Car hack uses digital-radio broadcasts to seize control - <AUTHOR> http://www.bbc.com/news/technology-33622298 <comment><USER2> see also: [https://news.ycombinator.com/item?id=9921557](https://news.ycombinator.com/item?id=9921557)

</comment><comment><USER3> There's something very wrong when you can control the _brakes_ of the vehicle via hacking the infotainment system... :(

<comment><USER4> And the problem is that we're going to blame the hackers, rather than the car manufacturer for creating such a defective product.

<comment><USER5> I think this is the heart of the argument.

Personally, I find it astonishing that the manufacturer hasn't caught this.

Here's my (probably) unpopular opinion: In the very near future, you might have to become 'certified' as a programmer for anything that touches the internet _EDIT: AND has the possibility of killing someone._ Much in the same way that a regular Joe can't build a bridge over a river without a few Civil Engineering certifications, a programmer can't make an internet-connected program that touches the internet and also controls a 2 ton moving vehicle.

There are rookie mistakes, and there are systematic failures; a LOT of these recent issues seem to be systematic in nature. The easiest fix in that case is to fix the system.

<comment><USER6> Is is possible the manufacturer is aware.

When Ford released the Pinto, they determined the cost of simply paying out potential lawsuits for driver deaths would be less than the cost of actually fixing the cars' tendency to explode when rear-ended, so they just let people die until the numbers balanced out[0].

Granted, that was a hardware issue and not a software issue, but if the risk of a class-action lawsuit is involved, and that risk is magnified by a recall or public awareness of the problem, then the motivation may be the same.

>In the very near future, you might have to become 'certified' as a programmer for anything that touches the internet.

I think a better option would be to mandate that certain things can't touch the internet. It would be absurd if I, someone who writes PHP/SQL and C# crud apps for a living, had to be certified as a systems programmer (or the other way around.)

The problem to me is the insidious way we as a society have sort of collectively accepted that connecting things to the internet is inevitable and always a good idea. Instead of making sure the engineers who connect the car's brakes and steering to the internet through the radio are competent, how about _not making that decision to begin with?_

[0][http://www.motherjones.com/politics/1977/09/pinto- madness](http://www.motherjones.com/politics/1977/09/pinto-madness)

<comment><USER7> The Pinto analogy is dangerous. The flaw in the Pinto was that when it got into a certain, common type of collision there was a higher-then-normal chance that its fuel tank might explode.

The risk was NOT that because of this vulnerability, there was a chance that bad guys might go around ramming into Pintos to make them explode. Who would even _do_ that? Or maybe that if you rammed a knitting needle into the back of a Pinto it would trigger a fuel leak. Well so what? Probably similar issues exist in any number of cars, but it's not something people would actually _do_ (and if they did it would obviously be criminal), so... that's not really an engineering flaw.

So the insecurity of infotainment systems in cars is NOT like the Pinto issue. Nobody is suggesting that when the infotainment system plays a Mariah Carey song it will, because of a bug, shut off the brakes. Or that during a common kind of collision, the infotainment system causes the airbags to fail to fire. No, this is only a risk if someone actively attacks the infotainment system and deliberately shuts off the brakes, or triggers an acceleration, or whatever.

There are already ways to physically sabotage a car to make it dangerous to drive - cut the brake lines, puncture the fuel tank, whatever. Those are, to a certain way of thinking, security vulnerabilities. If you're someone who is concerned about people trying to kill you, you probably take extra precautions to secure your car to mitigate those risks. Ordinary people just park their car on the street and assume assholes are not going to trigger a slow leak in their brake fluid.

So why should ordinary people be concerned that someone might install a trojan in their infotainment system which is going to shut off their brakes on the highway?

<comment><USER6> The chance may be low, but I think people should be concerned because it exists at all. It doesn't _have_ to be possible to install a trojan that shuts off a car's brakes on the highway - that possibility is the result of engineering choices and compromises which could have, and still could, be avoided. It doesn't have to be an acceptable level of risk for drivers to take on themselves, either. That there's little chance of someone taking advantage of it is irrelevant.

<comment><USER7> My point is that we're used to thinking of computer security as being an absolute necessity because, for example, it is of value to a bad guy to simply take control of a network-connected computer to become part of a botnet. Or to use it to obtain valuable personal data which passes through the computer. But I think that leads us to overestimate the risk created by the possibility that hacker activity could extend to the physical realm, because if a hacker crosses that line, it has _consequences_.

My car's infotainment system doesn't know my credit card number. It probably makes a pretty poor botnet member (but even if someone does hack it and turn it to churning out spam they're not going to be trying to get to the CAN bus). And there's little value to a badguy in just breaking my car for no reason. If someone just wants to break cars and hurt people, they can go throw rocks off an overpass. People do do that, admittedly, but they're not revealing an engineering flaw in cars by doing so.

If you can use this hack to pop the door locks and override the ignition, then maybe we should be talking.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> All these reports really makes you wonder if there was foul play in Michael Hastings accident.

[https://en.m.wikipedia.org/wiki/Michael_Hastings_(journalist...](https://en.m.wikipedia.org/wiki/Michael_Hastings_\(journalist\))

<comment><USER5> > Former U.S. National Coordinator for Security, Infrastructure Protection, > and Counter-terrorism Richard A. Clarke said that what is known about the > crash is "consistent with a car cyber attack".

Holy moly.

<comment><USER9> He is circumspect in his full comments, in context the text quoted in Wikipedia is not a positive statement that it was a cyber attack.

[http://www.huffingtonpost.com/2013/06/24/michael-hastings- ca...](http://www.huffingtonpost.com/2013/06/24/michael-hastings-car- hacked_n_3492339.html)

</comment></comment></comment><comment><USER10> Sadly, accidents are probably going to happen before infotainment gets decoupled from CAN bus. You don't just need a firewall, those need to be on physically separate networks.

<comment><USER9> I don't think there will ever be a recall to separate them in shipped vehicles.

<comment><USER11> No. It's de facto impossible. If all I had to worry about was the software alone I would despair of ever correcting this in a reasonable period of time; to also have to overcome fundamental hardware challenges? Not a chance.

For a long time I've wondered what would prove to be Security-Pocalypse that finally convinces everybody that this is a real problem. This is not yet it. But if somebody takes one of these attacks and gets... "creative"... in those ways that aren't really that hard to come up with but I hate to actually spell out online (it's scary to think too hard about this... there's no possible way these vulns could be closed before a bad actor could... be very bad...)... _that_ could become the moment the 21st century finally realized that secure code is no longer optional.

That will be one hell of a shakeup.

<comment><USER10> It is scary to think about because automated exploits could perhaps be scaled up and cause real mayhem. Hopefully it doesn't have to get that far before some elementary redesign of network architecture inside of vehicles. It's not rocket science. Just separate the safety critical network (which include brakes, steering, etc) from the non critical information and entertainment network.

</comment></comment></comment></comment><comment><USER12> The auto industry will very quickly have to learn from the aviation industry in terms of integrating all these diverse information systems safely and securely. One difference is that cars are way more accessible than planes to be tampered with and hence the security systems will most likely have to be seriously hardened.

EDIT: please take "integrate" to mean to properly place each system on its own space and then surface the necessary APIs in a secure fashion. Of course physical separation of entertainment and car systems is the logical step, and it comes from the aviation industry.

<comment><USER13> No NO No NO NO!

There is no justifiable reason for these things to be integrated _at all_. Yes, it saves the mfr some $$, but people can DIE because of this stupidity.

As recent events have shown, the aviation industry hasn't integrated these systems securely - they're just harder to get to so it took a while before people started discovering their flaws - [http://www.cnn.com/2015/05/17/us/fbi-hacker-flight- computer-...](http://www.cnn.com/2015/05/17/us/fbi-hacker-flight-computer- systems/)

Secure integration is not possible - the only right way for companies as inept as legacy auto makers to do this is for the systems to be separated.

</comment></comment><comment><USER14> I see.

"NCC's work - which has been restricted to its labs..."

"Mr Davis said he had simulated his DAB-based attack only on equipment in his company's buildings..."

"But he added that he had previously compromised a real vehicle's automatic- braking system ... by modifying an infotainment system, and _he believed_ this _could be_ replicated via a DAB broadcast."

So basically this is one of those non-stories where a researcher looking for some press coverage broadcasts a custom radio station with a name like 'LOL I HAKD UR CAR', then shows it - in an office - to a zero-knowledge reporter who is immediately impressed as if it was a demonstration of anything at all. Whereas actually it's just some bloke in an office saying "well I'm sure this is possible, I've never done it, obviously."

I'm reminded of the words of Travis Goodspeed... Proof Of Concept or GTFO.

</comment><comment><USER15> I'm tired of articles that explain absolutely nothing about the actual methodology of the hack.

Does Jeep Cherokee have separate buses for high-speed controller and low-speed infotainment CAN? (That's the usual setup.) What controller acts as the gateway between them? Is it read-write (which would be incredibly dumb) or did they actually hack that controller after hacking infotainment?

I had shown similar articles/research papers to my friends working in automotive. They pointed out several factual mistakes and said it's generic fluff with no meaningful technical details. (See the questions above.)

If realistically exploitable, these vulnerabilities are serious stuff. Hackers/journalists need to get their shit together and communicate these findings in an appropriate way. 99.9% of automotive engineers do not go to Black Hat conference.

