your not amazed currently, you're just not a fan of puppet shows.</comment></comment>


Endless OS 3: Linux for the Net Less - <AUTHOR> http://fossforce.com/2016/09/endless-os-3-linux-net-less/ <comment><USER2> > you can only install programs from the Endless App Center.

nope. noooopppeeeee</comment>


Show HN: Service Mocker – Mock your API server inside the browsers - <AUTHOR> https://github.com/service-mocker/service-mocker <comment><USER2> Something very similar already exists: [https://github.com/pretenderjs/pretender](https://github.com/pretenderjs/pretender)

I don't think it's a good idea in general to mock server responses because they are subject to change while the mocks don't, better to just run the server and make a real request.

<comment><AUTHOR> The main difference between Service Mocker and pretender is that we are using service worker API, therefore the HTTP requests and responses are real and can be inspected in devtools.

And usually, we mock an API while the server isn't ready to use. For example, when you just started a new project with backend dudes, it's highly possible that the server is unusable for the first few days, that is the best time to mock your APIs with such a tool :).</comment></comment>


Erlang-like Hot Code Loading in Node.js - <AUTHOR> http://romeda.org/blog/2010/01/hot-code-loading-in-nodejs.html

<comment><USER2> I'm glad that someone thought my post to be interesting even though no one found it to be good enough for a direct HN submission. However, I would like to disagree with the statement of my hack lacking subtlety.

The way the Node.js method is performed is by changing the binding of a function. This is possible in any dynamic language that has functions as first-class variables such as Python. Because that type of reloading is quite old, programmers have had a lot of time to find many problems with it: which is why people are hesitant to suggest using Python's reload.

One of those problems is consistency. While I can't think of a simple example off the top of my head, the blog author here acknowledges it's presence which I believe he will soon find to be a big problem.

And most importantly, my method allows you to use a new binary. What happens when you want to upgrade the V8 virtual machine because it has a memory leak or a security problem? With function loading you will still need to restart.

I think Node.js will be better off implementing the spawn method I documented.

</comment><comment><USER3> This is seriously cool. I'm constantly impressed with the amount of innovative things done with node.js. It's a very powerful ecosystem of tools being developed in front of our eyes.

</comment><comment><USER4> One of the thing proper to Erlang's hot code loading is that it uses a vm- centralized code server that handles and garbage collects the different versions of code.

This server can in turn notify subscribers about code changes; the OTP framework uses this to propagate code upgrades in its behaviours (gen_fsm, gen_event [and all the handlers], gen_server) with a callback function that lets the programmer define what changes to the data structures and state currently in running code have to be applied.

Does node.js have anything similar to that? Or is there anything of the kind planned?

I don't really know the in and outs of node.js, but from the blog post, it seems like there's no way to update current state and the only real upgrades will be done on new calls. Is this because node.js just doesn't have the same objectives in mind?</comment>


Why every entrepreneur needs to learn to code (something) - <AUTHOR> https://medium.com/architecting-a-life/c2b101b71ff3

<comment><USER2> "Ultimately, I'm in this for the long-game. And the decision to put in the hard work now comes down to the fact that it's a gateway to a new kind of freedom. A freedom I never had before. Knowing how to code will allow me to be able to act on ideas whenever inspiration strikes, to execute my own visions without having to find someone (and pay someone) to do it for me."

This is so great. I think a lot of people easily get sucked into the moment and keep their head down task to task. They come out of it months or years later and realize they've been making a huge mistake.

It may not feel like there are instant payoffs at this point, but if you stay focused and work hard, there is no way it won't pay off 1, 2, 3+ years from now. Good work :-)

<comment><AUTHOR> Yup. Totally. It's really hard to do the things that don't pay off now - especially when you're struggling to get started growing a business. But if you're able to carve out at least some of your time for longer-term goals I think the payoff is going to be huge.</comment></comment>


Strangest Language Features - <AUTHOR> http://stackoverflow.com/questions/1995113/strangest-language-feature <comment><USER2> Smalltalk's "cascading" operator is a strange (in the nicest way possible, it's mostly strange that nobody else has it) feature: a pretty popular style in OO languages these days is "fluent interfaces", in which methods return their `this` and — through method chaining — developers can call several methods on the same object while limiting verbosity. This style is of course possible in smalltalk:

        foo.bar().baz()

becomes

        foo bar baz

and if `bar` returns `self`/`this`, `baz` will be called on the same object. However, this has the issue that method implementors have to choose between fluent interfaces and returning useful values, as the fluency is decided by the return value domain for the method.

Smalltalk sidesteps this by having an operator `;` which essentially means "the message after this operator is sent to the same object as the message before this operator". As a result, in the example above you could have `bar` returning the height of the empire state building, and you'd still get the exact same result by writing:

        foo bar ; baz

(a message cascade returns the value returned by the last message)

Smalltalk was/is not fond of literal syntaxes, so its collection APIs (as far as adding to them goes anyway) look a lot like Java's, yet you could write things in a terser manner by using cascading:

        c := (ArrayList new) add: 3
                           ; add: 4
                           ; add: 5
                           ; add: 6
                           ; yourself.

is equivalent to:

        c := ArrayList new.
        c add: 3.
        c add: 4.
        c add: 5.
        c add: 6.

(note `yourself`, which does exactly what it says: it returns its `self`)

(and yes I know you can combine Java's anonymous subclasses and instance initializers to get something similar, in the specific case of instantiating non-final collections).

<comment><USER3> > it's mostly strange that nobody else has it

It looks like it is the same as clojure's doto macro:

<http://clojuredocs.org/clojure_core/clojure.core/doto>

And it is strange more languages don't have it.

<comment><USER2> It is pretty nice (and makes Clojure jump up a place or two in the completely unranked list of "languages I really need to learn"). It looks very similar yes, although there's a difference in that `doto` can only returns its `this`.

<comment><USER4> Clojure has something even cooler than doto. It's called "thrush operators":

<http://clojuredocs.org/clojure_core/clojure.core/-%3E> and <http://clojuredocs.org/clojure_core/clojure.core/-%3E%3E>

</comment></comment></comment></comment><comment><USER5> COBOL's ALTER statement.

As if COBOL weren't WTFy enough, the statement ALTER X TO PROCEED TO Y changes any subsequent GOTO X statement to go to Y instead. Meaning it's anybody's guess where a given GO TO, considered in isolation, goes to!

<comment><USER6> I upvoted you because it is the first thing I think of when I think of this question, but in Cobol's defense, self-modifying code (<http://en.wikipedia.org/wiki/Self-modifying_code>) was fairly normal at the time COBOL was conceived.

For a nice example from a later date, look at the GetChar subroutine on Commodore Basic. It loaded a byte from a hard-coded address, and then updated that address (hm, probably in the reverse order, since, IIRC, it shared code with GotChar, which returned the last value GetChar returned)

</comment></comment><comment><USER7> I find the amount of 'closed' questions on StackOverflow rather frustrating. I don't see how artificially restricting questions like this helps the site.

That said, I find the responses rather unsatisfying. Language design errors and quirks rather than unusual but useful features.

<comment><USER8> Counterpoint: I find it refreshing. In my opinion many otherwise interesting virtual communities degrade due to lack of some form of moderation.

I don't see it as artificially restricting questions. They're enforcing the rules that preserve the character and quality of the site. It's not arbitrary:

> _This question is not a good fit to our Q &A format. We expect answers to > generally involve facts, references, or specific expertise; this question > will likely solicit opinion, debate, arguments, polling, or extended > discussion._

There are other places for that sort of free-form discussion. Separating them from the factual Q&A is a win-win.

