DNA may not be life's instruction book, just a jumbled list of ingredients - <AUTHOR> https://phys.org/news/2020-04-dna-life-bookjust-jumbled-ingredients.html <comment><USER2> In essence, the papers argue that DNA is microcode ROM, and for any particular cell the actual "user code" is contained in "the molecules that regulate the cell's DNA and other functioning systems."

> _For example, the gene for eye color exists in every cell of the body, but > the process that produces the protein for eye color only occurs during a > specific stage of development and only in the cells that constitute the > colored portion of the eyes. That information is not stored in the DNA._

<comment><USER3> I'm no expert in biology, but I live with one. This statement is incorrect. The DNA is the blueprint. It's like saying the information of a Mandelbrot set doesn't exist in its expression. It's not a perfect analogy, but in both cases, the information in question is emergent from the starting point and the rules. Both parts are defined in DNA.

Edit: I have a feeling that this article isn't telling the researcher's whole story. The implications of epigenetics are vast.

<comment><USER4> I am not a biologist but biologists have discussed the idea that phenotype changes can occur without genotype change, since a long time. Although genotype inarguably influences the development and expression of phenotype, selective forces ultimately operate on phenotypes.

The concept of genetic canalization addresses the extent to which an organism's phenotype allows conclusions about its genotype. A phenotype is said to be canalized if mutations (changes in the genome) do not noticeably affect the physical properties of the organism.

This means that a canalized phenotype may form from a large variety of different genotypes. If canalization is not present, small changes in the genome have an immediate effect on the phenotype that develops. [3]

Mary Jane West-Eberhard famously told ""The 20th century has been called the century of the gene, the 21st century promises to be the century of the environment." ... " Darwin, who didn't even know genes existed, had it right, he left open the possibility that new traits could arise because of environmental influence." [1]

An example of such epigenetic and heritable trait changed in morphology without change in DNA is here [2]

[0] [https://en.wikipedia.org/wiki/Mary_Jane_West- Eberhard](https://en.wikipedia.org/wiki/Mary_Jane_West-Eberhard)

[1] [https://www.smithsonianmag.com/science-nature/how-the- tree-f...](https://www.smithsonianmag.com/science-nature/how-the-tree-frog- has-redefined-our-view-of-biology-165716397/)

[2] [https://www.ncbi.nlm.nih.gov/pubmed/12483213](https://www.ncbi.nlm.nih.gov/pubmed/12483213)

[3] [https://en.wikipedia.org/wiki/Genotype%E2%80%93phenotype_dis...](https://en.wikipedia.org/wiki/Genotype%E2%80%93phenotype_distinction)

</comment></comment></comment><comment><USER5> Reminds me of a clever exploit. The code for the OS is backdoor free, but the running OS has a backdoor. Once the running OS compiles a new OS from code it installs the backdoor. This way, no matter how much the code is inspected, backdoor is never discovered. However, each fresh version of the OS still has the backdoor. The exploit is always part of the running system information even though it is never in the static codebase. No reason why our biological information system cannot have an analogous aspect if our vastly inferior human designed systems can. (Also makes me wonder about the claim that the bazaar improves security. Maybe it only provides the appearance of greater security.)

<comment><USER6> This is framed more classically in terms of the compiler and toolchain: [https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...](https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf) "Reflections on Trusting Trust"

</comment></comment><comment><USER7> Doesn't DNA encode proteins that both constitute, assemble, and perform the functions of the cell? It's not a list of ingredients, it's a library of blueprints for machinery and specialized components. The information necessary to operate these molecular machines is built into their structure, different outputs require different molecules not different instructions.

Incredibly complex structure can arise from simple rules, see Turing Patterns [https://en.m.wikipedia.org/wiki/Turing_pattern](https://en.m.wikipedia.org/wiki/Turing_pattern) and cellular automata.

</comment><comment><USER8> Haven't there been nucleus swap experiments that showed transfer of major cell characteristics between species like e.g. different protists?

<comment><USER9> I vaguely recall reading something similar.

What does it prove though? We already know that cellular components are the same or similar across all life.

</comment></comment><comment><USER10> Here's an experiment: take two zygotes from each of two animals, and do a DNA swap. That's 2x2 combinations of environment-DNA pairings. Compare the 4 offsprings. If this can be done, it has been done a million times already, I presume. What's been observed?</comment>


How Apple Influenced The Labels To Shut Down My Music Streaming Startup - <AUTHOR> https://medium.com/@492727ZED/steve-jobs-made-warner-music-sue-my-startup-9a81c5a21d68 <comment><USER2> I read this half asleep and a little inebriated but it seemed to evolve into some kind of bizarre self-aggrandizing pitch on how this Kasian Franks is a super-human with deep hard-to-duplicate knowledge and insights spanning multiple important and lucrative industries. Almost some kind of cred piece bolstered by his proxy encounter with Steve Jobs. Weird.

<comment><USER3> I agree, although I think he sort of predisposed me to this attitude right off the bat with the desperate-seeming link to google results that are supposed to prove people called them an "itunes killer" (note: I could not find a single instance of anyone referring to them as an "itunes killer" in any of those results).

<comment><USER4> Being called "{Apple product there} killer" never turned out to be good for the "killer" involved.

<comment><USER5> Or anything "killer" in general. As evident by every MMORPG that is coming out being the "World of Warcraft killer" an then disappearing into obscurity after a few months of hype while WoW keeps on going.

</comment></comment></comment></comment><comment><USER6> They were crawling the web for mp3s the same way that Google does. Though admittedly Google hides the mp3s much better nowadays then they used to. And the web is way more balkanized into all these corporate walled gardens so there are fewer free roaming mp3s on random websites as there used to be. But technically it was a search engine the same as Google.

It always bothers me that this area of the law seems to be entirely based on judges' interpretation of the purpose of a UI. A UI is illegal if it guides the user towards the illegal action. If it is possible to perform the illegal action but the user has to put in a little thought into how to accomplish it then the UI is legal. Google can't have a file-type search box with an mp3 option but if users know the right incantation they can achieve the same thing. So we have lawyers telling us how we can build UIs. It seems wrong and like a dangerous slippery slope.

<comment><USER7> I was under the impression that the UI was pretty incidental in most judges' interpretations that platforms used _mainly_ to locate copyrighted material were on shakier ground than platforms which incidentally, and despite ostensibly significant efforts on the part of developers to limit it, could be used to locate copyright material. It's not like Google doesn't get hit by content-provider lawsuits either, it's just that they're big enough to usually get a settlement agreed on favourable terms and far too big to be bankrupted by legal costs, which is a wider and more general problem with litigation.

Ironically I'm writing this listening to YouTube streaming in the background: a far superior free way to locate and listen to music without paying for it than most of the early pirate platforms ever could have hoped to be.

<comment><USER8> When people think of "copyrighted" material they usually think Songs, Movies etc. However if you stop and think about it most content on the web is copyrighted, from the news articles you search for to images and websites themselves. With that in mind Google also is used "mainly to locate copyrighted material"

<comment><USER9> Hosted by the copyright holder. A crucial distinction!

<comment><USER10> And, in the case of websites, _almost always shared with the copyright holders' permission_.

</comment></comment></comment></comment></comment><comment><USER11> I kept waiting for the payoff, but the article never gave proof that Steve Jobs was behind it. Sounds to me like what happened is that Steve when negotiating with Warner Brothers said something like, "How can you charge us those rates for your music when I have a whole list of places online that have it for free?" At which point Warner said, "We'll take care of those. So the rates can stand."

<comment><AUTHOR> Fairly clear here: "During one of these breaks I was by myself in the office of the CTO. He came in and we chatted about the state of technology and music. I then thought to ask a question of which the answer would shed light on the real reason behind the litigation and contention technology companies share with old media companies. I asked Howie, why is it that Warner chose to sue SeeqPod? He said that they maintained a short list of companies and we were on top of that list. I then asked how we wound up on the list and at the top. This is when he mentioned that Steve Jobs had held meetings with several labels including Warner and disagreed with streaming music services like SeeqPod and that companies like ours would inhibit a deal between Apple and the labels, so they collectively decided to keep a running list of "problem" companies that need to be "addressed" by Warner. It was at this point I realized we were not in a fight with the labels but in a proxy war waged by Apple against innovative music technology companies."

<comment><USER12> Yeah, you can interpret that the way that dangero did. I think the interesting thing there is that streaming music services of that era (including Internet radio) were generally unlicensed and operating on slightly-questionable interpretations of copyright law that had them paying nothing. So, if Jobs' complaint was that there are these other companies that weren't paying a cent, and could play music anyway (including on Jobs' devices), that would "inhibit a deal" because it wouldn't be rational for Apple to pay either.

