Planetary Defense - <AUTHOR> http://www.nasa.gov/planetarydefense <comment><USER2> I'm kinda jealous of job titles that would come out of this department... "Director of Planetary Defense", "Strategic Interstellar Command Coordinator", "Chief Planetary Defense Officer".

<comment><USER3> My first thought was "I want to work there just so I can tell people I'm with Planetary Defense when they ask what I do for a living".

The downside is the nagging feeling like you should be wearing oversized futuristic pauldrons and a ridiculous-looking Space Belt all the time.

<comment><USER4> Depends on the franchise type I guess. MCU's S.H.I.E.L.D. wear and the Starfleet uniforms from First Contact and later look pretty smart, actually. I wouldn't be afraid to go out with something like this[0].

That is, I'd have to lose some weight first.

[0] - [http://img3.wikia.nocookie.net/__cb20121217161450/memoryalph...](http://img3.wikia.nocookie.net/__cb20121217161450/memoryalpha/en/images/e/ee/Starfleet_uniforms,_post-2373.jpg)

<comment><USER5> But no pockets? And your cellphone glued to your chest?

<comment><USER4> Didn't you hear that _wearables_ are the future? ;).

(Also, it's prior art. USPTO, pay attention.)

</comment></comment></comment></comment></comment><comment><USER6> Here is a list of NEO Earth Close Approaches:

[http://neo.jpl.nasa.gov/ca/](http://neo.jpl.nasa.gov/ca/)

1\. Not a bad ROI to save a global economy with a GDP of $77.609 trillion and population of 7.095 billion.[1]

2\. The side benefit is understanding how to mine NEOs worth billions.[2]

3\. I would like to buy an insurance policy against an impact. I bet it would be super cheap as there is very low risk, but would get me to Mars or ISS.

[1] [https://en.wikipedia.org/wiki/World_economy](https://en.wikipedia.org/wiki/World_economy)

[2] [https://en.wikipedia.org/wiki/Asteroid_mining](https://en.wikipedia.org/wiki/Asteroid_mining)

<comment><USER7> _" Based on known terrestrial reserves, and growing consumption in both developed and developing countries, key elements needed for modern industry and food production could be exhausted on Earth within 50–60 years.[2] These include phosphorus, antimony, zinc, tin, lead, indium, silver, gold and copper"_

Sounds ominous! Why aren't we more worried? Because Capitalism?

<comment><USER8> Mostly that. But realistically there's no education on any of this stuff.

For example 2017 is the year when some of the most used rare earth elements will be depleted and should be retrieved through recycling in the next years (gallium for the LCD displays is disappearing, so either we figure out the displays or massively recycle). This is not a surprise because the demand for rare earth elements has been rising exponentially, with the number of electronic devices produced :D

Although, food production is definitely getting more and more efficient. But biology of living beings on Earth is too inefficient for the current production to be sustainable. Just compare the vast amounts of food (energy) a single duck, chicken or cow needs to maintain body heat, with the weight (energy value) of meat. This coupled with growing consumption in developing countries won't really work.

Without Hot Air is an excellent book written by a problem solving pragmatist and excellent machine learning researcher David MacKay exposing the pure numbers and limits and extrapolating them carefully, to get the same conclusions. [http://www.withouthotair.com/Electronic.html](http://www.withouthotair.com/Electronic.html)

<comment><USER9> Gallium supply: Wikipedia [1] says USGS estimates gallium reserves as > one megaton. Production in 2012 was an estimated 273 metric tons. I don't see us running out of gallium soon.

[1] [https://en.wikipedia.org/wiki/Gallium](https://en.wikipedia.org/wiki/Gallium)

<comment><USER8> I'm not pulling these numbers out of my butt.

There's absolutely no way that there's one million gallium reserves economically viable for extraction. If there was, the price wouldn't be that high.

Hafnium and indium too. 2017-2020.

[https://scholar.google.hr/scholar?q=indium+hafnium+reserves&...](https://scholar.google.hr/scholar?q=indium+hafnium+reserves&btnG=&hl=en&as_sdt=0%2C5)

<comment><USER10> I'm sure you're not. The issue is, "economically viable" is a useless phrase by itself, and is usually used to imply "economically viable at current prices".

For most non-energy non-renewable resources, humanity can just pour more energy than they do now into securing the scarce resource, and things will be a bit more expensive, but less concentrated ores will be targetted and more expensive extraction methods used and the supply will hold up at a higher price. Substitutes will be sought and some will maybe be found, if they work out better than the now-pricier resource.

Finance abhors an inexpensive depleting natural resource it has no substitutes or emergency supply for: if it is economically viable for one investor to buy all the world's remaining supply of Technetium, he will stockpile it and trickle it out to the resource-starved market at ten times what he paid. To assert that "lack of education" is the problem is ignoring the numbers issue: it only takes a single smart investor to turn the whole market towards appreciating reality-mandated scarcity, and he earns a very large profit for educating the market.

Fossil fuel extraction concerns have a better basis: they have a floor at which it is mathematically impossible to profit from extraction, EROI<1, so long as you are using the energy you extracted to harvest more energy. I was for a period of five years or so an alarmist on this point. Even so, it looks like there exist enough positive EROI deposits to raise global CO2 by an untenable amount (an amount which depopulates >10% of the world's presentday habitation due to high wet bulb temperatures), long before we run out of coal, oil, gas, & kerogen shales.

<comment><USER7> I have a question: if squeezing a market results in a guaranteed profit, how come so few companies were able to do it, even on small markets? Goldman Sachs did it with bread and steel I think... but failed. Why would pumping cost less than the dumping makes?

<comment><USER10> Most markets in the modern world are fairly efficient. This means that they are priced appropriately for supply to meet demand, with all the most predictive facts about future supply & demand, acknowledged fairly well by the market price (which will drive expansion or contraction of that supply and demand next year). If it's possible to squeeze off supply to the market, the market has likely already been squeezed. There are billions of dollars in profits waiting for anyone to pounce on a market that is truly squeezable, and prove the rest of the investors wrong. Most markets are _not_ especially squeezable, because that element of risk to the supplychain has already been factored into their asset prices, and substitutes or alternative supply sources become available for exploration at higher prices, which undercuts anyone attempting to squeeze supply off.

It's pretty safe to assume an equilibrium between these sorts of processes, and a lack of "glaring upcoming shortages that Capitalism Didn't Listen To Our Warnings About".