</comment></comment><comment><USER9> The fact that this question is closed is one of the things that annoys me the most about stackoverflow. It sometimes seems like people can't ask interesting questions without others getting offended.

<comment><USER10> Seems everything that isn't a direct question/answer gets closed. Seems like they miss an opportunity with the discussion questions. They have really smart community that can't really converse on the site of something doesn't fit into he narrow question and answer definition.

<comment><USER11> That's the _whole point_ of StackOverflow. It's not a discussion platform. It's a Q&A platform. You can dispute whether that's a good idea, but they know exactly what they are doing.

</comment></comment></comment><comment><USER12> Common Lisp has a global variable called _read-base_ ,which controls also base numbers are read in with. This, IIRC, was put in because some earlier Lisps read numbers in octal, while others used decimal. Setting this variable to something higher than 10 can give you strange results. For example,

        nil
        => NIL
        (eql '() nil)
        => T
        (setf *read-base* 36)
        nil
        => 30477
        (eql '() nil)
        ERROR: 19101 is not a function name; try using a symbol instead
        (|EQL| '() nil)
        => NIL

For you non-lispers, the empty list '() is equal to the "false" value, nil. Also, the pipes are special syntax to allow for symbols which normally not parse as symbols. (The uppercase is for historical reasons too).

The moral of this story: "See that control variable over there, the one that does weird things to parsing? Don't touch it unless you know what you're doing."

<comment><USER13> I presume that CL standardized on a base as a default, though? Otherwise you have an appropriately recursive problem that every base is "base-10" in that base.

edit: (setf _read-base_ (+ 1 1 1 1 1 1 1 1 1 1)) :)

<comment><USER12> I just went and checked, and the standard gives a default value of "10." for _read-base_ , so decimal by default (I think). It also says:

"Notes:

Altering the input radix can be useful when reading data files in special formats. "

</comment></comment></comment><comment><USER14> Second SO repost. Previously discussed with > 80 comments here:

<https://news.ycombinator.com/item?id=1601062>

<comment><USER15> I have to admit that I upvoted the post because I had never seen this before, and the previous discussion is nearly 1.5 years old.

That said....how did this get resubmitted? They both have the exact same URL

\---- # edit: I see...one URL is <http://stackoverflow.com/questions/1995113/>

The other has a slug in it: [http://stackoverflow.com/questions/1995113/strangest- languag...](http://stackoverflow.com/questions/1995113/strangest-language- feature)

I thought HN had some kind of redirect-autofollow that sniffed this kind of thing out? Or at least that's why I assumed hitting "submit" can result in a long delay, even before you're told that the title is > 80 ( _I wish there were a javascript validator for title length, while I'm pondering things..._ )

<comment><USER16> Nope, even just appending a slash to a URL will get you past the dupe filter. Even beyond that, though, the filter only looks at recently accessed posts, so something with that long a gap between reposts almost certainly wouldn't get flagged.

</comment></comment></comment><comment><USER17> No COME FROM?

<http://en.wikipedia.org/wiki/COMEFROM> <http://c2.com/cgi/wiki?ComeFrom>

<comment><USER18> It's in the middle of the first page: <http://stackoverflow.com/a/1995275/221786>

</comment></comment><comment><USER19> I love the first answer to that question. And not just because I wrote it :)

A little bit of C trivia:

In C, arrays can be indexed like so:

a[10] which is very common.

However, the lesser known form (which really does work!) is:

10[a] which means the same as the above.

<comment><USER20> similarly, the 'approaches' pseudo-operator:

while (i --> 0) { /* do something */ }

<comment><USER21> For some variety, there's also the left-handed "goes to" operator.

        while (5 <-- x) {} //omits the zero

and the much easier to type

        while (x --- 0) {} //equivalent to the "-->" operator

</comment></comment></comment><comment><USER22> For more JavaScript awesomeness on par with what's already presented, see <http://wtfjs.com/> =)

</comment><comment><USER23> I have to say, this is what I come to HN for. I learned a lot from that link and doing wikipedia searches kept me entertained during lunch.

</comment><comment><USER24> What about strangest programmers needs :D : [http://stackoverflow.com/questions/8525199/how-to-store- java...](http://stackoverflow.com/questions/8525199/how-to-store-javascript- code-without-it-executing)

Edit: I think the title of the question was edited, the original was something like : "How to store javascript code in jquery variable without it executing?"

</comment><comment><USER25> PHP; converts array('123' => 0); into array(123 => 0);

Which I came across as a problem when working with mongodb as it will only except strings as keys (not sure if this is enforced by PHP and/or mongo). Luckily you can create a class with numeric properties and pass that to mongodb which will then be treated as strings i.e

$array = new stdClass; $array->{123} = 0;

<comment><USER26> > only except strings

A strange feature of the English language is that this doesn't work; you have to use 'accept' here.

</comment></comment><comment><USER27> Similar, but for more exotic languages: "What is the worst programming language you ever worked with?" [http://stackoverflow.com/questions/961942/what-is-the- worst-...](http://stackoverflow.com/questions/961942/what-is-the-worst- programming-language-you-ever-worked-with)

</comment><comment><USER28> Icon's conditional statements were pretty odd <http://en.wikipedia.org/wiki/Icon_(programming_language)>

</comment><comment><USER29> The Multi-Dimensional Analog Literals template in C++ is amazing.

</comment><comment><USER30> Ah yes, all the Perl special variables! I actually did get scoffed at at work for using "use english" (while taking care it didn't affect regexps).

</comment><comment><USER31> Identifiers with blanks:

<http://tibleiz.net/zinc/>

(not that strange, but not so common)

</comment><comment><USER15> Wow...not a single SO response that said Ruby? I guess that's a good thing for us Rubyists?

<comment><USER32> Actually, there is, just not as many upvotes as the others.

<http://stackoverflow.com/a/2026849>

Basically, it is possible to inherit a random class in ruby.

        class RandomSubclass < [Array, Hash, String, Fixnum, Float, TrueClass].sample
           ...
        end

<comment><USER33> I wouldn't call that a strange feature, just a surprising consequence of an un-strange feature, namely that inheritance involves expressions and that classes are first-class entities.

Folks from certain other languages would be just as surprised to find out that you can alias classes by assigning them, return them from functions, and so on.

</comment></comment></comment><comment><USER34> PHP: Personal favorite I used to quiz my students on:

$a = "5 Monkeys";

$b = "2 Bananas";

var_dump($a);

string(9) "5 Monkeys"

var_dump($a + $b);

int(7)

</comment><comment><USER35> This is an evil bug in Javascript

parseInt('06') // 6

parseInt('07') // 7

parseInt('08') // 0

parseInt('09') // 0

parseInt('10') // 10

parseInt should really return NaN for '08', '09' etc

<comment><USER36> Octal notation, with an invalid number. Makes perfect sense.

It's not a bug, behaves like specified:

[https://developer.mozilla.org/en/JavaScript/Reference/Global...](https://developer.mozilla.org/en/JavaScript/Reference/Global_Objects/parseInt)

If parseInt encounters a character that is not a numeral in the specified radix, _it ignores it and all succeeding characters and returns the integer value parsed up to that point_. parseInt truncates numbers to integer values. Leading and trailing spaces are allowed.

[...]

 _For this reason always specify a radix when using parseInt._

<comment><USER37> "Behaves as specified", "makes perfect sense", and "not a bug" are three entirely different concepts.

It does _not_ make perfect sense to anybody who's never used octal. That is presumably the vast majority of anybody born past, say, 1980.

As such, it _is_ a bug in the sense that it violates expectations. It's just a bug in the spec, not in the code.

<comment><USER36> Numeric constants starting with 0 define octal values in many languages, hell they do so even in Java. Does that mean all those languages are buggy? I'd say you're going to find features that don't make sense to anyone who's never used them...pretty much anywhere.