Depends, as always, what "innovative" means. Are cities against innovation in transportation? If the innovative thing is ignoring regulations that nobody else has thought to ignore, then yes, of course they are. (As with copyright, it's not obvious that the regulations are _good_ , but they are what's on the books.)

</comment></comment></comment><comment><USER13> This article reminds me of a lot of what Dalton Caldwell spoke about in his talk about why not to start a music startup at a Startup School in the last several years.

This business seems to have been run and have proceeded horribly, for the exact reasons that Caldwell and everyone else with experience in that area seems to be extremely familiar with.

Is there anything legitimately interesting to the "Apple" and "Steve Jobs" parts of this story other than the usual clickbait?

<comment><USER14> I found it interesting to see how - if the story is true - your enemies may not be who they appear to be. He thought the labels hated his business whereas they may have actually been quite partial to it in slightly different circumstances. That's useful to know for when your circumstances change.

</comment></comment><comment><USER15> " If I could compile and debug kernel issues along with X11 X86Config files with assistance from a good friend at the QNX-based Caprica Internet in LA and the 2-person Slackware "helpdesk" on the East Coast every few days then I'd be able to continue to test NCSA webserver over SLIP and PPP to deliver electronic faxes with a web interface for the Mosaic Browser for a sugar company in Marin County to save them a few thousand a month in fax fees to China. "

How does one "debug" X11 config files? I had to do that when it hated my monitor and rubbish graphics card but that sentence appears like complete and utter rubbish.

EDIT: For clarification for those disposed to downvote, looking through an XF86 config file is not rocket science.

<comment><USER16> Maybe modern Xorg config files are not rocket science, but surely you remember the days of manually listing video modes, and trying endless combinations of video drivers. Hell I think you even needed to add special directives to get three button mice to work properly.

Fortunately those days are gone, but you definitely _could_ debug xf86 config files.

<comment><USER17> It wasn't so much debugging as it was laying our your video card and monitor manual, listing the config file and making sure all the little numbers match up.

<comment><USER18> The coolest thing one could do with a legacy XF86 config and a CRT monitor was invent new "overclocked" video modes. I had one monitor that was rated for 1280x1024 running at 1600x600 to match another monitor for a Xinerama setup.

</comment></comment></comment></comment><comment><USER19> So they intelligently crawled the web for music files to download which were... not purchased.

The reason why they failed is because they, like many others, were "nebulously/quasi legal." (You know what was ALSO awesome yet not legal or respectful of creator pay? [https://en.wikipedia.org/wiki/Audiogalaxy](https://en.wikipedia.org/wiki/Audiogalaxy) .) At least Apple was trying to make it all legit. They did start with DRM (note: no longer the case for years) but this was to make the record companies more comfortable with it.

The reason why SeeqPod was sued is because Warner Music (and others) had a case. It was not a purely frivolous, harassing lawsuit.

</comment><comment><USER20> ". I also spent time through the years developing algorithms and predictive analytics associated to uncovering patterns in historical stock market data. "

A bizarre comment — did he expect to see it coming? How does this relate to the story at hand? "Somehow, even someone as sophisticated as me, didn't see the downturn coming" ... if he could predict any kind of change in the stock industry better than investing professionals he wouldn't be running a questionably-legal streaming startup.

<comment><USER21> He's expressing that he didn't see it coming:

      Even with this knowledge base I failed to pay attention to what I knew was a deep systematic fissure in the financial markets signaled by the fall of Bear Stearns. I was focused on user acquisition, growth and resolving litigation as opposed to revenue, a mistake when the Black Swan appears.

He's not claiming to have the ability to time markets perfectly. He had enough experience where he might have some awareness of the bigger economic and financial picture. He's saying that even people in the financial industry were caught off guard, especially investing professionals who are key to keeping startups funded.

I found this context to be the most interesting part in addition to the role of how companies behaved in an oligopolistic way.

It could also be taken as an argument for greater financial transparency, or recognizing that the stability of the financial sector is another risk to startups and innovation.

<comment><USER22> It doesn't seem to say whether he had any further success with that approach, other than predicting one event which may have been a coincidence.

</comment></comment></comment><comment><USER17> "We had 50M monthly active users and 250M searches every month. Steve Jobs told the labels, including Warner Music, to sue us. So they did and for $40B. How do I know? I know because Steve Jobs gave them a list of music streaming sites that were competitive threats to iTunes, and told them to take care of it."

Citation needed. Or did I miss it amongst the self-aggrandizing?

<comment><USER23> He named an engineer at Warner Music as his source.

<comment><USER24> The "engineer" being Howie Singer, the CTO of Warner Music.

</comment></comment></comment><comment><USER25> I saw Kasian Franks speak at a meetup in Oct 2007. A friend suggested that I check out SeeqPod since I had worked at an earlier music streaming startup. As I recall, he made a negative comment about the labels, near the end. His position seemed precarious. Warner sued a couple months later.

</comment><comment><USER26> TL;DR Music technology startups suck.

<comment><USER27> This is not a very HN comment even if true.

<comment><USER28> It's a brianmcconnell comment. Why should anybody act like a hive mind? His comment is quite true. I been there, done that.

<comment><USER27> Yes we know, but we are supposed to not be negative here even if what is said is true :)

</comment></comment></comment></comment><comment><USER29> Hint: when you start a service solving a _very generic_ problem, you have a big chance of being outmaneuvered by a competitor.

<comment><USER30> He touches on that when he goes into his background. He worked on a project in the mid 90s that was duplicated by a competitor and sold to Yahoo.

 _" I then moved to Sun Micro-Electronics (SME) and that's where I learned one of my most valuable lessons. I began to build and ship the first HTTP-based (yes, this was a thing back then) stock ticker and called it DigitalTrader in 1996 ([http://goo.gl/dQzPTC](http://goo.gl/dQzPTC)) It was built in Tcl/Tk and Java/Tk. It auto-updated itself and crawled Quote.com and Yahoo for data. Six months later a competitor duplicated it and Yahoo bought them and put us out of business overnight. Lesson learned: realize when you are doing something that is easily duplicated. "_

<comment><USER29> This is something else. A ticker tape is a niche product (not what I would call "generic"). Also, the lesson learned is about something which is easily duplicated, and this does not have to apply (in general) to a generic product.

</comment></comment></comment><comment><USER31> Whoever uses "analyzation" publicly deserves to have a failed start up.

</comment><comment><USER32> I actually like the second part of the article a lot more intriguing where he talks about his and the company's personal background. It's these stories that inspire to start a company.

</comment><comment><USER33> Being a search engine for independents seems like a good idea. It's another area where eliminating anonymity can help. The problem for someone in that business is people putting stuff they don't own into the system and getting them sued. By making people more accountable that problem should go away.

People on the web today are not really anonymous and not really identifiable either. I think we need to fix both of those problems.

</comment><comment><USER34> Can somebody with background on the law please explain how this is or isn't an anti-competitive practice? i.e., Warner Bros sues Apple's rival at Apple's request.

<comment><USER35> Because in America its only anti-competitive if you can't pay off the people who decide if it is.

<comment><USER36> Care to point out where this guy's startup was paying royalties for the music streamed?

</comment></comment></comment><comment><USER37> I'd feel smug about my choice of cell phone but Samsung sponsored the Olympics.

</comment><comment><USER38> This is why large companies should be more regulated. They should not be able to put pressure on labels or producers and get all the benefits. What Apple did by killing this startup is not ethical. Plus, by killing it, they tried to get a monopole. Microsoft got so many fines at the time because they had the monopole on PCs. If a large company tries to destroy startups just because they feel threatened, they should be penalised the same way Microsoft did (With huge fines) or I think of another way: forcing large companies to work with startups instead of shutting them down.

<comment><USER31> 1\. Apple was not a monopoly at that time. 2\. How do you rigorously tell, which company is big and which is small? 3\. This is a competitive market and ethics is not something that should be regulated. If people have a problem with a company's ethics, they should just stop using their products.

<comment><USER39> Ethics and moral is regulated in some countries, because it's part of the law. USA are so retarded on that point, that's all.

And people who buys Apple products doesn't care what could do that company just because they are inspired by all the ads and hype around their products.

<comment><USER4> I'd argue that Apple has done more positive and socially responsible thing than many other big (and small) companies. And generally people buy Apple products because they are great products. You can only fool once with advertising, however people keep using Apple.</comment></comment></comment></comment>


Show HN: Blockchain command-line interface - <AUTHOR> https://github.com/seanseany/blockchain.js <comment><USER2> Nice, it seems very well done. But why? Is there a use-case?