<comment><USER16> See the wired article.

<comment><USER15> I saw it. It doesn't answer any of the questions above. The fact that they were able to hack an infotainment system connected to the internet is not surprising. Anyone who knows how those things are written sort of assumed that this was possible.

The noteworthy part of this is being able to bridge the gap between the two CAN networks, and it's not explained in any way.

<comment><USER17> The thing is that your questions aren't really very applicable. For example if there is a high speed and low speed CAN bus or just one really does not matter cause of details about how it works. Also that applies to the question about read/write/modify - that's not really how CAN bus works at all, it's more like commands and there are some nifty ways to filter, like codes needed. For yesterday's article it boils down to modules not doing careful enough verification and likely a really boneheaded in hindsight mistake in the Uconnect software. The talks will be great resources for a lot of people, I'm eagerly awaiting them.

<comment><USER15> _For example if there is a high speed and low speed CAN bus or just one really does not matter cause of details about how it works._

It matters a lot. Typically, there is a gateway (in body or chassis controller) between the two (or three) buses. It puts some messages from the controller bus onto infotainment bus, but not the other way around. It's done specifically to prevent infotainment systems interfering with workings of the car.

If Jeep has everything running on the same bus, it's incredibly stupid.

<comment><USER17> That is a bit over simplified. In practice more is passed, but for example the ECU ignores based on rules like RPM above X, TCM not in P, and so on. There is pressure to move to a single high speed bus and modules that pass messages based on priority and time.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> > The UK's Society of Motor Manufacturers and Traders has responded by saying > that car companies "invest billions of pounds to keep vehicles secure as > possible".

Well they haven't done a particularly good job.

Anyone else spooked that this has come out of a security company based in Cheltenham (where GCHQ is...)?

<comment><USER18> >invest billions of pounds to keep vehicles secure as possible

ORLY? Can I ask them to point me to billions of expenditures done to ensure security that had no other purpose. Unless they are talking physical security like crash safety, I don't think they have spent billions they would've otherwise saved by not developing secure systems in the cars.

</comment></comment><comment><USER19> The article talks about taking control of a Jeep Cherokee yet the captions shows a Jeep Grand Cherokee.

Does anyone know if the exploit is across the whole line with U-Connect? I plan on purchasing a Grand Cherokee but I may wait and see how this plays out (or get an older model).

<comment><USER5> If it's related to the article from the other day, then yes;

It appears that they're gaining access via UConnect, which is connected to TMobile's cell phone network. Allegedly, this exploit makes it vulnerable from anywhere that the vehicle would have TMobile cell coverage.

<comment><USER9> Sprint!

(It is mentioned in the terms: [http://www.driveuconnect.com/terms/](http://www.driveuconnect.com/terms/) )

</comment></comment></comment><comment><USER20> Agreed with one of the comments, why do articles like this never share any sorts of details about the hack? Is this not a responsible disclosure / patched?</comment>


Go Away PayPal - <AUTHOR> http://yellloh.com/posts/go-away-paypal <comment><USER2> I am impressed with PayPal's ability to be aggressively clueless in this regard.

For at least two years, they have beens sending me "monthly statements". Which a) don't contain any information, and b) are idiotic, because a monthly statement is an artifact of a paper-based world, not something that Paypal needs. There is no way to get off this mailing list, and if you try replying, it just bounces.

And EVERY TIME I USE PAYPAL they try to get me to sign up for "Bill Me Later TM". I have to say no each time. I've made something like 200 transactions in the last 5 years, and after 200 refusals they're still like, "Hey, how about this new thing called "Bill Me Later TM"!

I'm sure both of these techniques boost some short-term metric, but they guarantee that when I have another option, I use it. And I'm not alone. The other day while watching a user test, the subject spontaneously offered a colorful negative opinion, and said they used PayPal only when there was no other choice.

Building up user resentment like this means that they are very vulnerable to a competitor. One day somebody like Square is going to cross the good-enough threshold and the use-it-when-forced crowd will leave and never, ever return.

<comment><USER3> I agree that paypal's automated communication is bunk, but I don't know if monthly statements are artifacts of the paper world.

Anything where I have a regular bill due every month, I'm going to appreciate a monthly statement -- probably an electronic one of some kind. Right?

You know my favorite monthly statement? Every month I get an SMS message from AT&T "A $XX.yy bill is due. Reply with '1' to pay from credit card ending NNNN." WOOT! THAT's a monthly statement for the modern world.

But really, any business I have an ongoing relationship with them where i periodically need to pay them, I'm going to appreciate a monthly update on what I owe them, sometimes over email. (I'm not going to appreciate a poorly done marketting brochure for things I don't want disguised as a monthly statement)

<comment><USER4> I think the parent's point is that you can (and should) get your "monthly" statement anytime you want, for any time period you want, on demand, by going to <bank>'s website.

Monthly bank statements (which I think the parent is specifically talking about) are different from monthly bills in that statements don't require you to take action.

</comment></comment></comment><comment><USER5> Like the one I received from British Telecom a few years back that went something like...

We noticed that in the past you opted not to receive marketing emails from us, but we're contacting you now to confirm whether this is still the case because we'd hate to think you're missing out on the following type of offers when you really wanted to see them...

[Insert unwanted marketing crap here]

<comment><USER6> In Australia they passed legislation to prevent banks from offering unsolicited credit increases. Now I regularly receive mail saying "We're not allowed to offer you credit increases unless you ask us to. Do you want to opt in?" What a joke.

</comment></comment><comment><USER7> TL;DR: OP received marketing email from Paypal and is angry

<comment><USER2> It goes deeper than that. He's specifically angry at the high bullshit level in the email, and has some reasonable speculation as to why PayPal is doing something harmful to their brand.

Marketing isn't synonymous with jerkiness. Google, for example, had a great touch with marketing for many years. AWS still does. In both cases I mainly heard from them when they had created something new and probably valuable to me personally.

Here, though, PayPal isn't sending these emails because they are creating value for you. They're sending them because they're using you to generate income. You aren't the customer; you're the veal cow, the foie gras goose.

<comment><USER8> Some context I didn't know before:

> The production of foie gras (the liver of a duck or a goose that has been > specially fattened) involves the controversial force-feeding of birds with > more food than they would eat in the wild, and more than they would > voluntarily eat domestically. The feed, usually corn boiled with fat (to > facilitate ingestion), deposits large amounts of fat in the liver, thereby > producing the buttery consistency sought by some gastronomes.

Animal welfare controversy aside, I would imagine this suggests they are prematurely exploiting their user base in a non-sustainable manner. If only the customers (I assume the shareholders are their customers?) would care that this tarnishes the brand in the long run.

Please correct me if I am wrong.

[0]: [https://en.wikipedia.org/wiki/Foie_gras_controversy](https://en.wikipedia.org/wiki/Foie_gras_controversy)

<comment><USER2> Sure, and I think customers care. This customer clearly cared.

But suppose some customers don't currently care about you doing something manipulative or exploitative to them. Is that a sign you should keep going?

I say no. That not everybody has yet wised up to your exploitation isn't a sign that you're safe. The fundamental basis of commerce is a positive-sum creation of value for both parties. Whenever a company drifts away from that, they're skating on thin ice, and they will eventually fall in.

</comment></comment></comment></comment><comment><USER9> It's not clear in the article - is PayPal gaming the "Important Inbox" feature of Gmail by making fake important-reading "Balance Summaries"?

<comment><USER10> What a shock!

When Gmail introduced a feature to reduce spam and spam-like email in your Inbox, the people sending that spam will adapt and try to game it. More news at eleven.

Did anyone seriously believe this would be a viable long term solution?

<comment><USER2> The shock expressed isn't about Gmail; it's Paypal. Bottom-feeding behavior from Viagra spammers is expected. But from valuable tech brands it's a sign of dangerous rot.

</comment></comment></comment><comment><USER11> I closed my paypal account last week due to receiving "transaction summary alerts" when I had no transactions. It seemed the only way to unsubscribe was to not be alerted of any real transactions.

Spammy behaviour -> lost customer. If enough people walk with their feet, their analytics should quickly give them the message.

</comment><comment><USER12> Between all the phishing and the spam, I filter out all email from PayPal. Realistically they might send me something important someday and I'll miss it, and that's unfortunate... but I was developing such a habit of ignoring paypal-related emails anyways that automating the ignoring changes nothing.

</comment><comment><USER13> Today fucking paypal suspended our account because there was 2500 euros income from one of our clients...

</comment><comment><USER14> Two and a half options:

1\. Click the unsubscribe link

2\. Click the spam button

2.5. Sue them if they're breaking any local anti-spam laws. It's quite obvious that the spirit of the email wasn't to deliver account information if it was otherwise laden with promotional content. Chances are any judge or magistrate would look right through the account update BS to see the true nature of the content.

<comment><USER15> Violence is not an appropriate response. The first two are sufficient.

<comment><USER14> I'm not sure what you mean. Suing someone isn't an act of violence.

<comment><USER15> What do you imagine the state uses to compel obedience to its laws, if not threats of violence? Sometimes that violence might be appropriate, but some firm sending you an unwanted email falls short of the mark.

<comment><USER14> Australia doesn't use crowbars or fists to remedy wrongdoings, therefore it's not an act of violence. If the punishment for sending bulk unsolicited commercial mail were canings, it'd be violence, but this isn't how civilized countries operate.