At least, up to some level - maybe two or three decades - at which uncertainty about future inflation rates and technologies renders it really risky to make long bets of any sort.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> There is some context in this Gizmodo article, "NASA's New Office Is Our Defense Against Death From the Skies" [1]. I thought HN would prefer the direct link to the new NASA site, however.

[1] [http://gizmodo.com/nasas-new-office-is-our-defense- against-d...](http://gizmodo.com/nasas-new-office-is-our-defense-against- death-from-the-1752280136)

</comment><comment><USER11> This is a master stroke. The masses want to cut science funding. Rebrand as "planetary defence" and the spigots re-open.

</comment><comment><USER12> I just finished re-reading Carl Sagan's Pale Blue Dot, in which he devotes a chapter to this subject. His conclusion is that, at our current level of civilizational maturity, we're better off crossing our fingers rather than learning how to redirect asteroids, since the technology required to save the planet from a massive impact is _exactly_ the same as that used to conduct asteroid bombardment.

<comment><USER3> I'm having trouble imagining a scenario where asteroid bombardment makes any sense in a world where nukes and ICBMs exist. Even factoring in the inconvenience of radiation it doesn't work. Too complicated, too expensive, too slow, anyone who could do it now or in the future will either have nukes or the ability to quickly acquire them.

<comment><USER13> Even if one insists on non-nuclear city killers, it's probably easier to get some Tungsten rods into orbit

[https://en.wikipedia.org/wiki/Kinetic_bombardment](https://en.wikipedia.org/wiki/Kinetic_bombardment)

<comment><USER14> Hardly a city-killer. The rods that were to be used in Project Thor would strike with the energy-equivalent of "11.5 tons of TNT".

</comment></comment></comment></comment><comment><USER15> Not just NASA. ESA is also busy.

[http://www.esa.int/Our_Activities/Space_Engineering_Technolo...](http://www.esa.int/Our_Activities/Space_Engineering_Technology/ESA_s_planetary_defence_test_set_for_2020)

</comment><comment><USER16> _" A first-ever robotic mission to identify, capture and redirect a near-Earth asteroid to a stable orbit around the moon, where astronauts will explore it in the 2020s."_

Wow! That's pretty awesome, but I'm hoping they plan this one _very_ carefully and/or pick a small asteroid.

<comment><USER17> An asteroid of any dangerous size is pretty hard to move. You're not going to inadvertently tap it into a bad orbit with a hammer.

We're already able to send probes to Pluto within a few kilometers, calculating an asteroid's orbit is well within our capabilities.

<comment><USER18> > We're already able to send probes to Pluto within a few kilometers, > calculating an asteroid's orbit is well within our capabilities.

Yeah calculating the orbits and movements for a simple small mass might be fairly easy. But an asteroid is irregulary shaped which makes stuff quite complex. We have failed with Philae for example...

The only way this is going to work is with a powerful nuclear bomb mounted on an interstellar rocket to blow said astroid to pieces (and these pieces should be tiny enough to vanish during atmospheric reentry), should the need arise - however the EMP would fry at least the satellites in orbit, maybe also on the ground.

<comment><USER19> Calculating the orbit of an irregularly shaped object is not difficult, just use its center of mass. What is difficult is calculating an orbit around an irregularly shaped object, unless you are far enough away that you can still ignore the irregularities.

</comment></comment></comment></comment><comment><USER20> This talk from Ed Lu[1] has a lot of great illustrations and cost/benefit analysis of NEO defense measures. He is obviously a bit biased as CEO of the Sentinel Mission, but IIRC, he isn't shy to admit that.

[1] [https://www.astrosociety.org/silicon-valley-astronomy- lectur...](https://www.astrosociety.org/silicon-valley-astronomy-lectures/the- sentinel-mission-finding-the-asteroid-headed-for-earth/)

</comment><comment><USER21> Dear [https://en.wikipedia.org/wiki/The_Asylum](https://en.wikipedia.org/wiki/The_Asylum), please use this department for your next SyFy B end-of-the-world B movie.

</comment><comment><USER22> This is a very exciting mission.

Does anyone have a sense of how many potential near-Earth objects have a rocky surface with large boulders as required by this mission?

</comment><comment><USER23> Nasa has an entire department dedicated to warning people about Vietnamese soups?</comment>


The tuition is too damn high - Part 2 - <AUTHOR> http://www.washingtonpost.com/blogs/wonkblog/wp/2013/08/27/the-tuition-is-too-damn-high-part-ii-why-college-is-still-worth-it/

<comment><USER2> I laughed at the study comparing twins with different schooling. Is that supposed to demonstrate anything except that success isn't entirely genetic?

Personally I think it's unwise to say that college is absolutely a positive investment. There are a lot of factors involved: the two most obvious are cost of attendance and desirability of degree.

Is it worth it to pay $15,000 a year for a STEM degree? I think so. At least, my personal experience indicates that this was an extremely wise financial decision. What about paying $15,000 a year for a degree in literature? Probably not so wise.

Also, the income comparison provided is a little misleading because it only includes full-time year-round workers 25 and older. This isn't useful for a prospective college student unless they also know the probability that they will actually be a full-time employee at age 25. If unemployment rates are similar for both demographics, the difference in expected income would be less. On the other hand, if college grads are more likely to be full-time workers, the article's statistical argument would receive some much-needed strengthening.

</comment><comment><USER3> Is there any reason to go to college beyond the prospect of making more money with a degree?

<comment><AUTHOR> To grow up? Meet a spouse? Transition to adulthood amongst peers?</comment></comment>


NYCSeed's summer program: $10k for 5% for 10 groups - <AUTHOR> http://nycseed.com/seedstart.html

<comment><USER2> Are there absolutely no innovators out there among investors?

It seems that there are lots of incubators just riping off without really understanding why yc actually works. They don't even bother to try and reflect on their own situation and shape a program reflecting their individual strengths and weaknesses.

YC is heavily tech and somewhat hackers only. Presumably because at least three of the founders are nerds themselves. This gives an obvious bias that YC has leveraged brilliantly to attract great hackers.

Why the hell doesn't someone do the same in another industry? For instance, if someone with credilility in greentech started Greencombinator that did the same thing just geared towards Greentech and ecological startups they would be the hub and powerhouse of greentech within two years. Same probably goes for a lot of other industries.