I would think the issue is more the behavior of "parse as much as you can until you can't, and return what you got so far", which is what causes the unexpected result of returning 0 instead of bailing out. However _that_ apparently wasn't fixed in ECMAScript 5, presumably for backwards compatibility.

<comment><USER37> I'd say that the entire concept of octal literals is a bug, yes. (It's almost _entirely_ useless, a leftover from the days of yore. When for Christmas, we got naked, wrapped ourselves in punch tape versions of the latest "editor", and danced around the Christmas tree while setting the line printer on fire. But I digress.. ;)

But fine, if I at least got "undefined" (well, null) as a result of parsing an invalid octal string, it'd be not quite as bad. So yes, if we talk root causes, you put your finger on that. The anachronism of octal parsing just exposes it.

</comment></comment></comment></comment></comment><comment><USER38> In JavaScript:

        (NaN === NaN) is false
        (NaN !== NaN) is true

<comment><USER33> This is isomorphic to NULLs in some languages (I think SQL behaves this way). Basically, NaN isn't some specific thing, it's an indication of something that isn't a number. So two things that aren't numbers can't be thought to be equal to each other, they might be radically different things.

If there's a WTF, it's that NaN === NaN is either true or false. If I were writing a language, it might be undecideable. But if you end up with:

        Undecideable === Undecideable //=> Undecideable

You are opening up the "Hopelessly Egocentric Null" can of worms:

[https://github.com/raganwald/homoiconic/blob/master/2009-02-...](https://github.com/raganwald/homoiconic/blob/master/2009-02-02/hopeless_egocentricity.md)

<comment><USER2> > I think SQL behaves this way

Yes. It's also how NaNs are supposed to work according to IEEE-754.

The only reason why it can be strange in javascript is that it's pretty common to encounter nans in JS as the language tries very hard not to throw errors and likes nans a lot (so `parseInt('foo')` returns NaN instead of `null` or an error), whereas it's very rare in other languages. Pretty much all languages have nans, and all nans behave this way. Here it is in Python:

        >>> float('nan')
        nan
        >>> float('nan') == float('nan')
        False
        >>> float('nan') != float('nan')
        True
        >>> a = float('nan')
        >>> a == a
        False
        >>> import decimal
        >>> decimal.Decimal('NaN')
        Decimal('NaN')
        >>> decimal.Decimal('NaN') == decimal.Decimal('NaN')
        False
        >>> a = decimal.Decimal('NaN')
        >>> a == a
        False

edit: now that I think about it, there is a difference: in SQL, all operations involving `NULL` (including comparisons) return `NULL`, so `NULL = NULL` => `NULL` and `NULL != NULL` => `NULL`.</comment></comment></comment>


Using Ed25519 signing keys for encryption - <AUTHOR> https://blog.filippo.io/using-ed25519-keys-for-encryption/ <comment><USER2> The edcurve.js project( [https://www.npmjs.com/package/ed2curve](https://www.npmjs.com/package/ed2curve) ) was apparently doing something similar already, but the author disclaimed: "Note that there's currently no proof that this is safe to do." while referring to a 2013 stackexchange discussion on the subject: [https://crypto.stackexchange.com/questions/3260/using- same-k...](https://crypto.stackexchange.com/questions/3260/using-same-keypair- for-diffie-hellman-and-signing/3311#3311).

It may be necessary to formally prove that combined use does not introduce new vulnerabilities.

The phrase "What remains open for future work is checking for cross-protocol attacks", is quite ominous in this respect. For example, combined use could gradually leak private bits to the attacker. Therefore, the status of this combined use strategy is still the same as ever before: doubtful.

</comment><comment><USER3> > What remains open for future work is checking for cross-protocol attacks. > [...] I can't see such an attack, but if you can, let me know on Twitter.

So we know using the same key for signing and encryption is catastrophic for general public key schemes. We don't know of any attacks in the Curve25519 case. Does anyone know of any proofs or partial results that might apply? Proof by absence of tweets feels a tad unsatisfactory.

<comment><USER4> > _using the same key for signing and encryption is catastrophic for general > public key schemes_

Weird thing, I'm fifteen years in web programming with an interest in crypto, but it's the first time I hear that, at least in such categorical form. On the contrary, it's usually "public-key crypto allows you to have both this and that."

<comment><USER5> The bit being referred to is how signing and encryption can be inverse operations of each other in some schemes. The canonical example is textbook RSA. Signing is the same operation/math as decryption. Likewise, verifying signatures and encryption are the same operation/math. So, if one used textbook RSA for both things under the same key pair, then an encrypted blob under public key PK could be decrypted if you can get the same person to sign that same blob using secret key SK. In other words, in textbook RSA sign(private, encrypt(public, message)) == message.

There are things that make this less trivial to exploit for non-textbook cases. But, either way, it is generally easier to mostly go with "don't use the same key for both signing and encryption" so you don't have to do a bunch of stuff to figure out if a given construction is safe. If Filippo is supporting RSA ssh keys, I'd love a post walking through the way to prove that reusing RSA keys turns out to be safe if done carefully/thoughtfully.

</comment></comment></comment><comment><USER6> > @Benjojo12 and I are building an encryption tool that will also support SSH > keys as recipients, because everyone effectively already publishes their SSH > public keys on GitHub.

Is this not already possible with tools like [https://ssh- vault.com/](https://ssh-vault.com/) and (shameless plug) [https://sshenc.sh/](https://sshenc.sh/)?

Those tools use the RSA keys to encrypt a symmetric key that is then used to encrypt the data, but the outcome is effectively the same. No?

<comment><USER7> Don't those run afoul of the linked white paper (under "dangerous" in the 2nd paragraph), which talks about the attack paths made available if an RSA key is used for signing and encryption?

<comment><USER6> I don't think so: neither of those tools sign the message with the same RSA keypair. sshenc.sh for example does not sign the message whatsoever. An attacker could just intercept a ciphertext, drop it, encrypt a different message and send that.

Those tools are not meant for sender authentication. If you want that you would have to first share the senders pubkey with the recipient, and sign your message with the corresponding privkey.

<comment><USER5> While the tools themselves might not use the same key for both operations, I think the question was asking about whether it is problematic that a user's SSH keys, used in SSH for signing, are also used by these tools for encrypting. In other words, the concern being the same key is used for two different operations, even if not in the same tool.

As I commented in [https://news.ycombinator.com/item?id=19953623](https://news.ycombinator.com/item?id=19953623), I'd love to see another blog post walking folks through why/how the "dangerous" RSA keys are in fact useable for both operations because the textbook RSA concerns aren't a concern because of X, Y, and Z.

</comment></comment></comment></comment><comment><USER8> NATS is moving to an Ed25519 based auth system as well - [https://github.com/nats-io/nkeys](https://github.com/nats-io/nkeys)

</comment><comment><USER9> It's possible to rule out some (but not necessarily all) cross-protocol attacks with a simple and cheap tweak. I have not proved that this rules out everything, but it appears to be no weaker than the scheme sans tweak, and proofs shouldn't be too hard.

The high-level idea is to derive a new encryption key from the recipient's signing key, such that only the recipient knows the secret. This is similar to HD wallets[1] and some recent work by Dauterman et al.[2]. It's easy to show, following the work of Morita et al.[3], that EdDSA is secure against (certain) related-key attacks. This means that, even if an adversary has a signing oracle for the derived key, it cannot forge signatures under the original key.

Alas, this is incomparable with giving the adversary a decryption oracle for the derived key, which means it's worth thinking about whether it's possible to prove some extra properties. It's also worth thinking about the other direction: does a signing oracle for the original key let an attacker break the encryption scheme? Again, I haven't proved these things, but it seems like it ought to be possible.