<comment><USER15> Of course it uses violence; try declining the "non-violent" penalties. Even criminals don't immediately resort to physical violence, but you still know precisely why you should hand over your wallet.

<comment><USER14> Show me an instance where a modern Australian court has ordered corporal punishment and I'll agree with you.

<comment><USER16> With respect, I think attagart has a valid point.

Violence can also be confining someone to a jail cell, or confiscating (taking without voluntary consent) some or all of their property (e.g., imposing a fine on a person)

Your modern Australian courts must do this, to compel compliance with their decisions.

<comment><USER2> Not really.

If you lose a lawsuit and fail to pay, then they just come and take your money and/or your possessions. If you attack the sheriff's deputies carting off your stuff, or assault the bank manager for having given away "your" money, then yeah, you are in for a world of hurt.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Well, the only mails I get from paypal are the ones confirming my transactions ... Never got any ads

<comment><USER18> Same here. I must have unsubscribed.

</comment></comment><comment><USER19> I never realised this was their marketing tools. I was wondering why they were normally sent at totally random times.

Time to unsubscribe / put to spam folder methinks.

</comment><comment><USER20> So is this really just another rant about PayPal - which would be hardly unique or unusual.

Or....

Is this just a ploy to get yet another stupid social media site some visibility traction on HN?

Hmmmmmmm?

</comment><comment><USER21> I got something similar. Had to triple check that it was actually from Paypal because it was so clearly spam

</comment><comment><USER22> PayPal has figured out how to fool the new Gmail inbox. Others will follow suit.

</comment><comment><USER23> Going through HN effect.

</comment><comment><USER24> [http://webcache.googleusercontent.com/search?q=cache:http://...](http://webcache.googleusercontent.com/search?q=cache:http://yellloh.com/posts/go- away-paypal)

<comment><USER25> Even the google cache doesn't load here.

<comment><USER26> Click on the "Plain text version". Google's cache has a really bizarre flaw where it still loads certain assets from the original site and if they block the rendering, things still don't appear.

<comment><USER27> hey guys, our servers are being pounded like a punching bag. dust is everywhere, fighting through the dust to press green button on larger servers. eyes hurt.. talk soon..

</comment></comment></comment></comment><comment><USER28> Didn't know anyone could try this hard to get a post on HN.

<comment><USER14> You could have said anything. Why this?</comment></comment>


"We are now encrypting over 100M domains" - <AUTHOR> https://twitter.com/letsencrypt/status/1022227355790499841 <comment><USER2> I wonder how many of these are due to chrome 68 showing http sites as not secure.

<comment><USER3> It's probably more the other way around: the Chrome team only felt confident to show a "not secure" indicator, because so many domains are HTTPS now, and there is a good free option to get TLS certificates.

</comment></comment><comment><USER4> This is phenomenal achievement in what used to be a vulture-like lucrative fees industry. THANK YOU!

I really just hope we get a letsencrypt equivalent for health insurance that is a "no-nonsense, gets the the job done" company.</comment>


Ask HN: Is a Biological Compiler feasible? - <AUTHOR> I keep hearing people say it would be super useful to have a design environment for biology, where the output is either a genetic circuit or some other implementable design, but I never really see anything that comes close. Cello and the folks behind Asimov are an interesting attempt, but I'm thinking more along the lines of Michael Levin's talk. Does anything like that exist? <comment><USER2> ICYMI, iGEM organization's overall goal and the projects that are carried out as part of the annual competitions are highly related to this topic: [http://igem.org/Main_Page](http://igem.org/Main_Page)

In general, it is hard to find a biological system that will give you a reliable and generic compiler framework (a la LVM) unless you better scope your problem and/or goal; but there are small problems for which we have nice implementations/solutions (a la software design patterns). The challenging part is to mix and match parts that will help you solve specific problems.

So the answer really depends on what you want to do with such a system and what parts of the already available solutions that you don't like.

</comment><comment><USER3> Thanks for mentioning Asimov. Had not seen this before, and it looks quite promising ;)

One could argue that BioCAD style automation adhering to optimized DNA construction protocols is the only way to do synthetic biology assembly properly.

Automated-design tools that are changing synthetic biology

[https://www.nature.com/articles/d41586-018-07662-w](https://www.nature.com/articles/d41586-018-07662-w)

</comment><comment><USER4> You may find the film eXistenZ interesting. Basically a biological version of the Matrix.

[https://en.wikipedia.org/wiki/Existenz](https://en.wikipedia.org/wiki/Existenz)

</comment><comment><USER5> i think those are called enzymes</comment>


Cloud Recording WebRTC to S3 - <AUTHOR> http://www.sightcall.com/cloud-recording-webrtc-to-s3/

<comment><USER2> recording in the cloud!</comment>


Multiple Black Vehicles with MD License Plates at Apple Executive Briefing Center - <AUTHOR> Sources on the scene are reporting multiple black Lincoln town cars and Escalades with Maryland license plates spotted at Apple Executive Briefing Center. <comment><USER2> Does the government really waste our tax dollars on Escalades? I can't imagine why they'd need such a behemoth, but even if they do, why not settle for a Chevy Tahoe instead? Functionally the same car, $25K cheaper.

<comment><USER3> Rest assured, the gov is not paying anywhere near MSRP for its fleet vehicles.

<comment><USER4> Even getting them at "cost" is roughly just as wasteful.

<comment><USER5> They're good tools. I'm okay with that.

<comment><USER2> Are they better tools than are Chevy Tahoes?

</comment></comment></comment></comment></comment><comment><AUTHOR> Sources at Apple are reporting multiple Black Vehicles with MD License Plates at Apple Executive Briefing Center this AM. Multiple CHP escorts. Men with ear pieces and sun glasses. Rumor is MD license plate indicates NSA involvement. If anyone at Apple can confirm please let us know.

<comment><USER6> CHP=California Highway Patrol?

<comment><AUTHOR> Yes, that's my understanding. Deeply disturbing news IMHO.

<comment><USER7> Why? Just means a VIP is visiting Apple and that is their detail. Might be the Biden, John Kerry, DHS Chief, or others.

Sure there's a certain intimidation factor when a VIP comes to visit with a huge security detail, but ultimately if the US Government REALLY wanted to threaten Apple they would use pieces of paper to do so (e.g. court orders, sanctions, national security letters, or w/e).

<comment><AUTHOR> Also the motorcade was there for a very short period of time...under an hour. Usually VIP visits involve meet-and-greets, etc... Maybe they were delivering an NSL as you hinted at?

<comment><USER8> Another theory would be that they were delivering the device for Apple to crack on their premises. This is based on the assumption that Apple could crack it (given as has been stated elsewhere that it is an older device without the secure enclave) but that they refused to hand the tools to do so over, and wanted to perform the crack themselves and the FBI, given the choice between a lengthy legal battle and getting the information on the device quickly, have given in to Apple.

In which case either the device was unlock very quickly or if there's an equally short visit some time later, it's the FBI picking up the device again.

</comment></comment></comment></comment></comment></comment><comment><USER9> Huh. I saw a police escorted (and I mean, they cleared the street of other vehicles and pedestrians and moved alone escorted) line of cars (black sedans, black SUVs, black vans) heading south on 6th in SF today at ~9:55 am. Still curious what it was/is.

There a good video someone captured of it on Twitter[1]. Though her post is timestamped at 4:36pm, and the weather kinda looks more like it did at around 4.

I have no idea if it's the same one, of course, but how many days do police- escorted motorcades happen in a metropolis?

Haven't managed to find anything on an actual news site.

[1]: [https://twitter.com/Honeybeast/status/700116621952552961](https://twitter.com/Honeybeast/status/700116621952552961)

[2]: [https://twitter.com/search?q=sf+motorcade](https://twitter.com/search?q=sf+motorcade)

</comment><comment><AUTHOR> I've contacted the San Jose Mercury News...hopefully they can get a reporter on site to photograph what must be a very intimidating moment for the folks at Apple.

</comment><comment><USER10> According to FlightAware data, a Boeing 747SP, tail number N007JB, was scheduled to depart SFO around 4pm Pacific.

It's interesting because FAA says there is no such N number and 007JB is obviously a play on James Bond.

A jet of that size would absolutely be capable of carrying multiple vehicles and agents.

<comment><USER11> Can you provide a link or alternative data source? I tried the typical flightaware link you would expect and did not observe what you said.

[https://flightaware.com/live/flight/N007JB](https://flightaware.com/live/flight/N007JB)

<comment><USER10> Unfortunately, I was stupid and didn't think to screenshot it. I did see it there for a while, though; it was a SFO -> LAX flight plan. I know FlightAware has a process by which you can remove flights if you can prove you've got a right to do so (e.g. Owner of aircraft)

</comment></comment></comment><comment><AUTHOR> Source indicates cars are leaving now. Nothing on the twitters so far. Hopefully someone will chime in soon. If I see anything in my news feed I'll post it here.

<comment><USER12> You scared them away :p

</comment></comment><comment><USER13> Is there any actual, credible _evidence_ of this taking place? Photos? Apple employees on the record? Anything?

<comment><USER14> Nope. I see 3-4 tourists taking pictures of the "1 Infinite Loop" sign every time I go to the main campus, yet not one of them took a picture of the giant motorcade that allegedly hung out in front of IL5 for an hour.