Or why doesn't someone do Universitycombinator that would specialise in spinning university research into viable companies.

I mean seriously, there are so many possibilities, yet all we see are stupid clones.

</ end rant >

<comment><USER3> I assume it's because software is the only industry where a 1-3 person startup can create a viable product in a short timeframe that can be sold for large multiples.

<comment><USER2> Assumptions are the enemy of innovation.

</comment></comment></comment><comment><USER4> Is it just me, or are these seed funding firms popping up everywhere? It looks like YCombinator is really starting to have an influence.

</comment><comment><AUTHOR> _We will give up to 10 teams a small amount of funding, space, and mentorship in exchange for a small piece of equity in whatever they build._

I thought the cash was a little low, I mean, this is NYC, after all?

They are providing space (working space, that is, not an apt, I think), though, which makes it a little better - but I like YC's 5k*n idea a lot more.

<comment><USER5> They aren't even in Manhattan, they are based in Brooklyn. I dunno that kind takes a hit on their legitimacy to me.

<comment><USER6> What is wrong with Brooklyn? If you start your company in Manhattan, you're just needlessly increasing your burn rate and reducing the amount of time you have.

</comment></comment></comment><comment><USER7> I know this is blasphemy (being on Y Combinator news, and all), but someone should compile a list of all these funding programs.

I think it'd be helpful for all of us.

<comment><USER8> YC, Techstars (in Boulder and Boston), Launchbox, Seedcamp, Alphalab, Shotput, Dreamit, NYC Seed, Capital Factory, Awesome Inc, Bootup Labs, Lightspeed Summer Grants, Summer@Highland, Founders Co-Op, Flow Ventures, Gangplank HQ Incubator. Also iVentures10, but they come with a strong unrecommendation from an anonymous YC commenter.

I didn't include some of the funds at the periphery, like CRV Quickstart and fbFund. There's also the Plug and Play Tech Center in Sunnyvale, just about the only true tech incubator left in the Bay Area.

<comment><AUTHOR> Also, Start@spark

</comment></comment></comment><comment><USER9> And now my summer program: $10 for 5%

<comment><USER10> I will happily accept your $10 in exchange for 5% of same. :)

</comment></comment><comment><USER11> Why does this page say up to 200k? <http://nycseed.com/apply.html>

<comment><USER6> This $10k program is a special summer funding session.

NYCSeed is actually an established angel investment firm that does invest significant amounts.

<comment><USER12> I wonder if this is a growing trend in regions across the country. Last week there was a post about AlphaLab providing $25K, but it too is a subsidiary of InnovationWorks which offers $100K. <http://news.ycombinator.com/item?id=550892>

<comment><USER6> It makes a lot of sense. Imagine you have a fund that you need to invest into new, unproven companies at the early seed stage. You can find companies the traditional way by having meetings, getting referrals, soliciting applications, etc. By the end, you'll have had a total of a couple hours (at most) contact with the founders before you decide to invest.

On the other hand, you can start out by spending 200k on 20 companies for the summer while mentoring them. By the end of the funding cycle, you'd have a really good idea of which founders were hustling, which ones suck, and which ideas you believe in. Based on this unusually in-depth knowledge of the companies and founders, you can invest more in the ones you like. Presumably, this would improve the quality of your overall portfolio.

</comment></comment></comment></comment><comment><USER13> So I guess the thinking is tha 5% is worth the access to other VCs?

I ask because $10k seems ridiculously small: if I had 4 people saving in my team, we could get $10k together in a month or two.

</comment><comment><USER14> Finally a seed fund in nyc. Anyone looking for a partner/team member?</comment>


How to force manufacturers to take IoT security seriously? - <AUTHOR> https://securitybytes.io/how-to-force-manufacturers-to-take-iot-security-seriously-33a3e9b5ba55 <comment><USER2> I think the morality of this issue is extremely interesting. A single insecure IoT device isn't a problem at all, but in huge quantities they become a form of Internet weaponry.

Imagine if white hats were given legal immunity to hack devices that are easy to hack (for some definition of "easy") and, for example, replace the firmware with something that flashes some red text reading "contact manufacturer for replacement", and simultaneously closing the security hole in of which they came in the first place.

This would be a sort of middle ground, giving consumers a minor annoyance rather than a bricked device, but still leveling the playing field between white hats and black hats.

Perhaps adding a $1 bounty per device for the white hats, paid by the device manufacturer. Then the manufacturer would be forced to purchase insurance, who would want to look at the security of the software before giving a offer on the policy.

<comment><USER3> This insurance concept is and interesting idea, I think.

Unfortunately, insurance is all about risk management. In layman's terms: why bother worrying about security when you can just buy insurance for it. Then they'll pick up the tab for any problems, right?

<comment><USER4> Insurance can be a powerful force for creating standards. Most of the building codes in existence were created by the insurance industry. The NFPA (National Fire Protection Association) was originally sponsored by a collaboration of insurance underwriters. [1]

Insurers want to make sure that a building meets the code before offering insurance on it. If a building collapses or burns down and it is later shown that it was not built to code, the insurance policy will be void.

I imagine similar incentives would hold for IoT security. The insurance would be contingent on the manufacturer following all available best practices to show that they did all they could to make the device secure.

[1] [http://www.nfpa.org/about-nfpa/nfpa-overview/history-of- nfpa](http://www.nfpa.org/about-nfpa/nfpa-overview/history-of-nfpa)

<comment><USER5> When I worked upon software for the oil industry for the building of oil rigs. The whole aspect of testing and insurance was very much key and Llyods of London have dedicated inspectors who would inspect and sign of parts as and when completed and without them, no insurance could be offered.

So for large scale key area's you will find that insurance/reinsurance companies have more than actuaries giving values to a risk. It is in their interest after all, more so when large sums of money are equally at risk of theirs.

AS for driving standards, yes, it happens. Though in some cases it happens after the horse has bolted.

For example in the UK ALL insurance has a premium added to it to cover people who have high-risk properties subject to flooding and with many houses built upon flood planes in the 80's with low regard to risk of flooding than they should, then it is a sticky plaster solution that fixes a legacy issue that we all end up paying for. That is the concern with IoT and I do fear that a solution that see's everybody paying the premium to cover the issues of the past, will transpire either directly or indirectly.

