Amazon says email banning TikTok from employee phones was 'sent in error' - <AUTHOR> https://twitter.com/scotthickle/status/1281631749533990914 <comment><AUTHOR> Note: since this tweet/submission, some outlets have written stories about this:

[https://www.theverge.com/2020/7/10/21320196/amazon- employees...](https://www.theverge.com/2020/7/10/21320196/amazon-employees- tiktok-uninstall-email-trump-administration-pompeo-ban)

[https://www.nytimes.com/2020/07/10/technology/tiktok- amazon-...](https://www.nytimes.com/2020/07/10/technology/tiktok-amazon- security-risk.html)

<comment><USER2> I'm curious, are these

1\. Devices owned by Amazon, for work

2\. Personal devices with the amazon email added directly

3\. Personal devices with amazon email added on Work profile

Could not find this info in the articles or tweet.

<comment><USER3> They're devices that are under Amazon's MDM. So if the device was enrolled with their MDM then it applies.

<comment><USER2> Right, but on Android at least, you can either have the whole device be under MDM (#2) or just a work profile (#3). In the latter, if your sysadmin decides to wipe your device, it only wipes your Work profile and not your entire phone, from my understanding. Is that not correct?

My assumption was that any apps installed on the personal partition were off limit for the MDM.

<comment><USER4> They might still require you to comply voluntarily (and be on your own if you lie).

</comment></comment></comment></comment></comment><comment><USER5> The email sent to Amazon employees was a mistake.

[https://variety.com/2020/digital/news/amazon-bans-tiktok- emp...](https://variety.com/2020/digital/news/amazon-bans-tiktok-employee- security-risk-1234703472/)

<comment><USER6> Someone goes through all the trouble of typing that explicit email and it's a mistake?

Sounds more like 'pulled after huge feedback'.

Though personally I'd agree with this decision. TikTok seems to be a particularly bad apple: [https://www.reddit.com/r/videos/comments/fxgi06/not_new_news...](https://www.reddit.com/r/videos/comments/fxgi06/not_new_news_but_tbh_if_you_have_tiktiok_just_get/fmuko1m/)

<comment><USER7> I keep seeing that Reddit thread linked (even the NYT is citing it now?) but still cannot for the life of me figure out what substantially TikTok does that is a concern compared to other popular apps? The guy has like 10 paragraphs of stories but no actual evidence? What is TikTok doing that somehow is flying under the app store guidelines of both Google and Apple but still a "national security concern"? Why is the only actual "evidence" that can seemingly be found, a comment from some rando on Reddit, not peer-reviewed, reproducible work from legit cybersecurity researchers? This reeks of the same scent that Bloomberg's "omg they're hackz0ring our chips!" story gave off.

<comment><USER8> For one, the clipboard snooping problem.

If you're using a password-manager (like we're supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere.

...and we only know about this issue now because iOS 14 adds clipboard snooping notifications - and that was only a month ago! Think about the stuff that the app could be doing that we _don't_ yet know about.

There's too many bloody-obvious security vulnerabilities that are decades old but don't get fixed until they either become a meme (like SQL Injection) or the platform vendor does something about it (iOS 14 clipboard notifications) - and don't forget that the SIGINT community is sitting on millions of dollars worth of zero-days that they won't disclose to vendors unless they feel like it - so I fully expect there to be more surprises in TikTok - and other apps - in the years to come - probably indefinitely.

<comment><USER9> _For one, the clipboard snooping problem. If you're using a password-manager (like we're supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere._

Your password should never be in your clipboard at least with iOS. If you're using either the native password manager or a third party password manager, the password manager is directly integrated with the keyboard and would auto fill into your app.

[https://techcrunch.com/2018/06/05/password-autofill-in- ios-1...](https://techcrunch.com/2018/06/05/password-autofill-in-ios-12-will- work-with-third-party-password-managers/)

<comment><USER10> Android does this too. On neither platform does it work 100% of the time, especially in browsers. That's why almost all clipboard managers also have a "copy to clipboard" feature from the autofill view.

<comment><USER9> I've never had it not work in the browser.

<comment><USER11> It's usually a result of the webpage doing stupid stuff to try to explicitly block password managers. There's a lot of banking and government websites that believe this makes things more secure somehow.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> For the context, as an Amazon employee I'm not required to access email from my mobile. The only app that I need to have is virtual pager and it doesn't require allowing Amazon to administer my phone. Physical pagers are also an option.

<comment><USER13> TLDR ooh Amazon has pagers, I wonder how?

Are there any pager networks left in the US? I've always been interested in them out of historical curiosity because I was too young to use them when they were actually a thing, but from what I understood, pagers are pretty much not a thing anymore.

<comment><USER14> I wouldn't expect a modern pager to operate on the same technology as older pager. Pagers are a thing and they have there uses. I've heard of a physical pager being used to symbolize who is "on call", and a team of engineers will pass the pager between themselves. I've seen restaurants pass out pagers to people waiting for tables. I've heard talk about some medical/emergency personal still using pagers.

I imagine pagers are probably used in highly secure communications (military, statecraft), because the thing being paged doesn't have to give away it's location, or even the fact that it received the message.

<comment><USER15> Yes, modern pagers do operate on the same tech (pocsag/flex) for the last few decades. And for the most part, are clear text. There are posts on HN about this in the last year.

</comment></comment></comment></comment><comment><USER16> Jeff Bezos, Amazon CEO, got his phone hacked and embarrassing text messages stolen off it from a vulnerability in the video parsing library in WhatsApp in a message sent to him by Saudi Crown Prince Mohammed bin Salman in 2018. So Amazon as a company is now very sensitive to what applications are installed on staff devices and how data on those devices can be extracted from vulnerabilities in other installed apps. This may be an outcome of that.

[https://www.businessinsider.com/jeff-bezos-phone-hacked- saud...](https://www.businessinsider.com/jeff-bezos-phone-hacked-saudi-crown- prince-mbs-whatsapp-report-2020-1)

<comment><USER17> Does anyone have any technical detail of that story. It is hard to imagine how a bug in the image parse library can be utilise to steal text message.

<comment><USER16> Sure, the blog post below covers it, and the vulnerability was probably CVE-2019-11931. You can do an awful lot with a buffer overflow if you're clever.

[https://www.okta.com/blog/2020/04/what-the-jeff-bezos- whatsa...](https://www.okta.com/blog/2020/04/what-the-jeff-bezos-whatsapp- hack-means-for-app-security/)

<comment><USER18> Does anyone have a "explain it like I'm 5 but took some CS classes back in college"?

I know that if you craft your buffer overflow just right it will overwrite other parts of memory with the new function.

But how do you know what parts will get overwritten?

Does that mean the new function can do almost anything?

<comment><USER19> With a buffer overflow, you can write your own code into a chunk of memory that ends up being run by the application. In this case, since WhatsApp already had SMS read privileges as part of the signup auth flow, the attacker also had those privileges.

The article has some detail about the remote code execution part of this exploit.

"What this means is that there was a software flaw in the WhatsApp code for handling MP4 media files. If an attacker triggered the flaw, the function in question would crash in a way that could allow a potential attacker to gain "RCE" or Remote Code Execution.

In layman's terms, this means the attacker could inject his own code into the application and, by triggering the flaw, make the application to run with all the privileges and access of the WhatsApp application itself."

<comment><USER20> So the payload would be some corrupted video file sent to Bezo's phone. Would the attack look something like:

1) Discover/buy/steal Bezo's Whatsapp number (how did they do that...)