Here's the idea in detail. First, definitions:

\- q = 2^252 + 0x14def9dea2f79cd65812631a5cf5d3ed, the order of the Curve25519 group [1]

\- (SK, PK) = (s, s * G) is an Ed25519 key pair (base point is G, * is elliptic curve scalar multiplication)

\- <PK> is some well-known encoding of PK as a bitstring

\- a || b is the concatenation of a and b

\- ID is some fixed string that identifies this ciphersuite, say, "age_ssh_ed25519_encrypt_v1"

\- I2OSP and OS2IP are standard conversions between integers and byte strings as defined in RFC8017 [5]

Now, to encrypt to the derived key, do the following:

1\. Let t = OS2IP(SHA256(ID || I2OSP(0, 1) || <PK>) || SHA256(ID || I2OSP(1, 1) || <PK>)) mod q. In other words, t is a (nearly) uniformly random element of Zq obtained by hashing the recipient's public key.

2\. Let PK' = t * PK, where * represents elliptic curve scalar multiplication.

3\. Encrypt your message to PK' rather than to PK.

Finally, to decrypt, the recipient does the following:

1\. Compute t exactly as above.

2\. Let s' = s * t, where s = SK is the secret key.

3\. Decrypt the message using s' as the secret key.

Note that in this scheme, everyone who encrypts to the recipient who owns (SK, PK) uses the same key. It's possible to derive a per-message key instead: choose a random nonce, hash it along with <PK> in the first step, and send it along with the message. Alternatively, you could derive a per-sender key by hashing both the sender's and recipient's keys. It's not obvious to me that per-message/per-sender keys improve security at all, and it's plausible that they somehow weaken it (since letting the attacker set the input to the hash allows it to choose among polynomially many PK'). So unless you decide that per-message keys are necessary for security, I wouldn't bother.

[1] [https://github.com/bitcoin/bips/blob/master/bip-0032.mediawi...](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki)

[2] [https://arxiv.org/abs/1810.04660](https://arxiv.org/abs/1810.04660)

[3] [https://eprint.iacr.org/2015/1135](https://eprint.iacr.org/2015/1135)

[4] [https://cr.yp.to/ecdh.html](https://cr.yp.to/ecdh.html)

[5] [https://tools.ietf.org/html/rfc8017](https://tools.ietf.org/html/rfc8017)

<comment><USER10> I don't honestly see what kind of attack could be defeated by multiplying by a fixed value (maybe because there isn't one, or likely because I simply can't) but sure, why not! It feels like good hygiene, can be done with just the X25519 function and a scalar field multiplication, and I imagine it can help with proofs.

Any reason not to use a simpler SHA-512(ID || <PK>) value for t?

BTW, I was about to report an errata for RFC 8017, until I realized they inverted both the order and the starting index in going from X_n to x_n... yeah, as much as I'd like not to redefine that function every time, I might keep calling it big endian fixed size encoding.</comment></comment>


Why you really shouldn't use MP3 in your HTML5 and Flash games - <AUTHOR> http://www.scirra.com/blog/64/why-you-shouldnt-use-mp3-in-your-html5-games

<comment><USER2> _The MP3 licensing website states at time of writing that an MP3 license will cost US $2,500 per game title. In their own words, a game is described as:_

 _"Interactive software products intended to interact with a user for entertainment (action, role play, strategy, adventure, simulations, racing, sport, arcade, card and board games) and/or education, that may be published for multiple machines, platforms or media"_

 _There is a small saving grace:_

 _"No license fees are due if less than 5,000 copies of a particular game title are distributed"_

 _Distribution of a particular game is not exclusive of web distribution! Take one of our most popular arcade games for example, "8 Bit Runner". To date it's far surpassed 5,000 plays. In their eyes this could easily qualify as 5,000 distributions. Had the author used MP3, they'd then be due to pay the MP3 licensers $2,500 for a small online game._

I had absolutely no idea that MP3 has such a license.

<comment><AUTHOR> I think it's a big problem as we didn't know either until we started writing our game engine and doing some research</comment></comment>


Free Range VHDL : Introduction to VHDL (pdf) - <AUTHOR> http://www.freerangefactory.org/dl/free_range_vhdl.pdf <comment><USER2> I really encourage people to take a look at Verilog as well. I think it is much easier to learn and much more expressive. To get equivalent functionality with VHDL, you usually have to write three times more code.

<comment><USER3> Agreed. SystemVerilog is now 90% of the market in the US. VHDL is now mostly used by a few fancy UK companies and the Defense industry.

I'm still looking for an online community of hardware developers like HN. Smenow, John Cooley's mailing list feels too 80s for me and Janick Bergeron's verification guild just never had enough traction. Is HW intrinsically more boring?

<comment><USER4> Not trying to be snarky at all, but can you cite a reference re: SystemVerilog = 90% of the US market? Very curious as I would consider myself to be a pretty experienced HDL user and have never seen SystemVerilog in the wild. I am guessing this is a FPGA vs. ASIC thing.

<comment><USER3> Yes, sorry, I meant for ASIC design of consumer chips.

</comment></comment></comment></comment><comment><USER5> This is a free online introduction to VHDL that doesn't suck, and for writing it, you are now officially a Hero of the Universe.

I wish I had had this a few years ago.

</comment><comment><USER6> I just skimmed over this, and was rather bothered by the fact that they just jump directly into syntax. There's essentially zero discussion about simulation or design.

Writing VHDL isn't programming. If you treat it like it is, you might get something that works in simulation, but it's going to be horribly inefficient at best, and will more likely not work at all in hardware.

<comment><USER7> I don't think it's helpful to refer to VHDL as "not programming". It _is_ programming, just in an inherently parallel, declarative fashion rather than an imperative one. My favourite metaphor for programming in an HDL is to think of it as building a computer or writing a program using expressions in a spreadsheet.

<comment><USER8> I have a background in Electrical Engineering, and when coding in a hardware description language, I feel that instantiating and connecting entities is like drawing a hierarchical schematic but in text mode. And writing the RTL implementation of an entity is like giving requirements to the synthesis tools that I need a bunch of gates and flip flops that implement this functionality. When coding in some programming language, I have a completely different mindset.

Programming usually means coding in some language that will be compiled to machine language, and hardware description is so different kind of "programming" that I think it's dangerous to call it programming at all.

</comment></comment></comment><comment><USER8> Why do they sometimes include other signals than clock and asynchronous reset/set in sequential process sensitivity lists? For example D in Listing 6.2. The extra signals in the sensitivity list don't add any functionality, and might be confusing to the reader.

It's probably good to teach the two process FSM first, because it resembles the mathematical model, but back when I did VHDL design, I found single process FSMs more straightforward. Can't remember what they looked like exactly, but something like Thompson's answer here: [http://stackoverflow.com/questions/5961751/encoding-state- ma...](http://stackoverflow.com/questions/5961751/encoding-state-machines-in- vhdl)

<comment><USER9> You're right - including 'D' in the sensitivity list is incorrect and is a good way to lead to the synthesis of latches. Sensitivity lists should only include the clock, or clock and an asynchronous reset, or if it's combinatorial logic, all signals (with no clock).

The best explanation I've seen for two and three process FSMs is that older synthesis tools weren't smart enough to infer an FSM from anything else. At least with FPGAs, it seems like the professionals are only using the single process model. Why wouldn't you? It doesn't separate related pieces of code over multiple pages and the chance for stuffing it up is reduced significantly.

Teach people to use the single process model. Teach them that two and three process FSMs exist so that they can identify and understand them, but don't waste too much time on it. Some of the textbooks I've read devote a chapter to the distinction between Mealy and Moore state machines. Time to let this one die!