</comment></comment></comment></comment><comment><USER6> In a way it is a bit unfair to IoT manufacturers. The problem is that to make something secure today, you need to be a network protocol specialist, a linux specialist, an expert cryptographer, etc. And guess who are IoT designers? Either a low level technician in a big western company or a guy hacking stuff together on the side of a factory floor in China.

To me it is unreasonable to ever expect that all of them will be linux specialists, expert cryptographers, network specialists, etc.

Fundamentally we are at the convergence of software and hardware, but the software is too complicated, give people too many ways to shoot themselves in the foot.

I'd argue we need better software, not IoT manufacturers sinking ressources in hundreds of unrelated expertises.

<comment><USER7> Ring stored WiFi credentials in plaintext on their video doorbells -- would you say it requires a cryptographer, a network specialist and an embedded device expert to know that was a terrible move for a home security device you can walk up and physically rip off the outside of someone's house?

IoT manufacturers don't have to contract Linus Torvald to review their code, but it's entirely reasonable to expect IoT manufacturers to use existing best practices to secure these products.

<comment><USER8> I would say, based on my experience that indeed it does require some level of specialization which most don't have today. I'm fighting with an IoT manufacturer right now because they ship the same root private key on every one of their devices. This is a pretty simple concept to understand:

"Are all your device privates derived from the same key? Do you ask your users to install your public root to get past security warnings?"

Yet they clearly don't understand PKI 101 and think what they are doing is completely appropriate because they are "following standards" while of course missing the bigger picture entirely.

</comment></comment></comment><comment><USER9> I like this quote I saw here:

> The "S" in "IoT" stands for "Security".

</comment><comment><USER10> From another IoT comment [0] that I just posted:

• Develop a standard interface/protocol for integrating IoT devices with the major mobile operating systems:

• Upon unboxing an IoT device and first power-on, require physical contact (via NFC?) with user's primary smartphone/wearable, and register the device with the user's third-party cloud account (e.g. Apple's iCloud/HomeKit).

• Only allow control of the IoT device from the smartphones/wearables that are signed into the user's iCloud/Google/Microsoft/etc. account.

• Web interfaces for IoT control should require two-factor authentication on the user's smartphone/wearable, again like the web interfaces for iCloud/Google/Microsoft accounts.

• Expose a different set of controls based on the user's physical distance from the IoT device, and the level of authentication on the controlling phone/wearable. For example: To unlock your front door you'd have to be standing right there (similar to unlocking a MacBook with the Apple Watch) but you could turn the lights on/off from across the world if you've unlocked your phone and entered your iCloud/Google/Microsoft password – and only from that phone.

• Sharing control with spouses/family could be similar to how Family Sharing for the App Store currently works; set a level of access on each IoT device for each member, and fallback on asking the family "admins" for permission.

No doubt there must be some non-apparent holes in this, but just throwing an idea out there.

[0] [https://news.ycombinator.com/item?id=14077965](https://news.ycombinator.com/item?id=14077965)

<comment><USER11> _" Upon unboxing an IoT device and first power-on, require physical contact (via NFC?) with user's primary smartphone/wearable, and register the device with the user's third-party cloud account (i.e. Apple's iCloud/HomeKit)."_

Sorry, you lost me here. The last thing we need right now is another database of users' personal information. Why every gadget should be attached to my _personal_ phone?

 _" Only allow control of the IoT device from the smartphones/wearables that are signed into the user's iCloud/Google/Microsoft/etc. account."_

No again. It's enough Google owns my phone and email, I don't want it to own my home. What happens when Google's algorithm decides to ban you for no apparent reason (there are plenty of such horror stories around)?

Tl;DR if that's the price to pay for IoT security, I'm resorting back to "dumb" devices or going to live in woods.

<comment><USER10> That is sort of similar to how Apple's Continuity/Handoff/etc. currently works though, isn't it?

Your iDevices, once registered on the same iCloud account, just talk to themselves, without needing to tell or ask Apple anything, other than just checking that you've signed into the same iCloud account.

<comment><USER11> I don't use Apple products, so can't comment on how that works, but Apple is a rare company that owns it all: hardware, software, support, so the hardest part of any solution -- agreement of different parties -- disappears.

</comment></comment></comment></comment><comment><USER12> For consumer devices the solution could be the consumer protection legislation. For example in EU the manufacturers/sellers are responsible for the devices after the sale. The exact time is not defined, but I believe for average consumer electronics 2 years is kind of minimum. During that period the manufacturer is responsible for defects in the products. The responsibility means they need to fix them, provide new (working) gadget or provide financial compensation.

If we would defined that device with a known security vulnerability is broken, the manufacturers/resellers would need to take action. Suddenly there would be direct financial consequences for shipping broken devices for which updates don't exist. I'm sure this would quite quickly lead to manufacturers putting more effort on providing updates and maybe even to proactively preventing security issues.

</comment><comment><USER13> The healthy technology market will force IoT manufacturers to take security seriously. It is not the job of a government to punish a corporation for failing to implement what should now be basic tenets of product quality and suitability.

The loss of customers and reputation should a major security concern arise is a serious market driver and calls for regulation will only ensure that nobody does anything until a multitude of governments agree on a standard. As further food for thought, do you honestly trust the government to make the best choices for your security as a private citizen?

<comment><USER14> I don't buy that argument.

If "customers and reputation" were sufficient, we wouldn't need regulations on the safety of e.g. medical stuff, food and cars. (And history, as well as comparison with other countries, confirms that we do need those.)

Whenever one needs to establish a minimum of quality (and this is what that's ultimatively about), establishing laws mostly works, while trusting the market mostly fails.

Markets are good at many things, but are really bad at establishing a minimum of quality (or provision with basic supplies, for that matter).

</comment></comment><comment><USER15> I know it's kind of a rhetorical question, but I think the answer is obviously: make it cost them _significant_ amounts of money if they do _not_.

So, the question then becomes, how do you make it cost them significant amounts of money?

<comment><USER16> Here's an idea:

There exists an FCC ID for every device that uses the RF spectrum. Similarly, there should be a similar required license for any device/product that operates on the Internet.

The license should be easy to get initially (basic examination by 3rd party). However, once the product is out on the market, if it is shown to be demonstrably broken (insecure), the license is revoked. It now becomes illegal to operate or sell the product as-is (both for user and manufacturer). It now has to be disconnected from the Internet (or the user and manufacturer face a fine).