2) Discover/buy/steal a 0-day bug in Whatsapp.

3) Write and compile a program that reads SMS from the OS and beacons it to some server you control.

4) Create a corrupted video file that would trigger the video parsing bug, and within that video file place the compiled program from the previous step in the correct place so that it gets executed.

5) Send to Bezos.

<comment><USER21> Yes, that seems like a reasonable summary. (3) is the kind of thing that exploit developers will have "off the shelf"; (1) is probably available in a dump of private information somewhere.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> Looks like TikTok is slowly imploding.

I know there's plenty of political implications and a lot of discussion here is on that (which is interesting in its own right), but I wonder if there's opportunity here for a potential competitor.

<comment><USER23> What does tiktok have that IG stories or SnapChat does not provide?

It appears to me that TikTok is just a perpetuation of exclusivity in Social Networks (the same way kids exited FB when their parents signed up) ...

<comment><USER24> The "For You" page.

Sure its just another algorithmic-based feed. But in my experience (and from talking to a few ppl who enjoy TikTok), the For You page is a differentiator. It's like a combination of what's trending, what's recent (time wise), and what you've spent time interacting (watching, liking, commenting) with previously.

Again all platforms do some form of this, but just saying TikTok does it in a pretty addicting way.

Also combine that with the fact that TikTok videos are so incredibly short that by the time they're over, you haven't even decided whether or not you liked it (no doubt by design), which means you can endlessly consume content.

Also, I've heard that TikTok has better (read: better for comedy-style content) tools to edit videos in the app

<comment><USER25> I seem to be the only person here who actually uses tiktok. What makes tiktok different is the musical background (somehow people never mention this when comparing it to vine), the fyp algorithm being incredibly good, and the various communities built around certain niches. It's night and day compared to other apps.

</comment></comment></comment></comment><comment><USER26> I'm more surprised Amazon (or any company, really) employees using an employer-managed device would have TikTok on them to start with, to be honest.

As the follow-up tweet says: "Completely independent of the specifics in this instance: get a second device before installing an employer's config profile on your personal device"

<comment><USER27> Does Amazon provide company phones or just install an MDM profile on your personal phone? I have TikTok installed on my phone, and if my employer said I had to remove it to access my work email, I'd ask them to buy me a work phone. It seems a bit ridiculous that they'd want to control what apps you download on your personal device without providing an alternative.

<comment><USER28> No, they are controlling the environment under which their company emails can be accessed.

If you, as an employee, don't want to remove TikTok I believe you will have that right, it's just that you won't be able to access company emails from that device.

Now, whether or not that leads to a company phone or you having to look for another job, depends on the individual and how important that individual is to the company.

<comment><USER29> If any company expects me to access my work email while mobile, they have to provide a phone. I _never_ mix work and personal. I've also never had a company say no to that.

<comment><USER30> Adding another anecdote, when I said I did not want to let work control my mobile phone, my boss told me I could figure out whether I wanted to keep the job or not

<comment><USER31> Switch jobs! Environments like that will grind down your soul. Or at least they did for mine.

Perhaps I'm projecting a little, but: please don't feel like you're stuck there. It's an illusion more often than not.

<comment><USER9> Switch from a well paying job instead of just getting another cheap phone?

Of all the hills I am willing to die on, getting another phone isn't one. Especially if they provide a credit for your cell phone.

[https://www.teamblind.com/post/Amazon-Cell-Phone- Reimburseme...](https://www.teamblind.com/post/Amazon-Cell-Phone- Reimbursement-OBDqT5Dy)

</comment></comment></comment></comment></comment></comment></comment><comment><USER32> I feel like this TikTok backlash is so overblown. I don't think TikTok is spying on US consumers/business, and I don't think TikTok is sharing any US private data with CCP... I believe this because there's no evidence to the contrary, and out of principle you shouldn't assume malintent.

In fact, TikTok explicitly left Hong Kong because if they didn't they would have to share private data with CCP to comply with new laws... they're intentionally leaving MAU on the table to keep their users' data safe. [1]

If you look around, US social companies are making the same mistake with your clipboard data that TikTok did. LinkedIn just got caught reading your clipboard data [2], but we aren't talking about banning them... I would assume in all of these cases, it's just an engineer who accidentally shipped a bug. There are legitimate use cases to read the clipboard (eg. more seamless 2fa).

It feels like the negative reaction to TikTok is so politicized and just comes from a "China bad" attitude.

[1]: [https://www.cnn.com/2020/07/07/tech/tiktok-leaving-hong- kong...](https://www.cnn.com/2020/07/07/tech/tiktok-leaving-hong-kong-intl- hnk/index.html)

[2]: [https://news.ycombinator.com/item?id=23716451](https://news.ycombinator.com/item?id=23716451)

<comment><USER33> Some light reading:

[https://rufposten.de/blog/2019/12/05/privacy-analysis-of- tik...](https://rufposten.de/blog/2019/12/05/privacy-analysis-of-tiktoks-app- and-website/)

[https://docs.google.com/document/d/1QEyWqAiTE_5xzCs_X3tjDCQx...](https://docs.google.com/document/d/1QEyWqAiTE_5xzCs_X3tjDCQxMvWWtntdJnhBOjtP9Qg/edit)

[https://www.reddit.com/r/videos/comments/fxgi06/not_new_news...](https://www.reddit.com/r/videos/comments/fxgi06/not_new_news_but_tbh_if_you_have_tiktiok_just_get/fmuko1m/?context=1)

[https://www.washingtonpost.com/world/tiktoks-owner-is- helpin...](https://www.washingtonpost.com/world/tiktoks-owner-is-helping- chinas-campaign-of-repression-in-xinjiang-report- finds/2019/11/28/98e8d9e4-119f-11ea-bf62-eadd5d11f559_story.html)

[https://www.thetimes.co.uk/article/video-app-linked-to- china...](https://www.thetimes.co.uk/article/video-app-linked-to-china-s- ruling-party-8c7j3ljlj)

[https://www.wired.com/story/tiktok-is-the-latest-window- into...](https://www.wired.com/story/tiktok-is-the-latest-window-into-chinas- police-state/)

[https://thehill.com/blogs/congress- blog/politics/478015-exer...](https://thehill.com/blogs/congress- blog/politics/478015-exercise-caution-when-using-chinese-apps-like-tiktok)

[https://www.forbes.com/sites/zakdoffman/2020/06/26/warning-a...](https://www.forbes.com/sites/zakdoffman/2020/06/26/warning- apple-suddenly-catches-tiktok-secretly-spying-on-millions-of-iphone- users/#484ce3434ef0)

<comment><USER32> I just read/skimmed each of these links.

Is this any less data than is collected by Facebook or Google in their apps/websites?

This seems like mostly an issue with the fact that Android lets apps get at this much data - something that should be fixed at the OS-level. There's very little mention of similar practices/vulnerabilities on iOS.

</comment></comment></comment><comment><USER34> Sorry if I missed something obvious, but if we're at the point where the U.S. government is even contemplating banning TikTok, how come it's on Google and Apple stores at this point? They seem to be at least somewhat vigilant about spyware etc.

<comment><USER35> From what I read, I think the issue is people keep claiming it does all this various "spyware" stuff, when it sounds like it's doing _nothing_ that any other app could do, given the (what appear to be) lax permissions of android/ios.

If people are so worried about what tiktok can be gathering outside of the app, that is a problem for apple & google.