</comment></comment><comment><USER10> This will be immensely useful for me. I just began to self-study "From NAND to Tetris in 12 steps", and going to use actual real world HDL instead of the authors toy language.

</comment><comment><USER11> Excellent! We need someone to create something similar for Verilog / SystemVerilog

</comment><comment><USER12> Beyond off topic:

The second, sixth, and twelfth pages of the PDF file are blank. The fifth page is nearly blank, except for the auto-erroneous notation that is was intentionally left blank. We are left with the ambiguity of unintentionally blank pages, or pages that refused to be corrupted by self negating declarations of their absence of content.</comment>


Show HN: Paletro – Enable Command Palette (⇧⌘P) in any applications on macOS - <AUTHOR> https://appmakes.io/paletro <comment><USER2> "$6.99 • 14 days free trial Version 1.0 — macOS 10.14 or later"

</comment><comment><USER3> there's already an extension for this for Alfred (the mac launch bar) and it's pretty customizable and works very very well. (shows hotkeys too)

<comment><USER4> Can you elaborate on this?</comment></comment>


Why huge gains in drug discovery tech have led to longer drug development times - <AUTHOR> https://www.hdphealth.com/2016/03/04/one-of-the-most-important-biopharma-research-papers-of-our-time-qa-with-the-authors/ <comment><USER2> The authors argue for using better predictive models to screen drugs at an early stage, because too many drugs are failing at costly clinical trials.

In my opinion we already know the best predictive model to use, but we choose not to use it. When Jenner developed the first vaccine back around 1800 he didn't use any petri dishes or mathematical models: he just found some nearby children and tested his theory directly.

Now you may find this ethically repulsive but from a consequentialist point of view it was the right thing to do at the time. This line of research saved hundreds of millions of lives.

I say we have gone too far in the other direction. The problem with failed costly clinical trials is not the failure per se but the cost: in money spent, time, reputation, commercial return, legal consequences, etc. And the hidden cost of how long the whole process takes even if successful.

Take the field of monoclonal antibodies. We now have almost off-the-shelf technology to develop drugs that specifically block certain biological mechanisms. But it still takes 10-15 expensive years to progress through different lab and animal models, then healthy humans, before clinical trials on actual patients.

Instead we should reduce the cost of human trials: have a network of terminally ill volunteers to test mabs at an early stage. Fail fast to move fast. Use the money saved to offer defined compensation when things go wrong.

The drugs that we really want to find are the ones with an obvious effect on real patients. This process would find those drugs much faster, and save lives overall.

<comment><USER3> I get where you're coming from, but I think your idea moves too far in the opposite direction.

Vaccines are somewhat different as "drugs". They are typically inactivated virus or bacteria (or fragments of them), so the safety risk is somewhat muted in the sense you aren't introducing something completely new into the body. The risk is still there, but not as much as a completely new molecule.

If you were to test new drugs on terminally ill patients and the patient died, was it the drug? Or did they die form their disease? Sometimes you can, often you can't. When you do clinical trials you're trying to eliminate any many variables as possible by running the trial on a relatively homogeneous population. That's why they do phase 1 with healthy volunteers.

The other challenge is that when human testing goes wrong, it can go horribly wrong. Check out the clinical trial of the FAAH Bial compound where people died. Also, TGN1412.

<comment><USER2> If you treat a terminally ill patient and they die, then you can still learn something. Maybe there was no effect at all on the target illness, e.g. the cancer spread and grew anyway. Maybe there was a large effect but the side effects were too severe, in which case you can investigate strategies for mitigation.

TGN1412 is a good example. This drug turned out to provoke the immune system in an extreme way. What if it had been tested first on cancer patients and, even with the life-threatening side effects, it worked as a cancer immunotherapy? Then we would be able to work on dosing or mitigation. Instead, the company folded, the research was abandoned and we'll probably never know.

And further, it's a cold calculation but instead of having healthy lives ruined you would have terminally ill patients die slightly sooner.

<comment><USER4> Frankly I think this is a ridiculous, inhumane, and fundamentally ignorant point of view.

Ridiculous - The idea of testing drugs with the hope that they magically treat something completely unexpected and without any theoretical framework supporting it.

Inhumane - Terminally ill people could hardly consent en masse to such a program. I suppose there is a utopic idea here, but you might as well wish everyone were healthy forever.

Fundamentally ignorant - The previous comment explained why terminally ill patients with many different medical problems would make poor subjects for a study that ostensibly informs medicine applied to generally healthy people.

<comment><USER2> Let's cover these one by one.

"Ridiculous": the whole point of the OP is that we don't have good predictive models for what treatments will be effective. We have hunches and theories but it is currently too costly to go through the whole process to test them all. One approach would be develop better models, but I'm suggesting another approach would be to reduce the cost of testing them in the real target.

"Inhumane": well that's the ethical question. Some countries compell vaccination because of the societal benefit. I'm not even proposing compulsion.

"Fundamentally ignorant": in the end medicine is needed to treat sick people, not healthy people. The OP makes the point that sometimes a biased, representative sample is better than an unbiased, unrepresentative sample.

</comment></comment></comment></comment></comment><comment><USER5> In the early days, most drug discovery (while amazing for its time) covered comparatively simpler diseases with arguably less complex physiological and pharmacological models i.e. low hanging fruit. Many of these diseases (e.g. Type 2 Diabetes) are still improperly addressed to this day. But they are not as lucrative for today's pharmaceutical company as they used to be in simpler times.

Governments and insurers are too astute to pay excessively for incremental improvements in mass or lifestyle disease categories. It makes more business sense for Big Pharma to target complex, hard-to-cure diseases that affect a small population set. While the success rate for such molecules is much lower, it's also much harder for payers to apply their usual mass-oriented drug economics to them.

One of the better examples of this is the recent introduction of Hep C "curing" drugs. Sponsors are going uncontested in pricing their molecules up to $84,000 per patient year[1,2].

With 3 million patients in the US alone, that's a TAM of $252 billion per year. For one drug category.

References:

[1] [http://hepatitiscresearchandnewsupdates.blogspot.com/2014/03...](http://hepatitiscresearchandnewsupdates.blogspot.com/2014/03/democratic- leaders-request-briefing-by.html)

[2] [http://www.grassley.senate.gov/news/news- releases/senators-s...](http://www.grassley.senate.gov/news/news- releases/senators-seek-details-sovaldi-pricing)

</comment><comment><USER3> _Gerhard Domagk tested his few hundred drug candidates in live mice with bacterial infections. The recent attempts started with single bacterial proteins in a tiny dish._

This goes back to the phenotypic screening argument.

Unless your biological model captures most of the factors involved in a biological system, it's not worth much. You might get a great hit, then put it in an animal model and get nothing.

There are a ton of examples of the value of phenotypic screening in past drug discovery. The discovery of benzodiazepines (Valium, etc) was completely random. Hoffman created some new molecules and just injected them into mice. When the mice fell asleep, he followed up on it.

Of course, phenotypic screening is not a panacea. It's expensive and has problems of it's own.

<comment><USER6> >This goes back to the phenotypic screening argument.

Truth. Domagk would have missed sulfa all together if he had been using an in- vitro strep model.

Prontosil (what Donmagk discovered), and azodye connected to a sulfa molecule, must be enzymatically digested into the individual azo and sulfa molecules before it becomes biologically active.

Sometimes reduction of a problem, looses the problem all together.

</comment></comment><comment><AUTHOR> My co-founder and I interviewed Jack Scannell and Jim Bosley, two renowned researchers, for this article on the state of drug development and Pharma.