<comment><AUTHOR> Thanks! I was caught in the cryptocurrency hype and was curious about how blockchains worked :).</comment></comment>


Configuration-Driven PHP Security Advice Considered Harmful - <AUTHOR> https://paragonie.com/blog/2017/01/configuration-driven-php-security-advice-considered-harmful <comment><USER2> thanks for helping the PHP Security ecosystem</comment>


MIT develops algorithms to "solve" non-linear systems as sum of squares - <AUTHOR> http://web.mit.edu/newsoffice/2010/parrilo-convergence.html

<comment><USER2> His publications are here: <http://www.mit.edu/~parrilo/pubs/index.html>. This one in particular: <http://arxiv.org/pdf/0909.0808v1> looks like it might be related.

<comment><USER3> Can't open file from <http://arxiv.org/pdf/0909.0808v1> evince says "Permission Denied". Could someone provide another link? Thanks in advance.

<comment><USER4> Its just a PDF file, but the name lacks an extension. You might try downloading it, renaming it with a .pdf extension, and trying again to open it.

</comment></comment></comment><comment><USER5> Does anyone have a link to the actual algorithms?

<comment><USER6> I suppose the article is referring to the SOSTOOLS (where SOS = _Sum of Squares_ ) free MATLAB toolbox:

<http://www.cds.caltech.edu/sostools>

<http://www.mit.edu/~parrilo/sostools>

The article could have mentioned that more people have worked on this. The whole thing started while Parrilo and Prajna were Prof. John Doyle's grad students at Caltech / CDS. Yet once again, MIT's shameless self-promotion fails to give credit where credit is due...

<comment><USER7> I always hate how these articles never have links to the actual papers or references. I suppose most people don't care, but then again, this is MIT news. Nerds will read it. HN's the only place where you get links to stuff. Thanks.

<comment><USER8> <http://web.mit.edu/newsoffice/> is the online alumni magazine whose, like every other alumni magazine on earth's, sole purpose is PR about the great things the school is doing.

It isn't exactly scientific american.

<comment><USER7> while true, I don't think it hurts for journalists of any sort to quote or link to their sources. And considering the audience of MIT alumni, I'm sure they'd appreciate it as much as I would.</comment></comment></comment></comment></comment>


Something is wrong with children's videos on the internet - <AUTHOR> https://medium.com/@jamesbridle/something-is-wrong-on-the-internet-c39c471271d2 <comment><USER3> I would say they the author dragged the readers into the dark depths of YouTube, but the billions of views on these videos belay that metaphor.

The ending is as pointed as it can be. It's hard to define what the solution is and how to go about dividing up responsibility.

Technology companies create these relatively neutral platforms which then grow and are gamed. In this case these videos are vying for mass attention from children which is subsequently monetized. They optimize, tweak, and mass produce their only paying regard to amount of attention they can secure. Taste, morals, exploitation of children, and everything else are meaningless so long as their videos receive an adequate number of views.

They did a good job of extrapolating this issue to other problem areas such a radical left/right videos or conspiracy videos. Here is an example of this issue in the form of Google results from yesterdays mass-shooting [https://twitter.com/justinhendrix/status/927335154707828736](https://twitter.com/justinhendrix/status/927335154707828736)

I think the lion's share of responsibility lies with the technology companies and governments. I'm hesitant to have government involved in their inability to keep pace or understand new and developing technologies. It's also hard to define how to solve this problem without censoring speech or disenfranchising it. It's hard for me to define what is the absolute issue and what to call it.

A "seemingly neutral platform" can become corrupted or systematically abused. You constantly need to account for bad actors and gray actors.

<comment><USER4> Re: billions of views:

"Once again, the view numbers of these videos must be taken under serious advisement. A huge number of these videos are essentially created by bots and viewed by bots, and even commented on by bots. "

<comment><USER3> That is an important caveat and it's hard to accurately pin down since there is no idea of how many of these views are generated by users or by bots.

For the real view number of billions to be wrong bots need to account for over 90% of the views if we're only considering the two channels the article referenced.

That bot percentage would have to be much higher if you factor in other channels of similar veins. [https://socialblade.com/youtube/top/500/mostviewed](https://socialblade.com/youtube/top/500/mostviewed)

Though you also have to factor in how many channels are just run of the mill content egg opening content vs more disturbing children's entertainment.

<comment><USER5> Where are you getting 90% from? There are only a little over 7 billion people on the planet and a little less than half of those have internet connection last I saw. If something got billions of view either the entire internet population watched it, or a smaller group watched it many many times. Sure some things are viral, but what are the odds that they have near 100% penetration or that everyone who sees it just plays it on repeat?

<comment><USER6> My two year old daughter has watched "Let It Go" 12 times so far _today_ and it's only a little after noon. I could very much see the human target audience of this content watching it on repeat.

</comment></comment></comment></comment></comment><comment><USER7> My kids are on YouTube Kids all the time, and this is terrifying:

> _" Someone or something or some combination of people and things is using > YouTube to systematically frighten, traumatise, and abuse children, > automatically and at scale, and it forces me to question my own beliefs > about the internet, at every level"_

Something about a lot of the videos I have watched along with my kid has always felt "off" to me. It makes 100% sense that a lot of the content on certain channels might be produced algorithmically, and uploaded en masse.

<comment><USER8> Don't let them watch one minute of it, it's all trash.

<comment><USER9> What part is trauma/abuse? I don't get it.

<comment><USER8> Practically speaking, all of it. The prolonged effects of handing an iDevice are damaging to their psyche. Kids aren't in a position to exercise rational decisions on what is and isn't acceptable content. The Youtube for Kids content filtering isn't nearly as advanced as it should be, so parents end up spending an inconsiderable amount of time attempting to filter to no success. These videos, along with those "Daddy finger" songs, adults unwrapping toys and "Ryan's toy review" where the little brat gets all the toys and destroys them are mind-numbingly pointless and damaging (considering the lack of value). At some point, parents need to consider the unknown factors and the possibility of (incidental) trauma.

At least, that's the conclusion I've come to after watching my four-year-old consume some of the above. Counter to that, the reduction of screen time has turned her more empathetic toward her sibling, though I can only state that qualitatively.

<comment><USER9> I still don't see what actual harm is being done here.

I agree that screen/device time is generally bad, but this goes whether it happens to be YTKids, Netflix or games.

What specifically is "wrong with the internet"? I still don't see the issue here.

<comment><USER10> Did you watch the video where a series of marvel heroes were captured and buried up to their necks in sand? These videos are nightmare fuel for children.

<comment><USER9> The violence in the superhero video I agree (esp. with the slapstick music) is a bit disturbing. Same with the gorilla daddy finger.

So what is the immediate solution for parents? Block/uninstall YTKids?

<comment><USER11> Yes. Block it. Turn it off. Try handing them crayons and paper. YTKids is a product begging for your time and attention and that of your kids. It sucks and beyond that may be damaging so stop buying it (with your kid's attention). Turn it off.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I found this to be a tediously drawn out read - the New York Times article is much better and to the point (without continuously warning me about reading further).

[https://www.nytimes.com/2017/11/04/business/media/youtube- ki...](https://www.nytimes.com/2017/11/04/business/media/youtube-kids-paw- patrol.html).

<comment><USER13> I think the medium article has a different and interesting take and conclusion about what the real issues may be. I agree it is quite long.

</comment></comment><comment><USER14> I have a 2 year old daughter, so I can relate to how enthralling those baby bum videos can be to a 2 year old.

But, Human oversite is not "impossible",it's called "parenting" and we should try it some time. We removed the TV from the living room and put it in the guest room, now sits a beautiful painting in it's place in the main part of the living room. Our kid doesn't use our iphone and ipad, it's as simple as that. If she cries for it, then she cries for it - no big deal. Ever since we removed the TV, she doesn't even ask to see videos in the living room anymore. You just gotta set limits.

Is, responsibility for the self, such an arcane concept. If you choose to get ALL your news from one site: whether it be Facebook or Youtube, then of course there's a chance your not going to get the whole truth. It should be all of our responsibility to seek out better sources of news. Install a plugin? or find a better search engine or get a better App, or go to something reputable like NPR, new york times, the Guardian. Lots of alternatives out there, as long as we're not too lazy to seek them out. There's plenty of ways to diversify your news sources and verify the things you read and watch. There's got to be a plugin out there that blocks news from FB if that's what you want.