</comment></comment><comment><AUTHOR> According to my source at Apple HQ a TV van is on the way. We should see some news coverage soon with any luck.

<comment><USER13> This doesn't seem like a story worth sending a live truck for, but OK. Do you know what station it's from? The story would also probably be posted on that station's website.

</comment></comment><comment><USER15> Interesting they have MD plates. Why not just have local NSA cars have CA plates?

<comment><USER16> Based on open sources, NSA has a fleet of about 100 vehicles at most in CONUS, so they would be more likely to fly vehicles cross-country if DIRNSA needed to use a fleet vehicle. Having said that, NSA doesn't just arbitrarily get involved in domestic law enforcement cases, even ones involving crypto, so let's wait to see if there's more evidence than a random HN post to support this allegation.

<comment><AUTHOR> This is a completely fair comment and my source certainly isn't fully aware of the situation...they just relayed what they saw out the window and some discussion among staff. I wanted to make sure this information was recorded for posterity at the time it happened in the (unlikely) event Tim Cook was taken away in hand-cuffs or something similarly dramatic were to happen. I'm hoping someone from Apple feels brave enough to confirm the events here on HN. Ideally with a few pictures showing the motorcade. I doubt Apple PR will comment.

<comment><USER17> Did your source take anyone photos of the event with their phone?

<comment><AUTHOR> Honestly, I didn't feel at liberty to ask and none were volunteered. I've been hoping someone from Apple would pick up on this thread and post them here.

<comment><USER17> Are these the vehicles in the convoy to Apple you were describing?

[https://twitter.com/Honeybeast/status/700116621952552961](https://twitter.com/Honeybeast/status/700116621952552961)

My knowledge of vehicle types is subpar.

<comment><USER18> No, those are all Ford. First three are Transit vans, then an Explorer and a Crown Vic.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> There is no parking specific for the "Apple Executive Briefing Center". Also, thousands of employees, and lots of people from off the street, would have seen the cars and someone would have uploaded something to Instagram/Twitter.

This reads like something made up by someone who has never actually been to Infinite Loop.

<comment><USER19> Yes true it was just conspiracy theory... like you know.. that government spies on you and stuff like that.

Nothing to see here those are not the droids you looking for!

</comment></comment><comment><AUTHOR> Just a follow-up to correct the record as much as possible. I believe this motorcade was related to the Prime Minister of Malaysia's visit to Apple per the following tweet. Hat tip to the redditor @frenvedd over on r/apple for this information!

[https://twitter.com/DelFazli/status/700133655444746241](https://twitter.com/DelFazli/status/700133655444746241)

</comment><comment><USER20> Thanks Mr James Comey. We have finally found our generation's Edgar Hoover.

</comment><comment><USER17> Anyone have any images of the event? Was anyone able to actually photograph the event, and of so, when can we expect to see the images?

</comment><comment><USER21> Any black helicopters?

;-)

</comment><comment><USER4> Good thing they probably spent about 100k on this cloak and dagger circus, when all they really needed was a single gov employee taking an uber ride.</comment>


Groovy language support for Android - <AUTHOR> https://github.com/melix/groovy-android-gradle-plugin

<comment><USER2> Google needs to decide if they want to be compatible with the JVM or not. If they do, then that opens the door for Groovy, Scala, Clojure, and all the other JVM languages. Plus it allows the full ecosystem of tools & libraries. There are plenty of Gradle build plugins that Android developers could tap into.

Many great things from the Java ecosystem do work when brought over to Android: Guava, Jackson, GSON, Joda-Time are some common libaries that are pure Java. Dagger is an Android library implemented in pure Java that is starting to work its way back into 'regular Java'. And of course the tools like IntelliJ, ProGuard, Maven, Gradle are all from the Java ecosystem.

But many of the best things are not compatible. The Android Gradle plugin has a different interface than the Java Gradle plugin, so other existing Gradle plugins (this one being an example) all have to be re-written specifically for Android. Even some of the seemingly obvious ones like pure Java/JUnit 4 testing on x86 are impossible. Some Java 7 syntax is available on Android, but the major SDK improvements like the new file I/O API are not. Nothing from Java 8 is available, including blocks and the new time API.

In light of the recent advances by Apple on the tooling & language front, Google needs to decide if half-baked Java compatibility is worth the cost of being handcuffed. Either go all-in on Java, pay whatever Oracle wants and get full Java 8 compatibility now, or fork out on their own and move faster.

<comment><USER3> I agree that Google needs to either move on with their Dalvik VM, or switch to something else. I vote for the latter.

<comment><USER4> They actively work on it and starting in Kit Kat there is an alternate runtime disabled by default.

</comment></comment></comment><comment><USER5> This link is really a call for people to alpha test Groovy's Android support, which is likely a long time coming before it's not buggy. Just look at the 5 years it's taken for Groovy to ship with static typing actually used by Grails (though with an official _Use With Caution_ attached) ...

mid 2009: Alex Tkachman began work on Groovy++, a statically typed plugin to Groovy's AST, which the Groovy project management said they didn't want [1]

mid 2010: Groovy 1.8 beta 2 broke Groovy++ which had to switch back to Groovy 1.7

late 2011: SpringSource employed Cedric Champeau to duplicate most of the Groovy++ code and renamed Groovy 1.9 to 2.0.0-beta-1, dropping other features like the Java 8 lambda retrofit and meta-object protocol cleanup

mid 2012: Official standalone release of Groovy 2.0 was really just another beta to encourage more people to test it

Dec 2012: Grails 2.2 released with groovy 2.0.5 bundled, after being tested by programmers who thought Groovy had any real intended use as a standalone language outside of Grails. Grails 2.2 doesn't, however, actually use the static compilation features of Groovy, just wanted to know it would run with Groovy 2.0 bundled without breaking.

mid 2013: Groovy 2.1 was the first release with most @CompileStatic bugs fixed

May 2014: Grails 2.4 released, the first to actually use any of the @CompileStatic features of Groovy, but with this strong caution in the doco: "Care must be taken when deciding to statically compile code." [2]

[1] [http://groovy.329449.n5.nabble.com/On-static-compilation- of-...](http://groovy.329449.n5.nabble.com/On-static-compilation-of-Groovy- tt347670.html#a347685)

[2] [http://grails.org/doc/2.4.0.M1/guide/introduction.html#whats...](http://grails.org/doc/2.4.0.M1/guide/introduction.html#whatsNew24)

<comment><USER6> vorg (aka Gavin), can you proof your 2011 statement about the duplication? Neither was there a copy&paste, nor is there a big overlap in concepts that goes beyond what these would have in common with javac for example.

And another thing... Grails has nothing to do with Groovy on Android. And thanks to some fixes I did with Cedric you don't need to statically compile the groovy code either.</comment></comment>


What real life bad habits has programming given you? - <AUTHOR>

<comment><USER2> I keep telling my girlfriend that cleaning up the apartment before we analyze which parts of the mess bother us most is premature optimization. Somehow she is not convinced :-/

</comment><comment><USER3> All my bad habits are hidden behind a clean, stable public API.

</comment><comment><USER4> Um. Thinking mostly internally in code metaphors and then isomorphing that to a relationship conversation. Yeah, that doesn't usually work out so well for me.

</comment><comment><USER5> Putting ';' at end of sentences, writing 'goto' instead of 'go to'

<comment><USER6> Hehe, yeah - and () after writing stop or play

</comment></comment><comment><USER7> Eating too much. Exercising too little.

</comment><comment><USER8> Attempting to refactor the universe.

</comment><comment><USER9> "I'll fix it later"

</comment><comment><USER10> sleeping during the day

</comment><comment><AUTHOR> thinking 256, 512 etc as special numbers :|</comment>


Paul Krugman: Why markets can't cure healthcare - <AUTHOR> http://krugman.blogs.nytimes.com/2009/07/25/why-markets-cant-cure-healthcare/

<comment><USER4> The problem with health care is no amount of money will ever be enough.

It's one of those areas where you can spend and spend and spend and you will still be far away from satisfying the needs we have.

The Danish model that I grew up with is ok, but don't expect treatment that are even half that of a good American hospital.

Put on top of that the fact that we are "discovering" (or inventing) more and more sickness that we can then threat which people expect the hospital to take care of.

Perhaps the real trick is to tax those treatments that are extremely both important and expensive and let the insurance companies take care of the milder forms of sickness. That way if technology makes what used to be expensive treatments easy and cheap they can be pushed into the private market.

Don't know, it's a tough nut to crack.

<comment><AUTHOR> It may be that no amount of money will ever be enough, but that money can be spent well or it can be spent badly. Doctors can prescribe an unnecessary procedure because they're paid for it or because they fear malpractice claims. Or they can prescribe an expensive drug or surgery with a high chance of saving your life. In America, we don't do a very efficient job of spending our health care dollars. In Denmark (where I'm living now), you may or may not get treatment as good as in an American hospital (you should try some of the public ones before you judge). At least you get the treatment you need regardless of your ability to pay, and without bankrupting you in the process.

<comment><USER5> Given the amounts that are spent both by public and private actors, you should qualify your statement. Clearly, vast amounts are being inefficiently spent through Medicare. The question though is that if government isn't already good at spending the money through medicare, what makes anyone think that if you give them the whole system to run, it will be any better?

<comment><AUTHOR> What makes you think insurance companies spend money efficiently?