If you have any follow on questions, we're meeting with Jack again next week and would be happy to add any more information on this topic!

<comment><USER7> Great interview for a great PLOS ONE article! Many thanks!

My take away is that this is what the so-called Systems Biology / in silico Biology ppl have been talking about for the past 10 years or so. Unfortunately the drug discovery industry has its own systematic problems as A) most major biopharma are run by MBA/lawyers/D. Pharm, (this is why M&A / tax inversion / outsourcing have higher priority than basic R&D); B) from A the basic R&D (left along Systems Biology) are on the chopping block for cost cutting; C) and it's hard for Bio Data Hacking companies to survive in the past 10 years or so. Most bioinformatic companies are either out of business or being absorbed. The Entelos the authors mentioned actually went through IPO, relisting, chapter 11 and recapitalization.

So my question would be how these road blocks could be overcome before in silico biology could contribute more to the drug discovery process for a better "compass"?

<comment><USER8> The article's conclusion would indicate that you would do use in-silico biology to 'discover' existing drugs. Then once computer methods can reliably discover, say both penicillin and tetracycline, you'd push forward.

Funding this, however, would never come from industry. You'd need to convince NIH that spending many years rediscovering old drugs is the magic leap forward we need.

As someone ignorant of the field - has this been done? What is the state of validation in computer biology?

<comment><USER7> yeah, more or less. it's called drug repositioning for 're-discovering' existing drugs for new indications. several firms are currently focusing on drug repositioning by mining fda databases such as drug adverse events data to mine possible new indications. major pharmas already use the find-new-trick- for-old-drug to find new usage (eg botax). by the way viagra is also such 're- discovered' drug as it was originally targeted for hypertension treatment with poor clinical trial results but with a surprising you-know-what 'side-effect' in some male patients.

any way, the solution might not be so straight forward for in-silico biology as several major bottlenecks still hard to resolved, such as those failed clinical trials data are never revealed and shared, and the most cash-burning process still concentrate on clinical trial stages.

</comment></comment></comment></comment><comment><USER9> In short, this paper calls for "Do more math on the front-end of the pipeline."

The core issue is that CEOs of biopharmas aren't compensated as such, so if you were to go to one with mathematical techniques that would take 3 to 6 months to run, (Combining research, bioinformatics, and diff EQ) they would look at you like you're crazy because the timeline and their incentivization is skewed toward not failing a trial.

Trials exceed CEO lifetime, and that's one core issue as to why pharma development isn't done this way today.

<comment><USER10> I think when they were referring to models they weren't necessarily referring to mathematical models, but also experimental models. They more stressed the importance of the predictive models that you are using, which in biomedical research is typically an experimental rather than mathematical/computational model.

From the takeaways portion of the article

"Judging the quality of the 'compass' (i.e., the 'validity' of experimental models) is very difficult. However, the drug industry should put its brightest and best people onto the problem of model validity"

</comment></comment><comment><USER11> Great article. I'll be sharing this with some colleagues that work in drug discovery.

<comment><AUTHOR> Awesome we'd love to chat with you and your colleagues as well! firstname.lastname@example.com

</comment></comment><comment><USER12> We'd like to think that we're a modern civilization, with systems in place, and the right priorities when it comes to life saving research & development.

In reality, we're barely out of the caves.

<comment><USER3> Think of it this way: do you cringe at the thought that 70 years ago, there were almost no antibiotics available? That if you had a serious infection that you'd probably die? That such an infection would now be trivial to cure?

That's how people will view our healthcare of today 70 years from now.

<comment><USER13> Or, we will have sure fire cures for baldness, and sexual dysfunction?

I keep thinking about this new antidepressant called Rexulti. The patent ran out on Abilify. It went to generic status. Drug company panicked.

They changed the Abilify molecule a tiny bit, and a did <400 patient study. The patients were evaluated over a two month period, using a 10 question happy test. From mean change from baseline, -5.2 people got better by Placebo. -8.4 got better from drug.

In big bold letters, it screamed to doctors, "62 Percent Greater". In small print they said vs. placebo.

Does it work? I don't know, and I doubt they know. Do they have a new, dubious drug they can con doctors/patients into buying--yes!

And yes--if we knew the actually efficacy of a lot of drugs, we would be astonished.

I sincerely hope we have better medications in the future.

<comment><USER3> Are you arguing that sexual dysfunction is not a worthy condition to treat? I would argue it has severe psychological ramifications and a negative impact on people's lives. As much as dying from cancer? No. But not something you can ignore.

We've made _tremendous_ strides over the past two decades in treating severe diseases. Look at drugs like Imbruvica, Harvoni, Kadcyla. Women with stage 4 breast cancer can now expect to live 3 to 5 years with their disease vs. dying within a year. Tremendous progress. Just because "lesser" drugs are being developed doesn't change that.

And you'll have to explain Rexulti and Abilify to me. Abilify isn't an antidepressant, it's an antipsychotic. My other comment is that treating psychological conditions is incredibly hard. The placebo effect is a huge issue with clinical trials whether or not for-profit companies run them.

And as for "me-too" drugs that you mentioned, they have value to. Jenkins from the FDA actually stated we need more of them, not less.[1] Yes, a new drug might only be a small tweak of an existing drug, but all humans aren't the same. A patient may not be able to take an older version, but the me-too works for them. That has added value.

And as for "conning" doctors or patients in buying drugs they don't need, I don't have a lot of sympathy. Doctors are the _final_ decision makers on what drugs are prescribed. If they don't do their homework and just prescribe something because they like the sales rep, that's on them.

[1][http://www.pharmexec.com/fda-more-me-betters-and-focused- bre...](http://www.pharmexec.com/fda-more-me-betters-and-focused- breakthroughs-0)

 _"Choice is a good thing," Jenkins commented, as later drugs in a class often enhance safety or efficacy for certain individuals. The move away from "me- too" drugs, he said, is "not necessarily good for public health."_

<comment><USER14> > Yes, a new drug might only be a small tweak of an existing drug, but all > humans aren't the same. A patient may not be able to take an older version, > but the me-too works for them. That has added value.

Indeed this is true, individual patients will respond differently, and inexplicably, to medications in the same class (e.g., Prozac vs. Zoloft). Having these choices is very useful.

However there are considerations beyond pharmacology that reduce the value of these choices. Problems arise because of non-clinical factors, particularly what rules of insurers allow. Formularies have become quite restrictive in many environments making it difficult to make use of the range of alternatives that are theoretically available.

In the last 10 years several new antidepressants have been developed, approved and marketed. That doesn't mean that patients can easily get these drugs even if patients have failed to benefit with older options. Insurers erect barriers like stiff co-payments, or complicated prior authorization procedures as effective impediments.

Consequently what good are new medications if they can't reach the people who need them? There's a strong disincentive to try to use these drugs and I think it's likely manufacturers would have less reason to develop them if they can't sell them.

So doctors would like to be able to prescribe what would work better, but that's frequently not practical. I'd add that doctors are not so easily "conned" into prescribing an agent just because companies and reps are promoting it. Quite to the contrary, making up one's own mind based on the merits and ignoring the sales pitch is the reality.

</comment></comment></comment></comment></comment><comment><USER15> tl;dr They can look for the wrong things, very quickly.

This is the classic [http://quoteinvestigator.com/2013/04/11/better- light/](http://quoteinvestigator.com/2013/04/11/better-light/)

</comment><comment><USER6> Wow that is one amazing PLOS one article.</comment>


Excuses kill dreams  - <AUTHOR> http://madebyloren.com/posts/19

<comment><AUTHOR> Author here. I went off on a bit of a rant, so here's the meat of it:

The funny thing about excuses is that they can be cleverly disguised to the point that they almost seem legitimate: _I can't start a website because I don't know how to code; I can't run a startup because I have no business experience; I can't travel the world because I'm too busy with work_.