For this, I think it's 100% overblown what people think tiktok is doing. It just doesn't make sense. If it was really some kind of massive spyware, I agree apple/google would be all over this.. but they aren't.

This comes down to a lack of trust in China obviously, and I don't think there's anything really more concrete than that.

<comment><USER36> It was the whole read write access that was a massive violation of apple and googles store policy.

It can upload and download whatever to your phone.

No other app is even close to allowed that.

<comment><USER37> Can you please point to any evidence or source? I've never heard of this happening (beyond what every other app can do in terms of downloading and uploading data) and the wording isn't clear as to what exactly you mean.

</comment></comment></comment></comment><comment><USER38> And that's why I never setup email on my personal mobile device when I worked for AWS.

</comment><comment><USER39> What's the security/privacy vulnerability that would allow TikTok access to sensitive info from email?

<comment><USER40> Likely that they have the potential to have as much information about us as Facebook does - but China?

If there was a real security/privacy issue - I'd be more upset with Apple than China (as an iPhone user). Apple needs to watch my back.

<comment><USER41> On top of background device data and analytics there is lot of sensetive user data shared on the app for which can be used to target certain audience. Social engineering this data and joining it with other apps(which can have security holes) is enough to hack the device and steal additional info. All this also applies to American companies like FB, Google etc however american companies don't have a parent like CCP who has access to all the data.

</comment></comment></comment><comment><USER42> If I had to judge between whether I wanted TikTok or corporate email on my phone, it wouldn't be just about the email. I could live without that. What I really liked, especially back when we actually went into offices, was that I had my calendar available without opening up my laptop, and that it showed the next place I needed to be right on my wrist.

</comment><comment><USER43> I assume they won't be doing that to the main-stream spyware pushed by US companies.

<comment><USER44> The threat model for AMZ is state sponsored corporate espionage, not government intruding on your and my privacy. The former cost them a ton of money unlike the later. Given their inability to enforce IP or many other laws in china even if there was similar espionage happening in the U.S. the legal system is strong enough for Amazon not to worry of losing money.

<comment><USER45> But if Amazon found evidence of code that allows for TikTok to engage in corporate espionage, why would they keep it a secret and just send out an email (and later retract) that forbids employees from using the app?

It seems way more likely that a non-tech manager at Amazon read the news and wrote the email.

</comment></comment></comment><comment><USER46> TikTok and Chinese apps in general are having a tough day. While nothing malicious has been conclusively shown—save for iOS pasteboard spying which it seems EVERY app is doing—I suspect that this is a geo-strategic move by the US and our Allies to dominate and flex economic power over China.

</comment><comment><USER47> Bytedance should just take the cash and spin off TikTok as a separate entity run by the new CEO Kevin Mayer. Perhaps selling the spin-off to Disney or Snapchat or Private Equity while its still worth something.

</comment><comment><USER48> Makes a lot of sense considering AWS deals with sensitive government data.

</comment><comment><USER49> Is TikTok officially the scapegoat now? Sure it's bad, but it seems like an awful lot of attention is being brought to it compared to many of the other companies (and governments!) that are doing... the exact same shit, and often more so.

</comment><comment><USER50> Does anyone have a link to a legit security analysis on this app? I'm trying to weed through all details, and I want to get past any FUD.

</comment><comment><USER51> How does Amazon email access work from home desktops? I assume it is not just simple POP/IMAP/SMTP authenticated by username/password, because if it was you could use that from mobile, too.

</comment><comment><USER52> I cannot think of a single action that will promote the adoption of Hauwei's app store more than banning TikTok.

</comment><comment><USER53> Byte.co waiting for adoption on the sidelines.

<comment><USER54> There are a bunch of TikTok wannabes (Byte, Dubsmash, or the various attempts by Facebook), none that I've seen are as fluid or addictive. TikTok's ability to navigate around with a bunch of responsive swipe gestures and keep showing things that might be interesting is miles ahead of the competition. The fluidity is very dependent on a good internet connection.

</comment></comment><comment><USER55> Standard corp policy? Google disallows dropbox on devices that can access Google internal data as well.

</comment><comment><USER56> Company doesn't want employees to install spyware. Is Fortnite next?

</comment><comment><USER57> Time to buy SNAP stocks :)

</comment><comment><USER58> What's the probability that the Trump admin/DOJ places a nationwide ban on TikTok and other Chinese apps? Could it actually be enforced, or will the First Amendment override any such ban?

What would the ramifications be if a ban were enacted? Retaliation from China against domestic companies?

Will this be an inflection point in the escalation of the trade war?

<comment><USER59> 25%. Yes. Yes.

Millions of angry teenagers. China retaliates against by barring a few American SAAS companies/ cloud providers on national security grounds.

It's a continuation of trends that were well underway since the Huawei entities list.

</comment></comment><comment><USER60> Good start. Hopefully the rest of the corporations and world governments follow.

</comment><comment><USER61> In 2018, Bytedance CEO released a public statement after an incident with the CCP censor. In that statement, he promised that Bytedance apps would strengthen "the work of Party construction" and "socialist core values" etc.

[https://chinamediaproject.org/2018/04/11/tech-shame-in- the-n...](https://chinamediaproject.org/2018/04/11/tech-shame-in-the-new-era/)

I don't know how Bytedance as a company can serve CCP interests AND claim to be independent of CCP interference _at the same time_.

TikTok is a good product, but it may not be a safe product.

More on the dystopian practices of Douyin (TikTok in China): [https://twitter.com/Izzy_Niu/status/1280906443273768960](https://twitter.com/Izzy_Niu/status/1280906443273768960) [https://twitter.com/JoshuaDummer/status/1280877750245453828](https://twitter.com/JoshuaDummer/status/1280877750245453828)

</comment><comment><USER62> Snapchat are you listening? Make a page for your users and allow them to persist the videos and images. You will have implemented a complete platform for those who want images to disappear and for those who want them to persist. That makes TikTok redundant and unnecessary.

</comment><comment><USER63> This is an example why I don't use Twitter regularly.

Someone mentions the copy/paste sec vuln in TikTok and "Onur Olmez" writes:

> LinkedIn app apparently also has this issue [...] Uncalled for to ban apps > for this one reason.

I mean, wtf? Everybody on Twitter has an opinion about everything, even things they know nothing about.

<comment><USER64> Are they wrong?

<comment><USER63> In my opinion, yes. This is an enormous security vulnerability. TikTok can exfiltrate any data that the user types into any application: passwords, any kind of sensitive data.

<comment><USER64> I think the objection is to the double-standard, where two apps commit the same infraction but one is assumed to be nefarious.</comment></comment></comment></comment>


Sapphire screens require new enclosing material (amorphous alloy) - <AUTHOR> http://www.techinsighter.com/blog/2014/2/24/sapphire-liquidmetal-the-ultimate-combination

<comment><USER2> that's pretty cool...

but how do I replace the battery, or repair it by myself? I can't help but to think that such 'elegant' methods of manufacture only serve to create more waste.</comment>


Ask HN: Anyone still doing monolithic Django? - <AUTHOR> Printing a hello world over kubernetes cluster is an overkill, so are multiple microservices when you do not need them. I loved monolithic django, but with the advent of microservices architecture and modern JS libraries react, vue, and the likes, here is what you got to do
Create a DRF Backend
Take care of authentication at both ends
Build your SPA in a modern JS framework.
The good is modularity, maintainability, better UX controls, super interactive UIs, and the likes, the bad is you need to write more code. In simple cases the good old django templates is good enough. Is anyone still doing them? I love the organised new age FE framework code, the imports that come with ES6.
Is anyone still doing monolith with django template and ES6. If so, mind sharing your workflow, and libraries? <comment><USER2> My app is still very much a monolith. It's just plain ol' django templates with turbolinks (so, pretty snappy to load pages). Tailwind's @apply + Django template partials give you a component-like workflow fairly easily.