Devices that are produced in very low quantities will be exempt from this (prototypes, specialty equipment, etc).

This is similar to the mandatory safety checking of a motor vehicle.

A cop pulls you over since your car mirrors are broken? You need to fix them before its legal to drive.

Some one finds out that all models have a fatal life-endangering flaw? It is now both illegal to drive them, and to sell new ones (as-is). Note that in this case, manufacturers will always foot the bill and do a recall.

I get that this is extreme. I don't see how anything else would work, though.

</comment></comment><comment><USER5> I would like some kind of standard for testing that is recognises, in much the same way the FTC tests radio related items for compliance.

Which reminds me that it is not a new issue and a read of few years back raises concerns for IoT and security, by the FTC:

[https://www.ftc.gov/system/files/documents/reports/federal-t...](https://www.ftc.gov/system/files/documents/reports/federal- trade-commission-staff-report-november-2013-workshop-entitled-internet-things- privacy/150127iotrpt.pdf)

</comment><comment><USER17> Bricking devices is unlikely to help; the manufacturer already got his money. Indeed, economics are the fundamental problem - the manufacturer has zero incentives to do anything correctly.

Laws can't solve all problems, but I think they could help.

See "What laws should be created to improve computer security?" \- [https://www.dwheeler.com/essays/law- security.html](https://www.dwheeler.com/essays/law-security.html) \- because I think some could help.

</comment><comment><USER18> The title IMO is clickbait in the way of "discover how ___"; I'd change it to: "Bricking IoT devices gives incentives for better security".

<comment><AUTHOR> I agree. Updated.

</comment></comment><comment><USER19> For what I see, this is a problem for the consumer market on one side and for the small manufacturers on the other. Big industrial players like General Electric, Bosch, Phillips, etc. are deep in this already with their QA protocols and their own software platforms, think of Predix.io. Nothing more than another line or an extension of home / office / factory appliances for them.

</comment><comment><USER20> Here's a much more descriptive/informative article (linked to in the original article): [https://arstechnica.co.uk/security/2017/04/rash-of-in-the- wi...](https://arstechnica.co.uk/security/2017/04/rash-of-in-the-wild-attacks- permanently-destroys-poorly-secured-iot-devices/)

</comment><comment><USER21> Would it be worth an effort if there was an open source protocol of secure communication of IOT devices?

For example, many solutions use MQTT, why not make a secure TCP/UDP one by implementing one of the higher layers in OSI stack?

</comment><comment><USER22> IoT seems hopeless because

\- There are so many different kinds of devices and different hardware

\- Vendors want to maximize profits like everyone else, which entails making new devices all the time, and ending support on the last model fairly quickly (typically within two years,) but consumers regularly keep their devices for more than two years.

\- Hardware vendors historically were not software vendors. For many IoT makers, this is their first real foray into software. The mistakes being made are amateurish, at a level that we saw on PCs in the mid-90s.

\- Although there are some IoT standards, they're mostly concerned with communications, not the operating system. It feels like we're still 5+ years off from something as basic as automatic updates being a given (even just notifying users that an update is available and allowing them to easily install it is a challenge currently.)

Two things that are really bothersome:

\- A huge number of IoT devices don't need the 'I'. They are perfectly capable of serving their purpose without an Internet connection (e.g. over Bluetooth,) but a huge attack surface is added to make you able to configure the device via a central website, or simply to monetize usage data.

\- It is futile to trust each vendor to have the security expertise to lock down every device. An "IoT operating system" would be highly desirable, but there is nothing anywhere near real world implementation, and given the heterogeneous of hardware components it doesn't seem likely something non- Linux-based will come along.

Brickerbot is hostile and aggressive and shouldn't be necessary, but maybe it is. That's beside the point, though: Nobody has to be given permission to brick insecure IoT devices. Vendors don't feel it where it hurts (the bottom line,) and consumers increasingly just don't care (studies show people have grown accustomed to security incidents -- "it happens to everyone and everything; replace it and move on, there's nothing you can do")

Hacks made Microsoft shape up in the 90s and early 2000s, but Windows has only become actually secure since after Vista. Maybe just don't buy IoT devices for another 5-10 years, or at least put them on a separate vlan.

There are a bunch of groups trying to spread the word, but it doesn't seem many vendors are listening (or if they are, they don't have the capability to really secure their devices.) We've had some success with Securing Smart Cities working with local and state governments, and trying to address some of these issues before hilariously insecure IoT hardware becomes ubiquitous in cities/related to critical infrastructure: [http://securingsmartcities.org/](http://securingsmartcities.org/)

It's hard to see how it's not going to get much, much worse before it gets better.

<comment><USER23> >A huge number of IoT devices don't need the 'I'. They are perfectly capable of serving their purpose without an Internet connection (e.g. over Bluetooth,) but a huge attack surface is added to make you able to configure the device via a central website, or simply to monetize usage data.

I always feel the need to disagree with this.

The biggest "value add" in most of my "connected" stuff is the fact that I can access and manage it from outside the home.

Z-Wave light switches are nice, but being able to turn them off when I forgot to after i've left is a huge bonus (and taking it a step further and tracking my and my families phones and turning them all off when nobody is home automatically).

A thermostat I can control when I'm on the couch is a convenience, but a thermostat that notices when I'm at work or the store or a friends house and turns off during that time saves tons of money and energy.

A garage door that I can control from anywhere in my house is normal, but a garage door that I can have ensure it's closed when i'm not home, and that I can open for a friend that showed up to my house 20 minutes before I did is awesome.

I really do think that the "I" in IoT is absolutely necessary (in many cases, not all), but I agree with the rest of your points.

(before people start commenting on the tracking stuff, it's all implemented on a home-server where the phones literally "phone home" to that server, nothing is processed outside the house)

<comment><USER24> All of those are great use-cases. But do you really want each of those devices to be added to the external threat surface? Perhaps it would be better to have everything talk to a central hub over a local protocol (ZigBee, Bluetooth, etc) and then that hub be the main connection out to the Internet at large. As it is now, it's still a bit of a free for all. And at least if you have a hub model where you can secure that one device (or replace it if it is compromised), you don't have to replace all of your individual IoT devices when something bad does happen.