Are you fucking kidding me? It's 2012, and I call bullshit. We are living in an age of virtually unlimited access to knowledge and opportunity. It's not okay to have excuses anymore. We complain that we don't have enough time, but we spend hours a day on Facebook and Youtube. We complain that we don't have the proper knowledge or skill, but anything we could ever want to know is right at our fingertips and the information infrastructure is expanding so rapidly that we can literally learn forever.

If you aren't doing exactly what you want to be doing, there's only one reason: you don't want it badly enough. That's all there is to it.</comment>


Show HN: Rate My Pet – Dog and Cat Photo Rating and Comments - <AUTHOR> https://play.google.com/store/apps/details?id=com.ratemypet.android <comment><USER2> Rating people is how facebook started. Soon pets will have their own social network.

Would like to point out a couple of things related to the app page:

1\. Don't use stock photos. It really ruins presentation. 2\. The screenshots you show don't entice me to even download the app, because they are all the same and don't show much of the functionality. 3\. Remove the notification bar from your screenshots.</comment>


Ask HN: How to get into a CS masters program without a strong academic record? - <AUTHOR> I'm curious how folks (specifically self-taught devs) who decided mid-career to get a masters degree in CS have done it, if they didn't have a high college GPA or professors to write rec letters. <comment><USER2> Most of the time, Masters students pay their own tuition (unlike PhD students) so it is not hard to get into a Master's program in CS -- so long as you are not trying to get into Stanford, CMU, or something like that.

</comment><comment><USER3> Probably a much better question is "why", for which the answer is: "You probably don't want to".

If you care about the learning: You can learn all that stuff for yourself.

If you care about getting a credential: You are in a field which doesn't care as much about those as other fields do.

If you want to teach and need the credential for teaching: Get therapy, teaching is a great way to live and an awful way to earn money.</comment>


Ask HN: Where do Adult Websites advertise tech roles? - <AUTHOR> My friend quipped if he was me, he would work for adult websites as it would free up half his monthly outgoings.<p>It dawned on me that I have no idea where these roles are even listed. I have been signed up to job alerts for a decade and never seen anything like it. Yet a lot of the driving force of the internet was adult content. <comment><USER2> Worked at one found through craigslist. I left after the first year because somehow they were making $5k a day yet always having money problems. It got so bad they didn't pay the power bill. That and finding used needles in the bathroom were the final straw. At one of the office parties they had a communal pile of ketamine on the table. Just a really toxic environment. The CEO would regularly come in and let us know we were doing great because he lounges in his pool all day and does nothing so "keep up the great work". People would write in all the time saying we ruined their lives and what's it going to take for us to remove the videos (we could not be bribed) I didn't really advance my career at all.

<comment><USER3> > People would write in all the time saying we ruined their lives and what's > it going to take for us to remove the videos

Did this business illegally post content it did not hold copyright to? If so that the environment is otherwise toxic is not surprising.

<comment><USER2> Basically it was 18 year old kids who legally had the right to sign our contracts, but still lived with mom & dad. Mom & dad would find out & call us with threats/bribes and "we" would just hang up the phone & laugh about it.

<comment><USER4> For those who are interested in going down the rabbit hole, watch the Netflix documentary "Hot Girls Wanted".

It's not exactly the same; skeezy old school porn producers have made way for young amateur porn producers, but it's still relatively the same as what OP refers to.

</comment></comment></comment></comment><comment><USER5> Many adult websites operate as a company with a completely different commercial name. I guess this is for legal reasons. I found that finding what company operates each websites (or website network) is extremely difficult.

Some job boards do the work for you by automatically classifying companies by industry. e.g. try filtering by "adult" at JobFluent job board. e.g for Barcelona: [https://www.jobfluent.com/jobs- barcelona/adult](https://www.jobfluent.com/jobs-barcelona/adult)

However, the same problem applies the other way around. Getting to know what adult websites operate each company is also a problem on its own...

</comment><comment><USER6> [https://www.mindgeek.com/careers/](https://www.mindgeek.com/careers/)

</comment><comment><USER7> > it would free up half his monthly outgoings.

What does that mean? Half his fixed monthly costs are for buying porn?

<comment> friend-monoid Yes. It was a joke.

</comment></comment><comment><USER8> I was headhunted for the job I had at an adult website hosting company. You can't go by domain name or anything, as the companies themselves all have very innocuous, bland corporate names to avoid attention.

I would say that there's no specific way to go about hunting for such jobs as they all use the same resources as any other internet companies to find employees, but they do lean more heavily on recruiters. Perhaps ask some recruiters to point you in that direction.

</comment><comment><USER9> [http://iq69.com/](http://iq69.com/) is a great source for stuff related to Adult Websites, along with job & gig ads. But it's private so you have to be approved by the admins first.

</comment><comment><USER10> > My friend quipped if he was me, he would work for adult websites as it would > free up half his monthly outgoings

What. How.. What?

What exactly is your friend spending _half his money_ on that he wouldn't need to, if working for an adult website?

<comment><AUTHOR> He was just making a joke that he spends too much money on porn. Although given his nickname was "dirtbox", one can never be too sure.

</comment></comment><comment><USER11> I worked at a top 250 website building billing and payments software ($85mm+ annual revenue) on the back-end for pretty much the top cam site in the world.

Got hired through a recruiter actually.

</comment><comment><USER12> gfy.com - Go Fuck Yourself

Word of warning: adult companies are super stingy with programmer salaries and you'll basically be competing against $10/hr offshore amateurs.

<comment><USER13> Usually the tradeoff you make for trashing your reputation is to become fabulously wealthy. This sounds like a really bad deal.

</comment></comment><comment><USER14> I wonder what this would do to your career after such a job.

<comment><USER15> Depends on how you market yourself.

Example : "Worked 2 years for PornHub on their porn website."

vs.

"Worked for 2 years for MindGeek on a streaming service network serving up to one million live customers."

</comment></comment><comment><USER16> I would imagine that most don't want agencies involved, sending though people that don't fit or would then be offended if they weren't told it was for a porn company or whatever, so I would guess they have them directly on their sites, or twitter/whatever feeds?

I had a quick look on a couple of sites (legitimate research!) but only found a job listing page on pornhub, so actually maybe that's not it. Could it be one of those industries that you have to work in to get to know about more jobs? Seems unlikely, though.

Either way, you have also piqued my interest in this!

Edit: Whilst I was writing this it seems to have been answered!

</comment><comment><USER15> I see ads for MindGeek on the sidebar of Stack Overflow quite often.

</comment><comment> et-al One company from Montreal has posted in the monthly Who's Hiring thread.

(edit: guessing Mindgeek given the other comments)

</comment><comment><USER17> Start your own, you'll quickly be earning more money than the people working jobs in the industry.

Even smallish blogs doing affiliate marketing for the bigger porn sites can earn you an easy six figure income.

<comment><USER18> Can you elaborate on that? How is that even possible in modern internet?

</comment></comment><comment><USER19> I have seen lots of roles from kink, on linkedin.

</comment><comment><USER20> the pay isn't particularly great in adult anymore, the parties aren't as fun either.

there used to be a couple agencies but they appear to have closed down over the years, just checked their websites.

if you really want to work in the space, just visit some of the links in their footers. you'll start finding out who the parent companies are and how to contact them.