And JS libs like Alpine, Stimulus, or plain old jQuery (as much as people may hate it) give you all the UI interactivity and reactivity you can hope for from the modern frameworks.

It may be a little more explicit and verbose at times, but I'll take that over having to reinvent multiple wheels (Auth, caching, validation, etc) when using DRF+React.

Combined with celery based task queues and the ocassional offloading of simple but time consuming tasks to serverless functions, IMHO there's very little Monolithic django can't do, even at scale.

<comment><USER3> Amen!

If your app is monolith, can I ask you to share the link? I'd love to see your turbolonk implementation. Can't wrap my head around it.

<comment><USER4> I've used turbolinks with django. It just required a small middleware:

[https://gitlab.com/danjac/localhub/-/blob/master/localhub/mi...](https://gitlab.com/danjac/localhub/-/blob/master/localhub/middleware/turbolinks.py)

<comment><USER3> Thank you!

</comment></comment></comment></comment><comment><USER5> I still do monolithic Django with just a sprinkle of js where necessary. I use the following libraries: * Django-allauth for authentication * Django- bootstrap4 for styling * Django-ckeditor atimes for rich text fields etc.

Django monolithic is still good for fast development and quick MVP release. Also SSR is quite and gives fast page loads

<comment><USER3> I totally agree. It's an overkill for most projects to fully separate the backend form the frontend. Django gives you everything you might need to build a fully capable app.

Maybe makes sense for Google, but not for most people working on side projects.

</comment></comment><comment><USER6> I do! Usually together with Unpoly for ajax stuff and tailwind for styling. Also, I prefer jinja2 templates because with the "macros" feature you can do easy to reuse components.</comment>


New Device Harvests Energy in Darkness - <AUTHOR> https://www.nytimes.com/2019/09/12/science/solar-energy-power-electricity.html <comment><USER2> Just like change of voltage is what matters, change of energy is what matters. I find it fascinating that all of energy politiking rests on fundamentals of funding these huge differences between potential energy wells so you can add something vampiric and capture the difference as electricity or some other type of kinetic energy that we like...

The million dollar question is whether the vacuum has some potential difference that can be exploited for energy generation..

<comment><USER3> As long as vacuum represents an energy differential worthwhile to exploit.

Heck, rusty iron in seawater generates enough energy to be usable.</comment></comment>


PostgreSQL Tips and Tricks - <AUTHOR> http://blog.gtuhl.com/2009/08/07/postgresql-tips-and-tricks/

<comment><USER2> #4 seems like a zealous overgeneralisation. JOINs get a lot of crap.

Yes, it's no secret that large joins on huge amounts of data can often be very intensive. From that does not follow, however, the exhortation to simply avoid them categorically. That's a little too much blanket statement for me.

For instance, joins are often used in situations where there is a numeric type column that refers to a very small table of enumerated values that have a textual or other translation, and there is a need to produce the latter in a single query. There's nothing wrong with that join from a performance standpoint, even for very large values of n.

<comment><AUTHOR> JOINs rightly get a lot of crap - they are massive performance bottlenecks if you are working with large tables.

Having a single awkward example does not detract from that.

I'll add to this by noting the post does say "For smaller tables it doesn't matter but as tables get bigger avoid joining when you can" which is sound advice.

I'd say joining scales up to perhaps a million or two rows unless you have a lot of RAM (you can see join spills to disk in the EXPLAIN ANALYZE output). I often am working with tables in the 10-30 million row range so my perspective is probably a little slanted towards the negative.

</comment></comment><comment><USER3> You might also be interested in this large collection of PostgreSQL SQL tricks: <http://www.postgres.cz/index.php/PostgreSQL_SQL_Tricks>

</comment><comment><USER4> Some reasonable advice in there, but #3? Ruh roh.

<comment><USER5> It's not particularly bad advice. Perhaps for someone who hasn't worked with databases long enough, it's dangerous to tell them "don't worry about normality." But denormalizing certain groups of tables can certainly cause a significant performance gain.

<comment><USER4> Yes, you're right. I agree that there are times that denormalizing makes sense. My point was that the item said:

* Throw away the normal forms you learned in school

* Denormalize [...] whenever it makes a query faster.

I think that's bad advice as stated. As you imply, you have to know why the rules are there to know when to break them intelligently. I didn't get that message from the item as posted, rather that the author thought that NF had little value, which probably doesn't belong in a list of database tips and tricks.

[edit: format]

<comment><AUTHOR> Been unplugged all day so haven't been around to respond. This is a completely fair criticism - the wording in my post is indeed too plain. Without understanding the normal forms making smart decisions about denormalization is going to be very difficult.

</comment></comment></comment></comment><comment><USER6> Good post, but most of those are SQL specific, and not really unique to Postgres, right? But yeah, very crucial points you covered that you see a lot of people not implementing!

<comment><AUTHOR> A lot of generic SQL stuff in there for sure. But, last I worked with MySQL (it has admittedly been a few years) the indexing options were severely limited when compared with PostgreSQL. Last I used it you could not index an expression or qualify an index with a where clause for example. Also at that time MySQL could only make use of one index per query.

All of those deficiencies may have since been eliminated.

</comment></comment><comment><USER7> So glad to see PostgreSQL bubbling up these day's as it's been my DB of choice for many years. I'd love to see a more portable version and of course something like mySQL's group_concat(). If you are game for trying it out be sure to check out the tools at sqlmanager.net (unfortunately they don't offer Linux versions anymore).

<comment><USER8> Postgres lets you define your own aggregate functions and has an array type. [http://mssql-to-postgresql.blogspot.com/2007/12/cool- groupco...](http://mssql-to-postgresql.blogspot.com/2007/12/cool- groupconcat.html)

<comment><USER9> Note that the array_accum user-defined agg described by that blog post is built into PostgreSQL 8.4 (it's called array_agg(), per the SQL standard).

</comment></comment></comment><comment><USER10> Interesting.

Any nice reference about pgsql and query optimization? Any book recommendation?

As an old mysql guy, as far as I do db:s, the advice re subqueries (#4) was unusual... :-)

(I looked at trying pgsql for a hobby a few years back and found lacking support for different char sets for different tables, etc. Is that [still] so?)

<comment><USER5> Yes, I'm pretty sure charset support in Postgres is at the database level, not the table level. See here: [http://www.postgresql.org/docs/8.4/interactive/multibyte.htm...](http://www.postgresql.org/docs/8.4/interactive/multibyte.html)

<comment><USER10> Ah, thanks. Sigh.