A good example of this is my garage door opener. Instead of building a WiFi connection into the opener itself, there is a separate little gateway device that sits inside my house. The gateway talks to the door (RF) and to the Internet (ethernet). I can still control my garage door, but if something is compromised, I can always detach that gateway and still have a working (secure) garage door.

<comment><USER23> It seems so silly to me to not use the ubiquitous "RF" broadcasting stations already in everyone's house, that also includes an "okay" addressing system, a security firewall, high bandwidth communications protocol, and more.

Why not focus on software which can use WiFi more securely and with a better focus on local connectivity? I can understand the "ultra low power" needs, but many of these devices are mains powered, and that's not really a concern.

But yes, what I do right now for the most part is use z-wave which is connected to a central "hub" which is then connected to the outside world. But IMO that's a hacky-workaround for this problem, not a real solution.

</comment></comment></comment></comment><comment><USER25> easy - educate them.

[http://ardiri.com/blog/utls_defining_lightweight_security_fo...](http://ardiri.com/blog/utls_defining_lightweight_security_for_iot_part_10)

</comment><comment><USER26> By aggressively exploiting insecure devices and maximizing damages to the end customer.

Either IoT market will die because of this or the IoT will become IoST - internet of secure things.

</comment><comment><USER27> Liability. Liability, liability, liability.

</comment><comment><USER28> IoT is going to change the world, so it's great to tackle this issue while it's in a premature stage</comment>


'The Age of Surveillance Capitalism' Review - <AUTHOR> https://www.wsj.com/articles/the-age-of-surveillance-capitalism-review-the-new-big-brother-11547509779 <comment><USER2> The depressing thing about all this is that it is getting harder to opt-out of being surveiled.

Even if you ditch your phone and computers, there are still way to track you.

Just look at some of the crazy stuff happening in retail where facial recognition is used in some stores and malls to track where you go and what you look at in order to manipulate you in to buying more. It may be niche right now, but as the tech develops and gets cheaper it's use will become more widespread.

</comment><comment><USER3> I've commented on their before, but my concern is more with the government having my data than companies. I hate both, but government is worse. Case study China.

Please. I don't care if it's left, right, or center. Next election, support someone who won't turn America into a technologically-enabled police state.

<comment><USER4> > _my concern is more with the government having my data than companies_

If the data exists then companies and governments alike will exploit it regardless of who collected it. Your internet usage, your phone records, even your DNA profile if you used a DNA profiling service can all be accessed at will without your knowledge or consent:

[https://www.purevpn.com/blog/data-retention-laws-by- countrie...](https://www.purevpn.com/blog/data-retention-laws-by-countries/)

In an age when your own data can be weaponized against your best interests I think the only sensible strategy is to minimize your data footprint as much as possible. Do not join "loyalty" programs, do not sign up to surveillance platforms like Facebook, do not submit your DNA to DNA databases, pay in cash whenever possible, etc.

You will inevitably be undermined by other people forking over your data to surveillance platforms but you can only do the best you can and hope to persuade as many people as possible to do similarly.

<comment><USER5> > Do not join "loyalty" programs, do not sign up to surveillance platforms > like Facebook, do not submit your DNA to DNA databases, pay in cash whenever > possible, etc.

I'm doing most of that already but even if you do all of these things, there's still the "friends" problem. The friends who use one of those apps that upload all of their contacts to the central server. The friends who use facebook. The family members who submit DNA to DNA databases. Very likely your friends are similar to you, so they serve as good predictors for your own data. As is for your family members, they usually have very similar DNA to yours :).

E.g. if your friends all live in one certain city, then you likely are to live there as well. If you have a suspiciously high amount of medical doctors in your friend circle, you are most likely one yourself. If 50% of your contacts are LGBT community members, you are likely to be one, too.

The data hoarders of this world don't need you to submit your data yourself in order to have your data.

<comment><USER6> The solution is radical transparency, make all of this transparent, including people in government.

<comment><USER7> Wasn't this the plot of The Circle, by Dave Eggers?

</comment></comment></comment></comment></comment><comment><USER8> I feel like scraping my bank transaction data to be the most violating breach of my privacy (more so than my likes), and yet companies like Plaid are thriving because people are willing to give up access to years of bank transaction history to use apps like Robinhood.

<comment><USER9> For this reason I have been experimenting with going cash only. Its actually not so bad and I can easily give money to those in need on the street.

<comment><USER2> I generally use cash for everything. The exceptions being large purchases or where I need a secondary proof of purchase.

I was once asked by my bank why I wasn't taking advantage of of the convenience my contactless debit card offered. I said because I didn't want them knowing what I spent my money on.

This led on to me being advised that I would struggle to get loan or mortgage facilities because the bank would be unable to see if I was spending my money responsibly.

I can live with that.

</comment></comment></comment><comment><USER10> Earlier work by Shoshana Zuboff, on corporations who see humans as a source of data, not even as customers.

[https://www.faz.net/aktuell/feuilleton/debatten/the- digital-...](https://www.faz.net/aktuell/feuilleton/debatten/the-digital- debate/shoshana-zuboff-secrets-of-surveillance- capitalism-14103616.html?printPagedArticle=true) (2016) & [https://vimeo.com/110222526](https://vimeo.com/110222526) (2014)

 _> While advertisers have been the dominant buyers in the early history of this new kind of marketplace, there is no substantive reason why such markets should be limited to this group. The already visible trend is that any actor with an interest in monetizing probabilistic information about our behavior and/or influencing future behavior can pay to play in a marketplace where the behavioral fortunes of individuals, groups, bodies, and things are told and sold. This is how in our own lifetimes we observe capitalism shifting under our gaze: once profits from products and services, then profits from speculation, and now profits from surveillance._

 _> The bare facts of surveillance capitalism necessarily arouse my indignation because they demean human dignity. The future of this narrative will depend upon the indignant scholars and journalists drawn to this frontier project, indignant elected officials and policy makers who understand that their authority originates in the foundational values of democratic communities, and indignant citizens who act in the knowledge that effectiveness without autonomy is not effective, dependency-induced compliance is no social contract, and freedom from uncertainty is no freedom._

<comment><USER11> > ...influencing future behavior...

This is insightful (to me at least) — the next step after surveillance capitalism is coercion capitalism.

I think the "nothing to hide / nothing to fear" people won't like being coerced. (Also, by their logic, GAFAM should be unafraid of publishing their algorithms — right?)