<comment><USER15> This solves the problem for your family, but doesn't solve it at large. There will still be parents who let their kids watch this. There will still be impressionable youths watching nazi propaganda. There will still be gullible people watching "The earth is flat" videos.

Yes, this is a problem that _you_ can solve for _yourself_ by moving to a cabin in the woods and hunting and skinning deer, but that's just a bandaid.

<comment><USER14> But, even without Youtube, you still need to supervise their access to the internet. But, AI can help in this regard too. Just install some parental control plugin that only allows educational content to come onto the device. Set it up with a timer, so their not on the device all day.

<comment><USER15> > _But, AI can help in this regard too. Just install some parental control > plugin that only allows educational content to come onto the device._

That's what Youtube Kids purports to be. You're just suggesting sending in more trains: [https://www.youtube.com/watch?v=v5JiPj9c98Y](https://www.youtube.com/watch?v=v5JiPj9c98Y)

</comment></comment></comment></comment><comment><USER16> I have a 4 year old, and I let her have some limited video time. I am familiar with most of the videos mentioned, but this is the first time I have heard of violent version.

I pre-screen what she can watch, and I limit it to about 20 minutes max. YouTube is not on the list, but I will occasionally play music videos as she likes to sing.

Amazon has a number of kids based learning shows Creative Galaxy, Tumble Leaf, and Luna. I wish they would expand out to more seasons as these have been very well thought out. I have not found any issues with these.

The real solution in my opinion is to screen stuff before you let you kids watch it. Leaving a screen open to a site like YouTube is asking for trouble as your not sure what is going to be suggested in the sidebar that they might click on.

<comment><USER17> We used to let our kids have semi-supervised YouTube Kids time on our iPad, but they were getting into content that wasn't age appropriate through recommended videos. (The app now lets you turn off search and recommended videos, so the majority of content is from vetted, more family-friendly producers like Disney, Nickolodeon and Dreamworks.)

But even if we selected good videos only, we came to realise that (along with video games) we were abdicating parenting to a screen so that we could ignore our children for a while. This is to some extent a useful stress relief strategy – we all need a break sometimes – but without being anti-technology about it, there are better things children can be doing with their time.

</comment></comment><comment><USER18> Many people here mention "parenting" as a solution to this problem, and although this is a solution available to the wealthy and time wealthy audience of hacker news, the other side of the world, probably in your own country and certainly in poorer countries, the people aren't able to put in as much attention into monitoring their children or to put in time understanding the many harms of the modern world.

The real problem is the mass effect of these people. The majority of the world.

We all like to think we are above manipulation, maybe as a form of egoism, but in reality we are all simple creatures compared to the momentum of science.

<comment><USER19> >We all like to think we are above manipulation

I never could understand why people have such a hard time admitting that a literal TEAM of PhD owning Psychologists who have spent their entire lives designing ways to trick and manipulate you could possibly be successful. That'd be like saying Ford couldn't possibly build an engine better than the one you hacked together from plumbing parts, just because you can't fathom the concept of people being good at their jobs

</comment></comment><comment><USER20> This might not be a comment people expect. I am a lover of abstract and surreal art and music, and while I personally don't like surreal stuff that gets gory or sexual or violent, some of the "off putting" bizarre videos the author shared here I found fantastic. I really liked the "wrong head" video for example.

I'm not sure how anyone is supposed to take that, perhaps it indeed is a sign these things might not be for children. :) I'm not sure how I'd feel if my nephew was subjected to this.

But with that said, I do want to remind people that there were abstract and surreal themes and art in children's media before. Winnie the Pooh had the "hevulumps and woozles" and then there was Halloween is Grinch Night, with the bizarre ten minute stretch of ghouls and shifting shapes trying to scare the main character. There was violence in Tom and Jerry, Looney Tunes, and almost every cartoon I watched. The gore and extreme sexual content are probably a bridge too far though, but it's not some of the milder content is that far outside what we watched as kids.

EDIT: I do admit though that this is different and I mostly agree with the author. The surreal stuff in kid's cartoons had some artistic intent. The "surreal" stuff here is essentially unintended, and merely the shoddy examples of a system meant to exploit children.

<comment><USER21> Yea, as nightmare fuel some of that is fantastic. But the larger problem is YouTube autoplaying and automatically recommending it to a naive audience. And the larger processes that incentivize people to make this stuff for children.

</comment></comment><comment><USER22> This is a such a cyberpunk story. A malevolent Library of Babel.

<comment><USER23> My own thinking on this has twisted from cyberpunk to lovecraftian lately. The best analogy I've been able to make lately is the warnings in classic fairy tales that fairy places are dark and full of horrors, and it is easy to be trapped within them if you aren't careful. (I even wrote a short story in a couple of days just recently trying to capture some of my thoughts and concerns/fears in this space [1]. I don't have much in the way of answers, either, just existential dread that I hope may lead to answers eventually.)

[1] [http://blog.worldmaker.net/2017/10/18/astral-plane- meteorolo...](http://blog.worldmaker.net/2017/10/18/astral-plane-meteorology/)

<comment><USER22> Indeed! But then again, I think the genre boundary between cyberpunk and fairy tale was always permeable. In _Count Zero_ , evolved AIs posses people like vodoo deities. In _Serial Experiments Lain_ , dead people live on as ghosts in cyberspace. While _Snow Crash_ plays it for laughs, the idea that Ancient Sumerian gods live on as latent patterns in our brains (ready to override and erase our consciousness if the right word is spoken) is pretty Lovecraftian too.

Maybe one of the purest exponents of this "Lovecraft-via-cyberpunk" aesthetic is Nick Land; his early works are very influenced by 1980s cyberpunk science fiction, and (as far as I can make out from his rather opaque writing) his main thesis is that the combination of AI and Capitalism will evolve into an entity literally beyond human understanding, which will get rid of us all as it goes on to pursue its own inscrutable goals...

<comment><USER24> Your last sentence also sounds a lot like Economics 2.0 (and some other things) from Charles Stross's magnificent book Accelerando.

<comment><USER23> That work is rumbling in the back of my head in _every_ bitcoin discussion.

</comment></comment></comment></comment></comment><comment><USER25> I think some of those videos are disturbing indeed, but I have to remember the kind of books that were considered childrens' literature when I was growing up: Oliver Twist, Nobody's Boy [1], the Brothers' Grimm fairytales, and various folk tales chock full of dragons, ogres, giants, evil witches, curses, evil, death, blood and torment.

Isn't Little Red Riding Hood the most common fairytale kids in the Western world are nursed to sleep with? That's a story of a little girl and her grandmother being eaten by a wolf, who's then eviscerated with an axe.

And, because I'm Greek, my readings included tomes of Greek history and legends "for kids", where someone always got killed, exiled, adbucted, raped, turned to stone or transformed into an animal, an insect [2], or a tree- including of course the story of Prometheus. You know- the guy that got chained to a rock and had an eagle eating his liver every day.

I read all that as a pre-teen. As a teen I read H.P. Lovecraft and Harry Potter. Harry Potter is probably the most benign, a series full of people getting murdered left and right, in all manner of grim ways, killed by monsters, their soul sucked by evil spirits, exiled to nether dimensions and blown to bits by spells cast by evil warlocks. Lovecraft is probably too scary even for some adults.

And yet, guys, I'm alright, OK? I'm not an axe murderer, a maniac, or a psycho. I'm not violent, I'm an independent adult, I'm not a criminal, or a drug addict, or an alcoholic, or a gambler, or all manner of fucked-up things that little kids can turn to when they grow up in this cruel world.

So, what's up? Is it really the themes of violence and terror that's harmful to kids, or the way those themes are presented? I certainly would rather my kids read old Hesiod, than watch those mind-numbingly stupid "kids'" youtube videos. But, if I could survive the story of Prometheus without turning into a psycho, I think most kids should be able to outgrow Hulk and Spiderman being buried in sand to their necks.

____________

[1] The only thing more depressing than that book are the books by A. I. Cronin, which I got as birthday presents in my teens.

[2] Yeah, I know insects are technically animals, too (as in members of the kingdom animalia). But, come on. Not _animals_ animals...

<comment><USER26> I was also an early reader, reading content you would consider adult long before I hit puberty.

However, it was also obvious as a kid—and I am curious if this is a common experience—that I couldn't regulate my emotions when watching movies. Scary movies would give me insomnia; i would literally burst out crying when watching something even emotional on screen that I couldn't understand.

Meanwhile, with books, things are either understandable or not. You learn quickly that humans are weird, cruel, loving, etc—but there's always that wall of explicit fiction, where you can pause mid-sentence just by looking elsewhere, and it leaves you in control of the experience.