(No book recommendations for something like e.g. "High Performance MySQL"? Well, nice with no fanatical fanboys in this area, at least. :-)

<comment><USER11> If you are looking for a book on Postgresql the Douglas book [http://www.amazon.com/PostgreSQL-Developers-Library-Korry- Do...](http://www.amazon.com/PostgreSQL-Developers-Library-Korry- Douglas/dp/0672327562) is pretty good introduction to most of the topics specific to postgres, it includes a sample implementation of a postgres accessing script in most of the languages commonly used for the task, which can be a bit repetitive (perl, python, php, java, C, same tune different instrument) but that does make it a fairly good reference.</comment></comment></comment></comment>


Yahoo escalates war on ad-blockers--by keeping people out of their own e-mail - <AUTHOR> https://www.washingtonpost.com/news/the-switch/wp/2015/11/23/yahoo-escalates-the-war-on-ad-blockers-by-keeping-people-out-of-their-own-e-mail/ <comment><USER2> If the ad-block-blocked content is of sufficient value, this will inevitably give rise to stealth tech in ad-blockers. If one isn't concerned about bandwidth, then an ad-blocker could operate at the level of hiding or obscuring ads, rather than not loading them. And so an arms-race develops, which site operators would likely lose.

Worse yet, measures against people running ad-blockers are sure to annoy some of them into retaliatory responses. For example, there are already plugins which attempt to click on _all_ the ads on a page, so advertisers become concerned about click-fraud and offer less return to the site operator.

It would be very interesting to know the rates at which users disable their ad-blocker for Yahoo Mail, versus the ultimate account-abandonment rate from this "small" A/B test.

<comment><USER3> > which site operators would likely lose

I keep hearing people say that, but I really don't think that's how it will turn out. Adblockers rely heavily on pattern-matching to work: scripts loaded from certain third-party domains, resources in particular subdirectories, markup structured with predictable element IDs/CSS classes, and the like. There are ways to break all of these: first-party ads, either by directly hosting them or by proxying your ad network; media served via embedded data: URIs or hash-based URIs; CSS which is minified, and randomized every few weeks; etc. These techniques may not be widespread yet, but I'm sure they will grow in popularity as the adblocking war rages on.

But hey, maybe ads will get a bit less egregious in the process.

<comment><USER4> I was actually thinking about this a while ago, but I couldn't figure out how to get around community-reported, site-specific element-blocking using CSS selectors (structural selectors, not id/class selectors, which can be easily defeated by randomization). You'd have to periodically change the placement of your ads and/or the layout of your site, and that's not really viable as a long term solution.

</comment></comment></comment><comment><USER5> (This is a direct copy of my post on another thread about this)

As a staunch advocate of adblockers: as is Yahoo!'s right and adblocker makers should not attempt to circumvent it.

Yahoo! doesn't have an implicit right to their code running fully on my machine but by the same token I don't have an implicit right to their services. If they've made it clear they think I am not making a bargain with them that they like then I respect that.

What I can't respect is whinging about adblockers in editorials but still serving me the content (cough, The Verge).

</comment><comment><USER6> I would be really curious to see if this sort of strong arm tactic actually works for them. Part of me wants to see them implement it just to see if their users cry loud enough to make them revert, but I have a feeling the vast majority would just disable Adblock and go on about their business. Most anyone serious about privacy likely quit using free email services long ago.

<comment><USER7> Y! Mail is already on the slide. I can't see how this would result in anything but temporary ad revenue.

</comment></comment><comment><USER8> I find amusing that WaPo is publishing this article, after the way they blocked users with ad blocking software for about two months themselves. Safe to say that wasn't an accident....</comment>


Bleve – A modern text indexing library for Go - <AUTHOR> https://github.com/blevesearch/bleve <comment><USER3> Wishful thinking: I hope this prefaces an Elasticsearch rewrite in Go. I'm happy to be rid of the JVM wherever I find it.

No hard feelings, but we just spent 20 years crowbaring Microsoft into irrelevance. It's time to get started on Larry.

<comment><USER4> Why on earth would you rewrite ElasticSearch in Go ?

You would have woeful monitoring support compared to the huge array of tooling for JVM, an average GC implementation and almost zero integration with most enterprise applications e.g. Hadoop. All so what, you can go from one multinational (Oracle) to another (Google).

<comment><USER5> _> All so what, you can go from one multinational (Oracle) to another (Google)._

Or from one Larry to another.

<comment><USER3> Valid, though I never have to click through any kind of EULA crap to use Go.

So long as Go is supported in gcc, I'm not particularly worried.

</comment></comment></comment></comment><comment><USER6> Is the name meant to bring to mind a large explosion?

[http://en.wikipedia.org/wiki/Boiling_liquid_expanding_vapor_...](http://en.wikipedia.org/wiki/Boiling_liquid_expanding_vapor_explosion)

<comment><USER7> Author here, will try to answer questions as best I can from my phone.

Yes, I think I was watching one of those amazing explosions shows on Netflix. I liked the way it sounded, and it suggested some simple logo ideas.

<comment><USER8> Have you run any benchmarks? Do you have any rough estimations on how does it compare to Lucene in terms of speed and memory usage?

<comment><USER7> We haven't yet. Our philosophy has been to get the features and API right first.

Though there is some low hanging fruit I'd like to tackle this week. First there will be some bleve only indexing and querying benchmarks to validate those improvements. Then we should be in better shape to do comparisons against lucene.

<comment><USER9> Is the goal to compete with Lucene or with Solr/ElasticSearch layer as well? It was a little hard to tell from the samples if - for example - <USER2> is coded in (like in Lucene) or has externalized XML/REST interface (like in Solr/ES). Same, with whether you are planning to scale beyond single embedded instance and need to worry about scaling/cloud/etc.

<comment><USER7> Thanks for taking an interest.

I would say that we're most comparable to Lucene, given that we're a library not a server. But, we're also very much not a port of Lucene to go. That already exists, and someone has posted that link elsewhere in this thread. I've worked a fair amount with Elasticsearch, so a lot of the higher level API is inspired by it. And thats one of the biggest differences between Bleve and Lucene today. Lucene is pretty low-level. The bleve top-level API works a lot more like Elasticsearch (specifically there is a mapping, its serialized and stored in the index). There is a lower level that looks more like Lucene (everything is just documents and fields), and the top-level API builds on top of that.

That is I would say the primary goal of Bleve, to be a great text indexing and search library for Go.

Next you asked about a REST interface. Bleve ships with HTTP handlers in a sub-package. These are completely optional, you can use Bleve without them, or you could write your own if you don't like these. There is a not-quite-done- yet example app that uses these to make it look a lot like a single-node Elasticsearch. But, its just an example app, I have no immediate plans to try to turn this into a production app.

Regarding scaling beyond a single embedded instance... Obviously there is a lot of interest in this area. The way I'm looking at this right now is that this is simply a layer above Bleve, much as Elasticsearch/Solr provide this as a layer above Lucene. There are a few enhancements we could add to streamline this, like allowing the Searches to operate across multiple indexes.

My hope is that lots of apps spring up around Bleve. Maybe someone wires up the HTTP handlers and Raft and makes an Elasticsearch clone. Maybe people will do something I don't expect. Will we go there? Not right now, we've got our hands full. But if we do, it will be in a separate project, built on top of Bleve.

</comment></comment></comment></comment></comment></comment><comment><USER10> Looks very interesting. I've been playing with golucene[1], another alternative for those looking for a jvm-free indexing/search engine.

[1] [https://github.com/balzaczyy/golucene](https://github.com/balzaczyy/golucene)

</comment><comment><USER11> Looks Great! Looks like a loosely equivalent structure to lucene, and is a feature i've wanted in the golang ecosystem for a while.

</comment><comment><USER12> Main website: [http://www.blevesearch.com/](http://www.blevesearch.com/)

</comment><comment><USER13> Any plans to support the lucene query parser syntax?