<comment><USER12> Is that rewards programs, coupons, black friday deals, amazon prime and rebates? I buy something a thrift books and Chase sends me a coupon for abe books. Who knows how much data Chase is selling to whom?

<comment><USER10> Real-time phone location can be purchased for a few hundred dollars.

</comment></comment></comment></comment><comment><USER13> [https://outline.com/6cVy9a](https://outline.com/6cVy9a)

</comment><comment><USER14> I understand the discomfort that comes with having vast corporate entities in possession of private personal information but as a user I'm somewhat confused about not exactly it affects my day to day life, especially since I insist on using adblock on every Internet connected device.

Perhap this book will reveal to me some dangers that I am not currently aware of. I'll try to keep an eye out for it and read it if it can.

<comment><USER15> Let's say you want to change things one day in your country: you get into politics or unionize. Too bad, your opponent has a back-channel access to data about you which could be used against you if made public. Or some law is passed and suddenly some of your old activity is made illegal: you're now on a watchlist, let's hope you can stop your cinnamon addiction.

Let's be more day-to-day: all your data is sold to insurance companies. Where you go, how fast you go, what kind of food you eat, your gym attendance etc.

<comment><USER14> That's a hypothetical situation, we could talk about those all day. And history shows us the government doesn't really need access to my browsing history to oppress me if that's what they want to do.

Re: insurance: Is that happening right now? I am not aware of any reports that indicate that is currently occurring.

</comment></comment></comment><comment><USER16> Technical solutions at scale to combat this is to poison the well with the aim for actors to spend more and more of their resources on separating signal from noise.

</comment><comment><USER17> There's no surveillance capitalism.

In capitalism you have property rights. That being so, your private information can be protected and hence "capitalized" upon (pun intended) by the owner because in free market you would be able to sell it (should you want to do that) at a price that makes you willing to share your info.

So what we have is rather fascism, or extreme statism. And it's more prevalent in countries where the government controls more GDP (so, socialist-like countries).

<comment><USER18> socialism != fascism

they're completely opposite on the spectrum. socialism is people's democratic ownership of property and government.

<comment><USER19> Going into semantics! Has there even been a 'true socialism' by your definition?

<comment><USER20> Would you be saying the same thing if someone said North Korea was democratic and then dismiss any arguments that it isn't democratic as 'semantics'? Simplistic generalizations on complex, broad, and especially controversial topics pretty much always results in ignorance based conclusions.

</comment></comment></comment></comment><comment><USER21> _The Age of Surveillance Capitalism_ is going to be a seminal book. I am looking forward to receiving my personal copy tomorrow (release is January 15).

<comment><USER22> What is the significance of this book? I'm not familiar with the author.

<comment><USER23> This entire HN post is a share of a review of the book by Shoshana Zuboff: The Age of Surveillance Capitalism Published 01.15.2019</comment></comment></comment>


Android's Back Button - Tim Bray - <AUTHOR> http://www.tbray.org/ongoing/When/201x/2011/11/03/The-Back-Button

<comment><USER2> No one complains about the back button just because they don't want a way to back out of a page/action/whatever. They complain because the back button is too often unintuitive. It's never "Ugh, I hate it when the back button does precisely what I expect."

If you're going to compare to the web browser, you have to acknowledge how utterly obnoxious it is when some rogue site breaks the back button. Except then you can at least click-and-hold (or equivalent) on the back button to get a drop-down with more history so you can hopefully back out of whatever crappy site you opened.

</comment><comment><USER3> Absolutely agree. Whenever I'm using an iPhone, I find myself trying to find the back button, but in many apps, and in many places on the iPhone, there just isn't one.

</comment><comment><USER4> I love the back button. It takes a little getting used to, but it's definitely one of my favorite features in Android now. I really can't imagine not having it.</comment>


One Millionth Tower, an interactive documentary in HTML5 - <AUTHOR> http://www.wired.com/underwire/2011/11/one-millionth-tower/

<comment><AUTHOR> For those trying to use the arrow keys to walk around the 3D environment, and finding their browser window tries to scroll instead, WASD seems to also better for me on Chrome.</comment>


Ask HN: How good is your article online reading experience? - <AUTHOR> <comment><USER2> I use adblockers and block all social media sharing widgets, so mine's pretty much perfect.</comment>


Ask HN: Rate my Startup - Office Trail Mix Dispenser? - <AUTHOR>

http://www.wyldsson.com/product/dispenser/
I developed this trail mix dispenser for the Irish Rugby team (the photo is from their team room at their training camp last weekend). In the evenings when they're chilling out, they take a little cup of trail mix instead of a bar, as its a much healthier snack.
Question: Would YOU like one of these in your office? (Think of it as a water fountain for trail mix) I'm thinking of promoting it to "progressive" firms, who already provide free snacks etc.
Any thoughts would be really welcomed!
PS: Will be exhibiting it at Web Summit - see you there! <comment><USER2> I looked all over and couldn't find an ingredients list for any of the products. (The "ingredients" page seems to have just an unsorted list of ingredients used in your entire product line.) I also can't find where to buy the refill packs, so I have no idea what varieties are available or what's in them. Based on just the pictures, I probably wouldn't eat any of them since they all have dried fruit, which is very sugary / high-GI. You mention GI in your nutritional FAQ so it seems a bit odd.

<comment><AUTHOR> Thanks for checking it out! Yeah, I haven't listed the refill packs yet. Good question about GI... nuts and seeds are very low-gi, so when mixed with dried fruit the mixture as a whole is low-gi as the dried fruit is only a small %. I should really make that clearer. Thanks for your comments - I'll get on to it!</comment></comment>


A Primer on Bézier Curves – B-Splines - <AUTHOR> http://pomax.github.io/bezierinfo/#bsplines <comment><USER3> Looks like an excellent resource! I had not seen this before, bookmarking it now.

Bezier curves are immensely useful in graphics, animation and pretty much everywhere you need interpolation. But to get the most out of them, you need to know the tricks to manipulate them, e.g. subdivision and calculation of derivatives.

Nice to see a really thorough resource on one of my favorite methods.

</comment><comment><USER4> Related: There's a Unity3D video on Bezier splines/curves [0] - it's far more noob than this article, and very good at explaining b-splines from the basics up. It certainly doesn't have the depth of this article (neither the maths nor more advanced spline stuff), but some of it is 'practical' (if you have Unity) and it might make a good primer for those getting started on the subject.