Movies force you to process the information at the rate of the film, and that is honestly far too quick for children to understand everything adults easily see, and images don't pass like words do. Hell, I still remember the scary scenes from snow white; but only one book has ever scared me—the raw shark texts.

I imagine I also excercised some self control when I saw some stuff I didn't want to read—I remember putting down the bourne series at age eleven after a depicition of sexual assault, but mostly because other things interested me more. (Probably the ender series—very little sex, lots of games and prognosticating!)

Tl;dr give your kids pretty much anything to read, but movies are more intense and you should watch them with your child to pause and explain or just shut off.

P.S. fairy tales were aimed at adults. Children were considered small adults. It was a recent fabrication that somehow these stories are intended primarily to entertain children. I believe this happened primarily after he Grimm brothers did their work, though.

<comment><USER21> Yes. Reading a story to a child is an inherently moderated experience. If the child gets scared, you can stop reading. You can also filter out inappropriate content in real time—some of the Andrew Lang fairy tale collections for example have racist language and anti-Semitic content.

Reading is active while watching video is passive. You have to work your way through a text, instead of mindlessly letting a weird video play on to see what's next. Reading requires more motivation and interest in the material.

Lastly, the main issue the author identifies is how cheaply-produced and algorithmically-generated video content will necessarily generate weird and disturbing content in a way that doesn't occur with authored books. The author is most disturbed by videos that are not human-led, or where machines are splicing together human-led content with parodies and gross-out videos.

</comment></comment></comment><comment><USER27> This was covered in the NYT yesterday:

[https://www.nytimes.com/2017/11/04/business/media/youtube- ki...](https://www.nytimes.com/2017/11/04/business/media/youtube-kids-paw- patrol.html?rref=collection%2Fsectioncollection%2Ftechnology&action=click&contentCollection=technology&region=rank&module=package&version=highlights&contentPlacement=2&pgtype=sectionfront)

</comment><comment><USER28> The conversation about parenting is somewhat of a red herring here. This is not a 'won't somebody think of the children moral panic', but a serious consideration of the unintended consequences of the systems we are building and what that means for us as a society.

YouTube videos for kids is a fairly lighthearted entry to the subject - <USER2> could be discussing news, porn, education, whatever, and the problems and implications would be the same.

The key issues raised here are:

* The 'delamination' of content and author and how that affects the awareness and trust of its source. If, for example, a scientific paper and a bunch of woo is presented in the same way who can tell which is more legitimate? 'Just teach critical thinking' is not an acceptable solution as by the time enough people have been taught to provide herd immunity we will have long since succumbed to this pandemic of bullshit.

* '...the impossibility of determining the degree of automation which is at work here'. If both humans and machines are creating content tailored for every possible niche, interest, fetish and keyword combination, and algorithmic personalisation makes it possible to exist entirely within our own personal tag clouds what does it mean for us as a society, which requires a basic set of shared values to function?

Junk content and pandering to base instincts is not new, but our ability now to automate the creation and dissemination of such content to pander to every possible interest and unlikely combination of interests at vast scale _is_ new - and we do not yet have the cultural toolkit to deal with the sheer quantity of it.

I wonder whether in a few years time, once we've really felt the impact of all this, people will look on today's enthusiasm for putting 'social' in everything with the contempt and horror we do with last century's enthusiasm for putting radium in everything.

<comment><USER29> Solid description of the important part of this essay. The automated generation of content that perfectly matches to humanity's unconscious desires is terrifying to watch.

I also worry that it's inevitable. Even if YouTube or PornHub or Facebook decided to introduce some sanity or human oversight in their system, that's such a massive waste of resources that competitors would beat them over. It's a race to the bottom for automation and machine learning. I genuinely can't think of any way to "go back in time" at this point, other than perhaps moving the entire internet away from its dependence on advertising.

</comment></comment><comment><USER30> > Once again, a content warning: while not being explicitly inappropriate, the > video is decidedly off, and contains elements which might trouble — frankly, > should trouble — anyone. It's very mild on the scale of such things, but. I > describe it below if you don't want to watch it. This warning will recur.

This, before an animation that has a happy song with characters and an animation of a little girl appearing periodically and crying briefly. How sheltered do you have to be before this is traumatic? It makes me wonder whether the author is a bot.

</comment><comment><USER31> I believe there was recently (this year) a big furor in the right/alt-right about this sort of thing, except it went much deeper, somewhat a la "Pizzagate". It felt very conspiracy-theoryish. I didn't read a whole lot into it, since it seemed pretty crazy, and the videos linked were, admittedly, pretty disturbing.

I now wonder it there's really something to this, especially with regard to people intentionally messing with/traumatizing kids via these videos.

<comment><USER32> Ehh... well I'm biased because I would be labelled by people as alt-right.

Basically, just use your intuition... use it boldly. What does it tell you about these videos? It's weiiiird

</comment></comment><comment><USER33> Can we change the title? There are two things wrong with the internet on the front page currently.

The first is children's videos. The second is the actual internet itself.

</comment><comment><USER34> Some things I'd like to see happen with the internet. There are probably opportunities here

1\. Proper age validation on pornography. The "You promise you're over 18/21?" is not working.

2\. A "safe" slice of the internet provided by an ISP such that more or less content matches the ratings systems open DNS does this but is easily defeated by an educated user. Also this on phones would be good.

3\. A government regulatory body that inspects the real effects of consumption of these products. Porn, infinite scroll sites (fb, intstagram), youtube video content etc are all known to be tailored for addiction and yet no controls on them exist. Though we do the same with tobacco, food additives etc.

</comment><comment><USER35> But this is hardly new. Anyone else watch "Dora" videos and notice how it's really a LOT like someone playing a really bad Sierra adventure game ? And it's not like that's the only show doing this.

In Belgium, there's a TV character called "bumba" whose videos (on TV) are like someone injected LSD into a seal, glued a hat onto it, stuck into a bag and filmed it trashing around.

Almost all recent kids content is algorithmically generated, on the "real" tv as much as on youtube.

As for toy unboxings, they're actually useful I would say.

</comment><comment><USER10> Why was email spam so effectively fought, but "next up" spam seems to thrive?

<comment><USER36> Because SMTP was an open protocol. No MUA company profited from its end user seeing spam. No end-user-targeted MTAs (i.e., the MTAs of most end users' ISPs) also found spam as a cost center. (I'm being pedantic here in that the rogue spam-friendly "Spamhaus" ISPs whose customer base was made up of spammers were technically operating MTAs as injection points. To the overwhelming majority of email users, admins, and providers, spam was a massive cost center.)

At some point in the 90s/00s, ISPs had to bite the bullet and acknowledge that if they didn't filter spam, customers would leave for ISPs who would. And in the SMTP era, y0u could use b4y3s14n techniques to f1lt3r out the v1@gr4 spam.

We're not at the point where the video equivalent of spammers can be automatically detected. So it's going to be expensive.

And in an age of walled gardens and ad-tech, the providers of "next up" and "recommended for you" clickbait/spam are not losing money (by having to pay for storage/bandwidth for spam that their end user merely deletes or filters client-side). Rather, sites like YouTube are profiting off of every clickthrough. An ad view is an ad view.

And that is why they have no business incentive to pay the money to hire the humans that are still required to solve the hard problem of differentiating spam from ham. Doing nothing, or pretending to be able to fully automate the problem away via still-error-prone AI, is cheaper than solving the hard problem of curation.

<comment><USER10> This seems reasonable to me.

</comment></comment></comment><comment><USER37> Google's Search and Youtube algorithms have encouraged the production of a deluge of low quality content and made it impossible to find high quality content. They are ready to be disrupted.

<comment><USER38> How would you disrupt them?

</comment></comment><comment><USER39> parents do not worry... hip hop killed the evils of rock and roll, and the internet killed the evils of TV. I'm sure something is waiting around the corner to resolve the evils you fear in the internet. in the meantime, take the attacks you perceive being weighed against your children as reason for you to spend more time with them. it may be that the internet isnt a unique problem after all

</comment><comment><USER40> I would like to know the exact intention of Youtube Kids. Is it truly an opportunity for the company to provide a safe place for kids? If so, how exactly are they filtering the contents?

I know, i know, it's free, don't use it, be a parent, blah blah blah. But it is a service being touted as being "kid-safe", are we not allowed to question?

</comment><comment><USER9> Ok, wtf moment here, is this snark?

FTA: "Someone or something or some combination of people and things is using YouTube to systematically frighten, traumatise, and abuse children, automatically and at scale, and it forces me to question my own beliefs about the internet, at every level."