For one thing, they tend to have much higher administrative costs than publicly run health care programs. See, for example, Wikipedia's article on health care in the US: [http://en.wikipedia.org/wiki/Health_care_in_the_United_State...](http://en.wikipedia.org/wiki/Health_care_in_the_United_States#Administrative_costs) or this blog post by Ezra Klein: [http://voices.washingtonpost.com/ezra- klein/2009/07/administ...](http://voices.washingtonpost.com/ezra- klein/2009/07/administrative_costs_in_health.html)

There are also all the reasons cited in Krugman's post.

Then there's the fact that the U.S. spends about twice as much on health care as any other developed nation and gets results that aren't clearly better overall. Is it a coincidence that we have the largest component of private spending?

If the insurance companies aren't already good at spending money on health care, what makes anyone think that if you give them the whole system to run, it will be any better?

<comment><USER5> I think that even most private healthcare advocates suggest that we do need to ensure that those who need the care get it - and one way to do so is for governments to cover premiums in order to do it. But to suggest that we need to completely dismantle our existing system seems rather drastic as we do get some significant benefits including the level of medical innovation that the US supplies the world. Granted, if the US is subsidizing the rest of the world through inefficient spending domestically this isn't ideal either.

Just a reminder: [http://www.gallup.com/poll/102934/majority-americans- satisfi...](http://www.gallup.com/poll/102934/majority-americans-satisfied- their-own-healthcare.aspx) \- instead of working at the people who aren't satisfied with their insurance or don't have any, we'd rather create an entirely new system from scratch?

As for higher administrative costs, as a number cruncher and one who has worked with non profits, this number can be both juiced and reduced depending on the operational strategy that's taken. For instance, despite higher administrative expenses, medicare fraud (15+%) is thought to be considerably higher than private healthcare - so there's a trade off here between administration and waste elsewhere. I'm not saying that this is necessarily the case here but given the fraud numbers, that case does seem compelling.

I'm not fond of the US insurance industry as a whole given that it's all third party payors (ie your employer chooses your insurance, not you) which introduces all sorts of wacky results but I find it odd that they wouldn't rather give users of the system more power rather than centralizing it with governments. Again - look at the stunning er, competence with which the bail out package has been run.

also fyi - [http://www.washingtonpost.com/wp- dyn/content/linkset/2005/07...](http://www.washingtonpost.com/wp- dyn/content/linkset/2005/07/23/LI2005072300409.html)

update - apparently administrative costs are higher not lower for Medicare than private insurance, check this link out: <http://www.heritage.org/research/healthcare/wm2505.cfm>

<comment><USER6> _I think that even most private healthcare advocates suggest that we do need to ensure that those who need the care get it - and one way to do so is for governments to cover premiums in order to do it._

Is anybody talking about a plan like that? I haven't heard anything about it, and I would think the GOP would be touting it if thats what they wanted. Most republicans I've heard either seem to be for inaction or for a health care bill that doesn't do anything for the uninsured/needy

</comment></comment></comment></comment></comment></comment><comment><USER5> "There are, however, no examples of successful health care based on the principles of the free market, for one simple reason: in health care, the free market just doesn't work. And people who say that the market is the answer are flying in the face of both theory and overwhelming evidence."

I'm quite curious where it has even been attempted (I'm assuming that Krugman is aware that it's difficult to prove a negative). There are submarkets where markets are being tried - prescription eye glasses for instance.

There are all types of insurance that cover complicated risks as well - <USER2> doesn't mean they are uninsurable (excess of loss coverage on any variety of things). But I think Krugman's biggest failings is in making a convincing argument that all healthcare is necessarily expensive. Back to the prescription eyeglass example - where the competition between opticians, optometrists and ophthalmologists have made costs rise considerably less than healthcare costs as a whole. Further, if you look at the innovations in ambulatory care centers, there have been dramatic reductions in costs.

Finally, let's also be reasonable about government run healthcare that has its own set of issues with spiraling costs and often lower standards of care. As a Canadian, you often see the effects of rationing - ie people wait. People die in the waiting line. The system is still quite expensive and is set to become even more so given demographics. It is however an interesting debate - where I worry though is given the US is the dominant innovator in healthcare, will the tinkerings to how and what incentives are offered dramatically reduce innovation? Despite being an obviously imperfect system (which one is perfect for that matter?), most Americans at least say they are satisfied with their own healthcare insurance. Are these really then acceptable tradeoffs to move to a largely government run system - especially given the level of competence we have seen them run the recent stimulus packages?

<comment><USER7> Most Americans are satisfied with their health care because most Americans have employer-provided insurance, and so are utterly ignorant of the costs involved. Unfortunately for these people, the skyrocketing costs will affect them, too, and soon - either through flattened or depressed wages, reduced or eliminated health coverage, or both. With insurance premiums rising 10 - 20% annually, it's only a matter of time.

<comment><USER5> And arguably the best way to control said costs is through introduction of competition and also giving people choice (with cost trade offs). Isn't the alternative government price controls? One of the arguments that Greg Mankiw makes is that at least with private institutions you have choice however limited, to move to another institution whereas this isn't the case with government.

I'm not sure that healthcare costs will necessarily increase over time - <USER3> are some pretty stunning developments in area of ambulatory care with dramatic savings for insurers (not to mention improvements in quality of care at the same time).

<comment><USER8> _I'm not sure that healthcare costs will necessarily increase over time_

From the Centers for Medicare and Medicaid Services, via the Kaiser Family Foundation:

<http://www.kff.org/insurance/upload/7692_02.pdf>

 _Spending on health care, which is a projected to be 17.6% of the U.S. gross domestic product (GDP) in 2009, has consistently grown faster than the economy overall since the 1960s._

 _In 1970, U.S. health care spending was about $75 billion, or $356 per resident, and accounted for 7.2% of GDP._

 _Health care spending has risen about 2.4 percentage points faster than GDP since 1970._

Please tell us the source of your touching faith that this rather well- established long-term trend -- one which has already bankrupted millions -- will spontaneously reverse itself.

<comment><USER5> [http://www.ifc.org/ifcext/che.nsf/AttachmentsByTitle/Hc09_Be...](http://www.ifc.org/ifcext/che.nsf/AttachmentsByTitle/Hc09_BeverlyPhilip/$FILE/Beverly+Philip.pdf)

I should add as well that just because we're spending more on healthcare doesn't mean that it's getting more expensive. We may just be consuming more and better care. Here's a case for that argument: [http://gregmankiw.blogspot.com/2009/07/keeping-animial- spiri...](http://gregmankiw.blogspot.com/2009/07/keeping-animial-spirits- alive.html)

</comment></comment></comment></comment></comment><comment><USER9> _How to Cure Health Care_ by Milton Friedman: <http://www.hoover.org/publications/digest/3459466.html>

</comment><comment><USER10> One can agree with (almost) every specific point Krugman makes, and yet disagree with his conclusion.

I don't think many economists would claim that free markets offer a perfect solution regarding health care. Rather, they would argue that the alternatives (for example, a government run system) are worse.

<comment><USER11> Well then they're wrong, because government run systems work better in Western Europe and Canada than the US private system.

<comment><USER12> Your contention is interesting. Let us compare cancer survival rates. <http://www.medscape.com/viewarticle/561737> Breast cancer survival rates in the US are 90.1%, versus 79.0% in Europe. The prostate cancer survival rate in the US is 99.3%, as compared to 77.5% in Europe.

We get better health care in the US.

The US also subsidizes drug discovery for the rest of the world. In the late 90's, I worked for a company that made robots used for drug discovery. Every once in a while, they would put up a chart showing year over year growth. There was a healthy, steady climb until the Hillary health care initiative. The company almost went out of business. Drug companies froze spending on drug discovery because it wasn't worth their while to spend the hundreds of millions to bring a new drug to market if the US was going to go to a single- payer system. US drug prices pay for R&D, and all the countries with enforced pricing get a free ride.

<comment><USER13> > Breast cancer survival rates in the US are 90.1%, versus 79.0% in Europe. > The prostate cancer survival rate in the US is 99.3%, as compared to 77.5% > in Europe. We get better health care in the US.

You conclusion doesn't follow from the data. The only conclusion you could make from that data is that the US has better care for prostate and breast cancer than Europe.

Most people don't die of these diseases. Indeed, most people don't die of cancer. So we should be looking at survival rates for all conditions, i.e. life expectancy.

As it happens, most (all?) western European countries have longer life expectancies than the USA, and all spend less on healthcare. If you wish to conclude that the US system is the best one, your conclusion isn't supported by the facts.

<comment><USER14> _As it happens, most (all?) western European countries have longer life expectancies than the USA_

The average life expectancy in the EU is 78.7 and in the USA it's 78.06, according to Wikipedia.

<comment><USER13> Bear in mind that western Europe != the EU.

In 2004 and 2007 12 countries from central and eastern Europe joined the EU, with lower standards of living and (presumably) healthcare. The western EU countries are more comparable with the USA, since they have a more similar standard of living.

</comment></comment></comment></comment></comment></comment><comment><USER5> A rejoinder/rebuttal by another prominent economist - <http://gregmankiw.blogspot.com/2009/07/trust.html>

</comment><comment><USER15> <http://en.wikipedia.org/wiki/Flexicurity> FTW.

<comment><USER16> Private healthcare FTW. You have a better chance of surviving cancer in the US than in Denmark.