The actual Bezier stuff starts 15-16 mins in.

[0] [https://www.youtube.com/watch?v=o9RK6O2kOKo](https://www.youtube.com/watch?v=o9RK6O2kOKo)

<comment><AUTHOR> More education is always more better. Good link!

</comment></comment><comment><USER5> The degree `n` B-spline basis function can be obtained (up to scale and location) by the `n`-fold convolution of the indicator function on [0,1]. It is also, therefore, the pdf for the sum of `n` uniform random variables, i.e., the Irwin-Hall distribution [1].

I have no idea if these facts are useful, but I've always found them interesting.

[1]: [https://en.wikipedia.org/wiki/Irwin%E2%80%93Hall_distributio...](https://en.wikipedia.org/wiki/Irwin%E2%80%93Hall_distribution)

<comment><AUTHOR> interesting counts just as much as useful! I shall dig into this myself.

</comment></comment><comment><USER6> It's the way my brain works for sure, but dense material is always harder for me to get through when it looks dense and is laid out densely. My brain instantly puts up a hurdle and makes assumptions about the material.

That said, it seems like the entire mathematics and scientific community disagrees with me :)

</comment><comment><USER7> I would have liked it to be more mathy, the "it seems complicated but it actually is" followed by an approximate explanation is confusing, and the math looks like a bit hidden inside the main explanation.

<comment><AUTHOR> For more detailed maths, wikipedia and actual B-spline articles are your content of choice. Doing a full analysis of B-splines is out of scope as a section in a Primer on Bezier curves (as noted in the text, I'd have to write a separate primer on B-splines instead), so the maths is not _as_ detailed, and the implementation focuses on code in use by several libraries (like the JavaScript "bspline.js" or C "tinyspline" libraries).

One note about it being an approximate explanation: it's not, B-Spline maths can analysed (like Bezier maths) either using calculus, using geometry, or using algorithm operations, all three being different ways to work out exactly the same thing. The explanation in this primer only covers the algorithmic approach of computing the B-spline function as iterative interpolation, but is functionally equivalent to a more "mathy" approach involving lots of calculus. Doing so does not give you the information you'd get from symbolic maths to aid in things like finding normals, tangents, extremities and inflection points, etc. etc. but for the scope of the section, and given the article it's part of, that's intentional.

</comment></comment><comment><USER8> I've got this one and a few more resources here:

[https://github.com/melling/ComputerGraphics/blob/master/bezi...](https://github.com/melling/ComputerGraphics/blob/master/bezier.org)

</comment><comment><USER9> NURBS!

<comment><USER10> One of my favorite acronyms: Non-Uniform Rational B-Spline. They were very popular in 3D modeling packages like Lightwave years ago.

Are they still used frequently in 3D modeling?

<comment><USER11> >They were very popular in 3D modeling packages like Lightwave years ago.

Actually I can't recall Lightwave ever having NURBS, it was all polygon/subdivision surfaces.

Maya has NURBS, and there is NURBS oriented software like Rhino3d, Blender also has rudimentary NURBS support.

>Are they still used frequently in 3D modeling?

I believe it's still the standard for anything requiring precision: computer aided manufacturing/design (CAM, CAD).

<comment><USER12> Almost all CAD/CAM these days runs on top of the Parasolid geometry kernel. While Parasolid does have b-spline support, it's mostly truely mathematically modeled geometry that is then converted to a poly mesh for rendering - <USER2> internally it's all "full precision". It's actually closer to how something like POV-Ray models, rather than NURBS.

</comment></comment></comment></comment><comment><USER13> Dupe: [https://hn.algolia.com/?query=%22A%20Primer%20on%20B%C3%A9zi...](https://hn.algolia.com/?query=%22A%20Primer%20on%20B%C3%A9zier%20Curves%22&sort=byDate&prefix&page=0&dateRange=all&type=story)

<comment><AUTHOR> No, it really wasn't, you changed the link and title I posted to a completely different thing by removing the hash for the B-Spline section that I finally finished adding to the primer about 10 minutes before posting the link, after having been in request for about 2 years, weeks of research, and days of writing/programming.

The link was very specifically to [https://pomax.github.io/bezierinfo/#bsplines](https://pomax.github.io/bezierinfo/#bsplines), and the title specifically mentioned the fact that it was about B-Splines, not the base article (because the base article is nearly 70 print pages worth of content, and the point was to link straight to the spline section near the end instead of linking people to an article that's been on HN before several times, but never with this new content, because it didn't exist any of the previous times).

A lot of people had requested it, and it was worth calling out on its own, specifically. Instead, by marking it a dupe and _rewriting_ the link, you completely wasted the effort of posting it because no one will have any idea the last section is even there. Certainly, some people will have never seen the entire site, but fragment identifiers in URLs are there for a reason. Don't strip them out unless you can show the content people get is the same whether they click on the link with or without the hash. Which for this URL was absolutely not the case.

So: can you please change this back, the link you rewrote it to is not useful for the purposes of why this was posted to HN, and the title you picked doesn't even make sense. This is a link to today's Primer, in 2016, not some historical tiny document from 2011, which the Primer was five years ago when I had only just started it.

<comment><USER13> Oh, I see. FWIW, I'm not an admin though. However, I sent them an e-mail asking them to revert the changes.

Also, from on HN user to another: Thank you for submitting high-quality links to the site. That's what makes this site so awesome. Cheers!

<comment><AUTHOR> ah, I see! cheers!

</comment></comment></comment></comment><comment><USER14> Nerd Love.

</comment><comment><USER15> _If you have JavaScript disabled, you 'll have to enable it, as this book heavily relies on JS rendering, both for the base content (it's been written as a React application) and all the interactive graphics, which rely on JS not just for the user interaction but also for the live-drawing (none of the graphics in this book are flat images, they're all live-rendered)._

I wouldn't call that a book, but rather an interactive article. I consider a book something I can save as a PDF, print out, and read without using a computer.

<comment><USER16> I'd like to call this sort of thing a dynabook, though unfortunately that's taken for a kind of laptop.

<comment><AUTHOR> Yeah I typically go with "online article", I think the only place I call it a book is literally in that JS notice, to highlight that we're talking about a lot of content (roughly 70 print pages worth) instead of the more usual "several pages max" that people think of when you use the word article.</comment></comment></comment>