All the examples are basically just kid-crack but I've watched these with my kids and they're (mostly) relatively harmless - exception being the weird/slash versions involving scary or sad versions of Peppa pig, paw patrol, etc.

What trauma/abuse is being inflicted here?

<comment><USER41> Those _exceptions_ are found by the millions. There are depictions of rape, cannibalism, gory death and all kinds of violence. Not even safe for <16 year olds, and we are talking about little children.

</comment></comment><comment><USER42> Nothing is wrong on the internet.

Something is wrong with parents who don't care what content they put in front of their kids as long as it looks like a cartoon and it shuts them up for a while. Then again, Looney Tunes characters were a lot more violent than this and no one got traumatized, so maybe the effect of this is blown out of proportion.

Yes, this stuff is vapid, and some of it is disturbing, and I suspect might be lowkey fetish porn, and it definitely infringes on copyright (who cares though,) but... the internet isn't your babysitter.

<comment><USER41> Are you a parent? The way YouTube works - and how centralized video has become - means it's extremely easy to let a kid fall into these dark areas just by playing _one_ innocent video. There is no obvious option to hide the rest of the UI, stop autoplay or recommended videos.

It also is nothing, absolutely nothing like Looney Tunes. Please watch the videos linked by the article before making such a statement. In one of them, Peppa Pig uses a razor blade to slice a piece of her own arm, right after eating her own father.

<comment><USER42> > In one of them, Peppa Pig uses a razor blade to slice a piece of her own > arm, right after eating her own father.

You mean the one clearly on a channel not officially associated with Peppa Pig's creators and that starts with a fake restricted content warning? Ok, yeah that was dark. But Youtube is not a G-rated site, and it's designed to make content discovery easy.

Doesn't Youtube have parental controls? If that's not enough, maybe there's a need that needs to be filled by a browser plugin that restricts the UI or external player. Either way, letting a child on to Youtube unsupervised is taking the risk of having them stumble across content you don't want them to see.

<comment><USER21> Right, that's the problem he's identifying. Search for "peppa pig bacon" take you right to that parody video, which is widely pirated...and given the weird, machine-generated examples he cites earlier, how much of that ended in a compilation a human child might see? It's not even that there is inappropriate content on YouTube: it's that these channels are trying to trick children into watching stuff that is so bizarre.

</comment></comment></comment></comment><comment><USER43> It's the working out of Tim O'Reilly's mechanical turk idea.

</comment><comment><USER44> My kids are allowed Hacker News and that's it.

</comment><comment><USER45> I'm really, really WTF.

I see nothing wrong with these videos at all and the current general opinion here is the real worry.

Not sure what the top secret videos the author found are that are so bad I can't see them but I totally have zero faith they back up the authors point whatever it is.

I think the author needs to read [https://en.wikipedia.org/wiki/Grimms%27_Fairy_Tales](https://en.wikipedia.org/wiki/Grimms%27_Fairy_Tales) and get over their moral panic.

There are possibly trolls out their that might create content with the purpose of harm, but i see no evidence yet they are succeeding in doing this, especially NOT in this article.

Mixed with this normal Moral Panic is the old Barney the Dinosaur Panic.

Shows that don't work on two levels (So just on a child's level) scare parents because they don't get them, the kids do, so the parent fear the unknown.

Screen time for kids is not on topic here, not allowing kids to see videos for adults is not on topic here, so really there's nothing to see here with evidence.

Unless the top secret videos do show evidence of videos children will accidentally come across while You tubing.

Using automation to monetize is pretty interesting stuff though. There's the interesting story.

<comment><USER46> I share your opinion on the banality of content-related moral panics. I don't think the subject matter covered matters much at all, since young children can't even comprehend the themes that horrify the author.

What really strikes me about these videos, though, is the sheer volume and the degree of engagement optimization demonstrated. _That 's_ new and worth thinking about.

We've had scary nursery rhymes and fairy tales for centuries at least. We've had nonsensical children's cartoons for half a century. Nothing has gone horribly wrong.

But I don't think we've ever had industrial-scale production of videos so rigorously optimized for engagement at the expense of everything else.

These videos remind me of the concept of "superstimuli" \--- artificially- created patterns that are more attractive than the ones that appear in nature and that lead organisms away from healthy behavior patterns. Highly refined sugar-loaded food is an example of a superstimulus in humans.

These videos are empty. They teach nothing. They're optimized for hitting all the right attention buttons in the brain, but they don't provide any of the training child's developing neural network needs to train itself. What effect is that going to have on development?

<comment><USER45> I definitely see your point of view and agree with superstimuli. Not necessarily empty though, you do have colors, words, sounds, rhythm, surprise, movement but not patience, conscientiousness etc

But I think it's time allowed using electronic entertainment not the content of the electronic entertainment. I think all youtube is superstimuli.

It possibly should be ZERO time, but if youtube for short periods allows the kids to go on a family trip or keeps parents sanity to allow for a dinner out perhaps there's value externally.

</comment></comment></comment><comment><USER47> I'm sorta convinced that out of boredom, many people that are involved in creating children's content will try to push up as close to the line of putting adult innuendo in their work as they can get.

See half the jokes on SpongeBob, or this gem that I saw in a Disney coloring book at the doctor's office the other day: [https://me.me/i/mickey-tosses-the- salad-dinney-while-colorin...](https://me.me/i/mickey-tosses-the-salad-dinney- while-coloring-with-my-two-1002421)

<comment><USER48> I think that's just you.

He's literally tossing a salad in that drawing.

</comment></comment><comment><USER49> In the future, the only skill of value will be video production. This is common theme, for example in Vernor Vinge's Rainbow's End. Getting and holding other human's attention is always worth something.

So possibly all these weird videos that kids watch constitute necessary future survival skills.</comment>


VirtualBox E1000 Guest-to-Host Escape - <AUTHOR> https://github.com/MorteNoir1/virtualbox_e1000_0day <comment><USER2> This [1] gives a little more background. The same security researcher found another vulnerability in VirtualBox earlier this year, and didn't have a great experience with Oracle:

"We reported this vulnerability to Oracle, the latest update from them is that they are still looking into it, while in fact the latest version of Oracle VirtualBox version 5.2.18 has silently introduced a patch without giving credit or mentioning of the vulnerability report."

[1] [https://blogs.securiteam.com/index.php/archives/3736](https://blogs.securiteam.com/index.php/archives/3736)

<comment><USER3> Does Oracle have a track record of being The Worst about this or should I have assumed as such given my preconceived notions of them being the classic villain in the tech world?

<comment><USER4> "You need to think of Larry Ellison the way you think of a lawnmower. You don't anthropomorphize your lawnmower, the lawnmower just mows the lawn, you stick your hand in there and it'll chop it off, the end. You don't think 'oh, the lawnmower hates me' \-- lawnmower doesn't give a shit about you, lawnmower can't hate you. Don't anthropomorphize the lawnmower. Don't fall into that trap about Oracle."

<comment><USER5> [https://www.youtube.com/watch?v=-zRN7XLCRhc](https://www.youtube.com/watch?v=-zRN7XLCRhc)

<comment><USER3> Entertaining talk.

The part that grandparent is quoting starts at about 38 minutes in.

</comment></comment></comment></comment></comment><comment><USER6> I think the author brings up a good point about so-called "responsible disclosure" (a self-serving term by the vendors).

I'm paraphrasing his 3 reasons for disclosing immediately:

1\. It's unacceptable to wait half a year until a vulnerability is patched.

2\. Bug bounties are riddled with tricks to delay you, shenanigans as to whether they'll pay you or not, and games to low ball the price.

3\. It's arrogant to wait months while meanwhile preparing for a big boastful disclosure.

I'm thinking that we could add to this list as follows:

4\. The vulnerability might already be well-known and being used by black hats and secret government agencies. Releasing the details immediately puts all of us on an equal footing.

5\. Punish the vendors for having such awful security. Just the other day, HN had an article[1] about Crucial SSDs that encrypt the drive with a key that doesn't depend on the password; you can decrypt the drive without the password just by patching the firmware. Is Crucial going to get punished for such an outrageous lie about their encryption? The marketplace mechanisms that force vendors to pay proper attention to security are trust in the brand, independent security reviews (thank you security researchers!), government regulation (no thank you), and _immediately_ naming and shaming them without giving them time to cover it up or downplay it.

6\. Punish the users for not demanding higher security. Of course, we could suffer as result, but it's not the security researcher who caused the bug and it's not the security researcher who would be exploiting it. There needs to be demand from users for higher security in their purchases.