[http://mjperry.blogspot.com/2008/07/cancer-survival- rates.ht...](http://mjperry.blogspot.com/2008/07/cancer-survival-rates.html)

US healthcare is not a pure market based system, though. The regulations make it very expensive.

\- an expat Dane

<comment><USER17> Private health care can coexist with a system of Universal Health Care Coverage. Yes, the Canadian system is almost entirely run by the government, but there is no reason that the US most copy the Canadian system. In Australia, 40% of hospital services are delivered by privately run hospitals.

</comment></comment></comment><comment><USER18> _There are, however, no examples of successful health care based on the principles of the free market_

This is easy to refute.

Flash back 100 years. People had healthcare they received from a family doctor. Insurance was non-existent, and the free market reigned.

In fact, it was the _success_ of the free market in healthcare that led -- and continues to lead -- for more and more complicated, expensive treatments that save more and more lives.

I see three problems with markets and healthcare:

1) Insurance policies are so obfuscated that nobody understands what they are buying. Government needs to step in here and create standard insurance policy baselines. This will allow me to make an informed decision.

2) The people receiving healthcare have little or no input into cost control -- the people controlling costs have no "skin in the game" when it comes to value and quality of care. This decoupling needs to be fixed to encourage individuals to monitor and control their own costs.

3) If society has a greater interest in making sure there is a basic level of healthcare for all, as it does with say automotive insurance, then it should be a law for all people to have personal health insurance that covers these catastrophic scenarios. This would also mean allowing all insurance to be tax deductable and decoupling insurance completely from employers. It should be completely portable and associated just with the person.

Compared to some of the huge plans I've seen, these are really easy to describe. A bill could be just a couple of pages, and most Americans could understand exactly what is being passed. Instead of trying to have one huge law "fix" the problem, it simply provides some definitions and takes one huge problem and breaks it up into hundreds of millions of little problems that can be solved various ways.

Why we continue to think that some legislative body can create gargantuan one- size-fits-all solutions is beyond me. Evolution, machine learning, market theory, chaos -- lots of real, hard science says that solutions are iterative, incremental, and adaptive. Not complex and static.

<comment><USER19> I have a hard time figuring out how an individual healthcare consumer would have any rational reason to "monitor and control their own costs"? If I'm sick, I want to be made better. If I have cancer, I want it cured, etc.

There's no point at which the average person with a reasonable prognosis for even 1 more year of life says "gee, that sounds expensive, perhaps I should just die instead, so as to control my own cost to society [or my insurance company]."

<comment><USER18> I would suggest that insurance policies be required to send a certain amount back to the purchaser each year in the form of a check -- say 20% of premiums. The total amount would be reduced by the amount of services used that year.

 _If I'm sick, I want to be made better. If I have cancer, I want it cured, etc._

I completely agree that if you have a life-threatening illness cost is not an option. But as a healthy young-person, when I get a cold or something I just take some aspirin and wait to get better. Same goes for ear infections. There is a lot of room for flex in how people get treatment for non-life-threatening illnesses. What the stats show is that the less skin in the game people have, the more likely they are to go to the emergency room for things like common colds.</comment></comment></comment>


Oracle v. Google - Oracle Motion for JMOL on Patent Infringement Denied - <AUTHOR> http://www.groklaw.net/article.php?story=2012053015590290

<comment><USER2> Ok, this quote:

 _"The foregoing is sufficient but it is worth adding that Oracle's infringement case was presented through Dr. Mitchell. A reasonable jury could have found his many "mistakes" in his report merely to be convenient alterations to fix truthful admissions earlier made before he realized the import of his admissions. For this reason, a reasonable jury could have rejected every word of his testimony."_

That's just _harsh_. If you ever get asked to be an expert witness in a case (and I have) there is one thing that is really really important, figure out what your opinion is, reason it all the way back to first principles, and then write it out. Sometimes that means that you aren't the right 'expert' for the case and that can mean forgoing a hefty pay day, but damn if it doesn't let you sleep well at night.</comment>


Facebook friends not real friends: judge - <AUTHOR> http://www.smh.com.au/news/technology/facebook-friends-not-real-judge/2008/03/27/1206207279597.html <comment><USER2> I definitely find myself agreeing with that judgment...

That, too, is why I tend to agree with all the 'FACEBOOK IS DOOMED!!!' articles too. Facebook, while being a pretty good web OS and development platform, lacks a decent social networking application. (Facebook itself, after a while, begins to seem very superficial and useless.)

<comment><USER3> Facebook may be like the Macintosh computer before desktop publishing. You may be not old enough to remember when the Macintosh was really just a toy, but it was. Don't count Facebook out yet, a killer application may just change the entire story. In fact, I am trying to build a killer application for it myself, one that takes it out of being just a game and provides a real reason for real people to use it every day. I've been working on my program for a long time, and if successful, it could change how some people perceive facebook No, it is not a 'Bit by a Vampire' applet! Even more interesting,there are probably 100s of other people just like me trying to do the same thing, find a way to leverage what is cool about facebook and make it a productive environment. Sure Facebook is Doomed, just like Apple has been doomed almost every year it has ever been around. :-) At least, that is what I hope.

<comment><USER2> "No, it is not a 'Bit by a Vampire' applet!" Oh, god, that's a relief. Facebook has enough of those. :)

Anyway, that's pretty much what I meant with my Emacs-ish response. It's a powerful platform, but people haven't really figured out what to do with it beyond small games and hundreds of friend invites.

Good luck with your app - I'd love to see it when/if you release it.

</comment></comment></comment><comment><USER4> Why would she take him to court over a friend request?</comment>


Goodbye Boost VC – Thank you Tribe 7 - <AUTHOR> http://blog.payload.tech/2016/04/23/thank-you-boost-vc-tribe-7/ <comment><USER2> Thanks for sharing you experience at boost. Little nitpick: you might have swapped the ping labels (Pak vs boost).

<comment><AUTHOR> Fixed! Thank you!

<comment><USER3> Are you sure? They still seem backwards

<comment><AUTHOR> I may have forgotten to hit the save button. Updated.... again. Thanks!

</comment></comment></comment></comment><comment><USER4> Congratulations. And Good Luck ! Always good to hear good stories about young Pakistanis.

</comment><comment><USER5> 1\. What is your product?

2\. How's the quality of engineers in Pakistan as compared to SV?

<comment><AUTHOR> 1\. Mailman - themailman.io - We're a priority messaging service. We're still in development, and while we have an MVP out, we're focused on product improvement right now and are holding off on marketing it.

2\. SV engineers are better than most other regions of the world because SV attracts them. Are there engineers in Pakistan as good? Definitely. Are they as easy to find as in SV? No. Will our network make it easier to find them? Yes. Are they cheaper? By magnitudes.

<comment><USER6> I didn't understand what it was until I went to this page [https://themailman.io/register](https://themailman.io/register) \- I would recommend you put the "Get Paid To Read Your Mail Charge senders to send you mail" on the front page. Without it I can't tell what's going on.

<comment><AUTHOR> Thank you, feedback always helps us make things better! The next iteration will do this! :)

It's a major overhaul.

</comment></comment></comment></comment><comment><USER7> Good to read!

</comment><comment><USER8> you plan to come back to pk or stay onwards?

<comment><AUTHOR> probably returning, since the burn rate is much lower there. That's an advantage I have over other founders. Advantages are meant to be exploited.

<comment><USER9> The whole world is full of founders. Being in the SV area is the rare advantage, not the other way around.

<comment><AUTHOR> I'm sure. Don't get me wrong, it's very very helpful. However, most of the startup life is keeping your head down and working. I can fly to SV at any point, but setting up a team in Pakistan + office space + utilities is only a fraction of 1 programmer being paid in SV.

At such an early stage, survival is all we're focused on. The moment we can afford SV, we'll jump right on over!

<comment><USER10> That's awesome. I hear a lot here in Canada (as a foreigner here) about the efforts they made decades ago to build an educated workforce for the information economy and a local tech industry. It did great things here and I have to imagine it's great for Pakistan. There are strong engineers and digital artists coming from Pakistan, and in the long term they should be able to stay and have a great career at home.

</comment></comment></comment></comment></comment><comment><USER8> and? i think this is incomplete.

<comment><AUTHOR> How so?

<comment><AUTHOR> But it isn't difficult. And there's no magical path. Where there's a will there's a way.