<comment><USER7> We have support for limited version of it right now. The syntax we support is documented here:

[https://github.com/blevesearch/bleve/wiki/Query-String- Query](https://github.com/blevesearch/bleve/wiki/Query-String-Query)

You can see an example query using it executed here:

[http://wikisearch.blevesearch.com/search/?q=name:query%20%2B...](http://wikisearch.blevesearch.com/search/?q=name:query%20%2Bbody:%22query%20string%22%20human%5E2&p=1)

A few things that are missing from the syntax. Numeric ranges only support simple one-sided syntax (age:>25), not a two-sided range (age:[25 to 30]). Date ranges aren't supported yet. Complex boolean expressions using parens, AND and OR. Those are things that we support in structured queries, just haven't wired up the grammar for it yet. There are handful of others we don't support at all yet, like wildcard, and proximity searches.

The grammar is also still pretty simple, with an emphasis on making simple things work, not on things like escaping special characters within expressions.</comment></comment>


Coronavirus may have spread undetected for weeks in U.S. - <AUTHOR> https://www.boston.com/news/health/2020/03/01/coronavirus-may-have-spread-undetected-for-weeks-in-u-s <comment><USER2> I created a throwaway account because, well you'll see why.

My wife just told me that two of her co-workers were in Wuhan in Late November visiting a factory and they both got the flu in Wuhan.

One guy A, tested negative for the flu, he was sick for 6 weeks, he would start to feel better than get sicker. His doctor told him that he had no idea what was wrong with him. The guy A, said it was the strangest flu he ever had. Over the 6 weeks he was sick he worked from home the entire time and was only working part time for most of those 6 weeks because of how bad he felt.

The other guy B, I don't know if B was tested for the flu, was sicker than A, and he was sick for 8 weeks. He also worked from home for the entire time, my wife doesn't work closely with B, so she's not sure how much time he missed during those 6 weeks.

<comment><USER3> > One guy A, tested negative for the flu, he was sick for 6 weeks, he would > start to feel better than get sicker.

I really think there's something to this. In my part of So Cal, people have been talking about a "recurrent flu" that keeps getting better and relapsing at about 2-week intervals. Everybody I know has had something like that.

I think we're going to find out that we've already had covid-19, or there's another very nasty bug out there.

<comment><USER4> There are (at least) two strains of flus circulating this season.

<comment><USER3> Of course, there are, there would have to be dozens if not hundreds?

</comment></comment></comment></comment><comment><USER5> Seeing as how the latest percentage-du-jour claims "80% of infected people will have no to mild symptoms"[0] I'm not surprised.

[0] [https://www.nytimes.com/2020/02/27/world/asia/coronavirus- tr...](https://www.nytimes.com/2020/02/27/world/asia/coronavirus-treament- recovery.html)

<comment><USER6> Honestly it seems like that would be a huge relief? Last I heard the fatality rate is 1%. If that's actually 1% of the 20% who show any symptoms at all, it's now 0.2%.

<comment><USER7> The most recent data I have seen (yesterday in the NEJM) indicates 1.4% fatality in lab diagnosed cases. This of course will only include more serious symptomatic patients, as mild or asymptomatic patients are told to stay home and are not getting tested.

No one wants to stand up and call hysteria for what it is. It's easier to go with the flow and cancel events out of an "abundance of caution."

<comment><USER8> R0 value is roughly 4-7. Upwards of 5% of the cases require the ICU, 15% require support breathing. Medical personnel are coming down with it frequently, and Italy is trying to bring in newly graduated nurses and retired nurses to fill the gap. This is NOT hysteria. While it isn't a death sentence for most, it is imperative to slow this thing down.

<comment><USER7> Please understand that every single one of those percentages is wrong as you have stated them. You forgot the most important qualifier, which is that the denominator is some _fraction_ (potentially small fraction) of the total number infected.

So when you say "upwards" of 5% of cases require the ICU, this is potentially very misleading. Stating that upwards of 5% of _hospital cases_ require the ICU may be true, but now you must not try to extrapolate that value any further until you can tell me definitively what percentage of infections result in hospitalization? 1 in 5? 1 in 20?

I won't get into debating R0 values because they are nearly impossible not to misuse. For example, COVID-19 does not have just one R0 value. R0 changes radically based on actual conditions on the ground, often day to day.

The R0 value of COVID in a cult church in South Korea may be actually 1,000 while the R0 globally over the entire course of this news cycle might be 1.2.

<comment><USER9> > Please understand that every single one of those percentages is wrong as you > have stated them.

No, they are accurate as far as I know and I've been following this thing with some dedication since before it was discussed in the media because of relatively close ties to China.

> You forgot the most important qualifier, which is that the denominator is > some fraction (potentially small fraction) of the total number infected.

You are misrepresenting the OP's words. He said 'of cases', that is the denominator right there. That we don't know all cases is something that everybody takes as a given. But just like we don't know all cases we also don't know all of the dead. The same happened with the swine flu, with SARS and with every other epidemic so far. Only afterwards, sometimes more than a year later do we have all the numbers. And sometimes those end up substantially higher than the original estimate _both_ for the number of infected people as well as for the number of people that end up dead.

> So when you say "upwards" of 5% of cases require the ICU, this is > potentially very misleading.

Upwards of 5% of the known cases. But that's assumed, if we don't know someone is infected then they by definition won't require ICU level care.

> Stating that upwards of 5% of hospital cases require the ICU may be true, > but now you must not try to extrapolate that value any further until you can > tell me definitively what percentage of infections result in > hospitalization? 1 in 5? 1 in 20?

They don't need to tell you anything 'definitely' to be allowed to speak their mind. And as far as I'm informed that 5% rate is on the money. So, instead, the onus is on you to prove that _less_ than 5% of the people infected that require care require ICU care. I don't think you are able to do that but I will happily take good news at this point if properly sourced.

> I won't get into debating R0 values because they are nearly impossible not > to misuse.

Agreed.

> For example, COVID-19 does not have just one R0 value. R0 changes radically > based on actual conditions on the ground, often day to day.

> The R0 value of COVID in a cult church in South Korea may be actually 1,000 > while the R0 globally over the entire course of this news cycle might be > 1.2.

True, but there are averages and even the WHO seems to place the number at > 3 at this point in time. That is already a pretty high number, even when taking all the care in the world to ensure it doesn't spread. Of course the criminals in Korea that hope to bring about the end times in some kind of warped self fulfilling religious prophesy are going to skew that number upwards. But in Iran and Italy there was no such cult, and their numbers are very much in line with the development in Korea. And since we're mentioning Iran now, there are lots of informal reports that the situation there is much worse then officially reported, with the number of high officials there infected this - unfortunately - isn't hard to believe at all.

<comment><USER7> I think it's very important to be precise if you're speaking of potential worldwide calamity.

I think you may be giving OP too much credit with their use of "cases" implying _hospital_ cases (which is the 5% ICU number, it is not 5% of infections require the ICU) I'm happy if we are agreeing and will leave it at that.

> _Upwards of 5% of the known cases. But that 's assumed, if we don't know > someone is infected then they by definition won't require ICU level care._

You are still making too strong of a statement. In the study last week from NEJM of 1099 hospital patients around China that found that 90% plus were diagnosed with pneumonia, and 5% were admitted to the ICU. Case fatality rate was 1.4%. [1]

It is absolutely not 5% of "known" cases. China turned anybody not seriously ill from the hospitals back home. So we actually do know there are a large number of uncounted mild (and even asymptomatic) cases.