7\. We get to see all the details if the vulnerability is disclosed immediately. If the vulnerability is disclosed after "responsible disclosure", plenty of times you don't get the raw details. I wouldn't be surprised if many security researchers are signed to NDAs (or simply threatened by lawyers), so we don't hear about the bugs _at all_. Having the full details published immediately advances our knowledge in the security field more than a partial disclosure months later (or a non-disclosure).

[1] [https://news.ycombinator.com/item?id=18382975](https://news.ycombinator.com/item?id=18382975)

<comment><USER7> While you raise very good points overall, this one I have beef with:

>SSDs that encrypt the drive with a key that doesn't depend on the password

AFAIK, this is the standard practice in software harddrive/filesystem encryption - LUKS, TrueCrypt, etc., for practical reasons, and with no negative impact on security if properly implemented. AFAIK again, this is also how Firefox handles encryption of stored website login/password credentials - they are always encrypted using locally generated & held key; in case user supplies her own password, this key is encrypted with that password, with no change to the actual login/password store.

Contrast the following two scenarios:

\- derive encryption key from user-supplied password [potentially weak key]

\- encrypt the whole device / filesystem with the key [very long process, prone to interruption]

\- user wishes to change the password

\- re-encrypt the whole device / filesystem with the new key [very long process, prone to interruption]

vs.

\- generate a cryptographically secure random or pseudorandom key

\- store the password in device

\- encrypt device with the key from the first write onward

\- when user sets password, encrypt the stored key [no change to content of device necessary]

\- from that point the user password is necessary to use the decryption/encryption key

\- when the user changes password, re-encrypt the stored key only [no change to content of device necessary]

The second scenario is also more amenable to implementing various multi- password schemes, password-recovery techniques, and encryption secured with both passwords and hardware tokens.

<comment><USER8> The difference is that the key was not encrypted with the password.

If the key were properly encrypted (as you describe) the password check could not have been bypassed.

</comment></comment></comment><comment><USER9> I enjoyed reading the author's motivation for posting as a 0day vs Bug bounty.

[https://github.com/MorteNoir1/virtualbox_e1000_0day#why](https://github.com/MorteNoir1/virtualbox_e1000_0day#why)

<comment><USER10> With regard to this, maybe there's an opportunity for a market maker to step in.

An "Uber for vulnerabilities".

Having said that, I do tend to think "slap a market on it" can often lead to perverse outcome.

<comment><USER11> These already exist. There are darknet firms that independently verify that an exploit is real (staking their reputation that they won't take it and run once shown), and then open it to the market.

The main trouble is that for it to fully work, you need to have the big corps bidding against black hats in this market. I can't see that happening. It'd have big corps dirtying their hands too openly.

The other trouble is that a lot of the damages (or value) of software bugs aren't readily fungible to dollars. For example, to actually profit from the Ashley Madison hack you'd need to blackmail a whole lot of people, which is incredibly time consuming. So software firms would be able to underpay for most exploits: The amount they'd be have to pay is at most what a black hat can profit from the bug, which is necessarily less than the real damages because the black hat has to cost for fungibility.

<comment><USER12> > _There are darknet firms that independently verify that an exploit is real > (staking their reputation that they won 't take it and run once shown), and > then open it to the market._

Is this really a thing? Who are these firms and what is their take?

<comment><USER13> One example: [http://www.zerodium.com/program.html](http://www.zerodium.com/program.html)

</comment></comment></comment></comment></comment><comment><USER14> This is why local root exploits matter even if compromised userspace already gives attackers control of everything in the VM. Don't update your kernel, and maybe they'll get everything outside the VM too.

From the article: "Elevated privileges are required to load a driver in both OSs. It's common and isn't considered an insurmountable obstacle. Look at Pwn2Own contest where researcher use exploit chains: a browser opened a malicious website in the guest OS is exploited, a browser sandbox escape is made to gain full ring 3 access, an operating system vulnerability is exploited to pave a way to ring 0 from where there are anything you need to attack a hypervisor from the guest OS."

Defense in depth means caring about every link of the chain.

</comment><comment><USER15> The pricing of / evaluation of bug bounties seems to be a problem. Going begging to the vendor of course results in reduced value.

Everything tends to be undervalued when there is only one buyer.

Also purchase processes tend to be slow when there is only one buyer.

It's almost as if there needs to be competition for the sale of the disclosure ... although that would have its own issues of course.

Another idea is a public timed/buy/disclosure board that offers security bugs to the vendor at a certain price but if the vendor does not want to pay within the time then it's released publicly. Effectively this is a concept in which the researcher who found the bug decides on the price and the timeframe in which it will be paid, rather than placing the decision in the hands of the vendor. This too of course has issues. It's likely that things will go this way though because security vulnerabilities are worth a great deal to companies.

There's an opportunity right here for the startup who wishes to publicly list vulnerabilities for sale to the vendor (only) at a given price within a given time with escrow, else the researcher release to public. You'd have to find a way to present it such that it is not extortion which might be hard, but in a way that sort of what bug bounty programs are - reverse extortion. Bug bounties are sort of saying "we'll pay you if you can exploit us but promise not to", whereas extortion is saying "I know how to exploit you, pay me so I won't". The big money goes to whichever startup finds how to present this in an acceptable way.

<comment><USER16> > Another idea is a public timed/buy/disclosure board that offers security > bugs to the vendor at a certain price but if the vendor does not want to pay > within the time then it's released publicly.

Problem with that is that it might be taken to be extortion / blackmailing / racketeering. (Though, not a lawyer and this isn't legal advice)

</comment></comment><comment><USER17> Great and very thorough writeup; the one biggest question I have left, is what happens if you do this with the real hardware. Will it crash the hardware and put it in a weird state, or will it do something natural and benign like wrapround an internal counter modulo 16K?

</comment><comment><USER18> Whats the CVE ? [1]

Next Critical Patch Updates by Oracle is scheduled at 15 January 2019. [2]

I see this bug exists at least in part in the open-source parts of VirtualBox. [3] Could it be fixed there?

Could that (that part being opensource) also be reason for the researcher not being granted the bug's bounty?

[1] [https://cve.mitre.org/cve/](https://cve.mitre.org/cve/)

[2] [https://www.oracle.com/technetwork/topics/security/alerts-08...](https://www.oracle.com/technetwork/topics/security/alerts-086861.html)

[3] [https://www.virtualbox.org/browser/vbox/trunk/src/VBox/Devic...](https://www.virtualbox.org/browser/vbox/trunk/src/VBox/Devices/Network/DevE1000.cpp#L4377)

</comment><comment><USER19> To give a bit of context to this discussion: Oracle does not and has never had a bug bounty program. Honestly Oracle does not even play a big role in this. From my experience with reporting VirtualBox bugs to them, they usually handle them rather professionally.

The author must be referring to third-party, vendor-agnostic programs such as the Zero Day Initiative (ZDI), SecuriTeam Secure Disclosure (SSD), or the Accenture iDefense VCP (unless he was planning to sell to a non-disclosing entity). Keep in mind that the main purpose of these programs is PR (in the case of SSD) or a specific part of a security product (TippingPoint). I am not surprised that the value of a vulnerability in these scenario varies heavily over time. For example, if your purpose is to write a blog post and highlight your security research, maybe it's not as interesting if you have written another post about the same software recently.

The real question is, what is a business model by which a third party can make money off of vulnerabilities despite reporting to the vendor. This is a tough problem to solve. Maybe it's time to have the users of software contribute financially in some way?

</comment><comment><USER20> The number 3. oh my. It's ridiculous what people do with the bugs their found since Heartbleed. I don't remember anything like that before, but ever since every security issue needs a logo and a catchphrase for some reason.

<comment><USER21> It makes vulnerabilities easier to remember and talk about. Is that bad?

</comment></comment><comment><USER22> Given the prevalence of security flaws and the seriousness of the consequences of a breach, I'm still surprised why people are so quick to dismiss high security systems like OpenBSD. Just a couple of days ago someone was incredulous that I would consider vmm from OpenBSD for virtual machines, but I'd rather have a secure, open source virtual machine, than a bug infested virtual machine from Oracle. But it is hard to argue with someone who has made a billion dollars from bug infested software... I guess it is really a balance between having cool new features people will buy and good-enough security for your purpose (or good enough for your customers purposes anyways). Maybe I should go work for Visa, they probably care about security.

</comment><comment><USER23> I have a slightly off topic observation and couple of questions. Hoping to get inputs from community. I'm half way through the write up and am amazed by the amount of research, skill and grit that went in to finding this vulnerability. Few questions I have:

1\. How do vulnerability researchers and RE engineers narrow down which code base to test? VirtualBox code could be so huge.