<comment><USER8> What was the way ?</comment></comment></comment></comment>


Ask HN: Can I help you be more awesome today? (No strings.) - <AUTHOR>

Hello HN. I like this community a lot and want to see if there's anything I can do to make you a little more successful. No strings. To give you an idea of what I might be able to help you with, let me tell you a few things I've done to help others recently...
- I'm an early-adopter and enjoy seeing new technology and ideas being put into action. If only to get access sooner, I'd be more than happy to critique and share my opinion on all things design, customer development, software, entrepreneurship, family, creativity, or productivity.
- I'm participating with a team of other students in the Stanford Technology Entrepreneurship online course and helping people learn to apply the Business Model Canvas along with lean startup methodologies as well as attempt to bring our own product to market. (On the side, our team published an ebook that helped other groups in the course to effectively brainstorm toward creating a viable business idea.) (This course is also the reason why I didn't do last month's "No strings" thread.)
- I organize the South Florida Hack and Tell, which is a group for geeks (and those interested in hanging out with geeks) to do interesting events here in South Florida (like learn Arduino, grab a beer, participate as a team in a Hack-a-thon, etc),
- I advise a few local single founders who are without technical expertise and guide them toward good long-term technical decisions for their startup,
- I write (moderately maintainable) software for a living,
- I understand good design from bad design and can push pixels with the best of them (I got a perfect on this color test: http://www.xrite.com/custom_page.aspx?pageid=77&lang=en),
- I have a family and juggle a mediocre work-life balance that's gradually improving.
If there's something I can help you with, just ask here or @mikegreenberg on Twitter. Be specific about what you're trying to fix/solve/accomplish. The more details you provide, the better I can help you out. :)
I also hope this inspires other people to help out even if you don't think you have anything useful to offer. Actions like this will only improve our community (locally and across the net).
Cheers! Mike
PS: I'll typically reciprocate the amount of effort/consideration that you've shown in your request. If you show me that you're thoughtful about the feedback you want from me, I'll be more apt to give you something useful. I'll accept any requests made before the end of today and will attempt to respond by the end of the weekend.
PPS: You can check out my previous submissions if you want to see the sort of feedback I can provide. <comment><USER2> Hi Mike, thanks for helping the community, there is actually one thing that i would love to get some input on from someone more "experienced". If you could validate my idea, the following: A service that lets you, developer, send message to the users under the form of alerts/dialogs, not push notifications. I think this service might have a lot of advantages, most of all, it should not annoy the user. In my view this service would help developers to keep a strict contact with the users, something that i think it's very important and it's usually appreciated the user. I do not want this to be something just to keep the user engaged.

Some examples of how this could be used:

\- Send notifications about the status of your service/app

\- Get in touch with specific users to provide support

\- Messages directed to specific platforms

\- Fast feedback from specifed users, like if there is someone who uses a feature more than other, ask why.

\- Give rewards to your most passionate users.

In the end i would say that this is a service to let the users know that you are there. I have a quite clear view of all of this even if i might not have expressed it in the best way. I even have already something in my hands. but i wish to know if this is something that people might actually like/use.

Thanks :)

<comment><AUTHOR> tl;dr: I think this could be a very useful service, but the execution is very important.

There are already services which are in this space who are trying to get it right (olark.com comes to mind). I'm not really sure what the right way is, but if I had to take a guess, the experience should feel very homogeneous with the app which offers it. Yes, there's a reasonable amount of value you get out of a drop-in service that you don't have to configure or think about, but I think every point of interaction with the customer should be a carefully- thought decision and not a white-label feature you add as an after-thought.

I think if you were able to figure out how to construct a communication's channel that could be easily added to an app while neatly integrating into the existing experience, that would be a major win that I'd give you money to provide me.

<comment><USER2> this was a really helpful comment! Thanks! I will carefully think about it! Actually olark is one of points of inspiration, but i would prefer to point it more to the mobile world. Thanks a lot for the help!

</comment></comment></comment><comment><USER3> Hey Mike, really appreciate you taking the time. I recently launched a service that creates elevator pitches for startups:

<http://pitchremix.com>

Any specific thoughts on the site and the service? Do you think there is a large enough market (i.e., do you think many startup founders would pay for this?) And are there any glaring holes to fix? Features that I absolutely must add?

Thanks again!

<comment><AUTHOR> This is pretty straightforward. I'm intrigued, but question how someone else (who has not thought about the problem as long as I have) be able to communicate the solution more effectively than me? Further, you don't guarantee anything if I think your pitch sucks. It feels like I might just blow $25 for entertainment and hope for the best.

Maybe re-position your value prop like so: "For $25, we'll consult with you for 30 minutes to help you refine your existing pitch or create one from scratch."

You can still earn your keep but allows your customers to be involved in shaping a pitch that actually reflects their vision.

<comment><USER3> Thanks for the feedback. That's actually the exact problem I've been having with my first customers. I end up consulting with them via email (until the pitch is perfect) anyway, so I might as well build the site around it. A 30-minute consultation is a great idea too.

Thanks again.

</comment></comment></comment><comment><USER4> Thank you! would you please consider perhaps reviewing FlashIssue? it helps people quickly create social newsletters / digests / tweetletters from their blog posts / other blogs / sites / anything in minutes by curating (more like your facebook timeline than an email...)

Would you please tell us your impression from the user experience?

<http://flashissue.com>

Also we have a very nice chrome extension that makes your gmail emails "facebook status" like, e.g. you grab articles and put in email more like a facebook timeline (with title, snippet and thumbnail + source attribution) it also works with the web app but I think it's the first "curator" clipper for gmail, here is the link

[https://chrome.google.com/webstore/detail/cihaednhfbocfdiflm...](https://chrome.google.com/webstore/detail/cihaednhfbocfdiflmpccekcmjepcnmb)

We use it internally all the time and it saves time and gets the email look much more professional than just a link... (better click rates as well)

Thanks!

<comment><AUTHOR> I'd be happy to give this a try. The clipping tool for newsletters sounds particularly interesting. I send emails to my members as a block of text (without much fanfare).

I'll give this extension a try this weekend and see how people like a different format. I'm not sure how soon I'll have results regarding the newsletter, but will definitely critique the experience. :)

<comment><USER4> Thank you! will be looking forward to hear back

<comment><AUTHOR> I didn't forget about this. My in-laws surprised us this weekend and I didn't have the time I originally anticipated. If you'd like to touch bases with me via email (in profile), I can follow up with you later this week.

Thanks for understanding.

</comment></comment></comment></comment><comment><USER5> Hey Mike,

I would love to get your feedback on this <http://coursebacon.com/>. The basic idea behind CourseBacon is to help you identify the best free online learning resources.

For the "star algorithm" I am pulling backlinks from Google, SEOmoz and Twitter.

Any suggestions would be greatly appreciated! Thanks in advance,

Carl

<comment><USER4> I like it... tip - use embed.ly to get better favicon / image / title / desc to the course list, will look much more of a list than a search engine result...

<comment><AUTHOR> This. Would add a LOT to your experience.

</comment></comment></comment><comment><USER6> I need to write an engineering spec for what is essentially the robotic endoskeleton for the terminator arnold plays in the franchise by the same name.

Help a girl out?

I can write software specifications but this task is beyond me.

My engineer must think I`m the reincarnation of tesla to have asked me for a spec, but I think I can pull it off, just having trouble getting started with everything else I have going on (new bf and dog, tcombinator, freelancing, my adult career, doing nothing, etc).

I was thinking you can talk to your peeps and see if any of them want to help.

Before the backlash, I don't intend for these robots to be used to kill people. They are for jobs that humans die doing or cannot do, like cleaning up nuclear accidents like fukishima without suffering the huge doses of radiation a man would (or at least not dying/becomong non-operational as a result of it). Thanks

<comment><AUTHOR> I'm not sure if you're trolling or not, but I would suggest you start taking some Robotics AI courses (<http://ai.stanford.edu>) and reading some books before taking this project on. I'm not sure how far you'd have to go but there's a big different between building a robot that moves and building a robot that can mobilize itself and perform actions in response to stimulation.

Also, engineering spec is quite vague. If you boss really asked you to do something like, think twice about taking it on. Loose, vague, and otherwise overreaching projects tend to not end well for those involved.

I think my peeps will feel similarly and pass on this one. But I'd be happy to introduce you should you want to come out to a hack night and ask them yourself. :)

Best of luck to you.

<comment><USER6> I'm the boss (tcombinator.blogspot.com), it's my engineer that is requesting an engineering specification. I'm assuming that it would essentially be a software specification document, but for a robot, as opposed to an app. I recognize the difficulties involved, hence my stagnation and reaching out for guidance and partnerships to jumpstart the process. I live in Virginia, otherwise I would be happy to meet with your contacts.

<comment><AUTHOR> Couldn't find a contact point for you. Feel free to send me an email and I'll see what I can do to help! :)

</comment></comment></comment></comment><comment><USER7> Hey Mike,

I had signed up for the Venture Labs course earlier this year and found it very interesting. Unfortunately, due to time commitments and various other issues I did not follow through with keeping up with the course.

Could you give me some pro cons of the Venture Labs course itself? How has your experience been so far? Keep being awesome.

<comment><AUTHOR> Thanks for the question. The ride has been particularly fun so far and I don't think a short answer will justify the experience. I've started a blog post that I'll put up later this week and cross-post here. If you want to reach out via email, I can drop you a line when it's up. (Or you can subscribe to blog in my profile.)

Cheers!

</comment></comment><comment><USER8> I'd like to get your opinions about a new tool <http://www.bulkmailapp.com>, a mass email merging tool to send personaliaed emails en masse to bloggers and contacts. what do you think about the selling message/product pitch on the site? Thanks

</comment><comment><USER9> What are some things/pitfalls I should look out if I'm starting a tech consulting company?

<comment><AUTHOR> Disclaimer: I doubt I'm a good role model to be answering this question. The majority of my experience has been spent working for someone. Granted most of the projects I've been able to choose, I am not yet a self-made man. I work with many consultancies and can only relate what I've observed.

The biggest problem is the overhead of managing your finances and business. It's a distraction that you'll have to learn to deal with one way or the other. In my opinion, find someone that will help you navigate these decisions early and often. (Look to your local Chamber of Commerce or entrepreneurial meetups for qualified mentors.)