It is 5% of serious hospital cases going on to the ICU. This is not my claim, this is straight from the latest issue of the NEJM.

Also, I didn't say anyone couldn't speak their mind. But I said if you do try extrapolating a sub-population percentage and multiplying by world population, it would be a serious miscalculation. That's _why_ I think it's important (crucial) to clearly identify the sub-population when you state the percentage. Calling a sub-population dealing with hospital admittances the "known" cases is not clearly stating identifying the patient population.

I don't think HN commentators should play epidemiologist while making predictions of catastrophe.

[https://www.nejm.org/doi/full/10.1056/NEJMoa2002032](https://www.nejm.org/doi/full/10.1056/NEJMoa2002032)

<comment><USER9> > But if you extrapolating a sub-population percentage and multiplying by > world population

Where did that happen? In this thread or elsewhere?

<comment><USER7> I did not say that anyone _did_ try to extrapolate numbers using these percentages in this thread. I said, and am saying, that it's important not to try to do that.

Because it leads to fear-mongering. For example, downthread, here;

[https://news.ycombinator.com/item?id=22461804](https://news.ycombinator.com/item?id=22461804)

<comment><USER9> > I did not say that anyone did try to extrapolate numbers using these > percentages in this thread.

But you did imply that. Look, I am all for keeping a cool head. But at the same time I'm not going to cool my head by sticking it in the sand. I think if you're going to participate in these discussions then you probably should do so by making your statements a lot clearer than you do.

If you - for instance - idd not intend to suggest that someone did try to extrapolate those numbers then you did a poor job of it. You can't just make up strawmen and then suggest people shouldn't do that.

The comment you linked to was properly qualified and is not fearmongering. If you think that is fearmongering then you possibly have a reading / comprehension issue.

Let me help you by picking that comment apart:

> The 1.4% apply to the general population.

You can't really argue with that I think,

> For people over 80, the fatality rate is 15%.

Not exactly correct, I have it at 14.8% _once infected and showing symptoms_. But close enough.

> There are roughly 13 million people over 80 in the US [1].

This is properly cited.

> If everyone gets infected, a fatality rate of 15% means 2 million deaths in > that single bracket alone.

Again, this is properly qualified by the leading 'If'

> With the 1.4% figure it's 4.6 million over the entire US population.

Again, with the implied assumption that people are all infected, something that is unlikely to happen.

> As a comparison, the number of yearly deaths in the US caused by influenza > is in the 5 digits.

This is correct as far as I know, between 10 and 60K cases annually ranging from very good years to very bad ones.

> World war 2 killed 3% of the world population over a range of multiple years > [2].

Can't argue with that.

> If the coronavirus kills only 1% of the current world population, its death > toll in absolute numbers will be equal to WW2.

Again, properly qualified by a conditional.

> I think at this point, the disease can't be contained, its spread only > slowed.

I don't think anybody is arguing that it can be contained still, even the WHO has moved on this, though they kept it up for longer than I personally think was responsible.

> Everyone will be exposed to it sooner or later.

Probably correct, similar to the flu, most people get exposed to it in their lives and usually once per year.

> Fortunately though there are treatments, and there are already candidates > for vaccines. The question is only how quickly and how well those treatments > can be deployed.

If there is one part of this comment that I have issues with then it is this one. There are - as far as I know - no vaccine candidates that have been trialed. I'm happy to be proven wrong here so any link is welcome.

> The less people have the disease at the same time, the better.

And that is the key insight: the whole thing revolves around managing the capacity to deal with the people that are ill. That and effectively reducing R0 < 1 are the main tools that we have at this stage to deal with this particular virus.

<comment><USER7> You asked for an extrapolation example, I gave that one. OK, so we agree people are extrapolating with these numbers.

Now, you want to keep playing that game.

To extrapolate over the general population with the 1.4% case fatality of serious hospital cases, _would be wrong_ and would be fear mongering. The general population does not have a infection rate of 100% nor a case fatality rate of 1.4%.

So the premise is wrong, the assumptions are wrong, and the result are wrong.

>> If everyone gets infected, a fatality rate of 15% means 2 million deaths in that single bracket alone.

> Again, this is properly qualified by the leading 'If'

Qualifying a statement ending with _"means 2 million deaths in that single bracket alone."_ with a qualifier that is false is what I would call fearmongering.

>> With the 1.4% figure it's 4.6 million over the entire US population.

> Again, with the implied assumption that people are all infected, something > that is unlikely to happen.

No, it's not an "implied assumption" it's faulty epidemiology. First, it is faulty to assume that everyone who is exposed will be infected. Second, it is faulty to apply the 1.4% case fatality rate of _serious hospital infections_ to the entire US population.

The assumptions are wrong. The figures are wrong. The result is wrong. It is putting false information based on poor understanding of the facts into the discussion and it's gone totally off the rails. Please, you should seriously reconsider why you are supporting this.

<comment><USER9> > Now, you want to keep playing that game.

I am not playing games. This stuff is _far_ too serious to play games over.

> To extrapolate over the general population with the 1.4% case fatality of > serious hospital cases, would be wrong and would be fear mongering. The > general population does not have a infection rate of 100% nor a case > fatality rate of 1.4%.

No, but the Spanish Flu for instance had an infection rate of about 25%, and the general _infected_ population could very well be above that 1.4% (in fact, there is every indication so far that it will end up somewhere between 2 and 3%).

> So the premise is wrong, the assumptions are wrong, and the result are > wrong.

The premises isn't nearly as faulty as you make it out to be, it might be off by a factor of four, hopefully much less than that. But so far - taking Wuhan as our baseline - unchecked this thing will spread very fast and kill lots of people. The only reason the onslaught was halted is because the Chinese took a bunch of draconian counter measures, the likes of which very few countries in the world will be able to copy.

> Qualifying a statement ending with "means 2 million deaths in that single > bracket alone." with a qualifier that is false is what I would call > fearmongering.

That's fine by me. But it isn't. As a whole it isn't and in the details it isn't either. We actually have precedent for this whole situation, it is the 1918 pandemic and the world apparently hasn't learned its lesson fully. Which may mean we are about to re-learn it the hard way. Maybe this time it will stick. But then - as now - there were plenty of people like you who were willfully - given the way this conversation is progressing I am assuming you are doing this on purpose - ignoring the cold hard facts. And that made the pandemic _much_ worse than it had to be.

Large events were not called off and led to the disease spreading much further than it had to.

Absent an effective anti-dote to this virus and with an overwhelmed health care system (note the qualifiers!) we might as well be in 1918.

> No, it's not an "implied assumption" it's faulty epidemiology.

Not as far as I can see. People talk about hypotheticals all the time. You can't really come out like this against a pretty clear comment and at the same time make up stuff you rail against that never happened in the first place. Fix your own issues first.

> First, it is faulty to assume that everyone who is exposed will be infected.

Agreed, so let's divide the number by 4 and call it a day. That's the worst this could possibly get. Right? Or do you think that given a sample of '1' the 1918 flu might not be the best guideline for precision and that it might be better _or_ worse? We don't actually know the answer to that.

> Second, it is faulty to apply the 1.4% case fatality rate of serious > hospital infections to the entire US population.

That's true. But for all the same money we end up with a higher case fatality rate. So that may end up affecting the equation in a negative way.

But assuming 10% of the country becomes infected and 5% of those end up with symptoms serious enough to warrant ICU care there is a serious problem.