2\. If their research leads to dead end, which I guess may happen most of the time, how do they keep themselves going/motivated?

3\. Clearly, this work needs lots of time. How do they fund themselves to do this?

4\. I believe a certain mindset is required to continue doing this work because most of this is 'altruistic' in nature. The monetary reward is a pittance. Would love to read some books on such topics.

</comment><comment><USER24> This bug was already reported to Oracle:

[https://github.com/MorteNoir1/virtualbox_e1000_0day/issues/8](https://github.com/MorteNoir1/virtualbox_e1000_0day/issues/8)

</comment><comment><USER25> FTA :

>>> a browser opened a malicious website in the guest OS is exploited, a browser sandbox escape is made to gain full ring 3 access, an operating system vulnerability is exploited to pave a way to ring 0 from where there are anything you need to attack a hypervisor from the guest OS.

I cracked several games in the end of the 80's but that was nowhere as hard as this seems to be. How do researchers find the time to go so deep in their analysis ? Where do they learn ?

Anyway, the code analysis showed by the author is really good. That's so much clever than old school "replace this check by NOP's" :-) Kudo's

<comment><USER26> > I cracked several games in the end of the 80's but that was nowhere as hard > as this seems to be.

There are are many reasons for this. One is that with a game, you already have full access to the program on your disc and can modify it at will, run it infinitely many times, have full access to how it's loaded and run, and analyze it separately. Plus "hacking a game" is not a security vulnerability, and the only person who loses if you add an RCE to your game is you, and possibly the publisher if you crack it.

</comment></comment><comment><USER27> Seems like the issue has been fixed in VirtualBox 5.2.22

[https://github.com/MorteNoir1/virtualbox_e1000_0day/issues/1...](https://github.com/MorteNoir1/virtualbox_e1000_0day/issues/12) [https://www.virtualbox.org/wiki/Changelog#22](https://www.virtualbox.org/wiki/Changelog#22)

</comment><comment><USER28> Very interesting read, I browsed the author's website and it says he is a independent security researcher and self employed, a real question, I am interesting in knowing he survives just reporting bugs, when there is no surety a bug could be found every month for a living....

</comment><comment><USER29> As soon as I read the phrase "ASLR bypass", I knew this would be devastating.

</comment><comment><USER30> I guess SELinux/SVirt would mitigate this

</comment><comment><USER31> Is qemu affected?

<comment><USER32> The exploit half impacts the E1000 driver, but the other half impacts VirtualBox's implementation of the virtualized system; so no.

Specifically, the write primitive exploits the way the E1000's EEPROM is emulated, and you can see the read primitive exploits VirtualBox's ACPI implementation.

</comment></comment><comment><USER33> huh. is the author a known "security researcher"? i agree more or less with his 3 points.

<comment><USER34> The author here just blindly assumes a lot of things about VirtualBox's bug bounty program. Many, like Google, put a very strict limit, and they will release the details when that time is over. I think it's more respectful to at least give them a chance, rather than throwing a hot shit on their lap and making hundreds of people's life a living hell for a week.

The engineers in charge quickly patching this up aren't the ones who came up with the bounty program. Making them pay for it seems like a pretty shitty move.

<comment><USER35> > rather than throwing a hot shit on their lap

Well really, Oracle threw the hot shit in customers' laps. The author just had the gall to point it out.

> making hundreds of people's life a living hell for a week

> Making them pay for it seems like a pretty shitty move.

It sounds like you assume Oracle is going to abuse its staff in the process of getting this fixed. I don't know why you assume that, nor why the author ought to be blamed if Oracle does.

<comment><USER34> > Oracle threw the hot shit

Right, Oracle as an organization did, not necessarily the engineers who will be tasked with fixing this.

> Oracle is going to abuse its staff

Not necessarily abuse, but obviously, having 30 days to fix something is a much more saner experience than when every minute counts.

</comment></comment></comment></comment><comment><USER36> Not to discount the work done here. Big high five. But I am surprised hundreds more of these bugs haven't found every week. It's Oracle. Their mission statement might as well be "we make security vulnerabilities and charge you a shitload"

I would never trust any Oracle product in any form in production environment.

<comment><USER37> I hate Oracle and consider them among the most evil of companies out there. However, I don't think that's a very fair characterization of their mission statement.

<comment><USER38> I think [1] shows that it is far from being an unfair synopsis of their mission statement.

[1]: [https://news.ycombinator.com/item?id=10039202](https://news.ycombinator.com/item?id=10039202)

</comment></comment></comment><comment><USER39> Oh, this might explain how I managed to cause the host OS to crash while running my homebrew OS when I was in college...

<comment><USER32> Homebrew OS? Interesting. What did it do? Can I see it anywhere?

What VM were you using?

Host OS crashes like what you describe are no-trust-me-it's-really-not-the- compiler unlikely.

I did have X crash on me once while figuring out the X11 protocol specification, but that's because X is widely known to be less than perfectly stable :D and also because the actual graphics driver I was using was a little flaky.

<comment><USER39> I took an OS class and wanted to learn more afterwards so I hacked together a small kernel mostly using info from the osdev wiki. I got decently far (managed to have a shell running, had VIM running), but ran out of steam years ago (that and the code needing a massive amount of cleanup and auditing).

So I misremembered (it's been 6+ years ago) but it was the AMD PCNET driver I wrote that triggered the crash, not E1000. Excuse the code quality, but the driver I wrote is located here: [https://github.com/blanham/ChickenOS/blob/master/src/device/...](https://github.com/blanham/ChickenOS/blob/master/src/device/net/pcnet.c) (Note the comment about it not working in Virtualbox) Attempting to boot my kernel with that driver activated would cause a hard freeze of the host OS, requiring a hard reset of the host machine. I replicated this multiple times, in Virtualbox for both OSX and Windows.

Thanks for actually replying instead of downvoting, I guess I shouldn't make off-the-cuff comments and then forget to follow-up until the next day.

<comment><USER32> Interesting. I've been eyeing OS development for a while myself. I have a few high-level ideas about kernel design, and a few years's worth of musings about good UX. I badly need to get on with spending a few years getting my feet wet with actual implementation details and such so I'm not just a pile of unorientated hot air though, haha. Armchair pontificating doesn't count for much. But anyway.

Huh, a shell and Vim. (Alongside multiple architecture support and two filesystems.) That's reasonably developed-out. Not bad!

Can totally understand the problem of running out of steam. (I think that might be why I've been so hesitant about diving in myself - want to pace things so they stay interesting for long enough, and don't want to make too many discouraging mistakes. A couple kernel architecture arguments doesn't produce a good filesystem, adequately future-proof UI model, good vertical "little detail" semantics, etc etc.

A hard crash on multiple platforms? That's almost definitely a bug. Heh, I think all the downvoters might've made a bunch of incorrect presumptions there :)

It might be mildly interesting to see if you can still trigger the crash with the latest version of VirtualBox. (I'd have a go but of course I have no repro details, or info on how to actually build everything for that matter.)

Precedent has just been set on 0daying VB networking hardware, for what that's worth :P but there's also Project Zero (which will accept security vulnerabilities in any software, and imposes a 90-day deadline) if VB's own bug bounty thing proves unappealing. This is of course getting a bit ahead of testing/re-verification. I mention it because I'm now very curious to know if the bug is still there, but of course HN comments are not the right place for a [Y] :)

It's impossible to say if recreating the test environment (host OS version(s), host VirtualBox version) would prove fruitful if the latest VB versions seem (...seem...) immune. Vulnerability research seems to be consist of a lot of "hmm, that seems like it _might_ run a tiny bit slower on months with a Q in them if the computer is leaning 30° to the left at 2:14PM in the afternoon" and then staring at Hex-Rays for 3 months to ultimately prove that your crazy theory is in fact valid (literal example [https://ramtin- amin.fr/#nvmedma;](https://ramtin-amin.fr/#nvmedma;) very similar example [https://bugs.chromium.org/p/chromium/issues/detail?id=648971](https://bugs.chromium.org/p/chromium/issues/detail?id=648971) \- "one byte overflow"!).

In any case, I wouldn't mind getting some more details and seeing the _CLUNK_ in action. It's interesting at face value.

NB. About that nvmedma link - it took me about 4-5 rereads of that article and its prequel ([https://ramtin-amin.fr/#nvmepcie](https://ramtin- amin.fr/#nvmepcie)) before the bigger picture started to click.

(I also need to check my comments somewhat frequently - and then remember to also actually follow-up after seeing I have replies! Woops. Thanks for the reply!)</comment></comment></comment></comment>