Do NOT underestimate how important it is to track your time and money. My approach was to take things in small bites. I setup a DBA and opened a business account and tried my best to keep my finances separate. When I paid for stuff out of my personal account, I made sure I put together an expense form to track reimbursements. Even though there aren't much tax benefits running as a sole proprietorship, the taxes are much easier and you do get to write off a few things. Once you start making 4 figures a month, seek out assistance again and see if it makes sense to formalize your business into a corporation.

There are services which help manage your books (such as Florida startup, <http://lessaccounting.com>). If it makes sense, use them! They are awesome people and will be a net positive gain for your business. There are also lawyer services which will probably answer questions you have over the phone. One such law service I'm aware of (but haven't used myself) is <http://walkercorporatelaw.com/> and comes highly recommended by Andrew Warner on Mixergy.

While this is basic advice, it's will set you with a strong foundation to start off. And having someone mentor you through the process will give you the best possible advice that will be tailored to your practice's needs.

</comment></comment><comment><USER10> Thanks for doing this. I sent you an email, if that wasn't too, if I may. Again, thanks.

<comment><AUTHOR> Perfectly fine. I got your email and I'll respond back as soon as I can. :)

</comment></comment><comment><USER11> Do you use GTD or any of the kind? What is your opinion on it?

<comment><AUTHOR> I read most of Allen's book but felt the best takeaway was asking "was it actionable". This question helps me get through the majority of my planning, but I don't bother with incorporating much else. The truth is I try to keep my life mostly in the digital world. I do a monthly cleanup of paperwork and followup to tie as many loose ends as possible. And I let technology filter and manage the rest of my information flow.

Allen's system was simple for most, but I found it needlessly complicated. This is his prescription: <http://cyprych.neostrada.pl/_images/processing.png>

I opt for the very low-maintenance system I described in exchange for a tolerable amount of chaos. Until I can afford a personal assistant, this will have to be and have stopped investing time into improving my system in pursuit of more satisfying improvements for myself.

*I like to leave the bookmark poking out about two-thirds of the way through the book and keep it on my bookcase in the living room for everyone to see.</comment></comment>


40M people with diabetes will be left without insulin by 2030, study predicts - <AUTHOR> https://www.ksl.com/article/46431985/40m-people-with-diabetes-will-be-left-without-insulin-by-2030-study-predicts <comment><USER2> No explanation as to the cause of the shortcoming. Do drug companies just hate money?

Madehow has a decent article on the history of insulin synthesis [1]. I don't see any natural bottlenecks that would interfere with scaling the process.

1\. [http://www.madehow.com/Volume-7/Insulin.html](http://www.madehow.com/Volume-7/Insulin.html)

<comment><USER3> Profits for generics are too low and there are no new market participants because outlays for initial investment and conformance testing is too high. Generics manufacturing is a strange beast, there are surprisingly few players involved, there is very little overcapacity, and that's not a good situation. When Hurricane Maria took out pharmaceutical plants in Puerto Rico there were severe drug shortages that were not easily fixed.

<comment><USER4> This is good fodder for a case that a public utility should produce these drugs. Of course that would freak various interests out so won't happen, at least in the US or EU.

A hybrid approach in the US has been fairly useful for orphan indications and, somewhat differently for vaccines, but of course jerks found ways to exploit that too. Still it points to a possibility.

But I favor a single utility making some small-molecule and biologic underserved drugs because of the economy of scale it could bring. A small NIH facility in some otherwise underserved part of the country could make a big difference at a relatively low cost.

<comment><USER5> If this was a viable model, I strongly suspect you would've already seen this happen in one of the many countries with socialized health care. I suspect you're assessment of the approach as "relatively low cost" is faulty. Biologic production is extremely difficult and expensive.

<comment><USER3> _Biologic production is extremely difficult and expensive_

It's not that bad. Brewers developed the knowledge how to work with microorganisms centuries ago. Most antibiotics are biologics, and they are dirt-cheap. Insulin isn't monoclonal antibodies, it's grown in bacteria, in the simplest expression system, and how to isolate it from the fermentation batch is well-understood and involves no problematic steps.

</comment></comment></comment></comment></comment><comment> open-source-ux Type 2 diabetes can be reversed through diet. The evidence comes from medical practitioners and scientists, not from quacks making outlandish claims (although they exist too).

Some links:

 _The Diabetes Code by Jason Fung_ : This is a best-selling book by a Canadian Nephrologist (care and treatment of kidney disease) that explains type 2 diabetes in detail and recommends diabetics switch to a low-carb diet.

 _Counterweight Plus low-calorie diet plan_ : This diet was run as part of a scientific trial and showed promising results for obese patients with type 2 diabetes. Nearly half of the 300 patients in the trial reversed their diabetes. Note: the diet was run under the supervision of medical professionals and is not suitable for everyone: [https://www.nhs.uk/news/diabetes/radical-low-calorie-diet- ma...](https://www.nhs.uk/news/diabetes/radical-low-calorie-diet-may-help- reverse-type-2-diabetes/)

 _The Truth about Carbs_ : this is a BBC documentary from earlier this year which is unfortunately no longer available to watch on the BBC website. It featured NHS doctors who ran a two-week low-carb diet plan with type 2 diabetic patients. All patients reported improvements to their health, but the most impressive result was a patient with type 2 diabetes for 17 years who was now in part-remission.

Here is a thorough write-up of the programme: [https://www.diabetes.co.uk/in- depth/truth-about-carbs-bbc-1-...](https://www.diabetes.co.uk/in-depth/truth- about-carbs-bbc-1-review/)

A clip from the programme: [https://www.youtube.com/watch?v=eKQWFJmCWZE](https://www.youtube.com/watch?v=eKQWFJmCWZE)

10 things you may not know about carbs: [http://www.bbc.co.uk/programmes/articles/4DfZMpv7BYJ3kGXdHxd...](http://www.bbc.co.uk/programmes/articles/4DfZMpv7BYJ3kGXdHxdxkKp/10-things- you-may-not-know-about-carbs)

Just to re-iterate, the examples above all refer to types 2 diabetes, not type 1 diabetes.

<comment><USER6> Something important that I think is worth noting is that you can reverse the symptoms of T2 Diabetes, but it does require a lifelong change of lifestyle. If you go back to your old lifestyle, those symptoms are just going to come right back. I know to some it may be obvious, but I think it's worth stressing this. When people say "reverse," they're talking "in remission." The symptoms are waiting to return if you start fucking up again. That being said, it is a much better approach than the alternatives.

</comment></comment><comment><USER7> Wonder why they picked 2030. I _might_ have read a 3-year forecast since they are sometimes correct. But any forecast involving social processes that is beyond 5 years is almost always wrong.

</comment><comment><USER8> Virta Health is a sf startup with meaningful results reversing T2 diabetes. If you're interested in this topic they are a compelling counterpoint to this study.

<comment><USER9> Type 2 diabetes can be reversed. Many people aren't seriously suggested this option by their medical professional or are unwilling to change their lifestyle.

I don't think it's a counterpoint to the study, but rather to the ways the data will drive policy changes.

It's taboo to take the obesity problem seriously. [https://en.wikipedia.org/wiki/Fat_acceptance_movement](https://en.wikipedia.org/wiki/Fat_acceptance_movement)

<comment><USER10> >It's taboo to take the obesity problem seriously. [https://en.wikipedia.org/wiki/Fat_acceptance_movement](https://en.wikipedia.org/wiki/Fat_acceptance_movement)

It is phenomenal to see such a movement sprout up, as if a chunk of society decided to just give up. I couldn't imagine a serious, equivalent movement on the same scale for alcoholism and cigarette smoking, to cite a few examples. Yet the abuse of food is going to (or is already) cost us far more.

<comment><USER11> We pretty much have that with regards to marijuana. I'm not sure why it's treated so differently from tobacco. In both cases you are inhaling the smoke from burning leaves.

<comment><USER12> Because you can vaporize it, turn it into oil and again vaporize it, bake it into food and eat it, etc. too. Even if you do smoke, a regular marijuana smoker consumes a lot less tar than a regular tobacco smoker since they need less plant product to get the desired effects. Plus, nicotine promotes cancer growth (but does not directly cause it) while THC may mildly inhibit cancer growth

</comment></comment></comment></comment></comment><comment><USER13> All I see from inside the EU is "Forbidden".

<comment><USER14> Likewise, but this works: [https://outline.com/yHC24A](https://outline.com/yHC24A)

</comment></comment><comment><USER15> How about we stop masking the problem of insulin resistance by pumping type 2 diabetics with insulin?

Why don't we start telling diabetics the truth — your diet is broken and needs to be fixed; avoid most carbs, do strength training.

We don't need more insulin to shove the massive onslaught of blood sugar from your crappy diet into your cells (which are telling you they've had enough, AKA insulin resistance), we need more honesty.

The healthcare industry is morally and intellectually bankrupt. All the honest people who got into it trying to make a real difference don't stand a chance, the truth doesn't survive for an instant in this corrupt industry more focused on how much they can get out of insurance companies than treating patients.

<comment><USER16> Diabetes is an incredibly scary disease and we need more focus on the underlying causes and permanent solutions instead of pumping all this money and effort into stop gap measures that perpetuate the problem.

<comment><USER17> By "perpetuate the problem" do you mean "keep people alive"? Because that is incredibly heartless.</comment></comment></comment>