And that 10% could very well be low. So as far as I'm concerned you should start taking this a bit more serious instead of trying to shout down the discussion. Stay dispassionate and try to argue your case with actual numbers rather than nay-saying. That way you can contribute rather than just irritate. Think of it as an opportunity to educate, and you just might learn a thing or two yourself.

<comment><USER7> Look, I appreciate the discussion, and I'm about to sign off.

I just want to say, it's easy to take the wrong numbers, multiply together, and see 100 ways that _millions of people die_. That's fear mongering.

What I believe is that it's incumbent on anyone who wants to participant in predictive discussions to do so responsibly and using only the best numbers that we have on hand.

Anything could happen. And this is always true, whether it's the Ebola discussion from a while back, or SARS, or MERS, or COVID today.

You still seem to insist on claiming that we could see pervasive worldwide infection, 5% ICU admits, and 1.4%+ general population fatality. I hope you will soon realize that is not actually representative of what we are facing, where in fact, the vast majority of cases are mild or even asymptomatic. I expect this will be clear even to the most avid doomers by mid-April.

Lastly, I don't want to go back and forth on little things, but this;

> _at the same time make up stuff you rail against that never happened in the > first place. Fix your own issues first._

I think you need to re-read what I originally wrote. I never strawmaned.

I said the numbers were all wrong _as they were stated_ due to lack of proper context. I could have used the word "useless" or "misleading" instead of "wrong" and that might have been better.

I then followed up by saying it's imperative not to try to use those numbers to extrapolate in the general population. I could have said "one must not". I was not accusing Op of doing this.

I was trying to say that the _danger_ of not properly qualifying the context of a percentage like case fatality is that people will misuse it by improperly extrapolating.

Then we found an example down thread which does exactly that... and you defend it anyway. Which is fine, but I stand my ground on the argument (same as the NEJM doctors) that it's improper to extrapolate the hospital case fatality to the general population.

If one "assumes that the number of asymptomatic or minimally symptomatic cases is several times as high as the number of reported cases, the case fatality rate may be considerably less than 1%." (NEJM)

<comment><USER9> > using only the best numbers that we have on hand.

But you yourself are not doing that. You quote data that has been long ago overrun by the reality on the ground.

> You still seem to insist on claiming that we could see pervasive worldwide > infection, 5% ICU admits, and 1.4%+ general population fatality.

We could. We also could not. Let's hope for the best and plan for the worst. That way we can all laugh at this a year from now.

> I hope you will soon realize that is not actually representative of what we > are facing, where in fact, the vast majority of cases are mild or even > asymptomatic.

I do not doubt that at all. But that does not rule out that the numbers could still be quite bad.

10% infected and 1.4% CFR would be _very_ bad news.

> I expect this will be clear even to the most avid doomers by mid-April.

Maybe those 'avid doomers' aren't the doomers. The doomers are the cultists and the 'we're all going to die' people. We're not all going to die. But unless we take substantial countermeasures a lot more people will die than need to. Look at Iran for a taste of that. And that's the message that should go out: reduce the opportunity for the virus to spread so that we get to R0 < 1 as soon as possible and then mop up from there. Anything less and it will just get worse and worse.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> That is scary, not for the actual health risk implications but for the implication when it comes to the supply chain. (Unless you are a member of a risk group). I'm not trying to panic or fear monger at all, but I think it is a good time to point to this scientific american blog post that suggest to have food and water on hand for two weeks [https://blogs.scientificamerican.com/observations/preparing-...](https://blogs.scientificamerican.com/observations/preparing- for-coronavirus-to-strike-the-u-s/)

That doesnt mean you need to stock up on ammunition and night vision googles, just have some food safety even just to not overload the supply chain

<comment><USER11> Why do we need to stock up on water? Even the CDC is recommending it. How does the virus put our water supply at risk? I have two weeks worth of water already stockpiled in case of an earthquake which could cause infrastructure damage to our water supply. Everyone should have that.

<comment><USER12> Jeez, you stock 14 gallons of water per person in your house? Where do you keep it? Do you periodically re-freshen it or what?

<comment><USER13> Do you have a hot water heater? Common knowledge among SFFD to have some bottled water and access the hot water heater when that runs out.

<comment><USER12> Interesting, our hot water heater is "tankless" and it hadn't occurred to me until this thread that this makes emergency prep a little more complicated.

</comment></comment></comment></comment></comment><comment><USER14> Fun story: a friend of mine works as an engineer in critical infrastructure (for a large utility in Germany). He wanted to spend his vacation in northern Italy (which currently has a COVID19 outbreak). When his employer got wind of it they offered to pay him extra to choose a different destination. If he went, they told him, he couldn't come back to work for another 2 weeks after his vacation (unpaid leave).

</comment><comment><USER15> I have read reports saying that the CDC won't test you unless you have fever, shortness of breath and chest pain. By the time you get to that point you already passed the virus to a bunch of people.

<comment><USER16> Fever and shortness of breath are the symptoms of the disease - how else would they figure out who to test?

<comment><USER15> What are your thoughts on this story:

[https://www.reddit.com/r/nyc/comments/fayko1/my_covid19_stor...](https://www.reddit.com/r/nyc/comments/fayko1/my_covid19_story_brooklyn/)

</comment></comment></comment><comment><USER7> There's almost nothing new in this article, for what it's worth. A genetic analysis of two infections show a mostly identical genome.

This does not definitively tell you anything about how those two people were infected.

Everything else is speculation wrapped in clickbait.

For the vast majority of people, an infection of this coronavirus would be more mild than catching the flu.

A reasoned analysis (such as what was provided yesterday in the New England Journal of Medicine) puts the fatality rate of COVID-19 on the same order of magnitude as the flu.

It is new and very sensationalized. I think it's absolutely imperative to try to maintain a rational stance of the actual relative impact of this coronavirus versus a typical flu season.

<comment><USER17> Reading this article actually had the effect of reducing my level of alarm, because it introduced the possibility that some of my household has already caught this bug in the last 6 weeks and we got through it.

<comment><USER18> I wouldn't feel too sure about that. They estimate 150 - 1500 total infected right now. There would be substantially fewer even 1 week ago (R0 of 2, roughly 1/2 last week. R0 of 3, roughly 1/3, etc).

It's possible the number of infected in the region only broke triple digits a couple of weeks ago. But exponential processes being exponential, there could be many thousands in 1-2 weeks.

Edit: Stated another way, from what we know of the course of the disease (14-21 days from infection till fatality) the critical and fatal patients identified this weekend likely entered the disease process 2-3 weeks ago when the total number of infections was small.

Edit 2: another confounding factor is that these numbers seem assume that all of the current infected are traceable to the index patient. I think it's very possible that there are other "trees" of infections spreading at the same time from different unidentified index patients. I'm guessing that's true because studies show that airport screening misses >50% of cases. Additional sequences on WA patients will be hugely informative.

</comment></comment></comment><comment><USER19> Yea I'm pretty sure it's out and about in the US now. Your patient numbers are always 0 if you don't test for it

</comment><comment><USER14> 1\. Don't panic, COVID19 won't harm you. 2\. No wonder it spreads undetected, with the messed up US medical system, I wouldn't go to the hospital either if I had to fear a huge medical bill [1].

[1] [https://www.nytimes.com/2020/02/29/upshot/coronavirus- surpri...](https://www.nytimes.com/2020/02/29/upshot/coronavirus-surprise- medical-bills.html)</comment>