</comment><comment><USER21> Seems like the perfect use-case for humans.txt

</comment><comment><USER22> Mindgeek is the big name in the space, if you're willing to relocate to Montreal.</comment>


Call to action insights from my checkout funnel - <AUTHOR> http://www.guotime.com/2011/05/call-to-action-insights-from-checkout-funnel-learn-from-my-mistakes-experiences/ <comment><AUTHOR> Made an update to the checkout funnel image, previously broken</comment>


With iTunes In The Cloud, Apple Under-Promises And Over-Delivers - <AUTHOR> http://techcrunch.com/2011/08/30/itunes-in-the-cloud-streaming/

<comment><USER2> so basically its better because its itunes. As someone that gets a lot of music from other sources such as soundcloud and bandcamp, google music is the better choice. The entire music upload complaint is bs because after the initial bulk upload its all incremental and uploaded within minutes. Otherwise all these services perform the same task. Also google music has web and android support.</comment>


Ask HN: Is Ruby on Rails really worth knowing? - <AUTHOR>

It seems that every where I am still seeing php GET variables in URLs (including on HN) and there is just so much support out there on the web for PHP. Big companies like Facebook and Wordpress still use it. Is Ruby on Rails really that valuable to learn? <comment><USER2> GET variables aren't unique to PHP. They're simply a means of passing data through on any HTTP GET request. HN itself runs on [Arc](<http://arclanguage.org/>).

To answer the question, Rails is certainly worth learning if you're interested in web applications development. It has, for better or worse, set the benchmark for interpreted MVC web frameworks, and a lot of the design decisions being made in other frameworks are heavily influenced by it.

(Also, it's fun.)

<comment><AUTHOR> Thanks for the link to Arc! I've heard it's fun, but for a newbie is it a concern that there is not as much support? I've heard there is maybe less quantity of support but the support online has more quality than php because of the quality of users.

<comment><USER2> I don't know much about Arc, but my gut feeling is that it is not likely to be newbie-friendly, between the combination of it being somewhat esoteric and, you know, a dialect of _lisp_ , which isn't exactly known for being all that friendly to the new programmer. :)

<comment><AUTHOR> I was actually referring to RoR in regards to support concerns but I appreciate the arc response :). Still helpful.

<comment><USER2> Ah, sorry. RoR has a very vibrant and active community, and I don't think you'll have any problem finding help with it if you choose to go that route.

</comment></comment></comment></comment></comment><comment><USER3> It's called a query string...

<http://en.wikipedia.org/wiki/Query_string>

My advice: come in on the Rails - stay for the Ruby.

</comment><comment><USER4> There is always a big debate surrounding what language to learn, and I don't think you'll get a solid answer from us. You'll have people arguing about which language is better. PHP, Python, and Ruby frameworks seem to be most popular here on HN. If you're new, my advice would be to experiment with different languages/frameworks but eventually have a "go to" one. Choosing a framework that you enjoy is a discovery process. Along the way you'll learn about language design.

By the way, GET requests are part of the HTTP protocol. Every web-based framework should support them, not just PHP-based ones. HN is written in Arc, a dialect of Lisp created by Paul Graham.

I personally use Python/Django :)

</comment><comment><USER5> Facebook and Wordpress are using PHP, but they've put significant effort into overcoming its pitfalls.

You can do anything in PHP that you could do in a more modern framework (Rails, Pyramid, Django or whatever), but some things will be more effort --- in particular, keeping the codebase organized and well-tested as an app gets larger.

(Also, FWIW, Facebook's codebase isn't all PHP, and Facebook alumni don't always stick with PHP for their next ventures. For instance, Quora's using Python on the server side; apparently its founders see some value in the switch.)

<comment><AUTHOR> Python is very fun and agile, however I was always under the impression it was also not meant for big projects as it is strongly not typed. Do you think Python is a great substitute or compliment to rails? What's your code of choice?

<comment><USER6> Python actually is strongly typed: Everything does have a type, and aside from within numerics (integers upconvert to floats), Python generally won't automatically convert between them. Mixing objects of different types in operations that would otherwise be ambiguous hence throws an error: You can't use a string and a numeric as the operands of an addition without explicitly converting one of them first, for example.

However, variables in Python aren't names assigned to storage areas for data of a particular type, but store references to objects, and can be freely reassigned to objects of any type at any time, i.e. there's no type constraint on them. Similarly, Python's built-in collection working horses (lists, dictionaries, tuples, sets) store references to objects of any type as well, including allowing mixing of the types of referenced objects in a single collection.

So while on one hand it won't allow you to shoot yourself in the foot with type mixing to a degree that e.g. PHP does, it also won't allow you to place much in the way of specific type constraints on common constructs. Technically you can check an object's specific type explicitly, but that's a lot of manual work and frowned upon since it undermines polymorphism, i.e. having the same code work on as many different object types as possible as long as they implement the interfaces the code wants to use. Some people feel this makes large bodies of code harder to maintain than in a language that places specific type constraints on variables, collections and other constructs.

</comment></comment></comment><comment><USER7> Rails has GET variables, but the "rails way" is "restful routes" whenever possible. So something like /posts/12 will automatically pass 12 as a specific GET variable e.g. params[:id]. Or /posts/12/comments/4 might pass the parameters :id (12) and :comment_id (4).

This happens all the time for people using PHP too, however it's usually accomplished via mod_rewrite. For example, Drupal's pretty URLs simply rewrite /posts/12/comments/4 to /index.php?q=posts/12/comments/4.

</comment><comment><USER8> When I first learned Rails I kinda messed around with it and wrote a quick demo app, but really wasn't that impressed with it. Coming from a C# background and ASP.NET MVC had just come out I didn't see much value in learning a new MVC framework.

However, when I started to need a language that I could use to write code that would let me easily integrate with different services and APIs I was finding that C# was cutting it for me. Not so much C# than just the .NET community. I found that the Open Source community is Ruby's greatest asset.

There are so many gems to be used in Ruby/Rails that I found that I seldom have to write anything from scratch. There is always a gem I can use to help me get a job done.

The second strongest asset of Ruby is the language itself. I found it to be a wonderful language to write in. Since learning Ruby, I haven't cared to write another line of C# again.

Is it worth learning? I say emphatically, "yes" but I would implore you to try it for yourself. Also checkout Github/Rubygems.org to see if there is a gem out there to try.

</comment><comment><USER9> It really depends what your looking to do. I use Rails and php depending on the project. I would say actually its best to focus on frameworks and Rails is probably one of the better ones out there these days. Django is also interesting. Php frameworks are going through alot of changes right now with no clear winner. So youll have to spend extra time even trying to figure out which one to use whereas with Rails its pretty much the dominant one so all the support in the community goes to it.

There are only a few ways you can pass data from one web page to another. Get and Post. Get sends it in the url whereas Post sends it in sort of a hidden way. In the old days post was preferred for more sensitive data so the user wouldnt see things in the url. Also post was and is used to keep the urls cleaner. However with the advent of web services the uses of these have changed somewhat.

</comment><comment><USER10> I had my doubts about Ruby too, but we built the entire backend of our iPhone app (<http://loqly.me>) on ROR and our website is going to be entirely on ROR too. The amount of time it saves you as compared to any other language is nothing short of mind blowing. Of course I am just sharing my 2 cents since you asked. Others could have a different experience. But we started out with php and 2 months down the line changed over to ROR and boy were we glad we switched!

</comment><comment><USER11> Yes. But make sure you start with Rails 3 and Ruby 1.9. They are vastly improved over Rails 2 & Ruby 1.8 IMHO.

</comment><comment><USER12> the most important skills you can have, imo, is the ability to learn new things as soon as possible, to be come competent quickly.

taking the time to learn rails isn't just about learning rails, it is also about keeping your ability to learn sharp.

<comment><AUTHOR> I believe it! Since I have already picked up Python, I guess rails is going to be my next learning experience this Spring Break...</comment></comment>